From 084d360254a0a7400ad7527cdd14e2f9679de1f3 Mon Sep 17 00:00:00 2001 From: erjosito Date: Mon, 24 Jun 2024 12:34:37 +0000 Subject: [PATCH] [create-pull-request] automated change --- checklists/checklist.en.master.json | 56229 ++++++++-------- checklists/security_checklist.en.json | 3338 +- checklists/security_checklist.es.json | 2995 +- checklists/security_checklist.ja.json | 2995 +- checklists/security_checklist.ko.json | 2995 +- checklists/security_checklist.pt.json | 2995 +- checklists/security_checklist.zh-Hant.json | 1669 + checklists/waf_checklist.en.json | 12672 ++-- checklists/waf_checklist.es.json | 6948 +- checklists/waf_checklist.ja.json | 8708 +-- checklists/waf_checklist.ko.json | 11232 +-- checklists/waf_checklist.pt.json | 8842 +-- checklists/waf_checklist.zh-Hant.json | 9104 +-- .../macrofree/checklist.en.master.xlsx | Bin 520716 -> 499920 bytes .../macrofree/security_checklist.en.xlsx | Bin 34519 -> 33750 bytes .../macrofree/security_checklist.es.xlsx | Bin 35641 -> 34881 bytes .../macrofree/security_checklist.ja.xlsx | Bin 38380 -> 36987 bytes .../macrofree/security_checklist.ko.xlsx | Bin 37313 -> 36529 bytes .../macrofree/security_checklist.pt.xlsx | Bin 35657 -> 34861 bytes .../macrofree/security_checklist.zh-Hant.xlsx | Bin 0 -> 35587 bytes spreadsheet/macrofree/waf_checklist.en.xlsx | Bin 189336 -> 189483 bytes spreadsheet/macrofree/waf_checklist.es.xlsx | Bin 175894 -> 176105 bytes spreadsheet/macrofree/waf_checklist.ja.xlsx | Bin 193236 -> 193031 bytes spreadsheet/macrofree/waf_checklist.ko.xlsx | Bin 187996 -> 187442 bytes spreadsheet/macrofree/waf_checklist.pt.xlsx | Bin 177593 -> 177020 bytes .../macrofree/waf_checklist.zh-Hant.xlsx | Bin 181244 -> 181339 bytes ...hecklist.en_network_counters_workbook.json | 184 +- ...en_network_counters_workbook_template.json | 2 +- ...elivery_checklist.en_network_workbook.json | 168 +- ...hecklist.en_network_workbook_template.json | 2 +- 30 files changed, 65984 insertions(+), 65094 deletions(-) create mode 100644 checklists/security_checklist.zh-Hant.json create mode 100644 spreadsheet/macrofree/security_checklist.zh-Hant.xlsx diff --git a/checklists/checklist.en.master.json b/checklists/checklist.en.master.json index 4503f44ae..e1f464776 100644 --- a/checklists/checklist.en.master.json +++ b/checklists/checklist.en.master.json @@ -2,223 +2,48 @@ "items": [ { "category": "Operations Management", - "checklist": "Cognitive Search Review Checklist", - "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", + "checklist": "Stream Analytics Review Checklist", + "guid": "32e52e36-11c8-418b-8a0b-c511e43a18a9", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-stream_analytics_v1.docx", "services": [], "severity": "High", - "subcategory": "High Availablity", - "text": "Enable 2 replicas to have 99.9% availability for read operations", + "subcategory": "High Availablity ", + "text": "Leverage FTA Resiliency Handbook for Stream Analytics", "waf": "Reliability" }, { "category": "Operations Management", - "checklist": "Cognitive Search Review Checklist", - "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", + "checklist": "Stream Analytics Review Checklist", + "description": "Azure Stream Analytics provides high availability (99.9% SLA) for jobs and clusters within a region, the details of which are transparent to the end customer. If failures occur within the service, per the documentation �Azure Stream Analytics guarantees exactly once event processing and at-least-once delivery of events, so events are never lost.�", + "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a", + "link": "https://azure.microsoft.com/en-in/products/stream-analytics", "services": [], "severity": "Medium", - "subcategory": "High Availablity", - "text": "Enable 3 replicas to have 99.9% availability for read/write operations", + "subcategory": "High Availablity ", + "text": "Understand High Availability 99% SLA and use it to plan your DR strategy", "waf": "Reliability" }, { "category": "Operations Management", - "checklist": "Cognitive Search Review Checklist", - "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", - "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", - "service": "Cognitive Search", + "checklist": "Stream Analytics Review Checklist", + "description": "Azure Stream Analytics resources (jobs, clusters, etc.) are regional and do not provide automatic geo-failover. However, you can achieve geo-redundancy by deploying identical Stream Analytics jobs in multiple Azure regions. Each job connects to local input and output sources. It is the responsibility of your application to both send input data into the two regional inputs and reconcile between the two regional outputs.", + "guid": "fc833934-8b26-42d6-ac5f-512925498e6d", + "link": "https://learn.microsoft.com/azure/stream-analytics/geo-redundancy", "services": [], - "severity": "High", - "subcategory": "High Availablity", - "text": "Leverage Availability Zones by enabling read and/or write replicas", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Cognitive Search Review Checklist", - "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", - "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", - "service": "Cognitive Search", - "services": [ - "ACR" - ], - "severity": "Medium", - "subcategory": "Georeplication", - "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Cognitive Search Review Checklist", - "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", - "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", - "service": "Cognitive Search", - "services": [ - "ACR" - ], - "severity": "Medium", - "subcategory": "Georeplication", - "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Cognitive Search Review Checklist", - "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", - "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", - "service": "Cognitive Search", - "services": [ - "TrafficManager" - ], - "severity": "Medium", - "subcategory": "Georeplication", - "text": "Use Azure Traffic Manager to coordinate requests", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Cognitive Search Review Checklist", - "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", - "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", - "service": "Cognitive Search", - "services": [ - "Backup", - "Storage", - "ASR" - ], - "severity": "High", - "subcategory": "Disaster Recovery", - "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Identity Review Checklist", - "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", - "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", - "service": "Entra", - "services": [ - "Entra" - ], - "severity": "Medium", - "subcategory": "Entra ID", - "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Identity Review Checklist", - "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", - "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", - "service": "AAD B2C", - "services": [ - "Entra" - ], - "severity": "Medium", - "subcategory": "AAD B2C", - "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Identity Review Checklist", - "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", - "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", - "service": "AAD B2C", - "services": [ - "Entra" - ], - "severity": "Medium", - "subcategory": "AAD B2C", - "text": "Custom brand assets should be hosted on a CDN", - "waf": "Performance" - }, - { - "category": "Operations Management", - "checklist": "Identity Review Checklist", - "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", - "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", - "service": "AAD B2C", - "services": [ - "Entra" - ], - "severity": "Low", - "subcategory": "AAD B2C", - "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Identity Review Checklist", - "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", - "services": [ - "Entra", - "VM" - ], - "severity": "Medium", - "subcategory": "Windows Server AD", - "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Identity Review Checklist", - "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", - "services": [ - "Entra" - ], - "severity": "Medium", - "subcategory": "Windows Server AD", - "text": "Don't replicate! Replication can create issues with directory synchronization", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Identity Review Checklist", - "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", - "services": [ - "Entra" - ], - "severity": "Medium", - "subcategory": "Windows Server AD", - "text": "Have active-active for multi-regions", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Identity Review Checklist", - "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", - "services": [ - "Entra" - ], "severity": "Medium", - "subcategory": "Entra Domain Services", - "text": "Add Azure AD Domain service stamps to additional regions and locations", + "subcategory": "Geo Redundancy", + "text": "Plan for Geo Redudancy of the service", "waf": "Reliability" }, { "category": "Operations Management", - "checklist": "Identity Review Checklist", - "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", - "services": [ - "Entra" - ], + "checklist": "Stream Analytics Review Checklist", + "guid": "b9d37dac-43bc-46cd-8d7a-a9b24604489a", + "link": "https://learn.microsoft.com/azure/stream-analytics/geo-redundancy", + "services": [], "severity": "Medium", - "subcategory": "Entra Domain Services", - "text": "Use Replica Sets for DR", + "subcategory": "Geo Redundancy", + "text": "Depending on your availablity requirement, configure Active/Active configuration or Active/Passive configuration ", "waf": "Reliability" }, { @@ -301,42481 +126,40513 @@ "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", + "service": "Entra", "services": [ - "WAF" + "Entra" ], - "severity": "High", - "text": "Enable 2 replicas to have 99.9% availability for read operations", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Microsoft Entra ID Tenants", + "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Entra", "services": [ - "WAF" + "Entra" ], - "severity": "Medium", - "text": "Enable 3 replicas to have 99.9% availability for read/write operations", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Microsoft Entra ID Tenants", + "text": "Ensure you have a Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", - "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", - "service": "Cognitive Search", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "Entra", "services": [ - "WAF" + "Entra" ], - "severity": "High", - "text": "Leverage Availability Zones by enabling read and/or write replicas", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Microsoft Entra ID Tenants", + "text": "Leverage Azure Lighthouse for Multi-Tenant Management", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", - "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", - "service": "Cognitive Search", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Entra", "services": [ - "ACR", - "WAF" + "Entra" ], "severity": "Medium", - "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions", - "waf": "Reliability" + "subcategory": "Cloud Solution Provider", + "text": "Ensure that Azure Lighthouse is used for administering the tenant by partner", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", - "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", - "service": "Cognitive Search", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "a24d0de3-d4b9-4dfb-8ddd-bbfaf123fa01", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-cloud-solution-provider#design-recommendations", "services": [ - "ACR", - "WAF" + "Entra" ], - "severity": "Medium", - "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Cloud Solution Provider", + "text": "Discuss support request and escalation process with CSP partner", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", - "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", - "service": "Cognitive Search", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "32952499-58c8-4e6f-ada5-972e67893d55", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "TrafficManager", - "WAF" + "Entra", + "Cost" ], "severity": "Medium", - "text": "Use Azure Traffic Manager to coordinate requests", - "waf": "Reliability" + "subcategory": "Cloud Solution Provider", + "text": "Setup Cost Reporting and Views with Azure Cost Management", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", - "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", - "service": "Cognitive Search", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "685cb4f2-ac9c-4b19-9167-993ed0b32415", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", "services": [ - "Backup", - "Storage", - "WAF" + "Entra", + "LoadBalancer" ], - "severity": "High", - "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Enterprise Agreement", + "text": "Configure Notification Contacts to a group mailbox", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", - "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", - "service": "Entra", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "12cd499f-96e2-4e41-a243-231fb3245a1c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ "Entra", - "WAF" + "TrafficManager" ], - "severity": "Medium", - "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Enterprise Agreement", + "text": "Use departments and accounts to map your organization's structure to your enrollment hierarchy which can help with separating billing.", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", - "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", - "service": "AAD B2C", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "ca0fe401-12ad-46fc-8a7e-86293866a9f6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "WAF" + "Entra", + "Cost" ], "severity": "Medium", - "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes", - "waf": "Reliability" + "subcategory": "Enterprise Agreement", + "text": "Enable both DA View Charges and AO View Charges on your EA Enrollments to allow users with the correct perms review Cost and Billing Data.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", - "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", - "service": "AAD B2C", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "5cf9f485-2784-49b3-9824-75d9b8bdb57b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "WAF" + "Entra", + "Subscriptions", + "Cost" ], - "severity": "Medium", - "text": "Custom brand assets should be hosted on a CDN", - "waf": "Performance" + "severity": "Low", + "subcategory": "Enterprise Agreement", + "text": "Make use of Enterprise Dev/Test Subscriptions to reduce costs for non-production workloads", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", - "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", - "service": "AAD B2C", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "6ad5c3dd-e5ea-4ff1-81a4-7886ff87845c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "WAF" + "Entra" ], "severity": "Low", - "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)", - "waf": "Reliability" + "subcategory": "Microsoft Customer Agreement", + "text": "Configure Agreement billing account notification contact email", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "90e87802-602f-4dfb-acea-67c60689f1d7", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice", "services": [ - "VM", - "WAF" + "Storage", + "Entra", + "Cost" ], - "severity": "Medium", - "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Microsoft Customer Agreement", + "text": "Use Billing Profiles and Invoice sections to structure your agreements billing for effective cost management", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "e81a73f0-84c4-4641-b406-14db3b4d1f50", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "WAF" + "Entra", + "Cost" ], - "severity": "Medium", - "text": "Don't replicate! Replication can create issues with directory synchronization", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Microsoft Customer Agreement", + "text": "Make use of Microsoft Azure plan for dev/test offer to reduce costs for non-production workloads", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "category": "Azure Billing and Microsoft Entra ID Tenants", + "checklist": "Azure Landing Zone Review", + "guid": "ae757485-92a4-482a-8bc9-eefe6f5b5ec3", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "WAF" + "Entra", + "RBAC" ], "severity": "Medium", - "text": "Have active-active for multi-regions", - "waf": "Reliability" + "subcategory": "Microsoft Customer Agreement", + "text": "Periodically audit the agreement billing RBAC role assignments to review who has access to your MCA billing account", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "ammp": true, + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "348ef254-c27d-442e-abba-c7571559ab91", + "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", "service": "Entra", "services": [ + "ACR", "Entra", - "WAF" + "RBAC", + "Subscriptions" ], - "severity": "Medium", - "text": "Add Azure AD Domain service stamps to additional regions and locations", - "waf": "Reliability" + "severity": "High", + "subcategory": "Identity", + "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", + "ammp": true, + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "4348bf81-7573-4512-8f46-9061cc198fea", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator", "services": [ - "WAF" + "Entra" ], - "severity": "Medium", - "text": "Use Replica Sets for DR", - "waf": "Reliability" + "severity": "High", + "subcategory": "Microsoft Entra ID and Hybrid Identity", + "text": "Use managed identities instead of service principals for authentication to Azure services. You can check for existing service principals via Entra ID > Sign in Logs > Service principal logins.", + "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx", - "service": "Cognitive Services", - "services": [ - "WAF" + "ammp": true, + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", + "service": "Entra", + "services": [ + "Entra" ], - "severity": "Medium", - "text": "Leverage FTA HandBook for Cognitive Services", - "waf": "Reliability" + "severity": "High", + "subcategory": "Identity", + "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5", - "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions", - "service": "Cognitive Services", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "Entra", "services": [ - "Backup", - "WAF" + "Entra" ], "severity": "Medium", - "text": "Backup Your Prompts", - "waf": "Reliability" + "subcategory": "Identity", + "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5", - "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery", - "service": "Cognitive Services", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", + "service": "Entra", "services": [ - "ASR", - "WAF" + "Entra", + "AzurePolicy" ], - "severity": "High", - "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Identity", + "text": "Enforce Microsoft Entra ID conditional-access policies for any user with rights to Azure environments", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "325af625-ca44-4e46-a5e2-223ace8bb123", - "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations", - "service": "Cognitive Services", + "ammp": true, + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", + "service": "Entra", "services": [ - "Backup", - "WAF" + "Entra" ], - "severity": "Medium", - "text": "Backup Your ChatGPT conversations", - "waf": "Reliability" + "severity": "High", + "subcategory": "Identity", + "text": "Enforce multi-factor authentication for any user with rights to the Azure environments", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618", - "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment", - "service": "Cognitive Services", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", "services": [ - "WAF" + "Entra", + "RBAC" ], "severity": "Medium", - "text": "CI/CD for custom speech", - "waf": "Reliability" + "subcategory": "Identity", + "text": "Enforce centralized and delegated responsibilities to manage resources deployed inside the landing zone, based on role and security requirements", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "3687a046-7a1f-4893-9bda-43324f248116", - "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base", - "service": "Cognitive Services", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "14658d35-58fd-4772-99b8-21112df27ee4", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "Entra", "services": [ - "WAF" + "Entra" ], - "severity": "Low", - "text": "Move a knowledge base using export-import", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Identity", + "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", - "service": "Bot service", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations", "services": [ - "WAF" + "Entra", + "ACR", + "VM" ], "severity": "Medium", - "text": "Follow reliability support recommendations in Azure Bot Service", + "subcategory": "Identity", + "text": "When deploying Active Directory on Windows Server, use a location with Availability Zones and deploy at least two VMs across these zones. If not available, deploy in an Availability Set", + "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", - "service": "Bot service", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "f5664b5e-984a-4859-a773-e7d261623a76", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", "services": [ - "WAF" + "ACR", + "Entra", + "RBAC", + "Subscriptions" ], "severity": "Medium", - "text": "Deploying bots with local data residency and regional compliance", - "waf": "Reliability" + "subcategory": "Identity", + "text": "Use Azure custom RBAC roles for the following key roles to provide fine-grain access across your ALZ: Azure platform owner, network management, security operations, subscription owner, application owner. Align these roles to teams and responsibilities within your business.", + "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", - "service": "Bot service", + "checklist": "Azure Landing Zone Review", + "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "Entra", "services": [ - "WAF" + "Entra" ], "severity": "Medium", - "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.", - "waf": "Reliability" + "subcategory": "Identity and Access Management", + "text": "If planning to switch from Active Directory Domain Serivces to Entra domain services, evaluate the compatibility of all workloads", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687", - "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/", - "service": "Purview", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", + "service": "Entra", "services": [ - "WAF" + "Entra", + "Monitor" ], "severity": "Medium", - "text": "Leverage FTA Resillency Handbook", - "waf": "Reliability" + "subcategory": "Identity", + "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "ammp": true, + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "984a859c-773e-47d2-9162-3a765a917e1f", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "service": "Entra", "services": [ - "WAF" + "Entra" ], "severity": "High", - "text": "Plan for Data Center level outage", - "waf": "Reliability" + "subcategory": "Identity", + "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets", - "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94", + "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server", "services": [ - "WAF" + "ASR", + "Entra" ], "severity": "Medium", - "text": "Practice Failover for BCDR", + "subcategory": "Microsoft Entra ID", + "text": "When deploying an Microsoft Entra Connect, leverage a staging sever for high availability / Disaster recovery", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "97b15b8a-219a-44ab-bb57-879024d22678", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "35037e68-9349-4c15-b371-228514f4cdff", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "Entra", "services": [ - "Backup", - "WAF" + "Entra", + "RBAC" ], - "severity": "High", - "text": "Plan a backup strategy and take regular backups", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Identity", + "text": "Avoid using on-premises synced accounts for Microsoft Entra ID role assignments.", + "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d", - "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet", - "service": "Purview", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Entra", "services": [ - "EventHubs", - "WAF" + "Entra" ], - "severity": "Low", - "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Identity", + "text": "Where required, use Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications (hosted in the cloud or on-premises).", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b", - "link": "https://learn.microsoft.com/purview/deployment-best-practices", - "service": "Purview", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "9cf5418b-1520-4b7b-add7-88eb28f833e8", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#managed-identities", "services": [ - "WAF" + "VNet", + "Entra" ], "severity": "Medium", - "text": "Follow Purview accounts architectures and deployment best practices", - "waf": "Reliability" + "subcategory": "Landing zones", + "text": "Configure Identity network segmentation through the use of a virtual Network and peer back to the hub. Providing authentication inside application landing zone (legacy).", + "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c", - "link": "https://learn.microsoft.com/purview/concept-best-practices-collections", - "service": "Purview", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "d4d1ad54-1abc-4919-b267-3f342d3b49e4", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations", "services": [ - "WAF" + "Storage", + "Entra", + "RBAC", + "AKV", + "ACR" ], "severity": "Medium", - "text": "Follow Collection Architectures and best practices", - "waf": "Reliability" + "subcategory": "Landing zones", + "text": "Use Azure RBAC to manage data plane access to resources, if possible. E.G - Data Operations across Key Vault, Storage Account and Database Services.", + "training": "https://learn.microsoft.com/azure/role-based-access-control/overview", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b", - "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle", - "service": "Purview", + "category": "Identity and Access Management", + "checklist": "Azure Landing Zone Review", + "guid": "d505ebcb-79b1-4274-9c0d-a27c8bea489c", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review", "services": [ - "WAF" + "Entra" ], "severity": "Medium", - "text": "Follow Assest lifecycle best practices", - "waf": "Reliability" + "subcategory": "Landing zones", + "text": "Use Microsoft Entra ID PIM access reviews to periodically validate resource entitlements.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed", - "link": "https://learn.microsoft.com/purview/concept-best-practices-automation", - "service": "Purview", + "ammp": true, + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "description": "Consider using the Azure naming tool available at https://aka.ms/azurenamingtool", + "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming", + "services": [], + "severity": "High", + "subcategory": "Naming and tagging", + "text": "It is recommended to follow Microsoft Best Practice Naming Standards", + "waf": "Security" + }, + { + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)", + "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", "services": [ - "WAF" + "Subscriptions" ], "severity": "Medium", - "text": "Follow automation best practices", - "waf": "Reliability" + "subcategory": "Subscriptions", + "text": "Enforce reasonably flat management group hierarchy with no more than four levels.", + "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "667313b4-f566-44b5-b984-a859c773e7d2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", "services": [ - "Backup", - "WAF" + "Subscriptions" ], "severity": "Medium", - "text": "Follow Backup and Migration Best practices", - "waf": "Reliability" + "subcategory": "Subscriptions", + "text": "Enforce a sandbox management group to allow users to immediately experiment with Azure", + "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7", - "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "61623a76-5a91-47e1-b348-ef254c27d42e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", "services": [ - "WAF" + "RBAC", + "Subscriptions", + "AzurePolicy" ], "severity": "Medium", - "text": "Follow Purview Glossary Best Practices", - "waf": "Reliability" + "subcategory": "Subscriptions", + "text": "Enforce a platform management group under the root management group to support common platform policy and Azure role assignment", + "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790", - "link": "https://learn.microsoft.com/purview/concept-workflow", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", "services": [ - "WAF" + "DNS", + "Subscriptions", + "ExpressRoute", + "VWAN" ], - "severity": "Low", - "text": "Leverage Workflows ", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Subscriptions", + "text": "Enforce a dedicated connectivity subscription in the Connectivity management group to host an Azure Virtual WAN hub, private Domain Name System (DNS), ExpressRoute circuit, and other networking resources.", + "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e", - "link": "https://learn.microsoft.com/purview/concept-best-practices-security", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)", + "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34", + "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group", "services": [ - "WAF" + "Subscriptions" ], "severity": "Medium", - "text": "Follow Purview Security Best Practices", - "waf": "Reliability" + "subcategory": "Subscriptions", + "text": "Enforce no subscriptions are placed under the root management group", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888", - "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19", + "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization", "services": [ - "WAF" + "RBAC", + "Subscriptions" ], "severity": "Medium", - "text": "Follow Purview Data Lineage Best Practices", - "waf": "Reliability" + "subcategory": "Subscriptions", + "text": "Enforce that only privileged users can operate management groups in the tenant by enabling Azure RBAC authorization in the management group hierarchy settings", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "9579e76b-896e-4710-a7da-7be9956d14d3", - "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "92481607-d5d1-4e4e-9146-58d3558fd772", + "link": "https://learn.microsoft.com/azure/governance/management-groups/overview", "services": [ - "WAF" + "Subscriptions" ], "severity": "Medium", - "text": "Follow Best Practices for Scanning Registered Sources", - "waf": "Reliability" + "subcategory": "Subscriptions", + "text": "Enforce management groups under the root-level management group to represent the types of workloads, based on their security, compliance, connectivity, and feature needs.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed", - "link": "https://learn.microsoft.com/purview/concept-best-practices-classification", - "service": "Purview", + "ammp": true, + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "49b82111-2df2-47ee-912e-7f983f630472", + "link": "https://learn.microsoft.com/azure/governance/management-groups/overview", "services": [ - "WAF" + "RBAC", + "Subscriptions", + "AzurePolicy", + "Cost" ], - "severity": "Medium", - "text": "Follow Classification Best Practices in Governance Portal", - "waf": "Reliability" + "severity": "High", + "subcategory": "Subscriptions", + "text": "Enforce a process to make resource owners aware of their roles and responsibilities, access review, budget review, policy compliance and remediate when necessary.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69", - "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "services": [ - "WAF" + "Subscriptions" ], "severity": "Medium", - "text": "Perform Sensitivity Labelling in the Purview Data Map", - "waf": "Reliability" + "subcategory": "Subscriptions", + "text": "Ensure that all subscription owners and IT core team are aware of subscription quotas and the impact they have on provision resources for a given subscription.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96", - "link": "https://learn.microsoft.com/purview/concept-data-share", - "service": "Purview", + "ammp": true, + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "c68e1d76-6673-413b-9f56-64b5e984a859", + "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations", "services": [ - "Storage", - "WAF" + "VM", + "Subscriptions", + "AzurePolicy", + "Cost" ], - "severity": "Low", - "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview", - "waf": "Reliability" + "severity": "High", + "subcategory": "Subscriptions", + "text": "Use Reserved Instances where appropriate to optimize cost and ensure available capacity in target regions. Enforce the use of purchased Reserved Instance VM SKUs via Azure Policy.", + "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4", - "link": "https://learn.microsoft.com/purview/concept-insights", - "service": "Purview", + "ammp": true, + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25", + "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/design-capacity", "services": [ - "WAF" + "Monitor", + "Subscriptions" ], - "severity": "Low", - "text": "Leverage Data Estate Insights", - "waf": "Reliability" - }, - { - "checklist": "WAF checklist", - "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab", - "link": "https://learn.microsoft.com/purview/catalog-adoption-insights", - "service": "Purview", - "services": [ - "WAF" - ], - "severity": "Low", - "text": "Use Data stewardship and Catalog adoption", - "waf": "Reliability" + "severity": "High", + "subcategory": "Subscriptions", + "text": "Enforce a dashboard, workbook, or manual process to monitor used capacity levels", + "training": "https://learn.microsoft.com/learn/paths/monitor-usage-performance-availability-resources-azure-monitor/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581", - "link": "https://learn.microsoft.com/purview/concept-insights", - "service": "Purview", + "ammp": true, + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40", + "link": "https://learn.microsoft.com/azure/cost-management-billing/cost-management-billing-overview", "services": [ - "WAF" + "Subscriptions", + "Cost" ], - "severity": "Low", - "text": "Use Inventory and Ownership", - "waf": "Reliability" + "severity": "High", + "subcategory": "Subscriptions", + "text": "Enforce a process for cost management", + "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9", - "link": "https://learn.microsoft.com/purview/glossary-insights", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de", + "link": "https://learn.microsoft.com/azure/governance/management-groups/overview", "services": [ - "WAF" + "Entra", + "Subscriptions" ], - "severity": "Low", - "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Subscriptions", + "text": "If servers will be used for Identity services, like domain controllers, establish a dedicated identity subscription in the identity management group, to host these services. Make sure that resources are set to use the domain controllers available in their region.", + "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "b130a888-9579-4e76-a896-e710a7da7be9", - "link": "https://learn.microsoft.com/purview/compliance-manager", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant", + "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs", "services": [ - "WAF" + "Subscriptions", + "Cost" ], "severity": "Medium", - "text": "Generate assessment scores", - "waf": "Reliability" + "subcategory": "Subscriptions", + "text": "Ensure tags are used for billing and cost management", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f", - "link": "https://learn.microsoft.com/purview/compliance-manager-scoring", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "6cc0ea22-42bb-441e-a345-804ab0a09666", + "link": "https://github.com/Azure/sovereign-landing-zone/blob/main/docs/02-Architecture.md", "services": [ - "WAF" + "Subscriptions" ], "severity": "Medium", - "text": "Profiling- get summaries of data content", - "waf": "Reliability" + "subcategory": "Subscriptions", + "text": "For Sovereign Landing Zone, have a 'confidential corp' and 'confidential online' management group directly under the 'landing zones' MG.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1", - "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "250d81ce-8bbe-4f85-9051-6a18a8221e50", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions", "services": [ - "AzurePolicy", - "WAF" + "Cost" ], - "severity": "Low", - "text": "Follow Microsoft Purview Data Owner access policies", + "severity": "High", + "subcategory": "Regions", + "text": "Select the right Azure region/s for your deployment. Azure is a global-scale cloud platform that provide global coverage through many regions and geographies. Different Azure regions have different characteristics, access and availability models, costs, capacity, and services offered, then it is important to consider all criteria and requirements", + "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac", - "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy", - "service": "Purview", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "19ca3f89-397d-44b1-b5b6-5e18661372ac", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions#operate-in-multiple-geographic-regions", "services": [ - "AzurePolicy", - "WAF" + "ASR" ], - "severity": "Low", - "text": "Follow Self-service access policies", + "severity": "Medium", + "subcategory": "Regions", + "text": "Consider a multi-region deployment. Depending on customer size, locations, and users presence, operating in multiple regions can be a common choice to deliver services and run applications closer to them. Using a multi-region deployment is also important to provide geo disaster recovery capabilities, to eliminate the dependency from a single region capacity and diminish the risk of a temporary and localized resource capacity constraint", + "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "b49e5b96-0332-44ec-b8cc-13318da61170", - "link": "https://learn.microsoft.com/purview/concept-policies-devops", - "service": "Purview", - "services": [ - "AzurePolicy", - "WAF" - ], - "severity": "Low", - "text": "Follow DevOps policies", + "category": "Resource Organization", + "checklist": "Azure Landing Zone Review", + "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908", + "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", + "services": [], + "severity": "Medium", + "subcategory": "Regions", + "text": "Ensure required services and features are available within the chosen deployment regions", + "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", - "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "373f482f-3e39-4d39-8aa4-7e566f6082b6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-app-delivery", "services": [ - "SAP", - "WAF" + "FrontDoor", + "AppGW" ], "severity": "Medium", - "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "subcategory": "App delivery", + "text": "Develop a plan for securing the delivery application content from your Workload spokes using Application Gateway and Azure Front door. You can use the Application Delivery checklist to for recommendations.", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", + "service": "VNet", "services": [ - "SAP", - "WAF" + "VNet" ], "severity": "Medium", - "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.", - "training": "https://github.com/Azure/sap-automation", - "waf": "Operations" + "subcategory": "Hub and spoke", + "text": "Leverage a network design based on the traditional hub-and-spoke network topology for network scenarios that require maximum flexibility.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", - "service": "SAP", - "services": [ - "SAP", - "WAF" - ], + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "6138a720-0f1c-4e16-bd30-1d6e872e52e3", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "services": [], "severity": "Medium", - "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally", - "waf": "Reliability" + "subcategory": "App delivery", + "text": "Perform app delivery within landing zones for both internal-facing (corp) and external-facing apps (online).", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", + "service": "VNet", "services": [ - "Backup", - "WAF" + "VNet", + "Entra", + "DNS", + "ExpressRoute", + "Firewall", + "VPN", + "NVA" ], - "severity": "Medium", - "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.", - "waf": "Reliability" + "severity": "High", + "subcategory": "Hub and spoke", + "text": "Ensure that shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS servers.", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "b651423c-8552-42db-a545-5cb50c05527a", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "VNet", "services": [ - "ASR", - "SAP", - "Backup", - "SQL", - "Storage", - "WAF" + "DDoS" ], - "severity": "High", - "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "App delivery", + "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "services": [ - "SAP", - "WAF" + "NVA" ], "severity": "Medium", - "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "subcategory": "Hub and spoke", + "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", + "service": "ExpressRoute", "services": [ - "ExpressRoute", "VPN", - "ASR", - "WAF" + "ARS", + "ExpressRoute" ], - "severity": "High", - "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.", - "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Hub and spoke", + "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", + "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", + "service": "ARS", "services": [ - "AKV", - "ACR", - "WAF" + "VNet", + "ARS" ], "severity": "Low", - "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.", - "waf": "Reliability" + "subcategory": "Hub and spoke", + "text": "If using Route Server, use a /27 prefix for the Route Server subnet.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", + "service": "VNet", "services": [ - "ASR", "VNet", - "SAP", - "WAF" + "ACR" ], "severity": "Medium", - "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.", - "waf": "Reliability" + "subcategory": "Hub and spoke", + "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", + "service": "VNet", "services": [ - "Storage", - "SAP", - "WAF" + "Monitor" ], - "severity": "Low", - "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.", - "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Hub and spoke", + "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", + "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "services": [ - "WAF" + "VNet", + "Entra", + "ExpressRoute" ], - "severity": "High", - "text": "Native database replication technology should be used to synchronize the database in a HA pair.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", + "severity": "Medium", + "subcategory": "Hub and spoke", + "text": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000)", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", - "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", + "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "services": [ - "VNet", - "WAF" + "Storage" ], - "severity": "High", - "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "severity": "Medium", + "subcategory": "Hub and spoke", + "text": "Consider the limit of routes per route table (400).", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", + "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", + "service": "VNet", "services": [ - "Entra", - "ASR", - "VM", - "WAF" + "VNet" ], "severity": "High", - "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "subcategory": "Hub and spoke", + "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", + "service": "ExpressRoute", "services": [ - "SAP", - "WAF" + "ExpressRoute" ], - "severity": "High", - "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Encryption", + "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", "services": [ - "SAP", - "WAF" + "VPN", + "ExpressRoute" ], - "severity": "High", - "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Encryption", + "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "558fd772-49b8-4211-82df-27ee412e7f98", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "ExpressRoute", "services": [ - "VM", - "Storage", - "WAF" + "VNet", + "ACR" ], "severity": "High", - "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", - "waf": "Reliability" + "subcategory": "IP plan", + "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", - "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", + "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", "services": [ - "Storage", - "SAP", - "WAF" + "VNet" ], - "severity": "High", - "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", - "waf": "Reliability" + "severity": "Low", + "subcategory": "IP plan", + "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", - "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", + "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", "services": [ - "SAP", - "WAF" + "VNet" ], "severity": "High", - "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "subcategory": "IP plan", + "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16)", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", + "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", + "service": "VNet", "services": [ - "LoadBalancer", - "SAP", - "WAF" + "VNet" ], "severity": "High", - "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "subcategory": "IP plan", + "text": "Avoid using overlapping IP address ranges for production and DR sites.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", "services": [ - "LoadBalancer", - "WAF" + "VNet", + "DNS" ], - "severity": "High", - "text": "Make sure the Floating IP is enabled on the Load balancer", - "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "IP plan", + "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", + "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", + "service": "DNS", "services": [ - "WAF" + "VNet", + "ACR", + "DNS" ], - "severity": "High", - "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "IP plan", + "text": "For environments where name resolution across Azure and on-premises is required, consider using Azure DNS Private Resolver.", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", - "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", "services": [ - "Entra", - "VM", - "SAP", - "WAF" + "VNet", + "DNS" ], - "severity": "High", - "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.", - "waf": "Reliability" + "severity": "Low", + "subcategory": "IP plan", + "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "cbe05bbe-209d-4490-ba47-778424d11678", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "614658d3-558f-4d77-849b-821112df27ee", + "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", + "service": "DNS", "services": [ - "Entra", - "VM", - "RBAC", - "WAF" + "VNet", + "DNS", + "VM" ], "severity": "High", - "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Reliability" + "subcategory": "IP plan", + "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", - "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "service": "Bastion", "services": [ - "WAF" + "Bastion" ], "severity": "Medium", - "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.", - "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "waf": "Reliability" + "subcategory": "Internet", + "text": "Consider using Azure Bastion to securely connect to your network.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "9674e7c7-7796-4181-8920-09f4429543ba", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", + "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", + "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", + "service": "Bastion", "services": [ - "VM", + "VNet", + "Bastion" + ], + "severity": "Medium", + "subcategory": "Internet", + "text": "Use Azure Bastion in a subnet /26 or larger.", + "waf": "Security" + }, + { + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "WAF", + "services": [ + "FrontDoor", + "ACR", + "AzurePolicy", "WAF" ], - "severity": "High", - "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Internet", + "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", "services": [ - "Entra", - "SAP", + "FrontDoor", + "AzurePolicy", + "WAF", + "AppGW" + ], + "severity": "Low", + "subcategory": "Internet", + "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Security" + }, + { + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", + "services": [ + "VNet", "WAF" ], "severity": "High", - "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.", - "waf": "Reliability" + "subcategory": "Internet", + "text": "Deploy WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", "services": [ - "SAP", - "ACR", - "WAF" + "DDoS", + "VNet" ], "severity": "High", - "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions", + "subcategory": "Internet", + "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" + }, + { + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "b034c01e-110b-463a-b36e-e3346e57f225", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "service": "VNet", + "services": [], + "severity": "High", + "subcategory": "Internet", + "text": "Assess and review network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", "services": [ - "Entra", - "SAP", - "WAF" + "DDoS" ], "severity": "High", - "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "subcategory": "Internet", + "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ed46b937-913e-4018-9c62-8393ab037e53", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", + "service": "ExpressRoute", "services": [ - "Entra", - "VM", - "WAF" + "ExpressRoute" ], "severity": "Medium", - "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "subcategory": "Hybrid", + "text": "Ensure that you have investigated the possibility to use ExpressRoute as primary connection to Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "f656e745-0cfb-453e-8008-0528fa21c933", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.", + "guid": "f29812b2-363c-4efe-879b-599de0d5973c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "services": [ - "VM", - "Storage", - "WAF" + "ExpressRoute" ], "severity": "Medium", - "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.", + "subcategory": "Hybrid", + "text": "When you use multiple ExpressRoute circuits, or multiple on-prem locations, make sure to optimize routing with BGP attributes, if certain paths are preferred.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "7f684ebc-95da-425e-b329-e782dbed050f", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", + "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "services": [ - "SAP", - "WAF" + "VPN", + "ExpressRoute" ], "severity": "Medium", - "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "subcategory": "Hybrid", + "text": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", + "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", + "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", + "service": "ExpressRoute", "services": [ - "Storage", - "WAF" + "ExpressRoute", + "Cost" ], "severity": "High", - "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", - "waf": "Reliability" + "subcategory": "Hybrid", + "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", + "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", + "service": "ExpressRoute", "services": [ - "Storage", - "SAP", - "WAF" + "ExpressRoute", + "Cost" ], "severity": "High", - "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.", - "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", - "waf": "Reliability" + "subcategory": "Hybrid", + "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU.", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", + "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", + "service": "ExpressRoute", "services": [ - "ASR", - "Storage", - "SAP", - "WAF" + "ExpressRoute" ], - "severity": "High", - "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", + "severity": "Medium", + "subcategory": "Hybrid", + "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", - "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "service": "ExpressRoute", "services": [ - "Storage", - "SAP", - "WAF" + "ExpressRoute" ], - "severity": "High", - "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Hybrid", + "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", + "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", + "service": "ExpressRoute", "services": [ - "Cost", - "SAP", - "WAF" + "ExpressRoute" ], "severity": "Medium", - "text": "Automate SAP System Start-Stop to manage costs.", - "waf": "Cost" + "subcategory": "Hybrid", + "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", + "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", + "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", + "service": "VPN", "services": [ - "SAP", - "Cost", - "Storage", - "VM", - "WAF" + "VPN" ], - "severity": "Low", - "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.", - "waf": "Cost" + "severity": "Medium", + "subcategory": "Hybrid", + "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "9877f353-2591-4e8b-8381-e9043fed1010", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", + "service": "VPN", "services": [ - "SAP", - "Cost", - "Storage", - "VM", - "WAF" + "VPN" ], - "severity": "Low", - "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.", - "waf": "Cost" + "severity": "Medium", + "subcategory": "Hybrid", + "text": "Use redundant VPN appliances on-premises (active/active or active/passive).", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "718cb437-b060-2589-8856-2e93a5c6633b", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", "services": [ - "RBAC", - "Subscriptions", - "WAF" + "ExpressRoute", + "Cost" ], "severity": "High", - "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", - "waf": "Security" + "subcategory": "Hybrid", + "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "45911475-e39e-4530-accc-d979366bcda2", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", + "service": "ExpressRoute", "services": [ - "Entra", - "SAP", - "WAF" + "ExpressRoute" ], "severity": "Medium", - "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", + "subcategory": "Hybrid", + "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", - "services": [ - "Entra", - "SAP", - "WAF" + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "b30e38c3-f298-412b-8363-cefe179b599d", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", + "service": "ExpressRoute", + "services": [ + "Monitor", + "ExpressRoute" ], "severity": "Medium", - "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.", - "waf": "Security" + "subcategory": "Hybrid", + "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", + "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", + "service": "ExpressRoute", "services": [ - "SAP", - "WAF" + "ACR", + "Monitor", + "NetworkWatcher" ], "severity": "Medium", - "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", - "waf": "Security" + "subcategory": "Hybrid", + "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", + "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", + "service": "ExpressRoute", "services": [ - "SAP", - "WAF" + "ExpressRoute" ], "severity": "Medium", - "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", - "waf": "Security" + "subcategory": "Hybrid", + "text": "Use ExpressRoute circuits from different peering locations for redundancy.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", + "service": "ExpressRoute", "services": [ - "SAP", - "WAF" + "VPN", + "ExpressRoute" ], "severity": "Medium", - "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", - "waf": "Security" + "subcategory": "Hybrid", + "text": "Use site-to-site VPN as failover of ExpressRoute, especially if only using a single ExpressRoute circuit.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", + "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", + "service": "ExpressRoute", "services": [ - "AKV", - "SAP", - "WAF" + "Storage", + "VNet" ], - "severity": "Medium", - "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", - "waf": "Security" + "severity": "High", + "subcategory": "Hybrid", + "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", - "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "d581a947-69a2-4783-942e-9df3664324c8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", + "service": "ExpressRoute", "services": [ - "AKV", - "SAP", - "WAF" + "ACR", + "ExpressRoute" ], - "severity": "Medium", - "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", - "waf": "Security" + "severity": "High", + "subcategory": "Hybrid", + "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "16785d6f-a96c-496a-b885-18f482734c88", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", + "service": "ExpressRoute", "services": [ - "SAP", - "WAF" + "ExpressRoute" ], "severity": "Medium", - "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.", - "waf": "Security" + "subcategory": "Hybrid", + "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "a747c350-8d4c-449c-93af-393dbca77c48", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", - "service": "SAP", - "services": [ - "SAP", - "WAF" - ], + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", + "service": "ExpressRoute", + "services": [], "severity": "Medium", - "text": "Implement SSO to SAP HANA", - "waf": "Security" + "subcategory": "Hybrid", + "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "ExpressRoute", "services": [ - "Entra", - "SAP", - "WAF" + "ExpressRoute" ], - "severity": "Medium", - "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.", - "waf": "Security" + "severity": "High", + "subcategory": "Hybrid", + "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", - "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", + "service": "ExpressRoute", "services": [ - "SAP", - "WAF" + "VNet", + "Monitor", + "ExpressRoute" ], "severity": "Medium", - "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.", - "waf": "Security" + "subcategory": "Hybrid", + "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "5234c93f-b651-41dd-80c1-234177b91ced", + "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", + "service": "ExpressRoute", "services": [ - "Entra", - "SAP", - "WAF" + "VNet", + "ExpressRoute" ], "severity": "Medium", - "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.", - "waf": "Security" + "subcategory": "Hybrid", + "text": "Avoid using ExpressRoute circuits for VNet-to-VNet communication.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "services": [ - "SAP", - "WAF" + "Firewall" ], - "severity": "Medium", - "text": "Implement SSO to SAP BTP", + "severity": "High", + "subcategory": "Firewall", + "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", "services": [ - "Entra", - "SAP", - "WAF" + "ACR", + "RBAC", + "AzurePolicy", + "Firewall" ], "severity": "Medium", - "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.", + "subcategory": "Firewall", + "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "6ba28021-4591-4147-9e39-e5309cccd979", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", + "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", + "service": "Firewall", "services": [ - "AzurePolicy", - "SAP", - "Subscriptions", - "WAF" + "Firewall" ], - "severity": "Medium", - "text": "enforce existing Management Group policies to SAP Subscriptions", - "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", - "waf": "Operations" + "severity": "Low", + "subcategory": "Firewall", + "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", + "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", + "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", + "service": "Firewall", "services": [ - "SAP", - "Subscriptions", - "WAF" + "DNS", + "Firewall" ], "severity": "High", - "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", - "waf": "Operations" + "subcategory": "Firewall", + "text": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", + "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", "services": [ - "Subscriptions", - "WAF" + "Firewall" ], "severity": "High", - "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ", - "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", - "waf": "Operations" + "subcategory": "Firewall", + "text": "Use Azure Firewall Premium for additional security and protection.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", - "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", + "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", "services": [ - "VM", - "Subscriptions", - "WAF" + "Firewall" ], "severity": "High", - "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)", - "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "waf": "Operations" + "subcategory": "Firewall", + "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", - "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", + "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", + "service": "Firewall", "services": [ - "WAF" + "Firewall" ], - "severity": "Low", - "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.", - "waf": "Operations" + "severity": "High", + "subcategory": "Firewall", + "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", - "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", + "guid": "a3784907-9836-4271-aafc-93535f8ec08b", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "service": "Firewall", "services": [ - "VM", - "Subscriptions", - "WAF" + "Storage", + "VNet", + "VWAN", + "Firewall", + "NVA" ], "severity": "High", - "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.", - "waf": "Operations" + "subcategory": "Firewall", + "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "e6e20617-3686-4af4-9791-f8935ada4332", - "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "715d833d-4708-4527-90ac-1b142c7045ba", + "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", + "service": "Firewall", "services": [ - "WAF" + "Storage", + "Firewall" ], - "severity": "High", - "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", + "severity": "Medium", + "subcategory": "Firewall", + "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", + "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", + "service": "Firewall", "services": [ - "Cost", - "TrafficManager", - "WAF" + "AzurePolicy", + "Firewall" ], - "severity": "Medium", - "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", + "severity": "Important", + "subcategory": "Firewall", + "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", + "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", + "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", + "service": "Firewall", "services": [ - "Backup", - "WAF" + "VNet", + "Firewall" ], "severity": "High", - "text": "Help protect your HANA database by using the Azure Backup service.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", - "waf": "Reliability" + "subcategory": "Segmentation", + "text": "Use a /26 prefix for your Azure Firewall subnets.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", + "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", + "service": "Firewall", "services": [ - "Entra", - "VM", - "Storage", - "WAF" + "AzurePolicy" ], "severity": "Medium", - "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.", - "waf": "Reliability" + "subcategory": "Firewall", + "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", + "link": "https://learn.microsoft.com/azure/firewall/ip-groups", + "service": "Firewall", "services": [ - "SAP", - "WAF" + "Storage" ], - "severity": "High", - "text": "Ensure time-zone matches between the operating system and the SAP system.", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Firewall", + "text": "Use IP Groups or IP prefixes to reduce number of IP table rules", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "c3c7abc0-716c-4486-893c-40e181d65539", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", - "service": "SAP", - "services": [ - "Entra", - "WAF" - ], + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", + "service": "Firewall", + "services": [], "severity": "Medium", - "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "subcategory": "Firewall", + "text": "Avoid wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "a491dfc4-9353-4213-9217-eef0949f9467", - "link": "https://azure.microsoft.com/pricing/offers/dev-test/", - "service": "SAP", - "services": [ - "Cost", - "WAF" - ], - "severity": "Low", - "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.", - "waf": "Cost" - }, - { - "checklist": "WAF checklist", - "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", - "link": "https://learn.microsoft.com/azure/lighthouse/overview", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", + "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", + "service": "Firewall", "services": [ - "Entra", - "SAP", - "WAF" + "Monitor" ], "severity": "Medium", - "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.", - "waf": "Operations" + "subcategory": "Firewall", + "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "4d116785-d2fa-456c-96ad-48408fe72734", - "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", - "service": "SAP", - "services": [ - "VM", - "WAF" - ], - "severity": "Medium", - "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.", - "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", - "waf": "Operations" + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "346840b8-1064-496e-8396-4b1340172d52", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", + "service": "Firewall", + "services": [], + "severity": "High", + "subcategory": "Firewall", + "text": "Enable TLS Inspection", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", - "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", + "service": "Firewall", "services": [ - "SAP", - "WAF" + "ServiceBus" ], "severity": "Low", - "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", - "waf": "Operations" + "subcategory": "Firewall", + "text": "Use web categories to allow or deny outbound access to specific topics.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "14591147-5e39-4e53-89cc-cd979366bcda", - "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", - "service": "SAP", - "services": [ - "SAP", - "SQL", - "Monitor", - "WAF" - ], + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", + "service": "Firewall", + "services": [], "severity": "Medium", - "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", - "waf": "Operations" + "subcategory": "Firewall", + "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", - "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "service": "Firewall", "services": [ - "SAP", - "Monitor", - "Entra", - "VM", - "WAF" + "DNS", + "Firewall" ], - "severity": "High", - "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.", - "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Firewall", + "text": "Enable Azure Firewall DNS proxy configuration ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", + "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", + "service": "Firewall", "services": [ - "AzurePolicy", - "WAF" + "VM", + "AzurePolicy" ], "severity": "Medium", - "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Operations" + "subcategory": "Firewall", + "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", - "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "service": "Firewall", "services": [ - "SAP", - "NetworkWatcher", "Monitor", - "WAF" + "Firewall" ], - "severity": "Medium", - "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", + "severity": "Low", + "subcategory": "Firewall", + "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "73686af4-6791-4f89-95ad-a43324e13811", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", "services": [ - "VM", - "SAP", - "WAF" + "Backup" ], - "severity": "Medium", - "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.", + "severity": "Low", + "subcategory": "Firewall", + "text": "Implement backups for your firewall rules", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "616785d6-fa96-4c96-ad88-518f482734c8", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "App Gateway", "services": [ - "SAP", - "Subscriptions", - "WAF" + "VNet" ], "severity": "High", - "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.", - "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "waf": "Performance" + "subcategory": "PaaS", + "text": "Ensure that control-plane communication for Azure PaaS services injected into a virtual network is not broken, for example with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", - "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", "services": [ - "ASR", - "Storage", - "WAF" + "PrivateLink" ], "severity": "Medium", - "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.", - "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", - "waf": "Reliability" + "subcategory": "PaaS", + "text": "Use Private Link, where available, for shared Azure PaaS services.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", - "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "ExpressRoute", "services": [ - "SAP", - "Sentinel", - "Monitor", - "WAF" + "ExpressRoute", + "PrivateLink" ], "severity": "Medium", - "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.", - "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", + "subcategory": "PaaS", + "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", - "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", + "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "VNet", "services": [ - "Cost", - "WAF" + "VNet" ], "severity": "Medium", - "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.", - "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", - "waf": "Operations" + "subcategory": "PaaS", + "text": "Don't enable virtual network service endpoints by default on all subnets.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "services": [ - "VM", - "Monitor", - "WAF" + "DNS", + "NVA", + "PrivateLink", + "Firewall" ], - "severity": "Low", - "text": "Use inter-VM latency monitoring for latency-sensitive applications.", - "waf": "Performance" + "severity": "Medium", + "subcategory": "PaaS", + "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", + "service": "ExpressRoute", "services": [ - "ASR", - "SAP", - "Monitor", - "WAF" + "VPN", + "VNet", + "ExpressRoute" ], - "severity": "Medium", - "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", - "waf": "Reliability" + "severity": "High", + "subcategory": "Segmentation", + "text": "Use at least a /27 prefix for your Gateway subnets", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", + "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", + "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", + "service": "NSG", "services": [ - "Storage", - "SAP", - "WAF" + "VNet" ], "severity": "Medium", - "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.", - "waf": "Performance" + "subcategory": "Segmentation", + "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "c027f893-f404-41a9-b33d-39d625a14964", - "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", "services": [ - "SAP", - "WAF" + "VNet" ], - "severity": "Low", - "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Segmentation", + "text": "Delegate subnet creation to the landing zone owner.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", + "service": "NSG", "services": [ - "Storage", - "SAP", - "WAF" + "VNet", + "ACR" ], "severity": "Medium", - "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.", - "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", - "waf": "Performance" + "subcategory": "Segmentation", + "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", + "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", + "service": "NSG", "services": [ - "SQL", - "SAP", - "WAF" + "VNet", + "VM" ], "severity": "Medium", - "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.", - "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", - "waf": "Performance" + "subcategory": "Segmentation", + "text": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "services": [ - "ASR", - "SAP", - "Monitor", - "WAF" + "VNet", + "Entra", + "NVA" ], - "severity": "High", - "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", - "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Segmentation", + "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "dfe237de-143b-416c-91d7-aa9b64704489", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "services": [ - "AzurePolicy", - "AppGW", - "WAF" + "VNet", + "NetworkWatcher" ], "severity": "Medium", - "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", + "subcategory": "Segmentation", + "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", + "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "NSG", "services": [ - "VM", - "DNS", - "SAP", - "WAF" + "VNet" ], "severity": "Medium", - "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", - "waf": "Operations" + "subcategory": "Segmentation", + "text": "Consider the limit of NSG rules per NSG (1000).", + "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", + "service": "VWAN", "services": [ - "VNet", - "DNS", - "SAP", - "WAF" + "VWAN" ], "severity": "Medium", - "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "subcategory": "Virtual WAN", + "text": "Consider Virtual WAN for simplified Azure networking management, and make sure your scenario is explicitly described in the list of Virtual WAN routing designs", + "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "a3592829-e6e2-4061-9368-6af46791f893", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "services": [ - "SAP", - "VNet", "ACR", - "WAF" + "VWAN" ], "severity": "Medium", - "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions", - "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", - "waf": "Reliability" + "subcategory": "Virtual WAN", + "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "services": [ - "NVA", - "SAP", - "WAF" + "ACR", + "VWAN" ], - "severity": "High", - "text": "It is not supported to deploy any NVA between SAP application and SAP Database server", - "training": "https://me.sap.com/notes/2731110", + "severity": "Low", + "subcategory": "Virtual WAN", + "text": "Follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network", "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", - "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", + "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "services": [ - "SAP", "VWAN", - "ACR", - "WAF" + "Firewall" ], "severity": "Medium", - "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", - "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "waf": "Operations" + "subcategory": "Virtual WAN", + "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "VWAN", "services": [ - "VNet", - "NVA", - "WAF" + "VWAN" ], "severity": "Medium", - "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.", - "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", - "waf": "Operations" + "subcategory": "Virtual WAN", + "text": "Ensure that the network architecture is within the Azure Virtual WAN limits.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", - "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", + "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", + "service": "VWAN", "services": [ - "VNet", - "SAP", - "VWAN", - "NVA", - "WAF" + "Monitor", + "VWAN" ], "severity": "Medium", - "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.", - "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", + "subcategory": "Virtual WAN", + "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "82734c88-6ba2-4802-8459-11475e39e530", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", + "service": "VWAN", "services": [ - "VM", - "SAP", - "WAF" + "VWAN" ], - "severity": "High", - "text": "Public IP assignment to VM running SAP Workload is not recommended.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", - "waf": "Security" + "severity": "Medium", + "subcategory": "Virtual WAN", + "text": "Make sure that your IaC deployments does not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", - "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", + "service": "VWAN", "services": [ - "ASR", - "WAF" + "VPN", + "ExpressRoute", + "VWAN" ], - "severity": "High", - "text": "Consider reserving IP address on DR side when configuring ASR", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Virtual WAN", + "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", + "service": "VWAN", "services": [ - "WAF" + "VWAN" ], - "severity": "High", - "text": "Avoid using overlapping IP address ranges for production and DR sites.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Virtual WAN", + "text": "Make sure that your IaC deployments are configuring label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "6e154e3a-a359-4282-ae6e-206173686af4", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", - "service": "SAP", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Landing Zone Review", + "guid": "9c75dfef-573c-461c-a698-68598595581a", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", + "service": "VWAN", "services": [ - "VNet", - "Storage", - "WAF" + "VWAN" ], - "severity": "Medium", - "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.", - "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", - "waf": "Operations" + "severity": "High", + "subcategory": "Virtual WAN", + "text": "Assign enough IP space to virtual hubs, ideally a /23 prefix.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", - "service": "SAP", + "ammp": true, + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "Firewall", - "WAF" + "AzurePolicy" ], - "severity": "Medium", - "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", - "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", + "severity": "High", + "subcategory": "Governance", + "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", - "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "AppGW", - "SAP", - "WAF" + "RBAC", + "AzurePolicy" ], "severity": "Medium", - "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", + "subcategory": "Governance", + "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "223ace8c-b123-408c-a501-7f154e3ab369", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "FrontDoor", - "AzurePolicy", - "ACR", - "WAF" + "Subscriptions", + "AzurePolicy" ], "severity": "Medium", - "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", - "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", + "subcategory": "Governance", + "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "3829e7e3-1618-4368-9a04-77a209945bda", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "FrontDoor", - "AzurePolicy", - "AppGW", - "WAF" + "AzurePolicy" ], "severity": "Medium", - "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", + "subcategory": "Governance", + "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "5ada4332-4e13-4811-9231-81aa41742694", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "43334f24-9116-4341-a2ba-527526944008", + "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", + "service": "Policy", "services": [ - "LoadBalancer", - "AppGW", - "WAF" + "Subscriptions", + "AzurePolicy" ], - "severity": "Medium", - "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", + "severity": "Low", + "subcategory": "Governance", + "text": "Use Azure Policy to control which services users can provision at the subscription/management group level", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "SAP", - "VWAN", - "ACR", - "WAF" + "AzurePolicy" ], "severity": "Medium", - "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", - "waf": "Performance" + "subcategory": "Governance", + "text": "Use built-in policies where possible to minimize operational overhead.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.", + "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", + "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", + "service": "Policy", "services": [ - "VNet", - "Backup", - "PrivateLink", - "Storage", - "ACR", - "WAF" + "Entra", + "RBAC", + "Subscriptions", + "AzurePolicy" ], "severity": "Medium", - "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.", - "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", + "subcategory": "Governance", + "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", - "service": "SAP", - "services": [ - "VM", - "SAP", - "WAF" - ], - "severity": "High", - "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", - "waf": "Performance" - }, - { - "checklist": "WAF checklist", - "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "19048384-5c98-46cb-8913-156a12476e49", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "LoadBalancer", - "WAF" + "Subscriptions", + "AzurePolicy" ], "severity": "Medium", - "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.", - "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "subcategory": "Governance", + "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "6791f893-5ada-4433-84e1-3811523181aa", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", + "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", + "service": "Policy", "services": [ - "VNet", - "VM", - "SAP", - "WAF" + "AzurePolicy" ], "severity": "Medium", - "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.", - "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", + "subcategory": "Governance", + "text": "If any data sovereignty requirements exist, Azure Policies can be deployed to enforce them", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", + "service": "Policy", "services": [ - "VNet", - "SAP", - "WAF" + "AzurePolicy" ], - "severity": "High", - "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Governance", + "text": "For Sovereign Landing Zone, sovereignty policy baseline' policy initiative is deployed and and assigned at correct MG level.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "fa96c96a-d885-418f-9827-34c886ba2802", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", + "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", + "service": "Policy", "services": [ - "SAP", - "WAF" + "AzurePolicy" ], "severity": "Medium", - "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.", - "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", - "waf": "Performance" + "subcategory": "Governance", + "text": "For Sovereign Landing Zone, sovereign Control objectives to policy mapping' is documented.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", + "service": "Policy", "services": [ - "SAP", - "WAF" + "AzurePolicy" ], - "severity": "High", - "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Governance", + "text": "For Sovereign Landing Zone, process is in place for CRUD of 'Sovereign Control objectives to policy mapping'.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "category": "Governance", + "checklist": "Azure Landing Zone Review", + "guid": "29fd366b-a180-452b-9bd7-954b7700c667", + "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json", "services": [ - "Cost", - "VNet", - "SAP", - "WAF" + "TrafficManager", + "Monitor", + "Cost" ], - "severity": "High", - "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "severity": "Medium", + "subcategory": "Optimize your cloud investment", + "text": "Configure 'Actual' and 'Forecasted' Budget Alerts.", "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "402a9846-d515-4061-aff8-cd30088693fa", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "services": [ - "LoadBalancer", - "WAF" + "Entra", + "RBAC", + "AzurePolicy", + "Monitor" ], - "severity": "High", - "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.", + "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "87585797-5551-4d53-bb7d-a94ee415734d", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Monitor", "services": [ - "VNet", - "SAP", - "WAF" + "Storage", + "ARS", + "AzurePolicy", + "Monitor" ], "severity": "Medium", - "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", + "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", + "service": "VM", "services": [ - "Backup", "VM", - "SAP", - "WAF" - ], - "severity": "High", - "text": "Review SAP HANA database backups for Azure VMs.", - "waf": "Cost" - }, - { - "checklist": "WAF checklist", - "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", - "services": [ - "ASR", - "SAP", "Monitor", - "WAF" + "AzurePolicy" ], "severity": "Medium", - "text": "Review Site Recovery built-in monitoring, where used for SAP.", - "waf": "Cost" + "subcategory": "Monitoring", + "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", - "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "services": [ - "SAP", - "Monitor", - "WAF" + "VM" ], - "severity": "High", - "text": "Review the Monitoring the SAP HANA System Landscape guidance.", + "severity": "Medium", + "subcategory": "Operational compliance", + "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "services": [ - "Backup", - "VM", - "WAF" + "VM" ], "severity": "Medium", - "text": "Review Oracle Database in Azure Linux VM backup strategies.", + "subcategory": "Operational compliance", + "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", - "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "90483845-c986-4cb2-a131-56a12476e49f", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Network Watcher", "services": [ - "SQL", - "Storage", - "WAF" + "Monitor", + "NetworkWatcher" ], "severity": "Medium", - "text": "Review the use of Azure Blob Storage with SQL Server 2016.", + "subcategory": "Monitoring", + "text": "Use Network Watcher to proactively monitor traffic flows", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "541acdce-9793-477b-adb3-751ab2ab13ad", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", "services": [ - "Backup", - "VM", - "WAF" + "Monitor" ], "severity": "Medium", - "text": "Review the use of Automated Backup v2 for Azure VMs.", + "subcategory": "Monitoring", + "text": "Use resource locks to prevent accidental deletion of critical shared services.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "WAF" + "RBAC", + "AzurePolicy", + "Monitor" ], - "severity": "High", - "text": "Enabling Write accelerator for M series when using premium disks(V1)", + "severity": "Low", + "subcategory": "Monitoring", + "text": "Use deny policies to supplement Azure role assignments. The combination of deny policies and Azure role assignments ensures the appropriate guardrails are in place to enforce who can deploy and configure resources and what resources they can deploy and configure.", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154", + "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", "services": [ - "WAF" + "Monitor" ], "severity": "Medium", - "text": "Test availability zone latency.", - "waf": "Performance" + "subcategory": "Monitoring", + "text": "Include service and resource health events as part of the overall platform monitoring solution. Tracking service and resource health from the platform perspective is an important component of resource management in Azure.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", - "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", "services": [ - "SAP", - "WAF" + "Monitor" ], "severity": "Medium", - "text": "Activate SAP EarlyWatch Alert for all SAP components.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", - "waf": "Performance" + "subcategory": "Monitoring", + "text": "Include alerts and action groups as part of the Azure Service Health platform to ensure that alerts or issues can be actioned", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "e3ab3693-829e-47e3-8618-3687a0477a20", + "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", "services": [ - "SAP", - "WAF" + "Monitor" ], "severity": "Medium", - "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.", - "training": "https://me.sap.com/notes/0002879613", - "waf": "Performance" + "subcategory": "Monitoring", + "text": "Don't send raw log entries back to on-premises monitoring systems. Instead, adopt a principle that data born in Azure stays in Azure. If on-premises SIEM integration is required, then send critical alerts instead of logs.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Monitor", "services": [ - "SQL", - "Monitor", - "WAF" + "Monitor" ], "severity": "Medium", - "text": "Review SQL Server performance monitoring using CCMS.", - "waf": "Performance" + "subcategory": "Monitoring", + "text": "Use Azure Monitor Logs for insights and reporting.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", - "link": "https://me.sap.com/notes/500235", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "619e8a13-f988-4795-85d6-26886d70ba6c", + "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview", "services": [ - "VM", - "SAP", - "WAF" + "Storage", + "Monitor" ], "severity": "Medium", - "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).", - "training": "https://me.sap.com/notes/1100926/E", - "waf": "Performance" + "subcategory": "Monitoring", + "text": "When necessary, use shared storage accounts within the landing zone for Azure diagnostic extension log storage.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", - "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "97be9951-9048-4384-9c98-6cb2913156a1", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", + "service": "Monitor", "services": [ - "SAP", - "Monitor", - "WAF" + "Monitor" ], "severity": "Medium", - "text": "Review SAP HANA studio alerts.", - "waf": "Performance" + "subcategory": "Monitoring", + "text": "Use Azure Monitor alerts for the generation of operational alerts.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", - "link": "https://me.sap.com/notes/1969700", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "859c3900-4514-41eb-b010-475d695abd74", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", "services": [ - "SAP", - "WAF" + "Monitor" ], "severity": "Medium", - "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.", - "waf": "Performance" + "subcategory": "Monitoring", + "text": "Ensure that monitoring requirements have been assessed and that appropriate data collection and alerting configurations are applied", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "Monitor", "services": [ - "VM", - "WAF" + "Monitor" ], "severity": "Medium", - "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.", - "training": "https://learn.microsoft.com/azure/automation/update-management/overview", - "waf": "Security" + "subcategory": "Monitoring", + "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "08951710-79a2-492a-adbc-06d7a401545b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "aa45be6a-8f2d-4896-b0e3-775e6e94e610", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-monitor", "services": [ - "SAP", - "WAF" + "Monitor", + "AzurePolicy" ], "severity": "Medium", - "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.", - "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Establish monitoring for platform components of your landing zone, AMBA is a framework solution that is available and provides an easy way to scale alerting by using Azure Policy", + "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", - "services": [ - "SQL", - "SAP", - "WAF" - ], - "severity": "Low", - "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.", - "waf": "Security" + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "services": [], + "severity": "Medium", + "subcategory": "Data Protection", + "text": "Consider cross-region replication in Azure for BCDR with paired regions", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Backup", "services": [ - "SQL", - "WAF" + "Backup" ], - "severity": "High", - "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.", - "training": "https://me.sap.com/notes/3019299/E", - "waf": "Security" + "severity": "Medium", + "subcategory": "Data Protection", + "text": "When using Azure Backup, consider the different backup types (GRS, ZRS & LRS) as the default setting is GRS", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "VM", "services": [ - "SAP", - "Backup", - "SQL", - "Storage", - "WAF" + "VM", + "AzurePolicy" ], - "severity": "High", - "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "severity": "Medium", + "subcategory": "Operational compliance", + "text": "Use Azure policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "description": "Azure Policy's guest configuration features can audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.", + "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "VM", "services": [ - "Storage", - "WAF" + "VM", + "Monitor", + "AzurePolicy" ], "severity": "Medium", - "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.", - "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", + "subcategory": "Operational compliance", + "text": "Monitor VM security configuration drift via Azure Policy.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", "services": [ - "AKV", - "WAF" + "ASR", + "ACR", + "VM" ], - "severity": "High", - "text": "Use Azure Key Vault to store your secrets and credentials", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", - "waf": "Security" + "severity": "Medium", + "subcategory": "Protect and Recover", + "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "829e2edb-2173-4676-aff6-691b4935ada4", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", "services": [ - "RBAC", - "AzurePolicy", - "Subscriptions", - "WAF" + "ASR" ], "severity": "Medium", - "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).", - "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", - "waf": "Security" + "subcategory": "Protect and Recover", + "text": "Ensure to use and test native PaaS service disaster recovery capabilities.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "Backup", "services": [ - "AzurePolicy", - "AKV", - "WAF" + "Backup" ], "severity": "Medium", - "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", - "waf": "Security" + "subcategory": "Protect and Recover", + "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", - "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", - "service": "SAP", + "ammp": true, + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", "services": [ - "RBAC", - "AzurePolicy", - "WAF" + "VM" ], "severity": "High", - "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed", - "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", - "waf": "Security" + "subcategory": "Fault Tolerance", + "text": "Leverage Availability Zones for your VMs in regions where they are supported.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "ammp": true, + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", "services": [ - "Defender", - "Storage", - "SAP", - "WAF" + "VM" ], "severity": "High", - "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", - "waf": "Security" + "subcategory": "Fault Tolerance", + "text": "Avoid running a production workload on a single VM.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "84101f59-1941-4195-a270-e28034290e3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", "services": [ - "Defender", - "RBAC", - "SAP", - "WAF" + "ACR", + "LoadBalancer", + "AppGW" ], - "severity": "High", - "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.", - "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", - "waf": "Security" + "severity": "Medium", + "subcategory": "Fault Tolerance", + "text": "Azure Load Balancer and Application Gateway distribute incoming network traffic across multiple resources.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "ammp": true, + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "WAF", "services": [ - "SAP", - "WAF" + "FrontDoor", + "WAF", + "AppGW" ], - "severity": "Low", - "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS", - "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", - "waf": "Security" + "severity": "High", + "subcategory": "App delivery", + "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", - "service": "SAP", + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "7f408960-c626-44cb-a018-347c8d790cdf", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "WAF", "services": [ - "AKV", - "WAF" + "AppGW", + "FrontDoor", + "WAF", + "Sentinel" ], "severity": "Medium", - "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "subcategory": "App delivery", + "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.", + "waf": "Operations" + }, + { + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "b86ad884-08e3-4727-94b8-75ba18f20459", + "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response", + "services": [], + "severity": "Medium", + "subcategory": "Access control", + "text": "Determine the incident response plan for Azure services before allowing it into production.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "4935ada4-2223-4ece-a1b1-23181a541741", - "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", - "service": "SAP", - "services": [ - "AKV", - "WAF" - ], - "severity": "High", - "text": "Use an Azure Key Vault per application per environment per region.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "01365d38-e43f-49cc-ad86-8266abca264f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/security-zero-trust", + "services": [], + "severity": "Medium", + "subcategory": "Access control", + "text": "Implement a zero-trust approach for access to the Azure platform, where appropriate.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", - "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", - "service": "SAP", + "ammp": true, + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "5017f154-e3ab-4369-9829-e7e316183687", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "Key Vault", "services": [ - "AKV", - "SAP", - "WAF" + "AKV" ], "severity": "High", - "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.", - "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", + "subcategory": "Encryption and keys", + "text": "Use Azure Key Vault to store your secrets and credentials", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "209d490d-a477-4784-84d1-16785d2fa56c", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", - "service": "SAP", - "services": [ - "RBAC", - "SAP", - "Subscriptions", - "WAF" + "category": "Security", + "checklist": "Azure Landing Zone Review", + "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", + "guid": "a0477a20-9945-4bda-9333-4f2491163418", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", + "service": "Key Vault", + "services": [ + "AKV" ], - "severity": "High", - "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes", - "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", - "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", - "service": "SAP", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "PrivateLink", - "NVA", - "SAP", - "WAF" + "AKV", + "AzurePolicy" ], - "severity": "High", - "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources", - "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", - "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", - "service": "SAP", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "dc055bcf-619e-48a1-9f98-879525d62688", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "VM", - "Storage", - "WAF" + "Entra", + "RBAC", + "AKV" ], - "severity": "Low", - "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.", - "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", - "service": "SAP", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "Defender", - "WAF" + "AKV" ], - "severity": "Low", - "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.", - "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "913156a1-2476-4e49-b541-acdce979377b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "VNet", - "SAP", - "WAF" + "AKV" ], - "severity": "High", - "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "Establish an automated process for key and certificate rotation.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "SAP", - "WAF" + "VNet", + "AKV", + "PrivateLink" ], - "severity": "Low", - "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.", - "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", - "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", - "service": "SAP", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", + "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", + "service": "Key Vault", "services": [ - "SAP", - "AKV", + "Entra", "Monitor", - "WAF" + "AKV" ], "severity": "Medium", - "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "subcategory": "Encryption and keys", + "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "af416482-663c-4ed6-b195-b44c7068e09c", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support", - "service": "Container Apps", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "WAF" + "AKV", + "AzurePolicy" ], - "severity": "High", - "text": "Leverage Availability Zones if regionally applicable", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment", - "service": "Container Apps", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "16183687-a047-47a2-8994-5bda43334f24", + "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest", "services": [ - "WAF" + "AKV" ], - "severity": "High", - "text": "Use more than one replica and enable Zone Redundancy.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", - "service": "Container Apps", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "91163418-2ba5-4275-8694-4008be7d7e48", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "WAF" + "AKV" ], - "severity": "High", - "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "Use an Azure Key Vault per application per environment per region.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", - "service": "Container Apps", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "25d62688-6d70-4ba6-a97b-e99519048384", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "FrontDoor", - "TrafficManager", - "WAF" + "ASR", + "ACR", + "AKV" ], - "severity": "High", - "text": "Use Front Door or Traffic Manager to route traffic to the closest region", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "0e03f5ee-4648-423c-bb86-7239480f9171", - "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", - "service": "Device Update for IoT Hub", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", + "link": "https://learn.microsoft.com/industry/sovereignty/key-management", + "service": "Key Vault", "services": [ - "WAF" + "AKV" ], - "severity": "High", - "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Encryption and keys", + "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55", - "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", - "service": "Device Update for IoT Hub", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", + "service": "Entra", "services": [ - "WAF" + "Entra" ], - "severity": "High", - "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Operations", + "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Device Update for IoT Hub", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal", "services": [ - "WAF" + "Storage", + "ARS", + "Monitor" ], - "severity": "High", - "text": "Consider a Cross-Region DR strategy for critical workloads", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Operations", + "text": "Export Azure activity logs to Azure Monitor Logs for long-term data retention. Export to Azure Storage for long-term storage beyond two years, if necessary.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Device Update for IoT Hub", + "ammp": true, + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "09945bda-4333-44f2-9911-634182ba5275", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", + "service": "Defender", "services": [ - "AppSvc", - "WAF" + "Subscriptions", + "Defender" ], "severity": "High", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", - "waf": "Reliability" - }, - { - "checklist": "WAF checklist", - "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Front Door", - "services": [ - "FrontDoor", - "AKV", - "WAF" - ], - "severity": "Medium", - "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal", - "waf": "Operations" + "subcategory": "Operations", + "text": "Enable Defender Cloud Security Posture Management for all subscriptions.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", - "guid": "553585a6-abe0-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "App Gateway", + "ammp": true, + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", + "service": "Defender", "services": [ - "AppGW", - "WAF" + "Subscriptions", + "Defender" ], - "severity": "Medium", - "text": "Ensure you are using Application Gateway v2 SKU", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "severity": "High", + "subcategory": "Operations", + "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.", "waf": "Security" }, { - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", - "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Load Balancer", + "ammp": true, + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", + "service": "Defender", "services": [ - "LoadBalancer", - "WAF" + "Subscriptions", + "Defender" ], - "severity": "Medium", - "text": "Ensure you are using the Standard SKU for your Azure Load Balancers", + "severity": "High", + "subcategory": "Operations", + "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "9432621a-8397-4654-a882-5bc856b7ef83", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", - "service": "Load Balancer", - "services": [ - "LoadBalancer", - "WAF" - ], - "severity": "Medium", - "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).", + "ammp": true, + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", + "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", + "service": "VM", + "services": [], + "severity": "High", + "subcategory": "Operations", + "text": "Enable Endpoint Protection on IaaS Servers.", "waf": "Security" }, { - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", - "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "App Gateway", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", + "link": "https://learn.microsoft.com/azure/security-center/", + "service": "VM", "services": [ - "VNet", - "AppGW", - "WAF" + "Monitor", + "Defender" ], "severity": "Medium", - "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "subcategory": "Operations", + "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.", - "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "services": [ - "VNet", - "Subscriptions", "Entra", - "NVA", - "AppGW", - "WAF" + "Monitor" ], "severity": "Medium", - "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "subcategory": "Operations", + "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", + "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", + "service": "Entra", "services": [ - "DDoS", - "WAF" + "Entra" ], "severity": "Medium", - "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "subcategory": "Operations", + "text": "For Sovereign Landing Zone, transparancy logs is enabled on the Entra ID tenant.", "waf": "Security" }, { - "checklist": "WAF checklist", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", - "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", - "service": "App Gateway", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", + "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", + "service": "Entra", "services": [ - "WAF" + "Entra" ], "severity": "Medium", - "text": "Configure autoscaling with a minimum amount of instances of two.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Reliability" + "subcategory": "Operations", + "text": "For Sovereign Landing Zone, customer Lockbox is enabled on the Entra ID tenant.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", - "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", - "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", - "service": "App Gateway", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "874a748b-662d-46d1-9051-2a66498f6dfe", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/security", "services": [ - "AppGW", - "ACR", - "WAF" + "Monitor" ], - "severity": "Medium", - "text": "Deploy Application Gateway across Availability Zones", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Operations", + "text": "Use an Azure Event Grid-based solution for log-oriented, real-time alerts", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Front Door", + "ammp": true, + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Storage", "services": [ - "FrontDoor", - "AzurePolicy", - "WAF" + "Storage" ], - "severity": "Medium", - "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "severity": "High", + "subcategory": "Overview", + "text": "Secure transfer to storage accounts should be enabled", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "3f29812b-2363-4cef-b179-b599de0d5973", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "Front Door", + "ammp": true, + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", + "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", + "service": "Storage", "services": [ - "FrontDoor", - "AzurePolicy", - "AppGW", - "WAF" + "Storage" ], - "severity": "Medium", - "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "severity": "High", + "subcategory": "Overview", + "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.", "waf": "Security" }, { "ammp": true, - "arm-service": "microsoft.network/trafficManagerProfiles", - "checklist": "WAF checklist", - "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Traffic Manager", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "6f704104-85c1-441f-96d3-c9819911645e", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning", "services": [ - "TrafficManager", - "WAF" + "Entra" ], "severity": "High", - "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Reliability" + "subcategory": "Secure privileged access", + "text": "Separate privileged admin accounts for Azure administrative tasks.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", - "services": [ - "Entra", - "AVD", - "WAF" - ], - "severity": "Low", - "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework", + "services": [], + "severity": "Medium", + "subcategory": "Service enablement framework", + "text": "Plan how new azure services will be implemented", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", - "services": [ - "Entra", - "WAF" - ], + "category": "Security", + "checklist": "Azure Landing Zone Review", + "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework", + "services": [], "severity": "Medium", - "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "subcategory": "Service enablement framework", + "text": "Plan how service request will be fulfilled for Azure services", "waf": "Security" }, { "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "ae248989-b306-4591-9186-de482e3f0f0e", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "Front Door", - "services": [ - "FrontDoor", - "AzurePolicy", - "WAF" - ], + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "e85f4226-bf06-4e35-8a8b-7aee4d2d633a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/platform-automation-devops", + "services": [], "severity": "High", - "text": "Deploy your WAF policy for Front Door in 'Prevention' mode.", - "waf": "Security" + "subcategory": "DevOps Team Topologies", + "text": "Ensure you have a cross functional DevOps Platform Team to build, manage and maintain your Azure Landing Zone architecture.", + "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "Front Door", + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "634146bf-7085-4419-a7b5-f96d2726f6da", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations", + "services": [], + "severity": "Low", + "subcategory": "DevOps Team Topologies", + "text": "Aim to define functions for Azure Landing Zone Platform team.", + "waf": "Operations" + }, + { + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "a9e65070-c59e-4112-8bf6-c11364d4a2a5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations", "services": [ - "FrontDoor", - "TrafficManager", - "WAF" + "RBAC" ], - "severity": "High", - "text": "Avoid combining Azure Traffic Manager and Azure Front Door.", - "waf": "Security" + "severity": "Low", + "subcategory": "DevOps Team Topologies", + "text": "Aim to define functions for application workload teams to be self-sufficient and not require DevOps Platform Team support. Achieve this through the use of custom RBAC role.", + "waf": "Operations" }, { "ammp": true, - "checklist": "WAF checklist", - "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "165eb5e9-b434-448a-9e24-178632186212", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code", + "services": [], "severity": "High", - "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.", - "waf": "Security" + "subcategory": "DevOps Team Topologies", + "text": "Use a CI/CD pipeline to deploy IaC artifacts and ensure the quality of your deployment and Azure environments.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", - "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], - "severity": "Low", - "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.", - "waf": "Performance" + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "0cadb8c7-8fa5-4fbf-8f39-d1fadb3b0460", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", + "services": [], + "severity": "Medium", + "subcategory": "DevOps Team Topologies", + "text": "Include unit tests for IaC and application code as part of your build process.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "Front Door", + "ammp": true, + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", + "service": "Key Vault", "services": [ - "FrontDoor", - "WAF" + "VM", + "AKV" ], - "severity": "Medium", - "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.", - "waf": "Reliability" + "severity": "High", + "subcategory": "DevOps Team Topologies", + "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", - "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "Front Door", + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "a52e0c98-76b9-4a09-a1c9-6b2babf22ac4", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/subscription-vending", "services": [ - "FrontDoor", - "WAF" + "Subscriptions" ], "severity": "Low", - "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.", - "waf": "Performance" + "subcategory": "DevOps Team Topologies", + "text": "Implement automation for new landing zone for applications and workloads through subscription vending", + "waf": "Operations" }, { "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", - "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "Load Balancer", - "services": [ - "LoadBalancer", - "WAF" - ], + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "cfe363b5-f579-4284-bc56-a42153e4c10b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code", + "services": [], "severity": "High", - "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability", - "waf": "Reliability" + "subcategory": "Development Lifecycle", + "text": "Ensure a version control system is used for source code of applications and IaC developed. Microsoft recommends Git.", + "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", - "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "Front Door", - "services": [ - "FrontDoor", - "AKV", - "Cost", - "WAF" - ], - "severity": "High", - "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.", + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "c7245dd4-af8a-403a-8bb7-890c1a7cfa9d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle", + "services": [], + "severity": "Low", + "subcategory": "Development Lifecycle", + "text": "Follow a branching strategy to allow teams to collaborate better and efficiently manage version control of IaC and application Code. Review options such as Github Flow.", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "12aeea20-9165-4b3e-bdf2-6795fcd3cdbe", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle", + "services": [], "severity": "Medium", - "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", + "subcategory": "Development Lifecycle", + "text": "Adopt a pull request strategy to help keep control of code changes merged into branches.", "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], - "severity": "High", - "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.", - "waf": "Security" - }, - { - "checklist": "WAF checklist", - "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "2676ae46-65ca-444e-8695-fdddeace4cb1", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-platform", + "services": [], "severity": "Medium", - "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.", - "waf": "Security" + "subcategory": "Development Lifecycle", + "text": "Establish a process for using code to implement quick fixes. Always register quick fixes in your team's backlog so each fix can be reworked at a later point, and you can limit technical debt.", + "waf": "Operations" }, { "ammp": true, - "checklist": "WAF checklist", - "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "2cdc9d99-dbcc-4ad4-97f5-e7d358bdfa73", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code", + "services": [], "severity": "High", - "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.", - "waf": "Security" + "subcategory": "Development Strategy", + "text": "Leverage Declarative Infrastructure as Code Tools such as Azure Bicep, ARM Templates or Terraform to build and maintain your Azure Landing Zone architecture. Both from a Platform and Application workload perspective.", + "waf": "Operations" }, { "ammp": true, - "checklist": "WAF checklist", - "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], + "category": "Platform Automation and DevOps", + "checklist": "Azure Landing Zone Review", + "guid": "cc87a3bc-c572-4ad2-92ed-8cabab66160f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/landing-zone-security#secure", + "services": [], "severity": "High", - "text": "Tune the Azure Front Door WAF for your workload. Reduce false positive detections.", - "waf": "Security" + "subcategory": "Security", + "text": "Integrate security into the already combined process of development and operations in DevOps to mitigate risks in the innovation process.", + "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "Front Door", - "services": [ - "FrontDoor", - "AzurePolicy", - "WAF" - ], + "category": "Operations Management", + "checklist": "Recovery Services Vault Checklist", + "guid": "cb7da8cf-aa62-4a15-a495-6da97dc3a242", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-plan-capacity-vmware", + "services": [], "severity": "High", - "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.", - "waf": "Security" + "subcategory": "Replication", + "text": "Capacity planning is required to make sure you have sufficient bandwidth for replication and an estimated number of CPU cores & disk types that will be needed in Azure for failover", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", - "service": "Front Door", + "category": "Operations Management", + "checklist": "Recovery Services Vault Checklist", + "guid": "67b23587-05a1-4652-aded-fa8a488cdec4", + "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-policy", "services": [ - "FrontDoor", - "WAF" + "ASR", + "VM", + "AzurePolicy" ], "severity": "High", - "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.", - "waf": "Security" + "subcategory": "Replication", + "text": "Use Azure Policy to ensure that all critical Azure VMs are protected with ASR", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", - "service": "Front Door", + "category": "Operations Management", + "checklist": "Recovery Services Vault Checklist", + "guid": "862bc3bc-14be-4b7f-96e8-d9b3bec228e7", + "link": "https://learn.microsoft.com/azure/site-recovery/recovery-plan-overview", "services": [ - "FrontDoor", - "WAF" + "VM" ], - "severity": "High", - "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.", - "waf": "Security" + "severity": "Medium", + "subcategory": "Replication", + "text": "Define recovery plans to automate the failover sequence for VMs. You can also include automation scripts to reduce manual steps and improve recovery time", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], + "category": "Operations Management", + "checklist": "Recovery Services Vault Checklist", + "guid": "437b1736-db55-4f67-a613-334bd09dc234", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-how-to-manage?tabs=recovery-services-vault", + "services": [], "severity": "Medium", - "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", - "waf": "Security" + "subcategory": "Data Protection", + "text": "Enable and LOCK immutability for vaults. This ensures recovery points cannot be deleted before their intended expiry", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "b9620385-1cde-418f-914b-a84a06982ffc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], + "category": "Operations Management", + "checklist": "Recovery Services Vault Checklist", + "guid": "19db6128-1265-404b-a47a-493a08042729", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about", + "services": [], "severity": "Medium", - "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", - "waf": "Security" + "subcategory": "Data Protection", + "text": "Enable 'Always-on soft delete' for vaults protecting critical workloads", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", - "service": "Front Door", + "category": "Operations Management", + "checklist": "Recovery Services Vault Checklist", + "guid": "4798b158-8b31-4aa5-9ceb-54445135a227", + "link": "https://learn.microsoft.com/azure/backup/backup-create-recovery-services-vault#set-storage-redundancy", "services": [ - "FrontDoor", - "WAF" + "Storage" ], "severity": "Medium", - "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", - "waf": "Security" + "subcategory": "Redudancy", + "text": "When creating Recovery Service Vaults choose the best storage redundancy option for your requirements. Vaults support local, geo and zone redundancy but this setting cannot be changed once the vault is protecting one or more resources", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", - "service": "Front Door", - "services": [ - "WAF" - ], - "severity": "Low", - "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", - "waf": "Security" + "category": "BC and DR", + "checklist": "Device Update Review", + "guid": "0e03f5ee-4648-423c-bb86-7239480f9171", + "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", + "service": "Device Update for IoT Hub", + "services": [], + "severity": "High", + "subcategory": "High Availability", + "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "00acd8a9-6975-414f-8491-2be6309893b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" - ], - "severity": "Medium", - "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", - "waf": "Security" + "category": "BC and DR", + "checklist": "Device Update Review", + "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55", + "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", + "service": "Device Update for IoT Hub", + "services": [], + "severity": "High", + "subcategory": "High Availability", + "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", - "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", - "service": "App Gateway", - "services": [ - "AppGW", - "WAF" - ], + "category": "BC and DR", + "checklist": "Device Update Review", + "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Device Update for IoT Hub", + "services": [], "severity": "High", - "text": "Enable the Azure Application Gateway WAF bot protection rule set The bot rules detect good and bad bots.", - "waf": "Security" + "subcategory": "High Availability", + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "App Gateway", + "category": "BC and DR", + "checklist": "Device Update Review", + "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Device Update for IoT Hub", "services": [ - "AzurePolicy", - "AppGW", - "WAF" + "AppSvc" ], "severity": "High", - "text": "Enable request body inspection feature enabled in Azure Application Gateway WAF policy.", - "waf": "Security" + "subcategory": "High Availability", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD control plane does not offer a financially backed service level agreement. We strive to attain at least 99.9% availability for the Azure Virtual Desktop service URLs. The availability of the session host virtual machines in your subscription is covered by the Virtual Machines SLA. Dependent resources/services and infrastructure availability must be also considered to properly satisfy global high-availability requirements.", + "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1", + "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/", "services": [ - "AppGW", - "WAF" + "ASR", + "Subscriptions", + "VM", + "AVD" ], "severity": "High", - "text": "Tune the Azure Application Gateway WAF for your workload. Reduce false positive detections.", - "waf": "Security" + "subcategory": "Compute", + "text": "Determine the expected High Availability SLA for applications/desktops published through AVD", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "'Active-Active' model can be achieved with multiple host pools in different regions. A single Host Pool with VMs from different regions is not recommended. If multiple pools for same users will be used, the problem of how to synchronize/replicate user profiles must be solved. FSLogix Cloud Cache could be used, but need to be carefully reviewed and planned, or customers can decide to do not synchronize/replicate at all. 'Active-Passive' can be achieved using Azure Site Recovery (ASR) or on-demand Pool deployment with automated mechanism. For a detailed discussion on multi-region BCDR, please read the companion article in the 'More Info' column and this FSLogix related page: https://learn.microsoft.com/fslogix/concepts-container-recovery-business-continuity.", + "guid": "6acc076e-f9b1-441a-a989-579e76b897e7", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/azure-virtual-desktop-multi-region-bcdr", "services": [ - "AzurePolicy", - "AppGW", - "WAF" + "ASR", + "Storage", + "VM", + "AVD" + ], + "severity": "Medium", + "subcategory": "Compute", + "text": "Assess Geo Disaster Recovery requirements for AVD Host Pools", + "waf": "Reliability" + }, + { + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "Before approaching Azure Virtual Desktop BCDR planning and design, it is important to initially consider which applications consumed through AVD are critical. You may want to separate them from non-critical apps and use a separate Host Pool with a different disaster recovery approach and capabilities.", + "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13", + "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", + "services": [ + "ASR", + "AVD" + ], + "severity": "Low", + "subcategory": "Compute", + "text": "Separate critical applications in different AVD Host Pools", + "waf": "Reliability" + }, + { + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "Each Host Pool can be deployed using Availability Zones (AZ) or Availability Set (AS). To maximize resiliency, usage of AZ is recommended: at Host Pool creation time you can decide to spread Host Pool Session Hosts across all available AZ. Usage of AS will not protect from single datacenter failure, then should be used only in regions where AZ are not available. More details on AZ and AVD in the companion article. For a comparison between AZ and AS you can read here: https://learn.microsoft.com/azure/virtual-machines/availability.", + "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb", + "link": "https://techcommunity.microsoft.com/t5/azure-virtual-desktop-blog/announcing-general-availability-of-support-for-azure/ba-p/3636262", + "services": [ + "ASR", + "ACR", + "AVD" ], "severity": "High", - "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.", - "waf": "Security" + "subcategory": "Compute", + "text": "Plan the best resiliency option for AVD Host Pool deployment", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "Azure Backup can be used to protect Host Pool VMs. For Pooled Pools, this is not necessary since should be stateless. Instead, this option can be considered for Personal Host Pools.", + "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e", + "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "AppGW", - "WAF" + "ASR", + "VM", + "Backup", + "AVD" ], "severity": "Medium", - "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", - "waf": "Security" + "subcategory": "Compute", + "text": "Assess the requirement to backup AVD Session Host VMs", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "Even for Personal Pools, usage of Availability Zones, when available, is recommended. Three possible in-region DR strategies are possible, it is recommended to select the best one based on cost, RTO/RPO, and if it is really necessary to save the entire VM OS disk: (1) create each session host in a specific zone (AZ) and then use Azure Site Recovery (ASR) to replicate to a different zone. (2) Use Azure Backup to backup and restore the specific session host in a different AZ. (3) Create a new session host in a different AZ and rely on FSLogix and/or OneDrive to make data and settings available on the new machine. All options require administrator intervention for DR and direct user assignment at Host Pool level, then must be planned and configured in advance.", + "guid": "5da58639-ca3a-4961-890b-29663c5e10d", + "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-zone-to-zone-disaster-recovery", "services": [ - "AppGW", - "WAF" + "Backup", + "Cost", + "ASR", + "VM", + "AVD" ], "severity": "Medium", - "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", - "waf": "Security" + "subcategory": "Compute", + "text": "Prepare a local DR strategy for Personal Host Pool Session Hosts", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "99937189-ff78-492a-b9ca-18d828d82b37", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "If custom images are used to deploy AVD Host Pool VMs, it is important to ensure those artifacts are available in all regions where AVD is deployed. Azure Compute Gallery service can be used to replicate images across all regions where a Host Pool is deployed, with redundant storage and in multiple copies. Please be aware that the Azure Compute Gallery service isn't a global resource. For disaster recovery scenarios, the best practice is to have at least two galleries, in different regions.", + "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141", + "link": "https://learn.microsoft.com/azure/virtual-machines/azure-compute-gallery", "services": [ - "WAF" + "Storage", + "ASR", + "ACR", + "VM", + "AVD" ], "severity": "Low", - "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", - "waf": "Security" + "subcategory": "Dependencies", + "text": "Plan for Golden Image cross-region availability", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "If users of the AVD infrastructure need on-premises resource access, high availability of network infrastructure required to connect is also critical and should be considered. Resiliency of authentication infrastructure needs to be assessed and evaluated. BCDR aspects for dependent applications and other resources need to be considered to ensure availability in the secondary DR location.", + "guid": "fd339489-8c12-488b-9c6a-57cfb644451e", + "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "AppGW", - "WAF" + "ASR", + "AVD" ], "severity": "Medium", - "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", - "waf": "Security" + "subcategory": "Dependencies", + "text": "Assess Infrastructure & Application dependencies ", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "Not all data inside FSLogix user profiles may deserve protection from disaster. Additionally, if external storage is used, for example OneDrive or File Servers/Shares, what is remaining in the FSLogix profile is minimal and could be lost in some extreme circumstances. In other cases, data inside the profile can be rebuilt from other storages (for example Outlook Inbox in cached mode).", + "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23", + "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt", "services": [ - "AppGW", - "WAF" + "Storage", + "ASR", + "AVD" ], "severity": "Medium", - "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", - "waf": "Security" + "subcategory": "Storage", + "text": "Assess which data need to be protected in the Profile and Office Containers", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "Preventing data loss for critical user data is important, first step is to assess which data need to be saved and protected. If using OneDrive or other external storage, saving user Profile and/or Office Containers data maybe not necessary. Appropriate mechanism must be considered to provide protection for critical user data. Azure Backup service can be used to protect Profile and Office Containers data when stored on Azure Files Standard and Premium tiers. Azure NetApp Files Snapshots and Policies can be used for Azure NetApp Files (all tiers).", + "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32", + "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "AppGW", - "WAF" + "Storage", + "Backup", + "ASR", + "AzurePolicy", + "AVD" ], "severity": "Medium", - "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.", - "waf": "Operations" + "subcategory": "Storage", + "text": "Build a backup protection strategy for Profile and Office Containers", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "Front Door", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "In AVD, multiple replication mechanisms and strategies can be used for user data residing in FSLogix containers: [Profile Pattern #1]: Native Azure storage replication mechanisms, for example Azure Files Standard GRS replication, Azure NetApp Files Cross Region Replication. Use Zone Replicated Storage (ZRS) or Geo replicated storage (GRS) for Azure Files is recommended. LRS with local-only resiliency can be used if no zone/region protection is required. NOTE: Azure Files Share Standard is LRS/ZRS/GRS, but with 100TB large support enabled only LRS/ZRS are supported. [Profile Pattern #2]: FSLogix Cloud Cache is built in automatic mechanism to replicate containers between different (up to 4) storage accounts. Cloud Cache should be used only when:(1) User Profile or Office containers data availability required high-availability SLA is critical and need to be resilient to region failure. (2) Selected storage option is not able to satisfy BCDR requirements. For example, with Azure File Share Premium tier, or Azure File Share Standard with Large File Support enabled, GRS is not available. (3) When replication between disparate storage is required. [Profile Pattern #3]: Only set up geo disaster recovery for application data and not for user data/profile containers: store important application data in separate storages, like OneDrive or other external storage with its own built-in DR mechanism.", + "guid": "9f7547c1-746d-4c56-868a-714435bd09dd", + "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "FrontDoor", - "WAF" + "Storage", + "ASR", + "AVD" ], "severity": "Medium", - "text": "Add diagnostic settings to save your Azure Front Door WAF logs.", - "waf": "Operations" + "subcategory": "Storage", + "text": "Assess Profile Container storage replication requirements and resiliency for BCDR purpose", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "92664c60-47e3-4591-8b1b-8d557656e686", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "For local disaster recovery, Azure Backup for Azure Files can be used. For cross-region geo disaster recovery: GRS for Azure Files is only available with standard SKU and no large share support, then not suitable in most customer scenarios. If geo-replication is required with Azure File Share Premium, replication with FSLogix Cloud Cache can be evaluated, or 'in-region' Availability Zone (AZ) only resiliency should be considered.", + "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05", + "link": "https://docs.microsoft.com/azure/backup/backup-afs", "services": [ - "Sentinel", - "AppGW", - "WAF" + "Storage", + "ASR", + "Backup", + "AVD" ], "severity": "Medium", - "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.", - "waf": "Operations" + "subcategory": "Storage", + "text": "Review Azure Files disaster recovery strategy", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "845f5f91-9c21-4674-a725-5ce890850e20", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "Front Door", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "Zone Redundant Storage will maximize in-region resiliency for the user profile data. ZRS is supported for premium file shares through the 'FileStorage' storage account kind. ZRS is supported in standard general-purpose v2 storage accounts. Usage of zone redundant storage must be paired with zone redundant deployment of Session Hosts in each Host Pool. ", + "guid": "10d4e875-d502-4142-a795-f2b6eff34f88", + "link": "https://learn.microsoft.com/azure/storage/files/files-redundancy#zone-redundant-storage", "services": [ - "FrontDoor", - "Sentinel", - "WAF" + "Storage", + "ASR", + "AVD" ], - "severity": "Medium", - "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.", - "waf": "Operations" + "severity": "High", + "subcategory": "Storage", + "text": "Use Zone Redundant Storage (ZRS) for Azure Files to maximize resiliency", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", - "service": "App Gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "Azure Virtual Desktop Review", + "description": "For local disaster recovery, Azure NetApp Files (ANF) native backup is available. ANF is essentially locally redundant, then for cross-region geo disaster recovery it is necessary to use an additional mechanism that is Cross-Region Replication (CRR) https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering. Currently, ANF does not provide replication nor redundancy across different Availability Zones (AZ), only the possibility to select in which single AZ to place the ANF volume: https://learn.microsoft.com/azure/azure-netapp-files/manage-availability-zone-volume-placement.", + "guid": "23429db7-2281-4376-85cc-57b4a4b18142", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering", "services": [ - "AppGW", - "WAF" + "Storage", + "Backup", + "ASR", + "ACR", + "AVD" ], "severity": "Medium", - "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", - "waf": "Operations" + "subcategory": "Storage", + "text": "Review Azure NetApp Files disaster recovery strategy", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "Applications can be preinstalled in the golden image/s, can be attached using MSIX & AppAttach feature or distributed to the session hosts after host pool deployment using traditional software distribution methods.", + "guid": "86ba2802-1459-4014-95d3-8e5309ccbd97", + "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image", "services": [ - "AzurePolicy", - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Use WAF Policies instead of the legacy WAF configuration.", + "severity": "High", + "subcategory": "Golden Images", + "text": "Determine how applications will be deployed in AVD Host Pools", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "Multiple golden images can be required to support different OS versions and/or settings, different groups of applications that must be separated and cannot be included in a single image.", + "guid": "9266bcca-274f-4aa1-abf3-9d95d44c7c89", + "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image", "services": [ - "VNet", - "ExpressRoute", - "VPN", - "AppGW", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.", - "waf": "Security" + "subcategory": "Golden Images", + "text": "Estimate the number of golden images that will be required", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", - "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", - "service": "Front Door", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "Determine which Guest OS will be used to deploy each Host Pool: Windows 10 vs. Windows Server, Marketplace vs. Custom images", + "guid": "19ca1f6d-5315-4ae5-84ba-34d4585e2213", + "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#operating-systems-and-licenses", "services": [ - "FrontDoor", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Make sure your origins only take traffic from your Azure Front Door instance.", - "waf": "Security" + "subcategory": "Golden Images", + "text": "Determine which OS image/s you will use for Host Pool deployment", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "Azure VM custom images can be created and stored in different ways: in an Azure Compute Gallery, as a managed image object or as a managed disk in the storage. The recommended way is to use Azure Compute Gallery.", + "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd", + "link": "https://learn.microsoft.com/azure/virtual-machines/shared-image-galleries", "services": [ - "WAF" + "Storage", + "VM", + "AVD" ], - "severity": "High", - "text": "You should encrypt traffic to the backend servers.", - "waf": "Security" + "severity": "Low", + "subcategory": "Golden Images", + "text": "Select the proper store for custom images", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "If custom images will be used, plan for an automated build process. If no pre-existing software factory exists, consider using Custom Image Templates and/or Azure Image Builder to automate the build process.", + "guid": "9bd7bb01-2f7b-495e-86e1-54e2aa359282", + "link": "https://learn.microsoft.com/azure/virtual-desktop/create-custom-image-templates", "services": [ - "WAF" + "AVD" ], - "severity": "High", - "text": "You should use a Web Application Firewall.", - "waf": "Security" + "severity": "Low", + "subcategory": "Golden Images", + "text": "Design your build process for custom images", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", - "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "There are some known best practices and recommendations for the golden image customization, be sure to check the referenced article.", + "guid": "deace4cb-1dec-44c6-90c3-fc14eebb36a3", + "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image", "services": [ - "WAF" + "AVD" ], "severity": "Medium", - "text": "Redirect HTTP to HTTPS", - "waf": "Security" + "subcategory": "Golden Images", + "text": "If custom image will be used, check recommended best practices for AVD on how to build custom image", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", - "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "FSLogix stack installed in AVD session hosts does not provide auto-update capability. For this reason, it is recommended to download the latest version of FSLogix and include in the golden image update process.", + "guid": "ed5c9027-dd1a-4343-86ca-52b199223186", + "link": "https://learn.microsoft.com/fslogix/how-to-install-fslogix", "services": [ - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing", - "waf": "Operations" + "severity": "High", + "subcategory": "Golden Images", + "text": "Include the latest version of FSLogix in the golden image update process", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "This tool-set has been created to automatically apply setting referenced in white paper 'Optimizing Windows 10, version 2004 for a Virtual Desktop Infrastructure (VDI) role': https://docs.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations-2004. Usage of the tool and/or optimizations mentioned in the white-paper should be considered. ", + "guid": "829e3fec-2183-4687-a017-7a2b5945bda4", + "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool", "services": [ - "WAF" + "RBAC", + "AVD" ], - "severity": "High", - "text": "Enable connection draining during planned service updates to prevent connection loss to existing membrs of the backend pool", - "waf": "Security" + "severity": "Low", + "subcategory": "Golden Images", + "text": "Evaluate the usage of Virtual-Desktop-Optimization-Tool", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", - "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "If OneDrive is used and included in a golden image, be sure to follow the configuration procedure reported in the companion article in the 'More Info' section. Not in scope in this AVD checklist, but OneDrive optimizations like 'Known Folder Redirection' and 'Files On-Demand' should be evaluated used to reduce the space used in FSLogix profiles and provide a better user experience. OneDrive today is not supported for Remote Apps.", + "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e", + "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image#install-onedrive-in-per-machine-mode", "services": [ - "WAF" + "Storage", + "AVD" ], "severity": "Low", - "text": "Create custom error pages to display a personalized user experience", + "subcategory": "Golden Images", + "text": "Determine if Microsoft OneDrive will be part of AVD deployment", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", - "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "Be sure to review the requirements and configuration procedure contained in the companion article in the 'More Info' column. Since Teams automatic updates will be disabled, it is recommended to check and include Teams latest version in the golden image update process.", + "guid": "b5887953-5d22-4788-9d30-b66c67be5951", + "link": "https://learn.microsoft.com/azure/virtual-desktop/teams-on-AVD", "services": [ - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server", - "waf": "Security" + "severity": "Low", + "subcategory": "Golden Images", + "text": "Determine if Microsoft Teams will be part of AVD deployment", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD can support users with different language and localization requirements in the same host pool. This can be done customizing golden images to ensure users can select whichever language they need. The procedure to configure additional language packs in Windows 11 is documented in the reference article.", + "guid": "7c336f3b-822a-498e-8cd1-667d1150df4a", + "link": "https://learn.microsoft.com/azure/virtual-desktop/windows-11-language-packs", "services": [ - "FrontDoor", - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover", - "waf": "Performance" + "severity": "Low", + "subcategory": "Golden Images", + "text": "Assess the requirement to support multiple languages", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "29dcc19f-a8fa-4c35-8281-290577538793", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "It is highly recommended to use separate storage accounts/shares to store MSIX packages. If necessary, storage can scale out independently and not being impacted by profile I/O activities. Azure offers multiple storage options that can be used for MISX app attach. We recommend using Azure Files or Azure NetApp Files as those options offer the best value between cost and management overhead. ", + "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f", + "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share", "services": [ - "WAF" + "Storage", + "Cost", + "AVD" ], "severity": "Medium", - "text": "Use transport layer load balancing", + "subcategory": "MSIX & AppAttach", + "text": "Do not use the same storage account/share as FSLogix profiles", "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", - "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "In the referenced article, we reported few but important performance considerations for MSIX usage in AVD context, be sure to carefully review.", + "guid": "241addce-5793-477b-adb3-751ab2ac1fad", + "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share", "services": [ - "WAF" + "AVD" ], "severity": "Medium", - "text": "Configure routing based on host or domain name for multiple web applications on a single gateway", - "waf": "Security" + "subcategory": "MSIX & AppAttach", + "text": "Review performance considerations for MSIX", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", - "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "MSIX app attach requires read-only permissions to access the file share. If you're storing your MSIX applications in Azure Files, then for your session hosts, you'll need to assign all session host VMs both storage account role-based access control (RBAC) and file share New Technology File System (NTFS) permissions on the share.", + "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41", + "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share", "services": [ - "Entra", - "WAF" + "Storage", + "RBAC", + "VM", + "AVD" ], "severity": "Medium", - "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm", + "subcategory": "MSIX & AppAttach", + "text": "Check proper session host permissions for MSIX share", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", - "service": "App Gateway", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "3rd-party software vendor must provide a MSIX package, it is not recommended for customer to attempt the conversion procedure without proper support from the application owner.", + "guid": "bd362caa-ab79-4b19-adab-81932c9fc9d1", + "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq", "services": [ - "AppGW", - "WAF" + "AVD" ], "severity": "Low", - "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols", - "waf": "Security" + "subcategory": "MSIX & AppAttach", + "text": "MSIX packages for 3rd-party applications", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", - "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", - "service": "App Services", - "services": [ - "WAF" - ], + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "MSIX app attach doesn't support auto-update for MSIX applications, so they should be disabled.", + "guid": "bb88037f-5e6b-4fbb-aed5-03547cc447e8", + "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq", + "services": [ + "AVD" + ], "severity": "Low", - "text": "Refer to baseline highly available zone-redundant web application architecture for best practices", - "waf": "Reliability" + "subcategory": "MSIX & AppAttach", + "text": "Disable auto-update for MSIX packages", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", - "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", - "service": "App Services", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "In order to leverage MSIX & App Attach, guest OS image for AVD Host pool must be Windows 10/11 Enterprise or Windows 10/11 Enterprise Multi-session, version 2004 or later.", + "guid": "26128a71-f0f1-4cac-9d9e-f1d5e832e42e", + "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq", "services": [ - "Backup", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.", + "subcategory": "MSIX & AppAttach", + "text": "Review operating systems support", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", - "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", - "service": "App Services", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "Once selected the VM SKU that will be used for Host Pool deployment, it is recommended to use Gen2 type of the SKU for higher security and improved capabilities.", + "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d", + "link": "https://docs.microsoft.com/azure/virtual-machines/generation-2", "services": [ - "WAF" + "VM", + "AVD" ], - "severity": "High", - "text": "Leverage Availability Zones where regionally applicable (requires Premium v2 or v3 tier)", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Session Host", + "text": "Evaluate the usage of Gen2 VM for Host Pool deployment", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "category": "Compute", + "checklist": "Azure Virtual Desktop Review", + "description": "MMR redirects the media content from Session Host to your local machine for faster processing and rendering. It only works when you play media content on Microsoft Edge or Google Chrome. See linked URL for more details.", + "guid": "adecb27f-dc40-40f5-aca2-0090f633b1c9", + "link": "https://learn.microsoft.com/azure/virtual-desktop/multimedia-redirection", "services": [ - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Implement health checks", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Session Host", + "text": "Consider using MMR (MultiMedia Redirection) to get better video performance on browser", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "A host pool is a collection of Azure virtual machines that register to Azure Virtual Desktop as session hosts. A host pool can be one of two types: Personal and Pooled. Which type to use, and how many, is a key design decision that must be documented and validated. See companion article in 'More Info' column for more details.", + "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2", + "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology#host-pools", "services": [ - "AppSvc", - "Backup", - "WAF" + "VM", + "AVD" ], "severity": "High", - "text": "Refer to backup and restore best practices for Azure App Service", - "waf": "Reliability" + "subcategory": "Capacity Planning", + "text": "Determine the Host Pool type to use", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", - "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "Use your design criteria to determine the number of Host Pools to deploy. This will be based on factors such as different OS images, multi-region support, guest VM hardware differences (such as GPU support or no), different user expectations and uptime requirements (examples might be 'Executives', 'Office Workers', 'Developers', etc.), and Host Pool RDP settings (such as drive redirection support). These will determine the number of host pools as well as how many hosts will be in each pool.", + "guid": "4e98495f-d3c0-4af2-aa59-a793395a32a7", + "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#host-pools", "services": [ - "AppSvc", - "WAF" + "VM", + "AVD" ], "severity": "High", - "text": "Implement Azure App Service reliability best practices", - "waf": "Reliability" + "subcategory": "Capacity Planning", + "text": "Estimate the number of different Host Pools to deploy ", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "Confirm that the difference between automatic and direct assignment is well understood and the selected option is appropriate for the scenario in question. Automatic is the default setting.", + "guid": "b38b875b-a1cf-4204-a901-3a5d3ce474db", + "link": "https://docs.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type", "services": [ - "AppSvc", - "WAF" + "AVD" ], "severity": "Low", - "text": "Familiarize with how to move an App Service app to another region During a disaster", - "waf": "Reliability" + "subcategory": "Capacity Planning", + "text": "For Personal Host Pool type, select the proper assignment type", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "Check which one to use and available options, autoscale ignores existing load-balancing algorithms.", + "guid": "cbd8682a-6abc-4a2a-9fda-1dbf3dc95d48", + "link": "https://docs.microsoft.com/azure/virtual-desktop/host-pool-load-balancing", "services": [ - "AppSvc", - "WAF" + "AVD" ], - "severity": "High", - "text": "Familiarize with reliability support in Azure App Service", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Capacity Planning", + "text": "For Pooled Host Pool type, select the best load balancing method", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "The number of cores increase, the system's synchronization overhead also increases. Especially for multiple user's sign-in simultaneously. Make sure not to use a VM that is too large for the session host", + "guid": "b3724959-4943-4577-a3a9-e10ff6345f24", + "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs", "services": [ - "AppSvc", - "WAF" + "VM", + "AVD" ], "severity": "Medium", - "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan", - "waf": "Reliability" + "subcategory": "Capacity Planning", + "text": "For Pooled Host Pool type, VMs shouldn't have more than 32 cores", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD does not support assigning both the RemoteApp and Desktop Application Group (DAG) in a single host pool to the same set of users. Doing so will cause a single user to have two user sessions in a single host pool. Users aren't supposed to have two active sessions at the same time in the same host pool using the same profile.", + "guid": "b384b7ed-1cdd-457e-a2cd-c8d4d55bc144", + "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#application-groups", "services": [ - "AppSvc", - "Monitor", - "WAF" + "Storage", + "AVD" + ], + "severity": "High", + "subcategory": "Capacity Planning", + "text": "Do not use the same Host Pool to offer both full desktops (DAG) and Remote Apps to the same set of users", + "waf": "Security" + }, + { + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "There is a limit of 500 Application Groups that can be created in AVD for each Microsoft Entra ID (former Azure AD) tenant. The limit can be increased (see the companion link for details) but it is not recommended.", + "guid": "971cc4a4-b1f7-4c12-90e0-1ad96808f00c", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-service-limits", + "services": [ + "Entra", + "ACR", + "AVD" ], "severity": "Medium", - "text": "Monitor App Service instances using Health checks", + "subcategory": "Capacity Planning", + "text": "Estimate the number of Application Groups required across all Host Pools in the Microsoft Entra ID tenant", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "Applications are grouped under Application Groups as containers for publishing and assigning permissions: we recommend that you do not publish more than 50 applications per application group.", + "guid": "fa9f2895-473d-439b-ab8e-5a5cf92c7f32", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations", "services": [ - "Monitor", - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests", + "severity": "Low", + "subcategory": "Capacity Planning", + "text": "Estimate the number of Applications for each Application Group", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "FSLogix is not required for Personal Host Pools since each VM is statically assigned to a single user, then no immediate needs for a roaming profile solution. In some usage scenarios FSLogix can help. For example, a VM can be re-assigned, or user moved to another desktop, or roaming profile can be used to save user profile in a different location for DR purposes.", + "guid": "38b19ab6-0693-4992-9394-5590883916ec", + "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type?tabs=azure#reassign-a-personal-desktop", "services": [ - "Monitor", - "WAF" + "Storage", + "VM", + "AVD" ], "severity": "Low", - "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website", + "subcategory": "Capacity Planning", + "text": "Evaluate the usage of FSLogix for Personal Host Pools", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.", - "guid": "834ac932-223e-4ce8-8b12-3071a5416415", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "Use the link provided to set a starting point for SKU decision, then validate using a performance test. Ensure a minimum of four cores for Production is selected per Session Host (multi-session)", + "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2", + "link": "https://docs.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs", "services": [ - "AppSvc", - "AKV", - "WAF" + "VM", + "AVD" ], "severity": "High", - "text": "Use Key Vault to store secrets", - "waf": "Security" + "subcategory": "Capacity Planning", + "text": "Run workload performance test to determine the best Azure VM SKU and size to use", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.", - "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "It is critical to check AVD capacity and limits reported in the referenced article. Additional limits and thresholds apply for network, compute, storage and service management. ", + "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations", "services": [ - "Entra", - "AKV", - "AppSvc", - "WAF" + "Storage", + "AVD" ], "severity": "High", - "text": "Use Managed Identity to connect to Key Vault", - "waf": "Security" + "subcategory": "Capacity Planning", + "text": "Verify AVD scalability limits for the environment", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Store the App Service TLS certificate in Key Vault.", - "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "Host Pools with GPU require special configuration, please be sure to review the referenced article.", + "guid": "c936667e-13c0-4056-94b1-e945a459837e", + "link": "https://docs.microsoft.com/azure/virtual-desktop/configure-vm-gpu", "services": [ - "AppSvc", - "AKV", - "WAF" + "AVD" ], - "severity": "High", - "text": "Use Key Vault to store TLS certificate.", - "waf": "Security" + "severity": "Low", + "subcategory": "Capacity Planning", + "text": "Determine if Session Hosts will require GPU", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Systems that process sensitive information should be isolated. To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.", - "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", - "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "Whenever is possible, it is recommended to leverage VM SKUs with Accelerated Networking feature. This feature does require specific VM SKU/size and OS versions, please see the list and requirement in the companion article.", + "guid": "b47a393a-0803-4272-a479-8b1578b219a4", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", "services": [ - "AppSvc", - "Subscriptions", - "WAF" + "VM", + "AVD" ], - "severity": "Medium", - "text": "Isolate systems that process sensitive information", - "waf": "Security" + "severity": "Low", + "subcategory": "Capacity Planning", + "text": "Use Azure VM SKUs able to leverage Accelerated Networking", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).", - "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "For proper planning and deployment, it is important to assess the maximum number of concurrent and total users for each Host Pool. Additionally, users from different regions may require different Host Pools to ensure the best user experience.", + "guid": "bb91a33d-90ca-4e2c-a881-3706f7c0cb9f", + "link": "https://learn.microsoft.com/azure/virtual-desktop/overview", "services": [ - "AppSvc", - "TrafficManager", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Do not store sensitive data on local disk", - "waf": "Security" + "subcategory": "Clients & Users", + "text": "Assess how many users will connect to AVD and from which regions", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C. Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.", - "guid": "919ca0b2-c121-459e-814b-933df574eccc", - "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "The dependencies on resources external to the AVD pool should be assessed and reviewed, for example Active Directory, external file shares or other storage, on-premises services and resources, network infrastructure components like VPN and or ExpressRoute, external services and 3rd-party components. For all these resources, latency from the AVD Host Pool needs to be evaluated and connectivity considered. Additionally, BCDR considerations need to be applied to these dependencies as well.", + "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop?toc=%2Fazure%2Fvirtual-desktop%2Ftoc.json&bc=%2Fazure%2Fvirtual-desktop%2Fbreadcrumb%2Ftoc.json", "services": [ - "Entra", - "AppSvc", - "WAF" + "VPN", + "Storage", + "ExpressRoute", + "AVD" ], "severity": "Medium", - "text": "Use an established Identity Provider for authentication", - "waf": "Security" + "subcategory": "Clients & Users", + "text": "Assess external dependencies for each Host Pool", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.", - "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", - "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD offers a variety of client types (fat, thin, web) to connect over different platforms (Windows, MacOS, iOS, Android). Review limitations of each client and compare multiple options when possible.", + "guid": "a1f6d565-99e5-458b-a37d-4985e1112dbd", + "link": "https://learn.microsoft.com/azure/virtual-desktop/users/connect-windows", "services": [ - "AppSvc", - "WAF" + "AVD" ], - "severity": "High", - "text": "Deploy from a trusted environment", - "waf": "Security" + "severity": "Low", + "subcategory": "Clients & Users", + "text": "Review user client OS used and AVD client type", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM. This disables access to these services and enforces the use of Azure AD secured endpoints for deployment. Note that the SCM site can also be opened using Azure AD credentials.", - "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", - "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "Depending on the user locations, and AVD region deployment, users may have a non-optimal experience, hence is important to test as soon as possible in a small PoC environment. Run the 'Azure Virtual Desktop Experience Estimator' tool to select the best Azure region to deploy Host Pools. Beyond 150ms latency, user experience may be not optimal.", + "guid": "d2f54b29-769e-43a6-a1e8-838ac936667e", + "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/", "services": [ - "Entra", - "WAF" + "AVD" ], "severity": "High", - "text": "Disable basic authentication", - "waf": "Security" + "subcategory": "Clients & Users", + "text": "Run a PoC to validate end-to-end user experience and impact of network latency", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Where possible use Managed Identity to connect to Azure AD secured resources. If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.", - "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", - "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "RDP settings can currently only be configured at the host pool level, not per user/group. If different settings are required for different set of users, it is recommended to create multiple Host Pools.", + "guid": "3b365a5c-7acb-4e48-abe5-4cd79f2e8776", + "link": "https://docs.microsoft.com/azure/virtual-desktop/customize-rdp-properties", "services": [ - "Entra", - "AKV", - "WAF" + "AVD" ], - "severity": "High", - "text": "Use Managed Identity to connect to resources", + "severity": "Low", + "subcategory": "Clients & Users", + "text": "Assess and document RDP settings for all user groups", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.", - "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD is a non-regional service, Host Pools can be created in any region, automatic redirection from closest front-end will happen automatically.", + "guid": "42e52f47-21d9-428c-8b1b-d521e44a29a9", + "link": "https://azure.microsoft.com/global-infrastructure/services/?products=virtual-desktop", "services": [ - "Entra", - "ACR", - "WAF" + "AVD" ], "severity": "High", - "text": "Pull containers using a Managed Identity", - "waf": "Security" + "subcategory": "General", + "text": "Determine in which Azure regions AVD Host Pools will be deployed.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...", - "guid": "47768314-c115-4775-a2ea-55b46ad48408", - "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD must store metadata to support the service; this is stored in the specified geography. However, this is independent of the regions where Host Pools are located.", + "guid": "bad37ead-53cc-47ce-8d7a-aab3571449ab", + "link": "https://docs.microsoft.com/azure/virtual-desktop/data-locations", "services": [ - "AppSvc", - "Entra", - "Monitor", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Send App Service runtime logs to Log Analytics", - "waf": "Security" + "subcategory": "General", + "text": "Determine metadata location for AVD service", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.", - "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", - "service": "App Services", + "category": "Foundation", + "checklist": "Azure Virtual Desktop Review", + "description": "Check for specific VM SKUs, especially if you need GPU or high-specs SKUs, and eventually Azure NetApp Files if used.", + "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91", + "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "services": [ - "AppSvc", - "Entra", - "Monitor", - "WAF" + "Storage", + "VM", + "AVD" ], - "severity": "Medium", - "text": "Send App Service activity logs to Log Analytics", - "waf": "Security" + "severity": "Low", + "subcategory": "General", + "text": "Check Azure quotas and availability for specific VM sizes and types in the selected regions", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's. Traffic should be routed to an NVA such as Azure Firewall. Ensure to monitor the Firewall's logs.", - "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", - "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "AD DCs in Azure are recommended (at least two in different AZ) to reduce latency for users logging into AVD session hosts, and eventually for Azure NetApp Files and AD integration. A DC need to be able to talk to DCs for ALL child domains. As alternative, on-premise connectivity must be used to reach AD DCs.", + "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073", + "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", "services": [ + "Storage", "VNet", - "Monitor", - "Firewall", - "NVA", - "WAF" + "Entra", + "AVD" ], "severity": "Medium", - "text": "Outbound network access should be controlled", - "waf": "Security" + "subcategory": "Active Directory", + "text": "Create at least two Active Directory Domain Controllers (DCs) in Azure VNet environment close to AVD Host Pool", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall. This allows the receiving party to allow-list based on IP, should that be needed. Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead. (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)", - "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", - "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "Recommended to create a separate OU per Host Pool under a separate OU hierarchy. These OUs will contain machine accounts of AVD Session Hosts. ", + "guid": "6db55f57-9603-4334-adf9-cc23418db612", + "link": "https://docs.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace", "services": [ - "VNet", - "Firewall", - "PrivateLink", - "Storage", - "NVA", - "WAF" + "Entra", + "AVD" ], - "severity": "Low", - "text": "Ensure a stable IP for outbound communications towards internet addresses", - "waf": "Security" - }, - { - "checklist": "WAF checklist", - "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.", - "guid": "0725769e-e669-41a4-a34a-c932223ece80", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", - "services": [ - "AppSvc", - "PrivateLink", - "WAF" - ], - "severity": "High", - "text": "Inbound network access should be controlled", - "waf": "Security" + "severity": "Medium", + "subcategory": "Active Directory", + "text": "Create a specific OU in Active Directory for each Host Pool", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door. Make sure to monitor the WAF's logs.", - "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", - "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "Carefully review, and potentially block/filter inheritance of GPOs to the OUs containing AVD Host Pools. ", + "guid": "7126504b-b47a-4393-a080-327294798b15", + "link": "https://docs.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy", "services": [ - "Monitor", - "FrontDoor", - "AppSvc", - "AppGW", - "WAF" + "Entra", + "AVD" ], - "severity": "High", - "text": "Use a WAF in front of App Service", - "waf": "Security" + "severity": "Medium", + "subcategory": "Active Directory", + "text": "Review Domain GPOs that will be applied to OU and impacting Host Pool Session Hosts functionalities", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF. Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.", - "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "If Active Directory Domain GPOs are used, it is recommended to configure FSLogix using the built-in provided GPO ADMX template referenced in the companion article in the 'More Info' column", + "guid": "2226a8e3-50a4-4ac3-8bd6-ee150553051f", + "link": "https://learn.microsoft.com/fslogix/how-to-use-group-policy-templates", "services": [ - "PrivateLink", - "WAF" + "Entra", + "AVD" ], - "severity": "High", - "text": "Avoid for WAF to be bypassed", - "waf": "Security" + "severity": "Medium", + "subcategory": "Active Directory", + "text": "Configure FSLogix settings using the built-in provided GPO ADMX template", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Set minimum TLS policy to 1.2 in App Service configuration.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", - "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "It is recommended to have a specific dedicated account with minimal permissions, and without the default 10 joins limitation. Review the companion article for more details.", + "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77", + "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#session-hosts", "services": [ - "AppSvc", - "AzurePolicy", - "WAF" + "Entra", + "VM", + "AVD" ], "severity": "Medium", - "text": "Set minimum TLS policy to 1.2", + "subcategory": "Active Directory", + "text": "Create a dedicated user account with only permissions to join VM to the domain", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Configure App Service to use HTTPS only. This causes App Service to redirect from HTTP to HTTPS. Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.", - "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", - "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "Avoid granting access per user, instead use AD groups and replicate them using Active Directory Connector (ADC) in Microsoft Entra ID (former Azure AD). ", + "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c", + "link": "https://docs.microsoft.com/azure/virtual-desktop/manage-app-groups", "services": [ - "AppSvc", - "WAF" + "Entra", + "AVD" ], - "severity": "High", - "text": "Use HTTPS only", + "severity": "Medium", + "subcategory": "Active Directory", + "text": "Create a domain user group for each set of users that will be granted access to each Host Pool Application Group (DAG or RAG)", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.", - "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", - "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "If Azure Files Active Directory (AD) integration is used, as part of the configuration procedure, an AD account to represent the storage account (file share) will be created. You can choose to register as a computer account or service logon account, see FAQ for details. For computer accounts, there is a default password expiration age set in AD at 30 days. Similarly, the service logon account may have a default password expiration age set on the AD domain or Organizational Unit (OU). For both account types, we recommend you check the password expiration age configured in your AD environment and plan to update the password of your storage account identity of the AD account before the maximum password age. You can consider creating a new AD Organizational Unit (OU) in AD and disabling password expiration policy on computer accounts or service logon accounts accordingly.", + "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3", + "link": "https://docs.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable", "services": [ "Storage", - "WAF" + "Entra", + "AzurePolicy", + "AVD" ], "severity": "High", - "text": "Wildcards must not be used for CORS", + "subcategory": "Active Directory", + "text": "Review your organization password expiration policy for accounts used by Azure Files AD integration", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", - "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", - "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "You can configure this using Active Directory Connect (ADC) or Azure AD Domain Services (for hybrid or cloud organizations). Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).", + "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a", + "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity", "services": [ - "WAF" + "Entra", + "AVD" ], "severity": "High", - "text": "Turn off remote debugging", - "waf": "Security" + "subcategory": "Active Directory", + "text": "A Windows Server Active Directory forest/domain must be in sync with Microsoft Entra ID", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.", - "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "If Azure Files is used and pre-requisites can be satisfied, it is recommended to configure (Microsoft Entra ID) Kerberos authentication. This configuration will allow to store FSLogix profiles that can be accessed by hybrid user identities from Azure AD-joined session hosts without requiring network line-of-sight to domain controllers.", + "guid": "e777fd5e-c5f1-4d6e-8fa9-fc210b88e338", + "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable", "services": [ - "AppSvc", - "Defender", - "WAF" + "Storage", + "Entra", + "AVD" ], "severity": "Medium", - "text": "Enable Defender for Cloud - Defender for App Service", + "subcategory": "Microsoft Entra ID", + "text": "Configure Azure Files share for Microsoft Entra ID (former Azure AD) Kerberos authentication on Microsoft Entra ID Joined scenario", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.", - "guid": "223ece80-b123-4071-a541-6415833ea3ad", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "An Azure subscription must be parented to the same Microsoft Entra ID (former Azure AD) tenant, that contains a virtual network that either contains or is connected to the Windows Server Active Directory Domain Services or Microsoft Entra ID Domain Services instance.", + "guid": "6ceb5443-5125-4922-9442-93bb628537a5", + "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity", "services": [ - "EventHubs", "VNet", - "DDoS", - "NVA", - "AppGW", - "WAF" + "Entra", + "Subscriptions", + "AVD" ], - "severity": "Medium", - "text": "Enable DDOS Protection Standard on the WAF VNet", - "waf": "Security" + "severity": "High", + "subcategory": "Requirements", + "text": "A Microsoft Entra ID tenant must be available with at least one subscription linked", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.", - "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "Azure Virtual Desktop supports different types of identities depending on which configuration you choose. Please review the supported scenarios mentioned in the 'More Info' article and document the design decision accordingly in the 'Comment' column. Critically, external identities (B2B or B2C) are not supported. Be sure to review also the list of supported scenarios in https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios.", + "guid": "b4ce4781-7557-4a1f-8043-332ae199d44c", + "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication", "services": [ - "PrivateLink", - "VNet", - "ACR", - "WAF" + "Entra", + "AVD" ], - "severity": "Medium", - "text": "Pull containers over a Virtual Network", + "severity": "High", + "subcategory": "Requirements", + "text": "Review and document your identity scenario", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.", - "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", - "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "Users need accounts that are in Microsoft Entra ID (former Azure AD). If you're also using AD DS or Azure AD Domain Services in your deployment of Azure Virtual Desktop, these accounts will need to be hybrid identities, which means the user accounts are synchronized. If you're using Microsoft Entra ID with AD DS, you'll need to configure Azure AD Connect to synchronize user identity data between AD DS and Microsoft Entra ID. If you're using Microsoft Entra ID with Azure AD Domain Services, user accounts are synchronized one way from Microsoft Entra ID to Azure AD Domain Services. This synchronization process is automatic. AVD also supports Microsoft Entra ID native accounts with some restrictions. External identities (B2B or B2C) are not supported.", + "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b", + "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios", "services": [ - "WAF" + "Entra", + "AVD" ], "severity": "Medium", - "text": "Conduct a penetration test", + "subcategory": "Requirements", + "text": "Assess User Account types and requirements", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", - "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD supports SSO using either Active Directory Federation Services (AD FS) or Microsoft Entra ID (former Azure AD) authentication. The latter is recommended, please check the requirements and limitation in the 'More Info' article. Using AD FS could be a viable choice if already present in the customer environment, it is not recommended to deploy a brand new ADFS infrastructure just for AVD SSO implementation.", + "guid": "5f9f680a-ba07-4429-bbf7-93d7071561f4", + "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication#single-sign-on-sso", "services": [ - "WAF" + "Entra", + "AVD" ], "severity": "Medium", - "text": "Deploy validated code", - "waf": "Security" + "subcategory": "Requirements", + "text": "If Single-Sign On (SSO) is a requirement, review the supported scenarios and prerequisites", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", - "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", - "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", - "service": "App Services", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "VMs can be Windows Active Directory (AD) domain-joined, Hybrid AD-joined, Microsoft Entra ID (former Azure AD) Joined or Azure AD Domain Services joined. Be sure to review supported scenarios, limitations and requirements from the referenced article.", + "guid": "ea962a15-9394-46da-a7cc-3923266b2258", + "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios", "services": [ - "WAF" + "Entra", + "VM", + "AVD" ], "severity": "High", - "text": "Use up-to-date platforms, languages, protocols and frameworks", + "subcategory": "Requirements", + "text": "Select the proper AVD Session Host domain join type", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", - "service": "Azure Monitor", + "category": "Identity", + "checklist": "Azure Virtual Desktop Review", + "description": "Compare self-managed Windows Active Directory Domain Services, Microsoft Entra ID (former Azure AD), and managed Azure AD Domain Services (AAD-DS)", + "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b", + "link": "https://docs.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions", + "services": [ + "Entra", + "AVD" + ], + "severity": "Low", + "subcategory": "Requirements", + "text": "Before using Azure AD Domain Services (AAD-DS) for AVD, be sure to review the limitations.", + "waf": "Reliability" + }, + { + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD provides administrative templates for Intune and Active Directory GPO. Using these templates it is possible to centrally control several AVD configuration settings: Graphics related data logging, Screen capture protection, RDP Shortpath for managed networks, Watermarking. See companion article in 'More Info' colum for details. NOTE: FSLogix has its own separate template.", + "guid": "5549524b-36c0-4f1a-892b-ab3ca78f5db2", + "link": "https://learn.microsoft.com/azure/virtual-desktop/administrative-template", "services": [ + "Entra", "Monitor", - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "Cost" + "severity": "Low", + "subcategory": "Management", + "text": "Use built-in provided administrative templates for AVD settings configuration", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "45901365-d38e-443f-abcb-d868266abca2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Azure Backup", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "Determine if a configuration management tool is already in place to manage Host Pool VM configuration after initial deployment, For example SCCM/SCOM, Intune/ConfigurationManager, 3rd-party solutions.", + "guid": "3334fdf9-1c23-4418-8b65-285269440b4b", + "link": "https://learn.microsoft.com/azure/virtual-desktop/management", "services": [ - "Backup", - "WAF" + "Monitor", + "VM", + "AVD" ], - "severity": "Medium", - "text": "check backup instances with the underlying datasource not found", - "waf": "Cost" + "severity": "Low", + "subcategory": "Management", + "text": "Plan AVD Session Hosts configuration management strategy", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "We recommend using Microsoft Intune, if requirements can be satisfied, to manage your Azure Virtual Desktop environment. Review supported scenarios and requirements to enable Intune for AVD Session Host management in the referenced article in the “More Info” column. Document your choice in the 'Comment' column. In that article, review the different requirements and capabilities for single-session https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop and multi-session https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session AVD.", + "guid": "63a08be1-6004-4b4a-a79b-f3239faae113", + "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop", "services": [ - "WAF" + "Monitor", + "AVD" ], "severity": "Medium", - "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)", - "waf": "Cost" + "subcategory": "Management", + "text": "Evaluate Intune for AVD Session Hosts management", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Azure Backup", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "The scaling tool provides a low-cost automation option for customers who want to optimize their session host VM costs. You can use the scaling tool to schedule VMs to start and stop based on Peak and Off-Peak business hours, scale out VMs based on number of sessions per CPU core, scale in VMs during Off-Peak hours, leaving the minimum number of session host VMs running. Not available yet for Personal Host Pool type.", + "guid": "7138b820-102c-4e16-be30-1e6e872e52e3", + "link": "https://learn.microsoft.com/azure/virtual-desktop/autoscale-scenarios", "services": [ - "Backup", - "Storage", - "ASR", - "WAF" + "Monitor", + "VM", + "Cost", + "AVD" ], "severity": "Medium", - "text": "Consider a good balance between site recovery storage and backup for non mission critical applications", - "waf": "Cost" + "subcategory": "Management", + "text": "Assess the requirements for host pool auto-scaling capability", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", - "service": "Azure Monitor", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "Start VM On Connect lets you reduce costs by enabling end users to turn on their session host virtual machines (VMs) only when they need them. You can then turn off VMs when they're not needed. You can configure Start VM on Connect for personal or pooled host pools using the Azure portal or PowerShell. Start VM on Connect is a host pool wide setting.", + "guid": "55f612fe-f215-4f0d-a956-10e7dd96bcbc", + "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect", "services": [ "Monitor", - "WAF" + "VM", + "Cost", + "AVD" ], - "severity": "Medium", - "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", + "severity": "Low", + "subcategory": "Management", + "text": "Consider the usage of Start VM on Connect for Personal Host Pools", "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Azure Monitor", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "'Start VM On Connect' provides a smart way to automatically start previously stopped Session Hosts but does not provide a mechanism to shut down when not in used. Administrators are encouraged to configure additional policies to sign users out of their sessions and run Azure automation scripts to de-allocate VMs. Users should be not allowed to shut down their Personal Hosts since will not be able to de-allocate Azure VMs, then billing will still be active with no cost reduction.", + "guid": "79a686ea-d971-4ea0-a9a8-1aea074c94cb", + "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect-faq#are-vms-automatically-deallocated-when-a-user-stops-using-them", "services": [ + "Cost", + "Monitor", + "VM", "AzurePolicy", - "Storage", - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)", - "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", + "severity": "Low", + "subcategory": "Management", + "text": "Evaluate the implementation of an ad-hoc mechanism to shut down Personal AVD Session Hosts", "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "Azure Virtual Desktop billing is mainly based on cost associated to compute, networking and storage resources consumed by Host Pools. In addition to this, costs can be generated by dependent resources, for example VPN or ExpressRoute or vWAN, Active Directory Domain Controllers, DNS, etc. There is no direct cost associated to AVD objects like workspaces, host pools or application groups. To make AVD associated costs more evident and grouped by Host Pool, it is recommended to use 'cm-resource-parent' tag. ", + "guid": "51bcafca-476a-48fa-9b91-9645a7679f20", + "link": "https://learn.microsoft.com/azure/virtual-desktop/tag-virtual-desktop-resources", "services": [ - "Backup", "Storage", - "WAF" + "VWAN", + "DNS", + "ExpressRoute", + "Cost", + "VPN", + "Monitor", + "AVD" ], - "severity": "Medium", - "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", + "severity": "Low", + "subcategory": "Management", + "text": "Review and adopt suggested Azure Tags for Azure Virtual Desktop", "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "d1e44a19-659d-4395-afd7-7289b835556d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Storage", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "Azure Advisor analyzes your configurations and telemetry to offer personalized recommendations to solve common problems. With these recommendations, you can optimize your Azure resources for reliability, security, operational excellence, performance, and cost.", + "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4", + "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor-recommendations", "services": [ - "AzurePolicy", - "Storage", - "WAF" + "Entra", + "Monitor", + "Cost", + "AVD" ], - "severity": "Medium", - "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "waf": "Cost" + "severity": "Low", + "subcategory": "Management", + "text": "Periodically check Azure Advisor recommendations for AVD", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "Customers have several options: Microsoft Configuration Manager, this article explains how to automatically apply updates to a Azure Virtual Desktop session hosts running Windows 10/11: https://learn.microsoft.com/azure/virtual-desktop/configure-automatic-updates, Microsoft Intune: https://docs.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session, Azure Update Management and WSUS for Windows Server OS only (client OS not supported: https://learn.microsoft.com/azure/automation/update-management/operating-system-requirements), 3rd Party tools. Outside an emergency security patching situation, it is recommended to move away from an 'in-place' update strategy patching strategy and adopt a re-imaging approach.", + "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa", + "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop-multi-session", "services": [ - "VM", - "WAF" + "Monitor", + "AVD" ], "severity": "Medium", - "text": "Make sure advisor is configured for VM right sizing ", - "waf": "Cost" + "subcategory": "Management", + "text": "Plan for a Session Host emergency patching and update strategy", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "check by searching the Meter Category Licenses in the Cost analysys", - "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "The Scheduled Agent Updates feature lets you create up to two maintenance windows per Host Pool to update AVD components at a convenient time. It is recommended to specify maintenance windows then upgrading Session Hosts will not happen during peak business hours. Scheduled Agent Updates is disabled by default. This means that, unless you enable this setting, the agent can get updated at any time by the agent update flighting service.", + "guid": "c067939b-e5ca-4698-b9ce-3bd91843e73f", + "link": "https://learn.microsoft.com/azure/virtual-desktop/scheduled-agent-updates", "services": [ - "AzurePolicy", - "VM", - "Cost", - "WAF" + "Monitor", + "AVD" ], - "severity": "Medium", - "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently", - "waf": "Cost" + "severity": "Low", + "subcategory": "Management", + "text": "Configure the Scheduled Agent Updates feature", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "Host pools are a collection of one or more identical virtual machines within Azure Virtual Desktop environment. We highly recommend you create a validation host pool where service updates are applied first. This allows you to monitor service updates before the service applies them to your standard or non-validation environment.", + "guid": "d1e8c38e-c936-4667-913c-005674b1e944", + "link": "https://docs.microsoft.com/azure/virtual-desktop/create-validation-host-pool", "services": [ - "LoadBalancer", - "WAF" + "Monitor", + "VM", + "AVD" ], "severity": "Medium", - "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", - "waf": "Cost" + "subcategory": "Management", + "text": "Create a validation (canary) Host Pool", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "An AVD Host Pool can be deployed in several ways: Azure Portal, ARM templates, Azure CLI tool, Powershell, manual VM creation with registration token, Terraform, 3rd-party tools. It is important to adopt proper method/s to support automatic deployment through automation and CI/CD tools.", + "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-platform-automation-and-devops", "services": [ + "Monitor", "VM", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)", - "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", - "waf": "Cost" + "subcategory": "Management", + "text": "Determine Host Pool deployment strategy", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "After you register a VM to a host pool within the Azure Virtual Desktop service, the agent regularly refreshes the VM's token whenever the VM is active. The certificate for the registration token is valid for 90 days. Because of this 90-day limit, we recommend VMs to be online for 20 minutes every 90 days so that the machine can refresh its tokens and update the agent and side-by-side stack components.", + "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e", + "link": "https://docs.microsoft.com/azure/virtual-desktop/faq", "services": [ - "Cost", - "ARS", + "Monitor", "VM", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.", - "waf": "Cost" + "subcategory": "Management", + "text": "Turn on Session Host VMs at least every 90 days for token refresh", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "Azure Virtual Desktop Insights is a dashboard built on Azure Monitor Workbooks that helps IT professionals understand their Azure Virtual Desktop environments. Read the referenced article to learn how to set up Azure Monitor for Azure Virtual Desktop to monitor your AVD environments.", + "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c", + "link": "https://learn.microsoft.com/azure/virtual-desktop/insights", "services": [ - "WAF" + "Monitor", + "AVD" ], - "severity": "Medium", - "text": "Only larger disks can be reserved => 1 TiB -", - "waf": "Cost" + "severity": "High", + "subcategory": "Monitoring", + "text": "Enable monitoring for AVD", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "Azure Virtual Desktop uses Azure Monitor and Log Analytics for monitoring and alerts like many other Azure services. This lets admins identify issues through a single interface. The service creates activity logs for both user and administrative actions. Each activity log falls under the following categories: Management, Feed, Connections, Host Registration, Errors, Checkpoints. ", + "guid": "81770afb-c4c0-4e43-a186-58d2857ed671", + "link": "https://docs.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics", "services": [ - "WAF" + "Monitor", + "VM", + "AVD" ], "severity": "Medium", - "text": "After the right-sizing optimization", - "waf": "Cost" + "subcategory": "Monitoring", + "text": "Enable diagnostic settings for Workspaces, Host Pools, Application Groups and Host VMs to Log Analytics workspace", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Azure SQL", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "See the referenced article and this additional one to setup proper monitoring and alerting for storage: https://docs.microsoft.com/azure/storage/files/storage-troubleshooting-files-performance. ", + "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c", + "link": "https://docs.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal", "services": [ - "AzurePolicy", - "SQL", - "Cost", - "WAF" + "Storage", + "Monitor", + "AVD" ], "severity": "Medium", - "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", - "waf": "Cost" + "subcategory": "Monitoring", + "text": "Create alerts on the profile storage to be alerted in case of high usage and throttling", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "VM", + "category": "Monitoring and Management", + "checklist": "Azure Virtual Desktop Review", + "description": "You can use Azure Service Health to monitor service issues and health advisories for Azure Virtual Desktop. Azure Service Health can notify you with different types of alerts (for example, email or SMS), help you understand the effect of an issue, and keep you updated as the issue resolves.", + "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6", + "link": "https://docs.microsoft.com/azure/virtual-desktop/set-up-service-alerts", "services": [ - "VM", - "WAF" + "Monitor", + "AVD" ], "severity": "Medium", - "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount", - "waf": "Cost" + "subcategory": "Monitoring", + "text": "Configure Azure Service Health for AVD alerts ", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "VM", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "If required to connect to on-premises environment, assess the current connectivity option or plan for the required connectivity (ExpressRoute, Azure S2S or 3rd-party NVA VPN). ", + "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b", + "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/", "services": [ - "VM", - "WAF" + "VPN", + "ExpressRoute", + "NVA", + "AVD" ], "severity": "Medium", - "text": "Consider using a VMSS to match demand rather than flat sizing", - "waf": "Cost" + "subcategory": "Networking", + "text": "Determine if hybrid connectivity is required to connect to on-premises environment", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "WAF checklist", - "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "AKS", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD Host Pools can be deployed in either Azure Virtual WAN or traditional 'Hub & Spoke' network topologies. It is recommended to deploy each Host Pool in a separate 'spoke' VNet, using 'hub' is not recommended.", + "guid": "c8639648-a652-4d6c-85e5-02965388e5de", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-network-topology-and-connectivity", "services": [ - "AKS", - "WAF" + "VNet", + "VWAN", + "AVD" ], "severity": "Medium", - "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)", - "waf": "Cost" + "subcategory": "Networking", + "text": "Determine Azure Virtual Network (VNet) placement for each AVD Host Pool", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Azure Backup", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "Evaluate the bandwidth requirements, ensure VPN/ER bandwidth will be enough, ensure proper routing and firewall rules are in place, test end-to-end latency. ", + "guid": "d227dd14-2b06-4c21-a799-9a646f4389a7", + "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/", "services": [ - "WAF" + "VPN", + "AVD" ], "severity": "Medium", - "text": "Move recovery points to vault-archive where applicable (Validate)", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "Cost" + "subcategory": "Networking", + "text": "Assess which on-premises resources are required from AVD Host Pools", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", - "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", - "service": "Databricks", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "Several options are available. You can use Azure Firewall or equivalent 3rd-party NVA, Network Security Group (NSG) and/or Proxy servers. NSG is not able to enable/disable by URL, only ports and protocols. Proxy should be used only as explicit setting in user browser. Details on using Azure Firewall Premium with AVD are reported in the companion article in the 'More Info' column. Be sure to allow proper access to required AVD URLs. Forced Tunneling to on-premises is not recommended.", + "guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d", + "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop", "services": [ - "VM", - "LoadBalancer", - "WAF" + "VNet", + "Firewall", + "NVA", + "AVD" ], "severity": "Medium", - "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.", - "waf": "Cost" + "subcategory": "Networking", + "text": "Need to control/restrict Internet outbound traffic for AVD hosts?", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", - "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", - "service": "Azure Functions", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "Required URLs for AVD control plane access by session hosts are documented here: https://docs.microsoft.com/azure/virtual-desktop/safe-url-list. A check tool is available to verify connectivity from the session hosts: https://docs.microsoft.com/azure/virtual-desktop/safe-url-list#required-url-check-tool. Forced Tunneling to on-premises is not recommended.", + "guid": "65c7acbe-45bb-4e60-ad89-f2e87778424d", + "link": "https://docs.microsoft.com/azure/virtual-desktop/safe-url-list", "services": [ - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Functions - Reuse connections", - "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", - "waf": "Cost" + "severity": "High", + "subcategory": "Networking", + "text": "Ensure AVD control plane endpoints are accessible", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview", - "service": "Azure Functions", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "Consider the usage of Azure Defender Endpoint or similar 3rd-party agents to control user web navigation, see the Security section for more details.", + "guid": "73676ae4-6691-4e88-95ad-a42223e13810", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/onboard-windows-multi-session-device?view=o365-worldwide", "services": [ - "WAF" + "Defender", + "AVD" ], "severity": "Medium", - "text": "Functions - Cache data locally", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", - "waf": "Cost" + "subcategory": "Networking", + "text": "Need to control/restrict Internet outbound traffic only for users on AVD hosts? ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Azure Functions", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "Custom UDR and NSG can be applied to AVD Host Pool subnets, for example to redirect to Azure Firewall or NVA, or to filter/block network traffic. In this case is recommended to carefully review to ensure optimal path for outbound traffic to AVD control plane is used. Service Tags can now be used with UDR and NSG, then AVD management plane traffic can be easily allowed: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list.", + "guid": "523181a9-4174-4158-93ff-7ae7c6d37431", + "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop", "services": [ - "Storage", - "WAF" + "VNet", + "Firewall", + "NVA", + "AVD" ], - "severity": "Medium", - "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "Cost" + "severity": "Low", + "subcategory": "Networking", + "text": "Review custom UDR and NSG for AVD Host Pool subnets", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "Azure Functions", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "Network traffic from AVD Session Host VMs to AVD control plane should be as direct as possible. Redirecting this traffic through a Proxy or Firewall with deep packet inspection and/or SSL termination could cause serious issues and bad customer experience. It is recommended to bypass Proxy and Firewall just for the AVD control plane. User generated traffic surfing the web instead, should be filtered by Firewall and/or redirected to a Proxy. For details and guidelines, please see the companion article in the 'More Info' column.", + "guid": "cc6edca0-aeca-4566-9e92-cf246f1465af", + "link": "https://learn.microsoft.com/azure/virtual-desktop/proxy-server-support", "services": [ - "WAF" + "VM", + "AVD" ], - "severity": "Medium", - "text": "Functions - Keep your functions warm", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Cost" + "severity": "High", + "subcategory": "Networking", + "text": "Do not use Proxy servers, SSL termination and Deep Packet Inspection for AVD control plane traffic", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Azure Functions", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "It is recommended to assess and review networking bandwidth requirements for users, based on the specific workload type. The referenced article provide general estimations and recommendations, but specific measure are required for proper sizing. ", + "guid": "516785c6-fa96-4c96-ad88-408f372734c8", + "link": "https://learn.microsoft.com/azure/virtual-desktop/rdp-bandwidth", "services": [ - "WAF" + "VM", + "AVD" ], - "severity": "Medium", - "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)", - "waf": "Cost" + "severity": "Low", + "subcategory": "Networking", + "text": "Check the network bandwidth required for each user and in total for the VM SKU", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", - "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", - "service": "Azure Functions", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "If Azure Files SMB share will be used to store user profiles via FSLogix, the usage of Private Endpoint (PE) for private access to the storage is recommended. AVD Session Hosts will access the storage using a private IP in the same VNet, a separate subnet is recommended. This feature has an additional cost that must be evaluated. If PE will not be used, at least Service Endpoint is recommended (no cost associated).", + "guid": "ec27d589-9178-426d-8df2-ff60020f30a6", + "link": "https://learn.microsoft.com/azure/storage/files/storage-files-networking-endpoints", "services": [ - "WAF" + "Storage", + "VNet", + "Cost", + "PrivateLink", + "AVD" ], "severity": "Medium", - "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.", - "waf": "Cost" + "subcategory": "Networking", + "text": "Evaluate usage Private Endpoint for Azure Files share", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", - "service": "Azure Functions", + "category": "Networking", + "checklist": "Azure Virtual Desktop Review", + "description": "Connections to Azure Virtual Desktop can use TCP or UDP. RDP Shortpath is a feature of AVD that establishes a direct UDP-based transport between a supported Windows Remote Desktop client and session host. if clients have line of sight to AVD session hosts from internal network (VPN usage is not recommended), this feature can provide lower latency and best performances as explained in https://learn.microsoft.com/azure/virtual-desktop/rdp-shortpath?tabs=managed-networks#key-benefits.", + "guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4", + "link": "https://docs.microsoft.com/azure/virtual-desktop/shortpath", "services": [ - "WAF" + "VPN", + "AVD" ], "severity": "Medium", - "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", - "waf": "Cost" + "subcategory": "Networking", + "text": "Evaluate usage of RDP ShortPath for clients connecting from managed internal networks", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Front Door", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Security mechanisms provided by GPO should be used, if available. For example, it is possible to impose desktop screen lock and idle session disconnection time. Existing GPOs applied to on-premises environment should be reviewed and eventually applied also to secure also AVD Hosts when joined to the domain.", + "guid": "a135e337-897e-431c-97d6-8cb6a22ac19f", + "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#establish-maximum-inactive-time-and-disconnection-policies", "services": [ - "FrontDoor", - "EventHubs", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.", - "waf": "Cost" + "subcategory": "Active Directory", + "text": "Review Active Directory GPO to secure RDP sessions", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Front Door", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Microsoft Defender for Endpoint supports Azure Virtual Desktop for Windows 10/11 Enterprise multi-session. Check article for onboarding non-persistent virtual desktop infrastructure (VDI) devices: https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi", + "guid": "b1172576-9ef6-4691-a483-5ac932223ece", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus", "services": [ - "AppSvc", - "FrontDoor", - "WAF" + "Defender", + "AVD" ], - "severity": "Medium", - "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.", - "waf": "Cost" + "severity": "High", + "subcategory": "Host Configuration", + "text": "Ensure anti-virus and anti-malware solutions are used", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", - "service": "Storage", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Disks in Azure are already encrypted at rest by default with Microsoft managed keys. Host VM OS disk encryption is possible and supported using Azure Disk Encryption (ADE - BitLocker) and Disk Encryption Set (DES - Server Side Encryption), the latter is recommended. Encryption of FSLogix storage using Azure Files can be done using SSE on Azure Storage. For OneDrive encryption, see this article: https://docs.microsoft.com/compliance/assurance/assurance-encryption-for-microsoft-365-services.", + "guid": "0fd32907-98bc-4178-adc5-a06ca7144351", + "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", "services": [ - "WAF" + "Storage", + "VM", + "AKV", + "AVD" ], - "severity": "Medium", - "text": "Consider archiving tiers for less used data", - "waf": "Cost" + "severity": "Low", + "subcategory": "Host Configuration", + "text": "Assess disk encryption requirements for AVD Session Hosts", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "VM", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Trusted launch are Gen2 Azure VMs with enhanced security features aimed to protect against “bottom of the stack” threats through attack vectors such as rootkits, boot kits, and kernel-level malware. Recommended to enable and leverage Secure Boot, Virtual TPM (vTPM) and Integrity Monitoring.", + "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28", + "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#azure-virtual-desktop-support-for-trusted-launch", "services": [ - "WAF" + "Monitor", + "VM", + "AVD" ], "severity": "Medium", - "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing", - "waf": "Cost" + "subcategory": "Host Configuration", + "text": "Enable Trusted launch in Azure Gen2 VM Session Hosts", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "Storage", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Trusted Launch and Gen2 VM are not only security and performance enhancing features but also system requirements for Windows 11. When building an AVD environment based on Windows 11, it is essential to enable these features.", + "guid": "135d3899-4b31-44d3-bc8f-028871a359d8", + "link": "https://learn.microsoft.com/windows/whats-new/windows-11-requirements", "services": [ - "WAF" + "VM", + "AVD" ], - "severity": "Medium", - "text": "Consider using standard SSD rather than Premium or Ultra where possible", - "waf": "Cost" + "severity": "High", + "subcategory": "Host Configuration", + "text": "Enable Trusted Launch and use Gen2 image are system requirements for Windows 11", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "Storage", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Displayed content will be automatically blocked or hidden in screenshots. Keep in mind screen sharing will also be blocked when using Teams or other collaboration software which use screen sharing.", + "guid": "a49dc137-7896-4343-b2bc-1a31bf1d30b6", + "link": "https://learn.microsoft.com/azure/virtual-desktop/screen-capture-protection", "services": [ - "Storage", - "WAF" + "AVD" ], - "severity": "Medium", - "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)", - "waf": "Cost" + "severity": "Low", + "subcategory": "Host Configuration", + "text": "Consider enabling screen capture protection to prevent sensitive information from being captured", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "Site Recovery", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "If not absolutely required, redirecting drives, printers, and USB devices to a user's local device in a remote desktop session should be disabled or highly restricted. Restrict Windows Explorer access by hiding local and remote drive mappings is also a secure measure to adopt preventing users from discovering unwanted information about system configuration and users.", + "guid": "7ce2cd20-85b4-4f82-828e-6558736ede6a", + "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#other-security-tips-for-session-hosts", "services": [ - "ASR", - "WAF" + "AVD" ], "severity": "Medium", - "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it", - "waf": "Cost" + "subcategory": "Host Configuration", + "text": "Restrict device redirection and drive mapping", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", - "service": "Storage", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "When choosing a deployment model, you can either provide remote users access to entire virtual desktops or only select applications. Remote applications, or RemoteApps, provide a seamless experience as the user works with apps on their virtual desktop. RemoteApps reduce risk by only letting the user work with a subset of the remote machine exposed by the application.", + "guid": "4e25d70e-3924-44f4-b66f-d6cdd4f4a973", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/web-protection-overview", "services": [ - "Storage", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Storage accounts: check hot tier and/or GRS necessary", - "waf": "Cost" + "subcategory": "Management", + "text": "When possible, prefer Remote Apps over Full Desktops (DAG)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "VM", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Web content filtering feature provided by Web Protection capability in Microsoft Defender for Endpoint, can be used to to control user web navigation. If this tool is used, configuration of web filtering for user Internet browsing is recommended. Access by the Guest OS system to required AVD control plane URLs must be guaranteed.", + "guid": "e19dd344-29eb-4722-a237-a151c5bb4e4f", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/web-protection-overview", "services": [ - "WAF" + "Defender", + "AVD" ], "severity": "Medium", - "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ", - "waf": "Cost" + "subcategory": "Management", + "text": "Need to control/restrict user Internet navigation from AVD session hosts?", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "Synapse", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "We recommend you don't grant your users admin access to virtual desktops. If you need software packages, we recommend you make them available through configuration management utilities.", + "guid": "a0cdb3b5-4eb2-4eb0-9dda-a3592718e2ed", + "link": "https://docs.microsoft.com/azure/virtual-desktop/security-guide", "services": [ - "EventHubs", - "Cost", - "Monitor", - "WAF" + "AVD" ], - "severity": "Medium", - "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.", - "waf": "Cost" + "severity": "High", + "subcategory": "Management", + "text": "Ensure AVD users will not have local administrator privileges on AVD Hosts", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "Synapse", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "We recommend you enable Defender for Cloud for the subscriptions, virtual machines, key vaults, and storage accounts used by AVD. With this tool is possible to assess and manage vulnerabilities, assess compliance with common frameworks like PCI, strengthen the overall security of your AVD environment and measure it over time using 'Secure Score': https://learn.microsoft.com/azure/virtual-desktop/security-guide#improve-your-secure-score.", + "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998", + "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#enable-microsoft-defender-for-cloud", "services": [ - "Cost", "Storage", - "WAF" - ], - "severity": "Medium", - "text": "Export cost data to a storage account for additional data analysis.", - "waf": "Cost" - }, - { - "checklist": "WAF checklist", - "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Synapse", - "services": [ - "Cost", - "SQL", - "WAF" + "Subscriptions", + "AKV", + "VM", + "Defender", + "AVD" ], "severity": "Medium", - "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.", - "waf": "Cost" + "subcategory": "Management", + "text": "Enable Microsoft Defender for Cloud to manage AVD Session Hosts security posture", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", - "service": "Synapse", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Enabling audit log collection lets you view user and admin activity related to Azure Virtual Desktop and store in a central repository like Log Analytics workspace. ", + "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352", + "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#collect-audit-logs", "services": [ - "WAF" + "Entra", + "Monitor", + "AVD" ], "severity": "Medium", - "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.", - "waf": "Cost" + "subcategory": "Management", + "text": "Enable diagnostic and audit logging", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Synapse", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Assign the least privilege required by defining administrative, operations, and engineering roles to Azure RBAC roles. To limit access to high privilege roles within your Azure Virtual Desktop landing zone, consider integration with Azure Privileged Identity Management (PIM). Maintaining knowledge of which team is responsible for each particular administrative area helps you determine Azure role-based access control (RBAC) roles and configuration.", + "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b", + "link": "https://docs.microsoft.com/azure/virtual-desktop/rbac", "services": [ - "WAF" + "Entra", + "RBAC", + "AVD" ], - "severity": "Medium", - "text": "Create multiple Apache Spark pool definitions of various sizes.", - "waf": "Cost" + "severity": "Low", + "subcategory": "Management", + "text": "Assess the requirement to use custom RBAC roles for AVD management", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "service": "Synapse", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "AVD users should not have permission to install application. If required, Windows Defender Application Control (WDAC) can be used to control which drivers and applications are allowed to run on their Windows clients. ", + "guid": "b9ea80c8-0628-49fc-ae63-125aa4c0a284", + "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#windows-defender-application-control", "services": [ - "Cost", - "WAF" + "Defender", + "AVD" ], "severity": "Medium", - "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "subcategory": "Management", + "text": "Restrict users from installing un-authorized applications", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "VM", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "Enabling MFA and CA lets you manage risks before you grant users access to your AVD environment. When deciding which users to grant access to, we recommend you also consider who the user is, how they sign in, and which device they're using. Additional details and configuration procedures are provided in the companion article. Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).", + "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9", + "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa", "services": [ - "Cost", - "VM", - "WAF" + "Entra", + "AVD" ], "severity": "Medium", - "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "subcategory": "Microsoft Entra ID", + "text": "Evaluate the usage of Multi-Factor Authentication (MFA) and Conditional Access (CA) for AVD users", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "544451e1-92d3-4442-a3c7-628637a551c5", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", + "category": "Security", + "checklist": "Azure Virtual Desktop Review", + "description": "If Zero Trust is a requirement, review the companion article in the 'More Info' column. It provides steps to apply the principles of Zero Trust to an Azure Virtual Desktop deployment.", + "guid": "221102d0-90af-49fc-b2b7-8d3fe397e43", + "link": "https://learn.microsoft.com/security/zero-trust/azure-infrastructure-avd", "services": [ - "VM", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Right-sizing all VMs", - "waf": "Cost" + "subcategory": "Zero Trust", + "text": "Review and Apply Zero Trust principles and guidance", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "VM", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "If used, make sure to check the list of best practices and recommendations described in the referenced article.", + "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6", + "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files#best-practices-for-azure-virtual-desktop", "services": [ - "VM", - "WAF" + "Storage", + "AVD" ], "severity": "Medium", - "text": "Swap VM sized with normalized and most recent sizes", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "subcategory": "Azure Files", + "text": "Check best-practices for Azure Files", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "SMB Multichannel enables clients to use multiple network connections that provide increased performance while lowering the cost of ownership. Increased performance is achieved through bandwidth aggregation over multiple NICs and utilizing Receive Side Scaling (RSS) support for NICs to distribute the IO load across multiple CPUs.", + "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369", + "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance", "services": [ - "VM", - "Monitor", - "WAF" + "Storage", + "ACR", + "Cost", + "AVD" ], - "severity": "Medium", - "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "severity": "Low", + "subcategory": "Azure Files", + "text": "Enable SMB multichannel when using a premium file share to host FSLogix profile containers.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "If a second region is required for DR purposes verify NetApp availability in there as well.", + "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3", + "link": "https://azure.microsoft.com/global-infrastructure/services/", "services": [ - "VM", - "WAF" + "Storage", + "AVD" ], "severity": "Medium", - "text": "Containerizing an application can improve VM density and save money on scaling it", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Cost" + "subcategory": "Azure NetApp Files", + "text": "If NetApp Files storage is required, check storage service availability in your specific region.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "65285269-441c-44bf-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview", - "service": "PostgreSQL", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "CA option is a recommended setting in the FSLogix scenario, as it enables a more resilient SMB session between the Session Host and NetApp Files.", + "guid": "a2661898-866a-4c8d-9d1f-8cfc86e88024", + "link": "https://learn.microsoft.com/azure/virtual-desktop/create-fslogix-profile-container", "services": [ - "WAF" + "Storage", + "AVD" ], "severity": "Medium", - "text": "Leverage Flexible Server", + "subcategory": "Azure NetApp Files", + "text": "If NetApp Files storage is used enable CA (Continuous Availability) option to increase resiliency", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "016ccf31-ae5a-41eb-9888-9535e227896d", - "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability", - "service": "PostgreSQL", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "An Active Directory Site should be created for the Azure virtual network environment where Azure NetApp Files (ANF) subnet will be created, and that site name should be specified in the ANF connection property when executing the join procedure as explained in the reference article.", + "guid": "6647e977-db49-48a8-bc35-743f17499d42", + "link": "https://docs.microsoft.com/azure/azure-netapp-files/create-active-directory-connections", "services": [ - "WAF" + "Storage", + "VNet", + "AVD" ], "severity": "High", - "text": "Leverage Availability Zones where regionally applicable", - "waf": "Reliability" - }, - { - "checklist": "WAF checklist", - "guid": "31b67c67-be59-4519-8083-845d587cb391", - "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas", - "service": "PostgreSQL", - "services": [ - "WAF" - ], - "severity": "Medium", - "text": "Leverage cross-region read replicas for BCDR", + "subcategory": "Azure NetApp Files", + "text": "If Azure NetApp Files storage is used, check Active Directory Site name setting in the Active Directory Connection configuration", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", - "service": "Azure Data Factory", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "Possible options: Standard HDD, Standard SSD, or Premium SSD. Ephemeral disks are not supported, Ultra-Disks not recommended. Recommended to evaluate Premium for OS disk if user density is not low, and if Cloud Cache will be used. ", + "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c", + "link": "https://docs.microsoft.com/azure/virtual-machines/disks-types", "services": [ - "WAF" + "Storage", + "AVD" ], "severity": "Medium", - "text": "Leverage FTA Resiliency Playbook for Azure Data Factory", - "waf": "Reliability" + "subcategory": "Capacity Planning", + "text": "Determine which type of managed disk will be used for the Session Hosts", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "Possible options are: Azure NetApp Files, Azure Files, VM based File Server. File-server it is not recommended. Azure Files Premium typically a good starting point. NetApp usually required for large scale / high-performant environment. For a detailed comparison see the article in the 'More Info' column.", + "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339", + "link": "https://docs.microsoft.com/azure/virtual-desktop/store-fslogix-profile", "services": [ - "WAF" + "Storage", + "VM", + "AVD" ], "severity": "High", - "text": "Use zone redundant pipelines in regions that support Availability Zones", - "waf": "Reliability" + "subcategory": "Capacity Planning", + "text": "Determine which storage backend solution will be used for FSLogix Profiles", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", - "link": "https://learn.microsoft.com/azure/data-factory/source-control", - "service": "Azure Data Factory", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "Every Host Pool should use a separate set of storage accounts/volumes (at least one) and shares. Users should have a different profile for each Host Pool since settings and configurations are specific to each Host Pool. Additionally, accessing different Host Pools at the same time can cause errors on the shared user profile VHD/X. Usage of different storage accounts/volumes for multiple shares is also recommended to scale independently.", + "guid": "2fad62bd-5004-453c-ace4-64d862e7f5a4", + "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile", "services": [ - "Backup", - "WAF" + "Storage", + "AVD" ], - "severity": "Medium", - "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ", - "waf": "Reliability" + "severity": "High", + "subcategory": "Capacity Planning", + "text": "Do not share storage and profiles between different Host Pools", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "As a starting point for estimating profile container storage performance requirements we recommend to assume 10 IOPS per user in the steady state and 50 IOPS per user during sign-in/sign-out. Space requirements is simply obtained based on the maximum profiles size in FSLogix per the total number of users for each Host Pool. Multiple storage accounts can be used for the same Host Pool if required.", + "guid": "680e7828-9c93-4665-9d02-bff4564b0d93", + "link": "https://learn.microsoft.com/azure/virtual-desktop/faq#what-s-the-largest-profile-size-fslogix-can-handle-", "services": [ - "VM", - "WAF" + "Storage", + "AVD" ], - "severity": "Medium", - "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ", + "severity": "High", + "subcategory": "Capacity Planning", + "text": "Verify storage scalability limits and Host Pool requirements", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "Avoid introducing additional latency and costs associated with cross-region network traffic where possible.", + "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e", + "link": "https://docs.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files", "services": [ - "VNet", - "WAF" + "Storage", + "Cost", + "AVD" ], - "severity": "Medium", - "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region", - "waf": "Reliability" + "severity": "High", + "subcategory": "Capacity Planning", + "text": "For optimal performance, the storage solution and the FSLogix profile container should be in the same Azure region.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you", - "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Azure Data Factory", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "The recommendation in Azure Virtual Desktop is to use Profile Container without Office Container (ODFC) split unless you are planning for specific Business Continuity and Disaster Recovery (BCDR) scenarios as described in the Disaster Recovery section below. https://docs.microsoft.com/fslogix/profile-container-office-container-cncpt ", + "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39", + "link": "https://learn.microsoft.com/fslogix/concepts-container-types#when-to-use-profile-and-odfc-containers", "services": [ - "AKV", - "WAF" + "Storage", + "ASR", + "AVD" ], - "severity": "Low", - "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity", + "severity": "High", + "subcategory": "FSLogix", + "text": "Do not use Office Containers (ODFC) if not strictly required and justified", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage", - "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", - "service": "Azure Storage", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "Make sure to configure the following antivirus exclusions for FSLogix Profile Container virtual hard drives, as documented in the referenced article in the 'More Info' column.", + "guid": "83f63047-22ee-479d-9b5c-3632054b69ba", + "link": "https://learn.microsoft.com/fslogix/overview-prerequisites#configure-antivirus-file-and-folder-exclusions", "services": [ "Storage", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Consider the 'Azure security baseline for storage'", + "subcategory": "FSLogix", + "text": "Configure the recommended antivirus exclusions for FSLogix (includes not scanning VHD(x) files on connect).", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet", - "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", - "service": "Azure Storage", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "Profile containers have a default max size of 30GB. If large Profile Containers are anticipated, and customers wants to try to keep them small, consider using OneDrive to host Office 365 files outside the FSLogix profile.", + "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5", + "link": "https://docs.microsoft.com/fslogix/profile-container-configuration-reference", "services": [ - "PrivateLink", "Storage", - "WAF" + "AVD" ], "severity": "High", - "text": "Consider using private endpoints for Azure Storage", - "waf": "Security" + "subcategory": "FSLogix", + "text": "Review and confirm configured maximum profile size in FSLogix", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription", - "guid": "30e37c3e-2971-41b2-963c-eee079b598de", - "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", - "service": "Azure Storage", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "Defaults and recommended settings are reported in the companion article in the 'More Info' column. If not recommended keys and/or values must be used, be sure to review with a Microsoft AVD expert and clearly document your choices.", + "guid": "d34aad5e-8c78-4e1d-9666-7313c405674c", + "link": "https://learn.microsoft.com/fslogix/concepts-configuration-examples", "services": [ - "RBAC", "Storage", - "Subscriptions", - "WAF" + "ACR", + "AKV", + "AVD" ], - "severity": "Medium", - "text": "Ensure older storage accounts are not using 'classic deployment model'", - "waf": "Security" + "severity": "High", + "subcategory": "FSLogix", + "text": "Review FSLogix registry keys and determine which ones to apply", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.", - "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", - "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", - "service": "Azure Storage", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "Concurrent or multiple connections are not recommended in Azure Virtual Desktop. Concurrent connections are also not supported by Session Hosts running in an Azure Virtual Desktop Host Pool. OneDrive, if used, doesn't support concurrent or multiple connections using the same container, under any circumstance. For multiple connections, usage of the same profile disk is not recommended.", + "guid": "5e985b85-9c77-43e7-b261-623b775a917e", + "link": "https://learn.microsoft.com/fslogix/concepts-multi-concurrent-connections", "services": [ - "Defender", "Storage", - "WAF" + "AVD" ], "severity": "High", - "text": "Enable Microsoft Defender for all of your storage accounts", - "waf": "Security" + "subcategory": "FSLogix", + "text": "Avoid usage of concurrent or multiple connections", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.", - "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", - "service": "Azure Storage", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "Cloud Cache uses OS drive as local cache storage and may generate lot of pressure on the VM disk. Depending on the VM SKU and size used, the VM temporary drive can be a viable and performant solution where to relocate Cloud Cache cached content. Before adopting this solution, tests should be executed to confirm performance and stability. More details on Cloud Cache can be found here: https://learn.microsoft.com/fslogix/concepts-fslogix-cloud-cache. ", + "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b", + "link": "https://docs.microsoft.com/fslogix/cloud-cache-configuration-reference", "services": [ "Storage", - "WAF" + "VM", + "AVD" ], - "severity": "Medium", - "text": "Enable 'soft delete' for blobs", - "waf": "Security" + "severity": "Low", + "subcategory": "FSLogix", + "text": "If FSLogix Cloud Cache is used, consider moving the cache directory to the VM temporary drive.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", - "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", + "category": "Storage", + "checklist": "Azure Virtual Desktop Review", + "description": "REDIRECTION.XML file is used to control what folders are redirected out of the profile container to the 'C:' drive. Exclusions should be the exception and should never be used unless the specific exclusion is completely understood by the person configuring the exclusion. Exclusions should always be fully tested in the environment where they are intended to be implemented. Configuring exclusions may impact functionality, stability and performance.", + "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de", + "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml", "services": [ "Storage", - "WAF" + "AVD" ], "severity": "Medium", - "text": "Disable 'soft delete' for blobs", - "waf": "Security" + "subcategory": "FSLogix", + "text": "Review the usage of FSLogix redirection.", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.", - "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", - "service": "Azure Storage", + "category": "BCDR", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Ensure that your backups are protected against attacks. This should include encryption of the backups to protect against loss of confidentiality. For regular Azure service backup, backup data is automatically encrypted using Azure platform-managed keys. You can also choose to encrypt the backup using a customer-managed key. In this case, ensure this customer-managed key in the key vault is also in the backup scope.", + "guid": "676f6951-0368-49e9-808d-c33a692c9a64", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data", "services": [ - "WAF" + "Backup", + "AKV", + "SQL" ], - "severity": "High", - "text": "Enable 'soft delete' for containers", + "severity": "Medium", + "subcategory": "Azure Key Vault", + "text": "Protect your backup data with encryption and store keys safely in Azure Key Vault", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", - "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", + "category": "BCDR", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Azure SQL Database uses SQL Server technology to create full backups every week, differential backup every 12-24 hours, and transaction log backup every 5 to 10 minutes. By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region.", + "guid": "e2518261-b3bc-4bd1-b331-637fb2df833f", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups", "services": [ "Storage", - "WAF" + "Backup", + "SQL" ], "severity": "Medium", - "text": "Disable 'soft delete' for containers", + "subcategory": "Backup", + "text": "Configure Azure SQL Database automated backups", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion", - "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", + "category": "BCDR", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region. For SQL Database, the backup storage redundancy can be configured at the time of database creation or can be updated for an existing database; the changes made to an existing database apply to future backups only.", + "guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4", + "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy", "services": [ "Storage", - "WAF" + "Backup", + "SQL" ], - "severity": "High", - "text": "Enable resource locks on storage accounts", + "severity": "Low", + "subcategory": "Backup", + "text": "Enable geo-redundant backup storage to protect against single region failure and data loss", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.", - "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", - "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", - "service": "Azure Storage", + "category": "Code", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Malicious code can potentially circumvent security controls. Before deploying custom code to production, it is essential to review what's being deployed. Use a database tool like Azure Data Studio that supports source control. Implement tools and logic for code analysis, vulnerability and credential scanning.", + "guid": "7ca9f006-d2a9-4652-951c-de8e4ac5e76e", + "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server", "services": [ - "AzurePolicy", - "Storage", - "Subscriptions", - "WAF" - ], - "severity": "High", - "text": "Consider immutable blobs", - "waf": "Security" - }, - { - "checklist": "WAF checklist", - "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ", - "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Azure Storage", - "services": [ - "Storage", - "WAF" + "SQL" ], - "severity": "High", - "text": "Require HTTPS, i.e. disable port 80 on the storage account", + "severity": "Medium", + "subcategory": "Source Control and Code Review", + "text": "Use Source Control systems to store, maintain and review application code deployed inside Azure SQLDB Database", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.", - "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", - "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", - "service": "Azure Storage", + "category": "Data Discovery and Classification", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "In case of classification requirements Purview is the preferred option. Only use SQL Data Discovery & Classification in case Purview is not an option. Discover columns that potentially contain sensitive data. What is considered sensitive data heavily depends on the customer, compliance regulation, etc., and needs to be evaluated by the users in charge of that data. Classify the columns to use advanced sensitivity-based auditing and protection scenarios. Review results of automated discovery and finalize the classification if necessary.", + "guid": "d401509b-2629-4484-9a7f-af0d29a7778f", + "link": "https://learn.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql#faq---advanced-classification-capabilities", "services": [ - "Storage", - "WAF" + "SQL" ], - "severity": "High", - "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.", + "severity": "Low", + "subcategory": "Data Discovery and Classification", + "text": "Plan and configure Data Discovery & Classification to protect the sensitive data", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.", - "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", - "service": "Azure Storage", + "category": "Data Masking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Usage of this feature is recommended only if column encryption is not an option and there is a specific requirement to preserve data types and formats. Dynamic data masking limits sensitive data exposure by masking it to non-privileged users. Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal impact on the application layer.", + "guid": "9391fd50-135e-453e-90a7-c1a23f88cc13", + "link": "https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview", "services": [ - "Storage", - "WAF" + "SQL" ], - "severity": "Medium", - "text": "Limit shared access signature (SAS) tokens to HTTPS connections only", + "severity": "Low", + "subcategory": "Data Masking", + "text": "Use Data Masking to prevent unauthorized non-admin users data access if no encryption is possible", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "AAD tokens should be favored over shared access signatures, wherever possible", - "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", - "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", - "service": "Azure Storage", + "category": "Defender", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "SQL Advanced Threat Detection (ATP) provides a layer of security that detects potential vulnerabilities and anomalous activity in databases such as SQL injection attacks and unusual behavior patterns. When a potential threat is detected Threat Detection sends an actionable real-time alert by email and in Microsoft Defender for Cloud, which includes clear investigation and remediation steps for the specific threat.", + "guid": "4e52d73f-5d37-428f-b3a2-e6997e835979", + "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure", "services": [ - "Entra", - "Storage", - "WAF" + "EventHubs", + "Defender", + "SQL" ], "severity": "High", - "text": "Use Azure Active Directory (Azure AD) tokens for blob access", + "subcategory": "Advanced Threat Protection", + "text": "Review and complete Advanced Threat Protection (ATP) configuration", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.", - "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", - "service": "Azure Storage", + "category": "Defender", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Enable Microsoft Defender for Azure SQL at the subscription level to automatically onboard and protect all existing and future servers and databases. When you enable on the subscription level, all databases in Azure SQL Database and Azure SQL Managed Instance are protected. You can then disable them individually if you choose. If you want to manually manage which databases are protected, disable at the subscription level and enable each database that you want protected.", + "guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1", + "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ", "services": [ - "RBAC", - "WAF" + "Subscriptions", + "Defender", + "SQL" ], - "severity": "Medium", - "text": "Least privilege in IaM permissions", + "severity": "High", + "subcategory": "Defender for Azure SQL", + "text": "Enable Microsoft Defender for Azure SQL", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ", - "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", - "service": "Azure Storage", + "category": "Defender", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Microsoft Defender for Azure SQL ATP detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. Alerts can be configured and generated and will be reported in the Defender for console.", + "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea", + "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure", "services": [ - "Entra", - "Storage", - "WAF" + "Monitor", + "Defender", + "SQL" ], "severity": "High", - "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.", + "subcategory": "Defender for Azure SQL", + "text": "Prepare a security response plan to promptly react to Microsoft Defender for Azure SQL alerts", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ", - "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", - "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", - "service": "Azure Storage", + "category": "Defender", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Azure SQLDB vulnerability assessment is a service that provides visibility into your security state. Vulnerability assessment includes actionable steps to resolve security issues and enhance your database security. It can help you to monitor a dynamic database environment where changes are difficult to track and improve your SQL security posture.", + "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview", "services": [ "Monitor", - "AKV", - "Storage", - "Entra", - "WAF" + "Defender", + "SQL" ], "severity": "High", - "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.", + "subcategory": "Vulnerability Assessment", + "text": "Configure Vulnerability Assessment (VA) findings and review recommendations", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).", - "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", - "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", - "service": "Azure Storage", + "category": "Defender", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Microsoft Defender for Cloud provides vulnerability assessment for your Azure SQL Databases. Vulnerability assessment scans your databases for software vulnerabilities and provides a list of findings. You can use the findings to remediate software vulnerabilities and disable findings.", + "guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql", "services": [ - "Monitor", - "AzurePolicy", - "AKV", - "Storage", - "WAF" + "Defender", + "SQL" ], "severity": "High", - "text": "Consider using Azure Monitor to audit control plane operations on the storage account", + "subcategory": "Vulnerability Assessment", + "text": "Regularly review of Vulnerability Assessment (VA) findings and recommendations and prepare a plan to fix", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.", - "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", - "service": "Azure Storage", + "category": "Encryption", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Always Encrypted with Secure Enclaves expands confidential computing capabilities of Always Encrypted by enabling in-place encryption and richer confidential queries. Always Encrypted with Secure Enclaves addresses these limitations by allowing some computations on plaintext data inside a secure enclave on the server side. Usage of this feature is recommended for the cases where you need to limit administrator access and need your queries to support more than equality matching of encrypted columns.", + "guid": "65d7e54a-10a6-4094-b673-9ff3809c9277", + "link": "https://learn.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves", "services": [ - "AzurePolicy", - "AKV", - "Storage", - "WAF" + "SQL" ], "severity": "Medium", - "text": "When using storage account keys, consider enabling a 'key expiration policy'", + "subcategory": "Always Encrypted", + "text": "If protecting sensitive PII data from admin users is a key requirement, but Column Encryption limitations cannot be tolerated, consider the adoption of Always Encrypted with Secure Enclaves", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.", - "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", - "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", - "service": "Azure Storage", + "category": "Encryption", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "With Azure SQL Database, you can apply symmetric encryption to a column of data by using Transact-SQL. This approach is called column encryption, because you can use it to encrypt specific columns with different encryption keys. Doing so gives you more granular encryption capability than TDE, which encrypts data in pages. Using Always Encrypted to ensure sensitive data isn't exposed in plaintext in Azure SQL Database or SQL Managed Instance, even in memory/in use. Always Encrypted protects the data from Database Administrators (DBAs) and cloud admins (or bad actors who can impersonate high-privileged but unauthorized users) and gives you more control over who can access your data.", + "guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3", + "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption", "services": [ - "AzurePolicy", - "WAF" + "Storage", + "AKV", + "SQL" ], - "severity": "Medium", - "text": "Consider configuring an SAS expiration policy", + "severity": "Low", + "subcategory": "Column Encryption", + "text": "To protect sensitive PII data from non-admin users in specific table columns, consider using Column Encryption", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ", - "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", - "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", - "service": "Azure Storage", + "category": "Encryption", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Enabled by default, Transparent data encryption (TDE) helps to protect the database files against information disclosure by performing real-time encryption and decryption of the database, associated backups, and transaction log files 'at rest', without requiring changes to the application.", + "guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d", + "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server", "services": [ - "AzurePolicy", - "AKV", "Storage", - "WAF" + "Backup", + "SQL" ], - "severity": "Medium", - "text": "Consider linking SAS to a stored access policy", + "severity": "High", + "subcategory": "Transparent Data Encryption", + "text": "Ensure Transparent Data Encryption (TDE) is kept enabled", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", - "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", - "service": "Azure Storage", + "category": "Encryption", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "If separation of duties in the management of keys and data within the organization is required, leverage Customer Managed Keys (CMK) for Transparent Data Encryption (TDE) for your Azure SQLDB and use Azure Key Vault to store (refer to its checklist). Leverage this feature when you have strict security requirements which cannot be met by the managed service keys.", + "guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25", + "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview", "services": [ "AKV", - "Storage", - "WAF" + "SQL" ], "severity": "Medium", - "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.", + "subcategory": "Transparent Data Encryption", + "text": "Use customer-managed keys (CMK) in Azure Key Vault (AKV) if you need increased transparency and granular control over the TDE protection", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.", - "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", - "service": "Azure Storage", + "category": "Encryption", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "The minimal Transport Layer Security (TLS) version setting allows customers to choose which version of TLS their SQL database uses. It's possible to change the minimum TLS version by using the Azure portal, Azure PowerShell, and the Azure CLI.", + "guid": "7754b605-57fd-4bcb-8213-52c39d8e8225", + "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings?source=recommendations&view=azuresql&tabs=azure-portal#minimal-tls-version", "services": [ - "Entra", - "Storage", - "WAF" + "SQL" ], "severity": "High", - "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)", + "subcategory": "Transport Layer Security", + "text": "Enforce minimum TLS version to the latest available", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.", - "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", + "category": "Identity", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Use Azure Active Directory (Azure AD) authentication for centralized identity management. Use SQL Authentication only if really necessary and document as exceptions.", + "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7", + "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview", "services": [ - "AzurePolicy", - "Storage", - "WAF" + "Entra", + "SQL" ], - "severity": "High", - "text": "Strive for short validity periods for ad-hoc SAS", + "severity": "Medium", + "subcategory": "Azure Active Directory", + "text": "Leverage Azure AD authentication for connections to Azure SQL Databases", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.", - "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", + "category": "Identity", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Using Azure AD groups simplifies permission management and both the group owner, and the resource owner can add/remove members to/from the group. Create a separate group for Azure AD administrators for each logical server. Monitor Azure AD group membership changes using Azure AD audit activity reports.", + "guid": "29820254-1d14-4778-ae90-ff4aeba504a3", + "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities", "services": [ - "WAF" + "Entra", + "Monitor", + "SQL" ], "severity": "Medium", - "text": "Apply a narrow scope to a SAS", + "subcategory": "Azure Active Directory", + "text": "Create a separate Azure AD group with two admin accounts for each Azure SQL Database logical server", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ", - "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", - "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", - "service": "Azure Storage", + "category": "Identity", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Ensure that distinct system and user assigned managed identities, that are dedicated to the function, with least permissions assigned, are used for communication from Azure services and applications to the Azure SQLDB databases.", + "guid": "df3a09ee-03bb-4198-8637-d141acf5f289", + "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications", "services": [ - "WAF" + "Entra", + "SQL" ], "severity": "Medium", - "text": "Consider scoping SAS to a specific client IP address, wherever possible", + "subcategory": "Azure Active Directory", + "text": "Minimize the use of password-based authentication for applications", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.", - "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", - "service": "Azure Storage", + "category": "Identity", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "System or User assigned managed identities enable Azure SQLDB to authenticate to other cloud services (e.g. Azure Key Vault) without storing credentials in code. Once enabled, all necessary permissions can be granted via Azure role-based-access-control to the specific Azure SQLDB instance. Do not share user assigned managed identities across multiple services if not strictly required.", + "guid": "69891194-5074-4e30-8f69-4efc3c580900", + "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", "services": [ - "Storage", - "WAF" + "Entra", + "RBAC", + "AKV", + "SQL", + "ACR" ], "severity": "Low", - "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ", + "subcategory": "Managed Identities", + "text": "Assign Azure SQL Database a managed identity for outbound resource access", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint", - "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", - "service": "Azure Storage", + "category": "Identity", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Use an Azure AD integrated authentication that eliminates the use of passwords. Password-based authentication methods are a weaker form of authentication. Credentials can be compromised or mistakenly given away. Use single sign-on authentication using Windows credentials. Federate the on-premises AD domain with Azure AD and use integrated Windows authentication (for domain-joined machines with Azure AD).", + "guid": "88287d4a-8bb8-4640-ad78-03f51354d003", + "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication", "services": [ "Entra", - "RBAC", - "Storage", - "WAF" + "SQL" ], - "severity": "High", - "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.", + "severity": "Medium", + "subcategory": "Passwords", + "text": "Minimize the use of password-based authentication for users", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", - "service": "Azure Storage", + "category": "Ledger", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Confidential Ledger is one of the supported store, it can be used and supports automatic generation and storage of database digests. Azure Ledger provides advanced security features like Blockchain Ledger Proof and Confidential Hardware Enclaves. Use it only if advanced security features are required, otherwise revert to Azure storage.", + "guid": "0e853380-50ba-4bce-b2fd-5c7391c85ecc", + "link": "https://learn.microsoft.com/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage", "services": [ - "WAF" + "Storage", + "SQL" ], "severity": "Medium", - "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.", + "subcategory": "Database Digest", + "text": "Use Azure Confidential Ledger to store database digests only if advanced security features are required", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.", - "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", - "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", - "service": "Azure Storage", + "category": "Ledger", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Blob Storage with Immutable Storage feature can be used and supports automatic generation and storage of database digests. To prevent tampering of your digest files, configure and lock a retention policy for your container.", + "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a", + "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management", "services": [ - "AzurePolicy", "Storage", - "WAF" + "AzurePolicy", + "SQL" ], - "severity": "High", - "text": "Avoid overly broad CORS policies", + "severity": "Medium", + "subcategory": "Database Digest", + "text": "If Azure storage account is used to store database digests, ensure security is properly configured", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.", - "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "Azure Storage", + "category": "Ledger", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Ledger provides a form of data integrity called forward integrity, which provides evidence of data tampering on data in your ledger tables. The database verification process takes as input one or more previously generated database digests. It then recomputes the hashes stored in the database ledger based on the current state of the ledger tables. If the computed hashes don't match the input digests, the verification fails. The failure indicates that the data has been tampered with. The verification process reports all inconsistencies that it detects.", + "guid": "f8d4ffda-8aac-4cc6-b72b-c81cb8625420", + "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-database-verification", "services": [ "Storage", - "WAF" + "SQL" ], - "severity": "High", - "text": "Determine how data at rest should be encrypted. Understand the thread model for data.", + "severity": "Medium", + "subcategory": "Integrity", + "text": "Schedule the Ledger verification process regularly to verify data integrity", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", - "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", - "service": "Azure Storage", + "category": "Ledger", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "The Ledger feature provides tamper-evidence capabilities in your database. You can cryptographically attest to other parties, such as auditors or other business parties, that your data hasn't been tampered with. Ledger helps protect data from any attacker or high-privileged user, including database administrators (DBAs), system administrators, and cloud administrators.", + "guid": "2563f498-e2d3-42ea-9e7b-5517881a06a2", + "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview", "services": [ - "WAF" + "SQL" ], "severity": "Medium", - "text": "Determine which/if platform encryption should be used.", + "subcategory": "Ledger", + "text": "If cryptographic proof of data integrity is a critical requirement, Ledger feature should be considered", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", - "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", - "service": "Azure Storage", + "category": "Ledger", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Depending on the type of tampering, there are cases where you can repair the ledger without losing data. In the article contained in the --More Info-- column, different scenarios and recovery techniques are described.", + "guid": "804fc554-6554-4842-91c1-713b32f99902", + "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering", "services": [ - "WAF" + "SQL" ], "severity": "Medium", - "text": "Determine which/if client-side encryption should be used.", + "subcategory": "Recovery", + "text": "Prepare a response plan to investigate and repair a database after a tampering event", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.", - "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", - "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", - "service": "Azure Storage", + "category": "Logging", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Azure SQL Database Auditing tracks database events and writes them to an audit log in your Azure storage account. Auditing helps you understand database activity and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations as well as helps you meet regulatory compliance. By default auditing policy includes all actions (queries, stored procedures and successful and failed logins) against the databases, which may result in high volume of audit logs. It's recommended for customers to configure auditing for different types of actions and action groups using PowerShell.", + "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6", + "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", "services": [ "Storage", - "WAF" + "AzurePolicy", + "SQL" ], - "severity": "High", - "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ", + "severity": "Medium", + "subcategory": "Auditing", + "text": "Ensure that Azure SQL Database Auditing is enabled at the server level", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal", - "service": "Azure Storage", + "category": "Logging", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Azure SQL Database Auditing logs can be written to external storage accounts, Log Analytics workspace or Event Hub. Be sure to protect the target repository using backups and secured configuration. Use Azure SQL Database Managed Identity to access the storage and set an explicit retention period. Do not grant permissions to administrators to the audit log repository. Use a different target storage for --Enabling Auditing of Microsoft support operations--. ", + "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46", + "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", "services": [ "Storage", - "WAF" + "Entra", + "Backup", + "EventHubs", + "SQL", + "Monitor" ], - "severity": "High", - "text": "Leverage a storagev2 account type for better performance and reliability", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Auditing", + "text": "Ensure that Azure SQL Database Auditing logs are backed up and secured in the selected repository type", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "e05bbe20-9d49-4fda-9777-8424d116785c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Azure Storage", + "category": "Logging", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "The Azure Monitor activity log is a platform log in Azure that provides insight into subscription-level events. The activity log includes information like when a resource is modified. It is recommended to send this activity log to the same external storage repository as the Azure SQL Database Audit Log (storage account, Log Analytics workspace, Event Hub).", + "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "services": [ "Storage", - "WAF" + "Subscriptions", + "EventHubs", + "SQL", + "Monitor" ], - "severity": "High", - "text": "Leverage GRS, ZRS or GZRS storage for the highest availability", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Auditing", + "text": "Ensure that Azure SQL Database Activity Log is collected and integrated with Auditing logs", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "2fa56c56-ad48-4408-be72-734c486ba280", - "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance", - "service": "Azure Storage", + "category": "Logging", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Forward any logs from Azure SQL to your Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR). Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.", + "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44", + "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", "services": [ - "WAF" + "Monitor", + "SQL" ], "severity": "Medium", - "text": "For write operation after failover, use customer-Managed Failover ", - "waf": "Reliability" + "subcategory": "SIEM/SOAR", + "text": "Ensure that Azure SQL Database Auditing logs are being presented in to your organizations SIEM/SOAR", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc", - "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover", - "service": "Azure Storage", + "category": "Logging", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Forward any logs from Azure SQL to your Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR), which can be used to set up custom threat detections. Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.", + "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "services": [ - "WAF" + "Monitor", + "SQL" ], "severity": "Medium", - "text": "Understand Microsoft-Managed Failover details", - "waf": "Reliability" + "subcategory": "SIEM/SOAR", + "text": "Ensure that Azure SQL Database Activity Log data is presented in to your SIEM/SOAR", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal", - "service": "Azure Storage", + "category": "Logging", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Security Operation Center (SOC) team should create an incident response plan (playbooks or manual responses) to investigate and mitigate tampering, malicious activities, and other anomalous behaviors.", + "guid": "19ec7c97-c563-4e1d-82f0-54d6ec12e754", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "services": [ - "WAF" + "EventHubs", + "SQL" ], "severity": "Medium", - "text": "Enable Soft Delete", - "waf": "Reliability" + "subcategory": "SIEM/SOAR", + "text": "Ensure that you have response plans for malicious or aberrant audit logging events", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", - "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "When you create a logical server from the Azure portal for Azure SQL Database, the result is a public endpoint that is visible and reachable over the public network (Public Access). You can then limit connectivity based on firewall rules and Service Endpoint. You can also configure private connectivity only limiting connections to internal networks using Private Endpoint (Private Access). Private Access using Private Endpoint should be the default unless a business case or performance/technical reason applies that cannot support it. Usage of Private Endpoints has performance implications that need to be considered and assessed.", + "guid": "2c6d356a-1784-475b-a42c-ec187dc8c925", + "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview", "services": [ - "AzurePolicy", - "WAF" + "PrivateLink", + "SQL" ], - "severity": "Medium", - "text": "Implement an error handling policy at the global level", - "waf": "Operations" + "severity": "High", + "subcategory": "Connectivity", + "text": "Review Public vs. Private Access connectivity methods and select the appropriate one for the workload", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", - "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "IMPORTANT: Connections to private endpoint only support Proxy as the connection policy. When using private endpoints connections are proxied via the Azure SQL Database gateway to the database nodes. Clients will not have a direct connection.", + "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718", + "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture", "services": [ "AzurePolicy", - "WAF" + "PrivateLink", + "SQL" ], - "severity": "Medium", - "text": "Ensure all APIs policies include a element.", - "waf": "Operations" + "severity": "Low", + "subcategory": "Connectivity", + "text": "Keep default Azure SQL Database Connection Policy if not differently required and justified", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", - "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "This option configures the firewall to allow all connections from Azure, including connections from the subscriptions of other customers. If you select this option, make sure that your login and user permissions limit access to authorized users only. If not strictly required, keep this setting to OFF.", + "guid": "f48efacf-4405-4e8d-9dd0-16c5302ed082", + "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview", "services": [ - "AzurePolicy", - "ACR", - "WAF" + "Subscriptions", + "SQL" ], - "severity": "Medium", - "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs", - "waf": "Operations" + "severity": "High", + "subcategory": "Connectivity", + "text": "Ensure Allow Azure Services and Resources to Access this Server setting is disabled in Azure SQL Database firewall", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", - "link": "https://learn.microsoft.com/azure/api-management/monetization-support", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Azure SQL Database has a new built-in feature that allows native integration with external REST endpoints. This means that integration of Azure SQL Database with Azure Functions, Azure Logic Apps, Cognitive Services, Event Hubs, Event Grid, Azure Containers, API Management and in general any REST or even GraphQL endpoint. If not properly restricted, code inside an Azure SQL Database database could leverage this mechanism to exfiltrate data. If not strictly required, it is recommended to block or restrict this feature using Outbound Firewall Rules.", + "guid": "cb3274a7-e36d-46f6-8de5-46d30c8dde8e", + "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql", "services": [ - "WAF" + "EventHubs", + "APIM", + "SQL" ], "severity": "Medium", - "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices", - "waf": "Operations" - }, - { - "checklist": "WAF checklist", - "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", - "service": "APIM", - "services": [ - "Monitor", - "WAF" - ], - "severity": "High", - "text": "Enable Diagnostics Settings to export logs to Azure Monitor", - "waf": "Operations" + "subcategory": "Outbound Control", + "text": "Block or restrict outbound REST API calls to external endpoints", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Outbound firewall rules limit network traffic from the Azure SQL Database logical server to a customer defined list of Azure Storage accounts and Azure SQL Database logical servers. Any attempt to access storage accounts or databases not in this list is denied.", + "guid": "a566dd3d-314e-4a94-9378-102c42d82b38", + "link": "https://learn.microsoft.com/azure/azure-sql/database/outbound-firewall-rule-overview", "services": [ - "WAF" + "Storage", + "SQL" ], "severity": "Medium", - "text": "Enable Application Insights for more detailed telemetry", - "waf": "Operations" + "subcategory": "Outbound Control", + "text": "If outbound network access is required, it is recommended to configure outbound networking restrictions using built-in Azure SQL Database control feature", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Private Endpoint is created inside a subnet in an Azure Virtual Network. Proper security configuration must be applied also to the containing network environment, including NSG/ASG, UDR, firewall, monitoring and auditing.", + "guid": "246cd832-f550-4af0-9c74-ca9baeeb8860", + "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server", "services": [ + "VNet", + "Firewall", + "SQL", "Monitor", - "WAF" + "PrivateLink" ], - "severity": "High", - "text": "Configure alerts on the most critical metrics", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Private Access", + "text": "If Private Access connectivity is used, ensure that you are using the Private Endpoint, Azure Virtual Network, Azure Firewall, and Azure Network Security Group checklists", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "When adding a Private Endpoint connection, public routing to your logical server isn't blocked by default. In the --Firewall and virtual networks-- pane, the setting --Deny public network access-- is not selected by default. To disable public network access, ensure that you select --Deny public network access--.", + "guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881", + "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server", "services": [ - "AKV", - "WAF" + "VNet", + "PrivateLink", + "SQL" ], "severity": "High", - "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated", + "subcategory": "Private Access", + "text": "If Private Endpoint (Private Access) is used, consider disabling Public Access connectivity", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Network Security Group (NSG) and Application Security Group (ASG) can be now applied to subnet containing Private Endpoints to restrict connections to Azure SQLDB based on internal source IP ranges.", + "guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2", + "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints", "services": [ - "Entra", - "WAF" + "VNet", + "PrivateLink", + "SQL" ], - "severity": "High", - "text": "Protect incoming requests to APIs (data plane) with Azure AD", + "severity": "Medium", + "subcategory": "Private Access", + "text": "If Private Endpoint (Private Access) is used, apply NSG and eventually ASG to limit incoming source IP address ranges", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. Applications and tools that are in the same or peered virtual network in the same region could access it directly. Applications and tools that are in different region could use virtual-network-to-virtual-network connection or ExpressRoute circuit peering to establish connection. Customer should use Network Security Groups (NSG), and eventually internal firewalls, to restrict access over port 1433 only to resources that require access to a managed instance.", + "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview", "services": [ - "Entra", - "WAF" + "VNet", + "ExpressRoute", + "SQL" ], "severity": "Medium", - "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal", + "subcategory": "Private Access", + "text": "Apply Network Security Groups (NSG) and firewall rules to restrict access to Azure SQL Managed Instance internal subnet", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Azure Virtual Network Service Endpoint is preferred solution if you want to establish a direct connection to the Azure SQL Database backend nodes using Redirect policy. This will allow access in high performance mode and is the recommended approach from a performance perspective.", + "guid": "55187443-6852-4fbd-99c6-ce303597ca7f", + "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules", "services": [ - "WAF" + "VNet", + "AzurePolicy", + "SQL" ], - "severity": "Medium", - "text": "Create appropriate groups to control the visibility of the products", + "severity": "High", + "subcategory": "Public Access", + "text": "If Public Access connectivity is used, leverage Service Endpoint to restrict access from selected Azure Virtual Networks", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "06862505-2d9a-4874-9491-2837b00a3475", - "link": "https://learn.microsoft.com/azure/api-management/backends", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "The Azure SQL Database firewall allows you to specify IP address ranges from which communications are accepted. This approach is fine for stable IP addresses that are outside the Azure private network.", + "guid": "a73e32da-b3f4-4960-b5ec-2f42a557bf31", + "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview", "services": [ - "WAF" + "Storage", + "SQL" ], "severity": "Medium", - "text": "Use Backends feature to eliminate redundant API backend configurations", - "waf": "Operations" + "subcategory": "Public Access", + "text": "If Public Access connectivity is used, ensure that only specific known IPs are added to the firewall", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "We recommend that you use database-level IP firewall rules whenever possible. This practice enhances security and makes your database more portable. Use server-level IP firewall rules for administrators. Also use them when you have many databases that have the same access requirements, and you don't want to configure each database individually.", + "guid": "e0f31ac9-35c8-4bfd-9865-edb60ffc6768", + "link": "https://learn.microsoft.com/azure/azure-sql/database/firewall-configure", "services": [ - "AzurePolicy", - "WAF" + "Storage", + "SQL" ], - "severity": "Medium", - "text": "Use Named Values to store common values that can be used in policies", - "waf": "Operations" + "severity": "Low", + "subcategory": "Public Access", + "text": "If Public Access connectivity is used and controlled by Azure SQL Database firewall rules, use database-level over server-level IP rules", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. The Managed Instance public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. If company policy disallows the use of public endpoints, use Azure Policy to prevent enabling public endpoints in the first place.", + "guid": "b8435656-143e-41a8-9922-61d34edb751a", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview", "services": [ - "ACR", - "WAF" + "VNet", + "AzurePolicy", + "SQL" ], - "severity": "Medium", - "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA", - "waf": "Reliability" + "severity": "High", + "subcategory": "Public Access", + "text": "Do not enable Azure SQL Managed Instance public endpoint", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", - "link": "https://learn.microsoft.com/azure/api-management/high-availability", - "service": "APIM", + "category": "Networking", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "A Managed Instance (SQL MI) public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. In this case, it is recommended to apply a Network Security Groups (NSG) to restrict access to port 3342 only to trusted source IP addresses.", + "guid": "057dd298-8726-4aa6-b590-1f81d2e30421", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview", "services": [ - "WAF" + "VNet", + "SQL" ], - "severity": "Medium", - "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%", - "waf": "Reliability" + "severity": "High", + "subcategory": "Public Access", + "text": "Restrict access if Azure SQL Managed Instance public endpoint is required", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", - "service": "APIM", + "category": "Privileged Access", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Most operations, support, and troubleshooting performed by Microsoft personnel and sub-processors do not require access to customer data. In those rare circumstances where such access is required, Customer Lockbox for Microsoft Azure provides an interface for customers to review and approve or reject customer data access requests. In support scenarios where Microsoft needs to access customer data, Azure SQL Database supports Customer Lockbox to provide an interface for you to review and approve or reject customer data access requests.", + "guid": "37b6eb0f-553d-488f-8a8a-cb9bf97388ff", + "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", "services": [ - "Backup", - "WAF" + "SQL" ], - "severity": "High", - "text": "Ensure there is an automated backup routine", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Lockbox", + "text": "Review and enable Customer Lockbox for Azure SQL Database access by Microsoft personnel", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", - "link": "https://learn.microsoft.com/azure/api-management/retry-policy", - "service": "APIM", + "category": "Privileged Access", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "The principle of least privilege states that users shouldn't have more privileges than needed to complete their tasks. High-privileged database and server users can perform many configuration and maintenance activities on the database and can also drop databases in Azure SQL instance. Tracking database owners and privileged accounts is important to avoid having excessive permission.", + "guid": "5fe5281f-f0f9-4842-a682-8baf18bd8316", + "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#implement-principle-of-least-privilege", "services": [ - "AzurePolicy", - "WAF" + "SQL" ], "severity": "Medium", - "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.", - "waf": "Reliability" + "subcategory": "Permissions", + "text": "Ensure that users are assigned the minimum level of access necessarily to complete their job functions", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", - "service": "APIM", + "category": "Privileged Access", + "checklist": "Azure SQLDB Security Checklist (Preview)", + "description": "Identities (both Users and SPNs) should be scoped to the least amount of access needed to perform the function. A higher number of tightly scoped SPNs should be used, instead of having one SPN with multiple sets of unrelated permissions. For example, if there are three external web applications hosted on-prem that make queries to the Azure SQL Database, they should not all use the same SPN for these activities. Instead, they should each have their own tightly scoped SPN.", + "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access", "services": [ - "EventHubs", - "AzurePolicy", - "WAF" + "Entra", + "SQL" ], "severity": "Low", - "text": "If you need to log at high performance levels, consider Event Hubs policy", - "waf": "Operations" + "subcategory": "Permissions", + "text": "Ensure that distinct applications will be assigned different credentials with minimal permissions to access Azure SQL Database", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", - "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore", + "guid": "976f32a7-30d1-6caa-c2a0-207fdc26571b", + "link": "https://learn.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", "services": [ - "AzurePolicy", - "WAF" + "Storage", + "AVS", + "Backup" ], "severity": "Medium", - "text": "Apply throttling policies to control the number of requests per second", - "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", - "waf": "Performance" + "subcategory": "Backup", + "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Microsoft backup service", + "guid": "fc8af7a1-c724-e255-c18d-4ca22a6f27f0", + "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", "services": [ - "WAF" + "AVS", + "Backup" ], "severity": "Medium", - "text": "Configure autoscaling to scale out the number of instances when the load increases", - "waf": "Performance" + "subcategory": "Business Continuity", + "text": "Use MABS as your backup solution", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Best practice - this is Backup, not disaster recovery", + "guid": "be28860f-3d29-a79a-1a0e-36f1b23b36ae", + "link": "Best practice to deploy backup in the same region as your AVS deployment", "services": [ - "WAF" + "ASR", + "AVS", + "Backup" ], "severity": "Medium", - "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.", - "waf": "Performance" + "subcategory": "Business Continuity", + "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", - "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Best practice - in case AVS is unavailable", + "guid": "4d2f79a5-4ccf-0dfc-557c-49619b99a540", + "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", "services": [ - "WAF" + "AVS" ], "severity": "Medium", - "text": "Use the premium tier for production workloads.", + "subcategory": "Business Continuity", + "text": "Preferably deploy MABS outside of the SDDC as native Azure IaaS", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?", + "guid": "ff431c40-962c-5182-d536-0c2f0c4ce9e0", + "link": "Will Disaster Recovery Site Recovery, HCX Disaster Recovery, SRM or back tools be used?", "services": [ - "AzurePolicy", - "WAF" + "AVS" ], "severity": "Medium", - "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.", + "subcategory": "Business Continuity", + "text": "Escalation process with Microsoft in the event of a regional DR", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Compare SRM with HCX", + "guid": "f379436d-3051-daa0-01fb-dc4e0e04d677", + "link": "https://docs.microsoft.com/azure/azure-vmware/disaster-recovery-using-vmware-site-recovery-manager", "services": [ - "Entra", - "APIM", - "WAF" + "ASR", + "AVS" ], - "severity": "High", - "text": "Be aware of APIM's limits", + "severity": "Medium", + "subcategory": "Disaster Recovery", + "text": "Use VMware Site Recovery Manager when both sites are Azure VMware Solution", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", - "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Recovery into Azure instead of Vmware solution", + "guid": "367f71d8-3cf6-51a0-91a5-3db3d570cc19", + "link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure", "services": [ - "WAF" + "ASR", + "AVS" ], - "severity": "High", - "text": "Ensure that the self-hosted gateway deployments are resilient.", + "severity": "Medium", + "subcategory": "Disaster Recovery", + "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "7519e385-a88b-4d34-966b-6269d686e890", - "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Avoid manual tasks as much as possible", + "guid": "ee02ada0-1887-bb3a-b84c-423f45a09ef9", + "link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure", "services": [ - "Entra", - "FrontDoor", - "APIM", - "WAF" + "ASR", + "AVS" ], "severity": "Medium", - "text": "Use Azure Front Door in front of APIM for multi-region deployment", - "waf": "Performance" + "subcategory": "Disaster Recovery", + "text": "Use Automated recovery plans with either of the Disaster solutions,", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "cd45c90e-7690-4753-930b-bf290c69c074", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Any other datacenter in the same region", + "guid": "0c2b74e5-9c28-780d-1df3-12d3de4aaa76", + "link": "https://docs.microsoft.com/azure/azure-vmware/connect-multiple-private-clouds-same-region", "services": [ - "VNet", - "WAF" + "ASR", + "AVS" ], "severity": "Medium", - "text": "Deploy the service within a Virtual Network (VNet)", - "waf": "Security" + "subcategory": "Disaster Recovery", + "text": "Configure a secondary disaster recovery environment", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", - "service": "APIM", - "services": [ - "APIM", - "VNet", - "Monitor", - "Entra", - "WAF" - ], - "severity": "Medium", - "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.", - "waf": "Security" - }, - { - "checklist": "WAF checklist", - "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions", + "guid": "c2a34ec4-2933-4e6c-dc36-e20e67abbe3f", + "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", "services": [ - "APIM", - "VNet", - "PrivateLink", - "Entra", - "WAF" + "ASR", + "AVS" ], "severity": "Medium", - "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.", - "waf": "Security" + "subcategory": "Disaster Recovery", + "text": "Assign IP ranges unique to each region", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", - "service": "APIM", + "category": "BCDR", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "ExpressRoute Global Reach can be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or routing must be done through network virtual appliances?", + "guid": "b44fb6ec-bfc1-3a8e-dba2-ca97f0991d2c", + "link": "This depends if you have multiple AVS Private Clouds. If so and they are in the same region then use AVS Interconnect. If they are in separate regions then use ExpressRoute Global Reach.", "services": [ - "WAF" + "ASR", + "AVS", + "ExpressRoute", + "NVA" ], - "severity": "High", - "text": "Disable Public Network Access", - "waf": "Security" + "severity": "Medium", + "subcategory": "Disaster Recovery", + "text": "Use Global Reach between DR regions", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", - "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "An ExR Global Reach connection will be established to the ExR circuit, no other connections", + "guid": "a2c12df2-07fa-3edd-2cec-fda0b55fb952", + "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud", "services": [ - "WAF" + "AVS", + "VWAN" ], "severity": "Medium", - "text": "Simplify management with PowerShell automation scripts", - "waf": "Operations" + "subcategory": "Direct (no vWAN, no H&S)", + "text": "Global Reach to ExR circuit - no Azure resources", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use ExR to connect on-premises (other) location to Azure", + "guid": "f62ce162-ba5a-429d-674e-fafa1af5f706", + "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud", "services": [ - "Entra", - "APIM", - "WAF" + "AVS", + "ExpressRoute" ], "severity": "Medium", - "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator", - "waf": "Operations" + "subcategory": "ExpressRoute", + "text": "Connect to Azure using ExR", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", - "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use the migration assesment tool and timeline to determine bandwidth required", + "guid": "cf01c73b-1247-0a7a-740c-e1ea29bda340", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-introduction", "services": [ - "Entra", - "APIM", - "WAF" + "AVS", + "ExpressRoute" ], "severity": "Medium", - "text": "Promote usage of Visual Studio Code APIM extension for faster API development", - "waf": "Operations" + "subcategory": "ExpressRoute", + "text": "Bandwidth sizing", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "354f1c03-8112-4965-85ad-c0074bddf231", - "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "What traffic is routed through a firewall, what goes directly into Azure", + "guid": "aab216ee-8941-315e-eada-c7e1f2243bd1", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking", "services": [ - "WAF" + "AVS", + "ExpressRoute" ], "severity": "Medium", - "text": "Implement DevOps and CI/CD in your workflow", - "waf": "Operations" + "subcategory": "ExpressRoute", + "text": "Traffic routing ", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "b6439493-426a-45f3-9697-cf65baee208d", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "AVS to ExR circuit, no traffic inspection", + "guid": "1f956e45-f62d-5c95-3a95-3bab718907f8", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking", "services": [ - "WAF" + "AVS", + "ExpressRoute" ], "severity": "Medium", - "text": "Secure APIs using client certificate authentication", - "waf": "Security" + "subcategory": "ExpressRoute", + "text": "Global Reach ", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "2a67d143-1033-4c0a-8732-680896478f08", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Name of the vNet and a unique address space /24 minimum", + "guid": "91f7a87b-21ac-d712-959c-8df2ba034253", + "link": "https://learn.microsoft.com/azure/virtual-network/quick-create-portal", "services": [ - "WAF" + "VNet", + "AVS" ], "severity": "Medium", - "text": "Secure backend services using client certificate authentication", - "waf": "Security" + "subcategory": "Hub & Spoke", + "text": "VNet name & address space", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", - "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Subnet must be called GatewaySubnet", + "guid": "58a027e2-f37f-b540-45d5-e44843aba26b", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", "services": [ - "WAF" + "VPN", + "VNet", + "AVS", + "ExpressRoute" ], "severity": "Medium", - "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs", - "waf": "Security" + "subcategory": "Hub & Spoke", + "text": "Gateway subnet", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", - "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Create a VPN gateway on the hub Gateway subnet", + "guid": "d4806549-0913-3e79-b580-ac2d3706e65a", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", "services": [ - "WAF" + "VPN", + "VNet", + "AVS", + "ExpressRoute" ], "severity": "Medium", - "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs", - "waf": "Security" + "subcategory": "Hub & Spoke", + "text": "VPN Gateway", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Create an ExR Gateway in the hub Gateway subnet.", + "guid": "864d7a8b-7016-c769-a717-61af6bfb73d2", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", "services": [ - "WAF" + "VPN", + "VNet", + "AVS", + "ExpressRoute" ], - "severity": "High", - "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.", - "waf": "Security" + "severity": "Medium", + "subcategory": "Hub & Spoke", + "text": "ExR Gateway", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "f8af3d94-1d2b-4070-846f-849197524258", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "How will Internet traffic be routes, Az Firewall, NVA, Secure Hub, On-Premises firewall?", + "guid": "cc2e11b9-7911-7da1-458c-d7fcef794aad", + "link": "https://learn.microsoft.com/azure/azure-vmware/enable-public-internet-access", "services": [ - "AKV", - "WAF" + "AVS", + "NVA" ], - "severity": "High", - "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated", - "waf": "Security" + "severity": "Medium", + "subcategory": "Internet", + "text": "Egress point", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "791abd8b-7706-4e31-9569-afefde724be3", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Allow remote connectivity to AVS via the portal, specifically to vCenter, NSX-T and HCX", + "guid": "71e68ce3-982e-5e56-0191-01100ad0e66f", + "link": "https://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", "services": [ - "Entra", - "WAF" + "AVS", + "Bastion" ], "severity": "Medium", - "text": "Use managed identities to authenticate to other Azure resources whenever possible", - "waf": "Security" + "subcategory": "Jumpbox & Bastion", + "text": "Remote connectivity to AVS", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", - "service": "APIM", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Name the jumpbox and identify the subnet where it will be hosted", + "guid": "6f8e93a2-44b1-bb1d-28a1-4d5b3c2ea857", + "link": "https://learn.microsoft.com/azure/bastion/tutorial-create-host-portal", "services": [ - "Entra", - "APIM", - "AppGW", - "WAF" + "VNet", + "AVS", + "Bastion" ], - "severity": "High", - "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM", - "waf": "Security" + "severity": "Medium", + "subcategory": "Jumpbox & Bastion", + "text": "Configure a jumbox and Azure Bastion", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx", - "service": "CosmosDB", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Provides secure / seamless RDP/SSH connectivity to your vm's directly through the portal.", + "guid": "ba430d58-4541-085c-3641-068c00be9bc5", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", "services": [ - "WAF" + "AVS", + "VM", + "Bastion" ], "severity": "Medium", - "text": "FTA Resiliency Playbook", - "waf": "Reliability" + "subcategory": "Jumpbox & Bastion", + "text": "Security measure allowing RDP access via the portal", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", - "service": "CosmosDB", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Using a VPN to connect to Azure to enable VMware communications (HCX) (not recommended)", + "guid": "9988598f-2a9f-6b12-9b46-488415ceb325", + "link": "https://learn.microsoft.com/azure/azure-vmware/configure-site-to-site-vpn-gateway", "services": [ - "WAF" + "VPN", + "AVS" ], - "severity": "High", - "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "VPN", + "text": "Connect to Azure using a VPN", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "0d934a34-8b26-43e7-bd60-513a3649906e", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages", - "service": "CosmosDB", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use the migration assesment tool and timeline to determine bandwidth required (eg 3rd party tool in link)", + "guid": "956ce5e9-a862-fe2b-a50d-a22923569357", + "link": "https://www.omnicalculator.com/other/data-transfer#:~:text=To%20calculate%20the%20data%20transfer%20speed%3A%201%20Download,measured%20time%20to%20find%20the%20data%20transfer%20speed.", "services": [ - "WAF" + "VPN", + "AVS" ], "severity": "Medium", - "text": "Run multiple replicas of the database (>1 ) in Prod", - "waf": "Reliability" + "subcategory": "VPN", + "text": "Bandwidth sizing", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe", - "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions", - "service": "CosmosDB", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "What traffic is routed through a firewall, what goes directly into Azure", + "guid": "e095116f-0bdc-4b51-4d71-b9e469d56f59", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking", "services": [ - "ACR", - "WAF" + "VPN", + "AVS" ], "severity": "Medium", - "text": "Leverage Multi-Region Writes", - "waf": "Reliability" + "subcategory": "VPN", + "text": "Traffic routing ", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Span Cosmos account across two or more regions with multi-region writes", - "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", - "service": "CosmosDB", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Name and unique address space for the vWAN, name for the vWAN hub", + "guid": "4dc480ac-cecd-39c4-fdc6-680b300716ab", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-site-to-site-portal#openvwan", "services": [ - "ACR", - "WAF" + "AVS", + "VWAN" ], "severity": "Medium", - "text": "Distribute your data globally", - "waf": "Reliability" + "subcategory": "vWAN hub", + "text": "vWAN name, hub name and address space", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong", - "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0", - "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels", - "service": "CosmosDB", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Select either boh or the appropriate connection type.", + "guid": "51d6affd-8e02-6aea-d3d4-0baf618b3076", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-point-to-site-portal", "services": [ - "WAF" + "VPN", + "AVS", + "VWAN" ], - "severity": "High", - "text": "Choose from several well-defined consistency models", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "vWAN hub", + "text": "ExR and/or VPN gateway provisioned", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.", - "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe", - "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover", - "service": "CosmosDB", + "category": "Connectivity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Add Azure firewall to vWAN (recommended)", + "guid": "e32a4c67-3dc0-c134-1c12-52d46dcbab5b", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-expressroute-portal", "services": [ - "CosmosDB", - "WAF" + "AVS", + "VWAN", + "Firewall" ], "severity": "Medium", - "text": "Enable Service managed failover", - "waf": "Reliability" + "subcategory": "vWAN hub", + "text": "Secure vWAN", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.", - "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90", - "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore", - "service": "CosmosDB", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Active directory or other identity provider servers", + "guid": "fbc47fbf-bc96-fa93-ed5d-8c9be63cd5c3", + "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter", "services": [ - "Backup", - "CosmosDB", - "Storage", - "WAF" + "Entra", + "AVS" ], "severity": "Medium", - "text": "Enable Automatic Backups", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Reliability" + "subcategory": "Access", + "text": "External Identity (user accounts)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.", - "guid": "a6eb33f6-005c-4d92-9286-7655672d6121", - "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction", - "service": "CosmosDB", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Not required for LDAPS, required for Kerberos", + "guid": "b5db7975-f6bb-8ba3-ee5f-e3e805887997", + "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology", "services": [ - "Backup", - "WAF" + "Entra", + "AVS" ], "severity": "Medium", - "text": "Perform Periodic Backups", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Reliability" + "subcategory": "Access", + "text": "If using AD domain, ensure Sites & Services has been configured", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.", - "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1", - "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction", - "service": "CosmosDB", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Authentication for users, must be secure.", + "guid": "c30749c4-e2af-558c-2eb9-0b6ae84881d1", + "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter", "services": [ - "Backup", - "CosmosDB", - "WAF" + "Entra", + "AVS" ], "severity": "Medium", - "text": "Continous Backup with point-in-time restore in Azure Cosmos DB", - "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", - "waf": "Reliability" + "subcategory": "Access", + "text": "Use LDAPS not ldap ( vCenter)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", - "service": "IoT", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Authentication for users, must be secure.", + "guid": "64cb9b5c-9edd-787e-1dd8-2b2338e51635", + "link": "https://learn.microsoft.com/azure/azure-vmware/configure-external-identity-source-nsx-t", "services": [ - "WAF" + "Entra", + "AVS" ], - "severity": "High", - "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Access", + "text": "Use LDAPS not ldap (NSX-T)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "CN or SAN names, no wildcards, contains private key - CER or PFX", + "guid": "bec285ab-037e-d629-81d1-f61dac23cd4c", + "link": "https://youtu.be/4jvfbsrhnEs", "services": [ - "WAF" + "Entra", + "AVS" ], "severity": "Medium", - "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.", - "waf": "Reliability" + "subcategory": "Security", + "text": "Security certificate installed on LDAPS servers ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", - "service": "IoT", - "services": [ - "WAF" - ], - "severity": "High", - "text": "Consider a Cross-Region DR strategy for critical workloads", - "waf": "Reliability" - }, - { - "checklist": "WAF checklist", - "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "services": [ - "WAF" - ], - "severity": "High", - "text": "Learn how to trigger a manual failover.", - "waf": "Reliability" - }, - { - "checklist": "WAF checklist", - "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", - "service": "IoT", - "services": [ - "WAF" - ], - "severity": "High", - "text": "Learn how to fail back after a failover.", - "waf": "Reliability" - }, - { - "checklist": "WAF checklist", - "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.", - "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e", - "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention", - "service": "ACR", - "services": [ - "ACR", - "WAF" - ], - "severity": "High", - "text": "Disable Azure Container Registry image export", - "waf": "Security" - }, - { - "checklist": "WAF checklist", - "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry", - "guid": "d503547c-d447-4e82-9128-a7100f1cac6d", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy", - "service": "ACR", - "services": [ - "AzurePolicy", - "ACR", - "WAF" - ], - "severity": "High", - "text": "Enable Azure Policies for Azure Container Registry", - "waf": "Security" - }, - { - "checklist": "WAF checklist", - "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.", - "guid": "d345293c-7639-4637-a551-c5c04e401955", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push", - "service": "ACR", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Standard Azure Roles Based Access Controls", + "guid": "4ba394a2-3c33-104c-8e34-2dadaba9cc73", + "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity", "services": [ - "AKV", - "ACR", - "WAF" + "Entra", + "RBAC", + "AVS" ], - "severity": "High", - "text": "Sign and Verify containers with notation (Notary v2)", + "severity": "Medium", + "subcategory": "Security", + "text": "RBAC applied to Azure roles", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.", - "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49", - "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys", - "service": "ACR", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Create roles in vCenter required to meet minimum viable access guidelines", + "guid": "b04ca129-83a9-3494-7512-347dd2d766db", + "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity#view-the-vcenter-server-privileges", "services": [ - "AKV", - "ACR", - "WAF" + "Entra", + "RBAC", + "AVS" ], "severity": "Medium", - "text": "Encrypt registry with a customer managed key", + "subcategory": "Security", + "text": "RBAC model in vCenter", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications", - "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", - "service": "ACR", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)", + "guid": "8e477d2f-8004-3dd0-93d6-0aece9e1b2fb", + "link": "Best practice", "services": [ "Entra", "RBAC", - "ACR", - "WAF" + "AVS" ], - "severity": "High", - "text": "Use Managed Identities to connect instead of Service Principals", + "severity": "Medium", + "subcategory": "Security", + "text": "CloudAdmin role usage", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead", - "guid": "be0e38ce-e297-411b-b363-caaab79b198d", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", - "service": "ACR", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "For roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)", + "guid": "00e0b729-f9be-f600-8c32-5ec0e8f2ed63", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "services": [ + "Entra", "RBAC", - "WAF" + "AVS" ], - "severity": "High", - "text": "Disable local authentication for management plane access", + "severity": "Medium", + "subcategory": "Security ", + "text": "Is Privileged Identity Management implemented", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations", - "guid": "387e5ced-126c-4d13-8af5-b20c6998a646", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli", - "service": "ACR", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "For the Azure VMware Solution PIM roles", + "guid": "0842d45f-41a8-8274-1155-2f6ed554d315", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "services": [ "Entra", "RBAC", - "ACR", - "WAF" + "AVS" ], - "severity": "High", - "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals", + "severity": "Medium", + "subcategory": "Security ", + "text": "Is Privileged Identity Management audit reporting implemented", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Disable anonymous pull/push access", - "guid": "e338997e-41c7-47d7-acf6-a62a1194956d", - "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access", - "service": "ACR", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Best practice, also see Monitoring/Alerts", + "guid": "915cbcd7-0640-eb7c-4162-9f33775de559", + "link": "Best practice", "services": [ - "WAF" + "Entra", + "Monitor", + "AVS" ], "severity": "Medium", - "text": "Disable Anonymous pull access", + "subcategory": "Security ", + "text": "Limit use of CloudAdmin account to emergency access only", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token", - "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli", - "service": "ACR", + "category": "Identity", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Operational procedure", + "guid": "7effa0c0-9172-e8e4-726a-67dbea8be40a", + "link": "https://learn.microsoft.com/azure/azure-vmware/rotate-cloudadmin-credentials?tabs=azure-portal", "services": [ "Entra", - "WAF" + "AVS" ], - "severity": "High", - "text": "Disable repository-scoped access tokens", + "severity": "Medium", + "subcategory": "Security ", + "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network", - "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee", - "service": "ACR", + "category": "Management", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)", + "guid": "8f426fd0-d73b-d398-1f6f-df0cbe262a82", + "link": "https://learn.microsoft.com/azure/azure-arc/vmware-vsphere/overview", "services": [ - "EventHubs", - "PrivateLink", - "ACR", - "WAF" + "AVS", + "VM", + "Arc" ], - "severity": "High", - "text": "Deploy images from a trusted environment", - "waf": "Security" + "severity": "Medium", + "subcategory": "Operations", + "text": "AVS VM Management (Azure Arc)", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR", - "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy", - "service": "ACR", + "category": "Management", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions", + "guid": "11dbe773-e380-9191-1418-e886fa7a6fd0", + "link": "https://docs.microsoft.com/azure/governance/policy/overview", "services": [ - "Entra", - "AzurePolicy", - "ACR", - "WAF" + "Monitor", + "AVS", + "AzurePolicy" ], "severity": "Medium", - "text": "Disable Azure ARM audience tokens for authentication", - "waf": "Security" + "subcategory": "Operations", + "text": "Azure policy", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.", - "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6", - "link": "https://learn.microsoft.com/azure/container-registry/monitor-service", - "service": "ACR", + "category": "Management", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud", + "guid": "1e59c639-9b7e-a60b-5e93-3798c1aff5db", + "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json#configure-locks", "services": [ - "Entra", - "ACR", - "Monitor", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Enable diagnostics logging", - "waf": "Security" + "subcategory": "Operations", + "text": "Resource locks", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch", - "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", - "service": "ACR", + "category": "Management", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "For manual deployments, all configuration and deployments must be documented", + "guid": "8f2c46aa-ca1b-cad3-3ac9-213dfc0a265e", + "link": "Make sure to create your own runbook on the deployment of AVS.", "services": [ - "Firewall", - "PrivateLink", - "VNet", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Control inbound network access with Private Link", - "waf": "Security" + "subcategory": "Operations", + "text": "Run books", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Disable public network access if inbound network access is secured using Private Link", - "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access", - "service": "ACR", + "category": "Management", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use", + "guid": "86b314f9-1f1e-317a-4dfb-cf510ad4a030", + "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations", "services": [ - "PrivateLink", - "WAF" + "AVS", + "AKV" ], "severity": "Medium", - "text": "Disable Public Network access", - "waf": "Security" + "subcategory": "Operations", + "text": "Naming conventions for auth keys", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Only the ACR Premium SKU supports Private Link access", - "guid": "fc833934-8b26-42d6-ac5f-512925498f6d", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus", - "service": "ACR", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "For automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", + "guid": "e22a2d99-eb71-7d7c-07af-6d4cdb1d4443", + "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", "services": [ - "PrivateLink", - "ACR", - "WAF" + "Monitor", + "AVS" ], "severity": "Medium", - "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)", - "waf": "Security" + "subcategory": "Alerts", + "text": "Create warning alerts for critical thresholds ", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities", - "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", - "service": "ACR", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", + "guid": "6d02f159-627d-79bf-a931-fab6d947eda2", + "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", "services": [ - "Defender", - "ACR", - "WAF" + "Monitor", + "AVS" ], - "severity": "Low", - "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities", - "waf": "Security" + "severity": "Medium", + "subcategory": "Alerts", + "text": "Create critical alert vSAN consumption", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", - "guid": "4451e1a2-d345-4293-a763-9637a551c5c0", - "service": "ACR", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Provides platform alerts (generated by Microsoft)", + "guid": "1cc97b39-2c7e-246f-6d73-789cfebfe951", + "link": "https://www.virtualworkloads.com/2021/04/azure-vmware-solution-azure-service-health/", "services": [ - "WAF" + "Monitor", + "AVS" ], "severity": "Medium", - "text": "Deploy validated container images", - "waf": "Security" + "subcategory": "Alerts", + "text": "Configured for Azure Service Health alerts and notifications", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", - "guid": "4e401955-387e-45ce-b126-cd132af5b20c", - "service": "ACR", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads", + "guid": "0962606c-e3b4-62a9-5661-e4ffd62a4509", + "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", "services": [ - "WAF" + "AVS", + "Backup", + "Monitor", + "VM", + "AzurePolicy" ], - "severity": "High", - "text": "Use up-to-date platforms, languages, protocols and frameworks", - "waf": "Security" + "severity": "Medium", + "subcategory": "Backup", + "text": "Backup policy", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", - "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", - "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Keep in mind the lead time for requesting new nodes", + "guid": "4ec7ccfb-795e-897e-4a84-fd31c04eadc6", + "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", "services": [ - "EventHubs", - "WAF" + "Monitor", + "AVS", + "AzurePolicy" ], - "severity": "Low", - "text": "Use customer-managed key option in data at rest encryption when required", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Security" + "severity": "Medium", + "subcategory": "Capacity", + "text": "Policy around ESXi host density and efficiency", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ", - "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", - "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Azure Cost Management can be used - one option, put AVS in it's own Subscription. ", + "guid": "7f8f175d-13f4-5298-9e61-0bc7e9fcc279", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/govern", "services": [ - "EventHubs", - "WAF" + "Monitor", + "AVS", + "Subscriptions", + "Cost" ], "severity": "Medium", - "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Security" + "subcategory": "Costs", + "text": "Ensure a good cost management process is in place for Azure VMware Solution - ", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", - "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Create dashboards to enable core Azure VMware Solution monitoring insights", + "guid": "01e689e0-7c6c-b58f-37bd-4d6b9b1b9c74", + "link": "https://docs.microsoft.com/azure/azure-portal/azure-portal-dashboards", "services": [ - "RBAC", - "EventHubs", - "TrafficManager", - "AzurePolicy", - "Entra", - "WAF" + "Monitor", + "AVS", + "NetworkWatcher" ], "severity": "Medium", - "text": "Avoid using root account when it is not necessary", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "Security" + "subcategory": "Dashboard", + "text": "Connection monitor dashboard", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ", - "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", - "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Send to an Azure Storage account or Azure EventHub for processing (direct to Log Analytics is pending)", + "guid": "f9afdcc9-649d-d840-9fb5-a3c0edcc697d", + "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", "services": [ - "EventHubs", - "AKV", "Storage", - "Entra", - "VM", - "WAF" + "Monitor", + "AVS" ], "severity": "Medium", - "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "Logs & Metrics", + "text": "Configure Azure VMware Solution logging ", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.", - "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Must be on-premises, implement if available", + "guid": "7cbac8c3-4eda-d5d9-9bda-c6b5abba9fb6", + "link": "Is vROPS or vRealize Network Insight going to be used? ", "services": [ - "RBAC", - "EventHubs", - "WAF" + "Monitor", + "AVS" ], - "severity": "High", - "text": "Use least privilege data plane RBAC", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Security" + "severity": "Medium", + "subcategory": "Logs & Metrics", + "text": "vRealize Operations", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.", - "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", - "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor", + "guid": "b243521a-644d-f865-7fb6-21f9019c0dd2", + "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", "services": [ - "EventHubs", - "VNet", "Monitor", - "WAF" + "AVS", + "VM" ], "severity": "Medium", - "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Security" - }, - { - "checklist": "WAF checklist", - "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", - "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", - "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", - "service": "Event Hubs", - "services": [ - "EventHubs", - "PrivateLink", - "VNet", - "WAF" - ], - "severity": "Medium", - "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "Logs & Metrics", + "text": "AVS VM logging", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", - "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Between on-premises to Azure are monitored using 'connection monitor'", + "guid": "2ca97d91-dd36-7229-b668-01036ccc3cd3", + "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", "services": [ - "EventHubs", - "WAF" + "AVS", + "ExpressRoute", + "VPN", + "Monitor", + "NetworkWatcher" ], "severity": "Medium", - "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Security" + "subcategory": "Network", + "text": "Monitor ExpressRoute and/or VPN connections ", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "31d41e36-11c8-417b-8afb-c410d4391898", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "To monitor the Azure VMware Solution back-end ExpressRoute connection (Azure native to AVS)", + "guid": "99209143-60fe-19f0-5633-8b5671277ba5", + "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", "services": [ - "WAF" + "Monitor", + "AVS", + "ExpressRoute" ], "severity": "Medium", - "text": "Leverage FTA Resillency HandBook", - "waf": "Reliability" + "subcategory": "Network", + "text": "Monitor from an Azure native resource to an Azure VMware Solution VM", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones", - "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "To monitor end-to-end, on-premises to AVS workloads", + "guid": "b9e5867c-57d3-036f-fb1b-3f0a71664efe", + "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", "services": [ - "EventHubs", - "ACR", - "WAF" + "Monitor", + "AVS" ], - "severity": "High", - "text": "Leverage Availability Zones if regionally applicable", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Network", + "text": "Monitor from an on-premises resource to an Azure VMware Solution VM", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "20b56c56-ad58-4519-8f82-735c586bb281", - "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Track requests to Azure VMware Solution and Azure VMware Solution based workloads", + "guid": "4af7c5f7-e5e9-bedf-a8cf-314b81735962", + "link": "Firewall logging and alerting rules are configured (Azure Firewall or 3rd party)", "services": [ - "WAF" + "Monitor", + "AVS" ], "severity": "Medium", - "text": "Use the Premium or Dedicated SKUs for predicable performance", - "waf": "Reliability" + "subcategory": "Security", + "text": "Auditing and logging is implemented for inbound internet ", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations", - "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity", + "guid": "74be60a3-cfac-f057-eda6-3ee087e805d5", + "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity", "services": [ - "EventHubs", - "ASR", - "WAF" + "Monitor", + "AVS" ], - "severity": "High", - "text": "Plan for Geo Disaster Recovery using Active Passive configuration", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Security", + "text": "Session monitoring ", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs", - "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Enable Diagnostic and metric logging on Azure VMware Solution", + "guid": "a434b3b5-f258-0845-cd76-d7df6ef5890e", + "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", "services": [ - "EventHubs", - "ASR", - "WAF" + "Monitor", + "AVS" ], "severity": "Medium", - "text": "For Business Critical Applications, use Active Active configuration", - "waf": "Reliability" + "subcategory": "VMWare", + "text": "Logging and diagnostics", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", - "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", - "service": "Event Hubs", + "category": "Monitoring", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Monitor AVS workloads (each VM in AVS)", + "guid": "fb00b69a-83ec-ce72-446e-6c23a0cab09a", + "link": "https://docs.microsoft.com/azure/azure-monitor/agents/agent-windows?tabs=setup-wizard", "services": [ - "EventHubs", - "WAF" + "Monitor", + "AVS", + "VM" ], "severity": "Medium", - "text": "Design Resilient Event Hubs", - "waf": "Reliability" + "subcategory": "VMware", + "text": "Log Analytics Agents deployed on Azure VMware Solution guest VM workloads", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.", - "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs", - "service": "VMSS", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Decision on traffic flow", + "guid": "a1354b87-e18e-bf5c-c50b-8ddf0540e971", + "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-hub-and-spoke", "services": [ - "VM", - "WAF" + "AVS" ], - "severity": "Low", - "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Hub & Spoke", + "text": "North/South routing through Az Firewall or 3rd party ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).", - "guid": "4d874a74-8b66-42d6-b150-512a66498f6d", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Decision to route Azure to Azure traffic through Firewall, not E/W between AVS workloads (internal to AVS)", + "guid": "29a8a499-ec31-f336-3266-0895f035e379", + "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-hub-and-spoke", "services": [ - "Backup", - "VM", - "WAF" + "AVS" ], - "severity": "High", - "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Hub & Spoke", + "text": "East West (Internal to Azure)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%", - "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Requires a 3rd party NVA with Azure Route server - Scenario 2 (see link)", + "guid": "ebd3cc3c-ac3d-4293-950d-cecd8445a523", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity", "services": [ - "VM", - "WAF" + "ARS", + "AVS", + "NVA" ], - "severity": "High", - "text": "Use Premium or Ultra disks for production VMs", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Hub & Spoke", + "text": "ExR without Global Reach", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.", - "guid": "b31e38c3-f298-412b-8363-cffe179b599d", - "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "When route server is used, ensure no more then 200 routes are propagated from route server to ExR gateway to on-premises (ARS limit). Important when using MoN", + "guid": "ffb5c5ca-bd89-ff1b-8b73-8a54d503d506", + "link": "https://learn.microsoft.com/azure/route-server/route-server-faq", "services": [ - "VM", - "WAF" + "ARS", + "AVS" ], - "severity": "High", - "text": "Ensure Managed Disks are used for all VMs", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Hub & Spoke", + "text": "Route server ", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.", - "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4", - "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Via on-premises, Az Firewall, 3rd Party, NSX-T pubic IP", + "guid": "a4070dad-3def-818d-e9f7-be440d10e7de", + "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-design-public-internet-access", "services": [ - "SQL", - "VM", - "Storage", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Do not use the Temp disk for anything that is not acceptable to be lost", - "waf": "Reliability" + "subcategory": "Internet", + "text": "Egress point(s)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.", - "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Az Firewall, 3rd party NVA, Application Gateway, Azure Frontdoor ", + "guid": "e942c03d-beaa-3d9f-0526-9b26cd5e9937", + "link": "Research and choose optimal solution for each application", "services": [ - "VM", - "Storage", - "ACR", - "WAF" + "AVS", + "FrontDoor", + "NVA", + "AppGW" ], "severity": "Medium", - "text": "Leverage Availability Zones for your VMs in regions where they are supported", - "waf": "Reliability" + "subcategory": "Internet", + "text": "Internet facing applications", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.", - "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Ensure no more then 200 routes are propagated from route server to ExR gateway to on-premises (ARS limit). Important when using MoN", + "guid": "e778a2ec-b4d7-1d27-574c-14476b167d37", + "link": "https://docs.microsoft.com/azure/route-server/route-server-faq#route-server-limits", "services": [ - "VM", - "WAF" + "ARS", + "AVS" ], "severity": "Medium", - "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets", - "waf": "Reliability" + "subcategory": "Routing", + "text": "When route server Route limit understood? ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)", - "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "(VPN Gateway, AppGW, FrontDoor, Load balancer, VMs (etc) (Remove: enabled on ExR/VPN Gateway subnet in Azure)", + "guid": "66c97b30-81b9-139a-cc76-dd1d94aef42a", + "link": "https://docs.microsoft.com/azure/ddos-protection/manage-ddos-protection", "services": [ - "ASR", + "VNet", + "AVS", + "ExpressRoute", + "LoadBalancer", + "VPN", "VM", - "WAF" + "DDoS", + "FrontDoor", + "AppGW" ], - "severity": "High", - "text": "Avoid running a production workload on a single VM", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Security", + "text": "Is DDoS standard protection of public facing IP addresses? ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.", - "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "To manage Azure VMware Solution, vCenter, NSX manager and HCX manager", + "guid": "d43da920-4ecc-a4e9-dd45-a2986ce81d32", + "link": "Best practice: Bastion or 3rd party tool", "services": [ - "ASR", - "AVS", - "VM", - "WAF" + "AVS" ], - "severity": "High", - "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Security", + "text": "Use a dedicated privileged access workstation (PAW)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.", - "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d", - "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use NSX-T for inter-vmware-traffic inspection", + "guid": "a2dac74f-5380-6e39-25e6-f13b99ece51f", + "link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-F6685367-7AA1-4771-927E-ED77727CFDA3.html", "services": [ - "WAF" + "AVS" ], - "severity": "Low", - "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Traffic Inspection", + "text": "East West (Internal to AVS)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.", - "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666", - "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Decision on whether or not to use Secure hub for E/W and Internet traffic - requires Global Reach", + "guid": "3f621543-dfac-c471-54a6-7b2849b6909a", + "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", "services": [ - "ASR", - "VM", - "WAF" + "AVS", + "VWAN", + "Firewall" ], "severity": "Medium", - "text": "Increase quotas in DR region before testing failover with ASR", - "waf": "Reliability" + "subcategory": "Virtual WAN", + "text": "Use Secure Hub (Azure Firewall or 3rd party)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.", - "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events", - "service": "VM", + "category": "Networking", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Decision to route Azure to Azure traffic through Firewall, not E/W between AVS workloads (internal to AVS)", + "guid": "d7af5670-1b39-d95d-6da2-8d660dfbe16b", + "link": "https://learn.microsoft.com/azure/firewall-manager/secure-cloud-network", "services": [ - "VM", - "WAF" + "AVS", + "VWAN" ], - "severity": "Low", - "text": "Utilize Scheduled Events to prepare for VM maintenance", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Virtual WAN", + "text": "East West (Internal to Azure)", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.", - "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Azure Storage", + "category": "Other Services/Operations", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution", + "guid": "7d049005-eb35-4a93-50a5-3b31a9f61161", + "link": "https://docs.microsoft.com/azure/azure-vmware/configure-nsx-network-components-azure-portal", "services": [ - "Storage", - "WAF" + "Subscriptions", + "AVS" ], "severity": "Medium", - "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements", - "waf": "Reliability" + "subcategory": "Automated Scale", + "text": "Scale out operations planning", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.", - "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", + "category": "Other Services/Operations", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action", + "guid": "7242c1de-da37-27f3-1ddd-565ccccb8ece", + "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale", "services": [ "Storage", - "WAF" + "AVS", + "AzurePolicy" ], - "severity": "Low", - "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Automated Scale", + "text": "Scale in operations planning", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.", - "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", + "category": "Other Services/Operations", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)", + "guid": "3233e49e-62ce-97f3-8737-8230e771b694", + "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale", "services": [ - "Storage", - "WAF" + "AVS" ], - "severity": "Low", - "text": "Enable soft delete for Storage Account Containers", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Automated Scale", + "text": "Scale serialized operations planning", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.", - "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", + "category": "Other Services/Operations", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", + "guid": "68161d66-5707-319b-e77d-9217da892593", + "link": "Best practice (testing)", "services": [ - "Storage", - "WAF" + "AVS" ], - "severity": "Low", - "text": "Enable soft delete for blobs", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Automated Scale", + "text": "Scale rd operations planning", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.", - "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about", - "service": "Azure Backup", + "category": "Other Services/Operations", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Define and enforce scale in/out maximum limits for your environment in the automations", + "guid": "c32cb953-e860-f204-957a-c79d61202669", + "link": "Operational planning - understand workload requirements", "services": [ - "Backup", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery", - "waf": "Reliability" + "subcategory": "Automated Scale", + "text": "Scale maximum operations planning", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.", - "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae", - "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept", - "service": "Azure Backup", + "category": "Other Services/Operations", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses", + "guid": "7bd65a5e-7b5d-652d-dbea-fc6f73a42857", + "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-management-and-monitoring", "services": [ - "Backup", - "WAF" + "Monitor", + "AVS" ], - "severity": "Low", - "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Automated Scale", + "text": "Monitor scaling operations ", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.", - "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault", - "service": "Azure Backup", + "category": "Other Services/Operations", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Consider the use of Azure Private-Link when using other Azure Native Services", + "guid": "95e374af-8a2a-2672-7ab7-b4a1be43ada7", + "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", "services": [ - "Backup", - "Storage", - "WAF" + "AVS", + "PrivateLink" ], - "severity": "Low", - "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Networking", + "text": "Private link", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.", - "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146", - "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", - "service": "DNS", + "category": "Other Services/Operations", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs", + "guid": "71eff90d-5ad7-ac60-6244-2a6f7d3c51f2", + "link": "Best practice", "services": [ - "ASR", - "DNS", - "ACR", - "WAF" + "AVS" ], - "severity": "Low", - "text": "Implement DNS Failover using Azure DNS Private Resolvers", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Networking", + "text": "Provisioning Vmware VLANs", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.", - "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103", - "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters", - "service": "Data Gateways", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "In which region will AVS be deployed", + "guid": "04e3a2f9-83b7-968a-1044-2811811a924b", + "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology", "services": [ - "ACR", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data", + "subcategory": "Pre-deployment", + "text": "Region selected", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.", - "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Are there regulatory or compliance policies in play", + "guid": "e52d1615-9cc6-565c-deb6-743ed7e90f4b", + "link": "Internal policy or regulatory compliance", "services": [ - "NVA", - "WAF" + "AVS", + "AzurePolicy" ], - "severity": "High", - "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability", + "severity": "Medium", + "subcategory": "Pre-deployment", + "text": "Data residency compliant with selected regions", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", - "service": "Azure MySQL", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Request through the support blade", + "guid": "92bd5ad6-441f-a983-7aa9-05dd669d760b", + "link": "https://learn.microsoft.com/azure/migrate/concepts-azure-vmware-solution-assessment-calculation", "services": [ - "WAF" + "AVS" ], "severity": "Medium", - "text": "Leverage Flexible Server", + "subcategory": "Pre-deployment", + "text": "Request for number of AVS hosts submitted ", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", - "service": "Azure MySQL", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "PG approval for deployment", + "guid": "28370f63-1cb8-2e35-907f-c5516b6954fa", + "link": "Support request through portal or get help from Account Team", "services": [ - "WAF" + "AVS" ], - "severity": "High", - "text": "Leverage Availability Zones where regionally applicable", + "severity": "Medium", + "subcategory": "Pre-deployment", + "text": "Region and number of AVS nodes approved", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", - "service": "Azure MySQL", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Portal/subscription/resource providers/ Microsoft.AVS", + "guid": "96c76997-30a6-bb92-024d-f4f93f5f57fa", + "link": "Done through the subscription/resource providers/ AVS register in the portal", "services": [ - "WAF" + "Subscriptions", + "AVS" ], "severity": "Medium", - "text": "Leverage Data-in replication for cross-region DR scenarios", + "subcategory": "Pre-deployment", + "text": "Resource provider for AVS registered", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", - "guid": "87af4a79-1f89-439b-ba47-768e14c11567", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key", - "service": "Service Bus", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Connectivity, subscription & governanace model", + "guid": "5898e3ff-5e6b-bee1-6f85-22fee261ce63", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/enterprise-scale-landing-zone", "services": [ - "ServiceBus", - "WAF" + "Subscriptions", + "AVS" ], - "severity": "Low", - "text": "Use customer-managed key option in data at rest encryption when required", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Security" + "severity": "Medium", + "subcategory": "Pre-deployment", + "text": "Landing zone architecture", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.", - "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version", - "service": "Service Bus", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "The name of the RG where AVS will exist", + "guid": "d0181fb8-9cb8-bf4b-f5e5-b5f9bf7ae4ea", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/manage-resource-groups-portal", "services": [ - "ServiceBus", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Security" + "subcategory": "Pre-deployment", + "text": "Resource group name selected", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", - "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies", - "service": "Service Bus", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Each resource created as part of the deployment will also utilize this prefix in the name", + "guid": "0f0d20c2-5a19-726c-de20-0984e070d9d6", + "link": "Best practice - naming standards", "services": [ - "RBAC", - "TrafficManager", - "ServiceBus", - "AzurePolicy", - "Entra", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Avoid using root account when it is not necessary", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "Security" + "subcategory": "Pre-deployment", + "text": "Deployment prefix selected", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "A Service Bus client app running inside an Azure App Service application or in a virtual machine with enabled managed entities for Azure resources support does not need to handle SAS rules and keys, or any other access tokens. The client app only needs the endpoint address of the Service Bus Messaging namespace. ", - "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity", - "service": "Service Bus", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "/22 unique non-overlapping IPv4 address space", + "guid": "7fbf2ab7-a36c-5957-c27a-67038557af2a", + "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-network-checklist#routing-and-subnet-considerations", "services": [ - "ServiceBus", - "AKV", - "Storage", - "AppSvc", - "Entra", - "VM", - "WAF" + "AVS" ], "severity": "Medium", - "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "Pre-deployment", + "text": "Network space for AVS management layer", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ", - "guid": "f615658d-e558-4f93-9249-b831112dbd7e", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus", - "service": "Service Bus", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "vNets used by workloads running in AVS (non-stretched)", + "guid": "0c87f999-e517-21ef-f355-f210ad4134d2", + "link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/installation/GUID-4B3860B8-1883-48CA-B2F3-7C2205D91D6D.html", "services": [ - "RBAC", - "ServiceBus", - "Subscriptions", - "Storage", - "WAF" + "VNet", + "AVS" ], - "severity": "High", - "text": "Use least privilege data plane RBAC", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Security" + "severity": "Medium", + "subcategory": "Pre-deployment", + "text": "Network space for AVS NSX-T segments", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.", - "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference", - "service": "Service Bus", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Choose AV36, AV36P, AV52, AV36T (AV36T = Trial)", + "guid": "946c8966-f902-6f53-4f37-00847e8895c2", + "link": "https://azure.microsoft.com/pricing/details/azure-vmware/", "services": [ - "ServiceBus", - "VNet", - "Monitor", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Security" + "subcategory": "Pre-deployment", + "text": "AVS SKU (region dependent)", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", - "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service", - "service": "Service Bus", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use the Azure migration assessment tool to determine the minimum number of nodes required (consider BCDR as well)", + "guid": "31833808-26ba-9c31-416f-d54a89a17f5d", + "link": "https://learn.microsoft.com/azure/migrate/how-to-assess", "services": [ - "ServiceBus", - "PrivateLink", - "VNet", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "Pre-deployment", + "text": "Number of hosts to be deployed", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", - "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering", - "service": "Service Bus", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Understand how and if you should be using reserved instances (cost control)", + "guid": "f2b73c4f-3d46-32c9-5df1-5b8dfcd3947f", + "link": "https://azure.microsoft.com/en-ca/pricing/details/azure-vmware/#:~:text=Azure%20VMware%20Solution%20%20%20%20Instance%20size,TB%20%28all%20NVMe%29%20%20%20N%2FA%20%2Fhour%20", "services": [ - "ServiceBus", - "WAF" + "AVS", + "Cost" ], "severity": "Medium", - "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Security" + "subcategory": "Pre-deployment", + "text": "Reserverd Instances", + "waf": "Cost" }, { - "checklist": "WAF checklist", - "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", - "service": "IoT Hub DPS", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement", + "guid": "94ac48ab-ade5-3fa7-f800-263feeb97070", + "link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", "services": [ - "WAF" + "ASR", + "AVS" ], - "severity": "High", - "text": "Select the right Logic App hosting plan based on your business & SLO requirements", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Pre-deployment", + "text": "Capacity ", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "IoT Hub DPS", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Identify which of the networking scenarios make ", + "guid": "1f9d4bd5-14b8-928c-b4cb-eb211f9b8de5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity", "services": [ - "WAF" + "AVS" ], - "severity": "High", - "text": "Protect logic apps from region failures with zone redundancy and availability zones", + "severity": "Medium", + "subcategory": "Pre-deployment", + "text": "Networking & Connectivity See docs describing scenrario 1 through 5", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "8aed4fbf-0830-4883-899d-222a154af478", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "IoT Hub DPS", + "category": "Planning", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.", + "guid": "070db19b-8a2a-fd6a-c39b-4488d8780da9", + "link": "Please Check Partner Ecosystem", "services": [ - "WAF" + "AVS" ], - "severity": "High", - "text": "Consider a Cross-Region DR strategy for critical workloads", + "severity": "Medium", + "subcategory": "Pre-deployment", + "text": "3rd party application compatibility ", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "IoT Hub DPS", + "category": "Security", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible", + "guid": "70cfbddc-d3d4-9188-77c8-1cabaefef646", + "link": "General recommendation for storing encryption keys.", "services": [ - "AppSvc", - "WAF" + "AVS", + "AKV" ], - "severity": "High", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Encryption", + "text": "Use Azure Key Vault with in-guest encryption ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "IoT Hub DPS", + "category": "Security", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)", + "guid": "c1a81638-18df-0ce9-a73a-4b9a8a8dd392", + "link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#data-at-rest-encryption", "services": [ - "WAF" + "AVS", + "SQL" ], "severity": "Medium", - "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", - "waf": "Operations" + "subcategory": "Encryption", + "text": "Use in-guest encryption", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage", - "guid": "ba7da7be-9951-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export", - "service": "Azure Data Explorer", + "category": "Security", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute", + "guid": "8d0a8f51-8d35-19cd-c2fe-4e3512fb467e", + "link": "https://docs.microsoft.com/azure/key-vault/general/authentication", "services": [ - "Cost", - "Storage", - "WAF" + "ExpressRoute", + "AVS", + "AKV" ], - "text": "Leverage External Tables and Continuous data export overview to reduce costs", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Encryption", + "text": "Keyvault use for secrets", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.", - "guid": "56a22586-f490-4641-addd-ea8a377cdeb3", - "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp", - "service": "Azure Data Explorer", + "category": "Security", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Older OS security patching configured for workloads running on Azure VMware Solution are eligible for ESU", + "guid": "4f8b20e9-a2a1-f80f-af9b-8aa3b26dca08", + "link": "https://docs.microsoft.com/windows-server/get-started/extended-security-updates-deploy", "services": [ - "Storage", - "WAF" + "AVS" ], - "text": "To share data, explore Leader-follower cluster configuration", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Extended support", + "text": "Ensure extended security update support ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.", - "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters", - "service": "Azure Data Explorer", + "category": "Security", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Use a SIEM/SOAR", + "guid": "9bb22fec-4d00-3b95-7136-e225d0f5c63a", + "link": "https://learn.microsoft.com/azure/sentinel/overview", "services": [ - "ASR", - "WAF" + "AVS", + "Sentinel" ], - "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Investigation", + "text": "Enable Azure Sentinel or 3rd party SIEM ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "436b0635-cb45-4e57-a603-324ace8cc123", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities", - "service": "Azure Data Explorer", + "category": "Security", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "MS Defender For Cloud, for workloads running on Azure VMware Solution", + "guid": "f42b0b09-c591-238a-1580-2de3c485ebd2", + "link": "https://learn.microsoft.com/azure/azure-vmware/azure-security-integration#prerequisites", "services": [ - "RBAC", - "Storage", - "WAF" + "AVS", + "Defender" ], - "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Security", + "text": "Enable Advanced Threat Detection ", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "18ca6017-0265-4f4b-a46a-393af7f31728", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution", - "service": "Azure Data Explorer", + "category": "Security", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Are the applicable policies enabled (compliance baselines added to MDfC)", + "guid": "bcdd2348-3d0e-c6bb-1092-aa4cd1a66d6b", + "link": "https://docs.microsoft.com/azure/azure-vmware/azure-security-integration", "services": [ - "WAF" + "AVS", + "AzurePolicy" ], - "text": "Ingest data into each cluster in parallel", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Security", + "text": "Policy & Regulatory Compliance", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.", - "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration", - "service": "Azure Data Explorer", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Azure to Azure (E/W), Azure to On-premises), AVS to Internet, AVS to Azure", + "guid": "607c1ca9-da92-ae19-5a4c-eb1e876acbe7", + "link": "https://techcommunity.microsoft.com/t5/azure-migration-and/firewall-integration-in-azure-vmware-solution/ba-p/2254961#:~:text=Azure%20VMware%20Solution%20customers%20have%20multiple%20security%20options,the%20box%20to%20provide%20East-West%20and%20North-South%20firewalling.", "services": [ - "ACR", - "WAF" + "AVS" ], - "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Firewalls", + "text": "Azure / 3rd party firewall", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.", - "guid": "563a4dc7-4a74-48b6-922a-d190916a6649", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration", - "service": "Azure Data Explorer", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "To allow HCX appliance to connect/sync", + "guid": "1d87925c-c02b-7fde-a425-7e95ad846a27", + "link": "https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-networking-security/GUID-2CFE1654-9CC9-4EDB-A625-21317299E559.html", "services": [ - "ACR", - "WAF" + "AVS" ], - "text": "For critical applications, create Active-Active configuration in two paired regions", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Firewalls", + "text": "Firewalls allow for East/West traffic inside AVS", + "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.", - "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration", - "service": "Azure Data Explorer", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Decision on which tool to use (SRM requires additional license - enables automation & other features)", + "guid": "468b3495-2f6e-b65a-38ef-3ba631bcaa46", + "link": "https://docs.vmware.com/en/VMware-HCX/4.2/hcx-user-guide/GUID-B842696B-89EF-4183-9C73-B77157F56055.html", "services": [ - "WAF" + "AVS" ], - "text": "For applications, which required only read during failure, create Active-Hot standby configuration", + "severity": "Medium", + "subcategory": "Networking", + "text": "HCX and/or SRM", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.", - "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration", - "service": "Azure Data Explorer", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Read up on requirements for Service Mesh requirements and how HCX ", + "guid": "be2ced52-da08-d366-cf7c-044c19e29509", + "link": "https://docs.vmware.com/en/VMware-HCX/4.6/hcx-user-guide/GUID-76BCD059-A31A-4041-9105-ACFB56213E7C.html", "services": [ - "ASR", - "Cost", - "AzurePolicy", - "Storage", - "WAF" + "AVS" ], - "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration", + "severity": "Medium", + "subcategory": "Networking", + "text": "Configuring and Managing the HCX Interconnect", "waf": "Reliability" }, { - "checklist": "WAF checklist", - "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.", - "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757", - "link": "https://learn.microsoft.com/azure/data-explorer/devops", - "service": "Azure Data Explorer", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "If you are planning on using stretch networks ensure that your on-premises environment requirements", + "guid": "7dcac579-fc5c-5c9c-f1f7-9b1149ff2c37", + "link": "https://docs.vmware.com/en/VMware-HCX/4.2/hcx-user-guide/GUID-DBDB4D1B-60B6-4D16-936B-4AC632606909.html", "services": [ - "AzurePolicy", - "WAF" + "AVS" ], - "text": "Wrap DevOps and source control around all your code", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Networking", + "text": "Restrictions and limitations for network extensions", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780", - "link": "https://learn.microsoft.com/azure/data-explorer/devops", - "service": "Azure Data Explorer", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Do workloads require MoN?", + "guid": "cf45c0b9-6c4b-3bfb-86c5-62fe54061c73", + "link": "https://learn.microsoft.com/azure/azure-vmware/vmware-hcx-mon-guidance", "services": [ - "WAF" + "AVS" ], - "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.", - "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Networking", + "text": "Mobility optimized networking", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18", - "link": "https://learn.microsoft.com/azure/data-explorer/devops", - "service": "Azure Data Explorer", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Operating system level of Vmware environment", + "guid": "b7cf11f3-b12e-5189-991a-06df5250d2ca", + "link": "https://learn.microsoft.com/azure/site-recovery/vmware-physical-azure-support-matrix", "services": [ - "WAF" + "AVS" ], - "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "On-premises pre-requisites", + "text": "Support matrix (OS versions etc).", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "65285269-440b-44be-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", - "service": "Redis", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Required that all switches are dynamic", + "guid": "45fe9252-aa1b-4e30-45c6-bc02f3b76acf", + "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/vsan-network-design-guide/GUID-91E1CD6F-33A6-4AC6-BC22-3E4807296F86.html#:~:text=Migrate%20Management%20Network%201%20Add%20hosts%20to%20the,each%20host.%20...%204%20Finish%20the%20configuration.%20", "services": [ - "ACR", - "WAF" + "AVS" ], - "severity": "High", - "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "On-premises pre-requisites", + "text": "Standard switches converted to dynamic switches", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", - "service": "Redis", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "See sections on sizing and capacity in the link.", + "guid": "e9f6d736-ee44-e2ac-e7f9-e361f8c857f3", + "link": "https://learn.microsoft.com/azure/azure-vmware/plan-private-cloud-deployment", "services": [ - "Storage", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.", - "waf": "Reliability" + "subcategory": "On-premises pre-requisites", + "text": "Capacity for HCX appliance", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", - "service": "Redis", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Check hardware restrictions to ensure compatibility with AVS/OS ", + "guid": "1be2cdd6-15a7-9a33-aea7-113859035ce9", + "link": "https://kb.vmware.com/s/article/2007240#:~:text=ESXi%2FESX%20hosts%20and%20compatible%20virtual%20machine%20hardware%20versions,%20Not%20Supported%20%204%20more%20rows", "services": [ - "Storage", - "WAF" + "AVS" ], "severity": "Medium", - "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available", - "waf": "Reliability" + "subcategory": "On-premises pre-requisites", + "text": "Hardware compatibility", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", - "service": "Redis", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Need to be converted", + "guid": "16ab821a-27c6-b6d3-6042-10dc4d6dfcb7", + "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.storage.doc/GUID-01D3CF47-A84A-4988-8103-A0487D6441AA.html", "services": [ - "ASR", - "WAF" + "Storage", + "AVS" ], "severity": "Medium", - "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.", - "waf": "Reliability" + "subcategory": "Storage", + "text": "VSAN RDM disks are converted - not supported.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", - "service": "Entra", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Need to be converted", + "guid": "eb2f9313-afb2-ab35-aa24-6d97a3cb0611", + "link": "3rd-Party tools", "services": [ - "Entra", - "WAF" + "Storage", + "AVS", + "VM" ], "severity": "Medium", - "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.", + "subcategory": "Storage", + "text": "VM with SCSI shared bus are not supported", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Entra", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Remove Direct IO before migration", + "guid": "3f2a5cff-c8a6-634a-1f1b-53ef9d321381", + "link": "Contact VMware", "services": [ - "Entra", - "WAF" + "Storage", + "AVS", + "VM" ], - "severity": "Low", - "text": "Ensure you have a Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants", + "severity": "Medium", + "subcategory": "Storage", + "text": "VM with Direct IO require removing DirectPath device", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "Entra", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Cannot migrate clusters ", + "guid": "efc8a311-74f8-0252-c6a0-4bac7610e266", + "link": "Contact VMware", "services": [ - "WAF" + "Storage", + "AVS" ], - "severity": "Low", - "text": "Leverage Azure Lighthouse for Multi-Tenant Management", + "severity": "Medium", + "subcategory": "Storage", + "text": "Shared VMDK files are not supported", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Entra", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Convert to a different format", + "guid": "ab6c89cd-a26f-b894-fe59-61863975458e", + "link": "Contact VMware", "services": [ - "WAF" + "Storage", + "AVS" ], "severity": "Medium", - "text": "Ensure that Azure Lighthouse is used for administering the tenant by partner", - "waf": "Cost" + "subcategory": "Storage", + "text": "RDM with 'physical compatibility mode' are not supported.", + "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "348ef254-c27d-442e-abba-c7571559ab91", - "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "service": "Entra", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning 'RAID-1 FTT-1' is default with Thin Provisioning", + "guid": "7628d446-6b10-9678-9cec-f407d990de43", + "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", "services": [ - "RBAC", - "ACR", - "Subscriptions", - "WAF" + "Storage", + "VM", + "AVS", + "AzurePolicy" ], - "severity": "High", - "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "Default storage policy", + "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", - "service": "Entra", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "The default storage policy is set to RAID-1 (Mirroring) FTT-1, with Object Space Reservation set to Thin provisioning.", + "guid": "37fef358-7ab9-43a9-542c-22673955200e", + "link": "https://learn.microsoft.com/azure/azure-vmware/configure-storage-policy", "services": [ - "WAF" + "Storage", + "AVS", + "VM", + "AzurePolicy" ], - "severity": "High", - "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "Ensure that the appropriate VM template storage policy is used", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "Entra", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs", + "guid": "ebebd109-9f9d-d85e-1b2f-d302012843b7", + "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", "services": [ - "Entra", - "WAF" + "Storage", + "AVS", + "AzurePolicy" ], "severity": "Medium", - "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Security" + "subcategory": "Storage", + "text": "Failure to tolerate policy", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", - "service": "Entra", + "category": "VMware", + "checklist": "Azure VMware Solution Implementation Checklist", + "description": "ANF can be used to extend storage for Azure VMware Solution,", + "guid": "1be821bd-4f37-216a-3e3d-2a5ac6996863", + "link": "https://learn.microsoft.com/azure/azure-vmware/netapp-files-with-azure-vmware-solution", "services": [ - "Entra", - "AzurePolicy", - "WAF" + "Storage", + "AVS" ], - "severity": "Low", - "text": "Enforce Microsoft Entra ID conditional-access policies for any user with rights to Azure environments", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "Use ANF for external storage", + "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", - "service": "Entra", + "category": "BC and DR", + "checklist": "Azure App Service Review", + "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", + "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", + "service": "App Services", "services": [ - "WAF" + "AppSvc" ], - "severity": "High", - "text": "Enforce multi-factor authentication for any user with rights to the Azure environments", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Security" + "severity": "Low", + "subcategory": "High Availability", + "text": "Refer to baseline highly available zone-redundant web application architecture for best practices", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "14658d35-58fd-4772-99b8-21112df27ee4", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "Entra", + "category": "BC and DR", + "checklist": "Azure App Service Review", + "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", + "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", + "service": "App Services", "services": [ - "Entra", - "WAF" + "Backup", + "AppSvc" ], "severity": "Medium", - "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "High Availability", + "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "Entra", + "category": "BC and DR", + "checklist": "Azure App Service Review", + "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", + "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", + "service": "App Services", "services": [ - "Entra", - "WAF" + "AppSvc" ], - "severity": "Medium", - "text": "If planning to switch from Active Directory Domain Serivces to Entra domain services, evaluate the compatibility of all workloads", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", - "waf": "Security" + "severity": "High", + "subcategory": "High Availability", + "text": "Leverage Availability Zones where regionally applicable (requires Premium v2 or v3 tier)", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", - "service": "Entra", + "category": "Operations", + "checklist": "Azure App Service Review", + "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "services": [ - "Entra", "Monitor", - "WAF" + "AppSvc" ], "severity": "Medium", - "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Implement health checks", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "984a859c-773e-47d2-9162-3a765a917e1f", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", - "service": "Entra", + "category": "Operations", + "checklist": "Azure App Service Review", + "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", + "service": "App Services", "services": [ - "WAF" + "Backup", + "AppSvc" ], "severity": "High", - "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "Multi-tenant service", + "text": "Refer to backup and restore best practices for Azure App Service", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "35037e68-9349-4c15-b371-228514f4cdff", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "Entra", + "category": "BC and DR", + "checklist": "Azure App Service Review", + "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", + "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", + "service": "App Services", "services": [ - "Entra", - "RBAC", - "WAF" + "AppSvc" ], - "severity": "Medium", - "text": "Avoid using on-premises synced accounts for Microsoft Entra ID role assignments.", - "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", - "waf": "Security" + "severity": "High", + "subcategory": "High Availability", + "text": "Implement Azure App Service reliability best practices", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Entra", + "category": "BC and DR", + "checklist": "Azure App Service Review", + "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", + "service": "App Services", "services": [ - "Entra", - "WAF" + "AppSvc" ], - "severity": "Medium", - "text": "Where required, use Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications (hosted in the cloud or on-premises).", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Security" + "severity": "Low", + "subcategory": "High Availability", + "text": "Familiarize with how to move an App Service app to another region During a disaster", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", - "service": "VNet", + "category": "BC and DR", + "checklist": "Azure App Service Review", + "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", + "service": "App Services", "services": [ - "VNet", - "WAF" - ], - "severity": "Medium", - "text": "Leverage a network design based on the traditional hub-and-spoke network topology for network scenarios that require maximum flexibility.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "Security" - }, - { - "ammp": true, - "checklist": "WAF checklist", - "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", - "service": "VNet", - "services": [ - "VNet", - "Firewall", - "ExpressRoute", - "DNS", - "VPN", - "Entra", - "NVA", - "WAF" + "AppSvc" ], "severity": "High", - "text": "Ensure that shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS servers.", - "waf": "Cost" + "subcategory": "High Availability", + "text": "Familiarize with reliability support in Azure App Service", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "VNet", + "category": "BC and DR", + "checklist": "Azure App Service Review", + "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "App Services", "services": [ - "DDoS", - "WAF" + "AppSvc" ], "severity": "Medium", - "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" + "subcategory": "High Availability", + "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", + "category": "Operations", + "checklist": "Azure App Service Review", + "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "services": [ - "NVA", - "WAF" + "Monitor", + "AppSvc" ], "severity": "Medium", - "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance", + "subcategory": "Monitoring", + "text": "Monitor App Service instances using Health checks", "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", - "service": "ExpressRoute", + "category": "Operations", + "checklist": "Azure App Service Review", + "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", + "service": "App Services", "services": [ - "ExpressRoute", - "ARS", - "VPN", - "WAF" + "Monitor", + "AppSvc" ], - "severity": "Low", - "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.", - "waf": "Security" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", - "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", - "service": "ARS", + "category": "Operations", + "checklist": "Azure App Service Review", + "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", + "service": "App Services", "services": [ - "ARS", - "VNet", - "WAF" + "Monitor", + "AppSvc" ], "severity": "Low", - "text": "If using Route Server, use a /27 prefix for the Route Server subnet.", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website", + "waf": "Reliability" }, { - "checklist": "WAF checklist", - "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.", + "guid": "834ac932-223e-4ce8-8b12-3071a5416415", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "services": [ - "VNet", - "ACR", - "WAF" + "AKV", + "AppSvc" ], - "severity": "Medium", - "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", - "waf": "Performance" + "severity": "High", + "subcategory": "Data Protection", + "text": "Use Key Vault to store secrets", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.", + "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "services": [ - "Monitor", - "WAF" + "Entra", + "AKV", + "AppSvc" ], - "severity": "Medium", - "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "Operations" + "severity": "High", + "subcategory": "Data Protection", + "text": "Use Managed Identity to connect to Key Vault", + "waf": "Security" }, { - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", - "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Store the App Service TLS certificate in Key Vault.", + "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", + "service": "App Services", "services": [ - "Entra", - "ExpressRoute", - "VNet", - "WAF" + "AKV", + "AppSvc" ], - "severity": "Medium", - "text": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000)", - "waf": "Reliability" + "severity": "High", + "subcategory": "Data Protection", + "text": "Use Key Vault to store TLS certificate.", + "waf": "Security" }, { - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", - "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Systems that process sensitive information should be isolated. To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.", + "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", + "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", + "service": "App Services", "services": [ - "Storage", - "WAF" + "Subscriptions", + "AppSvc" ], "severity": "Medium", - "text": "Consider the limit of routes per route table (400).", - "waf": "Reliability" + "subcategory": "Data Protection", + "text": "Isolate systems that process sensitive information", + "waf": "Security" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", - "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).", + "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", + "service": "App Services", "services": [ - "VNet", - "WAF" + "TrafficManager", + "AppSvc" ], - "severity": "High", - "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Data Protection", + "text": "Do not store sensitive data on local disk", + "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C. Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.", + "guid": "919ca0b2-c121-459e-814b-933df574eccc", + "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", + "service": "App Services", "services": [ - "ExpressRoute", - "WAF" + "Entra", + "AppSvc" ], "severity": "Medium", - "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.", + "subcategory": "Identity and Access Control", + "text": "Use an established Identity Provider for authentication", "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.", + "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", + "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", + "service": "App Services", "services": [ - "ExpressRoute", - "VPN", - "WAF" + "Entra", + "AppSvc" ], - "severity": "Low", - "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "severity": "High", + "subcategory": "Identity and Access Control", + "text": "Deploy from a trusted environment", "waf": "Security" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "558fd772-49b8-4211-82df-27ee412e7f98", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM. This disables access to these services and enforces the use of Azure AD secured endpoints for deployment. Note that the SCM site can also be opened using Azure AD credentials.", + "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", + "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", + "service": "App Services", "services": [ - "ACR", - "WAF" + "Entra", + "AppSvc" ], "severity": "High", - "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "subcategory": "Identity and Access Control", + "text": "Disable basic authentication", "waf": "Security" }, { - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", - "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Where possible use Managed Identity to connect to Azure AD secured resources. If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.", + "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", + "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", + "service": "App Services", "services": [ - "WAF" + "Entra", + "AKV", + "AppSvc" ], - "severity": "Low", - "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "severity": "High", + "subcategory": "Identity and Access Control", + "text": "Use Managed Identity to connect to resources", "waf": "Security" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", - "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.", + "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", + "service": "App Services", "services": [ - "VNet", - "WAF" + "Entra", + "ACR", + "AppSvc" ], "severity": "High", - "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16)", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "Performance" + "subcategory": "Identity and Access Control", + "text": "Pull containers using a Managed Identity", + "waf": "Security" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", - "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...", + "guid": "47768314-c115-4775-a2ea-55b46ad48408", + "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", + "service": "App Services", "services": [ - "WAF" + "Entra", + "Monitor", + "AppSvc" ], - "severity": "High", - "text": "Avoid using overlapping IP address ranges for production and DR sites.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Logging and Monitoring", + "text": "Send App Service runtime logs to Log Analytics", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.", + "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "service": "App Services", "services": [ - "DNS", - "WAF" + "Entra", + "Monitor", + "AppSvc" ], "severity": "Medium", - "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Operations" + "subcategory": "Logging and Monitoring", + "text": "Send App Service activity logs to Log Analytics", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", - "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", - "service": "DNS", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's. Traffic should be routed to an NVA such as Azure Firewall. Ensure to monitor the Firewall's logs.", + "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", + "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", + "service": "App Services", "services": [ - "DNS", - "ACR", - "WAF" + "VNet", + "Firewall", + "Monitor", + "NVA", + "AppSvc" ], "severity": "Medium", - "text": "For environments where name resolution across Azure and on-premises is required, consider using Azure DNS Private Resolver.", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "subcategory": "Network Security", + "text": "Outbound network access should be controlled", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall. This allows the receiving party to allow-list based on IP, should that be needed. Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead. (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)", + "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", + "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", + "service": "App Services", "services": [ - "DNS", - "WAF" + "Storage", + "VNet", + "Firewall", + "NVA", + "PrivateLink", + "AppSvc" ], "severity": "Low", - "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.", - "waf": "Operations" + "subcategory": "Network Security", + "text": "Ensure a stable IP for outbound communications towards internet addresses", + "waf": "Security" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "614658d3-558f-4d77-849b-821112df27ee", - "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", - "service": "DNS", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.", + "guid": "0725769e-e669-41a4-a34a-c932223ece80", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "services": [ - "VNet", - "VM", - "DNS", - "WAF" + "PrivateLink", + "AppSvc" ], "severity": "High", - "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Operations" + "subcategory": "Network Security", + "text": "Inbound network access should be controlled", + "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", - "service": "Bastion", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door. Make sure to monitor the WAF's logs.", + "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", + "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", + "service": "App Services", "services": [ - "Bastion", - "WAF" + "WAF", + "Monitor", + "AppSvc", + "FrontDoor", + "AppGW" ], - "severity": "Medium", - "text": "Consider using Azure Bastion to securely connect to your network.", + "severity": "High", + "subcategory": "Network Security", + "text": "Use a WAF in front of App Service", "waf": "Security" }, { - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", - "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", - "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", - "service": "Bastion", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF. Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.", + "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "services": [ - "VNet", - "Bastion", - "WAF" + "PrivateLink", + "WAF", + "AppSvc" ], - "severity": "Medium", - "text": "Use Azure Bastion in a subnet /26 or larger.", + "severity": "High", + "subcategory": "Network Security", + "text": "Avoid for WAF to be bypassed", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "WAF", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Set minimum TLS policy to 1.2 in App Service configuration.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", + "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", + "service": "App Services", "services": [ - "FrontDoor", "AzurePolicy", - "ACR", - "WAF" + "AppSvc" ], "severity": "Medium", - "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "subcategory": "Network Security", + "text": "Set minimum TLS policy to 1.2", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Configure App Service to use HTTPS only. This causes App Service to redirect from HTTP to HTTPS. Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.", + "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", + "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", + "service": "App Services", "services": [ - "FrontDoor", - "AzurePolicy", - "AppGW", - "WAF" + "WAF", + "AppSvc" ], - "severity": "Low", - "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "severity": "High", + "subcategory": "Network Security", + "text": "Use HTTPS only", "waf": "Security" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "services": [ - "VNet", - "WAF" + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.", + "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", + "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", + "service": "App Services", + "services": [ + "Storage", + "AppSvc" ], "severity": "High", - "text": "Deploy WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "subcategory": "Network Security", + "text": "Wildcards must not be used for CORS", "waf": "Security" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", + "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", + "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", + "service": "App Services", "services": [ - "VNet", - "DDoS", - "WAF" + "AppSvc" ], "severity": "High", - "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "subcategory": "Network Security", + "text": "Turn off remote debugging", "waf": "Security" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "b034c01e-110b-463a-b36e-e3346e57f225", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.", + "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", + "service": "App Services", "services": [ - "WAF" + "Defender", + "AppSvc" ], - "severity": "High", - "text": "Assess and review network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Network Security", + "text": "Enable Defender for Cloud - Defender for App Service", + "waf": "Security" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.", + "guid": "223ece80-b123-4071-a541-6415833ea3ad", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "App Services", "services": [ + "VNet", + "EventHubs", + "WAF", + "AppGW", + "NVA", "DDoS", - "WAF" + "AppSvc" ], - "severity": "High", - "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "severity": "Medium", + "subcategory": "Network Security", + "text": "Enable DDOS Protection Standard on the WAF VNet", "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.", + "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", + "service": "App Services", "services": [ - "ExpressRoute", - "WAF" + "VNet", + "ACR", + "PrivateLink", + "AppSvc" ], "severity": "Medium", - "text": "Ensure that you have investigated the possibility to use ExpressRoute as primary connection to Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "subcategory": "Network Security", + "text": "Pull containers over a Virtual Network", + "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.", - "guid": "f29812b2-363c-4efe-879b-599de0d5973c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.", + "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", + "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", + "service": "App Services", "services": [ - "ExpressRoute", - "WAF" + "AppSvc" ], "severity": "Medium", - "text": "When you use multiple ExpressRoute circuits, or multiple on-prem locations, make sure to optimize routing with BGP attributes, if certain paths are preferred.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "subcategory": "Penetration Testing", + "text": "Conduct a penetration test", + "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", - "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", + "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", + "service": "App Services", "services": [ - "ExpressRoute", - "VPN", - "WAF" + "AppSvc" ], "severity": "Medium", - "text": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "subcategory": "Vulnerability Management", + "text": "Deploy validated code", + "waf": "Security" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", - "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", - "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure App Service Review", + "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", + "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", + "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", + "service": "App Services", "services": [ - "ExpressRoute", - "Cost", - "WAF" + "AppSvc" ], "severity": "High", - "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.", - "waf": "Cost" + "subcategory": "Vulnerability Management", + "text": "Use up-to-date platforms, languages, protocols and frameworks", + "waf": "Security" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", - "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "When you are creating a SQL Server on Azure VM, carefully consider the type of workload necessary. If you are migrating an existing environment, collect a performance baseline to determine your SQL Server on Azure VM requirements. If this is a new VM, then create your new SQL Server VM based on your vendor requirements.", + "guid": "1fc3fc14-eea6-4e69-b8d9-a3eec218e687", + "link": "https://learn.microsoft.com/sql/dma/dma-sku-recommend-sql-db?view=sql-server-ver16", "services": [ - "ExpressRoute", - "Cost", - "WAF" + "VM", + "SQL" ], "severity": "High", - "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU.", - "waf": "Cost" + "subcategory": "VM Size", + "text": "Collect the target workload's performance characteristics and use them to determine the appropriate VM size for your business.", + "waf": "Performance" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", - "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "The memory optimized virtual machine sizes are a primary target for SQL Server VMs and the recommended choice by Microsoft. The memory optimized virtual machines offer stronger memory-to-CPU ratios and medium-to-large cache options.Consider Ebdsv5-series series first for most SQL Server workloads.", + "guid": "e04abe1f-8d39-4fda-9776-8424c116775c", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-vm-size?view=azuresql#memory-optimized", "services": [ - "ExpressRoute", - "WAF" + "VM", + "SQL" ], "severity": "Medium", - "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "subcategory": "VM Size", + "text": "Use memory optimized virtual machine sizes for the best performance of SQL Server workloads.", + "waf": "Performance" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "To find the most effective configuration for SQL Server workloads on an Azure VM, start by measuring the storage performance of your business application. Once storage requirements are known, select a virtual machine that supports the necessary IOPS and throughput with the appropriate memory-to-vCore ratio.", + "guid": "2ea55b56-ad48-4408-be72-734b476ba18f", + "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance#counters-to-measure-application-performance-requirements", "services": [ - "ExpressRoute", - "WAF" + "Storage", + "VM", + "SQL" ], "severity": "Medium", - "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "subcategory": "Storage", + "text": "Determine storage bandwidth and latency requirements for SQL Server data, log, and tempdb files before choosing the disk type.", "waf": "Performance" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", - "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "This provides more dedicated disk IOPS and throughput on the disk level and also allows you to configure the Azure disk host caching setting for each disk to the optimal setting for that data type.", + "guid": "dbf590ce-65de-48e0-9f9c-cbd468266abc", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "ExpressRoute", - "WAF" + "Storage", + "SQL" ], - "severity": "Medium", - "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "severity": "High", + "subcategory": "Storage", + "text": "Place data, log, and tempdb files on separate drives", "waf": "Performance" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", - "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", - "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", - "service": "VPN", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Premium SSD is always recommend as a minimum for SQL Server in order to obtain better performance and lower latency. P30 and P40 are recommended because disk caching is not supported for disks 4 TiB and larger ( P50 and above) and they provide the optimal price to performance ratio", + "guid": "e6a84de5-df43-4d19-a248-1718d5d1e5f6", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "VPN", - "WAF" + "Storage", + "SQL" ], - "severity": "Medium", - "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "Reliability" + "severity": "High", + "subcategory": "Storage", + "text": "For the data drive, use premium P30 and P40 or smaller disks to ensure the availability of cache support", + "waf": "Performance" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "WAF checklist", - "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", - "service": "VPN", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Log files have primarily write-heavy operations. Therefore, they do not benefit from the ReadOnly cache. Hence evaluate your price vs performance vs capacity and chose the right storage disk.", + "guid": "25659d35-58fd-4772-99c9-31112d027fe4", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "VPN", - "WAF" + "Storage", + "Cost", + "SQL" + ], + "severity": "High", + "subcategory": "Storage", + "text": "For the log drive plan for capacity and test performance versus cost while evaluating the premium P30 - P80 disks", + "waf": "Performance" + }, + { + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Placing TempDB on the D drive can help performance. Consider the size required and always test performance.", + "guid": "12f70983-f630-4472-8ee6-9d6b5c2622f5", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", + "services": [ + "Storage", + "VM", + "SQL" ], "severity": "Medium", - "text": "Use redundant VPN appliances on-premises (active/active or active/passive).", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "Reliability" + "subcategory": "Storage", + "text": "Place tempdb on the local ephemeral SSD (default D:\\) drive for most SQL Server workloads that are not part of Failover Cluster Instance (FCI) after choosing the optimal VM size.", + "waf": "Performance" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "718cb437-b060-2589-8856-2e93a5c6633b", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Striping Data and Log disk can increase bandwidth. Ensure that VM size also matches expected output", + "guid": "4b69bad3-4aad-45e8-a78e-1d76667313c4", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "ExpressRoute", - "Cost", - "WAF" + "Storage", + "VM", + "SQL" ], "severity": "High", - "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Cost" + "subcategory": "Storage", + "text": "Stripe multiple Azure data disks using Storage Spaces to increase I/O bandwidth", + "waf": "Performance" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Your storage caching policy varies depending on the type of SQL Server data files that are hosted on the drive.Enable Read-only caching for the disks hosting SQL Server data files.Reads from cache will be faster than the uncached reads from the data disk.Set the caching policy to None for disks hosting the transaction log. There is no performance benefit to enabling caching for the Transaction log disk.", + "guid": "05674b5e-985b-4859-a773-e7e261623b77", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "ExpressRoute", - "WAF" + "Storage", + "AzurePolicy", + "SQL" ], - "severity": "Medium", - "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Security" + "severity": "High", + "subcategory": "Storage", + "text": "Set host caching to read-only for data file disks and none for log file disks.", + "waf": "Performance" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "b30e38c3-f298-412b-8363-cefe179b599d", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Check that you storage is in the same region as your VM. For exaplme if your VM is in EAST US 2 ensure your storage is in East US 2.", + "guid": "5a917e1f-348e-4f35-9c27-d42e8bbac868", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "ExpressRoute", - "Monitor", - "WAF" + "Storage", + "VM", + "SQL" ], - "severity": "Medium", - "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operations" + "severity": "High", + "subcategory": "Storage", + "text": "Provision the storage account in the same region as the SQL Server VM", + "waf": "Performance" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", - "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "SQL Server uses extents to store data. These are 64KB in size. Therefore, on a SQL Server machine, the NTFS allocation unit size for hosting SQL database files should be 64 KB.", + "guid": "155abb91-63e9-4908-ae28-c84c33b6b780", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "ACR", - "NetworkWatcher", - "Monitor", - "WAF" + "Storage", + "SQL" ], - "severity": "Medium", - "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operations" + "severity": "High", + "subcategory": "Storage", + "text": "Format your data disk to use 64 KB block size (allocation unit size) for all data files placed on a drive other than the temporary D:\\ drive", + "waf": "Performance" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", - "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "It is recommended that you determine BCDR needs and requirements ensuring that you are able to meet you SLAs of the environment.", + "guid": "8b9fe5c4-2049-4d41-9a92-3c3474d11028", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#azure-only-disaster-recovery-solutions", "services": [ - "ExpressRoute", - "WAF" + "VM", + "SQL" ], "severity": "Medium", - "text": "Use ExpressRoute circuits from different peering locations for redundancy.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "subcategory": "HADR", + "text": "Determine HA/DR requirements for each VM to be migrated.", "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "When depoying High Availability you need to use availability sets or availability zones to avoid unexpected outages.", + "guid": "ac6aae01-e6a8-44de-9df4-3d1992481718", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#high-availability-nodes-in-an-availability-set", "services": [ - "ExpressRoute", - "VPN", - "WAF" + "VM", + "SQL" ], - "severity": "Medium", - "text": "Use site-to-site VPN as failover of ExpressRoute, especially if only using a single ExpressRoute circuit.", + "severity": "High", + "subcategory": "HADR", + "text": "Place your VMs in an availability set or different availability zones.", "waf": "Reliability" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", - "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Prefered option when deploying an Availability Group. The recommended solution is to use multi-subnets when deploying Always on Availability Groups.", + "guid": "d5d1e5f6-2565-49d3-958f-d77249c93111", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-azure-portal-configure?view=azuresql&tabs=azure-cli", "services": [ "VNet", - "Storage", - "WAF" + "VM", + "LoadBalancer", + "SQL" ], - "severity": "High", - "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.", + "severity": "Medium", + "subcategory": "HADR", + "text": "Deploy your SQL Server VMs to multiple subnets whenever possible to avoid the dependency on an Azure Load Balancer or a distributed network name (DNN) to route traffic to your HADR solution. ( If one is implementing FCI or AG)", "waf": "Reliability" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "d581a947-69a2-4783-942e-9df3664324c8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "High availability and disaster recovery (HADR) features, such as the Always On availability group and the failover cluster instance rely on underlying Windows Server Failover Cluster technology. Review the best practices for modifying your HADR settings to better support the cloud environment.", + "guid": "2d027fe4-12f7-4098-9f63-04722ee69d6b", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql-vm#hadr-configuration", "services": [ - "ExpressRoute", - "ACR", - "WAF" + "ASR", + "SQL" ], "severity": "High", - "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.", + "subcategory": "HADR", + "text": "Change the cluster to less aggressive parameters to avoid unexpected outages from transient network failures or Azure platform maintenance. ( If one is implementing FCI or AG)", "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Ensure that quorum is set correct for the number of instances deployed.", + "guid": "5c2622f5-4b69-4bad-94aa-d5e8c78e1d76", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/hadr-cluster-best-practices?view=azuresql-vm&tabs=windows2012#quorum-voting", "services": [ - "ExpressRoute", - "WAF" + "SQL" ], - "severity": "Medium", - "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "severity": "High", + "subcategory": "HADR", + "text": "Configure cluster quorum voting to use 3 or more odd number of votes. Don't assign votes to DR regions. ( If one is implementing FCI or AG)", "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "On Azure virtual machines, clusters use a load balancer to hold an IP address that needs to be on one cluster node at a time. In this solution, the load balancer holds the IP address for the virtual network name (VNN) listener for the Always On availability group when the SQL Server VMs are in a single subnet.", + "guid": "667313c4-0567-44b5-b985-b859c773e7e2", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-vnn-azure-load-balancer-configure?view=azuresql-vm&tabs=ilb", "services": [ - "WAF" + "VNet", + "VM", + "LoadBalancer", + "SQL" ], - "severity": "Medium", - "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "severity": "High", + "subcategory": "HADR", + "text": "When using the virtual network name (VNN) and Azure Load Balancer to connect to your HADR solution, specify MultiSubnetFailover = true in the connection string, even if your cluster only spans one subnet. ( If one is implementing FCI or AG)", "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "SQL Server, Azure SQL Database, and Azure SQL Managed Instance support row and page compression for rowstore tables and indexes, and support columnstore and columnstore archival compression for columnstore tables and indexes.", + "guid": "61623b77-5a91-47e1-b348-ef354c27d42e", + "link": "https://learn.microsoft.com/sql/relational-databases/data-compression/data-compression?view=sql-server-ver16", "services": [ - "ExpressRoute", - "WAF" + "Storage", + "SQL" + ], + "severity": "Low", + "subcategory": "SQL Server", + "text": "Enable database page compression where appropriate.", + "waf": "Performance" + }, + { + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "By default, data and log files are initialized to overwrite any existing data left on the disk from previously deleted files. Data and log files are first initialized by zeroing the files (filling with zeros).In SQL Server, for data files only, instant file initialization (IFI) allows for faster execution of the previously mentioned file operations, since it reclaims used disk space without filling that space with zeros. Instead, disk content is overwritten as new data is written to the files.", + "guid": "8bbac868-155a-4bb9-863e-9908ae28c84c", + "link": "https://learn.microsoft.com/sql/relational-databases/databases/database-instant-file-initialization?view=sql-server-ver16", + "services": [ + "Storage", + "SQL" ], "severity": "High", - "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "subcategory": "SQL Server", + "text": "Enable instant file initialization for data files.", + "waf": "Operations" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Recommended for best performance and availability migrate all databases to data and log disks", + "guid": "33b6b780-8b9f-4e5c-9204-9d413a923c34", + "link": "https://learn.microsoft.com/sql/relational-databases/databases/move-database-files?view=sql-server-ver16", "services": [ - "ExpressRoute", - "VNet", - "Monitor", - "WAF" + "SQL" ], "severity": "Medium", - "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "subcategory": "SQL Server", + "text": "Move all databases to data disks, including system databases.", "waf": "Operations" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "5234c93f-b651-41dd-80c1-234177b91ced", - "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", - "service": "ExpressRoute", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", + "guid": "b824546c-e1ae-4e34-93ae-c8239248725d", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql-vm#sql-server-features", "services": [ - "ExpressRoute", - "VNet", - "WAF" + "Storage", + "VM", + "SQL" ], - "severity": "Medium", - "text": "Avoid using ExpressRoute circuits for VNet-to-VNet communication.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "severity": "Low", + "subcategory": "SQL Server", + "text": "Move SQL Server error log and trace file directories to data disks.", + "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", + "guid": "d68c5b5c-2925-4394-a69a-9d2799c42bb6", + "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/server-memory-server-configuration-options#use-", "services": [ - "Firewall", - "WAF" + "VM", + "SQL" ], "severity": "High", - "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" + "subcategory": "SQL Server", + "text": "Set max SQL Server memory limit to leave enough memory for the Operating System.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", + "guid": "8d1d7555-6246-4b43-a563-b4dc74a748b6", + "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/enable-the-lock-pages-in-memory-option-windows", "services": [ - "RBAC", - "Firewall", - "AzurePolicy", - "ACR", - "WAF" + "VM", + "SQL" ], - "severity": "Medium", - "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" + "severity": "High", + "subcategory": "SQL Server", + "text": "Enable lock pages in memory.", + "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", - "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", + "guid": "633ad2a0-916a-4664-a8fa-d0e278ee293c", + "link": "https://learn.microsoft.com/sql/relational-databases/performance/monitoring-performance-by-using-the-query-store", "services": [ - "Firewall", - "WAF" + "VM", + "SQL" ], "severity": "Low", - "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" + "subcategory": "SQL Server", + "text": "Enable Query Store on all production SQL Server databases following best practices.", + "waf": "Performance" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", - "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", - "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", + "guid": "1bc352ba-aab7-4571-a49a-b8093dc9ec9d", + "link": "https://learn.microsoft.com/sql/relational-databases/databases/tempdb-database#optimizing-tempdb-performance-in-sql-server", "services": [ - "Firewall", - "DNS", - "WAF" + "VM", + "SQL" ], "severity": "High", - "text": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules.", - "waf": "Security" + "subcategory": "SQL Server", + "text": "Ensure that all tempdb best practices are followed.", + "waf": "Performance" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", - "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", + "guid": "1bb73b36-a5a6-47fb-a9ed-5b35478c3479", + "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization", "services": [ - "Firewall", - "WAF" + "VM", + "SQL" ], "severity": "High", - "text": "Use Azure Firewall Premium for additional security and protection.", - "waf": "Security" + "subcategory": "SQL Server", + "text": "Schedule SQL Server Agent jobs to run DBCC CHECKDB, index reorganize, index rebuild, and update statistics jobs.", + "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", - "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", + "guid": "816b2863-cffe-41ca-a599-ef0d5a73dd4c", + "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization", "services": [ - "Firewall", - "WAF" + "VM", + "SQL" ], - "severity": "High", - "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.", - "waf": "Security" + "severity": "Medium", + "subcategory": "SQL Server", + "text": "Limit autogrowth of the database and Disable autoshrink", + "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", - "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Constrained vCPU virtual machines (VMs) are a type of VM where the vCPU count can be constrained to a half or a quarter of the original VM size. This allows customers to reduce the cost of software licensing while maintaining the same memory, storage, and I/O bandwidth", + "guid": "e36c1c81-770a-4fbc-9c0d-43918648d285", + "link": "https://learn.microsoft.com/azure/virtual-machines/constrained-vcpu", "services": [ - "Firewall", - "WAF" + "Storage", + "VM", + "Cost", + "SQL" ], - "severity": "High", - "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.", - "waf": "Security" + "severity": "Low", + "subcategory": "Cost Optimization", + "text": "Optimize SQL Server License cost with Constrained vCPU VM's", + "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", + "waf": "Cost" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", - "guid": "a3784907-9836-4271-aafc-93535f8ec08b", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Azure Hybrid Benefit allows you to exchange your existing licenses for discounted rates on Azure SQL Database and Azure SQL Managed Instance. Y", + "guid": "7ed67178-b824-4546-ae1a-ee3453aec823", + "link": "https://azure.microsoft.com/en-ca/pricing/hybrid-benefit/", "services": [ - "VNet", - "Firewall", - "Storage", - "VWAN", - "NVA", - "WAF" + "Cost", + "SQL" ], - "severity": "High", - "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance", - "waf": "Security" + "severity": "Low", + "subcategory": "Cost Optimization", + "text": "Leverage Azure Hybrid benefit to maximize the value of your on premises licenses in the cloud", + "waf": "Cost" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "715d833d-4708-4527-90ac-1b142c7045ba", - "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "The SQL Server IaaS Agent extension (SqlIaasExtension) runs on SQL Server on Azure Windows Virtual Machines (VMs) to automate management and administration tasks.", + "guid": "9248725d-d68c-45b5-a292-5394a69a9d27", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/sql-agent-extension-automatic-registration-all-vms?view=azuresql-vm&tabs=azure-cli", "services": [ - "Firewall", - "Storage", - "WAF" + "VM", + "SQL" ], "severity": "Medium", - "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "subcategory": "Azure", + "text": "Register with the SQL IaaS Agent Extension to unlock a number of feature benefits.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", - "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Accelerated Networking provides consistent ultra-low network latency via Azure's in-house programmable hardware and technologies", + "guid": "99c42bb6-8d1d-4755-9624-6b438563b4dc", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", "services": [ - "AzurePolicy", - "Firewall", - "WAF" + "VM", + "SQL" ], - "severity": "Important", - "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "severity": "High", + "subcategory": "Azure", + "text": "Ensure Accelerated Networking is enabled on the virtual machine.", "waf": "Operations" }, { - "ammp": true, - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", - "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", - "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", - "service": "Firewall", + "category": "SQL Server on Azure VM", + "checklist": "SQL Migration Review", + "description": "Microsoft Defender detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases on the SQL server.", + "guid": "74a748b6-633a-4d2a-8916-a66498fad0e2", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls", "services": [ - "Firewall", - "VNet", - "WAF" + "VM", + "Defender", + "SQL" ], "severity": "High", - "text": "Use a /26 prefix for your Azure Firewall subnets.", + "subcategory": "Azure", + "text": "Leverage Microsoft Defender for Cloud to improve the overall security posture of your virtual machine deployment.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", - "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", - "service": "Firewall", - "services": [ - "AzurePolicy", - "WAF" - ], - "severity": "Medium", - "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use", - "waf": "Performance" - }, - { - "checklist": "WAF checklist", - "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", - "link": "https://learn.microsoft.com/azure/firewall/ip-groups", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "There are some PaaS limitations that are introduced in SQL Managed Instance and some behavior changes compared to SQL Server. It is important to review and understand these differences.", + "guid": "78ee293c-1bc3-452b-aaab-7571849ab809", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/transact-sql-tsql-differences-sql-server?view=azuresql", "services": [ - "Storage", - "WAF" + "EventHubs", + "SQL" ], - "severity": "Medium", - "text": "Use IP Groups or IP prefixes to reduce number of IP table rules", - "waf": "Performance" + "severity": "High", + "subcategory": "Pre Migration", + "text": "Review the major differences between SQL Server and Managed Instance", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "SQL Managed Instance has characteristics and resource limits that depend on the underlying infrastructure and architecture. It is important to review these limits.", + "guid": "3dc9ec9d-1bb7-43b3-9a5a-67fba9ed5b35", + "link": "https://docs.microsoft.com/azure/azure-sql/managed-instance/resource-limits", "services": [ - "WAF" + "SQL" ], - "severity": "Medium", - "text": "Avoid wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs", + "severity": "High", + "subcategory": "Pre Migration", + "text": "Review capacity limits for SQL MI", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", - "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "The instance settings between managed instance and your source SQL Server can be different . It is important to review those differences that can impact performance.", + "guid": "8bc178bd-c5a0-46ca-9144-351e19dd3442", + "link": "https://medium.com/azure-sqldb-managed-instance/compare-environment-settings-on-sql-server-and-azure-sql-that-may-impact-performance-e90c21fa9b08", "services": [ - "Monitor", - "WAF" + "SQL" ], - "severity": "Medium", - "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.", + "severity": "High", + "subcategory": "Pre Migration", + "text": "Compare instance settings on SQL Server and Azure SQL MI that may impact performance", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "346840b8-1064-496e-8396-4b1340172d52", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "Assess on-premises SQL Server instance(s) migrating to Azure SQL Managed Instance. The assessment workflow helps you to detect issues that block the migration itself and also partially supported and unsupported features", + "guid": "9eb72281-37a1-451c-9bb4-e4f1814287d5", + "link": "https://docs.microsoft.com/azure/dms/ads-sku-recommend", "services": [ - "WAF" + "SQL" ], "severity": "High", - "text": "Enable TLS Inspection", - "waf": "Performance" + "subcategory": "Pre Migration", + "text": "Run Data Migration assistant or Azure Data Studio Migration Extension to detect compatibility issues that can impact database functionality on Managed Instance", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "The SKU recommendation feature can evaluate the source SQL Server performance and utilization characteristics to recommend a right-sized Azure SQL Managed Instance to assist with your migration journey.", + "guid": "ca8c26c9-b32a-4b5b-afc6-898a135e3378", + "link": "https://learn.microsoft.com/azure/dms/ads-sku-recommend", "services": [ - "ServiceBus", - "WAF" + "SQL" ], - "severity": "Low", - "text": "Use web categories to allow or deny outbound access to specific topics.", + "severity": "High", + "subcategory": "Pre Migration", + "text": "Select the right compute resources for your workload by leveraging the SKU recommendation tools.", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "Performance" }, { - "checklist": "WAF checklist", - "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "Review Unsupported Features, Migration Blockers and Breaking Changes for each database from the Assessment", + "guid": "97e31c67-d68c-4b69-82ac-19f906d697c8", + "link": "https://learn.microsoft.com/azure/dms/ads-sku-recommend", "services": [ - "WAF" + "SQL" ], - "severity": "Medium", - "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.", - "waf": "Performance" + "severity": "High", + "subcategory": "Pre Migration", + "text": "Review and address the issues highlighted in DMA/Azure Data Studio", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", - "link": "https://learn.microsoft.com/azure/firewall/dns-details", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "The SQL Managed Instance default DNS zone .database.windows.net can be changed with your own. However, the managed instance hostname part of its FQDN should remain the same.", + "guid": "eaded26b-dd18-46f0-ac25-1b999a68af87", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/frequently-asked-questions-faq?view=azuresql-mi#can-a-managed-instance-have-the-same-name-as-a-sql-server-on-premises-instance", "services": [ - "Firewall", "DNS", - "WAF" + "SQL" ], - "severity": "Medium", - "text": "Enable Azure Firewall DNS proxy configuration ", - "waf": "Security" + "severity": "High", + "subcategory": "Pre Migration", + "text": "Plan for connection string changes as changing a managed instance name is not supported", + "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", - "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "There are addional requirements in configuring a vnet and subnet hosting the managed instance.", + "guid": "c9a7f821-b8eb-48c0-aa77-e25e4d5aeaa8", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-existing-add-subnet?view=azuresql-mi", "services": [ - "AzurePolicy", - "VM", - "WAF" + "VNet", + "SQL" ], "severity": "Medium", - "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines", - "waf": "Security" + "subcategory": "Pre Migration", + "text": "Review managed instance VNet requirements", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "Though it's possible to deploy managed instances to a subnet with a number of IP addresses that's less than the output of the subnet formula, always consider using bigger subnets instead. Using a bigger subnet can help avoid future issues stemming from a lack of IP addresses, such as the inability to create additional instances within the subnet or scale existing instances.", + "guid": "dc4e2436-bb33-46d7-85f1-7960eee0b9b5", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-subnet-determine-size?view=azuresql-mi", "services": [ - "Firewall", - "Monitor", - "WAF" + "VNet", + "SQL" ], - "severity": "Low", - "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.", + "severity": "High", + "subcategory": "Deployment", + "text": "Ensure managed instance subnet has sufficient IP addresses available", + "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "SQL Managed Instance has characteristics and resource limits that depend on the underlying infrastructure and architecture. SQL Managed Instance can be deployed on multiple hardware configurations.", + "guid": "c8defc4d-721d-431d-850f-b707ae9eab40", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/resource-limits?view=azuresql-mi#service-tier-characteristics", "services": [ - "Backup", - "WAF" + "SQL" ], - "severity": "Low", - "text": "Implement backups for your firewall rules", - "waf": "Operations" + "severity": "High", + "subcategory": "Pre Migration", + "text": "Plan between General Purpose and Business Critical tiers of MI", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "waf": "Performance" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "App Gateway", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "The auto-failover groups feature allows you to manage the replication and failover of user databases in a managed instance to a managed instance in another Azure region. Auto-failover groups are designed to simplify deployment and management of geo-replicated databases at scale.", + "guid": "ed329079-8bc1-478b-bc5a-06ca7144351e", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/auto-failover-group-sql-mi?view=azuresql-mi&tabs=azure-powershell", "services": [ - "VNet", - "WAF" + "SQL" ], "severity": "High", - "text": "Ensure that control-plane communication for Azure PaaS services injected into a virtual network is not broken, for example with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "Security" + "subcategory": "Pre Migration", + "text": "Based on your RPO/RTO's , determine if Auto failover Group needs to be implemented. If so, plan for the deployment attributes of the second instance.", + "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "ExpressRoute", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "There are multiple ways to connect your application to the managed instance. Review and understand the pros and cons and decide on the best approach for your application.", + "guid": "5d226886-d30b-466c-97be-595190f83845", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql-mi", "services": [ - "ExpressRoute", - "PrivateLink", - "WAF" + "SQL" ], - "severity": "Medium", - "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Security" + "severity": "Low", + "subcategory": "Pre Migration", + "text": "Review the Connectivity Design between Database and Application, test & validate it", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", - "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "VNet", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "Compare migration options to choose the path that's appropriate to your business needs.", + "guid": "c586cb29-1ec1-46a1-b076-ef9f141acdce", + "link": "https://learn.microsoft.com/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-overview?view=azuresql-mi#migration-tools", "services": [ - "VNet", - "WAF" + "SQL" ], "severity": "Medium", - "text": "Don't enable virtual network service endpoints by default on all subnets.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "Security" + "subcategory": "Pre Migration", + "text": "Plan for the Migration Method. Depending on the DB Size and Application downtime window, select the preferred Migration Method.", + "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "After you verify that data is the same on both source and target, you can cut over from the source to the target environment. It's important to plan the cutover process with business / application teams to ensure minimal interruption during cutover doesn't affect business continuity.", + "guid": "579377bc-db37-451a-a2ac-1fad66e15d4d", + "link": "https://learn.microsoft.com/azure/dms/tutorial-sql-server-managed-instance-online#performing-migration-cutover", "services": [ - "Firewall", - "PrivateLink", - "DNS", - "NVA", - "WAF" + "SQL" ], "severity": "Medium", - "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "Security" + "subcategory": "Pre Migration", + "text": "Plan the cutover process with business / application teams to ensure minimal interruption during cutover and it does not affect business continuity.", + "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain", + "waf": "Reliability" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", - "service": "ExpressRoute", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "A time zone of a managed instance can be set during instance creation only. The default time zone is UTC", + "guid": "4a2adb1c-3d23-426a-b225-ca44e1695fdd", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/timezones-overview?view=azuresql#set-a-time-zone", "services": [ - "ExpressRoute", - "VNet", - "VPN", - "WAF" + "SQL" ], "severity": "High", - "text": "Use at least a /27 prefix for your Gateway subnets", - "waf": "Security" + "subcategory": "Deployment", + "text": "Ensure you customize your time zone setting at the instance creation time. One cannot change it later.", + "training": "https://learn.microsoft.com/azure/role-based-access-control/overview", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", - "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", - "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", - "service": "NSG", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "Server-level collation in Azure SQL Managed Instance can be specified when the instance is created and cannot be changed later.Default server-level collation is SQL_Latin1_General_CP1_CI_AS.", + "guid": "deace4cb-1deb-44c6-90c3-fc14eebb3693", + "link": "https://learn.microsoft.com/sql/relational-databases/collations/set-or-change-the-server-collation?view=sql-server-ver16", "services": [ - "VNet", - "WAF" + "SQL" ], - "severity": "Medium", - "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.", - "waf": "Security" + "severity": "High", + "subcategory": "Deployment", + "text": "Ensure you select the right collation setting at the instance creation time. One cannot change it later", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", - "service": "NSG", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "When you're migrating a database protected by Transparent Data Encryption (TDE) to Azure SQL Managed Instance using the native restore option, the corresponding certificate from the SQL Server instance needs to be migrated before database restore.", + "guid": "829e3eec-2183-4687-a007-7a2b5945bda4", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/tde-certificate-migrate?view=azuresql-mi&tabs=azure-powershell", "services": [ - "VNet", - "ACR", - "WAF" + "VM", + "SQL" ], "severity": "Medium", - "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "Security" + "subcategory": "Deployment", + "text": "For TDE Enabled Database, corresponding certificate from the on-premises or Azure VM SQL Server needs to be migrated before database restore", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", - "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", - "service": "NSG", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "System databases can be restored only from backups that are created on the version of SQL Server that the server instance is currently running. This is not the case when you are migrating to SQL Managed Instance.Azure PowerShell and DBATools PowerShell libraries enable you to easily script and automate and customize all parts of the migration process.", + "guid": "3334fdf9-1c23-4418-8b65-275269440b4b", + "link": "https://learn.microsoft.com/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide?view=azuresql-mi#backup-and-restore", "services": [ - "VNet", - "VM", - "WAF" + "Backup", + "SQL" ], - "severity": "Medium", - "text": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "Security" + "severity": "Low", + "subcategory": "Migration", + "text": "Restore of system databases is not supported. To migrate instance-level objects (stored in master or msdb databases), we recommend to script them out and run T-SQL scripts on the destination instance.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "When using migration options that continuously replicate / sync data changes from source to the target, the source data and schema can change and drift from the target. During data sync, ensure that all changes on the source are captured and applied to the target during the migration process.", + "guid": "e3d3e084-3276-4d4b-bc01-5bcf219e4a1e", "services": [ - "Entra", - "VNet", - "NVA", - "WAF" + "SQL" ], - "severity": "Medium", - "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "Security" + "severity": "High", + "subcategory": "Migration", + "text": "Ensure that all changes on the source are captured and applied to the target during the migration process.", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "guid": "dfe237de-143b-416c-91d7-aa9b64704489", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "Ensure that the application is able to succesffuly connect to the managed instance post migration of the databases.", + "guid": "b5887952-5d22-4688-9d30-b66c57be5951", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql-mi", "services": [ - "VNet", - "NetworkWatcher", - "WAF" + "SQL" ], "severity": "Medium", - "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "Security" + "subcategory": "Migration", + "text": "Test Application Connectivity to MI and Databases", + "waf": "Operations" }, { - "checklist": "WAF checklist", - "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", - "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "NSG", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "High availability is a fundamental part of SQL Managed Instance platform that works transparently for your database applications. Failovers from primary to secondary nodes in case of node degradation or fault detection, or during regular monthly software updates are an expected occurrence for all applications using SQL Managed Instance in Azure.", + "guid": "90f83845-c586-4cb2-a1ec-16a1d076ef9f", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/user-initiated-failover?view=azuresql", "services": [ - "VNet", - "WAF" + "SQL" ], - "severity": "Medium", - "text": "Consider the limit of NSG rules per NSG (1000).", - "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "severity": "High", + "subcategory": "Post Migration", + "text": "Consider executing a manual failover on SQL Managed Instance to test for fault and failover resiliency.", + "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", - "service": "VWAN", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "Ensuring that your applications are failover resilient prior to deploying to production will help mitigate the risk of application faults in production and will contribute to application availability for your customers.", + "guid": "141acdce-5793-477b-adb3-751ab2ac1fad", + "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/auto-failover-group-configure-sql-mi?view=azuresql&tabs=azure-portal#test-failover", "services": [ - "VWAN", - "WAF" + "EventHubs", + "LoadBalancer", + "SQL" ], - "severity": "Medium", - "text": "Consider Virtual WAN for simplified Azure networking management, and make sure your scenario is explicitly described in the list of Virtual WAN routing designs", - "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", - "waf": "Operations" + "severity": "High", + "subcategory": "Post Migration", + "text": "If failover groups have been implemented, Test Manual Failover and Failback and test application connectivity behavior during failover/failback", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "This provides more dedicated disk IOPS and throughput", + "guid": "aa359272-8e6e-4205-8726-76ae46691e88", + "link": "https://techcommunity.microsoft.com/t5/azure-sql-blog/storage-performance-best-practices-and-considerations-for-azure/ba-p/305525", "services": [ - "ACR", - "VWAN", - "WAF" + "Storage", + "SQL" ], - "severity": "Medium", - "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.", + "severity": "High", + "subcategory": "Post Migration", + "text": "Optimize Storage Performance for General Purpose Managed Instance", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", "waf": "Performance" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "Many organizations have policies that require that certificates or encryption keys be created and managed internally. If your organization has a similar policy, this architecture might apply to you. If your customers require internal management of these items, the architecture also might apply to you.", + "guid": "35ad9422-23e1-4381-8523-081a94174158", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/data/sql-managed-instance-cmk", "services": [ - "ACR", - "WAF" + "AzurePolicy", + "AKV", + "Backup", + "SQL" ], "severity": "Low", - "text": "Follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network", - "waf": "Performance" - }, - { - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", - "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "services": [ - "Firewall", - "WAF" - ], - "severity": "Medium", - "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "subcategory": "Post Migration", + "text": "Enable Customer managed TDE for taking your own copy only full backups", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", "waf": "Security" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "VWAN", - "services": [ - "VWAN", - "WAF" - ], - "severity": "Medium", - "text": "Ensure that the network architecture is within the Azure Virtual WAN limits.", - "waf": "Reliability" - }, - { - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", - "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", - "service": "VWAN", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "The maintenance window feature provides you with the ability to onboard Azure SQL resource to prescheduled time blocks outside of business hours.", + "guid": "33ef7ad7-c6d3-4733-865c-7acbe44bbe60", + "link": "https://learn.microsoft.com/azure/azure-sql/database/planned-maintenance?view=azuresql", "services": [ - "VWAN", - "Monitor", - "WAF" + "SQL" ], "severity": "Medium", - "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.", + "subcategory": "Post Migration", + "text": "Plan for Azure maintenance events", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Operations" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", - "service": "VWAN", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "By using the long-term retention (LTR) feature, you can store specified SQL Database and SQL Managed Instance full backups in Azure Blob storage with configured redundancy for up to 10 years.", + "guid": "9d89f2e8-7778-4424-b516-785c6fa96b96", + "link": "https://learn.microsoft.com/azure/azure-sql/database/long-term-retention-overview?view=azuresql-mi", "services": [ - "VWAN", - "WAF" + "Storage", + "ARS", + "Backup", + "SQL" ], - "severity": "Medium", - "text": "Make sure that your IaC deployments does not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.", + "severity": "Low", + "subcategory": "Post Migration", + "text": "Configure Long Term backup retention, view backups and restore from backups", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", - "service": "VWAN", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "By using Azure Hybrid Benefit, you can achieve cost savings, modernise and maintain a flexible hybrid environment while optimising business applications.", + "guid": "ad88408f-3727-434c-a76b-a28021459014", + "link": "https://azure.microsoft.com/en-gb/pricing/hybrid-benefit/#overview", "services": [ - "ExpressRoute", - "VPN", - "WAF" + "Cost", + "SQL" ], - "severity": "Medium", - "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Post Migration", + "text": "Take advantage of Azure Hybrid Benefit and Azure Reservations where applicable.", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "Cost" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", - "service": "VWAN", + "category": "SQL Managed Instance", + "checklist": "SQL Migration Review", + "description": "If you don't have threat protection Advanced Threat Protection is part of the Microsoft Defender for SQL offering, which is a unified package for advanced SQL security capabilities.", + "guid": "65d38e53-f9cc-4bd8-9926-6acca274faa1", + "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-overview?view=azuresql", "services": [ - "VWAN", - "WAF" + "Defender", + "SQL" ], "severity": "Medium", - "text": "Make sure that your IaC deployments are configuring label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.", - "waf": "Reliability" + "subcategory": "Post Migration", + "text": "Leverage Microsoft Defender for Cloud to improve the overall security posture", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Security" }, { - "ammp": true, - "arm-service": "microsoft.network/virtualWans", - "checklist": "WAF checklist", - "guid": "9c75dfef-573c-461c-a698-68598595581a", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", - "service": "VWAN", + "category": "Security", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", + "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", + "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", + "service": "Event Hubs", "services": [ - "WAF" + "EventHubs" ], - "severity": "High", - "text": "Assign enough IP space to virtual hubs, ideally a /23 prefix.", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Data Protection", + "text": "Use customer-managed key option in data at rest encryption when required", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "Security" }, { - "ammp": true, - "checklist": "WAF checklist", - "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Security", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ", + "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", + "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", + "service": "Event Hubs", "services": [ - "AzurePolicy", - "WAF" + "EventHubs" ], - "severity": "High", - "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.", + "severity": "Medium", + "subcategory": "Data Protection", + "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Security", + "checklist": "Azure Event Hub Review", + "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", + "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", + "service": "Event Hubs", "services": [ + "TrafficManager", + "Entra", "RBAC", - "AzurePolicy", - "WAF" + "EventHubs", + "AzurePolicy" ], "severity": "Medium", - "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.", + "subcategory": "Identity and Access Management", + "text": "Avoid using root account when it is not necessary", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "223ace8c-b123-408c-a501-7f154e3ab369", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Security", + "checklist": "Azure Event Hub Review", + "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ", + "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", + "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", + "service": "Event Hubs", "services": [ - "AzurePolicy", - "Subscriptions", - "WAF" + "Storage", + "Entra", + "EventHubs", + "AKV", + "VM" ], "severity": "Medium", - "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes", + "subcategory": "Identity and Access Management", + "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "3829e7e3-1618-4368-9a04-77a209945bda", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Security", + "checklist": "Azure Event Hub Review", + "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.", + "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", + "service": "Event Hubs", "services": [ - "AzurePolicy", - "WAF" + "EventHubs", + "Entra", + "RBAC" ], - "severity": "Medium", - "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.", + "severity": "High", + "subcategory": "Identity and Access Management", + "text": "Use least privilege data plane RBAC", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "43334f24-9116-4341-a2ba-527526944008", - "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", - "service": "Policy", + "category": "Security", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.", + "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", + "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", + "service": "Event Hubs", "services": [ - "AzurePolicy", - "Subscriptions", - "WAF" + "EventHubs", + "VNet", + "Monitor" ], - "severity": "Low", - "text": "Use Azure Policy to control which services users can provision at the subscription/management group level", + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Security", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", + "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", + "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", + "service": "Event Hubs", "services": [ - "AzurePolicy", - "WAF" + "EventHubs", + "VNet", + "PrivateLink" ], "severity": "Medium", - "text": "Use built-in policies where possible to minimize operational overhead.", + "subcategory": "Networking", + "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "checklist": "WAF checklist", - "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.", - "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", - "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", - "service": "Policy", + "category": "Security", + "checklist": "Azure Event Hub Review", + "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", + "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", + "service": "Event Hubs", "services": [ - "RBAC", - "Subscriptions", - "AzurePolicy", - "Entra", - "WAF" + "EventHubs" ], "severity": "Medium", - "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.", + "subcategory": "Networking", + "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Security" }, { - "checklist": "WAF checklist", - "guid": "19048384-5c98-46cb-8913-156a12476e49", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Operations Management", + "checklist": "Azure Event Hub Review", + "guid": "31d41e36-11c8-417b-8afb-c410d4391898", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", + "service": "Event Hubs", "services": [ - "AzurePolicy", - "Subscriptions", - "WAF" + "EventHubs" ], "severity": "Medium", - "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Leverage FTA Resillency HandBook", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Azure Event Hub Review", + "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones", + "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", + "service": "Event Hubs", + "services": [ + "EventHubs", + "ACR" + ], + "severity": "High", + "subcategory": "Zone Redudancy", + "text": "Leverage Availability Zones if regionally applicable", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Azure Event Hub Review", + "guid": "20b56c56-ad58-4519-8f82-735c586bb281", + "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", + "service": "Event Hubs", + "services": [ + "EventHubs" + ], + "severity": "Medium", + "subcategory": "Best Practices", + "text": "Use the Premium or Dedicated SKUs for predicable performance", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Azure Event Hub Review", + "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations", + "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", + "service": "Event Hubs", + "services": [ + "EventHubs", + "ASR" + ], + "severity": "High", + "subcategory": "Geo Redudancy", + "text": "Plan for Geo Disaster Recovery using Active Passive configuration", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Azure Event Hub Review", + "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs", + "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", + "service": "Event Hubs", + "services": [ + "EventHubs", + "ASR" + ], + "severity": "Medium", + "subcategory": "Geo Redudancy", + "text": "For Business Critical Applications, use Active Active configuration", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Azure Event Hub Review", + "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", + "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", + "service": "Event Hubs", + "services": [ + "EventHubs" + ], + "severity": "Medium", + "subcategory": "Reliability", + "text": "Design Resilient Event Hubs", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", - "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", - "service": "Policy", + "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.", + "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e", + "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention", + "service": "ACR", "services": [ - "AzurePolicy", + "ACR", "WAF" ], - "severity": "Medium", - "text": "If any data sovereignty requirements exist, Azure Policies can be deployed to enforce them", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "severity": "High", + "text": "Disable Azure Container Registry image export", "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", - "service": "Policy", + "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry", + "guid": "d503547c-d447-4e82-9128-a7100f1cac6d", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy", + "service": "ACR", "services": [ + "ACR", "AzurePolicy", "WAF" ], - "severity": "Medium", - "text": "For Sovereign Landing Zone, sovereignty policy baseline' policy initiative is deployed and and assigned at correct MG level.", + "severity": "High", + "text": "Enable Azure Policies for Azure Container Registry", "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", - "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", - "service": "Policy", + "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.", + "guid": "d345293c-7639-4637-a551-c5c04e401955", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push", + "service": "ACR", "services": [ - "AzurePolicy", + "ACR", + "AKV", "WAF" ], - "severity": "Medium", - "text": "For Sovereign Landing Zone, sovereign Control objectives to policy mapping' is documented.", + "severity": "High", + "text": "Sign and Verify containers with notation (Notary v2)", "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", - "service": "Policy", + "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.", + "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49", + "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys", + "service": "ACR", "services": [ - "AzurePolicy", + "ACR", + "AKV", "WAF" ], "severity": "Medium", - "text": "For Sovereign Landing Zone, process is in place for CRUD of 'Sovereign Control objectives to policy mapping'.", + "text": "Encrypt registry with a customer managed key", "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications", + "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", + "service": "ACR", "services": [ - "RBAC", - "Monitor", - "AzurePolicy", + "ACR", "Entra", + "RBAC", "WAF" ], - "severity": "Medium", - "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.", - "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "waf": "Operations" + "severity": "High", + "text": "Use Managed Identities to connect instead of Service Principals", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Monitor", + "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead", + "guid": "be0e38ce-e297-411b-b363-caaab79b198d", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", + "service": "ACR", "services": [ - "AzurePolicy", - "ARS", - "Storage", + "RBAC", "WAF" ], - "severity": "Medium", - "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Operations" + "severity": "High", + "text": "Disable local authentication for management plane access", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", - "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", - "service": "VM", + "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations", + "guid": "387e5ced-126c-4d13-8af5-b20c6998a646", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli", + "service": "ACR", "services": [ - "AzurePolicy", - "VM", - "Monitor", + "ACR", + "Entra", + "RBAC", "WAF" ], - "severity": "Medium", - "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Operations" + "severity": "High", + "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", + "description": "Disable anonymous pull/push access", + "guid": "e338997e-41c7-47d7-acf6-a62a1194956d", + "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access", + "service": "ACR", "services": [ - "VM", "WAF" ], "severity": "Medium", - "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "Operations" + "text": "Disable Anonymous pull access", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", + "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token", + "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli", + "service": "ACR", "services": [ - "VM", + "Entra", "WAF" ], - "severity": "Medium", - "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in outside of Azure using Azure Arc.", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "Operations" + "severity": "High", + "text": "Disable repository-scoped access tokens", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "90483845-c986-4cb2-a131-56a12476e49f", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Network Watcher", + "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network", + "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee", + "service": "ACR", "services": [ - "Monitor", - "NetworkWatcher", + "EventHubs", + "PrivateLink", + "ACR", "WAF" ], - "severity": "Medium", - "text": "Use Network Watcher to proactively monitor traffic flows", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "Operations" + "severity": "High", + "text": "Deploy images from a trusted environment", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Monitor", + "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR", + "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy", + "service": "ACR", "services": [ - "Monitor", + "Entra", + "ACR", + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "Use Azure Monitor Logs for insights and reporting.", - "waf": "Operations" + "text": "Disable Azure ARM audience tokens for authentication", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "97be9951-9048-4384-9c98-6cb2913156a1", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", - "service": "Monitor", + "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.", + "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6", + "link": "https://learn.microsoft.com/azure/container-registry/monitor-service", + "service": "ACR", "services": [ "Monitor", + "Entra", + "ACR", "WAF" ], "severity": "Medium", - "text": "Use Azure Monitor alerts for the generation of operational alerts.", - "waf": "Operations" + "text": "Enable diagnostics logging", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "Monitor", + "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch", + "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", + "service": "ACR", "services": [ - "Monitor", - "WAF" + "VNet", + "PrivateLink", + "WAF", + "Firewall" ], "severity": "Medium", - "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.", - "waf": "Operations" + "text": "Control inbound network access with Private Link", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Backup", + "description": "Disable public network access if inbound network access is secured using Private Link", + "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access", + "service": "ACR", "services": [ - "Backup", + "PrivateLink", "WAF" ], "severity": "Medium", - "text": "When using Azure Backup, consider the different backup types (GRS, ZRS & LRS) as the default setting is GRS", - "waf": "Reliability" + "text": "Disable Public Network access", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "VM", + "description": "Only the ACR Premium SKU supports Private Link access", + "guid": "fc833934-8b26-42d6-ac5f-512925498f6d", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus", + "service": "ACR", "services": [ - "AzurePolicy", - "VM", + "PrivateLink", + "ACR", "WAF" ], "severity": "Medium", - "text": "Use Azure policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.", + "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)", "waf": "Security" }, { "checklist": "WAF checklist", - "description": "Azure Policy's guest configuration features can audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.", - "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "VM", + "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities", + "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", + "service": "ACR", "services": [ - "AzurePolicy", - "VM", - "Monitor", + "Defender", + "ACR", "WAF" ], - "severity": "Medium", - "text": "Monitor VM security configuration drift via Azure Policy.", + "severity": "Low", + "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities", "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", + "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", + "guid": "4451e1a2-d345-4293-a763-9637a551c5c0", + "service": "ACR", "services": [ - "ASR", - "VM", - "ACR", "WAF" ], "severity": "Medium", - "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.", - "waf": "Operations" + "text": "Deploy validated container images", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "Backup", + "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", + "guid": "4e401955-387e-45ce-b126-cd132af5b20c", + "service": "ACR", "services": [ - "Backup", "WAF" ], - "severity": "Medium", - "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.", - "waf": "Operations" + "severity": "High", + "text": "Use up-to-date platforms, languages, protocols and frameworks", + "waf": "Security" }, { - "ammp": true, "checklist": "WAF checklist", - "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", + "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", + "service": "Azure Data Factory", "services": [ - "VM", "WAF" ], - "severity": "High", - "text": "Leverage Availability Zones for your VMs in regions where they are supported.", + "severity": "Medium", + "text": "Leverage FTA Resiliency Playbook for Azure Data Factory", "waf": "Reliability" }, { - "ammp": true, "checklist": "WAF checklist", - "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", + "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "services": [ - "VM", "WAF" ], "severity": "High", - "text": "Avoid running a production workload on a single VM.", + "text": "Use zone redundant pipelines in regions that support Availability Zones", "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "84101f59-1941-4195-a270-e28034290e3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", + "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", + "link": "https://learn.microsoft.com/azure/data-factory/source-control", + "service": "Azure Data Factory", "services": [ - "AppGW", - "LoadBalancer", - "ACR", + "Backup", "WAF" ], "severity": "Medium", - "text": "Azure Load Balancer and Application Gateway distribute incoming network traffic across multiple resources.", + "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ", "waf": "Reliability" }, { - "ammp": true, "checklist": "WAF checklist", - "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "WAF", + "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "services": [ - "FrontDoor", - "AppGW", + "VM", "WAF" ], - "severity": "High", - "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.", - "waf": "Operations" + "severity": "Medium", + "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "7f408960-c626-44cb-a018-347c8d790cdf", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "WAF", + "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "services": [ - "FrontDoor", - "Sentinel", - "AppGW", + "VNet", "WAF" ], "severity": "Medium", - "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.", - "waf": "Operations" + "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region", + "waf": "Reliability" }, { - "ammp": true, "checklist": "WAF checklist", - "guid": "5017f154-e3ab-4369-9829-e7e316183687", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "Key Vault", + "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you", + "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Azure Data Factory", "services": [ "AKV", "WAF" ], - "severity": "High", - "text": "Use Azure Key Vault to store your secrets and credentials", - "waf": "Security" + "severity": "Low", + "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", - "guid": "a0477a20-9945-4bda-9333-4f2491163418", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", - "service": "Key Vault", + "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage", + "guid": "ba7da7be-9951-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export", + "service": "Azure Data Explorer", "services": [ - "AKV", + "Storage", + "Cost", "WAF" ], - "severity": "Medium", - "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.", - "waf": "Security" + "text": "Leverage External Tables and Continuous data export overview to reduce costs", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.", + "guid": "56a22586-f490-4641-addd-ea8a377cdeb3", + "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp", + "service": "Azure Data Explorer", "services": [ - "AzurePolicy", - "AKV", + "Storage", "WAF" ], - "severity": "Medium", - "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", - "waf": "Security" + "text": "To share data, explore Leader-follower cluster configuration", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "dc055bcf-619e-48a1-9f98-879525d62688", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.", + "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters", + "service": "Azure Data Explorer", "services": [ - "Entra", - "AKV", - "RBAC", + "ASR", "WAF" ], - "severity": "Medium", - "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.", - "waf": "Security" + "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "guid": "436b0635-cb45-4e57-a603-324ace8cc123", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities", + "service": "Azure Data Explorer", "services": [ + "Storage", + "RBAC", "WAF" ], - "severity": "Medium", - "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.", - "waf": "Security" + "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "913156a1-2476-4e49-b541-acdce979377b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "guid": "18ca6017-0265-4f4b-a46a-393af7f31728", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution", + "service": "Azure Data Explorer", "services": [ "WAF" ], - "severity": "Medium", - "text": "Establish an automated process for key and certificate rotation.", - "waf": "Security" + "text": "Ingest data into each cluster in parallel", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.", + "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration", + "service": "Azure Data Explorer", "services": [ - "PrivateLink", - "AKV", - "VNet", + "ACR", "WAF" ], - "severity": "Medium", - "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.", - "waf": "Security" + "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", - "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", - "service": "Key Vault", + "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.", + "guid": "563a4dc7-4a74-48b6-922a-d190916a6649", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration", + "service": "Azure Data Explorer", "services": [ - "Entra", - "AKV", - "Monitor", + "ACR", "WAF" ], - "severity": "Medium", - "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.", - "waf": "Security" + "text": "For critical applications, create Active-Active configuration in two paired regions", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.", + "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration", + "service": "Azure Data Explorer", "services": [ - "AzurePolicy", - "AKV", "WAF" ], - "severity": "Medium", - "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.", - "waf": "Security" + "text": "For applications, which required only read during failure, create Active-Hot standby configuration", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "91163418-2ba5-4275-8694-4008be7d7e48", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.", + "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration", + "service": "Azure Data Explorer", "services": [ - "AKV", - "WAF" + "Storage", + "Cost", + "WAF", + "ASR", + "AzurePolicy" ], - "severity": "Medium", - "text": "Use an Azure Key Vault per application per environment per region.", - "waf": "Security" + "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "25d62688-6d70-4ba6-a97b-e99519048384", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.", + "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757", + "link": "https://learn.microsoft.com/azure/data-explorer/devops", + "service": "Azure Data Explorer", "services": [ - "ASR", - "AKV", - "ACR", + "AzurePolicy", "WAF" ], - "severity": "Medium", - "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.", - "waf": "Security" + "text": "Wrap DevOps and source control around all your code", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", - "link": "https://learn.microsoft.com/industry/sovereignty/key-management", - "service": "Key Vault", + "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780", + "link": "https://learn.microsoft.com/azure/data-explorer/devops", + "service": "Azure Data Explorer", "services": [ - "AKV", "WAF" ], - "severity": "Medium", - "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.", - "waf": "Security" + "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.", + "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", - "service": "Entra", + "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18", + "link": "https://learn.microsoft.com/azure/data-explorer/devops", + "service": "Azure Data Explorer", "services": [ - "Entra", "WAF" ], - "severity": "Medium", - "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.", - "waf": "Security" + "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "waf": "Reliability" }, { - "ammp": true, + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "09945bda-4333-44f2-9911-634182ba5275", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", - "service": "Defender", + "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", + "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", + "service": "AKS", "services": [ - "Defender", - "Subscriptions", + "AKS", "WAF" ], - "severity": "High", - "text": "Enable Defender Cloud Security Posture Management for all subscriptions.", - "waf": "Security" + "severity": "Low", + "text": "If required for AKS Windows workloads HostProcess containers can be used", + "waf": "Reliability" }, { - "ammp": true, + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", - "service": "Defender", + "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", + "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", + "service": "AKS", "services": [ - "Defender", - "Subscriptions", "WAF" ], - "severity": "High", - "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.", - "waf": "Security" + "severity": "Low", + "text": "Use KEDA if running event-driven workloads", + "waf": "Performance" }, { - "ammp": true, + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", - "service": "Defender", + "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", + "link": "https://dapr.io/", + "service": "AKS", "services": [ - "Defender", - "Subscriptions", "WAF" ], - "severity": "High", - "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.", - "waf": "Security" + "severity": "Low", + "text": "Use Dapr to ease microservice development", + "waf": "Operations" }, { - "ammp": true, + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", - "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", - "service": "VM", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", + "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", + "link": "https://learn.microsoft.com/azure/aks/uptime-sla", + "service": "AKS", "services": [ + "AKS", "WAF" ], "severity": "High", - "text": "Enable Endpoint Protection on IaaS Servers.", - "waf": "Security" + "text": "Use the SLA-backed AKS offering", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", - "link": "https://learn.microsoft.com/azure/security-center/", - "service": "VM", + "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "services": [ - "Defender", - "Monitor", + "Cost", "WAF" ], - "severity": "Medium", - "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.", - "waf": "Security" + "severity": "Low", + "text": "Use Disruption Budgets in your pod and deployment definitions", + "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "guid": "3c763963-7a55-42d5-a15e-401955387e5c", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", + "service": "ACR", "services": [ - "Entra", - "Monitor", + "ACR", "WAF" ], - "severity": "Medium", - "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.", - "waf": "Security" + "severity": "High", + "text": "If using a private registry, configure region replication to store images in multiple regions", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", - "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", - "service": "Entra", + "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", + "service": "AKS", "services": [ - "Entra", + "Cost", "WAF" ], - "severity": "Medium", - "text": "For Sovereign Landing Zone, transparancy logs is enabled on the Entra ID tenant.", - "waf": "Security" + "severity": "Low", + "text": "Use an external application such as kubecost to allocate costs to different users", + "waf": "Cost" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", - "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", - "service": "Entra", + "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", + "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", + "service": "AKS", "services": [ - "Entra", "WAF" ], - "severity": "Medium", - "text": "For Sovereign Landing Zone, customer Lockbox is enabled on the Entra ID tenant.", - "waf": "Security" + "severity": "Low", + "text": "Use scale down mode to delete/deallocate nodes", + "waf": "Cost" }, { - "ammp": true, + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Storage", + "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", + "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", + "service": "AKS", "services": [ - "Storage", + "AKS", "WAF" ], - "severity": "High", - "text": "Secure transfer to storage accounts should be enabled", - "waf": "Security" + "severity": "Medium", + "text": "When required use multi-instance partitioning GPU on AKS Clusters", + "waf": "Cost" }, { - "ammp": true, + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", - "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", - "service": "Storage", + "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", + "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", + "service": "AKS", "services": [ - "Storage", "WAF" ], - "severity": "High", - "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.", - "waf": "Security" + "severity": "Low", + "text": "If running a Dev/Test cluster use NodePool Start/Stop", + "waf": "Cost" }, { - "ammp": true, + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", - "service": "Key Vault", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", + "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", + "service": "AKS", "services": [ - "VM", - "AKV", + "AKS", + "AzurePolicy", "WAF" ], - "severity": "High", - "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.", - "waf": "Operations" + "severity": "Medium", + "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", - "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", - "service": "Spring Apps", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", + "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "services": [ "WAF" ], "severity": "Medium", - "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions", - "waf": "Reliability" + "text": "Separate applications from the control plane with user/system node pools", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", - "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", - "service": "Spring Apps", + "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "services": [ - "FrontDoor", - "TrafficManager", "WAF" ], - "severity": "Medium", - "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", - "waf": "Reliability" + "severity": "Low", + "text": "Add taint to your system nodepool to make it dedicated", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", - "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", - "service": "Spring Apps", + "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", + "link": "https://learn.microsoft.com/azure/container-registry/", + "service": "AKS", "services": [ "ACR", "WAF" ], "severity": "Medium", - "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", - "waf": "Reliability" + "text": "Use a private registry for your images, such as ACR", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", - "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", - "service": "Spring Apps", + "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", + "link": "https://learn.microsoft.com/azure/security-center/container-security", + "service": "ACR", "services": [ "WAF" ], "severity": "Medium", - "text": "Use more than 1 app instance for your apps", - "waf": "Reliability" + "text": "Scan your images for vulnerabilities", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "7504c230-6035-4183-95a5-85762acc6075", - "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", - "service": "Spring Apps", + "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", + "service": "AKS", "services": [ - "Monitor", "WAF" ], - "severity": "Medium", - "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", - "waf": "Reliability" + "severity": "High", + "text": "Define app separation requirements (namespace/nodepool/cluster)", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", - "service": "Spring Apps", + "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", + "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", + "service": "AKS", "services": [ + "AKV", "WAF" ], "severity": "Medium", - "text": "Set up autoscaling in Spring Cloud Gateway", - "waf": "Reliability" + "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "97411607-b6fd-4335-99d1-9885faf4e392", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", - "service": "Spring Apps", + "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", + "link": "https://learn.microsoft.com/azure/aks/update-credentials", + "service": "AKS", "services": [ "WAF" ], - "severity": "Low", - "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.", - "waf": "Reliability" + "severity": "High", + "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", - "link": "https://learn.microsoft.com/azure/spring-apps/overview", - "service": "Spring Apps", + "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", + "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", + "service": "AKS", "services": [ "WAF" ], "severity": "Medium", - "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.", - "waf": "Reliability" + "text": "If required add Key Management Service etcd encryption", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", - "service": "AVS", + "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", + "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", + "service": "AKS", "services": [ - "Entra", - "Subscriptions", + "AKS", "WAF" ], - "severity": "High", - "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure", + "severity": "Low", + "text": "If required consider using Confidential Compute for AKS", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "75089c20-990d-4927-b105-885576f76fc2", - "service": "AVS", + "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", + "service": "AKS", "services": [ - "AVS", + "Defender", "WAF" ], "severity": "Medium", - "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure", + "text": "Consider using Defender for Containers", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", + "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", + "service": "AKS", "services": [ + "Entra", "WAF" ], "severity": "High", - "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'", + "text": "Use managed identities instead of Service Principals", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", + "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", + "link": "https://learn.microsoft.com/azure/aks/managed-aad", + "service": "AKS", "services": [ + "Entra", "WAF" ], "severity": "Medium", - "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)", + "text": "Integrate authentication with AAD (using the managed integration)", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", - "service": "AVS", + "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", + "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", + "service": "AKS", "services": [ "WAF" ], "severity": "Medium", - "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)", + "text": "Limit access to admin kubeconfig (get-credentials --admin)", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", - "service": "AVS", + "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", + "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", + "service": "AKS", "services": [ "Entra", + "RBAC", "WAF" ], - "severity": "High", - "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)", + "severity": "Medium", + "text": "Integrate authorization with AAD RBAC", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", - "service": "AVS", + "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", + "service": "AKS", "services": [ "RBAC", - "AVS", + "AKS", + "WAF" + ], + "severity": "High", + "text": "Use namespaces for restricting RBAC privilege in Kubernetes", + "waf": "Security" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "WAF checklist", + "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", + "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", + "service": "AKS", + "services": [ + "Entra", "WAF" ], "severity": "Medium", - "text": "Has an RBAC model been created for use within VMware vSphere", + "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", - "service": "AVS", + "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", + "service": "AKS", "services": [ - "RBAC", + "AKS", "WAF" ], "severity": "Medium", - "text": "RBAC permissions should be granted on ADDS groups and not on specific users", + "text": "For AKS non-interactive logins use kubelogin (preview)", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", + "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", + "service": "AKS", "services": [ - "RBAC", - "AVS", + "AKS", "WAF" ], - "severity": "High", - "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only", + "severity": "Medium", + "text": "Disable AKS local accounts", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", - "service": "AVS", + "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", + "service": "AKS", "services": [ - "RBAC", "WAF" ], - "severity": "High", - "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations", + "severity": "Low", + "text": "Configure if required Just-in-time cluster access", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", - "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", - "service": "AVS", + "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", + "service": "AKS", "services": [ - "AVS", + "Entra", + "AKS", "WAF" ], - "severity": "High", - "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand", - "waf": "Performance" + "severity": "Low", + "text": "Configure if required AAD conditional access for AKS", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", - "service": "AVS", + "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", + "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", + "service": "AKS", "services": [ - "Monitor", - "ExpressRoute", - "NetworkWatcher", - "VPN", + "AKS", "WAF" ], - "severity": "High", - "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'", - "waf": "Operations" + "severity": "Low", + "text": "If required for Windows AKS workloads configure gMSA ", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", - "service": "AVS", + "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", + "service": "AKS", "services": [ - "Monitor", - "ExpressRoute", - "NetworkWatcher", - "AVS", - "VM", + "Entra", "WAF" ], "severity": "Medium", - "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection", - "waf": "Operations" + "text": "For finer control consider using a managed Kubelet Identity", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", - "service": "AVS", + "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", + "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", + "service": "AKS", "services": [ - "Monitor", - "NetworkWatcher", - "AVS", - "VM", - "WAF" + "ACR", + "WAF", + "AppGW" ], "severity": "Medium", - "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity", - "waf": "Operations" + "text": "If using AGIC, do not share an AppGW across clusters", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", + "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", + "link": "https://learn.microsoft.com/azure/aks/http-application-routing", + "service": "AKS", "services": [ - "ARS", + "AKS", "WAF" ], "severity": "High", - "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).", - "waf": "Operations" + "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", - "service": "AVS", + "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", + "service": "AKS", "services": [ - "Entra", - "AVS", - "RBAC", "WAF" ], - "severity": "High", - "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)", - "waf": "Security" + "severity": "Medium", + "text": "For Windows workloads use Accelerated Networking", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", + "guid": "ba7da7be-9952-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "services": [ - "Entra", - "AVS", - "RBAC", + "LoadBalancer", "WAF" ], "severity": "High", - "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles", - "waf": "Security" + "text": "Use the standard ALB (as opposed to the basic one)", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", - "service": "AVS", + "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", + "service": "AKS", "services": [ - "Entra", - "AVS", + "VNet", "WAF" ], "severity": "Medium", - "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)", + "text": "If using Azure CNI, consider using different Subnets for NodePools", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", - "service": "AVS", + "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", + "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", + "service": "AKS", "services": [ + "VNet", + "PrivateLink", "WAF" ], - "severity": "High", - "text": "Limit use of CloudAdmin account to emergency access only", + "severity": "Medium", + "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", + "guid": "a0f61565-9de5-458f-a372-49c831112dbd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "services": [ - "RBAC", "WAF" ], - "severity": "Medium", - "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter", - "waf": "Security" + "severity": "High", + "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", - "service": "AVS", + "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ + "VNet", "WAF" ], - "severity": "Medium", - "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials", - "waf": "Security" + "severity": "High", + "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", - "service": "AVS", + "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "Entra", - "AVS", - "VM", "WAF" ], "severity": "High", - "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution", - "waf": "Security" + "text": "If using Azure CNI, check the maximum pods/node (default 30)", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", - "service": "AVS", + "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .", + "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", + "link": "https://learn.microsoft.com/azure/aks/internal-lb", + "service": "AKS", "services": [ + "VNet", + "AKS", "WAF" ], - "severity": "Medium", - "text": "Is East-West traffic filtering implemented within NSX-T", + "severity": "Low", + "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", - "service": "AVS", + "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "Firewall", - "AVS", - "AppGW", "WAF" ], "severity": "High", - "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions", - "waf": "Security" + "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", - "service": "AVS", + "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", + "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", + "service": "AKS", "services": [ - "AVS", "WAF" ], - "severity": "High", - "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads", + "severity": "Low", + "text": "If required add your own CNI plugin", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", - "service": "AVS", + "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", + "service": "AKS", "services": [ - "AVS", - "Monitor", + "AKS", "WAF" ], - "severity": "Medium", - "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity", - "waf": "Security" + "severity": "Low", + "text": "If required configure Public IP per node in AKS", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "334fdf91-c234-4182-a652-75269440b4be", - "service": "AVS", + "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", + "link": "https://learn.microsoft.com/azure/aks/concepts-network", + "service": "AKS", "services": [ - "VNet", - "ExpressRoute", - "VPN", - "DDoS", "WAF" ], "severity": "Medium", - "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure", - "waf": "Security" + "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", - "service": "AVS", + "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", + "link": "https://learn.microsoft.com/azure/aks/nat-gateway", + "service": "AKS", "services": [ - "AVS", "WAF" ], - "severity": "Medium", - "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager", - "waf": "Security" + "severity": "Low", + "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", - "service": "AVS", + "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", + "service": "AKS", "services": [ - "Defender", - "AVS", "WAF" ], "severity": "Medium", - "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution", - "waf": "Security" + "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion", + "waf": "Reliability" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", + "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", + "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", + "service": "AKS", "services": [ - "Arc", - "AVS", + "NVA", "WAF" ], - "severity": "Medium", - "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)", + "severity": "High", + "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", + "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", + "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", + "service": "AKS", "services": [ - "AVS", - "SQL", "WAF" ], - "severity": "Low", - "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)", + "severity": "Medium", + "text": "If using a public API endpoint, restrict the IP addresses that can access it", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "a3592718-e6e2-4051-9267-6ae46691e883", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", + "link": "https://learn.microsoft.com/azure/aks/private-clusters", + "service": "AKS", "services": [ - "AKV", "WAF" ], - "severity": "Low", - "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible", + "severity": "High", + "text": "Use private clusters if your requirements mandate it", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "5ac94222-3e13-4810-9230-81a941741583", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "services": [ - "AVS", + "AKS", + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)", + "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ", "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", + "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "services": [ + "AKS", + "AzurePolicy", "WAF" ], "severity": "High", - "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)", - "waf": "Reliability" + "text": "Enable a Kubernetes Network Policy option (Calico/Azure)", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "d88408f3-7273-44c8-96ba-280214590146", - "service": "AVS", + "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "services": [ + "AKS", "AzurePolicy", - "Storage", "WAF" ], "severity": "High", - "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs", - "waf": "Reliability" + "text": "Use Kubernetes network policies to increase intra-cluster security", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", - "service": "AVS", + "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "services": [ - "ASR", "WAF" ], "severity": "High", - "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement", - "waf": "Reliability" + "text": "Use a WAF for web workloads (UIs or APIs)", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", - "service": "AVS", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", + "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", + "service": "AKS", "services": [ + "DDoS", + "VNet", + "AKS", "WAF" ], "severity": "Medium", - "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.", - "waf": "Operations" + "text": "Use DDoS Standard in the AKS Virtual Network", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", - "service": "AVS", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", + "link": "https://learn.microsoft.com/azure/aks/http-proxy", + "service": "AKS", "services": [ - "AzurePolicy", "WAF" ], - "severity": "Medium", - "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes", - "waf": "Operations" + "severity": "Low", + "text": "If required add company HTTP Proxy", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", - "service": "AVS", + "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", + "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", + "service": "AKS", "services": [ - "Cost", - "AVS", "WAF" ], "severity": "Medium", - "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used", - "waf": "Cost" + "text": "Consider using a service mesh for advanced microservice communication management", + "waf": "Security" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", - "service": "AVS", + "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", + "service": "AKS", "services": [ - "Cost", - "AVS", + "Monitor", "WAF" ], - "severity": "Low", - "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution", - "waf": "Cost" + "severity": "High", + "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "6691e883-5ac9-4422-83e1-3810523081a9", - "service": "AVS", + "guid": "337453a3-cc63-4963-9a65-22ac19e80696", + "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", + "service": "AKS", "services": [ + "Entra", "WAF" ], - "severity": "Medium", - "text": "Consider the use of Azure Private-Link when using other Azure Native Services", - "waf": "Security" + "severity": "Low", + "text": "Check regularly Azure Advisor for recommendations on your cluster", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", - "service": "AVS", + "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", + "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", + "service": "AKS", "services": [ + "AKS", "WAF" ], - "severity": "High", - "text": "Ensure all required resource reside within the same Azure availability zone(s)", - "waf": "Performance" + "severity": "Low", + "text": "Enable AKS auto-certificate rotation", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", - "service": "AVS", + "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", + "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", + "service": "AKS", "services": [ - "Defender", - "AVS", - "VM", + "AKS", "WAF" ], - "severity": "Medium", - "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads", - "waf": "Security" + "severity": "High", + "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", - "service": "AVS", + "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", + "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", + "service": "AKS", "services": [ - "Arc", - "AVS", - "VM", "WAF" ], - "severity": "Medium", - "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads", - "waf": "Security" + "severity": "High", + "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", - "service": "AVS", + "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", + "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", + "service": "AKS", "services": [ - "AVS", "WAF" ], "severity": "High", - "text": "Enable Diagnostic and metric logging on Azure VMware Solution", + "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", - "service": "AVS", + "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", + "service": "AKS", "services": [ - "AVS", - "VM", - "Monitor", "WAF" ], - "severity": "Medium", - "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads", + "severity": "Low", + "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "589d457a-927c-4397-9d11-02cad6aae11e", - "service": "AVS", + "guid": "d7672c26-7602-4482-85a4-14527fbe855c", + "link": "https://learn.microsoft.com/azure/aks/command-invoke", + "service": "AKS", "services": [ - "Backup", - "AzurePolicy", - "AVS", - "VM", + "AKS", "WAF" ], - "severity": "Medium", - "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads", + "severity": "Low", + "text": "Consider using AKS command invoke on private clusters", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "ee29711b-d352-4caa-ab79-b198dab81932", - "service": "AVS", + "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", + "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", + "service": "AKS", "services": [ - "Defender", - "AVS", - "Monitor", "WAF" ], - "severity": "Medium", - "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution", - "waf": "Security" + "severity": "Low", + "text": "For planned events consider using Node Auto Drain", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", - "service": "AVS", + "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", + "link": "https://learn.microsoft.com/azure/aks/faq", + "service": "AKS", "services": [ - "Defender", "WAF" ], - "severity": "Medium", - "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud", - "waf": "Security" + "severity": "High", + "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", + "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", "services": [ - "AVS", "WAF" ], - "severity": "High", - "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment", - "waf": "Security" + "severity": "Low", + "text": "Use custom Node RG (aka 'Infra RG') name", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", - "service": "AVS", + "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", + "link": "https://kubernetes.io/docs/setup/release/notes/", + "service": "AKS", "services": [ + "AKS", "WAF" ], - "severity": "High", - "text": "Are data processing implications (service provider / service consumer model) clear and documented", - "waf": "Security" + "severity": "Medium", + "text": "Do not use deprecated Kubernetes APIs in your YAML manifests", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "547c1747-dc56-4068-a714-435cd19dd244", - "service": "AVS", + "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", + "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", + "service": "AKS", "services": [ "WAF" ], - "severity": "Medium", - "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).", - "waf": "Security" + "severity": "Low", + "text": "Taint Windows nodes", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", - "service": "AVS", + "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", + "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", + "service": "AKS", "services": [ - "AVS", - "Monitor", "WAF" ], - "severity": "High", - "text": "Create dashboards to enable core Azure VMware Solution monitoring insights", + "severity": "Low", + "text": "Keep windows containers patch level in sync with host patch level", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", - "service": "AVS", + "description": "Via Diagnostic Settings at the cluster level", + "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", + "link": "https://learn.microsoft.com/azure/aks/monitor-aks", + "service": "AKS", "services": [ - "AVS", "Monitor", "WAF" ], - "severity": "High", - "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", + "severity": "Low", + "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "9659e396-80e7-4828-ac93-5657d02bff45", - "service": "AVS", + "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", + "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", + "service": "AKS", "services": [ - "AVS", - "Monitor", "WAF" ], - "severity": "High", - "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware", - "waf": "Operations" + "severity": "Low", + "text": "If required use nodePool snapshots", + "waf": "Cost" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", - "service": "AVS", + "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", + "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", + "service": "AKS", "services": [ - "Monitor", "WAF" ], - "severity": "High", - "text": "Ensure alerts are configured for Azure Service Health alerts and notifications", + "severity": "Low", + "text": "Consider spot node pools for non time-sensitive workloads", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", + "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "services": [ - "AVS", - "Storage", + "AKS", "WAF" ], - "severity": "Medium", - "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing", + "severity": "Low", + "text": "Consider AKS virtual node for quick bursting", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", - "service": "AVS", + "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", "services": [ - "AVS", + "Monitor", "WAF" ], - "severity": "Low", - "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?", + "severity": "High", + "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", + "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", "services": [ - "AzurePolicy", - "VM", - "Storage", "WAF" ], "severity": "High", - "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning", + "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", - "service": "AVS", + "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", + "service": "AKS", "services": [ + "Monitor", "WAF" ], "severity": "Medium", - "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource", + "text": "Monitor CPU and memory utilization of the nodes", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", - "service": "AVS", + "guid": "1a4835ac-9422-423e-ae80-b123081a5417", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "Backup", - "Storage", + "Monitor", "WAF" ], "severity": "Medium", - "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore", + "text": "If using Azure CNI, monitor % of pod IPs consumed per node", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", - "service": "AVS", + "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady", + "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", + "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", + "service": "AKS", "services": [ - "Arc", - "AVS", - "WAF" + "Storage", + "EventHubs", + "ServiceBus", + "WAF", + "Monitor" ], "severity": "Medium", - "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)", + "text": "Monitor OS disk queue depth in nodes", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", - "service": "AVS", + "guid": "be209d39-fda4-4777-a424-d116785c2fa5", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "services": [ - "AVS", "Monitor", + "NVA", + "LoadBalancer", "WAF" ], "severity": "Medium", - "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor", + "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", - "service": "AVS", + "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", + "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", + "service": "AKS", "services": [ - "AVS", + "AKS", "WAF" ], "severity": "Medium", - "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management", + "text": "Subscribe to resource health notifications for your AKS cluster", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", - "service": "AVS", + "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "services": [ - "AzurePolicy", - "AVS", - "Monitor", "WAF" ], - "severity": "Medium", - "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions", + "severity": "High", + "text": "Configure requests and limits in your pod specs", "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", - "service": "AVS", + "guid": "769ef669-1a48-435a-a942-223ece80b123", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "services": [ - "Defender", - "AVS", "WAF" ], "severity": "Medium", - "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud", - "waf": "Security" + "text": "Enforce resource quotas for namespaces", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", - "service": "AVS", + "guid": "081a5417-4158-433e-a3ad-3c2de733165c", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "AKS", "services": [ - "Backup", + "Subscriptions", "WAF" ], - "severity": "Medium", - "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource", - "waf": "Reliability" + "severity": "High", + "text": "Ensure your subscription has enough quota to scale out your nodepools", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", - "service": "AVS", + "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65", + "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", + "service": "AKS", "services": [ "WAF" ], - "severity": "Medium", - "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]", - "waf": "Reliability" + "severity": "High", + "text": "Configure Liveness and Readiness probes for all deployments", + "waf": "Operations" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", + "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "services": [ - "ASR", "WAF" ], "severity": "Medium", - "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", - "waf": "Reliability" + "text": "Use the Cluster Autoscaler", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", + "guid": "831c2872-c693-4b39-a887-a561bada49bc", + "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", + "service": "AKS", "services": [ + "AKS", "WAF" ], - "severity": "High", - "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible", - "waf": "Reliability" + "severity": "Low", + "text": "Customize node configuration for AKS node pools", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "8255461e-2aee-4345-9aec-8339248b262d", - "service": "AVS", + "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "services": [ - "ASR", "WAF" ], "severity": "Medium", - "text": "Use the geopolitical region pair as the secondary disaster recovery environment", - "waf": "Reliability" + "text": "Use the Horizontal Pod Autoscaler when required", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", - "service": "AVS", + "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity", + "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", + "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", + "service": "AKS", "services": [ "WAF" ], "severity": "High", - "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions", - "waf": "Reliability" + "text": "Consider an appropriate node size, not too large or too small", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", - "service": "AVS", + "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", + "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", + "service": "AKS", "services": [ - "ExpressRoute", - "AVS", - "NVA", + "AKS", "WAF" ], - "severity": "Medium", - "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?", - "waf": "Reliability" + "severity": "Low", + "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", - "service": "AVS", + "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", + "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", + "service": "AKS", "services": [ - "Backup", + "AKS", "WAF" ], - "severity": "Medium", - "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]", - "waf": "Reliability" + "severity": "Low", + "text": "Consider subscribing to EventGrid Events for AKS automation", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", - "service": "AVS", + "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", + "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", + "service": "AKS", "services": [ - "Backup", - "AVS", + "AKS", "WAF" ], - "severity": "Medium", - "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud", - "waf": "Reliability" + "severity": "Low", + "text": "For long running operation on an AKS cluster consider event termination", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", - "service": "AVS", + "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", + "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", + "service": "AKS", "services": [ - "Backup", + "AKS", "WAF" ], - "severity": "Medium", - "text": "Deploy your backup solution outside of vSan, on Azure native components", - "waf": "Reliability" + "severity": "Low", + "text": "If required consider using Azure Dedicated Hosts for AKS nodes", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", - "service": "AVS", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", + "guid": "24367b33-6971-45b1-952b-eee0b9b588de", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", "services": [ - "AVS", "WAF" ], - "severity": "Low", - "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?", - "waf": "Reliability" + "severity": "High", + "text": "Use ephemeral OS disks", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", - "service": "AVS", + "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "AKS", "services": [ + "AKS", "WAF" ], - "severity": "Low", - "text": "For manual deployments, all configuration and deployments must be documented", - "waf": "Operations" + "severity": "High", + "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", - "service": "AVS", + "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", + "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", + "service": "AKS", "services": [ - "AVS", + "Storage", + "AKS", "WAF" ], "severity": "Low", - "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud", - "waf": "Operations" + "text": "For hyper performance storage option use Ultra Disks on AKS", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", - "service": "AVS", + "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "service": "AKS", "services": [ - "WAF" + "Storage", + "WAF", + "SQL" ], - "severity": "Low", - "text": "For automated deployments, deploy a minimal private cloud and scale as needed", - "waf": "Operations" + "severity": "Medium", + "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", - "service": "AVS", + "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", + "service": "AKS", "services": [ + "Storage", "WAF" ], - "severity": "Low", - "text": "For automated deployments, request or reserve quota prior to starting the deployment", - "waf": "Operations" + "severity": "Medium", + "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons", + "waf": "Performance" }, { + "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", - "service": "AVS", + "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", + "service": "AKS", "services": [ - "AzurePolicy", + "Storage", "WAF" ], - "severity": "Low", - "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance", - "waf": "Operations" + "severity": "Medium", + "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones", + "waf": "Performance" }, { "checklist": "WAF checklist", - "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", - "service": "AVS", + "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", + "service": "Entra", "services": [ - "AKV", + "Entra", "WAF" ], - "severity": "Low", - "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use", + "severity": "Medium", + "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.", "waf": "Operations" }, { "checklist": "WAF checklist", - "guid": "255461e2-aee3-4553-afc8-339248b262d6", - "service": "AVS", - "services": [ - "ExpressRoute", - "AVS", - "AKV", + "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Entra", + "services": [ + "Entra", "WAF" ], "severity": "Low", - "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute", + "text": "Ensure you have a Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants", "waf": "Operations" }, { "checklist": "WAF checklist", - "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", - "service": "AVS", + "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "Entra", "services": [ - "AVS", "WAF" ], "severity": "Low", - "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.", + "text": "Leverage Azure Lighthouse for Multi-Tenant Management", "waf": "Operations" }, { "checklist": "WAF checklist", - "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", - "service": "AVS", + "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Entra", "services": [ "WAF" ], - "severity": "Low", - "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs", - "waf": "Operations" + "severity": "Medium", + "text": "Ensure that Azure Lighthouse is used for administering the tenant by partner", + "waf": "Cost" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", - "service": "AVS", + "guid": "348ef254-c27d-442e-abba-c7571559ab91", + "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", + "service": "Entra", "services": [ - "AVS", + "ACR", + "RBAC", "Subscriptions", "WAF" ], - "severity": "Medium", - "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution", - "waf": "Performance" + "severity": "High", + "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Security" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", - "service": "AVS", + "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", + "service": "Entra", "services": [ - "AzurePolicy", - "Storage", "WAF" ], - "severity": "Medium", - "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action", - "waf": "Performance" + "severity": "High", + "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", - "service": "AVS", + "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "Entra", "services": [ + "Entra", "WAF" ], "severity": "Medium", - "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)", - "waf": "Performance" + "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", - "service": "AVS", + "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", + "service": "Entra", "services": [ + "Entra", + "AzurePolicy", "WAF" ], - "severity": "Medium", - "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", - "waf": "Performance" + "severity": "Low", + "text": "Enforce Microsoft Entra ID conditional-access policies for any user with rights to Azure environments", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "Security" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", - "service": "AVS", + "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", + "service": "Entra", "services": [ "WAF" ], - "severity": "Medium", - "text": "Define and enforce scale in/out maximum limits for your environment in the automations", - "waf": "Performance" + "severity": "High", + "text": "Enforce multi-factor authentication for any user with rights to the Azure environments", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", - "service": "AVS", + "guid": "14658d35-58fd-4772-99b8-21112df27ee4", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "Entra", "services": [ - "Monitor", + "Entra", "WAF" ], "severity": "Medium", - "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses", - "waf": "Operations" + "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", + "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "Entra", "services": [ - "VM", + "Entra", "WAF" ], - "severity": "High", - "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "Reliability" + "severity": "Medium", + "text": "If planning to switch from Active Directory Domain Serivces to Entra domain services, evaluate the compatibility of all workloads", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", + "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", + "service": "Entra", "services": [ + "Entra", + "Monitor", "WAF" ], - "severity": "High", - "text": "When using MON, you cannot enable MON on more than 100 Network extensions", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Reliability" + "severity": "Medium", + "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.", + "waf": "Security" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", - "service": "AVS", + "guid": "984a859c-773e-47d2-9162-3a765a917e1f", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "service": "Entra", "services": [ - "VPN", "WAF" ], - "severity": "Medium", - "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.", - "waf": "Performance" + "severity": "High", + "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "e614658d-d457-4e92-9139-b821102cad6e", - "service": "AVS", + "guid": "35037e68-9349-4c15-b371-228514f4cdff", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "Entra", "services": [ + "Entra", + "RBAC", "WAF" ], "severity": "Medium", - "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance", - "waf": "Performance" + "text": "Avoid using on-premises synced accounts for Microsoft Entra ID role assignments.", + "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", - "service": "AVS", + "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Entra", "services": [ + "Entra", "WAF" ], "severity": "Medium", - "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)", - "waf": "Reliability" + "text": "Where required, use Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications (hosted in the cloud or on-premises).", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "AVS", + "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", + "service": "VNet", "services": [ - "AVS", - "VM", - "Storage", + "VNet", "WAF" ], "severity": "Medium", - "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.", - "waf": "Reliability" + "text": "Leverage a network design based on the traditional hub-and-spoke network topology for network scenarios that require maximum flexibility.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "AVS", + "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", + "service": "VNet", "services": [ + "VNet", + "Entra", + "DNS", "ExpressRoute", - "Storage", - "WAF" + "WAF", + "Firewall", + "VPN", + "NVA" ], - "severity": "Medium", - "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions", - "waf": "Reliability" + "severity": "High", + "text": "Ensure that shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS servers.", + "waf": "Cost" }, { "checklist": "WAF checklist", - "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "AVS", + "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "VNet", "services": [ - "ExpressRoute", - "Storage", + "DDoS", "WAF" ], "severity": "Medium", - "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions", - "waf": "Reliability" + "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "AVS", + "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "services": [ - "ASR", + "NVA", "WAF" ], - "severity": "High", - "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor", + "severity": "Medium", + "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance", "waf": "Reliability" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "AVS", + "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", + "service": "ExpressRoute", "services": [ + "VPN", + "ARS", + "ExpressRoute", "WAF" ], - "severity": "High", - "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements", - "waf": "Reliability" + "severity": "Low", + "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "AVS", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", + "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", + "service": "ARS", "services": [ - "ExpressRoute", + "VNet", + "ARS", "WAF" ], - "severity": "High", - "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.", - "waf": "Reliability" + "severity": "Low", + "text": "If using Route Server, use a /27 prefix for the Route Server subnet.", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "AVS", + "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", + "service": "VNet", "services": [ - "ExpressRoute", + "VNet", + "ACR", "WAF" ], - "severity": "High", - "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.", - "waf": "Reliability" + "severity": "Medium", + "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", + "waf": "Performance" }, { "checklist": "WAF checklist", - "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "AVS", + "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", + "service": "VNet", "services": [ + "Monitor", "WAF" ], - "severity": "High", - "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.", - "waf": "Reliability" + "severity": "Medium", + "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "waf": "Operations" }, { "checklist": "WAF checklist", - "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", + "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "services": [ - "Backup", - "AKV", + "VNet", + "Entra", + "ExpressRoute", "WAF" ], - "severity": "High", - "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.", + "severity": "Medium", + "text": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000)", "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Key Vault", + "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", + "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "services": [ - "AKV", - "ACR", + "Storage", "WAF" ], "severity": "Medium", - "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.", + "text": "Consider the limit of routes per route table (400).", "waf": "Reliability" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication", - "service": "Key Vault", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", + "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", + "service": "VNet", "services": [ - "AKV", + "VNet", "WAF" ], - "severity": "Medium", - "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.", + "severity": "High", + "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings", "waf": "Reliability" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions", - "service": "Key Vault", + "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", + "service": "ExpressRoute", "services": [ - "AzurePolicy", - "AKV", + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.", - "waf": "Reliability" + "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.", + "waf": "Security" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509", - "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations", - "service": "Key Vault", + "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", "services": [ - "Backup", - "Subscriptions", - "AKV", - "Storage", + "VPN", + "ExpressRoute", "WAF" ], - "severity": "Medium", - "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.", - "waf": "Reliability" + "severity": "Low", + "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "Key Vault", + "guid": "558fd772-49b8-4211-82df-27ee412e7f98", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "ExpressRoute", "services": [ - "AKV", + "ACR", "WAF" ], "severity": "High", - "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.", - "waf": "Reliability" + "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "Key Vault", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", + "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", "services": [ - "AKV", "WAF" ], "severity": "Low", - "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.", - "waf": "Reliability" + "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c", - "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", - "service": "Key Vault", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", + "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", "services": [ - "Backup", - "AKV", + "VNet", "WAF" ], - "severity": "Low", - "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.", - "waf": "Reliability" + "severity": "High", + "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16)", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Performance" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04", - "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", - "service": "Key Vault", + "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", + "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", + "service": "VNet", "services": [ - "Backup", - "AKV", "WAF" ], - "severity": "Low", - "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.", + "severity": "High", + "text": "Avoid using overlapping IP address ranges for production and DR sites.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection", - "service": "Key Vault", + "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", "services": [ - "EventHubs", - "AKV", + "DNS", "WAF" ], "severity": "Medium", - "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.", - "waf": "Reliability" + "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", - "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", - "service": "AKS", + "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", + "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", + "service": "DNS", "services": [ - "AKS", + "ACR", + "DNS", "WAF" ], - "severity": "Low", - "text": "If required for AKS Windows workloads HostProcess containers can be used", - "waf": "Reliability" + "severity": "Medium", + "text": "For environments where name resolution across Azure and on-premises is required, consider using Azure DNS Private Resolver.", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", - "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", - "service": "AKS", + "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", "services": [ + "DNS", "WAF" ], "severity": "Low", - "text": "Use KEDA if running event-driven workloads", - "waf": "Performance" + "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", - "link": "https://dapr.io/", - "service": "AKS", + "guid": "614658d3-558f-4d77-849b-821112df27ee", + "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", + "service": "DNS", "services": [ + "VNet", + "DNS", + "VM", "WAF" ], - "severity": "Low", - "text": "Use Dapr to ease microservice development", + "severity": "High", + "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", - "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", - "link": "https://learn.microsoft.com/azure/aks/uptime-sla", - "service": "AKS", + "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "service": "Bastion", "services": [ - "AKS", - "WAF" + "WAF", + "Bastion" ], - "severity": "High", - "text": "Use the SLA-backed AKS offering", - "waf": "Reliability" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", + "severity": "Medium", + "text": "Consider using Azure Bastion to securely connect to your network.", + "waf": "Security" + }, + { "checklist": "WAF checklist", - "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", + "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", + "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", + "service": "Bastion", "services": [ - "Cost", - "WAF" + "VNet", + "WAF", + "Bastion" ], - "severity": "Low", - "text": "Use Disruption Budgets in your pod and deployment definitions", - "waf": "Reliability" + "severity": "Medium", + "text": "Use Azure Bastion in a subnet /26 or larger.", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "3c763963-7a55-42d5-a15e-401955387e5c", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", - "service": "ACR", + "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "WAF", "services": [ + "FrontDoor", "ACR", + "AzurePolicy", "WAF" ], - "severity": "High", - "text": "If using a private registry, configure region replication to store images in multiple regions", - "waf": "Reliability" + "severity": "Medium", + "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", - "service": "AKS", + "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", "services": [ - "Cost", - "WAF" + "FrontDoor", + "AzurePolicy", + "WAF", + "AppGW" ], "severity": "Low", - "text": "Use an external application such as kubecost to allocate costs to different users", - "waf": "Cost" + "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", - "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", - "service": "AKS", + "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", "services": [ + "VNet", "WAF" ], - "severity": "Low", - "text": "Use scale down mode to delete/deallocate nodes", - "waf": "Cost" + "severity": "High", + "text": "Deploy WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", - "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", - "service": "AKS", + "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", "services": [ - "AKS", + "DDoS", + "VNet", "WAF" ], - "severity": "Medium", - "text": "When required use multi-instance partitioning GPU on AKS Clusters", - "waf": "Cost" + "severity": "High", + "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", - "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", - "service": "AKS", + "guid": "b034c01e-110b-463a-b36e-e3346e57f225", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "service": "VNet", "services": [ "WAF" ], - "severity": "Low", - "text": "If running a Dev/Test cluster use NodePool Start/Stop", - "waf": "Cost" + "severity": "High", + "text": "Assess and review network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", - "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", - "service": "AKS", + "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", "services": [ - "AKS", - "AzurePolicy", + "DDoS", "WAF" ], - "severity": "Medium", - "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", + "severity": "High", + "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", - "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", + "service": "ExpressRoute", "services": [ + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "Separate applications from the control plane with user/system node pools", - "waf": "Security" + "text": "Ensure that you have investigated the possibility to use ExpressRoute as primary connection to Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.", + "guid": "f29812b2-363c-4efe-879b-599de0d5973c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "services": [ + "ExpressRoute", "WAF" ], - "severity": "Low", - "text": "Add taint to your system nodepool to make it dedicated", - "waf": "Security" + "severity": "Medium", + "text": "When you use multiple ExpressRoute circuits, or multiple on-prem locations, make sure to optimize routing with BGP attributes, if certain paths are preferred.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", - "link": "https://learn.microsoft.com/azure/container-registry/", - "service": "AKS", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", + "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "services": [ - "ACR", + "VPN", + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "Use a private registry for your images, such as ACR", - "waf": "Security" + "text": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", - "link": "https://learn.microsoft.com/azure/security-center/container-security", - "service": "ACR", + "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", + "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", + "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", + "service": "ExpressRoute", "services": [ - "WAF" + "ExpressRoute", + "WAF", + "Cost" ], - "severity": "Medium", - "text": "Scan your images for vulnerabilities", - "waf": "Security" + "severity": "High", + "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.", + "waf": "Cost" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", + "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", + "service": "ExpressRoute", "services": [ - "WAF" + "ExpressRoute", + "WAF", + "Cost" ], "severity": "High", - "text": "Define app separation requirements (namespace/nodepool/cluster)", - "waf": "Security" + "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU.", + "waf": "Cost" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", - "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", - "service": "AKS", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", + "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", + "service": "ExpressRoute", "services": [ - "AKV", + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver", - "waf": "Security" + "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", - "link": "https://learn.microsoft.com/azure/aks/update-credentials", - "service": "AKS", + "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "service": "ExpressRoute", "services": [ + "ExpressRoute", "WAF" ], - "severity": "High", - "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)", - "waf": "Security" + "severity": "Medium", + "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", - "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", - "service": "AKS", + "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", + "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", + "service": "ExpressRoute", "services": [ + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "If required add Key Management Service etcd encryption", - "waf": "Security" + "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/vpnGateways", "checklist": "WAF checklist", - "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", - "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", + "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", + "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", + "service": "VPN", "services": [ - "AKS", + "VPN", "WAF" ], - "severity": "Low", - "text": "If required consider using Confidential Compute for AKS", - "waf": "Security" + "severity": "Medium", + "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/vpnGateways", "checklist": "WAF checklist", - "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", - "service": "AKS", + "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", + "service": "VPN", "services": [ - "Defender", + "VPN", "WAF" ], "severity": "Medium", - "text": "Consider using Defender for Containers", - "waf": "Security" + "text": "Use redundant VPN appliances on-premises (active/active or active/passive).", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", - "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", - "service": "AKS", + "guid": "718cb437-b060-2589-8856-2e93a5c6633b", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", "services": [ - "Entra", - "WAF" + "ExpressRoute", + "WAF", + "Cost" ], "severity": "High", - "text": "Use managed identities instead of Service Principals", - "waf": "Security" + "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Cost" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", - "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", - "link": "https://learn.microsoft.com/azure/aks/managed-aad", - "service": "AKS", + "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", + "service": "ExpressRoute", "services": [ - "Entra", + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "Integrate authentication with AAD (using the managed integration)", + "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", - "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", - "service": "AKS", + "guid": "b30e38c3-f298-412b-8363-cefe179b599d", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", + "service": "ExpressRoute", "services": [ + "Monitor", + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "Limit access to admin kubeconfig (get-credentials --admin)", - "waf": "Security" + "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", - "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", - "service": "AKS", + "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", + "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", + "service": "ExpressRoute", "services": [ - "Entra", - "RBAC", - "WAF" + "Monitor", + "ACR", + "WAF", + "NetworkWatcher" ], "severity": "Medium", - "text": "Integrate authorization with AAD RBAC", - "waf": "Security" + "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", + "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", + "service": "ExpressRoute", "services": [ - "AKS", - "RBAC", + "ExpressRoute", "WAF" ], - "severity": "High", - "text": "Use namespaces for restricting RBAC privilege in Kubernetes", - "waf": "Security" + "severity": "Medium", + "text": "Use ExpressRoute circuits from different peering locations for redundancy.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", - "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", - "service": "AKS", + "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", + "service": "ExpressRoute", "services": [ - "Entra", + "VPN", + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)", - "waf": "Security" + "text": "Use site-to-site VPN as failover of ExpressRoute, especially if only using a single ExpressRoute circuit.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", + "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", + "service": "ExpressRoute", "services": [ - "AKS", + "Storage", + "VNet", "WAF" ], - "severity": "Medium", - "text": "For AKS non-interactive logins use kubelogin (preview)", - "waf": "Security" + "severity": "High", + "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", - "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", - "service": "AKS", + "guid": "d581a947-69a2-4783-942e-9df3664324c8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", + "service": "ExpressRoute", "services": [ - "AKS", + "ACR", + "ExpressRoute", "WAF" ], - "severity": "Medium", - "text": "Disable AKS local accounts", - "waf": "Security" + "severity": "High", + "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", - "service": "AKS", + "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", + "service": "ExpressRoute", "services": [ + "ExpressRoute", "WAF" ], - "severity": "Low", - "text": "Configure if required Just-in-time cluster access", - "waf": "Security" + "severity": "Medium", + "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", - "service": "AKS", + "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", + "service": "ExpressRoute", "services": [ - "AKS", - "Entra", "WAF" ], - "severity": "Low", - "text": "Configure if required AAD conditional access for AKS", - "waf": "Security" + "severity": "Medium", + "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", - "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", - "service": "AKS", + "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "ExpressRoute", "services": [ - "AKS", + "ExpressRoute", "WAF" ], - "severity": "Low", - "text": "If required for Windows AKS workloads configure gMSA ", - "waf": "Security" + "severity": "High", + "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", - "service": "AKS", + "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", + "service": "ExpressRoute", "services": [ - "Entra", + "VNet", + "Monitor", + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "For finer control consider using a managed Kubelet Identity", - "waf": "Security" + "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", - "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", - "service": "AKS", + "guid": "5234c93f-b651-41dd-80c1-234177b91ced", + "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", + "service": "ExpressRoute", "services": [ - "AppGW", - "ACR", + "VNet", + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "If using AGIC, do not share an AppGW across clusters", - "waf": "Reliability" + "text": "Avoid using ExpressRoute circuits for VNet-to-VNet communication.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", - "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", - "link": "https://learn.microsoft.com/azure/aks/http-application-routing", - "service": "AKS", + "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "services": [ - "AKS", - "WAF" + "WAF", + "Firewall" ], "severity": "High", - "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.", - "waf": "Reliability" + "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", - "service": "AKS", + "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", "services": [ - "WAF" + "RBAC", + "WAF", + "Firewall", + "ACR", + "AzurePolicy" ], "severity": "Medium", - "text": "For Windows workloads use Accelerated Networking", - "waf": "Performance" + "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", - "guid": "ba7da7be-9952-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", + "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", + "service": "Firewall", "services": [ - "LoadBalancer", - "WAF" + "WAF", + "Firewall" ], - "severity": "High", - "text": "Use the standard ALB (as opposed to the basic one)", - "waf": "Reliability" + "severity": "Low", + "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", + "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", + "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", + "service": "Firewall", "services": [ - "VNet", - "WAF" + "DNS", + "WAF", + "Firewall" ], - "severity": "Medium", - "text": "If using Azure CNI, consider using different Subnets for NodePools", + "severity": "High", + "text": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules.", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", - "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", + "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", "services": [ - "PrivateLink", - "VNet", - "WAF" + "WAF", + "Firewall" ], - "severity": "Medium", - "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster", + "severity": "High", + "text": "Use Azure Firewall Premium for additional security and protection.", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", - "guid": "a0f61565-9de5-458f-a372-49c831112dbd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", + "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", "services": [ - "WAF" + "WAF", + "Firewall" ], "severity": "High", - "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)", - "waf": "Reliability" + "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", + "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", + "service": "Firewall", "services": [ - "VNet", - "WAF" + "WAF", + "Firewall" ], "severity": "High", - "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node", - "waf": "Performance" + "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", + "guid": "a3784907-9836-4271-aafc-93535f8ec08b", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "service": "Firewall", "services": [ - "WAF" + "Storage", + "VNet", + "VWAN", + "WAF", + "Firewall", + "NVA" ], "severity": "High", - "text": "If using Azure CNI, check the maximum pods/node (default 30)", - "waf": "Performance" + "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .", - "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", - "link": "https://learn.microsoft.com/azure/aks/internal-lb", - "service": "AKS", + "guid": "715d833d-4708-4527-90ac-1b142c7045ba", + "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", + "service": "Firewall", "services": [ - "AKS", - "VNet", - "WAF" + "Storage", + "WAF", + "Firewall" ], - "severity": "Low", - "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)", - "waf": "Security" + "severity": "Medium", + "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", + "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", + "service": "Firewall", "services": [ - "WAF" + "AzurePolicy", + "WAF", + "Firewall" ], - "severity": "High", - "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)", - "waf": "Reliability" + "severity": "Important", + "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", - "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", + "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", + "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", + "service": "Firewall", "services": [ - "WAF" + "VNet", + "WAF", + "Firewall" ], - "severity": "Low", - "text": "If required add your own CNI plugin", + "severity": "High", + "text": "Use a /26 prefix for your Azure Firewall subnets.", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", - "service": "AKS", + "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", + "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", + "service": "Firewall", "services": [ - "AKS", + "AzurePolicy", "WAF" ], - "severity": "Low", - "text": "If required configure Public IP per node in AKS", + "severity": "Medium", + "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use", "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", - "link": "https://learn.microsoft.com/azure/aks/concepts-network", - "service": "AKS", + "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", + "link": "https://learn.microsoft.com/azure/firewall/ip-groups", + "service": "Firewall", "services": [ + "Storage", "WAF" ], "severity": "Medium", - "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services", - "waf": "Reliability" + "text": "Use IP Groups or IP prefixes to reduce number of IP table rules", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", - "link": "https://learn.microsoft.com/azure/aks/nat-gateway", - "service": "AKS", + "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", + "service": "Firewall", "services": [ "WAF" ], - "severity": "Low", - "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic", - "waf": "Reliability" + "severity": "Medium", + "text": "Avoid wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", - "service": "AKS", + "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", + "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", + "service": "Firewall", "services": [ + "Monitor", "WAF" ], "severity": "Medium", - "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion", - "waf": "Reliability" + "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", - "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", - "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", - "service": "AKS", + "guid": "346840b8-1064-496e-8396-4b1340172d52", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", + "service": "Firewall", "services": [ - "NVA", "WAF" ], "severity": "High", - "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it", - "waf": "Security" + "text": "Enable TLS Inspection", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", - "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", - "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", - "service": "AKS", + "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", + "service": "Firewall", "services": [ + "ServiceBus", "WAF" ], - "severity": "Medium", - "text": "If using a public API endpoint, restrict the IP addresses that can access it", - "waf": "Security" + "severity": "Low", + "text": "Use web categories to allow or deny outbound access to specific topics.", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", - "link": "https://learn.microsoft.com/azure/aks/private-clusters", - "service": "AKS", + "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", + "service": "Firewall", "services": [ "WAF" ], - "severity": "High", - "text": "Use private clusters if your requirements mandate it", - "waf": "Security" + "severity": "Medium", + "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "service": "Firewall", "services": [ - "AKS", - "AzurePolicy", - "WAF" + "DNS", + "WAF", + "Firewall" ], "severity": "Medium", - "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ", + "text": "Enable Azure Firewall DNS proxy configuration ", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", - "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", + "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", + "service": "Firewall", "services": [ - "AKS", + "VM", "AzurePolicy", "WAF" ], - "severity": "High", - "text": "Enable a Kubernetes Network Policy option (Calico/Azure)", + "severity": "Medium", + "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "service": "Firewall", "services": [ - "AKS", - "AzurePolicy", + "Monitor", + "WAF", + "Firewall" + ], + "severity": "Low", + "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.", + "waf": "Operations" + }, + { + "checklist": "WAF checklist", + "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", + "services": [ + "Backup", "WAF" ], - "severity": "High", - "text": "Use Kubernetes network policies to increase intra-cluster security", - "waf": "Security" + "severity": "Low", + "text": "Implement backups for your firewall rules", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "App Gateway", "services": [ + "VNet", "WAF" ], "severity": "High", - "text": "Use a WAF for web workloads (UIs or APIs)", + "text": "Ensure that control-plane communication for Azure PaaS services injected into a virtual network is not broken, for example with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", - "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", - "service": "AKS", + "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "ExpressRoute", "services": [ - "AKS", - "VNet", - "DDoS", + "PrivateLink", + "ExpressRoute", "WAF" ], "severity": "Medium", - "text": "Use DDoS Standard in the AKS Virtual Network", + "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", - "link": "https://learn.microsoft.com/azure/aks/http-proxy", - "service": "AKS", + "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", + "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "VNet", "services": [ + "VNet", "WAF" ], - "severity": "Low", - "text": "If required add company HTTP Proxy", + "severity": "Medium", + "text": "Don't enable virtual network service endpoints by default on all subnets.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", - "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", - "service": "AKS", + "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "services": [ - "WAF" + "DNS", + "WAF", + "Firewall", + "NVA", + "PrivateLink" ], "severity": "Medium", - "text": "Consider using a service mesh for advanced microservice communication management", + "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "WAF checklist", - "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", + "service": "ExpressRoute", "services": [ - "Monitor", + "VPN", + "VNet", + "ExpressRoute", "WAF" ], "severity": "High", - "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", - "waf": "Operations" + "text": "Use at least a /27 prefix for your Gateway subnets", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "337453a3-cc63-4963-9a65-22ac19e80696", - "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", + "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", + "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", + "service": "NSG", "services": [ - "Entra", + "VNet", "WAF" ], - "severity": "Low", - "text": "Check regularly Azure Advisor for recommendations on your cluster", - "waf": "Operations" + "severity": "Medium", + "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", - "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", - "service": "AKS", + "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", + "service": "NSG", "services": [ - "AKS", + "VNet", + "ACR", "WAF" ], - "severity": "Low", - "text": "Enable AKS auto-certificate rotation", - "waf": "Operations" + "severity": "Medium", + "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", - "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", - "service": "AKS", + "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", + "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", + "service": "NSG", "services": [ - "AKS", + "VNet", + "VM", "WAF" ], - "severity": "High", - "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature", - "waf": "Operations" + "severity": "Medium", + "text": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", - "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", - "service": "AKS", + "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "services": [ + "VNet", + "Entra", + "NVA", "WAF" ], - "severity": "High", - "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade", - "waf": "Operations" + "severity": "Medium", + "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", - "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", - "service": "AKS", + "guid": "dfe237de-143b-416c-91d7-aa9b64704489", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "services": [ - "WAF" + "VNet", + "WAF", + "NetworkWatcher" ], - "severity": "High", - "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)", - "waf": "Operations" + "severity": "Medium", + "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", - "service": "AKS", + "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", + "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "NSG", "services": [ + "VNet", "WAF" ], - "severity": "Low", - "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters", - "waf": "Operations" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "WAF checklist", - "guid": "d7672c26-7602-4482-85a4-14527fbe855c", - "link": "https://learn.microsoft.com/azure/aks/command-invoke", - "service": "AKS", - "services": [ - "AKS", - "WAF" - ], - "severity": "Low", - "text": "Consider using AKS command invoke on private clusters", - "waf": "Operations" + "severity": "Medium", + "text": "Consider the limit of NSG rules per NSG (1000).", + "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", - "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", - "service": "AKS", + "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", + "service": "VWAN", "services": [ + "VWAN", "WAF" ], - "severity": "Low", - "text": "For planned events consider using Node Auto Drain", + "severity": "Medium", + "text": "Consider Virtual WAN for simplified Azure networking management, and make sure your scenario is explicitly described in the list of Virtual WAN routing designs", + "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", - "link": "https://learn.microsoft.com/azure/aks/faq", - "service": "AKS", + "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "services": [ + "ACR", + "VWAN", "WAF" ], - "severity": "High", - "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')", - "waf": "Operations" + "severity": "Medium", + "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", - "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "services": [ + "ACR", "WAF" ], "severity": "Low", - "text": "Use custom Node RG (aka 'Infra RG') name", - "waf": "Operations" + "text": "Follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", - "link": "https://kubernetes.io/docs/setup/release/notes/", - "service": "AKS", + "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", + "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "services": [ - "AKS", - "WAF" + "WAF", + "Firewall" ], "severity": "Medium", - "text": "Do not use deprecated Kubernetes APIs in your YAML manifests", - "waf": "Operations" + "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", - "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", - "service": "AKS", + "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "VWAN", "services": [ + "VWAN", "WAF" ], - "severity": "Low", - "text": "Taint Windows nodes", - "waf": "Operations" + "severity": "Medium", + "text": "Ensure that the network architecture is within the Azure Virtual WAN limits.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", - "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", - "service": "AKS", + "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", + "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", + "service": "VWAN", "services": [ + "Monitor", + "VWAN", "WAF" ], - "severity": "Low", - "text": "Keep windows containers patch level in sync with host patch level", + "severity": "Medium", + "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.", "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "description": "Via Diagnostic Settings at the cluster level", - "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", - "link": "https://learn.microsoft.com/azure/aks/monitor-aks", - "service": "AKS", + "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", + "service": "VWAN", "services": [ - "Monitor", + "VWAN", "WAF" ], - "severity": "Low", - "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution", - "waf": "Operations" + "severity": "Medium", + "text": "Make sure that your IaC deployments does not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", - "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", - "service": "AKS", + "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", + "service": "VWAN", "services": [ + "VPN", + "ExpressRoute", "WAF" ], - "severity": "Low", - "text": "If required use nodePool snapshots", - "waf": "Cost" + "severity": "Medium", + "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", - "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", - "service": "AKS", + "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", + "service": "VWAN", "services": [ + "VWAN", "WAF" ], - "severity": "Low", - "text": "Consider spot node pools for non time-sensitive workloads", - "waf": "Operations" + "severity": "Medium", + "text": "Make sure that your IaC deployments are configuring label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, + "arm-service": "microsoft.network/virtualWans", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", - "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "guid": "9c75dfef-573c-461c-a698-68598595581a", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", + "service": "VWAN", "services": [ - "AKS", "WAF" ], - "severity": "Low", - "text": "Consider AKS virtual node for quick bursting", - "waf": "Operations" + "severity": "High", + "text": "Assign enough IP space to virtual hubs, ideally a /23 prefix.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", + "ammp": true, "checklist": "WAF checklist", - "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", + "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "Monitor", + "AzurePolicy", "WAF" ], "severity": "High", - "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)", - "waf": "Operations" + "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", - "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", + "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ + "RBAC", + "AzurePolicy", "WAF" ], - "severity": "High", - "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)", - "waf": "Operations" + "severity": "Medium", + "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", - "service": "AKS", + "guid": "223ace8c-b123-408c-a501-7f154e3ab369", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "Monitor", + "Subscriptions", + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "Monitor CPU and memory utilization of the nodes", - "waf": "Operations" + "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "1a4835ac-9422-423e-ae80-b123081a5417", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "guid": "3829e7e3-1618-4368-9a04-77a209945bda", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "Monitor", + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "If using Azure CNI, monitor % of pod IPs consumed per node", - "waf": "Operations" + "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady", - "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", - "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", - "service": "AKS", + "guid": "43334f24-9116-4341-a2ba-527526944008", + "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", + "service": "Policy", "services": [ - "EventHubs", - "Monitor", - "ServiceBus", - "Storage", + "Subscriptions", + "AzurePolicy", "WAF" ], - "severity": "Medium", - "text": "Monitor OS disk queue depth in nodes", - "waf": "Operations" + "severity": "Low", + "text": "Use Azure Policy to control which services users can provision at the subscription/management group level", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "be209d39-fda4-4777-a424-d116785c2fa5", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ - "NVA", - "LoadBalancer", - "Monitor", + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports", - "waf": "Operations" + "text": "Use built-in policies where possible to minimize operational overhead.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", - "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", - "service": "AKS", + "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.", + "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", + "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", + "service": "Policy", "services": [ - "AKS", - "WAF" + "Entra", + "RBAC", + "Subscriptions", + "WAF", + "AzurePolicy" ], "severity": "Medium", - "text": "Subscribe to resource health notifications for your AKS cluster", - "waf": "Operations" + "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "guid": "19048384-5c98-46cb-8913-156a12476e49", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "services": [ + "Subscriptions", + "AzurePolicy", "WAF" ], - "severity": "High", - "text": "Configure requests and limits in your pod specs", - "waf": "Operations" + "severity": "Medium", + "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "769ef669-1a48-435a-a942-223ece80b123", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", + "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", + "service": "Policy", "services": [ + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "Enforce resource quotas for namespaces", - "waf": "Operations" + "text": "If any data sovereignty requirements exist, Azure Policies can be deployed to enforce them", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "081a5417-4158-433e-a3ad-3c2de733165c", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "AKS", + "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", + "service": "Policy", "services": [ - "Subscriptions", + "AzurePolicy", "WAF" ], - "severity": "High", - "text": "Ensure your subscription has enough quota to scale out your nodepools", - "waf": "Operations" + "severity": "Medium", + "text": "For Sovereign Landing Zone, sovereignty policy baseline' policy initiative is deployed and and assigned at correct MG level.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65", - "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", - "service": "AKS", + "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", + "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", + "service": "Policy", "services": [ + "AzurePolicy", "WAF" ], - "severity": "High", - "text": "Configure Liveness and Readiness probes for all deployments", - "waf": "Operations" + "severity": "Medium", + "text": "For Sovereign Landing Zone, sovereign Control objectives to policy mapping' is documented.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", - "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", + "service": "Policy", "services": [ + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "Use the Cluster Autoscaler", - "waf": "Performance" + "text": "For Sovereign Landing Zone, process is in place for CRUD of 'Sovereign Control objectives to policy mapping'.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", - "guid": "831c2872-c693-4b39-a887-a561bada49bc", - "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", - "service": "AKS", + "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "services": [ - "AKS", - "WAF" + "Entra", + "RBAC", + "WAF", + "Monitor", + "AzurePolicy" ], - "severity": "Low", - "text": "Customize node configuration for AKS node pools", - "waf": "Performance" + "severity": "Medium", + "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.", + "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Monitor", "services": [ + "Storage", + "ARS", + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "Use the Horizontal Pod Autoscaler when required", - "waf": "Performance" + "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity", - "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", - "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", - "service": "AKS", + "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", + "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", + "service": "VM", "services": [ + "VM", + "Monitor", + "AzurePolicy", "WAF" ], - "severity": "High", - "text": "Consider an appropriate node size, not too large or too small", - "waf": "Performance" + "severity": "Medium", + "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", - "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", - "service": "AKS", + "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "services": [ - "AKS", + "VM", "WAF" ], - "severity": "Low", - "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster", - "waf": "Performance" + "severity": "Medium", + "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", - "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", - "service": "AKS", + "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "services": [ - "AKS", + "VM", "WAF" ], - "severity": "Low", - "text": "Consider subscribing to EventGrid Events for AKS automation", - "waf": "Performance" + "severity": "Medium", + "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", - "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", - "service": "AKS", + "guid": "90483845-c986-4cb2-a131-56a12476e49f", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Network Watcher", "services": [ - "AKS", - "WAF" + "Monitor", + "WAF", + "NetworkWatcher" ], - "severity": "Low", - "text": "For long running operation on an AKS cluster consider event termination", - "waf": "Performance" + "severity": "Medium", + "text": "Use Network Watcher to proactively monitor traffic flows", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", - "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", - "service": "AKS", + "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Monitor", "services": [ - "AKS", + "Monitor", "WAF" ], - "severity": "Low", - "text": "If required consider using Azure Dedicated Hosts for AKS nodes", - "waf": "Performance" + "severity": "Medium", + "text": "Use Azure Monitor Logs for insights and reporting.", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", - "guid": "24367b33-6971-45b1-952b-eee0b9b588de", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "guid": "97be9951-9048-4384-9c98-6cb2913156a1", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", + "service": "Monitor", "services": [ + "Monitor", "WAF" ], - "severity": "High", - "text": "Use ephemeral OS disks", - "waf": "Performance" + "severity": "Medium", + "text": "Use Azure Monitor alerts for the generation of operational alerts.", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "AKS", + "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "Monitor", "services": [ - "AKS", + "Monitor", "WAF" ], - "severity": "High", - "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds", - "waf": "Performance" + "severity": "Medium", + "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", - "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", - "service": "AKS", + "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Backup", "services": [ - "AKS", - "Storage", + "Backup", "WAF" ], - "severity": "Low", - "text": "For hyper performance storage option use Ultra Disks on AKS", - "waf": "Performance" - }, + "severity": "Medium", + "text": "When using Azure Backup, consider the different backup types (GRS, ZRS & LRS) as the default setting is GRS", + "waf": "Reliability" + }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", - "service": "AKS", + "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "VM", "services": [ - "SQL", - "Storage", + "VM", + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", - "waf": "Performance" + "text": "Use Azure policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", - "service": "AKS", + "description": "Azure Policy's guest configuration features can audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.", + "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "VM", "services": [ - "Storage", + "VM", + "Monitor", + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons", - "waf": "Performance" + "text": "Monitor VM security configuration drift via Azure Policy.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", "checklist": "WAF checklist", - "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", - "service": "AKS", + "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", "services": [ - "Storage", + "ASR", + "ACR", + "VM", "WAF" ], "severity": "Medium", - "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones", - "waf": "Performance" + "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.", + "waf": "Operations" }, { "checklist": "WAF checklist", - "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", - "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", - "service": "Logic Apps", + "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "Backup", "services": [ + "Backup", "WAF" ], - "severity": "High", - "text": "Select the right Logic App hosting plan based on your business & SLO requirements", - "waf": "Reliability" + "severity": "Medium", + "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.", + "waf": "Operations" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", - "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "Logic Apps", + "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", "services": [ + "VM", "WAF" ], "severity": "High", - "text": "Protect logic apps from region failures with zone redundancy and availability zones", + "text": "Leverage Availability Zones for your VMs in regions where they are supported.", "waf": "Reliability" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", - "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Logic Apps", + "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", "services": [ + "VM", "WAF" ], "severity": "High", - "text": "Consider a Cross-Region DR strategy for critical workloads", + "text": "Avoid running a production workload on a single VM.", "waf": "Reliability" }, { "checklist": "WAF checklist", - "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", - "link": "https://learn.microsoft.com/azure/app-service/environment/intro", - "service": "Logic Apps", + "guid": "84101f59-1941-4195-a270-e28034290e3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", "services": [ - "AppSvc", - "WAF" + "ACR", + "LoadBalancer", + "WAF", + "AppGW" ], - "severity": "High", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "severity": "Medium", + "text": "Azure Load Balancer and Application Gateway distribute incoming network traffic across multiple resources.", "waf": "Reliability" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", - "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", - "service": "Logic Apps", + "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "WAF", "services": [ - "WAF" + "FrontDoor", + "WAF", + "AppGW" + ], + "severity": "High", + "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.", + "waf": "Operations" + }, + { + "checklist": "WAF checklist", + "guid": "7f408960-c626-44cb-a018-347c8d790cdf", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "WAF", + "services": [ + "AppGW", + "FrontDoor", + "WAF", + "Sentinel" ], "severity": "Medium", - "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", + "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.", "waf": "Operations" }, { + "ammp": true, "checklist": "WAF checklist", - "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", + "guid": "5017f154-e3ab-4369-9829-e7e316183687", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "Key Vault", "services": [ + "AKV", "WAF" ], "severity": "High", - "text": "Select the right Function hosting plan based on your business & SLO requirements", - "waf": "Reliability" + "text": "Use Azure Key Vault to store your secrets and credentials", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", + "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", + "guid": "a0477a20-9945-4bda-9333-4f2491163418", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", + "service": "Key Vault", "services": [ + "AKV", "WAF" ], - "severity": "High", - "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)", - "waf": "Reliability" + "severity": "Medium", + "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", - "service": "Azure Functions", + "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ + "AKV", + "AzurePolicy", "WAF" ], "severity": "Medium", - "text": "Consider a Cross-Region DR strategy for critical workloads", - "waf": "Reliability" + "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Azure Functions", + "guid": "dc055bcf-619e-48a1-9f98-879525d62688", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "AppSvc", + "Entra", + "RBAC", + "AKV", "WAF" ], - "severity": "High", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", - "waf": "Reliability" + "severity": "Medium", + "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "Azure Functions", + "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "AppSvc", "WAF" ], - "severity": "High", - "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan", - "waf": "Reliability" + "severity": "Medium", + "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", - "service": "Azure Functions", + "guid": "913156a1-2476-4e49-b541-acdce979377b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "Storage", "WAF" ], "severity": "Medium", - "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled", - "waf": "Reliability" + "text": "Establish an automated process for key and certificate rotation.", + "waf": "Security" }, { "checklist": "WAF checklist", - "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "Azure Functions", + "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ + "VNet", + "PrivateLink", + "AKV", "WAF" ], "severity": "Medium", - "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code", - "waf": "Operations" + "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Azure Bot Service", - "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", - "service": "Bot service", - "services": [], + "checklist": "WAF checklist", + "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", + "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", + "service": "Key Vault", + "services": [ + "Entra", + "Monitor", + "AKV", + "WAF" + ], "severity": "Medium", - "subcategory": "High Availablity", - "text": "Follow reliability support recommendations in Azure Bot Service", - "waf": "Reliability" + "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Azure Bot Service", - "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", - "service": "Bot service", - "services": [], + "checklist": "WAF checklist", + "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "services": [ + "AKV", + "AzurePolicy", + "WAF" + ], "severity": "Medium", - "subcategory": "High Availablity", - "text": "Deploying bots with local data residency and regional compliance", - "waf": "Reliability" + "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Azure Bot Service", - "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", - "service": "Bot service", - "services": [], + "checklist": "WAF checklist", + "guid": "91163418-2ba5-4275-8694-4008be7d7e48", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "services": [ + "AKV", + "WAF" + ], "severity": "Medium", - "subcategory": "High Availablity", - "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.", - "waf": "Reliability" + "text": "Use an Azure Key Vault per application per environment per region.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687", - "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/", - "service": "Purview", - "services": [], + "checklist": "WAF checklist", + "guid": "25d62688-6d70-4ba6-a97b-e99519048384", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "services": [ + "ASR", + "ACR", + "AKV", + "WAF" + ], "severity": "Medium", - "subcategory": "Best Practices", - "text": "Leverage FTA Resillency Handbook", - "waf": "Reliability" + "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "checklist": "WAF checklist", + "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", + "link": "https://learn.microsoft.com/industry/sovereignty/key-management", + "service": "Key Vault", "services": [ - "ASR" + "AKV", + "WAF" ], - "severity": "High", - "subcategory": "Disaster Recovery", - "text": "Plan for Data Center level outage", - "waf": "Reliability" + "severity": "Medium", + "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets", - "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "checklist": "WAF checklist", + "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", + "service": "Entra", "services": [ - "ASR" + "Entra", + "WAF" ], "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Practice Failover for BCDR", - "waf": "Reliability" + "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "97b15b8a-219a-44ab-bb57-879024d22678", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "ammp": true, + "checklist": "WAF checklist", + "guid": "09945bda-4333-44f2-9911-634182ba5275", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", + "service": "Defender", "services": [ - "Backup" + "Defender", + "Subscriptions", + "WAF" ], "severity": "High", - "subcategory": "Backup and Restore ", - "text": "Plan a backup strategy and take regular backups", - "waf": "Reliability" + "text": "Enable Defender Cloud Security Posture Management for all subscriptions.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d", - "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet", - "service": "Purview", + "ammp": true, + "checklist": "WAF checklist", + "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", + "service": "Defender", "services": [ - "EventHubs" + "Defender", + "Subscriptions", + "WAF" ], - "severity": "Low", - "subcategory": "Purview Accounts Replications", - "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account", - "waf": "Reliability" + "severity": "High", + "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b", - "link": "https://learn.microsoft.com/purview/deployment-best-practices", - "service": "Purview", - "services": [], - "severity": "Medium", - "subcategory": "Data catalog", - "text": "Follow Purview accounts architectures and deployment best practices", - "waf": "Reliability" + "ammp": true, + "checklist": "WAF checklist", + "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", + "service": "Defender", + "services": [ + "Defender", + "Subscriptions", + "WAF" + ], + "severity": "High", + "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c", - "link": "https://learn.microsoft.com/purview/concept-best-practices-collections", - "service": "Purview", - "services": [], - "severity": "Medium", - "subcategory": "Data catalog", - "text": "Follow Collection Architectures and best practices", - "waf": "Reliability" + "ammp": true, + "checklist": "WAF checklist", + "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", + "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", + "service": "VM", + "services": [ + "WAF" + ], + "severity": "High", + "text": "Enable Endpoint Protection on IaaS Servers.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b", - "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle", - "service": "Purview", - "services": [], + "checklist": "WAF checklist", + "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", + "link": "https://learn.microsoft.com/azure/security-center/", + "service": "VM", + "services": [ + "Defender", + "Monitor", + "WAF" + ], "severity": "Medium", - "subcategory": "Data catalog", - "text": "Follow Assest lifecycle best practices", - "waf": "Reliability" + "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed", - "link": "https://learn.microsoft.com/purview/concept-best-practices-automation", - "service": "Purview", - "services": [], + "checklist": "WAF checklist", + "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", + "services": [ + "Entra", + "Monitor", + "WAF" + ], "severity": "Medium", - "subcategory": "Data catalog", - "text": "Follow automation best practices", - "waf": "Reliability" + "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "checklist": "WAF checklist", + "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", + "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", + "service": "Entra", "services": [ - "Backup" + "Entra", + "WAF" ], "severity": "Medium", - "subcategory": "Data catalog", - "text": "Follow Backup and Migration Best practices", - "waf": "Reliability" + "text": "For Sovereign Landing Zone, transparancy logs is enabled on the Entra ID tenant.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7", - "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary", - "service": "Purview", - "services": [], + "checklist": "WAF checklist", + "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", + "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", + "service": "Entra", + "services": [ + "Entra", + "WAF" + ], "severity": "Medium", - "subcategory": "Data catalog", - "text": "Follow Purview Glossary Best Practices", - "waf": "Reliability" - }, - { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790", - "link": "https://learn.microsoft.com/purview/concept-workflow", - "service": "Purview", - "services": [], - "severity": "Low", - "subcategory": "Data catalog", - "text": "Leverage Workflows ", - "waf": "Reliability" + "text": "For Sovereign Landing Zone, customer Lockbox is enabled on the Entra ID tenant.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e", - "link": "https://learn.microsoft.com/purview/concept-best-practices-security", - "service": "Purview", - "services": [], - "severity": "Medium", - "subcategory": "Data catalog", - "text": "Follow Purview Security Best Practices", - "waf": "Reliability" + "ammp": true, + "checklist": "WAF checklist", + "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Storage", + "services": [ + "Storage", + "WAF" + ], + "severity": "High", + "text": "Secure transfer to storage accounts should be enabled", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888", - "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory", - "service": "Purview", - "services": [], - "severity": "Medium", - "subcategory": "Data Map", - "text": "Follow Purview Data Lineage Best Practices", - "waf": "Reliability" + "ammp": true, + "checklist": "WAF checklist", + "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", + "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", + "service": "Storage", + "services": [ + "Storage", + "WAF" + ], + "severity": "High", + "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "9579e76b-896e-4710-a7da-7be9956d14d3", - "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning", - "service": "Purview", - "services": [], - "severity": "Medium", - "subcategory": "Data Map", - "text": "Follow Best Practices for Scanning Registered Sources", - "waf": "Reliability" + "ammp": true, + "checklist": "WAF checklist", + "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", + "service": "Key Vault", + "services": [ + "VM", + "AKV", + "WAF" + ], + "severity": "High", + "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed", - "link": "https://learn.microsoft.com/purview/concept-best-practices-classification", - "service": "Purview", - "services": [], + "checklist": "WAF checklist", + "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", + "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", + "service": "APIM", + "services": [ + "AzurePolicy", + "WAF" + ], "severity": "Medium", - "subcategory": "Data Map", - "text": "Follow Classification Best Practices in Governance Portal", - "waf": "Reliability" + "text": "Implement an error handling policy at the global level", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69", - "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions", - "service": "Purview", - "services": [], + "checklist": "WAF checklist", + "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", + "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", + "service": "APIM", + "services": [ + "AzurePolicy", + "WAF" + ], "severity": "Medium", - "subcategory": "Data Map", - "text": "Perform Sensitivity Labelling in the Purview Data Map", - "waf": "Reliability" + "text": "Ensure all APIs policies include a element.", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96", - "link": "https://learn.microsoft.com/purview/concept-data-share", - "service": "Purview", + "checklist": "WAF checklist", + "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", + "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", + "service": "APIM", "services": [ - "Storage" + "ACR", + "AzurePolicy", + "WAF" ], - "severity": "Low", - "subcategory": "Data Sharing", - "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview", - "waf": "Reliability" - }, - { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4", - "link": "https://learn.microsoft.com/purview/concept-insights", - "service": "Purview", - "services": [], - "severity": "Low", - "subcategory": "Data Estate", - "text": "Leverage Data Estate Insights", - "waf": "Reliability" + "severity": "Medium", + "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab", - "link": "https://learn.microsoft.com/purview/catalog-adoption-insights", - "service": "Purview", - "services": [], - "severity": "Low", - "subcategory": "Data Estate", - "text": "Use Data stewardship and Catalog adoption", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", + "link": "https://learn.microsoft.com/azure/api-management/monetization-support", + "service": "APIM", + "services": [ + "WAF" + ], + "severity": "Medium", + "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581", - "link": "https://learn.microsoft.com/purview/concept-insights", - "service": "Purview", - "services": [], - "severity": "Low", - "subcategory": "Data Estate", - "text": "Use Inventory and Ownership", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", + "service": "APIM", + "services": [ + "Monitor", + "WAF" + ], + "severity": "High", + "text": "Enable Diagnostics Settings to export logs to Azure Monitor", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9", - "link": "https://learn.microsoft.com/purview/glossary-insights", - "service": "Purview", - "services": [], - "severity": "Low", - "subcategory": "Data Estate", - "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", + "service": "APIM", + "services": [ + "WAF" + ], + "severity": "Medium", + "text": "Enable Application Insights for more detailed telemetry", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "b130a888-9579-4e76-a896-e710a7da7be9", - "link": "https://learn.microsoft.com/purview/compliance-manager", - "service": "Purview", - "services": [], - "severity": "Medium", - "subcategory": "Data Quality ", - "text": "Generate assessment scores", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", + "service": "APIM", + "services": [ + "Monitor", + "WAF" + ], + "severity": "High", + "text": "Configure alerts on the most critical metrics", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f", - "link": "https://learn.microsoft.com/purview/compliance-manager-scoring", - "service": "Purview", - "services": [], - "severity": "Medium", - "subcategory": "Data Quality ", - "text": "Profiling- get summaries of data content", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", + "service": "APIM", + "services": [ + "AKV", + "WAF" + ], + "severity": "High", + "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1", - "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts", - "service": "Purview", + "checklist": "WAF checklist", + "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", + "service": "APIM", "services": [ - "AzurePolicy" + "Entra", + "WAF" ], - "severity": "Low", - "subcategory": "Data Policy", - "text": "Follow Microsoft Purview Data Owner access policies", - "waf": "Reliability" + "severity": "High", + "text": "Protect incoming requests to APIs (data plane) with Azure AD", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac", - "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy", - "service": "Purview", + "checklist": "WAF checklist", + "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", + "service": "APIM", "services": [ - "AzurePolicy" + "Entra", + "WAF" ], - "severity": "Low", - "subcategory": "Data Policy", - "text": "Follow Self-service access policies", - "waf": "Reliability" + "severity": "Medium", + "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal", + "waf": "Security" }, { - "category": "Operations management", - "checklist": "Microsoft Purview Review Checklist", - "guid": "b49e5b96-0332-44ec-b8cc-13318da61170", - "link": "https://learn.microsoft.com/purview/concept-policies-devops", - "service": "Purview", + "checklist": "WAF checklist", + "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", + "service": "APIM", "services": [ - "AzurePolicy" + "WAF" ], - "severity": "Low", - "subcategory": "Data Policy", - "text": "Follow DevOps policies", - "waf": "Reliability" + "severity": "Medium", + "text": "Create appropriate groups to control the visibility of the products", + "waf": "Security" }, { - "category": "Automation", - "checklist": "SAP Checklist", - "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", - "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "06862505-2d9a-4874-9491-2837b00a3475", + "link": "https://learn.microsoft.com/azure/api-management/backends", + "service": "APIM", "services": [ - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "ACSS", - "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "text": "Use Backends feature to eliminate redundant API backend configurations", "waf": "Operations" }, { - "category": "Automation", - "checklist": "SAP Checklist", - "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", + "service": "APIM", "services": [ - "SAP" + "AzurePolicy", + "WAF" ], "severity": "Medium", - "subcategory": "SDAF", - "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.", - "training": "https://github.com/Azure/sap-automation", + "text": "Use Named Values to store common values that can be used in policies", "waf": "Operations" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", + "service": "APIM", "services": [ - "Backup", - "ASR", - "SAP" + "ACR", + "WAF" ], "severity": "Medium", - "subcategory": "Backup and restore", - "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally", + "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", + "link": "https://learn.microsoft.com/azure/api-management/high-availability", + "service": "APIM", "services": [ - "ASR", - "Backup", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "Disaster recovery", - "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.", + "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "b651423c-8552-42db-a545-5cb50c05527a", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", + "service": "APIM", "services": [ - "ASR", - "SAP", "Backup", - "SQL", - "Storage" + "WAF" ], "severity": "High", - "subcategory": "Disaster recovery", - "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "text": "Ensure there is an automated backup routine", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", + "link": "https://learn.microsoft.com/azure/api-management/retry-policy", + "service": "APIM", "services": [ - "ASR", - "SAP" + "AzurePolicy", + "WAF" ], "severity": "Medium", - "subcategory": "Disaster recovery", - "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", + "service": "APIM", "services": [ - "ASR", - "ExpressRoute", - "VPN", - "SAP" + "EventHubs", + "AzurePolicy", + "WAF" ], - "severity": "High", - "subcategory": "Disaster recovery", - "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.", - "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", - "waf": "Reliability" + "severity": "Low", + "text": "If you need to log at high performance levels, consider Event Hubs policy", + "waf": "Operations" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", + "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", + "service": "APIM", "services": [ - "ASR", - "ACR", - "AKV", - "SAP" + "AzurePolicy", + "WAF" ], - "severity": "Low", - "subcategory": "Disaster recovery", - "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.", - "waf": "Reliability" + "severity": "Medium", + "text": "Apply throttling policies to control the number of requests per second", + "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", + "waf": "Performance" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", + "service": "APIM", "services": [ - "ASR", - "VNet", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "Disaster recovery", - "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.", - "waf": "Reliability" + "text": "Configure autoscaling to scale out the number of instances when the load increases", + "waf": "Performance" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", + "service": "APIM", "services": [ - "ASR", - "Storage", - "SAP" + "WAF" ], - "severity": "Low", - "subcategory": "Disaster recovery", - "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.", - "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", - "waf": "Reliability" + "severity": "Medium", + "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.", + "waf": "Performance" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", + "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", + "service": "APIM", "services": [ - "ASR", - "SAP" + "WAF" ], - "severity": "High", - "subcategory": "Disaster recovery", - "text": "Native database replication technology should be used to synchronize the database in a HA pair.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", + "severity": "Medium", + "text": "Use the premium tier for production workloads.", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", - "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", + "service": "APIM", "services": [ - "ASR", - "VNet", - "SAP" + "AzurePolicy", + "WAF" ], - "severity": "High", - "subcategory": "Disaster recovery", - "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "severity": "Medium", + "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", + "service": "APIM", "services": [ "Entra", - "ASR", - "VM", - "SAP" + "APIM", + "WAF" ], "severity": "High", - "subcategory": "Disaster recovery", - "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "text": "Be aware of APIM's limits", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", + "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", + "service": "APIM", "services": [ - "ASR", - "SAP" + "WAF" ], "severity": "High", - "subcategory": "High availability", - "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", + "text": "Ensure that the self-hosted gateway deployments are resilient.", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "7519e385-a88b-4d34-966b-6269d686e890", + "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", + "service": "APIM", "services": [ - "ASR", - "SAP" + "Entra", + "APIM", + "FrontDoor", + "WAF" ], - "severity": "High", - "subcategory": "High availability", - "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "text": "Use Azure Front Door in front of APIM for multi-region deployment", + "waf": "Performance" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "cd45c90e-7690-4753-930b-bf290c69c074", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", + "service": "APIM", "services": [ - "ASR", - "VM", - "Storage", - "SAP" + "VNet", + "WAF" ], - "severity": "High", - "subcategory": "High availability", - "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", - "waf": "Reliability" + "severity": "Medium", + "text": "Deploy the service within a Virtual Network (VNet)", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", - "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", + "service": "APIM", "services": [ - "ASR", - "Storage", - "SAP" + "VNet", + "Entra", + "WAF", + "Monitor", + "APIM" ], - "severity": "High", - "subcategory": "High availability", - "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", - "waf": "Reliability" + "severity": "Medium", + "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", - "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", + "service": "APIM", "services": [ - "ASR", - "SAP" + "VNet", + "Entra", + "WAF", + "APIM", + "PrivateLink" ], - "severity": "High", - "subcategory": "High availability", - "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", + "service": "APIM", "services": [ - "ASR", - "LoadBalancer", - "SAP" + "WAF" ], "severity": "High", - "subcategory": "High availability", - "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", - "waf": "Reliability" + "text": "Disable Public Network Access", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", + "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", + "service": "APIM", "services": [ - "ASR", - "LoadBalancer", - "SAP" + "WAF" ], - "severity": "High", - "subcategory": "High availability", - "text": "Make sure the Floating IP is enabled on the Load balancer", - "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "text": "Simplify management with PowerShell automation scripts", + "waf": "Operations" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", + "service": "APIM", "services": [ - "ASR", - "SAP" + "Entra", + "APIM", + "WAF" ], - "severity": "High", - "subcategory": "High availability", - "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator", + "waf": "Operations" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", - "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", + "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", + "service": "APIM", "services": [ "Entra", - "ASR", - "VM", - "SAP" + "APIM", + "WAF" ], - "severity": "High", - "subcategory": "High availability", - "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.", - "waf": "Reliability" + "severity": "Medium", + "text": "Promote usage of Visual Studio Code APIM extension for faster API development", + "waf": "Operations" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "cbe05bbe-209d-4490-ba47-778424d11678", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "354f1c03-8112-4965-85ad-c0074bddf231", + "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", + "service": "APIM", "services": [ - "RBAC", - "ASR", - "SAP", - "Entra", - "VM" + "WAF" ], - "severity": "High", - "subcategory": "High availability", - "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "text": "Implement DevOps and CI/CD in your workflow", + "waf": "Operations" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", - "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "b6439493-426a-45f3-9697-cf65baee208d", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", + "service": "APIM", "services": [ - "ASR", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "High availability", - "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.", - "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "waf": "Reliability" + "text": "Secure APIs using client certificate authentication", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "9674e7c7-7796-4181-8920-09f4429543ba", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "2a67d143-1033-4c0a-8732-680896478f08", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", + "service": "APIM", "services": [ - "ASR", - "VM", - "SAP" + "WAF" ], - "severity": "High", - "subcategory": "High availability", - "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Reliability" + "severity": "Medium", + "text": "Secure backend services using client certificate authentication", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", + "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", + "service": "APIM", "services": [ - "Entra", - "ASR", - "SAP" + "WAF" ], - "severity": "High", - "subcategory": "High availability", - "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.", - "waf": "Reliability" + "severity": "Medium", + "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", + "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", + "service": "APIM", "services": [ - "ASR", - "ACR", - "SAP" + "WAF" + ], + "severity": "Medium", + "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs", + "waf": "Security" + }, + { + "checklist": "WAF checklist", + "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", + "service": "APIM", + "services": [ + "WAF" ], "severity": "High", - "subcategory": "High availability", - "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions", - "waf": "Reliability" + "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "f8af3d94-1d2b-4070-846f-849197524258", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", + "service": "APIM", "services": [ - "Entra", - "ASR", - "SAP" + "AKV", + "WAF" ], "severity": "High", - "subcategory": "High availability", - "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "ed46b937-913e-4018-9c62-8393ab037e53", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "791abd8b-7706-4e31-9569-afefde724be3", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", + "service": "APIM", "services": [ "Entra", - "ASR", - "VM", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "High availability", - "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "text": "Use managed identities to authenticate to other Azure resources whenever possible", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "f656e745-0cfb-453e-8008-0528fa21c933", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", + "service": "APIM", "services": [ - "ASR", - "VM", - "Storage", - "SAP" + "Entra", + "APIM", + "WAF", + "AppGW" ], - "severity": "Medium", - "subcategory": "High availability", - "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.", - "waf": "Reliability" + "severity": "High", + "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM", + "waf": "Security" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "7f684ebc-95da-425e-b329-e782dbed050f", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", + "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", + "service": "App Services", "services": [ - "ASR", - "SAP" + "WAF" ], - "severity": "Medium", - "subcategory": "High availability", - "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "severity": "Low", + "text": "Refer to baseline highly available zone-redundant web application architecture for best practices", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", + "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", + "service": "App Services", "services": [ - "ASR", - "Storage", - "SAP" + "Backup", + "WAF" ], - "severity": "High", - "subcategory": "Storage", - "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "severity": "Medium", + "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", + "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", + "service": "App Services", "services": [ - "ASR", - "Storage", - "SAP" + "WAF" ], "severity": "High", - "subcategory": "Storage", - "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.", - "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", + "text": "Leverage Availability Zones where regionally applicable (requires Premium v2 or v3 tier)", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "services": [ - "ASR", - "Storage", - "SAP" + "WAF" ], - "severity": "High", - "subcategory": "Storage", - "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", + "severity": "Medium", + "text": "Implement health checks", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "SAP Checklist", - "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", - "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", + "service": "App Services", "services": [ - "ASR", - "Storage", - "SAP" + "Backup", + "WAF", + "AppSvc" ], "severity": "High", - "subcategory": "Storage", - "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.", + "text": "Refer to backup and restore best practices for Azure App Service", "waf": "Reliability" }, { - "category": "Cost Optimization", - "checklist": "SAP Checklist", - "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", + "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", + "service": "App Services", "services": [ - "Cost", - "SAP" + "WAF", + "AppSvc" ], - "severity": "Medium", - "subcategory": " ", - "text": "Automate SAP System Start-Stop to manage costs.", - "waf": "Cost" + "severity": "High", + "text": "Implement Azure App Service reliability best practices", + "waf": "Reliability" }, { - "category": "Cost Optimization", - "checklist": "SAP Checklist", - "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", + "service": "App Services", "services": [ - "Cost", - "VM", - "Storage", - "SAP" + "WAF", + "AppSvc" ], "severity": "Low", - "subcategory": " ", - "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.", - "waf": "Cost" + "text": "Familiarize with how to move an App Service app to another region During a disaster", + "waf": "Reliability" }, { - "category": "Cost Optimization", - "checklist": "SAP Checklist", - "guid": "9877f353-2591-4e8b-8381-e9043fed1010", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", + "service": "App Services", "services": [ - "Cost", - "VM", - "Storage", - "SAP" + "WAF", + "AppSvc" ], - "severity": "Low", - "subcategory": " ", - "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.", - "waf": "Cost" + "severity": "High", + "text": "Familiarize with reliability support in Azure App Service", + "waf": "Reliability" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "App Services", "services": [ - "RBAC", - "Entra", - "Subscriptions", - "SAP" + "WAF", + "AppSvc" ], - "severity": "High", - "subcategory": "Identity", - "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", - "waf": "Security" + "severity": "Medium", + "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan", + "waf": "Reliability" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "45911475-e39e-4530-accc-d979366bcda2", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "services": [ - "Entra", - "SAP" + "Monitor", + "WAF", + "AppSvc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", - "waf": "Security" + "text": "Monitor App Service instances using Health checks", + "waf": "Reliability" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", + "service": "App Services", "services": [ - "Entra", - "SAP" + "Monitor", + "WAF" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.", - "waf": "Security" + "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests", + "waf": "Reliability" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", + "service": "App Services", "services": [ - "Entra", - "SAP" + "Monitor", + "WAF" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", - "waf": "Security" + "severity": "Low", + "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website", + "waf": "Reliability" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.", + "guid": "834ac932-223e-4ce8-8b12-3071a5416415", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "services": [ - "Entra", - "SAP" + "AKV", + "WAF", + "AppSvc" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", + "severity": "High", + "text": "Use Key Vault to store secrets", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.", + "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "services": [ "Entra", - "SAP" + "AKV", + "WAF", + "AppSvc" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "severity": "High", + "text": "Use Managed Identity to connect to Key Vault", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Store the App Service TLS certificate in Key Vault.", + "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", + "service": "App Services", "services": [ - "Entra", "AKV", - "SAP" + "WAF", + "AppSvc" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", + "severity": "High", + "text": "Use Key Vault to store TLS certificate.", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", - "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Systems that process sensitive information should be isolated. To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.", + "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", + "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", + "service": "App Services", "services": [ - "Entra", - "AKV", - "SAP" + "Subscriptions", + "WAF", + "AppSvc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", + "text": "Isolate systems that process sensitive information", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "16785d6f-a96c-496a-b885-18f482734c88", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).", + "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", + "service": "App Services", "services": [ - "Entra", - "SAP" + "TrafficManager", + "WAF", + "AppSvc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.", + "text": "Do not store sensitive data on local disk", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "a747c350-8d4c-449c-93af-393dbca77c48", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", - "service": "SAP", + "checklist": "WAF checklist", + "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C. Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.", + "guid": "919ca0b2-c121-459e-814b-933df574eccc", + "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", + "service": "App Services", "services": [ "Entra", - "SAP" + "WAF", + "AppSvc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Implement SSO to SAP HANA", + "text": "Use an established Identity Provider for authentication", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.", + "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", + "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", + "service": "App Services", "services": [ - "Entra", - "SAP" + "WAF", + "AppSvc" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.", + "severity": "High", + "text": "Deploy from a trusted environment", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", - "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM. This disables access to these services and enforces the use of Azure AD secured endpoints for deployment. Note that the SCM site can also be opened using Azure AD credentials.", + "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", + "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", + "service": "App Services", "services": [ "Entra", - "SAP" + "WAF" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.", + "severity": "High", + "text": "Disable basic authentication", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Where possible use Managed Identity to connect to Azure AD secured resources. If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.", + "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", + "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", + "service": "App Services", "services": [ "Entra", - "SAP" + "AKV", + "WAF" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.", + "severity": "High", + "text": "Use Managed Identity to connect to resources", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.", + "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", + "service": "App Services", "services": [ "Entra", - "SAP" + "ACR", + "WAF" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Implement SSO to SAP BTP", + "severity": "High", + "text": "Pull containers using a Managed Identity", "waf": "Security" }, { - "category": "Identity and Access", - "checklist": "SAP Checklist", - "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", - "service": "SAP", + "checklist": "WAF checklist", + "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...", + "guid": "47768314-c115-4775-a2ea-55b46ad48408", + "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", + "service": "App Services", "services": [ "Entra", - "SAP" + "Monitor", + "WAF", + "AppSvc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.", + "text": "Send App Service runtime logs to Log Analytics", "waf": "Security" }, { - "category": "Management Group and Subscriptions", - "checklist": "SAP Checklist", - "guid": "6ba28021-4591-4147-9e39-e5309cccd979", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.", + "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "service": "App Services", "services": [ - "AzurePolicy", - "Subscriptions", - "SAP" + "Entra", + "Monitor", + "WAF", + "AppSvc" ], "severity": "Medium", - "subcategory": "Subscriptions", - "text": "enforce existing Management Group policies to SAP Subscriptions", - "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", - "waf": "Operations" + "text": "Send App Service activity logs to Log Analytics", + "waf": "Security" }, { - "category": "Management Group and Subscriptions", - "checklist": "SAP Checklist", - "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's. Traffic should be routed to an NVA such as Azure Firewall. Ensure to monitor the Firewall's logs.", + "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", + "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", + "service": "App Services", "services": [ - "Subscriptions", - "SAP" + "VNet", + "WAF", + "Firewall", + "Monitor", + "NVA" ], - "severity": "High", - "subcategory": "Subscriptions", - "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", - "waf": "Operations" + "severity": "Medium", + "text": "Outbound network access should be controlled", + "waf": "Security" }, { - "category": "Management Group and Subscriptions", - "checklist": "SAP Checklist", - "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "checklist": "WAF checklist", + "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall. This allows the receiving party to allow-list based on IP, should that be needed. Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead. (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)", + "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", + "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", + "service": "App Services", "services": [ - "Subscriptions", - "SAP" + "Storage", + "VNet", + "WAF", + "Firewall", + "NVA", + "PrivateLink" ], - "severity": "High", - "subcategory": "Subscriptions", - "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ", - "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", - "waf": "Operations" + "severity": "Low", + "text": "Ensure a stable IP for outbound communications towards internet addresses", + "waf": "Security" }, { - "category": "Management Group and Subscriptions", - "checklist": "SAP Checklist", - "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", - "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.", + "guid": "0725769e-e669-41a4-a34a-c932223ece80", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "services": [ - "VM", - "Subscriptions", - "SAP" + "PrivateLink", + "WAF", + "AppSvc" ], "severity": "High", - "subcategory": "Subscriptions", - "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)", - "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "waf": "Operations" - }, - { - "category": "Management Group and Subscriptions", - "checklist": "SAP Checklist", - "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", - "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", - "service": "SAP", - "services": [ - "Subscriptions", - "SAP" - ], - "severity": "Low", - "subcategory": "Subscriptions", - "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.", - "waf": "Operations" + "text": "Inbound network access should be controlled", + "waf": "Security" }, { - "category": "Management Group and Subscriptions", - "checklist": "SAP Checklist", - "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", - "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door. Make sure to monitor the WAF's logs.", + "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", + "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", + "service": "App Services", "services": [ - "VM", - "Subscriptions", - "SAP" + "WAF", + "Monitor", + "AppSvc", + "FrontDoor", + "AppGW" ], "severity": "High", - "subcategory": "Subscriptions", - "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.", - "waf": "Operations" + "text": "Use a WAF in front of App Service", + "waf": "Security" }, { - "category": "Management Group and Subscriptions", - "checklist": "SAP Checklist", - "guid": "e6e20617-3686-4af4-9791-f8935ada4332", - "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF. Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.", + "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "services": [ - "Subscriptions", - "SAP" + "PrivateLink", + "WAF" ], "severity": "High", - "subcategory": "Subscriptions", - "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", - "waf": "Operations" + "text": "Avoid for WAF to be bypassed", + "waf": "Security" }, { - "category": "Management Group and Subscriptions", - "checklist": "SAP Checklist", - "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Set minimum TLS policy to 1.2 in App Service configuration.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", + "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", + "service": "App Services", "services": [ - "Cost", - "Subscriptions", - "TrafficManager", - "SAP" + "AzurePolicy", + "WAF", + "AppSvc" ], "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", - "waf": "Operations" + "text": "Set minimum TLS policy to 1.2", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Configure App Service to use HTTPS only. This causes App Service to redirect from HTTP to HTTPS. Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.", + "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", + "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", + "service": "App Services", "services": [ - "Backup", - "Monitor", - "SAP" + "WAF", + "AppSvc" ], "severity": "High", - "subcategory": "BCDR", - "text": "Help protect your HANA database by using the Azure Backup service.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", - "waf": "Reliability" + "text": "Use HTTPS only", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.", + "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", + "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", + "service": "App Services", "services": [ - "Monitor", - "SAP", "Storage", - "Entra", - "VM" + "WAF" ], - "severity": "Medium", - "subcategory": "BCDR", - "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.", - "waf": "Reliability" + "severity": "High", + "text": "Wildcards must not be used for CORS", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", + "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", + "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", + "service": "App Services", "services": [ - "Monitor", - "SAP" + "WAF" ], "severity": "High", - "subcategory": "Management", - "text": "Ensure time-zone matches between the operating system and the SAP system.", - "waf": "Operations" + "text": "Turn off remote debugging", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "c3c7abc0-716c-4486-893c-40e181d65539", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.", + "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", + "service": "App Services", "services": [ - "Entra", - "Monitor", - "SAP" + "Defender", + "WAF", + "AppSvc" ], "severity": "Medium", - "subcategory": "Management", - "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Reliability" + "text": "Enable Defender for Cloud - Defender for App Service", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "a491dfc4-9353-4213-9217-eef0949f9467", - "link": "https://azure.microsoft.com/pricing/offers/dev-test/", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.", + "guid": "223ece80-b123-4071-a541-6415833ea3ad", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "App Services", "services": [ - "Cost", - "Monitor", - "SAP" + "VNet", + "EventHubs", + "WAF", + "NVA", + "DDoS", + "AppGW" ], - "severity": "Low", - "subcategory": "Management", - "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.", - "waf": "Cost" + "severity": "Medium", + "text": "Enable DDOS Protection Standard on the WAF VNet", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", - "link": "https://learn.microsoft.com/azure/lighthouse/overview", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.", + "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", + "service": "App Services", "services": [ - "Entra", - "Monitor", - "SAP" + "VNet", + "PrivateLink", + "ACR", + "WAF" ], "severity": "Medium", - "subcategory": "Management", - "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.", - "waf": "Operations" + "text": "Pull containers over a Virtual Network", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "4d116785-d2fa-456c-96ad-48408fe72734", - "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.", + "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", + "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", + "service": "App Services", "services": [ - "VM", - "Monitor", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "Management", - "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.", - "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", - "waf": "Operations" + "text": "Conduct a penetration test", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", - "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", + "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", + "service": "App Services", "services": [ - "Monitor", - "SAP" + "WAF" ], - "severity": "Low", - "subcategory": "Management", - "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", - "waf": "Operations" + "severity": "Medium", + "text": "Deploy validated code", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "14591147-5e39-4e53-89cc-cd979366bcda", - "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", - "service": "SAP", + "checklist": "WAF checklist", + "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", + "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", + "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", + "service": "App Services", "services": [ - "SQL", - "Monitor", - "SAP" + "WAF" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", - "waf": "Operations" + "severity": "High", + "text": "Use up-to-date platforms, languages, protocols and frameworks", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", - "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", + "service": "AVS", "services": [ "Entra", - "VM", - "Monitor", - "SAP" + "Subscriptions", + "WAF" ], "severity": "High", - "subcategory": "Monitoring", - "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.", - "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", - "waf": "Operations" + "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "75089c20-990d-4927-b105-885576f76fc2", + "service": "AVS", "services": [ - "AzurePolicy", - "Monitor", - "SAP" + "AVS", + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Operations" + "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", - "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", + "service": "AVS", "services": [ - "Monitor", - "NetworkWatcher", - "SAP" + "WAF" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", - "waf": "Operations" + "severity": "High", + "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "73686af4-6791-4f89-95ad-a43324e13811", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", + "service": "AVS", "services": [ - "VM", - "Monitor", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.", - "waf": "Operations" + "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "616785d6-fa96-4c96-ad88-518f482734c8", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", + "service": "AVS", "services": [ - "Monitor", - "Subscriptions", - "SAP" + "WAF" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.", - "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "waf": "Performance" + "severity": "Medium", + "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", - "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", + "service": "AVS", "services": [ - "ASR", - "Monitor", - "Storage", - "SAP" + "Entra", + "WAF" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.", - "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", - "waf": "Reliability" + "severity": "High", + "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", - "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", + "service": "AVS", "services": [ - "Sentinel", - "Monitor", - "SAP" + "RBAC", + "AVS", + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.", - "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", + "text": "Has an RBAC model been created for use within VMware vSphere", "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", - "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", + "service": "AVS", "services": [ - "Cost", - "Monitor", - "SAP" + "RBAC", + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.", - "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", - "waf": "Operations" + "text": "RBAC permissions should be granted on ADDS groups and not on specific users", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", + "service": "AVS", "services": [ - "VM", - "Monitor", - "SAP" + "RBAC", + "AVS", + "WAF" ], - "severity": "Low", - "subcategory": "Performance", - "text": "Use inter-VM latency monitoring for latency-sensitive applications.", - "waf": "Performance" + "severity": "High", + "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", + "service": "AVS", "services": [ - "ASR", - "Monitor", - "SAP" + "RBAC", + "WAF" ], - "severity": "Medium", - "subcategory": "Performance", - "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", - "waf": "Reliability" + "severity": "High", + "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", + "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", + "service": "AVS", "services": [ - "Monitor", - "Storage", - "SAP" + "AVS", + "WAF" ], - "severity": "Medium", - "subcategory": "Performance", - "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.", + "severity": "High", + "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand", "waf": "Performance" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "c027f893-f404-41a9-b33d-39d625a14964", - "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", + "service": "AVS", "services": [ + "ExpressRoute", + "WAF", + "VPN", "Monitor", - "SAP" + "NetworkWatcher" ], - "severity": "Low", - "subcategory": "Performance", - "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.", - "waf": "Performance" + "severity": "High", + "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'", + "waf": "Operations" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", + "service": "AVS", "services": [ + "AVS", + "ExpressRoute", + "WAF", "Monitor", - "Storage", - "SAP" + "VM", + "NetworkWatcher" ], "severity": "Medium", - "subcategory": "Performance", - "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.", - "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", - "waf": "Performance" + "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection", + "waf": "Operations" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", + "service": "AVS", "services": [ - "SQL", + "AVS", + "WAF", "Monitor", - "SAP" + "VM", + "NetworkWatcher" ], "severity": "Medium", - "subcategory": "Performance", - "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.", - "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", - "waf": "Performance" + "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity", + "waf": "Operations" }, { - "category": "Management and Monitoring", - "checklist": "SAP Checklist", - "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", + "service": "AVS", "services": [ - "ASR", - "Monitor", - "SAP" + "ARS", + "WAF" ], "severity": "High", - "subcategory": "Reliability", - "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", - "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).", "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", + "service": "AVS", "services": [ - "AppGW", - "AzurePolicy", - "SAP", + "Entra", + "RBAC", + "AVS", "WAF" ], - "severity": "Medium", - "subcategory": "App delivery", - "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", + "severity": "High", + "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", + "service": "AVS", "services": [ - "VM", - "DNS", - "SAP" + "Entra", + "RBAC", + "AVS", + "WAF" ], - "severity": "Medium", - "subcategory": "DNS", - "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", - "waf": "Operations" + "severity": "High", + "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", + "service": "AVS", "services": [ - "VNet", - "DNS", - "SAP" + "Entra", + "AVS", + "WAF" ], "severity": "Medium", - "subcategory": "DNS", - "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", - "waf": "Operations" + "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "a3592829-e6e2-4061-9368-6af46791f893", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", + "service": "AVS", "services": [ - "ACR", - "VNet", - "SAP" + "WAF" ], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions", - "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", - "waf": "Reliability" + "severity": "High", + "text": "Limit use of CloudAdmin account to emergency access only", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", + "service": "AVS", "services": [ - "NVA", - "SAP" + "RBAC", + "WAF" ], - "severity": "High", - "subcategory": "Hybrid", - "text": "It is not supported to deploy any NVA between SAP application and SAP Database server", - "training": "https://me.sap.com/notes/2731110", - "waf": "Performance" + "severity": "Medium", + "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", - "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", + "service": "AVS", "services": [ - "ACR", - "VWAN", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", - "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "waf": "Operations" + "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", + "service": "AVS", "services": [ - "VNet", - "NVA", - "SAP" + "Entra", + "AVS", + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.", - "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", - "waf": "Operations" + "severity": "High", + "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", - "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", + "service": "AVS", "services": [ - "VNet", - "NVA", - "VWAN", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.", - "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", - "waf": "Operations" + "text": "Is East-West traffic filtering implemented within NSX-T", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "82734c88-6ba2-4802-8459-11475e39e530", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", + "service": "AVS", "services": [ - "VNet", - "VM", - "SAP" + "AppGW", + "AVS", + "WAF", + "Firewall" ], "severity": "High", - "subcategory": "IP plan", - "text": "Public IP assignment to VM running SAP Workload is not recommended.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", - "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", + "service": "AVS", "services": [ - "ASR", - "VNet", - "SAP" + "AVS", + "WAF" ], "severity": "High", - "subcategory": "IP plan", - "text": "Consider reserving IP address on DR side when configuring ASR", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "Operations" + "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", + "service": "AVS", "services": [ - "VNet", - "SAP" + "Monitor", + "AVS", + "WAF" ], - "severity": "High", - "subcategory": "IP plan", - "text": "Avoid using overlapping IP address ranges for production and DR sites.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", - "waf": "Operations" + "severity": "Medium", + "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "6e154e3a-a359-4282-ae6e-206173686af4", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "334fdf91-c234-4182-a652-75269440b4be", + "service": "AVS", "services": [ "VNet", - "Storage", - "SAP" + "ExpressRoute", + "WAF", + "VPN", + "DDoS" ], "severity": "Medium", - "subcategory": "IP plan", - "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.", - "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", - "waf": "Operations" + "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", + "service": "AVS", "services": [ - "SAP", - "Firewall" + "AVS", + "WAF" ], "severity": "Medium", - "subcategory": "Internet", - "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", - "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", + "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", - "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", + "service": "AVS", "services": [ - "AppGW", - "SAP", + "Defender", + "AVS", "WAF" ], "severity": "Medium", - "subcategory": "Internet", - "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", + "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", + "service": "AVS", "services": [ - "SAP", - "FrontDoor", - "AzurePolicy", - "ACR", + "Arc", + "AVS", "WAF" ], "severity": "Medium", - "subcategory": "Internet", - "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", - "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", + "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", + "service": "AVS", "services": [ - "SAP", - "FrontDoor", - "AzurePolicy", - "AppGW", - "WAF" + "AVS", + "WAF", + "SQL" ], - "severity": "Medium", - "subcategory": "Internet", - "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", + "severity": "Low", + "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "5ada4332-4e13-4811-9231-81aa41742694", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "a3592718-e6e2-4051-9267-6ae46691e883", + "service": "AVS", "services": [ - "AppGW", - "LoadBalancer", - "SAP", + "AKV", "WAF" ], - "severity": "Medium", - "subcategory": "Internet", - "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", + "severity": "Low", + "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "5ac94222-3e13-4810-9230-81a941741583", + "service": "AVS", "services": [ - "ACR", - "VWAN", - "SAP" + "AVS", + "WAF" ], "severity": "Medium", - "subcategory": "Internet", - "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", - "waf": "Performance" + "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", + "service": "AVS", "services": [ - "VNet", - "SAP", - "Backup", - "PrivateLink", - "Storage", - "ACR" + "WAF" ], - "severity": "Medium", - "subcategory": "Internet", - "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.", - "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", - "waf": "Security" + "severity": "High", + "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "d88408f3-7273-44c8-96ba-280214590146", + "service": "AVS", "services": [ - "VM", - "SAP" + "Storage", + "AzurePolicy", + "WAF" ], "severity": "High", - "subcategory": "Segmentation", - "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", - "waf": "Performance" + "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", + "service": "AVS", "services": [ - "LoadBalancer", - "SAP" + "ASR", + "WAF" ], - "severity": "Medium", - "subcategory": "Segmentation", - "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.", - "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", - "waf": "Security" + "severity": "High", + "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "6791f893-5ada-4433-84e1-3811523181aa", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", + "service": "AVS", "services": [ - "VNet", - "VM", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": "Segmentation", - "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.", - "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", - "waf": "Security" + "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", + "service": "AVS", "services": [ - "VNet", - "SAP" + "AzurePolicy", + "WAF" ], - "severity": "High", - "subcategory": "Segmentation", - "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Performance" + "severity": "Medium", + "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "fa96c96a-d885-418f-9827-34c886ba2802", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", + "service": "AVS", "services": [ - "SAP" + "AVS", + "Cost", + "WAF" ], "severity": "Medium", - "subcategory": "Segmentation", - "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.", - "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", - "waf": "Performance" + "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used", + "waf": "Cost" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", + "service": "AVS", "services": [ - "SAP" + "AVS", + "Cost", + "WAF" ], - "severity": "High", - "subcategory": "Segmentation", - "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Performance" + "severity": "Low", + "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution", + "waf": "Cost" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "6691e883-5ac9-4422-83e1-3810523081a9", + "service": "AVS", "services": [ - "Cost", - "VNet", - "SAP" + "WAF" ], - "severity": "High", - "subcategory": "Segmentation", - "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Cost" + "severity": "Medium", + "text": "Consider the use of Azure Private-Link when using other Azure Native Services", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "402a9846-d515-4061-aff8-cd30088693fa", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", + "service": "AVS", "services": [ - "LoadBalancer", - "SAP" + "WAF" ], "severity": "High", - "subcategory": "Segmentation", - "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "text": "Ensure all required resource reside within the same Azure availability zone(s)", "waf": "Performance" }, { - "category": "Network Topology and Connectivity", - "checklist": "SAP Checklist", - "guid": "87585797-5551-4d53-bb7d-a94ee415734d", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", + "service": "AVS", "services": [ - "VNet", - "SAP" + "Defender", + "AVS", + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Segmentation", - "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering", + "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads", "waf": "Security" }, { - "category": "Operational Excellence", - "checklist": "SAP Checklist", - "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", + "service": "AVS", "services": [ - "Backup", + "Arc", + "AVS", "VM", - "SAP" - ], - "severity": "High", - "subcategory": " ", - "text": "Review SAP HANA database backups for Azure VMs.", - "waf": "Cost" - }, - { - "category": "Operational Excellence", - "checklist": "SAP Checklist", - "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", - "services": [ - "ASR", - "Monitor", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": " ", - "text": "Review Site Recovery built-in monitoring, where used for SAP.", - "waf": "Cost" + "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads", + "waf": "Security" }, { - "category": "Operational Excellence", - "checklist": "SAP Checklist", - "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", - "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", + "service": "AVS", "services": [ - "Monitor", - "SAP" + "AVS", + "WAF" ], "severity": "High", - "subcategory": " ", - "text": "Review the Monitoring the SAP HANA System Landscape guidance.", + "text": "Enable Diagnostic and metric logging on Azure VMware Solution", "waf": "Operations" }, { - "category": "Operational Excellence", - "checklist": "SAP Checklist", - "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", + "service": "AVS", "services": [ - "Backup", + "Monitor", + "AVS", "VM", - "SAP" - ], - "severity": "Medium", - "subcategory": " ", - "text": "Review Oracle Database in Azure Linux VM backup strategies.", - "waf": "Operations" - }, - { - "category": "Operational Excellence", - "checklist": "SAP Checklist", - "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", - "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", - "service": "SAP", - "services": [ - "SQL", - "Storage", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": " ", - "text": "Review the use of Azure Blob Storage with SQL Server 2016.", + "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads", "waf": "Operations" }, { - "category": "Operational Excellence", - "checklist": "SAP Checklist", - "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "589d457a-927c-4397-9d11-02cad6aae11e", + "service": "AVS", "services": [ + "AVS", "Backup", + "WAF", "VM", - "SAP" + "AzurePolicy" ], "severity": "Medium", - "subcategory": " ", - "text": "Review the use of Automated Backup v2 for Azure VMs.", + "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads", "waf": "Operations" }, { - "category": "Operational Excellence", - "checklist": "SAP Checklist", - "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "ee29711b-d352-4caa-ab79-b198dab81932", + "service": "AVS", "services": [ - "SAP" + "Defender", + "Monitor", + "AVS", + "WAF" ], - "severity": "High", - "subcategory": " ", - "text": "Enabling Write accelerator for M series when using premium disks(V1)", - "waf": "Operations" + "severity": "Medium", + "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution", + "waf": "Security" }, { - "category": "Performant", - "checklist": "SAP Checklist", - "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", + "service": "AVS", "services": [ - "SAP" + "Defender", + "WAF" ], "severity": "Medium", - "subcategory": " ", - "text": "Test availability zone latency.", - "waf": "Performance" + "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud", + "waf": "Security" }, { - "category": "Performant", - "checklist": "SAP Checklist", - "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", - "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", + "service": "AVS", "services": [ - "SAP" + "AVS", + "WAF" ], - "severity": "Medium", - "subcategory": " ", - "text": "Activate SAP EarlyWatch Alert for all SAP components.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", - "waf": "Performance" + "severity": "High", + "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment", + "waf": "Security" }, { - "category": "Performant", - "checklist": "SAP Checklist", - "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", + "service": "AVS", "services": [ - "SAP" + "WAF" ], - "severity": "Medium", - "subcategory": " ", - "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.", - "training": "https://me.sap.com/notes/0002879613", - "waf": "Performance" + "severity": "High", + "text": "Are data processing implications (service provider / service consumer model) clear and documented", + "waf": "Security" }, { - "category": "Performant", - "checklist": "SAP Checklist", - "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "547c1747-dc56-4068-a714-435cd19dd244", + "service": "AVS", "services": [ - "SQL", - "Monitor", - "SAP" + "WAF" ], "severity": "Medium", - "subcategory": " ", - "text": "Review SQL Server performance monitoring using CCMS.", - "waf": "Performance" + "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).", + "waf": "Security" }, { - "category": "Performant", - "checklist": "SAP Checklist", - "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", - "link": "https://me.sap.com/notes/500235", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", + "service": "AVS", "services": [ - "VM", - "SAP" + "Monitor", + "AVS", + "WAF" ], - "severity": "Medium", - "subcategory": " ", - "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).", - "training": "https://me.sap.com/notes/1100926/E", - "waf": "Performance" + "severity": "High", + "text": "Create dashboards to enable core Azure VMware Solution monitoring insights", + "waf": "Operations" }, { - "category": "Performant", - "checklist": "SAP Checklist", - "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", - "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", + "service": "AVS", "services": [ "Monitor", - "SAP" + "AVS", + "WAF" ], - "severity": "Medium", - "subcategory": " ", - "text": "Review SAP HANA studio alerts.", - "waf": "Performance" + "severity": "High", + "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", + "waf": "Operations" }, { - "category": "Performant", - "checklist": "SAP Checklist", - "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", - "link": "https://me.sap.com/notes/1969700", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "9659e396-80e7-4828-ac93-5657d02bff45", + "service": "AVS", "services": [ - "SAP" + "Monitor", + "AVS", + "WAF" ], - "severity": "Medium", - "subcategory": " ", - "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.", - "waf": "Performance" + "severity": "High", + "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", + "service": "AVS", "services": [ - "VM", - "SAP" + "Monitor", + "WAF" ], - "severity": "Medium", - "subcategory": "Governance", - "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.", - "training": "https://learn.microsoft.com/azure/automation/update-management/overview", - "waf": "Security" + "severity": "High", + "text": "Ensure alerts are configured for Azure Service Health alerts and notifications", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "08951710-79a2-492a-adbc-06d7a401545b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", + "service": "AVS", "services": [ - "SAP" + "Storage", + "AVS", + "WAF" ], "severity": "Medium", - "subcategory": "Governance", - "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.", - "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", - "waf": "Security" + "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", + "service": "AVS", "services": [ - "SQL", - "SAP" + "AVS", + "WAF" ], "severity": "Low", - "subcategory": "Governance", - "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.", - "waf": "Security" + "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", + "service": "AVS", "services": [ - "SQL", - "SAP" + "Storage", + "VM", + "WAF", + "AzurePolicy" ], "severity": "High", - "subcategory": "Governance", - "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.", - "training": "https://me.sap.com/notes/3019299/E", - "waf": "Security" + "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", + "service": "AVS", "services": [ - "SAP", - "Backup", - "SQL", - "AKV", - "Storage" + "WAF" ], - "severity": "High", - "subcategory": "Secrets", - "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "waf": "Security" + "severity": "Medium", + "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", + "service": "AVS", "services": [ - "AKV", "Storage", - "SAP" + "Backup", + "WAF" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.", - "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", - "waf": "Security" + "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", + "service": "AVS", "services": [ - "AKV", - "SAP" + "Arc", + "AVS", + "WAF" ], - "severity": "High", - "subcategory": "Secrets", - "text": "Use Azure Key Vault to store your secrets and credentials", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", - "waf": "Security" + "severity": "Medium", + "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "829e2edb-2173-4676-aff6-691b4935ada4", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", + "service": "AVS", "services": [ - "RBAC", - "SAP", - "Subscriptions", - "AzurePolicy", - "AKV" + "Monitor", + "AVS", + "WAF" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).", - "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", - "waf": "Security" + "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", + "service": "AVS", "services": [ - "AzurePolicy", - "AKV", - "SAP" + "AVS", + "WAF" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", - "waf": "Security" + "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", - "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", + "service": "AVS", "services": [ - "RBAC", + "Monitor", + "AVS", "AzurePolicy", - "AKV", - "SAP" + "WAF" ], - "severity": "High", - "subcategory": "Secrets", - "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed", - "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", - "waf": "Security" + "severity": "Medium", + "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", + "service": "AVS", "services": [ "Defender", - "AKV", - "Storage", - "SAP" + "AVS", + "WAF" ], - "severity": "High", - "subcategory": "Secrets", - "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", + "severity": "Medium", + "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud", "waf": "Security" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", + "service": "AVS", "services": [ - "Defender", - "AKV", - "RBAC", - "SAP" + "Backup", + "WAF" ], - "severity": "High", - "subcategory": "Secrets", - "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.", - "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", - "waf": "Security" + "severity": "Medium", + "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", + "service": "AVS", "services": [ - "AKV", - "SAP" + "WAF" ], - "severity": "Low", - "subcategory": "Secrets", - "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS", - "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", - "waf": "Security" + "severity": "Medium", + "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", + "service": "AVS", "services": [ - "AKV", - "SAP" + "ASR", + "WAF" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", - "waf": "Security" + "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "4935ada4-2223-4ece-a1b1-23181a541741", - "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", + "service": "AVS", "services": [ - "AKV", - "SAP" + "WAF" ], "severity": "High", - "subcategory": "Secrets", - "text": "Use an Azure Key Vault per application per environment per region.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", - "waf": "Security" + "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", - "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "8255461e-2aee-4345-9aec-8339248b262d", + "service": "AVS", "services": [ - "AKV", - "SAP" + "ASR", + "WAF" ], - "severity": "High", - "subcategory": "Secrets", - "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.", - "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", - "waf": "Security" + "severity": "Medium", + "text": "Use the geopolitical region pair as the secondary disaster recovery environment", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "209d490d-a477-4784-84d1-16785d2fa56c", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", + "service": "AVS", "services": [ - "RBAC", - "Subscriptions", - "SAP" + "WAF" ], "severity": "High", - "subcategory": "Security", - "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes", - "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", - "waf": "Security" + "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", - "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", + "service": "AVS", "services": [ - "PrivateLink", "NVA", - "SAP" + "AVS", + "ExpressRoute", + "WAF" ], - "severity": "High", - "subcategory": "Security", - "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources", - "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", - "waf": "Security" + "severity": "Medium", + "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", - "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", + "service": "AVS", "services": [ - "VM", - "Storage", - "SAP" + "Backup", + "WAF" ], - "severity": "Low", - "subcategory": "Security", - "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.", - "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", - "waf": "Security" + "severity": "Medium", + "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", + "service": "AVS", "services": [ - "Defender", - "SAP" + "AVS", + "Backup", + "WAF" ], - "severity": "Low", - "subcategory": "Security", - "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.", - "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", - "waf": "Security" + "severity": "Medium", + "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", + "service": "AVS", "services": [ - "VNet", - "SAP" + "Backup", + "WAF" ], - "severity": "High", - "subcategory": "Security", - "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", - "waf": "Security" + "severity": "Medium", + "text": "Deploy your backup solution outside of vSan, on Azure native components", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", + "service": "AVS", "services": [ - "SAP", + "AVS", "WAF" ], "severity": "Low", - "subcategory": "Security", - "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.", - "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", - "waf": "Security" + "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "SAP Checklist", - "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", - "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", - "service": "SAP", + "checklist": "WAF checklist", + "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", + "service": "AVS", "services": [ - "AKV", - "Monitor", - "SAP" + "WAF" ], - "severity": "Medium", - "subcategory": "Security", - "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", - "waf": "Security" - }, - { - "category": "BC and DR", - "checklist": "Container Apps Review", - "guid": "af416482-663c-4ed6-b195-b44c7068e09c", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support", - "service": "Container Apps", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Leverage Availability Zones if regionally applicable", - "waf": "Reliability" - }, - { - "category": "BC and DR", - "checklist": "Container Apps Review", - "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment", - "service": "Container Apps", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Use more than one replica and enable Zone Redundancy.", - "waf": "Reliability" + "severity": "Low", + "text": "For manual deployments, all configuration and deployments must be documented", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Container Apps Review", - "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", - "service": "Container Apps", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", + "service": "AVS", + "services": [ + "AVS", + "WAF" + ], + "severity": "Low", + "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Container Apps Review", - "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", - "service": "Container Apps", + "checklist": "WAF checklist", + "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", + "service": "AVS", "services": [ - "FrontDoor", - "TrafficManager" + "WAF" ], - "severity": "High", - "subcategory": "High Availability", - "text": "Use Front Door or Traffic Manager to route traffic to the closest region", - "waf": "Reliability" + "severity": "Low", + "text": "For automated deployments, deploy a minimal private cloud and scale as needed", + "waf": "Operations" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "fda1dae2-dc95-4d48-a6c7-91dca0f6c565", - "link": "https://learn.microsoft.com/azure/synapse-analytics/sql-data-warehouse/backup-and-restore#geo-backups-and-disaster-recovery", + "checklist": "WAF checklist", + "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", + "service": "AVS", "services": [ - "Backup" + "WAF" ], - "severity": "Medium", - "subcategory": "Backup", - "text": "Enable Geo Backup ", - "waf": "Reliability" + "severity": "Low", + "text": "For automated deployments, request or reserve quota prior to starting the deployment", + "waf": "Operations" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "89e558b9-37d4-4974-b111-2dbd7baf12e7", - "link": "https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/how-to-use-ci-cd-integration-to-automate-the-deploy-of-a-synapse/ba-p/2248060", - "services": [], - "severity": "Medium", - "subcategory": "DevOps", - "text": "Integrate with Azure DevOps to deploy Multiple environments", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", + "service": "AVS", + "services": [ + "AzurePolicy", + "WAF" + ], + "severity": "Low", + "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance", + "waf": "Operations" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "b94ef6e0-47d2-4da2-a82b-1cd6d2f54b29", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "services": [], - "severity": "High", - "subcategory": "DR", - "text": "BCDR for Azure Synapse pipelines ", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", + "service": "AVS", + "services": [ + "AKV", + "WAF" + ], + "severity": "Low", + "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use", + "waf": "Operations" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "769e3a69-1e88-438a-a936-667e13c00567", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "services": [], - "severity": "High", - "subcategory": "DR", - "text": "Use Zone Redudant pipelines in regions supporting Availablity Zones", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "255461e2-aee3-4553-afc8-339248b262d6", + "service": "AVS", + "services": [ + "ExpressRoute", + "AVS", + "AKV", + "WAF" + ], + "severity": "Low", + "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute", + "waf": "Operations" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "4b1e944a-4598-437e-b7ad-6c6d3b365a5c", - "link": "https://learn.microsoft.com/azure/synapse-analytics/cicd/source-control", - "services": [], + "checklist": "WAF checklist", + "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", + "service": "AVS", + "services": [ + "AVS", + "WAF" + ], "severity": "Low", - "subcategory": "DevOps", - "text": "Create Scripts for all DLL Statements and save in Git Repository ", - "waf": "Reliability" + "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.", + "waf": "Operations" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "7acbe48a-be54-4cd7-af2e-87768358c559", - "link": "https://learn.microsoft.com/azure/synapse-analytics/spark/apache-spark-development-using-notebooks", - "services": [], + "checklist": "WAF checklist", + "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", + "service": "AVS", + "services": [ + "WAF" + ], "severity": "Low", - "subcategory": "DevOps", - "text": "When working with Spark Notebooks, make sure to integrate with Git or Azure DevOps", - "waf": "Reliability" + "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs", + "waf": "Operations" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "775c6ee9-5b86-4ad8-a44c-e3b2b38b875b", - "link": "https://learn.microsoft.com/azure/synapse-analytics/sql-data-warehouse/backup-and-restore", - "services": [], + "checklist": "WAF checklist", + "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", + "service": "AVS", + "services": [ + "Subscriptions", + "AVS", + "WAF" + ], "severity": "Medium", - "subcategory": "High Availablity", - "text": "Use Dedicated pools", - "waf": "Reliability" + "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution", + "waf": "Performance" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "a1cf2049-9013-4a5d-9ce4-74dbcbd8682a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/analytics/azure-synapse", - "services": [], + "checklist": "WAF checklist", + "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", + "service": "AVS", + "services": [ + "Storage", + "AzurePolicy", + "WAF" + ], "severity": "Medium", - "subcategory": "DR", - "text": "Use Database restore points for Azure Synapse", - "waf": "Reliability" + "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action", + "waf": "Performance" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "6abca2a4-fda1-4dae-8dc9-5d48c6c791dc", - "link": "https://learn.microsoft.com/azure/synapse-analytics/sql/on-demand-workspace-overview", - "services": [], + "checklist": "WAF checklist", + "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", + "service": "AVS", + "services": [ + "WAF" + ], "severity": "Medium", - "subcategory": "High Availablity", - "text": "Use Serverless Pools when required", - "waf": "Reliability" + "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)", + "waf": "Performance" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "a0f6c565-89e5-458b-a37d-4974e1112dbd", - "link": "https://learn.microsoft.com/azure/synapse-analytics/quickstart-deployment-template-workspaces", + "checklist": "WAF checklist", + "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", + "service": "AVS", "services": [ - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "DevOps", - "text": "Use Infrastructure as a Code template to do repeatable deployments", - "waf": "Reliability" + "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", + "waf": "Performance" }, { - "category": "Operations Management", - "checklist": "Azure Synapse Review Checklist", - "guid": "7baf12e7-b94e-4f6e-847d-2da2982b1cd6", - "link": "https://learn.microsoft.com/azure/cosmos-db/synapse-link", - "services": [], + "checklist": "WAF checklist", + "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", + "service": "AVS", + "services": [ + "WAF" + ], "severity": "Medium", - "subcategory": "High Availablity", - "text": "Make sure to re-eshtablish any Synapse Links", - "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", - "waf": "Reliability" - }, - { - "category": "BC and DR", - "checklist": "Device Update Review", - "guid": "0e03f5ee-4648-423c-bb86-7239480f9171", - "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", - "service": "Device Update for IoT Hub", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).", - "waf": "Reliability" + "text": "Define and enforce scale in/out maximum limits for your environment in the automations", + "waf": "Performance" }, { - "category": "BC and DR", - "checklist": "Device Update Review", - "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55", - "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", - "service": "Device Update for IoT Hub", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", + "service": "AVS", + "services": [ + "Monitor", + "WAF" + ], + "severity": "Medium", + "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Device Update Review", - "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Device Update for IoT Hub", - "services": [], + "checklist": "WAF checklist", + "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", + "services": [ + "VM", + "WAF" + ], "severity": "High", - "subcategory": "High Availability", - "text": "Consider a Cross-Region DR strategy for critical workloads", + "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Device Update Review", - "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Device Update for IoT Hub", + "checklist": "WAF checklist", + "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", "services": [ - "AppSvc" + "WAF" ], "severity": "High", - "subcategory": "High Availability", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "text": "When using MON, you cannot enable MON on more than 100 Network extensions", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", + "service": "AVS", "services": [ - "FrontDoor", - "AKV" + "VPN", + "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal", - "waf": "Operations" + "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.", + "waf": "Performance" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "b71ca41b-3a80-48f3-a6cd-22cdf197c1cf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "services": [], + "checklist": "WAF checklist", + "guid": "e614658d-d457-4e92-9139-b821102cad6e", + "service": "AVS", + "services": [ + "WAF" + ], "severity": "Medium", - "subcategory": "App delivery", - "text": "Perform app delivery within landing zones for both internal-facing (corp) and external-facing apps (online).", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Security" + "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance", + "waf": "Performance" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", - "guid": "553585a6-abe0-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "App Gateway", + "checklist": "WAF checklist", + "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", + "service": "AVS", "services": [ - "AppGW" + "WAF" ], "severity": "Medium", - "subcategory": "App Gateway", - "text": "Ensure you are using Application Gateway v2 SKU", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Security" + "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", - "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Load Balancer", + "checklist": "WAF checklist", + "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "AVS", "services": [ - "LoadBalancer" + "Storage", + "AVS", + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Load Balancer", - "text": "Ensure you are using the Standard SKU for your Azure Load Balancers", - "waf": "Security" + "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "9432621a-8397-4654-a882-5bc856b7ef83", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", - "service": "Load Balancer", + "checklist": "WAF checklist", + "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "AVS", "services": [ - "LoadBalancer" + "Storage", + "ExpressRoute", + "WAF" ], "severity": "Medium", - "subcategory": "Load Balancer", - "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).", - "waf": "Security" + "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", - "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "App Gateway", + "checklist": "WAF checklist", + "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "AVS", "services": [ - "VNet", - "AppGW" + "Storage", + "ExpressRoute", + "WAF" ], "severity": "Medium", - "subcategory": "App Gateway", - "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Security" + "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.", - "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", + "checklist": "WAF checklist", + "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "AVS", "services": [ - "VNet", - "Subscriptions", - "Entra", - "NVA", - "AppGW", + "ASR", "WAF" ], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Security" + "severity": "High", + "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", + "checklist": "WAF checklist", + "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "AVS", "services": [ - "DDoS" + "WAF" ], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", - "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", - "service": "App Gateway", - "services": [], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Configure autoscaling with a minimum amount of instances of two.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "severity": "High", + "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements", "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", - "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", - "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", - "service": "App Gateway", + "checklist": "WAF checklist", + "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "AVS", "services": [ - "AppGW", - "ACR" + "ExpressRoute", + "WAF" ], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Deploy Application Gateway across Availability Zones", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "severity": "High", + "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.", "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "AVS", "services": [ - "FrontDoor", - "AzurePolicy", + "ExpressRoute", "WAF" ], - "severity": "Medium", - "subcategory": "Front Door", - "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" + "severity": "High", + "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "3f29812b-2363-4cef-b179-b599de0d5973", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "AVS", "services": [ - "FrontDoor", - "AzurePolicy", - "AppGW", "WAF" ], - "severity": "Medium", - "subcategory": "App delivery", - "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" + "severity": "High", + "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Traffic Manager", + "checklist": "WAF checklist", + "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", "services": [ - "TrafficManager" + "WAF" ], "severity": "High", - "subcategory": "Traffic Manager", - "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Select the right Function hosting plan based on your business & SLO requirements", "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", + "checklist": "WAF checklist", + "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", "services": [ - "Entra", - "AVD" + "WAF" ], - "severity": "Low", - "subcategory": "App delivery", - "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "Security" + "severity": "High", + "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", + "checklist": "WAF checklist", + "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", + "service": "Azure Functions", "services": [ - "Entra" + "WAF" ], "severity": "Medium", - "subcategory": "App delivery", - "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Security" + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "ae248989-b306-4591-9186-de482e3f0f0e", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Azure Functions", "services": [ - "FrontDoor", - "AzurePolicy", - "WAF" + "WAF", + "AppSvc" ], "severity": "High", - "subcategory": "Front Door", - "text": "Deploy your WAF policy for Front Door in 'Prevention' mode.", - "waf": "Security" + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "Azure Functions", "services": [ - "FrontDoor", - "TrafficManager" + "WAF", + "AppSvc" ], "severity": "High", - "subcategory": "Front Door", - "text": "Avoid combining Azure Traffic Manager and Azure Front Door.", - "waf": "Security" + "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", + "service": "Azure Functions", "services": [ - "FrontDoor" + "Storage", + "WAF" ], - "severity": "High", - "subcategory": "Front Door", - "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.", - "waf": "Security" + "severity": "Medium", + "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", - "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "Azure Functions", "services": [ - "FrontDoor" + "WAF" ], - "severity": "Low", - "subcategory": "Front Door", - "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.", - "waf": "Performance" + "severity": "Medium", + "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", + "service": "Bot service", "services": [ - "FrontDoor" + "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.", + "text": "Follow reliability support recommendations in Azure Bot Service", "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", - "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", + "service": "Bot service", "services": [ - "FrontDoor" + "WAF" ], - "severity": "Low", - "subcategory": "Front Door", - "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.", - "waf": "Performance" + "severity": "Medium", + "text": "Deploying bots with local data residency and regional compliance", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", - "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "Load Balancer", + "checklist": "WAF checklist", + "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", + "service": "Bot service", "services": [ - "LoadBalancer" + "WAF" ], - "severity": "High", - "subcategory": "Load Balancer", - "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability", + "severity": "Medium", + "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.", "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", - "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "service": "Spring Apps", "services": [ - "FrontDoor", - "AKV", - "Cost" + "WAF" ], - "severity": "High", - "subcategory": "Front Door", - "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.", - "waf": "Operations" + "severity": "Medium", + "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "service": "Spring Apps", "services": [ + "TrafficManager", "FrontDoor", "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", - "waf": "Operations" + "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "service": "Spring Apps", "services": [ - "FrontDoor" + "ACR", + "WAF" ], - "severity": "High", - "subcategory": "Front Door", - "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.", - "waf": "Security" + "severity": "Medium", + "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "service": "Spring Apps", "services": [ - "FrontDoor" + "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.", - "waf": "Security" + "text": "Use more than 1 app instance for your apps", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "service": "Spring Apps", "services": [ - "FrontDoor", + "Monitor", "WAF" ], - "severity": "High", - "subcategory": "Front Door", - "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.", - "waf": "Security" + "severity": "Medium", + "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "service": "Spring Apps", "services": [ - "FrontDoor", "WAF" ], - "severity": "High", - "subcategory": "Front Door", - "text": "Tune the Azure Front Door WAF for your workload. Reduce false positive detections.", - "waf": "Security" + "severity": "Medium", + "text": "Set up autoscaling in Spring Cloud Gateway", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "service": "Spring Apps", "services": [ - "FrontDoor", - "AzurePolicy", "WAF" ], - "severity": "High", - "subcategory": "Front Door", - "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.", - "waf": "Security" + "severity": "Low", + "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "service": "Spring Apps", "services": [ - "FrontDoor", "WAF" ], - "severity": "High", - "subcategory": "Front Door", - "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.", - "waf": "Security" + "severity": "Medium", + "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", - "service": "Front Door", + "checklist": "WAF checklist", + "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage", + "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", + "service": "Azure Storage", "services": [ - "FrontDoor", + "Storage", "WAF" ], - "severity": "High", - "subcategory": "Front Door", - "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.", + "severity": "Medium", + "text": "Consider the 'Azure security baseline for storage'", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", - "service": "Front Door", - "services": [ - "FrontDoor", - "WAF" + "checklist": "WAF checklist", + "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet", + "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", + "service": "Azure Storage", + "services": [ + "Storage", + "PrivateLink", + "WAF" + ], + "severity": "High", + "text": "Consider using private endpoints for Azure Storage", + "waf": "Security" + }, + { + "checklist": "WAF checklist", + "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription", + "guid": "30e37c3e-2971-41b2-963c-eee079b598de", + "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", + "service": "Azure Storage", + "services": [ + "Storage", + "RBAC", + "Subscriptions", + "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", + "text": "Ensure older storage accounts are not using 'classic deployment model'", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "b9620385-1cde-418f-914b-a84a06982ffc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", - "service": "Front Door", + "checklist": "WAF checklist", + "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.", + "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", + "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", + "service": "Azure Storage", "services": [ - "FrontDoor", + "Storage", + "Defender", + "WAF" + ], + "severity": "High", + "text": "Enable Microsoft Defender for all of your storage accounts", + "waf": "Security" + }, + { + "checklist": "WAF checklist", + "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.", + "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", + "service": "Azure Storage", + "services": [ + "Storage", "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", + "text": "Enable 'soft delete' for blobs", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", - "service": "Front Door", + "checklist": "WAF checklist", + "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", + "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", "services": [ - "FrontDoor", + "Storage", "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", + "text": "Disable 'soft delete' for blobs", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", - "service": "Front Door", + "checklist": "WAF checklist", + "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.", + "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", + "service": "Azure Storage", "services": [ - "FrontDoor" + "WAF" ], - "severity": "Low", - "subcategory": "Front Door", - "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", + "severity": "High", + "text": "Enable 'soft delete' for containers", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "00acd8a9-6975-414f-8491-2be6309893b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", - "service": "Front Door", + "checklist": "WAF checklist", + "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", + "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", "services": [ - "FrontDoor", + "Storage", "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", + "text": "Disable 'soft delete' for containers", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", - "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion", + "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", "services": [ - "AppGW", + "Storage", "WAF" ], "severity": "High", - "subcategory": "App Gateway", - "text": "Enable the Azure Application Gateway WAF bot protection rule set The bot rules detect good and bad bots.", + "text": "Enable resource locks on storage accounts", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.", + "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", + "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", + "service": "Azure Storage", "services": [ + "Storage", + "Subscriptions", "AzurePolicy", - "AppGW", "WAF" ], "severity": "High", - "subcategory": "App Gateway", - "text": "Enable request body inspection feature enabled in Azure Application Gateway WAF policy.", + "text": "Consider immutable blobs", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ", + "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Azure Storage", "services": [ - "AppGW", + "Storage", "WAF" ], "severity": "High", - "subcategory": "App Gateway", - "text": "Tune the Azure Application Gateway WAF for your workload. Reduce false positive detections.", + "text": "Require HTTPS, i.e. disable port 80 on the storage account", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.", + "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", + "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", + "service": "Azure Storage", "services": [ - "AzurePolicy", - "AppGW", + "Storage", "WAF" ], "severity": "High", - "subcategory": "App Gateway", - "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.", + "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.", + "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", + "service": "Azure Storage", "services": [ - "AppGW", + "Storage", "WAF" ], "severity": "Medium", - "subcategory": "App Gateway", - "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", + "text": "Limit shared access signature (SAS) tokens to HTTPS connections only", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "AAD tokens should be favored over shared access signatures, wherever possible", + "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", + "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", + "service": "Azure Storage", "services": [ - "AppGW", + "Storage", + "Entra", "WAF" ], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", + "severity": "High", + "text": "Use Azure Active Directory (Azure AD) tokens for blob access", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "99937189-ff78-492a-b9ca-18d828d82b37", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", - "service": "App Gateway", - "services": [], - "severity": "Low", - "subcategory": "App Gateway", - "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", + "checklist": "WAF checklist", + "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.", + "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", + "service": "Azure Storage", + "services": [ + "RBAC", + "WAF" + ], + "severity": "Medium", + "text": "Least privilege in IaM permissions", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ", + "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", + "service": "Azure Storage", "services": [ - "AppGW", + "Storage", + "Entra", "WAF" ], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", + "severity": "High", + "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ", + "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", + "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", + "service": "Azure Storage", "services": [ - "AppGW", - "WAF" + "Storage", + "Entra", + "AKV", + "WAF", + "Monitor" ], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", + "severity": "High", + "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).", + "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", + "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", + "service": "Azure Storage", "services": [ - "AppGW", - "WAF" + "Storage", + "AKV", + "WAF", + "Monitor", + "AzurePolicy" + ], + "severity": "High", + "text": "Consider using Azure Monitor to audit control plane operations on the storage account", + "waf": "Security" + }, + { + "checklist": "WAF checklist", + "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.", + "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", + "service": "Azure Storage", + "services": [ + "Storage", + "AKV", + "WAF", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "App Gateway", - "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.", - "waf": "Operations" + "text": "When using storage account keys, consider enabling a 'key expiration policy'", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "Front Door", + "checklist": "WAF checklist", + "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.", + "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", + "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", + "service": "Azure Storage", "services": [ - "FrontDoor", + "AzurePolicy", "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Add diagnostic settings to save your Azure Front Door WAF logs.", - "waf": "Operations" + "text": "Consider configuring an SAS expiration policy", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "92664c60-47e3-4591-8b1b-8d557656e686", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ", + "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", + "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", + "service": "Azure Storage", "services": [ - "Sentinel", - "AppGW", + "Storage", + "AKV", + "AzurePolicy", "WAF" ], "severity": "Medium", - "subcategory": "App Gateway", - "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.", - "waf": "Operations" + "text": "Consider linking SAS to a stored access policy", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "845f5f91-9c21-4674-a725-5ce890850e20", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "Front Door", + "checklist": "WAF checklist", + "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", + "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", + "service": "Azure Storage", "services": [ - "FrontDoor", - "Sentinel", + "Storage", + "AKV", "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.", - "waf": "Operations" + "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.", + "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", + "service": "Azure Storage", "services": [ - "AppGW", + "Storage", + "Entra", "WAF" ], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", - "waf": "Operations" + "severity": "High", + "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.", + "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", "services": [ + "Storage", "AzurePolicy", "WAF" ], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Use WAF Policies instead of the legacy WAF configuration.", - "waf": "Operations" + "severity": "High", + "text": "Strive for short validity periods for ad-hoc SAS", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.", + "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", "services": [ - "ExpressRoute", - "VNet", - "VPN", - "AppGW" + "WAF" ], "severity": "Medium", - "subcategory": "App Gateway", - "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.", + "text": "Apply a narrow scope to a SAS", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", - "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", - "service": "Front Door", + "checklist": "WAF checklist", + "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ", + "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", + "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", + "service": "Azure Storage", "services": [ - "FrontDoor" + "WAF" ], "severity": "Medium", - "subcategory": "Front Door", - "text": "Make sure your origins only take traffic from your Azure Front Door instance.", + "text": "Consider scoping SAS to a specific client IP address, wherever possible", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", - "service": "App Gateway", - "services": [], - "severity": "High", - "subcategory": "App Gateway", - "text": "You should encrypt traffic to the backend servers.", + "checklist": "WAF checklist", + "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.", + "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", + "service": "Azure Storage", + "services": [ + "Storage", + "WAF" + ], + "severity": "Low", + "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint", + "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", + "service": "Azure Storage", "services": [ + "Storage", + "Entra", + "RBAC", "WAF" ], "severity": "High", - "subcategory": "App Gateway", - "text": "You should use a Web Application Firewall.", + "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", - "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", - "service": "App Gateway", - "services": [], + "checklist": "WAF checklist", + "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", + "service": "Azure Storage", + "services": [ + "WAF" + ], "severity": "Medium", - "subcategory": "App Gateway", - "text": "Redirect HTTP to HTTPS", + "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", - "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", - "service": "App Gateway", - "services": [], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing", - "waf": "Operations" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", - "service": "App Gateway", - "services": [], + "checklist": "WAF checklist", + "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.", + "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", + "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", + "service": "Azure Storage", + "services": [ + "Storage", + "AzurePolicy", + "WAF" + ], "severity": "High", - "subcategory": "App Gateway", - "text": "Enable connection draining during planned service updates to prevent connection loss to existing membrs of the backend pool", + "text": "Avoid overly broad CORS policies", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", - "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", - "service": "App Gateway", - "services": [], - "severity": "Low", - "subcategory": "App Gateway", - "text": "Create custom error pages to display a personalized user experience", - "waf": "Operations" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", - "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", - "service": "App Gateway", - "services": [], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server", + "checklist": "WAF checklist", + "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.", + "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "Azure Storage", + "services": [ + "Storage", + "WAF" + ], + "severity": "High", + "text": "Determine how data at rest should be encrypted. Understand the thread model for data.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "App Gateway", + "checklist": "WAF checklist", + "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", + "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", + "service": "Azure Storage", "services": [ - "FrontDoor" + "WAF" ], "severity": "Medium", - "subcategory": "App Gateway", - "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover", - "waf": "Performance" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "29dcc19f-a8fa-4c35-8281-290577538793", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "App Gateway", - "services": [], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Use transport layer load balancing", - "waf": "Performance" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", - "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", - "service": "App Gateway", - "services": [], - "severity": "Medium", - "subcategory": "App Gateway", - "text": "Configure routing based on host or domain name for multiple web applications on a single gateway", + "text": "Determine which/if platform encryption should be used.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", - "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", - "service": "App Gateway", + "checklist": "WAF checklist", + "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", + "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", + "service": "Azure Storage", "services": [ - "Entra" + "WAF" ], "severity": "Medium", - "subcategory": "App Gateway", - "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm", + "text": "Determine which/if client-side encryption should be used.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Application Delivery Networking", - "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", - "service": "App Gateway", + "checklist": "WAF checklist", + "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.", + "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", + "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", + "service": "Azure Storage", "services": [ - "AppGW" + "Storage", + "WAF" ], - "severity": "Low", - "subcategory": "App Gateway", - "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols", + "severity": "High", + "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ", "waf": "Security" }, { - "category": "BC and DR", - "checklist": "Azure App Service Review", - "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", - "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal", + "service": "Azure Storage", "services": [ - "AppSvc" + "Storage", + "WAF" ], - "severity": "Low", - "subcategory": "High Availability", - "text": "Refer to baseline highly available zone-redundant web application architecture for best practices", + "severity": "High", + "text": "Leverage a storagev2 account type for better performance and reliability", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure App Service Review", - "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", - "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "e05bbe20-9d49-4fda-9777-8424d116785c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Azure Storage", "services": [ - "AppSvc", - "Backup" + "Storage", + "WAF" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.", + "severity": "High", + "text": "Leverage GRS, ZRS or GZRS storage for the highest availability", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure App Service Review", - "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", - "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "2fa56c56-ad48-4408-be72-734c486ba280", + "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance", + "service": "Azure Storage", "services": [ - "AppSvc" + "WAF" ], - "severity": "High", - "subcategory": "High Availability", - "text": "Leverage Availability Zones where regionally applicable (requires Premium v2 or v3 tier)", + "severity": "Medium", + "text": "For write operation after failover, use customer-Managed Failover ", "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure App Service Review", - "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc", + "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover", + "service": "Azure Storage", "services": [ - "AppSvc", - "Monitor" + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Implement health checks", + "text": "Understand Microsoft-Managed Failover details", "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure App Service Review", - "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal", + "service": "Azure Storage", "services": [ - "AppSvc", - "Backup" + "WAF" ], - "severity": "High", - "subcategory": "Multi-tenant service", - "text": "Refer to backup and restore best practices for Azure App Service", + "severity": "Medium", + "text": "Enable Soft Delete", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure App Service Review", - "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", - "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", "services": [ - "AppSvc" + "WAF" ], "severity": "High", - "subcategory": "High Availability", - "text": "Implement Azure App Service reliability best practices", + "text": "Enable 2 replicas to have 99.9% availability for read operations", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure App Service Review", - "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", "services": [ - "AppSvc" + "WAF" ], - "severity": "Low", - "subcategory": "High Availability", - "text": "Familiarize with how to move an App Service app to another region During a disaster", + "severity": "Medium", + "text": "Enable 3 replicas to have 99.9% availability for read/write operations", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure App Service Review", - "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", + "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", + "service": "Cognitive Search", "services": [ - "AppSvc" + "WAF" ], "severity": "High", - "subcategory": "High Availability", - "text": "Familiarize with reliability support in Azure App Service", + "text": "Leverage Availability Zones by enabling read and/or write replicas", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure App Service Review", - "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", + "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", + "service": "Cognitive Search", "services": [ - "AppSvc" + "ACR", + "WAF" ], "severity": "Medium", - "subcategory": "High Availability", - "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan", + "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions", "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure App Service Review", - "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", + "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", + "service": "Cognitive Search", "services": [ - "AppSvc", - "Monitor" + "ACR", + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Monitor App Service instances using Health checks", + "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services", "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure App Service Review", - "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", + "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", + "service": "Cognitive Search", "services": [ - "AppSvc", - "Monitor" + "TrafficManager", + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests", + "text": "Use Azure Traffic Manager to coordinate requests", "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure App Service Review", - "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", + "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", + "service": "Cognitive Search", "services": [ - "AppSvc", - "Monitor" + "Storage", + "Backup", + "WAF" ], - "severity": "Low", - "subcategory": "Monitoring", - "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website", + "severity": "High", + "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files", "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.", - "guid": "834ac932-223e-4ce8-8b12-3071a5416415", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx", + "service": "Cognitive Services", "services": [ - "AppSvc", - "AKV" + "WAF" ], - "severity": "High", - "subcategory": "Data Protection", - "text": "Use Key Vault to store secrets", - "waf": "Security" + "severity": "Medium", + "text": "Leverage FTA HandBook for Cognitive Services", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.", - "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5", + "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions", + "service": "Cognitive Services", "services": [ - "AppSvc", - "Entra", - "AKV" + "Backup", + "WAF" ], - "severity": "High", - "subcategory": "Data Protection", - "text": "Use Managed Identity to connect to Key Vault", - "waf": "Security" + "severity": "Medium", + "text": "Backup Your Prompts", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Store the App Service TLS certificate in Key Vault.", - "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5", + "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery", + "service": "Cognitive Services", "services": [ - "AppSvc", - "AKV" + "ASR", + "WAF" ], "severity": "High", - "subcategory": "Data Protection", - "text": "Use Key Vault to store TLS certificate.", - "waf": "Security" + "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Systems that process sensitive information should be isolated. To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.", - "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", - "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "325af625-ca44-4e46-a5e2-223ace8bb123", + "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations", + "service": "Cognitive Services", "services": [ - "AppSvc", - "Subscriptions" + "Backup", + "WAF" ], "severity": "Medium", - "subcategory": "Data Protection", - "text": "Isolate systems that process sensitive information", - "waf": "Security" + "text": "Backup Your ChatGPT conversations", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).", - "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618", + "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment", + "service": "Cognitive Services", "services": [ - "AppSvc", - "TrafficManager" + "WAF" ], "severity": "Medium", - "subcategory": "Data Protection", - "text": "Do not store sensitive data on local disk", - "waf": "Security" + "text": "CI/CD for custom speech", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C. Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.", - "guid": "919ca0b2-c121-459e-814b-933df574eccc", - "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "3687a046-7a1f-4893-9bda-43324f248116", + "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base", + "service": "Cognitive Services", "services": [ - "AppSvc", - "Entra" + "WAF" ], - "severity": "Medium", - "subcategory": "Identity and Access Control", - "text": "Use an established Identity Provider for authentication", - "waf": "Security" + "severity": "Low", + "text": "Move a knowledge base using export-import", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.", - "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", - "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "af416482-663c-4ed6-b195-b44c7068e09c", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support", + "service": "Container Apps", "services": [ - "AppSvc", - "Entra" + "WAF" ], "severity": "High", - "subcategory": "Identity and Access Control", - "text": "Deploy from a trusted environment", - "waf": "Security" + "text": "Leverage Availability Zones if regionally applicable", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM. This disables access to these services and enforces the use of Azure AD secured endpoints for deployment. Note that the SCM site can also be opened using Azure AD credentials.", - "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", - "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment", + "service": "Container Apps", "services": [ - "AppSvc", - "Entra" + "WAF" ], "severity": "High", - "subcategory": "Identity and Access Control", - "text": "Disable basic authentication", - "waf": "Security" + "text": "Use more than one replica and enable Zone Redundancy.", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Where possible use Managed Identity to connect to Azure AD secured resources. If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.", - "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", - "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", + "service": "Container Apps", "services": [ - "AppSvc", - "Entra", - "AKV" + "WAF" ], "severity": "High", - "subcategory": "Identity and Access Control", - "text": "Use Managed Identity to connect to resources", - "waf": "Security" + "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.", - "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", + "service": "Container Apps", "services": [ - "AppSvc", - "Entra", - "ACR" + "TrafficManager", + "FrontDoor", + "WAF" ], "severity": "High", - "subcategory": "Identity and Access Control", - "text": "Pull containers using a Managed Identity", - "waf": "Security" + "text": "Use Front Door or Traffic Manager to route traffic to the closest region", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...", - "guid": "47768314-c115-4775-a2ea-55b46ad48408", - "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx", + "service": "CosmosDB", "services": [ - "AppSvc", - "Entra", - "Monitor" + "WAF" ], "severity": "Medium", - "subcategory": "Logging and Monitoring", - "text": "Send App Service runtime logs to Log Analytics", - "waf": "Security" + "text": "FTA Resiliency Playbook", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.", - "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", + "service": "CosmosDB", "services": [ - "AppSvc", - "Entra", - "Monitor" - ], - "severity": "Medium", - "subcategory": "Logging and Monitoring", - "text": "Send App Service activity logs to Log Analytics", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's. Traffic should be routed to an NVA such as Azure Firewall. Ensure to monitor the Firewall's logs.", - "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", - "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", - "service": "App Services", - "services": [ - "VNet", - "Monitor", - "Firewall", - "AppSvc", - "NVA" - ], - "severity": "Medium", - "subcategory": "Network Security", - "text": "Outbound network access should be controlled", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall. This allows the receiving party to allow-list based on IP, should that be needed. Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead. (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)", - "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", - "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", - "service": "App Services", - "services": [ - "VNet", - "Firewall", - "PrivateLink", - "Storage", - "AppSvc", - "NVA" - ], - "severity": "Low", - "subcategory": "Network Security", - "text": "Ensure a stable IP for outbound communications towards internet addresses", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.", - "guid": "0725769e-e669-41a4-a34a-c932223ece80", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", - "services": [ - "AppSvc", - "PrivateLink" - ], - "severity": "High", - "subcategory": "Network Security", - "text": "Inbound network access should be controlled", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door. Make sure to monitor the WAF's logs.", - "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", - "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", - "service": "App Services", - "services": [ - "Monitor", - "FrontDoor", - "AppSvc", - "AppGW", "WAF" ], "severity": "High", - "subcategory": "Network Security", - "text": "Use a WAF in front of App Service", - "waf": "Security" + "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF. Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.", - "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", + "checklist": "WAF checklist", + "guid": "0d934a34-8b26-43e7-bd60-513a3649906e", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages", + "service": "CosmosDB", "services": [ - "AppSvc", - "PrivateLink", "WAF" ], - "severity": "High", - "subcategory": "Network Security", - "text": "Avoid for WAF to be bypassed", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Set minimum TLS policy to 1.2 in App Service configuration.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", - "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", - "service": "App Services", - "services": [ - "AppSvc", - "AzurePolicy" - ], "severity": "Medium", - "subcategory": "Network Security", - "text": "Set minimum TLS policy to 1.2", - "waf": "Security" + "text": "Run multiple replicas of the database (>1 ) in Prod", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Configure App Service to use HTTPS only. This causes App Service to redirect from HTTP to HTTPS. Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.", - "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", - "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", - "service": "App Services", + "checklist": "WAF checklist", + "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe", + "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions", + "service": "CosmosDB", "services": [ - "AppSvc", + "ACR", "WAF" ], - "severity": "High", - "subcategory": "Network Security", - "text": "Use HTTPS only", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.", - "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", - "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", - "service": "App Services", - "services": [ - "AppSvc", - "Storage" - ], - "severity": "High", - "subcategory": "Network Security", - "text": "Wildcards must not be used for CORS", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", - "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", - "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", - "service": "App Services", - "services": [ - "AppSvc" - ], - "severity": "High", - "subcategory": "Network Security", - "text": "Turn off remote debugging", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.", - "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", - "service": "App Services", - "services": [ - "AppSvc", - "Defender" - ], "severity": "Medium", - "subcategory": "Network Security", - "text": "Enable Defender for Cloud - Defender for App Service", - "waf": "Security" + "text": "Leverage Multi-Region Writes", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.", - "guid": "223ece80-b123-4071-a541-6415833ea3ad", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "App Services", + "checklist": "WAF checklist", + "description": "Span Cosmos account across two or more regions with multi-region writes", + "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", + "service": "CosmosDB", "services": [ - "EventHubs", - "VNet", - "DDoS", - "AppSvc", - "NVA", - "AppGW", + "ACR", "WAF" ], "severity": "Medium", - "subcategory": "Network Security", - "text": "Enable DDOS Protection Standard on the WAF VNet", - "waf": "Security" + "text": "Distribute your data globally", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.", - "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", - "service": "App Services", + "checklist": "WAF checklist", + "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong", + "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0", + "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels", + "service": "CosmosDB", "services": [ - "AppSvc", - "PrivateLink", - "VNet", - "ACR" + "WAF" ], - "severity": "Medium", - "subcategory": "Network Security", - "text": "Pull containers over a Virtual Network", - "waf": "Security" + "severity": "High", + "text": "Choose from several well-defined consistency models", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.", - "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", - "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", - "service": "App Services", + "checklist": "WAF checklist", + "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.", + "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe", + "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover", + "service": "CosmosDB", "services": [ - "AppSvc" + "CosmosDB", + "WAF" ], "severity": "Medium", - "subcategory": "Penetration Testing", - "text": "Conduct a penetration test", - "waf": "Security" + "text": "Enable Service managed failover", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", - "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", - "service": "App Services", + "checklist": "WAF checklist", + "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.", + "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90", + "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore", + "service": "CosmosDB", "services": [ - "AppSvc" + "Storage", + "Backup", + "WAF", + "CosmosDB" ], "severity": "Medium", - "subcategory": "Vulnerability Management", - "text": "Deploy validated code", - "waf": "Security" + "text": "Enable Automatic Backups", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure App Service Review", - "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", - "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", - "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", - "service": "App Services", + "checklist": "WAF checklist", + "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.", + "guid": "a6eb33f6-005c-4d92-9286-7655672d6121", + "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction", + "service": "CosmosDB", "services": [ - "AppSvc" + "Backup", + "WAF" ], - "severity": "High", - "subcategory": "Vulnerability Management", - "text": "Use up-to-date platforms, languages, protocols and frameworks", - "waf": "Security" - }, - { - "category": "Operations Management", - "checklist": "Stream Analytics Review Checklist", - "guid": "32e52e36-11c8-418b-8a0b-c511e43a18a9", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-stream_analytics_v1.docx", - "services": [], - "severity": "High", - "subcategory": "High Availablity ", - "text": "Leverage FTA Resiliency Handbook for Stream Analytics", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Stream Analytics Review Checklist", - "description": "Azure Stream Analytics provides high availability (99.9% SLA) for jobs and clusters within a region, the details of which are transparent to the end customer. If failures occur within the service, per the documentation �Azure Stream Analytics guarantees exactly once event processing and at-least-once delivery of events, so events are never lost.�", - "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a", - "link": "https://azure.microsoft.com/en-in/products/stream-analytics", - "services": [], - "severity": "Medium", - "subcategory": "High Availablity ", - "text": "Understand High Availability 99% SLA and use it to plan your DR strategy", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Stream Analytics Review Checklist", - "description": "Azure Stream Analytics resources (jobs, clusters, etc.) are regional and do not provide automatic geo-failover. However, you can achieve geo-redundancy by deploying identical Stream Analytics jobs in multiple Azure regions. Each job connects to local input and output sources. It is the responsibility of your application to both send input data into the two regional inputs and reconcile between the two regional outputs.", - "guid": "fc833934-8b26-42d6-ac5f-512925498e6d", - "link": "https://learn.microsoft.com/azure/stream-analytics/geo-redundancy", - "services": [], "severity": "Medium", - "subcategory": "Geo Redundancy", - "text": "Plan for Geo Redudancy of the service", + "text": "Perform Periodic Backups", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "Reliability" }, { - "category": "Operations Management", - "checklist": "Stream Analytics Review Checklist", - "guid": "b9d37dac-43bc-46cd-8d7a-a9b24604489a", - "link": "https://learn.microsoft.com/azure/stream-analytics/geo-redundancy", - "services": [], + "checklist": "WAF checklist", + "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.", + "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1", + "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction", + "service": "CosmosDB", + "services": [ + "CosmosDB", + "WAF", + "Backup" + ], "severity": "Medium", - "subcategory": "Geo Redundancy", - "text": "Depending on your availablity requirement, configure Active/Active configuration or Active/Passive configuration ", + "text": "Continous Backup with point-in-time restore in Azure Cosmos DB", + "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", "waf": "Reliability" }, { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", + "checklist": "WAF checklist", "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", "service": "Azure Monitor", "services": [ - "Cost", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", - "subcategory": "Azure Monitor - enforce data collection rules", "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", "training": "https://azure.microsoft.com/pricing/reservations/", "waf": "Cost" }, { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", + "checklist": "WAF checklist", "guid": "45901365-d38e-443f-abcb-d868266abca2", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", "service": "Azure Backup", "services": [ - "Cost", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", - "subcategory": "Backup", "text": "check backup instances with the underlying datasource not found", "waf": "Cost" }, { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", + "checklist": "WAF checklist", "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", "service": "VM", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Delete/archive", "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)", "waf": "Cost" }, { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", - "guid": "659d3958-fd77-4289-a835-556df2bfe456", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "services": [ - "Cost" - ], - "severity": "Medium", - "subcategory": "Delete/archive", - "text": "Consider snooze and stop technique (snooze a service after x days, stop after 2x, delete/deallocate after 3x)", - "waf": "Cost" - }, - { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", - "guid": "3b0d834a-3487-426d-b69c-6b5c2a26494b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "services": [ - "Cost", - "Storage", - "Backup" - ], - "severity": "Medium", - "subcategory": "Delete/archive", - "text": "Delete or archive unused resources (old backups, logs, storage accounts, etc...)", - "waf": "Cost" - }, - { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", + "checklist": "WAF checklist", "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "service": "Azure Backup", "services": [ - "ASR", - "Cost", "Storage", - "Backup" + "ASR", + "Backup", + "WAF" ], "severity": "Medium", - "subcategory": "Delete/archive", "text": "Consider a good balance between site recovery storage and backup for non mission critical applications", "waf": "Cost" }, { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", + "checklist": "WAF checklist", "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", "service": "Azure Monitor", "services": [ - "Cost", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", - "subcategory": "Log Analytics retention for workspaces", "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", "waf": "Cost" }, { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", + "checklist": "WAF checklist", "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "service": "Azure Monitor", "services": [ - "Cost", + "Storage", "AzurePolicy", - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "Policy", "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)", "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", "waf": "Cost" }, { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", - "guid": "59bb91a3-ed90-4cae-8cc8-4c37b6b780cb", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "services": [ - "Cost" - ], - "severity": "Medium", - "subcategory": "Run orphaned resources workbook - delete or snooze ghost items", - "text": "https://github.com/dolevshor/azure-orphan-resources", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets", - "waf": "Cost" - }, - { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", - "guid": "9fe5c464-89d4-457a-a27c-3874d0102cac", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "services": [ - "Cost" - ], - "severity": "Medium", - "subcategory": "Shutdown/deallocate", - "text": "Shutdown underutilized instances", - "training": "https://learn.microsoft.com/azure/cost-management-billing/understand/analyze-unexpected-charges", - "waf": "Cost" - }, - { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", + "checklist": "WAF checklist", "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "service": "VM", "services": [ - "Cost", - "VM", "Storage", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", - "subcategory": "stopped/deallocated VMs: check disks", "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -", "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", "waf": "Cost" }, { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", + "checklist": "WAF checklist", "guid": "d1e44a19-659d-4395-afd7-7289b835556d", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "service": "Storage", "services": [ - "Cost", + "Storage", "AzurePolicy", - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "storage accounts lifecycle policy", "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", "waf": "Cost" }, { - "category": "Cleanup", - "checklist": "Cost Optimization Checklist", - "guid": "f2bfe456-3b0d-4834-a348-726de69c6b5c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "checklist": "WAF checklist", + "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "VM", "services": [ - "Cost" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Tagging", - "text": "Use specific tags for temporary items with 'delete by DATE' format - and automate monthly cleanup", + "text": "Make sure advisor is configured for VM right sizing ", "waf": "Cost" }, { - "category": "DB/App tuning", - "checklist": "Cost Optimization Checklist", - "guid": "2a26494b-69ba-4d37-aad5-3cc78e1d7666", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice", + "checklist": "WAF checklist", + "description": "check by searching the Meter Category Licenses in the Cost analysys", + "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", + "service": "VM", "services": [ + "VM", + "AzurePolicy", + "WAF", "Cost" ], "severity": "Medium", - "subcategory": "DB optimization", - "text": "Plan for db optimization with the intent of downsizing the related services (and improve performance)", + "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently", "waf": "Cost" }, { - "category": "DB/APP tuning", - "checklist": "Cost Optimization Checklist", - "guid": "7357c449-674b-45ed-a5a8-59c7733be2a1", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "checklist": "WAF checklist", + "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "VM", "services": [ - "Cost" + "LoadBalancer", + "WAF" ], "severity": "Medium", - "subcategory": "App modernization", - "text": "Modernizing the app towards a microservices architecture will have the effect of letting the app scale according to the single service and not the entire stack", + "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", "waf": "Cost" }, { - "category": "DB/APP tuning", - "checklist": "Cost Optimization Checklist", - "guid": "a27b765a-91be-41f3-a8ef-394c2bd463cb", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "checklist": "WAF checklist", + "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "VM", "services": [ - "Cost", "VM", - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "DB optimization", - "text": "optimizing the DB queries will increase performance and allow better right-sizing of storage and VMs", + "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)", + "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", "waf": "Cost" }, { - "category": "DB/APP tuning", - "checklist": "Cost Optimization Checklist", - "guid": "bac75819-59bb-491a-9ed9-0cae2cc84c37", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "checklist": "WAF checklist", + "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", + "service": "VM", "services": [ + "ARS", + "VM", + "WAF", "Cost" ], "severity": "Medium", - "subcategory": "Demand shaping", - "text": "Using demand shaping on PaaS services will optimize costs and performances", + "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "b6b780cb-9fe5-4c46-989d-457a927c3874", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging", + "checklist": "WAF checklist", + "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "VM", "services": [ - "Entra", - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Advisor", - "text": "Start from the Azure Advisor page suggestions.", + "text": "Only larger disks can be reserved => 1 TiB -", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "checklist": "WAF checklist", + "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", "service": "VM", "services": [ - "Cost", - "VM" + "WAF" ], "severity": "Medium", - "subcategory": "Advisor", - "text": "Make sure advisor is configured for VM right sizing ", + "text": "After the right-sizing optimization", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "881a1bd5-d1e4-44a1-a659-d3958fd77289", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "checklist": "WAF checklist", + "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Azure SQL", "services": [ + "SQL", + "AzurePolicy", + "WAF", "Cost" ], "severity": "Medium", - "subcategory": "Automation", - "text": "Consider implementing IaC scripts or devops pipelines to match the cost governance process", + "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "b835556d-f2bf-4e45-93b0-d834a348726d", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "checklist": "WAF checklist", + "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "VM", "services": [ - "Cost", - "Monitor" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Automation", - "text": "Set up cost alerts for applications that have variable costs (ideally for all of them)", + "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "e69c6b5c-2a26-4494-a69b-ad37aad53cc7", - "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", + "checklist": "WAF checklist", + "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "VM", "services": [ - "Cost" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Automation", - "text": "Use Azure Automation: Automate repetitive tasks can help you save time and resources, reducing costs in the process. ", + "text": "Consider using a VMSS to match demand rather than flat sizing", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "8e1d7666-7357-4c44-a674-b5ed85a859c7", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "WAF checklist", + "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "AKS", "services": [ - "Cost" + "AKS", + "WAF" ], "severity": "Medium", - "subcategory": "Automation", - "text": "Run orphaned resources workbook", + "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "733be2a1-a27b-4765-a91b-e1f388ef394c", - "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", + "checklist": "WAF checklist", + "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Azure Backup", "services": [ - "Cost", - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "Baseline", - "text": "Try and establish a baseline of monthly spending and an acceptable saving target against the baseline (new services will not be optimized at this stage)", + "text": "Move recovery points to vault-archive where applicable (Validate)", + "training": "https://azure.microsoft.com/pricing/reservations/", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "2bd463cb-bac7-4581-a59b-b91a3ed90cae", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "checklist": "WAF checklist", + "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", + "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", + "service": "Databricks", "services": [ - "Cost", - "AzurePolicy" + "LoadBalancer", + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Baseline", - "text": "Establish a cost optimization baseline by using a policy that tags every new resource as #NEW", + "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "2cc84c37-b6b7-480c-a9fe-5c46489d457a", - "link": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management-config", + "checklist": "WAF checklist", + "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", + "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", + "service": "Azure Functions", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Baseline", - "text": "Organize resources to maximize cost insights and accountability", + "text": "Functions - Reuse connections", + "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "927c3874-d010-42ca-a6aa-e01e6a84de5d", - "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json", + "checklist": "WAF checklist", + "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "service": "Azure Functions", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Budgets", - "text": "Create budgets", + "text": "Functions - Cache data locally", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "e36d1d92-881a-41bd-9d1e-44a19659d395", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator", + "checklist": "WAF checklist", + "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Azure Functions", "services": [ - "Cost" + "Storage", + "WAF" ], "severity": "Medium", - "subcategory": "Cost Analysis", - "text": "In cost analysis - use daily granularity, grouped by service name to analyze the spending of the past 3 months and identify the top 3 spenders", + "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "8fd77289-b835-4556-bf2b-fe4563b0d834", - "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server", + "checklist": "WAF checklist", + "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "Azure Functions", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Cost Analysis", - "text": "Check daily for cost spikes and anomalies (ideally with automatic billing exports)", + "text": "Functions - Keep your functions warm", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "a348726d-e69c-46b5-a2a2-6494b69bad37", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "checklist": "WAF checklist", + "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Azure Functions", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Cost Analysis", - "text": "Automate cost retrieval for deep analysis or integration", + "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "aad53cc7-8e1d-4766-9735-7c449674b5ed", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", + "checklist": "WAF checklist", + "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", + "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", + "service": "Azure Functions", "services": [ - "Cost", - "ACR" + "WAF" ], "severity": "Medium", - "subcategory": "Free services", - "text": "Take advantage of Azure free services: Azure offers a number of free services, such as DevOps, Azure Container Registry, and Azure Logic Apps, that can help you save costs on development and operations. ", + "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "96c96ad8-844c-4f3b-8b38-c886ba2c0214", - "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", + "checklist": "WAF checklist", + "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", + "service": "Azure Functions", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Tagging", - "text": "Tag shared resources", + "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", "waf": "Cost" }, { - "category": "Process Administration", - "checklist": "Cost Optimization Checklist", - "guid": "99014a5d-3ce5-474d-acbd-9792a6bcca2b", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", + "checklist": "WAF checklist", + "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Front Door", "services": [ - "Cost" + "EventHubs", + "FrontDoor", + "WAF" ], "severity": "Medium", - "subcategory": "Tagging", - "text": "Consider using tags to all services for cost allocation", + "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.", "waf": "Cost" }, { - "category": "reservations", - "checklist": "Cost Optimization Checklist", - "guid": "4fea1dbf-3dd9-45d4-ac7c-891dcb1f7d57", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", + "checklist": "WAF checklist", + "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Front Door", "services": [ - "Cost" + "FrontDoor", + "WAF", + "AppSvc" ], "severity": "Medium", - "subcategory": "automation", - "text": "Consider Reservation automation to track and promptly react to changes", + "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "description": "check by searching the Meter Category Licenses in the Cost analysys", - "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", - "service": "VM", + "checklist": "WAF checklist", + "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", + "service": "Storage", "services": [ - "SQL", - "Cost", - "VM", - "AzurePolicy" + "WAF" ], "severity": "Medium", - "subcategory": "check AHUB is applied to all Windows VMs, RHEL and SQL", - "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently", + "text": "Consider archiving tiers for less used data", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "checklist": "WAF checklist", + "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", "service": "VM", "services": [ - "Cost", - "LoadBalancer" + "WAF" ], "severity": "Medium", - "subcategory": "Check Red Hat Licences if applicable", - "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", + "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "a76af4a6-91e8-4839-ada4-6667e13c1056", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", + "checklist": "WAF checklist", + "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "Storage", "services": [ - "AppSvc", - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Functions", - "text": "Saving plans will provide 17% on select app service plans", + "text": "Consider using standard SSD rather than Premium or Ultra where possible", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "VM", + "checklist": "WAF checklist", + "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "Storage", "services": [ - "Cost", - "VM" + "Storage", + "WAF" ], "severity": "Medium", - "subcategory": "Planning", - "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)", - "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", + "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", - "service": "VM", + "checklist": "WAF checklist", + "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "Site Recovery", "services": [ - "Cost", - "ARS", - "VM" + "ASR", + "WAF" ], "severity": "Medium", - "subcategory": "Reservations/savings plans", - "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.", + "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "a785c6fe-96c9-46ad-a844-cf3b2b38c886", - "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/", + "checklist": "WAF checklist", + "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", + "service": "Storage", "services": [ - "Cost" + "Storage", + "WAF" ], "severity": "Medium", - "subcategory": "Reservations/savings plans", - "text": "Plan for Azure Savings Plans for all the workloads that are dynamic and need maximum flexibility", + "text": "Storage accounts: check hot tier and/or GRS necessary", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "ba2c0214-9901-44a5-b3ce-574dccbd9792", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "checklist": "WAF checklist", + "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "VM", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Reservations/savings plans", - "text": "Plan for Azure Reservations for all the workloads that are less dynamic and won't change much", + "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "VM", + "checklist": "WAF checklist", + "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "Synapse", "services": [ + "EventHubs", + "Monitor", "Cost", - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "Reserve storage", - "text": "Only larger disks can be reserved => 1 TiB -", + "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", - "service": "VM", + "checklist": "WAF checklist", + "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "Synapse", "services": [ + "Storage", "Cost", - "VM" + "WAF" ], "severity": "Medium", - "subcategory": "Reserve VMs with normalized and rationalized sizes", - "text": "After the right-sizing optimization", + "text": "Export cost data to a storage account for additional data analysis.", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Azure SQL", + "checklist": "WAF checklist", + "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Synapse", "services": [ "Cost", - "SQL", - "AzurePolicy" + "WAF", + "SQL" ], "severity": "Medium", - "subcategory": "SQL Database AHUB", - "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", + "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "VM", + "checklist": "WAF checklist", + "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", + "service": "Synapse", "services": [ - "SQL", - "Cost", - "VM" + "WAF" ], "severity": "Medium", - "subcategory": "SQL Database Reservations", - "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount", + "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "e13c1056-75c1-4e94-9b45-9837ff7ae7c6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#managed-identities", + "checklist": "WAF checklist", + "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Synapse", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Tracking", - "text": "Make sure you Azure Reservations and Savings plans are close to 100% utilization or make the necessary changes to reach it.", + "text": "Create multiple Apache Spark pool definitions of various sizes.", "waf": "Cost" }, { - "category": "Reservations", - "checklist": "Cost Optimization Checklist", - "guid": "d3b475a5-c7ac-4be4-abbe-64dd89f2e877", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations", + "checklist": "WAF checklist", + "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "service": "Synapse", "services": [ "Cost", - "AzurePolicy" + "WAF" ], "severity": "Medium", - "subcategory": "Tracking", - "text": "Make sure that your reservations usage is close to 100%. If not, either enforce an allowed SKU policy or exchange the reservation", + "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Cost" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "78468d55-a785-4c6f-b96c-96ad8844cf3b", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review", + "checklist": "WAF checklist", + "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "VM", "services": [ - "Cost", - "AzurePolicy" + "VM", + "WAF", + "Cost" ], "severity": "Medium", - "subcategory": "Automation", - "text": "Plan and enforce a On/Off policy for production services, where possible", + "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Cost" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "2b38c886-ba2c-4021-9990-14a5d3ce574d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "checklist": "WAF checklist", + "guid": "544451e1-92d3-4442-a3c7-628637a551c5", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", "services": [ - "Cost", - "AzurePolicy" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Automation", - "text": "Plan and enforce a On-Demand policy with auto-shutdown for non-production services, where possible", + "text": "Right-sizing all VMs", "waf": "Cost" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "checklist": "WAF checklist", + "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", "service": "VM", "services": [ - "Cost", - "VM" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Autoscale", - "text": "Consider using a VMSS to match demand rather than flat sizing", + "text": "Swap VM sized with normalized and most recent sizes", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Cost" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", "services": [ - "AKS", - "Cost" - ], + "Monitor", + "VM", + "WAF" + ], "severity": "Medium", - "subcategory": "Autoscale", - "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)", + "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Cost" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "93665720-2bff-4456-9b0d-934a359c363e", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "checklist": "WAF checklist", + "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", "services": [ - "Cost" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Autoscale", - "text": "Right-size PaaS service according to average use and accomodate spikes with auto or manual scaling", + "text": "Containerizing an application can improve VM density and save money on scaling it", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Cost" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "7dd61623-a364-4a90-9eba-e38ead53cc7d", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "checklist": "WAF checklist", + "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", + "service": "IoT Hub DPS", "services": [ - "Cost" + "WAF" ], - "severity": "Medium", - "subcategory": "Autoscale", - "text": "Plan for demand shaping where applicable", - "waf": "Cost" + "severity": "High", + "text": "Select the right Logic App hosting plan based on your business & SLO requirements", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "e2e8aaab-3571-4549-ab91-53d89f89dc7b", + "checklist": "WAF checklist", + "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "IoT Hub DPS", "services": [ - "Cost" + "WAF" ], - "severity": "Medium", - "subcategory": "Autoscale", - "text": "Consider implementing a service re-scaling logic within the application", - "training": "https://learn.microsoft.com/azure/cost-management-billing/savings-plan/", - "waf": "Cost" + "severity": "High", + "text": "Protect logic apps from region failures with zone redundancy and availability zones", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Azure Backup", + "checklist": "WAF checklist", + "guid": "8aed4fbf-0830-4883-899d-222a154af478", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "IoT Hub DPS", "services": [ - "Cost", - "Backup" + "WAF" ], - "severity": "Medium", - "subcategory": "Backup", - "text": "Move recovery points to vault-archive where applicable (Validate)", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "Cost" + "severity": "High", + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", - "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", - "service": "Databricks", + "checklist": "WAF checklist", + "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "IoT Hub DPS", "services": [ - "Cost", - "VM", - "LoadBalancer" + "WAF", + "AppSvc" ], - "severity": "Medium", - "subcategory": "Databricks", - "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.", - "waf": "Cost" + "severity": "High", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", - "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", - "service": "Azure Functions", + "checklist": "WAF checklist", + "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "IoT Hub DPS", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Functions", - "text": "Functions - Reuse connections", - "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", - "waf": "Cost" + "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", + "waf": "Operations" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview", - "service": "Azure Functions", + "checklist": "WAF checklist", + "guid": "0e03f5ee-4648-423c-bb86-7239480f9171", + "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", + "service": "Device Update for IoT Hub", "services": [ - "Cost" + "WAF" ], - "severity": "Medium", - "subcategory": "Functions", - "text": "Functions - Cache data locally", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", - "waf": "Cost" + "severity": "High", + "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Azure Functions", + "checklist": "WAF checklist", + "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55", + "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", + "service": "Device Update for IoT Hub", "services": [ - "Cost", - "Storage" + "WAF" ], - "severity": "Medium", - "subcategory": "Functions", - "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "Cost" + "severity": "High", + "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "Azure Functions", + "checklist": "WAF checklist", + "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Device Update for IoT Hub", "services": [ - "Cost" + "WAF" ], - "severity": "Medium", - "subcategory": "Functions", - "text": "Functions - Keep your functions warm", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Cost" + "severity": "High", + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Azure Functions", + "checklist": "WAF checklist", + "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Device Update for IoT Hub", "services": [ - "Cost" + "WAF", + "AppSvc" ], - "severity": "Medium", - "subcategory": "Functions", - "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)", - "waf": "Cost" + "severity": "High", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", - "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", - "service": "Azure Functions", + "checklist": "WAF checklist", + "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", + "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", + "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", + "service": "Event Hubs", "services": [ - "Cost" + "EventHubs", + "WAF" ], - "severity": "Medium", - "subcategory": "Functions", - "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.", - "waf": "Cost" + "severity": "Low", + "text": "Use customer-managed key option in data at rest encryption when required", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "Security" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", - "service": "Azure Functions", + "checklist": "WAF checklist", + "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ", + "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", + "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", + "service": "Event Hubs", "services": [ - "Cost" + "EventHubs", + "WAF" ], "severity": "Medium", - "subcategory": "Functions", - "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", - "waf": "Cost" + "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "Security" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "df03a822-cd46-43cb-abc8-ac299ebc91a4", - "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", + "checklist": "WAF checklist", + "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", + "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", + "service": "Event Hubs", "services": [ - "Cost" + "Entra", + "TrafficManager", + "RBAC", + "EventHubs", + "WAF", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Evaluate your network topology against networking costs and where applicable reduce the egress and peering data", - "waf": "Cost" + "text": "Avoid using root account when it is not necessary", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", + "waf": "Security" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Front Door", + "checklist": "WAF checklist", + "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ", + "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", + "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", + "service": "Event Hubs", "services": [ + "Storage", + "Entra", "EventHubs", - "Cost", - "FrontDoor" + "AKV", + "WAF", + "VM" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.", - "waf": "Cost" + "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Security" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Front Door", + "checklist": "WAF checklist", + "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.", + "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", + "service": "Event Hubs", "services": [ - "AppSvc", - "Cost", - "FrontDoor" + "EventHubs", + "RBAC", + "WAF" ], - "severity": "Medium", - "subcategory": "Networking", - "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.", - "waf": "Cost" + "severity": "High", + "text": "Use least privilege data plane RBAC", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "Security" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "f843e52f-4722-4d92-ac1b-1cd521e54a29", - "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview", + "checklist": "WAF checklist", + "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.", + "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", + "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", + "service": "Event Hubs", "services": [ - "Cost" + "EventHubs", + "VNet", + "Monitor", + "WAF" ], "severity": "Medium", - "subcategory": "PaaS", - "text": "Consider using free tiers where applicable for all non-production environments", - "waf": "Cost" + "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "Security" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "b9de39ac-0e7c-428d-a936-657202bff456", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", + "checklist": "WAF checklist", + "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", + "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", + "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", + "service": "Event Hubs", "services": [ - "Cost" + "EventHubs", + "VNet", + "PrivateLink", + "WAF" ], "severity": "Medium", - "subcategory": "Serverless", - "text": "Using serverless patterns for spikes can help keeping costs down", - "waf": "Cost" + "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Security" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", - "service": "Storage", + "checklist": "WAF checklist", + "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", + "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", + "service": "Event Hubs", "services": [ - "Cost", - "Storage" + "EventHubs", + "WAF" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Consider archiving tiers for less used data", - "waf": "Cost" + "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Security" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "VM", + "checklist": "WAF checklist", + "guid": "31d41e36-11c8-417b-8afb-c410d4391898", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", + "service": "Event Hubs", "services": [ - "Cost", - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing", - "waf": "Cost" + "text": "Leverage FTA Resillency HandBook", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "Storage", + "checklist": "WAF checklist", + "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones", + "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", + "service": "Event Hubs", "services": [ - "Cost", - "Storage" + "EventHubs", + "ACR", + "WAF" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "Consider using standard SSD rather than Premium or Ultra where possible", - "waf": "Cost" + "severity": "High", + "text": "Leverage Availability Zones if regionally applicable", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "Storage", + "checklist": "WAF checklist", + "guid": "20b56c56-ad58-4519-8f82-735c586bb281", + "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", + "service": "Event Hubs", "services": [ - "Cost", - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "Storage", - "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)", - "waf": "Cost" + "text": "Use the Premium or Dedicated SKUs for predicable performance", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "Site Recovery", + "checklist": "WAF checklist", + "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations", + "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", + "service": "Event Hubs", "services": [ - "Cost", - "Storage", - "ASR" + "ASR", + "WAF", + "EventHubs" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it", - "waf": "Cost" + "severity": "High", + "text": "Plan for Geo Disaster Recovery using Active Passive configuration", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", - "service": "Storage", + "checklist": "WAF checklist", + "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs", + "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", + "service": "Event Hubs", "services": [ - "Cost", - "Storage" + "EventHubs", + "ASR", + "WAF" ], "severity": "Medium", - "subcategory": "storage", - "text": "Storage accounts: check hot tier and/or GRS necessary", - "waf": "Cost" + "text": "For Business Critical Applications, use Active Active configuration", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "VM", + "checklist": "WAF checklist", + "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", + "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", + "service": "Event Hubs", "services": [ - "Cost", - "Storage" + "EventHubs", + "WAF" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ", - "waf": "Cost" + "text": "Design Resilient Event Hubs", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "Synapse", + "checklist": "WAF checklist", + "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", + "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", + "service": "Entra", "services": [ - "EventHubs", - "Cost", - "Monitor" + "Entra", + "WAF" ], "severity": "Medium", - "subcategory": "Synapse", - "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.", - "waf": "Cost" + "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "Synapse", + "checklist": "WAF checklist", + "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", + "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", + "service": "AAD B2C", "services": [ - "Cost", - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "Synapse", - "text": "Export cost data to a storage account for additional data analysis.", - "waf": "Cost" + "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Synapse", + "checklist": "WAF checklist", + "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", + "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", + "service": "AAD B2C", "services": [ - "Cost", - "SQL" + "WAF" ], "severity": "Medium", - "subcategory": "Synapse", - "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.", - "waf": "Cost" + "text": "Custom brand assets should be hosted on a CDN", + "waf": "Performance" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", - "service": "Synapse", + "checklist": "WAF checklist", + "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", + "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", + "service": "AAD B2C", "services": [ - "Cost" + "WAF" ], - "severity": "Medium", - "subcategory": "Synapse", - "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.", - "waf": "Cost" + "severity": "Low", + "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Synapse", + "checklist": "WAF checklist", + "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "services": [ - "Cost" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Synapse", - "text": "Create multiple Apache Spark pool definitions of various sizes.", - "waf": "Cost" + "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "service": "Synapse", + "checklist": "WAF checklist", + "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "services": [ - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Synapse", - "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "text": "Don't replicate! Replication can create issues with directory synchronization", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "VM", + "checklist": "WAF checklist", + "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "services": [ - "Cost", - "VM" + "WAF" ], "severity": "Medium", - "subcategory": "VM", - "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "text": "Have active-active for multi-regions", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "544451e1-92d3-4442-a3c7-628637a551c5", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", + "checklist": "WAF checklist", + "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "services": [ - "Cost", - "VM" + "Entra", + "WAF" ], "severity": "Medium", - "subcategory": "VM", - "text": "Right-sizing all VMs", - "waf": "Cost" + "text": "Add Azure AD Domain service stamps to additional regions and locations", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "VM", + "checklist": "WAF checklist", + "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "services": [ - "Cost", - "VM" + "WAF" ], "severity": "Medium", - "subcategory": "VM", - "text": "Swap VM sized with normalized and most recent sizes", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "text": "Use Replica Sets for DR", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", + "checklist": "WAF checklist", + "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", + "service": "IoT", "services": [ - "Cost", - "VM", - "Monitor" + "WAF" ], - "severity": "Medium", - "subcategory": "VM", - "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "severity": "High", + "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)", + "waf": "Reliability" }, { - "category": "Right-sizing", - "checklist": "Cost Optimization Checklist", - "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", + "checklist": "WAF checklist", + "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", "services": [ - "Cost", - "VM" + "WAF" ], "severity": "Medium", - "subcategory": "VM", - "text": "Containerizing an application can improve VM density and save money on scaling it", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Cost" + "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.", + "waf": "Reliability" }, { - "category": "Operations Management", - "checklist": "PostgreSQL Review Checklist", - "guid": "65285269-441c-44bf-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview", - "service": "PostgreSQL", + "checklist": "WAF checklist", + "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", + "service": "IoT", "services": [ - "SQL" + "WAF" ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Leverage Flexible Server", + "severity": "High", + "text": "Consider a Cross-Region DR strategy for critical workloads", "waf": "Reliability" }, { - "category": "Operations Management", - "checklist": "PostgreSQL Review Checklist", - "guid": "016ccf31-ae5a-41eb-9888-9535e227896d", - "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability", - "service": "PostgreSQL", + "checklist": "WAF checklist", + "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", "services": [ - "SQL" + "WAF" ], "severity": "High", - "subcategory": "Best Practices", - "text": "Leverage Availability Zones where regionally applicable", + "text": "Learn how to trigger a manual failover.", "waf": "Reliability" }, { - "category": "Operations Management", - "checklist": "PostgreSQL Review Checklist", - "guid": "31b67c67-be59-4519-8083-845d587cb391", - "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas", - "service": "PostgreSQL", + "checklist": "WAF checklist", + "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", + "service": "IoT", "services": [ - "SQL" + "WAF" ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Leverage cross-region read replicas for BCDR", + "severity": "High", + "text": "Learn how to fail back after a failover.", "waf": "Reliability" }, { - "category": "Application Deployment", - "checklist": "The AKS Checklist", - "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks", + "checklist": "WAF checklist", + "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "AKS" + "AKV", + "WAF", + "Backup" ], - "severity": "Medium", - "subcategory": "Development", - "text": "Use canary or blue/green deployments", - "waf": "Operations" + "severity": "High", + "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.", + "waf": "Reliability" }, { - "category": "Application Deployment", - "checklist": "The AKS Checklist", - "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", - "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Key Vault", "services": [ - "AKS" + "ACR", + "AKV", + "WAF" ], - "severity": "Low", - "subcategory": "Development", - "text": "If required for AKS Windows workloads HostProcess containers can be used", + "severity": "Medium", + "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.", "waf": "Reliability" }, { - "category": "Application Deployment", - "checklist": "The AKS Checklist", - "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", - "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication", + "service": "Key Vault", "services": [ - "AKS" + "AKV", + "WAF" ], - "severity": "Low", - "subcategory": "Development", - "text": "Use KEDA if running event-driven workloads", - "waf": "Performance" + "severity": "Medium", + "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.", + "waf": "Reliability" }, { - "category": "Application Deployment", - "checklist": "The AKS Checklist", - "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", - "link": "https://dapr.io/", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions", + "service": "Key Vault", "services": [ - "AKS" + "AKV", + "AzurePolicy", + "WAF" ], - "severity": "Low", - "subcategory": "Development", - "text": "Use Dapr to ease microservice development", - "waf": "Operations" + "severity": "Medium", + "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.", + "waf": "Reliability" }, { - "category": "Application Deployment", - "checklist": "The AKS Checklist", - "guid": "3acbe04b-be20-49d3-afda-47778424d116", - "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks", + "checklist": "WAF checklist", + "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509", + "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations", + "service": "Key Vault", "services": [ - "AKS" + "Storage", + "Subscriptions", + "Backup", + "AKV", + "WAF" ], "severity": "Medium", - "subcategory": "Infrastructure as Code", - "text": "Use automation through ARM/TF to create your Azure resources", - "waf": "Operations" + "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.", + "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "The AKS Checklist", - "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery", + "checklist": "WAF checklist", + "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "Key Vault", "services": [ - "AKS", - "ASR" + "AKV", + "WAF" ], "severity": "High", - "subcategory": "Disaster Recovery", - "text": "Schedule and perform DR tests regularly", + "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "The AKS Checklist", - "guid": "170265f4-bb46-4a39-9af7-f317284797b1", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "checklist": "WAF checklist", + "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "Key Vault", "services": [ - "AKS", - "FrontDoor", - "LoadBalancer", - "TrafficManager" + "AKV", + "WAF" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "Use Azure Traffic Manager or Azure Front Door as a global load balancer for region failover", + "severity": "Low", + "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "The AKS Checklist", - "graph": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant", - "guid": "578a219a-46be-4b54-9350-24922634292b", - "link": "https://learn.microsoft.com/azure/aks/availability-zones", + "checklist": "WAF checklist", + "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c", + "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", + "service": "Key Vault", "services": [ - "AKS" + "AKV", + "WAF", + "Backup" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "Use Availability Zones if they are supported in your Azure region", + "severity": "Low", + "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", - "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", - "link": "https://learn.microsoft.com/azure/aks/uptime-sla", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04", + "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", + "service": "Key Vault", "services": [ - "AKS" + "AKV", + "WAF", + "Backup" ], - "severity": "High", - "subcategory": "High Availability", - "text": "Use the SLA-backed AKS offering", + "severity": "Low", + "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "The AKS Checklist", - "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection", + "service": "Key Vault", "services": [ - "AKS", - "Cost" + "EventHubs", + "AKV", + "WAF" ], - "severity": "Low", - "subcategory": "High Availability", - "text": "Use Disruption Budgets in your pod and deployment definitions", + "severity": "Medium", + "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "The AKS Checklist", - "guid": "3c763963-7a55-42d5-a15e-401955387e5c", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", - "service": "ACR", + "checklist": "WAF checklist", + "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", + "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", + "service": "Logic Apps", "services": [ - "AKS", - "ACR" + "WAF" ], "severity": "High", - "subcategory": "High Availability", - "text": "If using a private registry, configure region replication to store images in multiple regions", + "text": "Select the right Logic App hosting plan based on your business & SLO requirements", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "The AKS Checklist", - "guid": "daa9a260-c3ea-4490-b077-5fc1f2a80cb0", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", + "checklist": "WAF checklist", + "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", + "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "Logic Apps", "services": [ - "AKS", - "ASR", - "Storage" + "WAF" ], "severity": "High", - "subcategory": "Disaster Recovery", - "text": "Use Zone-Redundant Storage (ZRS) with stateful workloads", + "text": "Protect logic apps from region failures with zone redundancy and availability zones", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "The AKS Checklist", - "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery", + "checklist": "WAF checklist", + "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", + "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Logic Apps", "services": [ - "AKS" + "WAF" ], "severity": "High", - "subcategory": "Requirements", - "text": "Define non-functional requirements such as SLAs, RTO (Recovery Time Objective) and RPO (Recovery Point Objective).", + "text": "Consider a Cross-Region DR strategy for critical workloads", "waf": "Reliability" }, { - "category": "Cost Governance", - "checklist": "The AKS Checklist", - "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", + "link": "https://learn.microsoft.com/azure/app-service/environment/intro", + "service": "Logic Apps", "services": [ - "AKS", - "Cost" + "WAF", + "AppSvc" ], - "severity": "Low", - "subcategory": "Cost", - "text": "Use an external application such as kubecost to allocate costs to different users", - "waf": "Cost" + "severity": "High", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" }, { - "category": "Cost Governance", - "checklist": "The AKS Checklist", - "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", - "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", + "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", + "service": "Logic Apps", "services": [ - "AKS", - "Cost" + "WAF" ], - "severity": "Low", - "subcategory": "Cost", - "text": "Use scale down mode to delete/deallocate nodes", - "waf": "Cost" + "severity": "Medium", + "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", + "waf": "Operations" }, { - "category": "Cost Governance", - "checklist": "The AKS Checklist", - "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", - "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", + "service": "Azure MySQL", "services": [ - "AKS", - "Cost" + "WAF" ], "severity": "Medium", - "subcategory": "Cost", - "text": "When required use multi-instance partitioning GPU on AKS Clusters", - "waf": "Cost" + "text": "Leverage Flexible Server", + "waf": "Reliability" }, { - "category": "Cost Governance", - "checklist": "The AKS Checklist", - "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", - "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", + "service": "Azure MySQL", "services": [ - "AKS", - "Cost" + "WAF" ], - "severity": "Low", - "subcategory": "Cost", - "text": "If running a Dev/Test cluster use NodePool Start/Stop", - "waf": "Cost" + "severity": "High", + "text": "Leverage Availability Zones where regionally applicable", + "waf": "Reliability" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", - "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", - "service": "AKS", - "services": [ - "AKS", - "AzurePolicy" - ], - "severity": "Medium", - "subcategory": "Compliance", - "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", - "waf": "Security" - }, - { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", - "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", + "service": "Azure MySQL", "services": [ - "AKS" + "WAF" ], "severity": "Medium", - "subcategory": "Compliance", - "text": "Separate applications from the control plane with user/system node pools", - "waf": "Security" + "text": "Leverage Data-in replication for cross-region DR scenarios", + "waf": "Reliability" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "AKV", + "WAF" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Add taint to your system nodepool to make it dedicated", - "waf": "Security" + "severity": "Medium", + "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal", + "waf": "Operations" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", - "link": "https://learn.microsoft.com/azure/container-registry/", - "service": "AKS", + "checklist": "WAF checklist", + "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", + "guid": "553585a6-abe0-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "App Gateway", "services": [ - "AKS", - "ACR" + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Compliance", - "text": "Use a private registry for your images, such as ACR", + "text": "Ensure you are using Application Gateway v2 SKU", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Security" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", - "link": "https://learn.microsoft.com/azure/security-center/container-security", - "service": "ACR", + "checklist": "WAF checklist", + "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", + "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Load Balancer", "services": [ - "AKS" + "LoadBalancer", + "WAF" ], "severity": "Medium", - "subcategory": "Compliance", - "text": "Scan your images for vulnerabilities", + "text": "Ensure you are using the Standard SKU for your Azure Load Balancers", "waf": "Security" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "cc639637-a652-42ac-89e8-06965388e9de", - "link": "https://learn.microsoft.com/azure/security-center/container-security", + "checklist": "WAF checklist", + "guid": "9432621a-8397-4654-a882-5bc856b7ef83", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", + "service": "Load Balancer", "services": [ - "AKS", - "Defender" + "LoadBalancer", + "WAF" ], "severity": "Medium", - "subcategory": "Compliance", - "text": "Use Azure Security Center to detect security posture vulnerabilities", + "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).", "waf": "Security" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "42d4aefe-2383-470e-b019-c30df24996b2", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool", + "checklist": "WAF checklist", + "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", + "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "App Gateway", "services": [ - "AKS" + "VNet", + "WAF", + "AppGW" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "If required configure FIPS", + "severity": "Medium", + "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Security" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", - "service": "AKS", + "checklist": "WAF checklist", + "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.", + "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "services": [ - "AKS" + "VNet", + "Entra", + "Subscriptions", + "WAF", + "NVA", + "AppGW" ], - "severity": "High", - "subcategory": "Compliance", - "text": "Define app separation requirements (namespace/nodepool/cluster)", + "severity": "Medium", + "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Security" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", - "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "services": [ - "AKS", - "AKV" + "DDoS", + "WAF" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver", + "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", - "link": "https://learn.microsoft.com/azure/aks/update-credentials", - "service": "AKS", + "checklist": "WAF checklist", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", + "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", + "service": "App Gateway", "services": [ - "AKS", - "AKV" + "WAF" ], - "severity": "High", - "subcategory": "Secrets", - "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)", - "waf": "Security" + "severity": "Medium", + "text": "Configure autoscaling with a minimum amount of instances of two.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Reliability" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", - "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", - "service": "AKS", + "checklist": "WAF checklist", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", + "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", + "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", + "service": "App Gateway", "services": [ - "AKS", - "AKV" + "ACR", + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "If required add Key Management Service etcd encryption", - "waf": "Security" + "text": "Deploy Application Gateway across Availability Zones", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Reliability" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", - "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Front Door", "services": [ - "AKS", - "AKV" + "FrontDoor", + "AzurePolicy", + "WAF" ], - "severity": "Low", - "subcategory": "Secrets", - "text": "If required consider using Confidential Compute for AKS", + "severity": "Medium", + "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "category": "Governance and Security", - "checklist": "The AKS Checklist", - "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "3f29812b-2363-4cef-b179-b599de0d5973", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "Front Door", "services": [ - "AKS", - "Defender", - "AKV" + "FrontDoor", + "AzurePolicy", + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "Consider using Defender for Containers", + "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", - "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", - "service": "AKS", + "ammp": true, + "arm-service": "microsoft.network/trafficManagerProfiles", + "checklist": "WAF checklist", + "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Traffic Manager", "services": [ - "AKS", - "Entra" + "TrafficManager", + "WAF" ], "severity": "High", - "subcategory": "Identity", - "text": "Use managed identities instead of Service Principals", - "waf": "Security" + "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Reliability" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", - "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", - "link": "https://learn.microsoft.com/azure/aks/managed-aad", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", "services": [ - "AKS", - "Entra" + "Entra", + "WAF", + "AVD" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Integrate authentication with AAD (using the managed integration)", + "severity": "Low", + "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", - "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", "services": [ - "AKS", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Limit access to admin kubeconfig (get-credentials --admin)", + "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", - "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "ae248989-b306-4591-9186-de482e3f0f0e", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "Front Door", "services": [ - "AKS", - "Entra", - "RBAC" + "FrontDoor", + "AzurePolicy", + "WAF" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Integrate authorization with AAD RBAC", + "severity": "High", + "text": "Deploy your WAF policy for Front Door in 'Prevention' mode.", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "Front Door", "services": [ - "AKS", - "Entra", - "RBAC" + "TrafficManager", + "FrontDoor", + "WAF" ], "severity": "High", - "subcategory": "Identity", - "text": "Use namespaces for restricting RBAC privilege in Kubernetes", + "text": "Avoid combining Azure Traffic Manager and Azure Front Door.", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", - "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "Front Door", "services": [ - "AKS", - "Entra" + "FrontDoor", + "WAF" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)", + "severity": "High", + "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", - "service": "AKS", + "checklist": "WAF checklist", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", + "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "Front Door", "services": [ - "AKS", - "Entra" + "FrontDoor", + "WAF" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "For AKS non-interactive logins use kubelogin (preview)", - "waf": "Security" + "severity": "Low", + "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.", + "waf": "Performance" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", - "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "Front Door", "services": [ - "AKS", - "Entra" + "FrontDoor", + "WAF" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Disable AKS local accounts", - "waf": "Security" + "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.", + "waf": "Reliability" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", - "service": "AKS", + "checklist": "WAF checklist", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", + "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "Front Door", "services": [ - "AKS", - "Entra" + "FrontDoor", + "WAF" ], "severity": "Low", - "subcategory": "Identity", - "text": "Configure if required Just-in-time cluster access", - "waf": "Security" + "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.", + "waf": "Performance" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", + "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "Load Balancer", "services": [ - "AKS", - "Entra" + "LoadBalancer", + "WAF" ], - "severity": "Low", - "subcategory": "Identity", - "text": "Configure if required AAD conditional access for AKS", - "waf": "Security" + "severity": "High", + "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability", + "waf": "Reliability" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", - "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", + "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "Front Door", "services": [ - "AKS", - "Entra" + "FrontDoor", + "AKV", + "WAF", + "Cost" ], - "severity": "Low", - "subcategory": "Identity", - "text": "If required for Windows AKS workloads configure gMSA ", - "waf": "Security" + "severity": "High", + "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "The AKS Checklist", - "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", + "service": "Front Door", "services": [ - "AKS", - "Entra" + "FrontDoor", + "WAF" ], "severity": "Medium", - "subcategory": "Identity", - "text": "For finer control consider using a managed Kubelet Identity", - "waf": "Security" + "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", - "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", + "service": "Front Door", "services": [ - "AKS", - "AppGW", - "ACR" + "FrontDoor", + "WAF" ], - "severity": "Medium", - "subcategory": "Best practices", - "text": "If using AGIC, do not share an AppGW across clusters", - "waf": "Reliability" + "severity": "High", + "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", - "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", - "link": "https://learn.microsoft.com/azure/aks/http-application-routing", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", + "service": "Front Door", "services": [ - "AKS" - ], - "severity": "High", - "subcategory": "Best practices", - "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.", - "waf": "Reliability" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", - "service": "AKS", - "services": [ - "AKS" - ], - "severity": "Medium", - "subcategory": "Best practices", - "text": "For Windows workloads use Accelerated Networking", - "waf": "Performance" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", - "guid": "ba7da7be-9952-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", - "services": [ - "AKS", - "LoadBalancer" - ], - "severity": "High", - "subcategory": "Best practices", - "text": "Use the standard ALB (as opposed to the basic one)", - "waf": "Reliability" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", - "service": "AKS", - "services": [ - "AKS", - "VNet" + "FrontDoor", + "WAF" ], "severity": "Medium", - "subcategory": "Best practices", - "text": "If using Azure CNI, consider using different Subnets for NodePools", + "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", - "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", + "service": "Front Door", "services": [ - "AKS", - "Cost", - "PrivateLink", - "VNet" + "FrontDoor", + "WAF" ], - "severity": "Medium", - "subcategory": "Cost", - "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster", + "severity": "High", + "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "services": [ - "AKS", - "VPN" - ], - "severity": "Medium", - "subcategory": "HA", - "text": "If hybrid connectivity is required, use 2xER or ER+VPN for better availability", - "waf": "Reliability" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", - "guid": "a0f61565-9de5-458f-a372-49c831112dbd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "WAF" ], "severity": "High", - "subcategory": "IPAM", - "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)", - "waf": "Reliability" + "text": "Tune the Azure Front Door WAF for your workload. Reduce false positive detections.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "Front Door", "services": [ - "AKS", - "VNet" + "FrontDoor", + "AzurePolicy", + "WAF" ], "severity": "High", - "subcategory": "IPAM", - "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node", - "waf": "Performance" + "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "WAF" ], "severity": "High", - "subcategory": "IPAM", - "text": "If using Azure CNI, check the maximum pods/node (default 30)", - "waf": "Performance" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .", - "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", - "link": "https://learn.microsoft.com/azure/aks/internal-lb", - "service": "AKS", - "services": [ - "AKS", - "VNet" - ], - "severity": "Low", - "subcategory": "IPAM", - "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)", + "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "WAF" ], "severity": "High", - "subcategory": "IPAM", - "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)", - "waf": "Reliability" + "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", - "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "WAF" ], - "severity": "Low", - "subcategory": "Operations", - "text": "If required add your own CNI plugin", + "severity": "Medium", + "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "b9620385-1cde-418f-914b-a84a06982ffc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "WAF" ], - "severity": "Low", - "subcategory": "Operations", - "text": "If required configure Public IP per node in AKS", - "waf": "Performance" + "severity": "Medium", + "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", - "link": "https://learn.microsoft.com/azure/aks/concepts-network", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "WAF" ], "severity": "Medium", - "subcategory": "Scalability", - "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services", - "waf": "Reliability" + "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", - "link": "https://learn.microsoft.com/azure/aks/nat-gateway", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", + "service": "Front Door", "services": [ - "AKS" + "WAF" ], "severity": "Low", - "subcategory": "Scalability", - "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic", - "waf": "Reliability" + "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "00acd8a9-6975-414f-8491-2be6309893b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "WAF" ], "severity": "Medium", - "subcategory": "Scalability", - "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion", - "waf": "Reliability" + "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", - "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", - "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", + "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", + "service": "App Gateway", "services": [ - "AKS", - "NVA" + "WAF", + "AppGW" ], "severity": "High", - "subcategory": "Security", - "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it", + "text": "Enable the Azure Application Gateway WAF bot protection rule set The bot rules detect good and bad bots.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", - "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", - "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "App Gateway", "services": [ - "AKS" + "AzurePolicy", + "WAF", + "AppGW" ], - "severity": "Medium", - "subcategory": "Security", - "text": "If using a public API endpoint, restrict the IP addresses that can access it", + "severity": "High", + "text": "Enable request body inspection feature enabled in Azure Application Gateway WAF policy.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", - "link": "https://learn.microsoft.com/azure/aks/private-clusters", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", + "service": "App Gateway", "services": [ - "AKS" + "WAF", + "AppGW" ], "severity": "High", - "subcategory": "Security", - "text": "Use private clusters if your requirements mandate it", + "text": "Tune the Azure Application Gateway WAF for your workload. Reduce false positive detections.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "ammp": true, + "checklist": "WAF checklist", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "App Gateway", "services": [ - "AKS", - "AzurePolicy" + "AzurePolicy", + "WAF", + "AppGW" ], - "severity": "Medium", - "subcategory": "Security", - "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ", + "severity": "High", + "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", - "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", + "service": "App Gateway", "services": [ - "AKS", - "AzurePolicy" + "WAF", + "AppGW" ], - "severity": "High", - "subcategory": "Security", - "text": "Enable a Kubernetes Network Policy option (Calico/Azure)", + "severity": "Medium", + "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", + "service": "App Gateway", "services": [ - "AKS", - "AzurePolicy" + "WAF", + "AppGW" ], - "severity": "High", - "subcategory": "Security", - "text": "Use Kubernetes network policies to increase intra-cluster security", + "severity": "Medium", + "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "99937189-ff78-492a-b9ca-18d828d82b37", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", + "service": "App Gateway", "services": [ - "AKS", "WAF" ], - "severity": "High", - "subcategory": "Security", - "text": "Use a WAF for web workloads (UIs or APIs)", + "severity": "Low", + "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", - "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", + "service": "App Gateway", "services": [ - "AKS", - "VNet", - "DDoS" + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Security", - "text": "Use DDoS Standard in the AKS Virtual Network", + "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", - "link": "https://learn.microsoft.com/azure/aks/http-proxy", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", + "service": "App Gateway", "services": [ - "AKS" + "WAF", + "AppGW" ], - "severity": "Low", - "subcategory": "Security", - "text": "If required add company HTTP Proxy", + "severity": "Medium", + "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "The AKS Checklist", - "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", - "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "App Gateway", "services": [ - "AKS" + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Security", - "text": "Consider using a service mesh for advanced microservice communication management", - "waf": "Security" + "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.", + "waf": "Operations" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "Front Door", "services": [ - "AKS", - "Monitor" + "FrontDoor", + "WAF" ], - "severity": "High", - "subcategory": "Alerting", - "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", + "severity": "Medium", + "text": "Add diagnostic settings to save your Azure Front Door WAF logs.", "waf": "Operations" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "337453a3-cc63-4963-9a65-22ac19e80696", - "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "92664c60-47e3-4591-8b1b-8d557656e686", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", + "service": "App Gateway", "services": [ - "AKS", - "Entra" + "AppGW", + "WAF", + "Sentinel" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Check regularly Azure Advisor for recommendations on your cluster", + "severity": "Medium", + "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.", "waf": "Operations" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", - "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "845f5f91-9c21-4674-a725-5ce890850e20", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "WAF", + "Sentinel" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Enable AKS auto-certificate rotation", + "severity": "Medium", + "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.", "waf": "Operations" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", - "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", + "service": "App Gateway", "services": [ - "AKS" + "WAF", + "AppGW" ], - "severity": "High", - "subcategory": "Compliance", - "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature", + "severity": "Medium", + "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", "waf": "Operations" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", - "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", + "service": "App Gateway", "services": [ - "AKS" + "AzurePolicy", + "WAF" ], - "severity": "High", - "subcategory": "Compliance", - "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade", + "severity": "Medium", + "text": "Use WAF Policies instead of the legacy WAF configuration.", "waf": "Operations" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", - "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", + "service": "App Gateway", "services": [ - "AKS" + "VNet", + "ExpressRoute", + "WAF", + "VPN", + "AppGW" ], - "severity": "High", - "subcategory": "Compliance", - "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)", - "waf": "Operations" + "severity": "Medium", + "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.", + "waf": "Security" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", + "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", + "service": "Front Door", "services": [ - "AKS" + "FrontDoor", + "WAF" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters", - "waf": "Operations" + "severity": "Medium", + "text": "Make sure your origins only take traffic from your Azure Front Door instance.", + "waf": "Security" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "d7672c26-7602-4482-85a4-14527fbe855c", - "link": "https://learn.microsoft.com/azure/aks/command-invoke", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "service": "App Gateway", "services": [ - "AKS" + "WAF" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Consider using AKS command invoke on private clusters", - "waf": "Operations" + "severity": "High", + "text": "You should encrypt traffic to the backend servers.", + "waf": "Security" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", - "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "service": "App Gateway", "services": [ - "AKS" + "WAF" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "For planned events consider using Node Auto Drain", - "waf": "Operations" + "severity": "High", + "text": "You should use a Web Application Firewall.", + "waf": "Security" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", - "link": "https://learn.microsoft.com/azure/aks/faq", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", + "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", + "service": "App Gateway", "services": [ - "AKS" + "WAF" ], - "severity": "High", - "subcategory": "Compliance", - "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')", - "waf": "Operations" + "severity": "Medium", + "text": "Redirect HTTP to HTTPS", + "waf": "Security" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", - "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", + "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", + "service": "App Gateway", "services": [ - "AKS" + "WAF" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Use custom Node RG (aka 'Infra RG') name", + "severity": "Medium", + "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing", "waf": "Operations" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", - "link": "https://kubernetes.io/docs/setup/release/notes/", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", + "service": "App Gateway", "services": [ - "AKS" + "WAF" ], - "severity": "Medium", - "subcategory": "Compliance", - "text": "Do not use deprecated Kubernetes APIs in your YAML manifests", - "waf": "Operations" + "severity": "High", + "text": "Enable connection draining during planned service updates to prevent connection loss to existing membrs of the backend pool", + "waf": "Security" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", - "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", + "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", + "service": "App Gateway", "services": [ - "AKS" + "WAF" ], "severity": "Low", - "subcategory": "Compliance", - "text": "Taint Windows nodes", + "text": "Create custom error pages to display a personalized user experience", "waf": "Operations" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", - "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", + "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", + "service": "App Gateway", "services": [ - "AKS" + "WAF" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Keep windows containers patch level in sync with host patch level", - "waf": "Operations" + "severity": "Medium", + "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server", + "waf": "Security" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "description": "Via Diagnostic Settings at the cluster level", - "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", - "link": "https://learn.microsoft.com/azure/aks/monitor-aks", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "App Gateway", "services": [ - "AKS", - "Monitor" + "FrontDoor", + "WAF" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution", - "waf": "Operations" + "severity": "Medium", + "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover", + "waf": "Performance" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", - "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "29dcc19f-a8fa-4c35-8281-290577538793", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "App Gateway", "services": [ - "AKS" + "WAF" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "If required use nodePool snapshots", - "waf": "Cost" + "severity": "Medium", + "text": "Use transport layer load balancing", + "waf": "Performance" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", - "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", + "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", + "service": "App Gateway", "services": [ - "AKS", - "Cost" + "WAF" ], - "severity": "Low", - "subcategory": "Cost", - "text": "Consider spot node pools for non time-sensitive workloads", - "waf": "Operations" + "severity": "Medium", + "text": "Configure routing based on host or domain name for multiple web applications on a single gateway", + "waf": "Security" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", - "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", + "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", + "service": "App Gateway", "services": [ - "AKS", - "Cost" + "Entra", + "WAF" + ], + "severity": "Medium", + "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm", + "waf": "Security" + }, + { + "checklist": "WAF checklist", + "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", + "service": "App Gateway", + "services": [ + "WAF", + "AppGW" ], "severity": "Low", - "subcategory": "Cost", - "text": "Consider AKS virtual node for quick bursting", - "waf": "Operations" + "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols", + "waf": "Security" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "65285269-441c-44bf-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview", + "service": "PostgreSQL", "services": [ - "AKS", - "Monitor" + "WAF" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)", - "waf": "Operations" + "severity": "Medium", + "text": "Leverage Flexible Server", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", - "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "016ccf31-ae5a-41eb-9888-9535e227896d", + "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability", + "service": "PostgreSQL", "services": [ - "AKS", - "Monitor" + "WAF" ], "severity": "High", - "subcategory": "Monitoring", - "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)", - "waf": "Operations" + "text": "Leverage Availability Zones where regionally applicable", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "31b67c67-be59-4519-8083-845d587cb391", + "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas", + "service": "PostgreSQL", "services": [ - "AKS", - "Monitor" + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Monitor CPU and memory utilization of the nodes", - "waf": "Operations" + "text": "Leverage cross-region read replicas for BCDR", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "1a4835ac-9422-423e-ae80-b123081a5417", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687", + "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/", + "service": "Purview", "services": [ - "AKS", - "Monitor" + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "If using Azure CNI, monitor % of pod IPs consumed per node", - "waf": "Operations" + "text": "Leverage FTA Resillency Handbook", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady", - "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", - "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", "services": [ - "AKS", - "EventHubs", - "Monitor", - "ServiceBus", - "Storage" + "WAF" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Monitor OS disk queue depth in nodes", - "waf": "Operations" + "severity": "High", + "text": "Plan for Data Center level outage", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "be209d39-fda4-4777-a424-d116785c2fa5", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "checklist": "WAF checklist", + "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets", + "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", "services": [ - "AKS", - "NVA", - "LoadBalancer", - "Monitor" + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports", - "waf": "Operations" + "text": "Practice Failover for BCDR", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", - "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "97b15b8a-219a-44ab-bb57-879024d22678", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", "services": [ - "AKS", - "Monitor" + "Backup", + "WAF" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Subscribe to resource health notifications for your AKS cluster", - "waf": "Operations" + "severity": "High", + "text": "Plan a backup strategy and take regular backups", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d", + "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet", + "service": "Purview", "services": [ - "AKS" + "EventHubs", + "WAF" ], - "severity": "High", - "subcategory": "Resources", - "text": "Configure requests and limits in your pod specs", - "waf": "Operations" + "severity": "Low", + "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "769ef669-1a48-435a-a942-223ece80b123", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b", + "link": "https://learn.microsoft.com/purview/deployment-best-practices", + "service": "Purview", "services": [ - "AKS" + "WAF" ], "severity": "Medium", - "subcategory": "Resources", - "text": "Enforce resource quotas for namespaces", - "waf": "Operations" + "text": "Follow Purview accounts architectures and deployment best practices", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "081a5417-4158-433e-a3ad-3c2de733165c", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c", + "link": "https://learn.microsoft.com/purview/concept-best-practices-collections", + "service": "Purview", "services": [ - "AKS", - "Subscriptions" + "WAF" ], - "severity": "High", - "subcategory": "Resources", - "text": "Ensure your subscription has enough quota to scale out your nodepools", - "waf": "Operations" + "severity": "Medium", + "text": "Follow Collection Architectures and best practices", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65", - "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b", + "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle", + "service": "Purview", "services": [ - "AKS" + "WAF" ], - "severity": "High", - "subcategory": "Resources", - "text": "Configure Liveness and Readiness probes for all deployments", - "waf": "Operations" + "severity": "Medium", + "text": "Follow Assest lifecycle best practices", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", - "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed", + "link": "https://learn.microsoft.com/purview/concept-best-practices-automation", + "service": "Purview", "services": [ - "AKS" + "WAF" ], "severity": "Medium", - "subcategory": "Scalability", - "text": "Use the Cluster Autoscaler", - "waf": "Performance" + "text": "Follow automation best practices", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", - "guid": "831c2872-c693-4b39-a887-a561bada49bc", - "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", "services": [ - "AKS" + "Backup", + "WAF" ], - "severity": "Low", - "subcategory": "Scalability", - "text": "Customize node configuration for AKS node pools", - "waf": "Performance" + "severity": "Medium", + "text": "Follow Backup and Migration Best practices", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7", + "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary", + "service": "Purview", "services": [ - "AKS" + "WAF" ], "severity": "Medium", - "subcategory": "Scalability", - "text": "Use the Horizontal Pod Autoscaler when required", - "waf": "Performance" + "text": "Follow Purview Glossary Best Practices", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity", - "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", - "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790", + "link": "https://learn.microsoft.com/purview/concept-workflow", + "service": "Purview", "services": [ - "AKS" + "WAF" ], - "severity": "High", - "subcategory": "Scalability", - "text": "Consider an appropriate node size, not too large or too small", - "waf": "Performance" + "severity": "Low", + "text": "Leverage Workflows ", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", - "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e", + "link": "https://learn.microsoft.com/purview/concept-best-practices-security", + "service": "Purview", "services": [ - "AKS" + "WAF" ], - "severity": "Low", - "subcategory": "Scalability", - "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster", - "waf": "Performance" + "severity": "Medium", + "text": "Follow Purview Security Best Practices", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", - "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888", + "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory", + "service": "Purview", "services": [ - "AKS" + "WAF" ], - "severity": "Low", - "subcategory": "Scalability", - "text": "Consider subscribing to EventGrid Events for AKS automation", - "waf": "Performance" + "severity": "Medium", + "text": "Follow Purview Data Lineage Best Practices", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", - "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "9579e76b-896e-4710-a7da-7be9956d14d3", + "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning", + "service": "Purview", "services": [ - "AKS" + "WAF" ], - "severity": "Low", - "subcategory": "Scalability", - "text": "For long running operation on an AKS cluster consider event termination", - "waf": "Performance" + "severity": "Medium", + "text": "Follow Best Practices for Scanning Registered Sources", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", - "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed", + "link": "https://learn.microsoft.com/purview/concept-best-practices-classification", + "service": "Purview", "services": [ - "AKS" + "WAF" ], - "severity": "Low", - "subcategory": "Scalability", - "text": "If required consider using Azure Dedicated Hosts for AKS nodes", - "waf": "Performance" + "severity": "Medium", + "text": "Follow Classification Best Practices in Governance Portal", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", - "guid": "24367b33-6971-45b1-952b-eee0b9b588de", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69", + "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions", + "service": "Purview", "services": [ - "AKS", - "Storage" + "WAF" ], - "severity": "High", - "subcategory": "Storage", - "text": "Use ephemeral OS disks", - "waf": "Performance" + "severity": "Medium", + "text": "Perform Sensitivity Labelling in the Purview Data Map", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96", + "link": "https://learn.microsoft.com/purview/concept-data-share", + "service": "Purview", "services": [ - "AKS", - "Storage" + "Storage", + "WAF" ], - "severity": "High", - "subcategory": "Storage", - "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds", - "waf": "Performance" + "severity": "Low", + "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", - "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4", + "link": "https://learn.microsoft.com/purview/concept-insights", + "service": "Purview", "services": [ - "AKS", - "Storage" + "WAF" ], "severity": "Low", - "subcategory": "Storage", - "text": "For hyper performance storage option use Ultra Disks on AKS", - "waf": "Performance" + "text": "Leverage Data Estate Insights", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab", + "link": "https://learn.microsoft.com/purview/catalog-adoption-insights", + "service": "Purview", "services": [ - "AKS", - "SQL", - "Storage" + "WAF" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", - "waf": "Performance" + "severity": "Low", + "text": "Use Data stewardship and Catalog adoption", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581", + "link": "https://learn.microsoft.com/purview/concept-insights", + "service": "Purview", "services": [ - "AKS", - "Storage" + "WAF" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons", - "waf": "Performance" + "severity": "Low", + "text": "Use Inventory and Ownership", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "The AKS Checklist", - "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", - "service": "AKS", + "checklist": "WAF checklist", + "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9", + "link": "https://learn.microsoft.com/purview/glossary-insights", + "service": "Purview", "services": [ - "AKS", - "Storage" + "WAF" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones", - "waf": "Performance" + "severity": "Low", + "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels", + "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD control plane does not offer a financially backed service level agreement. We strive to attain at least 99.9% availability for the Azure Virtual Desktop service URLs. The availability of the session host virtual machines in your subscription is covered by the Virtual Machines SLA. Dependent resources/services and infrastructure availability must be also considered to properly satisfy global high-availability requirements.", - "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1", - "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/", + "checklist": "WAF checklist", + "guid": "b130a888-9579-4e76-a896-e710a7da7be9", + "link": "https://learn.microsoft.com/purview/compliance-manager", + "service": "Purview", "services": [ - "AVD", - "VM", - "Subscriptions", - "ASR" + "WAF" ], - "severity": "High", - "subcategory": "Compute", - "text": "Determine the expected High Availability SLA for applications/desktops published through AVD", + "severity": "Medium", + "text": "Generate assessment scores", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "'Active-Active' model can be achieved with multiple host pools in different regions. A single Host Pool with VMs from different regions is not recommended. If multiple pools for same users will be used, the problem of how to synchronize/replicate user profiles must be solved. FSLogix Cloud Cache could be used, but need to be carefully reviewed and planned, or customers can decide to do not synchronize/replicate at all. 'Active-Passive' can be achieved using Azure Site Recovery (ASR) or on-demand Pool deployment with automated mechanism. For a detailed discussion on multi-region BCDR, please read the companion article in the 'More Info' column and this FSLogix related page: https://learn.microsoft.com/fslogix/concepts-container-recovery-business-continuity.", - "guid": "6acc076e-f9b1-441a-a989-579e76b897e7", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/azure-virtual-desktop-multi-region-bcdr", + "checklist": "WAF checklist", + "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f", + "link": "https://learn.microsoft.com/purview/compliance-manager-scoring", + "service": "Purview", "services": [ - "AVD", - "VM", - "Storage", - "ASR" + "WAF" ], "severity": "Medium", - "subcategory": "Compute", - "text": "Assess Geo Disaster Recovery requirements for AVD Host Pools", + "text": "Profiling- get summaries of data content", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "Before approaching Azure Virtual Desktop BCDR planning and design, it is important to initially consider which applications consumed through AVD are critical. You may want to separate them from non-critical apps and use a separate Host Pool with a different disaster recovery approach and capabilities.", - "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13", - "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", + "checklist": "WAF checklist", + "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1", + "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts", + "service": "Purview", "services": [ - "AVD", - "ASR" + "AzurePolicy", + "WAF" ], "severity": "Low", - "subcategory": "Compute", - "text": "Separate critical applications in different AVD Host Pools", + "text": "Follow Microsoft Purview Data Owner access policies", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "Each Host Pool can be deployed using Availability Zones (AZ) or Availability Set (AS). To maximize resiliency, usage of AZ is recommended: at Host Pool creation time you can decide to spread Host Pool Session Hosts across all available AZ. Usage of AS will not protect from single datacenter failure, then should be used only in regions where AZ are not available. More details on AZ and AVD in the companion article. For a comparison between AZ and AS you can read here: https://learn.microsoft.com/azure/virtual-machines/availability.", - "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb", - "link": "https://techcommunity.microsoft.com/t5/azure-virtual-desktop-blog/announcing-general-availability-of-support-for-azure/ba-p/3636262", + "checklist": "WAF checklist", + "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac", + "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy", + "service": "Purview", "services": [ - "AVD", - "ACR", - "ASR" + "AzurePolicy", + "WAF" ], - "severity": "High", - "subcategory": "Compute", - "text": "Plan the best resiliency option for AVD Host Pool deployment", + "severity": "Low", + "text": "Follow Self-service access policies", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "Azure Backup can be used to protect Host Pool VMs. For Pooled Pools, this is not necessary since should be stateless. Instead, this option can be considered for Personal Host Pools.", - "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e", - "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", + "checklist": "WAF checklist", + "guid": "b49e5b96-0332-44ec-b8cc-13318da61170", + "link": "https://learn.microsoft.com/purview/concept-policies-devops", + "service": "Purview", "services": [ - "ASR", - "AVD", - "VM", - "Backup" + "AzurePolicy", + "WAF" ], - "severity": "Medium", - "subcategory": "Compute", - "text": "Assess the requirement to backup AVD Session Host VMs", + "severity": "Low", + "text": "Follow DevOps policies", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "Even for Personal Pools, usage of Availability Zones, when available, is recommended. Three possible in-region DR strategies are possible, it is recommended to select the best one based on cost, RTO/RPO, and if it is really necessary to save the entire VM OS disk: (1) create each session host in a specific zone (AZ) and then use Azure Site Recovery (ASR) to replicate to a different zone. (2) Use Azure Backup to backup and restore the specific session host in a different AZ. (3) Create a new session host in a different AZ and rely on FSLogix and/or OneDrive to make data and settings available on the new machine. All options require administrator intervention for DR and direct user assignment at Host Pool level, then must be planned and configured in advance.", - "guid": "5da58639-ca3a-4961-890b-29663c5e10d", - "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-zone-to-zone-disaster-recovery", + "checklist": "WAF checklist", + "guid": "65285269-440b-44be-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", + "service": "Redis", "services": [ - "AVD", - "ASR", - "Backup", - "Cost", - "VM" + "ACR", + "WAF" ], - "severity": "Medium", - "subcategory": "Compute", - "text": "Prepare a local DR strategy for Personal Host Pool Session Hosts", + "severity": "High", + "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "If custom images are used to deploy AVD Host Pool VMs, it is important to ensure those artifacts are available in all regions where AVD is deployed. Azure Compute Gallery service can be used to replicate images across all regions where a Host Pool is deployed, with redundant storage and in multiple copies. Please be aware that the Azure Compute Gallery service isn't a global resource. For disaster recovery scenarios, the best practice is to have at least two galleries, in different regions.", - "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141", - "link": "https://learn.microsoft.com/azure/virtual-machines/azure-compute-gallery", + "checklist": "WAF checklist", + "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", + "service": "Redis", "services": [ - "AVD", - "ASR", "Storage", - "VM", - "ACR" + "WAF" ], - "severity": "Low", - "subcategory": "Dependencies", - "text": "Plan for Golden Image cross-region availability", + "severity": "Medium", + "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "If users of the AVD infrastructure need on-premises resource access, high availability of network infrastructure required to connect is also critical and should be considered. Resiliency of authentication infrastructure needs to be assessed and evaluated. BCDR aspects for dependent applications and other resources need to be considered to ensure availability in the secondary DR location.", - "guid": "fd339489-8c12-488b-9c6a-57cfb644451e", - "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", + "checklist": "WAF checklist", + "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", + "service": "Redis", "services": [ - "AVD", - "ASR" + "Storage", + "WAF" ], "severity": "Medium", - "subcategory": "Dependencies", - "text": "Assess Infrastructure & Application dependencies ", + "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "Not all data inside FSLogix user profiles may deserve protection from disaster. Additionally, if external storage is used, for example OneDrive or File Servers/Shares, what is remaining in the FSLogix profile is minimal and could be lost in some extreme circumstances. In other cases, data inside the profile can be rebuilt from other storages (for example Outlook Inbox in cached mode).", - "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23", - "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt", + "checklist": "WAF checklist", + "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", + "service": "Redis", "services": [ - "AVD", - "Storage", - "ASR" + "ASR", + "WAF" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Assess which data need to be protected in the Profile and Office Containers", + "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "Preventing data loss for critical user data is important, first step is to assess which data need to be saved and protected. If using OneDrive or other external storage, saving user Profile and/or Office Containers data maybe not necessary. Appropriate mechanism must be considered to provide protection for critical user data. Azure Backup service can be used to protect Profile and Office Containers data when stored on Azure Files Standard and Premium tiers. Azure NetApp Files Snapshots and Policies can be used for Azure NetApp Files (all tiers).", - "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32", - "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", + "checklist": "WAF checklist", + "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.", + "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs", + "service": "VMSS", "services": [ - "ASR", - "AVD", - "Backup", - "AzurePolicy", - "Storage" + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "Build a backup protection strategy for Profile and Office Containers", + "severity": "Low", + "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "In AVD, multiple replication mechanisms and strategies can be used for user data residing in FSLogix containers: [Profile Pattern #1]: Native Azure storage replication mechanisms, for example Azure Files Standard GRS replication, Azure NetApp Files Cross Region Replication. Use Zone Replicated Storage (ZRS) or Geo replicated storage (GRS) for Azure Files is recommended. LRS with local-only resiliency can be used if no zone/region protection is required. NOTE: Azure Files Share Standard is LRS/ZRS/GRS, but with 100TB large support enabled only LRS/ZRS are supported. [Profile Pattern #2]: FSLogix Cloud Cache is built in automatic mechanism to replicate containers between different (up to 4) storage accounts. Cloud Cache should be used only when:(1) User Profile or Office containers data availability required high-availability SLA is critical and need to be resilient to region failure. (2) Selected storage option is not able to satisfy BCDR requirements. For example, with Azure File Share Premium tier, or Azure File Share Standard with Large File Support enabled, GRS is not available. (3) When replication between disparate storage is required. [Profile Pattern #3]: Only set up geo disaster recovery for application data and not for user data/profile containers: store important application data in separate storages, like OneDrive or other external storage with its own built-in DR mechanism.", - "guid": "9f7547c1-746d-4c56-868a-714435bd09dd", - "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", + "checklist": "WAF checklist", + "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).", + "guid": "4d874a74-8b66-42d6-b150-512a66498f6d", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction", + "service": "VM", "services": [ - "AVD", - "Storage", - "ASR" + "VM", + "WAF", + "Backup" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "Assess Profile Container storage replication requirements and resiliency for BCDR purpose", + "severity": "High", + "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "For local disaster recovery, Azure Backup for Azure Files can be used. For cross-region geo disaster recovery: GRS for Azure Files is only available with standard SKU and no large share support, then not suitable in most customer scenarios. If geo-replication is required with Azure File Share Premium, replication with FSLogix Cloud Cache can be evaluated, or 'in-region' Availability Zone (AZ) only resiliency should be considered.", - "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05", - "link": "https://docs.microsoft.com/azure/backup/backup-afs", + "checklist": "WAF checklist", + "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%", + "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "VM", "services": [ - "Backup", - "AVD", - "Storage", - "ASR" + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "Review Azure Files disaster recovery strategy", + "severity": "High", + "text": "Use Premium or Ultra disks for production VMs", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "Zone Redundant Storage will maximize in-region resiliency for the user profile data. ZRS is supported for premium file shares through the 'FileStorage' storage account kind. ZRS is supported in standard general-purpose v2 storage accounts. Usage of zone redundant storage must be paired with zone redundant deployment of Session Hosts in each Host Pool. ", - "guid": "10d4e875-d502-4142-a795-f2b6eff34f88", - "link": "https://learn.microsoft.com/azure/storage/files/files-redundancy#zone-redundant-storage", + "checklist": "WAF checklist", + "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.", + "guid": "b31e38c3-f298-412b-8363-cffe179b599d", + "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview", + "service": "VM", "services": [ - "AVD", - "Storage", - "ASR" + "VM", + "WAF" ], "severity": "High", - "subcategory": "Storage", - "text": "Use Zone Redundant Storage (ZRS) for Azure Files to maximize resiliency", + "text": "Ensure Managed Disks are used for all VMs", "waf": "Reliability" }, { - "category": "Business Continuity and Disaster Recovery", - "checklist": "Azure Virtual Desktop Review", - "description": "For local disaster recovery, Azure NetApp Files (ANF) native backup is available. ANF is essentially locally redundant, then for cross-region geo disaster recovery it is necessary to use an additional mechanism that is Cross-Region Replication (CRR) https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering. Currently, ANF does not provide replication nor redundancy across different Availability Zones (AZ), only the possibility to select in which single AZ to place the ANF volume: https://learn.microsoft.com/azure/azure-netapp-files/manage-availability-zone-volume-placement.", - "guid": "23429db7-2281-4376-85cc-57b4a4b18142", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering", + "checklist": "WAF checklist", + "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.", + "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4", + "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk", + "service": "VM", "services": [ - "AVD", - "ASR", - "Backup", "Storage", - "ACR" + "VM", + "WAF", + "SQL" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Review Azure NetApp Files disaster recovery strategy", + "text": "Do not use the Temp disk for anything that is not acceptable to be lost", "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "Applications can be preinstalled in the golden image/s, can be attached using MSIX & AppAttach feature or distributed to the session hosts after host pool deployment using traditional software distribution methods.", - "guid": "86ba2802-1459-4014-95d3-8e5309ccbd97", - "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image", + "checklist": "WAF checklist", + "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.", + "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", "services": [ - "AVD" + "Storage", + "ACR", + "VM", + "WAF" ], - "severity": "High", - "subcategory": "Golden Images", - "text": "Determine how applications will be deployed in AVD Host Pools", - "waf": "Operations" + "severity": "Medium", + "text": "Leverage Availability Zones for your VMs in regions where they are supported", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "Multiple golden images can be required to support different OS versions and/or settings, different groups of applications that must be separated and cannot be included in a single image.", - "guid": "9266bcca-274f-4aa1-abf3-9d95d44c7c89", - "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image", + "checklist": "WAF checklist", + "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.", + "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "VM", "services": [ - "AVD" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Golden Images", - "text": "Estimate the number of golden images that will be required", - "waf": "Operations" + "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "Determine which Guest OS will be used to deploy each Host Pool: Windows 10 vs. Windows Server, Marketplace vs. Custom images", - "guid": "19ca1f6d-5315-4ae5-84ba-34d4585e2213", - "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#operating-systems-and-licenses", + "checklist": "WAF checklist", + "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)", + "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", "services": [ - "AVD" + "ASR", + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Golden Images", - "text": "Determine which OS image/s you will use for Host Pool deployment", + "severity": "High", + "text": "Avoid running a production workload on a single VM", "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "Azure VM custom images can be created and stored in different ways: in an Azure Compute Gallery, as a managed image object or as a managed disk in the storage. The recommended way is to use Azure Compute Gallery.", - "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd", - "link": "https://learn.microsoft.com/azure/virtual-machines/shared-image-galleries", + "checklist": "WAF checklist", + "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.", + "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", "services": [ - "AVD", + "ASR", + "AVS", "VM", - "Storage" + "WAF" ], - "severity": "Low", - "subcategory": "Golden Images", - "text": "Select the proper store for custom images", + "severity": "High", + "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery", "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "If custom images will be used, plan for an automated build process. If no pre-existing software factory exists, consider using Custom Image Templates and/or Azure Image Builder to automate the build process.", - "guid": "9bd7bb01-2f7b-495e-86e1-54e2aa359282", - "link": "https://learn.microsoft.com/azure/virtual-desktop/create-custom-image-templates", + "checklist": "WAF checklist", + "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.", + "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d", + "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview", + "service": "VM", "services": [ - "AVD" + "WAF" ], "severity": "Low", - "subcategory": "Golden Images", - "text": "Design your build process for custom images", - "waf": "Operations" + "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "There are some known best practices and recommendations for the golden image customization, be sure to check the referenced article.", - "guid": "deace4cb-1dec-44c6-90c3-fc14eebb36a3", - "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-golden-image", + "checklist": "WAF checklist", + "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.", + "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666", + "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests", + "service": "VM", "services": [ - "AVD" + "ASR", + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Golden Images", - "text": "If custom image will be used, check recommended best practices for AVD on how to build custom image", - "waf": "Operations" - }, - { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "FSLogix stack installed in AVD session hosts does not provide auto-update capability. For this reason, it is recommended to download the latest version of FSLogix and include in the golden image update process.", - "guid": "ed5c9027-dd1a-4343-86ca-52b199223186", - "link": "https://learn.microsoft.com/fslogix/how-to-install-fslogix", - "services": [ - "AVD" - ], - "severity": "High", - "subcategory": "Golden Images", - "text": "Include the latest version of FSLogix in the golden image update process", + "text": "Increase quotas in DR region before testing failover with ASR", "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "This tool-set has been created to automatically apply setting referenced in white paper 'Optimizing Windows 10, version 2004 for a Virtual Desktop Infrastructure (VDI) role': https://docs.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations-2004. Usage of the tool and/or optimizations mentioned in the white-paper should be considered. ", - "guid": "829e3fec-2183-4687-a017-7a2b5945bda4", - "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool", + "checklist": "WAF checklist", + "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.", + "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events", + "service": "VM", "services": [ - "RBAC", - "AVD" + "VM", + "WAF" ], "severity": "Low", - "subcategory": "Golden Images", - "text": "Evaluate the usage of Virtual-Desktop-Optimization-Tool", - "waf": "Performance" + "text": "Utilize Scheduled Events to prepare for VM maintenance", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "If OneDrive is used and included in a golden image, be sure to follow the configuration procedure reported in the companion article in the 'More Info' section. Not in scope in this AVD checklist, but OneDrive optimizations like 'Known Folder Redirection' and 'Files On-Demand' should be evaluated used to reduce the space used in FSLogix profiles and provide a better user experience. OneDrive today is not supported for Remote Apps.", - "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e", - "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image#install-onedrive-in-per-machine-mode", + "checklist": "WAF checklist", + "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.", + "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Azure Storage", "services": [ - "AVD", - "Storage" + "Storage", + "WAF" ], - "severity": "Low", - "subcategory": "Golden Images", - "text": "Determine if Microsoft OneDrive will be part of AVD deployment", - "waf": "Operations" + "severity": "Medium", + "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "Be sure to review the requirements and configuration procedure contained in the companion article in the 'More Info' column. Since Teams automatic updates will be disabled, it is recommended to check and include Teams latest version in the golden image update process.", - "guid": "b5887953-5d22-4788-9d30-b66c67be5951", - "link": "https://learn.microsoft.com/azure/virtual-desktop/teams-on-AVD", + "checklist": "WAF checklist", + "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.", + "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", "services": [ - "AVD" + "Storage", + "WAF" ], "severity": "Low", - "subcategory": "Golden Images", - "text": "Determine if Microsoft Teams will be part of AVD deployment", - "waf": "Performance" + "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD can support users with different language and localization requirements in the same host pool. This can be done customizing golden images to ensure users can select whichever language they need. The procedure to configure additional language packs in Windows 11 is documented in the reference article.", - "guid": "7c336f3b-822a-498e-8cd1-667d1150df4a", - "link": "https://learn.microsoft.com/azure/virtual-desktop/windows-11-language-packs", + "checklist": "WAF checklist", + "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.", + "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", "services": [ - "AVD" + "Storage", + "WAF" ], "severity": "Low", - "subcategory": "Golden Images", - "text": "Assess the requirement to support multiple languages", + "text": "Enable soft delete for Storage Account Containers", "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "It is highly recommended to use separate storage accounts/shares to store MSIX packages. If necessary, storage can scale out independently and not being impacted by profile I/O activities. Azure offers multiple storage options that can be used for MISX app attach. We recommend using Azure Files or Azure NetApp Files as those options offer the best value between cost and management overhead. ", - "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f", - "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share", + "checklist": "WAF checklist", + "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.", + "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", "services": [ - "AVD", "Storage", - "Cost" + "WAF" ], - "severity": "Medium", - "subcategory": "MSIX & AppAttach", - "text": "Do not use the same storage account/share as FSLogix profiles", - "waf": "Performance" + "severity": "Low", + "text": "Enable soft delete for blobs", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "In the referenced article, we reported few but important performance considerations for MSIX usage in AVD context, be sure to carefully review.", - "guid": "241addce-5793-477b-adb3-751ab2ac1fad", - "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share", + "checklist": "WAF checklist", + "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.", + "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about", + "service": "Azure Backup", "services": [ - "AVD" + "Backup", + "WAF" ], "severity": "Medium", - "subcategory": "MSIX & AppAttach", - "text": "Review performance considerations for MSIX", - "waf": "Performance" + "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "MSIX app attach requires read-only permissions to access the file share. If you're storing your MSIX applications in Azure Files, then for your session hosts, you'll need to assign all session host VMs both storage account role-based access control (RBAC) and file share New Technology File System (NTFS) permissions on the share.", - "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41", - "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share", + "checklist": "WAF checklist", + "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.", + "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae", + "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept", + "service": "Azure Backup", "services": [ - "RBAC", - "AVD", - "VM", - "Storage" + "Backup", + "WAF" ], - "severity": "Medium", - "subcategory": "MSIX & AppAttach", - "text": "Check proper session host permissions for MSIX share", - "waf": "Security" + "severity": "Low", + "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "3rd-party software vendor must provide a MSIX package, it is not recommended for customer to attempt the conversion procedure without proper support from the application owner.", - "guid": "bd362caa-ab79-4b19-adab-81932c9fc9d1", - "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq", + "checklist": "WAF checklist", + "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.", + "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault", + "service": "Azure Backup", "services": [ - "AVD" + "Storage", + "Backup", + "WAF" ], "severity": "Low", - "subcategory": "MSIX & AppAttach", - "text": "MSIX packages for 3rd-party applications", - "waf": "Cost" + "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "MSIX app attach doesn't support auto-update for MSIX applications, so they should be disabled.", - "guid": "bb88037f-5e6b-4fbb-aed5-03547cc447e8", - "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq", + "checklist": "WAF checklist", + "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.", + "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146", + "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", + "service": "DNS", "services": [ - "AVD" + "ASR", + "ACR", + "DNS", + "WAF" ], "severity": "Low", - "subcategory": "MSIX & AppAttach", - "text": "Disable auto-update for MSIX packages", - "waf": "Operations" + "text": "Implement DNS Failover using Azure DNS Private Resolvers", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "In order to leverage MSIX & App Attach, guest OS image for AVD Host pool must be Windows 10/11 Enterprise or Windows 10/11 Enterprise Multi-session, version 2004 or later.", - "guid": "26128a71-f0f1-4cac-9d9e-f1d5e832e42e", - "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-faq", + "checklist": "WAF checklist", + "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.", + "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103", + "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters", + "service": "Data Gateways", "services": [ - "AVD" + "ACR", + "WAF" ], "severity": "Medium", - "subcategory": "MSIX & AppAttach", - "text": "Review operating systems support", + "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data", "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "Once selected the VM SKU that will be used for Host Pool deployment, it is recommended to use Gen2 type of the SKU for higher security and improved capabilities.", - "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d", - "link": "https://docs.microsoft.com/azure/virtual-machines/generation-2", + "checklist": "WAF checklist", + "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.", + "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "services": [ - "AVD", - "VM" + "NVA", + "WAF" ], - "severity": "Medium", - "subcategory": "Session Host", - "text": "Evaluate the usage of Gen2 VM for Host Pool deployment", - "waf": "Performance" + "severity": "High", + "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability", + "waf": "Reliability" }, { - "category": "Compute", - "checklist": "Azure Virtual Desktop Review", - "description": "MMR redirects the media content from Session Host to your local machine for faster processing and rendering. It only works when you play media content on Microsoft Edge or Google Chrome. See linked URL for more details.", - "guid": "adecb27f-dc40-40f5-aca2-0090f633b1c9", - "link": "https://learn.microsoft.com/azure/virtual-desktop/multimedia-redirection", + "checklist": "WAF checklist", + "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", + "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", + "service": "SAP", "services": [ - "AVD" + "SAP", + "WAF" ], - "severity": "Low", - "subcategory": "Session Host", - "text": "Consider using MMR (MultiMedia Redirection) to get better video performance on browser", - "waf": "Performance" + "severity": "Medium", + "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "waf": "Operations" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "A host pool is a collection of Azure virtual machines that register to Azure Virtual Desktop as session hosts. A host pool can be one of two types: Personal and Pooled. Which type to use, and how many, is a key design decision that must be documented and validated. See companion article in 'More Info' column for more details.", - "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2", - "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology#host-pools", + "checklist": "WAF checklist", + "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", + "service": "SAP", "services": [ - "AVD", - "VM" + "SAP", + "WAF" ], - "severity": "High", - "subcategory": "Capacity Planning", - "text": "Determine the Host Pool type to use", - "waf": "Cost" + "severity": "Medium", + "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.", + "training": "https://github.com/Azure/sap-automation", + "waf": "Operations" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "Use your design criteria to determine the number of Host Pools to deploy. This will be based on factors such as different OS images, multi-region support, guest VM hardware differences (such as GPU support or no), different user expectations and uptime requirements (examples might be 'Executives', 'Office Workers', 'Developers', etc.), and Host Pool RDP settings (such as drive redirection support). These will determine the number of host pools as well as how many hosts will be in each pool.", - "guid": "4e98495f-d3c0-4af2-aa59-a793395a32a7", - "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#host-pools", + "checklist": "WAF checklist", + "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", + "service": "SAP", "services": [ - "AVD", - "VM" + "SAP", + "WAF" ], - "severity": "High", - "subcategory": "Capacity Planning", - "text": "Estimate the number of different Host Pools to deploy ", - "waf": "Performance" + "severity": "Medium", + "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "Confirm that the difference between automatic and direct assignment is well understood and the selected option is appropriate for the scenario in question. Automatic is the default setting.", - "guid": "b38b875b-a1cf-4204-a901-3a5d3ce474db", - "link": "https://docs.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type", + "checklist": "WAF checklist", + "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", + "service": "SAP", "services": [ - "AVD" + "Backup", + "WAF" ], - "severity": "Low", - "subcategory": "Capacity Planning", - "text": "For Personal Host Pool type, select the proper assignment type", - "waf": "Operations" + "severity": "Medium", + "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "Check which one to use and available options, autoscale ignores existing load-balancing algorithms.", - "guid": "cbd8682a-6abc-4a2a-9fda-1dbf3dc95d48", - "link": "https://docs.microsoft.com/azure/virtual-desktop/host-pool-load-balancing", + "checklist": "WAF checklist", + "guid": "b651423c-8552-42db-a545-5cb50c05527a", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "SAP", "services": [ - "AVD" + "Storage", + "Backup", + "WAF", + "SQL", + "ASR", + "SAP" ], - "severity": "Low", - "subcategory": "Capacity Planning", - "text": "For Pooled Host Pool type, select the best load balancing method", - "waf": "Performance" + "severity": "High", + "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "The number of cores increase, the system's synchronization overhead also increases. Especially for multiple user's sign-in simultaneously. Make sure not to use a VM that is too large for the session host", - "guid": "b3724959-4943-4577-a3a9-e10ff6345f24", - "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs", + "checklist": "WAF checklist", + "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", "services": [ - "AVD", - "VM" + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Capacity Planning", - "text": "For Pooled Host Pool type, VMs shouldn't have more than 32 cores", - "waf": "Performance" + "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD does not support assigning both the RemoteApp and Desktop Application Group (DAG) in a single host pool to the same set of users. Doing so will cause a single user to have two user sessions in a single host pool. Users aren't supposed to have two active sessions at the same time in the same host pool using the same profile.", - "guid": "b384b7ed-1cdd-457e-a2cd-c8d4d55bc144", - "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#application-groups", + "checklist": "WAF checklist", + "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "SAP", "services": [ - "AVD", - "Storage" + "VPN", + "ASR", + "ExpressRoute", + "WAF" ], "severity": "High", - "subcategory": "Capacity Planning", - "text": "Do not use the same Host Pool to offer both full desktops (DAG) and Remote Apps to the same set of users", - "waf": "Security" + "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.", + "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "There is a limit of 500 Application Groups that can be created in AVD for each Microsoft Entra ID (former Azure AD) tenant. The limit can be increased (see the companion link for details) but it is not recommended.", - "guid": "971cc4a4-b1f7-4c12-90e0-1ad96808f00c", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-service-limits", + "checklist": "WAF checklist", + "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "SAP", "services": [ - "Entra", - "AVD", - "ACR" + "ACR", + "AKV", + "WAF" ], - "severity": "Medium", - "subcategory": "Capacity Planning", - "text": "Estimate the number of Application Groups required across all Host Pools in the Microsoft Entra ID tenant", + "severity": "Low", + "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.", "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "Applications are grouped under Application Groups as containers for publishing and assigning permissions: we recommend that you do not publish more than 50 applications per application group.", - "guid": "fa9f2895-473d-439b-ab8e-5a5cf92c7f32", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations", + "checklist": "WAF checklist", + "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", + "service": "SAP", "services": [ - "AVD" + "ASR", + "VNet", + "SAP", + "WAF" ], - "severity": "Low", - "subcategory": "Capacity Planning", - "text": "Estimate the number of Applications for each Application Group", + "severity": "Medium", + "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.", "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "FSLogix is not required for Personal Host Pools since each VM is statically assigned to a single user, then no immediate needs for a roaming profile solution. In some usage scenarios FSLogix can help. For example, a VM can be re-assigned, or user moved to another desktop, or roaming profile can be used to save user profile in a different location for DR purposes.", - "guid": "38b19ab6-0693-4992-9394-5590883916ec", - "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type?tabs=azure#reassign-a-personal-desktop", + "checklist": "WAF checklist", + "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", + "service": "SAP", "services": [ - "AVD", - "VM", - "Storage" + "Storage", + "SAP", + "WAF" ], "severity": "Low", - "subcategory": "Capacity Planning", - "text": "Evaluate the usage of FSLogix for Personal Host Pools", + "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.", + "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "Use the link provided to set a starting point for SKU decision, then validate using a performance test. Ensure a minimum of four cores for Production is selected per Session Host (multi-session)", - "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2", - "link": "https://docs.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs", + "checklist": "WAF checklist", + "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", "services": [ - "AVD", - "VM" + "WAF" ], "severity": "High", - "subcategory": "Capacity Planning", - "text": "Run workload performance test to determine the best Azure VM SKU and size to use", - "waf": "Performance" + "text": "Native database replication technology should be used to synchronize the database in a HA pair.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "It is critical to check AVD capacity and limits reported in the referenced article. Additional limits and thresholds apply for network, compute, storage and service management. ", - "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations", + "checklist": "WAF checklist", + "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", + "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", + "service": "SAP", "services": [ - "AVD", - "Storage" + "VNet", + "WAF" ], "severity": "High", - "subcategory": "Capacity Planning", - "text": "Verify AVD scalability limits for the environment", + "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "Host Pools with GPU require special configuration, please be sure to review the referenced article.", - "guid": "c936667e-13c0-4056-94b1-e945a459837e", - "link": "https://docs.microsoft.com/azure/virtual-desktop/configure-vm-gpu", + "checklist": "WAF checklist", + "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", + "service": "SAP", "services": [ - "AVD" - ], - "severity": "Low", - "subcategory": "Capacity Planning", - "text": "Determine if Session Hosts will require GPU", - "waf": "Performance" - }, - { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "Whenever is possible, it is recommended to leverage VM SKUs with Accelerated Networking feature. This feature does require specific VM SKU/size and OS versions, please see the list and requirement in the companion article.", - "guid": "b47a393a-0803-4272-a479-8b1578b219a4", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", - "services": [ - "AVD", - "VM" + "ASR", + "Entra", + "VM", + "WAF" ], - "severity": "Low", - "subcategory": "Capacity Planning", - "text": "Use Azure VM SKUs able to leverage Accelerated Networking", - "waf": "Performance" + "severity": "High", + "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "For proper planning and deployment, it is important to assess the maximum number of concurrent and total users for each Host Pool. Additionally, users from different regions may require different Host Pools to ensure the best user experience.", - "guid": "bb91a33d-90ca-4e2c-a881-3706f7c0cb9f", - "link": "https://learn.microsoft.com/azure/virtual-desktop/overview", + "checklist": "WAF checklist", + "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "services": [ - "AVD" + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": "Clients & Users", - "text": "Assess how many users will connect to AVD and from which regions", - "waf": "Performance" + "severity": "High", + "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "The dependencies on resources external to the AVD pool should be assessed and reviewed, for example Active Directory, external file shares or other storage, on-premises services and resources, network infrastructure components like VPN and or ExpressRoute, external services and 3rd-party components. For all these resources, latency from the AVD Host Pool needs to be evaluated and connectivity considered. Additionally, BCDR considerations need to be applied to these dependencies as well.", - "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop?toc=%2Fazure%2Fvirtual-desktop%2Ftoc.json&bc=%2Fazure%2Fvirtual-desktop%2Fbreadcrumb%2Ftoc.json", + "checklist": "WAF checklist", + "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", + "service": "SAP", "services": [ - "AVD", - "VPN", - "Storage", - "ExpressRoute" + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": "Clients & Users", - "text": "Assess external dependencies for each Host Pool", - "waf": "Performance" + "severity": "High", + "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD offers a variety of client types (fat, thin, web) to connect over different platforms (Windows, MacOS, iOS, Android). Review limitations of each client and compare multiple options when possible.", - "guid": "a1f6d565-99e5-458b-a37d-4985e1112dbd", - "link": "https://learn.microsoft.com/azure/virtual-desktop/users/connect-windows", + "checklist": "WAF checklist", + "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", "services": [ - "AVD" + "Storage", + "VM", + "WAF" ], - "severity": "Low", - "subcategory": "Clients & Users", - "text": "Review user client OS used and AVD client type", - "waf": "Performance" + "severity": "High", + "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "Depending on the user locations, and AVD region deployment, users may have a non-optimal experience, hence is important to test as soon as possible in a small PoC environment. Run the 'Azure Virtual Desktop Experience Estimator' tool to select the best Azure region to deploy Host Pools. Beyond 150ms latency, user experience may be not optimal.", - "guid": "d2f54b29-769e-43a6-a1e8-838ac936667e", - "link": "https://azure.microsoft.com/services/virtual-desktop/assessment/", + "checklist": "WAF checklist", + "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", + "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", + "service": "SAP", "services": [ - "AVD" + "Storage", + "SAP", + "WAF" ], "severity": "High", - "subcategory": "Clients & Users", - "text": "Run a PoC to validate end-to-end user experience and impact of network latency", - "waf": "Performance" + "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "RDP settings can currently only be configured at the host pool level, not per user/group. If different settings are required for different set of users, it is recommended to create multiple Host Pools.", - "guid": "3b365a5c-7acb-4e48-abe5-4cd79f2e8776", - "link": "https://docs.microsoft.com/azure/virtual-desktop/customize-rdp-properties", + "checklist": "WAF checklist", + "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", + "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", + "service": "SAP", "services": [ - "AVD" + "SAP", + "WAF" ], - "severity": "Low", - "subcategory": "Clients & Users", - "text": "Assess and document RDP settings for all user groups", - "waf": "Security" + "severity": "High", + "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD is a non-regional service, Host Pools can be created in any region, automatic redirection from closest front-end will happen automatically.", - "guid": "42e52f47-21d9-428c-8b1b-d521e44a29a9", - "link": "https://azure.microsoft.com/global-infrastructure/services/?products=virtual-desktop", + "checklist": "WAF checklist", + "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", + "service": "SAP", "services": [ - "AVD" + "LoadBalancer", + "SAP", + "WAF" ], "severity": "High", - "subcategory": "General", - "text": "Determine in which Azure regions AVD Host Pools will be deployed.", - "waf": "Performance" + "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD must store metadata to support the service; this is stored in the specified geography. However, this is independent of the regions where Host Pools are located.", - "guid": "bad37ead-53cc-47ce-8d7a-aab3571449ab", - "link": "https://docs.microsoft.com/azure/virtual-desktop/data-locations", + "checklist": "WAF checklist", + "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", + "service": "SAP", "services": [ - "AVD" + "LoadBalancer", + "WAF" ], - "severity": "Medium", - "subcategory": "General", - "text": "Determine metadata location for AVD service", + "severity": "High", + "text": "Make sure the Floating IP is enabled on the Load balancer", + "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Virtual Desktop Review", - "description": "Check for specific VM SKUs, especially if you need GPU or high-specs SKUs, and eventually Azure NetApp Files if used.", - "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91", - "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "checklist": "WAF checklist", + "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "SAP", "services": [ - "AVD", - "VM", - "Storage" + "WAF" ], - "severity": "Low", - "subcategory": "General", - "text": "Check Azure quotas and availability for specific VM sizes and types in the selected regions", + "severity": "High", + "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "AD DCs in Azure are recommended (at least two in different AZ) to reduce latency for users logging into AVD session hosts, and eventually for Azure NetApp Files and AD integration. A DC need to be able to talk to DCs for ALL child domains. As alternative, on-premise connectivity must be used to reach AD DCs.", - "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073", - "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", + "checklist": "WAF checklist", + "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", + "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", + "service": "SAP", "services": [ "Entra", - "AVD", - "VNet", - "Storage" + "SAP", + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Active Directory", - "text": "Create at least two Active Directory Domain Controllers (DCs) in Azure VNet environment close to AVD Host Pool", + "severity": "High", + "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.", "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "Recommended to create a separate OU per Host Pool under a separate OU hierarchy. These OUs will contain machine accounts of AVD Session Hosts. ", - "guid": "6db55f57-9603-4334-adf9-cc23418db612", - "link": "https://docs.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace", + "checklist": "WAF checklist", + "guid": "cbe05bbe-209d-4490-ba47-778424d11678", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", "services": [ "Entra", - "AVD" + "RBAC", + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Active Directory", - "text": "Create a specific OU in Active Directory for each Host Pool", - "waf": "Operations" + "severity": "High", + "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "Carefully review, and potentially block/filter inheritance of GPOs to the OUs containing AVD Host Pools. ", - "guid": "7126504b-b47a-4393-a080-327294798b15", - "link": "https://docs.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy", + "checklist": "WAF checklist", + "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", + "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", + "service": "SAP", "services": [ - "Entra", - "AVD" + "WAF" ], "severity": "Medium", - "subcategory": "Active Directory", - "text": "Review Domain GPOs that will be applied to OU and impacting Host Pool Session Hosts functionalities", - "waf": "Operations" + "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.", + "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "If Active Directory Domain GPOs are used, it is recommended to configure FSLogix using the built-in provided GPO ADMX template referenced in the companion article in the 'More Info' column", - "guid": "2226a8e3-50a4-4ac3-8bd6-ee150553051f", - "link": "https://learn.microsoft.com/fslogix/how-to-use-group-policy-templates", + "checklist": "WAF checklist", + "guid": "9674e7c7-7796-4181-8920-09f4429543ba", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", "services": [ - "Entra", - "AVD" + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Active Directory", - "text": "Configure FSLogix settings using the built-in provided GPO ADMX template", - "waf": "Operations" + "severity": "High", + "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "It is recommended to have a specific dedicated account with minimal permissions, and without the default 10 joins limitation. Review the companion article for more details.", - "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77", - "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#session-hosts", + "checklist": "WAF checklist", + "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "services": [ "Entra", - "AVD", - "VM" + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": "Active Directory", - "text": "Create a dedicated user account with only permissions to join VM to the domain", - "waf": "Security" + "severity": "High", + "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "Avoid granting access per user, instead use AD groups and replicate them using Active Directory Connector (ADC) in Microsoft Entra ID (former Azure AD). ", - "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c", - "link": "https://docs.microsoft.com/azure/virtual-desktop/manage-app-groups", + "checklist": "WAF checklist", + "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "services": [ - "Entra", - "AVD" + "ACR", + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": "Active Directory", - "text": "Create a domain user group for each set of users that will be granted access to each Host Pool Application Group (DAG or RAG)", - "waf": "Security" + "severity": "High", + "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "If Azure Files Active Directory (AD) integration is used, as part of the configuration procedure, an AD account to represent the storage account (file share) will be created. You can choose to register as a computer account or service logon account, see FAQ for details. For computer accounts, there is a default password expiration age set in AD at 30 days. Similarly, the service logon account may have a default password expiration age set on the AD domain or Organizational Unit (OU). For both account types, we recommend you check the password expiration age configured in your AD environment and plan to update the password of your storage account identity of the AD account before the maximum password age. You can consider creating a new AD Organizational Unit (OU) in AD and disabling password expiration policy on computer accounts or service logon accounts accordingly.", - "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3", - "link": "https://docs.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable", + "checklist": "WAF checklist", + "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "services": [ "Entra", - "AVD", - "AzurePolicy", - "Storage" + "SAP", + "WAF" ], "severity": "High", - "subcategory": "Active Directory", - "text": "Review your organization password expiration policy for accounts used by Azure Files AD integration", - "waf": "Security" + "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "You can configure this using Active Directory Connect (ADC) or Azure AD Domain Services (for hybrid or cloud organizations). Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).", - "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a", - "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity", + "checklist": "WAF checklist", + "guid": "ed46b937-913e-4018-9c62-8393ab037e53", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", + "service": "SAP", "services": [ "Entra", - "AVD" + "VM", + "WAF" ], - "severity": "High", - "subcategory": "Active Directory", - "text": "A Windows Server Active Directory forest/domain must be in sync with Microsoft Entra ID", + "severity": "Medium", + "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "If Azure Files is used and pre-requisites can be satisfied, it is recommended to configure (Microsoft Entra ID) Kerberos authentication. This configuration will allow to store FSLogix profiles that can be accessed by hybrid user identities from Azure AD-joined session hosts without requiring network line-of-sight to domain controllers.", - "guid": "e777fd5e-c5f1-4d6e-8fa9-fc210b88e338", - "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable", + "checklist": "WAF checklist", + "guid": "f656e745-0cfb-453e-8008-0528fa21c933", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "services": [ - "Entra", - "AVD", - "Storage" + "Storage", + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Microsoft Entra ID", - "text": "Configure Azure Files share for Microsoft Entra ID (former Azure AD) Kerberos authentication on Microsoft Entra ID Joined scenario", - "waf": "Security" + "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "An Azure subscription must be parented to the same Microsoft Entra ID (former Azure AD) tenant, that contains a virtual network that either contains or is connected to the Windows Server Active Directory Domain Services or Microsoft Entra ID Domain Services instance.", - "guid": "6ceb5443-5125-4922-9442-93bb628537a5", - "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity", + "checklist": "WAF checklist", + "guid": "7f684ebc-95da-425e-b329-e782dbed050f", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", + "service": "SAP", "services": [ - "Entra", - "AVD", - "VNet", - "Subscriptions" + "SAP", + "WAF" ], - "severity": "High", - "subcategory": "Requirements", - "text": "A Microsoft Entra ID tenant must be available with at least one subscription linked", + "severity": "Medium", + "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "Azure Virtual Desktop supports different types of identities depending on which configuration you choose. Please review the supported scenarios mentioned in the 'More Info' article and document the design decision accordingly in the 'Comment' column. Critically, external identities (B2B or B2C) are not supported. Be sure to review also the list of supported scenarios in https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios.", - "guid": "b4ce4781-7557-4a1f-8043-332ae199d44c", - "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication", + "checklist": "WAF checklist", + "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", "services": [ - "Entra", - "AVD" + "Storage", + "WAF" ], "severity": "High", - "subcategory": "Requirements", - "text": "Review and document your identity scenario", - "waf": "Security" + "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "Users need accounts that are in Microsoft Entra ID (former Azure AD). If you're also using AD DS or Azure AD Domain Services in your deployment of Azure Virtual Desktop, these accounts will need to be hybrid identities, which means the user accounts are synchronized. If you're using Microsoft Entra ID with AD DS, you'll need to configure Azure AD Connect to synchronize user identity data between AD DS and Microsoft Entra ID. If you're using Microsoft Entra ID with Azure AD Domain Services, user accounts are synchronized one way from Microsoft Entra ID to Azure AD Domain Services. This synchronization process is automatic. AVD also supports Microsoft Entra ID native accounts with some restrictions. External identities (B2B or B2C) are not supported.", - "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b", - "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios", + "checklist": "WAF checklist", + "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", + "service": "SAP", "services": [ - "Entra", - "AVD" + "Storage", + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": "Requirements", - "text": "Assess User Account types and requirements", - "waf": "Security" + "severity": "High", + "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.", + "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD supports SSO using either Active Directory Federation Services (AD FS) or Microsoft Entra ID (former Azure AD) authentication. The latter is recommended, please check the requirements and limitation in the 'More Info' article. Using AD FS could be a viable choice if already present in the customer environment, it is not recommended to deploy a brand new ADFS infrastructure just for AVD SSO implementation.", - "guid": "5f9f680a-ba07-4429-bbf7-93d7071561f4", - "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication#single-sign-on-sso", + "checklist": "WAF checklist", + "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", + "service": "SAP", "services": [ - "Entra", - "AVD" + "Storage", + "SAP", + "ASR", + "WAF" ], - "severity": "Medium", - "subcategory": "Requirements", - "text": "If Single-Sign On (SSO) is a requirement, review the supported scenarios and prerequisites", + "severity": "High", + "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "VMs can be Windows Active Directory (AD) domain-joined, Hybrid AD-joined, Microsoft Entra ID (former Azure AD) Joined or Azure AD Domain Services joined. Be sure to review supported scenarios, limitations and requirements from the referenced article.", - "guid": "ea962a15-9394-46da-a7cc-3923266b2258", - "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios", + "checklist": "WAF checklist", + "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", + "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", + "service": "SAP", "services": [ - "Entra", - "AVD", - "VM" + "Storage", + "SAP", + "WAF" ], "severity": "High", - "subcategory": "Requirements", - "text": "Select the proper AVD Session Host domain join type", - "waf": "Security" + "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Virtual Desktop Review", - "description": "Compare self-managed Windows Active Directory Domain Services, Microsoft Entra ID (former Azure AD), and managed Azure AD Domain Services (AAD-DS)", - "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b", - "link": "https://docs.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions", + "checklist": "WAF checklist", + "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", + "service": "SAP", "services": [ - "Entra", - "AVD" + "SAP", + "Cost", + "WAF" ], - "severity": "Low", - "subcategory": "Requirements", - "text": "Before using Azure AD Domain Services (AAD-DS) for AVD, be sure to review the limitations.", - "waf": "Reliability" + "severity": "Medium", + "text": "Automate SAP System Start-Stop to manage costs.", + "waf": "Cost" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD provides administrative templates for Intune and Active Directory GPO. Using these templates it is possible to centrally control several AVD configuration settings: Graphics related data logging, Screen capture protection, RDP Shortpath for managed networks, Watermarking. See companion article in 'More Info' colum for details. NOTE: FSLogix has its own separate template.", - "guid": "5549524b-36c0-4f1a-892b-ab3ca78f5db2", - "link": "https://learn.microsoft.com/azure/virtual-desktop/administrative-template", + "checklist": "WAF checklist", + "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", "services": [ - "Entra", - "AVD", - "Monitor" + "Storage", + "WAF", + "Cost", + "VM", + "SAP" ], "severity": "Low", - "subcategory": "Management", - "text": "Use built-in provided administrative templates for AVD settings configuration", - "waf": "Operations" + "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.", + "waf": "Cost" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "Determine if a configuration management tool is already in place to manage Host Pool VM configuration after initial deployment, For example SCCM/SCOM, Intune/ConfigurationManager, 3rd-party solutions.", - "guid": "3334fdf9-1c23-4418-8b65-285269440b4b", - "link": "https://learn.microsoft.com/azure/virtual-desktop/management", + "checklist": "WAF checklist", + "guid": "9877f353-2591-4e8b-8381-e9043fed1010", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", "services": [ - "AVD", + "Storage", + "WAF", + "Cost", "VM", - "Monitor" + "SAP" ], "severity": "Low", - "subcategory": "Management", - "text": "Plan AVD Session Hosts configuration management strategy", - "waf": "Operations" + "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.", + "waf": "Cost" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "We recommend using Microsoft Intune, if requirements can be satisfied, to manage your Azure Virtual Desktop environment. Review supported scenarios and requirements to enable Intune for AVD Session Host management in the referenced article in the “More Info” column. Document your choice in the 'Comment' column. In that article, review the different requirements and capabilities for single-session https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop and multi-session https://learn.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session AVD.", - "guid": "63a08be1-6004-4b4a-a79b-f3239faae113", - "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop", + "checklist": "WAF checklist", + "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", + "service": "SAP", "services": [ - "AVD", - "Monitor" + "RBAC", + "Subscriptions", + "WAF" ], - "severity": "Medium", - "subcategory": "Management", - "text": "Evaluate Intune for AVD Session Hosts management", - "waf": "Operations" + "severity": "High", + "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "The scaling tool provides a low-cost automation option for customers who want to optimize their session host VM costs. You can use the scaling tool to schedule VMs to start and stop based on Peak and Off-Peak business hours, scale out VMs based on number of sessions per CPU core, scale in VMs during Off-Peak hours, leaving the minimum number of session host VMs running. Not available yet for Personal Host Pool type.", - "guid": "7138b820-102c-4e16-be30-1e6e872e52e3", - "link": "https://learn.microsoft.com/azure/virtual-desktop/autoscale-scenarios", + "checklist": "WAF checklist", + "guid": "45911475-e39e-4530-accc-d979366bcda2", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "services": [ - "AVD", - "VM", - "Cost", - "Monitor" + "Entra", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Management", - "text": "Assess the requirements for host pool auto-scaling capability", - "waf": "Reliability" - }, - { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "Start VM On Connect lets you reduce costs by enabling end users to turn on their session host virtual machines (VMs) only when they need them. You can then turn off VMs when they're not needed. You can configure Start VM on Connect for personal or pooled host pools using the Azure portal or PowerShell. Start VM on Connect is a host pool wide setting.", - "guid": "55f612fe-f215-4f0d-a956-10e7dd96bcbc", - "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect", - "services": [ - "AVD", - "VM", - "Cost", - "Monitor" - ], - "severity": "Low", - "subcategory": "Management", - "text": "Consider the usage of Start VM on Connect for Personal Host Pools", - "waf": "Cost" - }, - { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "'Start VM On Connect' provides a smart way to automatically start previously stopped Session Hosts but does not provide a mechanism to shut down when not in used. Administrators are encouraged to configure additional policies to sign users out of their sessions and run Azure automation scripts to de-allocate VMs. Users should be not allowed to shut down their Personal Hosts since will not be able to de-allocate Azure VMs, then billing will still be active with no cost reduction.", - "guid": "79a686ea-d971-4ea0-a9a8-1aea074c94cb", - "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect-faq#are-vms-automatically-deallocated-when-a-user-stops-using-them", - "services": [ - "AVD", - "Monitor", - "Cost", - "AzurePolicy", - "VM" - ], - "severity": "Low", - "subcategory": "Management", - "text": "Evaluate the implementation of an ad-hoc mechanism to shut down Personal AVD Session Hosts", - "waf": "Cost" + "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "Azure Virtual Desktop billing is mainly based on cost associated to compute, networking and storage resources consumed by Host Pools. In addition to this, costs can be generated by dependent resources, for example VPN or ExpressRoute or vWAN, Active Directory Domain Controllers, DNS, etc. There is no direct cost associated to AVD objects like workspaces, host pools or application groups. To make AVD associated costs more evident and grouped by Host Pool, it is recommended to use 'cm-resource-parent' tag. ", - "guid": "51bcafca-476a-48fa-9b91-9645a7679f20", - "link": "https://learn.microsoft.com/azure/virtual-desktop/tag-virtual-desktop-resources", + "checklist": "WAF checklist", + "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "services": [ - "AVD", - "Monitor", - "ExpressRoute", - "Cost", - "DNS", - "VPN", - "Storage", - "VWAN" + "Entra", + "SAP", + "WAF" ], - "severity": "Low", - "subcategory": "Management", - "text": "Review and adopt suggested Azure Tags for Azure Virtual Desktop", - "waf": "Cost" + "severity": "Medium", + "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "Azure Advisor analyzes your configurations and telemetry to offer personalized recommendations to solve common problems. With these recommendations, you can optimize your Azure resources for reliability, security, operational excellence, performance, and cost.", - "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4", - "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor-recommendations", + "checklist": "WAF checklist", + "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", "services": [ - "Entra", - "AVD", - "Cost", - "Monitor" + "SAP", + "WAF" ], - "severity": "Low", - "subcategory": "Management", - "text": "Periodically check Azure Advisor recommendations for AVD", - "waf": "Operations" + "severity": "Medium", + "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "Customers have several options: Microsoft Configuration Manager, this article explains how to automatically apply updates to a Azure Virtual Desktop session hosts running Windows 10/11: https://learn.microsoft.com/azure/virtual-desktop/configure-automatic-updates, Microsoft Intune: https://docs.microsoft.com/mem/intune/fundamentals/windows-virtual-desktop-multi-session, Azure Update Management and WSUS for Windows Server OS only (client OS not supported: https://learn.microsoft.com/azure/automation/update-management/operating-system-requirements), 3rd Party tools. Outside an emergency security patching situation, it is recommended to move away from an 'in-place' update strategy patching strategy and adopt a re-imaging approach.", - "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa", - "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop-multi-session", + "checklist": "WAF checklist", + "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", + "service": "SAP", "services": [ - "AVD", - "Monitor" + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Management", - "text": "Plan for a Session Host emergency patching and update strategy", - "waf": "Operations" + "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "The Scheduled Agent Updates feature lets you create up to two maintenance windows per Host Pool to update AVD components at a convenient time. It is recommended to specify maintenance windows then upgrading Session Hosts will not happen during peak business hours. Scheduled Agent Updates is disabled by default. This means that, unless you enable this setting, the agent can get updated at any time by the agent update flighting service.", - "guid": "c067939b-e5ca-4698-b9ce-3bd91843e73f", - "link": "https://learn.microsoft.com/azure/virtual-desktop/scheduled-agent-updates", + "checklist": "WAF checklist", + "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", "services": [ - "AVD", - "Monitor" + "SAP", + "WAF" ], - "severity": "Low", - "subcategory": "Management", - "text": "Configure the Scheduled Agent Updates feature", - "waf": "Reliability" + "severity": "Medium", + "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "Host pools are a collection of one or more identical virtual machines within Azure Virtual Desktop environment. We highly recommend you create a validation host pool where service updates are applied first. This allows you to monitor service updates before the service applies them to your standard or non-validation environment.", - "guid": "d1e8c38e-c936-4667-913c-005674b1e944", - "link": "https://docs.microsoft.com/azure/virtual-desktop/create-validation-host-pool", + "checklist": "WAF checklist", + "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", + "service": "SAP", "services": [ - "AVD", - "VM", - "Monitor" + "SAP", + "AKV", + "WAF" ], "severity": "Medium", - "subcategory": "Management", - "text": "Create a validation (canary) Host Pool", - "waf": "Operations" + "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "An AVD Host Pool can be deployed in several ways: Azure Portal, ARM templates, Azure CLI tool, Powershell, manual VM creation with registration token, Terraform, 3rd-party tools. It is important to adopt proper method/s to support automatic deployment through automation and CI/CD tools.", - "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-platform-automation-and-devops", + "checklist": "WAF checklist", + "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", + "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", + "service": "SAP", "services": [ - "AVD", - "VM", - "Monitor" + "SAP", + "AKV", + "WAF" ], "severity": "Medium", - "subcategory": "Management", - "text": "Determine Host Pool deployment strategy", - "waf": "Operations" + "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "After you register a VM to a host pool within the Azure Virtual Desktop service, the agent regularly refreshes the VM's token whenever the VM is active. The certificate for the registration token is valid for 90 days. Because of this 90-day limit, we recommend VMs to be online for 20 minutes every 90 days so that the machine can refresh its tokens and update the agent and side-by-side stack components.", - "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e", - "link": "https://docs.microsoft.com/azure/virtual-desktop/faq", + "checklist": "WAF checklist", + "guid": "16785d6f-a96c-496a-b885-18f482734c88", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", + "service": "SAP", "services": [ - "AVD", - "VM", - "Monitor" + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Management", - "text": "Turn on Session Host VMs at least every 90 days for token refresh", - "waf": "Operations" + "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "Azure Virtual Desktop Insights is a dashboard built on Azure Monitor Workbooks that helps IT professionals understand their Azure Virtual Desktop environments. Read the referenced article to learn how to set up Azure Monitor for Azure Virtual Desktop to monitor your AVD environments.", - "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c", - "link": "https://learn.microsoft.com/azure/virtual-desktop/insights", + "checklist": "WAF checklist", + "guid": "a747c350-8d4c-449c-93af-393dbca77c48", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", + "service": "SAP", "services": [ - "AVD", - "Monitor" + "SAP", + "WAF" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Enable monitoring for AVD", - "waf": "Reliability" + "severity": "Medium", + "text": "Implement SSO to SAP HANA", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "Azure Virtual Desktop uses Azure Monitor and Log Analytics for monitoring and alerts like many other Azure services. This lets admins identify issues through a single interface. The service creates activity logs for both user and administrative actions. Each activity log falls under the following categories: Management, Feed, Connections, Host Registration, Errors, Checkpoints. ", - "guid": "81770afb-c4c0-4e43-a186-58d2857ed671", - "link": "https://docs.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics", + "checklist": "WAF checklist", + "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", + "service": "SAP", "services": [ - "AVD", - "VM", - "Monitor" + "Entra", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Enable diagnostic settings for Workspaces, Host Pools, Application Groups and Host VMs to Log Analytics workspace", - "waf": "Reliability" + "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "See the referenced article and this additional one to setup proper monitoring and alerting for storage: https://docs.microsoft.com/azure/storage/files/storage-troubleshooting-files-performance. ", - "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c", - "link": "https://docs.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal", + "checklist": "WAF checklist", + "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", + "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", + "service": "SAP", "services": [ - "AVD", - "Storage", - "Monitor" + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Create alerts on the profile storage to be alerted in case of high usage and throttling", - "waf": "Reliability" + "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.", + "waf": "Security" }, { - "category": "Monitoring and Management", - "checklist": "Azure Virtual Desktop Review", - "description": "You can use Azure Service Health to monitor service issues and health advisories for Azure Virtual Desktop. Azure Service Health can notify you with different types of alerts (for example, email or SMS), help you understand the effect of an issue, and keep you updated as the issue resolves.", - "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6", - "link": "https://docs.microsoft.com/azure/virtual-desktop/set-up-service-alerts", + "checklist": "WAF checklist", + "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", + "service": "SAP", "services": [ - "AVD", - "Monitor" + "Entra", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Configure Azure Service Health for AVD alerts ", - "waf": "Reliability" + "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "If required to connect to on-premises environment, assess the current connectivity option or plan for the required connectivity (ExpressRoute, Azure S2S or 3rd-party NVA VPN). ", - "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b", - "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/", + "checklist": "WAF checklist", + "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", + "service": "SAP", "services": [ - "AVD", - "VPN", - "NVA", - "ExpressRoute" + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Determine if hybrid connectivity is required to connect to on-premises environment", - "waf": "Reliability" + "text": "Implement SSO to SAP BTP", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD Host Pools can be deployed in either Azure Virtual WAN or traditional 'Hub & Spoke' network topologies. It is recommended to deploy each Host Pool in a separate 'spoke' VNet, using 'hub' is not recommended.", - "guid": "c8639648-a652-4d6c-85e5-02965388e5de", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-network-topology-and-connectivity", + "checklist": "WAF checklist", + "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", + "service": "SAP", "services": [ - "AVD", - "VNet", - "VWAN" + "Entra", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Determine Azure Virtual Network (VNet) placement for each AVD Host Pool", - "waf": "Performance" + "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "Evaluate the bandwidth requirements, ensure VPN/ER bandwidth will be enough, ensure proper routing and firewall rules are in place, test end-to-end latency. ", - "guid": "d227dd14-2b06-4c21-a799-9a646f4389a7", - "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/", + "checklist": "WAF checklist", + "guid": "6ba28021-4591-4147-9e39-e5309cccd979", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", + "service": "SAP", "services": [ - "AVD", - "VPN" + "Subscriptions", + "SAP", + "AzurePolicy", + "WAF" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Assess which on-premises resources are required from AVD Host Pools", - "waf": "Reliability" + "text": "enforce existing Management Group policies to SAP Subscriptions", + "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "Several options are available. You can use Azure Firewall or equivalent 3rd-party NVA, Network Security Group (NSG) and/or Proxy servers. NSG is not able to enable/disable by URL, only ports and protocols. Proxy should be used only as explicit setting in user browser. Details on using Azure Firewall Premium with AVD are reported in the companion article in the 'More Info' column. Be sure to allow proper access to required AVD URLs. Forced Tunneling to on-premises is not recommended.", - "guid": "fc4972cd-3cd2-41bf-9703-6e5e6b4bed3d", - "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop", + "checklist": "WAF checklist", + "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", "services": [ - "AVD", - "VNet", - "NVA", - "Firewall" + "Subscriptions", + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": "Networking", - "text": "Need to control/restrict Internet outbound traffic for AVD hosts?", - "waf": "Security" + "severity": "High", + "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "Required URLs for AVD control plane access by session hosts are documented here: https://docs.microsoft.com/azure/virtual-desktop/safe-url-list. A check tool is available to verify connectivity from the session hosts: https://docs.microsoft.com/azure/virtual-desktop/safe-url-list#required-url-check-tool. Forced Tunneling to on-premises is not recommended.", - "guid": "65c7acbe-45bb-4e60-ad89-f2e87778424d", - "link": "https://docs.microsoft.com/azure/virtual-desktop/safe-url-list", + "checklist": "WAF checklist", + "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", "services": [ - "AVD" + "Subscriptions", + "WAF" ], "severity": "High", - "subcategory": "Networking", - "text": "Ensure AVD control plane endpoints are accessible", - "waf": "Reliability" + "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ", + "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "Consider the usage of Azure Defender Endpoint or similar 3rd-party agents to control user web navigation, see the Security section for more details.", - "guid": "73676ae4-6691-4e88-95ad-a42223e13810", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/onboard-windows-multi-session-device?view=o365-worldwide", + "checklist": "WAF checklist", + "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", + "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", + "service": "SAP", "services": [ - "Defender", - "AVD" + "Subscriptions", + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Networking", - "text": "Need to control/restrict Internet outbound traffic only for users on AVD hosts? ", - "waf": "Security" + "severity": "High", + "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)", + "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "Custom UDR and NSG can be applied to AVD Host Pool subnets, for example to redirect to Azure Firewall or NVA, or to filter/block network traffic. In this case is recommended to carefully review to ensure optimal path for outbound traffic to AVD control plane is used. Service Tags can now be used with UDR and NSG, then AVD management plane traffic can be easily allowed: https://learn.microsoft.com/azure/virtual-desktop/safe-url-list.", - "guid": "523181a9-4174-4158-93ff-7ae7c6d37431", - "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop", + "checklist": "WAF checklist", + "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", + "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", + "service": "SAP", "services": [ - "AVD", - "VNet", - "NVA", - "Firewall" + "WAF" ], "severity": "Low", - "subcategory": "Networking", - "text": "Review custom UDR and NSG for AVD Host Pool subnets", - "waf": "Security" + "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "Network traffic from AVD Session Host VMs to AVD control plane should be as direct as possible. Redirecting this traffic through a Proxy or Firewall with deep packet inspection and/or SSL termination could cause serious issues and bad customer experience. It is recommended to bypass Proxy and Firewall just for the AVD control plane. User generated traffic surfing the web instead, should be filtered by Firewall and/or redirected to a Proxy. For details and guidelines, please see the companion article in the 'More Info' column.", - "guid": "cc6edca0-aeca-4566-9e92-cf246f1465af", - "link": "https://learn.microsoft.com/azure/virtual-desktop/proxy-server-support", + "checklist": "WAF checklist", + "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", + "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", + "service": "SAP", "services": [ - "AVD", - "VM" + "Subscriptions", + "VM", + "WAF" ], "severity": "High", - "subcategory": "Networking", - "text": "Do not use Proxy servers, SSL termination and Deep Packet Inspection for AVD control plane traffic", - "waf": "Reliability" + "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "It is recommended to assess and review networking bandwidth requirements for users, based on the specific workload type. The referenced article provide general estimations and recommendations, but specific measure are required for proper sizing. ", - "guid": "516785c6-fa96-4c96-ad88-408f372734c8", - "link": "https://learn.microsoft.com/azure/virtual-desktop/rdp-bandwidth", + "checklist": "WAF checklist", + "guid": "e6e20617-3686-4af4-9791-f8935ada4332", + "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", + "service": "SAP", "services": [ - "AVD", - "VM" + "WAF" ], - "severity": "Low", - "subcategory": "Networking", - "text": "Check the network bandwidth required for each user and in total for the VM SKU", - "waf": "Performance" + "severity": "High", + "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "If Azure Files SMB share will be used to store user profiles via FSLogix, the usage of Private Endpoint (PE) for private access to the storage is recommended. AVD Session Hosts will access the storage using a private IP in the same VNet, a separate subnet is recommended. This feature has an additional cost that must be evaluated. If PE will not be used, at least Service Endpoint is recommended (no cost associated).", - "guid": "ec27d589-9178-426d-8df2-ff60020f30a6", - "link": "https://learn.microsoft.com/azure/storage/files/storage-files-networking-endpoints", + "checklist": "WAF checklist", + "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", + "service": "SAP", "services": [ - "AVD", - "VNet", + "TrafficManager", "Cost", - "PrivateLink", - "Storage" + "WAF" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Evaluate usage Private Endpoint for Azure Files share", - "waf": "Security" + "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure Virtual Desktop Review", - "description": "Connections to Azure Virtual Desktop can use TCP or UDP. RDP Shortpath is a feature of AVD that establishes a direct UDP-based transport between a supported Windows Remote Desktop client and session host. if clients have line of sight to AVD session hosts from internal network (VPN usage is not recommended), this feature can provide lower latency and best performances as explained in https://learn.microsoft.com/azure/virtual-desktop/rdp-shortpath?tabs=managed-networks#key-benefits.", - "guid": "b2074747-d01a-4f61-b1aa-92ad793d9ff4", - "link": "https://docs.microsoft.com/azure/virtual-desktop/shortpath", + "checklist": "WAF checklist", + "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", "services": [ - "AVD", - "VPN" + "Backup", + "WAF" ], - "severity": "Medium", - "subcategory": "Networking", - "text": "Evaluate usage of RDP ShortPath for clients connecting from managed internal networks", - "waf": "Performance" + "severity": "High", + "text": "Help protect your HANA database by using the Azure Backup service.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Security mechanisms provided by GPO should be used, if available. For example, it is possible to impose desktop screen lock and idle session disconnection time. Existing GPOs applied to on-premises environment should be reviewed and eventually applied also to secure also AVD Hosts when joined to the domain.", - "guid": "a135e337-897e-431c-97d6-8cb6a22ac19f", - "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#establish-maximum-inactive-time-and-disconnection-policies", + "checklist": "WAF checklist", + "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", + "service": "SAP", "services": [ - "AVD" + "Storage", + "Entra", + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Active Directory", - "text": "Review Active Directory GPO to secure RDP sessions", - "waf": "Security" + "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Microsoft Defender for Endpoint supports Azure Virtual Desktop for Windows 10/11 Enterprise multi-session. Check article for onboarding non-persistent virtual desktop infrastructure (VDI) devices: https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi", - "guid": "b1172576-9ef6-4691-a483-5ac932223ece", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus", + "checklist": "WAF checklist", + "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", "services": [ - "Defender", - "AVD" + "SAP", + "WAF" ], "severity": "High", - "subcategory": "Host Configuration", - "text": "Ensure anti-virus and anti-malware solutions are used", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Disks in Azure are already encrypted at rest by default with Microsoft managed keys. Host VM OS disk encryption is possible and supported using Azure Disk Encryption (ADE - BitLocker) and Disk Encryption Set (DES - Server Side Encryption), the latter is recommended. Encryption of FSLogix storage using Azure Files can be done using SSE on Azure Storage. For OneDrive encryption, see this article: https://docs.microsoft.com/compliance/assurance/assurance-encryption-for-microsoft-365-services.", - "guid": "0fd32907-98bc-4178-adc5-a06ca7144351", - "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", - "services": [ - "AVD", - "VM", - "Storage", - "AKV" - ], - "severity": "Low", - "subcategory": "Host Configuration", - "text": "Assess disk encryption requirements for AVD Session Hosts", - "waf": "Security" + "text": "Ensure time-zone matches between the operating system and the SAP system.", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Trusted launch are Gen2 Azure VMs with enhanced security features aimed to protect against “bottom of the stack” threats through attack vectors such as rootkits, boot kits, and kernel-level malware. Recommended to enable and leverage Secure Boot, Virtual TPM (vTPM) and Integrity Monitoring.", - "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28", - "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#azure-virtual-desktop-support-for-trusted-launch", + "checklist": "WAF checklist", + "guid": "c3c7abc0-716c-4486-893c-40e181d65539", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", + "service": "SAP", "services": [ - "AVD", - "VM", - "Monitor" + "Entra", + "WAF" ], "severity": "Medium", - "subcategory": "Host Configuration", - "text": "Enable Trusted launch in Azure Gen2 VM Session Hosts", - "waf": "Security" + "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Trusted Launch and Gen2 VM are not only security and performance enhancing features but also system requirements for Windows 11. When building an AVD environment based on Windows 11, it is essential to enable these features.", - "guid": "135d3899-4b31-44d3-bc8f-028871a359d8", - "link": "https://learn.microsoft.com/windows/whats-new/windows-11-requirements", + "checklist": "WAF checklist", + "guid": "a491dfc4-9353-4213-9217-eef0949f9467", + "link": "https://azure.microsoft.com/pricing/offers/dev-test/", + "service": "SAP", "services": [ - "AVD", - "VM" + "Cost", + "WAF" ], - "severity": "High", - "subcategory": "Host Configuration", - "text": "Enable Trusted Launch and use Gen2 image are system requirements for Windows 11", - "waf": "Security" + "severity": "Low", + "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Displayed content will be automatically blocked or hidden in screenshots. Keep in mind screen sharing will also be blocked when using Teams or other collaboration software which use screen sharing.", - "guid": "a49dc137-7896-4343-b2bc-1a31bf1d30b6", - "link": "https://learn.microsoft.com/azure/virtual-desktop/screen-capture-protection", + "checklist": "WAF checklist", + "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", + "link": "https://learn.microsoft.com/azure/lighthouse/overview", + "service": "SAP", "services": [ - "AVD" + "Entra", + "SAP", + "WAF" ], - "severity": "Low", - "subcategory": "Host Configuration", - "text": "Consider enabling screen capture protection to prevent sensitive information from being captured", - "waf": "Security" + "severity": "Medium", + "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "If not absolutely required, redirecting drives, printers, and USB devices to a user's local device in a remote desktop session should be disabled or highly restricted. Restrict Windows Explorer access by hiding local and remote drive mappings is also a secure measure to adopt preventing users from discovering unwanted information about system configuration and users.", - "guid": "7ce2cd20-85b4-4f82-828e-6558736ede6a", - "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#other-security-tips-for-session-hosts", + "checklist": "WAF checklist", + "guid": "4d116785-d2fa-456c-96ad-48408fe72734", + "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", + "service": "SAP", "services": [ - "AVD" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Host Configuration", - "text": "Restrict device redirection and drive mapping", - "waf": "Security" + "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.", + "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "When choosing a deployment model, you can either provide remote users access to entire virtual desktops or only select applications. Remote applications, or RemoteApps, provide a seamless experience as the user works with apps on their virtual desktop. RemoteApps reduce risk by only letting the user work with a subset of the remote machine exposed by the application.", - "guid": "4e25d70e-3924-44f4-b66f-d6cdd4f4a973", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/web-protection-overview", + "checklist": "WAF checklist", + "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", + "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", + "service": "SAP", "services": [ - "AVD" + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": "Management", - "text": "When possible, prefer Remote Apps over Full Desktops (DAG)", - "waf": "Security" + "severity": "Low", + "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Web content filtering feature provided by Web Protection capability in Microsoft Defender for Endpoint, can be used to to control user web navigation. If this tool is used, configuration of web filtering for user Internet browsing is recommended. Access by the Guest OS system to required AVD control plane URLs must be guaranteed.", - "guid": "e19dd344-29eb-4722-a237-a151c5bb4e4f", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/web-protection-overview", + "checklist": "WAF checklist", + "guid": "14591147-5e39-4e53-89cc-cd979366bcda", + "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", + "service": "SAP", "services": [ - "Defender", - "AVD" + "Monitor", + "SAP", + "WAF", + "SQL" ], "severity": "Medium", - "subcategory": "Management", - "text": "Need to control/restrict user Internet navigation from AVD session hosts?", - "waf": "Security" + "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "We recommend you don't grant your users admin access to virtual desktops. If you need software packages, we recommend you make them available through configuration management utilities.", - "guid": "a0cdb3b5-4eb2-4eb0-9dda-a3592718e2ed", - "link": "https://docs.microsoft.com/azure/virtual-desktop/security-guide", + "checklist": "WAF checklist", + "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", + "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", + "service": "SAP", "services": [ - "AVD" + "Entra", + "WAF", + "Monitor", + "VM", + "SAP" ], "severity": "High", - "subcategory": "Management", - "text": "Ensure AVD users will not have local administrator privileges on AVD Hosts", - "waf": "Security" + "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.", + "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "We recommend you enable Defender for Cloud for the subscriptions, virtual machines, key vaults, and storage accounts used by AVD. With this tool is possible to assess and manage vulnerabilities, assess compliance with common frameworks like PCI, strengthen the overall security of your AVD environment and measure it over time using 'Secure Score': https://learn.microsoft.com/azure/virtual-desktop/security-guide#improve-your-secure-score.", - "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998", - "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#enable-microsoft-defender-for-cloud", + "checklist": "WAF checklist", + "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "SAP", "services": [ - "AVD", - "Subscriptions", - "Defender", - "AKV", - "Storage", - "VM" + "AzurePolicy", + "WAF" ], "severity": "Medium", - "subcategory": "Management", - "text": "Enable Microsoft Defender for Cloud to manage AVD Session Hosts security posture", - "waf": "Security" + "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Enabling audit log collection lets you view user and admin activity related to Azure Virtual Desktop and store in a central repository like Log Analytics workspace. ", - "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352", - "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#collect-audit-logs", + "checklist": "WAF checklist", + "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", + "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", + "service": "SAP", "services": [ - "Entra", - "AVD", - "Monitor" + "Monitor", + "SAP", + "WAF", + "NetworkWatcher" ], "severity": "Medium", - "subcategory": "Management", - "text": "Enable diagnostic and audit logging", - "waf": "Security" + "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Assign the least privilege required by defining administrative, operations, and engineering roles to Azure RBAC roles. To limit access to high privilege roles within your Azure Virtual Desktop landing zone, consider integration with Azure Privileged Identity Management (PIM). Maintaining knowledge of which team is responsible for each particular administrative area helps you determine Azure role-based access control (RBAC) roles and configuration.", - "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b", - "link": "https://docs.microsoft.com/azure/virtual-desktop/rbac", + "checklist": "WAF checklist", + "guid": "73686af4-6791-4f89-95ad-a43324e13811", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", + "service": "SAP", "services": [ - "RBAC", - "AVD", - "Entra" + "SAP", + "VM", + "WAF" ], - "severity": "Low", - "subcategory": "Management", - "text": "Assess the requirement to use custom RBAC roles for AVD management", - "waf": "Security" + "severity": "Medium", + "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "AVD users should not have permission to install application. If required, Windows Defender Application Control (WDAC) can be used to control which drivers and applications are allowed to run on their Windows clients. ", - "guid": "b9ea80c8-0628-49fc-ae63-125aa4c0a284", - "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#windows-defender-application-control", + "checklist": "WAF checklist", + "guid": "616785d6-fa96-4c96-ad88-518f482734c8", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", "services": [ - "Defender", - "AVD" + "Subscriptions", + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": "Management", - "text": "Restrict users from installing un-authorized applications", - "waf": "Security" + "severity": "High", + "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.", + "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "waf": "Performance" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "Enabling MFA and CA lets you manage risks before you grant users access to your AVD environment. When deciding which users to grant access to, we recommend you also consider who the user is, how they sign in, and which device they're using. Additional details and configuration procedures are provided in the companion article. Microsoft Entra ID is the new name for Azure Active Directory (Azure AD).", - "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9", - "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa", + "checklist": "WAF checklist", + "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", + "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", + "service": "SAP", "services": [ - "Entra", - "AVD" + "Storage", + "ASR", + "WAF" ], "severity": "Medium", - "subcategory": "Microsoft Entra ID", - "text": "Evaluate the usage of Multi-Factor Authentication (MFA) and Conditional Access (CA) for AVD users", - "waf": "Security" + "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.", + "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Virtual Desktop Review", - "description": "If Zero Trust is a requirement, review the companion article in the 'More Info' column. It provides steps to apply the principles of Zero Trust to an Azure Virtual Desktop deployment.", - "guid": "221102d0-90af-49fc-b2b7-8d3fe397e43", - "link": "https://learn.microsoft.com/security/zero-trust/azure-infrastructure-avd", + "checklist": "WAF checklist", + "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", + "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", + "service": "SAP", "services": [ - "AVD" + "Monitor", + "SAP", + "WAF", + "Sentinel" ], "severity": "Medium", - "subcategory": "Zero Trust", - "text": "Review and Apply Zero Trust principles and guidance", + "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.", + "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "If used, make sure to check the list of best practices and recommendations described in the referenced article.", - "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6", - "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files#best-practices-for-azure-virtual-desktop", + "checklist": "WAF checklist", + "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", + "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "service": "SAP", "services": [ - "AVD", - "Storage" + "Cost", + "WAF" ], "severity": "Medium", - "subcategory": "Azure Files", - "text": "Check best-practices for Azure Files", - "waf": "Performance" + "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.", + "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", + "waf": "Operations" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "SMB Multichannel enables clients to use multiple network connections that provide increased performance while lowering the cost of ownership. Increased performance is achieved through bandwidth aggregation over multiple NICs and utilizing Receive Side Scaling (RSS) support for NICs to distribute the IO load across multiple CPUs.", - "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369", - "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance", + "checklist": "WAF checklist", + "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", + "service": "SAP", "services": [ - "AVD", - "Storage", - "ACR", - "Cost" + "Monitor", + "VM", + "WAF" ], "severity": "Low", - "subcategory": "Azure Files", - "text": "Enable SMB multichannel when using a premium file share to host FSLogix profile containers.", + "text": "Use inter-VM latency monitoring for latency-sensitive applications.", "waf": "Performance" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "If a second region is required for DR purposes verify NetApp availability in there as well.", - "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3", - "link": "https://azure.microsoft.com/global-infrastructure/services/", + "checklist": "WAF checklist", + "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", "services": [ - "AVD", - "Storage" + "ASR", + "Monitor", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Azure NetApp Files", - "text": "If NetApp Files storage is required, check storage service availability in your specific region.", + "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", "waf": "Reliability" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "CA option is a recommended setting in the FSLogix scenario, as it enables a more resilient SMB session between the Session Host and NetApp Files.", - "guid": "a2661898-866a-4c8d-9d1f-8cfc86e88024", - "link": "https://learn.microsoft.com/azure/virtual-desktop/create-fslogix-profile-container", + "checklist": "WAF checklist", + "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", "services": [ - "AVD", - "Storage" + "Storage", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Azure NetApp Files", - "text": "If NetApp Files storage is used enable CA (Continuous Availability) option to increase resiliency", - "waf": "Reliability" + "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.", + "waf": "Performance" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "An Active Directory Site should be created for the Azure virtual network environment where Azure NetApp Files (ANF) subnet will be created, and that site name should be specified in the ANF connection property when executing the join procedure as explained in the reference article.", - "guid": "6647e977-db49-48a8-bc35-743f17499d42", - "link": "https://docs.microsoft.com/azure/azure-netapp-files/create-active-directory-connections", + "checklist": "WAF checklist", + "guid": "c027f893-f404-41a9-b33d-39d625a14964", + "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", + "service": "SAP", "services": [ - "AVD", - "VNet", - "Storage" + "SAP", + "WAF" ], - "severity": "High", - "subcategory": "Azure NetApp Files", - "text": "If Azure NetApp Files storage is used, check Active Directory Site name setting in the Active Directory Connection configuration", - "waf": "Reliability" + "severity": "Low", + "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.", + "waf": "Performance" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "Possible options: Standard HDD, Standard SSD, or Premium SSD. Ephemeral disks are not supported, Ultra-Disks not recommended. Recommended to evaluate Premium for OS disk if user density is not low, and if Cloud Cache will be used. ", - "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c", - "link": "https://docs.microsoft.com/azure/virtual-machines/disks-types", + "checklist": "WAF checklist", + "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", + "service": "SAP", "services": [ - "AVD", - "Storage" + "Storage", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Capacity Planning", - "text": "Determine which type of managed disk will be used for the Session Hosts", + "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.", + "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", "waf": "Performance" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "Possible options are: Azure NetApp Files, Azure Files, VM based File Server. File-server it is not recommended. Azure Files Premium typically a good starting point. NetApp usually required for large scale / high-performant environment. For a detailed comparison see the article in the 'More Info' column.", - "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339", - "link": "https://docs.microsoft.com/azure/virtual-desktop/store-fslogix-profile", + "checklist": "WAF checklist", + "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", + "service": "SAP", "services": [ - "AVD", - "VM", - "Storage" + "SAP", + "WAF", + "SQL" ], - "severity": "High", - "subcategory": "Capacity Planning", - "text": "Determine which storage backend solution will be used for FSLogix Profiles", + "severity": "Medium", + "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.", + "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", "waf": "Performance" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "Every Host Pool should use a separate set of storage accounts/volumes (at least one) and shares. Users should have a different profile for each Host Pool since settings and configurations are specific to each Host Pool. Additionally, accessing different Host Pools at the same time can cause errors on the shared user profile VHD/X. Usage of different storage accounts/volumes for multiple shares is also recommended to scale independently.", - "guid": "2fad62bd-5004-453c-ace4-64d862e7f5a4", - "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile", + "checklist": "WAF checklist", + "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", "services": [ - "AVD", - "Storage" + "ASR", + "Monitor", + "SAP", + "WAF" ], "severity": "High", - "subcategory": "Capacity Planning", - "text": "Do not share storage and profiles between different Host Pools", - "waf": "Performance" + "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", + "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "waf": "Operations" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "As a starting point for estimating profile container storage performance requirements we recommend to assume 10 IOPS per user in the steady state and 50 IOPS per user during sign-in/sign-out. Space requirements is simply obtained based on the maximum profiles size in FSLogix per the total number of users for each Host Pool. Multiple storage accounts can be used for the same Host Pool if required.", - "guid": "680e7828-9c93-4665-9d02-bff4564b0d93", - "link": "https://learn.microsoft.com/azure/virtual-desktop/faq#what-s-the-largest-profile-size-fslogix-can-handle-", + "checklist": "WAF checklist", + "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "SAP", "services": [ - "AVD", - "Storage" + "AzurePolicy", + "WAF", + "AppGW" ], - "severity": "High", - "subcategory": "Capacity Planning", - "text": "Verify storage scalability limits and Host Pool requirements", - "waf": "Reliability" + "severity": "Medium", + "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "Avoid introducing additional latency and costs associated with cross-region network traffic where possible.", - "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e", - "link": "https://docs.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files", + "checklist": "WAF checklist", + "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", "services": [ - "AVD", - "Storage", - "Cost" + "DNS", + "SAP", + "VM", + "WAF" ], - "severity": "High", - "subcategory": "Capacity Planning", - "text": "For optimal performance, the storage solution and the FSLogix profile container should be in the same Azure region.", - "waf": "Performance" + "severity": "Medium", + "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "Operations" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "The recommendation in Azure Virtual Desktop is to use Profile Container without Office Container (ODFC) split unless you are planning for specific Business Continuity and Disaster Recovery (BCDR) scenarios as described in the Disaster Recovery section below. https://docs.microsoft.com/fslogix/profile-container-office-container-cncpt ", - "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39", - "link": "https://learn.microsoft.com/fslogix/concepts-container-types#when-to-use-profile-and-odfc-containers", + "checklist": "WAF checklist", + "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", "services": [ - "AVD", - "Storage", - "ASR" - ], - "severity": "High", - "subcategory": "FSLogix", - "text": "Do not use Office Containers (ODFC) if not strictly required and justified", - "waf": "Reliability" - }, - { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "Make sure to configure the following antivirus exclusions for FSLogix Profile Container virtual hard drives, as documented in the referenced article in the 'More Info' column.", - "guid": "83f63047-22ee-479d-9b5c-3632054b69ba", - "link": "https://learn.microsoft.com/fslogix/overview-prerequisites#configure-antivirus-file-and-folder-exclusions", - "services": [ - "AVD", - "Storage" + "VNet", + "DNS", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "FSLogix", - "text": "Configure the recommended antivirus exclusions for FSLogix (includes not scanning VHD(x) files on connect).", - "waf": "Security" + "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "Operations" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "Profile containers have a default max size of 30GB. If large Profile Containers are anticipated, and customers wants to try to keep them small, consider using OneDrive to host Office 365 files outside the FSLogix profile.", - "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5", - "link": "https://docs.microsoft.com/fslogix/profile-container-configuration-reference", + "checklist": "WAF checklist", + "guid": "a3592829-e6e2-4061-9368-6af46791f893", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "service": "SAP", "services": [ - "AVD", - "Storage" + "VNet", + "ACR", + "SAP", + "WAF" ], - "severity": "High", - "subcategory": "FSLogix", - "text": "Review and confirm configured maximum profile size in FSLogix", - "waf": "Cost" + "severity": "Medium", + "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions", + "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", + "waf": "Reliability" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "Defaults and recommended settings are reported in the companion article in the 'More Info' column. If not recommended keys and/or values must be used, be sure to review with a Microsoft AVD expert and clearly document your choices.", - "guid": "d34aad5e-8c78-4e1d-9666-7313c405674c", - "link": "https://learn.microsoft.com/fslogix/concepts-configuration-examples", + "checklist": "WAF checklist", + "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", + "service": "SAP", "services": [ - "AVD", - "AKV", - "Storage", - "ACR" + "NVA", + "SAP", + "WAF" ], "severity": "High", - "subcategory": "FSLogix", - "text": "Review FSLogix registry keys and determine which ones to apply", - "waf": "Reliability" + "text": "It is not supported to deploy any NVA between SAP application and SAP Database server", + "training": "https://me.sap.com/notes/2731110", + "waf": "Performance" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "Concurrent or multiple connections are not recommended in Azure Virtual Desktop. Concurrent connections are also not supported by Session Hosts running in an Azure Virtual Desktop Host Pool. OneDrive, if used, doesn't support concurrent or multiple connections using the same container, under any circumstance. For multiple connections, usage of the same profile disk is not recommended.", - "guid": "5e985b85-9c77-43e7-b261-623b775a917e", - "link": "https://learn.microsoft.com/fslogix/concepts-multi-concurrent-connections", + "checklist": "WAF checklist", + "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", + "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", + "service": "SAP", "services": [ - "AVD", - "Storage" + "ACR", + "SAP", + "VWAN", + "WAF" ], - "severity": "High", - "subcategory": "FSLogix", - "text": "Avoid usage of concurrent or multiple connections", - "waf": "Reliability" + "severity": "Medium", + "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", + "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "waf": "Operations" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "Cloud Cache uses OS drive as local cache storage and may generate lot of pressure on the VM disk. Depending on the VM SKU and size used, the VM temporary drive can be a viable and performant solution where to relocate Cloud Cache cached content. Before adopting this solution, tests should be executed to confirm performance and stability. More details on Cloud Cache can be found here: https://learn.microsoft.com/fslogix/concepts-fslogix-cloud-cache. ", - "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b", - "link": "https://docs.microsoft.com/fslogix/cloud-cache-configuration-reference", + "checklist": "WAF checklist", + "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", + "service": "SAP", "services": [ - "AVD", - "VM", - "Storage" + "VNet", + "NVA", + "WAF" ], - "severity": "Low", - "subcategory": "FSLogix", - "text": "If FSLogix Cloud Cache is used, consider moving the cache directory to the VM temporary drive.", - "waf": "Performance" + "severity": "Medium", + "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.", + "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", + "waf": "Operations" }, { - "category": "Storage", - "checklist": "Azure Virtual Desktop Review", - "description": "REDIRECTION.XML file is used to control what folders are redirected out of the profile container to the 'C:' drive. Exclusions should be the exception and should never be used unless the specific exclusion is completely understood by the person configuring the exclusion. Exclusions should always be fully tested in the environment where they are intended to be implemented. Configuring exclusions may impact functionality, stability and performance.", - "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de", - "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml", + "checklist": "WAF checklist", + "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", + "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", + "service": "SAP", "services": [ - "AVD", - "Storage" + "VNet", + "VWAN", + "WAF", + "NVA", + "SAP" ], "severity": "Medium", - "subcategory": "FSLogix", - "text": "Review the usage of FSLogix redirection.", - "waf": "Cost" + "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.", + "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", + "waf": "Operations" }, { - "category": "Operations Management", - "checklist": "Azure Data Factory Review Checklist", - "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", - "service": "Azure Data Factory", - "services": [], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Leverage FTA Resiliency Playbook for Azure Data Factory", - "waf": "Reliability" + "checklist": "WAF checklist", + "guid": "82734c88-6ba2-4802-8459-11475e39e530", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", + "services": [ + "SAP", + "VM", + "WAF" + ], + "severity": "High", + "text": "Public IP assignment to VM running SAP Workload is not recommended.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "Azure Data Factory Review Checklist", - "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", - "services": [], + "checklist": "WAF checklist", + "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", + "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "service": "SAP", + "services": [ + "ASR", + "WAF" + ], "severity": "High", - "subcategory": "Availablity Zone", - "text": "Use zone redundant pipelines in regions that support Availability Zones", - "waf": "Reliability" + "text": "Consider reserving IP address on DR side when configuring ASR", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Operations" }, { - "category": "Operations Management", - "checklist": "Azure Data Factory Review Checklist", - "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", - "link": "https://learn.microsoft.com/azure/data-factory/source-control", - "service": "Azure Data Factory", + "checklist": "WAF checklist", + "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", "services": [ - "Backup" + "WAF" ], - "severity": "Medium", - "subcategory": "DevOps Integration", - "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ", - "waf": "Reliability" + "severity": "High", + "text": "Avoid using overlapping IP address ranges for production and DR sites.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Data Factory Review Checklist", - "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "checklist": "WAF checklist", + "guid": "6e154e3a-a359-4282-ae6e-206173686af4", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", + "service": "SAP", "services": [ - "VM" + "Storage", + "VNet", + "WAF" ], "severity": "Medium", - "subcategory": "Network", - "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ", - "waf": "Reliability" + "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.", + "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Data Factory Review Checklist", - "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "checklist": "WAF checklist", + "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", + "service": "SAP", "services": [ - "VNet" + "WAF", + "Firewall" ], "severity": "Medium", - "subcategory": "Network", - "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region", - "waf": "Reliability" + "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", + "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "category": "Governance and Security", - "checklist": "Azure Data Factory Review Checklist", - "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you", - "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Azure Data Factory", + "checklist": "WAF checklist", + "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", + "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", + "service": "SAP", "services": [ - "AKV" + "SAP", + "WAF", + "AppGW" ], - "severity": "Low", - "subcategory": "Integration", - "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity", - "waf": "Reliability" + "severity": "Medium", + "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", + "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "d7e47431-76c8-4bdb-b55b-ce619e8a03f9", - "link": "https://learn.microsoft.com/azure/openshift/howto-create-service-principal?pivots=aro-azurecli", + "checklist": "WAF checklist", + "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", "services": [ - "RBAC", - "Entra" + "FrontDoor", + "ACR", + "AzurePolicy", + "WAF" ], - "severity": "High", - "subcategory": "Identity", - "text": "Create a service principal and its role assignments before creating the ARO clusters.", + "severity": "Medium", + "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", + "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "7879424d-6267-486d-90b9-6c97be985190", - "link": "https://learn.microsoft.com/azure/openshift/configure-azure-ad-ui", + "checklist": "WAF checklist", + "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "SAP", "services": [ - "Entra" + "FrontDoor", + "AzurePolicy", + "WAF", + "AppGW" ], - "severity": "High", - "subcategory": "Identity", - "text": "Use AAD to authenticate users in your ARO cluster.", + "severity": "Medium", + "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "adfec5f9-a82d-46e9-a8d1-5a0c7fed5d15", - "link": "https://docs.openshift.com/container-platform/4.14/authentication/remove-kubeadmin.html", + "checklist": "WAF checklist", + "guid": "5ada4332-4e13-4811-9231-81aa41742694", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", "services": [ - "Entra" + "LoadBalancer", + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Identity", - "text": "When using AAD authentication, remove kubeadmin user from the cluster.", + "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "483835c9-86bb-4291-8155-a11475e39f54", - "link": "https://docs.openshift.com/container-platform/4.13/applications/projects/working-with-projects.html", + "checklist": "WAF checklist", + "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "SAP", "services": [ - "RBAC", - "Entra" + "ACR", + "SAP", + "VWAN", + "WAF" ], - "severity": "High", - "subcategory": "Identity", - "text": "Define OpenShift projects to restrict RBAC privilege and isolate workloads in your cluster.", - "waf": "Security" + "severity": "Medium", + "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", + "waf": "Performance" }, { - "category": "Identity and Access Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "0acccd97-9376-4bcd-a375-0ab2ab039da6", - "link": "https://docs.openshift.com/container-platform/4.13/authentication/using-rbac.html", + "checklist": "WAF checklist", + "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "SAP", "services": [ - "RBAC", - "Entra" + "Storage", + "VNet", + "Backup", + "WAF", + "ACR", + "PrivateLink" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Define the required RBAC roles in OpenShift are scoped to either a project or a cluster.", + "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.", + "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "d54d7c89-29db-4107-b532-5ae625ca44e4", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", + "checklist": "WAF checklist", + "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", + "service": "SAP", "services": [ - "Entra", - "AKV" + "SAP", + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Minimize the number of users who have administrator rights and secrets access.", - "waf": "Security" + "severity": "High", + "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "waf": "Performance" }, { - "category": "Identity and Access Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "685e2223-ace8-4bb1-8307-ca5f16f154e3", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "checklist": "WAF checklist", + "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", + "service": "SAP", "services": [ - "Entra", - "RBAC" + "LoadBalancer", + "WAF" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Use Privileged Identity Management in AAD for ARO users with privileged roles.", + "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.", + "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", "waf": "Security" }, { - "category": "Network topology and connectivity", - "checklist": "Azure Red Hat OpenShift", - "guid": "aa369282-9e7e-4216-8836-87af467a1f89", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "checklist": "WAF checklist", + "guid": "6791f893-5ada-4433-84e1-3811523181aa", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "SAP", "services": [ "VNet", - "Firewall", - "Subscriptions", - "DDoS", - "Entra", + "SAP", + "VM", "WAF" ], - "severity": "Low", - "subcategory": "DDoS", - "text": "Use Azure DDoS Network/IP Protection to protect the virtual network you use for the ARO cluster unless you use Azure Firewall or WAF in a centralized subscription", + "severity": "Medium", + "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.", + "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", "waf": "Security" }, { - "category": "Network topology and connectivity", - "checklist": "Azure Red Hat OpenShift", - "guid": "35bda433-24f1-4481-8533-182aa5174269", - "link": "https://docs.openshift.com/container-platform/4.13/networking/routes/secured-routes.html", - "services": [], + "checklist": "WAF checklist", + "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", + "services": [ + "VNet", + "SAP", + "WAF" + ], "severity": "High", - "subcategory": "Encryption", - "text": "All web applications you configure to use an ingress should use TLS encryption and shouldn't allow access over unencrypted HTTP.", - "waf": "Security" + "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Performance" }, { - "category": "Network topology and connectivity", - "checklist": "Azure Red Hat OpenShift", - "guid": "44008ae7-d7e4-4743-876c-8bdbf55bce61", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "checklist": "WAF checklist", + "guid": "fa96c96a-d885-418f-9827-34c886ba2802", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "services": [ - "FrontDoor", + "SAP", "WAF" ], "severity": "Medium", - "subcategory": "Internet", - "text": "Use Azure Front Door with WAF to securely publish ARO applications to the internet, especially in multi-region environments.", - "waf": "Security" + "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.", + "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", + "waf": "Performance" }, { - "category": "Network topology and connectivity", - "checklist": "Azure Red Hat OpenShift", - "guid": "9e8a03f9-7879-4424-b626-786d60b96c97", - "link": "https://learn.microsoft.com/azure/openshift/howto-secure-openshift-with-front-door", + "checklist": "WAF checklist", + "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", "services": [ - "FrontDoor", - "PrivateLink" + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": "Internet", - "text": "If exposing an app on ARO with Azure Front Door, use private link to connect Front Door with the ARO router.", - "waf": "Security" + "severity": "High", + "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Performance" }, { - "category": "Network topology and connectivity", - "checklist": "Azure Red Hat OpenShift", - "guid": "be985190-4838-435c-a86b-b2912155a114", - "link": "https://learn.microsoft.com/azure/openshift/howto-restrict-egress", + "checklist": "WAF checklist", + "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", "services": [ - "AzurePolicy", - "NVA", - "Firewall" + "VNet", + "SAP", + "Cost", + "WAF" ], - "severity": "Medium", - "subcategory": "Internet", - "text": "If your security policy requires you to inspect all outbound internet traffic that's generated in the ARO cluster, secure egress network traffic by using Azure Firewall or an NVA.", - "waf": "Security" + "severity": "High", + "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Cost" }, { - "category": "Network topology and connectivity", - "checklist": "Azure Red Hat OpenShift", - "guid": "75e39f54-0acc-4cd9-9937-6bcda3750ab2", - "link": "https://learn.microsoft.com/azure/openshift/howto-create-private-cluster-4x", + "checklist": "WAF checklist", + "guid": "402a9846-d515-4061-aff8-cd30088693fa", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", + "service": "SAP", "services": [ - "AzurePolicy" + "LoadBalancer", + "WAF" ], "severity": "High", - "subcategory": "Private access", - "text": "If your security policy requires you to use a private IP address for the OpenShift API, deploy a private ARO cluster.", - "waf": "Security" + "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Performance" }, { - "category": "Network topology and connectivity", - "checklist": "Azure Red Hat OpenShift", - "guid": "ab039da6-d54d-47c8-a29d-b107d5325ae6", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", + "checklist": "WAF checklist", + "guid": "87585797-5551-4d53-bb7d-a94ee415734d", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", + "service": "SAP", "services": [ - "PrivateLink", - "ACR" + "VNet", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Private access", - "text": "Use Azure Private Link to secure network connections to managed Azure services, including to Azure Container Registry.", + "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering", "waf": "Security" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "25ca44e4-685e-4222-9ace-8bb12307ca5f", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-enable-arc-enabled-clusters", + "checklist": "WAF checklist", + "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", "services": [ - "Monitor" + "SAP", + "VM", + "WAF", + "Backup" ], "severity": "High", - "subcategory": "Operations", - "text": "Establish a monitoring process using the inbuilt Prometheus, OpenShift Logging or Container Insights integration.", - "waf": "Operations" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "16f154e3-aa36-4928-89e7-e216183687af", - "link": "https://docs.openshift.com/container-platform/4.13/cicd/pipelines/understanding-openshift-pipelines.html", - "services": [], - "severity": "Medium", - "subcategory": "Operations", - "text": "Automate the application delivery process through DevOps practices and CI/CD solutions, such as Pipelines/GitOps provided by OpenShift.", - "waf": "Operations" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "467a1f89-35bd-4a43-924f-14811533182a", - "link": "https://learn.microsoft.com/azure/architecture/guide/design-principles/managed-services", - "services": [], - "severity": "Low", - "subcategory": "Operations", - "text": "Whenever possible, remove the service state from inside containers. Instead, use an Azure platform as a service (PaaS) that supports multiregion replication.", - "waf": "Operations" + "text": "Review SAP HANA database backups for Azure VMs.", + "waf": "Cost" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "1b7da8cf-aa66-4e15-b4d5-ada97dc3e232", - "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-storageclass", + "checklist": "WAF checklist", + "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", "services": [ - "Storage" + "ASR", + "Monitor", + "SAP", + "WAF" ], - "severity": "Low", - "subcategory": "Operations", - "text": "Use RWX storage with inbuilt Azure Files storage class.", - "waf": "Operations" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "6bb235c7-05e1-4696-bded-fa8a4c8cdec4", - "link": "https://docs.openshift.com/container-platform/4.13/nodes/clusters/nodes-cluster-limit-ranges.html", - "services": [], - "severity": "Medium", - "subcategory": "Performance", - "text": "Use pod requests and limits to manage the compute resources within a cluster.", - "waf": "Performance" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "c620c30c-14ee-4b7f-9ae8-d9b3fec228e7", - "link": "https://docs.openshift.com/container-platform/4.13/applications/quotas/quotas-setting-per-project.html", - "services": [], "severity": "Medium", - "subcategory": "Performance", - "text": "Enforce resource quotas on projects.", - "waf": "Performance" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "87ab177a-db59-4f6b-a613-334fd09dc234", - "link": "https://docs.openshift.com/container-platform/4.13/machine_management/applying-autoscaling.html", - "services": [], - "severity": "High", - "subcategory": "Performance", - "text": "Define ClusterAutoScaler and MachineAutoScaler to scale machines when your cluster runs out of resources to support more deployments.", - "waf": "Performance" + "text": "Review Site Recovery built-in monitoring, where used for SAP.", + "waf": "Cost" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "19db6128-1269-4040-a4ba-4d3e0804276d", - "link": "https://learn.microsoft.com/azure/openshift/support-policies-v4#supported-virtual-machine-sizes", + "checklist": "WAF checklist", + "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", + "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", + "service": "SAP", "services": [ - "VM" + "Monitor", + "SAP", + "WAF" ], "severity": "High", - "subcategory": "Reliability", - "text": "Use virtual machine sizes that are large enough to contain multiple container instances so you get the benefits of increased density, but not so large that your cluster can't handle the workload of a failing node.", - "waf": "Reliability" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "4b98b15c-8b31-4aa5-aceb-58889135e227", - "link": "https://docs.openshift.com/container-platform/4.13/machine_management/deploying-machine-health-checks.html", - "services": [], - "severity": "High", - "subcategory": "Reliability", - "text": "Deploy machine health checks to automatically repair damaged machines in a machine pool.", - "waf": "Reliability" + "text": "Review the Monitoring the SAP HANA System Landscape guidance.", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "896d31b6-6c67-4ba5-a119-c08e8f5d587c", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-metric-alerts", + "checklist": "WAF checklist", + "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", + "service": "SAP", "services": [ - "Monitor" + "VM", + "WAF", + "Backup" ], - "severity": "High", - "subcategory": "Reliability", - "text": "Use an alerting system to provide notifications when things need direct action: Container Insights metric alerts or in-built Alerting UI.", - "waf": "Reliability" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "7e9ced16-acd1-476e-b9b2-41a998a57ae7", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview#availability-zones", - "services": [], - "severity": "High", - "subcategory": "Reliability", - "text": "Ensure that the cluster is created in a region that supports AZs and create a machine set for each AZ.", - "waf": "Reliability" + "severity": "Medium", + "text": "Review Oracle Database in Azure Linux VM backup strategies.", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "7b997e71-1b7d-4a8c-baa6-6e15d4d5ada9", - "link": "https://docs.openshift.com/container-platform/4.13/machine_management/creating-infrastructure-machinesets.html", + "checklist": "WAF checklist", + "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", + "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", + "service": "SAP", "services": [ - "AKS" + "Storage", + "WAF", + "SQL" ], - "severity": "Low", - "subcategory": "Reliability", - "text": "Create infrastructure machine sets to hold infrastructure components. Apply specific Kubernetes labels to these machines and then update the infrastructure components to run on only those machines.", - "waf": "Reliability" + "severity": "Medium", + "text": "Review the use of Azure Blob Storage with SQL Server 2016.", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "7dc3e232-6bb2-435c-905e-1696fdedfa8a", - "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-backup#create-a-backup-with-velero-to-include-snapshots", + "checklist": "WAF checklist", + "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", + "service": "SAP", "services": [ + "VM", + "WAF", "Backup" ], "severity": "Medium", - "subcategory": "Reliability", - "text": "Create application backup and plan for restore and include persistent volumes in the backup.", - "waf": "Reliability" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "81c12318-1a64-4174-8583-3fb4ae3c2df7", - "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-priority.html", - "services": [], - "severity": "Low", - "subcategory": "Reliability", - "text": "Use pod priorities, so that in case of limited resources the most critical pods will run.", - "waf": "Reliability" + "text": "Review the use of Automated Backup v2 for Azure VMs.", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "43166c3b-cbe0-45bb-b209-d4a0da577784", - "link": "https://docs.openshift.com/container-platform/4.13/architecture/admission-plug-ins.html", + "checklist": "WAF checklist", + "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", + "service": "SAP", "services": [ - "AzurePolicy" + "WAF" ], - "severity": "Low", - "subcategory": "Security", - "text": "Regulate cluster functions using admission plug-ins, which are commonly used to enforce security policy, resource limitations, or configuration requirements.", - "waf": "Security" + "severity": "High", + "text": "Enabling Write accelerator for M series when using premium disks(V1)", + "waf": "Operations" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "24d21678-5d2f-4a56-a56a-d48408fe8273", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", + "checklist": "WAF checklist", + "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "service": "SAP", "services": [ - "ACR" + "WAF" ], - "severity": "Low", - "subcategory": "Security", - "text": "Store your container images in Azure Container Registry and geo-replicate the registry to each region.", - "waf": "Security" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "4c486ba2-80dc-4059-8cf7-5ee8e1309ccc", - "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-vertical-autoscaler.html", - "services": [], "severity": "Medium", - "subcategory": "Workload", - "text": "Optimize the CPU and memory request values, and maximize the efficiency of the cluster resources using vertical pod autoscaler.", + "text": "Test availability zone latency.", "waf": "Performance" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "d579366b-cda2-4750-aa1a-bfe9d55d14c3", - "link": "https://docs.openshift.com/container-platform/4.13/applications/application-health.html", + "checklist": "WAF checklist", + "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", + "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", + "service": "SAP", "services": [ - "Monitor" + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Workload", - "text": "Add health probes to your pods to monitor application health. Make sure pods contain livenessProbe and readinessProbe. Use Startup probes to determine the point at which the application has started up.", - "waf": "Reliability" - }, - { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "c4929cb1-b3d1-4325-ae12-4ba34d0685ed", - "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-autoscaling.html", - "services": [], - "severity": "Medium", - "subcategory": "Workload", - "text": "Scale pods to meet demand using horizontal pod autoscaler.", - "waf": "Reliability" + "text": "Activate SAP EarlyWatch Alert for all SAP components.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", + "waf": "Performance" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "dce9be3b-b0dd-4b3b-95fb-2ec14eeaa359", - "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-configuring.html#nodes-pods-pod-distruption-about_nodes-pods-configuring", + "checklist": "WAF checklist", + "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", + "service": "SAP", "services": [ - "Cost" + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Workload", - "text": "Use disruption budgets to ensure the required number of pod replicas exist to handle expected application load.", - "waf": "Reliability" + "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.", + "training": "https://me.sap.com/notes/0002879613", + "waf": "Performance" }, { - "category": "Operations management", - "checklist": "Azure Red Hat OpenShift", - "guid": "2829e2ed-b217-4367-9aff-6791b4935ada", - "link": "https://docs.openshift.com/container-platform/4.13/nodes/scheduling/nodes-scheduler-pod-topology-spread-constraints.html", - "services": [], + "checklist": "WAF checklist", + "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", + "service": "SAP", + "services": [ + "Monitor", + "WAF", + "SQL" + ], "severity": "Medium", - "subcategory": "Workload", - "text": "Use pod topology constraints to automatically schedule pods on nodes throughout the cluster.", - "waf": "Reliability" + "text": "Review SQL Server performance monitoring using CCMS.", + "waf": "Performance" }, { - "category": "Operations Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "fea1dbf3-dd95-4d48-a7c8-91dcb1f7d575", - "link": "https://learn.microsoft.com/azure/openshift/intro-openshift#service-level-agreement", - "services": [], + "checklist": "WAF checklist", + "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", + "link": "https://me.sap.com/notes/500235", + "service": "SAP", + "services": [ + "SAP", + "VM", + "WAF" + ], "severity": "Medium", - "subcategory": "Availablity", - "text": "Leverage Current ARO SLA - 99.95 into BCDR planning", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "b95e06e1-58e2-4ea3-a92c-2de6e2065b3a", - "link": "https://www.redhat.com/rhdc/managed-files/pa-getting-started-azure-openshift-ebook-f20686-201911-en_0.pdf", - "services": [], - "severity": "High", - "subcategory": "Cluster Design", - "text": "Run user workloads on the worker nodes, not the control plane nodes", - "waf": "Reliability" + "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).", + "training": "https://me.sap.com/notes/1100926/E", + "waf": "Performance" }, { - "category": "Operations Management", - "checklist": "Azure Red Hat OpenShift", - "description": "Create infrastructure machine sets to hold infrastructure components. Apply specific Kubernetes labels to these machines and then update the infrastructure components to run on only those machines", - "guid": "76af4a69-1e88-439a-ba46-667e13c10567", - "link": "https://learn.microsoft.com/azure/openshift/howto-segregate-machinesets", + "checklist": "WAF checklist", + "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", + "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", + "service": "SAP", "services": [ - "AKS", - "VNet" + "Monitor", + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Cluster Design", - "text": "Isolate workloads into worker nodes running in individual subnets as needed", - "waf": "Reliability" + "text": "Review SAP HANA studio alerts.", + "waf": "Performance" }, { - "category": "Operations Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "785c6fe9-6c96-4ad8-a44c-f3b2b38c886b", - "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-backup", + "checklist": "WAF checklist", + "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", + "link": "https://me.sap.com/notes/1969700", + "service": "SAP", "services": [ - "Backup" + "SAP", + "WAF" ], "severity": "Medium", - "subcategory": "Backup", - "text": "Backup a cluster state for stateful workload scenarios to a paired region", - "waf": "Reliability" + "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.", + "waf": "Performance" }, { - "category": "Operations Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "a2c02149-9014-4a5d-9ce5-74dccbd9792a", - "link": "https://access.redhat.com/documentation/red_hat_openshift_container_storage/4.4/html/deploying_and_managing_openshift_container_storage_on_microsoft_azure/deploying-openshift-container-storage-on-microsoft-azure_rhocs", + "checklist": "WAF checklist", + "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", "services": [ - "Storage", - "ACR" + "VM", + "WAF" ], "severity": "Medium", - "subcategory": "Data Store", - "text": "If container storage is required, ensure availability across regions if needed: Using RWX storage with inbuilt Azure Files storage class. Using CSI Drivers for storage provisioning", - "waf": "Reliability" + "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.", + "training": "https://learn.microsoft.com/azure/automation/update-management/overview", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "Azure Red Hat OpenShift", - "guid": "6bcca2b4-fea1-4dbf-9dd9-5d48c7c891dc", - "link": "https://docs.openshift.com/aro/3/dev_guide/persistent_volumes.html", - "services": [], + "checklist": "WAF checklist", + "guid": "08951710-79a2-492a-adbc-06d7a401545b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", + "services": [ + "SAP", + "WAF" + ], "severity": "Medium", - "subcategory": "Data Store", - "text": "Whenever possible, move state out of containers and into external databases that support multi-region replication. Avoid Persistent Volumes", - "waf": "Reliability" - }, - { - "category": "Platform Automation", - "checklist": "Azure Red Hat OpenShift", - "guid": "42324ece-81c1-4231-a1a6-417415833fb4", - "link": "https://docs.openshift.com/container-platform/4.13/applications/deployments/route-based-deployment-strategies.html", - "services": [], - "severity": "Low", - "subcategory": "Workload", - "text": "Consider blue/green or canary strategies to deploy new releases of application.", - "waf": "Operations" + "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.", + "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", + "waf": "Security" }, { - "category": "Platform Automation", - "checklist": "Azure Red Hat OpenShift", - "guid": "ae3c2df7-4316-46c3-acbe-05bbe209d4a0", - "link": "https://docs.openshift.com/container-platform/4.13/cicd/gitops/understanding-openshift-gitops.html", - "services": [], + "checklist": "WAF checklist", + "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", + "services": [ + "SAP", + "WAF", + "SQL" + ], "severity": "Low", - "subcategory": "Workload", - "text": "Consider using Red Hat OpenShift GitOps. Red Hat OpenShift GitOps uses Argo CD to maintain cluster resources and support application CI/CD.", - "waf": "Operations" - }, - { - "category": "Security", - "checklist": "Azure Red Hat OpenShift", - "guid": "da577784-24d2-4167-a5d2-fa56c56ad484", - "link": "https://learn.microsoft.com/azure/openshift/support-lifecycle", - "services": [], - "severity": "High", - "subcategory": "Control plane", - "text": "Keep your clusters on the latest OpenShift version to avoid potential security or upgrade issues.", + "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Red Hat OpenShift", - "guid": "08fe8273-4c48-46ba-880d-c0591cf75ee8", - "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/quickstart-connect-cluster", + "checklist": "WAF checklist", + "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", "services": [ - "AKS", - "Arc" + "WAF", + "SQL" ], "severity": "High", - "subcategory": "Control plane", - "text": "Connect Azure Red Hat OpenShift clusters to Azure Arc-enabled Kubernetes.", + "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.", + "training": "https://me.sap.com/notes/3019299/E", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Red Hat OpenShift", - "guid": "e1309ccc-d579-4366-acda-2750aa1abfe9", - "link": "https://docs.openshift.com/container-platform/4.10/security/encrypting-etcd.html", - "services": [], - "severity": "Low", - "subcategory": "Encryption", - "text": "For Azure Red Hat OpenShift 4 clusters, etcd data isn't encrypted by default, but it's recommended to enable etcd encryption to provide another layer of data security.", + "checklist": "WAF checklist", + "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "services": [ + "Storage", + "Backup", + "WAF", + "SQL", + "SAP" + ], + "severity": "High", + "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Red Hat OpenShift", - "guid": "d55d14c3-c492-49cb-8b3d-1325ae124ba3", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", + "checklist": "WAF checklist", + "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "SAP", "services": [ - "AKS", - "Defender", - "Arc" + "Storage", + "WAF" ], "severity": "Medium", - "subcategory": "Posture", - "text": "Use Microsoft Defender for Containers supported via Arc-enabled Kubernetes to secure clusters, containers, and applications.", + "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.", + "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Red Hat OpenShift", - "guid": "4d0685ed-dce9-4be3-ab0d-db3b55fb2ec1", - "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/tutorial-akv-secrets-provider", + "checklist": "WAF checklist", + "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "SAP", "services": [ - "AKS", "AKV", - "Arc" + "WAF" ], - "severity": "Medium", - "subcategory": "Secrets", - "text": "For applications that require access to sensitive information, use a service principal and the AKV Secrets Provider with the extension for Arc-enabled Kubernetes clusters.", + "severity": "High", + "text": "Use Azure Key Vault to store your secrets and credentials", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Red Hat OpenShift", - "guid": "4eeaa359-2829-4e2e-bb21-73676aff6791", - "link": "https://learn.microsoft.com/azure/aks/developer-best-practices-pod-security#secure-pod-access-to-resources", - "services": [], - "severity": "Medium", - "subcategory": "Workload", - "text": "Secure pod access to resources. Provide the least number of permissions, and avoid using root or privileged escalation.", - "waf": "Security" + "checklist": "WAF checklist", + "guid": "829e2edb-2173-4676-aff6-691b4935ada4", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "SAP", + "services": [ + "RBAC", + "Subscriptions", + "AzurePolicy", + "WAF" + ], + "severity": "Medium", + "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).", + "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", + "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Red Hat OpenShift", - "guid": "b4935ada-4232-44ec-b81c-123181a64174", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes#install-azure-policy-extension-for-azure-arc-enabled-kubernetes", + "checklist": "WAF checklist", + "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "SAP", "services": [ + "AKV", "AzurePolicy", - "Monitor" + "WAF" ], "severity": "Medium", - "subcategory": "Workload", - "text": "Monitor and enforce configuration by using the Azure Policy Extension.", + "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Red Hat OpenShift", - "guid": "15833fb4-ae3c-42df-9431-66c3bcbe05bb", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", + "checklist": "WAF checklist", + "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", + "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", + "service": "SAP", "services": [ - "Defender" + "RBAC", + "AzurePolicy", + "WAF" ], "severity": "High", - "subcategory": "Workload", - "text": "Scan your images for vulnerabilities with Microsoft Defender or any other image scanning solution.", + "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed", + "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Red Hat OpenShift", - "guid": "e209d4a0-da57-4778-924d-216785d2fa56", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", + "checklist": "WAF checklist", + "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "services": [ - "ACR", - "Subscriptions" + "Storage", + "Defender", + "SAP", + "WAF" ], - "severity": "Low", - "subcategory": "Workload", - "text": "Deploy a dedicated and private instance of Azure Container Registry to each landing zone subscription.", + "severity": "High", + "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage", - "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", + "service": "SAP", "services": [ - "Storage" + "Defender", + "RBAC", + "SAP", + "WAF" ], - "severity": "Medium", - "subcategory": " Overview", - "text": "Consider the 'Azure security baseline for storage'", + "severity": "High", + "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.", + "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet", - "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "services": [ - "PrivateLink", - "Storage" + "SAP", + "WAF" ], - "severity": "High", - "subcategory": "Networking", - "text": "Consider using private endpoints for Azure Storage", + "severity": "Low", + "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS", + "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription", - "guid": "30e37c3e-2971-41b2-963c-eee079b598de", - "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", + "service": "SAP", "services": [ - "RBAC", - "Storage", - "Subscriptions" + "AKV", + "WAF" ], "severity": "Medium", - "subcategory": "Governance", - "text": "Ensure older storage accounts are not using 'classic deployment model'", + "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.", - "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", - "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "4935ada4-2223-4ece-a1b1-23181a541741", + "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", + "service": "SAP", "services": [ - "Defender", - "Storage" + "AKV", + "WAF" ], "severity": "High", - "subcategory": "Governance", - "text": "Enable Microsoft Defender for all of your storage accounts", + "text": "Use an Azure Key Vault per application per environment per region.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.", - "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", + "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", + "service": "SAP", "services": [ - "Storage" + "SAP", + "AKV", + "WAF" ], - "severity": "Medium", - "subcategory": "Data Availability", - "text": "Enable 'soft delete' for blobs", + "severity": "High", + "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.", + "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", - "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "209d490d-a477-4784-84d1-16785d2fa56c", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "service": "SAP", "services": [ - "Storage" + "SAP", + "RBAC", + "Subscriptions", + "WAF" ], - "severity": "Medium", - "subcategory": "Confidentiality", - "text": "Disable 'soft delete' for blobs", + "severity": "High", + "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes", + "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.", - "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", + "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", + "service": "SAP", "services": [ - "Storage" + "PrivateLink", + "SAP", + "NVA", + "WAF" ], "severity": "High", - "subcategory": "Data Availability", - "text": "Enable 'soft delete' for containers", + "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources", + "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", - "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", + "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "service": "SAP", "services": [ - "Storage" + "Storage", + "VM", + "WAF" ], - "severity": "Medium", - "subcategory": "Confidentiality", - "text": "Disable 'soft delete' for containers", + "severity": "Low", + "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.", + "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion", - "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", + "service": "SAP", "services": [ - "Storage" + "Defender", + "WAF" ], - "severity": "High", - "subcategory": "Data Availability", - "text": "Enable resource locks on storage accounts", + "severity": "Low", + "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.", + "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.", - "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", - "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", "services": [ - "AzurePolicy", - "Storage", - "Subscriptions" + "VNet", + "SAP", + "WAF" ], "severity": "High", - "subcategory": "Data Availability, Compliance", - "text": "Consider immutable blobs", + "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ", - "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "services": [ - "Storage" + "SAP", + "WAF" ], - "severity": "High", - "subcategory": "Networking", - "text": "Require HTTPS, i.e. disable port 80 on the storage account", + "severity": "Low", + "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.", + "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.", - "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", - "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", - "service": "Azure Storage", + "checklist": "WAF checklist", + "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", + "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", + "service": "SAP", "services": [ - "Storage" + "Monitor", + "SAP", + "AKV", + "WAF" ], - "severity": "High", - "subcategory": "Networking", - "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.", + "severity": "Medium", + "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.", - "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", - "service": "Azure Storage", + "checklist": "WAF checklist", + "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", + "guid": "87af4a79-1f89-439b-ba47-768e14c11567", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key", + "service": "Service Bus", "services": [ - "Storage" + "ServiceBus", + "WAF" ], - "severity": "Medium", - "subcategory": "Networking", - "text": "Limit shared access signature (SAS) tokens to HTTPS connections only", + "severity": "Low", + "text": "Use customer-managed key option in data at rest encryption when required", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "AAD tokens should be favored over shared access signatures, wherever possible", - "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", - "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", - "service": "Azure Storage", + "checklist": "WAF checklist", + "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.", + "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version", + "service": "Service Bus", "services": [ - "Entra", - "Storage" + "ServiceBus", + "WAF" ], - "severity": "High", - "subcategory": "Identity and Access Management", - "text": "Use Azure Active Directory (Azure AD) tokens for blob access", + "severity": "Medium", + "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.", - "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", - "service": "Azure Storage", + "checklist": "WAF checklist", + "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", + "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies", + "service": "Service Bus", "services": [ "Entra", + "TrafficManager", "RBAC", - "Storage" + "ServiceBus", + "WAF", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "Least privilege in IaM permissions", + "text": "Avoid using root account when it is not necessary", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ", - "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", - "service": "Azure Storage", + "checklist": "WAF checklist", + "description": "A Service Bus client app running inside an Azure App Service application or in a virtual machine with enabled managed entities for Azure resources support does not need to handle SAS rules and keys, or any other access tokens. The client app only needs the endpoint address of the Service Bus Messaging namespace. ", + "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity", + "service": "Service Bus", "services": [ + "Storage", "Entra", - "Storage" + "AKV", + "WAF", + "ServiceBus", + "VM", + "AppSvc" ], - "severity": "High", - "subcategory": "Identity and Access Management", - "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.", + "severity": "Medium", + "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ", - "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", - "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", - "service": "Azure Storage", + "checklist": "WAF checklist", + "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ", + "guid": "f615658d-e558-4f93-9249-b831112dbd7e", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus", + "service": "Service Bus", "services": [ - "Entra", - "AKV", "Storage", - "Monitor" + "RBAC", + "Subscriptions", + "ServiceBus", + "WAF" ], "severity": "High", - "subcategory": "Identity and Access Management", - "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.", + "text": "Use least privilege data plane RBAC", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).", - "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", - "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", - "service": "Azure Storage", + "checklist": "WAF checklist", + "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.", + "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference", + "service": "Service Bus", "services": [ - "AzurePolicy", - "AKV", - "Storage", - "Monitor" + "VNet", + "Monitor", + "ServiceBus", + "WAF" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Consider using Azure Monitor to audit control plane operations on the storage account", + "severity": "Medium", + "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.", - "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", - "service": "Azure Storage", + "checklist": "WAF checklist", + "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", + "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service", + "service": "Service Bus", "services": [ - "Entra", - "AzurePolicy", - "AKV", - "Storage" + "VNet", + "PrivateLink", + "ServiceBus", + "WAF" ], "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "When using storage account keys, consider enabling a 'key expiration policy'", + "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.", - "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", - "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", - "service": "Azure Storage", + "checklist": "WAF checklist", + "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", + "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering", + "service": "Service Bus", "services": [ - "Entra", - "AzurePolicy", - "Storage" + "ServiceBus", + "WAF" ], "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "Consider configuring an SAS expiration policy", + "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ", - "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", - "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", - "service": "Azure Storage", + "category": "BC and DR", + "checklist": "Redis Resiliency checklist", + "guid": "65285269-440b-44be-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", + "service": "Redis", "services": [ - "Entra", - "AzurePolicy", - "AKV", - "Storage" + "ACR" ], - "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "Consider linking SAS to a stored access policy", - "waf": "Security" + "severity": "High", + "subcategory": "High Availability", + "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", - "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", - "service": "Azure Storage", + "category": "BC and DR", + "checklist": "Redis Resiliency checklist", + "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", + "service": "Redis", "services": [ - "AKV", "Storage" ], "severity": "Medium", - "subcategory": "CI/CD", - "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.", - "waf": "Security" + "subcategory": "High Availability", + "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.", - "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", - "service": "Azure Storage", + "category": "BC and DR", + "checklist": "Redis Resiliency checklist", + "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", + "service": "Redis", "services": [ - "Entra", "Storage" ], - "severity": "High", - "subcategory": "Identity and Access Management", - "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)", - "waf": "Security" + "severity": "Medium", + "subcategory": "High Availability", + "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.", - "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", + "category": "BC and DR", + "checklist": "Redis Resiliency checklist", + "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", + "service": "Redis", "services": [ - "Entra", - "AzurePolicy", - "Storage" + "ASR" ], - "severity": "High", - "subcategory": "Identity and Access Management", - "text": "Strive for short validity periods for ad-hoc SAS", - "waf": "Security" + "severity": "Medium", + "subcategory": "High Availability", + "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.", - "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", - "services": [ - "Entra", - "Storage" - ], + "category": "Operations management", + "checklist": "Azure Bot Service", + "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", + "service": "Bot service", + "services": [], "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "Apply a narrow scope to a SAS", - "waf": "Security" + "subcategory": "High Availablity", + "text": "Follow reliability support recommendations in Azure Bot Service", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ", - "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", - "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", - "service": "Azure Storage", - "services": [ - "Entra", - "Storage" - ], + "category": "Operations management", + "checklist": "Azure Bot Service", + "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", + "service": "Bot service", + "services": [], "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "Consider scoping SAS to a specific client IP address, wherever possible", - "waf": "Security" + "subcategory": "High Availablity", + "text": "Deploying bots with local data residency and regional compliance", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.", - "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", - "service": "Azure Storage", + "category": "Operations management", + "checklist": "Azure Bot Service", + "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", + "service": "Bot service", + "services": [], + "severity": "Medium", + "subcategory": "High Availablity", + "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "MySQL Review Checklist", + "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", + "service": "Azure MySQL", "services": [ - "Entra", - "Storage" + "SQL" ], - "severity": "Low", - "subcategory": "Identity and Access Management", - "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ", - "waf": "Security" + "severity": "Medium", + "subcategory": "Best Practices", + "text": "Leverage Flexible Server", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint", - "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", - "service": "Azure Storage", + "category": "Operations Management", + "checklist": "MySQL Review Checklist", + "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", + "service": "Azure MySQL", "services": [ - "Entra", - "RBAC", - "Storage" + "SQL" ], "severity": "High", - "subcategory": "Identity and Access Management", - "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Leverage Availability Zones where regionally applicable", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", - "service": "Azure Storage", + "category": "Operations Management", + "checklist": "MySQL Review Checklist", + "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", + "service": "Azure MySQL", "services": [ - "Entra", - "Storage" + "SQL" ], "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Leverage Data-in replication for cross-region DR scenarios", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.", - "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", - "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", - "service": "Azure Storage", - "services": [ - "AzurePolicy", - "Storage" - ], + "category": "BC and DR", + "checklist": "Logic Apps checklist", + "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", + "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", + "service": "Logic Apps", + "services": [], "severity": "High", - "subcategory": "Networking", - "text": "Avoid overly broad CORS policies", - "waf": "Security" + "subcategory": "High Availability", + "text": "Select the right Logic App hosting plan based on your business & SLO requirements", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.", - "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "Azure Storage", - "services": [ - "Storage" - ], + "category": "BC and DR", + "checklist": "Logic Apps checklist", + "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", + "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "Logic Apps", + "services": [], "severity": "High", - "subcategory": "Confidentiality and Encryption", - "text": "Determine how data at rest should be encrypted. Understand the thread model for data.", - "waf": "Security" + "subcategory": "High Availability", + "text": "Protect logic apps from region failures with zone redundancy and availability zones", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", - "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", - "service": "Azure Storage", + "category": "BC and DR", + "checklist": "Logic Apps checklist", + "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", + "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Logic Apps", + "services": [], + "severity": "High", + "subcategory": "High Availability", + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" + }, + { + "category": "BC and DR", + "checklist": "Logic Apps checklist", + "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", + "link": "https://learn.microsoft.com/azure/app-service/environment/intro", + "service": "Logic Apps", "services": [ - "Storage" + "AppSvc" ], + "severity": "High", + "subcategory": "High Availability", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" + }, + { + "category": "Application Deployment", + "checklist": "Logic Apps checklist", + "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", + "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", + "service": "Logic Apps", + "services": [], "severity": "Medium", - "subcategory": "Confidentiality and Encryption", - "text": "Determine which/if platform encryption should be used.", - "waf": "Security" + "subcategory": "CI/CD", + "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", - "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", - "service": "Azure Storage", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "service": "Azure Monitor", "services": [ - "Storage" + "Monitor", + "Cost" ], "severity": "Medium", - "subcategory": "Confidentiality and Encryption", - "text": "Determine which/if client-side encryption should be used.", - "waf": "Security" + "subcategory": "Azure Monitor - enforce data collection rules", + "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Storage Review Checklist", - "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.", - "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", - "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", - "service": "Azure Storage", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "45901365-d38e-443f-abcb-d868266abca2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Azure Backup", "services": [ - "Entra", - "Storage" + "Backup", + "Cost" ], - "severity": "High", - "subcategory": "Identity and Access Management", - "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ", - "waf": "Security" + "severity": "Medium", + "subcategory": "Backup", + "text": "check backup instances with the underlying datasource not found", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "Azure Storage Review Checklist", - "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal", - "service": "Azure Storage", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "VM", "services": [ - "Storage" + "Cost" ], - "severity": "High", - "subcategory": "Platform Version", - "text": "Leverage a storagev2 account type for better performance and reliability", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Delete/archive", + "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)", + "waf": "Cost" }, { - "category": "BC and DR", - "checklist": "Azure Storage Review Checklist", - "guid": "e05bbe20-9d49-4fda-9777-8424d116785c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Azure Storage", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "659d3958-fd77-4289-a835-556df2bfe456", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "Storage" + "Cost" ], - "severity": "High", - "subcategory": "Availablity", - "text": "Leverage GRS, ZRS or GZRS storage for the highest availability", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Delete/archive", + "text": "Consider snooze and stop technique (snooze a service after x days, stop after 2x, delete/deallocate after 3x)", + "waf": "Cost" }, { - "category": "BC and DR", - "checklist": "Azure Storage Review Checklist", - "guid": "2fa56c56-ad48-4408-be72-734c486ba280", - "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance", - "service": "Azure Storage", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "3b0d834a-3487-426d-b69c-6b5c2a26494b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "Storage" + "Storage", + "Backup", + "Cost" ], "severity": "Medium", - "subcategory": "Failover", - "text": "For write operation after failover, use customer-Managed Failover ", - "waf": "Reliability" + "subcategory": "Delete/archive", + "text": "Delete or archive unused resources (old backups, logs, storage accounts, etc...)", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "Azure Storage Review Checklist", - "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc", - "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover", - "service": "Azure Storage", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Azure Backup", "services": [ - "Storage" + "Storage", + "ASR", + "Backup", + "Cost" ], "severity": "Medium", - "subcategory": "Failover", - "text": "Understand Microsoft-Managed Failover details", - "waf": "Reliability" + "subcategory": "Delete/archive", + "text": "Consider a good balance between site recovery storage and backup for non mission critical applications", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "Azure Storage Review Checklist", - "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal", - "service": "Azure Storage", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", + "service": "Azure Monitor", "services": [ - "Storage" + "Monitor", + "Cost" ], "severity": "Medium", - "subcategory": "Data Protection", - "text": "Enable Soft Delete", - "waf": "Reliability" + "subcategory": "Log Analytics retention for workspaces", + "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", + "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure API Management Review", - "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", - "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", - "service": "APIM", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Azure Monitor", "services": [ - "APIM", - "AzurePolicy" + "Storage", + "AzurePolicy", + "Cost" ], "severity": "Medium", - "subcategory": "Development best practices", - "text": "Implement an error handling policy at the global level", - "waf": "Operations" + "subcategory": "Policy", + "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)", + "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", + "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure API Management Review", - "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", - "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", - "service": "APIM", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "59bb91a3-ed90-4cae-8cc8-4c37b6b780cb", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "APIM", - "AzurePolicy" + "Cost" ], "severity": "Medium", - "subcategory": "Development best practices", - "text": "Ensure all APIs policies include a element.", - "waf": "Operations" + "subcategory": "Run orphaned resources workbook - delete or snooze ghost items", + "text": "https://github.com/dolevshor/azure-orphan-resources", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets", + "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure API Management Review", - "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", - "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", - "service": "APIM", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "9fe5c464-89d4-457a-a27c-3874d0102cac", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "APIM", - "AzurePolicy", - "ACR" + "Cost" ], "severity": "Medium", - "subcategory": "Development best practices", - "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs", - "waf": "Operations" + "subcategory": "Shutdown/deallocate", + "text": "Shutdown underutilized instances", + "training": "https://learn.microsoft.com/azure/cost-management-billing/understand/analyze-unexpected-charges", + "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure API Management Review", - "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", - "link": "https://learn.microsoft.com/azure/api-management/monetization-support", - "service": "APIM", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "VM", "services": [ - "APIM" + "Storage", + "VM", + "Backup", + "Cost" ], "severity": "Medium", - "subcategory": "Monetization", - "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices", - "waf": "Operations" + "subcategory": "stopped/deallocated VMs: check disks", + "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", + "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure API Management Review", - "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", - "service": "APIM", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "d1e44a19-659d-4395-afd7-7289b835556d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Storage", "services": [ - "APIM", - "Monitor" + "Storage", + "AzurePolicy", + "Cost" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Enable Diagnostics Settings to export logs to Azure Monitor", - "waf": "Operations" + "severity": "Medium", + "subcategory": "storage accounts lifecycle policy", + "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure API Management Review", - "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", - "service": "APIM", + "category": "Cleanup", + "checklist": "Cost Optimization Checklist", + "guid": "f2bfe456-3b0d-4834-a348-726de69c6b5c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "APIM", - "Monitor" + "Cost" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Enable Application Insights for more detailed telemetry", - "waf": "Operations" + "subcategory": "Tagging", + "text": "Use specific tags for temporary items with 'delete by DATE' format - and automate monthly cleanup", + "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure API Management Review", - "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", - "service": "APIM", + "category": "DB/App tuning", + "checklist": "Cost Optimization Checklist", + "guid": "2a26494b-69ba-4d37-aad5-3cc78e1d7666", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice", "services": [ - "APIM", - "Monitor" + "Cost" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Configure alerts on the most critical metrics", - "waf": "Operations" + "severity": "Medium", + "subcategory": "DB optimization", + "text": "Plan for db optimization with the intent of downsizing the related services (and improve performance)", + "waf": "Cost" }, { - "category": "Identity and Access Management", - "checklist": "Azure API Management Review", - "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", - "service": "APIM", + "category": "DB/APP tuning", + "checklist": "Cost Optimization Checklist", + "guid": "7357c449-674b-45ed-a5a8-59c7733be2a1", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "Entra", - "APIM", - "AKV" + "Cost" ], - "severity": "High", - "subcategory": "Data protection", - "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated", - "waf": "Security" + "severity": "Medium", + "subcategory": "App modernization", + "text": "Modernizing the app towards a microservices architecture will have the effect of letting the app scale according to the single service and not the entire stack", + "waf": "Cost" }, { - "category": "Identity and Access Management", - "checklist": "Azure API Management Review", - "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", - "service": "APIM", + "category": "DB/APP tuning", + "checklist": "Cost Optimization Checklist", + "guid": "a27b765a-91be-41f3-a8ef-394c2bd463cb", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "Entra", - "APIM" + "Storage", + "VM", + "Cost" ], - "severity": "High", - "subcategory": "Identity", - "text": "Protect incoming requests to APIs (data plane) with Azure AD", - "waf": "Security" + "severity": "Medium", + "subcategory": "DB optimization", + "text": "optimizing the DB queries will increase performance and allow better right-sizing of storage and VMs", + "waf": "Cost" }, { - "category": "Identity and Access Management", - "checklist": "Azure API Management Review", - "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", - "service": "APIM", + "category": "DB/APP tuning", + "checklist": "Cost Optimization Checklist", + "guid": "bac75819-59bb-491a-9ed9-0cae2cc84c37", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "Entra", - "APIM" + "Cost" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal", - "waf": "Security" + "subcategory": "Demand shaping", + "text": "Using demand shaping on PaaS services will optimize costs and performances", + "waf": "Cost" }, { - "category": "Identity and Access Management", - "checklist": "Azure API Management Review", - "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "b6b780cb-9fe5-4c46-989d-457a927c3874", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging", "services": [ "Entra", - "APIM" + "Cost" ], "severity": "Medium", - "subcategory": "Privileged access", - "text": "Create appropriate groups to control the visibility of the products", - "waf": "Security" + "subcategory": "Advisor", + "text": "Start from the Azure Advisor page suggestions.", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "06862505-2d9a-4874-9491-2837b00a3475", - "link": "https://learn.microsoft.com/azure/api-management/backends", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "VM", "services": [ - "APIM" + "VM", + "Cost" ], "severity": "Medium", - "subcategory": "Best practices", - "text": "Use Backends feature to eliminate redundant API backend configurations", - "waf": "Operations" + "subcategory": "Advisor", + "text": "Make sure advisor is configured for VM right sizing ", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "881a1bd5-d1e4-44a1-a659-d3958fd77289", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "APIM", - "AzurePolicy" + "Cost" ], "severity": "Medium", - "subcategory": "Best practices", - "text": "Use Named Values to store common values that can be used in policies", - "waf": "Operations" + "subcategory": "Automation", + "text": "Consider implementing IaC scripts or devops pipelines to match the cost governance process", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "b835556d-f2bf-4e45-93b0-d834a348726d", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "ASR", - "APIM", - "ACR" + "Monitor", + "Cost" ], "severity": "Medium", - "subcategory": "Business continuity and disaster recovery", - "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA", - "waf": "Reliability" + "subcategory": "Automation", + "text": "Set up cost alerts for applications that have variable costs (ideally for all of them)", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", - "link": "https://learn.microsoft.com/azure/api-management/high-availability", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "e69c6b5c-2a26-4494-a69b-ad37aad53cc7", + "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", "services": [ - "APIM", - "ASR" + "Cost" ], "severity": "Medium", - "subcategory": "Business continuity and disaster recovery", - "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%", - "waf": "Reliability" + "subcategory": "Automation", + "text": "Use Azure Automation: Automate repetitive tasks can help you save time and resources, reducing costs in the process. ", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "8e1d7666-7357-4c44-a674-b5ed85a859c7", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "ASR", - "APIM", - "Backup" + "Cost" ], - "severity": "High", - "subcategory": "Business continuity and disaster recovery", - "text": "Ensure there is an automated backup routine", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Automation", + "text": "Run orphaned resources workbook", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", - "link": "https://learn.microsoft.com/azure/api-management/retry-policy", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "733be2a1-a27b-4765-a91b-e1f388ef394c", + "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", "services": [ - "APIM", - "AzurePolicy" + "Storage", + "Cost" ], "severity": "Medium", - "subcategory": "Failover and Caching", - "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.", - "waf": "Reliability" + "subcategory": "Baseline", + "text": "Try and establish a baseline of monthly spending and an acceptable saving target against the baseline (new services will not be optimized at this stage)", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "2bd463cb-bac7-4581-a59b-b91a3ed90cae", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "Cost" ], "severity": "Medium", - "subcategory": "Performance and scalability", - "text": "Consider using a external cache policy for APIs that can benefit from caching", - "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/" + "subcategory": "Baseline", + "text": "Establish a cost optimization baseline by using a policy that tags every new resource as #NEW", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "2cc84c37-b6b7-480c-a9fe-5c46489d457a", + "link": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management-config", "services": [ - "EventHubs", - "APIM", - "AzurePolicy" + "Cost" ], - "severity": "Low", - "subcategory": "Performance and scalability", - "text": "If you need to log at high performance levels, consider Event Hubs policy", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Baseline", + "text": "Organize resources to maximize cost insights and accountability", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", - "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "927c3874-d010-42ca-a6aa-e01e6a84de5d", + "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json", "services": [ - "APIM", - "AzurePolicy" + "Cost" ], "severity": "Medium", - "subcategory": "Performance and scalability", - "text": "Apply throttling policies to control the number of requests per second", - "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", - "waf": "Performance" + "subcategory": "Budgets", + "text": "Create budgets", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "e36d1d92-881a-41bd-9d1e-44a19659d395", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator", "services": [ - "APIM" + "Cost" ], "severity": "Medium", - "subcategory": "Performance and scalability", - "text": "Configure autoscaling to scale out the number of instances when the load increases", - "waf": "Performance" + "subcategory": "Cost Analysis", + "text": "In cost analysis - use daily granularity, grouped by service name to analyze the spending of the past 3 months and identify the top 3 spenders", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "8fd77289-b835-4556-bf2b-fe4563b0d834", + "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server", "services": [ - "APIM" + "Cost" ], "severity": "Medium", - "subcategory": "Performance and scalability", - "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.", - "waf": "Performance" + "subcategory": "Cost Analysis", + "text": "Check daily for cost spikes and anomalies (ideally with automatic billing exports)", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", - "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "a348726d-e69c-46b5-a2a2-6494b69bad37", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", "services": [ - "APIM" + "Cost" ], "severity": "Medium", - "subcategory": "Premium Tier", - "text": "Use the premium tier for production workloads.", - "waf": "Reliability" + "subcategory": "Cost Analysis", + "text": "Automate cost retrieval for deep analysis or integration", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "aad53cc7-8e1d-4766-9735-7c449674b5ed", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", "services": [ - "APIM", - "AzurePolicy" + "ACR", + "Cost" ], "severity": "Medium", - "subcategory": "Request Routing", - "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.", - "waf": "Reliability" + "subcategory": "Free services", + "text": "Take advantage of Azure free services: Azure offers a number of free services, such as DevOps, Azure Container Registry, and Azure Logic Apps, that can help you save costs on development and operations. ", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "96c96ad8-844c-4f3b-8b38-c886ba2c0214", + "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", "services": [ - "Entra", - "APIM" + "Cost" ], - "severity": "High", - "subcategory": "Resource Limits", - "text": "Be aware of APIM's limits", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Tagging", + "text": "Tag shared resources", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure API Management Review", - "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", - "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", - "service": "APIM", + "category": "Process Administration", + "checklist": "Cost Optimization Checklist", + "guid": "99014a5d-3ce5-474d-acbd-9792a6bcca2b", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", "services": [ - "APIM" + "Cost" ], - "severity": "High", - "subcategory": "Self-Hosted", - "text": "Ensure that the self-hosted gateway deployments are resilient.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Tagging", + "text": "Consider using tags to all services for cost allocation", + "waf": "Cost" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure API Management Review", - "guid": "7519e385-a88b-4d34-966b-6269d686e890", - "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", - "service": "APIM", + "category": "reservations", + "checklist": "Cost Optimization Checklist", + "guid": "4fea1dbf-3dd9-45d4-ac7c-891dcb1f7d57", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", "services": [ - "Entra", - "APIM", - "FrontDoor" + "Cost" ], "severity": "Medium", - "subcategory": "Connectivity", - "text": "Use Azure Front Door in front of APIM for multi-region deployment", - "waf": "Performance" + "subcategory": "automation", + "text": "Consider Reservation automation to track and promptly react to changes", + "waf": "Cost" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure API Management Review", - "guid": "cd45c90e-7690-4753-930b-bf290c69c074", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "description": "check by searching the Meter Category Licenses in the Cost analysys", + "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", + "service": "VM", "services": [ - "APIM", - "VNet" + "VM", + "AzurePolicy", + "Cost", + "SQL" ], "severity": "Medium", - "subcategory": "Security", - "text": "Deploy the service within a Virtual Network (VNet)", - "waf": "Security" + "subcategory": "check AHUB is applied to all Windows VMs, RHEL and SQL", + "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently", + "waf": "Cost" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure API Management Review", - "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "VM", "services": [ - "Entra", - "APIM", - "VNet", - "Monitor" + "LoadBalancer", + "Cost" ], "severity": "Medium", - "subcategory": "Security", - "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.", - "waf": "Security" + "subcategory": "Check Red Hat Licences if applicable", + "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", + "waf": "Cost" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure API Management Review", - "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "a76af4a6-91e8-4839-ada4-6667e13c1056", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", "services": [ - "Entra", - "APIM", - "VNet", - "PrivateLink" + "Cost", + "AppSvc" ], "severity": "Medium", - "subcategory": "Security", - "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.", - "waf": "Security" + "subcategory": "Functions", + "text": "Saving plans will provide 17% on select app service plans", + "waf": "Cost" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure API Management Review", - "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "VM", "services": [ - "APIM" + "VM", + "Cost" ], - "severity": "High", - "subcategory": "Security", - "text": "Disable Public Network Access", - "waf": "Security" + "severity": "Medium", + "subcategory": "Planning", + "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)", + "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", + "waf": "Cost" }, { - "category": "Platform automation and DevOps", - "checklist": "Azure API Management Review", - "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", - "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", + "service": "VM", "services": [ - "APIM" + "ARS", + "VM", + "Cost" ], "severity": "Medium", - "subcategory": "Automation", - "text": "Simplify management with PowerShell automation scripts", - "waf": "Operations" + "subcategory": "Reservations/savings plans", + "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.", + "waf": "Cost" }, { - "category": "Platform automation and DevOps", - "checklist": "Azure API Management Review", - "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "a785c6fe-96c9-46ad-a844-cf3b2b38c886", + "link": "https://azure.microsoft.com/resources/achieving-compliant-data-residency-and-security-with-azure/", "services": [ - "Entra", - "APIM" + "Cost" ], "severity": "Medium", - "subcategory": "Best practices", - "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator", - "waf": "Operations" + "subcategory": "Reservations/savings plans", + "text": "Plan for Azure Savings Plans for all the workloads that are dynamic and need maximum flexibility", + "waf": "Cost" }, { - "category": "Platform automation and DevOps", - "checklist": "Azure API Management Review", - "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", - "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "ba2c0214-9901-44a5-b3ce-574dccbd9792", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", "services": [ - "Entra", - "APIM" + "Cost" ], "severity": "Medium", - "subcategory": "Best practices", - "text": "Promote usage of Visual Studio Code APIM extension for faster API development", - "waf": "Operations" + "subcategory": "Reservations/savings plans", + "text": "Plan for Azure Reservations for all the workloads that are less dynamic and won't change much", + "waf": "Cost" }, { - "category": "Platform automation and DevOps", - "checklist": "Azure API Management Review", - "guid": "354f1c03-8112-4965-85ad-c0074bddf231", - "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "VM", "services": [ - "APIM" + "Storage", + "Cost" ], "severity": "Medium", - "subcategory": "DevOps", - "text": "Implement DevOps and CI/CD in your workflow", - "waf": "Operations" + "subcategory": "Reserve storage", + "text": "Only larger disks can be reserved => 1 TiB -", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure API Management Review", - "guid": "b6439493-426a-45f3-9697-cf65baee208d", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", + "service": "VM", "services": [ - "APIM" + "VM", + "Cost" ], "severity": "Medium", - "subcategory": "APIs", - "text": "Secure APIs using client certificate authentication", - "waf": "Security" + "subcategory": "Reserve VMs with normalized and rationalized sizes", + "text": "After the right-sizing optimization", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure API Management Review", - "guid": "2a67d143-1033-4c0a-8732-680896478f08", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Azure SQL", "services": [ - "APIM" + "AzurePolicy", + "Cost", + "SQL" ], "severity": "Medium", - "subcategory": "APIs", - "text": "Secure backend services using client certificate authentication", - "waf": "Security" + "subcategory": "SQL Database AHUB", + "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure API Management Review", - "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", - "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "VM", "services": [ - "APIM" + "VM", + "Cost", + "SQL" ], "severity": "Medium", - "subcategory": "APIs", - "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs", - "waf": "Security" + "subcategory": "SQL Database Reservations", + "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure API Management Review", - "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", - "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "e13c1056-75c1-4e94-9b45-9837ff7ae7c6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#managed-identities", "services": [ - "APIM" + "Cost" ], "severity": "Medium", - "subcategory": "APIs", - "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs", - "waf": "Security" + "subcategory": "Tracking", + "text": "Make sure you Azure Reservations and Savings plans are close to 100% utilization or make the necessary changes to reach it.", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure API Management Review", - "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", - "service": "APIM", + "category": "Reservations", + "checklist": "Cost Optimization Checklist", + "guid": "d3b475a5-c7ac-4be4-abbe-64dd89f2e877", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations", "services": [ - "APIM" + "AzurePolicy", + "Cost" ], - "severity": "High", - "subcategory": "Ciphers", - "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.", - "waf": "Security" + "severity": "Medium", + "subcategory": "Tracking", + "text": "Make sure that your reservations usage is close to 100%. If not, either enforce an allowed SKU policy or exchange the reservation", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure API Management Review", - "guid": "f8af3d94-1d2b-4070-846f-849197524258", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", - "service": "APIM", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "78468d55-a785-4c6f-b96c-96ad8844cf3b", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review", "services": [ - "APIM", - "AKV" + "AzurePolicy", + "Cost" ], - "severity": "High", - "subcategory": "Data protection", - "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated", - "waf": "Security" + "severity": "Medium", + "subcategory": "Automation", + "text": "Plan and enforce a On/Off policy for production services, where possible", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure API Management Review", - "guid": "791abd8b-7706-4e31-9569-afefde724be3", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", - "service": "APIM", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "2b38c886-ba2c-4021-9990-14a5d3ce574d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", "services": [ - "Entra", - "APIM" + "AzurePolicy", + "Cost" ], "severity": "Medium", - "subcategory": "Identities", - "text": "Use managed identities to authenticate to other Azure resources whenever possible", - "waf": "Security" + "subcategory": "Automation", + "text": "Plan and enforce a On-Demand policy with auto-shutdown for non-production services, where possible", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure API Management Review", - "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", - "service": "APIM", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "VM", "services": [ - "Entra", - "APIM", - "AppGW", - "WAF" + "VM", + "Cost" ], - "severity": "High", - "subcategory": "Network", - "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM", - "waf": "Security" + "severity": "Medium", + "subcategory": "Autoscale", + "text": "Consider using a VMSS to match demand rather than flat sizing", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "AKS", "services": [ - "CosmosDB" + "AKS", + "Cost" ], "severity": "Medium", - "subcategory": "Best Practices", - "text": "FTA Resiliency Playbook", - "waf": "Reliability" + "subcategory": "Autoscale", + "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "93665720-2bff-4456-9b0d-934a359c363e", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", "services": [ - "CosmosDB" + "Cost" ], - "severity": "High", - "subcategory": "High Availability", - "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Autoscale", + "text": "Right-size PaaS service according to average use and accomodate spikes with auto or manual scaling", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "guid": "0d934a34-8b26-43e7-bd60-513a3649906e", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "7dd61623-a364-4a90-9eba-e38ead53cc7d", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "services": [ - "CosmosDB" + "Cost" ], "severity": "Medium", - "subcategory": "High Availability", - "text": "Run multiple replicas of the database (>1 ) in Prod", - "waf": "Reliability" + "subcategory": "Autoscale", + "text": "Plan for demand shaping where applicable", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe", - "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "e2e8aaab-3571-4549-ab91-53d89f89dc7b", "services": [ - "CosmosDB", - "ACR" + "Cost" ], "severity": "Medium", - "subcategory": "High Availability", - "text": "Leverage Multi-Region Writes", - "waf": "Reliability" + "subcategory": "Autoscale", + "text": "Consider implementing a service re-scaling logic within the application", + "training": "https://learn.microsoft.com/azure/cost-management-billing/savings-plan/", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "description": "Span Cosmos account across two or more regions with multi-region writes", - "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Azure Backup", "services": [ - "CosmosDB", - "ACR" + "Backup", + "Cost" ], "severity": "Medium", - "subcategory": "High Availability", - "text": "Distribute your data globally", - "waf": "Reliability" + "subcategory": "Backup", + "text": "Move recovery points to vault-archive where applicable (Validate)", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong", - "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0", - "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", + "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", + "service": "Databricks", "services": [ - "CosmosDB" + "LoadBalancer", + "VM", + "Cost" ], - "severity": "High", - "subcategory": "High Availability", - "text": "Choose from several well-defined consistency models", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Databricks", + "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.", - "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe", - "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", + "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", + "service": "Azure Functions", "services": [ - "CosmosDB" + "Cost" ], "severity": "Medium", - "subcategory": "High Availability", - "text": "Enable Service managed failover", - "waf": "Reliability" + "subcategory": "Functions", + "text": "Functions - Reuse connections", + "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.", - "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90", - "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "service": "Azure Functions", "services": [ - "Backup", - "CosmosDB", - "Storage" + "Cost" ], "severity": "Medium", - "subcategory": "Backup Strategy", - "text": "Enable Automatic Backups", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Reliability" + "subcategory": "Functions", + "text": "Functions - Cache data locally", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.", - "guid": "a6eb33f6-005c-4d92-9286-7655672d6121", - "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Azure Functions", "services": [ - "Backup", - "CosmosDB" + "Storage", + "Cost" ], "severity": "Medium", - "subcategory": "Backup Strategy", - "text": "Perform Periodic Backups", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Reliability" + "subcategory": "Functions", + "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "Cost" }, { - "category": "Operations Management", - "checklist": "CosmosDB Review Checklist", - "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.", - "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1", - "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction", - "service": "CosmosDB", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "Azure Functions", "services": [ - "Backup", - "CosmosDB" + "Cost" ], "severity": "Medium", - "subcategory": "Backup Strategy", - "text": "Continous Backup with point-in-time restore in Azure Cosmos DB", - "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", - "waf": "Reliability" + "subcategory": "Functions", + "text": "Functions - Keep your functions warm", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Cost" }, { - "category": "BC and DR", - "checklist": "IoT Hub Review", - "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", - "service": "IoT", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)", - "waf": "Reliability" + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Azure Functions", + "services": [ + "Cost" + ], + "severity": "Medium", + "subcategory": "Functions", + "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)", + "waf": "Cost" }, { - "category": "BC and DR", - "checklist": "IoT Hub Review", - "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "services": [], + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", + "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", + "service": "Azure Functions", + "services": [ + "Cost" + ], "severity": "Medium", - "subcategory": "High Availability", - "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.", - "waf": "Reliability" + "subcategory": "Functions", + "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.", + "waf": "Cost" }, { - "category": "BC and DR", - "checklist": "IoT Hub Review", - "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", - "service": "IoT", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Consider a Cross-Region DR strategy for critical workloads", - "waf": "Reliability" + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", + "service": "Azure Functions", + "services": [ + "Cost" + ], + "severity": "Medium", + "subcategory": "Functions", + "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", + "waf": "Cost" }, { - "category": "BC and DR", - "checklist": "IoT Hub Review", - "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Learn how to trigger a manual failover.", - "waf": "Reliability" + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "df03a822-cd46-43cb-abc8-ac299ebc91a4", + "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", + "services": [ + "Cost" + ], + "severity": "Medium", + "subcategory": "Networking", + "text": "Evaluate your network topology against networking costs and where applicable reduce the egress and peering data", + "waf": "Cost" }, { - "category": "BC and DR", - "checklist": "IoT Hub Review", - "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", - "service": "IoT", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Learn how to fail back after a failover.", - "waf": "Reliability" - }, - { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.", - "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e", - "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Front Door", "services": [ - "ACR" + "EventHubs", + "FrontDoor", + "Cost" ], - "severity": "High", - "subcategory": "Data Protection", - "text": "Disable Azure Container Registry image export", - "waf": "Security" + "severity": "Medium", + "subcategory": "Networking", + "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry", - "guid": "d503547c-d447-4e82-9128-a7100f1cac6d", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Front Door", "services": [ - "AzurePolicy", - "ACR" + "FrontDoor", + "Cost", + "AppSvc" ], - "severity": "High", - "subcategory": "Data Protection", - "text": "Enable Azure Policies for Azure Container Registry", - "waf": "Security" + "severity": "Medium", + "subcategory": "Networking", + "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.", - "guid": "d345293c-7639-4637-a551-c5c04e401955", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "f843e52f-4722-4d92-ac1b-1cd521e54a29", + "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview", "services": [ - "AKV", - "ACR" + "Cost" ], - "severity": "High", - "subcategory": "Data Protection", - "text": "Sign and Verify containers with notation (Notary v2)", - "waf": "Security" + "severity": "Medium", + "subcategory": "PaaS", + "text": "Consider using free tiers where applicable for all non-production environments", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.", - "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49", - "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "b9de39ac-0e7c-428d-a936-657202bff456", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", "services": [ - "AKV", - "ACR" + "Cost" ], "severity": "Medium", - "subcategory": "Data Protection", - "text": "Encrypt registry with a customer managed key", - "waf": "Security" + "subcategory": "Serverless", + "text": "Using serverless patterns for spikes can help keeping costs down", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications", - "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", + "service": "Storage", "services": [ - "Entra", - "RBAC", - "ACR" + "Storage", + "Cost" ], - "severity": "High", - "subcategory": "Identity and Access Control", - "text": "Use Managed Identities to connect instead of Service Principals", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "Consider archiving tiers for less used data", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead", - "guid": "be0e38ce-e297-411b-b363-caaab79b198d", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "VM", "services": [ - "Entra", - "RBAC", - "ACR" + "Storage", + "Cost" ], - "severity": "High", - "subcategory": "Identity and Access Control", - "text": "Disable local authentication for management plane access", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations", - "guid": "387e5ced-126c-4d13-8af5-b20c6998a646", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "Storage", "services": [ - "Entra", - "RBAC", - "ACR" + "Storage", + "Cost" ], - "severity": "High", - "subcategory": "Identity and Access Control", - "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "Consider using standard SSD rather than Premium or Ultra where possible", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Disable anonymous pull/push access", - "guid": "e338997e-41c7-47d7-acf6-a62a1194956d", - "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "Storage", "services": [ - "Entra", - "ACR" + "Storage", + "Cost" ], "severity": "Medium", - "subcategory": "Identity and Access Control", - "text": "Disable Anonymous pull access", - "waf": "Security" + "subcategory": "Storage", + "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token", - "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "Site Recovery", "services": [ - "Entra", - "ACR" + "ASR", + "Storage", + "Cost" ], - "severity": "High", - "subcategory": "Identity and Access Control", - "text": "Disable repository-scoped access tokens", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network", - "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", + "service": "Storage", "services": [ - "Entra", - "EventHubs", - "PrivateLink", - "ACR" + "Storage", + "Cost" ], - "severity": "High", - "subcategory": "Identity and Access Control", - "text": "Deploy images from a trusted environment", - "waf": "Security" + "severity": "Medium", + "subcategory": "storage", + "text": "Storage accounts: check hot tier and/or GRS necessary", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR", - "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "VM", "services": [ - "Entra", - "AzurePolicy", - "ACR" + "Storage", + "Cost" ], "severity": "Medium", - "subcategory": "Identity and Access Control", - "text": "Disable Azure ARM audience tokens for authentication", - "waf": "Security" + "subcategory": "Storage", + "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.", - "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6", - "link": "https://learn.microsoft.com/azure/container-registry/monitor-service", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "Synapse", "services": [ - "Entra", + "EventHubs", "Monitor", - "ACR" + "Cost" ], "severity": "Medium", - "subcategory": "Logging and Monitoring", - "text": "Enable diagnostics logging", - "waf": "Security" + "subcategory": "Synapse", + "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch", - "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "Synapse", "services": [ - "VNet", - "PrivateLink", - "ACR", - "Firewall" + "Storage", + "Cost" ], "severity": "Medium", - "subcategory": "Network Security", - "text": "Control inbound network access with Private Link", - "waf": "Security" + "subcategory": "Synapse", + "text": "Export cost data to a storage account for additional data analysis.", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Disable public network access if inbound network access is secured using Private Link", - "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Synapse", "services": [ - "PrivateLink", - "ACR" + "Cost", + "SQL" ], "severity": "Medium", - "subcategory": "Network Security", - "text": "Disable Public Network access", - "waf": "Security" + "subcategory": "Synapse", + "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Only the ACR Premium SKU supports Private Link access", - "guid": "fc833934-8b26-42d6-ac5f-512925498f6d", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", + "service": "Synapse", "services": [ - "PrivateLink", - "ACR" + "Cost" ], "severity": "Medium", - "subcategory": "Network Security", - "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)", - "waf": "Security" + "subcategory": "Synapse", + "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities", - "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Synapse", "services": [ - "Defender", - "ACR" + "Cost" ], - "severity": "Low", - "subcategory": "Network Security", - "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities", - "waf": "Security" + "severity": "Medium", + "subcategory": "Synapse", + "text": "Create multiple Apache Spark pool definitions of various sizes.", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", - "guid": "4451e1a2-d345-4293-a763-9637a551c5c0", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "service": "Synapse", "services": [ - "ACR" + "Cost" ], "severity": "Medium", - "subcategory": "Vulnerability Management", - "text": "Deploy validated container images", - "waf": "Security" + "subcategory": "Synapse", + "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Container Registry Security Review", - "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", - "guid": "4e401955-387e-45ce-b126-cd132af5b20c", - "service": "ACR", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "VM", "services": [ - "ACR" + "VM", + "Cost" ], - "severity": "High", - "subcategory": "Vulnerability Management", - "text": "Use up-to-date platforms, languages, protocols and frameworks", - "waf": "Security" + "severity": "Medium", + "subcategory": "VM", + "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", - "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", - "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", - "service": "Event Hubs", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "544451e1-92d3-4442-a3c7-628637a551c5", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", "services": [ - "EventHubs" + "VM", + "Cost" ], - "severity": "Low", - "subcategory": "Data Protection", - "text": "Use customer-managed key option in data at rest encryption when required", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Security" + "severity": "Medium", + "subcategory": "VM", + "text": "Right-sizing all VMs", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ", - "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", - "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", - "service": "Event Hubs", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "VM", "services": [ - "EventHubs" + "VM", + "Cost" ], "severity": "Medium", - "subcategory": "Data Protection", - "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Security" + "subcategory": "VM", + "text": "Swap VM sized with normalized and most recent sizes", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Event Hub Review", - "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", - "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", - "service": "Event Hubs", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", "services": [ - "RBAC", - "EventHubs", - "TrafficManager", - "AzurePolicy", - "Entra" + "Monitor", + "VM", + "Cost" ], "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "Avoid using root account when it is not necessary", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "Security" + "subcategory": "VM", + "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Event Hub Review", - "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ", - "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", - "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", - "service": "Event Hubs", + "category": "Right-sizing", + "checklist": "Cost Optimization Checklist", + "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", "services": [ - "EventHubs", - "AKV", - "Storage", - "Entra", - "VM" + "VM", + "Cost" ], "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "VM", + "text": "Containerizing an application can improve VM density and save money on scaling it", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure Event Hub Review", - "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.", - "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", - "service": "Event Hubs", - "services": [ - "RBAC", - "EventHubs", - "Entra" - ], + "category": "Operations Management", + "checklist": "Azure Data Factory Review Checklist", + "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", + "service": "Azure Data Factory", + "services": [], + "severity": "Medium", + "subcategory": "Best Practices", + "text": "Leverage FTA Resiliency Playbook for Azure Data Factory", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Azure Data Factory Review Checklist", + "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", + "services": [], "severity": "High", - "subcategory": "Identity and Access Management", - "text": "Use least privilege data plane RBAC", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Security" + "subcategory": "Availablity Zone", + "text": "Use zone redundant pipelines in regions that support Availability Zones", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.", - "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", - "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", - "service": "Event Hubs", + "category": "Operations Management", + "checklist": "Azure Data Factory Review Checklist", + "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", + "link": "https://learn.microsoft.com/azure/data-factory/source-control", + "service": "Azure Data Factory", "services": [ - "EventHubs", - "VNet", - "Monitor" + "Backup" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Security" + "subcategory": "DevOps Integration", + "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", - "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", - "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", - "service": "Event Hubs", + "category": "Network Topology and Connectivity", + "checklist": "Azure Data Factory Review Checklist", + "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", + "services": [ + "VM" + ], + "severity": "Medium", + "subcategory": "Network", + "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ", + "waf": "Reliability" + }, + { + "category": "Network Topology and Connectivity", + "checklist": "Azure Data Factory Review Checklist", + "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "services": [ - "EventHubs", - "PrivateLink", "VNet" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "subcategory": "Network", + "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region", + "waf": "Reliability" + }, + { + "category": "Governance and Security", + "checklist": "Azure Data Factory Review Checklist", + "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you", + "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Azure Data Factory", + "services": [ + "AKV" + ], + "severity": "Low", + "subcategory": "Integration", + "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity", + "waf": "Reliability" + }, + { + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Front Door", + "services": [ + "AKV", + "FrontDoor" + ], + "severity": "Medium", + "subcategory": "Front Door", + "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal", + "waf": "Operations" + }, + { + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "b71ca41b-3a80-48f3-a6cd-22cdf197c1cf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "services": [], + "severity": "Medium", + "subcategory": "App delivery", + "text": "Perform app delivery within landing zones for both internal-facing (corp) and external-facing apps (online).", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Event Hub Review", - "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", - "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", - "service": "Event Hubs", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", + "guid": "553585a6-abe0-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "App Gateway", "services": [ - "EventHubs" + "AppGW" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "subcategory": "App Gateway", + "text": "Ensure you are using Application Gateway v2 SKU", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Security" }, { - "category": "Operations Management", - "checklist": "Azure Event Hub Review", - "guid": "31d41e36-11c8-417b-8afb-c410d4391898", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", - "service": "Event Hubs", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", + "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Load Balancer", "services": [ - "EventHubs" + "LoadBalancer" ], "severity": "Medium", - "subcategory": "Best Practices", - "text": "Leverage FTA Resillency HandBook", - "waf": "Reliability" + "subcategory": "Load Balancer", + "text": "Ensure you are using the Standard SKU for your Azure Load Balancers", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "Azure Event Hub Review", - "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones", - "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", - "service": "Event Hubs", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "9432621a-8397-4654-a882-5bc856b7ef83", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", + "service": "Load Balancer", "services": [ - "EventHubs", - "ACR" + "LoadBalancer" ], - "severity": "High", - "subcategory": "Zone Redudancy", - "text": "Leverage Availability Zones if regionally applicable", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Load Balancer", + "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "Azure Event Hub Review", - "guid": "20b56c56-ad58-4519-8f82-735c586bb281", - "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", - "service": "Event Hubs", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", + "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "App Gateway", "services": [ - "EventHubs" + "VNet", + "AppGW" ], "severity": "Medium", - "subcategory": "Best Practices", - "text": "Use the Premium or Dedicated SKUs for predicable performance", - "waf": "Reliability" + "subcategory": "App Gateway", + "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "Azure Event Hub Review", - "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations", - "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", - "service": "Event Hubs", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.", + "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "services": [ - "EventHubs", - "ASR" + "VNet", + "Entra", + "Subscriptions", + "WAF", + "NVA", + "AppGW" ], - "severity": "High", - "subcategory": "Geo Redudancy", - "text": "Plan for Geo Disaster Recovery using Active Passive configuration", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "Azure Event Hub Review", - "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs", - "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", - "service": "Event Hubs", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "services": [ - "EventHubs", - "ASR" + "DDoS" ], "severity": "Medium", - "subcategory": "Geo Redudancy", - "text": "For Business Critical Applications, use Active Active configuration", + "subcategory": "App Gateway", + "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" + }, + { + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", + "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", + "service": "App Gateway", + "services": [], + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Configure autoscaling with a minimum amount of instances of two.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Reliability" }, { - "category": "Operations Management", - "checklist": "Azure Event Hub Review", - "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", - "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", - "service": "Event Hubs", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", + "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", + "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", + "service": "App Gateway", "services": [ - "EventHubs" + "ACR", + "AppGW" ], "severity": "Medium", - "subcategory": "Reliability", - "text": "Design Resilient Event Hubs", + "subcategory": "App Gateway", + "text": "Deploy Application Gateway across Availability Zones", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Reliability" }, { - "category": "Version Control", - "checklist": "Azure DevOps", - "description": "Implement branching policy in Azure DevOps", - "guid": "eda1dae2-cc85-4c47-a6b7-81cca0e6c465", - "link": "https://learn.microsoft.com/azure/devops/repos/git/branch-policies-overview?view=azure-devops", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Front Door", "services": [ - "AzurePolicy" + "FrontDoor", + "AzurePolicy", + "WAF" ], - "severity": "High", - "subcategory": "Branching Policy", - "text": "Branch Policies", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Front Door", + "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "category": "Version Control", - "checklist": "Azure DevOps", - "description": "Understand branch strategy such as GitFlow or GitHub Flow", - "guid": "bc288bec-6a16-4ca7-8444-51e1add34529", - "link": "https://learn.microsoft.com/azure/devops/repos/git/git-branching-guidance?view=azure-devops", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "3f29812b-2363-4cef-b179-b599de0d5973", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "Front Door", "services": [ - "AzurePolicy" + "FrontDoor", + "AzurePolicy", + "WAF", + "AppGW" ], - "severity": "High", - "subcategory": "Branching Policy", - "text": "Branching strategy", - "waf": "Operations" + "severity": "Medium", + "subcategory": "App delivery", + "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "category": "Version Control", - "checklist": "Azure DevOps", - "description": "Understand how teams work with git", - "guid": "ec723823-7a15-41c5-ab4e-401914387e5c", - "link": "https://www.atlassian.com/git/tutorials/comparing-workflows/gitflow-workflow", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Traffic Manager", "services": [ - "AzurePolicy" + "TrafficManager" ], "severity": "High", - "subcategory": "Branching Policy", - "text": "Understand GitFlow Branch Strategy", - "waf": "Operations" + "subcategory": "Traffic Manager", + "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Reliability" }, { - "category": "Version Control", - "checklist": "Azure DevOps", - "description": "Merge into higher branches after two or more reviewers in a PR", - "guid": "a9c26c9c-32ab-45bd-8c69-98a246e33899", - "link": "https://learn.microsoft.com/azure/devops/repos/git/review-pull-requests?view=azure-devops&tabs=browser", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", "services": [ - "AzurePolicy" + "Entra", + "AVD" ], - "severity": "High", - "subcategory": "Branching Policy", - "text": "Pull Request Review", - "waf": "Operations" + "severity": "Low", + "subcategory": "App delivery", + "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", + "waf": "Security" }, { - "category": "Version Control", - "checklist": "Azure DevOps", - "description": "Implement access control to the branches", - "guid": "7e41c77d-68cb-46a2-8ac1-9f916d697d8e", - "link": "https://learn.microsoft.com/azure/devops/repos/git/branch-permissions?view=azure-devops", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", "services": [ - "AzurePolicy" + "Entra" ], "severity": "Medium", - "subcategory": "Branching Policy", - "text": "Access Control to the Branch", - "waf": "Operations" + "subcategory": "App delivery", + "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Security" }, { - "category": "Version Control", - "checklist": "Azure DevOps", - "description": "Perform SAST code scan", - "guid": "adfd27bd-e187-401a-a252-baa9b68a088c", - "link": "https://devblogs.microsoft.com/devops/integrate-security-into-your-developer-workflow-with-github-advanced-security-for-azure-devops/", - "services": [], + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "ae248989-b306-4591-9186-de482e3f0f0e", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "Front Door", + "services": [ + "FrontDoor", + "AzurePolicy", + "WAF" + ], "severity": "High", - "subcategory": "Security", - "text": "Code Scan", + "subcategory": "Front Door", + "text": "Deploy your WAF policy for Front Door in 'Prevention' mode.", "waf": "Security" }, { - "category": "Version Control", - "checklist": "Azure DevOps", - "description": "Understand TFVC as Code Repo", - "guid": "9a8f822b-8eb9-4d1b-a77f-26e5e6beba8e", - "link": "https://learn.microsoft.com/azure/devops/repos/tfvc/what-is-tfvc?view=azure-devops", - "services": [], - "severity": "Low", - "subcategory": "Practice", - "text": "TFVC as Code Repository", - "waf": "Operations" + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "Front Door", + "services": [ + "TrafficManager", + "FrontDoor" + ], + "severity": "High", + "subcategory": "Front Door", + "text": "Avoid combining Azure Traffic Manager and Azure Front Door.", + "waf": "Security" }, { - "category": "Version Control", - "checklist": "Azure DevOps", - "description": "Compare Git vs TFVC for your project", - "guid": "d4f3437b-c336-4d71-9f27-a71eee0b9b5d", - "link": "https://learn.microsoft.com/azure/devops/repos/tfvc/comparison-git-tfvc?view=azure-devops", - "services": [], - "severity": "Low", - "subcategory": "Practice", - "text": "Choose Right version control", - "waf": "Operations" + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "Front Door", + "services": [ + "FrontDoor" + ], + "severity": "High", + "subcategory": "Front Door", + "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.", + "waf": "Security" }, { - "category": "Azure Boards", - "checklist": "Azure DevOps", - "description": "Set up your team management", - "guid": "8defd5d7-21d4-41d2-900c-807bf9eab40f", - "link": "https://learn.microsoft.com/azure/devops/organizations/settings/manage-teams?view=azure-devops", - "services": [], - "severity": "High", - "subcategory": "Team Planning", - "text": "Configure your teams", - "waf": "Operations" + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", + "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "Front Door", + "services": [ + "FrontDoor" + ], + "severity": "Low", + "subcategory": "Front Door", + "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.", + "waf": "Performance" }, { - "category": "Azure Boards", - "checklist": "Azure DevOps", - "description": "Start scheduling sprints", - "guid": "9ed5b354-78d4-447a-a26c-2863c00f1cac", - "link": "https://learn.microsoft.com/azure/devops/boards/sprints/define-sprints?view=azure-devops", - "services": [], + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "Front Door", + "services": [ + "FrontDoor" + ], "severity": "Medium", - "subcategory": "Team Planning", - "text": "Configure your sprints", - "waf": "Operations" + "subcategory": "Front Door", + "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.", + "waf": "Reliability" }, { - "category": "Azure Boards", - "checklist": "Azure DevOps", - "description": "Set up your work item heirarchy", - "guid": "699ef1d5-a83d-4e5d-b36c-1c81870a0bc5", - "link": "https://learn.microsoft.com/azure/devops/organizations/settings/work/customize-process-work-item-type?view=azure-devops", - "services": [], - "severity": "Low", - "subcategory": "Team Planning", - "text": "Choose Work Item types", - "waf": "Operations" - }, - { - "category": "Azure Boards", - "checklist": "Azure DevOps", - "description": "WIT Processes available in Azure DevOps", - "guid": "c1e43a18-658d-4285-aed6-7179b825546d", - "link": "https://learn.microsoft.com/azure/devops/boards/work-items/guidance/choose-process?view=azure-devops&tabs=agile-process", - "services": [], - "severity": "High", - "subcategory": "Team Planning", - "text": "Select a WIT Process", - "waf": "Operations" - }, - { - "category": "Azure Boards", - "checklist": "Azure DevOps", - "description": "Use Azure Boards with GitHub", - "guid": "f2aee455-3afc-4833-a248-726dd68c5b5c", - "link": "https://learn.microsoft.com/azure/devops/cross-service/github-integration?view=azure-devops", - "services": [], - "severity": "Low", - "subcategory": "Tool Integration", - "text": "GitHub Integration", - "waf": "Operations" - }, - { - "category": "Azure Boards", - "checklist": "Azure DevOps", - "description": "Understand the methologies", - "guid": "2925394b-69b9-4d37-aac4-3bc68d1d7665", - "link": "https://www.atlassian.com/agile/scrum/agile-vs-scrum", - "services": [], - "severity": "Medium", - "subcategory": "Process Planning", - "text": "Understand Agile Vs Scrum", - "waf": "Operations" - }, - { - "category": "Azure Boards", - "checklist": "Azure DevOps", - "description": "Create Dashboard and PowerBI reports", - "guid": "7246b448-564b-44dd-94a7-59c7633bd2a1", - "link": "https://learn.microsoft.com/azure/devops/report/dashboards/overview?view=azure-devops", - "services": [], - "severity": "Medium", - "subcategory": "Reporting", - "text": "Dashboard", - "waf": "Operations" - }, - { - "category": "Azure Boards", - "checklist": "Azure DevOps", - "description": "Set up backlog", - "guid": "a27a764a-90be-40e3-98ee-293c1bd363ca", - "link": "https://learn.microsoft.com/azure/devops/boards/backlogs/set-up-your-backlog?view=azure-devops", - "services": [], - "severity": "Medium", - "subcategory": "Reporting", - "text": "Refine your backlog", - "waf": "Operations" - }, - { - "category": "Azure Boards", - "checklist": "Azure DevOps", - "description": "Link your work items", - "guid": "aab75719-49ab-4919-9dc9-fc9d1bb84b37", - "link": "https://learn.microsoft.com/azure/devops/boards/queries/link-work-items-support-traceability?view=azure-devops&tabs=browser", - "services": [], - "severity": "Medium", - "subcategory": "Reporting", - "text": "Visualize Relationships", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "View the velocity report", - "guid": "b5a67fcb-9ed5-4b35-978d-447a826c2863", - "link": "https://learn.microsoft.com/azure/devops/report/dashboards/team-velocity?view=azure-devops&tabs=in-context", - "services": [], - "severity": "Low", - "subcategory": "Reporting", - "text": "Review Team Velocity", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Create your first pipeline", - "guid": "c00f1cac-699e-4f1d-9a83-de5de36c1c81", - "link": "https://learn.microsoft.com/azure/devops/pipelines/create-first-pipeline?view=azure-devops&tabs=java%2Ctfs-2018-2%2Cbrowser", - "services": [], - "severity": "High", - "subcategory": "Continuous Integration", - "text": "Set up pipeline", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Specify events that trigger pipelines", - "guid": "870a0bc5-c1e4-43a1-a658-d2858ed67179", - "link": "https://learn.microsoft.com/azure/devops/pipelines/build/triggers?view=azure-devops", - "services": [], - "severity": "High", - "subcategory": "Continuous Integration", - "text": "Set Build triggers", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Use YAML to create build pipeline", - "guid": "b825546d-f2ae-4e45-93af-c8339248726d", - "link": "https://learn.microsoft.com/azure/devops/pipelines/customize-pipeline?view=azure-devops", - "services": [], - "severity": "Low", - "subcategory": "Continuous Integration", - "text": "Customize YAML Pipeline", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Use classic GUI editor to set up pipeline", - "guid": "d68c5b5c-2925-4394-a69b-9d379ac43bc6", - "link": "https://learn.microsoft.com/azure/devops/pipelines/get-started/pipelines-get-started?view=azure-devops&source=recommendations#define-pipelines-using-the-classic-interface", - "services": [], - "severity": "Medium", - "subcategory": "Continuous Integration", - "text": "Use GUI for pipeline", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Set up templates, parameters and expressions", - "guid": "8d1d7665-7246-4b44-a564-b4dd74a759c7", - "link": "https://learn.microsoft.com/azure/devops/pipelines/process/templates?view=azure-devops&pivots=templates-includes", - "services": [], - "severity": "Medium", - "subcategory": "Continuous Integration", - "text": "Configure Templates", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Set up jobs, stages and dependencies", - "guid": "633bd2a1-a27a-4764-a90b-e0e378ee293c", - "link": "https://learn.microsoft.com/azure/devops/pipelines/process/stages?view=azure-devops&tabs=yaml", - "services": [], - "severity": "High", - "subcategory": "Continuous Integration", - "text": "Jobs", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Set up conditions and Demands", - "guid": "1bd363ca-aab7-4571-a49a-b9193dc9fc9d", - "link": "https://learn.microsoft.com/azure/devops/pipelines/process/conditions?view=azure-devops&tabs=yaml%2Cstages", - "services": [], - "severity": "Medium", - "subcategory": "Continuous Integration", - "text": "Conditions and Demands", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Define Variables", - "guid": "1bb84b37-b5a6-47fc-a9ed-5b35478d447a", - "link": "https://learn.microsoft.com/azure/devops/pipelines/process/variables?view=azure-devops&tabs=yaml%2Cbatch", - "services": [], - "severity": "High", - "subcategory": "Continuous Integration", - "text": "Variables", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Set up your deployment pipeline", - "guid": "826c2863-c00f-41ca-a699-ef1d5a83de5d", - "link": "https://learn.microsoft.com/azure/devops/pipelines/process/create-multistage-pipeline?view=azure-devops", - "services": [], - "severity": "High", - "subcategory": "Continuous Deployment", - "text": "Deployment Pipeline", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Select correct branches to deploy from", - "guid": "e36c1c81-870a-40bc-9c1e-43a18658d285", - "link": "https://learn.microsoft.com/azure/devops/pipelines/release/deploy-multiple-branches?view=azure-devops", - "services": [], - "severity": "Medium", - "subcategory": "Continuous Deployment", - "text": "Release branch", - "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "use relevant template to deploy to azure", - "guid": "8ed67179-b825-4546-bf2a-ee4553afc833", - "link": "https://learn.microsoft.com/azure/devops/pipelines/overview-azure?view=azure-devops", - "services": [], - "severity": "Medium", - "subcategory": "Continuous Deployment", - "text": "Deploy to Azure", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Define Release Approvals and pre deployment checks", - "guid": "9248726d-d68c-45b5-a292-5394b69b9d37", - "link": "https://learn.microsoft.com/azure/devops/pipelines/process/approvals?view=azure-devops&tabs=check-pass", - "services": [], - "severity": "Medium", - "subcategory": "Continuous Deployment", - "text": "Approvals and Checks", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Define Gates and post deployment checks", - "guid": "9ac43bc6-8d1d-4766-9724-6b448564b4dd", - "link": "https://learn.microsoft.com/azure/devops/pipelines/release/approvals/?view=azure-devops&tabs=yaml", - "services": [], - "severity": "Medium", - "subcategory": "Continuous Deployment", - "text": "Gates", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Define Azure Function and REST API Checks", - "guid": "74a759c7-633b-4d2a-8a27-a764a90be0e3", - "link": "https://learn.microsoft.com/azure/devops/pipelines/process/invoke-checks?view=azure-devops", - "services": [], - "severity": "Low", - "subcategory": "Continuous Deployment", - "text": "Azure Function Checks", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Review pipeline reports", - "guid": "78ee293c-1bd3-463c-aaab-7571949ab919", - "link": "https://learn.microsoft.com/azure/devops/pipelines/reports/pipelinereport?view=azure-devops", - "services": [], - "severity": "High", - "subcategory": "Continuous Deployment", - "text": "Pipline Reports", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "configure Trend Result widget", - "guid": "3dc9fc9d-1bb8-44b3-9b5a-67fcb9ed5b35", - "link": "https://learn.microsoft.com/azure/devops/report/dashboards/analytics-widgets?toc=%2Fazure%2Fdevops%2Fpipelines%2Ftoc.json&view=azure-devops#test-results-trend-advanced", - "services": [], - "severity": "Medium", - "subcategory": "Analytics", - "text": "Pipeline Result Trend", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Connect with WIT to visualize work", - "guid": "478d447a-826c-4286-9c00-f1cac699ef1d", - "link": "https://learn.microsoft.com/azure/devops/pipelines/integrations/configure-pipelines-work-tracking?view=azure-devops&tabs=yaml", - "services": [], - "severity": "Medium", - "subcategory": "Analytics", - "text": "Work Tracking with Pipeline", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Understand agent pools", - "guid": "5a83de5d-e36c-41c8-8870-a0bc5c1e43a1", - "link": "https://learn.microsoft.com/azure/devops/pipelines/agents/agents?view=azure-devops&tabs=yaml%2Cbrowser", - "services": [], - "severity": "Medium", - "subcategory": "Continuous Deployment", - "text": " Agents and agent pools", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Understand and provision Deployment Groups when required", - "guid": "8658d285-8ed6-4717-ab82-5546df2aee45", - "link": "https://learn.microsoft.com/azure/devops/pipelines/release/deployment-groups/?view=azure-devops", - "services": [], - "severity": "Low", - "subcategory": "Continuous Deployment", - "text": "Deployment Groups", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Understand Kubernetes Deployment", - "guid": "53afc833-9248-4726-bd68-c5b5c2925394", - "link": "https://learn.microsoft.com/azure/devops/pipelines/ecosystems/kubernetes/deploy?view=azure-devops", - "services": [ - "AKS" - ], - "severity": "Low", - "subcategory": "Continuous Deployment", - "text": "Deploy to Kubernetes", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Perform Dynamic Security Testing", - "guid": "b69b9d37-9ac4-43bc-98d1-d76657246b44", - "link": "https://devblogs.microsoft.com/premier-developer/azure-devops-pipelines-leveraging-owasp-zap-in-the-release-pipeline/", - "services": [], - "severity": "Medium", - "subcategory": "Security", - "text": "DAST Scan", - "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", - "waf": "Security" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Manage Service Connections", - "guid": "8564b4dd-74a7-459c-9633-bd2a1a27a764", - "link": "https://learn.microsoft.com/azure/devops/pipelines/library/service-endpoints?view=azure-devops&tabs=yaml", - "services": [], - "severity": "Medium", - "subcategory": "Security", - "text": "Service Connections", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", - "waf": "Security" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Set data retention policies for CI and CD", - "guid": "a90be0e3-78ee-4293-a1bd-363caaab7571", - "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/retention?view=azure-devops&tabs=yaml", - "services": [ - "AzurePolicy" - ], - "severity": "Medium", - "subcategory": "Security", - "text": "Retention Policies", - "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", - "waf": "Security" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Set up and pay for concurrent pipelines", - "guid": "949ab919-3dc9-4fc9-b1bb-84b37b5a67fc", - "link": "https://learn.microsoft.com/azure/devops/pipelines/licensing/concurrent-jobs?view=azure-devops&tabs=ms-hosted", - "services": [], - "severity": "Low", - "subcategory": "Administration", - "text": "Parallel Pipelines", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", - "waf": "Operations" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Set pipeline permissions", - "guid": "b9ed5b35-478d-4447-a826-c2863c00f1ca", - "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/permissions?view=azure-devops", - "services": [], - "severity": "Medium", - "subcategory": "Security", - "text": "Pipeline Permissions", - "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/", - "waf": "Security" - }, - { - "category": "Azure Pipelines", - "checklist": "Azure DevOps", - "description": "Add users to pipeline", - "guid": "c699ef1d-5a83-4de5-be36-c1c81870a0bc", - "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/set-permissions?view=azure-devops", - "services": [], - "severity": "Low", - "subcategory": "Security", - "text": "Pipeline Users", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Security" - }, - { - "category": "Azure Artifact", - "checklist": "Azure DevOps", - "description": "Configure Artifacts", - "guid": "5c1e43a1-8658-4d28-98ed-67179b825546", - "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/artifacts-overview?view=azure-devops&tabs=nuget", - "services": [], - "severity": "Medium", - "subcategory": "Configuration", - "text": "Artifact In Pipeline", - "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", - "waf": "Operations" - }, - { - "category": "Azure Artifact", - "checklist": "Azure DevOps", - "description": "Publish and consume artifact in pipeline", - "guid": "df2aee45-53af-4c83-9924-8726dd68c5b5", - "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/pipeline-artifacts?view=azure-devops&tabs=yaml", - "services": [], - "severity": "Medium", - "subcategory": "Configuration", - "text": "Publish and download Artifact", - "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain", - "waf": "Operations" - }, - { - "category": "Azure Artifact", - "checklist": "Azure DevOps", - "description": "Publish NuGet packages with artifacts", - "guid": "c2925394-b69b-49d3-99ac-43bc68d1d766", - "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/nuget?view=azure-devops&tabs=yaml", - "services": [], - "severity": "Low", - "subcategory": "Configuration", - "text": "NuGet", - "training": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "waf": "Operations" - }, - { - "category": "Azure Artifact", - "checklist": "Azure DevOps", - "description": "Publish Maven packages with artifacts", - "guid": "57246b44-8564-4b4d-b74a-759c7633bd2a", - "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/publish-maven-artifacts?view=azure-devops", - "services": [], - "severity": "Low", - "subcategory": "Configuration", - "text": "Maven", - "waf": "Operations" - }, - { - "category": "Azure Artifact", - "checklist": "Azure DevOps", - "description": "Publish NPM packages with artifacts", - "guid": "1a27a764-a90b-4e0e-978e-e293c1bd363c", - "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/npm?view=azure-devops&tabs=yaml", - "services": [], - "severity": "Low", - "subcategory": "Configuration", - "text": "NPM", - "waf": "Operations" - }, - { - "category": "Azure Artifact", - "checklist": "Azure DevOps", - "description": "Best Practices to work with Azure Artifact", - "guid": "aaab7571-949a-4b91-a3dc-9fc9d1bb84b3", - "link": "https://learn.microsoft.com/azure/devops/artifacts/concepts/best-practices?view=azure-devops", - "services": [], - "severity": "Medium", - "subcategory": "Configuration", - "text": "Best Practices", - "waf": "Operations" - }, - { - "category": "DevOps Practice", - "checklist": "Azure DevOps", - "description": "What is monitoring?", - "guid": "7b5a67fc-b9ed-45b3-9478-d447a826c286", - "link": "https://learn.microsoft.com/devops/operate/what-is-monitoring", - "services": [ - "Monitor" - ], - "severity": "High", - "subcategory": "Practice", - "text": "What to monitor?", - "waf": "Operations" - }, - { - "category": "DevOps Practice", - "checklist": "Azure DevOps", - "description": "Progressive Exposure Strategy", - "guid": "3c00f1ca-c699-4ef1-b5a8-3de5de36c1c8", - "link": "https://learn.microsoft.com/devops/operate/safe-deployment-practices", - "services": [], - "severity": "Medium", - "subcategory": "Practice", - "text": "Safe Deployment Practices", - "waf": "Operations" - }, - { - "category": "DevOps Practice", - "checklist": "Azure DevOps", - "description": "Microsoft runs reliable systems with DevOps", - "guid": "1870a0bc-5c1e-443a-8865-8d2858ed6717", - "link": "https://learn.microsoft.com/devops/operate/how-microsoft-operates-devops", - "services": [], - "severity": "Low", - "subcategory": "Practice", - "text": "Case Study", - "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "waf": "Operations" - }, - { - "category": "DevOps Practice", - "checklist": "Azure DevOps", - "description": "Security in DevOps", - "guid": "9b825546-df2a-4ee4-953a-fc8339248726", - "link": "https://learn.microsoft.com/devops/operate/security-in-devops", - "services": [], - "severity": "Medium", - "subcategory": "Practice", - "text": "DevSecOps", - "waf": "Security" - }, - { - "category": "DevOps Practice", - "checklist": "Azure DevOps", - "description": "Enable DevSecops with Azure And GitHub", - "guid": "dd68c5b5-c292-4539-9b69-b9d379ac43bc", - "link": "https://learn.microsoft.com/devops/devsecops/enable-devsecops-azure-github", - "services": [], - "severity": "Low", - "subcategory": "Practice", - "text": "DevSecops", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Security" - }, - { - "category": "DevOps Practice", - "checklist": "Azure DevOps", - "description": "Mirror RBAC in DevOps", - "guid": "68d1d766-5724-46b4-9856-4b4dd74a759c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/secure/best-practices/end-to-end-governance", - "services": [ - "RBAC" - ], - "severity": "Low", - "subcategory": "Practice", - "text": "Secure DevOps Govenance", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Security" - }, - { - "category": "DevOps Practice", - "checklist": "Azure DevOps", - "description": "Governance when using CI/CD", - "guid": "7633bd2a-1a27-4a76-9a90-be0e378ee293", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/governance/end-to-end-governance-in-azure", - "services": [], - "severity": "Medium", - "subcategory": "Practice", - "text": "Azure DevOps Governance", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Security" - }, - { - "category": "Operations Management", - "checklist": "DNS Review Checklist", - "guid": "a96b96ad-8840-48f3-9273-4c876ba28021", - "link": "https://learn.microsoft.com/azure/dns/private-dns-resiliency", - "services": [ - "VNet", - "DNS" - ], - "severity": "High", - "subcategory": "Azure Private DNS", - "text": "Verify that Zones are linked to Vnets in multiple regions", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "DNS Review Checklist", - "guid": "45901465-d38e-453f-accb-d969266acca2", - "link": "https://learn.microsoft.com/azure/dns/private-dns-resiliency", - "services": [ - "DNS" - ], - "severity": "High", - "subcategory": "Azure Private DNS", - "text": "If different Zones are used between regions, verify a plan for making sure that Zones are up to date in a DR failover situation", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "DNS Review Checklist", - "guid": "74faa19b-f39d-495d-94c7-c8919ca1f6d5", - "link": "https://learn.microsoft.com/azure/reliability/reliability-traffic-manager?toc=%2Fazure%2Fdns%2Ftoc.json", - "services": [ - "ASR", - "DNS", - "TrafficManager" - ], - "severity": "Medium", - "subcategory": "Azure DNS", - "text": "Plan for disaster recovery with Azure DNS and Traffic Manager", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "DNS Review Checklist", - "guid": "315ae524-ba34-4d45-a5e1-2139bd7bb012", - "link": "https://learn.microsoft.com/azure/dns/private-resolver-reliability#availability-zones", - "services": [ - "DNS" - ], - "severity": "Medium", - "subcategory": "Azure DNS Resolver", - "text": "Enable availability zones with Private Resolver", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "DNS Review Checklist", - "guid": "f7b95e06-e154-4e2a-a359-2828e6e20517", - "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", - "services": [ - "ASR", - "DNS" - ], - "severity": "Medium", - "subcategory": "Azure DNS Resolver", - "text": "Plan for failover with Private Resolvers in a Disaster Recovery", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "DNS Review Checklist", - "guid": "2676ae46-691e-4883-9ad9-42223e138105", - "link": "https://learn.microsoft.com/azure/reliability/reliability-virtual-machines?toc=%2Fazure%2Fvirtual-machines%2Ftoc.json&bc=%2Fazure%2Fvirtual-machines%2Fbreadcrumb%2Ftoc.json&tabs=graph", - "services": [ - "VM", - "DNS" - ], - "severity": "Medium", - "subcategory": "VM Based DNS Service", - "text": "Follow VM Guidance for resillency of VM", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "DNS Review Checklist", - "guid": "23081a94-1741-4583-9ff7-ad7c6d373316", - "link": "https://www.windows-active-directory.com/azure-ad-dns-for-custom-domain-names-with-advanced-dns-settings.html", - "services": [ - "Entra", - "VM", - "DNS" - ], - "severity": "Medium", - "subcategory": "VM Based DNS Service", - "text": "IF AD based DNS, follow the Identity -> Windows Server AD path", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.", - "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs", - "service": "VMSS", - "services": [ - "VM" - ], - "severity": "Low", - "subcategory": "VM Scale Sets", - "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).", - "guid": "4d874a74-8b66-42d6-b150-512a66498f6d", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction", - "service": "VM", - "services": [ - "Backup", - "VM" - ], - "severity": "High", - "subcategory": "Virtual Machines", - "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%", - "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "VM", - "services": [ - "VM" - ], - "severity": "High", - "subcategory": "Virtual Machines", - "text": "Use Premium or Ultra disks for production VMs", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.", - "guid": "b31e38c3-f298-412b-8363-cffe179b599d", - "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview", - "service": "VM", - "services": [ - "VM" - ], - "severity": "High", - "subcategory": "Virtual Machines", - "text": "Ensure Managed Disks are used for all VMs", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.", - "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4", - "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk", - "service": "VM", - "services": [ - "SQL", - "VM", - "Storage" - ], - "severity": "Medium", - "subcategory": "Virtual Machines", - "text": "Do not use the Temp disk for anything that is not acceptable to be lost", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.", - "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", - "services": [ - "VM", - "Storage", - "ACR" - ], - "severity": "Medium", - "subcategory": "Virtual Machines", - "text": "Leverage Availability Zones for your VMs in regions where they are supported", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.", - "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "VM", - "services": [ - "VM" - ], - "severity": "Medium", - "subcategory": "Virtual Machines", - "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)", - "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", - "services": [ - "ASR", - "VM" - ], - "severity": "High", - "subcategory": "Virtual Machines", - "text": "Avoid running a production workload on a single VM", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.", - "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", - "services": [ - "ASR", - "VM", - "AVS" - ], - "severity": "High", - "subcategory": "Virtual Machines", - "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.", - "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d", - "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview", - "service": "VM", - "services": [ - "VM" - ], - "severity": "Low", - "subcategory": "Virtual Machines", - "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.", - "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666", - "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests", - "service": "VM", - "services": [ - "ASR", - "VM" - ], - "severity": "Medium", - "subcategory": "Virtual Machines", - "text": "Increase quotas in DR region before testing failover with ASR", - "waf": "Reliability" - }, - { - "category": "Compute", - "checklist": "Resiliency Review", - "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.", - "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events", - "service": "VM", - "services": [ - "VM" - ], - "severity": "Low", - "subcategory": "Virtual Machines", - "text": "Utilize Scheduled Events to prepare for VM maintenance", - "waf": "Reliability" - }, - { - "category": "Data", - "checklist": "Resiliency Review", - "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.", - "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Azure Storage", - "services": [ - "Storage" - ], - "severity": "Medium", - "subcategory": "Storage Accounts", - "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements", - "waf": "Reliability" - }, - { - "category": "Data", - "checklist": "Resiliency Review", - "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.", - "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", - "services": [ - "Storage" - ], - "severity": "Low", - "subcategory": "Storage Accounts", - "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts", - "waf": "Reliability" - }, - { - "category": "Data", - "checklist": "Resiliency Review", - "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.", - "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", - "services": [ - "Storage" - ], - "severity": "Low", - "subcategory": "Storage Accounts", - "text": "Enable soft delete for Storage Account Containers", - "waf": "Reliability" - }, - { - "category": "Data", - "checklist": "Resiliency Review", - "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.", - "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", - "services": [ - "Storage" - ], - "severity": "Low", - "subcategory": "Storage Accounts", - "text": "Enable soft delete for blobs", - "waf": "Reliability" - }, - { - "category": "General", - "checklist": "Resiliency Review", - "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.", - "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about", - "service": "Azure Backup", - "services": [ - "Backup" - ], - "severity": "Medium", - "subcategory": "Backup", - "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery", - "waf": "Reliability" - }, - { - "category": "General", - "checklist": "Resiliency Review", - "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.", - "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae", - "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept", - "service": "Azure Backup", - "services": [ - "Backup" - ], - "severity": "Low", - "subcategory": "Backup", - "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources", - "waf": "Reliability" - }, - { - "category": "General", - "checklist": "Resiliency Review", - "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.", - "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault", - "service": "Azure Backup", - "services": [ - "Backup", - "Storage" - ], - "severity": "Low", - "subcategory": "Backup", - "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups", - "waf": "Reliability" - }, - { - "category": "General", - "checklist": "Resiliency Review", - "description": "Clearly define your organization's business continuity and disaster recovery requirements for your Azure environment. This includes identifying the critical applications, data, and services that need to be protected, as well as specifying the desired recovery objectives and strategies.", - "guid": "72e52e36-11dd-458c-9a4b-1521e43a58a9", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-business-continuity-disaster-recovery", - "services": [ - "ASR" - ], - "severity": "High", - "subcategory": "Design", - "text": "Define business continuity and disaster recovery requirements", - "waf": "Reliability" - }, - { - "category": "General", - "checklist": "Resiliency Review", - "description": "Ensure that your Azure architectures are designed with a focus on reliability. Consider implementing fault-tolerant mechanisms, redundancy, and resiliency patterns to minimize the impact of failures and maximize the availability of your applications and services.", - "guid": "c2399c4d-7b67-4d0c-9555-62f2b3e4563a", - "link": "https://learn.microsoft.com/azure/architecture/reliability/architect", - "services": [], - "severity": "High", - "subcategory": "Design", - "text": "Implement reliability best practices in Azure architectures", - "waf": "Reliability" - }, - { - "category": "General", - "checklist": "Resiliency Review", - "description": "IaC configurations can play a role in your disaster recovery plan, particularly in situations where recovery time is not time-sensitive. In the event of infrastructure recreation in a second region, IaC can be used to reproduce the necessary infrastructure.", - "guid": "fe237de2-43b1-46c3-8d7a-a9b7570449aa", - "link": "https://learn.microsoft.com/azure/well-architected/devops/automation-infrastructure", - "services": [ - "RBAC", - "ASR" - ], - "severity": "Medium", - "subcategory": "DevOps", - "text": "Implement Infrastructure as Code (IaC) for Rapid Infrastructure Recovery", - "waf": "Reliability" - }, - { - "category": "General", - "checklist": "Resiliency Review", - "description": "Azure offers region pairs that are geographically separated and can be used for cross-region replication and disaster recovery. These region pairs provide redundancy and protection against regional or large-scale disasters.", - "guid": "dcb1f7d5-769a-4e56-aba3-8d4a85e2213d", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "services": [ - "ASR" - ], - "severity": "Medium", - "subcategory": "Multi-region", - "text": "Plan for cross-region recovery by leveraging region pairs", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "By deploying an Application Gateway with a minimum instance count of two, you will have at least two instances available under normal circumstances. In the event that one of the instances encounters a problem, the other instance will handle the traffic while a new instance is being created. This approach significantly reduces the risk of service disruption and ensures a seamless experience for your users.", - "guid": "93c76286-37a5-451c-9b04-e4f1854387e5", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant#autoscaling-and-high-availability", - "services": [ - "AppGW" - ], - "severity": "Medium", - "subcategory": "Application Gateways", - "text": "Deploy Application Gateways with a minimum instance count of 2 to avoid instance provisioning downtime", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "The v2 SKU offers several advantages and critical new features that enhance the availability and resilience of your application infrastructure. One notable feature supported by the v2 SKU is zone redundancy, which allows an Application Gateway deployment to span multiple Availability Zones.", - "guid": "ced126cd-032a-4f5b-8fc6-998a535e3378", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "services": [ - "Storage", - "AppGW" - ], - "severity": "High", - "subcategory": "Application Gateways", - "text": "Deploy Azure Application Gateway v2 for zone redundancy support", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "Azure Front Door provides automatic failover capabilities, ensuring continuity in the event of a primary region becoming unavailable. However, during the failover process, there may be a brief period (typically 20-60 seconds) when clients cannot reach the application. It is essential to review the Azure Front Door service level agreement (SLA) to determine whether relying solely on Front Door meets your business requirements for high availability. ", - "guid": "97e31c67-d68c-4f6a-92a1-194956d697dc", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/multi-region#azure-front-door", - "services": [ - "FrontDoor" - ], - "severity": "Low", - "subcategory": "Azure Front Door", - "text": "Consider a redundant traffic management solution in conjunction with Azure Front Door", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "By implementing Traffic Manager, you can configure it to continuously monitor the health of your application endpoints and automatically redirect traffic to an alternate endpoint when necessary. This automation minimizes downtime and provides a more seamless experience for your users during disaster recovery scenarios.", - "guid": "8df03a82-2cd4-463c-abbc-8ac299ebc92a", - "link": "https://learn.microsoft.com/azure/networking/disaster-recovery-dns-traffic-manager", - "services": [ - "ASR", - "Monitor", - "DNS", - "TrafficManager" - ], - "severity": "Low", - "subcategory": "DNS", - "text": "Plan for automated failover using Traffic Manager for DNS Traffic", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.", - "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146", - "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", - "service": "DNS", - "services": [ - "ASR", - "DNS", - "ACR" - ], - "severity": "Low", - "subcategory": "DNS", - "text": "Implement DNS Failover using Azure DNS Private Resolvers", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.", - "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103", - "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters", - "service": "Data Gateways", - "services": [ - "ACR" - ], - "severity": "Medium", - "subcategory": "Data Gateways", - "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "When using ExpressRoute, it's important to design for high availability by incorporating redundancy in both the partner and customer networks. This can include multiple ExpressRoute circuits, redundant connections from your network to Microsoft, and ensuring your on-premises network equipment has redundant connections.", - "guid": "c0e7c28d-c936-4657-802b-ff4564b0d934", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", - "services": [ - "ExpressRoute" - ], - "severity": "Medium", - "subcategory": "ExpressRoute", - "text": "Ensure redundancy within both the partner network and customer network when utilizing ExpressRoute for high availability", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "The primary circuit should handle regular traffic while the backup circuit stays ready to take over if the primary circuit fails. Utilize BGP attributes to influence routing and designate your primary and backup circuits effectively.", - "guid": "a359c373-e7dd-4616-83a3-64a907ebae48", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "services": [ - "ExpressRoute", - "Backup" - ], - "severity": "Medium", - "subcategory": "ExpressRoute", - "text": "When using multiple ExpressRoute circuits ensure that routing allows for a primary and backup", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "S2S VPN connection can provide a cost-effective, resilient backup solution in the event of an ExpressRoute circuit failure. By using S2S VPN as a failover, you can maintain connectivity to your Azure resources without relying solely on ExpressRoute.", - "guid": "ead53cc7-de2e-48aa-ab35-71549ab9153d", - "link": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", - "services": [ - "ExpressRoute", - "VPN", - "Cost", - "Backup" - ], - "severity": "Low", - "subcategory": "ExpressRoute", - "text": "Consider deploying site-to-site VPN as a backup for your ExpressRoute private peering", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "Standard Load Balancer SKU offers an SLA of 99.99% and a higher level of service availability compared to the Basic Load Balancer SKU.", - "guid": "778468d5-5a78-45d6-be96-c96ad8844cf3", - "link": "https://learn.microsoft.com/azure/load-balancer/skus", - "services": [ - "LoadBalancer" - ], - "severity": "Medium", - "subcategory": "Load Balancers", - "text": "Leverage the Standard SKU for Load Balancers that handle traffic to production applications", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "By configuring the load balancer with a zone-redundant frontend, it can serve zonal resources in any zone with a single IP address. As long as at least one zone remains healthy within the region, the IP address associated with the frontend can survive one or more zone failures. It is recommended to have multiple zonal resources, such as virtual machines from different zones, in the backend pool of the load balancer. ", - "guid": "b2b38c88-6ba2-4c02-8499-114a5d3ce574", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", - "services": [ - "VM", - "LoadBalancer" - ], - "severity": "Low", - "subcategory": "Load Balancers", - "text": "For load balancers, consider using a zone-redundant frontend with multiple zonal resources in the backend", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "When designing health probes for your Azure Load Balancer, it is important to follow best practices to ensure reliable and accurate monitoring of your backend instances.", - "guid": "dccbd979-2a6b-4cca-8b5f-ea1ebf3dd95d", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-custom-probe-overview#design-guidance", - "services": [ - "LoadBalancer", - "Monitor" - ], - "severity": "Low", - "subcategory": "Load Balancers", - "text": "Select the right protocol, appropriate intervals and timeouts, representative paths and probe responses when defining Load Balancer Health Probes", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.", - "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", - "services": [ - "NVA" - ], - "severity": "High", - "subcategory": "NVAs", - "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "By deploying VPN Gateways in an active-active mode, you can distribute VPN traffic across multiple gateways, improving reliability and ensuring continuous connectivity in case of failures or maintenance.", - "guid": "927139b8-2110-42db-b6ea-f11e6f843e53", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", - "services": [ - "VPN", - "ACR" - ], - "severity": "Medium", - "subcategory": "VPN Gateways", - "text": "Deploy Azure VPN Gateways in an active-active mode to ensure high availability and redundancy for your VPN connections.", - "waf": "Reliability" - }, - { - "category": "Network", - "checklist": "Resiliency Review", - "description": "Zone-redundant SKUs ensure that your VPN gateways are physically and logically separated within a region, providing resiliency and scalability. This deployment configuration safeguards your on-premises network connectivity to Azure from zone-level failures.", - "guid": "f4722d92-8c1b-41cd-921f-54b29b9de39a", - "link": "https://learn.microsoft.com/azure/vpn-gateway/about-zone-redundant-vnet-gateways", - "services": [ - "VPN" - ], - "severity": "Medium", - "subcategory": "VPN Gateways", - "text": "Use zone-redundant SKUs when deploying VPN Gateways to enhance resilience and protect against zone-level failures", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "MySQL Review Checklist", - "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", - "service": "Azure MySQL", - "services": [ - "SQL" - ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Leverage Flexible Server", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "MySQL Review Checklist", - "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", - "service": "Azure MySQL", - "services": [ - "SQL" - ], - "severity": "High", - "subcategory": "Best Practices", - "text": "Leverage Availability Zones where regionally applicable", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "MySQL Review Checklist", - "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", - "service": "Azure MySQL", - "services": [ - "SQL" - ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Leverage Data-in replication for cross-region DR scenarios", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "974a759c-763e-47d2-9161-3a7649907e0e", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ASB_v1.docx", - "services": [ - "ServiceBus" - ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Leverage FTA Handbook", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "description": "This will be turned on automatically for a new SB namespace created from the portal with the Premium SKUs in a zone-enabled region. Both the Service Bus metadata and the messages data are replicated across datacenters in the availability zones configuration", - "guid": "338ee253-c17d-432e-aaaa-b7571549ab81", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#availability-zones", - "services": [ - "ServiceBus", - "ACR" - ], - "severity": "High", - "subcategory": "Best Practices", - "text": "Leverage Availability Zones if regionally applicable", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "description": "If enabled, Implements namespace metadata replication to a secondary region. Does not replicate queue/topic message data. Premium sku only.", - "guid": "53d89f89-d17b-484b-93b5-a67f7b9ed5b3", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#geo-disaster-recovery", - "services": [ - "ServiceBus", - "ASR", - "Storage" - ], - "severity": "Medium", - "subcategory": "Geo-Disaster Recovery", - "text": "Plan for Metadata replication during regional failure", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "description": "If an outage cannot be tolerated, do not use the build-in metadata replication option. Leverage a replication pattern to replicate Service Bus messages across two or more sets of cross-region namespaces", - "guid": "1f38c403-a822-4c24-93cf-0f18ac699ef1", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-federation-overview", - "services": [ - "ServiceBus", - "ASR", - "ACR" - ], - "severity": "Medium", - "subcategory": "Geo-Disaster Recovery", - "text": "Plan for Message replication during regional failure", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "description": "Azure Service Bus uses a message broker to handle messages that are sent to a Service Bus queue or topic. By default, all messages that are sent to a queue or topic are handled by the same message broker process. This architecture can place a limitation on the overall throughput of the message queue. However, you can also partition a queue or topic when it is created", - "guid": "d5a83de4-de32-4c18-a147-0607c5c0e4e6", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/data-partitioning-strategies#partitioning-azure-service-bus", - "services": [ - "ServiceBus", - "Storage" - ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "For applications which require high throughput, use Patritioning ", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "14658d24-58ed-4671-99b8-21102df26ee4", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters", - "services": [ - "ServiceBus" - ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Evaluate Premier-tier benefits of Azure Service Bus", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "11e6f883-e52f-4472-8dd6-8c5b5c2521e5", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-messaging-exceptions", - "services": [ - "ServiceBus" - ], - "severity": "High", - "subcategory": "Best Practices", - "text": "Ensure that Service Bus Messaging Exceptions are handled properly", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "4a69b9d3-39ac-44e7-a68d-1d75657202b4", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", - "services": [ - "ServiceBus", - "PrivateLink", - "Storage" - ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Connect to Service Bus with the Advanced Messaging Queue Protocol (AMQP) and use Service Endpoints or Private Endpoints when possible.", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "f4564b4d-974a-4759-a763-e7d261613a76", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-performance-improvements?tabs=net-standard-sdk-2", - "services": [ - "ServiceBus" - ], - "severity": "High", - "subcategory": "Best Practices", - "text": "Review the Best Practices for performance improvements using Service Bus Messaging", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "49907e0e-338e-4e25-9c17-d32e8aaab757", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/operational-excellence", - "services": [ - "ServiceBus" - ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Implement geo-replication on the sender and receiver side to protect against outages and disasters", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "1549ab81-53d8-49f8-ad17-b84b33b5a67f", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", - "services": [ - "ServiceBus", - "ASR", - "Storage" - ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "If you need mission-critical messaging with queues and topics, Service Bus Premium is recommended with Geo-Disaster Recovery.", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "7b9ed5b3-1f38-4c40-9a82-2c2463cf0f18", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", - "services": [ - "ServiceBus" - ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Implement high availability for the Service Bus namespace", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "ac699ef1-d5a8-43de-9de3-2c1881470607", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", - "services": [ - "ServiceBus" - ], - "severity": "High", - "subcategory": "Best Practices", - "text": "Ensure related messages are delivered in guaranteed order", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "c5c0e4e6-1465-48d2-958e-d67139b82110", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", - "services": [ - "ServiceBus" - ], - "severity": "Low", - "subcategory": "Best Practices", - "text": "Evaluate different Java Messaging Service (JMS) features through the JMS API", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "2df26ee4-11e6-4f88-9e52-f4722dd68c5b", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", + "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "Front Door", "services": [ - "ServiceBus" + "FrontDoor" ], "severity": "Low", - "subcategory": "Best Practices", - "text": "Use .NET Nuget packages to communicate with Service Bus messaging entities", - "waf": "Reliability" + "subcategory": "Front Door", + "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.", + "waf": "Performance" }, { - "category": "Operations Management", - "checklist": "Service Bus Review Checklist", - "guid": "5c2521e5-4a69-4b9d-939a-c4e7c68d1d75", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", + "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "Load Balancer", "services": [ - "ServiceBus" + "LoadBalancer" ], - "severity": "Medium", - "subcategory": "Best Practices", - "text": "Implement resilience for transient fault handling when sending or receiving messages", + "severity": "High", + "subcategory": "Load Balancer", + "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability", "waf": "Reliability" }, { - "category": "Security", - "checklist": "Service Bus Review Checklist", - "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", - "guid": "87af4a79-1f89-439b-ba47-768e14c11567", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key", - "service": "Service Bus", - "services": [ - "ServiceBus" - ], - "severity": "Low", - "subcategory": "Data Protection", - "text": "Use customer-managed key option in data at rest encryption when required", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Service Bus Review Checklist", - "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.", - "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version", - "service": "Service Bus", - "services": [ - "ServiceBus" - ], - "severity": "Medium", - "subcategory": "Data Protection", - "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Service Bus Review Checklist", - "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", - "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies", - "service": "Service Bus", - "services": [ - "RBAC", - "TrafficManager", - "ServiceBus", - "AzurePolicy", - "Entra" - ], - "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "Avoid using root account when it is not necessary", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Service Bus Review Checklist", - "description": "A Service Bus client app running inside an Azure App Service application or in a virtual machine with enabled managed entities for Azure resources support does not need to handle SAS rules and keys, or any other access tokens. The client app only needs the endpoint address of the Service Bus Messaging namespace. ", - "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity", - "service": "Service Bus", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", + "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "Front Door", "services": [ - "ServiceBus", "AKV", - "Storage", - "AppSvc", - "Entra", - "VM" - ], - "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Service Bus Review Checklist", - "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ", - "guid": "f615658d-e558-4f93-9249-b831112dbd7e", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus", - "service": "Service Bus", - "services": [ - "RBAC", - "ServiceBus", - "Subscriptions", - "Storage", - "Entra" + "FrontDoor", + "Cost" ], "severity": "High", - "subcategory": "Identity and Access Management", - "text": "Use least privilege data plane RBAC", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Service Bus Review Checklist", - "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.", - "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference", - "service": "Service Bus", - "services": [ - "ServiceBus", - "VNet", - "Monitor" - ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Service Bus Review Checklist", - "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", - "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service", - "service": "Service Bus", - "services": [ - "ServiceBus", - "PrivateLink", - "VNet" - ], - "severity": "Medium", - "subcategory": "Networking", - "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "Front Door", + "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Service Bus Review Checklist", - "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", - "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering", - "service": "Service Bus", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", + "service": "Front Door", "services": [ - "ServiceBus" + "FrontDoor", + "WAF" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Security" - }, - { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", - "services": [ - "Defender", - "Subscriptions" - ], - "severity": "High", - "subcategory": "Pricing & Settings", - "text": "Security Center/Defender enable in all subscriptions", - "waf": "Security" + "subcategory": "Front Door", + "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", + "waf": "Operations" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "349f0364-d28d-442e-abbb-c868255abc91", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", + "service": "Front Door", "services": [ - "Defender", - "Monitor" + "FrontDoor" ], "severity": "High", - "subcategory": "Pricing & Settings", - "text": "Security Center/Defender enabled on all Log Analytics workspaces", + "subcategory": "Front Door", + "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", + "service": "Front Door", "services": [ - "Defender" + "FrontDoor" ], "severity": "Medium", - "subcategory": "Pricing & Settings", - "text": "Data collection set to 'Common'", + "subcategory": "Front Door", + "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", + "service": "Front Door", "services": [ - "Defender" + "FrontDoor", + "WAF" ], "severity": "High", - "subcategory": "Pricing & Settings", - "text": "Defender for Cloud enhanced security features are all enabled", - "waf": "Security" - }, - { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", - "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection", - "services": [ - "Defender", - "AzurePolicy" - ], - "severity": "Medium", - "subcategory": "Pricing & Settings", - "text": "Auto-provisioning enabled as per company policy (policy must exist)", - "waf": "Security" - }, - { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "25759e35-680e-4782-9ac9-32213d027ff4", - "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details", - "services": [ - "Defender", - "AzurePolicy" - ], - "severity": "Low", - "subcategory": "Pricing & Settings", - "text": "Email notifications enabled as per company policy (policy must exist)", - "waf": "Security" - }, - { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", - "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows", - "services": [ - "Defender" - ], - "severity": "Medium", - "subcategory": "Pricing & Settings", - "text": "Enable integrations options are selected ", + "subcategory": "Front Door", + "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "5b7abae4-4aad-45e8-a79e-2e86667313c5", - "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd", - "services": [ - "Defender" - ], - "severity": "Medium", - "subcategory": "Pricing & Settings", - "text": "CI/CD integration is configured", - "waf": "Operations" - }, - { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "05675c5e-985b-4859-a774-f7e371623b87", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", + "service": "Front Door", "services": [ - "Defender", - "EventHubs" + "FrontDoor", + "WAF" ], "severity": "High", - "subcategory": "Pricing & Settings", - "text": "Continuous export 'Event Hub' is enabled if using 3rd party SIEM", + "subcategory": "Front Door", + "text": "Tune the Azure Front Door WAF for your workload. Reduce false positive detections.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "Front Door", "services": [ - "Defender", - "Sentinel", - "Monitor" + "FrontDoor", + "AzurePolicy", + "WAF" ], - "severity": "Medium", - "subcategory": "Pricing & Settings", - "text": "Continuous export 'Log Analytics Workspace' is enabled if not using Azure Sentinel", + "severity": "High", + "subcategory": "Front Door", + "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", + "service": "Front Door", "services": [ - "Defender" + "FrontDoor", + "WAF" ], "severity": "High", - "subcategory": "Pricing & Settings", - "text": "Cloud connector enabled for AWS", + "subcategory": "Front Door", + "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", + "service": "Front Door", "services": [ - "Defender" + "FrontDoor", + "WAF" ], "severity": "High", - "subcategory": "Pricing & Settings", - "text": "Cloud connector enabled for GCP", + "subcategory": "Front Door", + "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", + "service": "Front Door", "services": [ - "Entra", - "Defender", - "Monitor" + "FrontDoor", + "WAF" ], - "severity": "Low", - "subcategory": "Pricing & Settings", - "text": "If using Azure AD Application proxy, consider integrating with Microsoft Defender for Cloud Apps to monitor application access in real-time and apply advanced security controls.", + "severity": "Medium", + "subcategory": "Front Door", + "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", - "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "b9620385-1cde-418f-914b-a84a06982ffc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", + "service": "Front Door", "services": [ - "Defender" + "FrontDoor", + "WAF" ], "severity": "Medium", - "subcategory": "Recommendations", - "text": "All recommendations remediated or disabled if not required.", + "subcategory": "Front Door", + "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "description": "Microsoft minimum target for all customers is 70%", - "guid": "08032729-4798-4b15-98a2-19a46ceb5443", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", + "service": "Front Door", "services": [ - "Defender" + "FrontDoor", + "WAF" ], - "severity": "High", - "subcategory": "Recommendations", - "text": "Security Score>70%", + "severity": "Medium", + "subcategory": "Front Door", + "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "50259226-4429-42bb-9285-37a55119bf8e", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", + "service": "Front Door", "services": [ - "Defender", - "Monitor" + "FrontDoor" ], - "severity": "Medium", - "subcategory": "Security Alerts", - "text": "Security Alerts contain only those generated in the past 24 hours (remediate or disable older security alerts)", + "severity": "Low", + "subcategory": "Front Door", + "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", - "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "00acd8a9-6975-414f-8491-2be6309893b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", + "service": "Front Door", "services": [ - "Defender" + "FrontDoor", + "WAF" ], "severity": "Medium", - "subcategory": "Workbooks", - "text": "If continuous export is enabled, default workbooks published to custom security dashboard", + "subcategory": "Front Door", + "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", - "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", + "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", + "service": "App Gateway", "services": [ - "Defender" + "WAF", + "AppGW" ], - "severity": "Medium", - "subcategory": "Community", - "text": "Customer is aware of the value of the 'Community' page and has a regular cadence set up to review", + "severity": "High", + "subcategory": "App Gateway", + "text": "Enable the Azure Application Gateway WAF bot protection rule set The bot rules detect good and bad bots.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "description": "Customer Operational best practice - Transparency", - "guid": "93846da9-7cc3-4923-856b-22586f4a1641", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "App Gateway", "services": [ - "Defender", - "Subscriptions" + "AzurePolicy", + "WAF", + "AppGW" ], "severity": "High", - "subcategory": "Secure Score", - "text": "All subscriptions protected by Security Center are shown (no subscription filter set)", + "subcategory": "App Gateway", + "text": "Enable request body inspection feature enabled in Azure Application Gateway WAF policy.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", - "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", + "service": "App Gateway", "services": [ - "Defender" + "WAF", + "AppGW" ], "severity": "High", - "subcategory": "Regulatory Compliance", - "text": "Compliance controls are green for any required compliance requirements", + "subcategory": "App Gateway", + "text": "Tune the Azure Application Gateway WAF for your workload. Reduce false positive detections.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "description": "Customer Operational best practice - verify", - "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm", + "ammp": true, + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "App Gateway", "services": [ - "Defender", - "VM" + "AzurePolicy", + "WAF", + "AppGW" ], "severity": "High", - "subcategory": "Azure Defender", - "text": "High severity VM vulnerabilities is zero (empty)", + "subcategory": "App Gateway", + "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "9603334b-df9c-4c23-918d-b61171265f4b", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", + "service": "App Gateway", "services": [ - "Defender", - "Firewall" + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Firewall Manager", - "text": "Hubs are protected by an Azure Firewall", + "subcategory": "App Gateway", + "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "description": "Customer Operational best practice - verify", - "guid": "b47a393a-0803-4272-a479-8b1578a219a4", - "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", + "service": "App Gateway", "services": [ - "Defender", - "VNet", - "Firewall" + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Firewall Manager", - "text": "Virtual Networks are protected by a Firewall", + "subcategory": "App Gateway", + "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "6ceb5443-5025-4922-9442-92bb628537a5", - "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/", - "services": [ - "Defender", - "DDoS", - "Firewall" - ], - "severity": "Medium", - "subcategory": "Firewall Manager", - "text": "DDoS Standard enabled", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "99937189-ff78-492a-b9ca-18d828d82b37", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", + "service": "App Gateway", + "services": [], + "severity": "Low", + "subcategory": "App Gateway", + "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", "waf": "Security" }, { - "category": "Defender For Cloud", - "checklist": "Azure Security Review Checklist", - "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", + "service": "App Gateway", "services": [ - "Defender", - "Subscriptions" + "WAF", + "AppGW" ], - "severity": "High", - "subcategory": "Coverage", - "text": "Verify that all subscriptions are covered (see pricing and settings to modify)", + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", + "service": "App Gateway", "services": [ - "VNet", - "VM" + "WAF", + "AppGW" ], - "severity": "High", - "subcategory": "Public IPs", - "text": "VM's with public IPs should be protected by NSG ", + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "description": "Customer operational best practice - verify", - "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "App Gateway", "services": [ - "EventHubs", - "VM", - "Firewall" + "WAF", + "AppGW" ], - "severity": "High", - "subcategory": "Public IPs", - "text": "VMs with public IPs are moved behind Azure Firewall Premium", - "waf": "Security" + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "description": "Customer operational best practice - verify", - "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "Front Door", "services": [ - "VM" + "FrontDoor", + "WAF" ], - "severity": "High", - "subcategory": "Public IPs", - "text": "VM's that don't need public IPs do not have public IPs (i.e. internal RDP only)", - "waf": "Security" + "severity": "Medium", + "subcategory": "Front Door", + "text": "Add diagnostic settings to save your Azure Front Door WAF logs.", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "92664c60-47e3-4591-8b1b-8d557656e686", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", + "service": "App Gateway", "services": [ - "RBAC", - "VNet" + "AppGW", + "WAF", + "Sentinel" ], "severity": "Medium", - "subcategory": "NSG", - "text": "NSG RBAC is used to restrict access to network security team", - "waf": "Security" + "subcategory": "App Gateway", + "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "description": "Customer operational best practice - verify", - "guid": "a209939b-da47-4778-b24c-116785c2fa55", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "845f5f91-9c21-4674-a725-5ce890850e20", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "Front Door", "services": [ - "VNet" + "FrontDoor", + "WAF", + "Sentinel" ], - "severity": "High", - "subcategory": "NSG", - "text": "NSG Inbound security rules do not contain a * (wildcard) in Source field", - "waf": "Security" + "severity": "Medium", + "subcategory": "Front Door", + "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "description": "Customer operational best practice - verify", - "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", + "service": "App Gateway", "services": [ - "VNet" + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "NSG", - "text": "NSG outbound security rules are used to control traffic to specific IP addresses for traffic not routed through a Firewall", - "waf": "Security" + "subcategory": "App Gateway", + "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "description": "Customer operational best practice - verify", - "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", + "service": "App Gateway", "services": [ - "VNet" + "AzurePolicy", + "WAF" ], - "severity": "High", - "subcategory": "NSG", - "text": "NSG do not have Source as a * (wildcard) in place.", - "waf": "Security" + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Use WAF Policies instead of the legacy WAF configuration.", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", + "service": "App Gateway", "services": [ + "VPN", "VNet", - "Sentinel" + "ExpressRoute", + "AppGW" ], "severity": "Medium", - "subcategory": "NSG", - "text": "NSG Diagnostics send NetworkSecurityGroupEvent and NetworkSecurityGroupRuleCounter traffic to Sentinel LAW", + "subcategory": "App Gateway", + "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", + "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", + "service": "Front Door", "services": [ - "RBAC", - "VNet" + "FrontDoor" ], "severity": "Medium", - "subcategory": "UDR", - "text": "UDR RBAC is used to restrict access to the network security team", + "subcategory": "Front Door", + "text": "Make sure your origins only take traffic from your Azure Front Door instance.", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", - "services": [ - "VNet", - "Firewall" - ], + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "service": "App Gateway", + "services": [], "severity": "High", - "subcategory": "UDR", - "text": "If Zero Trust, then UDR's are used to send all traffic to the Azure Firewall Premium", + "subcategory": "App Gateway", + "text": "You should encrypt traffic to the backend servers.", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "description": "Customer operational best practice - verify", - "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "service": "App Gateway", "services": [ - "VNet" + "WAF" ], - "severity": "Medium", - "subcategory": "UDR", - "text": "UDR's that do not send all traffic to AzureFirewallPremium are known and documented.", + "severity": "High", + "subcategory": "App Gateway", + "text": "You should use a Web Application Firewall.", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default", - "services": [ - "VNet" - ], - "severity": "High", - "subcategory": "Virtual Networks", - "text": "Customer is familiar with Azure networking defaults / SDN default routing in Azure", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", + "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", + "service": "App Gateway", + "services": [], + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Redirect HTTP to HTTPS", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "description": "Customer operational best practice - verify", - "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", - "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672", - "services": [ - "RBAC", - "VNet" - ], + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", + "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", + "service": "App Gateway", + "services": [], "severity": "Medium", - "subcategory": "Virtual Networks", - "text": "VNet RBAC is used to restrict access to the network security team", - "waf": "Security" + "subcategory": "App Gateway", + "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", - "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference", - "services": [ - "VNet" - ], + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", + "service": "App Gateway", + "services": [], "severity": "High", - "subcategory": "Virtual Networks", - "text": "VNet Security recommendations are remediated and there are no 'At-risk' VNets ", + "subcategory": "App Gateway", + "text": "Enable connection draining during planned service updates to prevent connection loss to existing membrs of the backend pool", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", - "services": [ - "VNet" - ], - "severity": "High", - "subcategory": "Virtual Networks", - "text": "VNet Peering connections are understood and expected traffic flows are documented", - "waf": "Security" + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", + "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", + "service": "App Gateway", + "services": [], + "severity": "Low", + "subcategory": "App Gateway", + "text": "Create custom error pages to display a personalized user experience", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview", - "services": [ - "VNet" - ], - "severity": "High", - "subcategory": "Virtual Networks", - "text": "VNet Service Endpoints are in use, no legacy Public Service Endpoints exist", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", + "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", + "service": "App Gateway", + "services": [], + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "1f625659-ee55-480a-9824-9c931213dbd7", - "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "App Gateway", "services": [ - "PrivateLink", - "VNet" + "FrontDoor" ], - "severity": "High", - "subcategory": "Virtual Networks", - "text": "VNet Private Endpoints are in use to allow access from on-premises environments, no legacy public endpoints exist", + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover", + "waf": "Performance" + }, + { + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "29dcc19f-a8fa-4c35-8281-290577538793", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "App Gateway", + "services": [], + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Use transport layer load balancing", + "waf": "Performance" + }, + { + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", + "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", + "service": "App Gateway", + "services": [], + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Configure routing based on host or domain name for multiple web applications on a single gateway", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", + "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", + "service": "App Gateway", "services": [ - "VNet", - "Monitor" + "Entra" ], - "severity": "High", - "subcategory": "Virtual Networks", - "text": "VNet Monitoring enabled", + "severity": "Medium", + "subcategory": "App Gateway", + "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731", - "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies", + "category": "Network Topology and Connectivity", + "checklist": "Azure Application Delivery Networking", + "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", + "service": "App Gateway", "services": [ - "AKS", - "AzurePolicy", - "VNet" + "AppGW" ], - "severity": "High", - "subcategory": "Virtual Networks", - "text": "Secure traffic between pods using network policies in Azure Kubernetes Service (AKS)", + "severity": "Low", + "subcategory": "App Gateway", + "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols", "waf": "Security" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "3c005674-c1e9-445b-959c-373e7ed71623", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva", + "category": "Application Deployment", + "checklist": "Azure AKS Review", + "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks", "services": [ - "VNet", - "NVA" + "AKS" ], - "severity": "High", - "subcategory": "Virtual Networks", - "text": "VNet NVA (appliances) customer follows published architecture pattern", - "waf": "Security" + "severity": "Medium", + "subcategory": "Development", + "text": "Use canary or blue/green deployments", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "category": "Application Deployment", + "checklist": "Azure AKS Review", + "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", + "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", + "service": "AKS", "services": [ - "VNet", - "Sentinel", - "Monitor" + "AKS" ], - "severity": "High", - "subcategory": "Virtual Networks", - "text": "VNet Diagnostic settings are enabled and sending VMProtectionAlerts to the Azure Sentinel LAW", - "waf": "Security" + "severity": "Low", + "subcategory": "Development", + "text": "If required for AKS Windows workloads HostProcess containers can be used", + "waf": "Reliability" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "category": "Application Deployment", + "checklist": "Azure AKS Review", + "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", + "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", + "service": "AKS", "services": [ - "ExpressRoute", - "VPN" + "AKS" ], - "severity": "High", - "subcategory": "Connectivity", - "text": "Use ExpressRoute or VPN to access Azure resources from on-premises environments", - "waf": "Security" + "severity": "Low", + "subcategory": "Development", + "text": "Use KEDA if running event-driven workloads", + "waf": "Performance" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "category": "Application Deployment", + "checklist": "Azure AKS Review", + "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", + "link": "https://dapr.io/", + "service": "AKS", "services": [ - "RBAC", - "VWAN" + "AKS" ], - "severity": "High", - "subcategory": "Virtual WAN", - "text": "VWAN RBAC is used to restrict access to the network security team", - "waf": "Security" + "severity": "Low", + "subcategory": "Development", + "text": "Use Dapr to ease microservice development", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "718d1dca-1f62-4565-aee5-580a38249c93", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture", + "category": "Application Deployment", + "checklist": "Azure AKS Review", + "guid": "3acbe04b-be20-49d3-afda-47778424d116", + "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks", "services": [ - "VWAN", - "Monitor" + "AKS" ], - "severity": "High", - "subcategory": "Virtual WAN", - "text": "VWAN Customer is using Secure Hub or external Firewall to route and monitor traffic.", - "waf": "Security" + "severity": "Medium", + "subcategory": "Infrastructure as Code", + "text": "Use automation through ARM/TF to create your Azure resources", + "waf": "Operations" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "category": "BC and DR", + "checklist": "Azure AKS Review", + "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery", "services": [ - "RBAC", - "AppGW" + "ASR", + "AKS" ], "severity": "High", - "subcategory": "Application Gateway", - "text": "AppGW RBAC is used to restrict access to the network security team", - "waf": "Security" + "subcategory": "Disaster Recovery", + "text": "Schedule and perform DR tests regularly", + "waf": "Reliability" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "category": "BC and DR", + "checklist": "Azure AKS Review", + "guid": "170265f4-bb46-4a39-9af7-f317284797b1", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", "services": [ - "EventHubs", - "AppGW", - "WAF" + "TrafficManager", + "AKS", + "FrontDoor", + "LoadBalancer" ], - "severity": "High", - "subcategory": "Application Gateway", - "text": "AppGW All external facing web services are behind Application Gateways with WAF enabled ", - "waf": "Security" + "severity": "Medium", + "subcategory": "High Availability", + "text": "Use Azure Traffic Manager or Azure Front Door as a global load balancer for region failover", + "waf": "Reliability" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "94666731-3c00-4567-9c1e-945b459c373e", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "category": "BC and DR", + "checklist": "Azure AKS Review", + "graph": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant", + "guid": "578a219a-46be-4b54-9350-24922634292b", + "link": "https://learn.microsoft.com/azure/aks/availability-zones", "services": [ - "EventHubs", - "AppGW", - "WAF" + "AKS" ], - "severity": "High", - "subcategory": "Application Gateway", - "text": "AppGW All internal facing web services are behind Application Gateways with WAF enabled ", - "waf": "Security" + "severity": "Medium", + "subcategory": "High Availability", + "text": "Use Availability Zones if they are supported in your Azure region", + "waf": "Reliability" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "category": "BC and DR", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", + "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", + "link": "https://learn.microsoft.com/azure/aks/uptime-sla", + "service": "AKS", "services": [ - "AppGW" + "AKS" ], "severity": "High", - "subcategory": "Application Gateway", - "text": "AppGW - External facing has TLS/SSL enabled and redirects all traffic to 443 (no port 80 traffic)", - "waf": "Security" + "subcategory": "High Availability", + "text": "Use the SLA-backed AKS offering", + "waf": "Reliability" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", - "link": "https://learn.microsoft.com/azure/frontdoor/", + "category": "BC and DR", + "checklist": "Azure AKS Review", + "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "services": [ - "RBAC", - "FrontDoor" + "AKS", + "Cost" ], - "severity": "High", - "subcategory": "FrontDoor", - "text": "Front Door RBAC is used to restrict access to the network security team", - "waf": "Security" + "severity": "Low", + "subcategory": "High Availability", + "text": "Use Disruption Budgets in your pod and deployment definitions", + "waf": "Reliability" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json", + "category": "BC and DR", + "checklist": "Azure AKS Review", + "guid": "3c763963-7a55-42d5-a15e-401955387e5c", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", + "service": "ACR", "services": [ - "FrontDoor", - "AzurePolicy", - "WAF" + "ACR", + "AKS" ], "severity": "High", - "subcategory": "FrontDoor", - "text": "Front Door is associated with a WAF policy", - "waf": "Security" + "subcategory": "High Availability", + "text": "If using a private registry, configure region replication to store images in multiple regions", + "waf": "Reliability" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https", + "category": "BC and DR", + "checklist": "Azure AKS Review", + "guid": "daa9a260-c3ea-4490-b077-5fc1f2a80cb0", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", "services": [ - "FrontDoor", - "AzurePolicy" + "Storage", + "AKS", + "ASR" ], "severity": "High", - "subcategory": "FrontDoor", - "text": "Front Door TLS/SSL policy is configured", - "waf": "Security" + "subcategory": "Disaster Recovery", + "text": "Use Zone-Redundant Storage (ZRS) with stateful workloads", + "waf": "Reliability" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect", + "category": "BC and DR", + "checklist": "Azure AKS Review", + "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery", "services": [ - "FrontDoor" + "AKS" ], "severity": "High", - "subcategory": "FrontDoor", - "text": "Front Door redirect port 80 to port 443 is configured (listeners)", - "waf": "Security" + "subcategory": "Requirements", + "text": "Define non-functional requirements such as SLAs, RTO (Recovery Time Objective) and RPO (Recovery Point Objective).", + "waf": "Reliability" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics", + "category": "Cost Governance", + "checklist": "Azure AKS Review", + "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", + "service": "AKS", "services": [ - "FrontDoor", - "Sentinel" + "AKS", + "Cost" ], - "severity": "High", - "subcategory": "FrontDoor", - "text": "Front Door diagnostics logs send ApplicationGatewayAccessLog &ApplicationGateway FirewallLog to Sentinel LAW", - "waf": "Security" + "severity": "Low", + "subcategory": "Cost", + "text": "Use an external application such as kubecost to allocate costs to different users", + "waf": "Cost" }, { - "category": "Azure Networking", - "checklist": "Azure Security Review Checklist", - "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "category": "Cost Governance", + "checklist": "Azure AKS Review", + "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", + "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", + "service": "AKS", "services": [ - "DDoS" + "AKS", + "Cost" ], - "severity": "High", - "subcategory": "DDOS Protection", - "text": "Enabled for Firewall public IP's (all public IPs)", - "waf": "Security" + "severity": "Low", + "subcategory": "Cost", + "text": "Use scale down mode to delete/deallocate nodes", + "waf": "Cost" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", - "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory", + "category": "Cost Governance", + "checklist": "Azure AKS Review", + "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", + "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", + "service": "AKS", "services": [ - "Entra" + "AKS", + "Cost" ], - "severity": "High", - "subcategory": "Tenant", - "text": "Establish a single enterprise directory for managing identities of full-time employees and enterprise resources.", - "waf": "Security" + "severity": "Medium", + "subcategory": "Cost", + "text": "When required use multi-instance partitioning GPU on AKS Clusters", + "waf": "Cost" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", - "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems", + "category": "Cost Governance", + "checklist": "Azure AKS Review", + "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", + "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", + "service": "AKS", "services": [ - "Entra" + "AKS", + "Cost" ], - "severity": "High", - "subcategory": "Tenant", - "text": "Synchronize your cloud identity with your existing identity systems.", - "waf": "Security" + "severity": "Low", + "subcategory": "Cost", + "text": "If running a Dev/Test cluster use NodePool Start/Stop", + "waf": "Cost" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", - "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", + "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", + "service": "AKS", "services": [ - "Entra" + "AKS", + "AzurePolicy" ], - "severity": "High", - "subcategory": "Tenant", - "text": "Use cloud identity services to host non-employee accounts such as vendors, partners, and customers, rather than rather than including them in your on-premises directory.", + "severity": "Medium", + "subcategory": "Compliance", + "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", - "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", + "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "services": [ - "Entra" + "AKS" ], - "severity": "High", - "subcategory": "Tenant", - "text": "Disable insecure legacy protocols for internet-facing services.", + "severity": "Medium", + "subcategory": "Compliance", + "text": "Separate applications from the control plane with user/system node pools", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", - "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "services": [ - "Entra" + "AKS" ], - "severity": "High", - "subcategory": "Tenant", - "text": "Enable single sign-on", + "severity": "Low", + "subcategory": "Compliance", + "text": "Add taint to your system nodepool to make it dedicated", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", - "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", + "link": "https://learn.microsoft.com/azure/container-registry/", + "service": "AKS", "services": [ - "Entra" + "ACR", + "AKS" ], - "severity": "High", - "subcategory": "Privileged administration", - "text": "Don�t synchronize accounts with the highest privilege access to on-premises resources as you synchronize your enterprise identity systems with cloud directories.", + "severity": "Medium", + "subcategory": "Compliance", + "text": "Use a private registry for your images, such as ACR", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", + "link": "https://learn.microsoft.com/azure/security-center/container-security", + "service": "ACR", "services": [ - "Entra" + "AKS" ], - "severity": "High", - "subcategory": "Privileged administration", - "text": "Limit the number of Global Administrators to less than 5", + "severity": "Medium", + "subcategory": "Compliance", + "text": "Scan your images for vulnerabilities", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "cc639637-a652-42ac-89e8-06965388e9de", + "link": "https://learn.microsoft.com/azure/security-center/container-security", "services": [ - "Entra", - "RBAC" + "AKS", + "Defender" ], - "severity": "High", - "subcategory": "Privileged administration", - "text": "Use groups for Azure AD role assignments and delegate the role assignment", + "severity": "Medium", + "subcategory": "Compliance", + "text": "Use Azure Security Center to detect security posture vulnerabilities", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "42d4aefe-2383-470e-b019-c30df24996b2", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool", "services": [ - "Entra", - "AzurePolicy" + "AKS" ], - "severity": "High", - "subcategory": "Privileged administration", - "text": "Ensure all critical impact admins are managed by enterprise directory to follow organizational policy enforcement.", + "severity": "Low", + "subcategory": "Compliance", + "text": "If required configure FIPS", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", + "service": "AKS", "services": [ - "Entra" + "AKS" ], "severity": "High", - "subcategory": "Privileged administration", - "text": "Configure recurring access reviews to revoke unneeded permissions over time", + "subcategory": "Compliance", + "text": "Define app separation requirements (namespace/nodepool/cluster)", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", + "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", + "service": "AKS", "services": [ - "Entra", - "Monitor" + "AKS", + "AKV" ], "severity": "Medium", - "subcategory": "Privileged administration", - "text": "Ensure critical impact admins use a workstation with elevated security protections and monitoring", + "subcategory": "Secrets", + "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", + "link": "https://learn.microsoft.com/azure/aks/update-credentials", + "service": "AKS", "services": [ - "Entra" + "AKS", + "AKV" ], "severity": "High", - "subcategory": "External Identities", - "text": "Identity Providers: Verify external identity providers are known", + "subcategory": "Secrets", + "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", + "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", + "service": "AKS", "services": [ - "Entra" + "AKS", + "AKV" ], - "severity": "High", - "subcategory": "External Identities", - "text": "External Collaboration Settings: Guest user access set to 'Guest user access is restricted?'", + "severity": "Medium", + "subcategory": "Secrets", + "text": "If required add Key Management Service etcd encryption", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", + "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", + "service": "AKS", "services": [ - "RBAC", - "Entra" + "AKS", + "AKV" ], - "severity": "High", - "subcategory": "External Identities", - "text": "External Collaboration Settings: Guest invite settings set to 'Only users assigned to specific admin roles'", + "severity": "Low", + "subcategory": "Secrets", + "text": "If required consider using Confidential Compute for AKS", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "category": "Governance and Security", + "checklist": "Azure AKS Review", + "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", + "service": "AKS", "services": [ - "Entra" + "AKS", + "AKV", + "Defender" ], - "severity": "High", - "subcategory": "External Identities", - "text": "External Collaboration Settings: Enable guest self-service sign up via flows set to 'Disabled' ", + "severity": "Medium", + "subcategory": "Secrets", + "text": "Consider using Defender for Containers", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", + "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", + "service": "AKS", "services": [ - "Entra" + "Entra", + "AKS" ], "severity": "High", - "subcategory": "External Identities", - "text": "External Collaboration Settings: Collaboration restrictions set to 'Allow invitations to the specified domains'", + "subcategory": "Identity", + "text": "Use managed identities instead of Service Principals", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", - "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", + "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", + "link": "https://learn.microsoft.com/azure/aks/managed-aad", + "service": "AKS", "services": [ - "Entra" + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "External Identities", - "text": "Access Reviews: Enabled for all groups", + "subcategory": "Identity", + "text": "Integrate authentication with AAD (using the managed integration)", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", + "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", + "service": "AKS", "services": [ - "Entra" + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "Enterprise Applications", - "text": "Consent & Permissions: Allow user consent for apps from verified publishers", + "subcategory": "Identity", + "text": "Limit access to admin kubeconfig (get-credentials --admin)", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", + "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", + "service": "AKS", "services": [ - "Entra" + "RBAC", + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "Enterprise Applications", - "text": "Consent & Permissions: Allow group owner consent for selected group owners ", + "subcategory": "Identity", + "text": "Integrate authorization with AAD RBAC", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "bade4aad-1e8c-439e-a946-667313c00567", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", + "service": "AKS", "services": [ - "Entra" + "RBAC", + "Entra", + "AKS" ], "severity": "High", - "subcategory": "Custom Domains", - "text": "Only validated customer domains are registered", + "subcategory": "Identity", + "text": "Use namespaces for restricting RBAC privilege in Kubernetes", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", + "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", + "service": "AKS", "services": [ "Entra", - "AzurePolicy" + "AKS" ], - "severity": "High", - "subcategory": "Password Reset", - "text": "Self-service password reset policy requirement verified compliant.", + "severity": "Medium", + "subcategory": "Identity", + "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", + "service": "AKS", "services": [ - "Entra" + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "Password Reset", - "text": "Set number of days before users are asked to re-confirm authentication information is not set to zero", + "subcategory": "Identity", + "text": "For AKS non-interactive logins use kubelogin (preview)", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", + "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", + "service": "AKS", "services": [ - "Entra" + "Entra", + "AKS" ], - "severity": "High", - "subcategory": "Password Reset", - "text": "Set number of methods required to reset password are selected", + "severity": "Medium", + "subcategory": "Identity", + "text": "Disable AKS local accounts", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", - "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", + "service": "AKS", "services": [ - "Entra" + "Entra", + "AKS" ], - "severity": "High", - "subcategory": "User Setting", - "text": "Disable 'Users can register applications'", + "severity": "Low", + "subcategory": "Identity", + "text": "Configure if required Just-in-time cluster access", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", + "service": "AKS", "services": [ - "Entra" + "Entra", + "AKS" ], - "severity": "High", - "subcategory": "User Setting", - "text": "Restrict access to Administrative portal (portal.azure.com) to administrators only", + "severity": "Low", + "subcategory": "Identity", + "text": "Configure if required AAD conditional access for AKS", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", - "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", + "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", + "service": "AKS", "services": [ - "Entra" + "Entra", + "AKS" ], - "severity": "High", - "subcategory": "User Setting", - "text": "Disable 'LinkedIn account connection'", + "severity": "Low", + "subcategory": "Identity", + "text": "If required for Windows AKS workloads configure gMSA ", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring", + "category": "Identity and Access Management", + "checklist": "Azure AKS Review", + "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", + "service": "AKS", "services": [ "Entra", - "Sentinel", - "Monitor" + "AKS" ], - "severity": "High", - "subcategory": "Diagnostic Settings", - "text": "Enabled and send to Log Analytics workspace with Sentinel", + "severity": "Medium", + "subcategory": "Identity", + "text": "For finer control consider using a managed Kubelet Identity", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", + "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", + "service": "AKS", "services": [ - "Entra" + "ACR", + "AKS", + "AppGW" ], - "severity": "High", - "subcategory": "PIM enabled", - "text": "Privileged Identity Management enabled", - "waf": "Security" + "severity": "Medium", + "subcategory": "Best practices", + "text": "If using AGIC, do not share an AppGW across clusters", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", + "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", + "link": "https://learn.microsoft.com/azure/aks/http-application-routing", + "service": "AKS", "services": [ - "Entra" + "AKS" ], "severity": "High", - "subcategory": "PIM enabled", - "text": "Implement 'just in time' (JIT) access to further lower the exposure time for privileged accounts (reduce standing access)", - "waf": "Security" + "subcategory": "Best practices", + "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", + "service": "AKS", + "services": [ + "AKS" + ], + "severity": "Medium", + "subcategory": "Best practices", + "text": "For Windows workloads use Accelerated Networking", + "waf": "Performance" + }, + { + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", + "guid": "ba7da7be-9952-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "services": [ - "Entra", - "AzurePolicy" + "AKS", + "LoadBalancer" ], "severity": "High", - "subcategory": "Conditional Access Policies", - "text": "Configure conditional access policies / Access Controls", - "waf": "Security" + "subcategory": "Best practices", + "text": "Use the standard ALB (as opposed to the basic one)", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", + "service": "AKS", "services": [ - "Entra", - "AzurePolicy" + "VNet", + "AKS" ], "severity": "Medium", - "subcategory": "Conditional Access Policies", - "text": "Conditions: Restricted Locations", + "subcategory": "Best practices", + "text": "If using Azure CNI, consider using different Subnets for NodePools", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", + "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", + "service": "AKS", "services": [ - "Entra", - "AzurePolicy" + "VNet", + "AKS", + "Cost", + "PrivateLink" ], - "severity": "High", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: MFA enabled for all users", + "severity": "Medium", + "subcategory": "Cost", + "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", "services": [ - "Entra", - "AzurePolicy" + "VPN", + "AKS" ], "severity": "Medium", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: Require MFA for Administrators", - "waf": "Security" + "subcategory": "HA", + "text": "If hybrid connectivity is required, use 2xER or ER+VPN for better availability", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", + "guid": "a0f61565-9de5-458f-a372-49c831112dbd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "services": [ - "Entra", - "AzurePolicy" + "AKS" ], "severity": "High", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: Require MFA for Azure Management ", - "waf": "Security" + "subcategory": "IPAM", + "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "Entra", - "AzurePolicy" + "VNet", + "AKS" ], "severity": "High", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: Block Legacy Protocols", - "waf": "Security" + "subcategory": "IPAM", + "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node", + "waf": "Performance" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "Entra", - "AzurePolicy" + "AKS" ], "severity": "High", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: Require devices to be marked as compliant", - "waf": "Security" + "subcategory": "IPAM", + "text": "If using Azure CNI, check the maximum pods/node (default 30)", + "waf": "Performance" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "description": "Customer documented policy", - "guid": "a7144351-e19d-4d34-929e-b7228137a151", - "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .", + "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", + "link": "https://learn.microsoft.com/azure/aks/internal-lb", + "service": "AKS", "services": [ - "Entra", - "AzurePolicy" + "VNet", + "AKS" ], - "severity": "Medium", - "subcategory": "Guest users", - "text": "Is there a policy to track guest user accounts (i.e. usage/delete/disable)?", + "severity": "Low", + "subcategory": "IPAM", + "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "Entra" + "AKS" ], "severity": "High", - "subcategory": "Identity Secure Score", - "text": "Implement Identity Secure Score based on best practices in your industry", - "waf": "Security" + "subcategory": "IPAM", + "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure Security Review Checklist", - "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", + "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", + "service": "AKS", "services": [ - "Entra", - "AzurePolicy" + "AKS" ], - "severity": "Medium", - "subcategory": "Break Glass Accounts", - "text": "At least two break glass accounts have been created and policy around their use exists", + "severity": "Low", + "subcategory": "Operations", + "text": "If required add your own CNI plugin", "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", + "service": "AKS", "services": [ - "AzurePolicy", - "VM" + "AKS" ], - "severity": "High", - "subcategory": "Access Control", - "text": "Control VM Access leveraging Azure Policy", - "waf": "Security" + "severity": "Low", + "subcategory": "Operations", + "text": "If required configure Public IP per node in AKS", + "waf": "Performance" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", + "link": "https://learn.microsoft.com/azure/aks/concepts-network", + "service": "AKS", "services": [ - "VM" + "AKS" ], "severity": "Medium", - "subcategory": "Access Control", - "text": "Reduce variability in your setup and deployment of VMs by leveraging templates", - "waf": "Security" + "subcategory": "Scalability", + "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services", + "waf": "Reliability" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "b5945bda-4333-44fd-b91c-234182b65275", - "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", + "link": "https://learn.microsoft.com/azure/aks/nat-gateway", + "service": "AKS", "services": [ - "VM" + "AKS" ], - "severity": "Medium", - "subcategory": "Access Control", - "text": "Secure privileged access to deploy VMS by reducing who has access to Resources through Governance", - "waf": "Security" + "severity": "Low", + "subcategory": "Scalability", + "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic", + "waf": "Reliability" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", - "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", + "service": "AKS", "services": [ - "VM" + "AKS" ], "severity": "Medium", - "subcategory": "High Availability ", - "text": "Use multiple VMs for your workloads for better availability ", + "subcategory": "Scalability", + "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion", "waf": "Reliability" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "f219e4a1-eb58-4879-935d-227886d30b66", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", + "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", + "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", + "service": "AKS", "services": [ - "ASR", - "VM" + "AKS", + "NVA" ], - "severity": "Medium", - "subcategory": "High Availability ", - "text": "Deploy and test a disaster recovery solution ", - "waf": "Reliability" + "severity": "High", + "subcategory": "Security", + "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it", + "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "c57be595-1900-4838-95c5-86cb291ec16a", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", + "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", + "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", + "service": "AKS", "services": [ - "VM" + "AKS" ], "severity": "Medium", - "subcategory": "High Availability ", - "text": "Availability sets", - "waf": "Reliability" + "subcategory": "Security", + "text": "If using a public API endpoint, restrict the IP addresses that can access it", + "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", - "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", + "link": "https://learn.microsoft.com/azure/aks/private-clusters", + "service": "AKS", "services": [ - "VM" + "AKS" ], - "severity": "Medium", - "subcategory": "High Availability ", - "text": "Availability Zones", - "waf": "Reliability" + "severity": "High", + "subcategory": "Security", + "text": "Use private clusters if your requirements mandate it", + "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", - "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "services": [ - "VM" + "AKS", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "High Availability ", - "text": "Regional fault tolerance ", - "waf": "Reliability" + "subcategory": "Security", + "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ", + "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", - "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", + "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "services": [ - "VM" + "AKS", + "AzurePolicy" ], "severity": "High", - "subcategory": "Protect against malware", - "text": "Install antimalware solutions", + "subcategory": "Security", + "text": "Enable a Kubernetes Network Policy option (Calico/Azure)", "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "services": [ - "Defender", - "VM" + "AKS", + "AzurePolicy" ], "severity": "High", - "subcategory": "Protect against malware", - "text": "Integrate antimalware solution with Security Center", + "subcategory": "Security", + "text": "Use Kubernetes network policies to increase intra-cluster security", "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "services": [ - "VM" + "AKS", + "WAF" ], "severity": "High", - "subcategory": "Manage VM Updates", - "text": "Keep VMs up to date using Update Management with Azure Automation", + "subcategory": "Security", + "text": "Use a WAF for web workloads (UIs or APIs)", "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", - "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", + "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", + "service": "AKS", "services": [ - "VM" + "DDoS", + "VNet", + "AKS" ], "severity": "Medium", - "subcategory": "Manage VM Updates", - "text": "Ensure Windows images for deployment have the most recent level of updates ", + "subcategory": "Security", + "text": "Use DDoS Standard in the AKS Virtual Network", "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "02145901-465d-438e-9309-ccbd979266bc", - "link": "https://learn.microsoft.com/azure/security-center/asset-inventory", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", + "link": "https://learn.microsoft.com/azure/aks/http-proxy", + "service": "AKS", "services": [ - "Defender", - "VM" + "AKS" ], - "severity": "High", - "subcategory": "Manage VM Updates", - "text": "Rapidly apply security updates to VMs using Microsoft Defender for Cloud", + "severity": "Low", + "subcategory": "Security", + "text": "If required add company HTTP Proxy", "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", - "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", + "category": "Network Topology and Connectivity", + "checklist": "Azure AKS Review", + "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", + "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", + "service": "AKS", "services": [ - "VM" + "AKS" ], - "severity": "High", - "subcategory": "Encrypt your VHDs", - "text": "Enable encryption on your VMs", + "severity": "Medium", + "subcategory": "Security", + "text": "Consider using a service mesh for advanced microservice communication management", "waf": "Security" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", + "service": "AKS", "services": [ - "VM" + "AKS", + "Monitor" ], "severity": "High", - "subcategory": "Encrypt your VHDs", - "text": "Add Key Encryption Key (KEK) for added layer of security for encryption ", - "waf": "Security" + "subcategory": "Alerting", + "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", + "waf": "Operations" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "337453a3-cc63-4963-9a65-22ac19e80696", + "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", + "service": "AKS", "services": [ - "VM", - "LoadBalancer" + "Entra", + "AKS" ], - "severity": "Medium", - "subcategory": "Encrypt your VHDs", - "text": "Take a snapshot of disks before encryption for rollback purposes", - "waf": "Security" + "severity": "Low", + "subcategory": "Compliance", + "text": "Check regularly Azure Advisor for recommendations on your cluster", + "waf": "Operations" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "5173676a-e466-491e-a835-ad942223e138", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", + "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", + "service": "AKS", "services": [ - "Entra", - "VM" + "AKS" ], - "severity": "High", - "subcategory": "Restrict direct internet connection ", - "text": "Ensure only the central networking group has permissions to networking resources ", - "waf": "Security" + "severity": "Low", + "subcategory": "Compliance", + "text": "Enable AKS auto-certificate rotation", + "waf": "Operations" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "10523081-a941-4741-9833-ff7ad7c6d373", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", + "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", + "service": "AKS", "services": [ - "Entra", - "VM" + "AKS" ], "severity": "High", - "subcategory": "Restrict direct internet connection ", - "text": "Identity and remediate exposed VMs that allow access from 'ANY' source IP address", - "waf": "Security" + "subcategory": "Compliance", + "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature", + "waf": "Operations" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", - "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", + "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", + "service": "AKS", "services": [ - "VM" + "AKS" ], "severity": "High", - "subcategory": "Restrict direct internet connection ", - "text": "Restrict management ports (RDP, SSH) using Just-in-Time Access", - "waf": "Security" + "subcategory": "Compliance", + "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade", + "waf": "Operations" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", - "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", + "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", + "service": "AKS", "services": [ - "VM" + "AKS" ], "severity": "High", - "subcategory": "Restrict direct internet connection ", - "text": "Remove internet access and implement jump servers for RDP", - "waf": "Security" + "subcategory": "Compliance", + "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)", + "waf": "Operations" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", + "service": "AKS", "services": [ - "VM", - "VPN" + "AKS" ], - "severity": "High", - "subcategory": "Restrict direct internet connection ", - "text": "Remove direct logging into servers using RDP/SSH from internet and implement VPN or express route", - "waf": "Security" + "severity": "Low", + "subcategory": "Compliance", + "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters", + "waf": "Operations" }, { - "category": "VM Security Checks", - "checklist": "Azure Security Review Checklist", - "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "d7672c26-7602-4482-85a4-14527fbe855c", + "link": "https://learn.microsoft.com/azure/aks/command-invoke", + "service": "AKS", "services": [ - "VM", - "Bastion" + "AKS" ], - "severity": "High", - "subcategory": "Restrict direct internet connection ", - "text": "Leverage Azure Bastion as your RDP/SSH broker for added security and reduction in footprint", - "waf": "Security" + "severity": "Low", + "subcategory": "Compliance", + "text": "Consider using AKS command invoke on private clusters", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", - "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", + "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", + "service": "AKS", "services": [ - "Sentinel", - "Monitor" + "AKS" ], - "severity": "High", - "subcategory": "Architecture ", - "text": "All tenants contain have Sentinel enabled on at least one Log Analytics workspace", - "waf": "Security" + "severity": "Low", + "subcategory": "Compliance", + "text": "For planned events consider using Node Auto Drain", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", - "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", + "link": "https://learn.microsoft.com/azure/aks/faq", + "service": "AKS", "services": [ - "Sentinel" + "AKS" ], "severity": "High", - "subcategory": "Architecture ", - "text": "Customer understands Sentinel architecture", - "waf": "Security" + "subcategory": "Compliance", + "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", - "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view", + "category": "Operations", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", + "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", "services": [ - "ACR", - "Sentinel", - "Monitor" + "AKS" ], - "severity": "Medium", - "subcategory": "Architecture ", - "text": "Customer knows how to monitor Incidents across multiple Sentinel instances", - "waf": "Security" + "severity": "Low", + "subcategory": "Compliance", + "text": "Use custom Node RG (aka 'Infra RG') name", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "8989579e-76b8-497e-910a-7da7be9966e1", - "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", + "link": "https://kubernetes.io/docs/setup/release/notes/", + "service": "AKS", "services": [ - "Sentinel" + "AKS" ], "severity": "Medium", - "subcategory": "Overview", - "text": "No Incidents open more than 24 hours", - "waf": "Security" + "subcategory": "Compliance", + "text": "Do not use deprecated Kubernetes APIs in your YAML manifests", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", - "link": "https://learn.microsoft.com/azure/sentinel/whats-new", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", + "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", + "service": "AKS", "services": [ - "Sentinel" + "AKS" ], "severity": "Low", - "subcategory": "News & Guides", - "text": "Customer have been shown the News & Guides tab", - "waf": "Security" + "subcategory": "Compliance", + "text": "Taint Windows nodes", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", - "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", + "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", + "service": "AKS", "services": [ - "Sentinel" + "AKS" ], - "severity": "Medium", - "subcategory": "UEBA ", - "text": "UEBA Configured (Sentinel/Settings/Settings/Configure UEBA)", - "waf": "Security" + "severity": "Low", + "subcategory": "Compliance", + "text": "Keep windows containers patch level in sync with host patch level", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", - "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory", + "category": "Operations", + "checklist": "Azure AKS Review", + "description": "Via Diagnostic Settings at the cluster level", + "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", + "link": "https://learn.microsoft.com/azure/aks/monitor-aks", + "service": "AKS", "services": [ - "Entra", - "Sentinel" + "AKS", + "Monitor" ], - "severity": "High", - "subcategory": "Data Connectors", - "text": "Azure Active Directory in configured and 'Last Log Received' shows today", - "waf": "Security" + "severity": "Low", + "subcategory": "Compliance", + "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", + "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", + "service": "AKS", "services": [ - "Entra", - "Sentinel" + "AKS" ], - "severity": "High", - "subcategory": "Data Connectors", - "text": "Azure Active Directory Identity Protection is configured and 'Last Log Received' shows today", - "waf": "Security" + "severity": "Low", + "subcategory": "Compliance", + "text": "If required use nodePool snapshots", + "waf": "Cost" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", + "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", + "service": "AKS", "services": [ - "Sentinel" + "AKS", + "Cost" ], - "severity": "High", - "subcategory": "Data Connectors", - "text": "Azure Activity is configured is configured and 'Last Log Received' shows today", - "waf": "Security" + "severity": "Low", + "subcategory": "Cost", + "text": "Consider spot node pools for non time-sensitive workloads", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", - "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud", + "category": "Operations", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", + "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "services": [ - "Defender", - "Sentinel" + "AKS", + "Cost" ], - "severity": "High", - "subcategory": "Data Connectors", - "text": "Microsoft Defender for Cloud is configured and 'Last Log Received' shows today", - "waf": "Security" + "severity": "Low", + "subcategory": "Cost", + "text": "Consider AKS virtual node for quick bursting", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", "services": [ - "Sentinel", - "Firewall" + "AKS", + "Monitor" ], "severity": "High", - "subcategory": "Data Connectors", - "text": "Azure Firewall is configured and 'Last Log Received' shows today", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall", + "category": "Operations", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", + "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", "services": [ - "Sentinel" + "AKS", + "Monitor" ], "severity": "High", - "subcategory": "Data Connectors", - "text": "Windows Firewall is configured and 'Last Log Received' shows today", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", + "service": "AKS", "services": [ - "Sentinel" + "AKS", + "Monitor" ], - "severity": "High", - "subcategory": "Data Connectors", - "text": "Security Events is configured with AMA and 'Last Log Received' shows today", - "waf": "Security" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Monitor CPU and memory utilization of the nodes", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "1a4834ac-9322-423e-ae80-b123081a5417", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "1a4835ac-9422-423e-ae80-b123081a5417", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "Sentinel" + "AKS", + "Monitor" ], - "severity": "High", - "subcategory": "Data Connectors", - "text": "Security Events - verify Azure computers are connected and sending data to the workspace", - "waf": "Security" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "If using Azure CNI, monitor % of pod IPs consumed per node", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "category": "Operations", + "checklist": "Azure AKS Review", + "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady", + "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", + "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", + "service": "AKS", "services": [ - "Sentinel" + "Storage", + "EventHubs", + "AKS", + "ServiceBus", + "Monitor" ], - "severity": "High", - "subcategory": "Data Connectors", - "text": "Security Events - verify non-Azure computers are connected and sending data to the workspace", - "waf": "Security" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Monitor OS disk queue depth in nodes", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", - "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "be209d39-fda4-4777-a424-d116785c2fa5", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "services": [ - "Sentinel" + "AKS", + "NVA", + "LoadBalancer", + "Monitor" ], - "severity": "High", - "subcategory": "Data Connectors", - "text": "Connector for AWS", - "waf": "Security" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", + "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", + "service": "AKS", "services": [ - "Sentinel" + "AKS", + "Monitor" ], - "severity": "High", - "subcategory": "Data Connectors", - "text": "Connector for GCP", - "waf": "Security" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Subscribe to resource health notifications for your AKS cluster", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", - "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "services": [ - "Sentinel" + "AKS" ], "severity": "High", - "subcategory": "Analytics Rules", - "text": "Customer has enabled Analytics rules and configured Incidents ", - "waf": "Security" + "subcategory": "Resources", + "text": "Configure requests and limits in your pod specs", + "waf": "Operations" }, { - "category": "Sentinel", - "checklist": "Azure Security Review Checklist", - "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", - "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "769ef669-1a48-435a-a942-223ece80b123", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "services": [ - "Sentinel" + "AKS" ], "severity": "Medium", - "subcategory": "Settings", - "text": "Customer does not have a daily cap enabled", - "waf": "Security" + "subcategory": "Resources", + "text": "Enforce resource quotas for namespaces", + "waf": "Operations" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "081a5417-4158-433e-a3ad-3c2de733165c", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "AKS", "services": [ - "Firewall" + "AKS", + "Subscriptions" ], "severity": "High", - "subcategory": "Configuration", - "text": "Azure Firewall Premium deployed", - "waf": "Security" + "subcategory": "Resources", + "text": "Ensure your subscription has enough quota to scale out your nodepools", + "waf": "Operations" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65", + "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", + "service": "AKS", "services": [ - "Firewall" + "AKS" ], "severity": "High", - "subcategory": "Configuration", - "text": "Quad zero/force tunning enabled through Azure Firewall", - "waf": "Security" + "subcategory": "Resources", + "text": "Configure Liveness and Readiness probes for all deployments", + "waf": "Operations" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "category": "Operations", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", + "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "services": [ - "RBAC", - "Firewall" + "AKS" ], "severity": "Medium", - "subcategory": "Access Control", - "text": "RBAC set to enable only authorized users", - "waf": "Security" + "subcategory": "Scalability", + "text": "Use the Cluster Autoscaler", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "category": "Operations", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", + "guid": "831c2872-c693-4b39-a887-a561bada49bc", + "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", + "service": "AKS", "services": [ - "Monitor", - "Firewall" + "AKS" ], - "severity": "Medium", - "subcategory": "Diagnostic Settings", - "text": "Diagnostics enabled and sending metrics to a Log Analytics workspace ", - "waf": "Security" + "severity": "Low", + "subcategory": "Scalability", + "text": "Customize node configuration for AKS node pools", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "b35478c3-4798-416b-8863-cffe1cac599e", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "services": [ - "VNet", - "Firewall" + "AKS" ], - "severity": "High", - "subcategory": "Firewall Manager", - "text": "Hubs and virtual networks are protected or connected through Firewall Premium", - "waf": "Security" + "severity": "Medium", + "subcategory": "Scalability", + "text": "Use the Horizontal Pod Autoscaler when required", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "category": "Operations", + "checklist": "Azure AKS Review", + "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity", + "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", + "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", + "service": "AKS", "services": [ - "RBAC", - "AzurePolicy", - "Firewall" + "AKS" ], "severity": "High", - "subcategory": "Firewall Manager", - "text": "Policy: Access controls are configured (RBAC)", - "waf": "Security" + "subcategory": "Scalability", + "text": "Consider an appropriate node size, not too large or too small", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", - "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", + "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", + "service": "AKS", "services": [ - "AzurePolicy", - "Firewall" + "AKS" ], - "severity": "High", - "subcategory": "Firewall Manager", - "text": "Policy: Parent policy is configured ", - "waf": "Security" + "severity": "Low", + "subcategory": "Scalability", + "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", + "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", + "service": "AKS", "services": [ - "AzurePolicy", - "Firewall" + "AKS" ], - "severity": "High", - "subcategory": "Firewall Manager", - "text": "Policy: Rule collections are defined", - "waf": "Security" + "severity": "Low", + "subcategory": "Scalability", + "text": "Consider subscribing to EventGrid Events for AKS automation", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", + "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", + "service": "AKS", "services": [ - "AzurePolicy", - "Firewall" + "AKS" ], - "severity": "High", - "subcategory": "Firewall Manager", - "text": "Policy: DNAT policies are defined", - "waf": "Security" + "severity": "Low", + "subcategory": "Scalability", + "text": "For long running operation on an AKS cluster consider event termination", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", + "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", + "service": "AKS", "services": [ - "AzurePolicy", - "Firewall" + "AKS" ], - "severity": "High", - "subcategory": "Firewall Manager", - "text": "Policy: Network rules are defined", - "waf": "Security" + "severity": "Low", + "subcategory": "Scalability", + "text": "If required consider using Azure Dedicated Hosts for AKS nodes", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", - "link": "https://learn.microsoft.com/azure/firewall/features", + "category": "Operations", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", + "guid": "24367b33-6971-45b1-952b-eee0b9b588de", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", "services": [ - "AzurePolicy", - "Firewall" + "Storage", + "AKS" ], "severity": "High", - "subcategory": "Firewall Manager", - "text": "Policy: Application rules are defined", - "waf": "Security" - }, - { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", - "link": "https://learn.microsoft.com/azure/firewall/dns-details", - "services": [ - "DNS", - "Firewall" - ], - "severity": "Medium", - "subcategory": "Firewall Manager", - "text": "DNS: Feature understood and applied or not applied", - "waf": "Security" + "subcategory": "Storage", + "text": "Use ephemeral OS disks", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "AKS", "services": [ - "Firewall" + "Storage", + "AKS" ], "severity": "High", - "subcategory": "Firewall Manager", - "text": "Threat Intelligence: Set to Alert & Deny", - "waf": "Security" + "subcategory": "Storage", + "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", + "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", + "service": "AKS", "services": [ - "Firewall" + "Storage", + "AKS" ], - "severity": "High", - "subcategory": "Firewall Manager", - "text": "Threat Intelligence: Allowed list (justify if they are being used - ie performance)", - "waf": "Security" + "severity": "Low", + "subcategory": "Storage", + "text": "For hyper performance storage option use Ultra Disks on AKS", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", - "link": "https://learn.microsoft.com/azure/firewall/premium-certificates", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "service": "AKS", "services": [ - "Firewall" + "Storage", + "AKS", + "SQL" ], - "severity": "High", - "subcategory": "Firewall Manager", - "text": "TLS enabled", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", + "service": "AKS", "services": [ - "Firewall" + "Storage", + "AKS" ], - "severity": "High", - "subcategory": "Firewall Manager", - "text": "IDPS enabled", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", - "link": "https://learn.microsoft.com/azure/firewall/snat-private-range", + "category": "Operations", + "checklist": "Azure AKS Review", + "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", + "service": "AKS", "services": [ - "Firewall" + "Storage", + "AKS" ], - "severity": "High", - "subcategory": "Firewall Manager", - "text": "SNAT: Configured ", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones", + "waf": "Performance" }, { - "category": "Azure Firewall", - "checklist": "Azure Security Review Checklist", - "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "fda1dae2-dc95-4d48-a6c7-91dca0f6c565", + "link": "https://learn.microsoft.com/azure/synapse-analytics/sql-data-warehouse/backup-and-restore#geo-backups-and-disaster-recovery", "services": [ - "DDoS", - "Firewall" + "Backup" ], "severity": "Medium", - "subcategory": "DDOS Protection", - "text": "Enabled for Firewall public IP's", - "waf": "Security" - }, - { - "category": "BC and DR", - "checklist": "Device Provisioning Service Review", - "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", - "service": "IoT Hub DPS", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Select the right Logic App hosting plan based on your business & SLO requirements", + "subcategory": "Backup", + "text": "Enable Geo Backup ", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Device Provisioning Service Review", - "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "IoT Hub DPS", + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "89e558b9-37d4-4974-b111-2dbd7baf12e7", + "link": "https://techcommunity.microsoft.com/t5/azure-synapse-analytics-blog/how-to-use-ci-cd-integration-to-automate-the-deploy-of-a-synapse/ba-p/2248060", "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Protect logic apps from region failures with zone redundancy and availability zones", + "severity": "Medium", + "subcategory": "DevOps", + "text": "Integrate with Azure DevOps to deploy Multiple environments", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Device Provisioning Service Review", - "guid": "8aed4fbf-0830-4883-899d-222a154af478", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "IoT Hub DPS", + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "b94ef6e0-47d2-4da2-a82b-1cd6d2f54b29", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", "services": [], "severity": "High", - "subcategory": "High Availability", - "text": "Consider a Cross-Region DR strategy for critical workloads", + "subcategory": "DR", + "text": "BCDR for Azure Synapse pipelines ", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Device Provisioning Service Review", - "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "IoT Hub DPS", - "services": [ - "AppSvc" - ], + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "769e3a69-1e88-438a-a936-667e13c00567", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "services": [], "severity": "High", - "subcategory": "High Availability", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "subcategory": "DR", + "text": "Use Zone Redudant pipelines in regions supporting Availablity Zones", "waf": "Reliability" }, { - "category": "Application Deployment", - "checklist": "Device Provisioning Service Review", - "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "IoT Hub DPS", + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "4b1e944a-4598-437e-b7ad-6c6d3b365a5c", + "link": "https://learn.microsoft.com/azure/synapse-analytics/cicd/source-control", "services": [], - "severity": "Medium", - "subcategory": "CI/CD", - "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", - "waf": "Operations" - }, - { - "category": "Business", - "checklist": "Multitenant architecture", - "guid": "41177955-fe8f-430b-ae72-20dc5b6880da", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/overview", - "services": [ - "Entra" - ], - "severity": "High", - "subcategory": "Business", - "text": "Understand what kind of solution you're creating, such as business-to-business (B2B), business-to-consumer (B2C), or your enterprise software, and how tenants are different from users.", - "waf": "Operations" + "severity": "Low", + "subcategory": "DevOps", + "text": "Create Scripts for all DLL Statements and save in Git Repository ", + "waf": "Reliability" }, { - "category": "Business", - "checklist": "Multitenant architecture", - "guid": "2d33d1b7-697c-49f9-b944-afbeac0b2c8f", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "7acbe48a-be54-4cd7-af2e-87768358c559", + "link": "https://learn.microsoft.com/azure/synapse-analytics/spark/apache-spark-development-using-notebooks", "services": [], - "severity": "High", - "subcategory": "Business", - "text": "Define your tenants. Understand how many tenants you will support initially, and your growth plans.", - "waf": "Operations" - }, - { - "category": "Business", - "checklist": "Multitenant architecture", - "guid": "a2111b8b-cc66-4aa2-9da6-c09fa23851b6", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models", + "severity": "Low", + "subcategory": "DevOps", + "text": "When working with Spark Notebooks, make sure to integrate with Git or Azure DevOps", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "775c6ee9-5b86-4ad8-a44c-e3b2b38b875b", + "link": "https://learn.microsoft.com/azure/synapse-analytics/sql-data-warehouse/backup-and-restore", "services": [], - "severity": "High", - "subcategory": "Business", - "text": "Define your pricing model and ensure it aligns with your tenants' consumption of Azure resources.", - "waf": "Cost" + "severity": "Medium", + "subcategory": "High Availablity", + "text": "Use Dedicated pools", + "waf": "Reliability" }, { - "category": "Business", - "checklist": "Multitenant architecture", - "guid": "331e84a6-2d65-4359-92ff-a1870b062995", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models", + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "a1cf2049-9013-4a5d-9ce4-74dbcbd8682a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/analytics/azure-synapse", "services": [], "severity": "Medium", - "subcategory": "Business", - "text": "Understand whether you need to separate your tenants into different tiers. Tiers might have different pricing, features, performance promises, geographic locations, and so forth.", - "waf": "Operations" + "subcategory": "DR", + "text": "Use Database restore points for Azure Synapse", + "waf": "Reliability" }, { - "category": "Business", - "checklist": "Multitenant architecture", - "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "6abca2a4-fda1-4dae-8dc9-5d48c6c791dc", + "link": "https://learn.microsoft.com/azure/synapse-analytics/sql/on-demand-workspace-overview", "services": [], "severity": "Medium", - "subcategory": "Business", - "text": "Based on your customers' requirements, decide on the tenancy models that are appropriate for various parts of your solution.", - "waf": "Operations" + "subcategory": "High Availablity", + "text": "Use Serverless Pools when required", + "waf": "Reliability" }, { - "category": "Business", - "checklist": "Multitenant architecture", - "guid": "f5d76ae1-7048-4ff5-abba-f1ca799578b9", - "link": "https://learn.microsoft.com/azure/marketplace/plan-saas-offer", + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "a0f6c565-89e5-458b-a37d-4974e1112dbd", + "link": "https://learn.microsoft.com/azure/synapse-analytics/quickstart-deployment-template-workspaces", "services": [ - "Entra" + "Storage" ], "severity": "Medium", - "subcategory": "Business", - "text": "When you're ready, sell your B2B multitenant solution using the Microsoft Commercial Marketplace.", - "waf": "Operations" - }, - { - "category": "Reliability", - "checklist": "Multitenant architecture", - "guid": "9e7cedd9-1e05-4aeb-a7b3-01fe695a394c", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/design-checklist", - "services": [], - "severity": "High", - "subcategory": "Reliability", - "text": "Review the Azure Well-Architected Reliability checklist, which is applicable to all workloads.", + "subcategory": "DevOps", + "text": "Use Infrastructure as a Code template to do repeatable deployments", "waf": "Reliability" }, { - "category": "Reliability", - "checklist": "Multitenant architecture", - "guid": "e9521a55-2a7c-425c-8f3e-c38fd0c4df75", - "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor", + "category": "Operations Management", + "checklist": "Azure Synapse Review Checklist", + "guid": "7baf12e7-b94e-4f6e-847d-2da2982b1cd6", + "link": "https://learn.microsoft.com/azure/cosmos-db/synapse-link", "services": [], - "severity": "High", - "subcategory": "Reliability", - "text": "Understand the Noisy Neighbor antipattern. Prevent individual tenants from impacting the system's availability for other tenants.", + "severity": "Medium", + "subcategory": "High Availablity", + "text": "Make sure to re-eshtablish any Synapse Links", + "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", "waf": "Reliability" }, { - "category": "Reliability", - "checklist": "Multitenant architecture", - "guid": "2b99cb00-9abb-49b6-b11c-f2af9692f09e", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/overview", - "services": [], + "category": "Governance", + "checklist": "Azure API Management Review", + "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", + "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", + "service": "APIM", + "services": [ + "APIM", + "AzurePolicy" + ], "severity": "Medium", - "subcategory": "Reliability", - "text": "Design your multitenant solution for the level of growth that you expect. But don't overengineer for unrealistic growth.", - "waf": "Reliability" + "subcategory": "Development best practices", + "text": "Implement an error handling policy at the global level", + "waf": "Operations" }, { - "category": "Reliability", - "checklist": "Multitenant architecture", - "guid": "7a634a0e-1c9d-42b1-aac2-5a5378f103f1", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/business-metrics", - "services": [], + "category": "Governance", + "checklist": "Azure API Management Review", + "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", + "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", + "service": "APIM", + "services": [ + "APIM", + "AzurePolicy" + ], "severity": "Medium", - "subcategory": "Reliability", - "text": "Define service-level objectives (SLOs) and optionally service-level agreements (SLAs) for your solution. SLAs and SLOs should be based on the requirements of your tenants, as well as the composite SLA of the Azure resources in your architecture.", - "waf": "Reliability" + "subcategory": "Development best practices", + "text": "Ensure all APIs policies include a element.", + "waf": "Operations" }, { - "category": "Reliability", - "checklist": "Multitenant architecture", - "guid": "45beeeaf-fc59-4079-8fca-65d5724abaa7", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute", - "services": [], - "severity": "High", - "subcategory": "Reliability", - "text": "Test the scale of your solution. Ensure that it performs well under all levels of load, and that it scales correctly as the number of tenants increases.", - "waf": "Reliability" + "category": "Governance", + "checklist": "Azure API Management Review", + "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", + "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", + "service": "APIM", + "services": [ + "ACR", + "APIM", + "AzurePolicy" + ], + "severity": "Medium", + "subcategory": "Development best practices", + "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs", + "waf": "Operations" }, { - "category": "Reliability", - "checklist": "Multitenant architecture", - "guid": "2ff55551-984b-4606-95eb-bfb9c8b36761", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute", - "services": [], + "category": "Governance", + "checklist": "Azure API Management Review", + "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", + "link": "https://learn.microsoft.com/azure/api-management/monetization-support", + "service": "APIM", + "services": [ + "APIM" + ], "severity": "Medium", - "subcategory": "Reliability", - "text": "Apply chaos engineering principles to test the reliability of your solution.", - "waf": "Reliability" + "subcategory": "Monetization", + "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Multitenant architecture", - "guid": "8238c038-8eb2-4a02-8bd5-4908c9442c1c", - "link": "https://learn.microsoft.com/security/zero-trust", - "services": [], + "category": "Governance", + "checklist": "Azure API Management Review", + "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", + "service": "APIM", + "services": [ + "Monitor", + "APIM" + ], "severity": "High", - "subcategory": "Security", - "text": "Apply the Zero Trust and least privilege principles in all layers of your solution.", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Enable Diagnostics Settings to export logs to Azure Monitor", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Multitenant architecture", - "guid": "92160e00-6894-4102-97e0-615d4ed93c01", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/map-requests", + "category": "Governance", + "checklist": "Azure API Management Review", + "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", + "service": "APIM", "services": [ - "Entra" + "Monitor", + "APIM" ], - "severity": "High", - "subcategory": "Security", - "text": "Ensure that you can correctly map user requests to tenants. Consider including the tenant context as part of the identity system, or by using another means, like application-level tenant authorization.", - "waf": "Security" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Enable Application Insights for more detailed telemetry", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Multitenant architecture", - "guid": "3c1538b4-5676-4b85-b451-432befb37b4f", - "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", - "services": [], - "severity": "Medium", - "subcategory": "Security", - "text": "Perform ongoing penetration testing and security code reviews.", - "waf": "Security" + "category": "Governance", + "checklist": "Azure API Management Review", + "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", + "service": "APIM", + "services": [ + "Monitor", + "APIM" + ], + "severity": "High", + "subcategory": "Monitoring", + "text": "Configure alerts on the most critical metrics", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Multitenant architecture", - "guid": "5fca45ce-cf2d-42c0-a62c-aac92ba31498", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/governance-compliance", - "services": [], + "category": "Identity and Access Management", + "checklist": "Azure API Management Review", + "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", + "service": "APIM", + "services": [ + "Entra", + "APIM", + "AKV" + ], "severity": "High", - "subcategory": "Security", - "text": "Understand your tenants' compliance requirements, including data residency and any compliance or regulatory standards that they require you to meet.", + "subcategory": "Data protection", + "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated", "waf": "Security" }, { - "category": "Security", - "checklist": "Multitenant architecture", - "guid": "30adb90d-83d4-4a2e-986e-327ffe04e7a5", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/domain-names", + "category": "Identity and Access Management", + "checklist": "Azure API Management Review", + "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", + "service": "APIM", "services": [ - "DNS" + "Entra", + "APIM" ], "severity": "High", - "subcategory": "Security", - "text": "Correctly manage domain names and avoid vulnerabilities like dangling DNS and subdomain takeover attacks.", + "subcategory": "Identity", + "text": "Protect incoming requests to APIs (data plane) with Azure AD", "waf": "Security" }, { - "category": "Security", - "checklist": "Multitenant architecture", - "guid": "72ded36d-c633-4e0d-bd41-799a29da3481", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/overview", - "services": [], + "category": "Identity and Access Management", + "checklist": "Azure API Management Review", + "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", + "service": "APIM", + "services": [ + "Entra", + "APIM" + ], "severity": "Medium", - "subcategory": "Security", - "text": "Follow service-specific guidance for multitenancy.", + "subcategory": "Identity", + "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal", "waf": "Security" }, { - "category": "Cost Optimization", - "checklist": "Multitenant architecture", - "guid": "db30a9fc-9b1d-40f3-ab90-01f6a3e87fc8", - "link": "https://learn.microsoft.com/azure/architecture/framework/cost/design-checklist", + "category": "Identity and Access Management", + "checklist": "Azure API Management Review", + "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", + "service": "APIM", "services": [ - "Cost" + "Entra", + "APIM" ], "severity": "Medium", - "subcategory": "Cost Optimization", - "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.", - "waf": "Cost" + "subcategory": "Privileged access", + "text": "Create appropriate groups to control the visibility of the products", + "waf": "Security" }, { - "category": "Cost Optimization", - "checklist": "Multitenant architecture", - "guid": "8533af39-52f6-45b6-a9c3-81b2a54a31e0", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/measure-consumption", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "06862505-2d9a-4874-9491-2837b00a3475", + "link": "https://learn.microsoft.com/azure/api-management/backends", + "service": "APIM", "services": [ - "Cost" + "APIM" ], - "severity": "High", - "subcategory": "Cost Optimization", - "text": "Ensure you can adequately measure per-tenant consumption and correlate it with your infrastructure costs.", - "waf": "Cost" + "severity": "Medium", + "subcategory": "Best practices", + "text": "Use Backends feature to eliminate redundant API backend configurations", + "waf": "Operations" }, { - "category": "Cost Optimization", - "checklist": "Multitenant architecture", - "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", + "service": "APIM", "services": [ - "Cost", - "Monitor" + "APIM", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Cost Optimization", - "text": "Avoid antipatterns. Antipatterns include failing to track costs, tracking costs with unnecessary precision, real-time measurement, and using monitoring tools for billing.", - "waf": "Cost" - }, - { - "category": "Operational Excellence", - "checklist": "Multitenant architecture", - "guid": "0d475a5a-2c0f-47ab-b1e1-701da68d3407", - "link": "https://learn.microsoft.com/azure/architecture/checklist/data-ops", - "services": [], - "severity": "High", - "subcategory": "Operational Excellence", - "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.", + "subcategory": "Best practices", + "text": "Use Named Values to store common values that can be used in policies", "waf": "Operations" }, { - "category": "Operational Excellence", - "checklist": "Multitenant architecture", - "guid": "9f7fa7a9-47fc-4f04-81f6-9f9e87571ed3", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenant-lifecycle", - "services": [], + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", + "service": "APIM", + "services": [ + "ASR", + "ACR", + "APIM" + ], "severity": "Medium", - "subcategory": "Operational Excellence", - "text": "Use automation to manage the tenant lifecycle, such as onboarding, deployment, provisioning, and configuration.", - "waf": "Operations" + "subcategory": "Business continuity and disaster recovery", + "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA", + "waf": "Reliability" }, { - "category": "Operational Excellence", - "checklist": "Multitenant architecture", - "guid": "e0bfceed-4f4e-492d-b9f5-898815faa363", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/updates", - "services": [], + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", + "link": "https://learn.microsoft.com/azure/api-management/high-availability", + "service": "APIM", + "services": [ + "ASR", + "APIM" + ], "severity": "Medium", - "subcategory": "Operational Excellence", - "text": "Find the right balance for deploying service updates. Consider both your tenants' requirements and your own operational requirements.", - "waf": "Operations" + "subcategory": "Business continuity and disaster recovery", + "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%", + "waf": "Reliability" }, { - "category": "Operational Excellence", - "checklist": "Multitenant architecture", - "guid": "a3f80518-d428-4c02-b2cc-dfaef47db7e2", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", + "service": "APIM", "services": [ - "Monitor" + "ASR", + "APIM", + "Backup" ], "severity": "High", - "subcategory": "Operational Excellence", - "text": "Monitor the health of the overall system, as well as each tenant.", - "waf": "Operations" + "subcategory": "Business continuity and disaster recovery", + "text": "Ensure there is an automated backup routine", + "waf": "Reliability" }, { - "category": "Operational Excellence", - "checklist": "Multitenant architecture", - "guid": "dfb42da5-f871-4953-9e5c-da6fda3f1411", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", + "link": "https://learn.microsoft.com/azure/api-management/retry-policy", + "service": "APIM", "services": [ - "Monitor" + "APIM", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Operational Excellence", - "text": "Configure and test alerts to notify you when specific tenants are experiencing issues or are exceeding their consumption limits.", - "waf": "Operations" + "subcategory": "Failover and Caching", + "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.", + "waf": "Reliability" }, { - "category": "Operational Excellence", - "checklist": "Multitenant architecture", - "guid": "c0c72a1b-e34d-4b3d-b808-2e49f51ce47e", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization", - "services": [], - "severity": "High", - "subcategory": "Operational Excellence", - "text": "Organize your Azure resources for isolation and scale.", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external", + "services": [ + "APIM", + "AzurePolicy" + ], + "severity": "Medium", + "subcategory": "Performance and scalability", + "text": "Consider using a external cache policy for APIs that can benefit from caching", + "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/" + }, + { + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", + "service": "APIM", + "services": [ + "EventHubs", + "APIM", + "AzurePolicy" + ], + "severity": "Low", + "subcategory": "Performance and scalability", + "text": "If you need to log at high performance levels, consider Event Hubs policy", "waf": "Operations" }, { - "category": "Operational Excellence", - "checklist": "Multitenant architecture", - "guid": "c5c5e22d-4b51-4cac-a980-f7aac1a4b427", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/deployment-configuration", - "services": [], + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", + "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", + "service": "APIM", + "services": [ + "APIM", + "AzurePolicy" + ], "severity": "Medium", - "subcategory": "Operational Excellence", - "text": "Avoid deployment and configuration antipatterns. Antipatterns include running separate versions of the solution for each tenant, hardcoding tenant-specific configurations or logic, and manual deployments.", - "waf": "Operations" + "subcategory": "Performance and scalability", + "text": "Apply throttling policies to control the number of requests per second", + "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", + "waf": "Performance" }, { - "category": "Performance Efficiency", - "checklist": "Multitenant architecture", - "guid": "f0b1fbd8-689c-4ab3-be1d-ad7607d2fbfd", - "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/performance-efficiency", - "services": [], - "severity": "High", - "subcategory": "Performance Efficiency", - "text": "Review the Azure Well-Architected Performance Efficiency checklist, which is applicable to all workloads.", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", + "service": "APIM", + "services": [ + "APIM" + ], + "severity": "Medium", + "subcategory": "Performance and scalability", + "text": "Configure autoscaling to scale out the number of instances when the load increases", "waf": "Performance" }, { - "category": "Performance Efficiency", - "checklist": "Multitenant architecture", - "guid": "18911c4c-934c-49a8-839a-60c092afce30", - "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor", - "services": [], - "severity": "High", - "subcategory": "Performance Efficiency", - "text": "If you use shared infrastructure, plan for how you'll mitigate Noisy Neighbor concerns. Ensure that one tenant can't reduce the performance of the system for other tenants.", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", + "service": "APIM", + "services": [ + "APIM" + ], + "severity": "Medium", + "subcategory": "Performance and scalability", + "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.", "waf": "Performance" }, { - "category": "Performance Efficiency", - "checklist": "Multitenant architecture", - "guid": "6acf7eb5-24a3-47c7-ae87-1196cd96048e", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", + "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", + "service": "APIM", "services": [ - "Storage" + "APIM" ], "severity": "Medium", - "subcategory": "Performance Efficiency", - "text": "Determine how you'll scale your compute, storage, networking, and other Azure resources to match the demands of your tenants.", - "waf": "Performance" + "subcategory": "Premium Tier", + "text": "Use the premium tier for production workloads.", + "waf": "Reliability" }, { - "category": "Performance Efficiency", - "checklist": "Multitenant architecture", - "guid": "ea55400d-f97d-45aa-b71b-34224bf91ed4", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization", - "services": [], - "severity": "High", - "subcategory": "Performance Efficiency", - "text": "Consider each Azure resource's scale limits. Organize your resources appropriately, in order to avoid resource organization antipatterns. For example, don't over-architect your solution to work within unrealistic scale requirements.", - "waf": "Performance" + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", + "service": "APIM", + "services": [ + "APIM", + "AzurePolicy" + ], + "severity": "Medium", + "subcategory": "Request Routing", + "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Arc Review", - "description": "Define a resource group structure for placement of Azure Arc-enabled servers resources", - "guid": "585e1112-9bd7-4ba0-82f7-b94ef6e043d2", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", + "service": "APIM", "services": [ - "Arc" + "Entra", + "APIM" ], "severity": "High", - "subcategory": "Capacity Planning", - "text": "One or more resource groups is required for onboarding servers into Azure", - "waf": "Operations" + "subcategory": "Resource Limits", + "text": "Be aware of APIM's limits", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Arc Review", - "guid": "aa359271-8e6e-4205-8725-769e46691e88", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits", + "category": "Management", + "checklist": "Azure API Management Review", + "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", + "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", + "service": "APIM", "services": [ - "Arc", - "Entra" + "APIM" ], - "severity": "Medium", - "subcategory": "Capacity Planning", - "text": "Take Azure Active Directory object limitations into account", - "waf": "Performance" + "severity": "High", + "subcategory": "Self-Hosted", + "text": "Ensure that the self-hosted gateway deployments are resilient.", + "waf": "Reliability" }, { - "category": "Foundation", - "checklist": "Azure Arc Review", - "description": "The following resource providers needs to be registered: Microsoft.HybridCompute, Microsoft.GuestConfiguration, Microsoft.HybridConnectivity", - "guid": "deace4bb-1deb-44c6-9fc3-fc14eeaa3692", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-resource-providers", + "category": "Network Topology and Connectivity", + "checklist": "Azure API Management Review", + "guid": "7519e385-a88b-4d34-966b-6269d686e890", + "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", + "service": "APIM", "services": [ - "Arc", - "Subscriptions" + "Entra", + "APIM", + "FrontDoor" ], - "severity": "High", - "subcategory": "General", - "text": "Has the Resource providers required been registered in all subscriptions", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Connectivity", + "text": "Use Azure Front Door in front of APIM for multi-region deployment", + "waf": "Performance" }, { - "category": "Foundation", - "checklist": "Azure Arc Review", - "description": "Aligning with an existing or creating an Azure tagging strategy is recommended. Resource tags allow you to quickly locate it, automate operational tasks amd more. ", - "guid": "c6d37331-65c7-4acb-b44b-be609d79f2e8", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/", + "category": "Network Topology and Connectivity", + "checklist": "Azure API Management Review", + "guid": "cd45c90e-7690-4753-930b-bf290c69c074", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", + "service": "APIM", "services": [ - "Arc" + "VNet", + "APIM" ], - "severity": "Low", - "subcategory": "General", - "text": "Has a tagging strategy for Azure Arc-enabled servers been defined", - "waf": "Cost" + "severity": "Medium", + "subcategory": "Security", + "text": "Deploy the service within a Virtual Network (VNet)", + "waf": "Security" }, { - "category": "Foundation", - "checklist": "Azure Arc Review", - "description": "Installation of the connected machine agent is supported on most newer Windows and Linux operative systems, review the link to se the latest list", - "guid": "7778424c-5167-475c-9fa9-5b96ad88408e", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#supported-operating-systems", + "category": "Network Topology and Connectivity", + "checklist": "Azure API Management Review", + "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", + "service": "APIM", "services": [ - "Arc" + "VNet", + "Entra", + "Monitor", + "APIM" ], - "severity": "High", - "subcategory": "General", - "text": "What operating systems need to be Azure Arc-enabled", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Security", + "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.", + "waf": "Security" }, { - "category": "Foundation", - "checklist": "Azure Arc Review", - "description": "There are software requirements to the agent installation. Some might require a system reboot after installation, review to link", - "guid": "372734b8-76ba-428f-8145-901365d38e53", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#software-requirements", + "category": "Network Topology and Connectivity", + "checklist": "Azure API Management Review", + "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", + "service": "APIM", "services": [ - "Arc" + "VNet", + "Entra", + "APIM", + "PrivateLink" ], - "severity": "High", - "subcategory": "General", - "text": "Are required software installed on Windows and Linux servers to support the installation", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Security", + "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.", + "waf": "Security" }, { - "category": "Foundation", - "checklist": "Azure Arc Review", - "guid": "d44c7c89-19ca-41f6-b521-5ae514ba34d4", - "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/?products=azure-arc®ions=all", + "category": "Network Topology and Connectivity", + "checklist": "Azure API Management Review", + "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", + "service": "APIM", "services": [ - "Arc" + "APIM" ], "severity": "High", - "subcategory": "General", - "text": "Make sure to use a supported Azure region", - "waf": "Reliability" + "subcategory": "Security", + "text": "Disable Public Network Access", + "waf": "Security" }, { - "category": "Foundation", - "checklist": "Azure Arc Review", - "description": "The scope include organization into management groups, subscriptions, and resource groups.", - "guid": "f9ccbd86-8266-4abc-a264-f9a19bf39d95", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/organize-inventory-servers#organize-resources-with-built-in-azure-hierarchies", + "category": "Platform automation and DevOps", + "checklist": "Azure API Management Review", + "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", + "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", + "service": "APIM", "services": [ - "Arc", - "Subscriptions" + "APIM" ], - "severity": "Low", - "subcategory": "Organization", - "text": "Define the structure for Azure management of resources", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Automation", + "text": "Simplify management with PowerShell automation scripts", + "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure Arc Review", - "description": "Define RBAC rules to the servers / resource groups as required for servers management, the 'Azure Connected Machine Resource Administrator' or 'Hybrid Server Resource Administrator' role would be sufficient for management of the Azure Arc-enabled servers resources in Azure", - "guid": "9bf39d95-d44c-47c8-a19c-a1f6d5215ae5", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#identity-and-access-control", + "category": "Platform automation and DevOps", + "checklist": "Azure API Management Review", + "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", + "service": "APIM", "services": [ - "Arc", "Entra", - "RBAC" + "APIM" ], "severity": "Medium", - "subcategory": "Access", - "text": "Assign RBAC rights to Azure AD user/group access for managing Azure Arc-enabled servers", - "waf": "Security" + "subcategory": "Best practices", + "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator", + "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure Arc Review", - "guid": "14ba34d4-585e-4111-89bd-7ba012f7b94e", - "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad", + "category": "Platform automation and DevOps", + "checklist": "Azure API Management Review", + "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", + "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", + "service": "APIM", "services": [ - "Arc", "Entra", - "AKV" + "APIM" ], - "severity": "Low", - "subcategory": "Access", - "text": "Consider using managed identities for applications to access Azure resources like Key Vault example in link", - "waf": "Security" + "severity": "Medium", + "subcategory": "Best practices", + "text": "Promote usage of Visual Studio Code APIM extension for faster API development", + "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure Arc Review", - "description": "An Azure subscription must be parented to the same Azure AD tenant", - "guid": "35ac9322-23e1-4380-8523-081a94174158", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits", + "category": "Platform automation and DevOps", + "checklist": "Azure API Management Review", + "guid": "354f1c03-8112-4965-85ad-c0074bddf231", + "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", + "service": "APIM", "services": [ - "Arc", - "Entra", - "Subscriptions" + "APIM" ], - "severity": "High", - "subcategory": "Requirements", - "text": "An Azure Active Directory tenant must be available with at least one subscription", + "severity": "Medium", + "subcategory": "DevOps", + "text": "Implement DevOps and CI/CD in your workflow", "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure Arc Review", - "description": "Users (or SPs) need the 'Azure Connected Machine Onboarding' or 'Contributor' role to onboarding of servers", - "guid": "33ee7ad6-c6d3-4733-865c-7acbe44bbe60", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions", + "category": "Security", + "checklist": "Azure API Management Review", + "guid": "b6439493-426a-45f3-9697-cf65baee208d", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", + "service": "APIM", "services": [ - "Arc", - "Entra", - "RBAC" + "APIM" ], "severity": "Medium", - "subcategory": "Requirements", - "text": "Define which users (AAD user/groups) has access to onboard Azure Arc-enabled servers", + "subcategory": "APIs", + "text": "Secure APIs using client certificate authentication", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Arc Review", - "description": "Ensure to only add the rights to users or groups that is required to perform their role", - "guid": "9d79f2e8-7778-4424-a516-775c6fa95b96", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale", + "category": "Security", + "checklist": "Azure API Management Review", + "guid": "2a67d143-1033-4c0a-8732-680896478f08", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", + "service": "APIM", "services": [ - "Arc", - "Entra", - "RBAC" + "APIM" ], "severity": "Medium", - "subcategory": "Security", - "text": "Use the principle of least privileged", + "subcategory": "APIs", + "text": "Secure backend services using client certificate authentication", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Arc Review", - "description": "A service principle with the 'Azure Connected Machine Onboarding' role is required for at-scale onboarding of servers, consider more SP's if onboarding is done by different teams/decentralized management", - "guid": "ad88408e-3727-434b-a76b-a28f21459013", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale", + "category": "Security", + "checklist": "Azure API Management Review", + "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", + "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", + "service": "APIM", "services": [ - "Arc", - "Entra", - "RBAC" + "APIM" ], "severity": "Medium", - "subcategory": "Security", - "text": "How many Service Principals are needed for onboarding Arc-enabled servers into Azure", + "subcategory": "APIs", + "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure Arc Review", - "description": "Consider assigning the rights for the 'Azure Connected Machine Onboarding' role at the resource group level, to control the resource creation", - "guid": "65d38e53-f9cc-4bd8-9826-6abca264f9a1", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions", + "category": "Security", + "checklist": "Azure API Management Review", + "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", + "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", + "service": "APIM", "services": [ - "Arc", - "Entra", - "RBAC" + "APIM" ], "severity": "Medium", - "subcategory": "Security", - "text": "Limit the rights to onboard Azure Arc-enabled servers to the desired resource groups", + "subcategory": "APIs", + "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs", "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "description": "Plan for agent deployments at scale", - "guid": "6ee79d6b-5c2a-4364-a4b6-9bad38aad53c", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment", + "category": "Security", + "checklist": "Azure API Management Review", + "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", + "service": "APIM", "services": [ - "Arc", - "Monitor" + "APIM" ], - "severity": "Medium", - "subcategory": "Management", - "text": "Define a strategy for agent provisioning", - "waf": "Operations" + "severity": "High", + "subcategory": "Ciphers", + "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "description": "Use Microsoft Update to ensure that the connected machine agent is always up-to-date", - "guid": "c78e1d76-6673-457c-9496-74c5ed85b859", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#upgrade-the-agent", + "category": "Security", + "checklist": "Azure API Management Review", + "guid": "f8af3d94-1d2b-4070-846f-849197524258", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", + "service": "APIM", "services": [ - "Arc", - "Monitor" + "APIM", + "AKV" ], "severity": "High", - "subcategory": "Management", - "text": "Define a strategy for agent updates", - "waf": "Operations" + "subcategory": "Data protection", + "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "description": "Recommendation is to use Azure Policy, or another automation tool like Azure DevOps - important is to avoid configuration drift.", - "guid": "c7733be2-a1a2-47b7-95a9-1be1f388ff39", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-vm-extensions", + "category": "Security", + "checklist": "Azure API Management Review", + "guid": "791abd8b-7706-4e31-9569-afefde724be3", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", + "service": "APIM", "services": [ - "Arc", - "AzurePolicy", - "Monitor" + "Entra", + "APIM" ], "severity": "Medium", - "subcategory": "Management", - "text": "Define a strategy for extension installation", - "waf": "Operations" + "subcategory": "Identities", + "text": "Use managed identities to authenticate to other Azure resources whenever possible", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "description": "Use automatic upgrades where available and define an update strategy for all extensions not supporting automatic upgrades.", - "guid": "4c2bd463-cbbb-4c86-a195-abb91a4ed90d", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-automatic-vm-extension-upgrade?tabs=azure-portal", + "category": "Security", + "checklist": "Azure API Management Review", + "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", + "service": "APIM", "services": [ - "Arc", - "Monitor" + "Entra", + "APIM", + "WAF", + "AppGW" ], "severity": "High", - "subcategory": "Management", - "text": "Define a strategy for extension updates", - "waf": "Operations" + "subcategory": "Network", + "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "description": "Azure Automanage help implement Microsoft best-practices for servers management in Azure", - "guid": "7a927c39-74d1-4102-aac6-aae01e6a84de", - "link": "https://learn.microsoft.com/azure/automanage/automanage-arc", + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "9f519499-5820-4060-88fe-cab4538c9dd0", + "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/storage-spaces-direct-hardware-requirements", "services": [ - "Arc", - "Monitor" + "Storage" ], "severity": "Medium", - "subcategory": "Management", - "text": "Consider using Azure Automanage to control settings and avoid configuration drift on servers", - "waf": "Operations" + "subcategory": "Physical", + "text": "All planned storage pools should use direct-attached storage (SATA, SAS, NVMe)", + "waf": "Performance" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "guid": "37b6b780-cbaf-4e6c-9658-9d457a927c39", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate", + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "f7c015e0-7d97-4283-b006-567afeb2b5ca", + "link": "https://learn.microsoft.com/azure-stack/hci/concepts/drive-symmetry-considerations#understand-capacity-imbalance", "services": [ - "Arc", - "Monitor" + "Storage", + "ACR" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Monitor for unresponsive agents", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Physical", + "text": "Disks are symmetrical across all nodes", + "waf": "Performance" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "guid": "74d1102c-ac6a-4ae0-8e6a-84de5df47d2d", - "link": "https://learn.microsoft.com/azure/azure-monitor/agents/log-analytics-agent#data-collected", + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "f785b143-2c1e-4466-9baa-dde8ba4c7aaa", + "link": "https://learn.microsoft.com/azure-stack/hci/concepts/fault-tolerance#parity", "services": [ - "Arc", - "Monitor" + "Storage", + "Backup" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Design a monitoring strategy to send metrics and logs to an Log Analytics workspace", - "waf": "Operations" + "subcategory": "S2D", + "text": "Parity type disk redundancy should only be used for low I/O volumes (backup/archive)", + "waf": "Performance" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "guid": "92881b1c-d5d1-4e54-a296-59e3958fd782", - "link": "https://learn.microsoft.com/azure/service-health/resource-health-alert-monitor-guide", + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "8a705965-9840-43cc-93b3-06d089406bb4", + "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/storage-spaces-direct-hardware-requirements#physical-deployments", + "services": [ + "Storage" + ], + "severity": "Medium", + "subcategory": "S2D", + "text": "Ensure there at least 2 capacity disks with available capacity in the Storage Pool", + "waf": "Reliability" + }, + { + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "2a4f629a-d623-4610-a8e3-d6fd66057d8e", + "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/delimit-volume-allocation", + "services": [ + "Storage" + ], + "severity": "Low", + "subcategory": "S2D", + "text": "'Delimited allocation' has been considered to improve volume resiliency in a multi-node failure", + "waf": "Reliability" + }, + { + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "960eb9be-1f0f-4fc1-9b31-fcf1cf9e34e6", + "link": "https://learn.microsoft.com/azure-stack/hci/concepts/plan-volumes#choosing-how-many-volumes-to-create", "services": [ - "Arc", - "Monitor" + "Storage" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use notification in Activity logs to receive notification on unexpected changes to the resources", - "waf": "Operations" + "subcategory": "S2D", + "text": "CSVs are created in multiples of node count", + "waf": "Performance" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "guid": "89c93555-6d02-4bfe-9564-b0d834a34872", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/learn/tutorial-enable-vm-insights", + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "859ba2b9-a3a8-4ca1-bb61-165effbf1c03", + "link": "https://learn.microsoft.com/azure-stack/hci/concepts/cache", "services": [ - "Arc", - "Monitor" + "Storage" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use Azure Monitor for compliance and operational monitoring", - "waf": "Operations" + "subcategory": "S2D", + "text": "If a cache tier is implemented, the number of capacity drives is a multiple of the number of cache drives", + "waf": "Performance" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "guid": "5df47d2d-9288-41b1-ad5d-1e54a29659e3", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate", + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "d8a65f05-db06-461d-81dc-7899ad3f8f1e", + "link": "https://learn.microsoft.com/azure-stack/hci/concepts/plan-volumes#reserve-capacity", "services": [ - "Arc", - "Monitor" + "Storage" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Create an alert to identify Azure Arc-enabled servers that aren't using the latest version of the Azure connected machine agent", - "waf": "Operations" + "subcategory": "S2D", + "text": "A minimum of 1 type of each disk type per node has been factored as a reserve disk", + "waf": "Reliability" }, { - "category": "Management and Monitoring", - "checklist": "Azure Arc Review", - "description": "Use Update Management in Azure Automation or the new Update Management Center (preview) functionality to ensure update management of servers", - "guid": "ae2cc84c-37b6-4b78-8cba-fe6c46589d45", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-update-management", + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "description": "VMFleet is a tool that can be used to measure the performance of a storage subsystem, best used to baseline performance prior to workload deployment", + "guid": "9d138f1d-5363-476e-bbd7-acfa500bdc0c", + "link": "https://github.com/microsoft/diskspd/wiki/VMFleet", "services": [ - "Arc", - "Monitor" + "Storage" ], "severity": "Low", - "subcategory": "Security", - "text": "Use Azure Arc-enabled servers to control software updates deployments to servers", - "waf": "Operations" + "subcategory": "S2D", + "text": "VMFleet has been run prior to workload deployment to baseline storage performance", + "waf": "Performance" }, { - "category": "Networking", - "checklist": "Azure Arc Review", - "description": "The Connected Machine Agent will by default communicate with Azure services over public Internet connectivity using HTTPS (TCP port 443)", - "guid": "f6e043d2-aa35-4927-88e6-e2050725769e", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#details", + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "13c12e2a-c938-4dd1-9223-507d5e17f9c5", "services": [ - "Arc" + "Storage" ], - "severity": "High", - "subcategory": "Networking", - "text": "Define a connectivity method from the server to Azure", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Host OS", + "text": "OS drives use a dedicated storage controller", + "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure Arc Review", - "description": "The Connected Machine Agent can be configured to use a proxy server, it is recommended to define the proxy server address using 'azcmagent config set proxy.url' command on the local system.", - "guid": "46691e88-35ac-4932-823e-13800523081a", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#update-or-remove-proxy-settings", + "category": "Storage", + "checklist": "Azure Stack HCI Review", + "guid": "a631e7dc-8879-45bd-b0a7-e5927b805428", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/use-csv-cache", "services": [ - "Arc" + "Storage" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Is a proxy server a required for communication over the Public Internet", - "waf": "Operations" + "subcategory": "Host OS", + "text": "CSV in-memory read caching is enabled and properly configured", + "waf": "Performance" }, { "category": "Networking", - "checklist": "Azure Arc Review", - "description": "The Connected Machine Agent can use a Private Link for communication with Azure Services over an existing ExpressRoute or VPN connection", - "guid": "94174158-33ee-47ad-9c6d-3733165c7acb", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/private-link-security", + "checklist": "Azure Stack HCI Review", + "guid": "c062cd9a-f1db-4f83-aab3-9cb03f56c140", + "link": "https://learn.microsoft.com/azure-stack/hci/concepts/host-network-requirements#switch-embedded-teaming-set", "services": [ - "Arc", - "ExpressRoute", - "PrivateLink", - "VPN" + "ACR" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Is a private (not public Internet) connection required?", - "waf": "Operations" + "subcategory": "Host", + "text": "NICs are symmetrical across nodes", + "waf": "Reliability" }, { "category": "Networking", - "checklist": "Azure Arc Review", - "description": "Firewall configuration might be required for the agent to communicate with Azure, use the link to see ServiceTags and/or URL's required", - "guid": "e44bbe60-9d79-4f2e-a777-8424c516775c", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#service-tags", + "checklist": "Azure Stack HCI Review", + "guid": "ea8054db-a558-4533-80c8-5d9cf447ba19", "services": [ - "Arc" + "Storage" ], "severity": "High", - "subcategory": "Networking", - "text": "Will Firewall configurations be needed in order to ensure communication with Azure Services?", - "waf": "Security" + "subcategory": "Host", + "text": "Storage networking is redundant", + "waf": "Reliability" }, { "category": "Networking", - "checklist": "Azure Arc Review", - "description": "Use available automation tool for the system in question to regularly update the Azure endpoints", - "guid": "6fa95b96-ad88-4408-b372-734b876ba28f", - "link": "https://www.microsoft.com/download/details.aspx?id=56519", - "services": [ - "Arc" - ], - "severity": "Low", - "subcategory": "Networking", - "text": "Can the Firewall or Proxy rules be automated updated if Service Tags or IP addresses change", - "waf": "Security" + "checklist": "Azure Stack HCI Review", + "guid": "15d976c5-e267-49a1-8b00-62010bfa5188", + "link": "https://learn.microsoft.com/azure-stack/hci/deploy/network-atc", + "services": [], + "severity": "Medium", + "subcategory": "Host", + "text": "Host networking configuration is managed by Network ATC and intents are healthy", + "waf": "Reliability" }, { "category": "Networking", - "checklist": "Azure Arc Review", - "description": "Configure Servers to use Transport Layer Security (TLS) version 1.2", - "guid": "21459013-65d3-48e5-9f9c-cbd868266abc", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#transport-layer-security-12-protocol", - "services": [ - "Arc" - ], - "severity": "High", - "subcategory": "Networking", - "text": "Always use secure communication for Azure where possible", - "waf": "Security" + "checklist": "Azure Stack HCI Review", + "guid": "676c53ad-b29a-4de1-9d03-d7d2674405b8", + "link": "https://learn.microsoft.com/azure-stack/hci/concepts/network-hud-overview", + "services": [], + "severity": "Low", + "subcategory": "Host", + "text": "Network HUD has been configured", + "waf": "Reliability" }, { "category": "Networking", - "checklist": "Azure Arc Review", - "description": "All extensions (like log analytics etc.) have separate network requirements, be sure to include all in the network design.", - "guid": "a264f9a1-9bf3-49d9-9d44-c7c8919ca1f6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/hybrid/arc-enabled-servers/eslz-arc-servers-connectivity#define-extensions-connectivity-method", + "checklist": "Azure Stack HCI Review", + "guid": "8f6d58d9-6c1a-4ec1-b2d7-b2c6ba8f3949", + "link": "https://learn.microsoft.com/azure-stack/hci/concepts/host-network-requirements", "services": [ - "Arc", - "PrivateLink", - "Monitor" + "Storage", + "VNet" ], - "severity": "Low", - "subcategory": "Networking", - "text": "Include communication for Azure Arc-enabled Servers extensions in the design (firewall/proxy/private link)", - "waf": "Security" + "severity": "Medium", + "subcategory": "Host", + "text": "Storage NICs are assigned static IP addresses on separate subnets and VLANs", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "guid": "ac6aae01-e6a8-44de-9df4-7d2d92881b1c", - "link": "https://learn.microsoft.com/azure/governance/policy/", - "services": [ - "Arc", - "AzurePolicy" - ], + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "guid": "824e53ec-953e-40c2-a6b8-52970b5b0f74", + "link": "https://learn.microsoft.com/azure-stack/hci/plan/two-node-switched-converged", + "services": [], "severity": "Medium", - "subcategory": "Management", - "text": "Use Azure Policy to implement a governance model for hybrid connected servers", - "waf": "Security" + "subcategory": "Host", + "text": "For switchless designs, dual link full mesh connectivity has been implemented", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "guid": "5c2a3649-4b69-4bad-98aa-d53cc78e1d76", - "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "guid": "dbc85d0e-0ebd-4589-a789-0fa8ceb1d0f0", + "link": "https://learn.microsoft.com/azure-stack/hci/concepts/physical-network-requirements#using-switchless", "services": [ - "Arc" + "Storage" ], "severity": "Medium", - "subcategory": "Management", - "text": "Consider using Machine configurations for in guest OS configurations", - "waf": "Operations" + "subcategory": "Host", + "text": "If the cluster is made up of more than 3 nodes, a switched storage network has been implemented", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "guid": "667357c4-4967-44c5-bd85-b859c7733be2", - "link": "https://learn.microsoft.com/azure/governance/machine-configuration/machine-configuration-create", + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "guid": "603c6d71-59d2-419c-a312-8edc6e799c6a", "services": [ - "Arc", - "AzurePolicy" + "Storage" ], - "severity": "Medium", - "subcategory": "Management", - "text": "Evaluate the need for custom Guest Configuration policies", - "waf": "Operations" + "severity": "High", + "subcategory": "Host", + "text": "RDMA is enabled on the Storage networking", + "waf": "Performance" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "guid": "49674c5e-d85b-4859-a773-3be2a1a27b77", - "link": "https://learn.microsoft.com/azure/automation/change-tracking/overview", - "services": [ - "Arc", - "Monitor" - ], + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "guid": "9e260eae-bca1-4827-a259-76ee63fda8d6", + "link": "https://github.com/microsoft/SDN/blob/master/Diagnostics/Test-Rdma.ps1", + "services": [], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Consider using change tracking for tracking changes made on the servers", - "waf": "Operations" + "subcategory": "Host", + "text": "Test-RDMA.ps1 has been run to validate the RDMA configuration", + "waf": "Performance" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "guid": "d5d1e54a-2965-49e3-a58f-d78289c93555", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/data-residency", + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "description": "This ensures that Management traffic is not exposed to the VM traffic", + "guid": "abc85d0e-0ebd-4589-a777-0fa8ceb1d0f0", + "link": "", "services": [ - "Arc" + "VM" ], "severity": "Medium", - "subcategory": "Requirements", - "text": "Make sure to use an Azure region for storing the metadata approved by the organization", + "subcategory": "Host", + "text": "If a VMSwitch is shared for Compute and Management traffic, require that Management traffic is tagged with a VLAN ID", "waf": "Security" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "guid": "195abb91-a4ed-490d-ae2c-c84c37b6b780", - "link": "https://learn.microsoft.com/azure/key-vault/general/basic-concepts", + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "description": "This ensures you have at least 3 NCs active at all times during NC upgrades.", + "guid": "eb36f5f4-0fa7-4a2c-85f3-1b1c7c7817c0", "services": [ - "Arc", - "AKV" + "VM" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "Use Azure Key Vault for certificate management on servers", - "waf": "Security" + "subcategory": "SDN", + "text": "There are at least 3 Network Controller VMs deployed", + "waf": "Reliability" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "description": "Consider using a short-lived Azure AD service principal client secrets.", - "guid": "6d02bfe4-564b-40d8-94a3-48726ee79d6b", - "link": "https://learn.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret", + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "guid": "8bc78c85-6028-4a43-af2d-082a0a344909", + "link": "https://learn.microsoft.com/windows-server/networking/sdn/manage/update-backup-restore", "services": [ - "Arc", - "Entra", - "AKV", - "Storage" + "Backup" ], "severity": "High", - "subcategory": "Secrets", - "text": "What is the acceptable life time of the secret used by SP's", - "waf": "Security" + "subcategory": "SDN", + "text": "Backups of SDN infrastructure are configured and tested", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "description": "A private key is saved to the disk, ensure this is protected using disk encryption", - "guid": "a1a27b77-5a91-4be1-b388-ff394c2bd463", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#using-disk-encryption", + "category": "Management and Monitoring", + "checklist": "Azure Stack HCI Review", + "guid": "51eaa4b6-b9a7-43e1-a7dc-634d3107bc6d", "services": [ - "Arc", - "AKV" + "Monitor" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "Secure the public key for Azure Arc-enabled Servers", - "waf": "Security" + "subcategory": "Cluster", + "text": "SCOM Managed Instance has been considered for more complex monitoring and alerting scenarios", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "description": "Local administrator is required to install the Connected Machine Agent on Windows and Linux systems", - "guid": "29659e39-58fd-4782-a9c9-35556d02bfe4", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-portal#install-manually", + "category": "Management and Monitoring", + "checklist": "Azure Stack HCI Review", + "guid": "831f5aca-99ef-41e7-8263-9509f5093b43", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/setup-hci-system-alerts", "services": [ - "Arc" + "Monitor" ], "severity": "High", - "subcategory": "Security", - "text": "Ensure there is local administrator access for executing the agent installation", - "waf": "Security" + "subcategory": "Cluster", + "text": "Alerts have been configured for the cluster, either using Azure Monitor, SCOM, or a third-party solution", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "description": "Members of the local administrator group on Windows and users with root privileges on Linux, have permissions to manage the agent via command line.", - "guid": "564b0d83-4a34-4872-9ee7-9d6b5c2a3649", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#agent-security-and-permissions", + "category": "Management and Monitoring", + "checklist": "Azure Stack HCI Review", + "guid": "f95d0e7e-9f61-476d-bf65-59f2454d1d39", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later", "services": [ - "Arc" + "Monitor" ], "severity": "Medium", - "subcategory": "Security", - "text": "Limit the amount of users with local administrator rights to the servers", - "waf": "Security" + "subcategory": "Cluster", + "text": "Insights has been enabled at the cluster level and all nodes are reporting data", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "guid": "4b69bad3-8aad-453c-a78e-1d76667357c4", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication", + "category": "Management and Monitoring", + "checklist": "Azure Stack HCI Review", + "guid": "f4250fcb-ff53-40c9-b304-3560464fd90c", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later", "services": [ - "Arc", - "Entra" + "Monitor" ], "severity": "Medium", - "subcategory": "Security", - "text": "Consider using and restricting access to managed identities for applications.", - "waf": "Security" + "subcategory": "Cluster", + "text": "Azure Monitoring Agent has been deployed to hosts and an appropriate Data Collection Rule has been configured", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "description": "Use Defender for Endpoint or another AV and EDR solution to protect endpoints", - "guid": "5a91be1f-388f-4f39-9c2b-d463cbbbc868", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", + "category": "Management and Monitoring", + "checklist": "Azure Stack HCI Review", + "guid": "6143af1d-0d1a-4163-b1c9-662f7459bb98", "services": [ - "Arc", - "Defender" + "Monitor" ], "severity": "Medium", - "subcategory": "Security", - "text": "Enable Defender for Servers for all servers to secure hybrid workloads from threats", - "waf": "Security" + "subcategory": "Hardware", + "text": "Relevant hardware monitoring has been configured", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "guid": "cbafe6c4-6589-4d45-9a92-7c3974d1102c", + "category": "Management and Monitoring", + "checklist": "Azure Stack HCI Review", + "guid": "9cbdf225-549a-41cf-9c97-794766a6f2b0", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/health-service-overview", "services": [ - "Arc" + "Monitor" ], "severity": "Medium", - "subcategory": "Security", - "text": "Define controls to detect security misconfigurations and track compliance", - "waf": "Security" + "subcategory": "Hardware", + "text": "Relevant hardware alerting has been configured", + "waf": "Operations" }, { - "category": "Security, Governance and Compliance", - "checklist": "Azure Arc Review", - "guid": "cbbbc868-195a-4bb9-8a4e-d90dae2cc84c", - "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#extension-allowlists-and-blocklists", + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "c0da5bbd-0f0d-4a26-98ec-38c9cc42b323", "services": [ - "Arc" + "VM" ], - "severity": "Medium", - "subcategory": "Security", - "text": "Use allow- or block-lists to control what extensions can be installed on the Azure Arc-enabled servers", - "waf": "Security" + "severity": "Low", + "subcategory": "VM Management - Resource Bridge", + "text": "The Azure CLI has been installed on every node to enable RB management from WAC", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Data Explorer Review Checklist", - "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage", - "guid": "ba7da7be-9951-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export", - "service": "Azure Data Explorer", + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "guid": "a8ecf23c-c048-4fa9-b87b-51ebfb409863", "services": [ - "Cost", - "Storage" + "VM" ], - "subcategory": "Replication", - "text": "Leverage External Tables and Continuous data export overview to reduce costs", - "waf": "Reliability" + "severity": "Low", + "subcategory": "VM Management - Resource Bridge", + "text": "DHCP is available in the cluster to support Guest Configuration at VM deployment from Azure", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Data Explorer Review Checklist", - "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.", - "guid": "56a22586-f490-4641-addd-ea8a377cdeb3", - "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp", - "service": "Azure Data Explorer", + "category": "Backup and Disaster Recovery", + "checklist": "Azure Stack HCI Review", + "guid": "074541e3-fe08-458a-8062-32d13dcc10c6", + "link": "https://learn.microsoft.com/azure/backup/back-up-azure-stack-hyperconverged-infrastructure-virtual-machines", "services": [ - "Storage" + "ASR", + "VM", + "Backup" ], - "subcategory": "Replication", - "text": "To share data, explore Leader-follower cluster configuration", + "severity": "High", + "subcategory": "VM", + "text": "Backups of HCI VMs have been configured using MABS or a third-party solution", + "waf": "Operations" + }, + { + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "48f7ae57-1035-4101-8a38-fbe163d03e8a", + "services": [], + "severity": "High", + "subcategory": "Cluster Configuration", + "text": "Cluster configuration or a configuration script has been documented and maintained", + "waf": "Operations" + }, + { + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "f2a6a19a-ffe6-444d-badb-cb336c8e7b50", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/witness", + "services": [], + "severity": "High", + "subcategory": "Cluster Configuration", + "text": "A cluster witness has been configured for clusters with less than 5 nodes", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure Data Explorer Review Checklist", - "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.", - "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters", - "service": "Azure Data Explorer", + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "a47339fe-62c5-44a0-bb83-3d46ef16292f", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/update-cluster", + "services": [], + "severity": "Medium", + "subcategory": "Cluster Configuration", + "text": "Cluster-Aware Updating has been configured for Windows and hardware updates (if available)", + "waf": "Operations" + }, + { + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "7f1d6fe8-3079-44ea-8ea6-14494d1aa470", + "link": "https://learn.microsoft.com/azure-stack/hci/deploy/validate", + "services": [], + "severity": "High", + "subcategory": "Cluster Configuration", + "text": "Cluster validation has been run against the configured cluster", + "waf": "Reliability" + }, + { + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "81693af0-5638-4aa2-a153-1d6189df30a7", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-benefits", "services": [ - "ASR" + "VM" ], - "subcategory": "Replication", - "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions", + "severity": "Medium", + "subcategory": "Cluster Configuration", + "text": "Azure Benefits has been enabled at the cluster and VM levels", + "waf": "Cost" + }, + { + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "8c967ee8-8170-4537-a28d-33431cd3632a", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/use-environment-checker", + "services": [], + "severity": "Medium", + "subcategory": "Cluster Configuration", + "text": "The Environment Checker module has been run to validate the environment", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure Data Explorer Review Checklist", - "guid": "436b0635-cb45-4e57-a603-324ace8cc123", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities", - "service": "Azure Data Explorer", + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "43ffbfab-766e-4950-a102-78b479136e4d", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-benefits", "services": [ - "RBAC", - "Storage" + "AzurePolicy" ], - "subcategory": "Replication", - "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Cluster Configuration", + "text": "Group Policy inheritance on the HCI cluster and node Active Directory organizational unit has been blocked or applied policies have been evaluated for compatibility issues (usually WinRM and PowerShell execution policy)", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Data Explorer Review Checklist", - "guid": "18ca6017-0265-4f4b-a46a-393af7f31728", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution", - "service": "Azure Data Explorer", + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "e6a3f3a7-4a7d-49e2-985a-6e39dd284027", "services": [], - "subcategory": "Replication", - "text": "Ingest data into each cluster in parallel", + "severity": "Medium", + "subcategory": "Cluster Configuration", + "text": "WAC is on the latest release and configured to automatically upgrade extensions", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure Data Explorer Review Checklist", - "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.", - "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration", - "service": "Azure Data Explorer", + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "guid": "d1caa31f-cc26-42b2-b92f-2b667c0e6020", + "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr", "services": [ - "ACR" + "Entra" ], - "subcategory": "DR Configuration", - "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Stretch Clustering", + "text": "There is sub 5ms latency between each site if synchronous replication is being configured AAD", + "waf": "Performance" }, { - "category": "BC and DR", - "checklist": "Azure Data Explorer Review Checklist", - "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.", - "guid": "563a4dc7-4a74-48b6-922a-d190916a6649", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration", - "service": "Azure Data Explorer", + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "guid": "3277558e-3155-4088-b49a-78594cb4ce1a", "services": [ - "ACR" + "Storage", + "VNet" ], - "subcategory": "DR Configuration", - "text": "For critical applications, create Active-Active configuration in two paired regions", + "severity": "High", + "subcategory": "Stretch Clustering", + "text": "Management, Replication and Storage networks excluded from stretched VLANs configurations, are routed, and in different subnets", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Azure Data Explorer Review Checklist", - "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.", - "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration", - "service": "Azure Data Explorer", + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "baed6066-8531-44ba-bd94-38cbabbf4099", "services": [], - "subcategory": "DR Configuration", - "text": "For applications, which required only read during failure, create Active-Hot standby configuration", - "waf": "Reliability" + "severity": "High", + "subcategory": "Stretch Clustering", + "text": "There is a plan detailed for site failure and recovery", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Data Explorer Review Checklist", - "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.", - "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration", - "service": "Azure Data Explorer", + "category": "Networking", + "checklist": "Azure Stack HCI Review", + "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b4", "services": [ - "Cost", - "AzurePolicy", - "Storage", - "ASR" + "ACR" ], - "subcategory": "DR Configuration", - "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration", + "severity": "Medium", + "subcategory": "Stretch Clustering", + "text": "Separate vLANs and networks are used for each replication network across both sites", "waf": "Reliability" }, { - "category": "Operations Management", - "checklist": "Azure Data Explorer Review Checklist", - "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.", - "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757", - "link": "https://learn.microsoft.com/azure/data-explorer/devops", - "service": "Azure Data Explorer", + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b5", + "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr#cost-optimization", "services": [ - "AzurePolicy" + "Storage" ], - "subcategory": "IaC", - "text": "Wrap DevOps and source control around all your code", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", - "waf": "Reliability" - }, - { - "category": "Operations Management", - "checklist": "Azure Data Explorer Review Checklist", - "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780", - "link": "https://learn.microsoft.com/azure/data-explorer/devops", - "service": "Azure Data Explorer", - "services": [], - "subcategory": "IaC", - "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.", - "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", + "severity": "High", + "subcategory": "Stretch Clustering", + "text": "Use either a cloud witness or a file share witness in a third site for cluster quorum for clusters with less than 5 nodes", "waf": "Reliability" }, { - "category": "Operations Management", - "checklist": "Azure Data Explorer Review Checklist", - "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18", - "link": "https://learn.microsoft.com/azure/data-explorer/devops", - "service": "Azure Data Explorer", + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b6", + "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr#cost-optimization", "services": [], - "subcategory": "IaC", - "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "severity": "High", + "subcategory": "Stretch Clustering", + "text": "When using data deduplication, only enable it on the primary/source volumes", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Ensure that your backups are protected against attacks. This should include encryption of the backups to protect against loss of confidentiality. For regular Azure service backup, backup data is automatically encrypted using Azure platform-managed keys. You can also choose to encrypt the backup using a customer-managed key. In this case, ensure this customer-managed key in the key vault is also in the backup scope.", - "guid": "676f6951-0368-49e9-808d-c33a692c9a64", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data", + "category": "Operations", + "checklist": "Azure Stack HCI Review", + "guid": "ac527887-f6f4-40a3-b883-e04d704f013b", + "link": "https://learn.microsoft.com/windows-server/storage/storage-replica/stretch-cluster-replication-using-shared-storage#provision-operating-system-features-roles-storage-and-network", "services": [ - "Backup", - "SQL", - "AKV" + "Storage" ], - "severity": "Medium", - "subcategory": "Azure Key Vault", - "text": "Protect your backup data with encryption and store keys safely in Azure Key Vault", - "waf": "Security" + "severity": "High", + "subcategory": "Stretch Clustering", + "text": "Storage backing log volumes must be faster (ideally) or at least as fast as capacity storage", + "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Azure SQL Database uses SQL Server technology to create full backups every week, differential backup every 12-24 hours, and transaction log backup every 5 to 10 minutes. By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region.", - "guid": "e2518261-b3bc-4bd1-b331-637fb2df833f", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-1-ensure-regular-automated-backups", + "category": "Backup and Disaster Recovery", + "checklist": "Azure Stack HCI Review", + "guid": "8ea49f70-1038-4283-b0c4-230165d3eabc", + "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-site-recovery", "services": [ - "Backup", - "SQL", - "Storage" + "ASR", + "Backup" ], "severity": "Medium", - "subcategory": "Backup", - "text": "Configure Azure SQL Database automated backups", - "waf": "Security" + "subcategory": "Disaster Recovery", + "text": "Azure Site Recovery has been considered for DR purposes", + "waf": "Operations" }, { - "category": "BCDR", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "By default, SQL Database stores data in geo-redundant storage blobs that are replicated to a paired region. For SQL Database, the backup storage redundancy can be configured at the time of database creation or can be updated for an existing database; the changes made to an existing database apply to future backups only.", - "guid": "f8c7cda2-3ed7-43fb-a100-85dcd12a0ee4", - "link": "https://learn.microsoft.com/azure/azure-sql/database/automated-backups-overview?tabs=single-database&view=azuresql#backup-storage-redundancy", - "services": [ - "Backup", - "SQL", - "Storage" - ], - "severity": "Low", - "subcategory": "Backup", - "text": "Enable geo-redundant backup storage to protect against single region failure and data loss", + "category": "Security", + "checklist": "Azure Stack HCI Review", + "guid": "03e65fdc-2628-4a1a-ba2e-a5174340ba52", + "link": "https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", + "services": [], + "severity": "Medium", + "subcategory": "Host", + "text": "BitLocker has been enabled on CSVs for volume encryption, where appropriate", "waf": "Security" }, { - "category": "Code", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Malicious code can potentially circumvent security controls. Before deploying custom code to production, it is essential to review what's being deployed. Use a database tool like Azure Data Studio that supports source control. Implement tools and logic for code analysis, vulnerability and credential scanning.", - "guid": "7ca9f006-d2a9-4652-951c-de8e4ac5e76e", - "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server", - "services": [ - "SQL" - ], + "category": "Security", + "checklist": "Azure Stack HCI Review", + "guid": "9645d2e6-ba28-453c-b6d5-d9ef29fc34be", + "link": "https://learn.microsoft.com/windows-server/storage/file-server/smb-security", + "services": [], "severity": "Medium", - "subcategory": "Source Control and Code Review", - "text": "Use Source Control systems to store, maintain and review application code deployed inside Azure SQLDB Database", + "subcategory": "Host", + "text": "SMB encryption has been enabled, where appropriate", "waf": "Security" }, { - "category": "Data Discovery and Classification", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "In case of classification requirements Purview is the preferred option. Only use SQL Data Discovery & Classification in case Purview is not an option. Discover columns that potentially contain sensitive data. What is considered sensitive data heavily depends on the customer, compliance regulation, etc., and needs to be evaluated by the users in charge of that data. Classify the columns to use advanced sensitivity-based auditing and protection scenarios. Review results of automated discovery and finalize the classification if necessary.", - "guid": "d401509b-2629-4484-9a7f-af0d29a7778f", - "link": "https://learn.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql#faq---advanced-classification-capabilities", + "category": "Security", + "checklist": "Azure Stack HCI Review", + "guid": "8f03437a-5068-4486-9a78-0402ce771298", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server", "services": [ - "SQL" + "Defender" ], - "severity": "Low", - "subcategory": "Data Discovery and Classification", - "text": "Plan and configure Data Discovery & Classification to protect the sensitive data", + "severity": "Medium", + "subcategory": "Host", + "text": "Microsoft Defender Antivirus has been enabled on all nodes", "waf": "Security" }, { - "category": "Data Masking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Usage of this feature is recommended only if column encryption is not an option and there is a specific requirement to preserve data types and formats. Dynamic data masking limits sensitive data exposure by masking it to non-privileged users. Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal impact on the application layer.", - "guid": "9391fd50-135e-453e-90a7-c1a23f88cc13", - "link": "https://learn.microsoft.com/azure/azure-sql/database/dynamic-data-masking-overview", - "services": [ - "SQL" - ], - "severity": "Low", - "subcategory": "Data Masking", - "text": "Use Data Masking to prevent unauthorized non-admin users data access if no encryption is possible", + "category": "Security", + "checklist": "Azure Stack HCI Review", + "guid": "dba6b211-fc02-43b3-b7c8-f163c188332e", + "link": "https://learn.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage", + "services": [], + "severity": "Medium", + "subcategory": "Host", + "text": "Credential Guard has been configured, where appropriate", "waf": "Security" }, { - "category": "Defender", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "SQL Advanced Threat Detection (ATP) provides a layer of security that detects potential vulnerabilities and anomalous activity in databases such as SQL injection attacks and unusual behavior patterns. When a potential threat is detected Threat Detection sends an actionable real-time alert by email and in Microsoft Defender for Cloud, which includes clear investigation and remediation steps for the specific threat.", - "guid": "4e52d73f-5d37-428f-b3a2-e6997e835979", - "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure", - "services": [ - "Defender", - "EventHubs", - "SQL" - ], + "category": "Operations Management", + "checklist": "Cognitive Search Review Checklist", + "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", + "services": [], "severity": "High", - "subcategory": "Advanced Threat Protection", - "text": "Review and complete Advanced Threat Protection (ATP) configuration", - "waf": "Security" + "subcategory": "High Availablity", + "text": "Enable 2 replicas to have 99.9% availability for read operations", + "waf": "Reliability" }, { - "category": "Defender", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Enable Microsoft Defender for Azure SQL at the subscription level to automatically onboard and protect all existing and future servers and databases. When you enable on the subscription level, all databases in Azure SQL Database and Azure SQL Managed Instance are protected. You can then disable them individually if you choose. If you want to manually manage which databases are protected, disable at the subscription level and enable each database that you want protected.", - "guid": "dff87489-9edb-4cef-bdda-86e8212b2aa1", - "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ", - "services": [ - "Defender", - "SQL", - "Subscriptions" - ], - "severity": "High", - "subcategory": "Defender for Azure SQL", - "text": "Enable Microsoft Defender for Azure SQL", - "waf": "Security" + "category": "Operations Management", + "checklist": "Cognitive Search Review Checklist", + "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", + "services": [], + "severity": "Medium", + "subcategory": "High Availablity", + "text": "Enable 3 replicas to have 99.9% availability for read/write operations", + "waf": "Reliability" }, { - "category": "Defender", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Microsoft Defender for Azure SQL ATP detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. Alerts can be configured and generated and will be reported in the Defender for console.", - "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea", - "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure", - "services": [ - "Defender", - "SQL", - "Monitor" - ], + "category": "Operations Management", + "checklist": "Cognitive Search Review Checklist", + "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", + "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", + "service": "Cognitive Search", + "services": [], "severity": "High", - "subcategory": "Defender for Azure SQL", - "text": "Prepare a security response plan to promptly react to Microsoft Defender for Azure SQL alerts", - "waf": "Security" + "subcategory": "High Availablity", + "text": "Leverage Availability Zones by enabling read and/or write replicas", + "waf": "Reliability" }, { - "category": "Defender", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Azure SQLDB vulnerability assessment is a service that provides visibility into your security state. Vulnerability assessment includes actionable steps to resolve security issues and enhance your database security. It can help you to monitor a dynamic database environment where changes are difficult to track and improve your SQL security posture.", - "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview", + "category": "Operations Management", + "checklist": "Cognitive Search Review Checklist", + "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", + "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", + "service": "Cognitive Search", "services": [ - "Defender", - "SQL", - "Monitor" + "ACR" ], - "severity": "High", - "subcategory": "Vulnerability Assessment", - "text": "Configure Vulnerability Assessment (VA) findings and review recommendations", - "waf": "Security" + "severity": "Medium", + "subcategory": "Georeplication", + "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions", + "waf": "Reliability" }, { - "category": "Defender", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Microsoft Defender for Cloud provides vulnerability assessment for your Azure SQL Databases. Vulnerability assessment scans your databases for software vulnerabilities and provides a list of findings. You can use the findings to remediate software vulnerabilities and disable findings.", - "guid": "c8c5f112-1e50-4f77-9264-8195b4cd61ac", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-find?view=azuresql", + "category": "Operations Management", + "checklist": "Cognitive Search Review Checklist", + "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", + "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", + "service": "Cognitive Search", "services": [ - "Defender", - "SQL" + "ACR" ], - "severity": "High", - "subcategory": "Vulnerability Assessment", - "text": "Regularly review of Vulnerability Assessment (VA) findings and recommendations and prepare a plan to fix", - "waf": "Security" + "severity": "Medium", + "subcategory": "Georeplication", + "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services", + "waf": "Reliability" }, { - "category": "Encryption", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Always Encrypted with Secure Enclaves expands confidential computing capabilities of Always Encrypted by enabling in-place encryption and richer confidential queries. Always Encrypted with Secure Enclaves addresses these limitations by allowing some computations on plaintext data inside a secure enclave on the server side. Usage of this feature is recommended for the cases where you need to limit administrator access and need your queries to support more than equality matching of encrypted columns.", - "guid": "65d7e54a-10a6-4094-b673-9ff3809c9277", - "link": "https://learn.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves", + "category": "Operations Management", + "checklist": "Cognitive Search Review Checklist", + "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", + "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", + "service": "Cognitive Search", "services": [ - "SQL" + "TrafficManager" ], "severity": "Medium", - "subcategory": "Always Encrypted", - "text": "If protecting sensitive PII data from admin users is a key requirement, but Column Encryption limitations cannot be tolerated, consider the adoption of Always Encrypted with Secure Enclaves", - "waf": "Security" + "subcategory": "Georeplication", + "text": "Use Azure Traffic Manager to coordinate requests", + "waf": "Reliability" }, { - "category": "Encryption", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "With Azure SQL Database, you can apply symmetric encryption to a column of data by using Transact-SQL. This approach is called column encryption, because you can use it to encrypt specific columns with different encryption keys. Doing so gives you more granular encryption capability than TDE, which encrypts data in pages. Using Always Encrypted to ensure sensitive data isn't exposed in plaintext in Azure SQL Database or SQL Managed Instance, even in memory/in use. Always Encrypted protects the data from Database Administrators (DBAs) and cloud admins (or bad actors who can impersonate high-privileged but unauthorized users) and gives you more control over who can access your data.", - "guid": "c03ce136-e3d5-4e17-bf25-ed955ee480d3", - "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption", + "category": "Operations Management", + "checklist": "Cognitive Search Review Checklist", + "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", + "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", + "service": "Cognitive Search", "services": [ - "SQL", "Storage", - "AKV" + "ASR", + "Backup" ], - "severity": "Low", - "subcategory": "Column Encryption", - "text": "To protect sensitive PII data from non-admin users in specific table columns, consider using Column Encryption", - "waf": "Security" + "severity": "High", + "subcategory": "Disaster Recovery", + "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files", + "waf": "Reliability" }, { - "category": "Encryption", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Enabled by default, Transparent data encryption (TDE) helps to protect the database files against information disclosure by performing real-time encryption and decryption of the database, associated backups, and transaction log files 'at rest', without requiring changes to the application.", - "guid": "c614ac47-bebf-4061-b0a1-43e0c6b5e00d", - "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-create-server", - "services": [ - "Backup", - "SQL", - "Storage" - ], + "category": "BC and DR", + "checklist": "Azure Function Review", + "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "services": [], "severity": "High", - "subcategory": "Transparent Data Encryption", - "text": "Ensure Transparent Data Encryption (TDE) is kept enabled", - "waf": "Security" + "subcategory": "High Availability", + "text": "Select the right Function hosting plan based on your business & SLO requirements", + "waf": "Reliability" }, { - "category": "Encryption", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "If separation of duties in the management of keys and data within the organization is required, leverage Customer Managed Keys (CMK) for Transparent Data Encryption (TDE) for your Azure SQLDB and use Azure Key Vault to store (refer to its checklist). Leverage this feature when you have strict security requirements which cannot be met by the managed service keys.", - "guid": "2edb4165-4f54-47cc-a891-5c82c2f21e25", - "link": "https://learn.microsoft.com/azure/azure-sql/database/transparent-data-encryption-byok-overview", - "services": [ - "SQL", - "AKV" - ], - "severity": "Medium", - "subcategory": "Transparent Data Encryption", - "text": "Use customer-managed keys (CMK) in Azure Key Vault (AKV) if you need increased transparency and granular control over the TDE protection", - "waf": "Security" + "category": "BC and DR", + "checklist": "Azure Function Review", + "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "services": [], + "severity": "High", + "subcategory": "High Availability", + "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)", + "waf": "Reliability" }, { - "category": "Encryption", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "The minimal Transport Layer Security (TLS) version setting allows customers to choose which version of TLS their SQL database uses. It's possible to change the minimum TLS version by using the Azure portal, Azure PowerShell, and the Azure CLI.", - "guid": "7754b605-57fd-4bcb-8213-52c39d8e8225", - "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-settings?source=recommendations&view=azuresql&tabs=azure-portal#minimal-tls-version", - "services": [ - "SQL" - ], - "severity": "High", - "subcategory": "Transport Layer Security", - "text": "Enforce minimum TLS version to the latest available", - "waf": "Security" + "category": "BC and DR", + "checklist": "Azure Function Review", + "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", + "service": "Azure Functions", + "services": [], + "severity": "Medium", + "subcategory": "High Availability", + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Use Azure Active Directory (Azure AD) authentication for centralized identity management. Use SQL Authentication only if really necessary and document as exceptions.", - "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7", - "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview", + "category": "BC and DR", + "checklist": "Azure Function Review", + "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Azure Functions", "services": [ - "Entra", - "SQL" + "AppSvc" ], - "severity": "Medium", - "subcategory": "Azure Active Directory", - "text": "Leverage Azure AD authentication for connections to Azure SQL Databases", - "waf": "Security" + "severity": "High", + "subcategory": "High Availability", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Using Azure AD groups simplifies permission management and both the group owner, and the resource owner can add/remove members to/from the group. Create a separate group for Azure AD administrators for each logical server. Monitor Azure AD group membership changes using Azure AD audit activity reports.", - "guid": "29820254-1d14-4778-ae90-ff4aeba504a3", - "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities", + "category": "BC and DR", + "checklist": "Azure Function Review", + "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "Azure Functions", "services": [ - "Entra", - "SQL", - "Monitor" + "AppSvc" ], - "severity": "Medium", - "subcategory": "Azure Active Directory", - "text": "Create a separate Azure AD group with two admin accounts for each Azure SQL Database logical server", - "waf": "Security" + "severity": "High", + "subcategory": "High Availability", + "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Ensure that distinct system and user assigned managed identities, that are dedicated to the function, with least permissions assigned, are used for communication from Azure services and applications to the Azure SQLDB databases.", - "guid": "df3a09ee-03bb-4198-8637-d141acf5f289", - "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications", + "category": "BC and DR", + "checklist": "Azure Function Review", + "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", + "service": "Azure Functions", "services": [ - "Entra", - "SQL" + "Storage" ], "severity": "Medium", - "subcategory": "Azure Active Directory", - "text": "Minimize the use of password-based authentication for applications", - "waf": "Security" + "subcategory": "High Availability", + "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "System or User assigned managed identities enable Azure SQLDB to authenticate to other cloud services (e.g. Azure Key Vault) without storing credentials in code. Once enabled, all necessary permissions can be granted via Azure role-based-access-control to the specific Azure SQLDB instance. Do not share user assigned managed identities across multiple services if not strictly required.", - "guid": "69891194-5074-4e30-8f69-4efc3c580900", - "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", - "services": [ - "RBAC", - "SQL", - "AKV", - "Entra", - "ACR" - ], - "severity": "Low", - "subcategory": "Managed Identities", - "text": "Assign Azure SQL Database a managed identity for outbound resource access", - "waf": "Security" + "category": "Application Deployment", + "checklist": "Azure Function Review", + "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "Azure Functions", + "services": [], + "severity": "Medium", + "subcategory": "CI/CD", + "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code", + "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Use an Azure AD integrated authentication that eliminates the use of passwords. Password-based authentication methods are a weaker form of authentication. Credentials can be compromised or mistakenly given away. Use single sign-on authentication using Windows credentials. Federate the on-premises AD domain with Azure AD and use integrated Windows authentication (for domain-joined machines with Azure AD).", - "guid": "88287d4a-8bb8-4640-ad78-03f51354d003", - "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "974a759c-763e-47d2-9161-3a7649907e0e", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ASB_v1.docx", "services": [ - "Entra", - "SQL" + "ServiceBus" ], "severity": "Medium", - "subcategory": "Passwords", - "text": "Minimize the use of password-based authentication for users", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Leverage FTA Handbook", + "waf": "Reliability" }, { - "category": "Ledger", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Confidential Ledger is one of the supported store, it can be used and supports automatic generation and storage of database digests. Azure Ledger provides advanced security features like Blockchain Ledger Proof and Confidential Hardware Enclaves. Use it only if advanced security features are required, otherwise revert to Azure storage.", - "guid": "0e853380-50ba-4bce-b2fd-5c7391c85ecc", - "link": "https://learn.microsoft.com/azure/architecture/guide/technology-choices/multiparty-computing-service#confidential-ledger-and-azure-blob-storage", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "description": "This will be turned on automatically for a new SB namespace created from the portal with the Premium SKUs in a zone-enabled region. Both the Service Bus metadata and the messages data are replicated across datacenters in the availability zones configuration", + "guid": "338ee253-c17d-432e-aaaa-b7571549ab81", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#availability-zones", "services": [ - "SQL", - "Storage" + "ACR", + "ServiceBus" ], - "severity": "Medium", - "subcategory": "Database Digest", - "text": "Use Azure Confidential Ledger to store database digests only if advanced security features are required", - "waf": "Security" + "severity": "High", + "subcategory": "Best Practices", + "text": "Leverage Availability Zones if regionally applicable", + "waf": "Reliability" }, { - "category": "Ledger", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "The hash of the latest block in the database ledger is called the database digest. It represents the state of all ledger tables in the database at the time when the block was generated. Generating a database digest is efficient, because it involves computing only the hashes of the blocks that were recently appended. Azure Blob Storage with Immutable Storage feature can be used and supports automatic generation and storage of database digests. To prevent tampering of your digest files, configure and lock a retention policy for your container.", - "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a", - "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "description": "If enabled, Implements namespace metadata replication to a secondary region. Does not replicate queue/topic message data. Premium sku only.", + "guid": "53d89f89-d17b-484b-93b5-a67f7b9ed5b3", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#geo-disaster-recovery", "services": [ - "AzurePolicy", - "SQL", - "Storage" + "ASR", + "Storage", + "ServiceBus" ], "severity": "Medium", - "subcategory": "Database Digest", - "text": "If Azure storage account is used to store database digests, ensure security is properly configured", - "waf": "Security" + "subcategory": "Geo-Disaster Recovery", + "text": "Plan for Metadata replication during regional failure", + "waf": "Reliability" }, { - "category": "Ledger", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Ledger provides a form of data integrity called forward integrity, which provides evidence of data tampering on data in your ledger tables. The database verification process takes as input one or more previously generated database digests. It then recomputes the hashes stored in the database ledger based on the current state of the ledger tables. If the computed hashes don't match the input digests, the verification fails. The failure indicates that the data has been tampered with. The verification process reports all inconsistencies that it detects.", - "guid": "f8d4ffda-8aac-4cc6-b72b-c81cb8625420", - "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-database-verification", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "description": "If an outage cannot be tolerated, do not use the build-in metadata replication option. Leverage a replication pattern to replicate Service Bus messages across two or more sets of cross-region namespaces", + "guid": "1f38c403-a822-4c24-93cf-0f18ac699ef1", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-federation-overview", "services": [ - "SQL", - "Storage" + "ASR", + "ACR", + "ServiceBus" ], "severity": "Medium", - "subcategory": "Integrity", - "text": "Schedule the Ledger verification process regularly to verify data integrity", - "waf": "Security" + "subcategory": "Geo-Disaster Recovery", + "text": "Plan for Message replication during regional failure", + "waf": "Reliability" }, { - "category": "Ledger", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "The Ledger feature provides tamper-evidence capabilities in your database. You can cryptographically attest to other parties, such as auditors or other business parties, that your data hasn't been tampered with. Ledger helps protect data from any attacker or high-privileged user, including database administrators (DBAs), system administrators, and cloud administrators.", - "guid": "2563f498-e2d3-42ea-9e7b-5517881a06a2", - "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "description": "Azure Service Bus uses a message broker to handle messages that are sent to a Service Bus queue or topic. By default, all messages that are sent to a queue or topic are handled by the same message broker process. This architecture can place a limitation on the overall throughput of the message queue. However, you can also partition a queue or topic when it is created", + "guid": "d5a83de4-de32-4c18-a147-0607c5c0e4e6", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/data-partitioning-strategies#partitioning-azure-service-bus", "services": [ - "SQL" + "Storage", + "ServiceBus" ], "severity": "Medium", - "subcategory": "Ledger", - "text": "If cryptographic proof of data integrity is a critical requirement, Ledger feature should be considered", - "waf": "Security" + "subcategory": "Best Practices", + "text": "For applications which require high throughput, use Patritioning ", + "waf": "Reliability" }, { - "category": "Ledger", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Depending on the type of tampering, there are cases where you can repair the ledger without losing data. In the article contained in the --More Info-- column, different scenarios and recovery techniques are described.", - "guid": "804fc554-6554-4842-91c1-713b32f99902", - "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-how-to-recover-after-tampering", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "14658d24-58ed-4671-99b8-21102df26ee4", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters", "services": [ - "SQL" + "ServiceBus" ], "severity": "Medium", - "subcategory": "Recovery", - "text": "Prepare a response plan to investigate and repair a database after a tampering event", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Evaluate Premier-tier benefits of Azure Service Bus", + "waf": "Reliability" }, { - "category": "Logging", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Azure SQL Database Auditing tracks database events and writes them to an audit log in your Azure storage account. Auditing helps you understand database activity and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations as well as helps you meet regulatory compliance. By default auditing policy includes all actions (queries, stored procedures and successful and failed logins) against the databases, which may result in high volume of audit logs. It's recommended for customers to configure auditing for different types of actions and action groups using PowerShell.", - "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6", - "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "11e6f883-e52f-4472-8dd6-8c5b5c2521e5", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-messaging-exceptions", "services": [ - "AzurePolicy", - "SQL", - "Storage" + "ServiceBus" ], - "severity": "Medium", - "subcategory": "Auditing", - "text": "Ensure that Azure SQL Database Auditing is enabled at the server level", - "waf": "Security" + "severity": "High", + "subcategory": "Best Practices", + "text": "Ensure that Service Bus Messaging Exceptions are handled properly", + "waf": "Reliability" }, { - "category": "Logging", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Azure SQL Database Auditing logs can be written to external storage accounts, Log Analytics workspace or Event Hub. Be sure to protect the target repository using backups and secured configuration. Use Azure SQL Database Managed Identity to access the storage and set an explicit retention period. Do not grant permissions to administrators to the audit log repository. Use a different target storage for --Enabling Auditing of Microsoft support operations--. ", - "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46", - "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "4a69b9d3-39ac-44e7-a68d-1d75657202b4", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", "services": [ - "EventHubs", - "Monitor", - "Backup", - "SQL", "Storage", - "Entra" + "ServiceBus", + "PrivateLink" ], - "severity": "Low", - "subcategory": "Auditing", - "text": "Ensure that Azure SQL Database Auditing logs are backed up and secured in the selected repository type", - "waf": "Security" + "severity": "Medium", + "subcategory": "Best Practices", + "text": "Connect to Service Bus with the Advanced Messaging Queue Protocol (AMQP) and use Service Endpoints or Private Endpoints when possible.", + "waf": "Reliability" }, { - "category": "Logging", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "The Azure Monitor activity log is a platform log in Azure that provides insight into subscription-level events. The activity log includes information like when a resource is modified. It is recommended to send this activity log to the same external storage repository as the Azure SQL Database Audit Log (storage account, Log Analytics workspace, Event Hub).", - "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "f4564b4d-974a-4759-a763-e7d261613a76", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-performance-improvements?tabs=net-standard-sdk-2", "services": [ - "EventHubs", - "Monitor", - "Subscriptions", - "SQL", - "Storage" + "ServiceBus" ], - "severity": "Medium", - "subcategory": "Auditing", - "text": "Ensure that Azure SQL Database Activity Log is collected and integrated with Auditing logs", - "waf": "Security" + "severity": "High", + "subcategory": "Best Practices", + "text": "Review the Best Practices for performance improvements using Service Bus Messaging", + "waf": "Reliability" }, { - "category": "Logging", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Forward any logs from Azure SQL to your Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR). Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.", - "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44", - "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "49907e0e-338e-4e25-9c17-d32e8aaab757", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/operational-excellence", "services": [ - "SQL", - "Monitor" + "ServiceBus" ], "severity": "Medium", - "subcategory": "SIEM/SOAR", - "text": "Ensure that Azure SQL Database Auditing logs are being presented in to your organizations SIEM/SOAR", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Implement geo-replication on the sender and receiver side to protect against outages and disasters", + "waf": "Reliability" }, { - "category": "Logging", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Forward any logs from Azure SQL to your Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR), which can be used to set up custom threat detections. Ensure that you are monitoring different types of Azure assets for potential threats and anomalies. Focus on getting high-quality alerts to reduce false positives for analysts to sort through. Alerts can be sourced from log data, agents, or other data.", - "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "1549ab81-53d8-49f8-ad17-b84b33b5a67f", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", "services": [ - "SQL", - "Monitor" + "Storage", + "ASR", + "ServiceBus" ], "severity": "Medium", - "subcategory": "SIEM/SOAR", - "text": "Ensure that Azure SQL Database Activity Log data is presented in to your SIEM/SOAR", - "waf": "Security" + "subcategory": "Best Practices", + "text": "If you need mission-critical messaging with queues and topics, Service Bus Premium is recommended with Geo-Disaster Recovery.", + "waf": "Reliability" }, { - "category": "Logging", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Security Operation Center (SOC) team should create an incident response plan (playbooks or manual responses) to investigate and mitigate tampering, malicious activities, and other anomalous behaviors.", - "guid": "19ec7c97-c563-4e1d-82f0-54d6ec12e754", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "7b9ed5b3-1f38-4c40-9a82-2c2463cf0f18", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", "services": [ - "EventHubs", - "SQL" + "ServiceBus" ], "severity": "Medium", - "subcategory": "SIEM/SOAR", - "text": "Ensure that you have response plans for malicious or aberrant audit logging events", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Implement high availability for the Service Bus namespace", + "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "When you create a logical server from the Azure portal for Azure SQL Database, the result is a public endpoint that is visible and reachable over the public network (Public Access). You can then limit connectivity based on firewall rules and Service Endpoint. You can also configure private connectivity only limiting connections to internal networks using Private Endpoint (Private Access). Private Access using Private Endpoint should be the default unless a business case or performance/technical reason applies that cannot support it. Usage of Private Endpoints has performance implications that need to be considered and assessed.", - "guid": "2c6d356a-1784-475b-a42c-ec187dc8c925", - "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "ac699ef1-d5a8-43de-9de3-2c1881470607", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", "services": [ - "PrivateLink", - "SQL" + "ServiceBus" ], "severity": "High", - "subcategory": "Connectivity", - "text": "Review Public vs. Private Access connectivity methods and select the appropriate one for the workload", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Ensure related messages are delivered in guaranteed order", + "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "IMPORTANT: Connections to private endpoint only support Proxy as the connection policy. When using private endpoints connections are proxied via the Azure SQL Database gateway to the database nodes. Clients will not have a direct connection.", - "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718", - "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "c5c0e4e6-1465-48d2-958e-d67139b82110", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", "services": [ - "AzurePolicy", - "PrivateLink", - "SQL" + "ServiceBus" ], "severity": "Low", - "subcategory": "Connectivity", - "text": "Keep default Azure SQL Database Connection Policy if not differently required and justified", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Evaluate different Java Messaging Service (JMS) features through the JMS API", + "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "This option configures the firewall to allow all connections from Azure, including connections from the subscriptions of other customers. If you select this option, make sure that your login and user permissions limit access to authorized users only. If not strictly required, keep this setting to OFF.", - "guid": "f48efacf-4405-4e8d-9dd0-16c5302ed082", - "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "2df26ee4-11e6-4f88-9e52-f4722dd68c5b", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", "services": [ - "SQL", - "Subscriptions" + "ServiceBus" ], - "severity": "High", - "subcategory": "Connectivity", - "text": "Ensure Allow Azure Services and Resources to Access this Server setting is disabled in Azure SQL Database firewall", - "waf": "Security" + "severity": "Low", + "subcategory": "Best Practices", + "text": "Use .NET Nuget packages to communicate with Service Bus messaging entities", + "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Azure SQL Database has a new built-in feature that allows native integration with external REST endpoints. This means that integration of Azure SQL Database with Azure Functions, Azure Logic Apps, Cognitive Services, Event Hubs, Event Grid, Azure Containers, API Management and in general any REST or even GraphQL endpoint. If not properly restricted, code inside an Azure SQL Database database could leverage this mechanism to exfiltrate data. If not strictly required, it is recommended to block or restrict this feature using Outbound Firewall Rules.", - "guid": "cb3274a7-e36d-46f6-8de5-46d30c8dde8e", - "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql", + "category": "Operations Management", + "checklist": "Service Bus Review Checklist", + "guid": "5c2521e5-4a69-4b9d-939a-c4e7c68d1d75", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", "services": [ - "EventHubs", - "APIM", - "SQL" + "ServiceBus" ], "severity": "Medium", - "subcategory": "Outbound Control", - "text": "Block or restrict outbound REST API calls to external endpoints", - "waf": "Security" + "subcategory": "Best Practices", + "text": "Implement resilience for transient fault handling when sending or receiving messages", + "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Outbound firewall rules limit network traffic from the Azure SQL Database logical server to a customer defined list of Azure Storage accounts and Azure SQL Database logical servers. Any attempt to access storage accounts or databases not in this list is denied.", - "guid": "a566dd3d-314e-4a94-9378-102c42d82b38", - "link": "https://learn.microsoft.com/azure/azure-sql/database/outbound-firewall-rule-overview", + "category": "Security", + "checklist": "Service Bus Review Checklist", + "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", + "guid": "87af4a79-1f89-439b-ba47-768e14c11567", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key", + "service": "Service Bus", "services": [ - "SQL", - "Storage" + "ServiceBus" ], - "severity": "Medium", - "subcategory": "Outbound Control", - "text": "If outbound network access is required, it is recommended to configure outbound networking restrictions using built-in Azure SQL Database control feature", + "severity": "Low", + "subcategory": "Data Protection", + "text": "Use customer-managed key option in data at rest encryption when required", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Private Endpoint is created inside a subnet in an Azure Virtual Network. Proper security configuration must be applied also to the containing network environment, including NSG/ASG, UDR, firewall, monitoring and auditing.", - "guid": "246cd832-f550-4af0-9c74-ca9baeeb8860", - "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server", + "category": "Security", + "checklist": "Service Bus Review Checklist", + "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.", + "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version", + "service": "Service Bus", "services": [ - "VNet", - "Monitor", - "Firewall", - "PrivateLink", - "SQL" + "ServiceBus" ], "severity": "Medium", - "subcategory": "Private Access", - "text": "If Private Access connectivity is used, ensure that you are using the Private Endpoint, Azure Virtual Network, Azure Firewall, and Azure Network Security Group checklists", + "subcategory": "Data Protection", + "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "When adding a Private Endpoint connection, public routing to your logical server isn't blocked by default. In the --Firewall and virtual networks-- pane, the setting --Deny public network access-- is not selected by default. To disable public network access, ensure that you select --Deny public network access--.", - "guid": "3a0808ee-ea7a-47ab-bdce-920a6a2b3881", - "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server", + "category": "Security", + "checklist": "Service Bus Review Checklist", + "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", + "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies", + "service": "Service Bus", "services": [ - "PrivateLink", - "SQL", - "VNet" + "TrafficManager", + "Entra", + "RBAC", + "ServiceBus", + "AzurePolicy" ], - "severity": "High", - "subcategory": "Private Access", - "text": "If Private Endpoint (Private Access) is used, consider disabling Public Access connectivity", + "severity": "Medium", + "subcategory": "Identity and Access Management", + "text": "Avoid using root account when it is not necessary", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Network Security Group (NSG) and Application Security Group (ASG) can be now applied to subnet containing Private Endpoints to restrict connections to Azure SQLDB based on internal source IP ranges.", - "guid": "8600527e-e8c4-4424-90ef-1f0dca0224f2", - "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview#network-security-of-private-endpoints", + "category": "Security", + "checklist": "Service Bus Review Checklist", + "description": "A Service Bus client app running inside an Azure App Service application or in a virtual machine with enabled managed entities for Azure resources support does not need to handle SAS rules and keys, or any other access tokens. The client app only needs the endpoint address of the Service Bus Messaging namespace. ", + "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity", + "service": "Service Bus", "services": [ - "PrivateLink", - "SQL", - "VNet" + "Storage", + "Entra", + "AKV", + "ServiceBus", + "VM", + "AppSvc" ], "severity": "Medium", - "subcategory": "Private Access", - "text": "If Private Endpoint (Private Access) is used, apply NSG and eventually ASG to limit incoming source IP address ranges", + "subcategory": "Identity and Access Management", + "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. Applications and tools that are in the same or peered virtual network in the same region could access it directly. Applications and tools that are in different region could use virtual-network-to-virtual-network connection or ExpressRoute circuit peering to establish connection. Customer should use Network Security Groups (NSG), and eventually internal firewalls, to restrict access over port 1433 only to resources that require access to a managed instance.", - "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview", + "category": "Security", + "checklist": "Service Bus Review Checklist", + "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ", + "guid": "f615658d-e558-4f93-9249-b831112dbd7e", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus", + "service": "Service Bus", "services": [ - "ExpressRoute", - "VNet", - "SQL" + "Storage", + "Entra", + "RBAC", + "Subscriptions", + "ServiceBus" ], - "severity": "Medium", - "subcategory": "Private Access", - "text": "Apply Network Security Groups (NSG) and firewall rules to restrict access to Azure SQL Managed Instance internal subnet", + "severity": "High", + "subcategory": "Identity and Access Management", + "text": "Use least privilege data plane RBAC", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Azure Virtual Network Service Endpoint is preferred solution if you want to establish a direct connection to the Azure SQL Database backend nodes using Redirect policy. This will allow access in high performance mode and is the recommended approach from a performance perspective.", - "guid": "55187443-6852-4fbd-99c6-ce303597ca7f", - "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules", + "category": "Security", + "checklist": "Service Bus Review Checklist", + "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.", + "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference", + "service": "Service Bus", "services": [ - "AzurePolicy", "VNet", - "SQL" + "Monitor", + "ServiceBus" ], - "severity": "High", - "subcategory": "Public Access", - "text": "If Public Access connectivity is used, leverage Service Endpoint to restrict access from selected Azure Virtual Networks", + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "The Azure SQL Database firewall allows you to specify IP address ranges from which communications are accepted. This approach is fine for stable IP addresses that are outside the Azure private network.", - "guid": "a73e32da-b3f4-4960-b5ec-2f42a557bf31", - "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview", + "category": "Security", + "checklist": "Service Bus Review Checklist", + "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", + "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service", + "service": "Service Bus", "services": [ - "SQL", - "Storage" + "VNet", + "ServiceBus", + "PrivateLink" ], "severity": "Medium", - "subcategory": "Public Access", - "text": "If Public Access connectivity is used, ensure that only specific known IPs are added to the firewall", + "subcategory": "Networking", + "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "We recommend that you use database-level IP firewall rules whenever possible. This practice enhances security and makes your database more portable. Use server-level IP firewall rules for administrators. Also use them when you have many databases that have the same access requirements, and you don't want to configure each database individually.", - "guid": "e0f31ac9-35c8-4bfd-9865-edb60ffc6768", - "link": "https://learn.microsoft.com/azure/azure-sql/database/firewall-configure", + "category": "Security", + "checklist": "Service Bus Review Checklist", + "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", + "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering", + "service": "Service Bus", "services": [ - "SQL", - "Storage" + "ServiceBus" ], - "severity": "Low", - "subcategory": "Public Access", - "text": "If Public Access connectivity is used and controlled by Azure SQL Database firewall rules, use database-level over server-level IP rules", + "severity": "Medium", + "subcategory": "Networking", + "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "A Managed Instance (SQL MI) can be isolated inside a virtual network to prevent external access. The Managed Instance public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. If company policy disallows the use of public endpoints, use Azure Policy to prevent enabling public endpoints in the first place.", - "guid": "b8435656-143e-41a8-9922-61d34edb751a", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview", + "category": "Automation", + "checklist": "SAP Checklist", + "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", + "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", + "service": "SAP", "services": [ - "AzurePolicy", - "VNet", - "SQL" + "SAP" ], - "severity": "High", - "subcategory": "Public Access", - "text": "Do not enable Azure SQL Managed Instance public endpoint", - "waf": "Security" + "severity": "Medium", + "subcategory": "ACSS", + "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "A Managed Instance (SQL MI) public endpoint is not enabled by default, must be explicitly enabled, only if strictly required. In this case, it is recommended to apply a Network Security Groups (NSG) to restrict access to port 3342 only to trusted source IP addresses.", - "guid": "057dd298-8726-4aa6-b590-1f81d2e30421", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview", + "category": "Automation", + "checklist": "SAP Checklist", + "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", + "service": "SAP", "services": [ - "VNet", - "SQL" + "SAP" ], - "severity": "High", - "subcategory": "Public Access", - "text": "Restrict access if Azure SQL Managed Instance public endpoint is required", - "waf": "Security" + "severity": "Medium", + "subcategory": "SDAF", + "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.", + "training": "https://github.com/Azure/sap-automation", + "waf": "Operations" }, { - "category": "Privileged Access", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Most operations, support, and troubleshooting performed by Microsoft personnel and sub-processors do not require access to customer data. In those rare circumstances where such access is required, Customer Lockbox for Microsoft Azure provides an interface for customers to review and approve or reject customer data access requests. In support scenarios where Microsoft needs to access customer data, Azure SQL Database supports Customer Lockbox to provide an interface for you to review and approve or reject customer data access requests.", - "guid": "37b6eb0f-553d-488f-8a8a-cb9bf97388ff", - "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", + "service": "SAP", "services": [ - "SQL" + "ASR", + "SAP", + "Backup" ], - "severity": "Low", - "subcategory": "Lockbox", - "text": "Review and enable Customer Lockbox for Azure SQL Database access by Microsoft personnel", - "waf": "Security" + "severity": "Medium", + "subcategory": "Backup and restore", + "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally", + "waf": "Reliability" }, { - "category": "Privileged Access", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "The principle of least privilege states that users shouldn't have more privileges than needed to complete their tasks. High-privileged database and server users can perform many configuration and maintenance activities on the database and can also drop databases in Azure SQL instance. Tracking database owners and privileged accounts is important to avoid having excessive permission.", - "guid": "5fe5281f-f0f9-4842-a682-8baf18bd8316", - "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#implement-principle-of-least-privilege", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", + "service": "SAP", "services": [ - "SQL" + "ASR", + "SAP", + "Backup" ], "severity": "Medium", - "subcategory": "Permissions", - "text": "Ensure that users are assigned the minimum level of access necessarily to complete their job functions", - "waf": "Security" + "subcategory": "Disaster recovery", + "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.", + "waf": "Reliability" }, { - "category": "Privileged Access", - "checklist": "Azure SQLDB Security Checklist (Preview)", - "description": "Identities (both Users and SPNs) should be scoped to the least amount of access needed to perform the function. A higher number of tightly scoped SPNs should be used, instead of having one SPN with multiple sets of unrelated permissions. For example, if there are three external web applications hosted on-prem that make queries to the Azure SQL Database, they should not all use the same SPN for these activities. Instead, they should each have their own tightly scoped SPN.", - "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "b651423c-8552-42db-a545-5cb50c05527a", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "SAP", "services": [ - "Entra", - "SQL" + "Storage", + "Backup", + "SQL", + "ASR", + "SAP" ], - "severity": "Low", - "subcategory": "Permissions", - "text": "Ensure that distinct applications will be assigned different credentials with minimal permissions to access Azure SQL Database", - "waf": "Security" + "severity": "High", + "subcategory": "Disaster recovery", + "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore", - "guid": "976f32a7-30d1-6caa-c2a0-207fdc26571b", - "link": "https://learn.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", "services": [ - "Backup", - "Storage", - "AVS" + "ASR", + "SAP" ], "severity": "Medium", - "subcategory": "Backup", - "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource", + "subcategory": "Disaster recovery", + "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Microsoft backup service", - "guid": "fc8af7a1-c724-e255-c18d-4ca22a6f27f0", - "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "SAP", "services": [ - "Backup", - "AVS" + "VPN", + "ExpressRoute", + "SAP", + "ASR" ], - "severity": "Medium", - "subcategory": "Business Continuity", - "text": "Use MABS as your backup solution", + "severity": "High", + "subcategory": "Disaster recovery", + "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.", + "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Best practice - this is Backup, not disaster recovery", - "guid": "be28860f-3d29-a79a-1a0e-36f1b23b36ae", - "link": "Best practice to deploy backup in the same region as your AVS deployment", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "SAP", "services": [ - "Backup", "ASR", - "AVS" + "ACR", + "SAP", + "AKV" ], - "severity": "Medium", - "subcategory": "Business Continuity", - "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud", + "severity": "Low", + "subcategory": "Disaster recovery", + "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Best practice - in case AVS is unavailable", - "guid": "4d2f79a5-4ccf-0dfc-557c-49619b99a540", - "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", + "service": "SAP", "services": [ - "AVS" + "ASR", + "VNet", + "SAP" ], "severity": "Medium", - "subcategory": "Business Continuity", - "text": "Preferably deploy MABS outside of the SDDC as native Azure IaaS", + "subcategory": "Disaster recovery", + "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?", - "guid": "ff431c40-962c-5182-d536-0c2f0c4ce9e0", - "link": "Will Disaster Recovery Site Recovery, HCX Disaster Recovery, SRM or back tools be used?", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", + "service": "SAP", "services": [ - "AVS" + "Storage", + "SAP", + "ASR" ], - "severity": "Medium", - "subcategory": "Business Continuity", - "text": "Escalation process with Microsoft in the event of a regional DR", + "severity": "Low", + "subcategory": "Disaster recovery", + "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.", + "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Compare SRM with HCX", - "guid": "f379436d-3051-daa0-01fb-dc4e0e04d677", - "link": "https://docs.microsoft.com/azure/azure-vmware/disaster-recovery-using-vmware-site-recovery-manager", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", "services": [ "ASR", - "AVS" + "SAP" ], - "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Use VMware Site Recovery Manager when both sites are Azure VMware Solution", + "severity": "High", + "subcategory": "Disaster recovery", + "text": "Native database replication technology should be used to synchronize the database in a HA pair.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Recovery into Azure instead of Vmware solution", - "guid": "367f71d8-3cf6-51a0-91a5-3db3d570cc19", - "link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", + "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", + "service": "SAP", "services": [ "ASR", - "AVS" + "VNet", + "SAP" ], - "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", + "severity": "High", + "subcategory": "Disaster recovery", + "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Avoid manual tasks as much as possible", - "guid": "ee02ada0-1887-bb3a-b84c-423f45a09ef9", - "link": "https://docs.microsoft.com/azure/site-recovery/avs-tutorial-prepare-azure", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", + "service": "SAP", "services": [ "ASR", - "AVS" + "Entra", + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Use Automated recovery plans with either of the Disaster solutions,", + "severity": "High", + "subcategory": "Disaster recovery", + "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Any other datacenter in the same region", - "guid": "0c2b74e5-9c28-780d-1df3-12d3de4aaa76", - "link": "https://docs.microsoft.com/azure/azure-vmware/connect-multiple-private-clouds-same-region", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "services": [ "ASR", - "AVS" + "SAP" ], - "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Configure a secondary disaster recovery environment", + "severity": "High", + "subcategory": "High availability", + "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions", - "guid": "c2a34ec4-2933-4e6c-dc36-e20e67abbe3f", - "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", + "service": "SAP", "services": [ "ASR", - "AVS" + "SAP" ], - "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Assign IP ranges unique to each region", + "severity": "High", + "subcategory": "High availability", + "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "ExpressRoute Global Reach can be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or routing must be done through network virtual appliances?", - "guid": "b44fb6ec-bfc1-3a8e-dba2-ca97f0991d2c", - "link": "This depends if you have multiple AVS Private Clouds. If so and they are in the same region then use AVS Interconnect. If they are in separate regions then use ExpressRoute Global Reach.", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", "services": [ + "Storage", "ASR", - "NVA", - "ExpressRoute", - "AVS" + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Use Global Reach between DR regions", + "severity": "High", + "subcategory": "High availability", + "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "An ExR Global Reach connection will be established to the ExR circuit, no other connections", - "guid": "a2c12df2-07fa-3edd-2cec-fda0b55fb952", - "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", + "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", + "service": "SAP", "services": [ - "VWAN", - "AVS" + "Storage", + "SAP", + "ASR" ], - "severity": "Medium", - "subcategory": "Direct (no vWAN, no H&S)", - "text": "Global Reach to ExR circuit - no Azure resources", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use ExR to connect on-premises (other) location to Azure", - "guid": "f62ce162-ba5a-429d-674e-fafa1af5f706", - "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-expressroute-global-reach-private-cloud", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", + "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", + "service": "SAP", "services": [ - "ExpressRoute", - "AVS" + "ASR", + "SAP" ], - "severity": "Medium", - "subcategory": "ExpressRoute", - "text": "Connect to Azure using ExR", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use the migration assesment tool and timeline to determine bandwidth required", - "guid": "cf01c73b-1247-0a7a-740c-e1ea29bda340", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-introduction", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", + "service": "SAP", "services": [ - "ExpressRoute", - "AVS" + "ASR", + "SAP", + "LoadBalancer" ], - "severity": "Medium", - "subcategory": "ExpressRoute", - "text": "Bandwidth sizing", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "What traffic is routed through a firewall, what goes directly into Azure", - "guid": "aab216ee-8941-315e-eada-c7e1f2243bd1", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", + "service": "SAP", "services": [ - "ExpressRoute", - "AVS" + "ASR", + "SAP", + "LoadBalancer" ], - "severity": "Medium", - "subcategory": "ExpressRoute", - "text": "Traffic routing ", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "Make sure the Floating IP is enabled on the Load balancer", + "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "AVS to ExR circuit, no traffic inspection", - "guid": "1f956e45-f62d-5c95-3a95-3bab718907f8", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "SAP", "services": [ - "ExpressRoute", - "AVS" + "ASR", + "SAP" ], - "severity": "Medium", - "subcategory": "ExpressRoute", - "text": "Global Reach ", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Name of the vNet and a unique address space /24 minimum", - "guid": "91f7a87b-21ac-d712-959c-8df2ba034253", - "link": "https://learn.microsoft.com/azure/virtual-network/quick-create-portal", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", + "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", + "service": "SAP", "services": [ - "VNet", - "AVS" + "ASR", + "Entra", + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Hub & Spoke", - "text": "VNet name & address space", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Subnet must be called GatewaySubnet", - "guid": "58a027e2-f37f-b540-45d5-e44843aba26b", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "cbe05bbe-209d-4490-ba47-778424d11678", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", "services": [ - "ExpressRoute", - "VNet", - "VPN", - "AVS" + "Entra", + "RBAC", + "ASR", + "VM", + "SAP" ], - "severity": "Medium", - "subcategory": "Hub & Spoke", - "text": "Gateway subnet", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Create a VPN gateway on the hub Gateway subnet", - "guid": "d4806549-0913-3e79-b580-ac2d3706e65a", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", + "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", + "service": "SAP", "services": [ - "ExpressRoute", - "VNet", - "VPN", - "AVS" + "ASR", + "SAP" ], "severity": "Medium", - "subcategory": "Hub & Spoke", - "text": "VPN Gateway", - "waf": "Performance" + "subcategory": "High availability", + "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.", + "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Create an ExR Gateway in the hub Gateway subnet.", - "guid": "864d7a8b-7016-c769-a717-61af6bfb73d2", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "9674e7c7-7796-4181-8920-09f4429543ba", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", "services": [ - "ExpressRoute", - "VNet", - "VPN", - "AVS" + "ASR", + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Hub & Spoke", - "text": "ExR Gateway", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "How will Internet traffic be routes, Az Firewall, NVA, Secure Hub, On-Premises firewall?", - "guid": "cc2e11b9-7911-7da1-458c-d7fcef794aad", - "link": "https://learn.microsoft.com/azure/azure-vmware/enable-public-internet-access", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "services": [ - "NVA", - "AVS" + "ASR", + "Entra", + "SAP" ], - "severity": "Medium", - "subcategory": "Internet", - "text": "Egress point", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Allow remote connectivity to AVS via the portal, specifically to vCenter, NSX-T and HCX", - "guid": "71e68ce3-982e-5e56-0191-01100ad0e66f", - "link": "https://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "services": [ - "Bastion", - "AVS" + "ASR", + "ACR", + "SAP" ], - "severity": "Medium", - "subcategory": "Jumpbox & Bastion", - "text": "Remote connectivity to AVS", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Name the jumpbox and identify the subnet where it will be hosted", - "guid": "6f8e93a2-44b1-bb1d-28a1-4d5b3c2ea857", - "link": "https://learn.microsoft.com/azure/bastion/tutorial-create-host-portal", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "services": [ - "VNet", - "Bastion", - "AVS" + "ASR", + "Entra", + "SAP" ], - "severity": "Medium", - "subcategory": "Jumpbox & Bastion", - "text": "Configure a jumbox and Azure Bastion", - "waf": "Performance" + "severity": "High", + "subcategory": "High availability", + "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Provides secure / seamless RDP/SSH connectivity to your vm's directly through the portal.", - "guid": "ba430d58-4541-085c-3641-068c00be9bc5", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "ed46b937-913e-4018-9c62-8393ab037e53", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", + "service": "SAP", "services": [ - "VM", - "Bastion", - "AVS" + "ASR", + "Entra", + "SAP", + "VM" ], "severity": "Medium", - "subcategory": "Jumpbox & Bastion", - "text": "Security measure allowing RDP access via the portal", - "waf": "Performance" + "subcategory": "High availability", + "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Using a VPN to connect to Azure to enable VMware communications (HCX) (not recommended)", - "guid": "9988598f-2a9f-6b12-9b46-488415ceb325", - "link": "https://learn.microsoft.com/azure/azure-vmware/configure-site-to-site-vpn-gateway", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "f656e745-0cfb-453e-8008-0528fa21c933", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "services": [ - "VPN", - "AVS" + "Storage", + "ASR", + "SAP", + "VM" ], "severity": "Medium", - "subcategory": "VPN", - "text": "Connect to Azure using a VPN", - "waf": "Performance" + "subcategory": "High availability", + "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use the migration assesment tool and timeline to determine bandwidth required (eg 3rd party tool in link)", - "guid": "956ce5e9-a862-fe2b-a50d-a22923569357", - "link": "https://www.omnicalculator.com/other/data-transfer#:~:text=To%20calculate%20the%20data%20transfer%20speed%3A%201%20Download,measured%20time%20to%20find%20the%20data%20transfer%20speed.", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "7f684ebc-95da-425e-b329-e782dbed050f", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", + "service": "SAP", "services": [ - "VPN", - "AVS" + "ASR", + "SAP" ], "severity": "Medium", - "subcategory": "VPN", - "text": "Bandwidth sizing", - "waf": "Performance" + "subcategory": "High availability", + "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "What traffic is routed through a firewall, what goes directly into Azure", - "guid": "e095116f-0bdc-4b51-4d71-b9e469d56f59", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", "services": [ - "VPN", - "AVS" + "Storage", + "SAP", + "ASR" ], - "severity": "Medium", - "subcategory": "VPN", - "text": "Traffic routing ", - "waf": "Performance" + "severity": "High", + "subcategory": "Storage", + "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Name and unique address space for the vWAN, name for the vWAN hub", - "guid": "4dc480ac-cecd-39c4-fdc6-680b300716ab", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-site-to-site-portal#openvwan", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", + "service": "SAP", "services": [ - "VWAN", - "AVS" + "Storage", + "SAP", + "ASR" ], - "severity": "Medium", - "subcategory": "vWAN hub", - "text": "vWAN name, hub name and address space", - "waf": "Performance" + "severity": "High", + "subcategory": "Storage", + "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.", + "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Select either boh or the appropriate connection type.", - "guid": "51d6affd-8e02-6aea-d3d4-0baf618b3076", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-point-to-site-portal", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", + "service": "SAP", "services": [ - "VPN", - "VWAN", - "AVS" + "Storage", + "SAP", + "ASR" ], - "severity": "Medium", - "subcategory": "vWAN hub", - "text": "ExR and/or VPN gateway provisioned", - "waf": "Performance" + "severity": "High", + "subcategory": "Storage", + "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", + "waf": "Reliability" }, { - "category": "Connectivity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Add Azure firewall to vWAN (recommended)", - "guid": "e32a4c67-3dc0-c134-1c12-52d46dcbab5b", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-expressroute-portal", + "category": "Business Continuity and Disaster Recovery", + "checklist": "SAP Checklist", + "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", + "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", + "service": "SAP", "services": [ - "Firewall", - "VWAN", - "AVS" + "Storage", + "SAP", + "ASR" ], - "severity": "Medium", - "subcategory": "vWAN hub", - "text": "Secure vWAN", - "waf": "Security" + "severity": "High", + "subcategory": "Storage", + "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.", + "waf": "Reliability" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Active directory or other identity provider servers", - "guid": "fbc47fbf-bc96-fa93-ed5d-8c9be63cd5c3", - "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter", + "category": "Cost Optimization", + "checklist": "SAP Checklist", + "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", + "service": "SAP", "services": [ - "Entra", - "AVS" + "SAP", + "Cost" ], "severity": "Medium", - "subcategory": "Access", - "text": "External Identity (user accounts)", - "waf": "Security" + "subcategory": " ", + "text": "Automate SAP System Start-Stop to manage costs.", + "waf": "Cost" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Not required for LDAPS, required for Kerberos", - "guid": "b5db7975-f6bb-8ba3-ee5f-e3e805887997", - "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology", + "category": "Cost Optimization", + "checklist": "SAP Checklist", + "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", "services": [ - "Entra", - "AVS" + "Storage", + "SAP", + "VM", + "Cost" ], - "severity": "Medium", - "subcategory": "Access", - "text": "If using AD domain, ensure Sites & Services has been configured", - "waf": "Security" + "severity": "Low", + "subcategory": " ", + "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.", + "waf": "Cost" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Authentication for users, must be secure.", - "guid": "c30749c4-e2af-558c-2eb9-0b6ae84881d1", - "link": "https://learn.microsoft.com/azure/azure-vmware/configure-identity-source-vcenter", + "category": "Cost Optimization", + "checklist": "SAP Checklist", + "guid": "9877f353-2591-4e8b-8381-e9043fed1010", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", "services": [ - "Entra", - "AVS" + "Storage", + "SAP", + "VM", + "Cost" ], - "severity": "Medium", - "subcategory": "Access", - "text": "Use LDAPS not ldap ( vCenter)", - "waf": "Security" + "severity": "Low", + "subcategory": " ", + "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.", + "waf": "Cost" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Authentication for users, must be secure.", - "guid": "64cb9b5c-9edd-787e-1dd8-2b2338e51635", - "link": "https://learn.microsoft.com/azure/azure-vmware/configure-external-identity-source-nsx-t", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", + "service": "SAP", "services": [ "Entra", - "AVS" + "RBAC", + "SAP", + "Subscriptions" ], - "severity": "Medium", - "subcategory": "Access", - "text": "Use LDAPS not ldap (NSX-T)", + "severity": "High", + "subcategory": "Identity", + "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "CN or SAN names, no wildcards, contains private key - CER or PFX", - "guid": "bec285ab-037e-d629-81d1-f61dac23cd4c", - "link": "https://youtu.be/4jvfbsrhnEs", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "45911475-e39e-4530-accc-d979366bcda2", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "services": [ "Entra", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Security", - "text": "Security certificate installed on LDAPS servers ", + "subcategory": "Identity", + "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Standard Azure Roles Based Access Controls", - "guid": "4ba394a2-3c33-104c-8e34-2dadaba9cc73", - "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "services": [ - "RBAC", "Entra", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Security", - "text": "RBAC applied to Azure roles", + "subcategory": "Identity", + "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Create roles in vCenter required to meet minimum viable access guidelines", - "guid": "b04ca129-83a9-3494-7512-347dd2d766db", - "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity#view-the-vcenter-server-privileges", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", "services": [ - "RBAC", "Entra", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Security", - "text": "RBAC model in vCenter", + "subcategory": "Identity", + "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)", - "guid": "8e477d2f-8004-3dd0-93d6-0aece9e1b2fb", - "link": "Best practice", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", + "service": "SAP", "services": [ - "RBAC", "Entra", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Security", - "text": "CloudAdmin role usage", + "subcategory": "Identity", + "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "For roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)", - "guid": "00e0b729-f9be-f600-8c32-5ec0e8f2ed63", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", "services": [ "Entra", - "RBAC", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Security ", - "text": "Is Privileged Identity Management implemented", + "subcategory": "Identity", + "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "For the Azure VMware Solution PIM roles", - "guid": "0842d45f-41a8-8274-1155-2f6ed554d315", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", + "service": "SAP", "services": [ "Entra", - "RBAC", - "AVS" + "SAP", + "AKV" ], "severity": "Medium", - "subcategory": "Security ", - "text": "Is Privileged Identity Management audit reporting implemented", + "subcategory": "Identity", + "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Best practice, also see Monitoring/Alerts", - "guid": "915cbcd7-0640-eb7c-4162-9f33775de559", - "link": "Best practice", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", + "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", + "service": "SAP", "services": [ "Entra", - "Monitor", - "AVS" + "SAP", + "AKV" ], "severity": "Medium", - "subcategory": "Security ", - "text": "Limit use of CloudAdmin account to emergency access only", + "subcategory": "Identity", + "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Operational procedure", - "guid": "7effa0c0-9172-e8e4-726a-67dbea8be40a", - "link": "https://learn.microsoft.com/azure/azure-vmware/rotate-cloudadmin-credentials?tabs=azure-portal", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "16785d6f-a96c-496a-b885-18f482734c88", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", + "service": "SAP", "services": [ "Entra", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Security ", - "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials", + "subcategory": "Identity", + "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.", "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)", - "guid": "8f426fd0-d73b-d398-1f6f-df0cbe262a82", - "link": "https://learn.microsoft.com/azure/azure-arc/vmware-vsphere/overview", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "a747c350-8d4c-449c-93af-393dbca77c48", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", + "service": "SAP", "services": [ - "Arc", - "VM", - "AVS" + "Entra", + "SAP" ], "severity": "Medium", - "subcategory": "Operations", - "text": "AVS VM Management (Azure Arc)", - "waf": "Operations" + "subcategory": "Identity", + "text": "Implement SSO to SAP HANA", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions", - "guid": "11dbe773-e380-9191-1418-e886fa7a6fd0", - "link": "https://docs.microsoft.com/azure/governance/policy/overview", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", + "service": "SAP", "services": [ - "AzurePolicy", - "Monitor", - "AVS" + "Entra", + "SAP" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Azure policy", - "waf": "Operations" + "subcategory": "Identity", + "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud", - "guid": "1e59c639-9b7e-a60b-5e93-3798c1aff5db", - "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json#configure-locks", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", + "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", + "service": "SAP", "services": [ - "AVS" + "Entra", + "SAP" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Resource locks", - "waf": "Operations" + "subcategory": "Identity", + "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "For manual deployments, all configuration and deployments must be documented", - "guid": "8f2c46aa-ca1b-cad3-3ac9-213dfc0a265e", - "link": "Make sure to create your own runbook on the deployment of AVS.", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", + "service": "SAP", "services": [ - "AVS" + "Entra", + "SAP" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Run books", - "waf": "Operations" + "subcategory": "Identity", + "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use", - "guid": "86b314f9-1f1e-317a-4dfb-cf510ad4a030", - "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", + "service": "SAP", "services": [ - "AKV", - "AVS" + "Entra", + "SAP" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Naming conventions for auth keys", - "waf": "Operations" + "subcategory": "Identity", + "text": "Implement SSO to SAP BTP", + "waf": "Security" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "For automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", - "guid": "e22a2d99-eb71-7d7c-07af-6d4cdb1d4443", - "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", + "category": "Identity and Access", + "checklist": "SAP Checklist", + "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", + "service": "SAP", "services": [ - "Monitor", - "AVS" + "Entra", + "SAP" ], "severity": "Medium", - "subcategory": "Alerts", - "text": "Create warning alerts for critical thresholds ", - "waf": "Operations" + "subcategory": "Identity", + "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.", + "waf": "Security" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", - "guid": "6d02f159-627d-79bf-a931-fab6d947eda2", - "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", + "category": "Management Group and Subscriptions", + "checklist": "SAP Checklist", + "guid": "6ba28021-4591-4147-9e39-e5309cccd979", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", + "service": "SAP", "services": [ - "Monitor", - "AVS" + "Subscriptions", + "SAP", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Alerts", - "text": "Create critical alert vSAN consumption", + "subcategory": "Subscriptions", + "text": "enforce existing Management Group policies to SAP Subscriptions", + "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Provides platform alerts (generated by Microsoft)", - "guid": "1cc97b39-2c7e-246f-6d73-789cfebfe951", - "link": "https://www.virtualworkloads.com/2021/04/azure-vmware-solution-azure-service-health/", + "category": "Management Group and Subscriptions", + "checklist": "SAP Checklist", + "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", "services": [ - "Monitor", - "AVS" + "Subscriptions", + "SAP" ], - "severity": "Medium", - "subcategory": "Alerts", - "text": "Configured for Azure Service Health alerts and notifications", + "severity": "High", + "subcategory": "Subscriptions", + "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads", - "guid": "0962606c-e3b4-62a9-5661-e4ffd62a4509", - "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", + "category": "Management Group and Subscriptions", + "checklist": "SAP Checklist", + "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", "services": [ - "Monitor", - "Backup", - "AzurePolicy", - "AVS", - "VM" + "Subscriptions", + "SAP" ], - "severity": "Medium", - "subcategory": "Backup", - "text": "Backup policy", + "severity": "High", + "subcategory": "Subscriptions", + "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ", + "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Keep in mind the lead time for requesting new nodes", - "guid": "4ec7ccfb-795e-897e-4a84-fd31c04eadc6", - "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", + "category": "Management Group and Subscriptions", + "checklist": "SAP Checklist", + "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", + "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", + "service": "SAP", "services": [ - "AzurePolicy", - "Monitor", - "AVS" + "Subscriptions", + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Capacity", - "text": "Policy around ESXi host density and efficiency", + "severity": "High", + "subcategory": "Subscriptions", + "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)", + "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Azure Cost Management can be used - one option, put AVS in it's own Subscription. ", - "guid": "7f8f175d-13f4-5298-9e61-0bc7e9fcc279", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/govern", + "category": "Management Group and Subscriptions", + "checklist": "SAP Checklist", + "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", + "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", + "service": "SAP", "services": [ - "Cost", "Subscriptions", - "Monitor", - "AVS" + "SAP" ], - "severity": "Medium", - "subcategory": "Costs", - "text": "Ensure a good cost management process is in place for Azure VMware Solution - ", + "severity": "Low", + "subcategory": "Subscriptions", + "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Create dashboards to enable core Azure VMware Solution monitoring insights", - "guid": "01e689e0-7c6c-b58f-37bd-4d6b9b1b9c74", - "link": "https://docs.microsoft.com/azure/azure-portal/azure-portal-dashboards", + "category": "Management Group and Subscriptions", + "checklist": "SAP Checklist", + "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", + "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", + "service": "SAP", "services": [ - "Monitor", - "NetworkWatcher", - "AVS" + "Subscriptions", + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Dashboard", - "text": "Connection monitor dashboard", + "severity": "High", + "subcategory": "Subscriptions", + "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Send to an Azure Storage account or Azure EventHub for processing (direct to Log Analytics is pending)", - "guid": "f9afdcc9-649d-d840-9fb5-a3c0edcc697d", - "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", + "category": "Management Group and Subscriptions", + "checklist": "SAP Checklist", + "guid": "e6e20617-3686-4af4-9791-f8935ada4332", + "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", + "service": "SAP", "services": [ - "Storage", - "Monitor", - "AVS" + "Subscriptions", + "SAP" ], - "severity": "Medium", - "subcategory": "Logs & Metrics", - "text": "Configure Azure VMware Solution logging ", + "severity": "High", + "subcategory": "Subscriptions", + "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Must be on-premises, implement if available", - "guid": "7cbac8c3-4eda-d5d9-9bda-c6b5abba9fb6", - "link": "Is vROPS or vRealize Network Insight going to be used? ", + "category": "Management Group and Subscriptions", + "checklist": "SAP Checklist", + "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", + "service": "SAP", "services": [ - "Monitor", - "AVS" + "TrafficManager", + "Subscriptions", + "SAP", + "Cost" ], "severity": "Medium", - "subcategory": "Logs & Metrics", - "text": "vRealize Operations", + "subcategory": "Subscriptions", + "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor", - "guid": "b243521a-644d-f865-7fb6-21f9019c0dd2", - "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", "services": [ - "VM", "Monitor", - "AVS" + "SAP", + "Backup" ], - "severity": "Medium", - "subcategory": "Logs & Metrics", - "text": "AVS VM logging", - "waf": "Operations" + "severity": "High", + "subcategory": "BCDR", + "text": "Help protect your HANA database by using the Azure Backup service.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "Reliability" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Between on-premises to Azure are monitored using 'connection monitor'", - "guid": "2ca97d91-dd36-7229-b668-01036ccc3cd3", - "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", + "service": "SAP", "services": [ + "Storage", + "Entra", "Monitor", - "ExpressRoute", - "NetworkWatcher", - "VPN", - "AVS" + "VM", + "SAP" ], "severity": "Medium", - "subcategory": "Network", - "text": "Monitor ExpressRoute and/or VPN connections ", - "waf": "Operations" + "subcategory": "BCDR", + "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.", + "waf": "Reliability" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "To monitor the Azure VMware Solution back-end ExpressRoute connection (Azure native to AVS)", - "guid": "99209143-60fe-19f0-5633-8b5671277ba5", - "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", "services": [ - "ExpressRoute", "Monitor", - "AVS" + "SAP" ], - "severity": "Medium", - "subcategory": "Network", - "text": "Monitor from an Azure native resource to an Azure VMware Solution VM", + "severity": "High", + "subcategory": "Management", + "text": "Ensure time-zone matches between the operating system and the SAP system.", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "To monitor end-to-end, on-premises to AVS workloads", - "guid": "b9e5867c-57d3-036f-fb1b-3f0a71664efe", - "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "c3c7abc0-716c-4486-893c-40e181d65539", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", + "service": "SAP", "services": [ + "Entra", "Monitor", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Network", - "text": "Monitor from an on-premises resource to an Azure VMware Solution VM", - "waf": "Operations" + "subcategory": "Management", + "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Track requests to Azure VMware Solution and Azure VMware Solution based workloads", - "guid": "4af7c5f7-e5e9-bedf-a8cf-314b81735962", - "link": "Firewall logging and alerting rules are configured (Azure Firewall or 3rd party)", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "a491dfc4-9353-4213-9217-eef0949f9467", + "link": "https://azure.microsoft.com/pricing/offers/dev-test/", + "service": "SAP", "services": [ "Monitor", - "AVS" + "SAP", + "Cost" ], - "severity": "Medium", - "subcategory": "Security", - "text": "Auditing and logging is implemented for inbound internet ", - "waf": "Operations" + "severity": "Low", + "subcategory": "Management", + "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.", + "waf": "Cost" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity", - "guid": "74be60a3-cfac-f057-eda6-3ee087e805d5", - "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", + "link": "https://learn.microsoft.com/azure/lighthouse/overview", + "service": "SAP", "services": [ + "Entra", "Monitor", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Security", - "text": "Session monitoring ", + "subcategory": "Management", + "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Enable Diagnostic and metric logging on Azure VMware Solution", - "guid": "a434b3b5-f258-0845-cd76-d7df6ef5890e", - "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "4d116785-d2fa-456c-96ad-48408fe72734", + "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", + "service": "SAP", "services": [ "Monitor", - "AVS" + "SAP", + "VM" ], "severity": "Medium", - "subcategory": "VMWare", - "text": "Logging and diagnostics", + "subcategory": "Management", + "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.", + "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", "waf": "Operations" }, { - "category": "Monitoring", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Monitor AVS workloads (each VM in AVS)", - "guid": "fb00b69a-83ec-ce72-446e-6c23a0cab09a", - "link": "https://docs.microsoft.com/azure/azure-monitor/agents/agent-windows?tabs=setup-wizard", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", + "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", + "service": "SAP", "services": [ - "VM", "Monitor", - "AVS" - ], - "severity": "Medium", - "subcategory": "VMware", - "text": "Log Analytics Agents deployed on Azure VMware Solution guest VM workloads", + "SAP" + ], + "severity": "Low", + "subcategory": "Management", + "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Decision on traffic flow", - "guid": "a1354b87-e18e-bf5c-c50b-8ddf0540e971", - "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-hub-and-spoke", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "14591147-5e39-4e53-89cc-cd979366bcda", + "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", + "service": "SAP", "services": [ - "AVS" + "Monitor", + "SAP", + "SQL" ], "severity": "Medium", - "subcategory": "Hub & Spoke", - "text": "North/South routing through Az Firewall or 3rd party ", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Decision to route Azure to Azure traffic through Firewall, not E/W between AVS workloads (internal to AVS)", - "guid": "29a8a499-ec31-f336-3266-0895f035e379", - "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-hub-and-spoke", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", + "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", + "service": "SAP", "services": [ - "AVS" + "Entra", + "Monitor", + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Hub & Spoke", - "text": "East West (Internal to Azure)", - "waf": "Security" + "severity": "High", + "subcategory": "Monitoring", + "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.", + "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Requires a 3rd party NVA with Azure Route server - Scenario 2 (see link)", - "guid": "ebd3cc3c-ac3d-4293-950d-cecd8445a523", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "SAP", "services": [ - "ARS", - "NVA", - "AVS" + "Monitor", + "SAP", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Hub & Spoke", - "text": "ExR without Global Reach", + "subcategory": "Monitoring", + "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "When route server is used, ensure no more then 200 routes are propagated from route server to ExR gateway to on-premises (ARS limit). Important when using MoN", - "guid": "ffb5c5ca-bd89-ff1b-8b73-8a54d503d506", - "link": "https://learn.microsoft.com/azure/route-server/route-server-faq", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", + "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", + "service": "SAP", "services": [ - "ARS", - "AVS" + "Monitor", + "SAP", + "NetworkWatcher" ], "severity": "Medium", - "subcategory": "Hub & Spoke", - "text": "Route server ", + "subcategory": "Monitoring", + "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Via on-premises, Az Firewall, 3rd Party, NSX-T pubic IP", - "guid": "a4070dad-3def-818d-e9f7-be440d10e7de", - "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-design-public-internet-access", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "73686af4-6791-4f89-95ad-a43324e13811", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", + "service": "SAP", "services": [ - "AVS" + "Monitor", + "SAP", + "VM" ], "severity": "Medium", - "subcategory": "Internet", - "text": "Egress point(s)", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Az Firewall, 3rd party NVA, Application Gateway, Azure Frontdoor ", - "guid": "e942c03d-beaa-3d9f-0526-9b26cd5e9937", - "link": "Research and choose optimal solution for each application", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "616785d6-fa96-4c96-ad88-518f482734c8", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", "services": [ - "FrontDoor", - "NVA", - "AppGW", - "AVS" + "Subscriptions", + "SAP", + "Monitor" ], - "severity": "Medium", - "subcategory": "Internet", - "text": "Internet facing applications", - "waf": "Security" + "severity": "High", + "subcategory": "Monitoring", + "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.", + "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "waf": "Performance" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Ensure no more then 200 routes are propagated from route server to ExR gateway to on-premises (ARS limit). Important when using MoN", - "guid": "e778a2ec-b4d7-1d27-574c-14476b167d37", - "link": "https://docs.microsoft.com/azure/route-server/route-server-faq#route-server-limits", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", + "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", + "service": "SAP", "services": [ - "ARS", - "AVS" + "Storage", + "Monitor", + "SAP", + "ASR" ], "severity": "Medium", - "subcategory": "Routing", - "text": "When route server Route limit understood? ", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.", + "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", + "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "(VPN Gateway, AppGW, FrontDoor, Load balancer, VMs (etc) (Remove: enabled on ExR/VPN Gateway subnet in Azure)", - "guid": "66c97b30-81b9-139a-cc76-dd1d94aef42a", - "link": "https://docs.microsoft.com/azure/ddos-protection/manage-ddos-protection", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", + "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", + "service": "SAP", "services": [ - "VNet", - "ExpressRoute", - "FrontDoor", - "VPN", - "LoadBalancer", - "DDoS", - "AVS", - "VM", - "AppGW" + "Monitor", + "SAP", + "Sentinel" ], "severity": "Medium", - "subcategory": "Security", - "text": "Is DDoS standard protection of public facing IP addresses? ", + "subcategory": "Monitoring", + "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.", + "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "To manage Azure VMware Solution, vCenter, NSX manager and HCX manager", - "guid": "d43da920-4ecc-a4e9-dd45-a2986ce81d32", - "link": "Best practice: Bastion or 3rd party tool", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", + "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "service": "SAP", "services": [ - "AVS" + "Monitor", + "SAP", + "Cost" ], "severity": "Medium", - "subcategory": "Security", - "text": "Use a dedicated privileged access workstation (PAW)", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.", + "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use NSX-T for inter-vmware-traffic inspection", - "guid": "a2dac74f-5380-6e39-25e6-f13b99ece51f", - "link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-F6685367-7AA1-4771-927E-ED77727CFDA3.html", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", + "service": "SAP", "services": [ - "AVS" + "Monitor", + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Traffic Inspection", - "text": "East West (Internal to AVS)", - "waf": "Security" + "severity": "Low", + "subcategory": "Performance", + "text": "Use inter-VM latency monitoring for latency-sensitive applications.", + "waf": "Performance" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Decision on whether or not to use Secure hub for E/W and Internet traffic - requires Global Reach", - "guid": "3f621543-dfac-c471-54a6-7b2849b6909a", - "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", "services": [ - "Firewall", - "VWAN", - "AVS" + "ASR", + "Monitor", + "SAP" ], "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "Use Secure Hub (Azure Firewall or 3rd party)", - "waf": "Security" + "subcategory": "Performance", + "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Decision to route Azure to Azure traffic through Firewall, not E/W between AVS workloads (internal to AVS)", - "guid": "d7af5670-1b39-d95d-6da2-8d660dfbe16b", - "link": "https://learn.microsoft.com/azure/firewall-manager/secure-cloud-network", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", "services": [ - "VWAN", - "AVS" + "Storage", + "Monitor", + "SAP" ], "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "East West (Internal to Azure)", - "waf": "Security" + "subcategory": "Performance", + "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.", + "waf": "Performance" }, { - "category": "Other Services/Operations", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution", - "guid": "7d049005-eb35-4a93-50a5-3b31a9f61161", - "link": "https://docs.microsoft.com/azure/azure-vmware/configure-nsx-network-components-azure-portal", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "c027f893-f404-41a9-b33d-39d625a14964", + "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", + "service": "SAP", "services": [ - "Subscriptions", - "AVS" + "Monitor", + "SAP" ], - "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Scale out operations planning", + "severity": "Low", + "subcategory": "Performance", + "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.", "waf": "Performance" }, { - "category": "Other Services/Operations", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action", - "guid": "7242c1de-da37-27f3-1ddd-565ccccb8ece", - "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", + "service": "SAP", "services": [ - "AzurePolicy", "Storage", - "AVS" + "Monitor", + "SAP" ], "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Scale in operations planning", + "subcategory": "Performance", + "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.", + "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", "waf": "Performance" }, { - "category": "Other Services/Operations", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)", - "guid": "3233e49e-62ce-97f3-8737-8230e771b694", - "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", + "service": "SAP", "services": [ - "AVS" + "Monitor", + "SAP", + "SQL" ], "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Scale serialized operations planning", + "subcategory": "Performance", + "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.", + "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", "waf": "Performance" }, { - "category": "Other Services/Operations", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", - "guid": "68161d66-5707-319b-e77d-9217da892593", - "link": "Best practice (testing)", + "category": "Management and Monitoring", + "checklist": "SAP Checklist", + "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", "services": [ - "AVS" + "ASR", + "Monitor", + "SAP" ], - "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Scale rd operations planning", - "waf": "Performance" + "severity": "High", + "subcategory": "Reliability", + "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", + "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "waf": "Operations" }, { - "category": "Other Services/Operations", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Define and enforce scale in/out maximum limits for your environment in the automations", - "guid": "c32cb953-e860-f204-957a-c79d61202669", - "link": "Operational planning - understand workload requirements", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "SAP", "services": [ - "AVS" + "SAP", + "AzurePolicy", + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Scale maximum operations planning", - "waf": "Performance" + "subcategory": "App delivery", + "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", + "waf": "Security" }, { - "category": "Other Services/Operations", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses", - "guid": "7bd65a5e-7b5d-652d-dbea-fc6f73a42857", - "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-management-and-monitoring", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", "services": [ - "Monitor", - "AVS" + "DNS", + "SAP", + "VM" ], "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Monitor scaling operations ", - "waf": "Performance" + "subcategory": "DNS", + "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "Operations" }, { - "category": "Other Services/Operations", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Consider the use of Azure Private-Link when using other Azure Native Services", - "guid": "95e374af-8a2a-2672-7ab7-b4a1be43ada7", - "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", "services": [ - "PrivateLink", - "AVS" + "VNet", + "DNS", + "SAP" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Private link", - "waf": "Performance" + "subcategory": "DNS", + "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "Operations" }, { - "category": "Other Services/Operations", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs", - "guid": "71eff90d-5ad7-ac60-6244-2a6f7d3c51f2", - "link": "Best practice", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "a3592829-e6e2-4061-9368-6af46791f893", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "service": "SAP", "services": [ - "AVS" + "VNet", + "ACR", + "SAP" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Provisioning Vmware VLANs", - "waf": "Performance" + "subcategory": "Hybrid", + "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions", + "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", + "waf": "Reliability" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "In which region will AVS be deployed", - "guid": "04e3a2f9-83b7-968a-1044-2811811a924b", - "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", + "service": "SAP", "services": [ - "AVS" + "SAP", + "NVA" ], - "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Region selected", - "waf": "Reliability" + "severity": "High", + "subcategory": "Hybrid", + "text": "It is not supported to deploy any NVA between SAP application and SAP Database server", + "training": "https://me.sap.com/notes/2731110", + "waf": "Performance" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Are there regulatory or compliance policies in play", - "guid": "e52d1615-9cc6-565c-deb6-743ed7e90f4b", - "link": "Internal policy or regulatory compliance", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", + "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", + "service": "SAP", "services": [ - "AzurePolicy", - "AVS" + "ACR", + "SAP", + "VWAN" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Data residency compliant with selected regions", - "waf": "Reliability" + "subcategory": "Hybrid", + "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", + "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "waf": "Operations" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Request through the support blade", - "guid": "92bd5ad6-441f-a983-7aa9-05dd669d760b", - "link": "https://learn.microsoft.com/azure/migrate/concepts-azure-vmware-solution-assessment-calculation", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", + "service": "SAP", "services": [ - "AVS" + "VNet", + "SAP", + "NVA" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Request for number of AVS hosts submitted ", - "waf": "Reliability" - }, - { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "PG approval for deployment", - "guid": "28370f63-1cb8-2e35-907f-c5516b6954fa", - "link": "Support request through portal or get help from Account Team", + "subcategory": "Hybrid", + "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.", + "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", + "waf": "Operations" + }, + { + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", + "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", + "service": "SAP", "services": [ - "AVS" + "VNet", + "SAP", + "VWAN", + "NVA" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Region and number of AVS nodes approved", - "waf": "Reliability" + "subcategory": "Hybrid", + "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.", + "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", + "waf": "Operations" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Portal/subscription/resource providers/ Microsoft.AVS", - "guid": "96c76997-30a6-bb92-024d-f4f93f5f57fa", - "link": "Done through the subscription/resource providers/ AVS register in the portal", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "82734c88-6ba2-4802-8459-11475e39e530", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", "services": [ - "Subscriptions", - "AVS" + "VNet", + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Resource provider for AVS registered", - "waf": "Reliability" + "severity": "High", + "subcategory": "IP plan", + "text": "Public IP assignment to VM running SAP Workload is not recommended.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "waf": "Security" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Connectivity, subscription & governanace model", - "guid": "5898e3ff-5e6b-bee1-6f85-22fee261ce63", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/enterprise-scale-landing-zone", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", + "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "service": "SAP", "services": [ - "Subscriptions", - "AVS" + "ASR", + "VNet", + "SAP" ], - "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Landing zone architecture", - "waf": "Reliability" + "severity": "High", + "subcategory": "IP plan", + "text": "Consider reserving IP address on DR side when configuring ASR", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Operations" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "The name of the RG where AVS will exist", - "guid": "d0181fb8-9cb8-bf4b-f5e5-b5f9bf7ae4ea", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/manage-resource-groups-portal", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", "services": [ - "AVS" + "VNet", + "SAP" ], - "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Resource group name selected", - "waf": "Reliability" + "severity": "High", + "subcategory": "IP plan", + "text": "Avoid using overlapping IP address ranges for production and DR sites.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "waf": "Operations" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Each resource created as part of the deployment will also utilize this prefix in the name", - "guid": "0f0d20c2-5a19-726c-de20-0984e070d9d6", - "link": "Best practice - naming standards", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "6e154e3a-a359-4282-ae6e-206173686af4", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", + "service": "SAP", "services": [ - "AVS" + "Storage", + "VNet", + "SAP" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Deployment prefix selected", - "waf": "Reliability" + "subcategory": "IP plan", + "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.", + "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", + "waf": "Operations" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "/22 unique non-overlapping IPv4 address space", - "guid": "7fbf2ab7-a36c-5957-c27a-67038557af2a", - "link": "https://learn.microsoft.com/azure/azure-vmware/tutorial-network-checklist#routing-and-subnet-considerations", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", + "service": "SAP", "services": [ - "AVS" + "SAP", + "Firewall" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Network space for AVS management layer", - "waf": "Reliability" + "subcategory": "Internet", + "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", + "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "vNets used by workloads running in AVS (non-stretched)", - "guid": "0c87f999-e517-21ef-f355-f210ad4134d2", - "link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/installation/GUID-4B3860B8-1883-48CA-B2F3-7C2205D91D6D.html", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", + "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", + "service": "SAP", "services": [ - "VNet", - "AVS" + "SAP", + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Network space for AVS NSX-T segments", - "waf": "Reliability" + "subcategory": "Internet", + "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", + "waf": "Security" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Choose AV36, AV36P, AV52, AV36T (AV36T = Trial)", - "guid": "946c8966-f902-6f53-4f37-00847e8895c2", - "link": "https://azure.microsoft.com/pricing/details/azure-vmware/", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", "services": [ - "AVS" + "WAF", + "ACR", + "AzurePolicy", + "SAP", + "FrontDoor" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "AVS SKU (region dependent)", - "waf": "Performance" + "subcategory": "Internet", + "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", + "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", + "waf": "Security" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use the Azure migration assessment tool to determine the minimum number of nodes required (consider BCDR as well)", - "guid": "31833808-26ba-9c31-416f-d54a89a17f5d", - "link": "https://learn.microsoft.com/azure/migrate/how-to-assess", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "SAP", "services": [ - "AVS" + "WAF", + "AzurePolicy", + "SAP", + "FrontDoor", + "AppGW" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Number of hosts to be deployed", - "waf": "Performance" + "subcategory": "Internet", + "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", + "waf": "Security" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Understand how and if you should be using reserved instances (cost control)", - "guid": "f2b73c4f-3d46-32c9-5df1-5b8dfcd3947f", - "link": "https://azure.microsoft.com/en-ca/pricing/details/azure-vmware/#:~:text=Azure%20VMware%20Solution%20%20%20%20Instance%20size,TB%20%28all%20NVMe%29%20%20%20N%2FA%20%2Fhour%20", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "5ada4332-4e13-4811-9231-81aa41742694", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", "services": [ - "Cost", - "AVS" + "LoadBalancer", + "SAP", + "WAF", + "AppGW" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Reserverd Instances", - "waf": "Cost" + "subcategory": "Internet", + "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", + "waf": "Security" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement", - "guid": "94ac48ab-ade5-3fa7-f800-263feeb97070", - "link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "SAP", "services": [ - "ASR", - "AVS" + "ACR", + "SAP", + "VWAN" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Capacity ", + "subcategory": "Internet", + "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", "waf": "Performance" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Identify which of the networking scenarios make ", - "guid": "1f9d4bd5-14b8-928c-b4cb-eb211f9b8de5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "SAP", "services": [ - "AVS" + "Storage", + "VNet", + "Backup", + "ACR", + "SAP", + "PrivateLink" ], "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "Networking & Connectivity See docs describing scenrario 1 through 5", - "waf": "Reliability" + "subcategory": "Internet", + "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.", + "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", + "waf": "Security" }, { - "category": "Planning", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.", - "guid": "070db19b-8a2a-fd6a-c39b-4488d8780da9", - "link": "Please Check Partner Ecosystem", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", + "service": "SAP", "services": [ - "AVS" + "SAP", + "VM" ], - "severity": "Medium", - "subcategory": "Pre-deployment", - "text": "3rd party application compatibility ", - "waf": "Reliability" + "severity": "High", + "subcategory": "Segmentation", + "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "waf": "Performance" }, { - "category": "Security", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible", - "guid": "70cfbddc-d3d4-9188-77c8-1cabaefef646", - "link": "General recommendation for storing encryption keys.", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", + "service": "SAP", "services": [ - "AKV", - "AVS" + "SAP", + "LoadBalancer" ], "severity": "Medium", - "subcategory": "Encryption", - "text": "Use Azure Key Vault with in-guest encryption ", + "subcategory": "Segmentation", + "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.", + "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)", - "guid": "c1a81638-18df-0ce9-a73a-4b9a8a8dd392", - "link": "https://docs.microsoft.com/azure/azure-vmware/concepts-storage#data-at-rest-encryption", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "6791f893-5ada-4433-84e1-3811523181aa", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "SAP", "services": [ - "SQL", - "AVS" + "VNet", + "SAP", + "VM" ], "severity": "Medium", - "subcategory": "Encryption", - "text": "Use in-guest encryption", + "subcategory": "Segmentation", + "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.", + "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute", - "guid": "8d0a8f51-8d35-19cd-c2fe-4e3512fb467e", - "link": "https://docs.microsoft.com/azure/key-vault/general/authentication", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", "services": [ - "ExpressRoute", - "AKV", - "AVS" + "VNet", + "SAP" ], - "severity": "Medium", - "subcategory": "Encryption", - "text": "Keyvault use for secrets", - "waf": "Security" + "severity": "High", + "subcategory": "Segmentation", + "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Performance" }, { - "category": "Security", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Older OS security patching configured for workloads running on Azure VMware Solution are eligible for ESU", - "guid": "4f8b20e9-a2a1-f80f-af9b-8aa3b26dca08", - "link": "https://docs.microsoft.com/windows-server/get-started/extended-security-updates-deploy", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "fa96c96a-d885-418f-9827-34c886ba2802", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "services": [ - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Extended support", - "text": "Ensure extended security update support ", - "waf": "Security" + "subcategory": "Segmentation", + "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.", + "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", + "waf": "Performance" }, { - "category": "Security", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Use a SIEM/SOAR", - "guid": "9bb22fec-4d00-3b95-7136-e225d0f5c63a", - "link": "https://learn.microsoft.com/azure/sentinel/overview", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", "services": [ - "Sentinel", - "AVS" + "SAP" ], - "severity": "Medium", - "subcategory": "Investigation", - "text": "Enable Azure Sentinel or 3rd party SIEM ", - "waf": "Security" + "severity": "High", + "subcategory": "Segmentation", + "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Performance" }, { - "category": "Security", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "MS Defender For Cloud, for workloads running on Azure VMware Solution", - "guid": "f42b0b09-c591-238a-1580-2de3c485ebd2", - "link": "https://learn.microsoft.com/azure/azure-vmware/azure-security-integration#prerequisites", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", "services": [ - "Defender", - "AVS" + "VNet", + "SAP", + "Cost" ], - "severity": "Medium", - "subcategory": "Security", - "text": "Enable Advanced Threat Detection ", - "waf": "Security" + "severity": "High", + "subcategory": "Segmentation", + "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Cost" }, { - "category": "Security", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Are the applicable policies enabled (compliance baselines added to MDfC)", - "guid": "bcdd2348-3d0e-c6bb-1092-aa4cd1a66d6b", - "link": "https://docs.microsoft.com/azure/azure-vmware/azure-security-integration", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "402a9846-d515-4061-aff8-cd30088693fa", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", + "service": "SAP", "services": [ - "AzurePolicy", - "AVS" + "SAP", + "LoadBalancer" ], - "severity": "Medium", - "subcategory": "Security", - "text": "Policy & Regulatory Compliance", - "waf": "Security" + "severity": "High", + "subcategory": "Segmentation", + "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Performance" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Azure to Azure (E/W), Azure to On-premises), AVS to Internet, AVS to Azure", - "guid": "607c1ca9-da92-ae19-5a4c-eb1e876acbe7", - "link": "https://techcommunity.microsoft.com/t5/azure-migration-and/firewall-integration-in-azure-vmware-solution/ba-p/2254961#:~:text=Azure%20VMware%20Solution%20customers%20have%20multiple%20security%20options,the%20box%20to%20provide%20East-West%20and%20North-South%20firewalling.", + "category": "Network Topology and Connectivity", + "checklist": "SAP Checklist", + "guid": "87585797-5551-4d53-bb7d-a94ee415734d", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", + "service": "SAP", "services": [ - "AVS" + "VNet", + "SAP" ], "severity": "Medium", - "subcategory": "Firewalls", - "text": "Azure / 3rd party firewall", + "subcategory": "Segmentation", + "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering", "waf": "Security" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "To allow HCX appliance to connect/sync", - "guid": "1d87925c-c02b-7fde-a425-7e95ad846a27", - "link": "https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-networking-security/GUID-2CFE1654-9CC9-4EDB-A625-21317299E559.html", + "category": "Operational Excellence", + "checklist": "SAP Checklist", + "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", "services": [ - "AVS" + "SAP", + "VM", + "Backup" ], - "severity": "Medium", - "subcategory": "Firewalls", - "text": "Firewalls allow for East/West traffic inside AVS", - "waf": "Security" + "severity": "High", + "subcategory": " ", + "text": "Review SAP HANA database backups for Azure VMs.", + "waf": "Cost" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Decision on which tool to use (SRM requires additional license - enables automation & other features)", - "guid": "468b3495-2f6e-b65a-38ef-3ba631bcaa46", - "link": "https://docs.vmware.com/en/VMware-HCX/4.2/hcx-user-guide/GUID-B842696B-89EF-4183-9C73-B77157F56055.html", + "category": "Operational Excellence", + "checklist": "SAP Checklist", + "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", "services": [ - "AVS" + "ASR", + "Monitor", + "SAP" ], "severity": "Medium", - "subcategory": "Networking", - "text": "HCX and/or SRM", - "waf": "Reliability" + "subcategory": " ", + "text": "Review Site Recovery built-in monitoring, where used for SAP.", + "waf": "Cost" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Read up on requirements for Service Mesh requirements and how HCX ", - "guid": "be2ced52-da08-d366-cf7c-044c19e29509", - "link": "https://docs.vmware.com/en/VMware-HCX/4.6/hcx-user-guide/GUID-76BCD059-A31A-4041-9105-ACFB56213E7C.html", + "category": "Operational Excellence", + "checklist": "SAP Checklist", + "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", + "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", + "service": "SAP", "services": [ - "AVS" + "Monitor", + "SAP" ], - "severity": "Medium", - "subcategory": "Networking", - "text": "Configuring and Managing the HCX Interconnect", - "waf": "Reliability" + "severity": "High", + "subcategory": " ", + "text": "Review the Monitoring the SAP HANA System Landscape guidance.", + "waf": "Operations" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "If you are planning on using stretch networks ensure that your on-premises environment requirements", - "guid": "7dcac579-fc5c-5c9c-f1f7-9b1149ff2c37", - "link": "https://docs.vmware.com/en/VMware-HCX/4.2/hcx-user-guide/GUID-DBDB4D1B-60B6-4D16-936B-4AC632606909.html", + "category": "Operational Excellence", + "checklist": "SAP Checklist", + "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", + "service": "SAP", "services": [ - "AVS" + "SAP", + "VM", + "Backup" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Restrictions and limitations for network extensions", - "waf": "Performance" + "subcategory": " ", + "text": "Review Oracle Database in Azure Linux VM backup strategies.", + "waf": "Operations" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Do workloads require MoN?", - "guid": "cf45c0b9-6c4b-3bfb-86c5-62fe54061c73", - "link": "https://learn.microsoft.com/azure/azure-vmware/vmware-hcx-mon-guidance", + "category": "Operational Excellence", + "checklist": "SAP Checklist", + "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", + "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", + "service": "SAP", "services": [ - "AVS" + "Storage", + "SAP", + "SQL" ], "severity": "Medium", - "subcategory": "Networking", - "text": "Mobility optimized networking", - "waf": "Performance" + "subcategory": " ", + "text": "Review the use of Azure Blob Storage with SQL Server 2016.", + "waf": "Operations" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Operating system level of Vmware environment", - "guid": "b7cf11f3-b12e-5189-991a-06df5250d2ca", - "link": "https://learn.microsoft.com/azure/site-recovery/vmware-physical-azure-support-matrix", + "category": "Operational Excellence", + "checklist": "SAP Checklist", + "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", + "service": "SAP", "services": [ - "AVS" + "SAP", + "VM", + "Backup" ], "severity": "Medium", - "subcategory": "On-premises pre-requisites", - "text": "Support matrix (OS versions etc).", + "subcategory": " ", + "text": "Review the use of Automated Backup v2 for Azure VMs.", "waf": "Operations" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Required that all switches are dynamic", - "guid": "45fe9252-aa1b-4e30-45c6-bc02f3b76acf", - "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/vsan-network-design-guide/GUID-91E1CD6F-33A6-4AC6-BC22-3E4807296F86.html#:~:text=Migrate%20Management%20Network%201%20Add%20hosts%20to%20the,each%20host.%20...%204%20Finish%20the%20configuration.%20", + "category": "Operational Excellence", + "checklist": "SAP Checklist", + "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", + "service": "SAP", "services": [ - "AVS" + "SAP" ], - "severity": "Medium", - "subcategory": "On-premises pre-requisites", - "text": "Standard switches converted to dynamic switches", + "severity": "High", + "subcategory": " ", + "text": "Enabling Write accelerator for M series when using premium disks(V1)", "waf": "Operations" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "See sections on sizing and capacity in the link.", - "guid": "e9f6d736-ee44-e2ac-e7f9-e361f8c857f3", - "link": "https://learn.microsoft.com/azure/azure-vmware/plan-private-cloud-deployment", + "category": "Performant", + "checklist": "SAP Checklist", + "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "service": "SAP", "services": [ - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "On-premises pre-requisites", - "text": "Capacity for HCX appliance", + "subcategory": " ", + "text": "Test availability zone latency.", "waf": "Performance" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Check hardware restrictions to ensure compatibility with AVS/OS ", - "guid": "1be2cdd6-15a7-9a33-aea7-113859035ce9", - "link": "https://kb.vmware.com/s/article/2007240#:~:text=ESXi%2FESX%20hosts%20and%20compatible%20virtual%20machine%20hardware%20versions,%20Not%20Supported%20%204%20more%20rows", + "category": "Performant", + "checklist": "SAP Checklist", + "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", + "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", + "service": "SAP", "services": [ - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "On-premises pre-requisites", - "text": "Hardware compatibility", - "waf": "Operations" + "subcategory": " ", + "text": "Activate SAP EarlyWatch Alert for all SAP components.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", + "waf": "Performance" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Need to be converted", - "guid": "16ab821a-27c6-b6d3-6042-10dc4d6dfcb7", - "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.storage.doc/GUID-01D3CF47-A84A-4988-8103-A0487D6441AA.html", + "category": "Performant", + "checklist": "SAP Checklist", + "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", + "service": "SAP", "services": [ - "Storage", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Storage", - "text": "VSAN RDM disks are converted - not supported.", - "waf": "Operations" + "subcategory": " ", + "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.", + "training": "https://me.sap.com/notes/0002879613", + "waf": "Performance" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Need to be converted", - "guid": "eb2f9313-afb2-ab35-aa24-6d97a3cb0611", - "link": "3rd-Party tools", + "category": "Performant", + "checklist": "SAP Checklist", + "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", + "service": "SAP", "services": [ - "VM", - "Storage", - "AVS" + "Monitor", + "SAP", + "SQL" ], "severity": "Medium", - "subcategory": "Storage", - "text": "VM with SCSI shared bus are not supported", - "waf": "Operations" + "subcategory": " ", + "text": "Review SQL Server performance monitoring using CCMS.", + "waf": "Performance" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Remove Direct IO before migration", - "guid": "3f2a5cff-c8a6-634a-1f1b-53ef9d321381", - "link": "Contact VMware", + "category": "Performant", + "checklist": "SAP Checklist", + "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", + "link": "https://me.sap.com/notes/500235", + "service": "SAP", "services": [ - "VM", - "Storage", - "AVS" + "SAP", + "VM" ], "severity": "Medium", - "subcategory": "Storage", - "text": "VM with Direct IO require removing DirectPath device", - "waf": "Operations" + "subcategory": " ", + "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).", + "training": "https://me.sap.com/notes/1100926/E", + "waf": "Performance" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Cannot migrate clusters ", - "guid": "efc8a311-74f8-0252-c6a0-4bac7610e266", - "link": "Contact VMware", + "category": "Performant", + "checklist": "SAP Checklist", + "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", + "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", + "service": "SAP", "services": [ - "Storage", - "AVS" + "Monitor", + "SAP" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Shared VMDK files are not supported", - "waf": "Operations" + "subcategory": " ", + "text": "Review SAP HANA studio alerts.", + "waf": "Performance" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Convert to a different format", - "guid": "ab6c89cd-a26f-b894-fe59-61863975458e", - "link": "Contact VMware", + "category": "Performant", + "checklist": "SAP Checklist", + "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", + "link": "https://me.sap.com/notes/1969700", + "service": "SAP", "services": [ - "Storage", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Storage", - "text": "RDM with 'physical compatibility mode' are not supported.", - "waf": "Operations" + "subcategory": " ", + "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.", + "waf": "Performance" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning 'RAID-1 FTT-1' is default with Thin Provisioning", - "guid": "7628d446-6b10-9678-9cec-f407d990de43", - "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", "services": [ - "AzurePolicy", - "VM", - "Storage", - "AVS" + "SAP", + "VM" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Default storage policy", - "waf": "Operations" + "subcategory": "Governance", + "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.", + "training": "https://learn.microsoft.com/azure/automation/update-management/overview", + "waf": "Security" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "The default storage policy is set to RAID-1 (Mirroring) FTT-1, with Object Space Reservation set to Thin provisioning.", - "guid": "37fef358-7ab9-43a9-542c-22673955200e", - "link": "https://learn.microsoft.com/azure/azure-vmware/configure-storage-policy", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "08951710-79a2-492a-adbc-06d7a401545b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", "services": [ - "AzurePolicy", - "VM", - "Storage", - "AVS" + "SAP" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Ensure that the appropriate VM template storage policy is used", - "waf": "Operations" + "subcategory": "Governance", + "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.", + "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", + "waf": "Security" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs", - "guid": "ebebd109-9f9d-d85e-1b2f-d302012843b7", - "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", "services": [ - "AzurePolicy", - "Storage", - "AVS" + "SAP", + "SQL" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "Failure to tolerate policy", - "waf": "Operations" + "severity": "Low", + "subcategory": "Governance", + "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.", + "waf": "Security" }, { - "category": "VMware", - "checklist": "Azure VMware Solution Implementation Checklist", - "description": "ANF can be used to extend storage for Azure VMware Solution,", - "guid": "1be821bd-4f37-216a-3e3d-2a5ac6996863", - "link": "https://learn.microsoft.com/azure/azure-vmware/netapp-files-with-azure-vmware-solution", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", "services": [ - "Storage", - "AVS" + "SAP", + "SQL" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "Use ANF for external storage", - "waf": "Operations" - }, - { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "guid": "65285269-440c-44be-9d3e-0844276d4bdc", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foudations-playbooks-ADB_v1.docx", - "services": [], "severity": "High", - "subcategory": "Best Practices", - "text": "Reference Databricks HA/DR playbook", - "waf": "Reliability" + "subcategory": "Governance", + "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.", + "training": "https://me.sap.com/notes/3019299/E", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "guid": "89d558b9-37d3-4974-b111-2dbd7aaf12e6", - "link": "https://learn.microsoft.com/azure/databricks/security/secrets/secret-scopes", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "services": [ - "Backup" + "Storage", + "Backup", + "AKV", + "SQL", + "SAP" ], - "severity": "Medium", - "subcategory": "Backup", - "text": "Backup Your Workspace Configuration including ARM templates and Secret Scopes", - "waf": "Reliability" + "severity": "High", + "subcategory": "Secrets", + "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "guid": "b94ee5ef-47d2-4d92-a81b-1cd6d1f54b29", - "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/sharing-metadata-across-different-databricks-workspaces-using/ba-p/3679757", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "SAP", "services": [ - "Backup", - "ACR" + "Storage", + "SAP", + "AKV" ], "severity": "Medium", - "subcategory": "Backup", - "text": "Share MetaData Across different Databricks Workspaces using Hive External Metastore", - "waf": "Reliability" + "subcategory": "Secrets", + "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.", + "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "guid": "769e3969-0e78-428a-a936-657d03b0f466", - "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/disaster-recovery-strategy-in-azure-databricks-using-the-hive/ba-p/3684581", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "SAP", "services": [ - "ASR", - "Backup" + "SAP", + "AKV" ], - "severity": "Medium", - "subcategory": "Backup", - "text": "Plan Disaster Recovery Strategy in Databricks using the Hive External Metastore", - "waf": "Reliability" + "severity": "High", + "subcategory": "Secrets", + "text": "Use Azure Key Vault to store your secrets and credentials", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "guid": "4b1d944a-3598-437e-b79d-6c6d3a364a5b", - "link": "https://www.databricks.com/blog/2021/04/20/attack-of-the-delta-clones-against-disaster-recovery-availability-complexity.html", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "829e2edb-2173-4676-aff6-691b4935ada4", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "SAP", "services": [ - "Backup" + "RBAC", + "Subscriptions", + "AKV", + "AzurePolicy", + "SAP" ], "severity": "Medium", - "subcategory": "Backup", - "text": "Backup your data with deep and shallow clones", - "waf": "Reliability" + "subcategory": "Secrets", + "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).", + "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "description": "Download the blob using Secondary Endpoint in RAGRS Storage Account", - "guid": "7abae48a-bd54-4cd7-ae2e-86768357c559", - "link": "https://techcommunity.microsoft.com/t5/azure-paas-blog/download-the-blob-using-secondary-endpoint-in-ragrs-storage/ba-p/2403750", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "SAP", "services": [ - "Backup", - "Storage" + "AKV", + "SAP", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Backup", - "text": "Backup your data to Azure Storage RA-GRS", - "waf": "Reliability" + "subcategory": "Secrets", + "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "guid": "675c5ee8-5b85-49c7-944c-e3b1a28b875a", - "link": "https://learn.microsoft.com/azure/databricks/dev-tools/index-ci-cd", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", + "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", + "service": "SAP", "services": [ - "Backup" + "AKV", + "RBAC", + "SAP", + "AzurePolicy" ], "severity": "High", - "subcategory": "Backup", - "text": "Backup your code with DevOps", - "waf": "Reliability" + "subcategory": "Secrets", + "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed", + "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "guid": "a1bf1038-9f03-4a4d-8ce4-63dbbbc8682a", - "link": "https://learn.microsoft.com/azure/databricks/administration-guide/disaster-recovery", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "services": [ - "ASR" + "Storage", + "SAP", + "AKV", + "Defender" ], "severity": "High", - "subcategory": "Disaster Recovery", - "text": "Plan for Disaster recovery using Active/Active or Active/Passive Configuration", - "waf": "Reliability" + "subcategory": "Secrets", + "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "description": "Migration package to log all Databricks resources for backup and/or migrating to another Databricks workspace", - "guid": "5abc92a4-eda1-4dae-8cc8-5c47c6b781cc", - "link": "https://github.com/databrickslabs/migrate", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", + "service": "SAP", "services": [ - "Backup" + "RBAC", + "SAP", + "AKV", + "Defender" ], - "severity": "Medium", - "subcategory": "Migration", - "text": "Use Databricks Migration tools", - "waf": "Reliability" + "severity": "High", + "subcategory": "Secrets", + "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.", + "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "waf": "Security" }, { - "category": "Operations Management", - "checklist": "DataBricks Review Checklist", - "guid": "a0e6c465-89d5-458b-a37d-3974d1112dbd", - "link": "https://github.com/databrickslabs/databricks-sync", - "services": [], + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "services": [ + "SAP", + "AKV" + ], "severity": "Low", - "subcategory": "Migration", - "text": "Use Databricks Sync", - "waf": "Reliability" + "subcategory": "Secrets", + "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS", + "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", + "waf": "Security" }, { - "category": "BC and DR", - "checklist": "Redis Resiliency checklist", - "guid": "65285269-440b-44be-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", - "service": "Redis", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", + "service": "SAP", "services": [ - "ACR" + "SAP", + "AKV" ], - "severity": "High", - "subcategory": "High Availability", - "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Secrets", + "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "Security" }, { - "category": "BC and DR", - "checklist": "Redis Resiliency checklist", - "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", - "service": "Redis", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "4935ada4-2223-4ece-a1b1-23181a541741", + "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", + "service": "SAP", "services": [ - "Storage" + "SAP", + "AKV" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.", - "waf": "Reliability" + "severity": "High", + "subcategory": "Secrets", + "text": "Use an Azure Key Vault per application per environment per region.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "Security" }, { - "category": "BC and DR", - "checklist": "Redis Resiliency checklist", - "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", - "service": "Redis", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", + "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", + "service": "SAP", "services": [ - "Storage" + "SAP", + "AKV" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available", - "waf": "Reliability" + "severity": "High", + "subcategory": "Secrets", + "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.", + "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", + "waf": "Security" }, { - "category": "BC and DR", - "checklist": "Redis Resiliency checklist", - "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", - "service": "Redis", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "209d490d-a477-4784-84d1-16785d2fa56c", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "service": "SAP", "services": [ - "ASR" + "RBAC", + "SAP", + "Subscriptions" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.", - "waf": "Reliability" + "severity": "High", + "subcategory": "Security", + "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes", + "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", + "waf": "Security" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", - "service": "Entra", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", + "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", + "service": "SAP", "services": [ - "Entra" + "NVA", + "SAP", + "PrivateLink" ], - "severity": "Medium", - "subcategory": "Microsoft Entra ID Tenants", - "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.", - "waf": "Operations" + "severity": "High", + "subcategory": "Security", + "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources", + "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", + "waf": "Security" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Entra", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", + "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "service": "SAP", "services": [ - "Entra" + "Storage", + "SAP", + "VM" ], "severity": "Low", - "subcategory": "Microsoft Entra ID Tenants", - "text": "Ensure you have a Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants", - "waf": "Operations" + "subcategory": "Security", + "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.", + "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", + "waf": "Security" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "Entra", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", + "service": "SAP", "services": [ - "Entra" + "SAP", + "Defender" ], "severity": "Low", - "subcategory": "Microsoft Entra ID Tenants", - "text": "Leverage Azure Lighthouse for Multi-Tenant Management", - "waf": "Operations" + "subcategory": "Security", + "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.", + "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", + "waf": "Security" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Entra", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", "services": [ - "Entra" + "VNet", + "SAP" ], - "severity": "Medium", - "subcategory": "Cloud Solution Provider", - "text": "Ensure that Azure Lighthouse is used for administering the tenant by partner", - "waf": "Cost" + "severity": "High", + "subcategory": "Security", + "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", + "waf": "Security" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "a24d0de3-d4b9-4dfb-8ddd-bbfaf123fa01", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-cloud-solution-provider#design-recommendations", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "services": [ - "Entra" + "SAP", + "WAF" ], "severity": "Low", - "subcategory": "Cloud Solution Provider", - "text": "Discuss support request and escalation process with CSP partner", - "waf": "Cost" + "subcategory": "Security", + "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.", + "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", + "waf": "Security" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "32952499-58c8-4e6f-ada5-972e67893d55", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "category": "Security, Governance and Compliance", + "checklist": "SAP Checklist", + "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", + "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", + "service": "SAP", "services": [ - "Entra", - "Cost" + "Monitor", + "SAP", + "AKV" ], "severity": "Medium", - "subcategory": "Cloud Solution Provider", - "text": "Setup Cost Reporting and Views with Azure Cost Management", - "waf": "Cost" + "subcategory": "Security", + "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "Security" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "685cb4f2-ac9c-4b19-9167-993ed0b32415", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", + "category": "Business", + "checklist": "Multitenant architecture", + "guid": "41177955-fe8f-430b-ae72-20dc5b6880da", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/overview", "services": [ - "Entra", - "LoadBalancer" + "Entra" ], - "severity": "Medium", - "subcategory": "Enterprise Agreement", - "text": "Configure Notification Contacts to a group mailbox", - "waf": "Cost" + "severity": "High", + "subcategory": "Business", + "text": "Understand what kind of solution you're creating, such as business-to-business (B2B), business-to-consumer (B2C), or your enterprise software, and how tenants are different from users.", + "waf": "Operations" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "12cd499f-96e2-4e41-a243-231fb3245a1c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "services": [ - "Entra", - "TrafficManager" - ], - "severity": "Low", - "subcategory": "Enterprise Agreement", - "text": "Use departments and accounts to map your organization's structure to your enrollment hierarchy which can help with separating billing.", + "category": "Business", + "checklist": "Multitenant architecture", + "guid": "2d33d1b7-697c-49f9-b944-afbeac0b2c8f", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "services": [], + "severity": "High", + "subcategory": "Business", + "text": "Define your tenants. Understand how many tenants you will support initially, and your growth plans.", + "waf": "Operations" + }, + { + "category": "Business", + "checklist": "Multitenant architecture", + "guid": "a2111b8b-cc66-4aa2-9da6-c09fa23851b6", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models", + "services": [], + "severity": "High", + "subcategory": "Business", + "text": "Define your pricing model and ensure it aligns with your tenants' consumption of Azure resources.", "waf": "Cost" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "ca0fe401-12ad-46fc-8a7e-86293866a9f6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "services": [ - "Entra", - "Cost" - ], + "category": "Business", + "checklist": "Multitenant architecture", + "guid": "331e84a6-2d65-4359-92ff-a1870b062995", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/pricing-models", + "services": [], "severity": "Medium", - "subcategory": "Enterprise Agreement", - "text": "Enable both DA View Charges and AO View Charges on your EA Enrollments to allow users with the correct perms review Cost and Billing Data.", - "waf": "Security" + "subcategory": "Business", + "text": "Understand whether you need to separate your tenants into different tiers. Tiers might have different pricing, features, performance promises, geographic locations, and so forth.", + "waf": "Operations" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "5cf9f485-2784-49b3-9824-75d9b8bdb57b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "services": [ - "Entra", - "Cost", - "Subscriptions" - ], - "severity": "Low", - "subcategory": "Enterprise Agreement", - "text": "Make use of Enterprise Dev/Test Subscriptions to reduce costs for non-production workloads", - "waf": "Cost" + "category": "Business", + "checklist": "Multitenant architecture", + "guid": "90516b37-aab1-46ca-95bb-cc14a6a1608b", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "services": [], + "severity": "Medium", + "subcategory": "Business", + "text": "Based on your customers' requirements, decide on the tenancy models that are appropriate for various parts of your solution.", + "waf": "Operations" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "6ad5c3dd-e5ea-4ff1-81a4-7886ff87845c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "category": "Business", + "checklist": "Multitenant architecture", + "guid": "f5d76ae1-7048-4ff5-abba-f1ca799578b9", + "link": "https://learn.microsoft.com/azure/marketplace/plan-saas-offer", "services": [ "Entra" ], - "severity": "Low", - "subcategory": "Microsoft Customer Agreement", - "text": "Configure Agreement billing account notification contact email", - "waf": "Cost" + "severity": "Medium", + "subcategory": "Business", + "text": "When you're ready, sell your B2B multitenant solution using the Microsoft Commercial Marketplace.", + "waf": "Operations" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "90e87802-602f-4dfb-acea-67c60689f1d7", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice", - "services": [ - "Entra", - "Cost", - "Storage" - ], - "severity": "Low", - "subcategory": "Microsoft Customer Agreement", - "text": "Use Billing Profiles and Invoice sections to structure your agreements billing for effective cost management", - "waf": "Cost" + "category": "Reliability", + "checklist": "Multitenant architecture", + "guid": "9e7cedd9-1e05-4aeb-a7b3-01fe695a394c", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/design-checklist", + "services": [], + "severity": "High", + "subcategory": "Reliability", + "text": "Review the Azure Well-Architected Reliability checklist, which is applicable to all workloads.", + "waf": "Reliability" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "e81a73f0-84c4-4641-b406-14db3b4d1f50", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "services": [ - "Entra", - "Cost" - ], - "severity": "Low", - "subcategory": "Microsoft Customer Agreement", - "text": "Make use of Microsoft Azure plan for dev/test offer to reduce costs for non-production workloads", - "waf": "Cost" + "category": "Reliability", + "checklist": "Multitenant architecture", + "guid": "e9521a55-2a7c-425c-8f3e-c38fd0c4df75", + "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor", + "services": [], + "severity": "High", + "subcategory": "Reliability", + "text": "Understand the Noisy Neighbor antipattern. Prevent individual tenants from impacting the system's availability for other tenants.", + "waf": "Reliability" }, { - "category": "Azure Billing and Microsoft Entra ID Tenants", - "checklist": "Azure Landing Zone Review", - "guid": "ae757485-92a4-482a-8bc9-eefe6f5b5ec3", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "services": [ - "RBAC", - "Entra" - ], + "category": "Reliability", + "checklist": "Multitenant architecture", + "guid": "2b99cb00-9abb-49b6-b11c-f2af9692f09e", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/overview", + "services": [], "severity": "Medium", - "subcategory": "Microsoft Customer Agreement", - "text": "Periodically audit the agreement billing RBAC role assignments to review who has access to your MCA billing account", - "waf": "Cost" + "subcategory": "Reliability", + "text": "Design your multitenant solution for the level of growth that you expect. But don't overengineer for unrealistic growth.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "348ef254-c27d-442e-abba-c7571559ab91", - "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "service": "Entra", - "services": [ - "RBAC", - "Entra", - "ACR", - "Subscriptions" - ], + "category": "Reliability", + "checklist": "Multitenant architecture", + "guid": "7a634a0e-1c9d-42b1-aac2-5a5378f103f1", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/business-metrics", + "services": [], + "severity": "Medium", + "subcategory": "Reliability", + "text": "Define service-level objectives (SLOs) and optionally service-level agreements (SLAs) for your solution. SLAs and SLOs should be based on the requirements of your tenants, as well as the composite SLA of the Azure resources in your architecture.", + "waf": "Reliability" + }, + { + "category": "Reliability", + "checklist": "Multitenant architecture", + "guid": "45beeeaf-fc59-4079-8fca-65d5724abaa7", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute", + "services": [], "severity": "High", - "subcategory": "Identity", - "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Security" + "subcategory": "Reliability", + "text": "Test the scale of your solution. Ensure that it performs well under all levels of load, and that it scales correctly as the number of tenants increases.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "4348bf81-7573-4512-8f46-9061cc198fea", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator", - "services": [ - "Entra" - ], + "category": "Reliability", + "checklist": "Multitenant architecture", + "guid": "2ff55551-984b-4606-95eb-bfb9c8b36761", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute", + "services": [], + "severity": "Medium", + "subcategory": "Reliability", + "text": "Apply chaos engineering principles to test the reliability of your solution.", + "waf": "Reliability" + }, + { + "category": "Security", + "checklist": "Multitenant architecture", + "guid": "8238c038-8eb2-4a02-8bd5-4908c9442c1c", + "link": "https://learn.microsoft.com/security/zero-trust", + "services": [], "severity": "High", - "subcategory": "Microsoft Entra ID and Hybrid Identity", - "text": "Use managed identities instead of service principals for authentication to Azure services. You can check for existing service principals via Entra ID > Sign in Logs > Service principal logins.", - "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", + "subcategory": "Security", + "text": "Apply the Zero Trust and least privilege principles in all layers of your solution.", "waf": "Security" }, { - "ammp": true, - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", - "service": "Entra", + "category": "Security", + "checklist": "Multitenant architecture", + "guid": "92160e00-6894-4102-97e0-615d4ed93c01", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/map-requests", "services": [ "Entra" ], "severity": "High", - "subcategory": "Identity", - "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "subcategory": "Security", + "text": "Ensure that you can correctly map user requests to tenants. Consider including the tenant context as part of the identity system, or by using another means, like application-level tenant authorization.", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "Entra", - "services": [ - "Entra" - ], + "category": "Security", + "checklist": "Multitenant architecture", + "guid": "3c1538b4-5676-4b85-b451-432befb37b4f", + "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", + "services": [], "severity": "Medium", - "subcategory": "Identity", - "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "subcategory": "Security", + "text": "Perform ongoing penetration testing and security code reviews.", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", - "service": "Entra", - "services": [ - "Entra", - "AzurePolicy" - ], - "severity": "Low", - "subcategory": "Identity", - "text": "Enforce Microsoft Entra ID conditional-access policies for any user with rights to Azure environments", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "category": "Security", + "checklist": "Multitenant architecture", + "guid": "5fca45ce-cf2d-42c0-a62c-aac92ba31498", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/governance-compliance", + "services": [], + "severity": "High", + "subcategory": "Security", + "text": "Understand your tenants' compliance requirements, including data residency and any compliance or regulatory standards that they require you to meet.", "waf": "Security" }, { - "ammp": true, - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", - "service": "Entra", + "category": "Security", + "checklist": "Multitenant architecture", + "guid": "30adb90d-83d4-4a2e-986e-327ffe04e7a5", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/domain-names", "services": [ - "Entra" + "DNS" ], "severity": "High", - "subcategory": "Identity", - "text": "Enforce multi-factor authentication for any user with rights to the Azure environments", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "subcategory": "Security", + "text": "Correctly manage domain names and avoid vulnerabilities like dangling DNS and subdomain takeover attacks.", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", - "services": [ - "Entra", - "RBAC" - ], + "category": "Security", + "checklist": "Multitenant architecture", + "guid": "72ded36d-c633-4e0d-bd41-799a29da3481", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/service/overview", + "services": [], "severity": "Medium", - "subcategory": "Identity", - "text": "Enforce centralized and delegated responsibilities to manage resources deployed inside the landing zone, based on role and security requirements", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", + "subcategory": "Security", + "text": "Follow service-specific guidance for multitenancy.", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "14658d35-58fd-4772-99b8-21112df27ee4", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "Entra", + "category": "Cost Optimization", + "checklist": "Multitenant architecture", + "guid": "db30a9fc-9b1d-40f3-ab90-01f6a3e87fc8", + "link": "https://learn.microsoft.com/azure/architecture/framework/cost/design-checklist", "services": [ - "Entra" + "Cost" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "Cost Optimization", + "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.", + "waf": "Cost" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations", + "category": "Cost Optimization", + "checklist": "Multitenant architecture", + "guid": "8533af39-52f6-45b6-a9c3-81b2a54a31e0", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/measure-consumption", "services": [ - "Entra", - "VM", - "ACR" + "Cost" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "When deploying Active Directory on Windows Server, use a location with Availability Zones and deploy at least two VMs across these zones. If not available, deploy in an Availability Set", - "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", - "waf": "Reliability" + "severity": "High", + "subcategory": "Cost Optimization", + "text": "Ensure you can adequately measure per-tenant consumption and correlate it with your infrastructure costs.", + "waf": "Cost" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "f5664b5e-984a-4859-a773-e7d261623a76", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", + "category": "Cost Optimization", + "checklist": "Multitenant architecture", + "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation", "services": [ - "RBAC", - "Entra", - "ACR", - "Subscriptions" + "Monitor", + "Cost" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Use Azure custom RBAC roles for the following key roles to provide fine-grain access across your ALZ: Azure platform owner, network management, security operations, subscription owner, application owner. Align these roles to teams and responsibilities within your business.", - "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", - "waf": "Security" + "subcategory": "Cost Optimization", + "text": "Avoid antipatterns. Antipatterns include failing to track costs, tracking costs with unnecessary precision, real-time measurement, and using monitoring tools for billing.", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "Entra", - "services": [ - "Entra" - ], + "category": "Operational Excellence", + "checklist": "Multitenant architecture", + "guid": "0d475a5a-2c0f-47ab-b1e1-701da68d3407", + "link": "https://learn.microsoft.com/azure/architecture/checklist/data-ops", + "services": [], + "severity": "High", + "subcategory": "Operational Excellence", + "text": "Review the Azure Well-Architected Operational Excellence checklist, which is applicable to all workloads.", + "waf": "Operations" + }, + { + "category": "Operational Excellence", + "checklist": "Multitenant architecture", + "guid": "9f7fa7a9-47fc-4f04-81f6-9f9e87571ed3", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenant-lifecycle", + "services": [], "severity": "Medium", - "subcategory": "Identity and Access Management", - "text": "If planning to switch from Active Directory Domain Serivces to Entra domain services, evaluate the compatibility of all workloads", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", - "waf": "Security" + "subcategory": "Operational Excellence", + "text": "Use automation to manage the tenant lifecycle, such as onboarding, deployment, provisioning, and configuration.", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", - "service": "Entra", - "services": [ - "Entra", - "Monitor" - ], + "category": "Operational Excellence", + "checklist": "Multitenant architecture", + "guid": "e0bfceed-4f4e-492d-b9f5-898815faa363", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/updates", + "services": [], "severity": "Medium", - "subcategory": "Identity", - "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.", - "waf": "Security" + "subcategory": "Operational Excellence", + "text": "Find the right balance for deploying service updates. Consider both your tenants' requirements and your own operational requirements.", + "waf": "Operations" }, { - "ammp": true, - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "984a859c-773e-47d2-9162-3a765a917e1f", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", - "service": "Entra", + "category": "Operational Excellence", + "checklist": "Multitenant architecture", + "guid": "a3f80518-d428-4c02-b2cc-dfaef47db7e2", "services": [ - "Entra" + "Monitor" ], "severity": "High", - "subcategory": "Identity", - "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "subcategory": "Operational Excellence", + "text": "Monitor the health of the overall system, as well as each tenant.", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94", - "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server", + "category": "Operational Excellence", + "checklist": "Multitenant architecture", + "guid": "dfb42da5-f871-4953-9e5c-da6fda3f1411", "services": [ - "Entra", - "ASR" + "Monitor" ], "severity": "Medium", - "subcategory": "Microsoft Entra ID", - "text": "When deploying an Microsoft Entra Connect, leverage a staging sever for high availability / Disaster recovery", - "waf": "Reliability" + "subcategory": "Operational Excellence", + "text": "Configure and test alerts to notify you when specific tenants are experiencing issues or are exceeding their consumption limits.", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "35037e68-9349-4c15-b371-228514f4cdff", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "Entra", - "services": [ - "Entra", - "RBAC" - ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Avoid using on-premises synced accounts for Microsoft Entra ID role assignments.", - "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", - "waf": "Security" + "category": "Operational Excellence", + "checklist": "Multitenant architecture", + "guid": "c0c72a1b-e34d-4b3d-b808-2e49f51ce47e", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization", + "services": [], + "severity": "High", + "subcategory": "Operational Excellence", + "text": "Organize your Azure resources for isolation and scale.", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Entra", - "services": [ - "Entra" - ], + "category": "Operational Excellence", + "checklist": "Multitenant architecture", + "guid": "c5c5e22d-4b51-4cac-a980-f7aac1a4b427", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/deployment-configuration", + "services": [], "severity": "Medium", - "subcategory": "Identity", - "text": "Where required, use Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications (hosted in the cloud or on-premises).", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Security" + "subcategory": "Operational Excellence", + "text": "Avoid deployment and configuration antipatterns. Antipatterns include running separate versions of the solution for each tenant, hardcoding tenant-specific configurations or logic, and manual deployments.", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "9cf5418b-1520-4b7b-add7-88eb28f833e8", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#managed-identities", - "services": [ - "Entra", - "VNet" - ], - "severity": "Medium", - "subcategory": "Landing zones", - "text": "Configure Identity network segmentation through the use of a virtual Network and peer back to the hub. Providing authentication inside application landing zone (legacy).", - "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain", - "waf": "Security" + "category": "Performance Efficiency", + "checklist": "Multitenant architecture", + "guid": "f0b1fbd8-689c-4ab3-be1d-ad7607d2fbfd", + "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/performance-efficiency", + "services": [], + "severity": "High", + "subcategory": "Performance Efficiency", + "text": "Review the Azure Well-Architected Performance Efficiency checklist, which is applicable to all workloads.", + "waf": "Performance" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "d4d1ad54-1abc-4919-b267-3f342d3b49e4", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations", - "services": [ - "RBAC", - "AKV", - "Storage", - "Entra", - "ACR" - ], - "severity": "Medium", - "subcategory": "Landing zones", - "text": "Use Azure RBAC to manage data plane access to resources, if possible. E.G - Data Operations across Key Vault, Storage Account and Database Services.", - "training": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "waf": "Security" + "category": "Performance Efficiency", + "checklist": "Multitenant architecture", + "guid": "18911c4c-934c-49a8-839a-60c092afce30", + "link": "https://learn.microsoft.com/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor", + "services": [], + "severity": "High", + "subcategory": "Performance Efficiency", + "text": "If you use shared infrastructure, plan for how you'll mitigate Noisy Neighbor concerns. Ensure that one tenant can't reduce the performance of the system for other tenants.", + "waf": "Performance" }, { - "category": "Identity and Access Management", - "checklist": "Azure Landing Zone Review", - "guid": "d505ebcb-79b1-4274-9c0d-a27c8bea489c", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review", + "category": "Performance Efficiency", + "checklist": "Multitenant architecture", + "guid": "6acf7eb5-24a3-47c7-ae87-1196cd96048e", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/compute", "services": [ - "Entra" + "Storage" ], "severity": "Medium", - "subcategory": "Landing zones", - "text": "Use Microsoft Entra ID PIM access reviews to periodically validate resource entitlements.", - "waf": "Security" + "subcategory": "Performance Efficiency", + "text": "Determine how you'll scale your compute, storage, networking, and other Azure resources to match the demands of your tenants.", + "waf": "Performance" }, { - "ammp": true, - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "description": "Consider using the Azure naming tool available at https://aka.ms/azurenamingtool", - "guid": "cacf55bc-e4e4-46be-96bc-57a5f23a269a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming", + "category": "Performance Efficiency", + "checklist": "Multitenant architecture", + "guid": "ea55400d-f97d-45aa-b71b-34224bf91ed4", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/resource-organization", "services": [], "severity": "High", - "subcategory": "Naming and tagging", - "text": "It is recommended to follow Microsoft Best Practice Naming Standards", - "waf": "Security" + "subcategory": "Performance Efficiency", + "text": "Consider each Azure resource's scale limits. Organize your resources appropriately, in order to avoid resource organization antipatterns. For example, don't over-architect your solution to work within unrealistic scale requirements.", + "waf": "Performance" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)", - "guid": "2df27ee4-12e7-4f98-9f63-04722dd69c5b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", + "category": "Governance", + "checklist": "Azure Key Vault", + "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "services": [ - "Subscriptions" + "AKV", + "Backup" + ], + "severity": "High", + "subcategory": "Deployment best practices", + "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.", + "waf": "Reliability" + }, + { + "category": "BC and DR", + "checklist": "Azure Key Vault", + "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Key Vault", + "services": [ + "ACR", + "AKV" ], "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Enforce reasonably flat management group hierarchy with no more than four levels.", - "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/", - "waf": "Security" + "subcategory": "High Availability", + "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.", + "waf": "Reliability" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "667313b4-f566-44b5-b984-a859c773e7d2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", + "category": "BC and DR", + "checklist": "Azure Key Vault", + "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication", + "service": "Key Vault", "services": [ - "Subscriptions" + "AKV" ], "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Enforce a sandbox management group to allow users to immediately experiment with Azure", - "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/", - "waf": "Security" + "subcategory": "High Availability", + "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.", + "waf": "Reliability" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "61623a76-5a91-47e1-b348-ef254c27d42e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", + "category": "BC and DR", + "checklist": "Azure Key Vault", + "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions", + "service": "Key Vault", "services": [ - "RBAC", "AzurePolicy", - "Subscriptions" + "AKV" ], "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Enforce a platform management group under the root management group to support common platform policy and Azure role assignment", - "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/", - "waf": "Security" + "subcategory": "High Availability", + "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.", + "waf": "Reliability" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", + "category": "Management", + "checklist": "Azure Key Vault", + "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509", + "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations", + "service": "Key Vault", "services": [ - "ExpressRoute", + "Storage", "Subscriptions", - "DNS", - "VWAN" + "Backup", + "AKV", + "ASR" ], "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Enforce a dedicated connectivity subscription in the Connectivity management group to host an Azure Virtual WAN hub, private Domain Name System (DNS), ExpressRoute circuit, and other networking resources.", - "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/", - "waf": "Security" + "subcategory": "Business continuity and disaster recovery", + "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.", + "waf": "Reliability" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "graph": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)", - "guid": "33b6b780-8b9f-4e5c-9104-9d403a923c34", - "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group", + "category": "Management", + "checklist": "Azure Key Vault", + "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "Key Vault", "services": [ - "Subscriptions" + "ASR", + "AKV" ], - "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Enforce no subscriptions are placed under the root management group", - "waf": "Security" + "severity": "High", + "subcategory": "Business continuity and disaster recovery", + "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.", + "waf": "Reliability" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "74d00018-ac6a-49e0-8e6a-83de5de32c19", - "link": "https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization", + "category": "Management", + "checklist": "Azure Key Vault", + "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "Key Vault", "services": [ - "RBAC", - "Subscriptions" + "ASR", + "AKV" ], - "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Enforce that only privileged users can operate management groups in the tenant by enabling Azure RBAC authorization in the management group hierarchy settings", - "waf": "Security" + "severity": "Low", + "subcategory": "Business continuity and disaster recovery", + "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.", + "waf": "Reliability" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "92481607-d5d1-4e4e-9146-58d3558fd772", - "link": "https://learn.microsoft.com/azure/governance/management-groups/overview", + "category": "Management", + "checklist": "Azure Key Vault", + "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c", + "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", + "service": "Key Vault", "services": [ - "Subscriptions" + "ASR", + "AKV", + "Backup" ], - "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Enforce management groups under the root-level management group to represent the types of workloads, based on their security, compliance, connectivity, and feature needs.", - "waf": "Security" + "severity": "Low", + "subcategory": "Business continuity and disaster recovery", + "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "49b82111-2df2-47ee-912e-7f983f630472", - "link": "https://learn.microsoft.com/azure/governance/management-groups/overview", + "category": "Management", + "checklist": "Azure Key Vault", + "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04", + "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", + "service": "Key Vault", "services": [ - "RBAC", - "AzurePolicy", - "Cost", - "Subscriptions" + "ASR", + "AKV", + "Backup" ], - "severity": "High", - "subcategory": "Subscriptions", - "text": "Enforce a process to make resource owners aware of their roles and responsibilities, access review, budget review, policy compliance and remediate when necessary.", - "waf": "Security" + "severity": "Low", + "subcategory": "Business continuity and disaster recovery", + "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.", + "waf": "Reliability" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "2dd69c5b-5c26-422f-94b6-9bad33aad5e8", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "category": "Management", + "checklist": "Azure Key Vault", + "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection", + "service": "Key Vault", "services": [ - "Subscriptions" + "EventHubs", + "ASR", + "AKV" ], "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Ensure that all subscription owners and IT core team are aware of subscription quotas and the impact they have on provision resources for a given subscription.", - "waf": "Security" + "subcategory": "Business continuity and disaster recovery", + "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "c68e1d76-6673-413b-9f56-64b5e984a859", - "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations", + "category": "Identity and Access Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "d7e47431-76c8-4bdb-b55b-ce619e8a03f9", + "link": "https://learn.microsoft.com/azure/openshift/howto-create-service-principal?pivots=aro-azurecli", "services": [ - "AzurePolicy", - "VM", - "Cost", - "Subscriptions" + "Entra", + "RBAC" ], "severity": "High", - "subcategory": "Subscriptions", - "text": "Use Reserved Instances where appropriate to optimize cost and ensure available capacity in target regions. Enforce the use of purchased Reserved Instance VM SKUs via Azure Policy.", - "training": "https://learn.microsoft.com/learn/paths/improve-reliability-modern-operations/", + "subcategory": "Identity", + "text": "Create a service principal and its role assignments before creating the ARO clusters.", "waf": "Security" }, { - "ammp": true, - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25", - "link": "https://learn.microsoft.com/azure/architecture/framework/scalability/design-capacity", + "category": "Identity and Access Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "7879424d-6267-486d-90b9-6c97be985190", + "link": "https://learn.microsoft.com/azure/openshift/configure-azure-ad-ui", "services": [ - "Subscriptions", - "Monitor" + "Entra" ], "severity": "High", - "subcategory": "Subscriptions", - "text": "Enforce a dashboard, workbook, or manual process to monitor used capacity levels", - "training": "https://learn.microsoft.com/learn/paths/monitor-usage-performance-availability-resources-azure-monitor/", + "subcategory": "Identity", + "text": "Use AAD to authenticate users in your ARO cluster.", "waf": "Security" }, { - "ammp": true, - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40", - "link": "https://learn.microsoft.com/azure/cost-management-billing/cost-management-billing-overview", + "category": "Identity and Access Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "adfec5f9-a82d-46e9-a8d1-5a0c7fed5d15", + "link": "https://docs.openshift.com/container-platform/4.14/authentication/remove-kubeadmin.html", "services": [ - "Cost", - "Subscriptions" + "Entra" ], - "severity": "High", - "subcategory": "Subscriptions", - "text": "Enforce a process for cost management", - "training": "https://learn.microsoft.com/learn/paths/control-spending-manage-bills/", + "severity": "Medium", + "subcategory": "Identity", + "text": "When using AAD authentication, remove kubeadmin user from the cluster.", "waf": "Security" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de", - "link": "https://learn.microsoft.com/azure/governance/management-groups/overview", + "category": "Identity and Access Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "483835c9-86bb-4291-8155-a11475e39f54", + "link": "https://docs.openshift.com/container-platform/4.13/applications/projects/working-with-projects.html", "services": [ "Entra", - "Subscriptions" + "RBAC" ], - "severity": "Medium", - "subcategory": "Subscriptions", - "text": "If servers will be used for Identity services, like domain controllers, establish a dedicated identity subscription in the identity management group, to host these services. Make sure that resources are set to use the domain controllers available in their region.", - "training": "https://learn.microsoft.com/learn/paths/enterprise-scale-architecture/", + "severity": "High", + "subcategory": "Identity", + "text": "Define OpenShift projects to restrict RBAC privilege and isolate workloads in your cluster.", "waf": "Security" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "graph": "resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant", - "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs", + "category": "Identity and Access Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "0acccd97-9376-4bcd-a375-0ab2ab039da6", + "link": "https://docs.openshift.com/container-platform/4.13/authentication/using-rbac.html", "services": [ - "Cost", - "Subscriptions" + "Entra", + "RBAC" ], "severity": "Medium", - "subcategory": "Subscriptions", - "text": "Ensure tags are used for billing and cost management", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "subcategory": "Identity", + "text": "Define the required RBAC roles in OpenShift are scoped to either a project or a cluster.", "waf": "Security" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "6cc0ea22-42bb-441e-a345-804ab0a09666", - "link": "https://github.com/Azure/sovereign-landing-zone/blob/main/docs/02-Architecture.md", + "category": "Identity and Access Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "d54d7c89-29db-4107-b532-5ae625ca44e4", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", "services": [ - "Subscriptions" + "Entra", + "AKV" ], "severity": "Medium", - "subcategory": "Subscriptions", - "text": "For Sovereign Landing Zone, have a 'confidential corp' and 'confidential online' management group directly under the 'landing zones' MG.", + "subcategory": "Identity", + "text": "Minimize the number of users who have administrator rights and secrets access.", "waf": "Security" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "250d81ce-8bbe-4f85-9051-6a18a8221e50", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions", + "category": "Identity and Access Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "685e2223-ace8-4bb1-8307-ca5f16f154e3", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "services": [ - "Cost" + "Entra", + "RBAC" ], - "severity": "High", - "subcategory": "Regions", - "text": "Select the right Azure region/s for your deployment. Azure is a global-scale cloud platform that provide global coverage through many regions and geographies. Different Azure regions have different characteristics, access and availability models, costs, capacity, and services offered, then it is important to consider all criteria and requirements", - "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Identity", + "text": "Use Privileged Identity Management in AAD for ARO users with privileged roles.", + "waf": "Security" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "19ca3f89-397d-44b1-b5b6-5e18661372ac", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/regions#operate-in-multiple-geographic-regions", + "category": "Network topology and connectivity", + "checklist": "Azure Red Hat OpenShift", + "guid": "aa369282-9e7e-4216-8836-87af467a1f89", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "services": [ - "ASR" + "VNet", + "Entra", + "Subscriptions", + "WAF", + "Firewall", + "DDoS" ], - "severity": "Medium", - "subcategory": "Regions", - "text": "Consider a multi-region deployment. Depending on customer size, locations, and users presence, operating in multiple regions can be a common choice to deliver services and run applications closer to them. Using a multi-region deployment is also important to provide geo disaster recovery capabilities, to eliminate the dependency from a single region capacity and diminish the risk of a temporary and localized resource capacity constraint", - "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/", - "waf": "Reliability" + "severity": "Low", + "subcategory": "DDoS", + "text": "Use Azure DDoS Network/IP Protection to protect the virtual network you use for the ARO cluster unless you use Azure Firewall or WAF in a centralized subscription", + "waf": "Security" }, { - "category": "Resource Organization", - "checklist": "Azure Landing Zone Review", - "guid": "4c27d42e-8bba-4c75-9155-9ab9153e8908", - "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", + "category": "Network topology and connectivity", + "checklist": "Azure Red Hat OpenShift", + "guid": "35bda433-24f1-4481-8533-182aa5174269", + "link": "https://docs.openshift.com/container-platform/4.13/networking/routes/secured-routes.html", "services": [], - "severity": "Medium", - "subcategory": "Regions", - "text": "Ensure required services and features are available within the chosen deployment regions", - "training": "https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/", - "waf": "Reliability" + "severity": "High", + "subcategory": "Encryption", + "text": "All web applications you configure to use an ingress should use TLS encryption and shouldn't allow access over unencrypted HTTP.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "373f482f-3e39-4d39-8aa4-7e566f6082b6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-app-delivery", + "category": "Network topology and connectivity", + "checklist": "Azure Red Hat OpenShift", + "guid": "44008ae7-d7e4-4743-876c-8bdbf55bce61", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", "services": [ "FrontDoor", - "AppGW" + "WAF" ], "severity": "Medium", - "subcategory": "App delivery", - "text": "Develop a plan for securing the delivery application content from your Workload spokes using Application Gateway and Azure Front door. You can use the Application Delivery checklist to for recommendations.", - "waf": "Operations" + "subcategory": "Internet", + "text": "Use Azure Front Door with WAF to securely publish ARO applications to the internet, especially in multi-region environments.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", - "service": "VNet", + "category": "Network topology and connectivity", + "checklist": "Azure Red Hat OpenShift", + "guid": "9e8a03f9-7879-4424-b626-786d60b96c97", + "link": "https://learn.microsoft.com/azure/openshift/howto-secure-openshift-with-front-door", "services": [ - "VNet" + "FrontDoor", + "PrivateLink" ], "severity": "Medium", - "subcategory": "Hub and spoke", - "text": "Leverage a network design based on the traditional hub-and-spoke network topology for network scenarios that require maximum flexibility.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "subcategory": "Internet", + "text": "If exposing an app on ARO with Azure Front Door, use private link to connect Front Door with the ARO router.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "6138a720-0f1c-4e16-bd30-1d6e872e52e3", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "services": [], + "category": "Network topology and connectivity", + "checklist": "Azure Red Hat OpenShift", + "guid": "be985190-4838-435c-a86b-b2912155a114", + "link": "https://learn.microsoft.com/azure/openshift/howto-restrict-egress", + "services": [ + "AzurePolicy", + "NVA", + "Firewall" + ], "severity": "Medium", - "subcategory": "App delivery", - "text": "Perform app delivery within landing zones for both internal-facing (corp) and external-facing apps (online).", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "subcategory": "Internet", + "text": "If your security policy requires you to inspect all outbound internet traffic that's generated in the ARO cluster, secure egress network traffic by using Azure Firewall or an NVA.", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", - "service": "VNet", + "category": "Network topology and connectivity", + "checklist": "Azure Red Hat OpenShift", + "guid": "75e39f54-0acc-4cd9-9937-6bcda3750ab2", + "link": "https://learn.microsoft.com/azure/openshift/howto-create-private-cluster-4x", "services": [ - "VNet", - "Firewall", - "ExpressRoute", - "DNS", - "VPN", - "Entra", - "NVA" + "AzurePolicy" ], "severity": "High", - "subcategory": "Hub and spoke", - "text": "Ensure that shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS servers.", - "waf": "Cost" + "subcategory": "Private access", + "text": "If your security policy requires you to use a private IP address for the OpenShift API, deploy a private ARO cluster.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "VNet", + "category": "Network topology and connectivity", + "checklist": "Azure Red Hat OpenShift", + "guid": "ab039da6-d54d-47c8-a29d-b107d5325ae6", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", "services": [ - "DDoS" + "ACR", + "PrivateLink" ], "severity": "Medium", - "subcategory": "App delivery", - "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "subcategory": "Private access", + "text": "Use Azure Private Link to secure network connections to managed Azure services, including to Azure Container Registry.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "25ca44e4-685e-4222-9ace-8bb12307ca5f", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-enable-arc-enabled-clusters", "services": [ - "NVA" + "Monitor" ], + "severity": "High", + "subcategory": "Operations", + "text": "Establish a monitoring process using the inbuilt Prometheus, OpenShift Logging or Container Insights integration.", + "waf": "Operations" + }, + { + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "16f154e3-aa36-4928-89e7-e216183687af", + "link": "https://docs.openshift.com/container-platform/4.13/cicd/pipelines/understanding-openshift-pipelines.html", + "services": [], "severity": "Medium", - "subcategory": "Hub and spoke", - "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance", - "waf": "Reliability" + "subcategory": "Operations", + "text": "Automate the application delivery process through DevOps practices and CI/CD solutions, such as Pipelines/GitOps provided by OpenShift.", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", - "service": "ExpressRoute", - "services": [ - "ExpressRoute", - "ARS", - "VPN" - ], + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "467a1f89-35bd-4a43-924f-14811533182a", + "link": "https://learn.microsoft.com/azure/architecture/guide/design-principles/managed-services", + "services": [], "severity": "Low", - "subcategory": "Hub and spoke", - "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.", - "waf": "Security" + "subcategory": "Operations", + "text": "Whenever possible, remove the service state from inside containers. Instead, use an Azure platform as a service (PaaS) that supports multiregion replication.", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", - "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", - "service": "ARS", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "1b7da8cf-aa66-4e15-b4d5-ada97dc3e232", + "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-storageclass", "services": [ - "ARS", - "VNet" + "Storage" ], "severity": "Low", - "subcategory": "Hub and spoke", - "text": "If using Route Server, use a /27 prefix for the Route Server subnet.", - "waf": "Security" + "subcategory": "Operations", + "text": "Use RWX storage with inbuilt Azure Files storage class.", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", - "service": "VNet", - "services": [ - "VNet", - "ACR" - ], + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "6bb235c7-05e1-4696-bded-fa8a4c8cdec4", + "link": "https://docs.openshift.com/container-platform/4.13/nodes/clusters/nodes-cluster-limit-ranges.html", + "services": [], "severity": "Medium", - "subcategory": "Hub and spoke", - "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", + "subcategory": "Performance", + "text": "Use pod requests and limits to manage the compute resources within a cluster.", "waf": "Performance" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", - "service": "VNet", - "services": [ - "Monitor" - ], + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "c620c30c-14ee-4b7f-9ae8-d9b3fec228e7", + "link": "https://docs.openshift.com/container-platform/4.13/applications/quotas/quotas-setting-per-project.html", + "services": [], "severity": "Medium", - "subcategory": "Hub and spoke", - "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "Operations" + "subcategory": "Performance", + "text": "Enforce resource quotas on projects.", + "waf": "Performance" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", - "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "87ab177a-db59-4f6b-a613-334fd09dc234", + "link": "https://docs.openshift.com/container-platform/4.13/machine_management/applying-autoscaling.html", + "services": [], + "severity": "High", + "subcategory": "Performance", + "text": "Define ClusterAutoScaler and MachineAutoScaler to scale machines when your cluster runs out of resources to support more deployments.", + "waf": "Performance" + }, + { + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "19db6128-1269-4040-a4ba-4d3e0804276d", + "link": "https://learn.microsoft.com/azure/openshift/support-policies-v4#supported-virtual-machine-sizes", "services": [ - "Entra", - "ExpressRoute", - "VNet" + "VM" ], - "severity": "Medium", - "subcategory": "Hub and spoke", - "text": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000)", + "severity": "High", + "subcategory": "Reliability", + "text": "Use virtual machine sizes that are large enough to contain multiple container instances so you get the benefits of increased density, but not so large that your cluster can't handle the workload of a failing node.", "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", - "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", - "services": [ - "Storage" - ], - "severity": "Medium", - "subcategory": "Hub and spoke", - "text": "Consider the limit of routes per route table (400).", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "4b98b15c-8b31-4aa5-aceb-58889135e227", + "link": "https://docs.openshift.com/container-platform/4.13/machine_management/deploying-machine-health-checks.html", + "services": [], + "severity": "High", + "subcategory": "Reliability", + "text": "Deploy machine health checks to automatically repair damaged machines in a machine pool.", "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", - "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", - "service": "VNet", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "896d31b6-6c67-4ba5-a119-c08e8f5d587c", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-metric-alerts", "services": [ - "VNet" + "Monitor" ], "severity": "High", - "subcategory": "Hub and spoke", - "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings", + "subcategory": "Reliability", + "text": "Use an alerting system to provide notifications when things need direct action: Container Insights metric alerts or in-built Alerting UI.", "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", - "service": "ExpressRoute", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "7e9ced16-acd1-476e-b9b2-41a998a57ae7", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview#availability-zones", + "services": [], + "severity": "High", + "subcategory": "Reliability", + "text": "Ensure that the cluster is created in a region that supports AZs and create a machine set for each AZ.", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "7b997e71-1b7d-4a8c-baa6-6e15d4d5ada9", + "link": "https://docs.openshift.com/container-platform/4.13/machine_management/creating-infrastructure-machinesets.html", "services": [ - "ExpressRoute" + "AKS" ], - "severity": "Medium", - "subcategory": "Encryption", - "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.", - "waf": "Security" + "severity": "Low", + "subcategory": "Reliability", + "text": "Create infrastructure machine sets to hold infrastructure components. Apply specific Kubernetes labels to these machines and then update the infrastructure components to run on only those machines.", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "7dc3e232-6bb2-435c-905e-1696fdedfa8a", + "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-backup#create-a-backup-with-velero-to-include-snapshots", "services": [ - "ExpressRoute", - "VPN" + "Backup" ], + "severity": "Medium", + "subcategory": "Reliability", + "text": "Create application backup and plan for restore and include persistent volumes in the backup.", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "81c12318-1a64-4174-8583-3fb4ae3c2df7", + "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-priority.html", + "services": [], "severity": "Low", - "subcategory": "Encryption", - "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "Security" + "subcategory": "Reliability", + "text": "Use pod priorities, so that in case of limited resources the most critical pods will run.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "558fd772-49b8-4211-82df-27ee412e7f98", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "ExpressRoute", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "43166c3b-cbe0-45bb-b209-d4a0da577784", + "link": "https://docs.openshift.com/container-platform/4.13/architecture/admission-plug-ins.html", "services": [ - "VNet", - "ACR" + "AzurePolicy" ], - "severity": "High", - "subcategory": "IP plan", - "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "severity": "Low", + "subcategory": "Security", + "text": "Regulate cluster functions using admission plug-ins, which are commonly used to enforce security policy, resource limitations, or configuration requirements.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", - "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "24d21678-5d2f-4a56-a56a-d48408fe8273", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", "services": [ - "VNet" - ], - "severity": "Low", - "subcategory": "IP plan", - "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "ACR" + ], + "severity": "Low", + "subcategory": "Security", + "text": "Store your container images in Azure Container Registry and geo-replicate the registry to each region.", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", - "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", - "services": [ - "VNet" - ], - "severity": "High", - "subcategory": "IP plan", - "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16)", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "4c486ba2-80dc-4059-8cf7-5ee8e1309ccc", + "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-vertical-autoscaler.html", + "services": [], + "severity": "Medium", + "subcategory": "Workload", + "text": "Optimize the CPU and memory request values, and maximize the efficiency of the cluster resources using vertical pod autoscaler.", "waf": "Performance" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", - "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", - "service": "VNet", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "d579366b-cda2-4750-aa1a-bfe9d55d14c3", + "link": "https://docs.openshift.com/container-platform/4.13/applications/application-health.html", "services": [ - "VNet" + "Monitor" ], - "severity": "High", - "subcategory": "IP plan", - "text": "Avoid using overlapping IP address ranges for production and DR sites.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "severity": "Medium", + "subcategory": "Workload", + "text": "Add health probes to your pods to monitor application health. Make sure pods contain livenessProbe and readinessProbe. Use Startup probes to determine the point at which the application has started up.", "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", - "services": [ - "VNet", - "DNS" - ], + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "c4929cb1-b3d1-4325-ae12-4ba34d0685ed", + "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-autoscaling.html", + "services": [], "severity": "Medium", - "subcategory": "IP plan", - "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Operations" + "subcategory": "Workload", + "text": "Scale pods to meet demand using horizontal pod autoscaler.", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", - "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", - "service": "DNS", + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "dce9be3b-b0dd-4b3b-95fb-2ec14eeaa359", + "link": "https://docs.openshift.com/container-platform/4.13/nodes/pods/nodes-pods-configuring.html#nodes-pods-pod-distruption-about_nodes-pods-configuring", "services": [ - "VNet", - "DNS", - "ACR" + "Cost" ], "severity": "Medium", - "subcategory": "IP plan", - "text": "For environments where name resolution across Azure and on-premises is required, consider using Azure DNS Private Resolver.", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", - "waf": "Security" + "subcategory": "Workload", + "text": "Use disruption budgets to ensure the required number of pod replicas exist to handle expected application load.", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", - "services": [ - "VNet", - "DNS" - ], - "severity": "Low", - "subcategory": "IP plan", - "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.", - "waf": "Operations" + "category": "Operations management", + "checklist": "Azure Red Hat OpenShift", + "guid": "2829e2ed-b217-4367-9aff-6791b4935ada", + "link": "https://docs.openshift.com/container-platform/4.13/nodes/scheduling/nodes-scheduler-pod-topology-spread-constraints.html", + "services": [], + "severity": "Medium", + "subcategory": "Workload", + "text": "Use pod topology constraints to automatically schedule pods on nodes throughout the cluster.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "614658d3-558f-4d77-849b-821112df27ee", - "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", - "service": "DNS", - "services": [ - "VNet", - "VM", - "DNS" - ], + "category": "Operations Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "fea1dbf3-dd95-4d48-a7c8-91dcb1f7d575", + "link": "https://learn.microsoft.com/azure/openshift/intro-openshift#service-level-agreement", + "services": [], + "severity": "Medium", + "subcategory": "Availablity", + "text": "Leverage Current ARO SLA - 99.95 into BCDR planning", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "b95e06e1-58e2-4ea3-a92c-2de6e2065b3a", + "link": "https://www.redhat.com/rhdc/managed-files/pa-getting-started-azure-openshift-ebook-f20686-201911-en_0.pdf", + "services": [], "severity": "High", - "subcategory": "IP plan", - "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Operations" + "subcategory": "Cluster Design", + "text": "Run user workloads on the worker nodes, not the control plane nodes", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", - "service": "Bastion", + "category": "Operations Management", + "checklist": "Azure Red Hat OpenShift", + "description": "Create infrastructure machine sets to hold infrastructure components. Apply specific Kubernetes labels to these machines and then update the infrastructure components to run on only those machines", + "guid": "76af4a69-1e88-439a-ba46-667e13c10567", + "link": "https://learn.microsoft.com/azure/openshift/howto-segregate-machinesets", "services": [ - "Bastion" + "VNet", + "AKS" ], "severity": "Medium", - "subcategory": "Internet", - "text": "Consider using Azure Bastion to securely connect to your network.", - "waf": "Security" + "subcategory": "Cluster Design", + "text": "Isolate workloads into worker nodes running in individual subnets as needed", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", - "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", - "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", - "service": "Bastion", + "category": "Operations Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "785c6fe9-6c96-4ad8-a44c-f3b2b38c886b", + "link": "https://learn.microsoft.com/azure/openshift/howto-create-a-backup", "services": [ - "VNet", - "Bastion" + "Backup" ], "severity": "Medium", - "subcategory": "Internet", - "text": "Use Azure Bastion in a subnet /26 or larger.", - "waf": "Security" + "subcategory": "Backup", + "text": "Backup a cluster state for stateful workload scenarios to a paired region", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "WAF", + "category": "Operations Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "a2c02149-9014-4a5d-9ce5-74dccbd9792a", + "link": "https://access.redhat.com/documentation/red_hat_openshift_container_storage/4.4/html/deploying_and_managing_openshift_container_storage_on_microsoft_azure/deploying-openshift-container-storage-on-microsoft-azure_rhocs", "services": [ - "FrontDoor", - "AzurePolicy", - "ACR", - "WAF" + "Storage", + "ACR" ], "severity": "Medium", - "subcategory": "Internet", - "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Security" + "subcategory": "Data Store", + "text": "If container storage is required, ensure availability across regions if needed: Using RWX storage with inbuilt Azure Files storage class. Using CSI Drivers for storage provisioning", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "services": [ - "FrontDoor", - "AzurePolicy", - "AppGW", - "WAF" - ], + "category": "Operations Management", + "checklist": "Azure Red Hat OpenShift", + "guid": "6bcca2b4-fea1-4dbf-9dd9-5d48c7c891dc", + "link": "https://docs.openshift.com/aro/3/dev_guide/persistent_volumes.html", + "services": [], + "severity": "Medium", + "subcategory": "Data Store", + "text": "Whenever possible, move state out of containers and into external databases that support multi-region replication. Avoid Persistent Volumes", + "waf": "Reliability" + }, + { + "category": "Platform Automation", + "checklist": "Azure Red Hat OpenShift", + "guid": "42324ece-81c1-4231-a1a6-417415833fb4", + "link": "https://docs.openshift.com/container-platform/4.13/applications/deployments/route-based-deployment-strategies.html", + "services": [], "severity": "Low", - "subcategory": "Internet", - "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Security" + "subcategory": "Workload", + "text": "Consider blue/green or canary strategies to deploy new releases of application.", + "waf": "Operations" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "services": [ - "VNet", - "WAF" - ], + "category": "Platform Automation", + "checklist": "Azure Red Hat OpenShift", + "guid": "ae3c2df7-4316-46c3-acbe-05bbe209d4a0", + "link": "https://docs.openshift.com/container-platform/4.13/cicd/gitops/understanding-openshift-gitops.html", + "services": [], + "severity": "Low", + "subcategory": "Workload", + "text": "Consider using Red Hat OpenShift GitOps. Red Hat OpenShift GitOps uses Argo CD to maintain cluster resources and support application CI/CD.", + "waf": "Operations" + }, + { + "category": "Security", + "checklist": "Azure Red Hat OpenShift", + "guid": "da577784-24d2-4167-a5d2-fa56c56ad484", + "link": "https://learn.microsoft.com/azure/openshift/support-lifecycle", + "services": [], "severity": "High", - "subcategory": "Internet", - "text": "Deploy WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "subcategory": "Control plane", + "text": "Keep your clusters on the latest OpenShift version to avoid potential security or upgrade issues.", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", + "category": "Security", + "checklist": "Azure Red Hat OpenShift", + "guid": "08fe8273-4c48-46ba-880d-c0591cf75ee8", + "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/quickstart-connect-cluster", "services": [ - "VNet", - "DDoS" + "AKS", + "Arc" ], "severity": "High", - "subcategory": "Internet", - "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "subcategory": "Control plane", + "text": "Connect Azure Red Hat OpenShift clusters to Azure Arc-enabled Kubernetes.", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "b034c01e-110b-463a-b36e-e3346e57f225", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", - "service": "VNet", + "category": "Security", + "checklist": "Azure Red Hat OpenShift", + "guid": "e1309ccc-d579-4366-acda-2750aa1abfe9", + "link": "https://docs.openshift.com/container-platform/4.10/security/encrypting-etcd.html", "services": [], - "severity": "High", - "subcategory": "Internet", - "text": "Assess and review network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Encryption", + "text": "For Azure Red Hat OpenShift 4 clusters, etcd data isn't encrypted by default, but it's recommended to enable etcd encryption to provide another layer of data security.", + "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", + "category": "Security", + "checklist": "Azure Red Hat OpenShift", + "guid": "d55d14c3-c492-49cb-8b3d-1325ae124ba3", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", "services": [ - "DDoS" + "Defender", + "AKS", + "Arc" ], - "severity": "High", - "subcategory": "Internet", - "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "severity": "Medium", + "subcategory": "Posture", + "text": "Use Microsoft Defender for Containers supported via Arc-enabled Kubernetes to secure clusters, containers, and applications.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure Red Hat OpenShift", + "guid": "4d0685ed-dce9-4be3-ab0d-db3b55fb2ec1", + "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/tutorial-akv-secrets-provider", "services": [ - "ExpressRoute" + "AKS", + "AKV", + "Arc" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "Ensure that you have investigated the possibility to use ExpressRoute as primary connection to Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "subcategory": "Secrets", + "text": "For applications that require access to sensitive information, use a service principal and the AKV Secrets Provider with the extension for Arc-enabled Kubernetes clusters.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.", - "guid": "f29812b2-363c-4efe-879b-599de0d5973c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", - "services": [ - "ExpressRoute" - ], + "category": "Security", + "checklist": "Azure Red Hat OpenShift", + "guid": "4eeaa359-2829-4e2e-bb21-73676aff6791", + "link": "https://learn.microsoft.com/azure/aks/developer-best-practices-pod-security#secure-pod-access-to-resources", + "services": [], "severity": "Medium", - "subcategory": "Hybrid", - "text": "When you use multiple ExpressRoute circuits, or multiple on-prem locations, make sure to optimize routing with BGP attributes, if certain paths are preferred.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "subcategory": "Workload", + "text": "Secure pod access to resources. Provide the least number of permissions, and avoid using root or privileged escalation.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", - "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure Red Hat OpenShift", + "guid": "b4935ada-4232-44ec-b81c-123181a64174", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes#install-azure-policy-extension-for-azure-arc-enabled-kubernetes", "services": [ - "ExpressRoute", - "VPN" + "Monitor", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "subcategory": "Workload", + "text": "Monitor and enforce configuration by using the Azure Policy Extension.", + "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", - "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", - "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure Red Hat OpenShift", + "guid": "15833fb4-ae3c-42df-9431-66c3bcbe05bb", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", "services": [ - "ExpressRoute", - "Cost" + "Defender" ], "severity": "High", - "subcategory": "Hybrid", - "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.", - "waf": "Cost" + "subcategory": "Workload", + "text": "Scan your images for vulnerabilities with Microsoft Defender or any other image scanning solution.", + "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", - "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", - "service": "ExpressRoute", + "category": "Security", + "checklist": "Azure Red Hat OpenShift", + "guid": "e209d4a0-da57-4778-924d-216785d2fa56", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", "services": [ - "ExpressRoute", - "Cost" + "ACR", + "Subscriptions" ], - "severity": "High", - "subcategory": "Hybrid", - "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU.", - "waf": "Cost" + "severity": "Low", + "subcategory": "Workload", + "text": "Deploy a dedicated and private instance of Azure Container Registry to each landing zone subscription.", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", - "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", - "service": "ExpressRoute", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", + "service": "AVS", "services": [ - "ExpressRoute" + "Entra", + "Subscriptions", + "AVS" ], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "severity": "High", + "subcategory": "Identity", + "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", - "service": "ExpressRoute", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "75089c20-990d-4927-b105-885576f76fc2", + "service": "AVS", "services": [ - "ExpressRoute" + "Entra", + "AVS" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "subcategory": "Identity", + "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", - "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", - "service": "ExpressRoute", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", + "service": "AVS", "services": [ - "ExpressRoute" + "Entra", + "AVS" ], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "severity": "High", + "subcategory": "Identity", + "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", - "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", - "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", - "service": "VPN", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", + "service": "AVS", "services": [ - "VPN" - ], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "Reliability" + "Entra", + "AVS" + ], + "severity": "Medium", + "subcategory": "Identity", + "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", - "service": "VPN", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", + "service": "AVS", "services": [ - "VPN" + "Entra", + "AVS" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "Use redundant VPN appliances on-premises (active/active or active/passive).", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "Reliability" + "subcategory": "Identity", + "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)", + "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "718cb437-b060-2589-8856-2e93a5c6633b", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", + "service": "AVS", "services": [ - "ExpressRoute", - "Cost" + "Entra", + "AVS" ], "severity": "High", - "subcategory": "Hybrid", - "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Cost" + "subcategory": "Identity", + "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", - "service": "ExpressRoute", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", + "service": "AVS", "services": [ - "ExpressRoute" + "Entra", + "RBAC", + "AVS" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "subcategory": "Identity", + "text": "Has an RBAC model been created for use within VMware vSphere", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "b30e38c3-f298-412b-8363-cefe179b599d", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", - "service": "ExpressRoute", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", + "service": "AVS", "services": [ - "ExpressRoute", - "Monitor" + "Entra", + "RBAC", + "AVS" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operations" + "subcategory": "Identity", + "text": "RBAC permissions should be granted on ADDS groups and not on specific users", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", - "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", - "service": "ExpressRoute", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", + "service": "AVS", "services": [ - "ACR", - "NetworkWatcher", - "Monitor" + "Entra", + "RBAC", + "AVS" ], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operations" + "severity": "High", + "subcategory": "Identity", + "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", - "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", - "service": "ExpressRoute", + "category": "Identity", + "checklist": "Azure VMware Solution Design Review", + "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", + "service": "AVS", "services": [ - "ExpressRoute" + "Entra", + "RBAC", + "AVS" ], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "Use ExpressRoute circuits from different peering locations for redundancy.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "severity": "High", + "subcategory": "Identity", + "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", - "service": "ExpressRoute", + "category": "Networking", + "checklist": "Azure VMware Solution Design Review", + "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", + "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", + "service": "AVS", "services": [ - "ExpressRoute", - "VPN" + "AVS" ], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "Use site-to-site VPN as failover of ExpressRoute, especially if only using a single ExpressRoute circuit.", - "waf": "Reliability" + "severity": "High", + "subcategory": "Architecture", + "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand", + "waf": "Performance" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", - "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", - "service": "ExpressRoute", + "category": "Networking", + "checklist": "Azure VMware Solution Design Review", + "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", + "service": "AVS", "services": [ - "VNet", - "Storage" + "AVS", + "ExpressRoute", + "VPN", + "Monitor", + "NetworkWatcher" ], "severity": "High", - "subcategory": "Hybrid", - "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.", - "waf": "Reliability" + "subcategory": "Monitoring", + "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'", + "waf": "Operations" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "d581a947-69a2-4783-942e-9df3664324c8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", - "service": "ExpressRoute", + "category": "Networking", + "checklist": "Azure VMware Solution Design Review", + "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", + "service": "AVS", "services": [ + "AVS", "ExpressRoute", - "ACR" + "Monitor", + "VM", + "NetworkWatcher" ], - "severity": "High", - "subcategory": "Hybrid", - "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", - "service": "ExpressRoute", + "category": "Networking", + "checklist": "Azure VMware Solution Design Review", + "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", + "service": "AVS", "services": [ - "ExpressRoute" + "Monitor", + "AVS", + "VM", + "NetworkWatcher" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "subcategory": "Monitoring", + "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", - "service": "ExpressRoute", - "services": [], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "category": "Networking", + "checklist": "Azure VMware Solution Design Review", + "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", + "service": "AVS", + "services": [ + "ARS", + "AVS" + ], + "severity": "High", + "subcategory": "Routing", + "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "ExpressRoute", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", + "service": "AVS", "services": [ - "ExpressRoute" + "Entra", + "RBAC", + "AVS" ], "severity": "High", - "subcategory": "Hybrid", - "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "subcategory": "Security (identity)", + "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", - "service": "ExpressRoute", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", + "service": "AVS", "services": [ - "ExpressRoute", - "VNet", - "Monitor" + "Entra", + "RBAC", + "AVS" ], - "severity": "Medium", - "subcategory": "Hybrid", - "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operations" + "severity": "High", + "subcategory": "Security (identity)", + "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "5234c93f-b651-41dd-80c1-234177b91ced", - "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", - "service": "ExpressRoute", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", + "service": "AVS", "services": [ - "ExpressRoute", - "VNet" + "Entra", + "AVS" ], "severity": "Medium", - "subcategory": "Hybrid", - "text": "Avoid using ExpressRoute circuits for VNet-to-VNet communication.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "subcategory": "Security (identity)", + "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)", + "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", + "service": "AVS", "services": [ - "Firewall" + "Entra", + "AVS" ], "severity": "High", - "subcategory": "Firewall", - "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "subcategory": "Security (identity)", + "text": "Limit use of CloudAdmin account to emergency access only", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", + "service": "AVS", "services": [ + "Entra", "RBAC", - "AzurePolicy", - "ACR", - "Firewall" + "AVS" ], "severity": "Medium", - "subcategory": "Firewall", - "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "subcategory": "Security (identity)", + "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", - "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", + "service": "AVS", "services": [ - "Firewall" + "Entra", + "AVS" ], - "severity": "Low", - "subcategory": "Firewall", - "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "severity": "Medium", + "subcategory": "Security (identity)", + "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", - "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", - "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", + "service": "AVS", "services": [ - "DNS", - "Firewall" + "Entra", + "AVS", + "VM" ], "severity": "High", - "subcategory": "Firewall", - "text": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules.", + "subcategory": "Security (identity)", + "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", - "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", + "service": "AVS", "services": [ - "Firewall" + "AVS" ], - "severity": "High", - "subcategory": "Firewall", - "text": "Use Azure Firewall Premium for additional security and protection.", + "severity": "Medium", + "subcategory": "Security (network)", + "text": "Is East-West traffic filtering implemented within NSX-T", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", - "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", + "service": "AVS", "services": [ + "AppGW", + "AVS", "Firewall" ], "severity": "High", - "subcategory": "Firewall", - "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.", + "subcategory": "Security (network)", + "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", - "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", + "service": "AVS", "services": [ - "Firewall" + "AVS" ], "severity": "High", - "subcategory": "Firewall", - "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.", + "subcategory": "Security (network)", + "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", - "guid": "a3784907-9836-4271-aafc-93535f8ec08b", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", + "service": "AVS", "services": [ - "VNet", - "Firewall", - "Storage", - "VWAN", - "NVA" + "Monitor", + "AVS" ], - "severity": "High", - "subcategory": "Firewall", - "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance", + "severity": "Medium", + "subcategory": "Security (network)", + "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "715d833d-4708-4527-90ac-1b142c7045ba", - "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "334fdf91-c234-4182-a652-75269440b4be", + "service": "AVS", "services": [ - "Storage", - "Firewall" + "VNet", + "AVS", + "ExpressRoute", + "VPN", + "DDoS" ], "severity": "Medium", - "subcategory": "Firewall", - "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Operations" + "subcategory": "Security (network)", + "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure", + "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", - "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", + "service": "AVS", "services": [ - "AzurePolicy", - "Firewall" + "AVS" ], - "severity": "Important", - "subcategory": "Firewall", - "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Security (network)", + "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager", + "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", - "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", - "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", + "service": "AVS", "services": [ - "VNet", - "Firewall" + "AVS", + "Defender" ], - "severity": "High", - "subcategory": "Segmentation", - "text": "Use a /26 prefix for your Azure Firewall subnets.", + "severity": "Medium", + "subcategory": "Security (guest/VM)", + "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", - "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", + "service": "AVS", "services": [ - "AzurePolicy" + "AVS", + "Arc" ], "severity": "Medium", - "subcategory": "Firewall", - "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use", - "waf": "Performance" + "subcategory": "Security (guest/VM)", + "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", - "link": "https://learn.microsoft.com/azure/firewall/ip-groups", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", + "service": "AVS", "services": [ - "Storage" + "AVS", + "SQL" ], - "severity": "Medium", - "subcategory": "Firewall", - "text": "Use IP Groups or IP prefixes to reduce number of IP table rules", - "waf": "Performance" + "severity": "Low", + "subcategory": "Security (guest/VM)", + "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", - "service": "Firewall", - "services": [], - "severity": "Medium", - "subcategory": "Firewall", - "text": "Avoid wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs", - "waf": "Performance" + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "a3592718-e6e2-4051-9267-6ae46691e883", + "service": "AVS", + "services": [ + "AVS", + "AKV" + ], + "severity": "Low", + "subcategory": "Security (guest/VM)", + "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", - "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "5ac94222-3e13-4810-9230-81a941741583", + "service": "AVS", "services": [ - "Monitor" + "AVS" ], "severity": "Medium", - "subcategory": "Firewall", - "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.", - "waf": "Performance" + "subcategory": "Security (guest/VM)", + "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "346840b8-1064-496e-8396-4b1340172d52", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", - "service": "Firewall", - "services": [], + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", + "service": "AVS", + "services": [ + "AVS" + ], "severity": "High", - "subcategory": "Firewall", - "text": "Enable TLS Inspection", - "waf": "Performance" + "subcategory": "Governance (platform)", + "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "d88408f3-7273-44c8-96ba-280214590146", + "service": "AVS", "services": [ - "ServiceBus" + "Storage", + "AVS", + "AzurePolicy" ], - "severity": "Low", - "subcategory": "Firewall", - "text": "Use web categories to allow or deny outbound access to specific topics.", - "waf": "Performance" - }, - { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", - "service": "Firewall", - "services": [], - "severity": "Medium", - "subcategory": "Firewall", - "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.", - "waf": "Performance" + "severity": "High", + "subcategory": "Governance (platform)", + "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", - "link": "https://learn.microsoft.com/azure/firewall/dns-details", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", + "service": "AVS", "services": [ - "DNS", - "Firewall" + "ASR", + "AVS" ], - "severity": "Medium", - "subcategory": "Firewall", - "text": "Enable Azure Firewall DNS proxy configuration ", - "waf": "Security" + "severity": "High", + "subcategory": "Governance (platform)", + "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement", + "waf": "Reliability" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", - "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", + "service": "AVS", "services": [ - "AzurePolicy", - "VM" + "AVS" ], "severity": "Medium", - "subcategory": "Firewall", - "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines", - "waf": "Security" + "subcategory": "Governance (platform)", + "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", + "service": "AVS", "services": [ - "Monitor", - "Firewall" + "AVS", + "AzurePolicy" ], - "severity": "Low", - "subcategory": "Firewall", - "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.", + "severity": "Medium", + "subcategory": "Governance (platform)", + "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes", "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", + "service": "AVS", "services": [ - "Backup" + "AVS", + "Cost" ], - "severity": "Low", - "subcategory": "Firewall", - "text": "Implement backups for your firewall rules", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Governance (platform)", + "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used", + "waf": "Cost" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "App Gateway", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", + "service": "AVS", "services": [ - "VNet" + "AVS", + "Cost" ], - "severity": "High", - "subcategory": "PaaS", - "text": "Ensure that control-plane communication for Azure PaaS services injected into a virtual network is not broken, for example with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "Security" + "severity": "Low", + "subcategory": "Governance (platform)", + "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution", + "waf": "Cost" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "e43a58a9-c229-49c4-b7b5-7d0c655562f2", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "6691e883-5ac9-4422-83e1-3810523081a9", + "service": "AVS", "services": [ - "PrivateLink" + "AVS" ], "severity": "Medium", - "subcategory": "PaaS", - "text": "Use Private Link, where available, for shared Azure PaaS services.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "subcategory": "Governance (platform)", + "text": "Consider the use of Azure Private-Link when using other Azure Native Services", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "ExpressRoute", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", + "service": "AVS", "services": [ - "ExpressRoute", - "PrivateLink" + "AVS" ], - "severity": "Medium", - "subcategory": "PaaS", - "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Security" + "severity": "High", + "subcategory": "Governance (platform)", + "text": "Ensure all required resource reside within the same Azure availability zone(s)", + "waf": "Performance" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", - "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "VNet", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", + "service": "AVS", "services": [ - "VNet" + "AVS", + "VM", + "Defender" ], "severity": "Medium", - "subcategory": "PaaS", - "text": "Don't enable virtual network service endpoints by default on all subnets.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "subcategory": "Governance (guest/VM)", + "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", + "service": "AVS", "services": [ - "PrivateLink", - "NVA", - "DNS", - "Firewall" + "AVS", + "VM", + "Arc" ], "severity": "Medium", - "subcategory": "PaaS", - "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "subcategory": "Governance (guest/VM)", + "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads", "waf": "Security" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", - "service": "ExpressRoute", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", + "service": "AVS", "services": [ - "ExpressRoute", - "VNet", - "VPN" + "AVS" ], "severity": "High", - "subcategory": "Segmentation", - "text": "Use at least a /27 prefix for your Gateway subnets", - "waf": "Security" + "subcategory": "Governance (guest/VM)", + "text": "Enable Diagnostic and metric logging on Azure VMware Solution", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", - "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", - "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", - "service": "NSG", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", + "service": "AVS", "services": [ - "VNet" + "Monitor", + "AVS", + "VM" ], "severity": "Medium", - "subcategory": "Segmentation", - "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.", - "waf": "Security" + "subcategory": "Governance (guest/VM)", + "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "c2447ec6-6138-4a72-80f1-ce16ed301d6e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "589d457a-927c-4397-9d11-02cad6aae11e", + "service": "AVS", "services": [ - "VNet" + "VM", + "AVS", + "AzurePolicy", + "Backup" ], "severity": "Medium", - "subcategory": "Segmentation", - "text": "Delegate subnet creation to the landing zone owner.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Security" + "subcategory": "Governance (guest/VM)", + "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", - "service": "NSG", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "ee29711b-d352-4caa-ab79-b198dab81932", + "service": "AVS", "services": [ - "VNet", - "ACR" + "Monitor", + "AVS", + "Defender" ], "severity": "Medium", - "subcategory": "Segmentation", - "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "subcategory": "Compliance", + "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", - "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", - "service": "NSG", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", + "service": "AVS", "services": [ - "VNet", - "VM" + "AVS", + "Defender" ], "severity": "Medium", - "subcategory": "Segmentation", - "text": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "subcategory": "Compliance", + "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", + "service": "AVS", "services": [ - "Entra", - "VNet", - "NVA" + "AVS" ], - "severity": "Medium", - "subcategory": "Segmentation", - "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "severity": "High", + "subcategory": "Compliance", + "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "dfe237de-143b-416c-91d7-aa9b64704489", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", + "service": "AVS", "services": [ - "VNet", - "NetworkWatcher" + "AVS" ], - "severity": "Medium", - "subcategory": "Segmentation", - "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "severity": "High", + "subcategory": "Compliance", + "text": "Are data processing implications (service provider / service consumer model) clear and documented", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", - "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "NSG", + "category": "Governance", + "checklist": "Azure VMware Solution Design Review", + "guid": "547c1747-dc56-4068-a714-435cd19dd244", + "service": "AVS", "services": [ - "VNet" + "AVS" ], "severity": "Medium", - "subcategory": "Segmentation", - "text": "Consider the limit of NSG rules per NSG (1000).", - "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "waf": "Reliability" + "subcategory": "Compliance", + "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", + "service": "AVS", "services": [ - "VWAN" + "Monitor", + "AVS" ], - "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "Consider Virtual WAN for simplified Azure networking management, and make sure your scenario is explicitly described in the list of Virtual WAN routing designs", - "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", + "severity": "High", + "subcategory": "Monitoring", + "text": "Create dashboards to enable core Azure VMware Solution monitoring insights", "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", + "service": "AVS", "services": [ - "ACR", - "VWAN" + "Monitor", + "AVS" ], - "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.", - "waf": "Performance" + "severity": "High", + "subcategory": "Monitoring", + "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "9659e396-80e7-4828-ac93-5657d02bff45", + "service": "AVS", "services": [ - "VWAN", - "ACR" + "Monitor", + "AVS" ], - "severity": "Low", - "subcategory": "Virtual WAN", - "text": "Follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network", - "waf": "Performance" + "severity": "High", + "subcategory": "Monitoring", + "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", - "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", + "service": "AVS", "services": [ - "VWAN", - "Firewall" + "Monitor", + "AVS" ], - "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" + "severity": "High", + "subcategory": "Monitoring", + "text": "Ensure alerts are configured for Azure Service Health alerts and notifications", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", + "service": "AVS", "services": [ - "VWAN" + "Storage", + "Monitor", + "AVS" ], "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "Ensure that the network architecture is within the Azure Virtual WAN limits.", - "waf": "Reliability" + "subcategory": "Monitoring", + "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", - "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", + "service": "AVS", "services": [ - "VWAN", - "Monitor" + "Monitor", + "AVS" ], - "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.", + "severity": "Low", + "subcategory": "Monitoring", + "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?", "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", + "service": "AVS", "services": [ - "VWAN" + "Storage", + "AVS", + "VM", + "AzurePolicy" ], - "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "Make sure that your IaC deployments does not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.", - "waf": "Reliability" + "severity": "High", + "subcategory": "Operations", + "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", + "service": "AVS", "services": [ - "ExpressRoute", - "VPN", - "VWAN" + "AVS" ], "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.", - "waf": "Reliability" + "subcategory": "Operations", + "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", + "service": "AVS", "services": [ - "VWAN" + "Storage", + "AVS", + "Backup" ], "severity": "Medium", - "subcategory": "Virtual WAN", - "text": "Make sure that your IaC deployments are configuring label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.", - "waf": "Reliability" + "subcategory": "Operations", + "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore", + "waf": "Operations" }, { - "ammp": true, - "category": "Network Topology and Connectivity", - "checklist": "Azure Landing Zone Review", - "guid": "9c75dfef-573c-461c-a698-68598595581a", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", - "service": "VWAN", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", + "service": "AVS", "services": [ - "VWAN" + "AVS", + "Arc" ], - "severity": "High", - "subcategory": "Virtual WAN", - "text": "Assign enough IP space to virtual hubs, ideally a /23 prefix.", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Operations", + "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)", + "waf": "Operations" }, { - "ammp": true, - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", + "service": "AVS", "services": [ - "AzurePolicy" + "Monitor", + "AVS" ], - "severity": "High", - "subcategory": "Governance", - "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.", - "waf": "Security" + "severity": "Medium", + "subcategory": "Operations", + "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", + "service": "AVS", "services": [ - "RBAC", - "AzurePolicy" + "AVS" ], "severity": "Medium", - "subcategory": "Governance", - "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.", - "waf": "Security" + "subcategory": "Operations", + "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "223ace8c-b123-408c-a501-7f154e3ab369", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", + "service": "AVS", "services": [ - "AzurePolicy", - "Subscriptions" + "Monitor", + "AVS", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Governance", - "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes", - "waf": "Security" + "subcategory": "Operations", + "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "3829e7e3-1618-4368-9a04-77a209945bda", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "Management", + "checklist": "Azure VMware Solution Design Review", + "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", + "service": "AVS", "services": [ - "AzurePolicy" + "AVS", + "Defender" ], "severity": "Medium", - "subcategory": "Governance", - "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.", + "subcategory": "Security", + "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "43334f24-9116-4341-a2ba-527526944008", - "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", - "service": "Policy", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", + "service": "AVS", "services": [ - "AzurePolicy", - "Subscriptions" + "AVS", + "Backup" ], - "severity": "Low", - "subcategory": "Governance", - "text": "Use Azure Policy to control which services users can provision at the subscription/management group level", - "waf": "Security" + "severity": "Medium", + "subcategory": "Backup", + "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", + "service": "AVS", "services": [ - "AzurePolicy" + "ASR", + "AVS" ], "severity": "Medium", - "subcategory": "Governance", - "text": "Use built-in policies where possible to minimize operational overhead.", - "waf": "Security" + "subcategory": "Disaster Recovery", + "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.", - "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", - "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", - "service": "Policy", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", + "service": "AVS", "services": [ - "RBAC", - "AzurePolicy", - "Subscriptions", - "Entra" + "ASR", + "AVS" ], "severity": "Medium", - "subcategory": "Governance", - "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.", - "waf": "Security" + "subcategory": "Disaster Recovery", + "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "19048384-5c98-46cb-8913-156a12476e49", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", + "service": "AVS", "services": [ - "AzurePolicy", - "Subscriptions" + "ASR", + "AVS" ], - "severity": "Medium", - "subcategory": "Governance", - "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.", - "waf": "Security" + "severity": "High", + "subcategory": "Disaster Recovery", + "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", - "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", - "service": "Policy", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "8255461e-2aee-4345-9aec-8339248b262d", + "service": "AVS", "services": [ - "AzurePolicy" + "ASR", + "AVS" ], "severity": "Medium", - "subcategory": "Governance", - "text": "If any data sovereignty requirements exist, Azure Policies can be deployed to enforce them", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", - "waf": "Security" + "subcategory": "Disaster Recovery", + "text": "Use the geopolitical region pair as the secondary disaster recovery environment", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", - "service": "Policy", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", + "service": "AVS", "services": [ - "AzurePolicy" + "ASR", + "AVS" ], - "severity": "Medium", - "subcategory": "Governance", - "text": "For Sovereign Landing Zone, sovereignty policy baseline' policy initiative is deployed and and assigned at correct MG level.", - "waf": "Security" + "severity": "High", + "subcategory": "Disaster Recovery", + "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", - "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", - "service": "Policy", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", + "service": "AVS", "services": [ - "AzurePolicy" + "ASR", + "AVS", + "ExpressRoute", + "NVA" ], "severity": "Medium", - "subcategory": "Governance", - "text": "For Sovereign Landing Zone, sovereign Control objectives to policy mapping' is documented.", - "waf": "Security" + "subcategory": "Disaster Recovery", + "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", - "service": "Policy", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", + "service": "AVS", "services": [ - "AzurePolicy" + "AVS", + "Backup" ], "severity": "Medium", - "subcategory": "Governance", - "text": "For Sovereign Landing Zone, process is in place for CRUD of 'Sovereign Control objectives to policy mapping'.", - "waf": "Security" + "subcategory": "Business Continuity", + "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure Landing Zone Review", - "guid": "29fd366b-a180-452b-9bd7-954b7700c667", - "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", + "service": "AVS", "services": [ - "Cost", - "TrafficManager", - "Monitor" + "AVS", + "Backup" ], "severity": "Medium", - "subcategory": "Optimize your cloud investment", - "text": "Configure 'Actual' and 'Forecasted' Budget Alerts.", - "waf": "Cost" + "subcategory": "Business Continuity", + "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud", + "waf": "Reliability" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", + "service": "AVS", "services": [ - "Entra", - "AzurePolicy", - "RBAC", - "Monitor" + "AVS", + "Backup" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.", - "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "waf": "Operations" + "subcategory": "Business Continuity", + "text": "Deploy your backup solution outside of vSan, on Azure native components", + "waf": "Reliability" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Monitor", + "category": "BCDR", + "checklist": "Azure VMware Solution Design Review", + "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", + "service": "AVS", "services": [ - "AzurePolicy", - "ARS", - "Storage", - "Monitor" + "AVS" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Operations" + "severity": "Low", + "subcategory": "Business Continuity", + "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?", + "waf": "Reliability" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", - "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", - "service": "VM", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", + "service": "AVS", "services": [ - "AzurePolicy", - "VM", - "Monitor" + "AVS" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "severity": "Low", + "subcategory": "Deployment strategy", + "text": "For manual deployments, all configuration and deployments must be documented", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", + "service": "AVS", "services": [ - "VM" + "AVS" ], - "severity": "Medium", - "subcategory": "Operational compliance", - "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "severity": "Low", + "subcategory": "Deployment strategy", + "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", + "service": "AVS", "services": [ - "VM" + "AVS" ], - "severity": "Medium", - "subcategory": "Operational compliance", - "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "severity": "Low", + "subcategory": "Automated Deployment", + "text": "For automated deployments, deploy a minimal private cloud and scale as needed", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "90483845-c986-4cb2-a131-56a12476e49f", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Network Watcher", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", + "service": "AVS", "services": [ - "Monitor", - "NetworkWatcher" + "AVS" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use Network Watcher to proactively monitor traffic flows", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "severity": "Low", + "subcategory": "Automated Deployment", + "text": "For automated deployments, request or reserve quota prior to starting the deployment", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "541acdce-9793-477b-adb3-751ab2ab13ad", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", + "service": "AVS", "services": [ - "Monitor" + "AVS", + "AzurePolicy" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use resource locks to prevent accidental deletion of critical shared services.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "severity": "Low", + "subcategory": "Automated Deployment", + "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", + "service": "AVS", "services": [ - "RBAC", - "AzurePolicy", - "Monitor" + "AVS", + "AKV" ], "severity": "Low", - "subcategory": "Monitoring", - "text": "Use deny policies to supplement Azure role assignments. The combination of deny policies and Azure role assignments ensures the appropriate guardrails are in place to enforce who can deploy and configure resources and what resources they can deploy and configure.", + "subcategory": "Automated Connectivity", + "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "e5695f22-23ac-4e8c-a123-08ca5017f154", - "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "255461e2-aee3-4553-afc8-339248b262d6", + "service": "AVS", "services": [ - "Monitor" + "ExpressRoute", + "AVS", + "AKV" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Include service and resource health events as part of the overall platform monitoring solution. Tracking service and resource health from the platform perspective is an important component of resource management in Azure.", + "severity": "Low", + "subcategory": "Automated Connectivity", + "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "d5f345bf-97ab-41a7-819c-6104baa7d48c", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", + "service": "AVS", "services": [ - "Monitor" + "AVS" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Include alerts and action groups as part of the Azure Service Health platform to ensure that alerts or issues can be actioned", + "severity": "Low", + "subcategory": "Automated Connectivity", + "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "e3ab3693-829e-47e3-8618-3687a0477a20", - "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", + "service": "AVS", "services": [ - "Monitor" + "AVS" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Don't send raw log entries back to on-premises monitoring systems. Instead, adopt a principle that data born in Azure stays in Azure. If on-premises SIEM integration is required, then send critical alerts instead of logs.", + "severity": "Low", + "subcategory": "Automated Connectivity", + "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Monitor", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", + "service": "AVS", "services": [ - "Monitor" + "Subscriptions", + "AVS" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use Azure Monitor Logs for insights and reporting.", - "waf": "Operations" + "subcategory": "Automated Scale", + "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution", + "waf": "Performance" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "619e8a13-f988-4795-85d6-26886d70ba6c", - "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", + "service": "AVS", "services": [ "Storage", - "Monitor" + "AVS", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "When necessary, use shared storage accounts within the landing zone for Azure diagnostic extension log storage.", - "waf": "Operations" + "subcategory": "Automated Scale", + "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action", + "waf": "Performance" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "97be9951-9048-4384-9c98-6cb2913156a1", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", - "service": "Monitor", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", + "service": "AVS", "services": [ - "Monitor" + "AVS" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Use Azure Monitor alerts for the generation of operational alerts.", - "waf": "Operations" + "subcategory": "Automated Scale", + "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)", + "waf": "Performance" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "859c3900-4514-41eb-b010-475d695abd74", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", + "service": "AVS", "services": [ - "Monitor" + "AVS" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Ensure that monitoring requirements have been assessed and that appropriate data collection and alerting configurations are applied", - "waf": "Operations" + "subcategory": "Automated Scale", + "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", + "waf": "Performance" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "Monitor", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", + "service": "AVS", "services": [ - "Monitor" + "AVS" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.", - "waf": "Operations" + "subcategory": "Automated Scale", + "text": "Define and enforce scale in/out maximum limits for your environment in the automations", + "waf": "Performance" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "aa45be6a-8f2d-4896-b0e3-775e6e94e610", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-monitor", + "category": "Platform Automation", + "checklist": "Azure VMware Solution Design Review", + "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", + "service": "AVS", "services": [ - "AzurePolicy", - "Monitor" + "Monitor", + "AVS" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Establish monitoring for platform components of your landing zone, AMBA is a framework solution that is available and provides an easy way to scale alerting by using Azure Policy", - "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/", + "subcategory": "Automated Scale", + "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses", "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "services": [], - "severity": "Medium", - "subcategory": "Data Protection", - "text": "Consider cross-region replication in Azure for BCDR with paired regions", + "category": "Migration", + "checklist": "Azure VMware Solution Design Review", + "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", + "services": [ + "AVS", + "VM" + ], + "severity": "High", + "subcategory": "Architecture", + "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", "waf": "Reliability" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Backup", + "category": "Migration", + "checklist": "Azure VMware Solution Design Review", + "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", "services": [ - "Backup" + "AVS" ], - "severity": "Medium", - "subcategory": "Data Protection", - "text": "When using Azure Backup, consider the different backup types (GRS, ZRS & LRS) as the default setting is GRS", + "severity": "High", + "subcategory": "Architecture", + "text": "When using MON, you cannot enable MON on more than 100 Network extensions", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", "waf": "Reliability" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "VM", + "category": "Migration", + "checklist": "Azure VMware Solution Design Review", + "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", + "service": "AVS", "services": [ - "AzurePolicy", - "VM" + "VPN", + "AVS" ], "severity": "Medium", - "subcategory": "Operational compliance", - "text": "Use Azure policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.", - "waf": "Security" + "subcategory": "Networking", + "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.", + "waf": "Performance" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "description": "Azure Policy's guest configuration features can audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.", - "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "VM", + "category": "Migration", + "checklist": "Azure VMware Solution Design Review", + "guid": "e614658d-d457-4e92-9139-b821102cad6e", + "service": "AVS", "services": [ - "AzurePolicy", - "VM", - "Monitor" + "AVS" ], "severity": "Medium", - "subcategory": "Operational compliance", - "text": "Monitor VM security configuration drift via Azure Policy.", - "waf": "Security" + "subcategory": "Networking", + "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance", + "waf": "Performance" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", + "category": "Migration", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", + "service": "AVS", "services": [ - "ASR", - "VM", - "ACR" + "AVS" ], "severity": "Medium", - "subcategory": "Protect and Recover", - "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.", - "waf": "Operations" + "subcategory": "Process", + "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)", + "waf": "Reliability" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "b2ab13ad-a6e5-45d7-b8a2-adb117d6326a", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", + "category": "Data Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "AVS", "services": [ - "ASR" + "Storage", + "AVS", + "VM" ], "severity": "Medium", - "subcategory": "Protect and Recover", - "text": "Ensure to use and test native PaaS service disaster recovery capabilities.", - "waf": "Operations" + "subcategory": "Architecture", + "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.", + "waf": "Reliability" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "Backup", + "category": "Data Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "AVS", "services": [ - "Backup" + "Storage", + "AVS", + "ExpressRoute" ], "severity": "Medium", - "subcategory": "Protect and Recover", - "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.", - "waf": "Operations" + "subcategory": "Architecture", + "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions", + "waf": "Reliability" }, { - "ammp": true, - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", + "category": "Data Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "AVS", "services": [ - "VM" + "Storage", + "AVS", + "ExpressRoute" ], - "severity": "High", - "subcategory": "Fault Tolerance", - "text": "Leverage Availability Zones for your VMs in regions where they are supported.", + "severity": "Medium", + "subcategory": "Architecture", + "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions", "waf": "Reliability" }, { - "ammp": true, - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", + "category": "Stretched Cluster", + "checklist": "Azure VMware Solution Design Review", + "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "AVS", "services": [ - "VM" + "ASR", + "AVS" ], "severity": "High", - "subcategory": "Fault Tolerance", - "text": "Avoid running a production workload on a single VM.", + "subcategory": "Architecture", + "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor", "waf": "Reliability" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "84101f59-1941-4195-a270-e28034290e3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", + "category": "Stretched Cluster", + "checklist": "Azure VMware Solution Design Review", + "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "AVS", "services": [ - "AppGW", - "LoadBalancer", - "ACR" + "AVS" ], - "severity": "Medium", - "subcategory": "Fault Tolerance", - "text": "Azure Load Balancer and Application Gateway distribute incoming network traffic across multiple resources.", + "severity": "High", + "subcategory": "Architecture", + "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements", "waf": "Reliability" }, { - "ammp": true, - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "WAF", + "category": "Stretched Cluster", + "checklist": "Azure VMware Solution Design Review", + "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "AVS", "services": [ - "FrontDoor", - "AppGW", - "WAF" + "AVS", + "ExpressRoute" ], "severity": "High", - "subcategory": "App delivery", - "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.", - "waf": "Operations" + "subcategory": "Architecture", + "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.", + "waf": "Reliability" }, { - "category": "Management", - "checklist": "Azure Landing Zone Review", - "guid": "7f408960-c626-44cb-a018-347c8d790cdf", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "WAF", + "category": "Stretched Cluster", + "checklist": "Azure VMware Solution Design Review", + "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "AVS", "services": [ - "FrontDoor", - "Sentinel", - "AppGW", - "WAF" + "AVS", + "ExpressRoute" ], - "severity": "Medium", - "subcategory": "App delivery", - "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.", - "waf": "Operations" - }, - { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "b86ad884-08e3-4727-94b8-75ba18f20459", - "link": "https://learn.microsoft.com/security/benchmark/azure/security-control-incident-response", - "services": [], - "severity": "Medium", - "subcategory": "Access control", - "text": "Determine the incident response plan for Azure services before allowing it into production.", - "waf": "Security" - }, - { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "01365d38-e43f-49cc-ad86-8266abca264f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/security-zero-trust", - "services": [], - "severity": "Medium", - "subcategory": "Access control", - "text": "Implement a zero-trust approach for access to the Azure platform, where appropriate.", - "waf": "Security" + "severity": "High", + "subcategory": "Architecture", + "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.", + "waf": "Reliability" }, { - "ammp": true, - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "5017f154-e3ab-4369-9829-e7e316183687", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "Key Vault", + "category": "Stretched Cluster", + "checklist": "Azure VMware Solution Design Review", + "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "AVS", "services": [ - "AKV" + "AVS" ], "severity": "High", - "subcategory": "Encryption and keys", - "text": "Use Azure Key Vault to store your secrets and credentials", - "waf": "Security" + "subcategory": "Architecture", + "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", - "guid": "a0477a20-9945-4bda-9333-4f2491163418", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", - "service": "Key Vault", - "services": [ - "AKV" - ], - "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.", - "waf": "Security" + "category": "BC and DR", + "checklist": "Device Provisioning Service Review", + "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", + "service": "IoT Hub DPS", + "services": [], + "severity": "High", + "subcategory": "High Availability", + "text": "Select the right Logic App hosting plan based on your business & SLO requirements", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "services": [ - "AzurePolicy", - "AKV" - ], - "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", - "waf": "Security" + "category": "BC and DR", + "checklist": "Device Provisioning Service Review", + "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "IoT Hub DPS", + "services": [], + "severity": "High", + "subcategory": "High Availability", + "text": "Protect logic apps from region failures with zone redundancy and availability zones", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "dc055bcf-619e-48a1-9f98-879525d62688", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "services": [ - "Entra", - "AKV", - "RBAC" - ], - "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.", - "waf": "Security" + "category": "BC and DR", + "checklist": "Device Provisioning Service Review", + "guid": "8aed4fbf-0830-4883-899d-222a154af478", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "IoT Hub DPS", + "services": [], + "severity": "High", + "subcategory": "High Availability", + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "category": "BC and DR", + "checklist": "Device Provisioning Service Review", + "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "IoT Hub DPS", "services": [ - "AKV" + "AppSvc" ], - "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.", - "waf": "Security" + "severity": "High", + "subcategory": "High Availability", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "913156a1-2476-4e49-b541-acdce979377b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "services": [ - "AKV" - ], + "category": "Application Deployment", + "checklist": "Device Provisioning Service Review", + "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "IoT Hub DPS", + "services": [], "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Establish an automated process for key and certificate rotation.", - "waf": "Security" + "subcategory": "CI/CD", + "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx", + "service": "CosmosDB", "services": [ - "PrivateLink", - "AKV", - "VNet" + "CosmosDB" ], "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.", - "waf": "Security" + "subcategory": "Best Practices", + "text": "FTA Resiliency Playbook", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", - "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", - "service": "Key Vault", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", + "service": "CosmosDB", "services": [ - "Entra", - "AKV", - "Monitor" + "CosmosDB" ], - "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.", - "waf": "Security" + "severity": "High", + "subcategory": "High Availability", + "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "guid": "0d934a34-8b26-43e7-bd60-513a3649906e", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages", + "service": "CosmosDB", "services": [ - "AzurePolicy", - "AKV" + "CosmosDB" ], "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.", - "waf": "Security" + "subcategory": "High Availability", + "text": "Run multiple replicas of the database (>1 ) in Prod", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "16183687-a047-47a2-8994-5bda43334f24", - "link": "https://learn.microsoft.com/azure/security/fundamentals/encryption-atrest", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe", + "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions", + "service": "CosmosDB", "services": [ - "AKV" + "ACR", + "CosmosDB" ], "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.", - "waf": "Security" + "subcategory": "High Availability", + "text": "Leverage Multi-Region Writes", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "91163418-2ba5-4275-8694-4008be7d7e48", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "description": "Span Cosmos account across two or more regions with multi-region writes", + "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", + "service": "CosmosDB", "services": [ - "AKV" + "ACR", + "CosmosDB" ], "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "Use an Azure Key Vault per application per environment per region.", - "waf": "Security" + "subcategory": "High Availability", + "text": "Distribute your data globally", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "25d62688-6d70-4ba6-a97b-e99519048384", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong", + "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0", + "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels", + "service": "CosmosDB", "services": [ - "ASR", - "AKV", - "ACR" + "CosmosDB" ], - "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.", - "waf": "Security" + "severity": "High", + "subcategory": "High Availability", + "text": "Choose from several well-defined consistency models", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", - "link": "https://learn.microsoft.com/industry/sovereignty/key-management", - "service": "Key Vault", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.", + "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe", + "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover", + "service": "CosmosDB", "services": [ - "AKV" + "CosmosDB" ], "severity": "Medium", - "subcategory": "Encryption and keys", - "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.", - "waf": "Security" + "subcategory": "High Availability", + "text": "Enable Service managed failover", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", - "service": "Entra", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.", + "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90", + "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore", + "service": "CosmosDB", "services": [ - "Entra" + "Storage", + "CosmosDB", + "Backup" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.", - "waf": "Security" + "subcategory": "Backup Strategy", + "text": "Enable Automatic Backups", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "Reliability" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.", + "guid": "a6eb33f6-005c-4d92-9286-7655672d6121", + "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction", + "service": "CosmosDB", "services": [ - "ARS", - "Storage", - "Monitor" + "CosmosDB", + "Backup" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Export Azure activity logs to Azure Monitor Logs for long-term data retention. Export to Azure Storage for long-term storage beyond two years, if necessary.", - "waf": "Security" + "subcategory": "Backup Strategy", + "text": "Perform Periodic Backups", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "Reliability" }, { - "ammp": true, - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "09945bda-4333-44f2-9911-634182ba5275", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", - "service": "Defender", + "category": "Operations Management", + "checklist": "CosmosDB Review Checklist", + "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.", + "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1", + "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction", + "service": "CosmosDB", "services": [ - "Defender", - "Subscriptions" + "CosmosDB", + "Backup" ], - "severity": "High", - "subcategory": "Operations", - "text": "Enable Defender Cloud Security Posture Management for all subscriptions.", - "waf": "Security" + "severity": "Medium", + "subcategory": "Backup Strategy", + "text": "Continous Backup with point-in-time restore in Azure Cosmos DB", + "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", + "waf": "Reliability" }, { - "ammp": true, - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", - "service": "Defender", + "category": "Version Control", + "checklist": "Azure DevOps", + "description": "Implement branching policy in Azure DevOps", + "guid": "eda1dae2-cc85-4c47-a6b7-81cca0e6c465", + "link": "https://learn.microsoft.com/azure/devops/repos/git/branch-policies-overview?view=azure-devops", "services": [ - "Defender", - "Subscriptions" + "AzurePolicy" ], "severity": "High", - "subcategory": "Operations", - "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.", - "waf": "Security" + "subcategory": "Branching Policy", + "text": "Branch Policies", + "waf": "Operations" }, { - "ammp": true, - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", - "service": "Defender", + "category": "Version Control", + "checklist": "Azure DevOps", + "description": "Understand branch strategy such as GitFlow or GitHub Flow", + "guid": "bc288bec-6a16-4ca7-8444-51e1add34529", + "link": "https://learn.microsoft.com/azure/devops/repos/git/git-branching-guidance?view=azure-devops", "services": [ - "Defender", - "Subscriptions" + "AzurePolicy" ], "severity": "High", - "subcategory": "Operations", - "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.", - "waf": "Security" - }, - { - "ammp": true, - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", - "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", - "service": "VM", - "services": [], - "severity": "High", - "subcategory": "Operations", - "text": "Enable Endpoint Protection on IaaS Servers.", - "waf": "Security" + "subcategory": "Branching Policy", + "text": "Branching strategy", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", - "link": "https://learn.microsoft.com/azure/security-center/", - "service": "VM", + "category": "Version Control", + "checklist": "Azure DevOps", + "description": "Understand how teams work with git", + "guid": "ec723823-7a15-41c5-ab4e-401914387e5c", + "link": "https://www.atlassian.com/git/tutorials/comparing-workflows/gitflow-workflow", "services": [ - "Defender", - "Monitor" + "AzurePolicy" ], - "severity": "Medium", - "subcategory": "Operations", - "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.", - "waf": "Security" + "severity": "High", + "subcategory": "Branching Policy", + "text": "Understand GitFlow Branch Strategy", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "category": "Version Control", + "checklist": "Azure DevOps", + "description": "Merge into higher branches after two or more reviewers in a PR", + "guid": "a9c26c9c-32ab-45bd-8c69-98a246e33899", + "link": "https://learn.microsoft.com/azure/devops/repos/git/review-pull-requests?view=azure-devops&tabs=browser", "services": [ - "Entra", - "Monitor" + "AzurePolicy" ], - "severity": "Medium", - "subcategory": "Operations", - "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.", - "waf": "Security" + "severity": "High", + "subcategory": "Branching Policy", + "text": "Pull Request Review", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", - "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", - "service": "Entra", + "category": "Version Control", + "checklist": "Azure DevOps", + "description": "Implement access control to the branches", + "guid": "7e41c77d-68cb-46a2-8ac1-9f916d697d8e", + "link": "https://learn.microsoft.com/azure/devops/repos/git/branch-permissions?view=azure-devops", "services": [ - "Entra" + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Operations", - "text": "For Sovereign Landing Zone, transparancy logs is enabled on the Entra ID tenant.", - "waf": "Security" + "subcategory": "Branching Policy", + "text": "Access Control to the Branch", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", - "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", - "service": "Entra", - "services": [ - "Entra" - ], - "severity": "Medium", - "subcategory": "Operations", - "text": "For Sovereign Landing Zone, customer Lockbox is enabled on the Entra ID tenant.", + "category": "Version Control", + "checklist": "Azure DevOps", + "description": "Perform SAST code scan", + "guid": "adfd27bd-e187-401a-a252-baa9b68a088c", + "link": "https://devblogs.microsoft.com/devops/integrate-security-into-your-developer-workflow-with-github-advanced-security-for-azure-devops/", + "services": [], + "severity": "High", + "subcategory": "Security", + "text": "Code Scan", "waf": "Security" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "874a748b-662d-46d1-9051-2a66498f6dfe", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/security", - "services": [ - "Monitor" - ], + "category": "Version Control", + "checklist": "Azure DevOps", + "description": "Understand TFVC as Code Repo", + "guid": "9a8f822b-8eb9-4d1b-a77f-26e5e6beba8e", + "link": "https://learn.microsoft.com/azure/devops/repos/tfvc/what-is-tfvc?view=azure-devops", + "services": [], "severity": "Low", - "subcategory": "Operations", - "text": "Use an Azure Event Grid-based solution for log-oriented, real-time alerts", - "waf": "Security" - }, - { - "ammp": true, - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Storage", - "services": [ - "Storage" - ], - "severity": "High", - "subcategory": "Overview", - "text": "Secure transfer to storage accounts should be enabled", - "waf": "Security" + "subcategory": "Practice", + "text": "TFVC as Code Repository", + "waf": "Operations" }, { - "ammp": true, - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", - "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", - "service": "Storage", - "services": [ - "Storage" - ], - "severity": "High", - "subcategory": "Overview", - "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.", - "waf": "Security" + "category": "Version Control", + "checklist": "Azure DevOps", + "description": "Compare Git vs TFVC for your project", + "guid": "d4f3437b-c336-4d71-9f27-a71eee0b9b5d", + "link": "https://learn.microsoft.com/azure/devops/repos/tfvc/comparison-git-tfvc?view=azure-devops", + "services": [], + "severity": "Low", + "subcategory": "Practice", + "text": "Choose Right version control", + "waf": "Operations" }, { - "ammp": true, - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "6f704104-85c1-441f-96d3-c9819911645e", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning", - "services": [ - "Entra" - ], + "category": "Azure Boards", + "checklist": "Azure DevOps", + "description": "Set up your team management", + "guid": "8defd5d7-21d4-41d2-900c-807bf9eab40f", + "link": "https://learn.microsoft.com/azure/devops/organizations/settings/manage-teams?view=azure-devops", + "services": [], "severity": "High", - "subcategory": "Secure privileged access", - "text": "Separate privileged admin accounts for Azure administrative tasks.", - "waf": "Security" + "subcategory": "Team Planning", + "text": "Configure your teams", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "9a19bf39-c95d-444c-9c89-19ca1f6d5215", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework", + "category": "Azure Boards", + "checklist": "Azure DevOps", + "description": "Start scheduling sprints", + "guid": "9ed5b354-78d4-447a-a26c-2863c00f1cac", + "link": "https://learn.microsoft.com/azure/devops/boards/sprints/define-sprints?view=azure-devops", "services": [], "severity": "Medium", - "subcategory": "Service enablement framework", - "text": "Plan how new azure services will be implemented", - "waf": "Security" + "subcategory": "Team Planning", + "text": "Configure your sprints", + "waf": "Operations" }, { - "category": "Security", - "checklist": "Azure Landing Zone Review", - "guid": "ae514b93-3d45-485e-8112-9bd7ba012f7b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/service-enablement-framework", + "category": "Azure Boards", + "checklist": "Azure DevOps", + "description": "Set up your work item heirarchy", + "guid": "699ef1d5-a83d-4e5d-b36c-1c81870a0bc5", + "link": "https://learn.microsoft.com/azure/devops/organizations/settings/work/customize-process-work-item-type?view=azure-devops", "services": [], - "severity": "Medium", - "subcategory": "Service enablement framework", - "text": "Plan how service request will be fulfilled for Azure services", - "waf": "Security" + "severity": "Low", + "subcategory": "Team Planning", + "text": "Choose Work Item types", + "waf": "Operations" }, { - "ammp": true, - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "e85f4226-bf06-4e35-8a8b-7aee4d2d633a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/platform-automation-devops", + "category": "Azure Boards", + "checklist": "Azure DevOps", + "description": "WIT Processes available in Azure DevOps", + "guid": "c1e43a18-658d-4285-aed6-7179b825546d", + "link": "https://learn.microsoft.com/azure/devops/boards/work-items/guidance/choose-process?view=azure-devops&tabs=agile-process", "services": [], "severity": "High", - "subcategory": "DevOps Team Topologies", - "text": "Ensure you have a cross functional DevOps Platform Team to build, manage and maintain your Azure Landing Zone architecture.", + "subcategory": "Team Planning", + "text": "Select a WIT Process", "waf": "Operations" }, { - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "634146bf-7085-4419-a7b5-f96d2726f6da", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations", + "category": "Azure Boards", + "checklist": "Azure DevOps", + "description": "Use Azure Boards with GitHub", + "guid": "f2aee455-3afc-4833-a248-726dd68c5b5c", + "link": "https://learn.microsoft.com/azure/devops/cross-service/github-integration?view=azure-devops", "services": [], "severity": "Low", - "subcategory": "DevOps Team Topologies", - "text": "Aim to define functions for Azure Landing Zone Platform team.", + "subcategory": "Tool Integration", + "text": "GitHub Integration", "waf": "Operations" }, { - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "a9e65070-c59e-4112-8bf6-c11364d4a2a5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/devops-teams-topologies#design-recommendations", - "services": [ - "RBAC" - ], - "severity": "Low", - "subcategory": "DevOps Team Topologies", - "text": "Aim to define functions for application workload teams to be self-sufficient and not require DevOps Platform Team support. Achieve this through the use of custom RBAC role.", + "category": "Azure Boards", + "checklist": "Azure DevOps", + "description": "Understand the methologies", + "guid": "2925394b-69b9-4d37-aac4-3bc68d1d7665", + "link": "https://www.atlassian.com/agile/scrum/agile-vs-scrum", + "services": [], + "severity": "Medium", + "subcategory": "Process Planning", + "text": "Understand Agile Vs Scrum", "waf": "Operations" }, { - "ammp": true, - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "165eb5e9-b434-448a-9e24-178632186212", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code", + "category": "Azure Boards", + "checklist": "Azure DevOps", + "description": "Create Dashboard and PowerBI reports", + "guid": "7246b448-564b-44dd-94a7-59c7633bd2a1", + "link": "https://learn.microsoft.com/azure/devops/report/dashboards/overview?view=azure-devops", "services": [], - "severity": "High", - "subcategory": "DevOps Team Topologies", - "text": "Use a CI/CD pipeline to deploy IaC artifacts and ensure the quality of your deployment and Azure environments.", + "severity": "Medium", + "subcategory": "Reporting", + "text": "Dashboard", "waf": "Operations" }, { - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "0cadb8c7-8fa5-4fbf-8f39-d1fadb3b0460", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", + "category": "Azure Boards", + "checklist": "Azure DevOps", + "description": "Set up backlog", + "guid": "a27a764a-90be-40e3-98ee-293c1bd363ca", + "link": "https://learn.microsoft.com/azure/devops/boards/backlogs/set-up-your-backlog?view=azure-devops", "services": [], "severity": "Medium", - "subcategory": "DevOps Team Topologies", - "text": "Include unit tests for IaC and application code as part of your build process.", + "subcategory": "Reporting", + "text": "Refine your backlog", "waf": "Operations" }, { - "ammp": true, - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", - "service": "Key Vault", - "services": [ - "VM", - "AKV" - ], - "severity": "High", - "subcategory": "DevOps Team Topologies", - "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.", + "category": "Azure Boards", + "checklist": "Azure DevOps", + "description": "Link your work items", + "guid": "aab75719-49ab-4919-9dc9-fc9d1bb84b37", + "link": "https://learn.microsoft.com/azure/devops/boards/queries/link-work-items-support-traceability?view=azure-devops&tabs=browser", + "services": [], + "severity": "Medium", + "subcategory": "Reporting", + "text": "Visualize Relationships", "waf": "Operations" }, { - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "a52e0c98-76b9-4a09-a1c9-6b2babf22ac4", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/subscription-vending", - "services": [ - "Subscriptions" - ], + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "View the velocity report", + "guid": "b5a67fcb-9ed5-4b35-978d-447a826c2863", + "link": "https://learn.microsoft.com/azure/devops/report/dashboards/team-velocity?view=azure-devops&tabs=in-context", + "services": [], "severity": "Low", - "subcategory": "DevOps Team Topologies", - "text": "Implement automation for new landing zone for applications and workloads through subscription vending", + "subcategory": "Reporting", + "text": "Review Team Velocity", "waf": "Operations" }, { - "ammp": true, - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "cfe363b5-f579-4284-bc56-a42153e4c10b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Create your first pipeline", + "guid": "c00f1cac-699e-4f1d-9a83-de5de36c1c81", + "link": "https://learn.microsoft.com/azure/devops/pipelines/create-first-pipeline?view=azure-devops&tabs=java%2Ctfs-2018-2%2Cbrowser", "services": [], "severity": "High", - "subcategory": "Development Lifecycle", - "text": "Ensure a version control system is used for source code of applications and IaC developed. Microsoft recommends Git.", + "subcategory": "Continuous Integration", + "text": "Set up pipeline", "waf": "Operations" }, { - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "c7245dd4-af8a-403a-8bb7-890c1a7cfa9d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Specify events that trigger pipelines", + "guid": "870a0bc5-c1e4-43a1-a658-d2858ed67179", + "link": "https://learn.microsoft.com/azure/devops/pipelines/build/triggers?view=azure-devops", + "services": [], + "severity": "High", + "subcategory": "Continuous Integration", + "text": "Set Build triggers", + "waf": "Operations" + }, + { + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Use YAML to create build pipeline", + "guid": "b825546d-f2ae-4e45-93af-c8339248726d", + "link": "https://learn.microsoft.com/azure/devops/pipelines/customize-pipeline?view=azure-devops", "services": [], "severity": "Low", - "subcategory": "Development Lifecycle", - "text": "Follow a branching strategy to allow teams to collaborate better and efficiently manage version control of IaC and application Code. Review options such as Github Flow.", + "subcategory": "Continuous Integration", + "text": "Customize YAML Pipeline", "waf": "Operations" }, { - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "12aeea20-9165-4b3e-bdf2-6795fcd3cdbe", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Use classic GUI editor to set up pipeline", + "guid": "d68c5b5c-2925-4394-a69b-9d379ac43bc6", + "link": "https://learn.microsoft.com/azure/devops/pipelines/get-started/pipelines-get-started?view=azure-devops&source=recommendations#define-pipelines-using-the-classic-interface", "services": [], "severity": "Medium", - "subcategory": "Development Lifecycle", - "text": "Adopt a pull request strategy to help keep control of code changes merged into branches.", + "subcategory": "Continuous Integration", + "text": "Use GUI for pipeline", "waf": "Operations" }, { - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "2676ae46-65ca-444e-8695-fdddeace4cb1", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-platform", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Set up templates, parameters and expressions", + "guid": "8d1d7665-7246-4b44-a564-b4dd74a759c7", + "link": "https://learn.microsoft.com/azure/devops/pipelines/process/templates?view=azure-devops&pivots=templates-includes", "services": [], "severity": "Medium", - "subcategory": "Development Lifecycle", - "text": "Establish a process for using code to implement quick fixes. Always register quick fixes in your team's backlog so each fix can be reworked at a later point, and you can limit technical debt.", + "subcategory": "Continuous Integration", + "text": "Configure Templates", "waf": "Operations" }, { - "ammp": true, - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "2cdc9d99-dbcc-4ad4-97f5-e7d358bdfa73", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/infrastructure-as-code", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Set up jobs, stages and dependencies", + "guid": "633bd2a1-a27a-4764-a90b-e0e378ee293c", + "link": "https://learn.microsoft.com/azure/devops/pipelines/process/stages?view=azure-devops&tabs=yaml", "services": [], "severity": "High", - "subcategory": "Development Strategy", - "text": "Leverage Declarative Infrastructure as Code Tools such as Azure Bicep, ARM Templates or Terraform to build and maintain your Azure Landing Zone architecture. Both from a Platform and Application workload perspective.", + "subcategory": "Continuous Integration", + "text": "Jobs", "waf": "Operations" }, { - "ammp": true, - "category": "Platform Automation and DevOps", - "checklist": "Azure Landing Zone Review", - "guid": "cc87a3bc-c572-4ad2-92ed-8cabab66160f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/landing-zone-security#secure", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Set up conditions and Demands", + "guid": "1bd363ca-aab7-4571-a49a-b9193dc9fc9d", + "link": "https://learn.microsoft.com/azure/devops/pipelines/process/conditions?view=azure-devops&tabs=yaml%2Cstages", "services": [], - "severity": "High", - "subcategory": "Security", - "text": "Integrate security into the already combined process of development and operations in DevOps to mitigate risks in the innovation process.", + "severity": "Medium", + "subcategory": "Continuous Integration", + "text": "Conditions and Demands", "waf": "Operations" }, { - "category": "Application Deployment", - "checklist": "Azure Spring Apps Review", - "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", - "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", - "service": "Spring Apps", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Define Variables", + "guid": "1bb84b37-b5a6-47fc-a9ed-5b35478d447a", + "link": "https://learn.microsoft.com/azure/devops/pipelines/process/variables?view=azure-devops&tabs=yaml%2Cbatch", "services": [], - "severity": "Medium", - "subcategory": "DevOps", - "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions", - "waf": "Reliability" + "severity": "High", + "subcategory": "Continuous Integration", + "text": "Variables", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Spring Apps Review", - "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", - "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", - "service": "Spring Apps", - "services": [ - "FrontDoor", - "TrafficManager", - "ASR" - ], - "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", - "waf": "Reliability" + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Set up your deployment pipeline", + "guid": "826c2863-c00f-41ca-a699-ef1d5a83de5d", + "link": "https://learn.microsoft.com/azure/devops/pipelines/process/create-multistage-pipeline?view=azure-devops", + "services": [], + "severity": "High", + "subcategory": "Continuous Deployment", + "text": "Deployment Pipeline", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Spring Apps Review", - "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", - "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", - "service": "Spring Apps", - "services": [ - "ACR" - ], + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Select correct branches to deploy from", + "guid": "e36c1c81-870a-40bc-9c1e-43a18658d285", + "link": "https://learn.microsoft.com/azure/devops/pipelines/release/deploy-multiple-branches?view=azure-devops", + "services": [], "severity": "Medium", - "subcategory": "High Availability", - "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", - "waf": "Reliability" + "subcategory": "Continuous Deployment", + "text": "Release branch", + "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Spring Apps Review", - "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", - "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", - "service": "Spring Apps", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "use relevant template to deploy to azure", + "guid": "8ed67179-b825-4546-bf2a-ee4553afc833", + "link": "https://learn.microsoft.com/azure/devops/pipelines/overview-azure?view=azure-devops", "services": [], "severity": "Medium", - "subcategory": "High Availability", - "text": "Use more than 1 app instance for your apps", - "waf": "Reliability" + "subcategory": "Continuous Deployment", + "text": "Deploy to Azure", + "waf": "Operations" }, { - "category": "Operations", - "checklist": "Azure Spring Apps Review", - "guid": "7504c230-6035-4183-95a5-85762acc6075", - "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", - "service": "Spring Apps", - "services": [ - "Monitor" - ], + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Define Release Approvals and pre deployment checks", + "guid": "9248726d-d68c-45b5-a292-5394b69b9d37", + "link": "https://learn.microsoft.com/azure/devops/pipelines/process/approvals?view=azure-devops&tabs=check-pass", + "services": [], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", - "waf": "Reliability" + "subcategory": "Continuous Deployment", + "text": "Approvals and Checks", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Operations" }, { - "category": "Operations", - "checklist": "Azure Spring Apps Review", - "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", - "service": "Spring Apps", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Define Gates and post deployment checks", + "guid": "9ac43bc6-8d1d-4766-9724-6b448564b4dd", + "link": "https://learn.microsoft.com/azure/devops/pipelines/release/approvals/?view=azure-devops&tabs=yaml", "services": [], "severity": "Medium", - "subcategory": "Scalability", - "text": "Set up autoscaling in Spring Cloud Gateway", - "waf": "Reliability" + "subcategory": "Continuous Deployment", + "text": "Gates", + "waf": "Operations" }, { - "category": "Operations", - "checklist": "Azure Spring Apps Review", - "guid": "97411607-b6fd-4335-99d1-9885faf4e392", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", - "service": "Spring Apps", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Define Azure Function and REST API Checks", + "guid": "74a759c7-633b-4d2a-8a27-a764a90be0e3", + "link": "https://learn.microsoft.com/azure/devops/pipelines/process/invoke-checks?view=azure-devops", "services": [], "severity": "Low", - "subcategory": "Scalability", - "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.", - "waf": "Reliability" + "subcategory": "Continuous Deployment", + "text": "Azure Function Checks", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Operations" }, { - "category": "Operations", - "checklist": "Azure Spring Apps Review", - "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", - "link": "https://learn.microsoft.com/azure/spring-apps/overview", - "service": "Spring Apps", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Review pipeline reports", + "guid": "78ee293c-1bd3-463c-aaab-7571949ab919", + "link": "https://learn.microsoft.com/azure/devops/pipelines/reports/pipelinereport?view=azure-devops", "services": [], - "severity": "Medium", - "subcategory": "Support", - "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.", - "waf": "Reliability" - }, - { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", - "service": "AVS", - "services": [ - "Entra", - "Subscriptions", - "AVS" - ], "severity": "High", - "subcategory": "Identity", - "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure", - "waf": "Security" + "subcategory": "Continuous Deployment", + "text": "Pipline Reports", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "75089c20-990d-4927-b105-885576f76fc2", - "service": "AVS", - "services": [ - "Entra", - "AVS" - ], + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "configure Trend Result widget", + "guid": "3dc9fc9d-1bb8-44b3-9b5a-67fcb9ed5b35", + "link": "https://learn.microsoft.com/azure/devops/report/dashboards/analytics-widgets?toc=%2Fazure%2Fdevops%2Fpipelines%2Ftoc.json&view=azure-devops#test-results-trend-advanced", + "services": [], "severity": "Medium", - "subcategory": "Identity", - "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure", - "waf": "Security" - }, - { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", - "service": "AVS", - "services": [ - "Entra", - "AVS" - ], - "severity": "High", - "subcategory": "Identity", - "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'", - "waf": "Security" + "subcategory": "Analytics", + "text": "Pipeline Result Trend", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", - "service": "AVS", - "services": [ - "Entra", - "AVS" - ], + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Connect with WIT to visualize work", + "guid": "478d447a-826c-4286-9c00-f1cac699ef1d", + "link": "https://learn.microsoft.com/azure/devops/pipelines/integrations/configure-pipelines-work-tracking?view=azure-devops&tabs=yaml", + "services": [], "severity": "Medium", - "subcategory": "Identity", - "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)", - "waf": "Security" + "subcategory": "Analytics", + "text": "Work Tracking with Pipeline", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", + "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", - "service": "AVS", - "services": [ - "Entra", - "AVS" - ], + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Understand agent pools", + "guid": "5a83de5d-e36c-41c8-8870-a0bc5c1e43a1", + "link": "https://learn.microsoft.com/azure/devops/pipelines/agents/agents?view=azure-devops&tabs=yaml%2Cbrowser", + "services": [], "severity": "Medium", - "subcategory": "Identity", - "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)", - "waf": "Security" + "subcategory": "Continuous Deployment", + "text": " Agents and agent pools", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", - "service": "AVS", - "services": [ - "Entra", - "AVS" - ], - "severity": "High", - "subcategory": "Identity", - "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)", - "waf": "Security" + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Understand and provision Deployment Groups when required", + "guid": "8658d285-8ed6-4717-ab82-5546df2aee45", + "link": "https://learn.microsoft.com/azure/devops/pipelines/release/deployment-groups/?view=azure-devops", + "services": [], + "severity": "Low", + "subcategory": "Continuous Deployment", + "text": "Deployment Groups", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "Operations" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", - "service": "AVS", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Understand Kubernetes Deployment", + "guid": "53afc833-9248-4726-bd68-c5b5c2925394", + "link": "https://learn.microsoft.com/azure/devops/pipelines/ecosystems/kubernetes/deploy?view=azure-devops", "services": [ - "RBAC", - "Entra", - "AVS" + "AKS" ], + "severity": "Low", + "subcategory": "Continuous Deployment", + "text": "Deploy to Kubernetes", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "Operations" + }, + { + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Perform Dynamic Security Testing", + "guid": "b69b9d37-9ac4-43bc-98d1-d76657246b44", + "link": "https://devblogs.microsoft.com/premier-developer/azure-devops-pipelines-leveraging-owasp-zap-in-the-release-pipeline/", + "services": [], "severity": "Medium", - "subcategory": "Identity", - "text": "Has an RBAC model been created for use within VMware vSphere", + "subcategory": "Security", + "text": "DAST Scan", + "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", - "service": "AVS", - "services": [ - "RBAC", - "Entra", - "AVS" - ], + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Manage Service Connections", + "guid": "8564b4dd-74a7-459c-9633-bd2a1a27a764", + "link": "https://learn.microsoft.com/azure/devops/pipelines/library/service-endpoints?view=azure-devops&tabs=yaml", + "services": [], "severity": "Medium", - "subcategory": "Identity", - "text": "RBAC permissions should be granted on ADDS groups and not on specific users", + "subcategory": "Security", + "text": "Service Connections", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", - "service": "AVS", + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Set data retention policies for CI and CD", + "guid": "a90be0e3-78ee-4293-a1bd-363caaab7571", + "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/retention?view=azure-devops&tabs=yaml", "services": [ - "RBAC", - "Entra", - "AVS" + "AzurePolicy" ], - "severity": "High", - "subcategory": "Identity", - "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only", + "severity": "Medium", + "subcategory": "Security", + "text": "Retention Policies", + "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", "waf": "Security" }, { - "category": "Identity", - "checklist": "Azure VMware Solution Design Review", - "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", - "service": "AVS", - "services": [ - "RBAC", - "Entra", - "AVS" - ], - "severity": "High", - "subcategory": "Identity", - "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations", - "waf": "Security" + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Set up and pay for concurrent pipelines", + "guid": "949ab919-3dc9-4fc9-b1bb-84b37b5a67fc", + "link": "https://learn.microsoft.com/azure/devops/pipelines/licensing/concurrent-jobs?view=azure-devops&tabs=ms-hosted", + "services": [], + "severity": "Low", + "subcategory": "Administration", + "text": "Parallel Pipelines", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Design Review", - "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", - "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", - "service": "AVS", - "services": [ - "AVS" - ], - "severity": "High", - "subcategory": "Architecture", - "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand", - "waf": "Performance" + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Set pipeline permissions", + "guid": "b9ed5b35-478d-4447-a826-c2863c00f1ca", + "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/permissions?view=azure-devops", + "services": [], + "severity": "Medium", + "subcategory": "Security", + "text": "Pipeline Permissions", + "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Design Review", - "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", - "service": "AVS", - "services": [ - "Monitor", - "ExpressRoute", - "NetworkWatcher", - "VPN", - "AVS" - ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'", - "waf": "Operations" + "category": "Azure Pipelines", + "checklist": "Azure DevOps", + "description": "Add users to pipeline", + "guid": "c699ef1d-5a83-4de5-be36-c1c81870a0bc", + "link": "https://learn.microsoft.com/azure/devops/pipelines/policies/set-permissions?view=azure-devops", + "services": [], + "severity": "Low", + "subcategory": "Security", + "text": "Pipeline Users", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Design Review", - "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", - "service": "AVS", - "services": [ - "Monitor", - "ExpressRoute", - "NetworkWatcher", - "AVS", - "VM" - ], + "category": "Azure Artifact", + "checklist": "Azure DevOps", + "description": "Configure Artifacts", + "guid": "5c1e43a1-8658-4d28-98ed-67179b825546", + "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/artifacts-overview?view=azure-devops&tabs=nuget", + "services": [], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection", + "subcategory": "Configuration", + "text": "Artifact In Pipeline", + "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Design Review", - "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", - "service": "AVS", - "services": [ - "VM", - "Monitor", - "NetworkWatcher", - "AVS" - ], + "category": "Azure Artifact", + "checklist": "Azure DevOps", + "description": "Publish and consume artifact in pipeline", + "guid": "df2aee45-53af-4c83-9924-8726dd68c5b5", + "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/pipeline-artifacts?view=azure-devops&tabs=yaml", + "services": [], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity", + "subcategory": "Configuration", + "text": "Publish and download Artifact", + "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain", "waf": "Operations" }, { - "category": "Networking", - "checklist": "Azure VMware Solution Design Review", - "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", - "service": "AVS", - "services": [ - "ARS", - "AVS" - ], - "severity": "High", - "subcategory": "Routing", - "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).", + "category": "Azure Artifact", + "checklist": "Azure DevOps", + "description": "Publish NuGet packages with artifacts", + "guid": "c2925394-b69b-49d3-99ac-43bc68d1d766", + "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/nuget?view=azure-devops&tabs=yaml", + "services": [], + "severity": "Low", + "subcategory": "Configuration", + "text": "NuGet", + "training": "https://learn.microsoft.com/azure/role-based-access-control/overview", "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", - "service": "AVS", - "services": [ - "Entra", - "RBAC", - "AVS" - ], - "severity": "High", - "subcategory": "Security (identity)", - "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)", - "waf": "Security" + "category": "Azure Artifact", + "checklist": "Azure DevOps", + "description": "Publish Maven packages with artifacts", + "guid": "57246b44-8564-4b4d-b74a-759c7633bd2a", + "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/publish-maven-artifacts?view=azure-devops", + "services": [], + "severity": "Low", + "subcategory": "Configuration", + "text": "Maven", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", - "service": "AVS", - "services": [ - "Entra", - "RBAC", - "AVS" - ], - "severity": "High", - "subcategory": "Security (identity)", - "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles", - "waf": "Security" + "category": "Azure Artifact", + "checklist": "Azure DevOps", + "description": "Publish NPM packages with artifacts", + "guid": "1a27a764-a90b-4e0e-978e-e293c1bd363c", + "link": "https://learn.microsoft.com/azure/devops/pipelines/artifacts/npm?view=azure-devops&tabs=yaml", + "services": [], + "severity": "Low", + "subcategory": "Configuration", + "text": "NPM", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", - "service": "AVS", - "services": [ - "Entra", - "AVS" - ], + "category": "Azure Artifact", + "checklist": "Azure DevOps", + "description": "Best Practices to work with Azure Artifact", + "guid": "aaab7571-949a-4b91-a3dc-9fc9d1bb84b3", + "link": "https://learn.microsoft.com/azure/devops/artifacts/concepts/best-practices?view=azure-devops", + "services": [], "severity": "Medium", - "subcategory": "Security (identity)", - "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)", - "waf": "Security" + "subcategory": "Configuration", + "text": "Best Practices", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", - "service": "AVS", + "category": "DevOps Practice", + "checklist": "Azure DevOps", + "description": "What is monitoring?", + "guid": "7b5a67fc-b9ed-45b3-9478-d447a826c286", + "link": "https://learn.microsoft.com/devops/operate/what-is-monitoring", "services": [ - "Entra", - "AVS" + "Monitor" ], "severity": "High", - "subcategory": "Security (identity)", - "text": "Limit use of CloudAdmin account to emergency access only", - "waf": "Security" + "subcategory": "Practice", + "text": "What to monitor?", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", - "service": "AVS", - "services": [ - "RBAC", - "Entra", - "AVS" - ], + "category": "DevOps Practice", + "checklist": "Azure DevOps", + "description": "Progressive Exposure Strategy", + "guid": "3c00f1ca-c699-4ef1-b5a8-3de5de36c1c8", + "link": "https://learn.microsoft.com/devops/operate/safe-deployment-practices", + "services": [], "severity": "Medium", - "subcategory": "Security (identity)", - "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter", - "waf": "Security" + "subcategory": "Practice", + "text": "Safe Deployment Practices", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", - "service": "AVS", - "services": [ - "Entra", - "AVS" - ], - "severity": "Medium", - "subcategory": "Security (identity)", - "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials", - "waf": "Security" + "category": "DevOps Practice", + "checklist": "Azure DevOps", + "description": "Microsoft runs reliable systems with DevOps", + "guid": "1870a0bc-5c1e-443a-8865-8d2858ed6717", + "link": "https://learn.microsoft.com/devops/operate/how-microsoft-operates-devops", + "services": [], + "severity": "Low", + "subcategory": "Practice", + "text": "Case Study", + "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", - "service": "AVS", - "services": [ - "Entra", - "VM", - "AVS" - ], - "severity": "High", - "subcategory": "Security (identity)", - "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution", + "category": "DevOps Practice", + "checklist": "Azure DevOps", + "description": "Security in DevOps", + "guid": "9b825546-df2a-4ee4-953a-fc8339248726", + "link": "https://learn.microsoft.com/devops/operate/security-in-devops", + "services": [], + "severity": "Medium", + "subcategory": "Practice", + "text": "DevSecOps", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", - "service": "AVS", - "services": [ - "AVS" - ], - "severity": "Medium", - "subcategory": "Security (network)", - "text": "Is East-West traffic filtering implemented within NSX-T", + "category": "DevOps Practice", + "checklist": "Azure DevOps", + "description": "Enable DevSecops with Azure And GitHub", + "guid": "dd68c5b5-c292-4539-9b69-b9d379ac43bc", + "link": "https://learn.microsoft.com/devops/devsecops/enable-devsecops-azure-github", + "services": [], + "severity": "Low", + "subcategory": "Practice", + "text": "DevSecops", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", - "service": "AVS", + "category": "DevOps Practice", + "checklist": "Azure DevOps", + "description": "Mirror RBAC in DevOps", + "guid": "68d1d766-5724-46b4-9856-4b4dd74a759c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/secure/best-practices/end-to-end-governance", "services": [ - "Firewall", - "AppGW", - "AVS" + "RBAC" ], - "severity": "High", - "subcategory": "Security (network)", - "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions", + "severity": "Low", + "subcategory": "Practice", + "text": "Secure DevOps Govenance", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", - "service": "AVS", - "services": [ - "AVS" - ], - "severity": "High", - "subcategory": "Security (network)", - "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads", + "category": "DevOps Practice", + "checklist": "Azure DevOps", + "description": "Governance when using CI/CD", + "guid": "7633bd2a-1a27-4a76-9a90-be0e378ee293", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/governance/end-to-end-governance-in-azure", + "services": [], + "severity": "Medium", + "subcategory": "Practice", + "text": "Azure DevOps Governance", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", - "service": "AVS", + "category": "Application Deployment", + "checklist": "The AKS Checklist", + "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks", "services": [ - "Monitor", - "AVS" + "AKS" ], "severity": "Medium", - "subcategory": "Security (network)", - "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity", - "waf": "Security" + "subcategory": "Development", + "text": "Use canary or blue/green deployments", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "334fdf91-c234-4182-a652-75269440b4be", - "service": "AVS", + "category": "Application Deployment", + "checklist": "The AKS Checklist", + "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", + "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", + "service": "AKS", "services": [ - "VNet", - "ExpressRoute", - "VPN", - "DDoS", - "AVS" + "AKS" ], - "severity": "Medium", - "subcategory": "Security (network)", - "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure", - "waf": "Security" + "severity": "Low", + "subcategory": "Development", + "text": "If required for AKS Windows workloads HostProcess containers can be used", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", - "service": "AVS", + "category": "Application Deployment", + "checklist": "The AKS Checklist", + "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", + "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", + "service": "AKS", "services": [ - "AVS" + "AKS" ], - "severity": "Medium", - "subcategory": "Security (network)", - "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager", - "waf": "Security" + "severity": "Low", + "subcategory": "Development", + "text": "Use KEDA if running event-driven workloads", + "waf": "Performance" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", - "service": "AVS", + "category": "Application Deployment", + "checklist": "The AKS Checklist", + "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", + "link": "https://dapr.io/", + "service": "AKS", "services": [ - "Defender", - "AVS" + "AKS" ], - "severity": "Medium", - "subcategory": "Security (guest/VM)", - "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution", - "waf": "Security" + "severity": "Low", + "subcategory": "Development", + "text": "Use Dapr to ease microservice development", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", - "service": "AVS", + "category": "Application Deployment", + "checklist": "The AKS Checklist", + "guid": "3acbe04b-be20-49d3-afda-47778424d116", + "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks", "services": [ - "Arc", - "AVS" + "AKS" ], "severity": "Medium", - "subcategory": "Security (guest/VM)", - "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)", - "waf": "Security" - }, - { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", - "service": "AVS", + "subcategory": "Infrastructure as Code", + "text": "Use automation through ARM/TF to create your Azure resources", + "waf": "Operations" + }, + { + "category": "BC and DR", + "checklist": "The AKS Checklist", + "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery", "services": [ - "SQL", - "AVS" + "ASR", + "AKS" ], - "severity": "Low", - "subcategory": "Security (guest/VM)", - "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)", - "waf": "Security" + "severity": "High", + "subcategory": "Disaster Recovery", + "text": "Schedule and perform DR tests regularly", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "a3592718-e6e2-4051-9267-6ae46691e883", - "service": "AVS", + "category": "BC and DR", + "checklist": "The AKS Checklist", + "guid": "170265f4-bb46-4a39-9af7-f317284797b1", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", "services": [ - "AKV", - "AVS" + "TrafficManager", + "AKS", + "FrontDoor", + "LoadBalancer" ], - "severity": "Low", - "subcategory": "Security (guest/VM)", - "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible", - "waf": "Security" + "severity": "Medium", + "subcategory": "High Availability", + "text": "Use Azure Traffic Manager or Azure Front Door as a global load balancer for region failover", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "5ac94222-3e13-4810-9230-81a941741583", - "service": "AVS", + "category": "BC and DR", + "checklist": "The AKS Checklist", + "graph": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant", + "guid": "578a219a-46be-4b54-9350-24922634292b", + "link": "https://learn.microsoft.com/azure/aks/availability-zones", "services": [ - "AVS" + "AKS" ], "severity": "Medium", - "subcategory": "Security (guest/VM)", - "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)", - "waf": "Security" + "subcategory": "High Availability", + "text": "Use Availability Zones if they are supported in your Azure region", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", - "service": "AVS", + "category": "BC and DR", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", + "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", + "link": "https://learn.microsoft.com/azure/aks/uptime-sla", + "service": "AKS", "services": [ - "AVS" + "AKS" ], "severity": "High", - "subcategory": "Governance (platform)", - "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)", + "subcategory": "High Availability", + "text": "Use the SLA-backed AKS offering", "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "d88408f3-7273-44c8-96ba-280214590146", - "service": "AVS", + "category": "BC and DR", + "checklist": "The AKS Checklist", + "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "services": [ - "AzurePolicy", - "Storage", - "AVS" + "AKS", + "Cost" ], - "severity": "High", - "subcategory": "Governance (platform)", - "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs", + "severity": "Low", + "subcategory": "High Availability", + "text": "Use Disruption Budgets in your pod and deployment definitions", "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", - "service": "AVS", + "category": "BC and DR", + "checklist": "The AKS Checklist", + "guid": "3c763963-7a55-42d5-a15e-401955387e5c", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", + "service": "ACR", "services": [ - "ASR", - "AVS" + "ACR", + "AKS" ], "severity": "High", - "subcategory": "Governance (platform)", - "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement", + "subcategory": "High Availability", + "text": "If using a private registry, configure region replication to store images in multiple regions", "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", - "service": "AVS", + "category": "BC and DR", + "checklist": "The AKS Checklist", + "guid": "daa9a260-c3ea-4490-b077-5fc1f2a80cb0", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", "services": [ - "AVS" + "Storage", + "AKS", + "ASR" ], - "severity": "Medium", - "subcategory": "Governance (platform)", - "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.", - "waf": "Operations" + "severity": "High", + "subcategory": "Disaster Recovery", + "text": "Use Zone-Redundant Storage (ZRS) with stateful workloads", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", - "service": "AVS", + "category": "BC and DR", + "checklist": "The AKS Checklist", + "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery", "services": [ - "AzurePolicy", - "AVS" + "AKS" ], - "severity": "Medium", - "subcategory": "Governance (platform)", - "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes", - "waf": "Operations" + "severity": "High", + "subcategory": "Requirements", + "text": "Define non-functional requirements such as SLAs, RTO (Recovery Time Objective) and RPO (Recovery Point Objective).", + "waf": "Reliability" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", - "service": "AVS", + "category": "Cost Governance", + "checklist": "The AKS Checklist", + "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", + "service": "AKS", "services": [ - "Cost", - "AVS" + "AKS", + "Cost" ], - "severity": "Medium", - "subcategory": "Governance (platform)", - "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used", + "severity": "Low", + "subcategory": "Cost", + "text": "Use an external application such as kubecost to allocate costs to different users", "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", - "service": "AVS", + "category": "Cost Governance", + "checklist": "The AKS Checklist", + "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", + "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", + "service": "AKS", "services": [ - "Cost", - "AVS" + "AKS", + "Cost" ], "severity": "Low", - "subcategory": "Governance (platform)", - "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution", + "subcategory": "Cost", + "text": "Use scale down mode to delete/deallocate nodes", "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "6691e883-5ac9-4422-83e1-3810523081a9", - "service": "AVS", + "category": "Cost Governance", + "checklist": "The AKS Checklist", + "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", + "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", + "service": "AKS", "services": [ - "AVS" + "AKS", + "Cost" ], "severity": "Medium", - "subcategory": "Governance (platform)", - "text": "Consider the use of Azure Private-Link when using other Azure Native Services", - "waf": "Security" + "subcategory": "Cost", + "text": "When required use multi-instance partitioning GPU on AKS Clusters", + "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", - "service": "AVS", + "category": "Cost Governance", + "checklist": "The AKS Checklist", + "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", + "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", + "service": "AKS", "services": [ - "AVS" + "AKS", + "Cost" ], - "severity": "High", - "subcategory": "Governance (platform)", - "text": "Ensure all required resource reside within the same Azure availability zone(s)", - "waf": "Performance" + "severity": "Low", + "subcategory": "Cost", + "text": "If running a Dev/Test cluster use NodePool Start/Stop", + "waf": "Cost" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", + "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", + "service": "AKS", "services": [ - "Defender", - "VM", - "AVS" + "AKS", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Governance (guest/VM)", - "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads", + "subcategory": "Compliance", + "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", + "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "services": [ - "Arc", - "VM", - "AVS" + "AKS" ], "severity": "Medium", - "subcategory": "Governance (guest/VM)", - "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads", + "subcategory": "Compliance", + "text": "Separate applications from the control plane with user/system node pools", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", - "service": "AVS", - "services": [ - "AVS" - ], - "severity": "High", - "subcategory": "Governance (guest/VM)", - "text": "Enable Diagnostic and metric logging on Azure VMware Solution", - "waf": "Operations" - }, - { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "services": [ - "VM", - "Monitor", - "AVS" + "AKS" ], - "severity": "Medium", - "subcategory": "Governance (guest/VM)", - "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads", - "waf": "Operations" + "severity": "Low", + "subcategory": "Compliance", + "text": "Add taint to your system nodepool to make it dedicated", + "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "589d457a-927c-4397-9d11-02cad6aae11e", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", + "link": "https://learn.microsoft.com/azure/container-registry/", + "service": "AKS", "services": [ - "Backup", - "VM", - "AzurePolicy", - "AVS" + "ACR", + "AKS" ], "severity": "Medium", - "subcategory": "Governance (guest/VM)", - "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads", - "waf": "Operations" + "subcategory": "Compliance", + "text": "Use a private registry for your images, such as ACR", + "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "ee29711b-d352-4caa-ab79-b198dab81932", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", + "link": "https://learn.microsoft.com/azure/security-center/container-security", + "service": "ACR", "services": [ - "Defender", - "Monitor", - "AVS" + "AKS" ], "severity": "Medium", "subcategory": "Compliance", - "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution", + "text": "Scan your images for vulnerabilities", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "cc639637-a652-42ac-89e8-06965388e9de", + "link": "https://learn.microsoft.com/azure/security-center/container-security", "services": [ - "Defender", - "AVS" + "AKS", + "Defender" ], "severity": "Medium", "subcategory": "Compliance", - "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud", + "text": "Use Azure Security Center to detect security posture vulnerabilities", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "42d4aefe-2383-470e-b019-c30df24996b2", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool", "services": [ - "AVS" + "AKS" ], - "severity": "High", + "severity": "Low", "subcategory": "Compliance", - "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment", + "text": "If required configure FIPS", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", + "service": "AKS", "services": [ - "AVS" + "AKS" ], "severity": "High", "subcategory": "Compliance", - "text": "Are data processing implications (service provider / service consumer model) clear and documented", + "text": "Define app separation requirements (namespace/nodepool/cluster)", "waf": "Security" }, { - "category": "Governance", - "checklist": "Azure VMware Solution Design Review", - "guid": "547c1747-dc56-4068-a714-435cd19dd244", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", + "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", + "service": "AKS", "services": [ - "AVS" + "AKS", + "AKV" ], "severity": "Medium", - "subcategory": "Compliance", - "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).", + "subcategory": "Secrets", + "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver", "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", - "service": "AVS", - "services": [ - "Monitor", - "AVS" - ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Create dashboards to enable core Azure VMware Solution monitoring insights", - "waf": "Operations" - }, - { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", + "link": "https://learn.microsoft.com/azure/aks/update-credentials", + "service": "AKS", "services": [ - "Monitor", - "AVS" + "AKS", + "AKV" ], "severity": "High", - "subcategory": "Monitoring", - "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", - "waf": "Operations" + "subcategory": "Secrets", + "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "9659e396-80e7-4828-ac93-5657d02bff45", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", + "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", + "service": "AKS", "services": [ - "Monitor", - "AVS" + "AKS", + "AKV" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Secrets", + "text": "If required add Key Management Service etcd encryption", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", + "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", + "service": "AKS", "services": [ - "Monitor", - "AVS" + "AKS", + "AKV" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Ensure alerts are configured for Azure Service Health alerts and notifications", - "waf": "Operations" + "severity": "Low", + "subcategory": "Secrets", + "text": "If required consider using Confidential Compute for AKS", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", - "service": "AVS", + "category": "Governance and Security", + "checklist": "The AKS Checklist", + "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", + "service": "AKS", "services": [ - "Storage", - "Monitor", - "AVS" + "AKS", + "AKV", + "Defender" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing", - "waf": "Operations" - }, - { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", - "service": "AVS", - "services": [ - "Monitor", - "AVS" - ], - "severity": "Low", - "subcategory": "Monitoring", - "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?", - "waf": "Operations" + "subcategory": "Secrets", + "text": "Consider using Defender for Containers", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", + "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", + "service": "AKS", "services": [ - "AzurePolicy", - "VM", - "Storage", - "AVS" + "Entra", + "AKS" ], "severity": "High", - "subcategory": "Operations", - "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning", - "waf": "Operations" + "subcategory": "Identity", + "text": "Use managed identities instead of Service Principals", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", + "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", + "link": "https://learn.microsoft.com/azure/aks/managed-aad", + "service": "AKS", "services": [ - "AVS" + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource", - "waf": "Operations" + "subcategory": "Identity", + "text": "Integrate authentication with AAD (using the managed integration)", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", + "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", + "service": "AKS", "services": [ - "Backup", - "Storage", - "AVS" + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore", - "waf": "Operations" + "subcategory": "Identity", + "text": "Limit access to admin kubeconfig (get-credentials --admin)", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", + "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", + "service": "AKS", "services": [ - "Arc", - "AVS" + "RBAC", + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)", - "waf": "Operations" + "subcategory": "Identity", + "text": "Integrate authorization with AAD RBAC", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", + "service": "AKS", "services": [ - "Monitor", - "AVS" + "RBAC", + "Entra", + "AKS" ], - "severity": "Medium", - "subcategory": "Operations", - "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor", - "waf": "Operations" + "severity": "High", + "subcategory": "Identity", + "text": "Use namespaces for restricting RBAC privilege in Kubernetes", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", + "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", + "service": "AKS", "services": [ - "AVS" + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management", - "waf": "Operations" + "subcategory": "Identity", + "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", + "service": "AKS", "services": [ - "AzurePolicy", - "Monitor", - "AVS" + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "Operations", - "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions", - "waf": "Operations" + "subcategory": "Identity", + "text": "For AKS non-interactive logins use kubelogin (preview)", + "waf": "Security" }, { - "category": "Management", - "checklist": "Azure VMware Solution Design Review", - "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", + "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", + "service": "AKS", "services": [ - "Defender", - "AVS" + "Entra", + "AKS" ], "severity": "Medium", - "subcategory": "Security", - "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud", + "subcategory": "Identity", + "text": "Disable AKS local accounts", "waf": "Security" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", + "service": "AKS", "services": [ - "Backup", - "AVS" + "Entra", + "AKS" ], - "severity": "Medium", - "subcategory": "Backup", - "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Identity", + "text": "Configure if required Just-in-time cluster access", + "waf": "Security" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", + "service": "AKS", "services": [ - "ASR", - "AVS" + "Entra", + "AKS" ], - "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Identity", + "text": "Configure if required AAD conditional access for AKS", + "waf": "Security" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", + "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", + "service": "AKS", "services": [ - "ASR", - "AVS" + "Entra", + "AKS" ], - "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Identity", + "text": "If required for Windows AKS workloads configure gMSA ", + "waf": "Security" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", - "service": "AVS", + "category": "Identity and Access Management", + "checklist": "The AKS Checklist", + "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", + "service": "AKS", "services": [ - "ASR", - "AVS" + "Entra", + "AKS" ], - "severity": "High", - "subcategory": "Disaster Recovery", - "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Identity", + "text": "For finer control consider using a managed Kubelet Identity", + "waf": "Security" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "8255461e-2aee-4345-9aec-8339248b262d", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", + "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", + "service": "AKS", "services": [ - "ASR", - "AVS" + "ACR", + "AKS", + "AppGW" ], "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Use the geopolitical region pair as the secondary disaster recovery environment", + "subcategory": "Best practices", + "text": "If using AGIC, do not share an AppGW across clusters", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", + "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", + "link": "https://learn.microsoft.com/azure/aks/http-application-routing", + "service": "AKS", "services": [ - "ASR", - "AVS" + "AKS" ], "severity": "High", - "subcategory": "Disaster Recovery", - "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions", + "subcategory": "Best practices", + "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", + "service": "AKS", "services": [ - "ExpressRoute", - "NVA", - "ASR", - "AVS" + "AKS" ], "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?", - "waf": "Reliability" + "subcategory": "Best practices", + "text": "For Windows workloads use Accelerated Networking", + "waf": "Performance" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", + "guid": "ba7da7be-9952-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "services": [ - "Backup", - "AVS" + "AKS", + "LoadBalancer" ], - "severity": "Medium", - "subcategory": "Business Continuity", - "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]", + "severity": "High", + "subcategory": "Best practices", + "text": "Use the standard ALB (as opposed to the basic one)", "waf": "Reliability" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", + "service": "AKS", "services": [ - "Backup", - "AVS" + "VNet", + "AKS" ], "severity": "Medium", - "subcategory": "Business Continuity", - "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud", - "waf": "Reliability" + "subcategory": "Best practices", + "text": "If using Azure CNI, consider using different Subnets for NodePools", + "waf": "Security" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", + "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", + "service": "AKS", "services": [ - "Backup", - "AVS" + "VNet", + "AKS", + "Cost", + "PrivateLink" ], "severity": "Medium", - "subcategory": "Business Continuity", - "text": "Deploy your backup solution outside of vSan, on Azure native components", - "waf": "Reliability" + "subcategory": "Cost", + "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster", + "waf": "Security" }, { - "category": "BCDR", - "checklist": "Azure VMware Solution Design Review", - "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", "services": [ - "AVS" + "VPN", + "AKS" ], - "severity": "Low", - "subcategory": "Business Continuity", - "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?", + "severity": "Medium", + "subcategory": "HA", + "text": "If hybrid connectivity is required, use 2xER or ER+VPN for better availability", "waf": "Reliability" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", - "service": "AVS", - "services": [ - "AVS" - ], - "severity": "Low", - "subcategory": "Deployment strategy", - "text": "For manual deployments, all configuration and deployments must be documented", - "waf": "Operations" - }, - { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", + "guid": "a0f61565-9de5-458f-a372-49c831112dbd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "services": [ - "AVS" + "AKS" ], - "severity": "Low", - "subcategory": "Deployment strategy", - "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud", - "waf": "Operations" + "severity": "High", + "subcategory": "IPAM", + "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)", + "waf": "Reliability" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "AVS" + "VNet", + "AKS" ], - "severity": "Low", - "subcategory": "Automated Deployment", - "text": "For automated deployments, deploy a minimal private cloud and scale as needed", - "waf": "Operations" + "severity": "High", + "subcategory": "IPAM", + "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node", + "waf": "Performance" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "AVS" + "AKS" ], - "severity": "Low", - "subcategory": "Automated Deployment", - "text": "For automated deployments, request or reserve quota prior to starting the deployment", - "waf": "Operations" + "severity": "High", + "subcategory": "IPAM", + "text": "If using Azure CNI, check the maximum pods/node (default 30)", + "waf": "Performance" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .", + "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", + "link": "https://learn.microsoft.com/azure/aks/internal-lb", + "service": "AKS", "services": [ - "AzurePolicy", - "AVS" + "VNet", + "AKS" ], "severity": "Low", - "subcategory": "Automated Deployment", - "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance", - "waf": "Operations" + "subcategory": "IPAM", + "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)", + "waf": "Security" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "AKV", - "AVS" + "AKS" ], - "severity": "Low", - "subcategory": "Automated Connectivity", - "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use", - "waf": "Operations" + "severity": "High", + "subcategory": "IPAM", + "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)", + "waf": "Reliability" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "255461e2-aee3-4553-afc8-339248b262d6", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", + "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", + "service": "AKS", "services": [ - "ExpressRoute", - "AKV", - "AVS" + "AKS" ], "severity": "Low", - "subcategory": "Automated Connectivity", - "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute", - "waf": "Operations" + "subcategory": "Operations", + "text": "If required add your own CNI plugin", + "waf": "Security" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", + "service": "AKS", "services": [ - "AVS" + "AKS" ], "severity": "Low", - "subcategory": "Automated Connectivity", - "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.", - "waf": "Operations" + "subcategory": "Operations", + "text": "If required configure Public IP per node in AKS", + "waf": "Performance" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", + "link": "https://learn.microsoft.com/azure/aks/concepts-network", + "service": "AKS", "services": [ - "AVS" + "AKS" ], - "severity": "Low", - "subcategory": "Automated Connectivity", - "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Scalability", + "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services", + "waf": "Reliability" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", + "link": "https://learn.microsoft.com/azure/aks/nat-gateway", + "service": "AKS", "services": [ - "Subscriptions", - "AVS" + "AKS" ], - "severity": "Medium", - "subcategory": "Automated Scale", - "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution", - "waf": "Performance" + "severity": "Low", + "subcategory": "Scalability", + "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic", + "waf": "Reliability" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", + "service": "AKS", "services": [ - "AzurePolicy", - "Storage", - "AVS" + "AKS" ], "severity": "Medium", - "subcategory": "Automated Scale", - "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action", - "waf": "Performance" + "subcategory": "Scalability", + "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion", + "waf": "Reliability" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", + "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", + "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", + "service": "AKS", "services": [ - "AVS" + "AKS", + "NVA" ], - "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)", - "waf": "Performance" + "severity": "High", + "subcategory": "Security", + "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it", + "waf": "Security" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", + "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", + "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", + "service": "AKS", "services": [ - "AVS" + "AKS" ], "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", - "waf": "Performance" + "subcategory": "Security", + "text": "If using a public API endpoint, restrict the IP addresses that can access it", + "waf": "Security" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", + "link": "https://learn.microsoft.com/azure/aks/private-clusters", + "service": "AKS", "services": [ - "AVS" + "AKS" ], - "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Define and enforce scale in/out maximum limits for your environment in the automations", - "waf": "Performance" + "severity": "High", + "subcategory": "Security", + "text": "Use private clusters if your requirements mandate it", + "waf": "Security" }, { - "category": "Platform Automation", - "checklist": "Azure VMware Solution Design Review", - "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "services": [ - "Monitor", - "AVS" + "AKS", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Automated Scale", - "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses", - "waf": "Operations" + "subcategory": "Security", + "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ", + "waf": "Security" }, { - "category": "Migration", - "checklist": "Azure VMware Solution Design Review", - "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", + "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "services": [ - "VM", - "AVS" + "AKS", + "AzurePolicy" ], "severity": "High", - "subcategory": "Architecture", - "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "Reliability" + "subcategory": "Security", + "text": "Enable a Kubernetes Network Policy option (Calico/Azure)", + "waf": "Security" }, { - "category": "Migration", - "checklist": "Azure VMware Solution Design Review", - "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "services": [ - "AVS" + "AKS", + "AzurePolicy" ], "severity": "High", - "subcategory": "Architecture", - "text": "When using MON, you cannot enable MON on more than 100 Network extensions", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Reliability" + "subcategory": "Security", + "text": "Use Kubernetes network policies to increase intra-cluster security", + "waf": "Security" }, { - "category": "Migration", - "checklist": "Azure VMware Solution Design Review", - "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "services": [ - "VPN", - "AVS" + "AKS", + "WAF" ], - "severity": "Medium", - "subcategory": "Networking", - "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.", - "waf": "Performance" + "severity": "High", + "subcategory": "Security", + "text": "Use a WAF for web workloads (UIs or APIs)", + "waf": "Security" }, { - "category": "Migration", - "checklist": "Azure VMware Solution Design Review", - "guid": "e614658d-d457-4e92-9139-b821102cad6e", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", + "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", + "service": "AKS", "services": [ - "AVS" + "DDoS", + "VNet", + "AKS" ], "severity": "Medium", - "subcategory": "Networking", - "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance", - "waf": "Performance" + "subcategory": "Security", + "text": "Use DDoS Standard in the AKS Virtual Network", + "waf": "Security" }, { - "category": "Migration", - "checklist": "Azure VMware Solution Design Review", - "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", + "link": "https://learn.microsoft.com/azure/aks/http-proxy", + "service": "AKS", "services": [ - "AVS" + "AKS" ], - "severity": "Medium", - "subcategory": "Process", - "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Security", + "text": "If required add company HTTP Proxy", + "waf": "Security" }, { - "category": "Data Storage", - "checklist": "Azure VMware Solution Design Review", - "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "AVS", + "category": "Network Topology and Connectivity", + "checklist": "The AKS Checklist", + "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", + "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", + "service": "AKS", "services": [ - "VM", - "Storage", - "AVS" + "AKS" ], "severity": "Medium", - "subcategory": "Architecture", - "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.", - "waf": "Reliability" + "subcategory": "Security", + "text": "Consider using a service mesh for advanced microservice communication management", + "waf": "Security" }, { - "category": "Data Storage", - "checklist": "Azure VMware Solution Design Review", - "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "AVS", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", + "service": "AKS", "services": [ - "ExpressRoute", - "Storage", - "AVS" + "AKS", + "Monitor" ], - "severity": "Medium", - "subcategory": "Architecture", - "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions", - "waf": "Reliability" + "severity": "High", + "subcategory": "Alerting", + "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", + "waf": "Operations" }, { - "category": "Data Storage", - "checklist": "Azure VMware Solution Design Review", - "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "AVS", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "337453a3-cc63-4963-9a65-22ac19e80696", + "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", + "service": "AKS", "services": [ - "ExpressRoute", - "Storage", - "AVS" + "Entra", + "AKS" ], - "severity": "Medium", - "subcategory": "Architecture", - "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Compliance", + "text": "Check regularly Azure Advisor for recommendations on your cluster", + "waf": "Operations" }, { - "category": "Stretched Cluster", - "checklist": "Azure VMware Solution Design Review", - "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "AVS", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", + "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", + "service": "AKS", "services": [ - "ASR", - "AVS" + "AKS" ], - "severity": "High", - "subcategory": "Architecture", - "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Compliance", + "text": "Enable AKS auto-certificate rotation", + "waf": "Operations" }, { - "category": "Stretched Cluster", - "checklist": "Azure VMware Solution Design Review", - "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "AVS", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", + "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", + "service": "AKS", "services": [ - "AVS" + "AKS" ], "severity": "High", - "subcategory": "Architecture", - "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements", - "waf": "Reliability" + "subcategory": "Compliance", + "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature", + "waf": "Operations" }, { - "category": "Stretched Cluster", - "checklist": "Azure VMware Solution Design Review", - "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "AVS", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", + "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", + "service": "AKS", "services": [ - "ExpressRoute", - "AVS" + "AKS" ], "severity": "High", - "subcategory": "Architecture", - "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.", - "waf": "Reliability" + "subcategory": "Compliance", + "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade", + "waf": "Operations" }, { - "category": "Stretched Cluster", - "checklist": "Azure VMware Solution Design Review", - "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "AVS", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", + "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", + "service": "AKS", "services": [ - "ExpressRoute", - "AVS" + "AKS" ], "severity": "High", - "subcategory": "Architecture", - "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.", - "waf": "Reliability" + "subcategory": "Compliance", + "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)", + "waf": "Operations" }, { - "category": "Stretched Cluster", - "checklist": "Azure VMware Solution Design Review", - "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "AVS", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", + "service": "AKS", "services": [ - "AVS" + "AKS" ], - "severity": "High", - "subcategory": "Architecture", - "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Compliance", + "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters", + "waf": "Operations" }, { - "category": "Governance", - "checklist": "Azure Key Vault", - "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "d7672c26-7602-4482-85a4-14527fbe855c", + "link": "https://learn.microsoft.com/azure/aks/command-invoke", + "service": "AKS", "services": [ - "Backup", - "AKV" + "AKS" ], - "severity": "High", - "subcategory": "Deployment best practices", - "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Compliance", + "text": "Consider using AKS command invoke on private clusters", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Key Vault", - "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Key Vault", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", + "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", + "service": "AKS", "services": [ - "AKV", - "ACR" + "AKS" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Compliance", + "text": "For planned events consider using Node Auto Drain", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Key Vault", - "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication", - "service": "Key Vault", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", + "link": "https://learn.microsoft.com/azure/aks/faq", + "service": "AKS", "services": [ - "AKV" + "AKS" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.", - "waf": "Reliability" + "severity": "High", + "subcategory": "Compliance", + "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure Key Vault", - "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions", - "service": "Key Vault", + "category": "Operations", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", + "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", "services": [ - "AzurePolicy", - "AKV" + "AKS" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Compliance", + "text": "Use custom Node RG (aka 'Infra RG') name", + "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Key Vault", - "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509", - "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations", - "service": "Key Vault", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", + "link": "https://kubernetes.io/docs/setup/release/notes/", + "service": "AKS", "services": [ - "ASR", - "Backup", - "Subscriptions", - "AKV", - "Storage" + "AKS" ], "severity": "Medium", - "subcategory": "Business continuity and disaster recovery", - "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.", - "waf": "Reliability" - }, - { - "category": "Management", - "checklist": "Azure Key Vault", - "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "Key Vault", + "subcategory": "Compliance", + "text": "Do not use deprecated Kubernetes APIs in your YAML manifests", + "waf": "Operations" + }, + { + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", + "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", + "service": "AKS", "services": [ - "ASR", - "AKV" + "AKS" ], - "severity": "High", - "subcategory": "Business continuity and disaster recovery", - "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Compliance", + "text": "Taint Windows nodes", + "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Key Vault", - "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "Key Vault", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", + "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", + "service": "AKS", "services": [ - "ASR", - "AKV" + "AKS" ], "severity": "Low", - "subcategory": "Business continuity and disaster recovery", - "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.", - "waf": "Reliability" + "subcategory": "Compliance", + "text": "Keep windows containers patch level in sync with host patch level", + "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Key Vault", - "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c", - "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", - "service": "Key Vault", + "category": "Operations", + "checklist": "The AKS Checklist", + "description": "Via Diagnostic Settings at the cluster level", + "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", + "link": "https://learn.microsoft.com/azure/aks/monitor-aks", + "service": "AKS", "services": [ - "Backup", - "AKV", - "ASR" + "AKS", + "Monitor" ], "severity": "Low", - "subcategory": "Business continuity and disaster recovery", - "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.", - "waf": "Reliability" + "subcategory": "Compliance", + "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution", + "waf": "Operations" }, { - "category": "Management", - "checklist": "Azure Key Vault", - "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04", - "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", - "service": "Key Vault", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", + "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", + "service": "AKS", "services": [ - "Backup", - "AKV", - "ASR" + "AKS" ], "severity": "Low", - "subcategory": "Business continuity and disaster recovery", - "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.", - "waf": "Reliability" + "subcategory": "Compliance", + "text": "If required use nodePool snapshots", + "waf": "Cost" }, { - "category": "Management", - "checklist": "Azure Key Vault", - "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection", - "service": "Key Vault", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", + "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", + "service": "AKS", "services": [ - "EventHubs", - "AKV", - "ASR" + "AKS", + "Cost" ], - "severity": "Medium", - "subcategory": "Business continuity and disaster recovery", - "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Cost", + "text": "Consider spot node pools for non time-sensitive workloads", + "waf": "Operations" }, { - "category": "Application Deployment", - "checklist": "Azure AKS Review", - "guid": "785c2fa5-5b56-4ad4-a408-fe72734c476b", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks", + "category": "Operations", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", + "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "services": [ - "AKS" + "AKS", + "Cost" ], - "severity": "Medium", - "subcategory": "Development", - "text": "Use canary or blue/green deployments", + "severity": "Low", + "subcategory": "Cost", + "text": "Consider AKS virtual node for quick bursting", "waf": "Operations" }, { - "category": "Application Deployment", - "checklist": "Azure AKS Review", - "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", - "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", "service": "AKS", "services": [ - "AKS" + "AKS", + "Monitor" ], - "severity": "Low", - "subcategory": "Development", - "text": "If required for AKS Windows workloads HostProcess containers can be used", - "waf": "Reliability" + "severity": "High", + "subcategory": "Monitoring", + "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)", + "waf": "Operations" }, { - "category": "Application Deployment", - "checklist": "Azure AKS Review", - "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", - "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", + "category": "Operations", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", + "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", "service": "AKS", "services": [ - "AKS" + "AKS", + "Monitor" ], - "severity": "Low", - "subcategory": "Development", - "text": "Use KEDA if running event-driven workloads", - "waf": "Performance" + "severity": "High", + "subcategory": "Monitoring", + "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)", + "waf": "Operations" }, { - "category": "Application Deployment", - "checklist": "Azure AKS Review", - "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", - "link": "https://dapr.io/", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", "service": "AKS", "services": [ - "AKS" + "AKS", + "Monitor" ], - "severity": "Low", - "subcategory": "Development", - "text": "Use Dapr to ease microservice development", + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Monitor CPU and memory utilization of the nodes", "waf": "Operations" }, { - "category": "Application Deployment", - "checklist": "Azure AKS Review", - "guid": "3acbe04b-be20-49d3-afda-47778424d116", - "link": "https://learn.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-tf-and-aks", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "1a4835ac-9422-423e-ae80-b123081a5417", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "services": [ - "AKS" + "AKS", + "Monitor" ], "severity": "Medium", - "subcategory": "Infrastructure as Code", - "text": "Use automation through ARM/TF to create your Azure resources", + "subcategory": "Monitoring", + "text": "If using Azure CNI, monitor % of pod IPs consumed per node", "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure AKS Review", - "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery", + "category": "Operations", + "checklist": "The AKS Checklist", + "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady", + "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", + "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", + "service": "AKS", "services": [ + "Storage", + "EventHubs", "AKS", - "ASR" + "ServiceBus", + "Monitor" ], - "severity": "High", - "subcategory": "Disaster Recovery", - "text": "Schedule and perform DR tests regularly", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Monitor OS disk queue depth in nodes", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure AKS Review", - "guid": "170265f4-bb46-4a39-9af7-f317284797b1", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "be209d39-fda4-4777-a424-d116785c2fa5", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "services": [ "AKS", - "FrontDoor", + "NVA", "LoadBalancer", - "TrafficManager" + "Monitor" ], "severity": "Medium", - "subcategory": "High Availability", - "text": "Use Azure Traffic Manager or Azure Front Door as a global load balancer for region failover", - "waf": "Reliability" + "subcategory": "Monitoring", + "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure AKS Review", - "graph": "resources | where type=='microsoft.containerservice/managedclusters' | extend compliant= isnotnull(properties.agentPoolProfiles[0].availabilityZones) | distinct id,compliant", - "guid": "578a219a-46be-4b54-9350-24922634292b", - "link": "https://learn.microsoft.com/azure/aks/availability-zones", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", + "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", + "service": "AKS", "services": [ - "AKS" + "AKS", + "Monitor" ], "severity": "Medium", - "subcategory": "High Availability", - "text": "Use Availability Zones if they are supported in your Azure region", - "waf": "Reliability" + "subcategory": "Monitoring", + "text": "Subscribe to resource health notifications for your AKS cluster", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", - "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", - "link": "https://learn.microsoft.com/azure/aks/uptime-sla", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", "service": "AKS", "services": [ "AKS" ], "severity": "High", - "subcategory": "High Availability", - "text": "Use the SLA-backed AKS offering", - "waf": "Reliability" + "subcategory": "Resources", + "text": "Configure requests and limits in your pod specs", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure AKS Review", - "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "769ef669-1a48-435a-a942-223ece80b123", "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", "service": "AKS", "services": [ - "AKS", - "Cost" + "AKS" ], - "severity": "Low", - "subcategory": "High Availability", - "text": "Use Disruption Budgets in your pod and deployment definitions", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Resources", + "text": "Enforce resource quotas for namespaces", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure AKS Review", - "guid": "3c763963-7a55-42d5-a15e-401955387e5c", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", - "service": "ACR", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "081a5417-4158-433e-a3ad-3c2de733165c", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "AKS", "services": [ "AKS", - "ACR" + "Subscriptions" ], "severity": "High", - "subcategory": "High Availability", - "text": "If using a private registry, configure region replication to store images in multiple regions", - "waf": "Reliability" + "subcategory": "Resources", + "text": "Ensure your subscription has enough quota to scale out your nodepools", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure AKS Review", - "guid": "daa9a260-c3ea-4490-b077-5fc1f2a80cb0", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65", + "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", + "service": "AKS", "services": [ - "AKS", - "ASR", - "Storage" + "AKS" ], "severity": "High", - "subcategory": "Disaster Recovery", - "text": "Use Zone-Redundant Storage (ZRS) with stateful workloads", - "waf": "Reliability" + "subcategory": "Resources", + "text": "Configure Liveness and Readiness probes for all deployments", + "waf": "Operations" }, { - "category": "BC and DR", - "checklist": "Azure AKS Review", - "guid": "bc14aea6-e65d-48d9-a3ad-c218e6436b06", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery", + "category": "Operations", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", + "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "services": [ "AKS" ], - "severity": "High", - "subcategory": "Requirements", - "text": "Define non-functional requirements such as SLAs, RTO (Recovery Time Objective) and RPO (Recovery Point Objective).", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Scalability", + "text": "Use the Cluster Autoscaler", + "waf": "Performance" }, { - "category": "Cost Governance", - "checklist": "Azure AKS Review", - "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", + "category": "Operations", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", + "guid": "831c2872-c693-4b39-a887-a561bada49bc", + "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", "service": "AKS", "services": [ - "AKS", - "Cost" + "AKS" ], "severity": "Low", - "subcategory": "Cost", - "text": "Use an external application such as kubecost to allocate costs to different users", - "waf": "Cost" + "subcategory": "Scalability", + "text": "Customize node configuration for AKS node pools", + "waf": "Performance" }, { - "category": "Cost Governance", - "checklist": "Azure AKS Review", - "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", - "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", "service": "AKS", "services": [ - "AKS", - "Cost" + "AKS" ], - "severity": "Low", - "subcategory": "Cost", - "text": "Use scale down mode to delete/deallocate nodes", - "waf": "Cost" + "severity": "Medium", + "subcategory": "Scalability", + "text": "Use the Horizontal Pod Autoscaler when required", + "waf": "Performance" }, { - "category": "Cost Governance", - "checklist": "Azure AKS Review", - "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", - "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", + "category": "Operations", + "checklist": "The AKS Checklist", + "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity", + "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", + "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", "service": "AKS", "services": [ - "AKS", - "Cost" + "AKS" ], - "severity": "Medium", - "subcategory": "Cost", - "text": "When required use multi-instance partitioning GPU on AKS Clusters", - "waf": "Cost" + "severity": "High", + "subcategory": "Scalability", + "text": "Consider an appropriate node size, not too large or too small", + "waf": "Performance" }, { - "category": "Cost Governance", - "checklist": "Azure AKS Review", - "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", - "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", + "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", "service": "AKS", "services": [ - "AKS", - "Cost" + "AKS" ], "severity": "Low", - "subcategory": "Cost", - "text": "If running a Dev/Test cluster use NodePool Start/Stop", - "waf": "Cost" + "subcategory": "Scalability", + "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster", + "waf": "Performance" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", - "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", + "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", "service": "AKS", "services": [ - "AKS", - "AzurePolicy" + "AKS" ], - "severity": "Medium", - "subcategory": "Compliance", - "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", - "waf": "Security" + "severity": "Low", + "subcategory": "Scalability", + "text": "Consider subscribing to EventGrid Events for AKS automation", + "waf": "Performance" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", - "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", + "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", "service": "AKS", "services": [ "AKS" ], - "severity": "Medium", - "subcategory": "Compliance", - "text": "Separate applications from the control plane with user/system node pools", - "waf": "Security" + "severity": "Low", + "subcategory": "Scalability", + "text": "For long running operation on an AKS cluster consider event termination", + "waf": "Performance" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", + "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", "service": "AKS", "services": [ "AKS" ], "severity": "Low", - "subcategory": "Compliance", - "text": "Add taint to your system nodepool to make it dedicated", - "waf": "Security" + "subcategory": "Scalability", + "text": "If required consider using Azure Dedicated Hosts for AKS nodes", + "waf": "Performance" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", - "link": "https://learn.microsoft.com/azure/container-registry/", + "category": "Operations", + "checklist": "The AKS Checklist", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", + "guid": "24367b33-6971-45b1-952b-eee0b9b588de", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", "service": "AKS", "services": [ - "AKS", - "ACR" + "Storage", + "AKS" ], - "severity": "Medium", - "subcategory": "Compliance", - "text": "Use a private registry for your images, such as ACR", - "waf": "Security" + "severity": "High", + "subcategory": "Storage", + "text": "Use ephemeral OS disks", + "waf": "Performance" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", - "link": "https://learn.microsoft.com/azure/security-center/container-security", - "service": "ACR", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "AKS", + "services": [ + "Storage", + "AKS" + ], + "severity": "High", + "subcategory": "Storage", + "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds", + "waf": "Performance" + }, + { + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", + "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", + "service": "AKS", "services": [ + "Storage", "AKS" ], - "severity": "Medium", - "subcategory": "Compliance", - "text": "Scan your images for vulnerabilities", - "waf": "Security" + "severity": "Low", + "subcategory": "Storage", + "text": "For hyper performance storage option use Ultra Disks on AKS", + "waf": "Performance" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "cc639637-a652-42ac-89e8-06965388e9de", - "link": "https://learn.microsoft.com/azure/security-center/container-security", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "service": "AKS", "services": [ + "Storage", "AKS", - "Defender" + "SQL" ], "severity": "Medium", - "subcategory": "Compliance", - "text": "Use Azure Security Center to detect security posture vulnerabilities", - "waf": "Security" + "subcategory": "Storage", + "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", + "waf": "Performance" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "42d4aefe-2383-470e-b019-c30df24996b2", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-fips-enabled-node-pool", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", + "service": "AKS", "services": [ + "Storage", "AKS" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "If required configure FIPS", - "waf": "Security" + "severity": "Medium", + "subcategory": "Storage", + "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons", + "waf": "Performance" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", + "category": "Operations", + "checklist": "The AKS Checklist", + "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", "service": "AKS", "services": [ + "Storage", "AKS" ], + "severity": "Medium", + "subcategory": "Storage", + "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones", + "waf": "Performance" + }, + { + "category": "Foundation", + "checklist": "Azure Arc Review", + "description": "Define a resource group structure for placement of Azure Arc-enabled servers resources", + "guid": "585e1112-9bd7-4ba0-82f7-b94ef6e043d2", + "services": [ + "Arc" + ], "severity": "High", - "subcategory": "Compliance", - "text": "Define app separation requirements (namespace/nodepool/cluster)", - "waf": "Security" + "subcategory": "Capacity Planning", + "text": "One or more resource groups is required for onboarding servers into Azure", + "waf": "Operations" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", - "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", - "service": "AKS", + "category": "Foundation", + "checklist": "Azure Arc Review", + "guid": "aa359271-8e6e-4205-8725-769e46691e88", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits", "services": [ - "AKS", - "AKV" + "Entra", + "Arc" ], "severity": "Medium", - "subcategory": "Secrets", - "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver", - "waf": "Security" + "subcategory": "Capacity Planning", + "text": "Take Azure Active Directory object limitations into account", + "waf": "Performance" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", - "link": "https://learn.microsoft.com/azure/aks/update-credentials", - "service": "AKS", + "category": "Foundation", + "checklist": "Azure Arc Review", + "description": "The following resource providers needs to be registered: Microsoft.HybridCompute, Microsoft.GuestConfiguration, Microsoft.HybridConnectivity", + "guid": "deace4bb-1deb-44c6-9fc3-fc14eeaa3692", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-resource-providers", "services": [ - "AKS", - "AKV" + "Subscriptions", + "Arc" ], "severity": "High", - "subcategory": "Secrets", - "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)", - "waf": "Security" + "subcategory": "General", + "text": "Has the Resource providers required been registered in all subscriptions", + "waf": "Operations" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", - "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", - "service": "AKS", + "category": "Foundation", + "checklist": "Azure Arc Review", + "description": "Aligning with an existing or creating an Azure tagging strategy is recommended. Resource tags allow you to quickly locate it, automate operational tasks amd more. ", + "guid": "c6d37331-65c7-4acb-b44b-be609d79f2e8", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/", "services": [ - "AKS", - "AKV" + "Arc" ], - "severity": "Medium", - "subcategory": "Secrets", - "text": "If required add Key Management Service etcd encryption", - "waf": "Security" + "severity": "Low", + "subcategory": "General", + "text": "Has a tagging strategy for Azure Arc-enabled servers been defined", + "waf": "Cost" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", - "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", - "service": "AKS", + "category": "Foundation", + "checklist": "Azure Arc Review", + "description": "Installation of the connected machine agent is supported on most newer Windows and Linux operative systems, review the link to se the latest list", + "guid": "7778424c-5167-475c-9fa9-5b96ad88408e", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#supported-operating-systems", "services": [ - "AKS", - "AKV" + "Arc" ], - "severity": "Low", - "subcategory": "Secrets", - "text": "If required consider using Confidential Compute for AKS", - "waf": "Security" + "severity": "High", + "subcategory": "General", + "text": "What operating systems need to be Azure Arc-enabled", + "waf": "Operations" }, { - "category": "Governance and Security", - "checklist": "Azure AKS Review", - "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", - "service": "AKS", + "category": "Foundation", + "checklist": "Azure Arc Review", + "description": "There are software requirements to the agent installation. Some might require a system reboot after installation, review to link", + "guid": "372734b8-76ba-428f-8145-901365d38e53", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#software-requirements", "services": [ - "AKS", - "Defender", - "AKV" + "Arc" ], - "severity": "Medium", - "subcategory": "Secrets", - "text": "Consider using Defender for Containers", - "waf": "Security" + "severity": "High", + "subcategory": "General", + "text": "Are required software installed on Windows and Linux servers to support the installation", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", - "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", - "service": "AKS", + "category": "Foundation", + "checklist": "Azure Arc Review", + "guid": "d44c7c89-19ca-41f6-b521-5ae514ba34d4", + "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/?products=azure-arc®ions=all", "services": [ - "AKS", - "Entra" + "Arc" ], "severity": "High", - "subcategory": "Identity", - "text": "Use managed identities instead of Service Principals", - "waf": "Security" + "subcategory": "General", + "text": "Make sure to use a supported Azure region", + "waf": "Reliability" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", - "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", - "link": "https://learn.microsoft.com/azure/aks/managed-aad", - "service": "AKS", + "category": "Foundation", + "checklist": "Azure Arc Review", + "description": "The scope include organization into management groups, subscriptions, and resource groups.", + "guid": "f9ccbd86-8266-4abc-a264-f9a19bf39d95", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/organize-inventory-servers#organize-resources-with-built-in-azure-hierarchies", "services": [ - "AKS", - "Entra" + "Subscriptions", + "Arc" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Integrate authentication with AAD (using the managed integration)", - "waf": "Security" + "severity": "Low", + "subcategory": "Organization", + "text": "Define the structure for Azure management of resources", + "waf": "Performance" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", - "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", - "service": "AKS", + "category": "Identity", + "checklist": "Azure Arc Review", + "description": "Define RBAC rules to the servers / resource groups as required for servers management, the 'Azure Connected Machine Resource Administrator' or 'Hybrid Server Resource Administrator' role would be sufficient for management of the Azure Arc-enabled servers resources in Azure", + "guid": "9bf39d95-d44c-47c8-a19c-a1f6d5215ae5", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#identity-and-access-control", "services": [ - "AKS", - "Entra" + "Entra", + "RBAC", + "Arc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Limit access to admin kubeconfig (get-credentials --admin)", + "subcategory": "Access", + "text": "Assign RBAC rights to Azure AD user/group access for managing Azure Arc-enabled servers", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", - "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", - "service": "AKS", + "category": "Identity", + "checklist": "Azure Arc Review", + "guid": "14ba34d4-585e-4111-89bd-7ba012f7b94e", + "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad", "services": [ - "AKS", "Entra", - "RBAC" + "AKV", + "Arc" ], - "severity": "Medium", - "subcategory": "Identity", - "text": "Integrate authorization with AAD RBAC", + "severity": "Low", + "subcategory": "Access", + "text": "Consider using managed identities for applications to access Azure resources like Key Vault example in link", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", - "service": "AKS", + "category": "Identity", + "checklist": "Azure Arc Review", + "description": "An Azure subscription must be parented to the same Azure AD tenant", + "guid": "35ac9322-23e1-4380-8523-081a94174158", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits", "services": [ - "AKS", "Entra", - "RBAC" + "Subscriptions", + "Arc" ], "severity": "High", - "subcategory": "Identity", - "text": "Use namespaces for restricting RBAC privilege in Kubernetes", - "waf": "Security" + "subcategory": "Requirements", + "text": "An Azure Active Directory tenant must be available with at least one subscription", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", - "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", - "service": "AKS", + "category": "Identity", + "checklist": "Azure Arc Review", + "description": "Users (or SPs) need the 'Azure Connected Machine Onboarding' or 'Contributor' role to onboarding of servers", + "guid": "33ee7ad6-c6d3-4733-865c-7acbe44bbe60", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions", "services": [ - "AKS", - "Entra" + "Entra", + "RBAC", + "Arc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)", + "subcategory": "Requirements", + "text": "Define which users (AAD user/groups) has access to onboard Azure Arc-enabled servers", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", - "service": "AKS", + "category": "Identity", + "checklist": "Azure Arc Review", + "description": "Ensure to only add the rights to users or groups that is required to perform their role", + "guid": "9d79f2e8-7778-4424-a516-775c6fa95b96", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale", "services": [ - "AKS", - "Entra" + "Entra", + "RBAC", + "Arc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "For AKS non-interactive logins use kubelogin (preview)", + "subcategory": "Security", + "text": "Use the principle of least privileged", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", - "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", - "service": "AKS", + "category": "Identity", + "checklist": "Azure Arc Review", + "description": "A service principle with the 'Azure Connected Machine Onboarding' role is required for at-scale onboarding of servers, consider more SP's if onboarding is done by different teams/decentralized management", + "guid": "ad88408e-3727-434b-a76b-a28f21459013", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale", "services": [ - "AKS", - "Entra" + "Entra", + "RBAC", + "Arc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "Disable AKS local accounts", + "subcategory": "Security", + "text": "How many Service Principals are needed for onboarding Arc-enabled servers into Azure", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", - "service": "AKS", + "category": "Identity", + "checklist": "Azure Arc Review", + "description": "Consider assigning the rights for the 'Azure Connected Machine Onboarding' role at the resource group level, to control the resource creation", + "guid": "65d38e53-f9cc-4bd8-9826-6abca264f9a1", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions", "services": [ - "AKS", - "Entra" + "Entra", + "RBAC", + "Arc" ], - "severity": "Low", - "subcategory": "Identity", - "text": "Configure if required Just-in-time cluster access", + "severity": "Medium", + "subcategory": "Security", + "text": "Limit the rights to onboard Azure Arc-enabled servers to the desired resource groups", "waf": "Security" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", - "service": "AKS", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "description": "Plan for agent deployments at scale", + "guid": "6ee79d6b-5c2a-4364-a4b6-9bad38aad53c", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment", "services": [ - "AKS", - "Entra" + "Monitor", + "Arc" ], - "severity": "Low", - "subcategory": "Identity", - "text": "Configure if required AAD conditional access for AKS", - "waf": "Security" + "severity": "Medium", + "subcategory": "Management", + "text": "Define a strategy for agent provisioning", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", - "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", - "service": "AKS", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "description": "Use Microsoft Update to ensure that the connected machine agent is always up-to-date", + "guid": "c78e1d76-6673-457c-9496-74c5ed85b859", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#upgrade-the-agent", "services": [ - "AKS", - "Entra" + "Monitor", + "Arc" ], - "severity": "Low", - "subcategory": "Identity", - "text": "If required for Windows AKS workloads configure gMSA ", - "waf": "Security" + "severity": "High", + "subcategory": "Management", + "text": "Define a strategy for agent updates", + "waf": "Operations" }, { - "category": "Identity and Access Management", - "checklist": "Azure AKS Review", - "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", - "service": "AKS", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "description": "Recommendation is to use Azure Policy, or another automation tool like Azure DevOps - important is to avoid configuration drift.", + "guid": "c7733be2-a1a2-47b7-95a9-1be1f388ff39", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-vm-extensions", "services": [ - "AKS", - "Entra" + "Monitor", + "AzurePolicy", + "Arc" ], "severity": "Medium", - "subcategory": "Identity", - "text": "For finer control consider using a managed Kubelet Identity", - "waf": "Security" + "subcategory": "Management", + "text": "Define a strategy for extension installation", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", - "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", - "service": "AKS", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "description": "Use automatic upgrades where available and define an update strategy for all extensions not supporting automatic upgrades.", + "guid": "4c2bd463-cbbb-4c86-a195-abb91a4ed90d", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-automatic-vm-extension-upgrade?tabs=azure-portal", "services": [ - "AKS", - "AppGW", - "ACR" + "Monitor", + "Arc" + ], + "severity": "High", + "subcategory": "Management", + "text": "Define a strategy for extension updates", + "waf": "Operations" + }, + { + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "description": "Azure Automanage help implement Microsoft best-practices for servers management in Azure", + "guid": "7a927c39-74d1-4102-aac6-aae01e6a84de", + "link": "https://learn.microsoft.com/azure/automanage/automanage-arc", + "services": [ + "Monitor", + "Arc" ], "severity": "Medium", - "subcategory": "Best practices", - "text": "If using AGIC, do not share an AppGW across clusters", - "waf": "Reliability" + "subcategory": "Management", + "text": "Consider using Azure Automanage to control settings and avoid configuration drift on servers", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", - "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", - "link": "https://learn.microsoft.com/azure/aks/http-application-routing", - "service": "AKS", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "guid": "37b6b780-cbaf-4e6c-9658-9d457a927c39", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate", "services": [ - "AKS" + "Monitor", + "Arc" ], "severity": "High", - "subcategory": "Best practices", - "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.", - "waf": "Reliability" + "subcategory": "Monitoring", + "text": "Monitor for unresponsive agents", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", - "service": "AKS", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "guid": "74d1102c-ac6a-4ae0-8e6a-84de5df47d2d", + "link": "https://learn.microsoft.com/azure/azure-monitor/agents/log-analytics-agent#data-collected", "services": [ - "AKS" + "Monitor", + "Arc" ], "severity": "Medium", - "subcategory": "Best practices", - "text": "For Windows workloads use Accelerated Networking", - "waf": "Performance" + "subcategory": "Monitoring", + "text": "Design a monitoring strategy to send metrics and logs to an Log Analytics workspace", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", - "guid": "ba7da7be-9952-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "guid": "92881b1c-d5d1-4e54-a296-59e3958fd782", + "link": "https://learn.microsoft.com/azure/service-health/resource-health-alert-monitor-guide", "services": [ - "AKS", - "LoadBalancer" - ], - "severity": "High", - "subcategory": "Best practices", - "text": "Use the standard ALB (as opposed to the basic one)", - "waf": "Reliability" + "Monitor", + "Arc" + ], + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Use notification in Activity logs to receive notification on unexpected changes to the resources", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", - "service": "AKS", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "guid": "89c93555-6d02-4bfe-9564-b0d834a34872", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/learn/tutorial-enable-vm-insights", "services": [ - "AKS", - "VNet" + "Monitor", + "Arc" ], "severity": "Medium", - "subcategory": "Best practices", - "text": "If using Azure CNI, consider using different Subnets for NodePools", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Use Azure Monitor for compliance and operational monitoring", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", - "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", - "service": "AKS", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "guid": "5df47d2d-9288-41b1-ad5d-1e54a29659e3", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate", "services": [ - "AKS", - "Cost", - "PrivateLink", - "VNet" + "Monitor", + "Arc" ], "severity": "Medium", - "subcategory": "Cost", - "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster", - "waf": "Security" + "subcategory": "Monitoring", + "text": "Create an alert to identify Azure Arc-enabled servers that aren't using the latest version of the Azure connected machine agent", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "category": "Management and Monitoring", + "checklist": "Azure Arc Review", + "description": "Use Update Management in Azure Automation or the new Update Management Center (preview) functionality to ensure update management of servers", + "guid": "ae2cc84c-37b6-4b78-8cba-fe6c46589d45", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-update-management", "services": [ - "AKS", - "VPN" + "Monitor", + "Arc" ], - "severity": "Medium", - "subcategory": "HA", - "text": "If hybrid connectivity is required, use 2xER or ER+VPN for better availability", - "waf": "Reliability" + "severity": "Low", + "subcategory": "Security", + "text": "Use Azure Arc-enabled servers to control software updates deployments to servers", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", - "guid": "a0f61565-9de5-458f-a372-49c831112dbd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "category": "Networking", + "checklist": "Azure Arc Review", + "description": "The Connected Machine Agent will by default communicate with Azure services over public Internet connectivity using HTTPS (TCP port 443)", + "guid": "f6e043d2-aa35-4927-88e6-e2050725769e", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#details", "services": [ - "AKS" + "Arc" ], "severity": "High", - "subcategory": "IPAM", - "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)", - "waf": "Reliability" + "subcategory": "Networking", + "text": "Define a connectivity method from the server to Azure", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "category": "Networking", + "checklist": "Azure Arc Review", + "description": "The Connected Machine Agent can be configured to use a proxy server, it is recommended to define the proxy server address using 'azcmagent config set proxy.url' command on the local system.", + "guid": "46691e88-35ac-4932-823e-13800523081a", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#update-or-remove-proxy-settings", "services": [ - "AKS", - "VNet" + "Arc" ], - "severity": "High", - "subcategory": "IPAM", - "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Networking", + "text": "Is a proxy server a required for communication over the Public Internet", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "category": "Networking", + "checklist": "Azure Arc Review", + "description": "The Connected Machine Agent can use a Private Link for communication with Azure Services over an existing ExpressRoute or VPN connection", + "guid": "94174158-33ee-47ad-9c6d-3733165c7acb", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/private-link-security", "services": [ - "AKS" + "VPN", + "PrivateLink", + "ExpressRoute", + "Arc" + ], + "severity": "Medium", + "subcategory": "Networking", + "text": "Is a private (not public Internet) connection required?", + "waf": "Operations" + }, + { + "category": "Networking", + "checklist": "Azure Arc Review", + "description": "Firewall configuration might be required for the agent to communicate with Azure, use the link to see ServiceTags and/or URL's required", + "guid": "e44bbe60-9d79-4f2e-a777-8424c516775c", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#service-tags", + "services": [ + "Arc" ], "severity": "High", - "subcategory": "IPAM", - "text": "If using Azure CNI, check the maximum pods/node (default 30)", - "waf": "Performance" + "subcategory": "Networking", + "text": "Will Firewall configurations be needed in order to ensure communication with Azure Services?", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .", - "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", - "link": "https://learn.microsoft.com/azure/aks/internal-lb", - "service": "AKS", + "category": "Networking", + "checklist": "Azure Arc Review", + "description": "Use available automation tool for the system in question to regularly update the Azure endpoints", + "guid": "6fa95b96-ad88-4408-b372-734b876ba28f", + "link": "https://www.microsoft.com/download/details.aspx?id=56519", "services": [ - "AKS", - "VNet" + "Arc" ], "severity": "Low", - "subcategory": "IPAM", - "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)", + "subcategory": "Networking", + "text": "Can the Firewall or Proxy rules be automated updated if Service Tags or IP addresses change", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "category": "Networking", + "checklist": "Azure Arc Review", + "description": "Configure Servers to use Transport Layer Security (TLS) version 1.2", + "guid": "21459013-65d3-48e5-9f9c-cbd868266abc", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#transport-layer-security-12-protocol", "services": [ - "AKS" + "Arc" ], "severity": "High", - "subcategory": "IPAM", - "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)", - "waf": "Reliability" + "subcategory": "Networking", + "text": "Always use secure communication for Azure where possible", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", - "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", - "service": "AKS", + "category": "Networking", + "checklist": "Azure Arc Review", + "description": "All extensions (like log analytics etc.) have separate network requirements, be sure to include all in the network design.", + "guid": "a264f9a1-9bf3-49d9-9d44-c7c8919ca1f6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/hybrid/arc-enabled-servers/eslz-arc-servers-connectivity#define-extensions-connectivity-method", "services": [ - "AKS" + "PrivateLink", + "Monitor", + "Arc" ], "severity": "Low", - "subcategory": "Operations", - "text": "If required add your own CNI plugin", + "subcategory": "Networking", + "text": "Include communication for Azure Arc-enabled Servers extensions in the design (firewall/proxy/private link)", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "guid": "ac6aae01-e6a8-44de-9df4-7d2d92881b1c", + "link": "https://learn.microsoft.com/azure/governance/policy/", "services": [ - "AKS" + "AzurePolicy", + "Arc" ], - "severity": "Low", - "subcategory": "Operations", - "text": "If required configure Public IP per node in AKS", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Management", + "text": "Use Azure Policy to implement a governance model for hybrid connected servers", + "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", - "link": "https://learn.microsoft.com/azure/aks/concepts-network", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "guid": "5c2a3649-4b69-4bad-98aa-d53cc78e1d76", + "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", "services": [ - "AKS" + "Arc" ], "severity": "Medium", - "subcategory": "Scalability", - "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services", - "waf": "Reliability" + "subcategory": "Management", + "text": "Consider using Machine configurations for in guest OS configurations", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", - "link": "https://learn.microsoft.com/azure/aks/nat-gateway", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "guid": "667357c4-4967-44c5-bd85-b859c7733be2", + "link": "https://learn.microsoft.com/azure/governance/machine-configuration/machine-configuration-create", "services": [ - "AKS" + "AzurePolicy", + "Arc" ], - "severity": "Low", - "subcategory": "Scalability", - "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Management", + "text": "Evaluate the need for custom Guest Configuration policies", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "guid": "49674c5e-d85b-4859-a773-3be2a1a27b77", + "link": "https://learn.microsoft.com/azure/automation/change-tracking/overview", "services": [ - "AKS" + "Monitor", + "Arc" ], "severity": "Medium", - "subcategory": "Scalability", - "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion", - "waf": "Reliability" + "subcategory": "Monitoring", + "text": "Consider using change tracking for tracking changes made on the servers", + "waf": "Operations" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", - "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", - "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "guid": "d5d1e54a-2965-49e3-a58f-d78289c93555", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/data-residency", "services": [ - "AKS", - "NVA" + "Arc" ], - "severity": "High", - "subcategory": "Security", - "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it", + "severity": "Medium", + "subcategory": "Requirements", + "text": "Make sure to use an Azure region for storing the metadata approved by the organization", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", - "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", - "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "guid": "195abb91-a4ed-490d-ae2c-c84c37b6b780", + "link": "https://learn.microsoft.com/azure/key-vault/general/basic-concepts", "services": [ - "AKS" + "AKV", + "Arc" ], "severity": "Medium", - "subcategory": "Security", - "text": "If using a public API endpoint, restrict the IP addresses that can access it", + "subcategory": "Secrets", + "text": "Use Azure Key Vault for certificate management on servers", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", - "link": "https://learn.microsoft.com/azure/aks/private-clusters", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "description": "Consider using a short-lived Azure AD service principal client secrets.", + "guid": "6d02bfe4-564b-40d8-94a3-48726ee79d6b", + "link": "https://learn.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret", "services": [ - "AKS" + "Storage", + "Entra", + "AKV", + "Arc" ], "severity": "High", - "subcategory": "Security", - "text": "Use private clusters if your requirements mandate it", + "subcategory": "Secrets", + "text": "What is the acceptable life time of the secret used by SP's", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "description": "A private key is saved to the disk, ensure this is protected using disk encryption", + "guid": "a1a27b77-5a91-4be1-b388-ff394c2bd463", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#using-disk-encryption", "services": [ - "AKS", - "AzurePolicy" + "AKV", + "Arc" ], "severity": "Medium", - "subcategory": "Security", - "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ", + "subcategory": "Secrets", + "text": "Secure the public key for Azure Arc-enabled Servers", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", - "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "description": "Local administrator is required to install the Connected Machine Agent on Windows and Linux systems", + "guid": "29659e39-58fd-4782-a9c9-35556d02bfe4", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-portal#install-manually", "services": [ - "AKS", - "AzurePolicy" + "Arc" ], "severity": "High", "subcategory": "Security", - "text": "Enable a Kubernetes Network Policy option (Calico/Azure)", + "text": "Ensure there is local administrator access for executing the agent installation", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "description": "Members of the local administrator group on Windows and users with root privileges on Linux, have permissions to manage the agent via command line.", + "guid": "564b0d83-4a34-4872-9ee7-9d6b5c2a3649", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#agent-security-and-permissions", "services": [ - "AKS", - "AzurePolicy" + "Arc" ], - "severity": "High", + "severity": "Medium", "subcategory": "Security", - "text": "Use Kubernetes network policies to increase intra-cluster security", + "text": "Limit the amount of users with local administrator rights to the servers", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "guid": "4b69bad3-8aad-453c-a78e-1d76667357c4", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication", "services": [ - "AKS", - "WAF" + "Entra", + "Arc" ], - "severity": "High", + "severity": "Medium", "subcategory": "Security", - "text": "Use a WAF for web workloads (UIs or APIs)", + "text": "Consider using and restricting access to managed identities for applications.", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", - "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "description": "Use Defender for Endpoint or another AV and EDR solution to protect endpoints", + "guid": "5a91be1f-388f-4f39-9c2b-d463cbbbc868", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", "services": [ - "AKS", - "VNet", - "DDoS" + "Defender", + "Arc" ], "severity": "Medium", "subcategory": "Security", - "text": "Use DDoS Standard in the AKS Virtual Network", + "text": "Enable Defender for Servers for all servers to secure hybrid workloads from threats", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", - "link": "https://learn.microsoft.com/azure/aks/http-proxy", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "guid": "cbafe6c4-6589-4d45-9a92-7c3974d1102c", "services": [ - "AKS" + "Arc" ], - "severity": "Low", + "severity": "Medium", "subcategory": "Security", - "text": "If required add company HTTP Proxy", + "text": "Define controls to detect security misconfigurations and track compliance", "waf": "Security" }, { - "category": "Network Topology and Connectivity", - "checklist": "Azure AKS Review", - "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", - "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", - "service": "AKS", + "category": "Security, Governance and Compliance", + "checklist": "Azure Arc Review", + "guid": "cbbbc868-195a-4bb9-8a4e-d90dae2cc84c", + "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#extension-allowlists-and-blocklists", "services": [ - "AKS" + "Arc" ], "severity": "Medium", "subcategory": "Security", - "text": "Consider using a service mesh for advanced microservice communication management", + "text": "Use allow- or block-lists to control what extensions can be installed on the Azure Arc-enabled servers", "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", - "service": "AKS", - "services": [ - "AKS", - "Monitor" - ], - "severity": "High", - "subcategory": "Alerting", - "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", - "waf": "Operations" - }, - { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "337453a3-cc63-4963-9a65-22ac19e80696", - "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", - "service": "AKS", - "services": [ - "AKS", - "Entra" - ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Check regularly Azure Advisor for recommendations on your cluster", - "waf": "Operations" - }, - { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", - "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", - "service": "AKS", - "services": [ - "AKS" - ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Enable AKS auto-certificate rotation", - "waf": "Operations" - }, - { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", - "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", - "service": "AKS", + "category": "BC and DR", + "checklist": "Azure Data Explorer Review Checklist", + "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage", + "guid": "ba7da7be-9951-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export", + "service": "Azure Data Explorer", "services": [ - "AKS" + "Storage", + "Cost" ], - "severity": "High", - "subcategory": "Compliance", - "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature", - "waf": "Operations" + "subcategory": "Replication", + "text": "Leverage External Tables and Continuous data export overview to reduce costs", + "waf": "Reliability" }, - { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", - "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", - "service": "AKS", + { + "category": "BC and DR", + "checklist": "Azure Data Explorer Review Checklist", + "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.", + "guid": "56a22586-f490-4641-addd-ea8a377cdeb3", + "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp", + "service": "Azure Data Explorer", "services": [ - "AKS" + "Storage" ], - "severity": "High", - "subcategory": "Compliance", - "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade", - "waf": "Operations" + "subcategory": "Replication", + "text": "To share data, explore Leader-follower cluster configuration", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", - "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", - "service": "AKS", + "category": "BC and DR", + "checklist": "Azure Data Explorer Review Checklist", + "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.", + "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters", + "service": "Azure Data Explorer", "services": [ - "AKS" + "ASR" ], - "severity": "High", - "subcategory": "Compliance", - "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)", - "waf": "Operations" + "subcategory": "Replication", + "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", - "service": "AKS", + "category": "BC and DR", + "checklist": "Azure Data Explorer Review Checklist", + "guid": "436b0635-cb45-4e57-a603-324ace8cc123", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities", + "service": "Azure Data Explorer", "services": [ - "AKS" + "Storage", + "RBAC" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters", - "waf": "Operations" + "subcategory": "Replication", + "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "d7672c26-7602-4482-85a4-14527fbe855c", - "link": "https://learn.microsoft.com/azure/aks/command-invoke", - "service": "AKS", + "category": "BC and DR", + "checklist": "Azure Data Explorer Review Checklist", + "guid": "18ca6017-0265-4f4b-a46a-393af7f31728", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution", + "service": "Azure Data Explorer", + "services": [], + "subcategory": "Replication", + "text": "Ingest data into each cluster in parallel", + "waf": "Reliability" + }, + { + "category": "BC and DR", + "checklist": "Azure Data Explorer Review Checklist", + "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.", + "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration", + "service": "Azure Data Explorer", "services": [ - "AKS" + "ACR" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Consider using AKS command invoke on private clusters", - "waf": "Operations" + "subcategory": "DR Configuration", + "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", - "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", - "service": "AKS", + "category": "BC and DR", + "checklist": "Azure Data Explorer Review Checklist", + "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.", + "guid": "563a4dc7-4a74-48b6-922a-d190916a6649", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration", + "service": "Azure Data Explorer", "services": [ - "AKS" + "ACR" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "For planned events consider using Node Auto Drain", - "waf": "Operations" + "subcategory": "DR Configuration", + "text": "For critical applications, create Active-Active configuration in two paired regions", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", - "link": "https://learn.microsoft.com/azure/aks/faq", - "service": "AKS", + "category": "BC and DR", + "checklist": "Azure Data Explorer Review Checklist", + "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.", + "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration", + "service": "Azure Data Explorer", + "services": [], + "subcategory": "DR Configuration", + "text": "For applications, which required only read during failure, create Active-Hot standby configuration", + "waf": "Reliability" + }, + { + "category": "BC and DR", + "checklist": "Azure Data Explorer Review Checklist", + "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.", + "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration", + "service": "Azure Data Explorer", "services": [ - "AKS" + "Storage", + "ASR", + "AzurePolicy", + "Cost" ], - "severity": "High", - "subcategory": "Compliance", - "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')", - "waf": "Operations" + "subcategory": "DR Configuration", + "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", - "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "category": "Operations Management", + "checklist": "Azure Data Explorer Review Checklist", + "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.", + "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757", + "link": "https://learn.microsoft.com/azure/data-explorer/devops", + "service": "Azure Data Explorer", "services": [ - "AKS" + "AzurePolicy" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Use custom Node RG (aka 'Infra RG') name", - "waf": "Operations" + "subcategory": "IaC", + "text": "Wrap DevOps and source control around all your code", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", - "link": "https://kubernetes.io/docs/setup/release/notes/", - "service": "AKS", + "category": "Operations Management", + "checklist": "Azure Data Explorer Review Checklist", + "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780", + "link": "https://learn.microsoft.com/azure/data-explorer/devops", + "service": "Azure Data Explorer", + "services": [], + "subcategory": "IaC", + "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.", + "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Azure Data Explorer Review Checklist", + "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18", + "link": "https://learn.microsoft.com/azure/data-explorer/devops", + "service": "Azure Data Explorer", + "services": [], + "subcategory": "IaC", + "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "waf": "Reliability" + }, + { + "category": "Operations Management", + "checklist": "Identity Review Checklist", + "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", + "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", + "service": "Entra", "services": [ - "AKS" + "Entra" ], "severity": "Medium", - "subcategory": "Compliance", - "text": "Do not use deprecated Kubernetes APIs in your YAML manifests", - "waf": "Operations" + "subcategory": "Entra ID", + "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", - "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", - "service": "AKS", + "category": "Operations Management", + "checklist": "Identity Review Checklist", + "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", + "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", + "service": "AAD B2C", "services": [ - "AKS" + "Entra" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Taint Windows nodes", - "waf": "Operations" + "severity": "Medium", + "subcategory": "AAD B2C", + "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", - "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", - "service": "AKS", + "category": "Operations Management", + "checklist": "Identity Review Checklist", + "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", + "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", + "service": "AAD B2C", "services": [ - "AKS" + "Entra" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "Keep windows containers patch level in sync with host patch level", - "waf": "Operations" + "severity": "Medium", + "subcategory": "AAD B2C", + "text": "Custom brand assets should be hosted on a CDN", + "waf": "Performance" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "description": "Via Diagnostic Settings at the cluster level", - "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", - "link": "https://learn.microsoft.com/azure/aks/monitor-aks", - "service": "AKS", + "category": "Operations Management", + "checklist": "Identity Review Checklist", + "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", + "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", + "service": "AAD B2C", "services": [ - "AKS", - "Monitor" + "Entra" ], "severity": "Low", - "subcategory": "Compliance", - "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution", - "waf": "Operations" + "subcategory": "AAD B2C", + "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", - "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", - "service": "AKS", + "category": "Operations Management", + "checklist": "Identity Review Checklist", + "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "services": [ - "AKS" + "Entra", + "VM" ], - "severity": "Low", - "subcategory": "Compliance", - "text": "If required use nodePool snapshots", - "waf": "Cost" + "severity": "Medium", + "subcategory": "Windows Server AD", + "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", - "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", - "service": "AKS", + "category": "Operations Management", + "checklist": "Identity Review Checklist", + "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "services": [ - "AKS", - "Cost" + "Entra" ], - "severity": "Low", - "subcategory": "Cost", - "text": "Consider spot node pools for non time-sensitive workloads", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Windows Server AD", + "text": "Don't replicate! Replication can create issues with directory synchronization", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", - "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "category": "Operations Management", + "checklist": "Identity Review Checklist", + "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "services": [ - "AKS", - "Cost" + "Entra" ], - "severity": "Low", - "subcategory": "Cost", - "text": "Consider AKS virtual node for quick bursting", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Windows Server AD", + "text": "Have active-active for multi-regions", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", + "category": "Operations Management", + "checklist": "Identity Review Checklist", + "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "services": [ - "AKS", - "Monitor" + "Entra" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Entra Domain Services", + "text": "Add Azure AD Domain service stamps to additional regions and locations", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", - "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", + "category": "Operations Management", + "checklist": "Identity Review Checklist", + "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "services": [ - "AKS", - "Monitor" + "Entra" ], - "severity": "High", - "subcategory": "Monitoring", - "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Entra Domain Services", + "text": "Use Replica Sets for DR", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.", + "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs", + "service": "VMSS", "services": [ - "AKS", - "Monitor" + "VM" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Monitor CPU and memory utilization of the nodes", - "waf": "Operations" + "severity": "Low", + "subcategory": "VM Scale Sets", + "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "1a4835ac-9422-423e-ae80-b123081a5417", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).", + "guid": "4d874a74-8b66-42d6-b150-512a66498f6d", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction", + "service": "VM", "services": [ - "AKS", - "Monitor" + "VM", + "Backup" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "If using Azure CNI, monitor % of pod IPs consumed per node", - "waf": "Operations" + "severity": "High", + "subcategory": "Virtual Machines", + "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady", - "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", - "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%", + "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "VM", "services": [ - "AKS", - "EventHubs", - "Monitor", - "ServiceBus", - "Storage" + "VM" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "Monitor OS disk queue depth in nodes", - "waf": "Operations" + "severity": "High", + "subcategory": "Virtual Machines", + "text": "Use Premium or Ultra disks for production VMs", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "be209d39-fda4-4777-a424-d116785c2fa5", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.", + "guid": "b31e38c3-f298-412b-8363-cffe179b599d", + "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview", + "service": "VM", "services": [ - "AKS", - "NVA", - "LoadBalancer", - "Monitor" + "VM" ], - "severity": "Medium", - "subcategory": "Monitoring", - "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports", - "waf": "Operations" + "severity": "High", + "subcategory": "Virtual Machines", + "text": "Ensure Managed Disks are used for all VMs", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", - "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.", + "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4", + "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk", + "service": "VM", "services": [ - "AKS", - "Monitor" + "Storage", + "VM", + "SQL" ], "severity": "Medium", - "subcategory": "Monitoring", - "text": "Subscribe to resource health notifications for your AKS cluster", - "waf": "Operations" + "subcategory": "Virtual Machines", + "text": "Do not use the Temp disk for anything that is not acceptable to be lost", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.", + "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", "services": [ - "AKS" + "Storage", + "ACR", + "VM" ], - "severity": "High", - "subcategory": "Resources", - "text": "Configure requests and limits in your pod specs", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Virtual Machines", + "text": "Leverage Availability Zones for your VMs in regions where they are supported", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "769ef669-1a48-435a-a942-223ece80b123", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.", + "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "VM", "services": [ - "AKS" + "VM" ], "severity": "Medium", - "subcategory": "Resources", - "text": "Enforce resource quotas for namespaces", - "waf": "Operations" + "subcategory": "Virtual Machines", + "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "081a5417-4158-433e-a3ad-3c2de733165c", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)", + "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", "services": [ - "AKS", - "Subscriptions" + "ASR", + "VM" ], "severity": "High", - "subcategory": "Resources", - "text": "Ensure your subscription has enough quota to scale out your nodepools", - "waf": "Operations" + "subcategory": "Virtual Machines", + "text": "Avoid running a production workload on a single VM", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65", - "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.", + "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", "services": [ - "AKS" + "ASR", + "AVS", + "VM" ], "severity": "High", - "subcategory": "Resources", - "text": "Configure Liveness and Readiness probes for all deployments", - "waf": "Operations" + "subcategory": "Virtual Machines", + "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", - "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.", + "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d", + "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview", + "service": "VM", "services": [ - "AKS" + "VM" + ], + "severity": "Low", + "subcategory": "Virtual Machines", + "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity", + "waf": "Reliability" + }, + { + "category": "Compute", + "checklist": "Resiliency Review", + "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.", + "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666", + "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests", + "service": "VM", + "services": [ + "ASR", + "VM" ], "severity": "Medium", - "subcategory": "Scalability", - "text": "Use the Cluster Autoscaler", - "waf": "Performance" + "subcategory": "Virtual Machines", + "text": "Increase quotas in DR region before testing failover with ASR", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", - "guid": "831c2872-c693-4b39-a887-a561bada49bc", - "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", - "service": "AKS", + "category": "Compute", + "checklist": "Resiliency Review", + "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.", + "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events", + "service": "VM", "services": [ - "AKS" + "VM" ], "severity": "Low", - "subcategory": "Scalability", - "text": "Customize node configuration for AKS node pools", - "waf": "Performance" + "subcategory": "Virtual Machines", + "text": "Utilize Scheduled Events to prepare for VM maintenance", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "category": "Data", + "checklist": "Resiliency Review", + "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.", + "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Azure Storage", "services": [ - "AKS" + "Storage" ], "severity": "Medium", - "subcategory": "Scalability", - "text": "Use the Horizontal Pod Autoscaler when required", - "waf": "Performance" + "subcategory": "Storage Accounts", + "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity", - "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", - "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", - "service": "AKS", + "category": "Data", + "checklist": "Resiliency Review", + "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.", + "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", "services": [ - "AKS" + "Storage" ], - "severity": "High", - "subcategory": "Scalability", - "text": "Consider an appropriate node size, not too large or too small", - "waf": "Performance" + "severity": "Low", + "subcategory": "Storage Accounts", + "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", - "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", - "service": "AKS", + "category": "Data", + "checklist": "Resiliency Review", + "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.", + "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", "services": [ - "AKS" + "Storage" ], "severity": "Low", - "subcategory": "Scalability", - "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster", - "waf": "Performance" + "subcategory": "Storage Accounts", + "text": "Enable soft delete for Storage Account Containers", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", - "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", - "service": "AKS", + "category": "Data", + "checklist": "Resiliency Review", + "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.", + "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", "services": [ - "AKS" + "Storage" ], "severity": "Low", - "subcategory": "Scalability", - "text": "Consider subscribing to EventGrid Events for AKS automation", - "waf": "Performance" + "subcategory": "Storage Accounts", + "text": "Enable soft delete for blobs", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", - "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", - "service": "AKS", + "category": "General", + "checklist": "Resiliency Review", + "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.", + "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about", + "service": "Azure Backup", "services": [ - "AKS" + "Backup" ], - "severity": "Low", - "subcategory": "Scalability", - "text": "For long running operation on an AKS cluster consider event termination", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Backup", + "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", - "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", - "service": "AKS", + "category": "General", + "checklist": "Resiliency Review", + "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.", + "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae", + "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept", + "service": "Azure Backup", "services": [ - "AKS" + "Backup" ], "severity": "Low", - "subcategory": "Scalability", - "text": "If required consider using Azure Dedicated Hosts for AKS nodes", - "waf": "Performance" + "subcategory": "Backup", + "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", - "guid": "24367b33-6971-45b1-952b-eee0b9b588de", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "category": "General", + "checklist": "Resiliency Review", + "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.", + "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault", + "service": "Azure Backup", "services": [ - "AKS", - "Storage" + "Storage", + "Backup" ], - "severity": "High", - "subcategory": "Storage", - "text": "Use ephemeral OS disks", - "waf": "Performance" + "severity": "Low", + "subcategory": "Backup", + "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "AKS", + "category": "General", + "checklist": "Resiliency Review", + "description": "Clearly define your organization's business continuity and disaster recovery requirements for your Azure environment. This includes identifying the critical applications, data, and services that need to be protected, as well as specifying the desired recovery objectives and strategies.", + "guid": "72e52e36-11dd-458c-9a4b-1521e43a58a9", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-business-continuity-disaster-recovery", "services": [ - "AKS", - "Storage" + "ASR" ], "severity": "High", - "subcategory": "Storage", - "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds", - "waf": "Performance" + "subcategory": "Design", + "text": "Define business continuity and disaster recovery requirements", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", - "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", - "service": "AKS", - "services": [ - "AKS", - "Storage" - ], - "severity": "Low", - "subcategory": "Storage", - "text": "For hyper performance storage option use Ultra Disks on AKS", - "waf": "Performance" + "category": "General", + "checklist": "Resiliency Review", + "description": "Ensure that your Azure architectures are designed with a focus on reliability. Consider implementing fault-tolerant mechanisms, redundancy, and resiliency patterns to minimize the impact of failures and maximize the availability of your applications and services.", + "guid": "c2399c4d-7b67-4d0c-9555-62f2b3e4563a", + "link": "https://learn.microsoft.com/azure/architecture/reliability/architect", + "services": [], + "severity": "High", + "subcategory": "Design", + "text": "Implement reliability best practices in Azure architectures", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", - "service": "AKS", + "category": "General", + "checklist": "Resiliency Review", + "description": "IaC configurations can play a role in your disaster recovery plan, particularly in situations where recovery time is not time-sensitive. In the event of infrastructure recreation in a second region, IaC can be used to reproduce the necessary infrastructure.", + "guid": "fe237de2-43b1-46c3-8d7a-a9b7570449aa", + "link": "https://learn.microsoft.com/azure/well-architected/devops/automation-infrastructure", "services": [ - "AKS", - "SQL", - "Storage" + "ASR", + "RBAC" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", - "waf": "Performance" + "subcategory": "DevOps", + "text": "Implement Infrastructure as Code (IaC) for Rapid Infrastructure Recovery", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", - "service": "AKS", + "category": "General", + "checklist": "Resiliency Review", + "description": "Azure offers region pairs that are geographically separated and can be used for cross-region replication and disaster recovery. These region pairs provide redundancy and protection against regional or large-scale disasters.", + "guid": "dcb1f7d5-769a-4e56-aba3-8d4a85e2213d", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", "services": [ - "AKS", - "Storage" + "ASR" ], "severity": "Medium", - "subcategory": "Storage", - "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons", - "waf": "Performance" + "subcategory": "Multi-region", + "text": "Plan for cross-region recovery by leveraging region pairs", + "waf": "Reliability" }, { - "category": "Operations", - "checklist": "Azure AKS Review", - "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", - "service": "AKS", + "category": "Network", + "checklist": "Resiliency Review", + "description": "By deploying an Application Gateway with a minimum instance count of two, you will have at least two instances available under normal circumstances. In the event that one of the instances encounters a problem, the other instance will handle the traffic while a new instance is being created. This approach significantly reduces the risk of service disruption and ensures a seamless experience for your users.", + "guid": "93c76286-37a5-451c-9b04-e4f1854387e5", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant#autoscaling-and-high-availability", "services": [ - "AKS", - "Storage" + "AppGW" ], "severity": "Medium", - "subcategory": "Storage", - "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones", - "waf": "Performance" + "subcategory": "Application Gateways", + "text": "Deploy Application Gateways with a minimum instance count of 2 to avoid instance provisioning downtime", + "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Logic Apps checklist", - "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", - "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", - "service": "Logic Apps", - "services": [], + "category": "Network", + "checklist": "Resiliency Review", + "description": "The v2 SKU offers several advantages and critical new features that enhance the availability and resilience of your application infrastructure. One notable feature supported by the v2 SKU is zone redundancy, which allows an Application Gateway deployment to span multiple Availability Zones.", + "guid": "ced126cd-032a-4f5b-8fc6-998a535e3378", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "services": [ + "Storage", + "AppGW" + ], "severity": "High", - "subcategory": "High Availability", - "text": "Select the right Logic App hosting plan based on your business & SLO requirements", + "subcategory": "Application Gateways", + "text": "Deploy Azure Application Gateway v2 for zone redundancy support", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Logic Apps checklist", - "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", - "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "Logic Apps", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Protect logic apps from region failures with zone redundancy and availability zones", + "category": "Network", + "checklist": "Resiliency Review", + "description": "Azure Front Door provides automatic failover capabilities, ensuring continuity in the event of a primary region becoming unavailable. However, during the failover process, there may be a brief period (typically 20-60 seconds) when clients cannot reach the application. It is essential to review the Azure Front Door service level agreement (SLA) to determine whether relying solely on Front Door meets your business requirements for high availability. ", + "guid": "97e31c67-d68c-4f6a-92a1-194956d697dc", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/app-service-web-app/multi-region#azure-front-door", + "services": [ + "FrontDoor" + ], + "severity": "Low", + "subcategory": "Azure Front Door", + "text": "Consider a redundant traffic management solution in conjunction with Azure Front Door", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Logic Apps checklist", - "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", - "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Logic Apps", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Consider a Cross-Region DR strategy for critical workloads", + "category": "Network", + "checklist": "Resiliency Review", + "description": "By implementing Traffic Manager, you can configure it to continuously monitor the health of your application endpoints and automatically redirect traffic to an alternate endpoint when necessary. This automation minimizes downtime and provides a more seamless experience for your users during disaster recovery scenarios.", + "guid": "8df03a82-2cd4-463c-abbc-8ac299ebc92a", + "link": "https://learn.microsoft.com/azure/networking/disaster-recovery-dns-traffic-manager", + "services": [ + "ASR", + "TrafficManager", + "DNS", + "Monitor" + ], + "severity": "Low", + "subcategory": "DNS", + "text": "Plan for automated failover using Traffic Manager for DNS Traffic", "waf": "Reliability" }, { - "category": "BC and DR", - "checklist": "Logic Apps checklist", - "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", - "link": "https://learn.microsoft.com/azure/app-service/environment/intro", - "service": "Logic Apps", + "category": "Network", + "checklist": "Resiliency Review", + "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.", + "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146", + "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", + "service": "DNS", "services": [ - "AppSvc" + "ASR", + "ACR", + "DNS" ], - "severity": "High", - "subcategory": "High Availability", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "severity": "Low", + "subcategory": "DNS", + "text": "Implement DNS Failover using Azure DNS Private Resolvers", "waf": "Reliability" }, { - "category": "Application Deployment", - "checklist": "Logic Apps checklist", - "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", - "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", - "service": "Logic Apps", - "services": [], + "category": "Network", + "checklist": "Resiliency Review", + "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.", + "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103", + "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters", + "service": "Data Gateways", + "services": [ + "ACR" + ], "severity": "Medium", - "subcategory": "CI/CD", - "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", - "waf": "Operations" + "subcategory": "Data Gateways", + "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "When you are creating a SQL Server on Azure VM, carefully consider the type of workload necessary. If you are migrating an existing environment, collect a performance baseline to determine your SQL Server on Azure VM requirements. If this is a new VM, then create your new SQL Server VM based on your vendor requirements.", - "guid": "1fc3fc14-eea6-4e69-b8d9-a3eec218e687", - "link": "https://learn.microsoft.com/sql/dma/dma-sku-recommend-sql-db?view=sql-server-ver16", + "category": "Network", + "checklist": "Resiliency Review", + "description": "When using ExpressRoute, it's important to design for high availability by incorporating redundancy in both the partner and customer networks. This can include multiple ExpressRoute circuits, redundant connections from your network to Microsoft, and ensuring your on-premises network equipment has redundant connections.", + "guid": "c0e7c28d-c936-4657-802b-ff4564b0d934", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", "services": [ - "VM", - "SQL" + "ExpressRoute" ], - "severity": "High", - "subcategory": "VM Size", - "text": "Collect the target workload's performance characteristics and use them to determine the appropriate VM size for your business.", - "waf": "Performance" + "severity": "Medium", + "subcategory": "ExpressRoute", + "text": "Ensure redundancy within both the partner network and customer network when utilizing ExpressRoute for high availability", + "waf": "Reliability" + }, + { + "category": "Network", + "checklist": "Resiliency Review", + "description": "The primary circuit should handle regular traffic while the backup circuit stays ready to take over if the primary circuit fails. Utilize BGP attributes to influence routing and designate your primary and backup circuits effectively.", + "guid": "a359c373-e7dd-4616-83a3-64a907ebae48", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "services": [ + "ExpressRoute", + "Backup" + ], + "severity": "Medium", + "subcategory": "ExpressRoute", + "text": "When using multiple ExpressRoute circuits ensure that routing allows for a primary and backup", + "waf": "Reliability" + }, + { + "category": "Network", + "checklist": "Resiliency Review", + "description": "S2S VPN connection can provide a cost-effective, resilient backup solution in the event of an ExpressRoute circuit failure. By using S2S VPN as a failover, you can maintain connectivity to your Azure resources without relying solely on ExpressRoute.", + "guid": "ead53cc7-de2e-48aa-ab35-71549ab9153d", + "link": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", + "services": [ + "VPN", + "ExpressRoute", + "Cost", + "Backup" + ], + "severity": "Low", + "subcategory": "ExpressRoute", + "text": "Consider deploying site-to-site VPN as a backup for your ExpressRoute private peering", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "The memory optimized virtual machine sizes are a primary target for SQL Server VMs and the recommended choice by Microsoft. The memory optimized virtual machines offer stronger memory-to-CPU ratios and medium-to-large cache options.Consider Ebdsv5-series series first for most SQL Server workloads.", - "guid": "e04abe1f-8d39-4fda-9776-8424c116775c", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-vm-size?view=azuresql#memory-optimized", + "category": "Network", + "checklist": "Resiliency Review", + "description": "Standard Load Balancer SKU offers an SLA of 99.99% and a higher level of service availability compared to the Basic Load Balancer SKU.", + "guid": "778468d5-5a78-45d6-be96-c96ad8844cf3", + "link": "https://learn.microsoft.com/azure/load-balancer/skus", "services": [ - "VM", - "SQL" + "LoadBalancer" ], "severity": "Medium", - "subcategory": "VM Size", - "text": "Use memory optimized virtual machine sizes for the best performance of SQL Server workloads.", - "waf": "Performance" + "subcategory": "Load Balancers", + "text": "Leverage the Standard SKU for Load Balancers that handle traffic to production applications", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "To find the most effective configuration for SQL Server workloads on an Azure VM, start by measuring the storage performance of your business application. Once storage requirements are known, select a virtual machine that supports the necessary IOPS and throughput with the appropriate memory-to-vCore ratio.", - "guid": "2ea55b56-ad48-4408-be72-734b476ba18f", - "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance#counters-to-measure-application-performance-requirements", + "category": "Network", + "checklist": "Resiliency Review", + "description": "By configuring the load balancer with a zone-redundant frontend, it can serve zonal resources in any zone with a single IP address. As long as at least one zone remains healthy within the region, the IP address associated with the frontend can survive one or more zone failures. It is recommended to have multiple zonal resources, such as virtual machines from different zones, in the backend pool of the load balancer. ", + "guid": "b2b38c88-6ba2-4c02-8499-114a5d3ce574", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", "services": [ "VM", - "SQL", - "Storage" + "LoadBalancer" ], - "severity": "Medium", - "subcategory": "Storage", - "text": "Determine storage bandwidth and latency requirements for SQL Server data, log, and tempdb files before choosing the disk type.", - "waf": "Performance" + "severity": "Low", + "subcategory": "Load Balancers", + "text": "For load balancers, consider using a zone-redundant frontend with multiple zonal resources in the backend", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "This provides more dedicated disk IOPS and throughput on the disk level and also allows you to configure the Azure disk host caching setting for each disk to the optimal setting for that data type.", - "guid": "dbf590ce-65de-48e0-9f9c-cbd468266abc", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", + "category": "Network", + "checklist": "Resiliency Review", + "description": "When designing health probes for your Azure Load Balancer, it is important to follow best practices to ensure reliable and accurate monitoring of your backend instances.", + "guid": "dccbd979-2a6b-4cca-8b5f-ea1ebf3dd95d", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-custom-probe-overview#design-guidance", "services": [ - "SQL", - "Storage" + "Monitor", + "LoadBalancer" ], - "severity": "High", - "subcategory": "Storage", - "text": "Place data, log, and tempdb files on separate drives", - "waf": "Performance" + "severity": "Low", + "subcategory": "Load Balancers", + "text": "Select the right protocol, appropriate intervals and timeouts, representative paths and probe responses when defining Load Balancer Health Probes", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Premium SSD is always recommend as a minimum for SQL Server in order to obtain better performance and lower latency. P30 and P40 are recommended because disk caching is not supported for disks 4 TiB and larger ( P50 and above) and they provide the optimal price to performance ratio", - "guid": "e6a84de5-df43-4d19-a248-1718d5d1e5f6", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", + "category": "Network", + "checklist": "Resiliency Review", + "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.", + "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "services": [ - "SQL", - "Storage" + "NVA" ], "severity": "High", - "subcategory": "Storage", - "text": "For the data drive, use premium P30 and P40 or smaller disks to ensure the availability of cache support", - "waf": "Performance" + "subcategory": "NVAs", + "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Log files have primarily write-heavy operations. Therefore, they do not benefit from the ReadOnly cache. Hence evaluate your price vs performance vs capacity and chose the right storage disk.", - "guid": "25659d35-58fd-4772-99c9-31112d027fe4", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", + "category": "Network", + "checklist": "Resiliency Review", + "description": "By deploying VPN Gateways in an active-active mode, you can distribute VPN traffic across multiple gateways, improving reliability and ensuring continuous connectivity in case of failures or maintenance.", + "guid": "927139b8-2110-42db-b6ea-f11e6f843e53", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", "services": [ - "Cost", - "SQL", - "Storage" + "VPN", + "ACR" ], - "severity": "High", - "subcategory": "Storage", - "text": "For the log drive plan for capacity and test performance versus cost while evaluating the premium P30 - P80 disks", - "waf": "Performance" + "severity": "Medium", + "subcategory": "VPN Gateways", + "text": "Deploy Azure VPN Gateways in an active-active mode to ensure high availability and redundancy for your VPN connections.", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Placing TempDB on the D drive can help performance. Consider the size required and always test performance.", - "guid": "12f70983-f630-4472-8ee6-9d6b5c2622f5", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", + "category": "Network", + "checklist": "Resiliency Review", + "description": "Zone-redundant SKUs ensure that your VPN gateways are physically and logically separated within a region, providing resiliency and scalability. This deployment configuration safeguards your on-premises network connectivity to Azure from zone-level failures.", + "guid": "f4722d92-8c1b-41cd-921f-54b29b9de39a", + "link": "https://learn.microsoft.com/azure/vpn-gateway/about-zone-redundant-vnet-gateways", "services": [ - "VM", - "SQL", - "Storage" + "VPN" ], "severity": "Medium", - "subcategory": "Storage", - "text": "Place tempdb on the local ephemeral SSD (default D:\\) drive for most SQL Server workloads that are not part of Failover Cluster Instance (FCI) after choosing the optimal VM size.", - "waf": "Performance" + "subcategory": "VPN Gateways", + "text": "Use zone-redundant SKUs when deploying VPN Gateways to enhance resilience and protect against zone-level failures", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Striping Data and Log disk can increase bandwidth. Ensure that VM size also matches expected output", - "guid": "4b69bad3-4aad-45e8-a78e-1d76667313c4", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", - "services": [ - "VM", - "SQL", - "Storage" - ], + "category": "BC and DR", + "checklist": "Container Apps Review", + "guid": "af416482-663c-4ed6-b195-b44c7068e09c", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support", + "service": "Container Apps", + "services": [], "severity": "High", - "subcategory": "Storage", - "text": "Stripe multiple Azure data disks using Storage Spaces to increase I/O bandwidth", - "waf": "Performance" + "subcategory": "High Availability", + "text": "Leverage Availability Zones if regionally applicable", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Your storage caching policy varies depending on the type of SQL Server data files that are hosted on the drive.Enable Read-only caching for the disks hosting SQL Server data files.Reads from cache will be faster than the uncached reads from the data disk.Set the caching policy to None for disks hosting the transaction log. There is no performance benefit to enabling caching for the Transaction log disk.", - "guid": "05674b5e-985b-4859-a773-e7e261623b77", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", - "services": [ - "AzurePolicy", - "SQL", - "Storage" - ], + "category": "BC and DR", + "checklist": "Container Apps Review", + "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment", + "service": "Container Apps", + "services": [], "severity": "High", - "subcategory": "Storage", - "text": "Set host caching to read-only for data file disks and none for log file disks.", - "waf": "Performance" + "subcategory": "High Availability", + "text": "Use more than one replica and enable Zone Redundancy.", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Check that you storage is in the same region as your VM. For exaplme if your VM is in EAST US 2 ensure your storage is in East US 2.", - "guid": "5a917e1f-348e-4f35-9c27-d42e8bbac868", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", - "services": [ - "VM", - "SQL", - "Storage" - ], + "category": "BC and DR", + "checklist": "Container Apps Review", + "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", + "service": "Container Apps", + "services": [], "severity": "High", - "subcategory": "Storage", - "text": "Provision the storage account in the same region as the SQL Server VM", - "waf": "Performance" + "subcategory": "High Availability", + "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "SQL Server uses extents to store data. These are 64KB in size. Therefore, on a SQL Server machine, the NTFS allocation unit size for hosting SQL database files should be 64 KB.", - "guid": "155abb91-63e9-4908-ae28-c84c33b6b780", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", + "category": "BC and DR", + "checklist": "Container Apps Review", + "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", + "service": "Container Apps", "services": [ - "SQL", - "Storage" + "TrafficManager", + "FrontDoor" ], "severity": "High", - "subcategory": "Storage", - "text": "Format your data disk to use 64 KB block size (allocation unit size) for all data files placed on a drive other than the temporary D:\\ drive", - "waf": "Performance" + "subcategory": "High Availability", + "text": "Use Front Door or Traffic Manager to route traffic to the closest region", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "It is recommended that you determine BCDR needs and requirements ensuring that you are able to meet you SLAs of the environment.", - "guid": "8b9fe5c4-2049-4d41-9a92-3c3474d11028", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#azure-only-disaster-recovery-solutions", - "services": [ - "VM", - "SQL" - ], + "category": "Application Deployment", + "checklist": "Azure Spring Apps Review", + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "service": "Spring Apps", + "services": [], "severity": "Medium", - "subcategory": "HADR", - "text": "Determine HA/DR requirements for each VM to be migrated.", + "subcategory": "DevOps", + "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions", "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "When depoying High Availability you need to use availability sets or availability zones to avoid unexpected outages.", - "guid": "ac6aae01-e6a8-44de-9df4-3d1992481718", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#high-availability-nodes-in-an-availability-set", + "category": "BC and DR", + "checklist": "Azure Spring Apps Review", + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "service": "Spring Apps", "services": [ - "VM", - "SQL" + "ASR", + "TrafficManager", + "FrontDoor" ], - "severity": "High", - "subcategory": "HADR", - "text": "Place your VMs in an availability set or different availability zones.", + "severity": "Medium", + "subcategory": "Disaster Recovery", + "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Prefered option when deploying an Availability Group. The recommended solution is to use multi-subnets when deploying Always on Availability Groups.", - "guid": "d5d1e5f6-2565-49d3-958f-d77249c93111", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-azure-portal-configure?view=azuresql&tabs=azure-cli", + "category": "BC and DR", + "checklist": "Azure Spring Apps Review", + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "service": "Spring Apps", "services": [ - "VM", - "VNet", - "SQL", - "LoadBalancer" + "ACR" ], "severity": "Medium", - "subcategory": "HADR", - "text": "Deploy your SQL Server VMs to multiple subnets whenever possible to avoid the dependency on an Azure Load Balancer or a distributed network name (DNN) to route traffic to your HADR solution. ( If one is implementing FCI or AG)", + "subcategory": "High Availability", + "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "High availability and disaster recovery (HADR) features, such as the Always On availability group and the failover cluster instance rely on underlying Windows Server Failover Cluster technology. Review the best practices for modifying your HADR settings to better support the cloud environment.", - "guid": "2d027fe4-12f7-4098-9f63-04722ee69d6b", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql-vm#hadr-configuration", - "services": [ - "ASR", - "SQL" - ], - "severity": "High", - "subcategory": "HADR", - "text": "Change the cluster to less aggressive parameters to avoid unexpected outages from transient network failures or Azure platform maintenance. ( If one is implementing FCI or AG)", + "category": "BC and DR", + "checklist": "Azure Spring Apps Review", + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "service": "Spring Apps", + "services": [], + "severity": "Medium", + "subcategory": "High Availability", + "text": "Use more than 1 app instance for your apps", "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Ensure that quorum is set correct for the number of instances deployed.", - "guid": "5c2622f5-4b69-4bad-94aa-d5e8c78e1d76", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/hadr-cluster-best-practices?view=azuresql-vm&tabs=windows2012#quorum-voting", + "category": "Operations", + "checklist": "Azure Spring Apps Review", + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "service": "Spring Apps", "services": [ - "SQL" + "Monitor" ], - "severity": "High", - "subcategory": "HADR", - "text": "Configure cluster quorum voting to use 3 or more odd number of votes. Don't assign votes to DR regions. ( If one is implementing FCI or AG)", + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "On Azure virtual machines, clusters use a load balancer to hold an IP address that needs to be on one cluster node at a time. In this solution, the load balancer holds the IP address for the virtual network name (VNN) listener for the Always On availability group when the SQL Server VMs are in a single subnet.", - "guid": "667313c4-0567-44b5-b985-b859c773e7e2", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-vnn-azure-load-balancer-configure?view=azuresql-vm&tabs=ilb", - "services": [ - "VM", - "VNet", - "SQL", - "LoadBalancer" - ], - "severity": "High", - "subcategory": "HADR", - "text": "When using the virtual network name (VNN) and Azure Load Balancer to connect to your HADR solution, specify MultiSubnetFailover = true in the connection string, even if your cluster only spans one subnet. ( If one is implementing FCI or AG)", + "category": "Operations", + "checklist": "Azure Spring Apps Review", + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "service": "Spring Apps", + "services": [], + "severity": "Medium", + "subcategory": "Scalability", + "text": "Set up autoscaling in Spring Cloud Gateway", "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "SQL Server, Azure SQL Database, and Azure SQL Managed Instance support row and page compression for rowstore tables and indexes, and support columnstore and columnstore archival compression for columnstore tables and indexes.", - "guid": "61623b77-5a91-47e1-b348-ef354c27d42e", - "link": "https://learn.microsoft.com/sql/relational-databases/data-compression/data-compression?view=sql-server-ver16", - "services": [ - "SQL", - "Storage" - ], + "category": "Operations", + "checklist": "Azure Spring Apps Review", + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "service": "Spring Apps", + "services": [], "severity": "Low", - "subcategory": "SQL Server", - "text": "Enable database page compression where appropriate.", - "waf": "Performance" + "subcategory": "Scalability", + "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "By default, data and log files are initialized to overwrite any existing data left on the disk from previously deleted files. Data and log files are first initialized by zeroing the files (filling with zeros).In SQL Server, for data files only, instant file initialization (IFI) allows for faster execution of the previously mentioned file operations, since it reclaims used disk space without filling that space with zeros. Instead, disk content is overwritten as new data is written to the files.", - "guid": "8bbac868-155a-4bb9-863e-9908ae28c84c", - "link": "https://learn.microsoft.com/sql/relational-databases/databases/database-instant-file-initialization?view=sql-server-ver16", - "services": [ - "SQL", - "Storage" - ], - "severity": "High", - "subcategory": "SQL Server", - "text": "Enable instant file initialization for data files.", - "waf": "Operations" + "category": "Operations", + "checklist": "Azure Spring Apps Review", + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "service": "Spring Apps", + "services": [], + "severity": "Medium", + "subcategory": "Support", + "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Recommended for best performance and availability migrate all databases to data and log disks", - "guid": "33b6b780-8b9f-4e5c-9204-9d413a923c34", - "link": "https://learn.microsoft.com/sql/relational-databases/databases/move-database-files?view=sql-server-ver16", - "services": [ - "SQL" - ], - "severity": "Medium", - "subcategory": "SQL Server", - "text": "Move all databases to data disks, including system databases.", - "waf": "Operations" + "category": "BC and DR", + "checklist": "IoT Hub Review", + "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", + "service": "IoT", + "services": [], + "severity": "High", + "subcategory": "High Availability", + "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", - "guid": "b824546c-e1ae-4e34-93ae-c8239248725d", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql-vm#sql-server-features", - "services": [ - "VM", - "SQL", - "Storage" - ], - "severity": "Low", - "subcategory": "SQL Server", - "text": "Move SQL Server error log and trace file directories to data disks.", - "waf": "Operations" + "category": "BC and DR", + "checklist": "IoT Hub Review", + "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", + "services": [], + "severity": "Medium", + "subcategory": "High Availability", + "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", - "guid": "d68c5b5c-2925-4394-a69a-9d2799c42bb6", - "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/server-memory-server-configuration-options#use-", - "services": [ - "VM", - "SQL" - ], + "category": "BC and DR", + "checklist": "IoT Hub Review", + "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", + "service": "IoT", + "services": [], "severity": "High", - "subcategory": "SQL Server", - "text": "Set max SQL Server memory limit to leave enough memory for the Operating System.", - "waf": "Performance" + "subcategory": "High Availability", + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", - "guid": "8d1d7555-6246-4b43-a563-b4dc74a748b6", - "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/enable-the-lock-pages-in-memory-option-windows", - "services": [ - "VM", - "SQL" - ], + "category": "BC and DR", + "checklist": "IoT Hub Review", + "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", + "services": [], "severity": "High", - "subcategory": "SQL Server", - "text": "Enable lock pages in memory.", - "waf": "Performance" + "subcategory": "High Availability", + "text": "Learn how to trigger a manual failover.", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", - "guid": "633ad2a0-916a-4664-a8fa-d0e278ee293c", - "link": "https://learn.microsoft.com/sql/relational-databases/performance/monitoring-performance-by-using-the-query-store", - "services": [ - "VM", - "SQL" - ], - "severity": "Low", - "subcategory": "SQL Server", - "text": "Enable Query Store on all production SQL Server databases following best practices.", - "waf": "Performance" + "category": "BC and DR", + "checklist": "IoT Hub Review", + "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", + "service": "IoT", + "services": [], + "severity": "High", + "subcategory": "High Availability", + "text": "Learn how to fail back after a failover.", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", - "guid": "1bc352ba-aab7-4571-a49a-b8093dc9ec9d", - "link": "https://learn.microsoft.com/sql/relational-databases/databases/tempdb-database#optimizing-tempdb-performance-in-sql-server", + "category": "Operations Management", + "checklist": "DNS Review Checklist", + "guid": "a96b96ad-8840-48f3-9273-4c876ba28021", + "link": "https://learn.microsoft.com/azure/dns/private-dns-resiliency", "services": [ - "VM", - "SQL" - ], - "severity": "High", - "subcategory": "SQL Server", - "text": "Ensure that all tempdb best practices are followed.", - "waf": "Performance" + "VNet", + "DNS" + ], + "severity": "High", + "subcategory": "Azure Private DNS", + "text": "Verify that Zones are linked to Vnets in multiple regions", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", - "guid": "1bb73b36-a5a6-47fb-a9ed-5b35478c3479", - "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization", + "category": "Operations Management", + "checklist": "DNS Review Checklist", + "guid": "45901465-d38e-453f-accb-d969266acca2", + "link": "https://learn.microsoft.com/azure/dns/private-dns-resiliency", "services": [ - "VM", - "SQL" + "DNS" ], "severity": "High", - "subcategory": "SQL Server", - "text": "Schedule SQL Server Agent jobs to run DBCC CHECKDB, index reorganize, index rebuild, and update statistics jobs.", - "waf": "Operations" + "subcategory": "Azure Private DNS", + "text": "If different Zones are used between regions, verify a plan for making sure that Zones are up to date in a DR failover situation", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Part of the SQL Server Feature checklist in the link that is recommended when SQL Server Instance is in an Azure VM.", - "guid": "816b2863-cffe-41ca-a599-ef0d5a73dd4c", - "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization", + "category": "Operations Management", + "checklist": "DNS Review Checklist", + "guid": "74faa19b-f39d-495d-94c7-c8919ca1f6d5", + "link": "https://learn.microsoft.com/azure/reliability/reliability-traffic-manager?toc=%2Fazure%2Fdns%2Ftoc.json", "services": [ - "VM", - "SQL" + "ASR", + "TrafficManager", + "DNS" ], "severity": "Medium", - "subcategory": "SQL Server", - "text": "Limit autogrowth of the database and Disable autoshrink", - "waf": "Operations" + "subcategory": "Azure DNS", + "text": "Plan for disaster recovery with Azure DNS and Traffic Manager", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Constrained vCPU virtual machines (VMs) are a type of VM where the vCPU count can be constrained to a half or a quarter of the original VM size. This allows customers to reduce the cost of software licensing while maintaining the same memory, storage, and I/O bandwidth", - "guid": "e36c1c81-770a-4fbc-9c0d-43918648d285", - "link": "https://learn.microsoft.com/azure/virtual-machines/constrained-vcpu", + "category": "Operations Management", + "checklist": "DNS Review Checklist", + "guid": "315ae524-ba34-4d45-a5e1-2139bd7bb012", + "link": "https://learn.microsoft.com/azure/dns/private-resolver-reliability#availability-zones", "services": [ - "VM", - "SQL", - "Cost", - "Storage" + "DNS" ], - "severity": "Low", - "subcategory": "Cost Optimization", - "text": "Optimize SQL Server License cost with Constrained vCPU VM's", - "training": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", - "waf": "Cost" + "severity": "Medium", + "subcategory": "Azure DNS Resolver", + "text": "Enable availability zones with Private Resolver", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Azure Hybrid Benefit allows you to exchange your existing licenses for discounted rates on Azure SQL Database and Azure SQL Managed Instance. Y", - "guid": "7ed67178-b824-4546-ae1a-ee3453aec823", - "link": "https://azure.microsoft.com/en-ca/pricing/hybrid-benefit/", + "category": "Operations Management", + "checklist": "DNS Review Checklist", + "guid": "f7b95e06-e154-4e2a-a359-2828e6e20517", + "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", "services": [ - "Cost", - "SQL" + "ASR", + "DNS" ], - "severity": "Low", - "subcategory": "Cost Optimization", - "text": "Leverage Azure Hybrid benefit to maximize the value of your on premises licenses in the cloud", - "waf": "Cost" + "severity": "Medium", + "subcategory": "Azure DNS Resolver", + "text": "Plan for failover with Private Resolvers in a Disaster Recovery", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "The SQL Server IaaS Agent extension (SqlIaasExtension) runs on SQL Server on Azure Windows Virtual Machines (VMs) to automate management and administration tasks.", - "guid": "9248725d-d68c-45b5-a292-5394a69a9d27", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/sql-agent-extension-automatic-registration-all-vms?view=azuresql-vm&tabs=azure-cli", + "category": "Operations Management", + "checklist": "DNS Review Checklist", + "guid": "2676ae46-691e-4883-9ad9-42223e138105", + "link": "https://learn.microsoft.com/azure/reliability/reliability-virtual-machines?toc=%2Fazure%2Fvirtual-machines%2Ftoc.json&bc=%2Fazure%2Fvirtual-machines%2Fbreadcrumb%2Ftoc.json&tabs=graph", "services": [ - "VM", - "SQL" + "DNS", + "VM" ], "severity": "Medium", - "subcategory": "Azure", - "text": "Register with the SQL IaaS Agent Extension to unlock a number of feature benefits.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Operations" + "subcategory": "VM Based DNS Service", + "text": "Follow VM Guidance for resillency of VM", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Accelerated Networking provides consistent ultra-low network latency via Azure's in-house programmable hardware and technologies", - "guid": "99c42bb6-8d1d-4755-9624-6b438563b4dc", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", + "category": "Operations Management", + "checklist": "DNS Review Checklist", + "guid": "23081a94-1741-4583-9ff7-ad7c6d373316", + "link": "https://www.windows-active-directory.com/azure-ad-dns-for-custom-domain-names-with-advanced-dns-settings.html", "services": [ - "VM", - "SQL" + "Entra", + "DNS", + "VM" ], - "severity": "High", - "subcategory": "Azure", - "text": "Ensure Accelerated Networking is enabled on the virtual machine.", - "waf": "Operations" + "severity": "Medium", + "subcategory": "VM Based DNS Service", + "text": "IF AD based DNS, follow the Identity -> Windows Server AD path", + "waf": "Reliability" }, { - "category": "SQL Server on Azure VM", - "checklist": "SQL Migration Review", - "description": "Microsoft Defender detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases on the SQL server.", - "guid": "74a748b6-633a-4d2a-8916-a66498fad0e2", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls", - "services": [ - "Defender", - "VM", - "SQL" - ], - "severity": "High", - "subcategory": "Azure", - "text": "Leverage Microsoft Defender for Cloud to improve the overall security posture of your virtual machine deployment.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Security" + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687", + "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Best Practices", + "text": "Leverage FTA Resillency Handbook", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "There are some PaaS limitations that are introduced in SQL Managed Instance and some behavior changes compared to SQL Server. It is important to review and understand these differences.", - "guid": "78ee293c-1bc3-452b-aaab-7571849ab809", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/transact-sql-tsql-differences-sql-server?view=azuresql", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", "services": [ - "EventHubs", - "SQL" + "ASR" ], "severity": "High", - "subcategory": "Pre Migration", - "text": "Review the major differences between SQL Server and Managed Instance", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Operations" + "subcategory": "Disaster Recovery", + "text": "Plan for Data Center level outage", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "SQL Managed Instance has characteristics and resource limits that depend on the underlying infrastructure and architecture. It is important to review these limits.", - "guid": "3dc9ec9d-1bb7-43b3-9a5a-67fba9ed5b35", - "link": "https://docs.microsoft.com/azure/azure-sql/managed-instance/resource-limits", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets", + "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", "services": [ - "SQL" + "ASR" ], - "severity": "High", - "subcategory": "Pre Migration", - "text": "Review capacity limits for SQL MI", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Disaster Recovery", + "text": "Practice Failover for BCDR", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "The instance settings between managed instance and your source SQL Server can be different . It is important to review those differences that can impact performance.", - "guid": "8bc178bd-c5a0-46ca-9144-351e19dd3442", - "link": "https://medium.com/azure-sqldb-managed-instance/compare-environment-settings-on-sql-server-and-azure-sql-that-may-impact-performance-e90c21fa9b08", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "97b15b8a-219a-44ab-bb57-879024d22678", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", "services": [ - "SQL" + "Backup" ], "severity": "High", - "subcategory": "Pre Migration", - "text": "Compare instance settings on SQL Server and Azure SQL MI that may impact performance", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "Performance" + "subcategory": "Backup and Restore ", + "text": "Plan a backup strategy and take regular backups", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "Assess on-premises SQL Server instance(s) migrating to Azure SQL Managed Instance. The assessment workflow helps you to detect issues that block the migration itself and also partially supported and unsupported features", - "guid": "9eb72281-37a1-451c-9bb4-e4f1814287d5", - "link": "https://docs.microsoft.com/azure/dms/ads-sku-recommend", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d", + "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet", + "service": "Purview", "services": [ - "SQL" + "EventHubs" ], - "severity": "High", - "subcategory": "Pre Migration", - "text": "Run Data Migration assistant or Azure Data Studio Migration Extension to detect compatibility issues that can impact database functionality on Managed Instance", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Operations" + "severity": "Low", + "subcategory": "Purview Accounts Replications", + "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "The SKU recommendation feature can evaluate the source SQL Server performance and utilization characteristics to recommend a right-sized Azure SQL Managed Instance to assist with your migration journey.", - "guid": "ca8c26c9-b32a-4b5b-afc6-898a135e3378", - "link": "https://learn.microsoft.com/azure/dms/ads-sku-recommend", - "services": [ - "SQL" - ], - "severity": "High", - "subcategory": "Pre Migration", - "text": "Select the right compute resources for your workload by leveraging the SKU recommendation tools.", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Performance" + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b", + "link": "https://learn.microsoft.com/purview/deployment-best-practices", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data catalog", + "text": "Follow Purview accounts architectures and deployment best practices", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "Review Unsupported Features, Migration Blockers and Breaking Changes for each database from the Assessment", - "guid": "97e31c67-d68c-4b69-82ac-19f906d697c8", - "link": "https://learn.microsoft.com/azure/dms/ads-sku-recommend", - "services": [ - "SQL" - ], - "severity": "High", - "subcategory": "Pre Migration", - "text": "Review and address the issues highlighted in DMA/Azure Data Studio", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Operations" + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c", + "link": "https://learn.microsoft.com/purview/concept-best-practices-collections", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data catalog", + "text": "Follow Collection Architectures and best practices", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "The SQL Managed Instance default DNS zone .database.windows.net can be changed with your own. However, the managed instance hostname part of its FQDN should remain the same.", - "guid": "eaded26b-dd18-46f0-ac25-1b999a68af87", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/frequently-asked-questions-faq?view=azuresql-mi#can-a-managed-instance-have-the-same-name-as-a-sql-server-on-premises-instance", - "services": [ - "SQL", - "DNS" - ], - "severity": "High", - "subcategory": "Pre Migration", - "text": "Plan for connection string changes as changing a managed instance name is not supported", - "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", - "waf": "Operations" + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b", + "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data catalog", + "text": "Follow Assest lifecycle best practices", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "There are addional requirements in configuring a vnet and subnet hosting the managed instance.", - "guid": "c9a7f821-b8eb-48c0-aa77-e25e4d5aeaa8", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-existing-add-subnet?view=azuresql-mi", - "services": [ - "VNet", - "SQL" - ], + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed", + "link": "https://learn.microsoft.com/purview/concept-best-practices-automation", + "service": "Purview", + "services": [], "severity": "Medium", - "subcategory": "Pre Migration", - "text": "Review managed instance VNet requirements", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", - "waf": "Operations" + "subcategory": "Data catalog", + "text": "Follow automation best practices", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "Though it's possible to deploy managed instances to a subnet with a number of IP addresses that's less than the output of the subnet formula, always consider using bigger subnets instead. Using a bigger subnet can help avoid future issues stemming from a lack of IP addresses, such as the inability to create additional instances within the subnet or scale existing instances.", - "guid": "dc4e2436-bb33-46d7-85f1-7960eee0b9b5", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/vnet-subnet-determine-size?view=azuresql-mi", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", "services": [ - "VNet", - "SQL" + "Backup" ], - "severity": "High", - "subcategory": "Deployment", - "text": "Ensure managed instance subnet has sufficient IP addresses available", - "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Data catalog", + "text": "Follow Backup and Migration Best practices", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "SQL Managed Instance has characteristics and resource limits that depend on the underlying infrastructure and architecture. SQL Managed Instance can be deployed on multiple hardware configurations.", - "guid": "c8defc4d-721d-431d-850f-b707ae9eab40", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/resource-limits?view=azuresql-mi#service-tier-characteristics", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7", + "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data catalog", + "text": "Follow Purview Glossary Best Practices", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790", + "link": "https://learn.microsoft.com/purview/concept-workflow", + "service": "Purview", + "services": [], + "severity": "Low", + "subcategory": "Data catalog", + "text": "Leverage Workflows ", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e", + "link": "https://learn.microsoft.com/purview/concept-best-practices-security", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data catalog", + "text": "Follow Purview Security Best Practices", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888", + "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data Map", + "text": "Follow Purview Data Lineage Best Practices", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "9579e76b-896e-4710-a7da-7be9956d14d3", + "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data Map", + "text": "Follow Best Practices for Scanning Registered Sources", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed", + "link": "https://learn.microsoft.com/purview/concept-best-practices-classification", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data Map", + "text": "Follow Classification Best Practices in Governance Portal", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69", + "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data Map", + "text": "Perform Sensitivity Labelling in the Purview Data Map", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96", + "link": "https://learn.microsoft.com/purview/concept-data-share", + "service": "Purview", "services": [ - "SQL" + "Storage" ], - "severity": "High", - "subcategory": "Pre Migration", - "text": "Plan between General Purpose and Business Critical tiers of MI", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", - "waf": "Performance" + "severity": "Low", + "subcategory": "Data Sharing", + "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4", + "link": "https://learn.microsoft.com/purview/concept-insights", + "service": "Purview", + "services": [], + "severity": "Low", + "subcategory": "Data Estate", + "text": "Leverage Data Estate Insights", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab", + "link": "https://learn.microsoft.com/purview/catalog-adoption-insights", + "service": "Purview", + "services": [], + "severity": "Low", + "subcategory": "Data Estate", + "text": "Use Data stewardship and Catalog adoption", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581", + "link": "https://learn.microsoft.com/purview/concept-insights", + "service": "Purview", + "services": [], + "severity": "Low", + "subcategory": "Data Estate", + "text": "Use Inventory and Ownership", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9", + "link": "https://learn.microsoft.com/purview/glossary-insights", + "service": "Purview", + "services": [], + "severity": "Low", + "subcategory": "Data Estate", + "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels", + "waf": "Reliability" + }, + { + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "b130a888-9579-4e76-a896-e710a7da7be9", + "link": "https://learn.microsoft.com/purview/compliance-manager", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data Quality ", + "text": "Generate assessment scores", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "The auto-failover groups feature allows you to manage the replication and failover of user databases in a managed instance to a managed instance in another Azure region. Auto-failover groups are designed to simplify deployment and management of geo-replicated databases at scale.", - "guid": "ed329079-8bc1-478b-bc5a-06ca7144351e", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/auto-failover-group-sql-mi?view=azuresql-mi&tabs=azure-powershell", - "services": [ - "SQL" - ], - "severity": "High", - "subcategory": "Pre Migration", - "text": "Based on your RPO/RTO's , determine if Auto failover Group needs to be implemented. If so, plan for the deployment attributes of the second instance.", - "training": "https://learn.microsoft.com/learn/paths/implement-windows-server-iaas-virtual-machine-identity/", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f", + "link": "https://learn.microsoft.com/purview/compliance-manager-scoring", + "service": "Purview", + "services": [], + "severity": "Medium", + "subcategory": "Data Quality ", + "text": "Profiling- get summaries of data content", "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "There are multiple ways to connect your application to the managed instance. Review and understand the pros and cons and decide on the best approach for your application.", - "guid": "5d226886-d30b-466c-97be-595190f83845", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql-mi", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1", + "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts", + "service": "Purview", "services": [ - "SQL" + "AzurePolicy" ], "severity": "Low", - "subcategory": "Pre Migration", - "text": "Review the Connectivity Design between Database and Application, test & validate it", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Operations" + "subcategory": "Data Policy", + "text": "Follow Microsoft Purview Data Owner access policies", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "Compare migration options to choose the path that's appropriate to your business needs.", - "guid": "c586cb29-1ec1-46a1-b076-ef9f141acdce", - "link": "https://learn.microsoft.com/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-overview?view=azuresql-mi#migration-tools", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac", + "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy", + "service": "Purview", "services": [ - "SQL" + "AzurePolicy" ], - "severity": "Medium", - "subcategory": "Pre Migration", - "text": "Plan for the Migration Method. Depending on the DB Size and Application downtime window, select the preferred Migration Method.", - "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", - "waf": "Operations" + "severity": "Low", + "subcategory": "Data Policy", + "text": "Follow Self-service access policies", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "After you verify that data is the same on both source and target, you can cut over from the source to the target environment. It's important to plan the cutover process with business / application teams to ensure minimal interruption during cutover doesn't affect business continuity.", - "guid": "579377bc-db37-451a-a2ac-1fad66e15d4d", - "link": "https://learn.microsoft.com/azure/dms/tutorial-sql-server-managed-instance-online#performing-migration-cutover", + "category": "Operations management", + "checklist": "Microsoft Purview Review Checklist", + "guid": "b49e5b96-0332-44ec-b8cc-13318da61170", + "link": "https://learn.microsoft.com/purview/concept-policies-devops", + "service": "Purview", "services": [ - "SQL" + "AzurePolicy" ], - "severity": "Medium", - "subcategory": "Pre Migration", - "text": "Plan the cutover process with business / application teams to ensure minimal interruption during cutover and it does not affect business continuity.", - "training": "https://learn.microsoft.com/azure/architecture/example-scenario/identity/adds-extend-domain", + "severity": "Low", + "subcategory": "Data Policy", + "text": "Follow DevOps policies", "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "A time zone of a managed instance can be set during instance creation only. The default time zone is UTC", - "guid": "4a2adb1c-3d23-426a-b225-ca44e1695fdd", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/timezones-overview?view=azuresql#set-a-time-zone", - "services": [ - "SQL" - ], + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "guid": "65285269-440c-44be-9d3e-0844276d4bdc", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foudations-playbooks-ADB_v1.docx", + "services": [], "severity": "High", - "subcategory": "Deployment", - "text": "Ensure you customize your time zone setting at the instance creation time. One cannot change it later.", - "training": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "waf": "Operations" + "subcategory": "Best Practices", + "text": "Reference Databricks HA/DR playbook", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "Server-level collation in Azure SQL Managed Instance can be specified when the instance is created and cannot be changed later.Default server-level collation is SQL_Latin1_General_CP1_CI_AS.", - "guid": "deace4cb-1deb-44c6-90c3-fc14eebb3693", - "link": "https://learn.microsoft.com/sql/relational-databases/collations/set-or-change-the-server-collation?view=sql-server-ver16", + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "guid": "89d558b9-37d3-4974-b111-2dbd7aaf12e6", + "link": "https://learn.microsoft.com/azure/databricks/security/secrets/secret-scopes", "services": [ - "SQL" + "Backup" ], - "severity": "High", - "subcategory": "Deployment", - "text": "Ensure you select the right collation setting at the instance creation time. One cannot change it later", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Backup", + "text": "Backup Your Workspace Configuration including ARM templates and Secret Scopes", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "When you're migrating a database protected by Transparent Data Encryption (TDE) to Azure SQL Managed Instance using the native restore option, the corresponding certificate from the SQL Server instance needs to be migrated before database restore.", - "guid": "829e3eec-2183-4687-a007-7a2b5945bda4", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/tde-certificate-migrate?view=azuresql-mi&tabs=azure-powershell", + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "guid": "b94ee5ef-47d2-4d92-a81b-1cd6d1f54b29", + "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/sharing-metadata-across-different-databricks-workspaces-using/ba-p/3679757", "services": [ - "VM", - "SQL" + "ACR", + "Backup" ], "severity": "Medium", - "subcategory": "Deployment", - "text": "For TDE Enabled Database, corresponding certificate from the on-premises or Azure VM SQL Server needs to be migrated before database restore", - "waf": "Operations" + "subcategory": "Backup", + "text": "Share MetaData Across different Databricks Workspaces using Hive External Metastore", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "System databases can be restored only from backups that are created on the version of SQL Server that the server instance is currently running. This is not the case when you are migrating to SQL Managed Instance.Azure PowerShell and DBATools PowerShell libraries enable you to easily script and automate and customize all parts of the migration process.", - "guid": "3334fdf9-1c23-4418-8b65-275269440b4b", - "link": "https://learn.microsoft.com/azure/azure-sql/migration-guides/managed-instance/sql-server-to-managed-instance-guide?view=azuresql-mi#backup-and-restore", + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "guid": "769e3969-0e78-428a-a936-657d03b0f466", + "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/disaster-recovery-strategy-in-azure-databricks-using-the-hive/ba-p/3684581", "services": [ - "Backup", - "SQL" + "ASR", + "Backup" ], - "severity": "Low", - "subcategory": "Migration", - "text": "Restore of system databases is not supported. To migrate instance-level objects (stored in master or msdb databases), we recommend to script them out and run T-SQL scripts on the destination instance.", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Backup", + "text": "Plan Disaster Recovery Strategy in Databricks using the Hive External Metastore", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "When using migration options that continuously replicate / sync data changes from source to the target, the source data and schema can change and drift from the target. During data sync, ensure that all changes on the source are captured and applied to the target during the migration process.", - "guid": "e3d3e084-3276-4d4b-bc01-5bcf219e4a1e", + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "guid": "4b1d944a-3598-437e-b79d-6c6d3a364a5b", + "link": "https://www.databricks.com/blog/2021/04/20/attack-of-the-delta-clones-against-disaster-recovery-availability-complexity.html", "services": [ - "SQL" + "Backup" ], - "severity": "High", - "subcategory": "Migration", - "text": "Ensure that all changes on the source are captured and applied to the target during the migration process.", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Backup", + "text": "Backup your data with deep and shallow clones", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "Ensure that the application is able to succesffuly connect to the managed instance post migration of the databases.", - "guid": "b5887952-5d22-4688-9d30-b66c57be5951", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql-mi", + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "description": "Download the blob using Secondary Endpoint in RAGRS Storage Account", + "guid": "7abae48a-bd54-4cd7-ae2e-86768357c559", + "link": "https://techcommunity.microsoft.com/t5/azure-paas-blog/download-the-blob-using-secondary-endpoint-in-ragrs-storage/ba-p/2403750", "services": [ - "SQL" + "Storage", + "Backup" ], "severity": "Medium", - "subcategory": "Migration", - "text": "Test Application Connectivity to MI and Databases", - "waf": "Operations" + "subcategory": "Backup", + "text": "Backup your data to Azure Storage RA-GRS", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "High availability is a fundamental part of SQL Managed Instance platform that works transparently for your database applications. Failovers from primary to secondary nodes in case of node degradation or fault detection, or during regular monthly software updates are an expected occurrence for all applications using SQL Managed Instance in Azure.", - "guid": "90f83845-c586-4cb2-a1ec-16a1d076ef9f", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/user-initiated-failover?view=azuresql", + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "guid": "675c5ee8-5b85-49c7-944c-e3b1a28b875a", + "link": "https://learn.microsoft.com/azure/databricks/dev-tools/index-ci-cd", "services": [ - "SQL" + "Backup" ], "severity": "High", - "subcategory": "Post Migration", - "text": "Consider executing a manual failover on SQL Managed Instance to test for fault and failover resiliency.", - "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "subcategory": "Backup", + "text": "Backup your code with DevOps", "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "Ensuring that your applications are failover resilient prior to deploying to production will help mitigate the risk of application faults in production and will contribute to application availability for your customers.", - "guid": "141acdce-5793-477b-adb3-751ab2ac1fad", - "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/auto-failover-group-configure-sql-mi?view=azuresql&tabs=azure-portal#test-failover", + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "guid": "a1bf1038-9f03-4a4d-8ce4-63dbbbc8682a", + "link": "https://learn.microsoft.com/azure/databricks/administration-guide/disaster-recovery", "services": [ - "EventHubs", - "SQL", - "LoadBalancer" + "ASR" ], "severity": "High", - "subcategory": "Post Migration", - "text": "If failover groups have been implemented, Test Manual Failover and Failback and test application connectivity behavior during failover/failback", + "subcategory": "Disaster Recovery", + "text": "Plan for Disaster recovery using Active/Active or Active/Passive Configuration", "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "This provides more dedicated disk IOPS and throughput", - "guid": "aa359272-8e6e-4205-8726-76ae46691e88", - "link": "https://techcommunity.microsoft.com/t5/azure-sql-blog/storage-performance-best-practices-and-considerations-for-azure/ba-p/305525", + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "description": "Migration package to log all Databricks resources for backup and/or migrating to another Databricks workspace", + "guid": "5abc92a4-eda1-4dae-8cc8-5c47c6b781cc", + "link": "https://github.com/databrickslabs/migrate", "services": [ - "SQL", - "Storage" + "Backup" ], - "severity": "High", - "subcategory": "Post Migration", - "text": "Optimize Storage Performance for General Purpose Managed Instance", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Performance" + "severity": "Medium", + "subcategory": "Migration", + "text": "Use Databricks Migration tools", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "Many organizations have policies that require that certificates or encryption keys be created and managed internally. If your organization has a similar policy, this architecture might apply to you. If your customers require internal management of these items, the architecture also might apply to you.", - "guid": "35ad9422-23e1-4381-8523-081a94174158", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/data/sql-managed-instance-cmk", - "services": [ - "Backup", - "SQL", - "AzurePolicy", - "AKV" - ], + "category": "Operations Management", + "checklist": "DataBricks Review Checklist", + "guid": "a0e6c465-89d5-458b-a37d-3974d1112dbd", + "link": "https://github.com/databrickslabs/databricks-sync", + "services": [], "severity": "Low", - "subcategory": "Post Migration", - "text": "Enable Customer managed TDE for taking your own copy only full backups", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Security" + "subcategory": "Migration", + "text": "Use Databricks Sync", + "waf": "Reliability" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "The maintenance window feature provides you with the ability to onboard Azure SQL resource to prescheduled time blocks outside of business hours.", - "guid": "33ef7ad7-c6d3-4733-865c-7acbe44bbe60", - "link": "https://learn.microsoft.com/azure/azure-sql/database/planned-maintenance?view=azuresql", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.", + "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e", + "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention", + "service": "ACR", "services": [ - "SQL" + "ACR" ], - "severity": "Medium", - "subcategory": "Post Migration", - "text": "Plan for Azure maintenance events", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Operations" + "severity": "High", + "subcategory": "Data Protection", + "text": "Disable Azure Container Registry image export", + "waf": "Security" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "By using the long-term retention (LTR) feature, you can store specified SQL Database and SQL Managed Instance full backups in Azure Blob storage with configured redundancy for up to 10 years.", - "guid": "9d89f2e8-7778-4424-b516-785c6fa96b96", - "link": "https://learn.microsoft.com/azure/azure-sql/database/long-term-retention-overview?view=azuresql-mi", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry", + "guid": "d503547c-d447-4e82-9128-a7100f1cac6d", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy", + "service": "ACR", "services": [ - "Backup", - "ARS", - "SQL", - "Storage" + "ACR", + "AzurePolicy" ], - "severity": "Low", - "subcategory": "Post Migration", - "text": "Configure Long Term backup retention, view backups and restore from backups", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", - "waf": "Reliability" + "severity": "High", + "subcategory": "Data Protection", + "text": "Enable Azure Policies for Azure Container Registry", + "waf": "Security" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "By using Azure Hybrid Benefit, you can achieve cost savings, modernise and maintain a flexible hybrid environment while optimising business applications.", - "guid": "ad88408f-3727-434c-a76b-a28021459014", - "link": "https://azure.microsoft.com/en-gb/pricing/hybrid-benefit/#overview", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.", + "guid": "d345293c-7639-4637-a551-c5c04e401955", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push", + "service": "ACR", "services": [ - "Cost", - "SQL" + "ACR", + "AKV" ], - "severity": "Low", - "subcategory": "Post Migration", - "text": "Take advantage of Azure Hybrid Benefit and Azure Reservations where applicable.", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "Cost" + "severity": "High", + "subcategory": "Data Protection", + "text": "Sign and Verify containers with notation (Notary v2)", + "waf": "Security" }, { - "category": "SQL Managed Instance", - "checklist": "SQL Migration Review", - "description": "If you don't have threat protection Advanced Threat Protection is part of the Microsoft Defender for SQL offering, which is a unified package for advanced SQL security capabilities.", - "guid": "65d38e53-f9cc-4bd8-9926-6acca274faa1", - "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-overview?view=azuresql", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.", + "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49", + "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys", + "service": "ACR", "services": [ - "Defender", - "SQL" + "ACR", + "AKV" ], "severity": "Medium", - "subcategory": "Post Migration", - "text": "Leverage Microsoft Defender for Cloud to improve the overall security posture", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "subcategory": "Data Protection", + "text": "Encrypt registry with a customer managed key", "waf": "Security" }, { - "category": "BC and DR", - "checklist": "Azure Function Review", - "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Select the right Function hosting plan based on your business & SLO requirements", - "waf": "Reliability" - }, - { - "category": "BC and DR", - "checklist": "Azure Function Review", - "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", - "services": [], - "severity": "High", - "subcategory": "High Availability", - "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)", - "waf": "Reliability" - }, - { - "category": "BC and DR", - "checklist": "Azure Function Review", - "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", - "service": "Azure Functions", - "services": [], - "severity": "Medium", - "subcategory": "High Availability", - "text": "Consider a Cross-Region DR strategy for critical workloads", - "waf": "Reliability" - }, - { - "category": "BC and DR", - "checklist": "Azure Function Review", - "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Azure Functions", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications", + "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", + "service": "ACR", "services": [ - "AppSvc" + "RBAC", + "Entra", + "ACR" ], "severity": "High", - "subcategory": "High Availability", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", - "waf": "Reliability" + "subcategory": "Identity and Access Control", + "text": "Use Managed Identities to connect instead of Service Principals", + "waf": "Security" }, { - "category": "BC and DR", - "checklist": "Azure Function Review", - "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "Azure Functions", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead", + "guid": "be0e38ce-e297-411b-b363-caaab79b198d", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", + "service": "ACR", "services": [ - "AppSvc" + "RBAC", + "Entra", + "ACR" ], "severity": "High", - "subcategory": "High Availability", - "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan", - "waf": "Reliability" + "subcategory": "Identity and Access Control", + "text": "Disable local authentication for management plane access", + "waf": "Security" }, { - "category": "BC and DR", - "checklist": "Azure Function Review", - "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", - "service": "Azure Functions", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations", + "guid": "387e5ced-126c-4d13-8af5-b20c6998a646", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli", + "service": "ACR", "services": [ - "Storage" + "RBAC", + "Entra", + "ACR" ], - "severity": "Medium", - "subcategory": "High Availability", - "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled", - "waf": "Reliability" - }, - { - "category": "Application Deployment", - "checklist": "Azure Function Review", - "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "Azure Functions", - "services": [], - "severity": "Medium", - "subcategory": "CI/CD", - "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code", - "waf": "Operations" + "severity": "High", + "subcategory": "Identity and Access Control", + "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "9f519499-5820-4060-88fe-cab4538c9dd0", - "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/storage-spaces-direct-hardware-requirements", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Disable anonymous pull/push access", + "guid": "e338997e-41c7-47d7-acf6-a62a1194956d", + "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access", + "service": "ACR", "services": [ - "Storage" + "Entra", + "ACR" ], "severity": "Medium", - "subcategory": "Physical", - "text": "All planned storage pools should use direct-attached storage (SATA, SAS, NVMe)", - "waf": "Performance" + "subcategory": "Identity and Access Control", + "text": "Disable Anonymous pull access", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "f7c015e0-7d97-4283-b006-567afeb2b5ca", - "link": "https://learn.microsoft.com/azure-stack/hci/concepts/drive-symmetry-considerations#understand-capacity-imbalance", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token", + "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli", + "service": "ACR", "services": [ - "Storage", + "Entra", "ACR" ], - "severity": "Medium", - "subcategory": "Physical", - "text": "Disks are symmetrical across all nodes", - "waf": "Performance" + "severity": "High", + "subcategory": "Identity and Access Control", + "text": "Disable repository-scoped access tokens", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "f785b143-2c1e-4466-9baa-dde8ba4c7aaa", - "link": "https://learn.microsoft.com/azure-stack/hci/concepts/fault-tolerance#parity", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network", + "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee", + "service": "ACR", "services": [ - "Backup", - "Storage" + "EventHubs", + "Entra", + "ACR", + "PrivateLink" ], - "severity": "Medium", - "subcategory": "S2D", - "text": "Parity type disk redundancy should only be used for low I/O volumes (backup/archive)", - "waf": "Performance" + "severity": "High", + "subcategory": "Identity and Access Control", + "text": "Deploy images from a trusted environment", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "8a705965-9840-43cc-93b3-06d089406bb4", - "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/storage-spaces-direct-hardware-requirements#physical-deployments", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR", + "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy", + "service": "ACR", "services": [ - "Storage" + "Entra", + "ACR", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "S2D", - "text": "Ensure there at least 2 capacity disks with available capacity in the Storage Pool", - "waf": "Reliability" + "subcategory": "Identity and Access Control", + "text": "Disable Azure ARM audience tokens for authentication", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "2a4f629a-d623-4610-a8e3-d6fd66057d8e", - "link": "https://learn.microsoft.com/windows-server/storage/storage-spaces/delimit-volume-allocation", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.", + "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6", + "link": "https://learn.microsoft.com/azure/container-registry/monitor-service", + "service": "ACR", "services": [ - "Storage" + "Entra", + "ACR", + "Monitor" ], - "severity": "Low", - "subcategory": "S2D", - "text": "'Delimited allocation' has been considered to improve volume resiliency in a multi-node failure", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Logging and Monitoring", + "text": "Enable diagnostics logging", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "960eb9be-1f0f-4fc1-9b31-fcf1cf9e34e6", - "link": "https://learn.microsoft.com/azure-stack/hci/concepts/plan-volumes#choosing-how-many-volumes-to-create", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch", + "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", + "service": "ACR", "services": [ - "Storage" + "VNet", + "ACR", + "PrivateLink", + "Firewall" ], "severity": "Medium", - "subcategory": "S2D", - "text": "CSVs are created in multiples of node count", - "waf": "Performance" + "subcategory": "Network Security", + "text": "Control inbound network access with Private Link", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "859ba2b9-a3a8-4ca1-bb61-165effbf1c03", - "link": "https://learn.microsoft.com/azure-stack/hci/concepts/cache", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Disable public network access if inbound network access is secured using Private Link", + "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access", + "service": "ACR", "services": [ - "Storage" + "ACR", + "PrivateLink" ], "severity": "Medium", - "subcategory": "S2D", - "text": "If a cache tier is implemented, the number of capacity drives is a multiple of the number of cache drives", - "waf": "Performance" + "subcategory": "Network Security", + "text": "Disable Public Network access", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "d8a65f05-db06-461d-81dc-7899ad3f8f1e", - "link": "https://learn.microsoft.com/azure-stack/hci/concepts/plan-volumes#reserve-capacity", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Only the ACR Premium SKU supports Private Link access", + "guid": "fc833934-8b26-42d6-ac5f-512925498f6d", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus", + "service": "ACR", "services": [ - "Storage" + "ACR", + "PrivateLink" ], "severity": "Medium", - "subcategory": "S2D", - "text": "A minimum of 1 type of each disk type per node has been factored as a reserve disk", - "waf": "Reliability" + "subcategory": "Network Security", + "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "description": "VMFleet is a tool that can be used to measure the performance of a storage subsystem, best used to baseline performance prior to workload deployment", - "guid": "9d138f1d-5363-476e-bbd7-acfa500bdc0c", - "link": "https://github.com/microsoft/diskspd/wiki/VMFleet", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities", + "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", + "service": "ACR", "services": [ - "Storage" + "ACR", + "Defender" ], "severity": "Low", - "subcategory": "S2D", - "text": "VMFleet has been run prior to workload deployment to baseline storage performance", - "waf": "Performance" + "subcategory": "Network Security", + "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "13c12e2a-c938-4dd1-9223-507d5e17f9c5", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", + "guid": "4451e1a2-d345-4293-a763-9637a551c5c0", + "service": "ACR", "services": [ - "Storage" + "ACR" ], "severity": "Medium", - "subcategory": "Host OS", - "text": "OS drives use a dedicated storage controller", - "waf": "Reliability" + "subcategory": "Vulnerability Management", + "text": "Deploy validated container images", + "waf": "Security" }, { - "category": "Storage", - "checklist": "Azure Stack HCI Review", - "guid": "a631e7dc-8879-45bd-b0a7-e5927b805428", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/use-csv-cache", + "category": "Security", + "checklist": "Azure Container Registry Security Review", + "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", + "guid": "4e401955-387e-45ce-b126-cd132af5b20c", + "service": "ACR", "services": [ - "Storage" + "ACR" ], - "severity": "Medium", - "subcategory": "Host OS", - "text": "CSV in-memory read caching is enabled and properly configured", - "waf": "Performance" + "severity": "High", + "subcategory": "Vulnerability Management", + "text": "Use up-to-date platforms, languages, protocols and frameworks", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "c062cd9a-f1db-4f83-aab3-9cb03f56c140", - "link": "https://learn.microsoft.com/azure-stack/hci/concepts/host-network-requirements#switch-embedded-teaming-set", + "category": "Operations Management", + "checklist": "PostgreSQL Review Checklist", + "guid": "65285269-441c-44bf-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview", + "service": "PostgreSQL", "services": [ - "ACR" + "SQL" ], "severity": "Medium", - "subcategory": "Host", - "text": "NICs are symmetrical across nodes", + "subcategory": "Best Practices", + "text": "Leverage Flexible Server", "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "ea8054db-a558-4533-80c8-5d9cf447ba19", + "category": "Operations Management", + "checklist": "PostgreSQL Review Checklist", + "guid": "016ccf31-ae5a-41eb-9888-9535e227896d", + "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability", + "service": "PostgreSQL", "services": [ - "Storage" + "SQL" ], "severity": "High", - "subcategory": "Host", - "text": "Storage networking is redundant", + "subcategory": "Best Practices", + "text": "Leverage Availability Zones where regionally applicable", "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "15d976c5-e267-49a1-8b00-62010bfa5188", - "link": "https://learn.microsoft.com/azure-stack/hci/deploy/network-atc", - "services": [], + "category": "Operations Management", + "checklist": "PostgreSQL Review Checklist", + "guid": "31b67c67-be59-4519-8083-845d587cb391", + "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas", + "service": "PostgreSQL", + "services": [ + "SQL" + ], "severity": "Medium", - "subcategory": "Host", - "text": "Host networking configuration is managed by Network ATC and intents are healthy", - "waf": "Reliability" - }, - { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "676c53ad-b29a-4de1-9d03-d7d2674405b8", - "link": "https://learn.microsoft.com/azure-stack/hci/concepts/network-hud-overview", - "services": [], - "severity": "Low", - "subcategory": "Host", - "text": "Network HUD has been configured", + "subcategory": "Best Practices", + "text": "Leverage cross-region read replicas for BCDR", "waf": "Reliability" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "8f6d58d9-6c1a-4ec1-b2d7-b2c6ba8f3949", - "link": "https://learn.microsoft.com/azure-stack/hci/concepts/host-network-requirements", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage", + "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", + "service": "Azure Storage", "services": [ - "VNet", "Storage" ], "severity": "Medium", - "subcategory": "Host", - "text": "Storage NICs are assigned static IP addresses on separate subnets and VLANs", - "waf": "Reliability" + "subcategory": " Overview", + "text": "Consider the 'Azure security baseline for storage'", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "824e53ec-953e-40c2-a6b8-52970b5b0f74", - "link": "https://learn.microsoft.com/azure-stack/hci/plan/two-node-switched-converged", - "services": [], - "severity": "Medium", - "subcategory": "Host", - "text": "For switchless designs, dual link full mesh connectivity has been implemented", - "waf": "Reliability" + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet", + "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", + "service": "Azure Storage", + "services": [ + "Storage", + "PrivateLink" + ], + "severity": "High", + "subcategory": "Networking", + "text": "Consider using private endpoints for Azure Storage", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "dbc85d0e-0ebd-4589-a789-0fa8ceb1d0f0", - "link": "https://learn.microsoft.com/azure-stack/hci/concepts/physical-network-requirements#using-switchless", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription", + "guid": "30e37c3e-2971-41b2-963c-eee079b598de", + "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", + "service": "Azure Storage", "services": [ - "Storage" + "Storage", + "RBAC", + "Subscriptions" ], "severity": "Medium", - "subcategory": "Host", - "text": "If the cluster is made up of more than 3 nodes, a switched storage network has been implemented", - "waf": "Reliability" + "subcategory": "Governance", + "text": "Ensure older storage accounts are not using 'classic deployment model'", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "603c6d71-59d2-419c-a312-8edc6e799c6a", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.", + "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", + "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", + "service": "Azure Storage", "services": [ - "Storage" + "Storage", + "Defender" ], "severity": "High", - "subcategory": "Host", - "text": "RDMA is enabled on the Storage networking", - "waf": "Performance" - }, - { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "9e260eae-bca1-4827-a259-76ee63fda8d6", - "link": "https://github.com/microsoft/SDN/blob/master/Diagnostics/Test-Rdma.ps1", - "services": [], - "severity": "Medium", - "subcategory": "Host", - "text": "Test-RDMA.ps1 has been run to validate the RDMA configuration", - "waf": "Performance" + "subcategory": "Governance", + "text": "Enable Microsoft Defender for all of your storage accounts", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "description": "This ensures that Management traffic is not exposed to the VM traffic", - "guid": "abc85d0e-0ebd-4589-a777-0fa8ceb1d0f0", - "link": "", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.", + "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", + "service": "Azure Storage", "services": [ - "VM" + "Storage" ], "severity": "Medium", - "subcategory": "Host", - "text": "If a VMSwitch is shared for Compute and Management traffic, require that Management traffic is tagged with a VLAN ID", + "subcategory": "Data Availability", + "text": "Enable 'soft delete' for blobs", "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "description": "This ensures you have at least 3 NCs active at all times during NC upgrades.", - "guid": "eb36f5f4-0fa7-4a2c-85f3-1b1c7c7817c0", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", + "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", "services": [ - "VM" + "Storage" ], "severity": "Medium", - "subcategory": "SDN", - "text": "There are at least 3 Network Controller VMs deployed", - "waf": "Reliability" + "subcategory": "Confidentiality", + "text": "Disable 'soft delete' for blobs", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "8bc78c85-6028-4a43-af2d-082a0a344909", - "link": "https://learn.microsoft.com/windows-server/networking/sdn/manage/update-backup-restore", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.", + "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", + "service": "Azure Storage", "services": [ - "Backup" + "Storage" ], "severity": "High", - "subcategory": "SDN", - "text": "Backups of SDN infrastructure are configured and tested", - "waf": "Operations" + "subcategory": "Data Availability", + "text": "Enable 'soft delete' for containers", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Stack HCI Review", - "guid": "51eaa4b6-b9a7-43e1-a7dc-634d3107bc6d", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", + "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", "services": [ - "Monitor" + "Storage" ], "severity": "Medium", - "subcategory": "Cluster", - "text": "SCOM Managed Instance has been considered for more complex monitoring and alerting scenarios", - "waf": "Operations" + "subcategory": "Confidentiality", + "text": "Disable 'soft delete' for containers", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Stack HCI Review", - "guid": "831f5aca-99ef-41e7-8263-9509f5093b43", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/setup-hci-system-alerts", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion", + "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", "services": [ - "Monitor" + "Storage" ], "severity": "High", - "subcategory": "Cluster", - "text": "Alerts have been configured for the cluster, either using Azure Monitor, SCOM, or a third-party solution", - "waf": "Operations" + "subcategory": "Data Availability", + "text": "Enable resource locks on storage accounts", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Stack HCI Review", - "guid": "f95d0e7e-9f61-476d-bf65-59f2454d1d39", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.", + "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", + "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", + "service": "Azure Storage", "services": [ - "Monitor" + "Storage", + "Subscriptions", + "AzurePolicy" ], - "severity": "Medium", - "subcategory": "Cluster", - "text": "Insights has been enabled at the cluster level and all nodes are reporting data", - "waf": "Operations" + "severity": "High", + "subcategory": "Data Availability, Compliance", + "text": "Consider immutable blobs", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Stack HCI Review", - "guid": "f4250fcb-ff53-40c9-b304-3560464fd90c", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/monitor-hci-single?tabs=22h2-and-later", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ", + "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Azure Storage", "services": [ - "Monitor" + "Storage" ], - "severity": "Medium", - "subcategory": "Cluster", - "text": "Azure Monitoring Agent has been deployed to hosts and an appropriate Data Collection Rule has been configured", - "waf": "Operations" + "severity": "High", + "subcategory": "Networking", + "text": "Require HTTPS, i.e. disable port 80 on the storage account", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Stack HCI Review", - "guid": "6143af1d-0d1a-4163-b1c9-662f7459bb98", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.", + "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", + "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", + "service": "Azure Storage", "services": [ - "Monitor" + "Storage" ], - "severity": "Medium", - "subcategory": "Hardware", - "text": "Relevant hardware monitoring has been configured", - "waf": "Operations" + "severity": "High", + "subcategory": "Networking", + "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.", + "waf": "Security" }, { - "category": "Management and Monitoring", - "checklist": "Azure Stack HCI Review", - "guid": "9cbdf225-549a-41cf-9c97-794766a6f2b0", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/health-service-overview", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.", + "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", + "service": "Azure Storage", "services": [ - "Monitor" + "Storage" ], "severity": "Medium", - "subcategory": "Hardware", - "text": "Relevant hardware alerting has been configured", - "waf": "Operations" - }, - { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "c0da5bbd-0f0d-4a26-98ec-38c9cc42b323", - "services": [ - "VM" - ], - "severity": "Low", - "subcategory": "VM Management - Resource Bridge", - "text": "The Azure CLI has been installed on every node to enable RB management from WAC", - "waf": "Operations" + "subcategory": "Networking", + "text": "Limit shared access signature (SAS) tokens to HTTPS connections only", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "a8ecf23c-c048-4fa9-b87b-51ebfb409863", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "AAD tokens should be favored over shared access signatures, wherever possible", + "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", + "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", + "service": "Azure Storage", "services": [ - "VM" + "Storage", + "Entra" ], - "severity": "Low", - "subcategory": "VM Management - Resource Bridge", - "text": "DHCP is available in the cluster to support Guest Configuration at VM deployment from Azure", - "waf": "Operations" + "severity": "High", + "subcategory": "Identity and Access Management", + "text": "Use Azure Active Directory (Azure AD) tokens for blob access", + "waf": "Security" }, { - "category": "Backup and Disaster Recovery", - "checklist": "Azure Stack HCI Review", - "guid": "074541e3-fe08-458a-8062-32d13dcc10c6", - "link": "https://learn.microsoft.com/azure/backup/back-up-azure-stack-hyperconverged-infrastructure-virtual-machines", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.", + "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", + "service": "Azure Storage", "services": [ - "Backup", - "VM", - "ASR" + "Storage", + "Entra", + "RBAC" ], - "severity": "High", - "subcategory": "VM", - "text": "Backups of HCI VMs have been configured using MABS or a third-party solution", - "waf": "Operations" + "severity": "Medium", + "subcategory": "Identity and Access Management", + "text": "Least privilege in IaM permissions", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "48f7ae57-1035-4101-8a38-fbe163d03e8a", - "services": [], + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ", + "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", + "service": "Azure Storage", + "services": [ + "Storage", + "Entra" + ], "severity": "High", - "subcategory": "Cluster Configuration", - "text": "Cluster configuration or a configuration script has been documented and maintained", - "waf": "Operations" + "subcategory": "Identity and Access Management", + "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "f2a6a19a-ffe6-444d-badb-cb336c8e7b50", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/witness", - "services": [], + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ", + "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", + "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", + "service": "Azure Storage", + "services": [ + "Storage", + "Entra", + "Monitor", + "AKV" + ], "severity": "High", - "subcategory": "Cluster Configuration", - "text": "A cluster witness has been configured for clusters with less than 5 nodes", - "waf": "Reliability" - }, - { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "a47339fe-62c5-44a0-bb83-3d46ef16292f", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/update-cluster", - "services": [], - "severity": "Medium", - "subcategory": "Cluster Configuration", - "text": "Cluster-Aware Updating has been configured for Windows and hardware updates (if available)", - "waf": "Operations" + "subcategory": "Identity and Access Management", + "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "7f1d6fe8-3079-44ea-8ea6-14494d1aa470", - "link": "https://learn.microsoft.com/azure-stack/hci/deploy/validate", - "services": [], + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).", + "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", + "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", + "service": "Azure Storage", + "services": [ + "Storage", + "Monitor", + "AKV", + "AzurePolicy" + ], "severity": "High", - "subcategory": "Cluster Configuration", - "text": "Cluster validation has been run against the configured cluster", - "waf": "Reliability" + "subcategory": "Monitoring", + "text": "Consider using Azure Monitor to audit control plane operations on the storage account", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "81693af0-5638-4aa2-a153-1d6189df30a7", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-benefits", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.", + "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", + "service": "Azure Storage", "services": [ - "VM" + "Storage", + "Entra", + "AKV", + "AzurePolicy" ], "severity": "Medium", - "subcategory": "Cluster Configuration", - "text": "Azure Benefits has been enabled at the cluster and VM levels", - "waf": "Cost" - }, - { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "8c967ee8-8170-4537-a28d-33431cd3632a", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/use-environment-checker", - "services": [], - "severity": "Medium", - "subcategory": "Cluster Configuration", - "text": "The Environment Checker module has been run to validate the environment", - "waf": "Reliability" + "subcategory": "Identity and Access Management", + "text": "When using storage account keys, consider enabling a 'key expiration policy'", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "43ffbfab-766e-4950-a102-78b479136e4d", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-benefits", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.", + "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", + "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", + "service": "Azure Storage", "services": [ + "Storage", + "Entra", "AzurePolicy" ], "severity": "Medium", - "subcategory": "Cluster Configuration", - "text": "Group Policy inheritance on the HCI cluster and node Active Directory organizational unit has been blocked or applied policies have been evaluated for compatibility issues (usually WinRM and PowerShell execution policy)", - "waf": "Operations" + "subcategory": "Identity and Access Management", + "text": "Consider configuring an SAS expiration policy", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "e6a3f3a7-4a7d-49e2-985a-6e39dd284027", - "services": [], + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ", + "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", + "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", + "service": "Azure Storage", + "services": [ + "Storage", + "Entra", + "AKV", + "AzurePolicy" + ], "severity": "Medium", - "subcategory": "Cluster Configuration", - "text": "WAC is on the latest release and configured to automatically upgrade extensions", - "waf": "Reliability" + "subcategory": "Identity and Access Management", + "text": "Consider linking SAS to a stored access policy", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "d1caa31f-cc26-42b2-b92f-2b667c0e6020", - "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", + "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", + "service": "Azure Storage", "services": [ - "Entra" + "Storage", + "AKV" ], "severity": "Medium", - "subcategory": "Stretch Clustering", - "text": "There is sub 5ms latency between each site if synchronous replication is being configured AAD", - "waf": "Performance" + "subcategory": "CI/CD", + "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "3277558e-3155-4088-b49a-78594cb4ce1a", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.", + "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", + "service": "Azure Storage", "services": [ - "VNet", - "Storage" + "Storage", + "Entra" ], "severity": "High", - "subcategory": "Stretch Clustering", - "text": "Management, Replication and Storage networks excluded from stretched VLANs configurations, are routed, and in different subnets", - "waf": "Reliability" + "subcategory": "Identity and Access Management", + "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "baed6066-8531-44ba-bd94-38cbabbf4099", - "services": [], + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.", + "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", + "services": [ + "Storage", + "Entra", + "AzurePolicy" + ], "severity": "High", - "subcategory": "Stretch Clustering", - "text": "There is a plan detailed for site failure and recovery", - "waf": "Operations" + "subcategory": "Identity and Access Management", + "text": "Strive for short validity periods for ad-hoc SAS", + "waf": "Security" }, { - "category": "Networking", - "checklist": "Azure Stack HCI Review", - "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b4", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.", + "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", "services": [ - "ACR" + "Storage", + "Entra" ], "severity": "Medium", - "subcategory": "Stretch Clustering", - "text": "Separate vLANs and networks are used for each replication network across both sites", - "waf": "Reliability" + "subcategory": "Identity and Access Management", + "text": "Apply a narrow scope to a SAS", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b5", - "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr#cost-optimization", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ", + "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", + "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", + "service": "Azure Storage", "services": [ - "Storage" + "Storage", + "Entra" ], - "severity": "High", - "subcategory": "Stretch Clustering", - "text": "Use either a cloud witness or a file share witness in a third site for cluster quorum for clusters with less than 5 nodes", - "waf": "Reliability" + "severity": "Medium", + "subcategory": "Identity and Access Management", + "text": "Consider scoping SAS to a specific client IP address, wherever possible", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "8e62945f-b9ac-4a5c-a4e4-836f527010b6", - "link": "https://learn.microsoft.com/azure/architecture/hybrid/azure-stack-hci-dr#cost-optimization", - "services": [], - "severity": "High", - "subcategory": "Stretch Clustering", - "text": "When using data deduplication, only enable it on the primary/source volumes", - "waf": "Reliability" + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.", + "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", + "service": "Azure Storage", + "services": [ + "Storage", + "Entra" + ], + "severity": "Low", + "subcategory": "Identity and Access Management", + "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ", + "waf": "Security" }, { - "category": "Operations", - "checklist": "Azure Stack HCI Review", - "guid": "ac527887-f6f4-40a3-b883-e04d704f013b", - "link": "https://learn.microsoft.com/windows-server/storage/storage-replica/stretch-cluster-replication-using-shared-storage#provision-operating-system-features-roles-storage-and-network", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint", + "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", + "service": "Azure Storage", "services": [ - "Storage" + "Storage", + "Entra", + "RBAC" ], "severity": "High", - "subcategory": "Stretch Clustering", - "text": "Storage backing log volumes must be faster (ideally) or at least as fast as capacity storage", - "waf": "Reliability" + "subcategory": "Identity and Access Management", + "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.", + "waf": "Security" }, { - "category": "Backup and Disaster Recovery", - "checklist": "Azure Stack HCI Review", - "guid": "8ea49f70-1038-4283-b0c4-230165d3eabc", - "link": "https://learn.microsoft.com/azure-stack/hci/manage/azure-site-recovery", + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", + "service": "Azure Storage", "services": [ - "ASR", - "Backup" + "Storage", + "Entra" ], "severity": "Medium", - "subcategory": "Disaster Recovery", - "text": "Azure Site Recovery has been considered for DR purposes", - "waf": "Operations" + "subcategory": "Identity and Access Management", + "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.", + "waf": "Security" }, { "category": "Security", - "checklist": "Azure Stack HCI Review", - "guid": "03e65fdc-2628-4a1a-ba2e-a5174340ba52", - "link": "https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", - "services": [], - "severity": "Medium", - "subcategory": "Host", - "text": "BitLocker has been enabled on CSVs for volume encryption, where appropriate", + "checklist": "Azure Storage Review Checklist", + "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.", + "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", + "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", + "service": "Azure Storage", + "services": [ + "Storage", + "AzurePolicy" + ], + "severity": "High", + "subcategory": "Networking", + "text": "Avoid overly broad CORS policies", "waf": "Security" }, { "category": "Security", - "checklist": "Azure Stack HCI Review", - "guid": "9645d2e6-ba28-453c-b6d5-d9ef29fc34be", - "link": "https://learn.microsoft.com/windows-server/storage/file-server/smb-security", - "services": [], - "severity": "Medium", - "subcategory": "Host", - "text": "SMB encryption has been enabled, where appropriate", + "checklist": "Azure Storage Review Checklist", + "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.", + "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "Azure Storage", + "services": [ + "Storage" + ], + "severity": "High", + "subcategory": "Confidentiality and Encryption", + "text": "Determine how data at rest should be encrypted. Understand the thread model for data.", "waf": "Security" }, { "category": "Security", - "checklist": "Azure Stack HCI Review", - "guid": "8f03437a-5068-4486-9a78-0402ce771298", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server", + "checklist": "Azure Storage Review Checklist", + "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", + "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", + "service": "Azure Storage", "services": [ - "Defender" + "Storage" ], "severity": "Medium", - "subcategory": "Host", - "text": "Microsoft Defender Antivirus has been enabled on all nodes", + "subcategory": "Confidentiality and Encryption", + "text": "Determine which/if platform encryption should be used.", "waf": "Security" }, { "category": "Security", - "checklist": "Azure Stack HCI Review", - "guid": "dba6b211-fc02-43b3-b7c8-f163c188332e", - "link": "https://learn.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage", - "services": [], + "checklist": "Azure Storage Review Checklist", + "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", + "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", + "service": "Azure Storage", + "services": [ + "Storage" + ], "severity": "Medium", - "subcategory": "Host", - "text": "Credential Guard has been configured, where appropriate", + "subcategory": "Confidentiality and Encryption", + "text": "Determine which/if client-side encryption should be used.", "waf": "Security" }, { - "category": "Operations Management", - "checklist": "Recovery Services Vault Checklist", - "guid": "cb7da8cf-aa62-4a15-a495-6da97dc3a242", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-plan-capacity-vmware", - "services": [], + "category": "Security", + "checklist": "Azure Storage Review Checklist", + "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.", + "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", + "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", + "service": "Azure Storage", + "services": [ + "Storage", + "Entra" + ], "severity": "High", - "subcategory": "Replication", - "text": "Capacity planning is required to make sure you have sufficient bandwidth for replication and an estimated number of CPU cores & disk types that will be needed in Azure for failover", - "waf": "Reliability" + "subcategory": "Identity and Access Management", + "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ", + "waf": "Security" }, { "category": "Operations Management", - "checklist": "Recovery Services Vault Checklist", - "guid": "67b23587-05a1-4652-aded-fa8a488cdec4", - "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-policy", + "checklist": "Azure Storage Review Checklist", + "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal", + "service": "Azure Storage", "services": [ - "ASR", - "VM", - "AzurePolicy" + "Storage" ], "severity": "High", - "subcategory": "Replication", - "text": "Use Azure Policy to ensure that all critical Azure VMs are protected with ASR", + "subcategory": "Platform Version", + "text": "Leverage a storagev2 account type for better performance and reliability", "waf": "Reliability" }, { - "category": "Operations Management", - "checklist": "Recovery Services Vault Checklist", - "guid": "862bc3bc-14be-4b7f-96e8-d9b3bec228e7", - "link": "https://learn.microsoft.com/azure/site-recovery/recovery-plan-overview", + "category": "BC and DR", + "checklist": "Azure Storage Review Checklist", + "guid": "e05bbe20-9d49-4fda-9777-8424d116785c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Azure Storage", "services": [ - "VM" + "Storage" ], - "severity": "Medium", - "subcategory": "Replication", - "text": "Define recovery plans to automate the failover sequence for VMs. You can also include automation scripts to reduce manual steps and improve recovery time", + "severity": "High", + "subcategory": "Availablity", + "text": "Leverage GRS, ZRS or GZRS storage for the highest availability", "waf": "Reliability" }, { - "category": "Operations Management", - "checklist": "Recovery Services Vault Checklist", - "guid": "437b1736-db55-4f67-a613-334bd09dc234", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-how-to-manage?tabs=recovery-services-vault", - "services": [], + "category": "BC and DR", + "checklist": "Azure Storage Review Checklist", + "guid": "2fa56c56-ad48-4408-be72-734c486ba280", + "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance", + "service": "Azure Storage", + "services": [ + "Storage" + ], "severity": "Medium", - "subcategory": "Data Protection", - "text": "Enable and LOCK immutability for vaults. This ensures recovery points cannot be deleted before their intended expiry", + "subcategory": "Failover", + "text": "For write operation after failover, use customer-Managed Failover ", "waf": "Reliability" }, { "category": "Operations Management", - "checklist": "Recovery Services Vault Checklist", - "guid": "19db6128-1265-404b-a47a-493a08042729", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about", - "services": [], + "checklist": "Azure Storage Review Checklist", + "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc", + "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover", + "service": "Azure Storage", + "services": [ + "Storage" + ], "severity": "Medium", - "subcategory": "Data Protection", - "text": "Enable 'Always-on soft delete' for vaults protecting critical workloads", + "subcategory": "Failover", + "text": "Understand Microsoft-Managed Failover details", "waf": "Reliability" }, { "category": "Operations Management", - "checklist": "Recovery Services Vault Checklist", - "guid": "4798b158-8b31-4aa5-9ceb-54445135a227", - "link": "https://learn.microsoft.com/azure/backup/backup-create-recovery-services-vault#set-storage-redundancy", + "checklist": "Azure Storage Review Checklist", + "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal", + "service": "Azure Storage", "services": [ "Storage" ], "severity": "Medium", - "subcategory": "Redudancy", - "text": "When creating Recovery Service Vaults choose the best storage redundancy option for your requirements. Vaults support local, geo and zone redundancy but this setting cannot be changed once the vault is protecting one or more resources", + "subcategory": "Data Protection", + "text": "Enable Soft Delete", "waf": "Reliability" } ], "metadata": { "name": "Master checklist", - "timestamp": "June 17, 2024" + "timestamp": "June 24, 2024" }, "severities": [ { diff --git a/checklists/security_checklist.en.json b/checklists/security_checklist.en.json index c208015d0..a50f04989 100644 --- a/checklists/security_checklist.en.json +++ b/checklists/security_checklist.en.json @@ -1,1669 +1,1669 @@ -{ - "items": [ - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Security Center/Defender enable in all subscriptions", - "waf": "Security", - "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", - "id": "A01.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Security Center/Defender enabled on all Log Analytics workspaces", - "waf": "Security", - "guid": "349f0364-d28d-442e-abbb-c868255abc91", - "id": "A01.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Data collection set to 'Common'", - "waf": "Security", - "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", - "id": "A01.03", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Defender for Cloud enhanced security features are all enabled", - "waf": "Security", - "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", - "id": "A01.04", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Auto-provisioning enabled as per company policy (policy must exist)", - "waf": "Security", - "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", - "id": "A01.05", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Email notifications enabled as per company policy (policy must exist)", - "waf": "Security", - "guid": "25759e35-680e-4782-9ac9-32213d027ff4", - "id": "A01.06", - "severity": "Low", - "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Enable integrations options are selected ", - "waf": "Security", - "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", - "id": "A01.07", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "CI/CD integration is configured", - "waf": "Operations", - "guid": "5b7abae4-4aad-45e8-a79e-2e86667313c5", - "id": "A01.08", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Continuous export 'Event Hub' is enabled if using 3rd party SIEM", - "waf": "Security", - "guid": "05675c5e-985b-4859-a774-f7e371623b87", - "id": "A01.09", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Continuous export 'Log Analytics Workspace' is enabled if not using Azure Sentinel", - "waf": "Security", - "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", - "id": "A01.10", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Cloud connector enabled for AWS", - "waf": "Security", - "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", - "id": "A01.11", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "Cloud connector enabled for GCP", - "waf": "Security", - "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", - "id": "A01.12", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp" - }, - { - "category": "Defender For Cloud", - "subcategory": "Pricing & Settings", - "text": "If using Azure AD Application proxy, consider integrating with Microsoft Defender for Cloud Apps to monitor application access in real-time and apply advanced security controls.", - "waf": "Security", - "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", - "id": "A01.13", - "severity": "Low", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security" - }, - { - "category": "Defender For Cloud", - "subcategory": "Recommendations", - "text": "All recommendations remediated or disabled if not required.", - "waf": "Security", - "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", - "id": "A02.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls" - }, - { - "category": "Defender For Cloud", - "subcategory": "Recommendations", - "text": "Security Score>70%", - "description": "Microsoft minimum target for all customers is 70%", - "waf": "Security", - "guid": "08032729-4798-4b15-98a2-19a46ceb5443", - "id": "A02.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls" - }, - { - "category": "Defender For Cloud", - "subcategory": "Security Alerts", - "text": "Security Alerts contain only those generated in the past 24 hours (remediate or disable older security alerts)", - "waf": "Security", - "guid": "50259226-4429-42bb-9285-37a55119bf8e", - "id": "A03.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident" - }, - { - "category": "Defender For Cloud", - "subcategory": "Workbooks", - "text": "If continuous export is enabled, default workbooks published to custom security dashboard", - "waf": "Security", - "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", - "id": "A04.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks" - }, - { - "category": "Defender For Cloud", - "subcategory": "Community", - "text": "Customer is aware of the value of the 'Community' page and has a regular cadence set up to review", - "waf": "Security", - "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", - "id": "A05.01", - "severity": "Medium", - "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud" - }, - { - "category": "Defender For Cloud", - "subcategory": "Secure Score", - "text": "All subscriptions protected by Security Center are shown (no subscription filter set)", - "description": "Customer Operational best practice - Transparency", - "waf": "Security", - "guid": "93846da9-7cc3-4923-856b-22586f4a1641", - "id": "A06.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security" - }, - { - "category": "Defender For Cloud", - "subcategory": "Regulatory Compliance", - "text": "Compliance controls are green for any required compliance requirements", - "waf": "Security", - "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", - "id": "A07.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard" - }, - { - "category": "Defender For Cloud", - "subcategory": "Azure Defender", - "text": "High severity VM vulnerabilities is zero (empty)", - "description": "Customer Operational best practice - verify", - "waf": "Security", - "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", - "id": "A08.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm" - }, - { - "category": "Defender For Cloud", - "subcategory": "Firewall Manager", - "text": "Hubs are protected by an Azure Firewall", - "waf": "Security", - "guid": "9603334b-df9c-4c23-918d-b61171265f4b", - "id": "A09.01", - "severity": "Medium", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679" - }, - { - "category": "Defender For Cloud", - "subcategory": "Firewall Manager", - "text": "Virtual Networks are protected by a Firewall", - "description": "Customer Operational best practice - verify", - "waf": "Security", - "guid": "b47a393a-0803-4272-a479-8b1578a219a4", - "id": "A09.02", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices" - }, - { - "category": "Defender For Cloud", - "subcategory": "Firewall Manager", - "text": "DDoS Standard enabled", - "waf": "Security", - "guid": "6ceb5443-5025-4922-9442-92bb628537a5", - "id": "A09.03", - "severity": "Medium", - "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/" - }, - { - "category": "Defender For Cloud", - "subcategory": "Coverage", - "text": "Verify that all subscriptions are covered (see pricing and settings to modify)", - "waf": "Security", - "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", - "id": "A10.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "Azure Networking", - "subcategory": "Public IPs", - "text": "VM's with public IPs should be protected by NSG ", - "waf": "Security", - "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", - "id": "B01.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Azure Networking", - "subcategory": "Public IPs", - "text": "VMs with public IPs are moved behind Azure Firewall Premium", - "description": "Customer operational best practice - verify", - "waf": "Security", - "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", - "id": "B01.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Azure Networking", - "subcategory": "Public IPs", - "text": "VM's that don't need public IPs do not have public IPs (i.e. internal RDP only)", - "description": "Customer operational best practice - verify", - "waf": "Security", - "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", - "id": "B01.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "NSG RBAC is used to restrict access to network security team", - "waf": "Security", - "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", - "id": "B02.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "NSG Inbound security rules do not contain a * (wildcard) in Source field", - "description": "Customer operational best practice - verify", - "waf": "Security", - "guid": "a209939b-da47-4778-b24c-116785c2fa55", - "id": "B02.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "NSG outbound security rules are used to control traffic to specific IP addresses for traffic not routed through a Firewall", - "description": "Customer operational best practice - verify", - "waf": "Security", - "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", - "id": "B02.03", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "NSG do not have Source as a * (wildcard) in place.", - "description": "Customer operational best practice - verify", - "waf": "Security", - "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", - "id": "B02.04", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "NSG Diagnostics send NetworkSecurityGroupEvent and NetworkSecurityGroupRuleCounter traffic to Sentinel LAW", - "waf": "Security", - "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", - "id": "B02.05", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log" - }, - { - "category": "Azure Networking", - "subcategory": "UDR", - "text": "UDR RBAC is used to restrict access to the network security team", - "waf": "Security", - "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", - "id": "B03.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "UDR", - "text": "If Zero Trust, then UDR's are used to send all traffic to the Azure Firewall Premium", - "waf": "Security", - "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", - "id": "B03.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "UDR", - "text": "UDR's that do not send all traffic to AzureFirewallPremium are known and documented.", - "description": "Customer operational best practice - verify", - "waf": "Security", - "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", - "id": "B03.03", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "Customer is familiar with Azure networking defaults / SDN default routing in Azure", - "waf": "Security", - "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", - "id": "B04.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "VNet RBAC is used to restrict access to the network security team", - "description": "Customer operational best practice - verify", - "waf": "Security", - "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", - "id": "B04.02", - "severity": "Medium", - "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "VNet Security recommendations are remediated and there are no 'At-risk' VNets ", - "waf": "Security", - "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", - "id": "B04.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "VNet Peering connections are understood and expected traffic flows are documented", - "waf": "Security", - "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", - "id": "B04.04", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "VNet Service Endpoints are in use, no legacy Public Service Endpoints exist", - "waf": "Security", - "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", - "id": "B04.05", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "VNet Private Endpoints are in use to allow access from on-premises environments, no legacy public endpoints exist", - "waf": "Security", - "guid": "1f625659-ee55-480a-9824-9c931213dbd7", - "id": "B04.06", - "severity": "High", - "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "VNet Monitoring enabled", - "waf": "Security", - "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", - "id": "B04.07", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "Secure traffic between pods using network policies in Azure Kubernetes Service (AKS)", - "waf": "Security", - "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731", - "id": "B04.08", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "VNet NVA (appliances) customer follows published architecture pattern", - "waf": "Security", - "guid": "3c005674-c1e9-445b-959c-373e7ed71623", - "id": "B04.09", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual Networks", - "text": "VNet Diagnostic settings are enabled and sending VMProtectionAlerts to the Azure Sentinel LAW", - "waf": "Security", - "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", - "id": "B04.10", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Azure Networking", - "subcategory": "Connectivity", - "text": "Use ExpressRoute or VPN to access Azure resources from on-premises environments", - "waf": "Security", - "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", - "id": "B05.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual WAN", - "text": "VWAN RBAC is used to restrict access to the network security team", - "waf": "Security", - "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", - "id": "B06.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual WAN", - "text": "VWAN Customer is using Secure Hub or external Firewall to route and monitor traffic.", - "waf": "Security", - "guid": "718d1dca-1f62-4565-aee5-580a38249c93", - "id": "B06.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture" - }, - { - "category": "Azure Networking", - "subcategory": "Application Gateway", - "text": "AppGW RBAC is used to restrict access to the network security team", - "waf": "Security", - "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", - "id": "B07.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview" - }, - { - "category": "Azure Networking", - "subcategory": "Application Gateway", - "text": "AppGW All external facing web services are behind Application Gateways with WAF enabled ", - "waf": "Security", - "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", - "id": "B07.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Azure Networking", - "subcategory": "Application Gateway", - "text": "AppGW All internal facing web services are behind Application Gateways with WAF enabled ", - "waf": "Security", - "guid": "94666731-3c00-4567-9c1e-945b459c373e", - "id": "B07.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Azure Networking", - "subcategory": "Application Gateway", - "text": "AppGW - External facing has TLS/SSL enabled and redirects all traffic to 443 (no port 80 traffic)", - "waf": "Security", - "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", - "id": "B07.04", - "severity": "High", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview" - }, - { - "category": "Azure Networking", - "subcategory": "FrontDoor", - "text": "Front Door RBAC is used to restrict access to the network security team", - "waf": "Security", - "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", - "id": "B08.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/frontdoor/" - }, - { - "category": "Azure Networking", - "subcategory": "FrontDoor", - "text": "Front Door is associated with a WAF policy", - "waf": "Security", - "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", - "id": "B08.02", - "severity": "High", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json" - }, - { - "category": "Azure Networking", - "subcategory": "FrontDoor", - "text": "Front Door TLS/SSL policy is configured", - "waf": "Security", - "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", - "id": "B08.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https" - }, - { - "category": "Azure Networking", - "subcategory": "FrontDoor", - "text": "Front Door redirect port 80 to port 443 is configured (listeners)", - "waf": "Security", - "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", - "id": "B08.04", - "severity": "High", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect" - }, - { - "category": "Azure Networking", - "subcategory": "FrontDoor", - "text": "Front Door diagnostics logs send ApplicationGatewayAccessLog &ApplicationGateway FirewallLog to Sentinel LAW", - "waf": "Security", - "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", - "id": "B08.05", - "severity": "High", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics" - }, - { - "category": "Azure Networking", - "subcategory": "DDOS Protection", - "text": "Enabled for Firewall public IP's (all public IPs)", - "waf": "Security", - "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", - "id": "B09.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - }, - { - "category": "Identity", - "subcategory": "Tenant", - "text": "Establish a single enterprise directory for managing identities of full-time employees and enterprise resources.", - "waf": "Security", - "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", - "id": "C01.01", - "severity": "High", - "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory" - }, - { - "category": "Identity", - "subcategory": "Tenant", - "text": "Synchronize your cloud identity with your existing identity systems.", - "waf": "Security", - "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", - "id": "C01.02", - "severity": "High", - "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems" - }, - { - "category": "Identity", - "subcategory": "Tenant", - "text": "Use cloud identity services to host non-employee accounts such as vendors, partners, and customers, rather than rather than including them in your on-premises directory.", - "waf": "Security", - "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", - "id": "C01.03", - "severity": "High", - "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties" - }, - { - "category": "Identity", - "subcategory": "Tenant", - "text": "Disable insecure legacy protocols for internet-facing services.", - "waf": "Security", - "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", - "id": "C01.04", - "severity": "High", - "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication" - }, - { - "category": "Identity", - "subcategory": "Tenant", - "text": "Enable single sign-on", - "waf": "Security", - "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", - "id": "C01.05", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on" - }, - { - "category": "Identity", - "subcategory": "Privileged administration", - "text": "Don�t synchronize accounts with the highest privilege access to on-premises resources as you synchronize your enterprise identity systems with cloud directories.", - "waf": "Security", - "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", - "id": "C02.01", - "severity": "High", - "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers" - }, - { - "category": "Identity", - "subcategory": "Privileged administration", - "text": "Limit the number of Global Administrators to less than 5", - "waf": "Security", - "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", - "id": "C02.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5" - }, - { - "category": "Identity", - "subcategory": "Privileged administration", - "text": "Use groups for Azure AD role assignments and delegate the role assignment", - "waf": "Security", - "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", - "id": "C02.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment" - }, - { - "category": "Identity", - "subcategory": "Privileged administration", - "text": "Ensure all critical impact admins are managed by enterprise directory to follow organizational policy enforcement.", - "waf": "Security", - "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", - "id": "C02.04", - "severity": "High", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins" - }, - { - "category": "Identity", - "subcategory": "Privileged administration", - "text": "Configure recurring access reviews to revoke unneeded permissions over time", - "waf": "Security", - "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", - "id": "C02.05", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time" - }, - { - "category": "Identity", - "subcategory": "Privileged administration", - "text": "Ensure critical impact admins use a workstation with elevated security protections and monitoring", - "waf": "Security", - "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", - "id": "C02.06", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security" - }, - { - "category": "Identity", - "subcategory": "External Identities", - "text": "Identity Providers: Verify external identity providers are known", - "waf": "Security", - "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", - "id": "C03.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c" - }, - { - "category": "Identity", - "subcategory": "External Identities", - "text": "External Collaboration Settings: Guest user access set to 'Guest user access is restricted?'", - "waf": "Security", - "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", - "id": "C03.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identity", - "subcategory": "External Identities", - "text": "External Collaboration Settings: Guest invite settings set to 'Only users assigned to specific admin roles'", - "waf": "Security", - "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", - "id": "C03.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identity", - "subcategory": "External Identities", - "text": "External Collaboration Settings: Enable guest self-service sign up via flows set to 'Disabled' ", - "waf": "Security", - "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", - "id": "C03.04", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identity", - "subcategory": "External Identities", - "text": "External Collaboration Settings: Collaboration restrictions set to 'Allow invitations to the specified domains'", - "waf": "Security", - "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", - "id": "C03.05", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identity", - "subcategory": "External Identities", - "text": "Access Reviews: Enabled for all groups", - "waf": "Security", - "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", - "id": "C03.06", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews" - }, - { - "category": "Identity", - "subcategory": "Enterprise Applications", - "text": "Consent & Permissions: Allow user consent for apps from verified publishers", - "waf": "Security", - "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", - "id": "C04.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent" - }, - { - "category": "Identity", - "subcategory": "Enterprise Applications", - "text": "Consent & Permissions: Allow group owner consent for selected group owners ", - "waf": "Security", - "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", - "id": "C04.02", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups" - }, - { - "category": "Identity", - "subcategory": "Custom Domains", - "text": "Only validated customer domains are registered", - "waf": "Security", - "guid": "bade4aad-1e8c-439e-a946-667313c00567", - "id": "C05.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain" - }, - { - "category": "Identity", - "subcategory": "Password Reset", - "text": "Self-service password reset policy requirement verified compliant.", - "waf": "Security", - "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", - "id": "C06.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr" - }, - { - "category": "Identity", - "subcategory": "Password Reset", - "text": "Set number of days before users are asked to re-confirm authentication information is not set to zero", - "waf": "Security", - "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", - "id": "C06.02", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "Identity", - "subcategory": "Password Reset", - "text": "Set number of methods required to reset password are selected", - "waf": "Security", - "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", - "id": "C06.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "Identity", - "subcategory": "User Setting", - "text": "Disable 'Users can register applications'", - "waf": "Security", - "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", - "id": "C07.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles" - }, - { - "category": "Identity", - "subcategory": "User Setting", - "text": "Restrict access to Administrative portal (portal.azure.com) to administrators only", - "waf": "Security", - "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", - "id": "C07.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions" - }, - { - "category": "Identity", - "subcategory": "User Setting", - "text": "Disable 'LinkedIn account connection'", - "waf": "Security", - "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", - "id": "C07.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration" - }, - { - "category": "Identity", - "subcategory": "Diagnostic Settings", - "text": "Enabled and send to Log Analytics workspace with Sentinel", - "waf": "Security", - "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", - "id": "C08.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring" - }, - { - "category": "Identity", - "subcategory": "PIM enabled", - "text": "Privileged Identity Management enabled", - "waf": "Security", - "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", - "id": "C09.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan" - }, - { - "category": "Identity", - "subcategory": "PIM enabled", - "text": "Implement 'just in time' (JIT) access to further lower the exposure time for privileged accounts (reduce standing access)", - "waf": "Security", - "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", - "id": "C09.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc" - }, - { - "category": "Identity", - "subcategory": "Conditional Access Policies", - "text": "Configure conditional access policies / Access Controls", - "waf": "Security", - "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", - "id": "C10.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common" - }, - { - "category": "Identity", - "subcategory": "Conditional Access Policies", - "text": "Conditions: Restricted Locations", - "waf": "Security", - "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", - "id": "C10.02", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition" - }, - { - "category": "Identity", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: MFA enabled for all users", - "waf": "Security", - "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", - "id": "C10.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa" - }, - { - "category": "Identity", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: Require MFA for Administrators", - "waf": "Security", - "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", - "id": "C10.04", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa" - }, - { - "category": "Identity", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: Require MFA for Azure Management ", - "waf": "Security", - "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", - "id": "C10.05", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management" - }, - { - "category": "Identity", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: Block Legacy Protocols", - "waf": "Security", - "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", - "id": "C10.06", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy" - }, - { - "category": "Identity", - "subcategory": "Conditional Access Policies", - "text": "Access Controls: Require devices to be marked as compliant", - "waf": "Security", - "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", - "id": "C10.07", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices" - }, - { - "category": "Identity", - "subcategory": "Guest users", - "text": "Is there a policy to track guest user accounts (i.e. usage/delete/disable)?", - "description": "Customer documented policy", - "waf": "Security", - "guid": "a7144351-e19d-4d34-929e-b7228137a151", - "id": "C11.01", - "severity": "Medium", - "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/" - }, - { - "category": "Identity", - "subcategory": "Identity Secure Score", - "text": "Implement Identity Secure Score based on best practices in your industry", - "waf": "Security", - "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", - "id": "C12.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score" - }, - { - "category": "Identity", - "subcategory": "Break Glass Accounts", - "text": "At least two break glass accounts have been created and policy around their use exists", - "waf": "Security", - "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", - "id": "C13.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access" - }, - { - "category": "VM Security Checks", - "subcategory": "Access Control", - "text": "Control VM Access leveraging Azure Policy", - "waf": "Security", - "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", - "id": "D01.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/governance/policy/overview" - }, - { - "category": "VM Security Checks", - "subcategory": "Access Control", - "text": "Reduce variability in your setup and deployment of VMs by leveraging templates", - "waf": "Security", - "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", - "id": "D01.02", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax" - }, - { - "category": "VM Security Checks", - "subcategory": "Access Control", - "text": "Secure privileged access to deploy VMS by reducing who has access to Resources through Governance", - "waf": "Security", - "guid": "b5945bda-4333-44fd-b91c-234182b65275", - "id": "D01.03", - "severity": "Medium", - "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models" - }, - { - "category": "VM Security Checks", - "subcategory": "High Availability ", - "text": "Use multiple VMs for your workloads for better availability ", - "waf": "Reliability", - "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", - "id": "D02.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service" - }, - { - "category": "VM Security Checks", - "subcategory": "High Availability ", - "text": "Deploy and test a disaster recovery solution ", - "waf": "Reliability", - "guid": "f219e4a1-eb58-4879-935d-227886d30b66", - "id": "D02.02", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm" - }, - { - "category": "VM Security Checks", - "subcategory": "High Availability ", - "text": "Availability sets", - "waf": "Reliability", - "guid": "c57be595-1900-4838-95c5-86cb291ec16a", - "id": "D02.03", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview" - }, - { - "category": "VM Security Checks", - "subcategory": "High Availability ", - "text": "Availability Zones", - "waf": "Reliability", - "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", - "id": "D02.04", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context" - }, - { - "category": "VM Security Checks", - "subcategory": "High Availability ", - "text": "Regional fault tolerance ", - "waf": "Reliability", - "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", - "id": "D02.05", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region" - }, - { - "category": "VM Security Checks", - "subcategory": "Protect against malware", - "text": "Install antimalware solutions", - "waf": "Security", - "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", - "id": "D03.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware" - }, - { - "category": "VM Security Checks", - "subcategory": "Protect against malware", - "text": "Integrate antimalware solution with Security Center", - "waf": "Security", - "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", - "id": "D03.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "VM Security Checks", - "subcategory": "Manage VM Updates", - "text": "Keep VMs up to date using Update Management with Azure Automation", - "waf": "Security", - "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", - "id": "D04.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview" - }, - { - "category": "VM Security Checks", - "subcategory": "Manage VM Updates", - "text": "Ensure Windows images for deployment have the most recent level of updates ", - "waf": "Security", - "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", - "id": "D04.02", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching" - }, - { - "category": "VM Security Checks", - "subcategory": "Manage VM Updates", - "text": "Rapidly apply security updates to VMs using Microsoft Defender for Cloud", - "waf": "Security", - "guid": "02145901-465d-438e-9309-ccbd979266bc", - "id": "D04.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/asset-inventory" - }, - { - "category": "VM Security Checks", - "subcategory": "Encrypt your VHDs", - "text": "Enable encryption on your VMs", - "waf": "Security", - "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", - "id": "D05.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview" - }, - { - "category": "VM Security Checks", - "subcategory": "Encrypt your VHDs", - "text": "Add Key Encryption Key (KEK) for added layer of security for encryption ", - "waf": "Security", - "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", - "id": "D05.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek" - }, - { - "category": "VM Security Checks", - "subcategory": "Encrypt your VHDs", - "text": "Take a snapshot of disks before encryption for rollback purposes", - "waf": "Security", - "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", - "id": "D05.03", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk" - }, - { - "category": "VM Security Checks", - "subcategory": "Restrict direct internet connection ", - "text": "Ensure only the central networking group has permissions to networking resources ", - "waf": "Security", - "guid": "5173676a-e466-491e-a835-ad942223e138", - "id": "D06.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles" - }, - { - "category": "VM Security Checks", - "subcategory": "Restrict direct internet connection ", - "text": "Identity and remediate exposed VMs that allow access from 'ANY' source IP address", - "waf": "Security", - "guid": "10523081-a941-4741-9833-ff7ad7c6d373", - "id": "D06.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "VM Security Checks", - "subcategory": "Restrict direct internet connection ", - "text": "Restrict management ports (RDP, SSH) using Just-in-Time Access", - "waf": "Security", - "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", - "id": "D06.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time" - }, - { - "category": "VM Security Checks", - "subcategory": "Restrict direct internet connection ", - "text": "Remove internet access and implement jump servers for RDP", - "waf": "Security", - "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", - "id": "D06.04", - "severity": "High", - "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html" - }, - { - "category": "VM Security Checks", - "subcategory": "Restrict direct internet connection ", - "text": "Remove direct logging into servers using RDP/SSH from internet and implement VPN or express route", - "waf": "Security", - "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", - "id": "D06.05", - "severity": "High", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling" - }, - { - "category": "VM Security Checks", - "subcategory": "Restrict direct internet connection ", - "text": "Leverage Azure Bastion as your RDP/SSH broker for added security and reduction in footprint", - "waf": "Security", - "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", - "id": "D06.06", - "severity": "High", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview" - }, - { - "category": "Sentinel", - "subcategory": "Architecture ", - "text": "All tenants contain have Sentinel enabled on at least one Log Analytics workspace", - "waf": "Security", - "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", - "id": "E01.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard" - }, - { - "category": "Sentinel", - "subcategory": "Architecture ", - "text": "Customer understands Sentinel architecture", - "waf": "Security", - "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", - "id": "E01.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture" - }, - { - "category": "Sentinel", - "subcategory": "Architecture ", - "text": "Customer knows how to monitor Incidents across multiple Sentinel instances", - "waf": "Security", - "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", - "id": "E01.03", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view" - }, - { - "category": "Sentinel", - "subcategory": "Overview", - "text": "No Incidents open more than 24 hours", - "waf": "Security", - "guid": "8989579e-76b8-497e-910a-7da7be9966e1", - "id": "E02.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics" - }, - { - "category": "Sentinel", - "subcategory": "News & Guides", - "text": "Customer have been shown the News & Guides tab", - "waf": "Security", - "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", - "id": "E03.01", - "severity": "Low", - "link": "https://learn.microsoft.com/azure/sentinel/whats-new" - }, - { - "category": "Sentinel", - "subcategory": "UEBA ", - "text": "UEBA Configured (Sentinel/Settings/Settings/Configure UEBA)", - "waf": "Security", - "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", - "id": "E04.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Azure Active Directory in configured and 'Last Log Received' shows today", - "waf": "Security", - "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", - "id": "E05.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Azure Active Directory Identity Protection is configured and 'Last Log Received' shows today", - "waf": "Security", - "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", - "id": "E05.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Azure Activity is configured is configured and 'Last Log Received' shows today", - "waf": "Security", - "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", - "id": "E05.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Microsoft Defender for Cloud is configured and 'Last Log Received' shows today", - "waf": "Security", - "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", - "id": "E05.04", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Azure Firewall is configured and 'Last Log Received' shows today", - "waf": "Security", - "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", - "id": "E05.05", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Windows Firewall is configured and 'Last Log Received' shows today", - "waf": "Security", - "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", - "id": "E05.06", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Security Events is configured with AMA and 'Last Log Received' shows today", - "waf": "Security", - "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", - "id": "E05.07", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Security Events - verify Azure computers are connected and sending data to the workspace", - "waf": "Security", - "guid": "1a4834ac-9322-423e-ae80-b123081a5417", - "id": "E05.08", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Security Events - verify non-Azure computers are connected and sending data to the workspace", - "waf": "Security", - "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", - "id": "E05.09", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Connector for AWS", - "waf": "Security", - "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", - "id": "E05.10", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3" - }, - { - "category": "Sentinel", - "subcategory": "Data Connectors", - "text": "Connector for GCP", - "waf": "Security", - "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", - "id": "E05.11", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "Sentinel", - "subcategory": "Analytics Rules", - "text": "Customer has enabled Analytics rules and configured Incidents ", - "waf": "Security", - "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", - "id": "E06.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in" - }, - { - "category": "Sentinel", - "subcategory": "Settings", - "text": "Customer does not have a daily cap enabled", - "waf": "Security", - "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", - "id": "E07.01", - "severity": "Medium", - "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/" - }, - { - "category": "Azure Firewall", - "subcategory": "Configuration", - "text": "Azure Firewall Premium deployed", - "waf": "Security", - "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", - "id": "F01.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall/premium-features" - }, - { - "category": "Azure Firewall", - "subcategory": "Configuration", - "text": "Quad zero/force tunning enabled through Azure Firewall", - "waf": "Security", - "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", - "id": "F01.02", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route" - }, - { - "category": "Azure Firewall", - "subcategory": "Access Control", - "text": "RBAC set to enable only authorized users", - "waf": "Security", - "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", - "id": "F02.01", - "severity": "Medium", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "Diagnostic Settings", - "text": "Diagnostics enabled and sending metrics to a Log Analytics workspace ", - "waf": "Security", - "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", - "id": "F03.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "Hubs and virtual networks are protected or connected through Firewall Premium", - "waf": "Security", - "guid": "b35478c3-4798-416b-8863-cffe1cac599e", - "id": "F04.01", - "severity": "High", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "Policy: Access controls are configured (RBAC)", - "waf": "Security", - "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", - "id": "F04.02", - "severity": "High", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "Policy: Parent policy is configured ", - "waf": "Security", - "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", - "id": "F04.03", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "Policy: Rule collections are defined", - "waf": "Security", - "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", - "id": "F04.04", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "Policy: DNAT policies are defined", - "waf": "Security", - "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", - "id": "F04.05", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "Policy: Network rules are defined", - "waf": "Security", - "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", - "id": "F04.06", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "Policy: Application rules are defined", - "waf": "Security", - "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", - "id": "F04.07", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall/features" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "DNS: Feature understood and applied or not applied", - "waf": "Security", - "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", - "id": "F04.08", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/firewall/dns-details" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "Threat Intelligence: Set to Alert & Deny", - "waf": "Security", - "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", - "id": "F04.09", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "Threat Intelligence: Allowed list (justify if they are being used - ie performance)", - "waf": "Security", - "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", - "id": "F04.10", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "TLS enabled", - "waf": "Security", - "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", - "id": "F04.11", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall/premium-certificates" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "IDPS enabled", - "waf": "Security", - "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", - "id": "F04.12", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Firewall Manager", - "text": "SNAT: Configured ", - "waf": "Security", - "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", - "id": "F04.13", - "severity": "High", - "link": "https://learn.microsoft.com/azure/firewall/snat-private-range" - }, - { - "category": "Azure Firewall", - "subcategory": "DDOS Protection", - "text": "Enabled for Firewall public IP's", - "waf": "Security", - "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", - "id": "F05.01", - "severity": "Medium", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - } - ], - "categories": [ - { - "name": "Defender For Cloud" - }, - { - "name": "Azure Networking" - }, - { - "name": "Identity" - }, - { - "name": "VM Security Checks" - }, - { - "name": "Sentinel" - }, - { - "name": "Azure Firewall" - } - ], - "waf": [ - { - "name": "Reliability" - }, - { - "name": "Security" - }, - { - "name": "Cost" - }, - { - "name": "Operations" - }, - { - "name": "Performance" - } - ], - "yesno": [ - { - "name": "Yes" - }, - { - "name": "No" - } - ], - "status": [ - { - "name": "Not verified", - "description": "This check has not been looked at yet" - }, - { - "name": "Open", - "description": "There is an action item associated to this check" - }, - { - "name": "Fulfilled", - "description": "This check has been verified, and there are no further action items associated to it" - }, - { - "name": "Not required", - "description": "Recommendation understood, but not needed by current requirements" - }, - { - "name": "N/A", - "description": "Not applicable for current design" - } - ], - "severities": [ - { - "name": "High" - }, - { - "name": "Medium" - }, - { - "name": "Low" - } - ], - "metadata": { - "name": "Azure Security Review Checklist", - "state": "Deprecated", - "timestamp": "12/15/2023 12:00:24" - } -} +{ + "items": [ + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Security Center/Defender enable in all subscriptions", + "waf": "Security", + "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", + "id": "A01.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Security Center/Defender enabled on all Log Analytics workspaces", + "waf": "Security", + "guid": "349f0364-d28d-442e-abbb-c868255abc91", + "id": "A01.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Data collection set to 'Common'", + "waf": "Security", + "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", + "id": "A01.03", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Defender for Cloud enhanced security features are all enabled", + "waf": "Security", + "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", + "id": "A01.04", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Auto-provisioning enabled as per company policy (policy must exist)", + "waf": "Security", + "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", + "id": "A01.05", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Email notifications enabled as per company policy (policy must exist)", + "waf": "Security", + "guid": "25759e35-680e-4782-9ac9-32213d027ff4", + "id": "A01.06", + "severity": "Low", + "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Enable integrations options are selected ", + "waf": "Security", + "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", + "id": "A01.07", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "CI/CD integration is configured", + "waf": "Operations", + "guid": "5b7abae4-4aad-45e8-a79e-2e86667313c5", + "id": "A01.08", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Continuous export 'Event Hub' is enabled if using 3rd party SIEM", + "waf": "Security", + "guid": "05675c5e-985b-4859-a774-f7e371623b87", + "id": "A01.09", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Continuous export 'Log Analytics Workspace' is enabled if not using Azure Sentinel", + "waf": "Security", + "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", + "id": "A01.10", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Cloud connector enabled for AWS", + "waf": "Security", + "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", + "id": "A01.11", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "Cloud connector enabled for GCP", + "waf": "Security", + "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", + "id": "A01.12", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp" + }, + { + "category": "Defender For Cloud", + "subcategory": "Pricing & Settings", + "text": "If using Azure AD Application proxy, consider integrating with Microsoft Defender for Cloud Apps to monitor application access in real-time and apply advanced security controls.", + "waf": "Security", + "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", + "id": "A01.13", + "severity": "Low", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security" + }, + { + "category": "Defender For Cloud", + "subcategory": "Recommendations", + "text": "All recommendations remediated or disabled if not required.", + "waf": "Security", + "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", + "id": "A02.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls" + }, + { + "category": "Defender For Cloud", + "subcategory": "Recommendations", + "text": "Security Score>70%", + "description": "Microsoft minimum target for all customers is 70%", + "waf": "Security", + "guid": "08032729-4798-4b15-98a2-19a46ceb5443", + "id": "A02.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls" + }, + { + "category": "Defender For Cloud", + "subcategory": "Security Alerts", + "text": "Security Alerts contain only those generated in the past 24 hours (remediate or disable older security alerts)", + "waf": "Security", + "guid": "50259226-4429-42bb-9285-37a55119bf8e", + "id": "A03.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident" + }, + { + "category": "Defender For Cloud", + "subcategory": "Workbooks", + "text": "If continuous export is enabled, default workbooks published to custom security dashboard", + "waf": "Security", + "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", + "id": "A04.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks" + }, + { + "category": "Defender For Cloud", + "subcategory": "Community", + "text": "Customer is aware of the value of the 'Community' page and has a regular cadence set up to review", + "waf": "Security", + "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", + "id": "A05.01", + "severity": "Medium", + "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud" + }, + { + "category": "Defender For Cloud", + "subcategory": "Secure Score", + "text": "All subscriptions protected by Security Center are shown (no subscription filter set)", + "description": "Customer Operational best practice - Transparency", + "waf": "Security", + "guid": "93846da9-7cc3-4923-856b-22586f4a1641", + "id": "A06.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security" + }, + { + "category": "Defender For Cloud", + "subcategory": "Regulatory Compliance", + "text": "Compliance controls are green for any required compliance requirements", + "waf": "Security", + "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", + "id": "A07.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard" + }, + { + "category": "Defender For Cloud", + "subcategory": "Azure Defender", + "text": "High severity VM vulnerabilities is zero (empty)", + "description": "Customer Operational best practice - verify", + "waf": "Security", + "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", + "id": "A08.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm" + }, + { + "category": "Defender For Cloud", + "subcategory": "Firewall Manager", + "text": "Hubs are protected by an Azure Firewall", + "waf": "Security", + "guid": "9603334b-df9c-4c23-918d-b61171265f4b", + "id": "A09.01", + "severity": "Medium", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679" + }, + { + "category": "Defender For Cloud", + "subcategory": "Firewall Manager", + "text": "Virtual Networks are protected by a Firewall", + "description": "Customer Operational best practice - verify", + "waf": "Security", + "guid": "b47a393a-0803-4272-a479-8b1578a219a4", + "id": "A09.02", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices" + }, + { + "category": "Defender For Cloud", + "subcategory": "Firewall Manager", + "text": "DDoS Standard enabled", + "waf": "Security", + "guid": "6ceb5443-5025-4922-9442-92bb628537a5", + "id": "A09.03", + "severity": "Medium", + "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/" + }, + { + "category": "Defender For Cloud", + "subcategory": "Coverage", + "text": "Verify that all subscriptions are covered (see pricing and settings to modify)", + "waf": "Security", + "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", + "id": "A10.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security" + }, + { + "category": "Azure Networking", + "subcategory": "Public IPs", + "text": "VM's with public IPs should be protected by NSG ", + "waf": "Security", + "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", + "id": "B01.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" + }, + { + "category": "Azure Networking", + "subcategory": "Public IPs", + "text": "VMs with public IPs are moved behind Azure Firewall Premium", + "description": "Customer operational best practice - verify", + "waf": "Security", + "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", + "id": "B01.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" + }, + { + "category": "Azure Networking", + "subcategory": "Public IPs", + "text": "VM's that don't need public IPs do not have public IPs (i.e. internal RDP only)", + "description": "Customer operational best practice - verify", + "waf": "Security", + "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", + "id": "B01.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access" + }, + { + "category": "Azure Networking", + "subcategory": "NSG", + "text": "NSG RBAC is used to restrict access to network security team", + "waf": "Security", + "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", + "id": "B02.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" + }, + { + "category": "Azure Networking", + "subcategory": "NSG", + "text": "NSG Inbound security rules do not contain a * (wildcard) in Source field", + "description": "Customer operational best practice - verify", + "waf": "Security", + "guid": "a209939b-da47-4778-b24c-116785c2fa55", + "id": "B02.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" + }, + { + "category": "Azure Networking", + "subcategory": "NSG", + "text": "NSG outbound security rules are used to control traffic to specific IP addresses for traffic not routed through a Firewall", + "description": "Customer operational best practice - verify", + "waf": "Security", + "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", + "id": "B02.03", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" + }, + { + "category": "Azure Networking", + "subcategory": "NSG", + "text": "NSG do not have Source as a * (wildcard) in place.", + "description": "Customer operational best practice - verify", + "waf": "Security", + "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", + "id": "B02.04", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" + }, + { + "category": "Azure Networking", + "subcategory": "NSG", + "text": "NSG Diagnostics send NetworkSecurityGroupEvent and NetworkSecurityGroupRuleCounter traffic to Sentinel LAW", + "waf": "Security", + "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", + "id": "B02.05", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log" + }, + { + "category": "Azure Networking", + "subcategory": "UDR", + "text": "UDR RBAC is used to restrict access to the network security team", + "waf": "Security", + "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", + "id": "B03.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" + }, + { + "category": "Azure Networking", + "subcategory": "UDR", + "text": "If Zero Trust, then UDR's are used to send all traffic to the Azure Firewall Premium", + "waf": "Security", + "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", + "id": "B03.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" + }, + { + "category": "Azure Networking", + "subcategory": "UDR", + "text": "UDR's that do not send all traffic to AzureFirewallPremium are known and documented.", + "description": "Customer operational best practice - verify", + "waf": "Security", + "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", + "id": "B03.03", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "Customer is familiar with Azure networking defaults / SDN default routing in Azure", + "waf": "Security", + "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", + "id": "B04.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "VNet RBAC is used to restrict access to the network security team", + "description": "Customer operational best practice - verify", + "waf": "Security", + "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", + "id": "B04.02", + "severity": "Medium", + "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "VNet Security recommendations are remediated and there are no 'At-risk' VNets ", + "waf": "Security", + "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", + "id": "B04.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "VNet Peering connections are understood and expected traffic flows are documented", + "waf": "Security", + "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", + "id": "B04.04", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "VNet Service Endpoints are in use, no legacy Public Service Endpoints exist", + "waf": "Security", + "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", + "id": "B04.05", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "VNet Private Endpoints are in use to allow access from on-premises environments, no legacy public endpoints exist", + "waf": "Security", + "guid": "1f625659-ee55-480a-9824-9c931213dbd7", + "id": "B04.06", + "severity": "High", + "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "VNet Monitoring enabled", + "waf": "Security", + "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", + "id": "B04.07", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "Secure traffic between pods using network policies in Azure Kubernetes Service (AKS)", + "waf": "Security", + "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731", + "id": "B04.08", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "VNet NVA (appliances) customer follows published architecture pattern", + "waf": "Security", + "guid": "3c005674-c1e9-445b-959c-373e7ed71623", + "id": "B04.09", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual Networks", + "text": "VNet Diagnostic settings are enabled and sending VMProtectionAlerts to the Azure Sentinel LAW", + "waf": "Security", + "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", + "id": "B04.10", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" + }, + { + "category": "Azure Networking", + "subcategory": "Connectivity", + "text": "Use ExpressRoute or VPN to access Azure resources from on-premises environments", + "waf": "Security", + "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", + "id": "B05.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual WAN", + "text": "VWAN RBAC is used to restrict access to the network security team", + "waf": "Security", + "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", + "id": "B06.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about" + }, + { + "category": "Azure Networking", + "subcategory": "Virtual WAN", + "text": "VWAN Customer is using Secure Hub or external Firewall to route and monitor traffic.", + "waf": "Security", + "guid": "718d1dca-1f62-4565-aee5-580a38249c93", + "id": "B06.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture" + }, + { + "category": "Azure Networking", + "subcategory": "Application Gateway", + "text": "AppGW RBAC is used to restrict access to the network security team", + "waf": "Security", + "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", + "id": "B07.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview" + }, + { + "category": "Azure Networking", + "subcategory": "Application Gateway", + "text": "AppGW All external facing web services are behind Application Gateways with WAF enabled ", + "waf": "Security", + "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", + "id": "B07.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" + }, + { + "category": "Azure Networking", + "subcategory": "Application Gateway", + "text": "AppGW All internal facing web services are behind Application Gateways with WAF enabled ", + "waf": "Security", + "guid": "94666731-3c00-4567-9c1e-945b459c373e", + "id": "B07.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" + }, + { + "category": "Azure Networking", + "subcategory": "Application Gateway", + "text": "AppGW - External facing has TLS/SSL enabled and redirects all traffic to 443 (no port 80 traffic)", + "waf": "Security", + "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", + "id": "B07.04", + "severity": "High", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview" + }, + { + "category": "Azure Networking", + "subcategory": "FrontDoor", + "text": "Front Door RBAC is used to restrict access to the network security team", + "waf": "Security", + "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", + "id": "B08.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/frontdoor/" + }, + { + "category": "Azure Networking", + "subcategory": "FrontDoor", + "text": "Front Door is associated with a WAF policy", + "waf": "Security", + "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", + "id": "B08.02", + "severity": "High", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json" + }, + { + "category": "Azure Networking", + "subcategory": "FrontDoor", + "text": "Front Door TLS/SSL policy is configured", + "waf": "Security", + "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", + "id": "B08.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https" + }, + { + "category": "Azure Networking", + "subcategory": "FrontDoor", + "text": "Front Door redirect port 80 to port 443 is configured (listeners)", + "waf": "Security", + "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", + "id": "B08.04", + "severity": "High", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect" + }, + { + "category": "Azure Networking", + "subcategory": "FrontDoor", + "text": "Front Door diagnostics logs send ApplicationGatewayAccessLog &ApplicationGateway FirewallLog to Sentinel LAW", + "waf": "Security", + "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", + "id": "B08.05", + "severity": "High", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics" + }, + { + "category": "Azure Networking", + "subcategory": "DDOS Protection", + "text": "Enabled for Firewall public IP's (all public IPs)", + "waf": "Security", + "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", + "id": "B09.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" + }, + { + "category": "Identity", + "subcategory": "Tenant", + "text": "Establish a single enterprise directory for managing identities of full-time employees and enterprise resources.", + "waf": "Security", + "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", + "id": "C01.01", + "severity": "High", + "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory" + }, + { + "category": "Identity", + "subcategory": "Tenant", + "text": "Synchronize your cloud identity with your existing identity systems.", + "waf": "Security", + "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", + "id": "C01.02", + "severity": "High", + "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems" + }, + { + "category": "Identity", + "subcategory": "Tenant", + "text": "Use cloud identity services to host non-employee accounts such as vendors, partners, and customers, rather than rather than including them in your on-premises directory.", + "waf": "Security", + "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", + "id": "C01.03", + "severity": "High", + "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties" + }, + { + "category": "Identity", + "subcategory": "Tenant", + "text": "Disable insecure legacy protocols for internet-facing services.", + "waf": "Security", + "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", + "id": "C01.04", + "severity": "High", + "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication" + }, + { + "category": "Identity", + "subcategory": "Tenant", + "text": "Enable single sign-on", + "waf": "Security", + "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", + "id": "C01.05", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on" + }, + { + "category": "Identity", + "subcategory": "Privileged administration", + "text": "Don\ufffdt synchronize accounts with the highest privilege access to on-premises resources as you synchronize your enterprise identity systems with cloud directories.", + "waf": "Security", + "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", + "id": "C02.01", + "severity": "High", + "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers" + }, + { + "category": "Identity", + "subcategory": "Privileged administration", + "text": "Limit the number of Global Administrators to less than 5", + "waf": "Security", + "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", + "id": "C02.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5" + }, + { + "category": "Identity", + "subcategory": "Privileged administration", + "text": "Use groups for Azure AD role assignments and delegate the role assignment", + "waf": "Security", + "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", + "id": "C02.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment" + }, + { + "category": "Identity", + "subcategory": "Privileged administration", + "text": "Ensure all critical impact admins are managed by enterprise directory to follow organizational policy enforcement.", + "waf": "Security", + "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", + "id": "C02.04", + "severity": "High", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins" + }, + { + "category": "Identity", + "subcategory": "Privileged administration", + "text": "Configure recurring access reviews to revoke unneeded permissions over time", + "waf": "Security", + "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", + "id": "C02.05", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time" + }, + { + "category": "Identity", + "subcategory": "Privileged administration", + "text": "Ensure critical impact admins use a workstation with elevated security protections and monitoring", + "waf": "Security", + "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", + "id": "C02.06", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security" + }, + { + "category": "Identity", + "subcategory": "External Identities", + "text": "Identity Providers: Verify external identity providers are known", + "waf": "Security", + "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", + "id": "C03.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c" + }, + { + "category": "Identity", + "subcategory": "External Identities", + "text": "External Collaboration Settings: Guest user access set to 'Guest user access is restricted?'", + "waf": "Security", + "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", + "id": "C03.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" + }, + { + "category": "Identity", + "subcategory": "External Identities", + "text": "External Collaboration Settings: Guest invite settings set to 'Only users assigned to specific admin roles'", + "waf": "Security", + "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", + "id": "C03.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" + }, + { + "category": "Identity", + "subcategory": "External Identities", + "text": "External Collaboration Settings: Enable guest self-service sign up via flows set to 'Disabled' ", + "waf": "Security", + "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", + "id": "C03.04", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" + }, + { + "category": "Identity", + "subcategory": "External Identities", + "text": "External Collaboration Settings: Collaboration restrictions set to 'Allow invitations to the specified domains'", + "waf": "Security", + "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", + "id": "C03.05", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" + }, + { + "category": "Identity", + "subcategory": "External Identities", + "text": "Access Reviews: Enabled for all groups", + "waf": "Security", + "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", + "id": "C03.06", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews" + }, + { + "category": "Identity", + "subcategory": "Enterprise Applications", + "text": "Consent & Permissions: Allow user consent for apps from verified publishers", + "waf": "Security", + "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", + "id": "C04.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent" + }, + { + "category": "Identity", + "subcategory": "Enterprise Applications", + "text": "Consent & Permissions: Allow group owner consent for selected group owners ", + "waf": "Security", + "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", + "id": "C04.02", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups" + }, + { + "category": "Identity", + "subcategory": "Custom Domains", + "text": "Only validated customer domains are registered", + "waf": "Security", + "guid": "bade4aad-1e8c-439e-a946-667313c00567", + "id": "C05.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain" + }, + { + "category": "Identity", + "subcategory": "Password Reset", + "text": "Self-service password reset policy requirement verified compliant.", + "waf": "Security", + "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", + "id": "C06.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr" + }, + { + "category": "Identity", + "subcategory": "Password Reset", + "text": "Set number of days before users are asked to re-confirm authentication information is not set to zero", + "waf": "Security", + "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", + "id": "C06.02", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" + }, + { + "category": "Identity", + "subcategory": "Password Reset", + "text": "Set number of methods required to reset password are selected", + "waf": "Security", + "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", + "id": "C06.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" + }, + { + "category": "Identity", + "subcategory": "User Setting", + "text": "Disable 'Users can register applications'", + "waf": "Security", + "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", + "id": "C07.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles" + }, + { + "category": "Identity", + "subcategory": "User Setting", + "text": "Restrict access to Administrative portal (portal.azure.com) to administrators only", + "waf": "Security", + "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", + "id": "C07.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions" + }, + { + "category": "Identity", + "subcategory": "User Setting", + "text": "Disable 'LinkedIn account connection'", + "waf": "Security", + "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", + "id": "C07.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration" + }, + { + "category": "Identity", + "subcategory": "Diagnostic Settings", + "text": "Enabled and send to Log Analytics workspace with Sentinel", + "waf": "Security", + "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", + "id": "C08.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring" + }, + { + "category": "Identity", + "subcategory": "PIM enabled", + "text": "Privileged Identity Management enabled", + "waf": "Security", + "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", + "id": "C09.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan" + }, + { + "category": "Identity", + "subcategory": "PIM enabled", + "text": "Implement 'just in time' (JIT) access to further lower the exposure time for privileged accounts (reduce standing access)", + "waf": "Security", + "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", + "id": "C09.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc" + }, + { + "category": "Identity", + "subcategory": "Conditional Access Policies", + "text": "Configure conditional access policies / Access Controls", + "waf": "Security", + "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", + "id": "C10.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common" + }, + { + "category": "Identity", + "subcategory": "Conditional Access Policies", + "text": "Conditions: Restricted Locations", + "waf": "Security", + "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", + "id": "C10.02", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition" + }, + { + "category": "Identity", + "subcategory": "Conditional Access Policies", + "text": "Access Controls: MFA enabled for all users", + "waf": "Security", + "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", + "id": "C10.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa" + }, + { + "category": "Identity", + "subcategory": "Conditional Access Policies", + "text": "Access Controls: Require MFA for Administrators", + "waf": "Security", + "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", + "id": "C10.04", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa" + }, + { + "category": "Identity", + "subcategory": "Conditional Access Policies", + "text": "Access Controls: Require MFA for Azure Management ", + "waf": "Security", + "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", + "id": "C10.05", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management" + }, + { + "category": "Identity", + "subcategory": "Conditional Access Policies", + "text": "Access Controls: Block Legacy Protocols", + "waf": "Security", + "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", + "id": "C10.06", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy" + }, + { + "category": "Identity", + "subcategory": "Conditional Access Policies", + "text": "Access Controls: Require devices to be marked as compliant", + "waf": "Security", + "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", + "id": "C10.07", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices" + }, + { + "category": "Identity", + "subcategory": "Guest users", + "text": "Is there a policy to track guest user accounts (i.e. usage/delete/disable)?", + "description": "Customer documented policy", + "waf": "Security", + "guid": "a7144351-e19d-4d34-929e-b7228137a151", + "id": "C11.01", + "severity": "Medium", + "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/" + }, + { + "category": "Identity", + "subcategory": "Identity Secure Score", + "text": "Implement Identity Secure Score based on best practices in your industry", + "waf": "Security", + "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", + "id": "C12.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score" + }, + { + "category": "Identity", + "subcategory": "Break Glass Accounts", + "text": "At least two break glass accounts have been created and policy around their use exists", + "waf": "Security", + "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", + "id": "C13.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access" + }, + { + "category": "VM Security Checks", + "subcategory": "Access Control", + "text": "Control VM Access leveraging Azure Policy", + "waf": "Security", + "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", + "id": "D01.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/governance/policy/overview" + }, + { + "category": "VM Security Checks", + "subcategory": "Access Control", + "text": "Reduce variability in your setup and deployment of VMs by leveraging templates", + "waf": "Security", + "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", + "id": "D01.02", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax" + }, + { + "category": "VM Security Checks", + "subcategory": "Access Control", + "text": "Secure privileged access to deploy VMS by reducing who has access to Resources through Governance", + "waf": "Security", + "guid": "b5945bda-4333-44fd-b91c-234182b65275", + "id": "D01.03", + "severity": "Medium", + "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models" + }, + { + "category": "VM Security Checks", + "subcategory": "High Availability ", + "text": "Use multiple VMs for your workloads for better availability ", + "waf": "Reliability", + "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", + "id": "D02.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service" + }, + { + "category": "VM Security Checks", + "subcategory": "High Availability ", + "text": "Deploy and test a disaster recovery solution ", + "waf": "Reliability", + "guid": "f219e4a1-eb58-4879-935d-227886d30b66", + "id": "D02.02", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm" + }, + { + "category": "VM Security Checks", + "subcategory": "High Availability ", + "text": "Availability sets", + "waf": "Reliability", + "guid": "c57be595-1900-4838-95c5-86cb291ec16a", + "id": "D02.03", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview" + }, + { + "category": "VM Security Checks", + "subcategory": "High Availability ", + "text": "Availability Zones", + "waf": "Reliability", + "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", + "id": "D02.04", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context" + }, + { + "category": "VM Security Checks", + "subcategory": "High Availability ", + "text": "Regional fault tolerance ", + "waf": "Reliability", + "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", + "id": "D02.05", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region" + }, + { + "category": "VM Security Checks", + "subcategory": "Protect against malware", + "text": "Install antimalware solutions", + "waf": "Security", + "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", + "id": "D03.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware" + }, + { + "category": "VM Security Checks", + "subcategory": "Protect against malware", + "text": "Integrate antimalware solution with Security Center", + "waf": "Security", + "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", + "id": "D03.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" + }, + { + "category": "VM Security Checks", + "subcategory": "Manage VM Updates", + "text": "Keep VMs up to date using Update Management with Azure Automation", + "waf": "Security", + "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", + "id": "D04.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview" + }, + { + "category": "VM Security Checks", + "subcategory": "Manage VM Updates", + "text": "Ensure Windows images for deployment have the most recent level of updates ", + "waf": "Security", + "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", + "id": "D04.02", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching" + }, + { + "category": "VM Security Checks", + "subcategory": "Manage VM Updates", + "text": "Rapidly apply security updates to VMs using Microsoft Defender for Cloud", + "waf": "Security", + "guid": "02145901-465d-438e-9309-ccbd979266bc", + "id": "D04.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/asset-inventory" + }, + { + "category": "VM Security Checks", + "subcategory": "Encrypt your VHDs", + "text": "Enable encryption on your VMs", + "waf": "Security", + "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", + "id": "D05.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview" + }, + { + "category": "VM Security Checks", + "subcategory": "Encrypt your VHDs", + "text": "Add Key Encryption Key (KEK) for added layer of security for encryption ", + "waf": "Security", + "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", + "id": "D05.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek" + }, + { + "category": "VM Security Checks", + "subcategory": "Encrypt your VHDs", + "text": "Take a snapshot of disks before encryption for rollback purposes", + "waf": "Security", + "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", + "id": "D05.03", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk" + }, + { + "category": "VM Security Checks", + "subcategory": "Restrict direct internet connection ", + "text": "Ensure only the central networking group has permissions to networking resources ", + "waf": "Security", + "guid": "5173676a-e466-491e-a835-ad942223e138", + "id": "D06.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles" + }, + { + "category": "VM Security Checks", + "subcategory": "Restrict direct internet connection ", + "text": "Identity and remediate exposed VMs that allow access from 'ANY' source IP address", + "waf": "Security", + "guid": "10523081-a941-4741-9833-ff7ad7c6d373", + "id": "D06.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" + }, + { + "category": "VM Security Checks", + "subcategory": "Restrict direct internet connection ", + "text": "Restrict management ports (RDP, SSH) using Just-in-Time Access", + "waf": "Security", + "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", + "id": "D06.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time" + }, + { + "category": "VM Security Checks", + "subcategory": "Restrict direct internet connection ", + "text": "Remove internet access and implement jump servers for RDP", + "waf": "Security", + "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", + "id": "D06.04", + "severity": "High", + "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html" + }, + { + "category": "VM Security Checks", + "subcategory": "Restrict direct internet connection ", + "text": "Remove direct logging into servers using RDP/SSH from internet and implement VPN or express route", + "waf": "Security", + "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", + "id": "D06.05", + "severity": "High", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling" + }, + { + "category": "VM Security Checks", + "subcategory": "Restrict direct internet connection ", + "text": "Leverage Azure Bastion as your RDP/SSH broker for added security and reduction in footprint", + "waf": "Security", + "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", + "id": "D06.06", + "severity": "High", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview" + }, + { + "category": "Sentinel", + "subcategory": "Architecture ", + "text": "All tenants contain have Sentinel enabled on at least one Log Analytics workspace", + "waf": "Security", + "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", + "id": "E01.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard" + }, + { + "category": "Sentinel", + "subcategory": "Architecture ", + "text": "Customer understands Sentinel architecture", + "waf": "Security", + "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", + "id": "E01.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture" + }, + { + "category": "Sentinel", + "subcategory": "Architecture ", + "text": "Customer knows how to monitor Incidents across multiple Sentinel instances", + "waf": "Security", + "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", + "id": "E01.03", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view" + }, + { + "category": "Sentinel", + "subcategory": "Overview", + "text": "No Incidents open more than 24 hours", + "waf": "Security", + "guid": "8989579e-76b8-497e-910a-7da7be9966e1", + "id": "E02.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics" + }, + { + "category": "Sentinel", + "subcategory": "News & Guides", + "text": "Customer have been shown the News & Guides tab", + "waf": "Security", + "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", + "id": "E03.01", + "severity": "Low", + "link": "https://learn.microsoft.com/azure/sentinel/whats-new" + }, + { + "category": "Sentinel", + "subcategory": "UEBA ", + "text": "UEBA Configured (Sentinel/Settings/Settings/Configure UEBA)", + "waf": "Security", + "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", + "id": "E04.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Azure Active Directory in configured and 'Last Log Received' shows today", + "waf": "Security", + "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", + "id": "E05.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Azure Active Directory Identity Protection is configured and 'Last Log Received' shows today", + "waf": "Security", + "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", + "id": "E05.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Azure Activity is configured is configured and 'Last Log Received' shows today", + "waf": "Security", + "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", + "id": "E05.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Microsoft Defender for Cloud is configured and 'Last Log Received' shows today", + "waf": "Security", + "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", + "id": "E05.04", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Azure Firewall is configured and 'Last Log Received' shows today", + "waf": "Security", + "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", + "id": "E05.05", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Windows Firewall is configured and 'Last Log Received' shows today", + "waf": "Security", + "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", + "id": "E05.06", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Security Events is configured with AMA and 'Last Log Received' shows today", + "waf": "Security", + "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", + "id": "E05.07", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Security Events - verify Azure computers are connected and sending data to the workspace", + "waf": "Security", + "guid": "1a4834ac-9322-423e-ae80-b123081a5417", + "id": "E05.08", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Security Events - verify non-Azure computers are connected and sending data to the workspace", + "waf": "Security", + "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", + "id": "E05.09", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Connector for AWS", + "waf": "Security", + "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", + "id": "E05.10", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3" + }, + { + "category": "Sentinel", + "subcategory": "Data Connectors", + "text": "Connector for GCP", + "waf": "Security", + "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", + "id": "E05.11", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" + }, + { + "category": "Sentinel", + "subcategory": "Analytics Rules", + "text": "Customer has enabled Analytics rules and configured Incidents ", + "waf": "Security", + "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", + "id": "E06.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in" + }, + { + "category": "Sentinel", + "subcategory": "Settings", + "text": "Customer does not have a daily cap enabled", + "waf": "Security", + "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", + "id": "E07.01", + "severity": "Medium", + "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/" + }, + { + "category": "Azure Firewall", + "subcategory": "Configuration", + "text": "Azure Firewall Premium deployed", + "waf": "Security", + "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", + "id": "F01.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall/premium-features" + }, + { + "category": "Azure Firewall", + "subcategory": "Configuration", + "text": "Quad zero/force tunning enabled through Azure Firewall", + "waf": "Security", + "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", + "id": "F01.02", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route" + }, + { + "category": "Azure Firewall", + "subcategory": "Access Control", + "text": "RBAC set to enable only authorized users", + "waf": "Security", + "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", + "id": "F02.01", + "severity": "Medium", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" + }, + { + "category": "Azure Firewall", + "subcategory": "Diagnostic Settings", + "text": "Diagnostics enabled and sending metrics to a Log Analytics workspace ", + "waf": "Security", + "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", + "id": "F03.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "Hubs and virtual networks are protected or connected through Firewall Premium", + "waf": "Security", + "guid": "b35478c3-4798-416b-8863-cffe1cac599e", + "id": "F04.01", + "severity": "High", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "Policy: Access controls are configured (RBAC)", + "waf": "Security", + "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", + "id": "F04.02", + "severity": "High", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "Policy: Parent policy is configured ", + "waf": "Security", + "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", + "id": "F04.03", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "Policy: Rule collections are defined", + "waf": "Security", + "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", + "id": "F04.04", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "Policy: DNAT policies are defined", + "waf": "Security", + "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", + "id": "F04.05", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "Policy: Network rules are defined", + "waf": "Security", + "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", + "id": "F04.06", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "Policy: Application rules are defined", + "waf": "Security", + "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", + "id": "F04.07", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall/features" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "DNS: Feature understood and applied or not applied", + "waf": "Security", + "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", + "id": "F04.08", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/firewall/dns-details" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "Threat Intelligence: Set to Alert & Deny", + "waf": "Security", + "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", + "id": "F04.09", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "Threat Intelligence: Allowed list (justify if they are being used - ie performance)", + "waf": "Security", + "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", + "id": "F04.10", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "TLS enabled", + "waf": "Security", + "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", + "id": "F04.11", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall/premium-certificates" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "IDPS enabled", + "waf": "Security", + "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", + "id": "F04.12", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing" + }, + { + "category": "Azure Firewall", + "subcategory": "Firewall Manager", + "text": "SNAT: Configured ", + "waf": "Security", + "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", + "id": "F04.13", + "severity": "High", + "link": "https://learn.microsoft.com/azure/firewall/snat-private-range" + }, + { + "category": "Azure Firewall", + "subcategory": "DDOS Protection", + "text": "Enabled for Firewall public IP's", + "waf": "Security", + "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", + "id": "F05.01", + "severity": "Medium", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" + } + ], + "categories": [ + { + "name": "Defender For Cloud" + }, + { + "name": "Azure Networking" + }, + { + "name": "Identity" + }, + { + "name": "VM Security Checks" + }, + { + "name": "Sentinel" + }, + { + "name": "Azure Firewall" + } + ], + "waf": [ + { + "name": "Reliability" + }, + { + "name": "Security" + }, + { + "name": "Cost" + }, + { + "name": "Operations" + }, + { + "name": "Performance" + } + ], + "yesno": [ + { + "name": "Yes" + }, + { + "name": "No" + } + ], + "status": [ + { + "name": "Not verified", + "description": "This check has not been looked at yet" + }, + { + "name": "Open", + "description": "There is an action item associated to this check" + }, + { + "name": "Fulfilled", + "description": "This check has been verified, and there are no further action items associated to it" + }, + { + "name": "Not required", + "description": "Recommendation understood, but not needed by current requirements" + }, + { + "name": "N/A", + "description": "Not applicable for current design" + } + ], + "severities": [ + { + "name": "High" + }, + { + "name": "Medium" + }, + { + "name": "Low" + } + ], + "metadata": { + "name": "Azure Security Review Checklist", + "state": "Deprecated", + "timestamp": "June 24, 2024" + } +} \ No newline at end of file diff --git a/checklists/security_checklist.es.json b/checklists/security_checklist.es.json index 35f3dba70..7d6c9183a 100644 --- a/checklists/security_checklist.es.json +++ b/checklists/security_checklist.es.json @@ -1,1328 +1,1669 @@ { - "metadata": { - "name": "Lista de comprobación de revisión de seguridad de Azure" - }, - "items": [ - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Habilitación de Security Center/Defender en todas las suscripciones", - "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Security Center/Defender habilitado en todos los espacios de trabajo de Log Analytics", - "guid": "349f0364-d28d-442e-abbb-c868255abc91", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Conjunto de recopilación de datos en 'Común'", - "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Las funciones de seguridad mejoradas de Defender for Cloud están habilitadas", - "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Aprovisionamiento automático habilitado según la directiva de la empresa (la directiva debe existir)", - "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Notificaciones por correo electrónico habilitadas según la directiva de la empresa (la directiva debe existir)", - "guid": "25759e35-680e-4782-9ac9-32213d027ff4", - "severity": "Bajo", - "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Se seleccionan las opciones Habilitar integraciones ", - "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "La integración de CI/CD está configurada", - "guid": "5b7bae4-4º-45e8-a79e-2e86667313c5", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "La exportación continua 'Event Hub' está habilitada si se utiliza SIEM de 3ª parte", - "guid": "05675c5e-985b-4859-a774-f7e371623b87", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "La exportación continua 'Log Analytics Workspace' está habilitada si no se usa Azure Sentinel", - "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Conector en la nube habilitado para AWS", - "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Conector en la nube habilitado para GCP", - "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp" - }, - { - "category": "Defender para la nube", - "subcategory": "Precios y configuración", - "text": "Si usa el proxy de aplicación de Azure AD, considere la posibilidad de integrarse con Microsoft Defender for Cloud Apps para supervisar el acceso a las aplicaciones en tiempo real y aplicar controles de seguridad avanzados.", - "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", - "severity": "Bajo", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security" - }, - { - "category": "Defender para la nube", - "subcategory": "Recomendaciones", - "text": "Todas las recomendaciones remediadas o deshabilitadas si no es necesario.", - "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls" - }, - { - "category": "Defender para la nube", - "subcategory": "Recomendaciones", - "text": "Puntuación de seguridad>70%", - "description": "El objetivo mínimo de Microsoft para todos los clientes es del 70 %", - "guid": "08032729-4798-4b15-98a2-19a46ceb5443", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls" - }, - { - "category": "Defender para la nube", - "subcategory": "Alertas de seguridad", - "text": "Las alertas de seguridad contienen solo las generadas en las últimas 24 horas (corregir o deshabilitar las alertas de seguridad más antiguas)", - "guid": "50259226-4429-42bb-9285-37a55119bf8e", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident" - }, - { - "category": "Defender para la nube", - "subcategory": "Libros", - "text": "Si la exportación continua está habilitada, los libros predeterminados se publican en el panel de seguridad personalizado", - "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks" - }, - { - "category": "Defender para la nube", - "subcategory": "Comunidad", - "text": "El cliente es consciente del valor de la página 'Comunidad' y tiene una cadencia regular configurada para revisar", - "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", - "severity": "Medio", - "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud" - }, - { - "category": "Defender para la nube", - "subcategory": "Puntuación segura", - "text": "Se muestran todas las suscripciones protegidas por Security Center (sin filtro de suscripción establecido)", - "description": "Mejores prácticas operativas del cliente - Transparencia", - "guid": "93846da9-7cc3-4923-856b-22586f4a1641", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security" - }, - { - "category": "Defender para la nube", - "subcategory": "Cumplimiento normativo", - "text": "Los controles de cumplimiento son ecológicos para cualquier requisito de cumplimiento requerido", - "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard" - }, - { - "category": "Defender para la nube", - "subcategory": "Azure Defender", - "text": "Las vulnerabilidades de VM de alta gravedad son cero (vacías)", - "description": "Mejores prácticas operativas del cliente: verificar", - "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm" - }, - { - "category": "Defender para la nube", - "subcategory": "Administrador de cortafuegos", - "text": "Los concentradores están protegidos por un Firewall de Azure", - "guid": "9603334b-df9c-4c23-918d-b61171265f4b", - "severity": "Medio", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679" - }, - { - "category": "Defender para la nube", - "subcategory": "Administrador de cortafuegos", - "text": "Las redes virtuales están protegidas por un firewall", - "description": "Mejores prácticas operativas del cliente: verificar", - "guid": "b47a393a-0803-4272-a479-8b1578a219a4", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices" - }, - { - "category": "Defender para la nube", - "subcategory": "Administrador de cortafuegos", - "text": "DDoS Standard habilitado", - "guid": "6ceb5443-5025-4922-9442-92bb628537a5", - "severity": "Medio", - "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/" - }, - { - "category": "Defender para la nube", - "subcategory": "Cobertura", - "text": "Verifique que todas las suscripciones estén cubiertas (consulte los precios y la configuración para modificar)", - "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "Azure Networking", - "subcategory": "IP públicas", - "text": "Las máquinas virtuales con IP públicas deben estar protegidas por NSG ", - "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Azure Networking", - "subcategory": "IP públicas", - "text": "Las máquinas virtuales con direcciones IP públicas se mueven detrás de Azure Firewall Premium", - "description": "Mejores prácticas operativas del cliente: verificar", - "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Azure Networking", - "subcategory": "IP públicas", - "text": "Las máquinas virtuales que no necesitan DIRECCIONES IP públicas no tienen IP públicas (es decir, solo RDP interno)", - "description": "Mejores prácticas operativas del cliente: verificar", - "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "NSG RBAC se utiliza para restringir el acceso al equipo de seguridad de red", - "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "Las reglas de seguridad de entrada de NSG no contienen un * (comodín) en el campo Origen", - "description": "Mejores prácticas operativas del cliente: verificar", - "guid": "a209939b-da47-4778-b24c-116785c2fa55", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "Las reglas de seguridad salientes de NSG se utilizan para controlar el tráfico a direcciones IP específicas para el tráfico no enrutado a través de un firewall", - "description": "Mejores prácticas operativas del cliente: verificar", - "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "NSG no tiene Source como * (comodín) en su lugar.", - "description": "Mejores prácticas operativas del cliente: verificar", - "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "NSG", - "text": "Los diagnósticos de NSG envían el tráfico NetworkSecurityGroupEvent y NetworkSecurityGroupRuleCounter a Sentinel LAW", - "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log" - }, - { - "category": "Azure Networking", - "subcategory": "UDR", - "text": "UDR RBAC se utiliza para restringir el acceso al equipo de seguridad de red", - "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "UDR", - "text": "Si Zero Trust, los UDR se usan para enviar todo el tráfico a Azure Firewall Premium", - "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "UDR", - "text": "Los UDR que no envían todo el tráfico a AzureFirewallPremium son conocidos y documentados.", - "description": "Mejores prácticas operativas del cliente: verificar", - "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "El cliente está familiarizado con los valores predeterminados de red de Azure / enrutamiento predeterminado de SDN en Azure", - "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "RBAC de red virtual se usa para restringir el acceso al equipo de seguridad de red", - "description": "Mejores prácticas operativas del cliente: verificar", - "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", - "severity": "Medio", - "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "Las recomendaciones de seguridad de la red virtual se han corregido y no hay redes virtuales \"en riesgo\" ", - "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "Se comprenden las conexiones de emparejamiento de red virtual y se documentan los flujos de tráfico esperados", - "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "Los extremos de servicio de red virtual están en uso, no existen extremos de servicio público heredados", - "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "Los puntos de conexión privados de red virtual están en uso para permitir el acceso desde entornos locales, no existen puntos de enlace públicos heredados", - "guid": "1f625659-ee55-480a-9824-9c931213dbd7", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "Supervisión de red virtual habilitada", - "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "Proteger el tráfico entre pods mediante directivas de red en Azure Kubernetes Service (AKS)", - "guid": "2055b29b-ade4-4th-8e8c-39ec94666731", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "El cliente de VNet NVA (dispositivos) sigue el patrón de arquitectura publicado", - "guid": "3c005674-c1e9-445b-959c-373e7ed71623", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva" - }, - { - "category": "Azure Networking", - "subcategory": "Redes virtuales", - "text": "La configuración de diagnóstico de red virtual está habilitada y envía VMProtectionAlerts a Azure Sentinel LAW", - "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Azure Networking", - "subcategory": "Conectividad", - "text": "Usar ExpressRoute o VPN para acceder a los recursos de Azure desde entornos locales", - "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual WAN", - "text": "VWAN RBAC se utiliza para restringir el acceso al equipo de seguridad de red", - "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about" - }, - { - "category": "Azure Networking", - "subcategory": "Virtual WAN", - "text": "El cliente de VWAN está utilizando Secure Hub o Firewall externo para enrutar y monitorear el tráfico.", - "guid": "718d1dca-1f62-4565-aee5-580a38249c93", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture" - }, - { - "category": "Azure Networking", - "subcategory": "Puerta de enlace de aplicaciones", - "text": "AppGW RBAC se utiliza para restringir el acceso al equipo de seguridad de red", - "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview" - }, - { - "category": "Azure Networking", - "subcategory": "Puerta de enlace de aplicaciones", - "text": "AppGW Todos los servicios web externos están conectados a Application Gateways con WAF habilitado ", - "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Azure Networking", - "subcategory": "Puerta de enlace de aplicaciones", - "text": "AppGW Todos los servicios web internos están integrados en Application Gateways con WAF habilitado ", - "guid": "94666731-3c00-4567-9c1e-945b459c373e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Azure Networking", - "subcategory": "Puerta de enlace de aplicaciones", - "text": "AppGW - La cara externa tiene TLS / SSL habilitado y redirige todo el tráfico a 443 (sin tráfico del puerto 80)", - "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview" - }, - { - "category": "Azure Networking", - "subcategory": "Puerta frontal", - "text": "Front Door RBAC se utiliza para restringir el acceso al equipo de seguridad de red", - "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/frontdoor/" - }, - { - "category": "Azure Networking", - "subcategory": "Puerta frontal", - "text": "Front Door está asociado a una política WAF", - "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json" - }, - { - "category": "Azure Networking", - "subcategory": "Puerta frontal", - "text": "La directiva TLS/SSL de puerta principal está configurada", - "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https" - }, - { - "category": "Azure Networking", - "subcategory": "Puerta frontal", - "text": "El puerto de redirección de la puerta principal 80 al puerto 443 está configurado (oyentes)", - "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect" - }, - { - "category": "Azure Networking", - "subcategory": "Puerta frontal", - "text": "Los registros de diagnóstico de Front Door envían ApplicationGatewayAccessLog &ApplicationGateway FirewallLog a Sentinel LAW", - "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics" - }, - { - "category": "Azure Networking", - "subcategory": "Protección DDOS", - "text": "Habilitado para IP públicas de Firewall (todas las IP públicas)", - "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - }, - { - "category": "Identidad", - "subcategory": "Arrendatario", - "text": "Establezca un directorio empresarial único para administrar las identidades de los empleados a tiempo completo y los recursos empresariales.", - "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory" - }, - { - "category": "Identidad", - "subcategory": "Arrendatario", - "text": "Sincronice su identidad en la nube con sus sistemas de identidad existentes.", - "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems" - }, - { - "category": "Identidad", - "subcategory": "Arrendatario", - "text": "Use los servicios de identidad en la nube para hospedar cuentas que no sean de empleados, como proveedores, socios y clientes, en lugar de incluirlos en su directorio local.", - "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties" - }, - { - "category": "Identidad", - "subcategory": "Arrendatario", - "text": "Deshabilite los protocolos heredados inseguros para los servicios orientados a Internet.", - "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication" - }, - { - "category": "Identidad", - "subcategory": "Arrendatario", - "text": "Habilitar el inicio de sesión único", - "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on" - }, - { - "category": "Identidad", - "subcategory": "Administración privilegiada", - "text": "No sincronice cuentas con el acceso con privilegios más altos a los recursos locales mientras sincroniza sus sistemas de identidad empresarial con directorios en la nube.", - "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers" - }, - { - "category": "Identidad", - "subcategory": "Administración privilegiada", - "text": "Limitar el número de administradores globales a menos de 5", - "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5" - }, - { - "category": "Identidad", - "subcategory": "Administración privilegiada", - "text": "Usar grupos para asignaciones de roles de Azure AD y delegar la asignación de roles", - "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment" - }, - { - "category": "Identidad", - "subcategory": "Administración privilegiada", - "text": "Asegúrese de que todos los administradores de impacto crítico sean administrados por el directorio empresarial para seguir la aplicación de las políticas de la organización.", - "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins" - }, - { - "category": "Identidad", - "subcategory": "Administración privilegiada", - "text": "Configurar revisiones de acceso recurrentes para revocar permisos innecesarios a lo largo del tiempo", - "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time" - }, - { - "category": "Identidad", - "subcategory": "Administración privilegiada", - "text": "Garantice que los administradores de impacto crítico utilicen una estación de trabajo con protecciones de seguridad y supervisión elevadas", - "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security" - }, - { - "category": "Identidad", - "subcategory": "Identidades externas", - "text": "Proveedores de identidad: verifique que los proveedores de identidad externos sean conocidos", - "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c" - }, - { - "category": "Identidad", - "subcategory": "Identidades externas", - "text": "Configuración de colaboración externa: ¿El acceso de usuario invitado se establece en '¿El acceso de usuario invitado está restringido?'", - "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identidad", - "subcategory": "Identidades externas", - "text": "Configuración de colaboración externa: la configuración de invitación de invitado se establece en 'Solo usuarios asignados a roles de administrador específicos'", - "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identidad", - "subcategory": "Identidades externas", - "text": "Configuración de colaboración externa: habilite el registro de autoservicio de invitados a través de flujos establecidos en 'Deshabilitado' ", - "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identidad", - "subcategory": "Identidades externas", - "text": "Configuración de colaboración externa: restricciones de colaboración establecidas en 'Permitir invitaciones a los dominios especificados'", - "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identidad", - "subcategory": "Identidades externas", - "text": "Revisiones de acceso: habilitado para todos los grupos", - "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews" - }, - { - "category": "Identidad", - "subcategory": "Aplicaciones empresariales", - "text": "Consentimiento y permisos: permitir el consentimiento del usuario para aplicaciones de editores verificados", - "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent" - }, - { - "category": "Identidad", - "subcategory": "Aplicaciones empresariales", - "text": "Consentimiento y permisos: Permitir el consentimiento del propietario del grupo para los propietarios de grupos seleccionados ", - "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups" - }, - { - "category": "Identidad", - "subcategory": "Dominios personalizados", - "text": "Solo se registran los dominios de clientes validados", - "guid": "bade4aad-1e8c-439e-a946-667313c00567", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain" - }, - { - "category": "Identidad", - "subcategory": "Restablecimiento de contraseña", - "text": "Requisito de directiva de restablecimiento de contraseña de autoservicio verificado conforme.", - "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr" - }, - { - "category": "Identidad", - "subcategory": "Restablecimiento de contraseña", - "text": "Establecer el número de días antes de que se pida a los usuarios que vuelvan a confirmar que la información de autenticación no se establece en cero", - "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "Identidad", - "subcategory": "Restablecimiento de contraseña", - "text": "Se selecciona el número establecido de métodos necesarios para restablecer la contraseña", - "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "Identidad", - "subcategory": "Configuración de usuario", - "text": "Deshabilitar 'Los usuarios pueden registrar aplicaciones'", - "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles" - }, - { - "category": "Identidad", - "subcategory": "Configuración de usuario", - "text": "Restringir el acceso al portal administrativo (portal.azure.com) solo a los administradores", - "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions" - }, - { - "category": "Identidad", - "subcategory": "Configuración de usuario", - "text": "Deshabilite la 'conexión de la cuenta de LinkedIn'", - "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration" - }, - { - "category": "Identidad", - "subcategory": "Configuración de diagnóstico", - "text": "Habilitado y enviar al área de trabajo de Log Analytics con Sentinel", - "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring" - }, - { - "category": "Identidad", - "subcategory": "PIM habilitado", - "text": "Administración de identidades privilegiada habilitada", - "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan" - }, - { - "category": "Identidad", - "subcategory": "PIM habilitado", - "text": "Implementar el acceso \"justo a tiempo\" (JIT) para reducir aún más el tiempo de exposición de las cuentas privilegiadas (reducir el acceso permanente)", - "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc" - }, - { - "category": "Identidad", - "subcategory": "Directivas de acceso condicional", - "text": "Configurar directivas de acceso condicional / Controles de acceso", - "guid": "6e6a8dc4-a20e-427b-9e29-711b1352estado", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common" - }, - { - "category": "Identidad", - "subcategory": "Directivas de acceso condicional", - "text": "Condiciones: Ubicaciones restringidas", - "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition" - }, - { - "category": "Identidad", - "subcategory": "Directivas de acceso condicional", - "text": "Controles de acceso: MFA habilitado para todos los usuarios", - "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa" - }, - { - "category": "Identidad", - "subcategory": "Directivas de acceso condicional", - "text": "Controles de acceso: Requerir MFA para administradores", - "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa" - }, - { - "category": "Identidad", - "subcategory": "Directivas de acceso condicional", - "text": "Controles de acceso: requerir MFA para Azure Management ", - "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management" - }, - { - "category": "Identidad", - "subcategory": "Directivas de acceso condicional", - "text": "Controles de acceso: Bloquear protocolos heredados", - "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy" - }, - { - "category": "Identidad", - "subcategory": "Directivas de acceso condicional", - "text": "Controles de acceso: requieren que los dispositivos estén marcados como compatibles", - "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices" - }, - { - "category": "Identidad", - "subcategory": "Usuarios invitados", - "text": "¿Existe una política para rastrear las cuentas de usuario invitado (es decir, usar/eliminar/deshabilitar)?", - "description": "Política documentada del cliente", - "guid": "a7144351-e19d-4d34-929e-b7228137a151", - "severity": "Medio", - "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/" - }, - { - "category": "Identidad", - "subcategory": "Puntuación segura de identidad", - "text": "Implemente Identity Secure Score basado en las mejores prácticas de su sector", - "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score" - }, - { - "category": "Identidad", - "subcategory": "Cuentas de Break Glass", - "text": "Se han creado al menos dos cuentas de break glass y existe una política en torno a su uso.", - "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Control de acceso", - "text": "Control del acceso a máquinas virtuales mediante la directiva de Azure", - "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/governance/policy/overview" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Control de acceso", - "text": "Reduzca la variabilidad en la configuración e implementación de máquinas virtuales aprovechando las plantillas", - "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Control de acceso", - "text": "Acceso privilegiado seguro para implementar VMS al reducir quién tiene acceso a los recursos a través de la gobernanza", - "guid": "b5945bda-4333-44fd-b91c-234182b65275", - "severity": "Medio", - "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Alta disponibilidad ", - "text": "Use varias máquinas virtuales para sus cargas de trabajo para una mejor disponibilidad ", - "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Alta disponibilidad ", - "text": "Implementar y probar una solución de recuperación ante desastres ", - "guid": "f219e4a1-eb58-4879-935d-227886d30b66", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Alta disponibilidad ", - "text": "Conjuntos de disponibilidad", - "guid": "c57be595-1900-4838-95c5-86cb291ec16a", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Alta disponibilidad ", - "text": "Zonas de disponibilidad", - "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Alta disponibilidad ", - "text": "Tolerancia a fallos regional ", - "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Protección contra el malware", - "text": "Instalar soluciones antimalware", - "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Protección contra el malware", - "text": "Integre la solución antimalware con Security Center", - "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Administrar actualizaciones de máquinas virtuales", - "text": "Mantenga actualizadas las máquinas virtuales mediante La administración de actualizaciones con Automatización de Azure", - "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Administrar actualizaciones de máquinas virtuales", - "text": "Asegúrese de que las imágenes de Windows para la implementación tengan el nivel más reciente de actualizaciones ", - "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Administrar actualizaciones de máquinas virtuales", - "text": "Aplique rápidamente actualizaciones de seguridad a las máquinas virtuales con Microsoft Defender para la nube", - "guid": "02145901-465d-438e-9309-ccbd979266bc", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/asset-inventory" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Cifre sus VHD", - "text": "Habilite el cifrado en sus máquinas virtuales", - "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Cifre sus VHD", - "text": "Agregar clave de cifrado de clave (KEK) para una capa adicional de seguridad para el cifrado ", - "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Cifre sus VHD", - "text": "Tome una instantánea de los discos antes del cifrado para fines de reversión", - "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Restringir la conexión directa a Internet ", - "text": "Asegúrese de que solo el grupo de red central tiene permisos para los recursos de red ", - "guid": "5173676a-e466-491e-a835-ad942223E138", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Restringir la conexión directa a Internet ", - "text": "Identifique y corrija las máquinas virtuales expuestas que permiten el acceso desde 'CUALQUIER' complemento de IP de origen", - "guid": "10523081-a941-4741-9833-ff7ad7c6d373", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Restringir la conexión directa a Internet ", - "text": "Restringir los puertos de administración (RDP, SSH) mediante el acceso justo a tiempo", - "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Restringir la conexión directa a Internet ", - "text": "Quitar el acceso a Internet e implementar servidores de salto para RDP", - "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", - "severity": "Alto", - "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Restringir la conexión directa a Internet ", - "text": "Elimine el inicio de sesión directo en los servidores que usan RDP / SSH de Internet e implemente VPN o ruta rápida", - "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling" - }, - { - "category": "Comprobaciones de seguridad de VM", - "subcategory": "Restringir la conexión directa a Internet ", - "text": "Aproveche Azure Bastion como su agente RDP/SSH para mayor seguridad y reducción de la huella", - "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview" - }, - { - "category": "Centinela", - "subcategory": "Arquitectura ", - "text": "Todos los inquilinos que contienen Sentinel tiene habilitado en al menos un área de trabajo de Log Analytics", - "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard" - }, - { - "category": "Centinela", - "subcategory": "Arquitectura ", - "text": "El cliente entiende la arquitectura de Sentinel", - "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture" - }, - { - "category": "Centinela", - "subcategory": "Arquitectura ", - "text": "El cliente sabe cómo supervisar los incidentes en varias instancias de Sentinel", - "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view" - }, - { - "category": "Centinela", - "subcategory": "Visión general", - "text": "No Hay incidencias abierto más de 24 horas", - "guid": "8989579e-76b8-497e-910A-7Da7be9966E1", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics" - }, - { - "category": "Centinela", - "subcategory": "Noticias y Guías", - "text": "A los clientes se les ha mostrado la pestaña Noticias y guías", - "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", - "severity": "Bajo", - "link": "https://learn.microsoft.com/azure/sentinel/whats-new" - }, - { - "category": "Centinela", - "subcategory": "UEBA ", - "text": "UEBA configurado (Sentinel/Settings/Settings/Configure UEBA)", - "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Azure Active Directory en configurado y 'Último registro recibido' se muestra hoy", - "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Azure Active Directory Identity Protection está configurado y 'Último registro recibido' se muestra hoy", - "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Azure Activity está configurado y 'Último registro recibido' se muestra hoy", - "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Microsoft Defender para Cloud está configurado y 'Last Log Received' se muestra hoy", - "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Azure Firewall está configurado y 'Último registro recibido' se muestra hoy", - "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Firewall de Windows está configurado y 'Último registro recibido' se muestra hoy", - "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Security Events está configurado con AMA y 'Last Log Received' se muestra hoy", - "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Eventos de seguridad: compruebe que los equipos de Azure están conectados y envían datos al área de trabajo", - "guid": "1a4834ac-9322-423e-ae80-b123081a5417", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Eventos de seguridad: compruebe que los equipos que no son de Azure están conectados y envían datos al área de trabajo", - "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Conector para AWS", - "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3" - }, - { - "category": "Centinela", - "subcategory": "Conectores de datos", - "text": "Conector para GCP", - "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "Centinela", - "subcategory": "Reglas de análisis", - "text": "El cliente ha habilitado las reglas de Analytics y ha configurado incidentes ", - "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in" - }, - { - "category": "Centinela", - "subcategory": "Configuración", - "text": "El cliente no tiene un límite diario habilitado", - "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", - "severity": "Medio", - "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/" - }, - { - "category": "Azure Firewall", - "subcategory": "Configuración", - "text": "Implementación de Azure Firewall Premium", - "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/premium-features" - }, - { - "category": "Azure Firewall", - "subcategory": "Configuración", - "text": "Ajuste de cuatro cero/fuerza habilitado a través de Azure Firewall", - "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route" - }, - { - "category": "Azure Firewall", - "subcategory": "Control de acceso", - "text": "RBAC establecido para habilitar solo usuarios autorizados", - "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", - "severity": "Medio", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "Configuración de diagnóstico", - "text": "Diagnóstico habilitado y envío de métricas a un área de trabajo de Log Analytics ", - "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "Los concentradores y las redes virtuales están protegidos o conectados a través de Firewall Premium", - "guid": "b35478c3-4798-416b-8863-cffe1cac599e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "Directiva: Los controles de acceso están configurados (RBAC)", - "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", - "severity": "Alto", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "Directiva: la directiva principal está configurada ", - "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "Directiva: se definen las colecciones de reglas", - "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "Política: Se definen las políticas de DNAT", - "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "Directiva: Se definen las reglas de red", - "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "Directiva: Se definen las reglas de aplicación", - "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/features" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "DNS: Característica entendida y aplicada o no aplicada", - "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/firewall/dns-details" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "Inteligencia de amenazas: Configurado para alertar y denegar", - "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "Inteligencia de amenazas: Lista permitida (justifique si se están utilizando, es decir, rendimiento)", - "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "TLS habilitado", - "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/premium-certificates" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "IDPS habilitados", - "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Administrador de cortafuegos", - "text": "SNAT: Configurado ", - "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/snat-private-range" - }, - { - "category": "Azure Firewall", - "subcategory": "Protección DDOS", - "text": "Habilitado para IP públicas de Firewall", - "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", - "severity": "Medio", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - } - ], - "severities": [ - { - "name": "Alto" - }, - { - "name": "Medio" - }, - { - "name": "Bajo" - } - ], - "status": [ - { - "name": "No verificado", - "description": "Esta comprobación aún no se ha analizado" - }, - { - "name": "Abrir", - "description": "Hay un elemento de acción asociado a esta comprobación" - }, - { - "name": "Cumplido", - "description": "Esta comprobación se ha verificado y no hay más elementos de acción asociados a ella" - }, - { - "name": "No es necesario", - "description": "Recomendación entendida, pero no necesaria por los requisitos actuales" - }, - { - "name": "N/A", - "description": "No aplicable para el diseño actual" - } - ], - "categories": [ - { - "name": "Defender para la nube" - }, - { - "name": "Azure Networking" - }, - { - "name": "Identidad" - }, - { - "name": "Comprobaciones de seguridad de VM" - }, - { - "name": "Centinela" - }, - { - "name": "Azure Firewall" - } - ] -} + "categories": [ + { + "name": "Defender For Cloud" + }, + { + "name": "Redes de Azure" + }, + { + "name": "Identidad" + }, + { + "name": "Comprobaciones de seguridad de VM" + }, + { + "name": "Centinela" + }, + { + "name": "Azure Firewall" + } + ], + "items": [ + { + "category": "Defender For Cloud", + "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", + "id": "A01.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", + "severity": "Alto", + "subcategory": "Precios y configuración", + "text": "Habilitación de Security Center/Defender en todas las suscripciones", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "349f0364-d28d-442e-abbb-c868255abc91", + "id": "A01.02", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "Alto", + "subcategory": "Precios y configuración", + "text": "Security Center/Defender habilitado en todas las áreas de trabajo de Log Analytics", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", + "id": "A01.03", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal", + "severity": "Medio", + "subcategory": "Precios y configuración", + "text": "Recopilación de datos establecida en 'Común'", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", + "id": "A01.04", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "Alto", + "subcategory": "Precios y configuración", + "text": "Las características de seguridad mejoradas de Defender for Cloud están habilitadas", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", + "id": "A01.05", + "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection", + "severity": "Medio", + "subcategory": "Precios y configuración", + "text": "Aprovisionamiento automático habilitado según la directiva de la empresa (la directiva debe existir)", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "25759e35-680e-4782-9ac9-32213d027ff4", + "id": "A01.06", + "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details", + "severity": "Bajo", + "subcategory": "Precios y configuración", + "text": "Notificaciones por correo electrónico habilitadas según la política de la empresa (la directiva debe existir)", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", + "id": "A01.07", + "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows", + "severity": "Medio", + "subcategory": "Precios y configuración", + "text": "Se seleccionan las opciones de habilitación de integraciones ", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "5b7abae4-4aad-45e8-a79e-2e86667313c5", + "id": "A01.08", + "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd", + "severity": "Medio", + "subcategory": "Precios y configuración", + "text": "La integración de CI/CD está configurada", + "waf": "Operaciones" + }, + { + "category": "Defender For Cloud", + "guid": "05675c5e-985b-4859-a774-f7e371623b87", + "id": "A01.09", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "Alto", + "subcategory": "Precios y configuración", + "text": "La exportación continua \"Centro de eventos\" está habilitada si se usa SIEM de terceros", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", + "id": "A01.10", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "Medio", + "subcategory": "Precios y configuración", + "text": "La exportación continua \"Área de trabajo de Log Analytics\" está habilitada si no se usa Azure Sentinel", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", + "id": "A01.11", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "Alto", + "subcategory": "Precios y configuración", + "text": "Conector en la nube habilitado para AWS", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", + "id": "A01.12", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp", + "severity": "Alto", + "subcategory": "Precios y configuración", + "text": "Conector en la nube habilitado para GCP", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", + "id": "A01.13", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security", + "severity": "Bajo", + "subcategory": "Precios y configuración", + "text": "Si usa el proxy de aplicación de Azure AD, considere la posibilidad de integrarse con Microsoft Defender for Cloud Apps para supervisar el acceso a las aplicaciones en tiempo real y aplicar controles de seguridad avanzados.", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", + "id": "A02.01", + "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls", + "severity": "Medio", + "subcategory": "Recomendaciones", + "text": "Todas las recomendaciones se corrigen o deshabilitan si no son necesarias.", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "description": "El objetivo mínimo de Microsoft para todos los clientes es del 70 %", + "guid": "08032729-4798-4b15-98a2-19a46ceb5443", + "id": "A02.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls", + "severity": "Alto", + "subcategory": "Recomendaciones", + "text": "Puntuación de seguridad>70%", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "50259226-4429-42bb-9285-37a55119bf8e", + "id": "A03.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident", + "severity": "Medio", + "subcategory": "Alertas de seguridad", + "text": "Las alertas de seguridad contienen solo las generadas en las últimas 24 horas (corrija o deshabilite las alertas de seguridad más antiguas)", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", + "id": "A04.01", + "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks", + "severity": "Medio", + "subcategory": "Libros", + "text": "Si la exportación continua está habilitada, los libros de trabajo predeterminados se publican en el panel de seguridad personalizado", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", + "id": "A05.01", + "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud", + "severity": "Medio", + "subcategory": "Comunidad", + "text": "El cliente es consciente del valor de la página \"Comunidad\" y tiene una cadencia regular configurada para revisar", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "description": "Mejores prácticas operativas para el cliente - Transparencia", + "guid": "93846da9-7cc3-4923-856b-22586f4a1641", + "id": "A06.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security", + "severity": "Alto", + "subcategory": "Puntuación segura", + "text": "Se muestran todas las suscripciones protegidas por Security Center (sin establecer filtros de suscripción)", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", + "id": "A07.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard", + "severity": "Alto", + "subcategory": "Cumplimiento normativo", + "text": "Los controles de cumplimiento son ecológicos para cualquier requisito de cumplimiento requerido", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "description": "Prácticas recomendadas para el cliente: verificación", + "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", + "id": "A08.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm", + "severity": "Alto", + "subcategory": "Azure Defender", + "text": "Las vulnerabilidades de VM de alta gravedad son cero (vacías)", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "9603334b-df9c-4c23-918d-b61171265f4b", + "id": "A09.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679", + "severity": "Medio", + "subcategory": "Administrador de cortafuegos", + "text": "Los centros están protegidos por Azure Firewall", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "description": "Prácticas recomendadas para el cliente: verificación", + "guid": "b47a393a-0803-4272-a479-8b1578a219a4", + "id": "A09.02", + "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices", + "severity": "Medio", + "subcategory": "Administrador de cortafuegos", + "text": "Las redes virtuales están protegidas por un firewall", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "6ceb5443-5025-4922-9442-92bb628537a5", + "id": "A09.03", + "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/", + "severity": "Medio", + "subcategory": "Administrador de cortafuegos", + "text": "DDoS Standard habilitado", + "waf": "Seguridad" + }, + { + "category": "Defender For Cloud", + "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", + "id": "A10.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "Alto", + "subcategory": "Cobertura", + "text": "Compruebe que todas las suscripciones están cubiertas (consulte los precios y la configuración para modificar)", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", + "id": "B01.01", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "Alto", + "subcategory": "IPs públicas", + "text": "Las máquinas virtuales con direcciones IP públicas deben protegerse mediante un grupo de seguridad de red ", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "description": "Prácticas recomendadas para el cliente: verificación", + "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", + "id": "B01.02", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "Alto", + "subcategory": "IPs públicas", + "text": "Las máquinas virtuales con direcciones IP públicas se mueven detrás de Azure Firewall Premium", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "description": "Prácticas recomendadas para el cliente: verificación", + "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", + "id": "B01.03", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "severity": "Alto", + "subcategory": "IPs públicas", + "text": "Las máquinas virtuales que no necesitan direcciones IP públicas no tienen direcciones IP públicas (es decir, solo RDP interno)", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", + "id": "B02.01", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "Medio", + "subcategory": "Grupo de seguridad de red", + "text": "RBAC de grupo de seguridad de red se usa para restringir el acceso al equipo de seguridad de red", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "description": "Prácticas recomendadas para el cliente: verificación", + "guid": "a209939b-da47-4778-b24c-116785c2fa55", + "id": "B02.02", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "Alto", + "subcategory": "Grupo de seguridad de red", + "text": "Las reglas de seguridad de entrada del grupo de seguridad de red no contienen un * (comodín) en el campo Origen", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "description": "Prácticas recomendadas para el cliente: verificación", + "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", + "id": "B02.03", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "Medio", + "subcategory": "Grupo de seguridad de red", + "text": "Las reglas de seguridad de salida de grupo de seguridad de red se usan para controlar el tráfico a direcciones IP específicas para el tráfico que no se enruta a través de un firewall", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "description": "Prácticas recomendadas para el cliente: verificación", + "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", + "id": "B02.04", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "Alto", + "subcategory": "Grupo de seguridad de red", + "text": "El grupo de seguridad de red no tiene Source como * (comodín) en su lugar.", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", + "id": "B02.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log", + "severity": "Medio", + "subcategory": "Grupo de seguridad de red", + "text": "Los diagnósticos de NSG envían tráfico NetworkSecurityGroupEvent y NetworkSecurityGroupRuleCounter a Sentinel LAW", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", + "id": "B03.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "Medio", + "subcategory": "UDR", + "text": "RBAC de UDR se usa para restringir el acceso al equipo de seguridad de red", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", + "id": "B03.02", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "Alto", + "subcategory": "UDR", + "text": "Si es Confianza cero, se usan UDR para enviar todo el tráfico a Azure Firewall Premium", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "description": "Prácticas recomendadas para el cliente: verificación", + "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", + "id": "B03.03", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "Medio", + "subcategory": "UDR", + "text": "Las UDR que no envían todo el tráfico a AzureFirewallPremium son conocidas y están documentadas.", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", + "id": "B04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default", + "severity": "Alto", + "subcategory": "Redes virtuales", + "text": "El cliente está familiarizado con los valores predeterminados de red de Azure o el enrutamiento predeterminado de SDN en Azure", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "description": "Prácticas recomendadas para el cliente: verificación", + "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", + "id": "B04.02", + "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672", + "severity": "Medio", + "subcategory": "Redes virtuales", + "text": "RBAC de red virtual se usa para restringir el acceso al equipo de seguridad de red", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", + "id": "B04.03", + "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference", + "severity": "Alto", + "subcategory": "Redes virtuales", + "text": "Se corrigen las recomendaciones de seguridad de red virtual y no hay redes virtuales \"en riesgo\" ", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", + "id": "B04.04", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "severity": "Alto", + "subcategory": "Redes virtuales", + "text": "Se comprenden las conexiones de emparejamiento de red virtual y se documentan los flujos de tráfico esperados", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", + "id": "B04.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview", + "severity": "Alto", + "subcategory": "Redes virtuales", + "text": "Los puntos de conexión de servicio de red virtual están en uso, no existen puntos de conexión de servicio público heredados", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "1f625659-ee55-480a-9824-9c931213dbd7", + "id": "B04.06", + "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview", + "severity": "Alto", + "subcategory": "Redes virtuales", + "text": "Los puntos de conexión privados de red virtual están en uso para permitir el acceso desde entornos locales, no existen puntos de conexión públicos heredados", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", + "id": "B04.07", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "Alto", + "subcategory": "Redes virtuales", + "text": "Supervisión de red virtual habilitada", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731", + "id": "B04.08", + "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies", + "severity": "Alto", + "subcategory": "Redes virtuales", + "text": "Protección del tráfico entre pods mediante directivas de red en Azure Kubernetes Service (AKS)", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "3c005674-c1e9-445b-959c-373e7ed71623", + "id": "B04.09", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva", + "severity": "Alto", + "subcategory": "Redes virtuales", + "text": "El cliente de NVA de red virtual (dispositivos) sigue el patrón de arquitectura publicado", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", + "id": "B04.10", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "Alto", + "subcategory": "Redes virtuales", + "text": "La configuración de diagnóstico de red virtual está habilitada y envía VMProtectionAlerts a Azure Sentinel LAW", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", + "id": "B05.01", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "severity": "Alto", + "subcategory": "Conectividad", + "text": "Uso de ExpressRoute o VPN para acceder a los recursos de Azure desde entornos locales", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", + "id": "B06.01", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "severity": "Alto", + "subcategory": "Virtual WAN", + "text": "VWAN RBAC se utiliza para restringir el acceso al equipo de seguridad de la red", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "718d1dca-1f62-4565-aee5-580a38249c93", + "id": "B06.02", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture", + "severity": "Alto", + "subcategory": "Virtual WAN", + "text": "El cliente de VWAN utiliza Secure Hub o un firewall externo para enrutar y supervisar el tráfico.", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", + "id": "B07.01", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "severity": "Alto", + "subcategory": "Application Gateway", + "text": "AppGW RBAC se utiliza para restringir el acceso al equipo de seguridad de la red", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", + "id": "B07.02", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "Alto", + "subcategory": "Application Gateway", + "text": "AppGW Todos los servicios web externos están detrás de Application Gateways con WAF habilitado ", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "94666731-3c00-4567-9c1e-945b459c373e", + "id": "B07.03", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "Alto", + "subcategory": "Application Gateway", + "text": "AppGW Todos los servicios web internos están detrás de Application Gateways con WAF habilitado ", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", + "id": "B07.04", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "severity": "Alto", + "subcategory": "Application Gateway", + "text": "AppGW: la orientación externa tiene TLS/SSL habilitado y redirige todo el tráfico a 443 (sin tráfico de puerto 80)", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", + "id": "B08.01", + "link": "https://learn.microsoft.com/azure/frontdoor/", + "severity": "Alto", + "subcategory": "Puerta frontal", + "text": "RBAC de Front Door se usa para restringir el acceso al equipo de seguridad de red", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", + "id": "B08.02", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json", + "severity": "Alto", + "subcategory": "Puerta frontal", + "text": "Front Door está asociado a una directiva de WAF", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", + "id": "B08.03", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https", + "severity": "Alto", + "subcategory": "Puerta frontal", + "text": "La directiva TLS/SSL de Front Door está configurada", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", + "id": "B08.04", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect", + "severity": "Alto", + "subcategory": "Puerta frontal", + "text": "Se configura el puerto de redireccionamiento de Front Door 80 al puerto 443 (agentes de escucha)", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", + "id": "B08.05", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics", + "severity": "Alto", + "subcategory": "Puerta frontal", + "text": "Los registros de diagnóstico de Front Door envían ApplicationGatewayAccessLog y ApplicationGateway FirewallLog a Sentinel LAW", + "waf": "Seguridad" + }, + { + "category": "Redes de Azure", + "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", + "id": "B09.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "Alto", + "subcategory": "Protección DDoS", + "text": "Habilitado para IP públicas de firewall (todas las IP públicas)", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", + "id": "C01.01", + "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory", + "severity": "Alto", + "subcategory": "Arrendatario", + "text": "Establezca un único directorio empresarial para administrar las identidades de los empleados a tiempo completo y los recursos de la empresa.", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", + "id": "C01.02", + "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems", + "severity": "Alto", + "subcategory": "Arrendatario", + "text": "Sincronice su identidad en la nube con sus sistemas de identidad existentes.", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", + "id": "C01.03", + "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties", + "severity": "Alto", + "subcategory": "Arrendatario", + "text": "Use los servicios de identidad en la nube para hospedar cuentas que no sean de empleados, como proveedores, asociados y clientes, en lugar de incluirlas en el directorio local.", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", + "id": "C01.04", + "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication", + "severity": "Alto", + "subcategory": "Arrendatario", + "text": "Deshabilite los protocolos heredados inseguros para los servicios orientados a Internet.", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", + "id": "C01.05", + "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on", + "severity": "Alto", + "subcategory": "Arrendatario", + "text": "Habilitar el inicio de sesión único", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", + "id": "C02.01", + "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers", + "severity": "Alto", + "subcategory": "Administración privilegiada", + "text": "No sincronice las cuentas con el acceso con los privilegios más altos a los recursos locales a medida que sincroniza los sistemas de identidad de la empresa con los directorios en la nube.", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", + "id": "C02.02", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5", + "severity": "Alto", + "subcategory": "Administración privilegiada", + "text": "Limitar el número de administradores globales a menos de 5", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", + "id": "C02.03", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment", + "severity": "Alto", + "subcategory": "Administración privilegiada", + "text": "Uso de grupos para asignaciones de roles de Azure AD y delegación de la asignación de roles", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", + "id": "C02.04", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins", + "severity": "Alto", + "subcategory": "Administración privilegiada", + "text": "Asegúrese de que todos los administradores de impacto crítico estén administrados por el directorio de la empresa para seguir la aplicación de las políticas de la organización.", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", + "id": "C02.05", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time", + "severity": "Alto", + "subcategory": "Administración privilegiada", + "text": "Configurar revisiones de acceso recurrentes para revocar permisos innecesarios a lo largo del tiempo", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", + "id": "C02.06", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security", + "severity": "Medio", + "subcategory": "Administración privilegiada", + "text": "Asegúrese de que los administradores de impacto crítico utilicen una estación de trabajo con protecciones de seguridad y supervisión elevadas", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", + "id": "C03.01", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Proveedores de identidades: compruebe que se conocen los proveedores de identidades externos", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", + "id": "C03.02", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Configuración de colaboración externa: el acceso de los usuarios invitados está establecido en \"¿El acceso de los usuarios invitados está restringido?\"", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", + "id": "C03.03", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Configuración de colaboración externa: la configuración de invitación de invitados se establece en \"Solo usuarios asignados a roles de administrador específicos\"", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", + "id": "C03.04", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Configuración de colaboración externa: habilite el registro de autoservicio de invitados a través de flujos establecidos en \"Deshabilitado\" ", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", + "id": "C03.05", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Configuración de colaboración externa: Restricciones de colaboración establecidas en \"Permitir invitaciones a los dominios especificados\"", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", + "id": "C03.06", + "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews", + "severity": "Medio", + "subcategory": "Identidades externas", + "text": "Acceder a las revisiones: Habilitado para todos los grupos", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", + "id": "C04.01", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent", + "severity": "Medio", + "subcategory": "Aplicaciones empresariales", + "text": "Consentimiento y permisos: Permitir el consentimiento del usuario para aplicaciones de editores verificados", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", + "id": "C04.02", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups", + "severity": "Medio", + "subcategory": "Aplicaciones empresariales", + "text": "Consentimiento y permisos: Permitir el consentimiento del propietario del grupo para los propietarios del grupo seleccionados ", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "bade4aad-1e8c-439e-a946-667313c00567", + "id": "C05.01", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain", + "severity": "Alto", + "subcategory": "Dominios personalizados", + "text": "Solo se registran los dominios de clientes validados", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", + "id": "C06.01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr", + "severity": "Alto", + "subcategory": "Restablecimiento de contraseña", + "text": "Se ha verificado el requisito de directiva de restablecimiento de contraseña de autoservicio.", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", + "id": "C06.02", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "Medio", + "subcategory": "Restablecimiento de contraseña", + "text": "Establecer el número de días antes de que se pida a los usuarios que vuelvan a confirmar la información de autenticación no está establecido en cero", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", + "id": "C06.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "Alto", + "subcategory": "Restablecimiento de contraseña", + "text": "Se selecciona el número de métodos necesarios para restablecer la contraseña", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", + "id": "C07.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles", + "severity": "Alto", + "subcategory": "Configuración de usuario", + "text": "Deshabilite 'Los usuarios pueden registrar aplicaciones'", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", + "id": "C07.02", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions", + "severity": "Alto", + "subcategory": "Configuración de usuario", + "text": "Restrinja el acceso al portal administrativo (portal.azure.com) solo a los administradores", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", + "id": "C07.03", + "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration", + "severity": "Alto", + "subcategory": "Configuración de usuario", + "text": "Desactivar la 'Conexión de la cuenta de LinkedIn'", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", + "id": "C08.01", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring", + "severity": "Alto", + "subcategory": "Configuración de diagnóstico", + "text": "Habilitado y envío al área de trabajo de Log Analytics con Sentinel", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", + "id": "C09.01", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan", + "severity": "Alto", + "subcategory": "PIM habilitado", + "text": "Privileged Identity Management habilitado", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", + "id": "C09.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc", + "severity": "Alto", + "subcategory": "PIM habilitado", + "text": "Implementar el acceso \"justo a tiempo\" (JIT) para reducir aún más el tiempo de exposición de las cuentas privilegiadas (reducir el acceso permanente)", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", + "id": "C10.01", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common", + "severity": "Alto", + "subcategory": "Directivas de acceso condicional", + "text": "Configuración de directivas de acceso condicional / Controles de acceso", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", + "id": "C10.02", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition", + "severity": "Medio", + "subcategory": "Directivas de acceso condicional", + "text": "Condiciones: Ubicaciones restringidas", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", + "id": "C10.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa", + "severity": "Alto", + "subcategory": "Directivas de acceso condicional", + "text": "Controles de acceso: MFA habilitado para todos los usuarios", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", + "id": "C10.04", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa", + "severity": "Medio", + "subcategory": "Directivas de acceso condicional", + "text": "Controles de acceso: Requerir MFA para los administradores", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", + "id": "C10.05", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management", + "severity": "Alto", + "subcategory": "Directivas de acceso condicional", + "text": "Controles de acceso: Requerir MFA para la administración de Azure ", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", + "id": "C10.06", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy", + "severity": "Alto", + "subcategory": "Directivas de acceso condicional", + "text": "Controles de acceso: Bloquear protocolos heredados", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", + "id": "C10.07", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices", + "severity": "Alto", + "subcategory": "Directivas de acceso condicional", + "text": "Controles de acceso: requieren que los dispositivos se marquen como compatibles", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "description": "Política documentada por el cliente", + "guid": "a7144351-e19d-4d34-929e-b7228137a151", + "id": "C11.01", + "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/", + "severity": "Medio", + "subcategory": "Usuarios invitados", + "text": "¿Existe una política para realizar un seguimiento de las cuentas de usuario invitado (es decir, uso/eliminación/deshabilitación)?", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", + "id": "C12.01", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score", + "severity": "Alto", + "subcategory": "Puntuación de seguridad de identidad", + "text": "Implemente la puntuación de seguridad de identidad en función de las mejores prácticas de su sector", + "waf": "Seguridad" + }, + { + "category": "Identidad", + "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", + "id": "C13.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "severity": "Medio", + "subcategory": "Cuentas de Break Glass", + "text": "Se han creado al menos dos cuentas de ruptura y existe una política en torno a su uso", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", + "id": "D01.01", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "severity": "Alto", + "subcategory": "Control de acceso", + "text": "Control del acceso a máquinas virtuales mediante Azure Policy", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", + "id": "D01.02", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax", + "severity": "Medio", + "subcategory": "Control de acceso", + "text": "Reduzca la variabilidad en la configuración e implementación de máquinas virtuales aprovechando las plantillas", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "b5945bda-4333-44fd-b91c-234182b65275", + "id": "D01.03", + "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models", + "severity": "Medio", + "subcategory": "Control de acceso", + "text": "Proteja el acceso privilegiado para implementar VMS reduciendo quién tiene acceso a los recursos a través de la gobernanza", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", + "id": "D02.01", + "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service", + "severity": "Medio", + "subcategory": "Alta disponibilidad ", + "text": "Use varias máquinas virtuales para sus cargas de trabajo para una mejor disponibilidad ", + "waf": "Fiabilidad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "f219e4a1-eb58-4879-935d-227886d30b66", + "id": "D02.02", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm", + "severity": "Medio", + "subcategory": "Alta disponibilidad ", + "text": "Implementación y prueba de una solución de recuperación ante desastres ", + "waf": "Fiabilidad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "c57be595-1900-4838-95c5-86cb291ec16a", + "id": "D02.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "severity": "Medio", + "subcategory": "Alta disponibilidad ", + "text": "Conjuntos de disponibilidad", + "waf": "Fiabilidad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", + "id": "D02.04", + "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context", + "severity": "Medio", + "subcategory": "Alta disponibilidad ", + "text": "Zonas de disponibilidad", + "waf": "Fiabilidad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", + "id": "D02.05", + "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region", + "severity": "Medio", + "subcategory": "Alta disponibilidad ", + "text": "Tolerancia a fallos regionales ", + "waf": "Fiabilidad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", + "id": "D03.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware", + "severity": "Alto", + "subcategory": "Protéjase contra el malware", + "text": "Instalación de soluciones antimalware", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", + "id": "D03.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "Alto", + "subcategory": "Protéjase contra el malware", + "text": "Integración de la solución antimalware con Security Center", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", + "id": "D04.01", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "severity": "Alto", + "subcategory": "Administrar actualizaciones de máquinas virtuales", + "text": "Mantenga las máquinas virtuales actualizadas con Update Management con Azure Automation", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", + "id": "D04.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching", + "severity": "Medio", + "subcategory": "Administrar actualizaciones de máquinas virtuales", + "text": "Asegúrese de que las imágenes de Windows para la implementación tengan el nivel más reciente de actualizaciones ", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "02145901-465d-438e-9309-ccbd979266bc", + "id": "D04.03", + "link": "https://learn.microsoft.com/azure/security-center/asset-inventory", + "severity": "Alto", + "subcategory": "Administrar actualizaciones de máquinas virtuales", + "text": "Aplique rápidamente actualizaciones de seguridad a las máquinas virtuales mediante Microsoft Defender for Cloud", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", + "id": "D05.01", + "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", + "severity": "Alto", + "subcategory": "Cifre de los discos duros virtuales", + "text": "Habilitación del cifrado en las máquinas virtuales", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", + "id": "D05.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek", + "severity": "Alto", + "subcategory": "Cifre de los discos duros virtuales", + "text": "Agregue la clave de cifrado de claves (KEK) para agregar una capa de seguridad para el cifrado ", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", + "id": "D05.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk", + "severity": "Medio", + "subcategory": "Cifre de los discos duros virtuales", + "text": "Tome una instantánea de los discos antes del cifrado con fines de reversión", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "5173676a-e466-491e-a835-ad942223e138", + "id": "D06.01", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "severity": "Alto", + "subcategory": "Restringir la conexión directa a Internet ", + "text": "Asegúrese de que solo el grupo de redes central tenga permisos para los recursos de red ", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "10523081-a941-4741-9833-ff7ad7c6d373", + "id": "D06.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "Alto", + "subcategory": "Restringir la conexión directa a Internet ", + "text": "Identifique y corrija las máquinas virtuales expuestas que permiten el acceso desde \"CUALQUIER\" dirección IP de origen", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", + "id": "D06.03", + "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time", + "severity": "Alto", + "subcategory": "Restringir la conexión directa a Internet ", + "text": "Restrinja los puertos de administración (RDP, SSH) mediante el acceso Just-In-Time", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", + "id": "D06.04", + "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", + "severity": "Alto", + "subcategory": "Restringir la conexión directa a Internet ", + "text": "Eliminar el acceso a Internet e implementar servidores de salto para RDP", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", + "id": "D06.05", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling", + "severity": "Alto", + "subcategory": "Restringir la conexión directa a Internet ", + "text": "Elimine el inicio de sesión directo en servidores que utilizan RDP/SSH desde Internet e implemente VPN o ruta rápida", + "waf": "Seguridad" + }, + { + "category": "Comprobaciones de seguridad de VM", + "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", + "id": "D06.06", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "severity": "Alto", + "subcategory": "Restringir la conexión directa a Internet ", + "text": "Aproveche Azure Bastion como agente RDP/SSH para aumentar la seguridad y reducir el espacio ocupado", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", + "id": "E01.01", + "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", + "severity": "Alto", + "subcategory": "Arquitectura ", + "text": "Todos los inquilinos contienen Sentinel habilitado en al menos un área de trabajo de Log Analytics", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", + "id": "E01.02", + "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture", + "severity": "Alto", + "subcategory": "Arquitectura ", + "text": "El cliente entiende la arquitectura de Sentinel", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", + "id": "E01.03", + "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view", + "severity": "Medio", + "subcategory": "Arquitectura ", + "text": "El cliente sabe cómo supervisar los incidentes en varias instancias de Sentinel", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "8989579e-76b8-497e-910a-7da7be9966e1", + "id": "E02.01", + "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics", + "severity": "Medio", + "subcategory": "Visión general", + "text": "No hay incidencias abiertas más de 24 horas", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", + "id": "E03.01", + "link": "https://learn.microsoft.com/azure/sentinel/whats-new", + "severity": "Bajo", + "subcategory": "Noticias y Guías", + "text": "Al cliente se le ha mostrado la pestaña Noticias y guías", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", + "id": "E04.01", + "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics", + "severity": "Medio", + "subcategory": "UEBA ", + "text": "UEBA configurada (Sentinel/Ajustes/Ajustes/Configurar UEBA)", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", + "id": "E05.01", + "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "Azure Active Directory está configurado y \"Último registro recibido\" se muestra hoy", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", + "id": "E05.02", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "Azure Active Directory Identity Protection está configurado y se muestra hoy el mensaje \"Último registro recibido\"", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", + "id": "E05.03", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "La actividad de Azure está configurada, se configura y se muestra \"Último registro recibido\"", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", + "id": "E05.04", + "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "Microsoft Defender for Cloud está configurado y se muestra hoy el \"Último registro recibido\"", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", + "id": "E05.05", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "Azure Firewall está configurado y se muestra \"Último registro recibido\"", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", + "id": "E05.06", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "El Firewall de Windows está configurado y se muestra hoy \"Último registro recibido\"", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", + "id": "E05.07", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "Los eventos de seguridad se configuran con AMA y el \"Último registro recibido\" se muestra hoy", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "1a4834ac-9322-423e-ae80-b123081a5417", + "id": "E05.08", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "Eventos de seguridad: compruebe que los equipos de Azure están conectados y envían datos al área de trabajo", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", + "id": "E05.09", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "Eventos de seguridad: compruebe que los equipos que no son de Azure están conectados y envían datos al área de trabajo", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", + "id": "E05.10", + "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "Conector para AWS", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", + "id": "E05.11", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "Alto", + "subcategory": "Conectores de datos", + "text": "Conector para GCP", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", + "id": "E06.01", + "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in", + "severity": "Alto", + "subcategory": "Reglas de análisis", + "text": "El cliente ha habilitado las reglas de Analytics y ha configurado los incidentes ", + "waf": "Seguridad" + }, + { + "category": "Centinela", + "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", + "id": "E07.01", + "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/", + "severity": "Medio", + "subcategory": "Configuración", + "text": "El cliente no tiene habilitado un límite diario", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", + "id": "F01.01", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "severity": "Alto", + "subcategory": "Configuración", + "text": "Implementación de Azure Firewall Premium", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", + "id": "F01.02", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route", + "severity": "Alto", + "subcategory": "Configuración", + "text": "Ajuste cuádruple cero/forzado habilitado a través de Azure Firewall", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", + "id": "F02.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "Medio", + "subcategory": "Control de acceso", + "text": "RBAC configurado para habilitar solo usuarios autorizados", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", + "id": "F03.01", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "severity": "Medio", + "subcategory": "Configuración de diagnóstico", + "text": "Diagnósticos habilitados y envío de métricas a un área de trabajo de Log Analytics ", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "b35478c3-4798-416b-8863-cffe1cac599e", + "id": "F04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "Los centros y las redes virtuales están protegidos o conectados a través de Firewall Premium", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", + "id": "F04.02", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "Directiva: Se configuran los controles de acceso (RBAC)", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", + "id": "F04.03", + "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "Directiva: se configura la directiva principal ", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", + "id": "F04.04", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "Directiva: se definen las colecciones de reglas", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", + "id": "F04.05", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "Política: se definen las políticas DNAT", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", + "id": "F04.06", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "Directiva: Se definen las reglas de red", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", + "id": "F04.07", + "link": "https://learn.microsoft.com/azure/firewall/features", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "Directiva: Se definen las reglas de aplicación", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", + "id": "F04.08", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "severity": "Medio", + "subcategory": "Administrador de cortafuegos", + "text": "DNS: Característica entendida y aplicada o no aplicada", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", + "id": "F04.09", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "Inteligencia de amenazas: Establecer en Alerta y denegación", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", + "id": "F04.10", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "Inteligencia de amenazas: Lista permitida (justifique si se están utilizando, es decir, rendimiento)", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", + "id": "F04.11", + "link": "https://learn.microsoft.com/azure/firewall/premium-certificates", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "TLS habilitado", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", + "id": "F04.12", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "IDPS habilitado", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", + "id": "F04.13", + "link": "https://learn.microsoft.com/azure/firewall/snat-private-range", + "severity": "Alto", + "subcategory": "Administrador de cortafuegos", + "text": "SNAT: Configurado ", + "waf": "Seguridad" + }, + { + "category": "Azure Firewall", + "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", + "id": "F05.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "Medio", + "subcategory": "Protección DDoS", + "text": "Habilitado para IP públicas de Firewall", + "waf": "Seguridad" + } + ], + "metadata": { + "name": "Azure Security Review Checklist", + "state": "Deprecated", + "timestamp": "June 24, 2024" + }, + "severities": [ + { + "name": "Alto" + }, + { + "name": "Medio" + }, + { + "name": "Bajo" + } + ], + "status": [ + { + "description": "Esta comprobación aún no se ha examinado", + "name": "No verificado" + }, + { + "description": "Hay un elemento de acción asociado a esta comprobación", + "name": "Abrir" + }, + { + "description": "Esta comprobación se ha verificado y no hay más elementos de acción asociados a ella", + "name": "Cumplido" + }, + { + "description": "Recomendación entendida, pero no necesaria por los requisitos actuales", + "name": "No es necesario" + }, + { + "description": "No aplicable para el diseño actual", + "name": "N/A" + } + ], + "waf": [ + { + "name": "Fiabilidad" + }, + { + "name": "Seguridad" + }, + { + "name": "Costar" + }, + { + "name": "Operaciones" + }, + { + "name": "Rendimiento" + } + ], + "yesno": [ + { + "name": "Sí" + }, + { + "name": "No" + } + ] +} \ No newline at end of file diff --git a/checklists/security_checklist.ja.json b/checklists/security_checklist.ja.json index 234eaaa05..a33d2ff17 100644 --- a/checklists/security_checklist.ja.json +++ b/checklists/security_checklist.ja.json @@ -1,1328 +1,1669 @@ { - "metadata": { - "name": "Azure セキュリティ レビュー チェックリスト" - }, - "items": [ - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "セキュリティ センター/ディフェンダーは、すべてのサブスクリプションで有効にします。", - "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "セキュリティ センター/ディフェンダーがすべてのログ分析ワークスペースで有効", - "guid": "349f0364-d28d-442e-abbb-c868255abc91", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "データ収集は「共通」に設定", - "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "Defender for Cloud の強化されたセキュリティ機能はすべて有効になっています", - "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "会社のポリシーに従って自動プロビジョニングを有効にする (ポリシーが存在する必要があります)", - "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "会社のポリシーに従って有効な電子メール通知 (ポリシーが存在する必要があります)", - "guid": "25759e35-680e-4782-9ac9-32213d027ff4", - "severity": "低い", - "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "統合を有効にするオプションが選択されている", - "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "CI/CD 統合が構成されている", - "guid": "5b7bae4-4th-45e8-a79e-2e86667313c5", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "連続エクスポート「イベントハブ」は、サードパーティのSIEMを使用している場合に有効になります", - "guid": "05675c5e-985b-4859-a774-f7e371623b87", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "継続的なエクスポート 'Log Analytics Workspace' は、Azure Sentinel を使用していない場合に有効になります。", - "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "AWS で有効になっているクラウドコネクタ", - "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "GCP で有効なクラウドコネクタ", - "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "価格と設定", - "text": "Azure AD アプリケーション プロキシを使用する場合は、Microsoft Defender for Cloud Apps との統合を検討して、アプリケーションのアクセスをリアルタイムで監視し、高度なセキュリティ制御を適用することを検討してください。", - "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", - "severity": "低い", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "推奨 事項", - "text": "すべての推奨事項は、必要でない場合は修復または無効にされました。", - "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "推奨 事項", - "text": "セキュリティスコア>70%", - "description": "マイクロソフトのすべてのお客様の最小目標は 70% です。", - "guid": "08032729-4798-4b15-98a2-19a46ceb5443", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "セキュリティアラート", - "text": "セキュリティ警告には、過去 24 時間以内に生成されたもののみが含まれます (古いセキュリティ警告を修復または無効にする)", - "guid": "50259226-4429-42bb-9285-37a55119bf8e", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "ブック", - "text": "継続的エクスポートが有効になっている場合、カスタム セキュリティ ダッシュボードにパブリッシュされた既定のブック", - "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "コミュニティ", - "text": "お客様は「コミュニティ」ページの価値を認識しており、レビュー用に定期的なリズムを設定しています。", - "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", - "severity": "中程度", - "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "セキュアスコア", - "text": "Security Center によって保護されているすべてのサブスクリプションが表示されます (サブスクリプション フィルター セットなし)", - "description": "お客様の運用のベストプラクティス - 透明性", - "guid": "93846da9-7cc3-4923-856b-22586f4a1641", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "法規制の遵守", - "text": "コンプライアンスコントロールは、必要なコンプライアンス要件に対して緑色です", - "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "Azure Defender", - "text": "重大度の高い VM の脆弱性はゼロ (空) です。", - "description": "お客様の運用上のベスト・プラクティス - 検証", - "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "ファイアウォールマネージャ", - "text": "ハブは Azure ファイアウォールによって保護されています。", - "guid": "9603334b-df9c-4c23-918d-b61171265f4b", - "severity": "中程度", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "ファイアウォールマネージャ", - "text": "仮想ネットワークはファイアウォールで保護されています", - "description": "お客様の運用上のベスト・プラクティス - 検証", - "guid": "b47a393a-0803-4272-a479-8b1578a219a4", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "ファイアウォールマネージャ", - "text": "DDoS 標準が有効", - "guid": "6ceb5443-5025-4922-9442-92bb628537a5", - "severity": "中程度", - "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/" - }, - { - "category": "クラウド用ディフェンダー", - "subcategory": "カバレッジ", - "text": "すべてのサブスクリプションがカバーされていることを確認します (変更する価格と設定を参照)。", - "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "Azure Networking", - "subcategory": "パブリック IP アドレス", - "text": "パブリック IP を持つ VM は NSG によって保護される必要があります。", - "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Azure Networking", - "subcategory": "パブリック IP アドレス", - "text": "パブリック IP を持つ VM は、Azure Firewall Premium の背後に移動されます。", - "description": "お客様の運用上のベスト・プラクティス - 検証", - "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Azure Networking", - "subcategory": "パブリック IP アドレス", - "text": "パブリックIPを必要としないVMにはパブリックIPがありません(つまり、内部RDPのみ)", - "description": "お客様の運用上のベスト・プラクティス - 検証", - "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access" - }, - { - "category": "Azure Networking", - "subcategory": "ティッカー", - "text": "NSG RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。", - "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "ティッカー", - "text": "NSG インバウンド セキュリティ規則に [ソース] フィールドに * (ワイルドカード) が含まれていません", - "description": "お客様の運用上のベスト・プラクティス - 検証", - "guid": "a209939b-da47-4778-b24c-116785c2fa55", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "ティッカー", - "text": "NSG アウトバウンド セキュリティ ルールは、ファイアウォール経由でルーティングされないトラフィックの特定の IP アドレスへのトラフィックを制御するために使用されます。", - "description": "お客様の運用上のベスト・プラクティス - 検証", - "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "ティッカー", - "text": "NSG には、ソースを * (ワイルドカード) として配置していません。", - "description": "お客様の運用上のベスト・プラクティス - 検証", - "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "ティッカー", - "text": "NSG Diagnostics が NetworkSecurityGroupEvent および NetworkSecurityGroupRuleCounter トラフィックを Sentinel LAW に送信する", - "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log" - }, - { - "category": "Azure Networking", - "subcategory": "ティッカー", - "text": "UDR RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。", - "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "ティッカー", - "text": "ゼロ トラストの場合、UDR を使用してすべてのトラフィックが Azure Firewall Premium に送信されます。", - "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "ティッカー", - "text": "すべてのトラフィックを AzureFirewallPremium に送信しない UDR は既知であり、文書化されています。", - "description": "お客様の運用上のベスト・プラクティス - 検証", - "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "お客様は、Azure ネットワークの既定値 / Azure での SDN の既定のルーティングに精通している", - "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "VNet RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。", - "description": "お客様の運用上のベスト・プラクティス - 検証", - "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", - "severity": "中程度", - "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "VNet セキュリティの推奨事項は修復され、「危険にさらされている」VNet はありません。", - "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "VNet ピアリング接続が理解され、予想されるトラフィック フローが文書化されている", - "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "VNet サービス エンドポイントが使用中であり、従来のパブリック サービス エンドポイントは存在しません", - "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "VNet プライベート エンドポイントはオンプレミス環境からのアクセスを許可するために使用されており、従来のパブリック エンドポイントは存在しません", - "guid": "1f625659-ee55-480a-9824-9c931213dbd7", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "VNet 監視が有効になりました", - "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "Azure Kubernetes Service (AKS) のネットワーク ポリシーを使用したポッド間のトラフィックのセキュリティ保護", - "guid": "2055b29b-ade4-4th-8e8c-39ec94666731", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "VNet NVA(アプライアンス)のお客様は、公開されたアーキテクチャ パターンに従っています", - "guid": "3c005674-c1e9-445b-959c-373e7ed71623", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva" - }, - { - "category": "Azure Networking", - "subcategory": "仮想ネットワーク", - "text": "VNet 診断設定が有効で、VMProtectionAlert を Azure Sentinel LAW に送信している", - "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Azure Networking", - "subcategory": "接続", - "text": "ExpressRoute または VPN を使用してオンプレミス環境から Azure リソースにアクセスする", - "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure" - }, - { - "category": "Azure Networking", - "subcategory": "仮想WAN", - "text": "VWAN RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。", - "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about" - }, - { - "category": "Azure Networking", - "subcategory": "仮想WAN", - "text": "VWAN のお客様は、セキュアハブまたは外部ファイアウォールを使用してトラフィックをルーティングおよび監視しています。", - "guid": "718d1dca-1f62-4565-aee5-580a38249c93", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture" - }, - { - "category": "Azure Networking", - "subcategory": "アプリケーションゲートウェイ", - "text": "AppGW RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます。", - "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview" - }, - { - "category": "Azure Networking", - "subcategory": "アプリケーションゲートウェイ", - "text": "AppGW すべての外部向け Web サービスが、WAF が有効になっているアプリケーション ゲートウェイに依存しています。", - "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Azure Networking", - "subcategory": "アプリケーションゲートウェイ", - "text": "AppGW すべての内部向け Web サービスが、WAF が有効になっているアプリケーション ゲートウェイに依存しています。", - "guid": "94666731-3c00-4567-9c1e-945b459c373e", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Azure Networking", - "subcategory": "アプリケーションゲートウェイ", - "text": "AppGW - 外部フェーシングでは TLS/SSL が有効になっており、すべてのトラフィックを 443 にリダイレクトします (ポート 80 トラフィックなし)", - "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview" - }, - { - "category": "Azure Networking", - "subcategory": "フロントドア", - "text": "フロントドアRBACは、ネットワークセキュリティチームへのアクセスを制限するために使用されます", - "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/frontdoor/" - }, - { - "category": "Azure Networking", - "subcategory": "フロントドア", - "text": "フロント ドアは WAF ポリシーに関連付けられています。", - "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", - "severity": "高い", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json" - }, - { - "category": "Azure Networking", - "subcategory": "フロントドア", - "text": "フロント ドア TLS/SSL ポリシーが構成されている", - "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https" - }, - { - "category": "Azure Networking", - "subcategory": "フロントドア", - "text": "Front Door リダイレクト ポート 80 からポート 443 が設定されています (リスナー)", - "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect" - }, - { - "category": "Azure Networking", - "subcategory": "フロントドア", - "text": "Front Door diagnostics logs send ApplicationGatewayAccessLog &ApplicationGateway FirewallLog to Sentinel LAW", - "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics" - }, - { - "category": "Azure Networking", - "subcategory": "DDOS保護", - "text": "ファイアウォールのパブリック IP (すべてのパブリック IP) に対して有効", - "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - }, - { - "category": "同一性", - "subcategory": "テナント", - "text": "フルタイムの従業員とエンタープライズ リソースの ID を管理するための単一のエンタープライズ ディレクトリを確立します。", - "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", - "severity": "高い", - "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory" - }, - { - "category": "同一性", - "subcategory": "テナント", - "text": "クラウド ID を既存の ID システムと同期します。", - "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", - "severity": "高い", - "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems" - }, - { - "category": "同一性", - "subcategory": "テナント", - "text": "クラウド ID サービスを使用して、ベンダー、パートナー、顧客などの従業員以外のアカウントを、オンプレミスのディレクトリに含めるのではなく、ホストします。", - "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", - "severity": "高い", - "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties" - }, - { - "category": "同一性", - "subcategory": "テナント", - "text": "インターネットに接続するサービスの安全でないレガシ プロトコルを無効にします。", - "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", - "severity": "高い", - "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication" - }, - { - "category": "同一性", - "subcategory": "テナント", - "text": "シングルサインオンの有効化", - "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on" - }, - { - "category": "同一性", - "subcategory": "特権管理", - "text": "エンタープライズ ID システムをクラウド ディレクトリと同期するときに、オンプレミスのリソースへの最高の特権アクセスを持つアカウントを同期しないでください。", - "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", - "severity": "高い", - "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers" - }, - { - "category": "同一性", - "subcategory": "特権管理", - "text": "グローバル管理者の数を 5 人未満に制限する", - "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5" - }, - { - "category": "同一性", - "subcategory": "特権管理", - "text": "Azure AD ロールの割り当てにグループを使用し、ロールの割り当てを委任する", - "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment" - }, - { - "category": "同一性", - "subcategory": "特権管理", - "text": "すべての重大な影響の管理者がエンタープライズディレクトリによって管理され、組織のポリシーの適用に従うようにします。", - "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins" - }, - { - "category": "同一性", - "subcategory": "特権管理", - "text": "定期的なアクセス レビューを構成して、不要なアクセス許可を時間の経過と共に取り消す", - "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time" - }, - { - "category": "同一性", - "subcategory": "特権管理", - "text": "重大な影響を被る管理者が、セキュリティ保護と監視を強化したワークステーションを使用するようにする", - "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security" - }, - { - "category": "同一性", - "subcategory": "外部アイデンティティ", - "text": "ID プロバイダー: 外部 ID プロバイダーが既知であることを確認する", - "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c" - }, - { - "category": "同一性", - "subcategory": "外部アイデンティティ", - "text": "外部コラボレーション設定: ゲスト ユーザー アクセスが [ゲスト ユーザー アクセスが制限されています?] に設定されています。", - "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "同一性", - "subcategory": "外部アイデンティティ", - "text": "外部コラボレーション設定: ゲスト招待の設定が [特定の管理者ロールに割り当てられているユーザーのみ] に設定されています。", - "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "同一性", - "subcategory": "外部アイデンティティ", - "text": "外部コラボレーション設定: [無効] に設定されたフロー経由のゲストセルフサービス サインアップを有効にする", - "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "同一性", - "subcategory": "外部アイデンティティ", - "text": "外部コラボレーション設定: コラボレーションの制限が [指定したドメインへの招待を許可する] に設定されています。", - "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "同一性", - "subcategory": "外部アイデンティティ", - "text": "アクセスレビュー: すべてのグループで有効", - "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews" - }, - { - "category": "同一性", - "subcategory": "エンタープライズアプリケーション", - "text": "同意とアクセス許可: 確認済みの発行元からのアプリのユーザーの同意を許可する", - "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent" - }, - { - "category": "同一性", - "subcategory": "エンタープライズアプリケーション", - "text": "同意と権限: 選択したグループ所有者にグループ所有者の同意を許可する", - "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups" - }, - { - "category": "同一性", - "subcategory": "カスタムドメイン", - "text": "検証済みの顧客ドメインのみが登録されます。", - "guid": "bade4aad-1e8c-439e-a946-667313c00567", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain" - }, - { - "category": "同一性", - "subcategory": "パスワードのリセット", - "text": "セルフサービスのパスワードリセットポリシー要件に準拠していることが確認されました。", - "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr" - }, - { - "category": "同一性", - "subcategory": "パスワードのリセット", - "text": "ユーザーに認証情報の再確認を求めるまでの日数の設定がゼロに設定されていない", - "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "同一性", - "subcategory": "パスワードのリセット", - "text": "パスワードのリセットに必要なメソッドの設定数が選択されている", - "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "同一性", - "subcategory": "ユーザー設定", - "text": "「ユーザーがアプリケーションを登録できる」を無効にする", - "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles" - }, - { - "category": "同一性", - "subcategory": "ユーザー設定", - "text": "管理ポータル (portal.azure.com) へのアクセスを管理者のみに制限する", - "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions" - }, - { - "category": "同一性", - "subcategory": "ユーザー設定", - "text": "「LinkedInアカウント接続」を無効にする", - "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration" - }, - { - "category": "同一性", - "subcategory": "診断設定", - "text": "有効にし、Sentinelでログ分析ワークスペースに送信する", - "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring" - }, - { - "category": "同一性", - "subcategory": "PIM が有効", - "text": "特権 ID 管理が有効", - "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan" - }, - { - "category": "同一性", - "subcategory": "PIM が有効", - "text": "「ジャストインタイム」(JIT)アクセスを実装して、特権アカウントの公開時間をさらに短縮(常設アクセスの削減)", - "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc" - }, - { - "category": "同一性", - "subcategory": "条件付きアクセス ポリシー", - "text": "条件付きアクセスポリシー/アクセス制御の構成", - "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common" - }, - { - "category": "同一性", - "subcategory": "条件付きアクセス ポリシー", - "text": "条件: 制限された場所", - "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition" - }, - { - "category": "同一性", - "subcategory": "条件付きアクセス ポリシー", - "text": "アクセス制御: すべてのユーザーに対して MFA が有効", - "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa" - }, - { - "category": "同一性", - "subcategory": "条件付きアクセス ポリシー", - "text": "アクセス制御: 管理者に MFA を要求する", - "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa" - }, - { - "category": "同一性", - "subcategory": "条件付きアクセス ポリシー", - "text": "アクセス制御: Azure 管理に MFA を要求する", - "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management" - }, - { - "category": "同一性", - "subcategory": "条件付きアクセス ポリシー", - "text": "アクセス制御: ブロック レガシー プロトコル", - "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy" - }, - { - "category": "同一性", - "subcategory": "条件付きアクセス ポリシー", - "text": "アクセス制御: デバイスを準拠としてマークする必要がある", - "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices" - }, - { - "category": "同一性", - "subcategory": "ゲスト ユーザー", - "text": "ゲストユーザーアカウントを追跡するポリシー(つまり、使用状況/削除/無効化)はありますか?", - "description": "お客様が文書化したポリシー", - "guid": "a7144351-e19d-4d34-929e-b7228137a151", - "severity": "中程度", - "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/" - }, - { - "category": "同一性", - "subcategory": "アイデンティティセキュアスコア", - "text": "業界のベストプラクティスに基づくIDセキュアスコアの実装", - "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score" - }, - { - "category": "同一性", - "subcategory": "ガラスのアカウントを破る", - "text": "少なくとも 2 つの非常口アカウントが作成され、その使用に関するポリシーが存在します。", - "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "アクセス制御", - "text": "Azure Policy を活用して VM アクセスを制御する", - "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/governance/policy/overview" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "アクセス制御", - "text": "テンプレートを活用して VM のセットアップとデプロイのばらつきを軽減", - "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "アクセス制御", - "text": "ガバナンスを通じてリソースにアクセスできるユーザーを減らすことにより、VMS を展開するための特権アクセスをセキュリティで保護", - "guid": "b5945bda-4333-44fd-b91c-234182b65275", - "severity": "中程度", - "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "高可用性", - "text": "ワークロードに複数の VM を使用して可用性を向上させる", - "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "高可用性", - "text": "災害復旧ソリューションの展開とテスト", - "guid": "f219e4a1-eb58-4879-935d-227886d30b66", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "高可用性", - "text": "可用性セット", - "guid": "c57be595-1900-4838-95c5-86cb291ec16a", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "高可用性", - "text": "アベイラビリティーゾーン", - "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "高可用性", - "text": "地域のフォールトトレランス", - "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "マルウェアからの保護", - "text": "マルウェア対策ソリューションのインストール", - "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "マルウェアからの保護", - "text": "マルウェア対策ソリューションをセキュリティセンターと統合する", - "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "VM の更新の管理", - "text": "Azure オートメーションによる更新管理を使用して VM を最新の状態に保つ", - "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "VM の更新の管理", - "text": "展開する Windows イメージに最新のレベルの更新プログラムが適用されていることを確認する", - "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "VM の更新の管理", - "text": "Microsoft Defender for Cloud を使用して VM にセキュリティ更新プログラムを迅速に適用する", - "guid": "02145901-465d-438e-9309-ccbd979266bc", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/asset-inventory" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "VHD を暗号化する", - "text": "VM で暗号化を有効にする", - "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "VHD を暗号化する", - "text": "暗号化のためのセキュリティ層を追加するためのキー暗号化キー (KEK) の追加", - "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "VHD を暗号化する", - "text": "ロールバックの目的で暗号化の前にディスクのスナップショットを作成する", - "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "直接インターネット接続を制限する", - "text": "中央ネットワーク グループのみがネットワーク リソースに対するアクセス許可を持っていることを確認する", - "guid": "5173676a-e466-491e-a835-ad942223E138", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "直接インターネット接続を制限する", - "text": "「ANY」ソースIPアデスからのアクセスを許可する公開されたVMを識別して修復する", - "guid": "10523081-a941-4741-9833-ff7ad7c6d373", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "直接インターネット接続を制限する", - "text": "ジャストインタイムアクセスを使用した管理ポート(RDP、SSH)の制限", - "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "直接インターネット接続を制限する", - "text": "インターネット アクセスを削除し、RDP 用のジャンプ サーバーを実装する", - "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", - "severity": "高い", - "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "直接インターネット接続を制限する", - "text": "インターネットからRDP / SSHを使用してサーバーへの直接ログインを削除し、VPNまたは高速ルートを実装する", - "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling" - }, - { - "category": "VM セキュリティ チェック", - "subcategory": "直接インターネット接続を制限する", - "text": "Azure Bastion を RDP/SSH ブローカーとして活用して、セキュリティの強化とフットプリントの削減を実現", - "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview" - }, - { - "category": "番兵", - "subcategory": "建築", - "text": "すべてのテナントで、少なくとも1つのLog AnalyticsワークスペースでSentinelが有効になっている", - "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard" - }, - { - "category": "番兵", - "subcategory": "建築", - "text": "お客様がSentinelアーキテクチャを理解している", - "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture" - }, - { - "category": "番兵", - "subcategory": "建築", - "text": "お客様は、複数のSentinelインスタンスにわたるインシデントを監視する方法を熟知しています。", - "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view" - }, - { - "category": "番兵", - "subcategory": "概要", - "text": "24時間以上オープンするインシデントはありません", - "guid": "8989579e-76b8-497e-910A-7Da7be9966E1", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics" - }, - { - "category": "番兵", - "subcategory": "ニュースとガイド", - "text": "お客様には[ニュースとガイド]タブが表示されている。", - "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", - "severity": "低い", - "link": "https://learn.microsoft.com/azure/sentinel/whats-new" - }, - { - "category": "番兵", - "subcategory": "UEBA", - "text": "UEBA Configured (Sentinel/Settings/Settings/Configure UEBA)", - "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "Azure Active Directory in configured and 'Last Received Log Received' が今日表示される", - "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "Azure Active Directory ID Protection が構成され、\"最後に受信したログ\" が今日表示されます。", - "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "Azure アクティビティが構成され、\"前回受信したログ\" が今日表示されます", - "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "Microsoft Defender for Cloud が構成され、「最後に受信したログ」が本日表示される", - "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "Azure ファイアウォールが構成され、\"最後に受信したログ\" が今日表示されます。", - "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "Windows ファイアウォールが構成され、[最後に受信したログ] が今日表示されます。", - "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "セキュリティ イベントは AMA で構成されており、\"最後に受信したログ\" は今日表示されます。", - "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "セキュリティ イベント - Azure コンピューターが接続され、ワークスペースにデータが送信されていることを確認します。", - "guid": "1a4834ac-9322-423e-ae80-b123081a5417", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "セキュリティ イベント - Azure 以外のコンピューターが接続され、ワークスペースにデータが送信されていることを確認します。", - "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "AWS のコネクタ", - "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3" - }, - { - "category": "番兵", - "subcategory": "データコネクタ", - "text": "GCP用コネクタ", - "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "番兵", - "subcategory": "分析ルール", - "text": "お客様がアナリティクスルールを有効にし、インシデントを設定しました", - "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in" - }, - { - "category": "番兵", - "subcategory": "設定", - "text": "お客様は日次上限を有効にしていません", - "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", - "severity": "中程度", - "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/" - }, - { - "category": "Azure Firewall", - "subcategory": "構成", - "text": "Azure Firewall Premium がデプロイされました", - "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall/premium-features" - }, - { - "category": "Azure Firewall", - "subcategory": "構成", - "text": "Azure ファイアウォール経由で有効なクワッド ゼロ/強制チューニング", - "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route" - }, - { - "category": "Azure Firewall", - "subcategory": "アクセス制御", - "text": "許可されたユーザーのみを使用可能にするように設定された RBAC", - "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", - "severity": "中程度", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "診断設定", - "text": "診断が有効になり、メトリックが Log Analytics ワークスペースに送信される", - "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "ハブと仮想ネットワークは、ファイアウォールプレミアムを介して保護または接続されています", - "guid": "b35478c3-4798-416b-8863-cffe1cac599e", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "ポリシー: アクセス制御が構成されている (RBAC)", - "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", - "severity": "高い", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "ポリシー: 親ポリシーが構成されている", - "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "ポリシー: ルール コレクションが定義されている", - "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "ポリシー: DNAT ポリシーが定義されている", - "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "ポリシー: ネットワークルールが定義されている", - "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "ポリシー: アプリケーション ルールが定義されている", - "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall/features" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "DNS:機能が理解され、適用されているか、または適用されていないか", - "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/firewall/dns-details" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "脅威インテリジェンス: アラートと拒否に設定", - "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "脅威インテリジェンス:許可リスト(使用されているかどうかを正当化する - つまりパフォーマンス)", - "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "TLS が有効", - "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall/premium-certificates" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "IDPS が有効", - "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "ファイアウォールマネージャ", - "text": "SNAT: 設定済み", - "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", - "severity": "高い", - "link": "https://learn.microsoft.com/azure/firewall/snat-private-range" - }, - { - "category": "Azure Firewall", - "subcategory": "DDOS保護", - "text": "ファイアウォールのパブリックIPに対して有効", - "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", - "severity": "中程度", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - } - ], - "severities": [ - { - "name": "高い" - }, - { - "name": "中程度" - }, - { - "name": "低い" - } - ], - "status": [ - { - "name": "未検証", - "description": "このチェックはまだ見ていません" - }, - { - "name": "開ける", - "description": "このチェックに関連付けられているアクションアイテムがあります" - }, - { - "name": "達成", - "description": "このチェックは検証済みであり、それに関連付けられたアクションアイテムはこれ以上ありません。" - }, - { - "name": "必須ではありません", - "description": "推奨事項は理解しているが、現在の要件では必要ではない" - }, - { - "name": "該当なし", - "description": "現在の設計には適用されません" - } - ], - "categories": [ - { - "name": "クラウド用ディフェンダー" - }, - { - "name": "Azure Networking" - }, - { - "name": "同一性" - }, - { - "name": "VM セキュリティ チェック" - }, - { - "name": "番兵" - }, - { - "name": "Azure Firewall" - } - ] -} + "categories": [ + { + "name": "Defender For Cloud" + }, + { + "name": "Azure ネットワーク" + }, + { + "name": "同一性" + }, + { + "name": "VM セキュリティチェック" + }, + { + "name": "番兵" + }, + { + "name": "Azure Firewall" + } + ], + "items": [ + { + "category": "Defender For Cloud", + "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", + "id": "A01.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", + "severity": "高い", + "subcategory": "価格と設定", + "text": "すべてのサブスクリプションで Security Center/Defender を有効にする", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "349f0364-d28d-442e-abbb-c868255abc91", + "id": "A01.02", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "高い", + "subcategory": "価格と設定", + "text": "すべての Log Analytics ワークスペースで Security Center/Defender が有効になっている", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", + "id": "A01.03", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal", + "severity": "中程度", + "subcategory": "価格と設定", + "text": "データ コレクションを 'Common' に設定", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", + "id": "A01.04", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "高い", + "subcategory": "価格と設定", + "text": "Defender for Cloud の強化されたセキュリティ機能がすべて有効になっている", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", + "id": "A01.05", + "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection", + "severity": "中程度", + "subcategory": "価格と設定", + "text": "会社のポリシーに従って自動プロビジョニングを有効にする (ポリシーが存在する必要があります)", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "25759e35-680e-4782-9ac9-32213d027ff4", + "id": "A01.06", + "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details", + "severity": "低い", + "subcategory": "価格と設定", + "text": "会社のポリシーに従って有効になっている電子メール通知 (ポリシーが存在する必要があります)", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", + "id": "A01.07", + "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows", + "severity": "中程度", + "subcategory": "価格と設定", + "text": "統合オプションを有効にする が選択されている", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "5b7abae4-4aad-45e8-a79e-2e86667313c5", + "id": "A01.08", + "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd", + "severity": "中程度", + "subcategory": "価格と設定", + "text": "CI/CD 統合が構成されている", + "waf": "オペレーションズ" + }, + { + "category": "Defender For Cloud", + "guid": "05675c5e-985b-4859-a774-f7e371623b87", + "id": "A01.09", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "高い", + "subcategory": "価格と設定", + "text": "連続エクスポートの \"Event Hub\" は、サード パーティの SIEM を使用している場合に有効になります", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", + "id": "A01.10", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "中程度", + "subcategory": "価格と設定", + "text": "連続エクスポート \"Log Analytics ワークスペース\" は、Azure Sentinel を使用していない場合に有効になります", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", + "id": "A01.11", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "高い", + "subcategory": "価格と設定", + "text": "AWSで有効なクラウドコネクタ", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", + "id": "A01.12", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp", + "severity": "高い", + "subcategory": "価格と設定", + "text": "GCPに対応したクラウドコネクタ", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", + "id": "A01.13", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security", + "severity": "低い", + "subcategory": "価格と設定", + "text": "Azure AD アプリケーション プロキシを使用する場合は、Microsoft Defender for Cloud Apps と統合して、アプリケーション アクセスをリアルタイムで監視し、高度なセキュリティ制御を適用することを検討してください。", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", + "id": "A02.01", + "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls", + "severity": "中程度", + "subcategory": "推奨 事項", + "text": "すべての推奨事項は、不要な場合は修復または無効化されます。", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "description": "すべてのお客様に対する Microsoft の最小目標は 70% です", + "guid": "08032729-4798-4b15-98a2-19a46ceb5443", + "id": "A02.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls", + "severity": "高い", + "subcategory": "推奨 事項", + "text": "セキュリティスコア>70%", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "50259226-4429-42bb-9285-37a55119bf8e", + "id": "A03.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident", + "severity": "中程度", + "subcategory": "セキュリティ アラート", + "text": "セキュリティ アラートには、過去 24 時間以内に生成されたもののみが含まれます (古いセキュリティ アラートを修復または無効にします)", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", + "id": "A04.01", + "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks", + "severity": "中程度", + "subcategory": "ブック", + "text": "連続エクスポートが有効になっている場合、既定のワークブックはカスタム セキュリティ ダッシュボードにパブリッシュされます", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", + "id": "A05.01", + "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud", + "severity": "中程度", + "subcategory": "コミュニティ", + "text": "お客様は「コミュニティ」ページの価値を認識しており、定期的に確認するように設定されています", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "description": "お客様の運用のベストプラクティス - 透明性", + "guid": "93846da9-7cc3-4923-856b-22586f4a1641", + "id": "A06.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security", + "severity": "高い", + "subcategory": "セキュリティ スコア", + "text": "Security Center によって保護されているすべてのサブスクリプションが表示されます (サブスクリプション フィルターは設定されていません)", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", + "id": "A07.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard", + "severity": "高い", + "subcategory": "法規制の遵守", + "text": "コンプライアンス制御は、必要なコンプライアンス要件に対して緑色です", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "description": "お客様の運用のベスト プラクティス - 確認", + "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", + "id": "A08.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm", + "severity": "高い", + "subcategory": "Azure Defender", + "text": "重大度の高い VM の脆弱性は 0 (空) です", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "9603334b-df9c-4c23-918d-b61171265f4b", + "id": "A09.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679", + "severity": "中程度", + "subcategory": "ファイアウォール マネージャー", + "text": "ハブは Azure Firewall によって保護されます", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "description": "お客様の運用のベスト プラクティス - 確認", + "guid": "b47a393a-0803-4272-a479-8b1578a219a4", + "id": "A09.02", + "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices", + "severity": "中程度", + "subcategory": "ファイアウォール マネージャー", + "text": "仮想ネットワークはファイアウォールによって保護されています", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "6ceb5443-5025-4922-9442-92bb628537a5", + "id": "A09.03", + "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/", + "severity": "中程度", + "subcategory": "ファイアウォール マネージャー", + "text": "DDoS Standard 対応", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", + "id": "A10.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "高い", + "subcategory": "カバレッジ", + "text": "すべてのサブスクリプションが対象であることを確認します (変更するには、「価格と設定」を参照してください)", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", + "id": "B01.01", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "高い", + "subcategory": "パブリック IP", + "text": "パブリック IP を持つ VM は NSG によって保護する必要がある", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "description": "お客様の運用のベスト プラクティス - 確認", + "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", + "id": "B01.02", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "高い", + "subcategory": "パブリック IP", + "text": "パブリック IP を持つ VM は、Azure Firewall Premium の背後に移動されます", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "description": "お客様の運用のベスト プラクティス - 確認", + "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", + "id": "B01.03", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "severity": "高い", + "subcategory": "パブリック IP", + "text": "パブリック IP を必要としない VM にはパブリック IP がありません (つまり、内部 RDP のみ)", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", + "id": "B02.01", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "中程度", + "subcategory": "NSGの", + "text": "NSG RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "description": "お客様の運用のベスト プラクティス - 確認", + "guid": "a209939b-da47-4778-b24c-116785c2fa55", + "id": "B02.02", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "高い", + "subcategory": "NSGの", + "text": "NSG 受信セキュリティ規則の [ソース] フィールドに * (ワイルドカード) が含まれていません", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "description": "お客様の運用のベスト プラクティス - 確認", + "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", + "id": "B02.03", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "中程度", + "subcategory": "NSGの", + "text": "NSG 送信セキュリティ規則は、ファイアウォール経由でルーティングされないトラフィックの特定の IP アドレスへのトラフィックを制御するために使用されます", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "description": "お客様の運用のベスト プラクティス - 確認", + "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", + "id": "B02.04", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "高い", + "subcategory": "NSGの", + "text": "NSG には、ソースが * (ワイルドカード) として設定されていません。", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", + "id": "B02.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log", + "severity": "中程度", + "subcategory": "NSGの", + "text": "NSG 診断によって NetworkSecurityGroupEvent トラフィックと NetworkSecurityGroupRuleCounter トラフィックが Sentinel LAW に送信される", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", + "id": "B03.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "中程度", + "subcategory": "UDR (UDR)", + "text": "UDR RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", + "id": "B03.02", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "高い", + "subcategory": "UDR (UDR)", + "text": "ゼロ トラストの場合、UDR を使用してすべてのトラフィックが Azure Firewall Premium に送信されます", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "description": "お客様の運用のベスト プラクティス - 確認", + "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", + "id": "B03.03", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "中程度", + "subcategory": "UDR (UDR)", + "text": "すべてのトラフィックを AzureFirewallPremium に送信しない UDR は既知であり、文書化されています。", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", + "id": "B04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default", + "severity": "高い", + "subcategory": "仮想ネットワーク", + "text": "お客様は、Azure での Azure ネットワークの既定値と SDN の既定のルーティングに精通しています", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "description": "お客様の運用のベスト プラクティス - 確認", + "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", + "id": "B04.02", + "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672", + "severity": "中程度", + "subcategory": "仮想ネットワーク", + "text": "VNet RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", + "id": "B04.03", + "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference", + "severity": "高い", + "subcategory": "仮想ネットワーク", + "text": "VNet のセキュリティに関する推奨事項が修復され、\"リスクのある\" VNet がない", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", + "id": "B04.04", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "severity": "高い", + "subcategory": "仮想ネットワーク", + "text": "VNet ピアリング接続が認識され、予想されるトラフィック フローが文書化されている", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", + "id": "B04.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview", + "severity": "高い", + "subcategory": "仮想ネットワーク", + "text": "VNet サービス エンドポイントが使用中であり、レガシ パブリック サービス エンドポイントが存在しない", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "1f625659-ee55-480a-9824-9c931213dbd7", + "id": "B04.06", + "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview", + "severity": "高い", + "subcategory": "仮想ネットワーク", + "text": "VNet プライベート エンドポイントは、オンプレミス環境からのアクセスを許可するために使用されており、レガシ パブリック エンドポイントは存在しません", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", + "id": "B04.07", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "高い", + "subcategory": "仮想ネットワーク", + "text": "VNet 監視が有効", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731", + "id": "B04.08", + "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies", + "severity": "高い", + "subcategory": "仮想ネットワーク", + "text": "Azure Kubernetes Service (AKS) のネットワーク ポリシーを使用してポッド間のトラフィックをセキュリティで保護するSecure traffic between pods using network policies in Azure Kubernetes Service (AKS)", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "3c005674-c1e9-445b-959c-373e7ed71623", + "id": "B04.09", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva", + "severity": "高い", + "subcategory": "仮想ネットワーク", + "text": "VNet NVA (アプライアンス) のお客様は、公開されているアーキテクチャ パターンに従います", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", + "id": "B04.10", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "高い", + "subcategory": "仮想ネットワーク", + "text": "VNet 診断設定が有効になっていて、VMProtectionAlerts が Azure Sentinel LAW に送信されている", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", + "id": "B05.01", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "severity": "高い", + "subcategory": "接続", + "text": "ExpressRoute または VPN を使用してオンプレミス環境から Azure リソースにアクセスする", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", + "id": "B06.01", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "severity": "高い", + "subcategory": "仮想WAN", + "text": "VWAN RBACは、ネットワークセキュリティチームへのアクセスを制限するために使用されます", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "718d1dca-1f62-4565-aee5-580a38249c93", + "id": "B06.02", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture", + "severity": "高い", + "subcategory": "仮想WAN", + "text": "VWANカスタマーは、Secure Hubまたは外部ファイアウォールを使用してトラフィックのルーティングと監視を行っています。", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", + "id": "B07.01", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "severity": "高い", + "subcategory": "アプリケーション ゲートウェイ", + "text": "AppGW RBACは、ネットワークセキュリティチームへのアクセスを制限するために使用されます", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", + "id": "B07.02", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "高い", + "subcategory": "アプリケーション ゲートウェイ", + "text": "AppGW: すべての外部向け Web サービスは、WAF が有効になっている Application Gateway の背後にあります", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "94666731-3c00-4567-9c1e-945b459c373e", + "id": "B07.03", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "高い", + "subcategory": "アプリケーション ゲートウェイ", + "text": "AppGW: すべての内部向け Web サービスは、WAF が有効になっている Application Gateway の背後にあります", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", + "id": "B07.04", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "severity": "高い", + "subcategory": "アプリケーション ゲートウェイ", + "text": "AppGW - 外部向けで TLS/SSL が有効になっており、すべてのトラフィックが 443 にリダイレクトされます (ポート 80 トラフィックなし)", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", + "id": "B08.01", + "link": "https://learn.microsoft.com/azure/frontdoor/", + "severity": "高い", + "subcategory": "フロントドア", + "text": "Front Door RBAC は、ネットワーク セキュリティ チームへのアクセスを制限するために使用されます", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", + "id": "B08.02", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json", + "severity": "高い", + "subcategory": "フロントドア", + "text": "Front Door は WAF ポリシーに関連付けられています", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", + "id": "B08.03", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https", + "severity": "高い", + "subcategory": "フロントドア", + "text": "Front Door TLS/SSL ポリシーが構成されている", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", + "id": "B08.04", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect", + "severity": "高い", + "subcategory": "フロントドア", + "text": "Front Door リダイレクト ポート 80 からポート 443 が構成されている (リスナー)", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", + "id": "B08.05", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics", + "severity": "高い", + "subcategory": "フロントドア", + "text": "Front Door 診断ログから ApplicationGatewayAccessLog と ApplicationGateway FirewallLog が Sentinel LAW に送信される", + "waf": "安全" + }, + { + "category": "Azure ネットワーク", + "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", + "id": "B09.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "高い", + "subcategory": "DDOSプロテクション", + "text": "ファイアウォールのパブリック IP (すべてのパブリック IP) に対して有効", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", + "id": "C01.01", + "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory", + "severity": "高い", + "subcategory": "テナント", + "text": "フルタイムの従業員とエンタープライズ リソースの ID を管理するための単一のエンタープライズ ディレクトリを確立します。", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", + "id": "C01.02", + "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems", + "severity": "高い", + "subcategory": "テナント", + "text": "クラウド ID を既存の ID システムと同期します。", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", + "id": "C01.03", + "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties", + "severity": "高い", + "subcategory": "テナント", + "text": "クラウド ID サービスを使用して、ベンダー、パートナー、顧客などの従業員以外のアカウントをオンプレミスのディレクトリに含めるのではなく、ホストします。", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", + "id": "C01.04", + "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication", + "severity": "高い", + "subcategory": "テナント", + "text": "インターネットに接続するサービスの安全でないレガシ プロトコルを無効にします。", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", + "id": "C01.05", + "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on", + "severity": "高い", + "subcategory": "テナント", + "text": "シングルサインオンを有効にする", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", + "id": "C02.01", + "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers", + "severity": "高い", + "subcategory": "特権管理", + "text": "エンタープライズ ID システムをクラウド ディレクトリと同期するときに、オンプレミス リソースへの最高の特権アクセス権を持つアカウントを同期しないでください。", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", + "id": "C02.02", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5", + "severity": "高い", + "subcategory": "特権管理", + "text": "グローバル管理者の数を 5 人未満に制限する", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", + "id": "C02.03", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment", + "severity": "高い", + "subcategory": "特権管理", + "text": "Azure AD ロールの割り当てにグループを使用し、ロールの割り当てを委任する", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", + "id": "C02.04", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins", + "severity": "高い", + "subcategory": "特権管理", + "text": "すべての重大な影響のある管理者がエンタープライズ ディレクトリによって管理され、組織のポリシーの適用に従うようにします。", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", + "id": "C02.05", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time", + "severity": "高い", + "subcategory": "特権管理", + "text": "定期的なアクセス レビューを構成して、時間の経過と共に不要なアクセス許可を取り消す", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", + "id": "C02.06", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security", + "severity": "中程度", + "subcategory": "特権管理", + "text": "重大な影響の管理者が、高度なセキュリティ保護と監視を備えたワークステーションを使用できるようにする", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", + "id": "C03.01", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c", + "severity": "高い", + "subcategory": "外部 ID", + "text": "ID プロバイダー: 外部 ID プロバイダーが既知であることを確認する", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", + "id": "C03.02", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "高い", + "subcategory": "外部 ID", + "text": "外部コラボレーション設定: ゲスト ユーザー アクセスが [ゲスト ユーザー アクセスが制限されていますか?] に設定", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", + "id": "C03.03", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "高い", + "subcategory": "外部 ID", + "text": "外部コラボレーション設定: ゲスト招待設定を [特定の管理者ロールに割り当てられたユーザーのみ] に設定", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", + "id": "C03.04", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "高い", + "subcategory": "外部 ID", + "text": "外部コラボレーション設定: [無効] に設定されたフローによるゲストのセルフサービス サインアップを有効にする", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", + "id": "C03.05", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "高い", + "subcategory": "外部 ID", + "text": "外部コラボレーション設定: コラボレーションの制限を [指定したドメインへの招待を許可する] に設定", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", + "id": "C03.06", + "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews", + "severity": "中程度", + "subcategory": "外部 ID", + "text": "アクセス レビュー: すべてのグループに対して有効", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", + "id": "C04.01", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent", + "severity": "中程度", + "subcategory": "エンタープライズ アプリケーション", + "text": "同意とアクセス許可: 検証済みの発行元からのアプリに対するユーザーの同意を許可します", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", + "id": "C04.02", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups", + "severity": "中程度", + "subcategory": "エンタープライズ アプリケーション", + "text": "同意と権限: 選択したグループ所有者のグループ所有者の同意を許可します", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "bade4aad-1e8c-439e-a946-667313c00567", + "id": "C05.01", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain", + "severity": "高い", + "subcategory": "カスタムドメイン", + "text": "検証済みの顧客ドメインのみが登録されます", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", + "id": "C06.01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr", + "severity": "高い", + "subcategory": "パスワードのリセット", + "text": "セルフサービス パスワード リセット ポリシー要件に準拠していることが確認されました。", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", + "id": "C06.02", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "中程度", + "subcategory": "パスワードのリセット", + "text": "[ユーザーが認証情報の再確認を求められるまでの日数を設定する] が 0 に設定されていない", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", + "id": "C06.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "高い", + "subcategory": "パスワードのリセット", + "text": "パスワードのリセットに必要な方法の数を設定します", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", + "id": "C07.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles", + "severity": "高い", + "subcategory": "ユーザー設定", + "text": "「ユーザーはアプリケーションを登録できます」を無効にする", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", + "id": "C07.02", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions", + "severity": "高い", + "subcategory": "ユーザー設定", + "text": "管理ポータル (portal.azure.com) へのアクセスを管理者のみに制限する", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", + "id": "C07.03", + "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration", + "severity": "高い", + "subcategory": "ユーザー設定", + "text": "「LinkedInアカウント接続」を無効にする", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", + "id": "C08.01", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring", + "severity": "高い", + "subcategory": "診断設定", + "text": "有効で、Sentinel を使用して Log Analytics ワークスペースに送信する", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", + "id": "C09.01", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan", + "severity": "高い", + "subcategory": "PIM 有効", + "text": "Privileged Identity Management が有効", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", + "id": "C09.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc", + "severity": "高い", + "subcategory": "PIM 有効", + "text": "「ジャストインタイム」(JIT)アクセスを実装して、特権アカウントの公開時間をさらに短縮します(継続的なアクセスを減らします)", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", + "id": "C10.01", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common", + "severity": "高い", + "subcategory": "条件付きアクセス ポリシー", + "text": "条件付きアクセス ポリシー/アクセス制御を構成する", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", + "id": "C10.02", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition", + "severity": "中程度", + "subcategory": "条件付きアクセス ポリシー", + "text": "条件:制限付き地域", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", + "id": "C10.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa", + "severity": "高い", + "subcategory": "条件付きアクセス ポリシー", + "text": "アクセス制御: すべてのユーザーに対して MFA が有効", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", + "id": "C10.04", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa", + "severity": "中程度", + "subcategory": "条件付きアクセス ポリシー", + "text": "アクセス制御: 管理者に MFA を要求する", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", + "id": "C10.05", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management", + "severity": "高い", + "subcategory": "条件付きアクセス ポリシー", + "text": "アクセス制御: Azure 管理に MFA を要求する", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", + "id": "C10.06", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy", + "severity": "高い", + "subcategory": "条件付きアクセス ポリシー", + "text": "アクセス制御:レガシープロトコルのブロック", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", + "id": "C10.07", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices", + "severity": "高い", + "subcategory": "条件付きアクセス ポリシー", + "text": "アクセス制御: デバイスを準拠としてマークする必要があります", + "waf": "安全" + }, + { + "category": "同一性", + "description": "顧客文書化ポリシー", + "guid": "a7144351-e19d-4d34-929e-b7228137a151", + "id": "C11.01", + "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/", + "severity": "中程度", + "subcategory": "ゲスト ユーザー", + "text": "ゲスト ユーザー アカウントを追跡するポリシー (つまり、使用/削除/無効化) はありますか?", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", + "id": "C12.01", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score", + "severity": "高い", + "subcategory": "ID セキュリティ スコア", + "text": "業界のベストプラクティスに基づくIDセキュリティスコアの実装", + "waf": "安全" + }, + { + "category": "同一性", + "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", + "id": "C13.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "severity": "中程度", + "subcategory": "非常用アカウント", + "text": "少なくとも 2 つの非常用アカウントが作成されており、その使用に関するポリシーが存在します", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", + "id": "D01.01", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "severity": "高い", + "subcategory": "アクセス制御", + "text": "Azure Policy を利用した VM アクセスの制御", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", + "id": "D01.02", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax", + "severity": "中程度", + "subcategory": "アクセス制御", + "text": "テンプレートを活用して VM のセットアップとデプロイのばらつきを減らす", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "b5945bda-4333-44fd-b91c-234182b65275", + "id": "D01.03", + "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models", + "severity": "中程度", + "subcategory": "アクセス制御", + "text": "ガバナンスを通じてリソースにアクセスできるユーザーを減らすことで、VMS をデプロイするための特権アクセスをセキュリティで保護します", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", + "id": "D02.01", + "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service", + "severity": "中程度", + "subcategory": "高可用性", + "text": "ワークロードに複数の VM を使用して可用性を向上させる", + "waf": "確実" + }, + { + "category": "VM セキュリティチェック", + "guid": "f219e4a1-eb58-4879-935d-227886d30b66", + "id": "D02.02", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm", + "severity": "中程度", + "subcategory": "高可用性", + "text": "ディザスター リカバリー ソリューションのデプロイとテスト", + "waf": "確実" + }, + { + "category": "VM セキュリティチェック", + "guid": "c57be595-1900-4838-95c5-86cb291ec16a", + "id": "D02.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "severity": "中程度", + "subcategory": "高可用性", + "text": "可用性セット", + "waf": "確実" + }, + { + "category": "VM セキュリティチェック", + "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", + "id": "D02.04", + "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context", + "severity": "中程度", + "subcategory": "高可用性", + "text": "アベイラビリティーゾーン", + "waf": "確実" + }, + { + "category": "VM セキュリティチェック", + "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", + "id": "D02.05", + "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region", + "severity": "中程度", + "subcategory": "高可用性", + "text": "地域フォールトトレランス", + "waf": "確実" + }, + { + "category": "VM セキュリティチェック", + "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", + "id": "D03.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware", + "severity": "高い", + "subcategory": "マルウェアからの保護", + "text": "マルウェア対策ソリューションをインストールする", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", + "id": "D03.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "高い", + "subcategory": "マルウェアからの保護", + "text": "マルウェア対策ソリューションと Security Center の統合", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", + "id": "D04.01", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "severity": "高い", + "subcategory": "VM の更新を管理する", + "text": "Update Management と Azure Automation を使用して VM を最新の状態に保つ", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", + "id": "D04.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching", + "severity": "中程度", + "subcategory": "VM の更新を管理する", + "text": "展開用の Windows イメージに最新レベルの更新プログラムがあることを確認する", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "02145901-465d-438e-9309-ccbd979266bc", + "id": "D04.03", + "link": "https://learn.microsoft.com/azure/security-center/asset-inventory", + "severity": "高い", + "subcategory": "VM の更新を管理する", + "text": "Microsoft Defender for Cloud を使用して VM にセキュリティ更新プログラムを迅速に適用する", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", + "id": "D05.01", + "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", + "severity": "高い", + "subcategory": "VHD を暗号化する", + "text": "VM で暗号化を有効にする", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", + "id": "D05.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek", + "severity": "高い", + "subcategory": "VHD を暗号化する", + "text": "暗号化のセキュリティ層を追加するためのキー暗号化キー(KEK)の追加", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", + "id": "D05.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk", + "severity": "中程度", + "subcategory": "VHD を暗号化する", + "text": "ロールバックのために暗号化する前にディスクのスナップショットを作成する", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "5173676a-e466-491e-a835-ad942223e138", + "id": "D06.01", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "severity": "高い", + "subcategory": "インターネットへの直接接続を制限する", + "text": "中央ネットワーク・グループのみがネットワーク・リソースへのアクセス許可を持っていることを確認する", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "10523081-a941-4741-9833-ff7ad7c6d373", + "id": "D06.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "高い", + "subcategory": "インターネットへの直接接続を制限する", + "text": "\"ANY\" ソース IP アドレスからのアクセスを許可する公開されている VM を特定して修復する", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", + "id": "D06.03", + "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time", + "severity": "高い", + "subcategory": "インターネットへの直接接続を制限する", + "text": "ジャストインタイムアクセスを使用した管理ポート(RDP、SSH)の制限", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", + "id": "D06.04", + "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", + "severity": "高い", + "subcategory": "インターネットへの直接接続を制限する", + "text": "インターネット アクセスを削除し、RDP 用のジャンプ サーバーを実装する", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", + "id": "D06.05", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling", + "severity": "高い", + "subcategory": "インターネットへの直接接続を制限する", + "text": "インターネットからRDP/SSHを使用してサーバーへの直接ログインを削除し、VPNまたはExpressルートを実装します", + "waf": "安全" + }, + { + "category": "VM セキュリティチェック", + "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", + "id": "D06.06", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "severity": "高い", + "subcategory": "インターネットへの直接接続を制限する", + "text": "Azure Bastion を RDP/SSH ブローカーとして活用して、セキュリティを強化し、フットプリントを削減", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", + "id": "E01.01", + "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", + "severity": "高い", + "subcategory": "建築", + "text": "すべてのテナントに、少なくとも 1 つの Log Analytics ワークスペースで Sentinel が有効になっていることが含まれている", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", + "id": "E01.02", + "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture", + "severity": "高い", + "subcategory": "建築", + "text": "お客様がSentinelのアーキテクチャを理解している", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", + "id": "E01.03", + "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view", + "severity": "中程度", + "subcategory": "建築", + "text": "お客様は、複数のSentinelインスタンスにわたってインシデントを監視する方法を知っている", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "8989579e-76b8-497e-910a-7da7be9966e1", + "id": "E02.01", + "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics", + "severity": "中程度", + "subcategory": "概要", + "text": "24 時間以上オープンするインシデントはありません", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", + "id": "E03.01", + "link": "https://learn.microsoft.com/azure/sentinel/whats-new", + "severity": "低い", + "subcategory": "ニュース&ガイド", + "text": "お客様には「News & Guides」タブが表示されました", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", + "id": "E04.01", + "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics", + "severity": "中程度", + "subcategory": "UEBA(欧州経済共同体)", + "text": "UEBA設定済み(Sentinel/Settings/Settings/Configure UEBA)", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", + "id": "E05.01", + "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "構成済みの Azure Active Directory と \"Last Log Received\" が今日表示されます", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", + "id": "E05.02", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "Azure Active Directory Identity Protection が構成され、\"最後に受信したログ\" が今日表示されます", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", + "id": "E05.03", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "Azure アクティビティが構成され、構成され、\"最後に受信したログ\" が今日表示されます", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", + "id": "E05.04", + "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "Microsoft Defender for Cloud が構成され、\"最後に受信したログ\" が今日表示されます", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", + "id": "E05.05", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "Azure Firewall が構成され、\"最後に受信したログ\" が今日表示されます", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", + "id": "E05.06", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "Windows ファイアウォールが構成され、「最後に受信したログ」が今日表示される", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", + "id": "E05.07", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "セキュリティイベントはAMAで設定され、「Last Log Received」が今日表示されます", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "1a4834ac-9322-423e-ae80-b123081a5417", + "id": "E05.08", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "セキュリティ イベント - Azure コンピューターが接続され、ワークスペースにデータを送信していることを確認します", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", + "id": "E05.09", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "セキュリティ イベント - Azure 以外のコンピューターが接続され、ワークスペースにデータを送信していることを確認します", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", + "id": "E05.10", + "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "AWS用コネクタ", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", + "id": "E05.11", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "高い", + "subcategory": "通信用コネクタ", + "text": "GCP用コネクタ", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", + "id": "E06.01", + "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in", + "severity": "高い", + "subcategory": "分析ルール", + "text": "お客様が分析ルールを有効にし、インシデントを構成しました", + "waf": "安全" + }, + { + "category": "番兵", + "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", + "id": "E07.01", + "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/", + "severity": "中程度", + "subcategory": "設定", + "text": "お客様が日次上限を有効にしていない", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", + "id": "F01.01", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "severity": "高い", + "subcategory": "構成", + "text": "Azure Firewall Premium のデプロイ", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", + "id": "F01.02", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route", + "severity": "高い", + "subcategory": "構成", + "text": "クワッド ゼロ/フォース チューニングを Azure Firewall で有効にする", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", + "id": "F02.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "中程度", + "subcategory": "アクセス制御", + "text": "許可されたユーザーのみを有効にするように設定された RBAC", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", + "id": "F03.01", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "severity": "中程度", + "subcategory": "診断設定", + "text": "診断が有効で、Log Analytics ワークスペースにメトリックを送信する", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "b35478c3-4798-416b-8863-cffe1cac599e", + "id": "F04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "ハブと仮想ネットワークは、Firewall Premium を介して保護または接続されます", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", + "id": "F04.02", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "ポリシー: アクセス制御が構成されている (RBAC)", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", + "id": "F04.03", + "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "ポリシー: 親ポリシーが構成されています", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", + "id": "F04.04", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "ポリシー: ルール コレクションが定義されている", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", + "id": "F04.05", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "ポリシー: DNAT ポリシーが定義されています", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", + "id": "F04.06", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "ポリシー: ネットワーク ルールが定義されている", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", + "id": "F04.07", + "link": "https://learn.microsoft.com/azure/firewall/features", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "ポリシー: アプリケーション ルールが定義されている", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", + "id": "F04.08", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "severity": "中程度", + "subcategory": "ファイアウォール マネージャー", + "text": "DNS:機能が認識され、適用されている、または適用されていない", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", + "id": "F04.09", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "脅威インテリジェンス: [アラートと拒否] に設定", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", + "id": "F04.10", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "脅威インテリジェンス:許可リスト(使用されているかどうか、つまりパフォーマンスを正当化します)", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", + "id": "F04.11", + "link": "https://learn.microsoft.com/azure/firewall/premium-certificates", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "TLS対応", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", + "id": "F04.12", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "IDPS が有効", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", + "id": "F04.13", + "link": "https://learn.microsoft.com/azure/firewall/snat-private-range", + "severity": "高い", + "subcategory": "ファイアウォール マネージャー", + "text": "SNAT: 構成済み", + "waf": "安全" + }, + { + "category": "Azure Firewall", + "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", + "id": "F05.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "中程度", + "subcategory": "DDOSプロテクション", + "text": "ファイアウォールのパブリック IP に対して有効", + "waf": "安全" + } + ], + "metadata": { + "name": "Azure Security Review Checklist", + "state": "Deprecated", + "timestamp": "June 24, 2024" + }, + "severities": [ + { + "name": "高い" + }, + { + "name": "中程度" + }, + { + "name": "低い" + } + ], + "status": [ + { + "description": "このチェックはまだ検討されていません", + "name": "未確認" + }, + { + "description": "このチェックにはアクションアイテムが関連付けられています", + "name": "開ける" + }, + { + "description": "このチェックは検証済みで、これ以上のアクションアイテムは関連付けられていません", + "name": "達成" + }, + { + "description": "推奨事項は理解されているが、現在の要件では不要", + "name": "必要なし" + }, + { + "description": "現在のデザインには適用されません", + "name": "該当なし" + } + ], + "waf": [ + { + "name": "確実" + }, + { + "name": "安全" + }, + { + "name": "費用" + }, + { + "name": "オペレーションズ" + }, + { + "name": "パフォーマンス" + } + ], + "yesno": [ + { + "name": "はい" + }, + { + "name": "いいえ" + } + ] +} \ No newline at end of file diff --git a/checklists/security_checklist.ko.json b/checklists/security_checklist.ko.json index 231924a77..8194f11e2 100644 --- a/checklists/security_checklist.ko.json +++ b/checklists/security_checklist.ko.json @@ -1,1328 +1,1669 @@ { - "metadata": { - "name": "Azure 보안 검토 검사 목록" - }, - "items": [ - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "모든 구독에서 보안 센터/수비수 사용", - "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "모든 로그 분석 작업 영역에서 보안 센터/수비수 사용", - "guid": "349f0364-d28d-442e-abbb-c868255abc91", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "데이터 수집이 '공통'으로 설정됨", - "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "Defender for Cloud 강화 보안 기능이 모두 활성화되었습니다.", - "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "회사 정책에 따라 자동 프로비저닝 사용(정책이 있어야 함)", - "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "회사 정책에 따라 사용하도록 설정된 전자 메일 알림(정책이 있어야 함)", - "guid": "25759e35-680e-4782-9ac9-32213d027ff4", - "severity": "낮다", - "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "통합 사용 옵션이 선택되었습니다. ", - "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "CI/CD 통합이 구성됨", - "guid": "5b7bae4-4위-45e8-a79e-2e86667313c5", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "제3자 SIEM을 사용하는 경우 '이벤트 허브' 연속 내보내기가 활성화됩니다.", - "guid": "05675c5e-985b-4859-a774-f7e371623b87", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "Azure 센티넬을 사용하지 않는 경우 '로그 분석 작업 영역'을 계속 내보낼 수 있습니다.", - "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "AWS에 클라우드 커넥터 지원", - "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "GCP에 사용할 수 있는 클라우드 커넥터", - "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "가격 및 설정", - "text": "Azure AD 응용 프로그램 프록시를 사용하는 경우 클라우드 앱용 Microsoft Defender와 통합하여 응용 프로그램 액세스를 실시간으로 모니터링하고 고급 보안 제어를 적용하는 것이 좋습니다.", - "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", - "severity": "낮다", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "권장 사항", - "text": "필요하지 않은 경우 모든 권장 사항이 수정되거나 비활성화됩니다.", - "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "권장 사항", - "text": "보안 점수 > 70 %", - "description": "모든 고객에 대한 Microsoft 최소 목표는 70%입니다.", - "guid": "08032729-4798-4b15-98a2-19a46ceb5443", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "보안 경고", - "text": "보안 경고에는 지난 24시간 동안 생성된 경고만 포함됩니다(이전 보안 경고 수정 또는 비활성화).", - "guid": "50259226-4429-42bb-9285-37a55119bf8e", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "통합 문서", - "text": "연속 내보내기를 사용하도록 설정한 경우 기본 통합 문서가 사용자 지정 보안 대시보드에 게시됨", - "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "커뮤니티", - "text": "고객은 '커뮤니티'페이지의 가치를 알고 있으며 검토를 위해 정기적으로 케이던스를 설정했습니다.", - "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", - "severity": "보통", - "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "보안 점수", - "text": "Security Center에서 보호하는 모든 구독이 표시됩니다(구독 필터가 설정되지 않음).", - "description": "고객 운영 모범 사례 - 투명성", - "guid": "93846da9-7cc3-4923-856b-22586f4a1641", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "규정 준수", - "text": "규정 준수 제어는 필요한 규정 준수 요구 사항에 대해 친환경적입니다.", - "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "Azure Defender", - "text": "심각도가 높은 VM 취약성이 제로(비어 있음)입니다.", - "description": "고객 운영 모범 사례 - 확인", - "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "방화벽 관리자", - "text": "허브는 Azure 방화벽에 의해 보호됩니다.", - "guid": "9603334b-df9c-4c23-918d-b61171265f4b", - "severity": "보통", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "방화벽 관리자", - "text": "가상 네트워크는 방화벽에 의해 보호됩니다.", - "description": "고객 운영 모범 사례 - 확인", - "guid": "b47a393a-0803-4272-a479-8b1578a219a4", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "방화벽 관리자", - "text": "DDoS 표준 사용 가능", - "guid": "6ceb5443-5025-4922-9442-92bb628537a5", - "severity": "보통", - "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/" - }, - { - "category": "클라우드를 위한 수비수", - "subcategory": "보도", - "text": "모든 구독이 적용되는지 확인(가격 및 수정할 설정 참조)", - "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "Azure Networking", - "subcategory": "공용 IP", - "text": "공용 IP가 있는 VM은 NSG로 보호해야 합니다. ", - "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Azure Networking", - "subcategory": "공용 IP", - "text": "공용 IP가 있는 VM은 Azure 방화벽 프리미엄 뒤로 이동됩니다.", - "description": "고객 운영 모범 사례 - 확인", - "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Azure Networking", - "subcategory": "공용 IP", - "text": "공용 IP가 필요하지 않은 VM에는 공용 IP가 없습니다(예: 내부 RDP에만 해당).", - "description": "고객 운영 모범 사례 - 확인", - "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access" - }, - { - "category": "Azure Networking", - "subcategory": "증권 시세 표시기", - "text": "NSG RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.", - "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "증권 시세 표시기", - "text": "NSG 인바운드 보안 규칙에는 원본 필드에 *(와일드카드)가 포함되어 있지 않습니다.", - "description": "고객 운영 모범 사례 - 확인", - "guid": "a209939b-da47-4778-b24c-116785c2fa55", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "증권 시세 표시기", - "text": "NSG 아웃바운드 보안 규칙은 방화벽을 통해 라우팅되지 않은 트래픽에 대해 특정 IP 주소에 대한 트래픽을 제어하는 데 사용됩니다.", - "description": "고객 운영 모범 사례 - 확인", - "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "증권 시세 표시기", - "text": "NSG에는 소스가 *(와일드카드)로 설정되어 있지 않습니다.", - "description": "고객 운영 모범 사례 - 확인", - "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Azure Networking", - "subcategory": "증권 시세 표시기", - "text": "NSG 진단은 NetworkSecurityGroupEvent 및 NetworkSecurityGroupRuleCounter 트래픽을 Sentinel LAW로 보냅니다.", - "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log" - }, - { - "category": "Azure Networking", - "subcategory": "UDR", - "text": "UDR RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.", - "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "UDR", - "text": "제로 트러스트인 경우 UDR은 모든 트래픽을 Azure 방화벽 프리미엄으로 보내는 데 사용됩니다.", - "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "UDR", - "text": "AzureFirewallPremium으로 모든 트래픽을 보내지 않는 UDR은 알려져 있고 문서화되어 있습니다.", - "description": "고객 운영 모범 사례 - 확인", - "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "고객은 Azure의 Azure 네트워킹 기본값/SDN 기본 라우팅에 익숙합니다.", - "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "VNet RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.", - "description": "고객 운영 모범 사례 - 확인", - "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", - "severity": "보통", - "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "VNet 보안 권장 사항이 수정되고 '위험' VNet이 없습니다. ", - "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "VNet 피어링 연결을 이해하고 예상되는 트래픽 흐름이 문서화됩니다.", - "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "VNet 서비스 끝점이 사용 중이며 레거시 공용 서비스 끝점이 없습니다.", - "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "VNet 개인 끝점이 온-프레미스 환경에서 액세스를 허용하는 데 사용 중이며 레거시 공용 끝점이 없습니다.", - "guid": "1f625659-ee55-480a-9824-9c931213dbd7", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "VNet 모니터링 사용", - "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "AKS(Azure Kubernetes Service)의 네트워크 정책을 사용하여 포드 간의 트래픽 보안", - "guid": "2055b29b-ade4-4위-8e8c-39ec94666731", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "VNet NVA(어플라이언스) 고객이 게시된 아키텍처 패턴을 따릅니다.", - "guid": "3c005674-c1e9-445b-959c-373e7ed71623", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva" - }, - { - "category": "Azure Networking", - "subcategory": "가상 네트워크", - "text": "VNet 진단 설정이 사용하도록 설정되고 VMProtectionAlerts를 Azure Sentinel LAW로 보냅니다.", - "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Azure Networking", - "subcategory": "인터넷", - "text": "ExpressRoute 또는 VPN을 사용하여 온-프레미스 환경에서 Azure 리소스에 액세스", - "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure" - }, - { - "category": "Azure Networking", - "subcategory": "가상 WAN", - "text": "VWAN RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.", - "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about" - }, - { - "category": "Azure Networking", - "subcategory": "가상 WAN", - "text": "VWAN 고객은 보안 허브 또는 외부 방화벽을 사용하여 트래픽을 라우팅하고 모니터링합니다.", - "guid": "718d1dca-1f62-4565-aee5-580a38249c93", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture" - }, - { - "category": "Azure Networking", - "subcategory": "응용 프로그램 게이트웨이", - "text": "AppGW RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.", - "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview" - }, - { - "category": "Azure Networking", - "subcategory": "응용 프로그램 게이트웨이", - "text": "AppGW 모든 외부 연결 웹 서비스는 WAF가 활성화 된 응용 프로그램 게이트웨이를 호출합니다. ", - "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Azure Networking", - "subcategory": "응용 프로그램 게이트웨이", - "text": "AppGW 모든 내부 연결 웹 서비스는 WAF가 활성화 된 응용 프로그램 게이트웨이를 호출합니다. ", - "guid": "94666731-3c00-4567-9c1e-945b459c373e", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Azure Networking", - "subcategory": "응용 프로그램 게이트웨이", - "text": "AppGW - 외부 직면이 TLS/SSL을 사용하도록 설정되어 있으며 모든 트래픽을 443(포트 80 트래픽 없음)으로 리디렉션합니다.", - "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview" - }, - { - "category": "Azure Networking", - "subcategory": "프론트도어", - "text": "Front Door RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.", - "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/frontdoor/" - }, - { - "category": "Azure Networking", - "subcategory": "프론트도어", - "text": "정문은 WAF 정책과 연결되어 있습니다.", - "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", - "severity": "높다", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json" - }, - { - "category": "Azure Networking", - "subcategory": "프론트도어", - "text": "프런트 도어 TLS/SSL 정책이 구성됨", - "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https" - }, - { - "category": "Azure Networking", - "subcategory": "프론트도어", - "text": "전면 도어 리디렉션 포트 80에서 포트 443으로 구성됨(수신기)", - "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect" - }, - { - "category": "Azure Networking", - "subcategory": "프론트도어", - "text": "정문 진단 로그는 ApplicationGatewayAccessLog &ApplicationGateway FirewallLog를 Sentinel LAW로 보냅니다.", - "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics" - }, - { - "category": "Azure Networking", - "subcategory": "DDOS 보호", - "text": "방화벽 공용 IP(모든 공용 IP)에 대해 사용", - "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - }, - { - "category": "신원", - "subcategory": "테 넌 트", - "text": "풀 타임 직원 및 엔터프라이즈 리소스의 ID를 관리하기 위한 단일 엔터프라이즈 디렉터리를 설정합니다.", - "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", - "severity": "높다", - "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory" - }, - { - "category": "신원", - "subcategory": "테 넌 트", - "text": "클라우드 ID를 기존 ID 시스템과 동기화합니다.", - "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", - "severity": "높다", - "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems" - }, - { - "category": "신원", - "subcategory": "테 넌 트", - "text": "클라우드 ID 서비스를 사용하여 온-프레미스 디렉터리에 포함시키지 않고 공급업체, 파트너 및 고객과 같은 직원이 아닌 계정을 호스팅합니다.", - "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", - "severity": "높다", - "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties" - }, - { - "category": "신원", - "subcategory": "테 넌 트", - "text": "인터넷 연결 서비스에 대해 안전하지 않은 레거시 프로토콜을 사용하지 않도록 설정합니다.", - "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", - "severity": "높다", - "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication" - }, - { - "category": "신원", - "subcategory": "테 넌 트", - "text": "싱글 사인온 사용", - "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on" - }, - { - "category": "신원", - "subcategory": "권한 있는 관리", - "text": "엔터프라이즈 ID 시스템을 클라우드 디렉터리와 동기화할 때 온-프레미스 리소스에 대한 가장 높은 권한 액세스 권한으로 계정을 동기화하지 마세요.", - "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", - "severity": "높다", - "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers" - }, - { - "category": "신원", - "subcategory": "권한 있는 관리", - "text": "전역 관리자 수를 5명 미만으로 제한합니다.", - "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5" - }, - { - "category": "신원", - "subcategory": "권한 있는 관리", - "text": "Azure AD 역할 할당에 그룹을 사용하고 역할 할당을 위임합니다.", - "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment" - }, - { - "category": "신원", - "subcategory": "권한 있는 관리", - "text": "모든 중요 영향 관리자가 엔터프라이즈 디렉터리에서 관리되어 조직 정책 적용을 따르도록 합니다.", - "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins" - }, - { - "category": "신원", - "subcategory": "권한 있는 관리", - "text": "시간이 지남에 따라 불필요한 권한을 해지하도록 반복 액세스 검토 구성", - "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time" - }, - { - "category": "신원", - "subcategory": "권한 있는 관리", - "text": "중대한 영향 관리자가 보안 보호 및 모니터링이 강화된 워크스테이션을 사용하는지 확인", - "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security" - }, - { - "category": "신원", - "subcategory": "외부 신원", - "text": "ID 공급자: 외부 ID 공급자가 알려져 있는지 확인", - "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c" - }, - { - "category": "신원", - "subcategory": "외부 신원", - "text": "외부 공동 작업 설정: 게스트 사용자 액세스가 '게스트 사용자 액세스가 제한됩니까?'로 설정됩니다.", - "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "신원", - "subcategory": "외부 신원", - "text": "외부 공동 작업 설정: 게스트 초대 설정이 '특정 관리자 역할에 할당된 사용자만'으로 설정됨", - "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "신원", - "subcategory": "외부 신원", - "text": "외부 공동 작업 설정: '사용 안 함'으로 설정된 흐름을 통해 게스트 셀프 서비스 가입 사용 ", - "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "신원", - "subcategory": "외부 신원", - "text": "외부 공동 작업 설정: 공동 작업 제한이 '지정된 도메인에 대한 초대 허용'으로 설정됨", - "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "신원", - "subcategory": "외부 신원", - "text": "액세스 검토: 모든 그룹에 대해 사용 가능", - "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews" - }, - { - "category": "신원", - "subcategory": "엔터프라이즈 응용 프로그램", - "text": "동의 및 권한: 확인된 게시자의 앱에 대한 사용자 동의 허용", - "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent" - }, - { - "category": "신원", - "subcategory": "엔터프라이즈 응용 프로그램", - "text": "동의 및 권한: 선택한 그룹 소유자에 대해 그룹 소유자 동의 허용 ", - "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups" - }, - { - "category": "신원", - "subcategory": "사용자 지정 도메인", - "text": "검증된 고객 도메인만 등록됩니다.", - "guid": "bade4aad-1e8c-439e-a946-667313c00567", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain" - }, - { - "category": "신원", - "subcategory": "암호 재설정", - "text": "셀프 서비스 암호 재설정 정책 요구 사항을 준수하는지 확인했습니다.", - "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr" - }, - { - "category": "신원", - "subcategory": "암호 재설정", - "text": "사용자에게 인증 정보를 다시 확인하라는 메시지가 표시되기까지의 일수를 0으로 설정하지 않음", - "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "신원", - "subcategory": "암호 재설정", - "text": "암호 재설정에 필요한 설정 횟수가 선택되었습니다.", - "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "신원", - "subcategory": "사용자 설정", - "text": "'사용자가 응용 프로그램을 등록 할 수 있습니다'를 비활성화하십시오.", - "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles" - }, - { - "category": "신원", - "subcategory": "사용자 설정", - "text": "portal.azure.com(관리 포털)에 대한 액세스를 관리자로만 제한", - "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions" - }, - { - "category": "신원", - "subcategory": "사용자 설정", - "text": "'LinkedIn 계정 연결' 비활성화", - "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration" - }, - { - "category": "신원", - "subcategory": "진단 설정", - "text": "사용 및 센티넬을 사용하여 로그 분석 작업 영역으로 보내기", - "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring" - }, - { - "category": "신원", - "subcategory": "PIM 사용 가능", - "text": "권한 있는 ID 관리 사용", - "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan" - }, - { - "category": "신원", - "subcategory": "PIM 사용 가능", - "text": "'JIT(Just in Time)' 액세스를 구현하여 권한 있는 계정의 노출 시간을 더욱 단축(스탠딩 액세스 감소)", - "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc" - }, - { - "category": "신원", - "subcategory": "조건부 액세스 정책", - "text": "조건부 액세스 정책 구성 / 액세스 제어", - "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common" - }, - { - "category": "신원", - "subcategory": "조건부 액세스 정책", - "text": "조건: 제한된 위치", - "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition" - }, - { - "category": "신원", - "subcategory": "조건부 액세스 정책", - "text": "액세스 제어: 모든 사용자에 대해 MFA 사용", - "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa" - }, - { - "category": "신원", - "subcategory": "조건부 액세스 정책", - "text": "액세스 제어: 관리자에 대해 MFA 필요", - "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa" - }, - { - "category": "신원", - "subcategory": "조건부 액세스 정책", - "text": "액세스 제어: Azure 관리에 MFA 필요 ", - "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management" - }, - { - "category": "신원", - "subcategory": "조건부 액세스 정책", - "text": "액세스 제어: 레거시 프로토콜 차단", - "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy" - }, - { - "category": "신원", - "subcategory": "조건부 액세스 정책", - "text": "액세스 제어: 장치를 규격으로 표시해야 합니다.", - "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices" - }, - { - "category": "신원", - "subcategory": "게스트 사용자", - "text": "게스트 사용자 계정을 추적하는 정책(예: 사용/삭제/사용 안 함)이 있습니까?", - "description": "고객 문서화 정책", - "guid": "a7144351-e19d-4d34-929e-b7228137a151", - "severity": "보통", - "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/" - }, - { - "category": "신원", - "subcategory": "ID 보안 점수", - "text": "업계 모범 사례를 기반으로 ID 보안 점수 구현", - "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score" - }, - { - "category": "신원", - "subcategory": "브레이크 글래스 계정", - "text": "적어도 두 개의 브레이크 글라스 계정이 만들어졌으며 사용에 관한 정책이 존재합니다.", - "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access" - }, - { - "category": "VM 보안 검사", - "subcategory": "액세스 제어", - "text": "Azure 정책을 활용한 VM 액세스 제어", - "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/governance/policy/overview" - }, - { - "category": "VM 보안 검사", - "subcategory": "액세스 제어", - "text": "템플릿을 활용하여 VM 설정 및 배포의 변동성을 줄입니다.", - "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax" - }, - { - "category": "VM 보안 검사", - "subcategory": "액세스 제어", - "text": "거버넌스를 통해 리소스에 액세스할 수 있는 사용자를 줄임으로써 VMS를 배포하기 위한 권한 있는 액세스 보안", - "guid": "b5945bda-4333-44fd-b91c-234182b65275", - "severity": "보통", - "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models" - }, - { - "category": "VM 보안 검사", - "subcategory": "고가용성 ", - "text": "더 나은 가용성을 위해 워크로드에 여러 VM 사용 ", - "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service" - }, - { - "category": "VM 보안 검사", - "subcategory": "고가용성 ", - "text": "재해 복구 솔루션 배포 및 테스트 ", - "guid": "f219e4a1-eb58-4879-935d-227886d30b66", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm" - }, - { - "category": "VM 보안 검사", - "subcategory": "고가용성 ", - "text": "가용성 세트", - "guid": "c57be595-1900-4838-95c5-86cb291ec16a", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview" - }, - { - "category": "VM 보안 검사", - "subcategory": "고가용성 ", - "text": "가용 영역", - "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context" - }, - { - "category": "VM 보안 검사", - "subcategory": "고가용성 ", - "text": "지역 내결함성 ", - "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region" - }, - { - "category": "VM 보안 검사", - "subcategory": "맬웨어로부터 보호", - "text": "맬웨어 방지 솔루션 설치", - "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware" - }, - { - "category": "VM 보안 검사", - "subcategory": "맬웨어로부터 보호", - "text": "맬웨어 방지 솔루션을 보안 센터와 통합", - "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "VM 보안 검사", - "subcategory": "VM 업데이트 관리", - "text": "Azure 자동화를 사용한 업데이트 관리를 사용하여 VM을 최신 상태로 유지", - "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview" - }, - { - "category": "VM 보안 검사", - "subcategory": "VM 업데이트 관리", - "text": "배포용 Windows 이미지에 최신 수준의 업데이트가 있는지 확인 ", - "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching" - }, - { - "category": "VM 보안 검사", - "subcategory": "VM 업데이트 관리", - "text": "클라우드용 Microsoft Defender를 사용하여 VM에 보안 업데이트를 신속하게 적용", - "guid": "02145901-465d-438e-9309-ccbd979266bc", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/asset-inventory" - }, - { - "category": "VM 보안 검사", - "subcategory": "VHD 암호화", - "text": "VM에서 암호화 사용", - "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview" - }, - { - "category": "VM 보안 검사", - "subcategory": "VHD 암호화", - "text": "암호화를 위한 보안 계층을 추가하기 위해 KEK(키 암호화 키) 추가 ", - "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek" - }, - { - "category": "VM 보안 검사", - "subcategory": "VHD 암호화", - "text": "롤백 목적으로 암호화하기 전에 디스크의 스냅숏 만들기", - "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk" - }, - { - "category": "VM 보안 검사", - "subcategory": "직접 인터넷 연결 제한 ", - "text": "중앙 네트워킹 그룹에만 네트워킹 리소스에 대한 사용 권한이 있는지 확인 ", - "guid": "5173676a-e466-491e-a835-ad942223E138", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles" - }, - { - "category": "VM 보안 검사", - "subcategory": "직접 인터넷 연결 제한 ", - "text": "'ANY' 원본 IP 추가 기능으로부터의 액세스를 허용하는 노출된 VM을 ID 및 수정합니다.", - "guid": "10523081-a941-4741-9833-ff7ad7c6d373", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "VM 보안 검사", - "subcategory": "직접 인터넷 연결 제한 ", - "text": "적시 액세스를 사용하여 관리 포트(RDP, SSH) 제한", - "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time" - }, - { - "category": "VM 보안 검사", - "subcategory": "직접 인터넷 연결 제한 ", - "text": "인터넷 액세스를 제거하고 RDP용 점프 서버를 구현합니다.", - "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", - "severity": "높다", - "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html" - }, - { - "category": "VM 보안 검사", - "subcategory": "직접 인터넷 연결 제한 ", - "text": "인터넷에서 RDP / SSH를 사용하여 서버에 직접 로그인을 제거하고 VPN 또는 고속 경로를 구현하십시오.", - "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling" - }, - { - "category": "VM 보안 검사", - "subcategory": "직접 인터넷 연결 제한 ", - "text": "Azure 요새를 RDP/SSH 브로커로 활용하여 보안을 강화하고 설치 공간을 줄입니다.", - "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview" - }, - { - "category": "센 티 넬", - "subcategory": "건축학 ", - "text": "포함된 모든 테넌트에는 하나 이상의 로그 분석 작업 영역에서 센티넬이 활성화되어 있습니다.", - "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard" - }, - { - "category": "센 티 넬", - "subcategory": "건축학 ", - "text": "고객이 센티넬 아키텍처를 이해합니다.", - "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture" - }, - { - "category": "센 티 넬", - "subcategory": "건축학 ", - "text": "고객은 여러 센티넬 인스턴스에서 인시던트를 모니터링하는 방법을 알고 있습니다.", - "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view" - }, - { - "category": "센 티 넬", - "subcategory": "개요", - "text": "24시간 이상 열리는 인시던트 없음", - "guid": "8989579e-76b8-497e-910A-7Da7be9966E1", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics" - }, - { - "category": "센 티 넬", - "subcategory": "뉴스 및 가이드", - "text": "고객에게 뉴스 및 가이드 탭이 표시됨", - "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", - "severity": "낮다", - "link": "https://learn.microsoft.com/azure/sentinel/whats-new" - }, - { - "category": "센 티 넬", - "subcategory": "UEBA ", - "text": "UEBA 구성됨(센티넬/설정/설정/UEBA 구성)", - "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "구성된 Azure Active Directory 및 '마지막으로 받은 로그'가 오늘 표시됩니다.", - "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "Azure Active Directory ID 보호가 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.", - "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "Azure 활동이 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.", - "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "클라우드용 Microsoft Defender가 구성되었으며 '마지막으로 받은 로그'가 오늘 표시됩니다.", - "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "Azure 방화벽이 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.", - "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "Windows 방화벽이 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.", - "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "보안 이벤트는 AMA로 구성되며 '마지막으로 받은 로그'가 오늘 표시됩니다.", - "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "보안 이벤트 - Azure 컴퓨터가 연결되어 있고 작업 영역으로 데이터를 보내는지 확인", - "guid": "1a4834ac-9322-423e-ae80-b123081a5417", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "보안 이벤트 - Azure 이외의 컴퓨터가 연결되어 있고 작업 영역으로 데이터를 보내는지 확인", - "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "AWS용 커넥터", - "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3" - }, - { - "category": "센 티 넬", - "subcategory": "데이터 커넥터", - "text": "GCP용 커넥터", - "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "센 티 넬", - "subcategory": "분석 규칙", - "text": "고객이 분석 규칙을 사용하도록 설정하고 인시던트를 구성했습니다. ", - "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in" - }, - { - "category": "센 티 넬", - "subcategory": "설정", - "text": "일일 한도가 활성화되어 있지 않은 경우", - "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", - "severity": "보통", - "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/" - }, - { - "category": "Azure Firewall", - "subcategory": "구성", - "text": "Azure 방화벽 프리미엄 배포됨", - "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall/premium-features" - }, - { - "category": "Azure Firewall", - "subcategory": "구성", - "text": "쿼드 제로/강제 튜닝은 Azure 방화벽을 통해 사용하도록 설정됨", - "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route" - }, - { - "category": "Azure Firewall", - "subcategory": "액세스 제어", - "text": "권한이 있는 사용자만 사용하도록 설정된 RBAC", - "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", - "severity": "보통", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "진단 설정", - "text": "진단을 사용하도록 설정하고 로그 분석 작업 영역에 메트릭을 보냅니다. ", - "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "허브와 가상 네트워크는 방화벽 프리미엄을 통해 보호되거나 연결됩니다.", - "guid": "b35478c3-4798-416b-8863-cffe1cac599e", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "정책: 액세스 제어 구성됨(RBAC)", - "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", - "severity": "높다", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "정책: 상위 정책이 구성됨 ", - "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "정책: 규칙 컬렉션이 정의됩니다.", - "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "정책: DNAT 정책이 정의되어 있습니다.", - "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "정책: 네트워크 규칙이 정의됩니다.", - "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "정책: 응용 프로그램 규칙이 정의됩니다.", - "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall/features" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "DNS: 이해되고 적용되거나 적용되지 않는 기능", - "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/firewall/dns-details" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "위협 인텔리전스: 경고 및 거부로 설정", - "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "위협 인텔리전스: 허용된 목록(사용 중인 경우 정당화 - 즉, 성능)", - "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "TLS 사용", - "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall/premium-certificates" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "IDPS 사용 가능", - "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "방화벽 관리자", - "text": "SNAT: 구성됨 ", - "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", - "severity": "높다", - "link": "https://learn.microsoft.com/azure/firewall/snat-private-range" - }, - { - "category": "Azure Firewall", - "subcategory": "DDOS 보호", - "text": "방화벽 공용 IP에 대해 사용", - "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", - "severity": "보통", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - } - ], - "severities": [ - { - "name": "높다" - }, - { - "name": "보통" - }, - { - "name": "낮다" - } - ], - "status": [ - { - "name": "확인되지 않음", - "description": "이 검사는 아직 검토되지 않았습니다." - }, - { - "name": "열다", - "description": "이 검사와 연관된 작업 항목이 있습니다." - }, - { - "name": "성취", - "description": "이 검사가 확인되었으며 연관된 추가 작업 항목이 없습니다." - }, - { - "name": "필요하지 않음", - "description": "권장 사항은 이해되었지만 현재 요구 사항에는 필요하지 않습니다." - }, - { - "name": "해당 없음", - "description": "현재 설계에는 적용되지 않음" - } - ], - "categories": [ - { - "name": "클라우드를 위한 수비수" - }, - { - "name": "Azure Networking" - }, - { - "name": "신원" - }, - { - "name": "VM 보안 검사" - }, - { - "name": "센 티 넬" - }, - { - "name": "Azure Firewall" - } - ] -} + "categories": [ + { + "name": "클라우드용 Defender" + }, + { + "name": "Azure 네트워킹" + }, + { + "name": "신원" + }, + { + "name": "VM 보안 검사" + }, + { + "name": "센 티 넬" + }, + { + "name": "Azure 방화벽" + } + ], + "items": [ + { + "category": "클라우드용 Defender", + "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", + "id": "A01.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", + "severity": "높다", + "subcategory": "가격 및 설정", + "text": "Security Center/Defender는 모든 구독에서 사용하도록 설정합니다.", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "349f0364-d28d-442e-abbb-c868255abc91", + "id": "A01.02", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "높다", + "subcategory": "가격 및 설정", + "text": "모든 Log Analytics 작업 영역에서 Security Center/Defender 사용", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", + "id": "A01.03", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal", + "severity": "보통", + "subcategory": "가격 및 설정", + "text": "'공통'으로 설정된 데이터 컬렉션", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", + "id": "A01.04", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "높다", + "subcategory": "가격 및 설정", + "text": "클라우드용 Defender 향상된 보안 기능이 모두 활성화됨", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", + "id": "A01.05", + "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection", + "severity": "보통", + "subcategory": "가격 및 설정", + "text": "회사 정책에 따라 자동 프로비저닝 사용(정책이 있어야 함)", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "25759e35-680e-4782-9ac9-32213d027ff4", + "id": "A01.06", + "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details", + "severity": "낮다", + "subcategory": "가격 및 설정", + "text": "회사 정책에 따라 이메일 알림 사용(정책이 있어야 함)", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", + "id": "A01.07", + "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows", + "severity": "보통", + "subcategory": "가격 및 설정", + "text": "통합 활성화 옵션이 선택되어 있습니다. ", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "5b7abae4-4aad-45e8-a79e-2e86667313c5", + "id": "A01.08", + "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd", + "severity": "보통", + "subcategory": "가격 및 설정", + "text": "CI/CD 통합이 구성됨", + "waf": "작업" + }, + { + "category": "클라우드용 Defender", + "guid": "05675c5e-985b-4859-a774-f7e371623b87", + "id": "A01.09", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "높다", + "subcategory": "가격 및 설정", + "text": "3rd party SIEM을 사용하는 경우 연속 내보내기 'Event Hub'가 사용하도록 설정됨", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", + "id": "A01.10", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "보통", + "subcategory": "가격 및 설정", + "text": "Azure Sentinel을 사용하지 않는 경우 연속 내보내기 'Log Analytics 작업 영역'을 사용할 수 있습니다.", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", + "id": "A01.11", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "높다", + "subcategory": "가격 및 설정", + "text": "AWS에 사용할 수 있는 클라우드 커넥터", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", + "id": "A01.12", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp", + "severity": "높다", + "subcategory": "가격 및 설정", + "text": "GCP에 사용하도록 설정된 클라우드 커넥터", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", + "id": "A01.13", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security", + "severity": "낮다", + "subcategory": "가격 및 설정", + "text": "Azure AD 애플리케이션 프록시를 사용하는 경우 Microsoft Defender for Cloud Apps 통합하여 애플리케이션 액세스를 실시간으로 모니터링하고 고급 보안 제어를 적용하는 것이 좋습니다.", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", + "id": "A02.01", + "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls", + "severity": "보통", + "subcategory": "권장 사항", + "text": "필요하지 않은 경우 모든 권장 사항이 수정되거나 비활성화됩니다.", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "description": "모든 고객에 대한 Microsoft 최소 목표는 70%입니다.", + "guid": "08032729-4798-4b15-98a2-19a46ceb5443", + "id": "A02.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls", + "severity": "높다", + "subcategory": "권장 사항", + "text": "보안 점수>70%", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "50259226-4429-42bb-9285-37a55119bf8e", + "id": "A03.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident", + "severity": "보통", + "subcategory": "보안 경고", + "text": "보안 경고에는 지난 24시간 동안 생성된 경고만 포함됩니다(이전 보안 경고 수정 또는 사용 안 함).", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", + "id": "A04.01", + "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks", + "severity": "보통", + "subcategory": "통합 문서", + "text": "연속 내보내기를 사용하는 경우 기본 통합 문서가 사용자 지정 보안 대시보드에 게시됩니다.", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", + "id": "A05.01", + "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud", + "severity": "보통", + "subcategory": "커뮤니티", + "text": "고객은 '커뮤니티' 페이지의 가치를 알고 있으며 검토를 위해 정기적인 주기를 설정했습니다.", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "description": "고객 운영 모범 사례 - 투명성", + "guid": "93846da9-7cc3-4923-856b-22586f4a1641", + "id": "A06.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security", + "severity": "높다", + "subcategory": "보안 점수", + "text": "Security Center에서 보호하는 모든 구독이 표시됩니다(구독 필터 집합 없음).", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", + "id": "A07.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard", + "severity": "높다", + "subcategory": "규정 준수", + "text": "규정 준수 제어는 필요한 모든 규정 준수 요구 사항에 대해 친환경적입니다.", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "description": "고객 운영 모범 사례 - 확인", + "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", + "id": "A08.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm", + "severity": "높다", + "subcategory": "Azure 수비수", + "text": "심각도가 높은 VM 취약성이 0(비어 있음)", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "9603334b-df9c-4c23-918d-b61171265f4b", + "id": "A09.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679", + "severity": "보통", + "subcategory": "방화벽 관리자", + "text": "허브는 Azure Firewall로 보호됩니다.", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "description": "고객 운영 모범 사례 - 확인", + "guid": "b47a393a-0803-4272-a479-8b1578a219a4", + "id": "A09.02", + "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices", + "severity": "보통", + "subcategory": "방화벽 관리자", + "text": "가상 네트워크는 방화벽으로 보호됩니다.", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "6ceb5443-5025-4922-9442-92bb628537a5", + "id": "A09.03", + "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/", + "severity": "보통", + "subcategory": "방화벽 관리자", + "text": "DDoS 표준 사용", + "waf": "안전" + }, + { + "category": "클라우드용 Defender", + "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", + "id": "A10.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "높다", + "subcategory": "보도", + "text": "모든 구독이 적용되는지 확인합니다(수정할 가격 책정 및 설정 참조).", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", + "id": "B01.01", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "높다", + "subcategory": "공용 IP", + "text": "공용 IP가 있는 VM은 NSG로 보호해야 합니다. ", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "description": "고객 운영 모범 사례 - 확인", + "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", + "id": "B01.02", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "높다", + "subcategory": "공용 IP", + "text": "공용 IP가 있는 VM은 Azure Firewall 프리미엄 뒤로 이동됩니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "description": "고객 운영 모범 사례 - 확인", + "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", + "id": "B01.03", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "severity": "높다", + "subcategory": "공용 IP", + "text": "공용 IP가 필요하지 않은 VM에는 공용 IP가 없습니다(즉, 내부 RDP만 해당).", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", + "id": "B02.01", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "보통", + "subcategory": "NSG (뉴사우스웨일스주)", + "text": "NSG RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "description": "고객 운영 모범 사례 - 확인", + "guid": "a209939b-da47-4778-b24c-116785c2fa55", + "id": "B02.02", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "높다", + "subcategory": "NSG (뉴사우스웨일스주)", + "text": "NSG 인바운드 보안 규칙의 원본 필드에 *(와일드카드)가 포함되어 있지 않습니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "description": "고객 운영 모범 사례 - 확인", + "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", + "id": "B02.03", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "보통", + "subcategory": "NSG (뉴사우스웨일스주)", + "text": "NSG 아웃바운드 보안 규칙은 방화벽을 통해 라우팅되지 않는 트래픽에 대해 특정 IP 주소에 대한 트래픽을 제어하는 데 사용됩니다", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "description": "고객 운영 모범 사례 - 확인", + "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", + "id": "B02.04", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "높다", + "subcategory": "NSG (뉴사우스웨일스주)", + "text": "NSG에는 원본이 *(와일드카드)로 없습니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", + "id": "B02.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log", + "severity": "보통", + "subcategory": "NSG (뉴사우스웨일스주)", + "text": "NSG 진단은 NetworkSecurityGroupEvent 및 NetworkSecurityGroupRuleCounter 트래픽을 Sentinel LAW로 보냅니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", + "id": "B03.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "보통", + "subcategory": "UDR", + "text": "UDR RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", + "id": "B03.02", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "높다", + "subcategory": "UDR", + "text": "제로 트러스트인 경우 UDR은 모든 트래픽을 Azure Firewall 프리미엄으로 보내는 데 사용됩니다", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "description": "고객 운영 모범 사례 - 확인", + "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", + "id": "B03.03", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "보통", + "subcategory": "UDR", + "text": "모든 트래픽을 AzureFirewallPremium으로 보내지 않는 UDR은 알려지고 문서화되어 있습니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", + "id": "B04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default", + "severity": "높다", + "subcategory": "가상 네트워크", + "text": "고객은 Azure의 Azure 네트워킹 기본값/SDN 기본 라우팅에 대해 잘 알고 있습니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "description": "고객 운영 모범 사례 - 확인", + "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", + "id": "B04.02", + "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672", + "severity": "보통", + "subcategory": "가상 네트워크", + "text": "VNet RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", + "id": "B04.03", + "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference", + "severity": "높다", + "subcategory": "가상 네트워크", + "text": "VNet 보안 권장 사항이 수정되고 '위험한' VNet이 없습니다. ", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", + "id": "B04.04", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "severity": "높다", + "subcategory": "가상 네트워크", + "text": "VNet 피어링 연결이 이해되고 예상 트래픽 흐름이 문서화됩니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", + "id": "B04.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview", + "severity": "높다", + "subcategory": "가상 네트워크", + "text": "VNet 서비스 엔드포인트가 사용 중이며 레거시 공용 서비스 엔드포인트가 없습니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "1f625659-ee55-480a-9824-9c931213dbd7", + "id": "B04.06", + "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview", + "severity": "높다", + "subcategory": "가상 네트워크", + "text": "VNet 프라이빗 엔드포인트는 온-프레미스 환경에서 액세스를 허용하는 데 사용 중이며 레거시 퍼블릭 엔드포인트는 없습니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", + "id": "B04.07", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "높다", + "subcategory": "가상 네트워크", + "text": "VNet 모니터링 사용", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731", + "id": "B04.08", + "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies", + "severity": "높다", + "subcategory": "가상 네트워크", + "text": "AKS(Azure Kubernetes Service)에서 네트워크 정책을 사용하여 Pod 간 트래픽 보호", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "3c005674-c1e9-445b-959c-373e7ed71623", + "id": "B04.09", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva", + "severity": "높다", + "subcategory": "가상 네트워크", + "text": "VNet NVA(어플라이언스) 고객은 게시된 아키텍처 패턴을 따릅니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", + "id": "B04.10", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "높다", + "subcategory": "가상 네트워크", + "text": "VNet 진단 설정이 사용하도록 설정되고 VMProtectionAlerts를 Azure Sentinel LAW로 보냅니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", + "id": "B05.01", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "severity": "높다", + "subcategory": "인터넷", + "text": "ExpressRoute 또는 VPN을 사용하여 온-프레미스 환경에서 Azure 리소스에 액세스", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", + "id": "B06.01", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "severity": "높다", + "subcategory": "가상 WAN", + "text": "VWAN RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "718d1dca-1f62-4565-aee5-580a38249c93", + "id": "B06.02", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture", + "severity": "높다", + "subcategory": "가상 WAN", + "text": "VWAN 고객이 Secure Hub 또는 외부 방화벽을 사용하여 트래픽을 라우팅하고 모니터링하고 있습니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", + "id": "B07.01", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "severity": "높다", + "subcategory": "애플리케이션 게이트웨이", + "text": "AppGW RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", + "id": "B07.02", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "높다", + "subcategory": "애플리케이션 게이트웨이", + "text": "AppGW 모든 외부 연결 웹 서비스는 WAF를 사용하도록 설정된 Application Gateway 뒤에 있습니다. ", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "94666731-3c00-4567-9c1e-945b459c373e", + "id": "B07.03", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "높다", + "subcategory": "애플리케이션 게이트웨이", + "text": "AppGW 모든 내부 연결 웹 서비스는 WAF를 사용하도록 설정된 Application Gateway 뒤에 있습니다. ", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", + "id": "B07.04", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "severity": "높다", + "subcategory": "애플리케이션 게이트웨이", + "text": "AppGW - 외부 연결에서 TLS/SSL을 사용하도록 설정하고 모든 트래픽을 443(포트 80 트래픽 없음)으로 리디렉션합니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", + "id": "B08.01", + "link": "https://learn.microsoft.com/azure/frontdoor/", + "severity": "높다", + "subcategory": "프론트도어", + "text": "Front Door RBAC는 네트워크 보안 팀에 대한 액세스를 제한하는 데 사용됩니다", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", + "id": "B08.02", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json", + "severity": "높다", + "subcategory": "프론트도어", + "text": "Front Door는 WAF 정책과 연결되어 있습니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", + "id": "B08.03", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https", + "severity": "높다", + "subcategory": "프론트도어", + "text": "Front Door TLS/SSL 정책이 구성됨", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", + "id": "B08.04", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect", + "severity": "높다", + "subcategory": "프론트도어", + "text": "Front Door 리디렉션 포트 80에서 포트 443으로 구성됨(수신기)", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", + "id": "B08.05", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics", + "severity": "높다", + "subcategory": "프론트도어", + "text": "Front Door 진단 로그는 ApplicationGatewayAccessLog 및 ApplicationGateway FirewallLog를 Sentinel LAW로 보냅니다.", + "waf": "안전" + }, + { + "category": "Azure 네트워킹", + "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", + "id": "B09.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "높다", + "subcategory": "디도스 방어", + "text": "방화벽 공용 IP(모든 공용 IP)에 사용", + "waf": "안전" + }, + { + "category": "신원", + "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", + "id": "C01.01", + "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory", + "severity": "높다", + "subcategory": "테 넌 트", + "text": "정규직 직원 및 Enterprise 자원의 ID를 관리하기 위한 단일 엔터프라이즈 디렉터리를 설정합니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", + "id": "C01.02", + "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems", + "severity": "높다", + "subcategory": "테 넌 트", + "text": "클라우드 ID를 기존 ID 시스템과 동기화합니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", + "id": "C01.03", + "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties", + "severity": "높다", + "subcategory": "테 넌 트", + "text": "Cloud ID 서비스를 사용하여 공급업체, 파트너, 고객과 같은 직원이 아닌 계정을 온프레미스 디렉터리에 포함하지 않고 호스팅합니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", + "id": "C01.04", + "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication", + "severity": "높다", + "subcategory": "테 넌 트", + "text": "인터넷 연결 서비스에 대해 안전하지 않은 레거시 프로토콜을 사용하지 않도록 설정합니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", + "id": "C01.05", + "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on", + "severity": "높다", + "subcategory": "테 넌 트", + "text": "Single Sign-On 사용", + "waf": "안전" + }, + { + "category": "신원", + "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", + "id": "C02.01", + "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers", + "severity": "높다", + "subcategory": "권한 있는 관리", + "text": "엔터프라이즈 ID 시스템을 클라우드 디렉터리와 동기화할 때 온-프레미스 리소스에 대한 가장 높은 권한의 액세스 권한이 있는 계정을 동기화하지 마세요.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", + "id": "C02.02", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5", + "severity": "높다", + "subcategory": "권한 있는 관리", + "text": "전역 관리자 수를 5명 미만으로 제한", + "waf": "안전" + }, + { + "category": "신원", + "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", + "id": "C02.03", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment", + "severity": "높다", + "subcategory": "권한 있는 관리", + "text": "Azure AD 역할 할당에 그룹을 사용하고 역할 할당을 위임합니다", + "waf": "안전" + }, + { + "category": "신원", + "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", + "id": "C02.04", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins", + "severity": "높다", + "subcategory": "권한 있는 관리", + "text": "모든 중요한 영향 관리자가 조직 정책 적용을 따르도록 엔터프라이즈 디렉터리에서 관리되는지 확인합니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", + "id": "C02.05", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time", + "severity": "높다", + "subcategory": "권한 있는 관리", + "text": "시간이 지남에 따라 불필요한 권한을 취소하도록 반복 액세스 검토 구성", + "waf": "안전" + }, + { + "category": "신원", + "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", + "id": "C02.06", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security", + "severity": "보통", + "subcategory": "권한 있는 관리", + "text": "중요한 영향 관리자가 강화된 보안 보호 및 모니터링 기능을 갖춘 워크스테이션을 사용하도록 보장", + "waf": "안전" + }, + { + "category": "신원", + "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", + "id": "C03.01", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c", + "severity": "높다", + "subcategory": "외부 ID", + "text": "ID 공급자: 외부 ID 공급자가 알려져 있는지 확인합니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", + "id": "C03.02", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "높다", + "subcategory": "외부 ID", + "text": "외부 공동 작업 설정: 게스트 사용자 액세스가 '게스트 사용자 액세스가 제한됨'으로 설정되었습니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", + "id": "C03.03", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "높다", + "subcategory": "외부 ID", + "text": "외부 협업 설정: 게스트 초대 설정을 '특정 관리자 역할에 할당된 사용자만'으로 설정", + "waf": "안전" + }, + { + "category": "신원", + "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", + "id": "C03.04", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "높다", + "subcategory": "외부 ID", + "text": "외부 공동 작업 설정: '사용 안 함'으로 설정된 흐름을 통해 게스트 셀프 서비스 등록 사용 ", + "waf": "안전" + }, + { + "category": "신원", + "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", + "id": "C03.05", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "높다", + "subcategory": "외부 ID", + "text": "외부 협업 설정: '특정 도메인 초대 허용'으로 설정된 협업 제한", + "waf": "안전" + }, + { + "category": "신원", + "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", + "id": "C03.06", + "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews", + "severity": "보통", + "subcategory": "외부 ID", + "text": "검토 액세스: 모든 그룹에 대해 사용", + "waf": "안전" + }, + { + "category": "신원", + "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", + "id": "C04.01", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent", + "severity": "보통", + "subcategory": "기업용 응용 프로그램", + "text": "동의 및 권한: 확인된 게시자의 앱에 대한 사용자 동의 허용", + "waf": "안전" + }, + { + "category": "신원", + "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", + "id": "C04.02", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups", + "severity": "보통", + "subcategory": "기업용 응용 프로그램", + "text": "동의 및 권한: 선택한 그룹 소유자에 대한 그룹 소유자 동의 허용 ", + "waf": "안전" + }, + { + "category": "신원", + "guid": "bade4aad-1e8c-439e-a946-667313c00567", + "id": "C05.01", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain", + "severity": "높다", + "subcategory": "사용자 지정 도메인", + "text": "검증된 고객 도메인만 등록됩니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", + "id": "C06.01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr", + "severity": "높다", + "subcategory": "비밀번호 재설정", + "text": "셀프 서비스 암호 재설정 정책 요구 사항을 준수하는 것으로 확인되었습니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", + "id": "C06.02", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "보통", + "subcategory": "비밀번호 재설정", + "text": "사용자에게 인증 정보가 0으로 설정되지 않았는지 다시 확인하도록 요청하기 전의 일 수 설정", + "waf": "안전" + }, + { + "category": "신원", + "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", + "id": "C06.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "높다", + "subcategory": "비밀번호 재설정", + "text": "비밀번호 재설정에 필요한 방법 수 설정이 선택되었습니다.", + "waf": "안전" + }, + { + "category": "신원", + "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", + "id": "C07.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles", + "severity": "높다", + "subcategory": "사용자 설정", + "text": "'사용자가 응용 프로그램을 등록할 수 있음' 비활성화", + "waf": "안전" + }, + { + "category": "신원", + "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", + "id": "C07.02", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions", + "severity": "높다", + "subcategory": "사용자 설정", + "text": "관리 포털(portal.azure.com)에 대한 접근을 관리자로만 제한", + "waf": "안전" + }, + { + "category": "신원", + "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", + "id": "C07.03", + "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration", + "severity": "높다", + "subcategory": "사용자 설정", + "text": "'LinkedIn 계정 연결' 비활성화", + "waf": "안전" + }, + { + "category": "신원", + "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", + "id": "C08.01", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring", + "severity": "높다", + "subcategory": "진단 설정", + "text": "Sentinel을 사용하여 사용하도록 설정하고 Log Analytics 작업 영역으로 보내기", + "waf": "안전" + }, + { + "category": "신원", + "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", + "id": "C09.01", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan", + "severity": "높다", + "subcategory": "PIM 사용", + "text": "Privileged Identity Management 사용", + "waf": "안전" + }, + { + "category": "신원", + "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", + "id": "C09.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc", + "severity": "높다", + "subcategory": "PIM 사용", + "text": "JIT('Just-In-Time') 액세스를 구현하여 권한 있는 계정에 대한 노출 시간을 더욱 줄입니다(스탠딩 액세스 감소).", + "waf": "안전" + }, + { + "category": "신원", + "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", + "id": "C10.01", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common", + "severity": "높다", + "subcategory": "조건부 액세스 정책", + "text": "조건부 액세스 정책 구성/액세스 제어", + "waf": "안전" + }, + { + "category": "신원", + "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", + "id": "C10.02", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition", + "severity": "보통", + "subcategory": "조건부 액세스 정책", + "text": "정황: 제한된 장소", + "waf": "안전" + }, + { + "category": "신원", + "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", + "id": "C10.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa", + "severity": "높다", + "subcategory": "조건부 액세스 정책", + "text": "액세스 제어: 모든 사용자에 대해 MFA 사용", + "waf": "안전" + }, + { + "category": "신원", + "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", + "id": "C10.04", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa", + "severity": "보통", + "subcategory": "조건부 액세스 정책", + "text": "액세스 제어: 관리자용 MFA 필요", + "waf": "안전" + }, + { + "category": "신원", + "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", + "id": "C10.05", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management", + "severity": "높다", + "subcategory": "조건부 액세스 정책", + "text": "액세스 제어: Azure Management에 MFA 필요 ", + "waf": "안전" + }, + { + "category": "신원", + "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", + "id": "C10.06", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy", + "severity": "높다", + "subcategory": "조건부 액세스 정책", + "text": "액세스 제어: 레거시 프로토콜 차단", + "waf": "안전" + }, + { + "category": "신원", + "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", + "id": "C10.07", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices", + "severity": "높다", + "subcategory": "조건부 액세스 정책", + "text": "액세스 제어: 장치를 규격으로 표시해야 합니다.", + "waf": "안전" + }, + { + "category": "신원", + "description": "고객 문서화 정책", + "guid": "a7144351-e19d-4d34-929e-b7228137a151", + "id": "C11.01", + "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/", + "severity": "보통", + "subcategory": "게스트 사용자", + "text": "게스트 사용자 계정(예: 사용/삭제/사용 안 함)을 추적하는 정책이 있나요?", + "waf": "안전" + }, + { + "category": "신원", + "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", + "id": "C12.01", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score", + "severity": "높다", + "subcategory": "ID 보안 점수", + "text": "업계의 모범 사례에 따라 ID 보안 점수 구현", + "waf": "안전" + }, + { + "category": "신원", + "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", + "id": "C13.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "severity": "보통", + "subcategory": "Break Glass 계정", + "text": "두 개 이상의 비상 계정이 생성되었으며 해당 사용에 대한 정책이 존재합니다", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", + "id": "D01.01", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "severity": "높다", + "subcategory": "출입 통제", + "text": "Azure Policy를 활용하여 VM 액세스 제어", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", + "id": "D01.02", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax", + "severity": "보통", + "subcategory": "출입 통제", + "text": "템플릿을 활용하여 VM 설정 및 배포의 가변성 줄이기Reduce variability in your setup and deployment of VM by levering templates", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "b5945bda-4333-44fd-b91c-234182b65275", + "id": "D01.03", + "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models", + "severity": "보통", + "subcategory": "출입 통제", + "text": "거버넌스를 통해 리소스에 액세스할 수 있는 사용자를 줄여 VMS를 배포하기 위한 권한 있는 액세스 보호Secure privileged access to deploy VMS by reducing who have access to Resources through Governance", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", + "id": "D02.01", + "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service", + "severity": "보통", + "subcategory": "고가용성 ", + "text": "가용성 향상을 위해 워크로드에 여러 VM 사용 ", + "waf": "신뢰도" + }, + { + "category": "VM 보안 검사", + "guid": "f219e4a1-eb58-4879-935d-227886d30b66", + "id": "D02.02", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm", + "severity": "보통", + "subcategory": "고가용성 ", + "text": "재해 복구 솔루션 배포 및 테스트Deploy and test a disaster recovery solution ", + "waf": "신뢰도" + }, + { + "category": "VM 보안 검사", + "guid": "c57be595-1900-4838-95c5-86cb291ec16a", + "id": "D02.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "severity": "보통", + "subcategory": "고가용성 ", + "text": "가용성 집합", + "waf": "신뢰도" + }, + { + "category": "VM 보안 검사", + "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", + "id": "D02.04", + "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context", + "severity": "보통", + "subcategory": "고가용성 ", + "text": "가용 영역", + "waf": "신뢰도" + }, + { + "category": "VM 보안 검사", + "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", + "id": "D02.05", + "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region", + "severity": "보통", + "subcategory": "고가용성 ", + "text": "지역별 내결함성 ", + "waf": "신뢰도" + }, + { + "category": "VM 보안 검사", + "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", + "id": "D03.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware", + "severity": "높다", + "subcategory": "멀웨어로부터 보호", + "text": "맬웨어 방지 솔루션 설치Install antimalware solutions", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", + "id": "D03.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "높다", + "subcategory": "멀웨어로부터 보호", + "text": "맬웨어 방지 솔루션을 Security Center와 통합Integrate antimalware solution with Security Center", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", + "id": "D04.01", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "severity": "높다", + "subcategory": "VM 업데이트 관리", + "text": "Azure Automation에서 업데이트 관리를 사용하여 VM을 최신 상태로 유지", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", + "id": "D04.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching", + "severity": "보통", + "subcategory": "VM 업데이트 관리", + "text": "배포용 Windows 이미지에 최신 수준의 업데이트가 있는지 확인합니다. ", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "02145901-465d-438e-9309-ccbd979266bc", + "id": "D04.03", + "link": "https://learn.microsoft.com/azure/security-center/asset-inventory", + "severity": "높다", + "subcategory": "VM 업데이트 관리", + "text": "클라우드용 Microsoft Defender를 사용하여 VM에 보안 업데이트를 신속하게 적용", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", + "id": "D05.01", + "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", + "severity": "높다", + "subcategory": "VHD 암호화", + "text": "VM에서 암호화 사용Enable encryption on your VMs", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", + "id": "D05.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek", + "severity": "높다", + "subcategory": "VHD 암호화", + "text": "암호화를 위한 보안 계층 추가를 위한 KEK(키 암호화 키) 추가 ", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", + "id": "D05.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk", + "severity": "보통", + "subcategory": "VHD 암호화", + "text": "롤백을 위해 암호화하기 전에 디스크의 스냅숏을 만듭니다", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "5173676a-e466-491e-a835-ad942223e138", + "id": "D06.01", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "severity": "높다", + "subcategory": "직접 인터넷 연결 제한 ", + "text": "중앙 네트워킹 그룹에만 네트워킹 리소스에 대한 권한이 있는지 확인합니다. ", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "10523081-a941-4741-9833-ff7ad7c6d373", + "id": "D06.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "높다", + "subcategory": "직접 인터넷 연결 제한 ", + "text": "'ANY' 원본 IP 주소에서 액세스할 수 있는 노출된 VM을 식별하고 업데이트를 적용합니다", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", + "id": "D06.03", + "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time", + "severity": "높다", + "subcategory": "직접 인터넷 연결 제한 ", + "text": "Just-in-Time Access를 사용하여 관리 포트(RDP, SSH) 제한Restrict management ports (RDP, SSH) using Just-in-Time Access", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", + "id": "D06.04", + "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", + "severity": "높다", + "subcategory": "직접 인터넷 연결 제한 ", + "text": "인터넷 액세스 제거 및 RDP용 점프 서버 구현", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", + "id": "D06.05", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling", + "severity": "높다", + "subcategory": "직접 인터넷 연결 제한 ", + "text": "인터넷에서 RDP/SSH를 사용하여 서버에 직접 로그인하는 것을 제거하고 VPN 또는 Express 경로를 구현합니다.", + "waf": "안전" + }, + { + "category": "VM 보안 검사", + "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", + "id": "D06.06", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "severity": "높다", + "subcategory": "직접 인터넷 연결 제한 ", + "text": "Azure Bastion을 RDP/SSH 브로커로 활용하여 보안을 강화하고 공간을 줄입니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", + "id": "E01.01", + "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", + "severity": "높다", + "subcategory": "건축학 ", + "text": "모든 테넌트에는 하나 이상의 Log Analytics 작업 영역에서 Sentinel이 사용하도록 설정되어 있습니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", + "id": "E01.02", + "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture", + "severity": "높다", + "subcategory": "건축학 ", + "text": "Sentinel 아키텍처를 이해하는 고객", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", + "id": "E01.03", + "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view", + "severity": "보통", + "subcategory": "건축학 ", + "text": "고객은 여러 Sentinel 인스턴스에서 인시던트를 모니터링하는 방법을 알고 있습니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "8989579e-76b8-497e-910a-7da7be9966e1", + "id": "E02.01", + "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics", + "severity": "보통", + "subcategory": "개요", + "text": "24시간 이상 운영되는 인시던트 없음", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", + "id": "E03.01", + "link": "https://learn.microsoft.com/azure/sentinel/whats-new", + "severity": "낮다", + "subcategory": "뉴스 & 가이드", + "text": "고객에게 News & Guides 탭이 표시되었습니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", + "id": "E04.01", + "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics", + "severity": "보통", + "subcategory": "UEBA (우에바) ", + "text": "UEBA 구성됨(Sentinel/설정/설정/UEBA 구성)", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", + "id": "E05.01", + "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "구성된 Azure Active Directory 및 '마지막으로 받은 로그'가 오늘 표시됨", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", + "id": "E05.02", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "Azure Active Directory ID 보호가 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", + "id": "E05.03", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "Azure 활동이 구성되고 구성되었으며 '마지막으로 받은 로그'가 오늘 표시됩니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", + "id": "E05.04", + "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "클라우드용 Microsoft Defender가 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", + "id": "E05.05", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "Azure Firewall이 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", + "id": "E05.06", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "Windows 방화벽이 구성되고 '마지막으로 받은 로그'가 오늘 표시됩니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", + "id": "E05.07", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "보안 이벤트는 AMA로 구성되며 '마지막 로그 수신'은 오늘 표시됩니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "1a4834ac-9322-423e-ae80-b123081a5417", + "id": "E05.08", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "보안 이벤트 - Azure 컴퓨터가 연결되어 있고 작업 영역으로 데이터를 보내고 있는지 확인합니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", + "id": "E05.09", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "보안 이벤트 - 비 Azure 컴퓨터가 연결되어 있고 작업 영역으로 데이터를 보내고 있는지 확인합니다.", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", + "id": "E05.10", + "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "AWS용 커넥터", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", + "id": "E05.11", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "높다", + "subcategory": "데이터 커넥터", + "text": "GCP용 커넥터", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", + "id": "E06.01", + "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in", + "severity": "높다", + "subcategory": "분석 규칙", + "text": "고객이 Analytics 규칙을 사용하도록 설정하고 인시던트를 구성했습니다. ", + "waf": "안전" + }, + { + "category": "센 티 넬", + "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", + "id": "E07.01", + "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/", + "severity": "보통", + "subcategory": "설정", + "text": "고객이 일일 한도를 사용하도록 설정하지 않았습니다.", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", + "id": "F01.01", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "severity": "높다", + "subcategory": "구성", + "text": "Azure Firewall 프리미엄이 배포됨", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", + "id": "F01.02", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route", + "severity": "높다", + "subcategory": "구성", + "text": "Azure Firewall을 통해 사용하도록 설정된 쿼드 0/강제 튜닝", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", + "id": "F02.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "보통", + "subcategory": "출입 통제", + "text": "권한 있는 사용자만 사용하도록 설정된 RBAC", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", + "id": "F03.01", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "severity": "보통", + "subcategory": "진단 설정", + "text": "진단 사용 및 Log Analytics 작업 영역으로 메트릭 보내기 ", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "b35478c3-4798-416b-8863-cffe1cac599e", + "id": "F04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "허브 및 가상 네트워크는 Firewall 프리미엄을 통해 보호되거나 연결됩니다.", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", + "id": "F04.02", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "정책: 액세스 제어가 구성됨(RBAC)", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", + "id": "F04.03", + "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "정책: 상위 정책이 구성되었습니다. ", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", + "id": "F04.04", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "정책: 규칙 컬렉션이 정의됩니다.", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", + "id": "F04.05", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "정책: DNAT 정책이 정의됩니다.", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", + "id": "F04.06", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "정책: 네트워크 규칙이 정의됩니다.", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", + "id": "F04.07", + "link": "https://learn.microsoft.com/azure/firewall/features", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "정책: 응용 프로그램 규칙이 정의됩니다.", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", + "id": "F04.08", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "severity": "보통", + "subcategory": "방화벽 관리자", + "text": "DNS: 기능 이해 및 적용 또는 적용되지 않음", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", + "id": "F04.09", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "위협 인텔리전스: 경고 및 거부로 설정", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", + "id": "F04.10", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "위협 인텔리전스: 허용 목록(사용 중인 경우 정당화 - 예: 성능)", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", + "id": "F04.11", + "link": "https://learn.microsoft.com/azure/firewall/premium-certificates", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "TLS 사용", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", + "id": "F04.12", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "IDPS 사용", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", + "id": "F04.13", + "link": "https://learn.microsoft.com/azure/firewall/snat-private-range", + "severity": "높다", + "subcategory": "방화벽 관리자", + "text": "SNAT: 구성됨 ", + "waf": "안전" + }, + { + "category": "Azure 방화벽", + "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", + "id": "F05.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "보통", + "subcategory": "디도스 방어", + "text": "방화벽 공용 IP에 대해 사용", + "waf": "안전" + } + ], + "metadata": { + "name": "Azure Security Review Checklist", + "state": "Deprecated", + "timestamp": "June 24, 2024" + }, + "severities": [ + { + "name": "높다" + }, + { + "name": "보통" + }, + { + "name": "낮다" + } + ], + "status": [ + { + "description": "이 검사는 아직 검토되지 않았습니다", + "name": "확인되지 않음" + }, + { + "description": "이 검사와 연관된 작업 항목이 있습니다", + "name": "열다" + }, + { + "description": "이 검사는 확인되었으며 이와 관련된 추가 작업 항목이 없습니다", + "name": "성취" + }, + { + "description": "권장 사항은 이해되었지만 현재 요구 사항에 필요하지 않음", + "name": "필요 없음" + }, + { + "description": "현재 설계에는 적용되지 않습니다.", + "name": "해당 없음" + } + ], + "waf": [ + { + "name": "신뢰도" + }, + { + "name": "안전" + }, + { + "name": "비용" + }, + { + "name": "작업" + }, + { + "name": "공연" + } + ], + "yesno": [ + { + "name": "예" + }, + { + "name": "아니요" + } + ] +} \ No newline at end of file diff --git a/checklists/security_checklist.pt.json b/checklists/security_checklist.pt.json index 1715471f5..422a6782d 100644 --- a/checklists/security_checklist.pt.json +++ b/checklists/security_checklist.pt.json @@ -1,1328 +1,1669 @@ { - "metadata": { - "name": "Lista de verificação de revisão de segurança do Azure" - }, - "items": [ - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Centro de segurança/Defender habilita em todas as assinaturas", - "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Centro de segurança/Defender ativado em todos os espaços de trabalho do Log Analytics", - "guid": "349f0364-d28d-442e-abbb-c868255abc91", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Coleta de dados definida como 'Comum'", - "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Os recursos de segurança aprimorados do Defender for Cloud estão todos habilitados", - "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Provisionamento automático habilitado de acordo com a política da empresa (a política deve existir)", - "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Notificações por e-mail habilitadas de acordo com a política da empresa (a política deve existir)", - "guid": "25759e35-680e-4782-9ac9-32213d027ff4", - "severity": "Baixo", - "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Ativar as opções de integrações são selecionadas ", - "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "A integração CI/CD está configurada", - "guid": "5b7bae4-4th-45e8-a79e-2e86667313c5", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "O 'Event Hub' de exportação contínua é ativado se usar o SIEM de terceiros", - "guid": "05675c5e-985b-4859-a774-f7e371623b87", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "O 'Log Analytics Workspace' de exportação contínua é ativado se não estiver usando o Azure Sentinel", - "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Conector de nuvem habilitado para AWS", - "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Conector de nuvem habilitado para GCP", - "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp" - }, - { - "category": "Defender para nuvem", - "subcategory": "Preços e Configurações", - "text": "Se usar o proxy do aplicativo Azure AD, considere integrar-se ao Microsoft Defender for Cloud Apps para monitorar o acesso de aplicativos em tempo real e aplicar controles de segurança avançados.", - "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", - "severity": "Baixo", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security" - }, - { - "category": "Defender para nuvem", - "subcategory": "Recomendações", - "text": "Todas as recomendações remediadas ou desativadas, se não forem necessárias.", - "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls" - }, - { - "category": "Defender para nuvem", - "subcategory": "Recomendações", - "text": "Pontuação de segurança>70%", - "description": "A meta mínima da Microsoft para todos os clientes é de 70%", - "guid": "08032729-4798-4b15-98a2-19a46ceb5443", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls" - }, - { - "category": "Defender para nuvem", - "subcategory": "Alertas de secuidade", - "text": "Os alertas de segurança contêm apenas aqueles gerados nas últimas 24 horas (remediar ou desativar alertas de segurança mais antigos)", - "guid": "50259226-4429-42bb-9285-37a55119bf8e", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident" - }, - { - "category": "Defender para nuvem", - "subcategory": "Pastas", - "text": "Se a exportação contínua estiver ativada, as pastas de trabalho padrão são publicadas no painel de segurança personalizado", - "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks" - }, - { - "category": "Defender para nuvem", - "subcategory": "Comunidade", - "text": "O cliente está ciente do valor da página 'Comunidade' e tem uma cadência regular configurada para revisar", - "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", - "severity": "Média", - "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud" - }, - { - "category": "Defender para nuvem", - "subcategory": "Pontuação segura", - "text": "Todas as assinaturas protegidas pelo Security Center são mostradas (sem conjunto de filtros de assinatura)", - "description": "Práticas recomendadas operacionais do cliente - Transparência", - "guid": "93846da9-7cc3-4923-856b-22586f4a1641", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security" - }, - { - "category": "Defender para nuvem", - "subcategory": "Conformidade regulatória", - "text": "Os controles de conformidade são verdes para quaisquer requisitos de conformidade necessários", - "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard" - }, - { - "category": "Defender para nuvem", - "subcategory": "Azure Defender", - "text": "Vulnerabilidades VM de alta gravidade são zero (vazias)", - "description": "Práticas recomendadas operacionais do cliente - verificar", - "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm" - }, - { - "category": "Defender para nuvem", - "subcategory": "Gerente de Firewall", - "text": "Hubs são protegidos por um Firewall Azure", - "guid": "960334b-df9c-4c23-918d-b61171265f4b", - "severity": "Média", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679" - }, - { - "category": "Defender para nuvem", - "subcategory": "Gerente de Firewall", - "text": "Redes virtuais são protegidas por um Firewall", - "description": "Práticas recomendadas operacionais do cliente - verificar", - "guid": "b47a393a-0803-4272-a479-8b1578a219a4", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices" - }, - { - "category": "Defender para nuvem", - "subcategory": "Gerente de Firewall", - "text": "Padrão DDoS ativado", - "guid": "6ceb5443-5025-4922-9442-92bb628537a5", - "severity": "Média", - "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/" - }, - { - "category": "Defender para nuvem", - "subcategory": "Cobertura", - "text": "Verifique se todas as assinaturas estão cobertas (veja preços e configurações para modificar)", - "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security" - }, - { - "category": "Rede Azure", - "subcategory": "IPs públicos", - "text": "VM's com IPs públicos devem ser protegidos pelo NSG ", - "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb2eb0", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Rede Azure", - "subcategory": "IPs públicos", - "text": "VMs com IPs públicos são movidos atrás do Azure Firewall Premium", - "description": "Práticas recomendadas operacionais do cliente - verifique", - "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses" - }, - { - "category": "Rede Azure", - "subcategory": "IPs públicos", - "text": "VM's que não precisam de IPs públicos não têm IPs públicos (ou seja, somente RDP interno)", - "description": "Práticas recomendadas operacionais do cliente - verifique", - "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access" - }, - { - "category": "Rede Azure", - "subcategory": "NSG", - "text": "O NSG RBAC é usado para restringir o acesso à equipe de segurança de rede", - "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Rede Azure", - "subcategory": "NSG", - "text": "As regras de segurança de entrada do NSG não contêm um * (curinga) no campo Fonte", - "description": "Práticas recomendadas operacionais do cliente - verifique", - "guid": "a209939b-da47-4778-b24c-116785c2fa55", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Rede Azure", - "subcategory": "NSG", - "text": "As regras de segurança de saída do NSG são usadas para controlar o tráfego de endereços IP específicos para tráfego não roteado através de um Firewall", - "description": "Práticas recomendadas operacionais do cliente - verifique", - "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Rede Azure", - "subcategory": "NSG", - "text": "O NSG não tem a Fonte como um curinga no lugar.", - "description": "Práticas recomendadas operacionais do cliente - verifique", - "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview" - }, - { - "category": "Rede Azure", - "subcategory": "NSG", - "text": "Os diagnósticos NSG enviam o NetworkSecurityGroupEvent e o NetworkSecurityGroupRuleCounter para o Sentinel LAW", - "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log" - }, - { - "category": "Rede Azure", - "subcategory": "UDR", - "text": "UDR RBAC é usado para restringir o acesso à equipe de segurança da rede", - "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Rede Azure", - "subcategory": "UDR", - "text": "Se o Zero Trust, então os UDR's são usados para enviar todo o tráfego para o Azure Firewall Premium", - "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Rede Azure", - "subcategory": "UDR", - "text": "Os UDR's que não enviam todo o tráfego para OzureFirewallPremium são conhecidos e documentados.", - "description": "Práticas recomendadas operacionais do cliente - verifique", - "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "O cliente está familiarizado com os padrões de rede do Azure / roteamento padrão SDN no Azure", - "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "O VNet RBAC é usado para restringir o acesso à equipe de segurança da rede", - "description": "Práticas recomendadas operacionais do cliente - verifique", - "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", - "severity": "Média", - "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "As recomendações de segurança do VNet são remediadas e não há VNets 'em risco' ", - "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "As conexões de peering do VNet são compreendidas e os fluxos de tráfego esperados são documentados", - "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "Os endpoints de serviço VNet estão em uso, não existem pontos finais legados do serviço público", - "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "Os Endpoints Privados VNet estão em uso para permitir o acesso de ambientes locais, não existem pontos finais públicos legados", - "guid": "1f625659-ee55-480a-9824-9c931213dbd7", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "Monitoramento do VNet ativado", - "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "Tráfego seguro entre pods usando políticas de rede no Azure Kubernetes Service (AKS)", - "guid": "2055b29b-ade4-4th-8e8c-39ec94666731", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "Cliente VNet NVA (eletrodomésticos) segue padrão de arquitetura publicado", - "guid": "3c005674-c1e9-445b-959c-373e7ed71623", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva" - }, - { - "category": "Rede Azure", - "subcategory": "Redes Virtuais", - "text": "As configurações do VNet Diagnostic estão habilitadas e enviam VMProtectionAlerts para a LEI do Azure Sentinel", - "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network" - }, - { - "category": "Rede Azure", - "subcategory": "Conectividade", - "text": "Use o ExpressRoute ou VPN para acessar recursos do Azure a partir de ambientes locais", - "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure" - }, - { - "category": "Rede Azure", - "subcategory": "Virtual WAN", - "text": "VWAN RBAC é usado para restringir o acesso à equipe de segurança da rede", - "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about" - }, - { - "category": "Rede Azure", - "subcategory": "Virtual WAN", - "text": "O cliente VWAN está usando o Secure Hub ou firewall externo para rotear e monitorar o tráfego.", - "guid": "718d1dca-1f62-4565-aee5-580a38249c93", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture" - }, - { - "category": "Rede Azure", - "subcategory": "Gateway de aplicativos", - "text": "AppGW RBAC é usado para restringir o acesso à equipe de segurança de rede", - "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview" - }, - { - "category": "Rede Azure", - "subcategory": "Gateway de aplicativos", - "text": "AppGW Todos os serviços web voltados externos estão afer gateways de aplicativos com WAF ativado ", - "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Rede Azure", - "subcategory": "Gateway de aplicativos", - "text": "AppGW Todos os serviços internos voltados para a Web estão behing Application Gateways com WAF ativado ", - "guid": "94666731-3c00-4567-9c1e-945b459c373e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip" - }, - { - "category": "Rede Azure", - "subcategory": "Gateway de aplicativos", - "text": "AppGW - Frente externa tem TLS/SSL ativado e redireciona todo o tráfego para 443 (sem tráfego na porta 80)", - "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview" - }, - { - "category": "Rede Azure", - "subcategory": "FrontDoor", - "text": "O FRONT Door RBAC é usado para restringir o acesso à equipe de segurança da rede", - "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/frontdoor/" - }, - { - "category": "Rede Azure", - "subcategory": "FrontDoor", - "text": "Porta da Frente está associada a uma política WAF", - "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json" - }, - { - "category": "Rede Azure", - "subcategory": "FrontDoor", - "text": "A política TLS/SSL da porta frontal está configurada", - "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https" - }, - { - "category": "Rede Azure", - "subcategory": "FrontDoor", - "text": "Porta de redirecionamento da porta 80 para porta 443 está configurada (ouvintes)", - "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect" - }, - { - "category": "Rede Azure", - "subcategory": "FrontDoor", - "text": "Os registros de diagnósticos da Porta frontal enviam o ApplicationGatewayAccessLog &ApplicationGateway FirewallLog para o Sentinel LAW", - "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics" - }, - { - "category": "Rede Azure", - "subcategory": "Proteção DDOS", - "text": "Habilitado para IP's públicos do Firewall (todos os IPs públicos)", - "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - }, - { - "category": "Identidade", - "subcategory": "Inquilino", - "text": "Estabeleça um único diretório empresarial para gerenciar identidades de funcionários em tempo integral e recursos corporativos.", - "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory" - }, - { - "category": "Identidade", - "subcategory": "Inquilino", - "text": "Sincronize sua identidade na nuvem com seus sistemas de identidade existentes.", - "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems" - }, - { - "category": "Identidade", - "subcategory": "Inquilino", - "text": "Use serviços de identidade na nuvem para hospedar contas não-funcionários, como fornecedores, parceiros e clientes, em vez de incluí-las em seu diretório local.", - "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties" - }, - { - "category": "Identidade", - "subcategory": "Inquilino", - "text": "Desativar protocolos legados inseguros para serviços voltados à internet.", - "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication" - }, - { - "category": "Identidade", - "subcategory": "Inquilino", - "text": "Habilitar um único login", - "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on" - }, - { - "category": "Identidade", - "subcategory": "Administração privilegiada", - "text": "Não sincronize contas com o maior acesso privilegiado aos recursos locais à medida que você sincroniza seus sistemas de identidade corporativa com diretórios em nuvem.", - "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", - "severity": "Alto", - "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers" - }, - { - "category": "Identidade", - "subcategory": "Administração privilegiada", - "text": "Limitar o número de administradores globais a menos de 5", - "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5" - }, - { - "category": "Identidade", - "subcategory": "Administração privilegiada", - "text": "Use grupos para atribuições de papéis do Azure AD e delegue a atribuição de função", - "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment" - }, - { - "category": "Identidade", - "subcategory": "Administração privilegiada", - "text": "Certifique-se de que todos os administradores de impacto críticos sejam gerenciados pelo diretório corporativo para acompanhar a aplicação da política organizacional.", - "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins" - }, - { - "category": "Identidade", - "subcategory": "Administração privilegiada", - "text": "Configure revisões de acesso recorrentes para revogar permissões não precisas ao longo do tempo", - "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time" - }, - { - "category": "Identidade", - "subcategory": "Administração privilegiada", - "text": "Certifique-se de que os administradores de impacto crítico usem uma estação de trabalho com proteções de segurança elevadas e monitoramento", - "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security" - }, - { - "category": "Identidade", - "subcategory": "Identidades Externas", - "text": "Provedores de identidade: Verifique se são conhecidos os provedores de identidade externos", - "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c" - }, - { - "category": "Identidade", - "subcategory": "Identidades Externas", - "text": "Configurações de colaboração externa: o acesso do usuário convidado definido para 'Acesso ao usuário convidado é restrito?'", - "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identidade", - "subcategory": "Identidades Externas", - "text": "Configurações de colaboração externa: Configurações de convite de hóspedes definidas como 'Somente usuários atribuídos a funções específicas de administração'", - "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identidade", - "subcategory": "Identidades Externas", - "text": "Configurações de colaboração externa: habilite o autoatendimento do hóspede por meio de fluxos definidos como 'Desativados' ", - "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identidade", - "subcategory": "Identidades Externas", - "text": "Configurações de colaboração externa: restrições de colaboração definidas como 'Permitir convites para os domínios especificados'", - "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations" - }, - { - "category": "Identidade", - "subcategory": "Identidades Externas", - "text": "Avaliações de acesso: Habilitadas para todos os grupos", - "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews" - }, - { - "category": "Identidade", - "subcategory": "Aplicações Corporativas", - "text": "Consentimento & Permissões: Permitir o consentimento do usuário para aplicativos de editores verificados", - "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent" - }, - { - "category": "Identidade", - "subcategory": "Aplicações Corporativas", - "text": "Consentimento & Permissões: Permitir o consentimento do proprietário do grupo para proprietários de grupos selecionados ", - "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups" - }, - { - "category": "Identidade", - "subcategory": "Domínios personalizados", - "text": "Apenas domínios validados de clientes são registrados", - "guid": "bade4aad-1e8c-439e-a946-667313c00567", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain" - }, - { - "category": "Identidade", - "subcategory": "Redefinição de senha", - "text": "Requisito de política de redefinição de senha de autoatendimento verificado em conformidade.", - "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr" - }, - { - "category": "Identidade", - "subcategory": "Redefinição de senha", - "text": "Definir o número de dias antes que os usuários sejam solicitados a re-confirmar informações de autenticação não está definido como zero", - "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "Identidade", - "subcategory": "Redefinição de senha", - "text": "Definir o número de métodos necessários para redefinir a senha são selecionados", - "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment" - }, - { - "category": "Identidade", - "subcategory": "Configuração do usuário", - "text": "Desativar 'Os usuários podem registrar aplicativos'", - "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles" - }, - { - "category": "Identidade", - "subcategory": "Configuração do usuário", - "text": "Restringir o acesso ao portal Administrativo (portal.azure.com) apenas aos administradores", - "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions" - }, - { - "category": "Identidade", - "subcategory": "Configuração do usuário", - "text": "Desativar a 'conexão de conta do LinkedIn'", - "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration" - }, - { - "category": "Identidade", - "subcategory": "Configurações de diagnóstico", - "text": "Ativado e enviado para o espaço de trabalho Log Analytics com o Sentinel", - "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring" - }, - { - "category": "Identidade", - "subcategory": "PIM ativado", - "text": "Gerenciamento de identidade privilegiado ativado", - "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan" - }, - { - "category": "Identidade", - "subcategory": "PIM ativado", - "text": "Implementar o acesso 'just in time' (JIT) para reduzir ainda mais o tempo de exposição de contas privilegiadas (reduzir o acesso permanente)", - "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc" - }, - { - "category": "Identidade", - "subcategory": "Políticas de acesso condicional", - "text": "Configure políticas de acesso condicional / Controles de Acesso", - "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common" - }, - { - "category": "Identidade", - "subcategory": "Políticas de acesso condicional", - "text": "Condições: Locais Restritos", - "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition" - }, - { - "category": "Identidade", - "subcategory": "Políticas de acesso condicional", - "text": "Controles de acesso: MFA ativado para todos os usuários", - "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa" - }, - { - "category": "Identidade", - "subcategory": "Políticas de acesso condicional", - "text": "Controles de acesso: Exigir MFA para administradores", - "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa" - }, - { - "category": "Identidade", - "subcategory": "Políticas de acesso condicional", - "text": "Controles de acesso: Exigir MFA para gerenciamento do Azure ", - "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management" - }, - { - "category": "Identidade", - "subcategory": "Políticas de acesso condicional", - "text": "Controles de acesso: bloqueie protocolos legados", - "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy" - }, - { - "category": "Identidade", - "subcategory": "Políticas de acesso condicional", - "text": "Controles de acesso: Exigir que os dispositivos sejam marcados como compatíveis", - "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices" - }, - { - "category": "Identidade", - "subcategory": "Usuários convidados", - "text": "Existe uma política para rastrear contas de usuários de hóspedes (ou seja, uso/exclusão/desativação)?", - "description": "Política documentada pelo cliente", - "guid": "a7144351-e19d-4d34-929e-b7228137a151", - "severity": "Média", - "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/" - }, - { - "category": "Identidade", - "subcategory": "Pontuação segura de identidade", - "text": "Implementar o Score seguro de identidade com base nas melhores práticas do seu setor", - "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score" - }, - { - "category": "Identidade", - "subcategory": "Quebrar contas de vidro", - "text": "Pelo menos duas contas de vidro de quebra foram criadas e a política em torno de seu uso existe", - "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Controle de acesso", - "text": "Controle de acesso VM aproveitando a política do Azure", - "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/governance/policy/overview" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Controle de acesso", - "text": "Reduza a variabilidade na configuração e implantação de VMs aproveitando modelos", - "guid": "0a77e26-e4d5-4aea-a8dc-4e2436bc336d", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Controle de acesso", - "text": "Garantir acesso privilegiado para implantar VMS reduzindo quem tem acesso a Recursos através da Governança", - "guid": "b5945bda-4333-44fd-b91c-234182b65275", - "severity": "Média", - "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Alta disponibilidade ", - "text": "Use vários VMs para suas cargas de trabalho para melhor disponibilidade ", - "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Alta disponibilidade ", - "text": "Implantar e testar uma solução de recuperação de desastres ", - "guid": "f219e4a1-eb58-4879-935d-227886d30b66", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Alta disponibilidade ", - "text": "Conjuntos de Availabilty", - "guid": "c57be595-1900-4838-95c5-86cb291ec16a", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Alta disponibilidade ", - "text": "Zonas de disponibilidade", - "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Alta disponibilidade ", - "text": "Tolerância a falhas regionais ", - "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Proteger contra malware", - "text": "Instalar soluções antimalware", - "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Proteger contra malware", - "text": "Integre a solução antimalware com o Security Center", - "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Gerenciar atualizações vm", - "text": "Mantenha os VMs atualizados usando o Gerenciamento de Atualizações com automação do Azure", - "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Gerenciar atualizações vm", - "text": "Certifique-se de que as imagens do Windows para implantação tenham o nível mais recente de atualizações ", - "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Gerenciar atualizações vm", - "text": "Aplique rapidamente atualizações de segurança para VMs usando o Microsoft Defender for Cloud", - "guid": "02145901-465d-438e-9309-ccbd979266bc", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/asset-inventory" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Criptografe seus VHDs", - "text": "Habilite a criptografia em seus VMs", - "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Criptografe seus VHDs", - "text": "Adicione a chave de criptografia chave (KEK) para adicionar camada de segurança para criptografia ", - "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Criptografe seus VHDs", - "text": "Tire um instantâneo de discos antes da criptografia para fins de reversão", - "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Restringir a conexão direta à internet ", - "text": "Garantir que apenas o grupo central de rede tenha permissões para recursos de rede ", - "guid": "5173676a-e466-491e-a835-ad942223e138", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Restringir a conexão direta à internet ", - "text": "VMs expostos de identidade e correção que permitem o acesso a partir de adicionas IP de origem 'ANY'", - "guid": "10523081-a941-4741-9833-ff7ad7c6d373", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Restringir a conexão direta à internet ", - "text": "Restringir portas de gerenciamento (RDP, SSH) usando acesso just-in-time", - "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Restringir a conexão direta à internet ", - "text": "Remova o acesso à internet e implemente servidores de salto para RDP", - "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", - "severity": "Alto", - "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Restringir a conexão direta à internet ", - "text": "Remova o login direto em servidores usando RDP/SSH da internet e implemente VPN ou rota expressa", - "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling" - }, - { - "category": "Verificações de segurança VM", - "subcategory": "Restringir a conexão direta à internet ", - "text": "Aproveite o Azure Bastion como seu corretor RDP/SSH para maior segurança e redução de pegada", - "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview" - }, - { - "category": "Sentinela", - "subcategory": "Arquitetura ", - "text": "Todos os inquilinos contêm sentinela habilitado em pelo menos um espaço de trabalho Log Analytics", - "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard" - }, - { - "category": "Sentinela", - "subcategory": "Arquitetura ", - "text": "Cliente entende arquitetura Sentinela", - "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture" - }, - { - "category": "Sentinela", - "subcategory": "Arquitetura ", - "text": "O cliente sabe como monitorar incidentes em várias instâncias do Sentinel", - "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view" - }, - { - "category": "Sentinela", - "subcategory": "Visão geral", - "text": "Sem Incidentes abertos mais de 24 horas", - "guid": "8989579e-76b8-497e-910a-7da7be9966e1", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics" - }, - { - "category": "Sentinela", - "subcategory": "Notícias e Guias", - "text": "O cliente foi mostrado na guia Notícias & Guias", - "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", - "severity": "Baixo", - "link": "https://learn.microsoft.com/azure/sentinel/whats-new" - }, - { - "category": "Sentinela", - "subcategory": "UEBA ", - "text": "Configurado pelo UEBA (Sentinel/Configurações/Configurações/Configurar UEBA)", - "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "Diretório Ativo do Azure em programas configurados e 'Último Log Recebido' hoje", - "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "A proteção de identidade do Diretório Ativo do Azure é configurada e 'Último Registro Recebido' é apresentado hoje", - "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "A Atividade do Azure está configurada e 'Último Registro Recebido' é apresentado hoje", - "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "Microsoft Defender for Cloud é configurado e 'Último Log Recebido' mostra hoje", - "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "O Azure Firewall está configurado e o 'Último Log Recebido' é apresentado hoje", - "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "O Firewall do Windows está configurado e o 'Último Log Recebido' é apresentado hoje", - "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "Eventos de segurança são configurados com os shows ama e 'Último Log Recebido' hoje", - "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "Eventos de Segurança - verifique se os computadores do Azure estão conectados e enviando dados para o espaço de trabalho", - "guid": "1a4834ac-9322-423e-ae80-b123081a5417", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "Eventos de Segurança - verifique se computadores não-Azure estão conectados e enviando dados para o espaço de trabalho", - "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "Conector para AWS", - "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3" - }, - { - "category": "Sentinela", - "subcategory": "Conectores de dados", - "text": "Conector para GCP", - "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference" - }, - { - "category": "Sentinela", - "subcategory": "Regras de análise", - "text": "O cliente habilitou as regras de análise e configurou incidentes ", - "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in" - }, - { - "category": "Sentinela", - "subcategory": "Configurações", - "text": "O cliente não tem um limite diário habilitado", - "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", - "severity": "Média", - "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/" - }, - { - "category": "Azure Firewall", - "subcategory": "Configuração", - "text": "Azure Firewall Premium implantado", - "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/premium-features" - }, - { - "category": "Azure Firewall", - "subcategory": "Configuração", - "text": "Tunning quad zero/force ativado através do Firewall Azure", - "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route" - }, - { - "category": "Azure Firewall", - "subcategory": "Controle de acesso", - "text": "RBAC definido para habilitar apenas usuários autorizados", - "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", - "severity": "Média", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "Configurações de diagnóstico", - "text": "Diagnósticos ativados e envio de métricas para um espaço de trabalho do Log Analytics ", - "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "Hubs e redes virtuais são protegidos ou conectados através do Firewall Premium", - "guid": "b35478c3-4798-416b-8863-cffe1cac599e", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "Política: Os controles de acesso são configurados (RBAC)", - "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", - "severity": "Alto", - "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "Política: A política dos pais está configurada ", - "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "Política: As coleções de regras são definidas", - "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "Política: As políticas de DNAT são definidas", - "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "Política: As regras da rede são definidas", - "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "Política: As regras de aplicação são definidas", - "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/features" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "DNS: Recurso compreendido e aplicado ou não aplicado", - "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/firewall/dns-details" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "Inteligência de Ameaças: Definir para Alertar e Negar", - "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "Inteligência de Ameaças: Lista permitida (justificar se eles estão sendo usados - ou seja, desempenho)", - "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "TLS ativado", - "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/premium-certificates" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "IDPS ativado", - "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/rule-processing" - }, - { - "category": "Azure Firewall", - "subcategory": "Gerente de Firewall", - "text": "SNAT: Configurado ", - "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", - "severity": "Alto", - "link": "https://learn.microsoft.com/azure/firewall/snat-private-range" - }, - { - "category": "Azure Firewall", - "subcategory": "Proteção DDOS", - "text": "Habilitado para IP's públicos do Firewall", - "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", - "severity": "Média", - "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices" - } - ], - "severities": [ - { - "name": "Alto" - }, - { - "name": "Média" - }, - { - "name": "Baixo" - } - ], - "status": [ - { - "name": "Não verificado", - "description": "Este cheque ainda não foi examinado." - }, - { - "name": "Abrir", - "description": "Há um item de ação associado a este cheque" - }, - { - "name": "Cumprido", - "description": "Esta verificação foi verificada, e não há mais itens de ação associados a ele" - }, - { - "name": "Não é necessário", - "description": "Recomendação compreendida, mas não necessária pelos requisitos atuais" - }, - { - "name": "N/A", - "description": "Não é aplicável para o design atual" - } - ], - "categories": [ - { - "name": "Defender para nuvem" - }, - { - "name": "Rede Azure" - }, - { - "name": "Identidade" - }, - { - "name": "Verificações de segurança VM" - }, - { - "name": "Sentinela" - }, - { - "name": "Azure Firewall" - } - ] -} + "categories": [ + { + "name": "Defender para nuvem" + }, + { + "name": "Rede do Azure" + }, + { + "name": "Identidade" + }, + { + "name": "Verificações de segurança da VM" + }, + { + "name": "Sentinela" + }, + { + "name": "Azure Firewall" + } + ], + "items": [ + { + "category": "Defender para nuvem", + "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", + "id": "A01.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", + "severity": "Alto", + "subcategory": "Preços & Configurações", + "text": "Central de Segurança/Defender habilitado em todas as assinaturas", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "349f0364-d28d-442e-abbb-c868255abc91", + "id": "A01.02", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "Alto", + "subcategory": "Preços & Configurações", + "text": "Central de Segurança/Defender habilitada em todos os espaços de trabalho do Log Analytics", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", + "id": "A01.03", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal", + "severity": "Média", + "subcategory": "Preços & Configurações", + "text": "Conjunto de coleta de dados como 'Comum'", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", + "id": "A01.04", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "Alto", + "subcategory": "Preços & Configurações", + "text": "Os recursos de segurança aprimorados do Defender for Cloud estão todos habilitados", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", + "id": "A01.05", + "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection", + "severity": "Média", + "subcategory": "Preços & Configurações", + "text": "Provisionamento automático habilitado de acordo com a política da empresa (a política deve existir)", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "25759e35-680e-4782-9ac9-32213d027ff4", + "id": "A01.06", + "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details", + "severity": "Baixo", + "subcategory": "Preços & Configurações", + "text": "Notificações por e-mail habilitadas de acordo com a política da empresa (a política deve existir)", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", + "id": "A01.07", + "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows", + "severity": "Média", + "subcategory": "Preços & Configurações", + "text": "As opções de ativação de integrações estão selecionadas ", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "5b7abae4-4aad-45e8-a79e-2e86667313c5", + "id": "A01.08", + "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd", + "severity": "Média", + "subcategory": "Preços & Configurações", + "text": "A integração CI/CD está configurada", + "waf": "Operações" + }, + { + "category": "Defender para nuvem", + "guid": "05675c5e-985b-4859-a774-f7e371623b87", + "id": "A01.09", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "Alto", + "subcategory": "Preços & Configurações", + "text": "A exportação contínua 'Hub de Eventos' está habilitada se estiver usando o SIEM de 3ª parte", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", + "id": "A01.10", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "Média", + "subcategory": "Preços & Configurações", + "text": "A exportação contínua 'Log Analytics Workspace' está habilitada se não estiver usando o Azure Sentinel", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", + "id": "A01.11", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "Alto", + "subcategory": "Preços & Configurações", + "text": "Conector de nuvem habilitado para AWS", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", + "id": "A01.12", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp", + "severity": "Alto", + "subcategory": "Preços & Configurações", + "text": "Conector de nuvem habilitado para GCP", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", + "id": "A01.13", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security", + "severity": "Baixo", + "subcategory": "Preços & Configurações", + "text": "Se estiver usando o proxy de Aplicativo do Azure AD, considere a integração com o Microsoft Defender for Cloud Apps para monitorar o acesso ao aplicativo em tempo real e aplicar controles de segurança avançados.", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", + "id": "A02.01", + "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls", + "severity": "Média", + "subcategory": "Recomendações", + "text": "Todas as recomendações corrigidas ou desabilitadas, se não forem necessárias.", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "description": "A meta mínima da Microsoft para todos os clientes é de 70%", + "guid": "08032729-4798-4b15-98a2-19a46ceb5443", + "id": "A02.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls", + "severity": "Alto", + "subcategory": "Recomendações", + "text": "Pontuação de segurança>70%", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "50259226-4429-42bb-9285-37a55119bf8e", + "id": "A03.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident", + "severity": "Média", + "subcategory": "Alertas de Segurança", + "text": "Os Alertas de Segurança contêm apenas os gerados nas últimas 24 horas (corrigir ou desativar alertas de segurança mais antigos)", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", + "id": "A04.01", + "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks", + "severity": "Média", + "subcategory": "Pastas", + "text": "Se a exportação contínua estiver habilitada, as pastas de trabalho padrão serão publicadas no painel de segurança personalizado", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", + "id": "A05.01", + "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud", + "severity": "Média", + "subcategory": "Comunidade", + "text": "O cliente está ciente do valor da página \"Comunidade\" e tem uma cadência regular configurada para revisar", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "description": "Melhores práticas operacionais do cliente - Transparência", + "guid": "93846da9-7cc3-4923-856b-22586f4a1641", + "id": "A06.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security", + "severity": "Alto", + "subcategory": "Pontuação segura", + "text": "Todas as assinaturas protegidas pela Central de Segurança são mostradas (sem filtro de assinatura definido)", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", + "id": "A07.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard", + "severity": "Alto", + "subcategory": "Conformidade regulatória", + "text": "Os controles de conformidade são ecológicos para quaisquer requisitos de conformidade exigidos", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "description": "Práticas recomendadas operacionais do cliente - verificar", + "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", + "id": "A08.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm", + "severity": "Alto", + "subcategory": "Azure Defender", + "text": "Vulnerabilidades de VM de alta gravidade são zero (vazias)", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "9603334b-df9c-4c23-918d-b61171265f4b", + "id": "A09.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679", + "severity": "Média", + "subcategory": "Gerenciador de Firewall", + "text": "Os hubs são protegidos por um Firewall do Azure", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "description": "Práticas recomendadas operacionais do cliente - verificar", + "guid": "b47a393a-0803-4272-a479-8b1578a219a4", + "id": "A09.02", + "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices", + "severity": "Média", + "subcategory": "Gerenciador de Firewall", + "text": "As Redes Virtuais são protegidas por um Firewall", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "6ceb5443-5025-4922-9442-92bb628537a5", + "id": "A09.03", + "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/", + "severity": "Média", + "subcategory": "Gerenciador de Firewall", + "text": "DDoS Standard ativado", + "waf": "Segurança" + }, + { + "category": "Defender para nuvem", + "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", + "id": "A10.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "Alto", + "subcategory": "Cobertura", + "text": "Verifique se todas as assinaturas estão cobertas (consulte preços e configurações para modificar)", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", + "id": "B01.01", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "Alto", + "subcategory": "IPs públicos", + "text": "VMs com IPs públicos devem ser protegidas pelo NSG ", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "description": "Práticas recomendadas operacionais do cliente - verificar", + "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", + "id": "B01.02", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "Alto", + "subcategory": "IPs públicos", + "text": "As VMs com IPs públicos são movidas para trás do Firewall Premium do Azure", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "description": "Práticas recomendadas operacionais do cliente - verificar", + "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", + "id": "B01.03", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "severity": "Alto", + "subcategory": "IPs públicos", + "text": "VMs que não precisam de IPs públicos não têm IPs públicos (ou seja, somente RDP interno)", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", + "id": "B02.01", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "Média", + "subcategory": "NSG", + "text": "O NSG RBAC é usado para restringir o acesso à equipe de segurança de rede", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "description": "Práticas recomendadas operacionais do cliente - verificar", + "guid": "a209939b-da47-4778-b24c-116785c2fa55", + "id": "B02.02", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "Alto", + "subcategory": "NSG", + "text": "As regras de segurança de entrada do NSG não contêm um * (curinga) no campo Origem", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "description": "Práticas recomendadas operacionais do cliente - verificar", + "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", + "id": "B02.03", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "Média", + "subcategory": "NSG", + "text": "As regras de segurança de saída do NSG são usadas para controlar o tráfego para endereços IP específicos para o tráfego não roteado por meio de um Firewall", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "description": "Práticas recomendadas operacionais do cliente - verificar", + "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", + "id": "B02.04", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "Alto", + "subcategory": "NSG", + "text": "O NSG não tem Source como um * (curinga) no lugar.", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", + "id": "B02.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log", + "severity": "Média", + "subcategory": "NSG", + "text": "O NSG Diagnostics envia o tráfego NetworkSecurityGroupEvent e NetworkSecurityGroupRuleCounter para o Sentinel LAW", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", + "id": "B03.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "Média", + "subcategory": "UDR", + "text": "O UDR RBAC é usado para restringir o acesso à equipe de segurança de rede", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", + "id": "B03.02", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "Alto", + "subcategory": "UDR", + "text": "Se Zero Trust, os UDRs serão usados para enviar todo o tráfego para o Firewall do Azure Premium", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "description": "Práticas recomendadas operacionais do cliente - verificar", + "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", + "id": "B03.03", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "Média", + "subcategory": "UDR", + "text": "Os UDRs que não enviam todo o tráfego para o AzureFirewallPremium são conhecidos e documentados.", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", + "id": "B04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default", + "severity": "Alto", + "subcategory": "Redes Virtuais", + "text": "O cliente está familiarizado com os padrões de rede do Azure / roteamento padrão SDN no Azure", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "description": "Práticas recomendadas operacionais do cliente - verificar", + "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", + "id": "B04.02", + "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672", + "severity": "Média", + "subcategory": "Redes Virtuais", + "text": "VNet RBAC é usado para restringir o acesso à equipe de segurança de rede", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", + "id": "B04.03", + "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference", + "severity": "Alto", + "subcategory": "Redes Virtuais", + "text": "As recomendações de segurança da rede virtual são corrigidas e não há redes virtuais \"em risco\" ", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", + "id": "B04.04", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "severity": "Alto", + "subcategory": "Redes Virtuais", + "text": "As conexões de emparelhamento de rede virtual são compreendidas e os fluxos de tráfego esperados são documentados", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", + "id": "B04.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview", + "severity": "Alto", + "subcategory": "Redes Virtuais", + "text": "Os pontos de extremidade de serviço VNet estão em uso, não existem pontos de extremidade de serviço público herdados", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "1f625659-ee55-480a-9824-9c931213dbd7", + "id": "B04.06", + "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview", + "severity": "Alto", + "subcategory": "Redes Virtuais", + "text": "Os pontos de extremidade privados da rede virtual estão em uso para permitir o acesso de ambientes locais, não existem pontos de extremidade públicos herdados", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", + "id": "B04.07", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "Alto", + "subcategory": "Redes Virtuais", + "text": "Monitoramento de rede virtual habilitado", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731", + "id": "B04.08", + "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies", + "severity": "Alto", + "subcategory": "Redes Virtuais", + "text": "Tráfego seguro entre pods usando políticas de rede no Serviço de Kubernetes do Azure (AKS)", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "3c005674-c1e9-445b-959c-373e7ed71623", + "id": "B04.09", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva", + "severity": "Alto", + "subcategory": "Redes Virtuais", + "text": "O cliente VNet NVA (appliances) segue o padrão de arquitetura publicado", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", + "id": "B04.10", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "Alto", + "subcategory": "Redes Virtuais", + "text": "As configurações de Diagnóstico de Rede Virtual estão habilitadas e enviando VMProtectionAlerts para a LEI do Azure Sentinel", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", + "id": "B05.01", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "severity": "Alto", + "subcategory": "Conectividade", + "text": "Usar a Rota Expressa ou VPN para acessar recursos do Azure de ambientes locais", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", + "id": "B06.01", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "severity": "Alto", + "subcategory": "Virtual WAN", + "text": "VWAN RBAC é usado para restringir o acesso à equipe de segurança de rede", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "718d1dca-1f62-4565-aee5-580a38249c93", + "id": "B06.02", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture", + "severity": "Alto", + "subcategory": "Virtual WAN", + "text": "O Cliente VWAN está usando o Secure Hub ou o Firewall externo para rotear e monitorar o tráfego.", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", + "id": "B07.01", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "severity": "Alto", + "subcategory": "Gateway de aplicativo", + "text": "O AppGW RBAC é usado para restringir o acesso à equipe de segurança de rede", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", + "id": "B07.02", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "Alto", + "subcategory": "Gateway de aplicativo", + "text": "AppGW Todos os serviços Web externos estão atrás de gateways de aplicativos com WAF habilitado ", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "94666731-3c00-4567-9c1e-945b459c373e", + "id": "B07.03", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "Alto", + "subcategory": "Gateway de aplicativo", + "text": "AppGW Todos os serviços Web internos estão atrás de gateways de aplicativos com WAF habilitado ", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", + "id": "B07.04", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "severity": "Alto", + "subcategory": "Gateway de aplicativo", + "text": "AppGW - Externo tem TLS/SSL habilitado e redireciona todo o tráfego para 443 (sem tráfego da porta 80)", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", + "id": "B08.01", + "link": "https://learn.microsoft.com/azure/frontdoor/", + "severity": "Alto", + "subcategory": "Porta de entrada", + "text": "O RBAC Front Door é usado para restringir o acesso à equipe de segurança de rede", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", + "id": "B08.02", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json", + "severity": "Alto", + "subcategory": "Porta de entrada", + "text": "Front Door está associado a uma política de WAF", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", + "id": "B08.03", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https", + "severity": "Alto", + "subcategory": "Porta de entrada", + "text": "A política TLS/SSL da porta da frente está configurada", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", + "id": "B08.04", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect", + "severity": "Alto", + "subcategory": "Porta de entrada", + "text": "A porta de redirecionamento da porta frontal 80 para a porta 443 está configurada (ouvintes)", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", + "id": "B08.05", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics", + "severity": "Alto", + "subcategory": "Porta de entrada", + "text": "Os logs de diagnóstico do Front Door enviam ApplicationGatewayAccessLog &ApplicationGateway FirewallLog para o Sentinel LAW", + "waf": "Segurança" + }, + { + "category": "Rede do Azure", + "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", + "id": "B09.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "Alto", + "subcategory": "Proteção DDOS", + "text": "Habilitado para IPs públicos do Firewall (todos os IPs públicos)", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", + "id": "C01.01", + "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory", + "severity": "Alto", + "subcategory": "Inquilino", + "text": "Estabeleça um único diretório corporativo para gerenciar identidades de funcionários em tempo integral e recursos da empresa.", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", + "id": "C01.02", + "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems", + "severity": "Alto", + "subcategory": "Inquilino", + "text": "Sincronize sua identidade de nuvem com seus sistemas de identidade existentes.", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", + "id": "C01.03", + "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties", + "severity": "Alto", + "subcategory": "Inquilino", + "text": "Use os serviços de identidade na nuvem para hospedar contas de não funcionários, como fornecedores, parceiros e clientes, em vez de incluí-las em seu diretório local.", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", + "id": "C01.04", + "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication", + "severity": "Alto", + "subcategory": "Inquilino", + "text": "Desative protocolos legados inseguros para serviços voltados para a Internet.", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", + "id": "C01.05", + "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on", + "severity": "Alto", + "subcategory": "Inquilino", + "text": "Habilitar logon único", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", + "id": "C02.01", + "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers", + "severity": "Alto", + "subcategory": "Administração privilegiada", + "text": "Não sincronize contas com o acesso de privilégios mais altos a recursos locais enquanto sincroniza seus sistemas de identidade corporativos com diretórios de nuvem.", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", + "id": "C02.02", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5", + "severity": "Alto", + "subcategory": "Administração privilegiada", + "text": "Limitar o número de administradores globais a menos de 5", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", + "id": "C02.03", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment", + "severity": "Alto", + "subcategory": "Administração privilegiada", + "text": "Usar grupos para atribuições de função do Azure AD e delegar a atribuição de função", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", + "id": "C02.04", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins", + "severity": "Alto", + "subcategory": "Administração privilegiada", + "text": "Certifique-se de que todos os administradores de impacto crítico sejam gerenciados pelo diretório corporativo para seguir a imposição da política organizacional.", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", + "id": "C02.05", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time", + "severity": "Alto", + "subcategory": "Administração privilegiada", + "text": "Configurar revisões de acesso recorrentes para revogar permissões desnecessárias ao longo do tempo", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", + "id": "C02.06", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security", + "severity": "Média", + "subcategory": "Administração privilegiada", + "text": "Garantir que os administradores de impacto crítico usem uma estação de trabalho com proteções de segurança e monitoramento elevados", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", + "id": "C03.01", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Provedores de identidade: verifique se os provedores de identidade externos são conhecidos", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", + "id": "C03.02", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Configurações de colaboração externa: acesso de usuário convidado definido como \"O acesso de usuário convidado é restrito?\"", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", + "id": "C03.03", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Configurações de colaboração externa: configurações de convite de convidado definidas como \"Somente usuários atribuídos a funções de administrador específicas\"", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", + "id": "C03.04", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Configurações de colaboração externa: habilite a inscrição de autoatendimento de convidado por meio de fluxos definidos como 'Desabilitado' ", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", + "id": "C03.05", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "Alto", + "subcategory": "Identidades externas", + "text": "Configurações de colaboração externa: restrições de colaboração definidas como 'Permitir convites para os domínios especificados'", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", + "id": "C03.06", + "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews", + "severity": "Média", + "subcategory": "Identidades externas", + "text": "Revisões de acesso: habilitado para todos os grupos", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", + "id": "C04.01", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent", + "severity": "Média", + "subcategory": "Aplicativos Corporativos", + "text": "Permissões de consentimento e emissão: permitir o consentimento do usuário para aplicativos de editores verificados", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", + "id": "C04.02", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups", + "severity": "Média", + "subcategory": "Aplicativos Corporativos", + "text": "Consentimento & Permissões: Permitir o consentimento do proprietário do grupo para proprietários de grupo selecionados ", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "bade4aad-1e8c-439e-a946-667313c00567", + "id": "C05.01", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain", + "severity": "Alto", + "subcategory": "Domínios personalizados", + "text": "Somente domínios de clientes validados são registrados", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", + "id": "C06.01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr", + "severity": "Alto", + "subcategory": "Redefinição de senha", + "text": "Requisito de política de redefinição de senha de autoatendimento verificado em conformidade.", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", + "id": "C06.02", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "Média", + "subcategory": "Redefinição de senha", + "text": "Definir o número de dias antes que os usuários sejam solicitados a confirmar novamente as informações de autenticação não está definido como zero", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", + "id": "C06.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "Alto", + "subcategory": "Redefinição de senha", + "text": "Definir o número de métodos necessários para redefinir a senha está selecionado", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", + "id": "C07.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles", + "severity": "Alto", + "subcategory": "Configuração do usuário", + "text": "Desativar 'Os usuários podem registrar aplicativos'", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", + "id": "C07.02", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions", + "severity": "Alto", + "subcategory": "Configuração do usuário", + "text": "Restringir o acesso ao Portal Administrativo (portal.azure.com) apenas aos administradores", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", + "id": "C07.03", + "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration", + "severity": "Alto", + "subcategory": "Configuração do usuário", + "text": "Desativar a \"conexão da conta do LinkedIn\"", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", + "id": "C08.01", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring", + "severity": "Alto", + "subcategory": "Configurações de diagnóstico", + "text": "Habilitado e enviado para o espaço de trabalho do Log Analytics com o Sentinel", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", + "id": "C09.01", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan", + "severity": "Alto", + "subcategory": "PIM habilitado", + "text": "Gerenciamento de Identidades Privilegiado habilitado", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", + "id": "C09.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc", + "severity": "Alto", + "subcategory": "PIM habilitado", + "text": "Implementar o acesso \"just in time\" (JIT) para reduzir ainda mais o tempo de exposição para contas privilegiadas (reduzir o acesso permanente)", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", + "id": "C10.01", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common", + "severity": "Alto", + "subcategory": "Políticas de acesso condicional", + "text": "Configurar políticas de acesso condicional / Controles de acesso", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", + "id": "C10.02", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition", + "severity": "Média", + "subcategory": "Políticas de acesso condicional", + "text": "Condições: Locais Restritos", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", + "id": "C10.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa", + "severity": "Alto", + "subcategory": "Políticas de acesso condicional", + "text": "Controles de acesso: MFA habilitado para todos os usuários", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", + "id": "C10.04", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa", + "severity": "Média", + "subcategory": "Políticas de acesso condicional", + "text": "Controles de acesso: exigir MFA para administradores", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", + "id": "C10.05", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management", + "severity": "Alto", + "subcategory": "Políticas de acesso condicional", + "text": "Controles de acesso: exigir MFA para o Gerenciamento do Azure ", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", + "id": "C10.06", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy", + "severity": "Alto", + "subcategory": "Políticas de acesso condicional", + "text": "Controles de acesso: Bloquear protocolos herdados", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", + "id": "C10.07", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices", + "severity": "Alto", + "subcategory": "Políticas de acesso condicional", + "text": "Controles de acesso: exigem que os dispositivos sejam marcados como compatíveis", + "waf": "Segurança" + }, + { + "category": "Identidade", + "description": "Política documentada pelo cliente", + "guid": "a7144351-e19d-4d34-929e-b7228137a151", + "id": "C11.01", + "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/", + "severity": "Média", + "subcategory": "Usuários convidados", + "text": "Existe uma política para rastrear contas de usuário convidado (ou seja, uso/exclusão/desabilitação)?", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", + "id": "C12.01", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score", + "severity": "Alto", + "subcategory": "Pontuação segura de identidade", + "text": "Implemente o Identity Secure Score com base nas melhores práticas do seu setor", + "waf": "Segurança" + }, + { + "category": "Identidade", + "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", + "id": "C13.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "severity": "Média", + "subcategory": "Contas Break Glass", + "text": "Pelo menos duas contas de quebra de vidro foram criadas e existe uma política em torno de seu uso", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", + "id": "D01.01", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "severity": "Alto", + "subcategory": "Controle de acesso", + "text": "Controlar o acesso à VM aproveitando a Política do Azure", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", + "id": "D01.02", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax", + "severity": "Média", + "subcategory": "Controle de acesso", + "text": "Reduza a variabilidade na configuração e implantação de VMs aproveitando modelos", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "b5945bda-4333-44fd-b91c-234182b65275", + "id": "D01.03", + "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models", + "severity": "Média", + "subcategory": "Controle de acesso", + "text": "Proteja o acesso privilegiado para implantar o VMS, reduzindo quem tem acesso aos recursos por meio da governança", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", + "id": "D02.01", + "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service", + "severity": "Média", + "subcategory": "Alta Disponibilidade ", + "text": "Use várias VMs para suas cargas de trabalho para melhor disponibilidade ", + "waf": "Fiabilidade" + }, + { + "category": "Verificações de segurança da VM", + "guid": "f219e4a1-eb58-4879-935d-227886d30b66", + "id": "D02.02", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm", + "severity": "Média", + "subcategory": "Alta Disponibilidade ", + "text": "Implantar e testar uma solução de recuperação de desastres ", + "waf": "Fiabilidade" + }, + { + "category": "Verificações de segurança da VM", + "guid": "c57be595-1900-4838-95c5-86cb291ec16a", + "id": "D02.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "severity": "Média", + "subcategory": "Alta Disponibilidade ", + "text": "Conjuntos de disponibilidade", + "waf": "Fiabilidade" + }, + { + "category": "Verificações de segurança da VM", + "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", + "id": "D02.04", + "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context", + "severity": "Média", + "subcategory": "Alta Disponibilidade ", + "text": "Zonas de disponibilidade", + "waf": "Fiabilidade" + }, + { + "category": "Verificações de segurança da VM", + "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", + "id": "D02.05", + "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region", + "severity": "Média", + "subcategory": "Alta Disponibilidade ", + "text": "Tolerância a falhas regionais ", + "waf": "Fiabilidade" + }, + { + "category": "Verificações de segurança da VM", + "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", + "id": "D03.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware", + "severity": "Alto", + "subcategory": "Proteja-se contra malware", + "text": "Instalar soluções antimalware", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", + "id": "D03.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "Alto", + "subcategory": "Proteja-se contra malware", + "text": "Integre a solução antimalware com a Central de Segurança", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", + "id": "D04.01", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "severity": "Alto", + "subcategory": "Gerenciar atualizações de VM", + "text": "Mantenha as VMs atualizadas usando o Gerenciamento de Atualizações com a Automação do Azure", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", + "id": "D04.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching", + "severity": "Média", + "subcategory": "Gerenciar atualizações de VM", + "text": "Garantir que as imagens do Windows para implantação tenham o nível mais recente de atualizações ", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "02145901-465d-438e-9309-ccbd979266bc", + "id": "D04.03", + "link": "https://learn.microsoft.com/azure/security-center/asset-inventory", + "severity": "Alto", + "subcategory": "Gerenciar atualizações de VM", + "text": "Aplique rapidamente atualizações de segurança a VMs usando o Microsoft Defender for Cloud", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", + "id": "D05.01", + "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", + "severity": "Alto", + "subcategory": "Criptografar seus VHDs", + "text": "Habilitar a criptografia em suas VMs", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", + "id": "D05.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek", + "severity": "Alto", + "subcategory": "Criptografar seus VHDs", + "text": "Adicionar chave de criptografia (KEK) para camada adicional de segurança para criptografia ", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", + "id": "D05.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk", + "severity": "Média", + "subcategory": "Criptografar seus VHDs", + "text": "Fazer um instantâneo dos discos antes da criptografia para fins de reversão", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "5173676a-e466-491e-a835-ad942223e138", + "id": "D06.01", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "severity": "Alto", + "subcategory": "Restringir a conexão direta com a Internet ", + "text": "Verifique se apenas o grupo de rede central tem permissões para recursos de rede ", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "10523081-a941-4741-9833-ff7ad7c6d373", + "id": "D06.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "Alto", + "subcategory": "Restringir a conexão direta com a Internet ", + "text": "Identidade e correção de VMs expostas que permitem o acesso a partir de 'QUALQUER' endereço IP de origem", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", + "id": "D06.03", + "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time", + "severity": "Alto", + "subcategory": "Restringir a conexão direta com a Internet ", + "text": "Restringir portas de gerenciamento (RDP, SSH) usando o Acesso Just-in-Time", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", + "id": "D06.04", + "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", + "severity": "Alto", + "subcategory": "Restringir a conexão direta com a Internet ", + "text": "Remover o acesso à Internet e implementar servidores de salto para RDP", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", + "id": "D06.05", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling", + "severity": "Alto", + "subcategory": "Restringir a conexão direta com a Internet ", + "text": "Remova o login direto em servidores usando RDP/SSH da Internet e implemente VPN ou rota expressa", + "waf": "Segurança" + }, + { + "category": "Verificações de segurança da VM", + "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", + "id": "D06.06", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "severity": "Alto", + "subcategory": "Restringir a conexão direta com a Internet ", + "text": "Aproveite o Azure Bastion como seu agente RDP/SSH para maior segurança e redução do espaço ocupado", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", + "id": "E01.01", + "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", + "severity": "Alto", + "subcategory": "Arquitetura ", + "text": "Todos os locatários contêm o Sentinel habilitado em pelo menos um espaço de trabalho do Log Analytics", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", + "id": "E01.02", + "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture", + "severity": "Alto", + "subcategory": "Arquitetura ", + "text": "O cliente entende a arquitetura do Sentinel", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", + "id": "E01.03", + "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view", + "severity": "Média", + "subcategory": "Arquitetura ", + "text": "O cliente sabe como monitorar incidentes em várias instâncias do Sentinel", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "8989579e-76b8-497e-910a-7da7be9966e1", + "id": "E02.01", + "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics", + "severity": "Média", + "subcategory": "Visão geral", + "text": "Nenhum incidente aberto mais de 24 horas", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", + "id": "E03.01", + "link": "https://learn.microsoft.com/azure/sentinel/whats-new", + "severity": "Baixo", + "subcategory": "Notícias & Guias", + "text": "O cliente mostrou a guia Notícias e Guias", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", + "id": "E04.01", + "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics", + "severity": "Média", + "subcategory": "UEBA ", + "text": "UEBA configurado (Sentinel/Configurações/Configurações/Configurar UEBA)", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", + "id": "E05.01", + "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "O Azure Active Directory em configurado e 'Último Log Recebido' é exibido hoje", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", + "id": "E05.02", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "O Azure Active Directory Identity Protection está configurado e o 'Último Log Recebido' é exibido hoje", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", + "id": "E05.03", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "A Atividade do Azure está configurada, está configurada e o 'Último Log Recebido' é exibido hoje", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", + "id": "E05.04", + "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "O Microsoft Defender para nuvem está configurado e o 'Último log recebido' é exibido hoje", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", + "id": "E05.05", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "O Firewall do Azure está configurado e o 'Último Log Recebido' é exibido hoje", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", + "id": "E05.06", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "O Firewall do Windows está configurado e o 'Último Log Recebido' é exibido hoje", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", + "id": "E05.07", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "Eventos de segurança é configurado com AMA e 'Último log recebido' é exibido hoje", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "1a4834ac-9322-423e-ae80-b123081a5417", + "id": "E05.08", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "Eventos de segurança - verifique se os computadores do Azure estão conectados e enviando dados para o espaço de trabalho", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", + "id": "E05.09", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "Eventos de segurança - verifique se os computadores que não são do Azure estão conectados e enviando dados para o espaço de trabalho", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", + "id": "E05.10", + "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "Conector para AWS", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", + "id": "E05.11", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "Alto", + "subcategory": "Conectores de dados", + "text": "Conector para GCP", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", + "id": "E06.01", + "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in", + "severity": "Alto", + "subcategory": "Regras do Google Analytics", + "text": "O cliente habilitou as regras do Google Analytics e configurou os Incidentes ", + "waf": "Segurança" + }, + { + "category": "Sentinela", + "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", + "id": "E07.01", + "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/", + "severity": "Média", + "subcategory": "Configurações", + "text": "O cliente não tem um limite diário habilitado", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", + "id": "F01.01", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "severity": "Alto", + "subcategory": "Configuração", + "text": "Azure Firewall Premium implantado", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", + "id": "F01.02", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route", + "severity": "Alto", + "subcategory": "Configuração", + "text": "Ajuste quádruplo de zero/força habilitado por meio do Firewall do Azure", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", + "id": "F02.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "Média", + "subcategory": "Controle de acesso", + "text": "RBAC definido para habilitar apenas usuários autorizados", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", + "id": "F03.01", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "severity": "Média", + "subcategory": "Configurações de diagnóstico", + "text": "Diagnóstico habilitado e envio de métricas para um espaço de trabalho do Log Analytics ", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "b35478c3-4798-416b-8863-cffe1cac599e", + "id": "F04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "Hubs e redes virtuais são protegidos ou conectados por meio do Firewall Premium", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", + "id": "F04.02", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "Política: os controles de acesso estão configurados (RBAC)", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", + "id": "F04.03", + "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "Política: a política pai está configurada ", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", + "id": "F04.04", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "Política: as coleções de regras são definidas", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", + "id": "F04.05", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "Política: as políticas do DNAT são definidas", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", + "id": "F04.06", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "Política: as regras de rede são definidas", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", + "id": "F04.07", + "link": "https://learn.microsoft.com/azure/firewall/features", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "Política: as regras do aplicativo são definidas", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", + "id": "F04.08", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "severity": "Média", + "subcategory": "Gerenciador de Firewall", + "text": "DNS: Recurso compreendido e aplicado ou não aplicado", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", + "id": "F04.09", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "Inteligência de ameaças: definir como Alertar e Negar", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", + "id": "F04.10", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "Threat Intelligence: Lista de permitidos (justifique se eles estão sendo usados - ou seja, desempenho)", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", + "id": "F04.11", + "link": "https://learn.microsoft.com/azure/firewall/premium-certificates", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "TLS habilitado", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", + "id": "F04.12", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "IDPS habilitado", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", + "id": "F04.13", + "link": "https://learn.microsoft.com/azure/firewall/snat-private-range", + "severity": "Alto", + "subcategory": "Gerenciador de Firewall", + "text": "SNAT: Configurado ", + "waf": "Segurança" + }, + { + "category": "Azure Firewall", + "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", + "id": "F05.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "Média", + "subcategory": "Proteção DDOS", + "text": "Habilitado para IPs públicos do Firewall", + "waf": "Segurança" + } + ], + "metadata": { + "name": "Azure Security Review Checklist", + "state": "Deprecated", + "timestamp": "June 24, 2024" + }, + "severities": [ + { + "name": "Alto" + }, + { + "name": "Média" + }, + { + "name": "Baixo" + } + ], + "status": [ + { + "description": "Esta verificação ainda não foi analisada", + "name": "Não verificado" + }, + { + "description": "Há um item de ação associado a essa verificação", + "name": "Abrir" + }, + { + "description": "Essa verificação foi verificada e não há outros itens de ação associados a ela", + "name": "Cumprido" + }, + { + "description": "Recomendação compreendida, mas não necessária pelos requisitos atuais", + "name": "Não é necessário" + }, + { + "description": "Não aplicável ao projeto atual", + "name": "N/A" + } + ], + "waf": [ + { + "name": "Fiabilidade" + }, + { + "name": "Segurança" + }, + { + "name": "Custar" + }, + { + "name": "Operações" + }, + { + "name": "Desempenho" + } + ], + "yesno": [ + { + "name": "Sim" + }, + { + "name": "Não" + } + ] +} \ No newline at end of file diff --git a/checklists/security_checklist.zh-Hant.json b/checklists/security_checklist.zh-Hant.json new file mode 100644 index 000000000..cceb17dd7 --- /dev/null +++ b/checklists/security_checklist.zh-Hant.json @@ -0,0 +1,1669 @@ +{ + "categories": [ + { + "name": "Defender For Cloud" + }, + { + "name": "Azure 網路" + }, + { + "name": "身份" + }, + { + "name": "虛擬機安全檢查" + }, + { + "name": "哨兵" + }, + { + "name": "Azure 防火牆" + } + ], + "items": [ + { + "category": "Defender For Cloud", + "guid": "54174158-33fb-43ae-9c2d-e743165c3acb", + "id": "A01.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", + "severity": "高", + "subcategory": "定價和設置", + "text": "在所有訂閱中啟用安全中心/Defender", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "349f0364-d28d-442e-abbb-c868255abc91", + "id": "A01.02", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "高", + "subcategory": "定價和設置", + "text": "在所有 Log Analytics 工作區上啟用安全中心/Defender", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "64e9a19a-e28c-484c-93b6-b7818ca0e6c4", + "id": "A01.03", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-data-collection?tabs=autoprovision-feature#what-event-types-are-stored-for-common-and-minimal", + "severity": "中等", + "subcategory": "定價和設置", + "text": "數據收集設置為“通用”", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "2149d414-a923-4c35-94d1-1029bd6aaf11", + "id": "A01.04", + "link": "https://learn.microsoft.com/azure/security-center/enable-azure-defender", + "severity": "高", + "subcategory": "定價和設置", + "text": "Defender for Cloud 增強的安全功能均已啟用", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "e6b84ee5-ef43-4d29-a248-1718d5d1f5f7", + "id": "A01.05", + "link": "https://learn.microsoft.com/azure/security-center/security-center-enable-data-collection", + "severity": "中等", + "subcategory": "定價和設置", + "text": "根據公司策略啟用自動預配（策略必須存在）", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "25759e35-680e-4782-9ac9-32213d027ff4", + "id": "A01.06", + "link": "https://learn.microsoft.com/azure/security-center/security-center-provide-security-contact-details", + "severity": "低", + "subcategory": "定價和設置", + "text": "根據公司策略啟用電子郵件通知（策略必須存在）", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "12f70993-0631-4583-9ee7-9d6c6d363206", + "id": "A01.07", + "link": "https://learn.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows", + "severity": "中等", + "subcategory": "定價和設置", + "text": "選擇啟用整合選項", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "5b7abae4-4aad-45e8-a79e-2e86667313c5", + "id": "A01.08", + "link": "https://learn.microsoft.com/azure/security-center/defender-for-container-registries-cicd", + "severity": "中等", + "subcategory": "定價和設置", + "text": "配置 CI/CD 集成", + "waf": "操作" + }, + { + "category": "Defender For Cloud", + "guid": "05675c5e-985b-4859-a774-f7e371623b87", + "id": "A01.09", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "高", + "subcategory": "定價和設置", + "text": "如果使用第三方 SIEM，則啟用連續導出“事件中心”", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "5a917e1f-349f-4036-9d28-d42e8bbbc868", + "id": "A01.10", + "link": "https://learn.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal", + "severity": "中等", + "subcategory": "定價和設置", + "text": "如果不使用 Azure Sentinel，則啟用連續匯出“Log Analytics 工作區”", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "255abc91-64e9-4a19-ae28-c84c43b6b781", + "id": "A01.11", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-aws?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "高", + "subcategory": "定價和設置", + "text": "為 AWS 啟用了 Cloud Connector", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "8ca0e6c4-2149-4d41-9a92-3c3574d11029", + "id": "A01.12", + "link": "https://learn.microsoft.com/azure/security-center/quickstart-onboard-gcp", + "severity": "高", + "subcategory": "定價和設置", + "text": "為 GCP 啟用了雲端連接器", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "cce9bdf6-b483-45a0-85ec-c8232b230652", + "id": "A01.13", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-integrate-with-microsoft-cloud-application-security", + "severity": "低", + "subcategory": "定價和設置", + "text": "如果使用 Azure AD 應用程式代理，請考慮與 Microsoft Defender for Cloud Apps 集成，以即時監視應用程式訪問並應用高級安全控制。", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "df9cc234-18db-4611-9126-5f4bb47a393a", + "id": "A02.01", + "link": "https://learn.microsoft.com/azure/security-center/secure-score-security-controls", + "severity": "中等", + "subcategory": "建議", + "text": "如果不需要，則修正或禁用所有建議。", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "description": "Microsoft 所有客戶的最低目標是 70%", + "guid": "08032729-4798-4b15-98a2-19a46ceb5443", + "id": "A02.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls", + "severity": "高", + "subcategory": "建議", + "text": "安全評分>70%", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "50259226-4429-42bb-9285-37a55119bf8e", + "id": "A03.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/tutorial-security-incident", + "severity": "中等", + "subcategory": "保安警報", + "text": "安全警報僅包含過去 24 小時內生成的警報（修正或禁用較舊的安全警報）", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "8f585428-7d9c-4dc1-96cd-072af9b141a8", + "id": "A04.01", + "link": "https://learn.microsoft.com/azure/security-center/custom-dashboards-azure-workbooks", + "severity": "中等", + "subcategory": "練習冊", + "text": "如果啟用了連續匯出，則預設工作簿將發佈到自定義安全儀錶板", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "98a535e7-3789-47e7-8ca7-da7be9962a15", + "id": "A05.01", + "link": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/bd-p/MicrosoftDefenderCloud", + "severity": "中等", + "subcategory": "社區", + "text": "客戶瞭解「社區」頁面的價值，並設置了定期的審核節奏", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "description": "客戶運營最佳實踐 - 透明度", + "guid": "93846da9-7cc3-4923-856b-22586f4a1641", + "id": "A06.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/enable-enhanced-security", + "severity": "高", + "subcategory": "安全分數", + "text": "顯示受安全中心保護的所有訂閱（未設定訂閱篩選器）", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "bdddea8a-487c-4deb-9861-bc3bc14aea6e", + "id": "A07.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-compliance-dashboard", + "severity": "高", + "subcategory": "法規遵從性", + "text": "對於任何必需的合規性要求，合規性控制都是綠色的", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "description": "客戶運營最佳實踐 - 驗證", + "guid": "65e8d9a3-aec2-418e-9436-b0736db55f57", + "id": "A08.01", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/remediate-vulnerability-findings-vm", + "severity": "高", + "subcategory": "Azure Defender", + "text": "高嚴重性 VM 漏洞為零（空）", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "9603334b-df9c-4c23-918d-b61171265f4b", + "id": "A09.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/azure-firewall-manager-is-now-integrated-with-azure-security/ba-p/2228679", + "severity": "中等", + "subcategory": "防火牆管理器", + "text": "中心受 Azure 防火牆保護", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "description": "客戶運營最佳實踐 - 驗證", + "guid": "b47a393a-0803-4272-a479-8b1578a219a4", + "id": "A09.02", + "link": "https://learn.microsoft.com/azure/security/fundamentals/network-best-practices", + "severity": "中等", + "subcategory": "防火牆管理器", + "text": "虛擬網路受防火牆保護", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "6ceb5443-5025-4922-9442-92bb628537a5", + "id": "A09.03", + "link": "https://azure.microsoft.com/blog/how-azure-security-center-detects-ddos-attack-using-cyber-threat-intelligence/", + "severity": "中等", + "subcategory": "防火牆管理器", + "text": "已啟用 DDoS 標準", + "waf": "安全" + }, + { + "category": "Defender For Cloud", + "guid": "5119bf8e-8f58-4542-a7d9-cdc166cd072a", + "id": "A10.01", + "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started?WT.mc_id=Portal-Microsoft_Azure_Security", + "severity": "高", + "subcategory": "覆蓋", + "text": "驗證是否涵蓋所有訂閱（請參閱要修改的定價和設置）", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "4df585ec-dce9-4793-a7bc-db3b51eb2eb0", + "id": "B01.01", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "高", + "subcategory": "公共IP", + "text": "具有公共IP的 VM 應受 NSG 保護", + "waf": "安全" + }, + { + "category": "Azure 網路", + "description": "客戶運營最佳實踐 - 驗證", + "guid": "3dda6e59-d7c8-4a2e-bb11-7d6769af669c", + "id": "B01.02", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-addresses", + "severity": "高", + "subcategory": "公共IP", + "text": "具有公共IP的 VM 將移到 Azure 防火牆高級版後面", + "waf": "安全" + }, + { + "category": "Azure 網路", + "description": "客戶運營最佳實踐 - 驗證", + "guid": "a48e5a85-f222-43ec-b8bb-12308ca5017f", + "id": "B01.03", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "severity": "高", + "subcategory": "公共IP", + "text": "不需要公共 IP 的 VM 沒有公共 IP（即僅限內部 RDP）", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "158e3ea3-a93c-42de-9e31-65c3a87a04b7", + "id": "B02.01", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "中等", + "subcategory": "核供應國集團", + "text": "NSG RBAC 用於限制對網路安全團隊的訪問", + "waf": "安全" + }, + { + "category": "Azure 網路", + "description": "客戶運營最佳實踐 - 驗證", + "guid": "a209939b-da47-4778-b24c-116785c2fa55", + "id": "B02.02", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "高", + "subcategory": "核供應國集團", + "text": "NSG 入站安全規則在「源」欄位中不包含 *（通配符）", + "waf": "安全" + }, + { + "category": "Azure 網路", + "description": "客戶運營最佳實踐 - 驗證", + "guid": "b56a9480-08be-47d7-b4c4-76b6d8bdcf59", + "id": "B02.03", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "中等", + "subcategory": "核供應國集團", + "text": "NSG 出站安全規則用於控制發往特定IP位址的流量，以防不通過防火牆路由的流量", + "waf": "安全" + }, + { + "category": "Azure 網路", + "description": "客戶運營最佳實踐 - 驗證", + "guid": "bce65de8-a13f-4988-9946-8d66a786d60f", + "id": "B02.04", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", + "severity": "高", + "subcategory": "核供應國集團", + "text": "NSG 沒有將源作為 *（通配符）就位。", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "a6c97be9-955d-404c-9c49-c986cb2d1215", + "id": "B02.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-nsg-manage-log", + "severity": "中等", + "subcategory": "核供應國集團", + "text": "NSG 診斷將 NetworkSecurityGroupEvent 和 NetworkSecurityGroupRuleCounter 流量發送到 Sentinel LAW", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "aa124b6e-4df5-485e-adce-9793b7bcdb3b", + "id": "B03.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "中等", + "subcategory": "UDR協定", + "text": "UDR RBAC 用於限制對網路安全團隊的訪問", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "51eb2eb0-3dda-46e5-ad7c-8a2edb117d67", + "id": "B03.02", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "高", + "subcategory": "UDR協定", + "text": "如果為零信任，則使用UDR將所有流量發送到Azure防火牆高級版", + "waf": "安全" + }, + { + "category": "Azure 網路", + "description": "客戶運營最佳實踐 - 驗證", + "guid": "69af669c-a48e-45a8-9f22-23ece8bb1230", + "id": "B03.03", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "中等", + "subcategory": "UDR協定", + "text": "不會將所有流量發送到 AzureFirewallPremium 的 UDR 是已知的，並記錄在案。", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "8ca5017f-158e-43ea-9a93-c2de7e3165c3", + "id": "B04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview#default", + "severity": "高", + "subcategory": "虛擬網路", + "text": "客戶熟悉 Azure 中的 Azure 網路預設值/SDN 預設路由", + "waf": "安全" + }, + { + "category": "Azure 網路", + "description": "客戶運營最佳實踐 - 驗證", + "guid": "a87a04b7-a209-4939-ada4-7778f24c1167", + "id": "B04.02", + "link": "https://github.com/MicrosoftDocs/azure-docs/issues/53672", + "severity": "中等", + "subcategory": "虛擬網路", + "text": "VNet RBAC 用於限制對網路安全團隊的訪問", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "85c2fa55-b56a-4948-808b-e7d7e4c476b6", + "id": "B04.03", + "link": "https://learn.microsoft.com/azure/virtual-network/policy-reference", + "severity": "高", + "subcategory": "虛擬網路", + "text": "VNet 安全建議已修正，並且沒有“有風險”的 VNet", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "d8bdcf59-bce6-45de-aa13-f98879468d66", + "id": "B04.04", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "severity": "高", + "subcategory": "虛擬網路", + "text": "瞭解 VNet 對等互連連接並記錄預期的流量", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "a786d60f-a6c9-47be-a955-d04c3c49c986", + "id": "B04.05", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview", + "severity": "高", + "subcategory": "虛擬網路", + "text": "VNet 服務終結點正在使用中，不存在舊版公共服務終結點", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "1f625659-ee55-480a-9824-9c931213dbd7", + "id": "B04.06", + "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview", + "severity": "高", + "subcategory": "虛擬網路", + "text": "VNet 專用終結點用於允許從本地環境進行訪問，不存在舊版公共終結點", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "fb012f70-943f-4630-9722-ea39d2b1ce63", + "id": "B04.07", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "高", + "subcategory": "虛擬網路", + "text": "已啟用 VNet 監視", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "2055b29b-ade4-4aad-8e8c-39ec94666731", + "id": "B04.08", + "link": "https://learn.microsoft.com/azure/virtual-network/kubernetes-network-policies", + "severity": "高", + "subcategory": "虛擬網路", + "text": "使用 Azure Kubernetes 服務 （AKS） 中的網路策略保護 Pod 之間的流量", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "3c005674-c1e9-445b-959c-373e7ed71623", + "id": "B04.09", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-scenario-udr-gw-nva", + "severity": "高", + "subcategory": "虛擬網路", + "text": "VNet NVA（設備）客戶遵循已發佈的體系結構模式", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "b375a917-ecbe-448f-ae64-dd7df2e8bbbc", + "id": "B04.10", + "link": "https://learn.microsoft.com/azure/virtual-network/monitor-virtual-network", + "severity": "高", + "subcategory": "虛擬網路", + "text": "VNet 診斷設置已啟用，並將 VMProtectionAlerts 發送到 Azure Sentinel LAW", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "468155ab-c916-44e9-a09a-ed8c44cf3b2b", + "id": "B05.01", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "severity": "高", + "subcategory": "連接", + "text": "使用 ExpressRoute 或 VPN 從本地環境訪問 Azure 資源", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "bd8ac2aa-ebca-42a4-9da1-dbf3dd992481", + "id": "B06.01", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "severity": "高", + "subcategory": "虛擬廣域網", + "text": "VWAN RBAC 用於限制對網路安全團隊的訪問", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "718d1dca-1f62-4565-aee5-580a38249c93", + "id": "B06.02", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-global-transit-network-architecture", + "severity": "高", + "subcategory": "虛擬廣域網", + "text": "VWAN 客戶正在使用 Secure Hub 或外部防火牆來路由和監控流量。", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "1213dbd7-fb01-42f7-8943-f6304722ea39", + "id": "B07.01", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "severity": "高", + "subcategory": "應用程式閘道", + "text": "AppGW RBAC 用於限制對網路安全團隊的訪問", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "d2b1ce63-2055-4b29-aade-4aad1e8c39ec", + "id": "B07.02", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "高", + "subcategory": "應用程式閘道", + "text": "AppGW 所有面向外部的 Web 服務都位於啟用了 WAF 的應用程式閘道後面", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "94666731-3c00-4567-9c1e-945b459c373e", + "id": "B07.03", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-front-end-ip", + "severity": "高", + "subcategory": "應用程式閘道", + "text": "AppGW 所有面向內部的 Web 服務都位於啟用了 WAF 的應用程式閘道後面", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "7ed71623-b375-4a91-9ecb-e48fbe64dd7d", + "id": "B07.04", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "severity": "高", + "subcategory": "應用程式閘道", + "text": "AppGW - 面向外部已啟用 TLS/SSL，並將所有流量重定向到 443（沒有埠 80 流量）", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "f2e8bbbc-4681-455a-ac91-64e9909aed8c", + "id": "B08.01", + "link": "https://learn.microsoft.com/azure/frontdoor/", + "severity": "高", + "subcategory": "前門", + "text": "Front Door RBAC 用於限制對網路安全團隊的訪問", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "44cf3b2b-3818-4baf-a2cf-2149d013a923", + "id": "B08.02", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/front-door-security-baseline?toc=/azure/frontdoor/TOC.json", + "severity": "高", + "subcategory": "前門", + "text": "Front Door 與 WAF 策略相關聯", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "ce574dcc-bd8a-4c2a-aebc-a2a44da1dbf3", + "id": "B08.03", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https", + "severity": "高", + "subcategory": "前門", + "text": "配置了 Front Door TLS/SSL 策略", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "dd992481-718d-41dc-a1f6-25659ee5580a", + "id": "B08.04", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-url-redirect", + "severity": "高", + "subcategory": "前門", + "text": "設定 Front Door 重定向埠 80 到埠 443（偵聽器）", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "38249c93-1213-4dbd-9fb0-12f70943f630", + "id": "B08.05", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-diagnostics", + "severity": "高", + "subcategory": "前門", + "text": "Front Door 診斷日誌將 ApplicationGatewayAccessLog 和 ApplicationGateway FirewallLog 發送到 Sentinel LAW", + "waf": "安全" + }, + { + "category": "Azure 網路", + "guid": "4722ea39-d2b1-4ce6-9205-5b29bade4aad", + "id": "B09.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "高", + "subcategory": "DDOS防護", + "text": "為防火牆公共IP（所有公共IP）啟用", + "waf": "安全" + }, + { + "category": "身份", + "guid": "346ad56f-bdb8-44db-8bcd-0a689af63f1e", + "id": "C01.01", + "link": "https://learn.microsoft.com/security/compass/identity#a-single-enterprise-directory", + "severity": "高", + "subcategory": "房客", + "text": "建立單一的企業目錄，用於管理全職員工的身份和企業資源。", + "waf": "安全" + }, + { + "category": "身份", + "guid": "a46108cd-6a76-4749-ae69-b7bf61410010", + "id": "C01.02", + "link": "https://learn.microsoft.com/security/compass/identity#synchronized-identity-systems", + "severity": "高", + "subcategory": "房客", + "text": "將雲標識與現有標識系統同步。", + "waf": "安全" + }, + { + "category": "身份", + "guid": "a1ab96ceb-c149-4ce2-bcad-3bd375ebfc7f", + "id": "C01.03", + "link": "https://learn.microsoft.com/security/compass/identity#cloud-provider-identity-source-for-third-parties", + "severity": "高", + "subcategory": "房客", + "text": "使用雲標識服務託管非員工帳戶，例如供應商、合作夥伴和客戶，而不是將它們包含在本地目錄中。", + "waf": "安全" + }, + { + "category": "身份", + "guid": "343473ec-ed5c-49e1-98f4-cb09524a23cd", + "id": "C01.04", + "link": "https://learn.microsoft.com/security/compass/identity#block-legacy-authentication", + "severity": "高", + "subcategory": "房客", + "text": "為面向 Internet 的服務禁用不安全的舊協定。", + "waf": "安全" + }, + { + "category": "身份", + "guid": "70dceb23-50c7-4d8d-bf53-8cc104c7dc44", + "id": "C01.05", + "link": "https://learn.microsoft.com/azure/security/fundamentals/identity-management-best-practices#enable-single-sign-on", + "severity": "高", + "subcategory": "房客", + "text": "啟用單點登錄", + "waf": "安全" + }, + { + "category": "身份", + "guid": "87791be1-1eb0-48ed-8003-ad9bcf241b99", + "id": "C02.01", + "link": "https://learn.microsoft.com/security/compass/identity#no-on-premises-admin-accounts-in-cloud-identity-providers", + "severity": "高", + "subcategory": "特權管理", + "text": "在將企業身份系統與雲目錄同步時，請勿將具有最高許可權訪問許可權的帳戶同步到本地資源。", + "waf": "安全" + }, + { + "category": "身份", + "guid": "9e6efe9d-f28f-463b-9bff-b5080173e9fe", + "id": "C02.02", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5", + "severity": "高", + "subcategory": "特權管理", + "text": "將全域管理員的數量限制為少於5個", + "waf": "安全" + }, + { + "category": "身份", + "guid": "e0d968d3-87f6-41fb-a4f9-d852f1673f4c", + "id": "C02.03", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#6-use-groups-for-azure-ad-role-assignments-and-delegate-the-role-assignment", + "severity": "高", + "subcategory": "特權管理", + "text": "使用組進行 Azure AD 角色分配並委派角色分配", + "waf": "安全" + }, + { + "category": "身份", + "guid": "00350863-4df6-4050-9cf1-cbaa6d58283e", + "id": "C02.04", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#managed-accounts-for-admins", + "severity": "高", + "subcategory": "特權管理", + "text": "確保所有關鍵影響管理員都由企業目錄管理，以遵循組織策略實施。", + "waf": "安全" + }, + { + "category": "身份", + "guid": "eae64d01-0d3a-4ae1-a89d-cc1c2ad3888f", + "id": "C02.05", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices#4-configure-recurring-access-reviews-to-revoke-unneeded-permissions-over-time", + "severity": "高", + "subcategory": "特權管理", + "text": "配置定期訪問評審以隨時間推移撤消不需要的許可權", + "waf": "安全" + }, + { + "category": "身份", + "guid": "922ac19f-916d-4697-b8ea-ded26bdd186f", + "id": "C02.06", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-admins#admin-workstation-security", + "severity": "中等", + "subcategory": "特權管理", + "text": "確保關鍵影響管理員使用具有高級安全保護和監控功能的工作站", + "waf": "安全" + }, + { + "category": "身份", + "guid": "1e8c39ec-9466-4673-83c0-05674c1e945b", + "id": "C03.01", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/compare-with-b2c", + "severity": "高", + "subcategory": "外部標識", + "text": "身份提供程序：驗證外部身份提供程式是否已知", + "waf": "安全" + }, + { + "category": "身份", + "guid": "459c373e-7ed7-4162-9b37-5a917ecbe48f", + "id": "C03.02", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "高", + "subcategory": "外部標識", + "text": "外部協作設置：訪客使用者訪問許可權設置為「訪客使用者訪問許可權受到限制？", + "waf": "安全" + }, + { + "category": "身份", + "guid": "be64dd7d-f2e8-4bbb-a468-155abc9164e9", + "id": "C03.03", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "高", + "subcategory": "外部標識", + "text": "外部協作設置：訪客邀請設置設置為“僅分配給特定管理員角色的使用者”", + "waf": "安全" + }, + { + "category": "身份", + "guid": "909aed8c-44cf-43b2-a381-8bafa2cf2149", + "id": "C03.04", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "高", + "subcategory": "外部標識", + "text": "外部協作設置：通過設置為「已禁用」的流啟用訪客自助註冊", + "waf": "安全" + }, + { + "category": "身份", + "guid": "d013a923-ce57-44dc-abd8-ac2aaebca2a4", + "id": "C03.05", + "link": "https://learn.microsoft.com/azure/active-directory/external-identities/delegate-invitations", + "severity": "高", + "subcategory": "外部標識", + "text": "外部協作設置：協作限制設置為“允許向指定域發出邀請”", + "waf": "安全" + }, + { + "category": "身份", + "guid": "4da1dbf3-dd99-4248-8718-d1dca1f62565", + "id": "C03.06", + "link": "https://learn.microsoft.com/azure/active-directory/governance/deploy-access-reviews", + "severity": "中等", + "subcategory": "外部標識", + "text": "訪問評審：為所有組啟用", + "waf": "安全" + }, + { + "category": "身份", + "guid": "9ee5580a-3824-49c9-9121-3dbd7fb012f7", + "id": "C04.01", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent", + "severity": "中等", + "subcategory": "企業應用程式", + "text": "同意和許可權：允許使用者同意來自經過驗證的發佈者的應用", + "waf": "安全" + }, + { + "category": "身份", + "guid": "0943f630-4722-4ea3-ad2b-1ce632055b29", + "id": "C04.02", + "link": "https://learn.microsoft.com/azure/active-directory/manage-apps/configure-user-consent-groups", + "severity": "中等", + "subcategory": "企業應用程式", + "text": "同意和許可權：允許組擁有者對選定的組擁有者進行同意", + "waf": "安全" + }, + { + "category": "身份", + "guid": "bade4aad-1e8c-439e-a946-667313c00567", + "id": "C05.01", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy-configure-custom-domain", + "severity": "高", + "subcategory": "自訂域", + "text": "僅註冊經過驗證的客戶域", + "waf": "安全" + }, + { + "category": "身份", + "guid": "4c1e945b-459c-4373-b7ed-71623b375a91", + "id": "C06.01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-sspr", + "severity": "高", + "subcategory": "密碼重置", + "text": "驗證符合自助服務密碼重置策略要求。", + "waf": "安全" + }, + { + "category": "身份", + "guid": "7ecbe48f-be64-4dd7-bf2e-8bbbc468155a", + "id": "C06.02", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "中等", + "subcategory": "密碼重置", + "text": "在要求使用者重新確認身份驗證資訊之前設置的天數未設置為零", + "waf": "安全" + }, + { + "category": "身份", + "guid": "bc9164e9-909a-4ed8-a44c-f3b2b3818baf", + "id": "C06.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/howto-sspr-deployment", + "severity": "高", + "subcategory": "密碼重置", + "text": "選擇重置密碼所需的設置方法數", + "waf": "安全" + }, + { + "category": "身份", + "guid": "a2cf2149-d013-4a92-9ce5-74dccbd8ac2a", + "id": "C07.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/delegate-app-roles", + "severity": "高", + "subcategory": "用戶設置", + "text": "禁用「用戶可以註冊應用程式」", + "waf": "安全" + }, + { + "category": "身份", + "guid": "aebca2a4-4da1-4dbf-9dd9-92481718d1dc", + "id": "C07.02", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/users-default-permissions", + "severity": "高", + "subcategory": "用戶設置", + "text": "將對管理門戶 （portal.azure.com） 的訪問限制為僅管理員", + "waf": "安全" + }, + { + "category": "身份", + "guid": "a1f62565-9ee5-4580-a382-49c931213dbd", + "id": "C07.03", + "link": "https://learn.microsoft.com/azure/active-directory/enterprise-users/linkedin-integration", + "severity": "高", + "subcategory": "用戶設置", + "text": "禁用“LinkedIn帳戶連接”", + "waf": "安全" + }, + { + "category": "身份", + "guid": "7fb012f7-0943-4f63-8472-2ea39d2b1ce6", + "id": "C08.01", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-monitoring", + "severity": "高", + "subcategory": "診斷設置", + "text": "使用 Sentinel 啟用併發送到 Log Analytics 工作區", + "waf": "安全" + }, + { + "category": "身份", + "guid": "21e44a19-a9dd-4399-afd7-b28dc8355562", + "id": "C09.01", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan", + "severity": "高", + "subcategory": "已啟用 PIM", + "text": "已啟用 Privileged Identity Management", + "waf": "安全" + }, + { + "category": "身份", + "guid": "46f4389a-7f42-4c78-b78c-06a63a21a495", + "id": "C09.02", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc", + "severity": "高", + "subcategory": "已啟用 PIM", + "text": "實現「即時」（JIT） 訪問，以進一步降低特權帳戶的暴露時間（減少長期訪問）", + "waf": "安全" + }, + { + "category": "身份", + "guid": "6e6a8dc4-a20e-427b-9e29-711b1352beee", + "id": "C10.01", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common", + "severity": "高", + "subcategory": "條件訪問策略", + "text": "配置條件訪問策略/訪問控制", + "waf": "安全" + }, + { + "category": "身份", + "guid": "079b588d-efc4-4972-ac3c-d21bf77036e5", + "id": "C10.02", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition", + "severity": "中等", + "subcategory": "條件訪問策略", + "text": "條件：受限地點", + "waf": "安全" + }, + { + "category": "身份", + "guid": "e6b4bed3-d5f3-4547-a134-7dc56028a71f", + "id": "C10.03", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/tutorial-enable-azure-mfa", + "severity": "高", + "subcategory": "條件訪問策略", + "text": "訪問控制：為所有用戶啟用 MFA", + "waf": "安全" + }, + { + "category": "身份", + "guid": "fe1bd15d-d2f0-4d5e-972d-41e3611cc57b", + "id": "C10.04", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa", + "severity": "中等", + "subcategory": "條件訪問策略", + "text": "訪問控制：要求管理員進行 MFA", + "waf": "安全" + }, + { + "category": "身份", + "guid": "4a4b1410-d439-4589-ac22-89b3d6b57cfc", + "id": "C10.05", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-azure-management", + "severity": "高", + "subcategory": "條件訪問策略", + "text": "訪問控制：需要 MFA 才能進行 Azure 管理", + "waf": "安全" + }, + { + "category": "身份", + "guid": "645461e1-a3e3-4453-a3c8-639637a552d6", + "id": "C10.06", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy", + "severity": "高", + "subcategory": "條件訪問策略", + "text": "訪問控制：阻止傳統協定", + "waf": "安全" + }, + { + "category": "身份", + "guid": "7ae9eab4-0fd3-4290-998b-c178bdc5a06c", + "id": "C10.07", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/require-managed-devices", + "severity": "高", + "subcategory": "條件訪問策略", + "text": "訪問控制：要求將設備標記為合規", + "waf": "安全" + }, + { + "category": "身份", + "description": "客戶記錄在案的策略", + "guid": "a7144351-e19d-4d34-929e-b7228137a151", + "id": "C11.01", + "link": "https://devblogs.microsoft.com/premier-developer/azure-active-directory-automating-guest-user-management/", + "severity": "中等", + "subcategory": "來賓使用者", + "text": "是否有跟蹤來賓用戶帳戶的策略（即使用/刪除/禁用）？", + "waf": "安全" + }, + { + "category": "身份", + "guid": "c5bb4e4f-1814-4287-b5ca-8c26c9b32ab5", + "id": "C12.01", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/identity-secure-score", + "severity": "高", + "subcategory": "身份安全分數", + "text": "根據行業中的最佳實踐實施身份安全功能分數", + "waf": "安全" + }, + { + "category": "身份", + "guid": "bcfc6998-a135-4e33-9897-e31c67d68cb6", + "id": "C13.01", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "severity": "中等", + "subcategory": "Break Glass 帳戶", + "text": "至少已經創建了兩個打破玻璃的帳戶，並且存在有關其使用的政策", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "0ac252b9-99a6-48af-a7c9-a8f821b8eb8c", + "id": "D01.01", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "severity": "高", + "subcategory": "存取控制", + "text": "利用 Azure Policy 控制 VM 訪問", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "0aa77e26-e4d5-4aea-a8dc-4e2436bc336d", + "id": "D01.02", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/templates/syntax", + "severity": "中等", + "subcategory": "存取控制", + "text": "利用範本減少 VM 設置和部署中的可變性", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "b5945bda-4333-44fd-b91c-234182b65275", + "id": "D01.03", + "link": "https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models", + "severity": "中等", + "subcategory": "存取控制", + "text": "通過治理減少對資源的訪問許可權，從而保護部署 VMS 的特權訪問許可權", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "269440b4-be3d-43e0-a432-76d4bdc015bc", + "id": "D02.01", + "link": "https://learn.microsoft.com/azure/architecture/checklist/resiliency-per-service", + "severity": "中等", + "subcategory": "高可用性", + "text": "對工作負載使用多個 VM 以提高可用性", + "waf": "可靠性" + }, + { + "category": "虛擬機安全檢查", + "guid": "f219e4a1-eb58-4879-935d-227886d30b66", + "id": "D02.02", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-first-look-arm", + "severity": "中等", + "subcategory": "高可用性", + "text": "部署和測試災難恢復解決方案", + "waf": "可靠性" + }, + { + "category": "虛擬機安全檢查", + "guid": "c57be595-1900-4838-95c5-86cb291ec16a", + "id": "D02.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "severity": "中等", + "subcategory": "高可用性", + "text": "可用性集", + "waf": "可靠性" + }, + { + "category": "虛擬機安全檢查", + "guid": "1d076ef9-f141-4acd-ae57-9377bcdb3751", + "id": "D02.04", + "link": "https://learn.microsoft.com/azure/availability-zones/az-overview?context=/azure/virtual-machines/context/context", + "severity": "中等", + "subcategory": "高可用性", + "text": "可用區", + "waf": "可靠性" + }, + { + "category": "虛擬機安全檢查", + "guid": "ab2ac1fa-d66e-415d-9d5a-2adb2c3e2326", + "id": "D02.05", + "link": "https://learn.microsoft.com/azure/architecture/resiliency/recovery-loss-azure-region", + "severity": "中等", + "subcategory": "高可用性", + "text": "區域容錯", + "waf": "可靠性" + }, + { + "category": "虛擬機安全檢查", + "guid": "af225ca4-4e16-496f-bdde-ace4cb1deb4c", + "id": "D03.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/antimalware", + "severity": "高", + "subcategory": "防範惡意軟體", + "text": "安裝反惡意軟體解決方案", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "650c3fc1-4eeb-4b36-a382-9e3eec218368", + "id": "D03.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "高", + "subcategory": "防範惡意軟體", + "text": "將反惡意軟體解決方案與安全中心集成", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "7a0177a2-b594-45bd-a433-34fdf91c2341", + "id": "D04.01", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "severity": "高", + "subcategory": "管理 VM 更新", + "text": "使用 Azure 自動化的更新管理使 VM 保持最新狀態", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "c6fa96b9-6ad8-4840-af37-2734c876ba28", + "id": "D04.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/automatic-vm-guest-patching", + "severity": "中等", + "subcategory": "管理 VM 更新", + "text": "確保用於部署的 Windows 映像具有最新級別的更新", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "02145901-465d-438e-9309-ccbd979266bc", + "id": "D04.03", + "link": "https://learn.microsoft.com/azure/security-center/asset-inventory", + "severity": "高", + "subcategory": "管理 VM 更新", + "text": "使用 Microsoft Defender for Cloud 快速將安全更新應用於 VM", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "ca274faa-19bf-439d-a5d4-4c7c8919ca1f", + "id": "D05.01", + "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", + "severity": "高", + "subcategory": "加密 VHD", + "text": "在 VM 上啟用加密", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "6d5315ae-524b-4a34-b458-5e12139bd7bb", + "id": "D05.02", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/disk-encryption-key-vault#set-up-a-key-encryption-key-kek", + "severity": "高", + "subcategory": "加密 VHD", + "text": "添加金鑰加密金鑰 （KEK） 以增加加密安全層", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "012f7b95-e06e-4154-b2aa-3592828e6e20", + "id": "D05.03", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk", + "severity": "中等", + "subcategory": "加密 VHD", + "text": "在加密之前拍攝磁碟快照以進行回滾", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "5173676a-e466-491e-a835-ad942223e138", + "id": "D06.01", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "severity": "高", + "subcategory": "限制直接 Internet 連接", + "text": "確保只有中央網路組才有權訪問網路資源", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "10523081-a941-4741-9833-ff7ad7c6d373", + "id": "D06.02", + "link": "https://learn.microsoft.com/azure/security-center/security-center-partner-integration", + "severity": "高", + "subcategory": "限制直接 Internet 連接", + "text": "標識並修正允許從「ANY」源 IP 位址訪問的公開 VM", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "75a91be1-f388-4f03-a4d2-cd463cbbbc86", + "id": "D06.03", + "link": "https://learn.microsoft.com/azure/security-center/security-center-just-in-time", + "severity": "高", + "subcategory": "限制直接 Internet 連接", + "text": "使用即時存取限制管理埠（RDP、SSH）", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "8295abc9-1a4e-4da0-bae2-cc84c47b6b78", + "id": "D06.04", + "link": "http://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", + "severity": "高", + "subcategory": "限制直接 Internet 連接", + "text": "刪除 Internet 訪問並實現 RDP 跳轉伺服器", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "1cbafe6c-4658-49d4-98a9-27c3974d1102", + "id": "D06.05", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-forced-tunneling", + "severity": "高", + "subcategory": "限制直接 Internet 連接", + "text": "從互聯網上刪除使用 RDP/SSH 直接登錄伺服器並實施 VPN 或快速路由", + "waf": "安全" + }, + { + "category": "虛擬機安全檢查", + "guid": "dad6aae1-1e6b-484e-b5df-47d2d92881b1", + "id": "D06.06", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "severity": "高", + "subcategory": "限制直接 Internet 連接", + "text": "利用 Azure Bastion 作為 RDP/SSH 代理，提高安全性並減少佔用空間", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "cd5d1e54-a297-459e-9968-0e78289c9356", + "id": "E01.01", + "link": "https://learn.microsoft.com/azure/sentinel/quickstart-onboard", + "severity": "高", + "subcategory": "建築", + "text": "所有租戶都包含至少在一個Log Analytics工作區上啟用了Sentinel", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "57d02bff-4564-4b0d-a34a-359836ee79d6", + "id": "E01.02", + "link": "https://learn.microsoft.com/azure/sentinel/best-practices-workspace-architecture", + "severity": "高", + "subcategory": "建築", + "text": "客戶瞭解 Sentinel 架構", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "e8f5c586-c7d9-4cdc-86ac-c075ef9b141a", + "id": "E01.03", + "link": "https://learn.microsoft.com/azure/sentinel/multiple-workspace-view", + "severity": "中等", + "subcategory": "建築", + "text": "客戶知道如何跨多個 Sentinel 實例監控事件", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "8989579e-76b8-497e-910a-7da7be9966e1", + "id": "E02.01", + "link": "https://learn.microsoft.com/azure/sentinel/manage-soc-with-incident-metrics", + "severity": "中等", + "subcategory": "概述", + "text": "沒有事件開放超過24小時", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "5d3c4ada-97cb-43d1-925a-b225c6f4e068", + "id": "E03.01", + "link": "https://learn.microsoft.com/azure/sentinel/whats-new", + "severity": "低", + "subcategory": "新聞 & 指南", + "text": "客戶已看到「新聞和指南」選項卡", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "5edddea8-a4b7-4cde-a4c6-1fc3fc14eea6", + "id": "E04.01", + "link": "https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics", + "severity": "中等", + "subcategory": "UEBA", + "text": "UEBA 已配置 （Sentinel/Settings/Settings/Configure UEBA）", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "e69d8d9a-3eec-4218-b687-ab077adb49e5", + "id": "E05.01", + "link": "https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory", + "severity": "高", + "subcategory": "數據連接器", + "text": "Azure Active Directory 已配置，並且“上次收到的日誌”今天顯示", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "b9603334-fdf8-4cc2-9318-db61171269f4", + "id": "E05.02", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-active-directory-identity-protection", + "severity": "高", + "subcategory": "數據連接器", + "text": "Azure Active Directory Identity Protection 已配置，今天將顯示“上次收到的日誌”", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "0b4aa3d3-e070-4327-9d4b-98b15b8a219a", + "id": "E05.03", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-activity", + "severity": "高", + "subcategory": "數據連接器", + "text": "Azure 活動已配置，今天顯示“上次收到的日誌”", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "8e13f9cc-bd46-4826-9abc-a264f9a19bfe", + "id": "E05.04", + "link": "https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud", + "severity": "高", + "subcategory": "數據連接器", + "text": "Microsoft Defender for Cloud已配置，今天顯示“上次收到的日誌”", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "9d55d04c-3c49-419c-a1b2-d1215ae114b9", + "id": "E05.05", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#azure-firewall", + "severity": "高", + "subcategory": "數據連接器", + "text": "Azure 防火牆已配置，今天顯示“上次收到的日誌”", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "34df585e-cccd-49bd-9ba0-cdb3b54eb2eb", + "id": "E05.06", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-firewall", + "severity": "高", + "subcategory": "數據連接器", + "text": "Windows 防火牆已配置，今天顯示“上次收到日誌”", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "03ddaa25-9271-48d2-bdb1-0725769ef669", + "id": "E05.07", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference#windows-security-events-via-ama", + "severity": "高", + "subcategory": "數據連接器", + "text": "安全事件配置了 AMA，並且「上次收到日誌」今天顯示", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "1a4834ac-9322-423e-ae80-b123081a5417", + "id": "E05.08", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "高", + "subcategory": "數據連接器", + "text": "安全事件 - 驗證 Azure 電腦是否已連接並將數據發送到工作區", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "859c773e-7e26-4162-9b77-5a917e1f348e", + "id": "E05.09", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "高", + "subcategory": "數據連接器", + "text": "安全事件 - 驗證非 Azure 電腦是否已連接並將數據發送到工作區", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "f354c27d-42e8-4bba-a868-155abb9163e9", + "id": "E05.10", + "link": "https://learn.microsoft.com/azure/sentinel/connect-aws?tabs=s3", + "severity": "高", + "subcategory": "數據連接器", + "text": "適用於 AWS 的連接器", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "909ae28c-84c3-43b6-a780-8bafe6c42149", + "id": "E05.11", + "link": "https://learn.microsoft.com/azure/sentinel/data-connectors-reference", + "severity": "高", + "subcategory": "數據連接器", + "text": "GCP 連接器", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "d413a923-c357-44d1-8028-ac6aae01e6a8", + "id": "E06.01", + "link": "https://learn.microsoft.com/azure/sentinel/detect-threats-built-in", + "severity": "高", + "subcategory": "分析規則", + "text": "客戶已啟用 Analytics 規則並配置了事件", + "waf": "安全" + }, + { + "category": "哨兵", + "guid": "4de5df43-d299-4248-8718-d5d1e5f62565", + "id": "E07.01", + "link": "https://azure.microsoft.com/updates/controlling-data-volume-and-retention-in-log-analytics-2/", + "severity": "中等", + "subcategory": "設置", + "text": "客戶未啟用每日上限", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "9e3558fd-7724-49c9-9111-2d027fe412f7", + "id": "F01.01", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "severity": "高", + "subcategory": "配置", + "text": "已部署 Azure 防火牆高級版", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "4dc74a74-8b66-433a-b2a0-916a764980ad", + "id": "F01.02", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal#create-a-default-route", + "severity": "高", + "subcategory": "配置", + "text": "通過 Azure 防火牆啟用四重零/強制優化", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "0e278ee2-93c1-4bc3-92ba-aab7571849ab", + "id": "F02.01", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "中等", + "subcategory": "存取控制", + "text": "RBAC 設定為僅啟用授權使用者", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "8093dc9f-c9d1-4bb7-9b36-a5a67fbb9ed5", + "id": "F03.01", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "severity": "中等", + "subcategory": "診斷設置", + "text": "已啟用診斷並將指標發送到Log Analytics工作區", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "b35478c3-4798-416b-8863-cffe1cac599e", + "id": "F04.01", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "中心和虛擬網路通過防火牆高級版進行保護或連接", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "f0d5a73d-d4de-436c-8c81-770afbc4c0e4", + "id": "F04.02", + "link": "https://techcommunity.microsoft.com/t5/azure-network-security/role-based-access-control-for-azure-firewall/ba-p/2245598", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "策略：設定存取控制 （RBAC）", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "5c3a87af-4a79-41f8-a39b-da47768e14c1", + "id": "F04.03", + "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "策略：已配置父策略", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "15675c1e-a55b-446a-a48f-f8ae7d7e4b47", + "id": "F04.04", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "策略：定義規則集合", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "5b6c8bcb-f59b-4ce6-9de8-a03f97879468", + "id": "F04.05", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "策略：定義DNAT策略", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "d66a786d-60e9-46c9-9ad8-855d04c2b39c", + "id": "F04.06", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "策略：定義網路規則", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "986bb2c1-2149-4a11-9b5e-3df574ecccd9", + "id": "F04.07", + "link": "https://learn.microsoft.com/azure/firewall/features", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "策略：定義應用程式規則", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "793a6bcd-a3b5-40eb-8eb0-3dd95d58d7c8", + "id": "F04.08", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "severity": "中等", + "subcategory": "防火牆管理器", + "text": "DNS：已理解並應用或未應用的功能", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "d622f54b-29ba-4de3-aad1-e8c28ec93666", + "id": "F04.09", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "威脅情報：設置為“警報和拒絕”", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "7313b005-674b-41e9-94a4-59c373e7ed61", + "id": "F04.10", + "link": "https://learn.microsoft.com/azure/firewall-manager/threat-intelligence-settings#allowlist-addresses", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "威脅情報：允許清單（證明它們是否被使用-即性能）", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "623b365a-917e-4cbe-98eb-d54cd7df2e8b", + "id": "F04.11", + "link": "https://learn.microsoft.com/azure/firewall/premium-certificates", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "已啟用 TLS", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "bac35715-59ab-4915-9e99-08aed8c44ce3", + "id": "F04.12", + "link": "https://learn.microsoft.com/azure/firewall/rule-processing", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "已啟用IDPS", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "b2b3808b-9fa1-4cf1-849d-003a923ce474", + "id": "F04.13", + "link": "https://learn.microsoft.com/azure/firewall/snat-private-range", + "severity": "高", + "subcategory": "防火牆管理器", + "text": "SNAT：已配置", + "waf": "安全" + }, + { + "category": "Azure 防火牆", + "guid": "dbcbd8ac-2aae-4bca-8a43-da1dae2cc992", + "id": "F05.01", + "link": "https://learn.microsoft.com/azure/security/fundamentals/ddos-best-practices", + "severity": "中等", + "subcategory": "DDOS防護", + "text": "為防火牆公共IP啟用", + "waf": "安全" + } + ], + "metadata": { + "name": "Azure Security Review Checklist", + "state": "Deprecated", + "timestamp": "June 24, 2024" + }, + "severities": [ + { + "name": "高" + }, + { + "name": "中等" + }, + { + "name": "低" + } + ], + "status": [ + { + "description": "此檢查尚未查看", + "name": "未驗證" + }, + { + "description": "有一個與此檢查關聯的操作項", + "name": "打開" + }, + { + "description": "此檢查已通過驗證，並且沒有與之關聯的進一步操作項", + "name": "實現" + }, + { + "description": "建議已理解，但當前需求不需要", + "name": "不需要" + }, + { + "description": "不適用於當前設計", + "name": "不適用" + } + ], + "waf": [ + { + "name": "可靠性" + }, + { + "name": "安全" + }, + { + "name": "成本" + }, + { + "name": "操作" + }, + { + "name": "性能" + } + ], + "yesno": [ + { + "name": "是的" + }, + { + "name": "不" + } + ] +} \ No newline at end of file diff --git a/checklists/waf_checklist.en.json b/checklists/waf_checklist.en.json index ac84630b8..b4a1fa66a 100644 --- a/checklists/waf_checklist.en.json +++ b/checklists/waf_checklist.en.json @@ -1,9103 +1,9103 @@ { "items": [ { - "checklist": "Azure Container Registry Security Review", - "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.", - "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e", - "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention", - "service": "ACR", - "severity": "High", - "text": "Disable Azure Container Registry image export", - "waf": "Security" + "checklist": "Cognitive Services Review Checklist", + "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx", + "service": "Cognitive Services", + "severity": "Medium", + "text": "Leverage FTA HandBook for Cognitive Services", + "waf": "Reliability" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry", - "guid": "d503547c-d447-4e82-9128-a7100f1cac6d", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy", - "service": "ACR", - "severity": "High", - "text": "Enable Azure Policies for Azure Container Registry", - "waf": "Security" + "checklist": "Cognitive Services Review Checklist", + "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5", + "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions", + "service": "Cognitive Services", + "severity": "Medium", + "text": "Backup Your Prompts", + "waf": "Reliability" }, { - "checklist": "Azure Container Registry Security Review", - "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.", - "guid": "d345293c-7639-4637-a551-c5c04e401955", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push", - "service": "ACR", + "checklist": "Cognitive Services Review Checklist", + "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5", + "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery", + "service": "Cognitive Services", "severity": "High", - "text": "Sign and Verify containers with notation (Notary v2)", - "waf": "Security" + "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service", + "waf": "Reliability" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.", - "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49", - "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys", - "service": "ACR", + "checklist": "Cognitive Services Review Checklist", + "guid": "325af625-ca44-4e46-a5e2-223ace8bb123", + "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations", + "service": "Cognitive Services", "severity": "Medium", - "text": "Encrypt registry with a customer managed key", - "waf": "Security" + "text": "Backup Your ChatGPT conversations", + "waf": "Reliability" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications", - "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", - "service": "ACR", - "severity": "High", - "text": "Use Managed Identities to connect instead of Service Principals", - "waf": "Security" + "checklist": "Cognitive Services Review Checklist", + "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618", + "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment", + "service": "Cognitive Services", + "severity": "Medium", + "text": "CI/CD for custom speech", + "waf": "Reliability" }, { - "checklist": "Azure Container Registry Security Review", - "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead", - "guid": "be0e38ce-e297-411b-b363-caaab79b198d", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", - "service": "ACR", - "severity": "High", - "text": "Disable local authentication for management plane access", - "waf": "Security" + "checklist": "Cognitive Services Review Checklist", + "guid": "3687a046-7a1f-4893-9bda-43324f248116", + "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base", + "service": "Cognitive Services", + "severity": "Low", + "text": "Move a knowledge base using export-import", + "waf": "Reliability" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations", - "guid": "387e5ced-126c-4d13-8af5-b20c6998a646", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli", - "service": "ACR", - "severity": "High", - "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals", - "waf": "Security" + "checklist": "Azure Landing Zone Review", + "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", + "service": "Entra", + "severity": "Medium", + "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.", + "waf": "Operations" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Disable anonymous pull/push access", - "guid": "e338997e-41c7-47d7-acf6-a62a1194956d", - "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access", - "service": "ACR", + "checklist": "Azure Landing Zone Review", + "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Entra", + "severity": "Low", + "text": "Ensure you have a Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants", + "waf": "Operations" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "Entra", + "severity": "Low", + "text": "Leverage Azure Lighthouse for Multi-Tenant Management", + "waf": "Operations" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Entra", "severity": "Medium", - "text": "Disable Anonymous pull access", - "waf": "Security" + "text": "Ensure that Azure Lighthouse is used for administering the tenant by partner", + "waf": "Cost" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token", - "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli", - "service": "ACR", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "348ef254-c27d-442e-abba-c7571559ab91", + "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", + "service": "Entra", "severity": "High", - "text": "Disable repository-scoped access tokens", + "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Security" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network", - "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee", - "service": "ACR", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", + "service": "Entra", "severity": "High", - "text": "Deploy images from a trusted environment", + "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "Security" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR", - "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy", - "service": "ACR", + "checklist": "Azure Landing Zone Review", + "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "Entra", "severity": "Medium", - "text": "Disable Azure ARM audience tokens for authentication", + "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "Security" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.", - "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6", - "link": "https://learn.microsoft.com/azure/container-registry/monitor-service", - "service": "ACR", - "severity": "Medium", - "text": "Enable diagnostics logging", + "checklist": "Azure Landing Zone Review", + "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", + "service": "Entra", + "severity": "Low", + "text": "Enforce Microsoft Entra ID conditional-access policies for any user with rights to Azure environments", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", "waf": "Security" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch", - "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", - "service": "ACR", - "severity": "Medium", - "text": "Control inbound network access with Private Link", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", + "service": "Entra", + "severity": "High", + "text": "Enforce multi-factor authentication for any user with rights to the Azure environments", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", "waf": "Security" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Disable public network access if inbound network access is secured using Private Link", - "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access", - "service": "ACR", + "checklist": "Azure Landing Zone Review", + "guid": "14658d35-58fd-4772-99b8-21112df27ee4", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "Entra", "severity": "Medium", - "text": "Disable Public Network access", + "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Only the ACR Premium SKU supports Private Link access", - "guid": "fc833934-8b26-42d6-ac5f-512925498f6d", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus", - "service": "ACR", + "checklist": "Azure Landing Zone Review", + "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "Entra", "severity": "Medium", - "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)", - "waf": "Security" - }, - { - "checklist": "Azure Container Registry Security Review", - "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities", - "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", - "service": "ACR", - "severity": "Low", - "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities", + "text": "If planning to switch from Active Directory Domain Serivces to Entra domain services, evaluate the compatibility of all workloads", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", "waf": "Security" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", - "guid": "4451e1a2-d345-4293-a763-9637a551c5c0", - "service": "ACR", + "checklist": "Azure Landing Zone Review", + "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", + "service": "Entra", "severity": "Medium", - "text": "Deploy validated container images", + "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.", "waf": "Security" }, { - "checklist": "Azure Container Registry Security Review", - "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", - "guid": "4e401955-387e-45ce-b126-cd132af5b20c", - "service": "ACR", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "984a859c-773e-47d2-9162-3a765a917e1f", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "service": "Entra", "severity": "High", - "text": "Use up-to-date platforms, languages, protocols and frameworks", + "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", - "service": "Azure Data Factory", + "checklist": "Azure Landing Zone Review", + "guid": "35037e68-9349-4c15-b371-228514f4cdff", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "Entra", "severity": "Medium", - "text": "Leverage FTA Resiliency Playbook for Azure Data Factory", - "waf": "Reliability" + "text": "Avoid using on-premises synced accounts for Microsoft Entra ID role assignments.", + "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", + "waf": "Security" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", - "severity": "High", - "text": "Use zone redundant pipelines in regions that support Availability Zones", - "waf": "Reliability" + "checklist": "Azure Landing Zone Review", + "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Entra", + "severity": "Medium", + "text": "Where required, use Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications (hosted in the cloud or on-premises).", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Security" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", - "link": "https://learn.microsoft.com/azure/data-factory/source-control", - "service": "Azure Data Factory", + "checklist": "Azure Landing Zone Review", + "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", + "service": "VNet", "severity": "Medium", - "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ", - "waf": "Reliability" + "text": "Leverage a network design based on the traditional hub-and-spoke network topology for network scenarios that require maximum flexibility.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", + "service": "VNet", + "severity": "High", + "text": "Ensure that shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS servers.", + "waf": "Cost" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "VNet", "severity": "Medium", - "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ", - "waf": "Reliability" + "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "checklist": "Azure Landing Zone Review", + "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "severity": "Medium", - "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region", + "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance", "waf": "Reliability" }, { - "checklist": "Azure Data Factory Review Checklist", - "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you", - "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Azure Data Factory", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", + "service": "ExpressRoute", "severity": "Low", - "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity", - "waf": "Reliability" + "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.", + "waf": "Security" }, { - "checklist": "Azure Data Explorer Review Checklist", - "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage", - "guid": "ba7da7be-9951-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export", - "service": "Azure Data Explorer", - "text": "Leverage External Tables and Continuous data export overview to reduce costs", - "waf": "Reliability" + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", + "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", + "service": "ARS", + "severity": "Low", + "text": "If using Route Server, use a /27 prefix for the Route Server subnet.", + "waf": "Security" }, { - "checklist": "Azure Data Explorer Review Checklist", - "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.", - "guid": "56a22586-f490-4641-addd-ea8a377cdeb3", - "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp", - "service": "Azure Data Explorer", - "text": "To share data, explore Leader-follower cluster configuration", - "waf": "Reliability" + "checklist": "Azure Landing Zone Review", + "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", + "service": "VNet", + "severity": "Medium", + "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", + "waf": "Performance" }, { - "checklist": "Azure Data Explorer Review Checklist", - "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.", - "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters", - "service": "Azure Data Explorer", - "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions", - "waf": "Reliability" + "checklist": "Azure Landing Zone Review", + "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", + "service": "VNet", + "severity": "Medium", + "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "waf": "Operations" }, { - "checklist": "Azure Data Explorer Review Checklist", - "guid": "436b0635-cb45-4e57-a603-324ace8cc123", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities", - "service": "Azure Data Explorer", - "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", + "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", + "severity": "Medium", + "text": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000)", "waf": "Reliability" }, { - "checklist": "Azure Data Explorer Review Checklist", - "guid": "18ca6017-0265-4f4b-a46a-393af7f31728", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution", - "service": "Azure Data Explorer", - "text": "Ingest data into each cluster in parallel", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", + "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", + "severity": "Medium", + "text": "Consider the limit of routes per route table (400).", "waf": "Reliability" }, { - "checklist": "Azure Data Explorer Review Checklist", - "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.", - "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration", - "service": "Azure Data Explorer", - "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", + "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", + "service": "VNet", + "severity": "High", + "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings", "waf": "Reliability" }, { - "checklist": "Azure Data Explorer Review Checklist", - "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.", - "guid": "563a4dc7-4a74-48b6-922a-d190916a6649", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration", - "service": "Azure Data Explorer", - "text": "For critical applications, create Active-Active configuration in two paired regions", - "waf": "Reliability" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", + "service": "ExpressRoute", + "severity": "Medium", + "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.", + "waf": "Security" }, { - "checklist": "Azure Data Explorer Review Checklist", - "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.", - "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration", - "service": "Azure Data Explorer", - "text": "For applications, which required only read during failure, create Active-Hot standby configuration", - "waf": "Reliability" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", + "severity": "Low", + "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "checklist": "Azure Data Explorer Review Checklist", - "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.", - "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba", - "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration", - "service": "Azure Data Explorer", - "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration", - "waf": "Reliability" + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "558fd772-49b8-4211-82df-27ee412e7f98", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "ExpressRoute", + "severity": "High", + "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { - "checklist": "Azure Data Explorer Review Checklist", - "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.", - "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757", - "link": "https://learn.microsoft.com/azure/data-explorer/devops", - "service": "Azure Data Explorer", - "text": "Wrap DevOps and source control around all your code", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", - "waf": "Reliability" + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", + "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", + "severity": "Low", + "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Security" }, { - "checklist": "Azure Data Explorer Review Checklist", - "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780", - "link": "https://learn.microsoft.com/azure/data-explorer/devops", - "service": "Azure Data Explorer", - "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.", - "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", - "waf": "Reliability" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", + "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", + "severity": "High", + "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16)", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Performance" }, { - "checklist": "Azure Data Explorer Review Checklist", - "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18", - "link": "https://learn.microsoft.com/azure/data-explorer/devops", - "service": "Azure Data Explorer", - "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", - "waf": "Reliability" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", - "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", - "service": "AKS", - "severity": "Low", - "text": "If required for AKS Windows workloads HostProcess containers can be used", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", + "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", + "service": "VNet", + "severity": "High", + "text": "Avoid using overlapping IP address ranges for production and DR sites.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", - "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", - "service": "AKS", - "severity": "Low", - "text": "Use KEDA if running event-driven workloads", - "waf": "Performance" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", - "link": "https://dapr.io/", - "service": "AKS", - "severity": "Low", - "text": "Use Dapr to ease microservice development", + "checklist": "Azure Landing Zone Review", + "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", + "severity": "Medium", + "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", - "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", - "link": "https://learn.microsoft.com/azure/aks/uptime-sla", - "service": "AKS", - "severity": "High", - "text": "Use the SLA-backed AKS offering", - "waf": "Reliability" + "checklist": "Azure Landing Zone Review", + "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", + "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", + "service": "DNS", + "severity": "Medium", + "text": "For environments where name resolution across Azure and on-premises is required, consider using Azure DNS Private Resolver.", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", "severity": "Low", - "text": "Use Disruption Budgets in your pod and deployment definitions", - "waf": "Reliability" + "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.", + "waf": "Operations" }, { - "checklist": "Azure AKS Review", - "guid": "3c763963-7a55-42d5-a15e-401955387e5c", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", - "service": "ACR", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "614658d3-558f-4d77-849b-821112df27ee", + "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", + "service": "DNS", "severity": "High", - "text": "If using a private registry, configure region replication to store images in multiple regions", - "waf": "Reliability" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", - "service": "AKS", - "severity": "Low", - "text": "Use an external application such as kubecost to allocate costs to different users", - "waf": "Cost" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", - "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", - "service": "AKS", - "severity": "Low", - "text": "Use scale down mode to delete/deallocate nodes", - "waf": "Cost" + "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", - "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "service": "Bastion", "severity": "Medium", - "text": "When required use multi-instance partitioning GPU on AKS Clusters", - "waf": "Cost" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", - "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", - "service": "AKS", - "severity": "Low", - "text": "If running a Dev/Test cluster use NodePool Start/Stop", - "waf": "Cost" + "text": "Consider using Azure Bastion to securely connect to your network.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", - "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", + "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", + "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", + "service": "Bastion", "severity": "Medium", - "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", + "text": "Use Azure Bastion in a subnet /26 or larger.", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", - "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "WAF", "severity": "Medium", - "text": "Separate applications from the control plane with user/system node pools", + "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", "severity": "Low", - "text": "Add taint to your system nodepool to make it dedicated", - "waf": "Security" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", - "link": "https://learn.microsoft.com/azure/container-registry/", - "service": "AKS", - "severity": "Medium", - "text": "Use a private registry for your images, such as ACR", + "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Security" }, { - "checklist": "Azure AKS Review", - "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", - "link": "https://learn.microsoft.com/azure/security-center/container-security", - "service": "ACR", - "severity": "Medium", - "text": "Scan your images for vulnerabilities", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", + "severity": "High", + "text": "Deploy WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", "severity": "High", - "text": "Define app separation requirements (namespace/nodepool/cluster)", + "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", - "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", - "service": "AKS", - "severity": "Medium", - "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver", - "waf": "Security" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b034c01e-110b-463a-b36e-e3346e57f225", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "service": "VNet", + "severity": "High", + "text": "Assess and review network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", - "link": "https://learn.microsoft.com/azure/aks/update-credentials", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", "severity": "High", - "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)", + "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", - "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", + "service": "ExpressRoute", "severity": "Medium", - "text": "If required add Key Management Service etcd encryption", - "waf": "Security" + "text": "Ensure that you have investigated the possibility to use ExpressRoute as primary connection to Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", - "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", - "service": "AKS", - "severity": "Low", - "text": "If required consider using Confidential Compute for AKS", - "waf": "Security" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.", + "guid": "f29812b2-363c-4efe-879b-599de0d5973c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", + "severity": "Medium", + "text": "When you use multiple ExpressRoute circuits, or multiple on-prem locations, make sure to optimize routing with BGP attributes, if certain paths are preferred.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", + "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "severity": "Medium", - "text": "Consider using Defender for Containers", - "waf": "Security" + "text": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", - "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", - "service": "AKS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", + "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", + "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", + "service": "ExpressRoute", "severity": "High", - "text": "Use managed identities instead of Service Principals", - "waf": "Security" + "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.", + "waf": "Cost" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", - "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", - "link": "https://learn.microsoft.com/azure/aks/managed-aad", - "service": "AKS", - "severity": "Medium", - "text": "Integrate authentication with AAD (using the managed integration)", - "waf": "Security" + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", + "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", + "service": "ExpressRoute", + "severity": "High", + "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU.", + "waf": "Cost" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", - "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", + "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", + "service": "ExpressRoute", "severity": "Medium", - "text": "Limit access to admin kubeconfig (get-credentials --admin)", - "waf": "Security" + "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", - "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "service": "ExpressRoute", "severity": "Medium", - "text": "Integrate authorization with AAD RBAC", - "waf": "Security" + "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", - "service": "AKS", - "severity": "High", - "text": "Use namespaces for restricting RBAC privilege in Kubernetes", - "waf": "Security" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", + "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", + "service": "ExpressRoute", + "severity": "Medium", + "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", - "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", - "service": "AKS", + "arm-service": "microsoft.network/vpnGateways", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", + "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", + "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", + "service": "VPN", "severity": "Medium", - "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)", - "waf": "Security" + "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", - "service": "AKS", + "arm-service": "microsoft.network/vpnGateways", + "checklist": "Azure Landing Zone Review", + "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", + "service": "VPN", "severity": "Medium", - "text": "For AKS non-interactive logins use kubelogin (preview)", - "waf": "Security" + "text": "Use redundant VPN appliances on-premises (active/active or active/passive).", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", - "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", - "service": "AKS", - "severity": "Medium", - "text": "Disable AKS local accounts", - "waf": "Security" + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "718cb437-b060-2589-8856-2e93a5c6633b", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", + "severity": "High", + "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Cost" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", - "service": "AKS", - "severity": "Low", - "text": "Configure if required Just-in-time cluster access", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", + "service": "ExpressRoute", + "severity": "Medium", + "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", - "service": "AKS", - "severity": "Low", - "text": "Configure if required AAD conditional access for AKS", - "waf": "Security" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b30e38c3-f298-412b-8363-cefe179b599d", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", + "service": "ExpressRoute", + "severity": "Medium", + "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", - "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", - "service": "AKS", - "severity": "Low", - "text": "If required for Windows AKS workloads configure gMSA ", - "waf": "Security" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", + "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", + "service": "ExpressRoute", + "severity": "Medium", + "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", + "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", + "service": "ExpressRoute", "severity": "Medium", - "text": "For finer control consider using a managed Kubelet Identity", - "waf": "Security" + "text": "Use ExpressRoute circuits from different peering locations for redundancy.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", - "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", + "service": "ExpressRoute", "severity": "Medium", - "text": "If using AGIC, do not share an AppGW across clusters", + "text": "Use site-to-site VPN as failover of ExpressRoute, especially if only using a single ExpressRoute circuit.", "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", - "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", - "link": "https://learn.microsoft.com/azure/aks/http-application-routing", - "service": "AKS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", + "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", + "service": "ExpressRoute", "severity": "High", - "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.", + "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.", "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", - "service": "AKS", - "severity": "Medium", - "text": "For Windows workloads use Accelerated Networking", - "waf": "Performance" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", - "guid": "ba7da7be-9952-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "d581a947-69a2-4783-942e-9df3664324c8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", + "service": "ExpressRoute", "severity": "High", - "text": "Use the standard ALB (as opposed to the basic one)", + "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.", "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", + "service": "ExpressRoute", "severity": "Medium", - "text": "If using Azure CNI, consider using different Subnets for NodePools", - "waf": "Security" + "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", - "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", + "service": "ExpressRoute", "severity": "Medium", - "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster", - "waf": "Security" + "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", - "guid": "a0f61565-9de5-458f-a372-49c831112dbd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "ExpressRoute", "severity": "High", - "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)", + "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "High", - "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node", - "waf": "Performance" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", + "service": "ExpressRoute", + "severity": "Medium", + "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "High", - "text": "If using Azure CNI, check the maximum pods/node (default 30)", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "5234c93f-b651-41dd-80c1-234177b91ced", + "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", + "service": "ExpressRoute", + "severity": "Medium", + "text": "Avoid using ExpressRoute circuits for VNet-to-VNet communication.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .", - "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", - "link": "https://learn.microsoft.com/azure/aks/internal-lb", - "service": "AKS", - "severity": "Low", - "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)", - "waf": "Security" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "severity": "High", - "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)", - "waf": "Reliability" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", - "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", - "service": "AKS", - "severity": "Low", - "text": "If required add your own CNI plugin", + "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", - "service": "AKS", - "severity": "Low", - "text": "If required configure Public IP per node in AKS", - "waf": "Performance" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", - "link": "https://learn.microsoft.com/azure/aks/concepts-network", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", "severity": "Medium", - "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services", - "waf": "Reliability" + "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", - "link": "https://learn.microsoft.com/azure/aks/nat-gateway", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", + "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", + "service": "Firewall", "severity": "Low", - "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic", - "waf": "Reliability" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", - "service": "AKS", - "severity": "Medium", - "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion", - "waf": "Reliability" + "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", - "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", - "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", + "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", + "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", + "service": "Firewall", "severity": "High", - "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it", + "text": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules.", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", - "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", - "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", - "service": "AKS", - "severity": "Medium", - "text": "If using a public API endpoint, restrict the IP addresses that can access it", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", + "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", + "severity": "High", + "text": "Use Azure Firewall Premium for additional security and protection.", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", - "link": "https://learn.microsoft.com/azure/aks/private-clusters", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", + "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", "severity": "High", - "text": "Use private clusters if your requirements mandate it", + "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", - "severity": "Medium", - "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", + "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", + "service": "Firewall", + "severity": "High", + "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", - "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", + "guid": "a3784907-9836-4271-aafc-93535f8ec08b", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "service": "Firewall", "severity": "High", - "text": "Enable a Kubernetes Network Policy option (Calico/Azure)", + "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", - "severity": "High", - "text": "Use Kubernetes network policies to increase intra-cluster security", - "waf": "Security" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "715d833d-4708-4527-90ac-1b142c7045ba", + "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", + "service": "Firewall", + "severity": "Medium", + "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", + "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", + "service": "Firewall", + "severity": "Important", + "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Operations" + }, + { + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", + "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", + "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", + "service": "Firewall", "severity": "High", - "text": "Use a WAF for web workloads (UIs or APIs)", + "text": "Use a /26 prefix for your Azure Firewall subnets.", "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", - "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", + "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", + "service": "Firewall", "severity": "Medium", - "text": "Use DDoS Standard in the AKS Virtual Network", - "waf": "Security" + "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", - "link": "https://learn.microsoft.com/azure/aks/http-proxy", - "service": "AKS", - "severity": "Low", - "text": "If required add company HTTP Proxy", - "waf": "Security" + "checklist": "Azure Landing Zone Review", + "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", + "link": "https://learn.microsoft.com/azure/firewall/ip-groups", + "service": "Firewall", + "severity": "Medium", + "text": "Use IP Groups or IP prefixes to reduce number of IP table rules", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", - "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", + "service": "Firewall", "severity": "Medium", - "text": "Consider using a service mesh for advanced microservice communication management", - "waf": "Security" + "text": "Avoid wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", - "service": "AKS", - "severity": "High", - "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", + "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", + "service": "Firewall", + "severity": "Medium", + "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "337453a3-cc63-4963-9a65-22ac19e80696", - "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", - "service": "AKS", - "severity": "Low", - "text": "Check regularly Azure Advisor for recommendations on your cluster", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "guid": "346840b8-1064-496e-8396-4b1340172d52", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", + "service": "Firewall", + "severity": "High", + "text": "Enable TLS Inspection", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", - "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", + "service": "Firewall", "severity": "Low", - "text": "Enable AKS auto-certificate rotation", - "waf": "Operations" + "text": "Use web categories to allow or deny outbound access to specific topics.", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", - "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", - "service": "AKS", - "severity": "High", - "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", + "service": "Firewall", + "severity": "Medium", + "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", - "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", - "service": "AKS", - "severity": "High", - "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "service": "Firewall", + "severity": "Medium", + "text": "Enable Azure Firewall DNS proxy configuration ", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", - "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", - "service": "AKS", - "severity": "High", - "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", + "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", + "service": "Firewall", + "severity": "Medium", + "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "service": "Firewall", "severity": "Low", - "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters", + "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.", "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d7672c26-7602-4482-85a4-14527fbe855c", - "link": "https://learn.microsoft.com/azure/aks/command-invoke", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", "severity": "Low", - "text": "Consider using AKS command invoke on private clusters", + "text": "Implement backups for your firewall rules", "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", - "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", - "service": "AKS", - "severity": "Low", - "text": "For planned events consider using Node Auto Drain", - "waf": "Operations" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "App Gateway", + "severity": "High", + "text": "Ensure that control-plane communication for Azure PaaS services injected into a virtual network is not broken, for example with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", - "link": "https://learn.microsoft.com/azure/aks/faq", - "service": "AKS", - "severity": "High", - "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')", - "waf": "Operations" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "ExpressRoute", + "severity": "Medium", + "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", - "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", - "severity": "Low", - "text": "Use custom Node RG (aka 'Infra RG') name", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", + "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "VNet", + "severity": "Medium", + "text": "Don't enable virtual network service endpoints by default on all subnets.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", - "link": "https://kubernetes.io/docs/setup/release/notes/", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "severity": "Medium", - "text": "Do not use deprecated Kubernetes APIs in your YAML manifests", - "waf": "Operations" + "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", - "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", - "service": "AKS", - "severity": "Low", - "text": "Taint Windows nodes", - "waf": "Operations" + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", + "service": "ExpressRoute", + "severity": "High", + "text": "Use at least a /27 prefix for your Gateway subnets", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", - "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", - "service": "AKS", - "severity": "Low", - "text": "Keep windows containers patch level in sync with host patch level", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", + "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", + "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", + "service": "NSG", + "severity": "Medium", + "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "Via Diagnostic Settings at the cluster level", - "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", - "link": "https://learn.microsoft.com/azure/aks/monitor-aks", - "service": "AKS", - "severity": "Low", - "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", + "service": "NSG", + "severity": "Medium", + "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", - "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", - "service": "AKS", - "severity": "Low", - "text": "If required use nodePool snapshots", - "waf": "Cost" + "checklist": "Azure Landing Zone Review", + "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", + "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", + "service": "NSG", + "severity": "Medium", + "text": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", - "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", - "service": "AKS", - "severity": "Low", - "text": "Consider spot node pools for non time-sensitive workloads", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", + "severity": "Medium", + "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", - "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", - "severity": "Low", - "text": "Consider AKS virtual node for quick bursting", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "guid": "dfe237de-143b-416c-91d7-aa9b64704489", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", + "severity": "Medium", + "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", - "severity": "High", - "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)", - "waf": "Operations" + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", + "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "NSG", + "severity": "Medium", + "text": "Consider the limit of NSG rules per NSG (1000).", + "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", - "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", - "severity": "High", - "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", + "service": "VWAN", + "severity": "Medium", + "text": "Consider Virtual WAN for simplified Azure networking management, and make sure your scenario is explicitly described in the list of Virtual WAN routing designs", + "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "severity": "Medium", - "text": "Monitor CPU and memory utilization of the nodes", - "waf": "Operations" + "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.", + "waf": "Performance" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1a4835ac-9422-423e-ae80-b123081a5417", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "Low", + "text": "Follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network", + "waf": "Performance" + }, + { + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", + "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "severity": "Medium", - "text": "If using Azure CNI, monitor % of pod IPs consumed per node", - "waf": "Operations" + "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady", - "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", - "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "VWAN", "severity": "Medium", - "text": "Monitor OS disk queue depth in nodes", - "waf": "Operations" + "text": "Ensure that the network architecture is within the Azure Virtual WAN limits.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "be209d39-fda4-4777-a424-d116785c2fa5", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", + "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", + "service": "VWAN", "severity": "Medium", - "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports", + "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.", "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", - "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", + "service": "VWAN", "severity": "Medium", - "text": "Subscribe to resource health notifications for your AKS cluster", - "waf": "Operations" + "text": "Make sure that your IaC deployments does not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", - "severity": "High", - "text": "Configure requests and limits in your pod specs", - "waf": "Operations" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", + "service": "VWAN", + "severity": "Medium", + "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "769ef669-1a48-435a-a942-223ece80b123", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", + "service": "VWAN", "severity": "Medium", - "text": "Enforce resource quotas for namespaces", - "waf": "Operations" + "text": "Make sure that your IaC deployments are configuring label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "081a5417-4158-433e-a3ad-3c2de733165c", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "AKS", + "ammp": true, + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "9c75dfef-573c-461c-a698-68598595581a", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", + "service": "VWAN", "severity": "High", - "text": "Ensure your subscription has enough quota to scale out your nodepools", - "waf": "Operations" + "text": "Assign enough IP space to virtual hubs, ideally a /23 prefix.", + "waf": "Reliability" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65", - "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "High", - "text": "Configure Liveness and Readiness probes for all deployments", - "waf": "Operations" + "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", - "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "Medium", - "text": "Use the Cluster Autoscaler", - "waf": "Performance" + "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", - "guid": "831c2872-c693-4b39-a887-a561bada49bc", - "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "223ace8c-b123-408c-a501-7f154e3ab369", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "Medium", + "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes", + "waf": "Security" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "3829e7e3-1618-4368-9a04-77a209945bda", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "Medium", + "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.", + "waf": "Security" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "43334f24-9116-4341-a2ba-527526944008", + "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", + "service": "Policy", "severity": "Low", - "text": "Customize node configuration for AKS node pools", - "waf": "Performance" + "text": "Use Azure Policy to control which services users can provision at the subscription/management group level", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "Medium", - "text": "Use the Horizontal Pod Autoscaler when required", - "waf": "Performance" + "text": "Use built-in policies where possible to minimize operational overhead.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity", - "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", - "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", - "service": "AKS", - "severity": "High", - "text": "Consider an appropriate node size, not too large or too small", - "waf": "Performance" + "checklist": "Azure Landing Zone Review", + "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.", + "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", + "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", + "service": "Policy", + "severity": "Medium", + "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", - "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", - "service": "AKS", - "severity": "Low", - "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster", - "waf": "Performance" + "checklist": "Azure Landing Zone Review", + "guid": "19048384-5c98-46cb-8913-156a12476e49", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "Medium", + "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", - "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", - "service": "AKS", - "severity": "Low", - "text": "Consider subscribing to EventGrid Events for AKS automation", - "waf": "Performance" + "checklist": "Azure Landing Zone Review", + "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", + "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", + "service": "Policy", + "severity": "Medium", + "text": "If any data sovereignty requirements exist, Azure Policies can be deployed to enforce them", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "waf": "Security" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", + "service": "Policy", + "severity": "Medium", + "text": "For Sovereign Landing Zone, sovereignty policy baseline' policy initiative is deployed and and assigned at correct MG level.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", - "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", - "service": "AKS", - "severity": "Low", - "text": "For long running operation on an AKS cluster consider event termination", - "waf": "Performance" + "checklist": "Azure Landing Zone Review", + "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", + "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", + "service": "Policy", + "severity": "Medium", + "text": "For Sovereign Landing Zone, sovereign Control objectives to policy mapping' is documented.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", - "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", - "service": "AKS", - "severity": "Low", - "text": "If required consider using Azure Dedicated Hosts for AKS nodes", - "waf": "Performance" + "checklist": "Azure Landing Zone Review", + "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", + "service": "Policy", + "severity": "Medium", + "text": "For Sovereign Landing Zone, process is in place for CRUD of 'Sovereign Control objectives to policy mapping'.", + "waf": "Security" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", - "guid": "24367b33-6971-45b1-952b-eee0b9b588de", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", - "severity": "High", - "text": "Use ephemeral OS disks", - "waf": "Performance" + "checklist": "Azure Landing Zone Review", + "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", + "severity": "Medium", + "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.", + "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "AKS", - "severity": "High", - "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds", - "waf": "Performance" + "checklist": "Azure Landing Zone Review", + "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Monitor", + "severity": "Medium", + "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", - "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", - "service": "AKS", - "severity": "Low", - "text": "For hyper performance storage option use Ultra Disks on AKS", - "waf": "Performance" + "checklist": "Azure Landing Zone Review", + "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", + "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", + "service": "VM", + "severity": "Medium", + "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "severity": "Medium", - "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", - "waf": "Performance" + "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "severity": "Medium", - "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons", - "waf": "Performance" + "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "90483845-c986-4cb2-a131-56a12476e49f", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Network Watcher", "severity": "Medium", - "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones", - "waf": "Performance" + "text": "Use Network Watcher to proactively monitor traffic flows", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "Operations" }, { "checklist": "Azure Landing Zone Review", - "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", - "service": "Entra", + "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Monitor", "severity": "Medium", - "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.", + "text": "Use Azure Monitor Logs for insights and reporting.", "waf": "Operations" }, { "checklist": "Azure Landing Zone Review", - "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Entra", - "severity": "Low", - "text": "Ensure you have a Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants", + "guid": "97be9951-9048-4384-9c98-6cb2913156a1", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", + "service": "Monitor", + "severity": "Medium", + "text": "Use Azure Monitor alerts for the generation of operational alerts.", "waf": "Operations" }, { "checklist": "Azure Landing Zone Review", - "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "Entra", - "severity": "Low", - "text": "Leverage Azure Lighthouse for Multi-Tenant Management", + "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "Monitor", + "severity": "Medium", + "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.", "waf": "Operations" }, { "checklist": "Azure Landing Zone Review", - "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Entra", + "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Backup", "severity": "Medium", - "text": "Ensure that Azure Lighthouse is used for administering the tenant by partner", - "waf": "Cost" + "text": "When using Azure Backup, consider the different backup types (GRS, ZRS & LRS) as the default setting is GRS", + "waf": "Reliability" }, { - "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "348ef254-c27d-442e-abba-c7571559ab91", - "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "service": "Entra", - "severity": "High", - "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "VM", + "severity": "Medium", + "text": "Use Azure policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.", "waf": "Security" }, { - "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", - "service": "Entra", - "severity": "High", - "text": "Only use the authentication type Work or school account for all account types. Avoid using the Microsoft account", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "description": "Azure Policy's guest configuration features can audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.", + "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "VM", + "severity": "Medium", + "text": "Monitor VM security configuration drift via Azure Policy.", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "Entra", + "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", "severity": "Medium", - "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Security" + "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.", + "waf": "Operations" }, { "checklist": "Azure Landing Zone Review", - "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", - "service": "Entra", - "severity": "Low", - "text": "Enforce Microsoft Entra ID conditional-access policies for any user with rights to Azure environments", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Security" + "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "Backup", + "severity": "Medium", + "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.", + "waf": "Operations" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", - "service": "Entra", + "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", "severity": "High", - "text": "Enforce multi-factor authentication for any user with rights to the Azure environments", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Security" + "text": "Leverage Availability Zones for your VMs in regions where they are supported.", + "waf": "Reliability" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "14658d35-58fd-4772-99b8-21112df27ee4", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "Entra", - "severity": "Medium", - "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", + "severity": "High", + "text": "Avoid running a production workload on a single VM.", + "waf": "Reliability" }, { "checklist": "Azure Landing Zone Review", - "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "Entra", + "guid": "84101f59-1941-4195-a270-e28034290e3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", "severity": "Medium", - "text": "If planning to switch from Active Directory Domain Serivces to Entra domain services, evaluate the compatibility of all workloads", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", - "waf": "Security" + "text": "Azure Load Balancer and Application Gateway distribute incoming network traffic across multiple resources.", + "waf": "Reliability" + }, + { + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "WAF", + "severity": "High", + "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.", + "waf": "Operations" }, { "checklist": "Azure Landing Zone Review", - "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", - "service": "Entra", + "guid": "7f408960-c626-44cb-a018-347c8d790cdf", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "WAF", "severity": "Medium", - "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.", - "waf": "Security" + "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.", + "waf": "Operations" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "984a859c-773e-47d2-9162-3a765a917e1f", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", - "service": "Entra", + "guid": "5017f154-e3ab-4369-9829-e7e316183687", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "Key Vault", "severity": "High", - "text": "Implement an emergency access or break-glass accounts to prevent tenant-wide account lockout", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "text": "Use Azure Key Vault to store your secrets and credentials", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "35037e68-9349-4c15-b371-228514f4cdff", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "Entra", + "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", + "guid": "a0477a20-9945-4bda-9333-4f2491163418", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", + "service": "Key Vault", "severity": "Medium", - "text": "Avoid using on-premises synced accounts for Microsoft Entra ID role assignments.", - "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", + "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Entra", + "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medium", - "text": "Where required, use Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications (hosted in the cloud or on-premises).", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", - "service": "VNet", + "guid": "dc055bcf-619e-48a1-9f98-879525d62688", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medium", - "text": "Leverage a network design based on the traditional hub-and-spoke network topology for network scenarios that require maximum flexibility.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.", "waf": "Security" }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", - "service": "VNet", - "severity": "High", - "text": "Ensure that shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS servers.", - "waf": "Cost" - }, { "checklist": "Azure Landing Zone Review", - "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "VNet", + "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medium", - "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", + "guid": "913156a1-2476-4e49-b541-acdce979377b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medium", - "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance", - "waf": "Reliability" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", - "service": "ExpressRoute", - "severity": "Low", - "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.", + "text": "Establish an automated process for key and certificate rotation.", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", - "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", - "service": "ARS", - "severity": "Low", - "text": "If using Route Server, use a /27 prefix for the Route Server subnet.", + "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "Medium", + "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", - "service": "VNet", + "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", + "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", + "service": "Key Vault", "severity": "Medium", - "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", - "waf": "Performance" + "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.", + "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", - "service": "VNet", + "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medium", - "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "Operations" + "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.", + "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", - "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", + "guid": "91163418-2ba5-4275-8694-4008be7d7e48", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medium", - "text": "When connecting spoke virtual networks to the central hub virtual network, consider VNet peering limits (500), the maximum number of prefixes that can be advertised via ExpressRoute (1000)", - "waf": "Reliability" + "text": "Use an Azure Key Vault per application per environment per region.", + "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", - "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", + "guid": "25d62688-6d70-4ba6-a97b-e99519048384", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medium", - "text": "Consider the limit of routes per route table (400).", - "waf": "Reliability" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", - "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", - "service": "VNet", - "severity": "High", - "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings", - "waf": "Reliability" + "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.", + "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", - "service": "ExpressRoute", + "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", + "link": "https://learn.microsoft.com/industry/sovereignty/key-management", + "service": "Key Vault", "severity": "Medium", - "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.", + "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.", "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", - "severity": "Low", - "text": "For scenarios where MACsec isn't an option (for example, not using ExpressRoute Direct), use a VPN gateway to establish IPsec tunnels over ExpressRoute private peering.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", + "service": "Entra", + "severity": "Medium", + "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.", "waf": "Security" }, { "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "558fd772-49b8-4211-82df-27ee412e7f98", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "ExpressRoute", + "guid": "09945bda-4333-44f2-9911-634182ba5275", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", + "service": "Defender", "severity": "High", - "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "Security" - }, - { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", - "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", - "severity": "Low", - "text": "Use IP addresses from the address allocation ranges for private internets (RFC 1918).", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "Enable Defender Cloud Security Posture Management for all subscriptions.", "waf": "Security" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", - "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", + "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", + "service": "Defender", "severity": "High", - "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16)", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "Performance" + "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.", + "waf": "Security" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", - "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", - "service": "VNet", + "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", + "service": "Defender", "severity": "High", - "text": "Avoid using overlapping IP address ranges for production and DR sites.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Reliability" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", - "severity": "Medium", - "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Operations" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", - "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", - "service": "DNS", - "severity": "Medium", - "text": "For environments where name resolution across Azure and on-premises is required, consider using Azure DNS Private Resolver.", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.", "waf": "Security" }, - { - "checklist": "Azure Landing Zone Review", - "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", - "severity": "Low", - "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.", - "waf": "Operations" - }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "614658d3-558f-4d77-849b-821112df27ee", - "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", - "service": "DNS", + "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", + "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", + "service": "VM", "severity": "High", - "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Operations" + "text": "Enable Endpoint Protection on IaaS Servers.", + "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", - "service": "Bastion", + "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", + "link": "https://learn.microsoft.com/azure/security-center/", + "service": "VM", "severity": "Medium", - "text": "Consider using Azure Bastion to securely connect to your network.", + "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", - "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", - "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", - "service": "Bastion", + "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "severity": "Medium", - "text": "Use Azure Bastion in a subnet /26 or larger.", + "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "WAF", + "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", + "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", + "service": "Entra", "severity": "Medium", - "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "text": "For Sovereign Landing Zone, transparancy logs is enabled on the Entra ID tenant.", "waf": "Security" }, { "checklist": "Azure Landing Zone Review", - "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "severity": "Low", - "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", + "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", + "service": "Entra", + "severity": "Medium", + "text": "For Sovereign Landing Zone, customer Lockbox is enabled on the Entra ID tenant.", "waf": "Security" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", + "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Storage", "severity": "High", - "text": "Deploy WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "Secure transfer to storage accounts should be enabled", "waf": "Security" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", + "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", + "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", + "service": "Storage", "severity": "High", - "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.", "waf": "Security" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "b034c01e-110b-463a-b36e-e3346e57f225", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", - "service": "VNet", + "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", + "service": "Key Vault", "severity": "High", - "text": "Assess and review network outbound traffic configuration and strategy before the upcoming breaking change. On September 30, 2025, default outbound access for new deployments will be retired and only explicit access configurations will be allowed", - "waf": "Reliability" + "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.", + "waf": "Operations" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", + "checklist": "Device Update Review", + "guid": "0e03f5ee-4648-423c-bb86-7239480f9171", + "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", + "service": "Device Update for IoT Hub", "severity": "High", - "text": "Add diagnostic settings to save DDoS related logs for all the protected public IP addresses (DDoS IP or Network Protection).", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", - "service": "ExpressRoute", - "severity": "Medium", - "text": "Ensure that you have investigated the possibility to use ExpressRoute as primary connection to Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "description": "You can use AS-path prepending and connection weights to influence traffic from Azure to on-premises, and the full range of BGP attributes in your own routers to influence traffic from on-premises to Azure.", - "guid": "f29812b2-363c-4efe-879b-599de0d5973c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", - "severity": "Medium", - "text": "When you use multiple ExpressRoute circuits, or multiple on-prem locations, make sure to optimize routing with BGP attributes, if certain paths are preferred.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).", "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", - "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", - "severity": "Medium", - "text": "Ensure that you're using the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "checklist": "Device Update Review", + "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55", + "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", + "service": "Device Update for IoT Hub", + "severity": "High", + "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.", + "waf": "Reliability" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", - "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", - "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", - "service": "ExpressRoute", + "checklist": "Device Update Review", + "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Device Update for IoT Hub", "severity": "High", - "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.", - "waf": "Cost" + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", - "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", - "service": "ExpressRoute", + "checklist": "Device Update Review", + "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Device Update for IoT Hub", "severity": "High", - "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuits' peering location supports your Azure regions for the Local SKU.", - "waf": "Cost" + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", - "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", - "service": "ExpressRoute", - "severity": "Medium", - "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "checklist": "Azure App Service Review", + "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", + "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", + "service": "App Services", + "severity": "Low", + "text": "Refer to baseline highly available zone-redundant web application architecture for best practices", "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", + "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", + "service": "App Services", "severity": "Medium", - "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", - "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", - "service": "ExpressRoute", - "severity": "Medium", - "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "checklist": "Azure App Service Review", + "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", + "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", + "service": "App Services", + "severity": "High", + "text": "Leverage Availability Zones where regionally applicable (requires Premium v2 or v3 tier)", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", - "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", - "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", - "service": "VPN", + "checklist": "Azure App Service Review", + "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "severity": "Medium", - "text": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available).", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "text": "Implement health checks", "waf": "Reliability" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", - "service": "VPN", - "severity": "Medium", - "text": "Use redundant VPN appliances on-premises (active/active or active/passive).", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "checklist": "Azure App Service Review", + "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", + "service": "App Services", + "severity": "High", + "text": "Refer to backup and restore best practices for Azure App Service", "waf": "Reliability" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "718cb437-b060-2589-8856-2e93a5c6633b", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", + "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", + "service": "App Services", "severity": "High", - "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Cost" + "text": "Implement Azure App Service reliability best practices", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", - "service": "ExpressRoute", - "severity": "Medium", - "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Security" + "checklist": "Azure App Service Review", + "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", + "service": "App Services", + "severity": "Low", + "text": "Familiarize with how to move an App Service app to another region During a disaster", + "waf": "Reliability" + }, + { + "checklist": "Azure App Service Review", + "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", + "service": "App Services", + "severity": "High", + "text": "Familiarize with reliability support in Azure App Service", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b30e38c3-f298-412b-8363-cefe179b599d", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "App Services", "severity": "Medium", - "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operations" + "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", - "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "severity": "Medium", - "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operations" + "text": "Monitor App Service instances using Health checks", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", - "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", + "service": "App Services", "severity": "Medium", - "text": "Use ExpressRoute circuits from different peering locations for redundancy.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests", "waf": "Reliability" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", - "service": "ExpressRoute", - "severity": "Medium", - "text": "Use site-to-site VPN as failover of ExpressRoute, especially if only using a single ExpressRoute circuit.", + "checklist": "Azure App Service Review", + "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", + "service": "App Services", + "severity": "Low", + "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website", "waf": "Reliability" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", - "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "description": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.", + "guid": "834ac932-223e-4ce8-8b12-3071a5416415", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "severity": "High", - "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.", - "waf": "Reliability" + "text": "Use Key Vault to store secrets", + "waf": "Security" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "d581a947-69a2-4783-942e-9df3664324c8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.", + "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "severity": "High", - "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.", - "waf": "Reliability" + "text": "Use Managed Identity to connect to Key Vault", + "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "description": "Store the App Service TLS certificate in Key Vault.", + "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", + "service": "App Services", + "severity": "High", + "text": "Use Key Vault to store TLS certificate.", + "waf": "Security" + }, + { + "checklist": "Azure App Service Review", + "description": "Systems that process sensitive information should be isolated. To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.", + "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", + "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", + "service": "App Services", "severity": "Medium", - "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "text": "Isolate systems that process sensitive information", + "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).", + "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", + "service": "App Services", "severity": "Medium", - "text": "Ensure Bidirectional Forwarding Detection (BFD) is enabled and configured on customer or provider edge routing devices.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "text": "Do not store sensitive data on local disk", + "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C. Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.", + "guid": "919ca0b2-c121-459e-814b-933df574eccc", + "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", + "service": "App Services", + "severity": "Medium", + "text": "Use an established Identity Provider for authentication", + "waf": "Security" + }, + { + "checklist": "Azure App Service Review", + "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.", + "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", + "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", + "service": "App Services", "severity": "High", - "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Reliability" + "text": "Deploy from a trusted environment", + "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", - "service": "ExpressRoute", - "severity": "Medium", - "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operations" + "checklist": "Azure App Service Review", + "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM. This disables access to these services and enforces the use of Azure AD secured endpoints for deployment. Note that the SCM site can also be opened using Azure AD credentials.", + "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", + "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", + "service": "App Services", + "severity": "High", + "text": "Disable basic authentication", + "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5234c93f-b651-41dd-80c1-234177b91ced", - "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", - "service": "ExpressRoute", - "severity": "Medium", - "text": "Avoid using ExpressRoute circuits for VNet-to-VNet communication.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Performance" + "checklist": "Azure App Service Review", + "description": "Where possible use Managed Identity to connect to Azure AD secured resources. If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.", + "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", + "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", + "service": "App Services", + "severity": "High", + "text": "Use Managed Identity to connect to resources", + "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.", + "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", + "service": "App Services", "severity": "High", - "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Pull containers using a Managed Identity", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...", + "guid": "47768314-c115-4775-a2ea-55b46ad48408", + "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", + "service": "App Services", "severity": "Medium", - "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Send App Service runtime logs to Log Analytics", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", - "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", - "service": "Firewall", - "severity": "Low", - "text": "Configure supported partner SaaS security providers within Firewall Manager if the organization wants to use such solutions to help protect outbound connections.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "checklist": "Azure App Service Review", + "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.", + "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "service": "App Services", + "severity": "Medium", + "text": "Send App Service activity logs to Log Analytics", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", - "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", - "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", - "service": "Firewall", - "severity": "High", - "text": "Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over protocols not supported by application rules.", + "checklist": "Azure App Service Review", + "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's. Traffic should be routed to an NVA such as Azure Firewall. Ensure to monitor the Firewall's logs.", + "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", + "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", + "service": "App Services", + "severity": "Medium", + "text": "Outbound network access should be controlled", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", - "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", - "severity": "High", - "text": "Use Azure Firewall Premium for additional security and protection.", + "checklist": "Azure App Service Review", + "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall. This allows the receiving party to allow-list based on IP, should that be needed. Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead. (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)", + "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", + "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", + "service": "App Services", + "severity": "Low", + "text": "Ensure a stable IP for outbound communications towards internet addresses", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", - "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.", + "guid": "0725769e-e669-41a4-a34a-c932223ece80", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "severity": "High", - "text": "Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection.", + "text": "Inbound network access should be controlled", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", - "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door. Make sure to monitor the WAF's logs.", + "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", + "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", + "service": "App Services", "severity": "High", - "text": "Configure Azure Firewall IDPS mode to Deny for additional protection.", + "text": "Use a WAF in front of App Service", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", - "guid": "a3784907-9836-4271-aafc-93535f8ec08b", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF. Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.", + "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "severity": "High", - "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance", + "text": "Avoid for WAF to be bypassed", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "715d833d-4708-4527-90ac-1b142c7045ba", - "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Set minimum TLS policy to 1.2 in App Service configuration.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", + "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", + "service": "App Services", "severity": "Medium", - "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Operations" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", - "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", - "service": "Firewall", - "severity": "Important", - "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Operations" + "text": "Set minimum TLS policy to 1.2", + "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", - "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", - "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Configure App Service to use HTTPS only. This causes App Service to redirect from HTTP to HTTPS. Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.", + "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", + "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", + "service": "App Services", "severity": "High", - "text": "Use a /26 prefix for your Azure Firewall subnets.", + "text": "Use HTTPS only", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", - "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", - "service": "Firewall", - "severity": "Medium", - "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use", - "waf": "Performance" + "checklist": "Azure App Service Review", + "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.", + "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", + "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", + "service": "App Services", + "severity": "High", + "text": "Wildcards must not be used for CORS", + "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", - "link": "https://learn.microsoft.com/azure/firewall/ip-groups", - "service": "Firewall", - "severity": "Medium", - "text": "Use IP Groups or IP prefixes to reduce number of IP table rules", - "waf": "Performance" + "checklist": "Azure App Service Review", + "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", + "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", + "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", + "service": "App Services", + "severity": "High", + "text": "Turn off remote debugging", + "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.", + "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", + "service": "App Services", "severity": "Medium", - "text": "Avoid wildcards as a source IP for DNATS, such as * or any, you should specify source IPs for incoming DNATs", - "waf": "Performance" + "text": "Enable Defender for Cloud - Defender for App Service", + "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", - "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.", + "guid": "223ece80-b123-4071-a541-6415833ea3ad", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "App Services", "severity": "Medium", - "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.", - "waf": "Performance" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "346840b8-1064-496e-8396-4b1340172d52", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", - "service": "Firewall", - "severity": "High", - "text": "Enable TLS Inspection", - "waf": "Performance" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", - "service": "Firewall", - "severity": "Low", - "text": "Use web categories to allow or deny outbound access to specific topics.", - "waf": "Performance" + "text": "Enable DDOS Protection Standard on the WAF VNet", + "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.", + "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", + "service": "App Services", "severity": "Medium", - "text": "As part of your TLS inspection, plan for receiving traffic from Azure App Gateways for inspection.", - "waf": "Performance" + "text": "Pull containers over a Virtual Network", + "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", - "link": "https://learn.microsoft.com/azure/firewall/dns-details", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.", + "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", + "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", + "service": "App Services", "severity": "Medium", - "text": "Enable Azure Firewall DNS proxy configuration ", + "text": "Conduct a penetration test", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", - "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", - "service": "Firewall", + "checklist": "Azure App Service Review", + "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", + "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", + "service": "App Services", "severity": "Medium", - "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines", + "text": "Deploy validated code", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", - "service": "Firewall", - "severity": "Low", - "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.", - "waf": "Operations" + "checklist": "Azure App Service Review", + "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", + "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", + "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", + "service": "App Services", + "severity": "High", + "text": "Use up-to-date platforms, languages, protocols and frameworks", + "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", + "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", + "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", + "service": "Event Hubs", "severity": "Low", - "text": "Implement backups for your firewall rules", - "waf": "Operations" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "App Gateway", - "severity": "High", - "text": "Ensure that control-plane communication for Azure PaaS services injected into a virtual network is not broken, for example with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "text": "Use customer-managed key option in data at rest encryption when required", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", "waf": "Security" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "ExpressRoute", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ", + "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", + "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", + "service": "Event Hubs", "severity": "Medium", - "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", - "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "VNet", + "checklist": "Azure Event Hub Review", + "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", + "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", + "service": "Event Hubs", "severity": "Medium", - "text": "Don't enable virtual network service endpoints by default on all subnets.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "text": "Avoid using root account when it is not necessary", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", + "checklist": "Azure Event Hub Review", + "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ", + "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", + "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", + "service": "Event Hubs", "severity": "Medium", - "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", - "service": "ExpressRoute", + "checklist": "Azure Event Hub Review", + "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.", + "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", + "service": "Event Hubs", "severity": "High", - "text": "Use at least a /27 prefix for your Gateway subnets", + "text": "Use least privilege data plane RBAC", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", - "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", - "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", - "service": "NSG", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.", + "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", + "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", + "service": "Event Hubs", "severity": "Medium", - "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.", + "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", - "service": "NSG", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", + "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", + "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", + "service": "Event Hubs", "severity": "Medium", - "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", - "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", - "service": "NSG", + "checklist": "Azure Event Hub Review", + "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", + "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", + "service": "Event Hubs", "severity": "Medium", - "text": "The application team should use application security groups at the subnet-level NSGs to help protect multi-tier VMs within the landing zone.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Security" }, { - "checklist": "Azure Landing Zone Review", - "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", + "checklist": "Azure Event Hub Review", + "guid": "31d41e36-11c8-417b-8afb-c410d4391898", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", + "service": "Event Hubs", "severity": "Medium", - "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "Security" + "text": "Leverage FTA Resillency HandBook", + "waf": "Reliability" }, { - "checklist": "Azure Landing Zone Review", - "guid": "dfe237de-143b-416c-91d7-aa9b64704489", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", + "checklist": "Azure Event Hub Review", + "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones", + "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", + "service": "Event Hubs", + "severity": "High", + "text": "Leverage Availability Zones if regionally applicable", + "waf": "Reliability" + }, + { + "checklist": "Azure Event Hub Review", + "guid": "20b56c56-ad58-4519-8f82-735c586bb281", + "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", + "service": "Event Hubs", "severity": "Medium", - "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "Security" + "text": "Use the Premium or Dedicated SKUs for predicable performance", + "waf": "Reliability" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", - "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "NSG", + "checklist": "Azure Event Hub Review", + "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations", + "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", + "service": "Event Hubs", + "severity": "High", + "text": "Plan for Geo Disaster Recovery using Active Passive configuration", + "waf": "Reliability" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs", + "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", + "service": "Event Hubs", "severity": "Medium", - "text": "Consider the limit of NSG rules per NSG (1000).", - "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "text": "For Business Critical Applications, use Active Active configuration", "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", - "service": "VWAN", + "checklist": "Azure Event Hub Review", + "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", + "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", + "service": "Event Hubs", "severity": "Medium", - "text": "Consider Virtual WAN for simplified Azure networking management, and make sure your scenario is explicitly described in the list of Virtual WAN routing designs", - "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", - "waf": "Operations" + "text": "Design Resilient Event Hubs", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "checklist": "Redis Resiliency checklist", + "guid": "65285269-440b-44be-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", + "service": "Redis", + "severity": "High", + "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.", + "waf": "Reliability" + }, + { + "checklist": "Redis Resiliency checklist", + "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", + "service": "Redis", "severity": "Medium", - "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.", - "waf": "Performance" + "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "severity": "Low", - "text": "Follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network", - "waf": "Performance" + "checklist": "Redis Resiliency checklist", + "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", + "service": "Redis", + "severity": "Medium", + "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", - "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "checklist": "Redis Resiliency checklist", + "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", + "service": "Redis", "severity": "Medium", - "text": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Security" + "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "VWAN", + "checklist": "Azure Bot Service", + "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", + "service": "Bot service", "severity": "Medium", - "text": "Ensure that the network architecture is within the Azure Virtual WAN limits.", + "text": "Follow reliability support recommendations in Azure Bot Service", "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", - "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", - "service": "VWAN", + "checklist": "Azure Bot Service", + "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", + "service": "Bot service", "severity": "Medium", - "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.", - "waf": "Operations" + "text": "Deploying bots with local data residency and regional compliance", + "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", - "service": "VWAN", + "checklist": "Azure Bot Service", + "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", + "service": "Bot service", "severity": "Medium", - "text": "Make sure that your IaC deployments does not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.", + "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.", "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", - "service": "VWAN", + "checklist": "MySQL Review Checklist", + "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", + "service": "Azure MySQL", "severity": "Medium", - "text": "Use AS-Path as hub routing preference, since it is more flexible than ExpressRoute or VPN.", + "text": "Leverage Flexible Server", "waf": "Reliability" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", - "service": "VWAN", + "checklist": "MySQL Review Checklist", + "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", + "service": "Azure MySQL", + "severity": "High", + "text": "Leverage Availability Zones where regionally applicable", + "waf": "Reliability" + }, + { + "checklist": "MySQL Review Checklist", + "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", + "service": "Azure MySQL", "severity": "Medium", - "text": "Make sure that your IaC deployments are configuring label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.", + "text": "Leverage Data-in replication for cross-region DR scenarios", "waf": "Reliability" }, { - "ammp": true, - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "9c75dfef-573c-461c-a698-68598595581a", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", - "service": "VWAN", + "checklist": "Logic Apps checklist", + "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", + "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", + "service": "Logic Apps", "severity": "High", - "text": "Assign enough IP space to virtual hubs, ideally a /23 prefix.", + "text": "Select the right Logic App hosting plan based on your business & SLO requirements", "waf": "Reliability" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "Logic Apps checklist", + "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", + "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "Logic Apps", "severity": "High", - "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.", - "waf": "Security" + "text": "Protect logic apps from region failures with zone redundancy and availability zones", + "waf": "Reliability" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", - "severity": "Medium", - "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.", - "waf": "Security" + "checklist": "Logic Apps checklist", + "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", + "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Logic Apps", + "severity": "High", + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "checklist": "Azure Landing Zone Review", - "guid": "223ace8c-b123-408c-a501-7f154e3ab369", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", - "severity": "Medium", - "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes", - "waf": "Security" + "checklist": "Logic Apps checklist", + "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", + "link": "https://learn.microsoft.com/azure/app-service/environment/intro", + "service": "Logic Apps", + "severity": "High", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3829e7e3-1618-4368-9a04-77a209945bda", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "Logic Apps checklist", + "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", + "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", + "service": "Logic Apps", "severity": "Medium", - "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.", - "waf": "Security" + "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", + "waf": "Operations" }, { - "checklist": "Azure Landing Zone Review", - "guid": "43334f24-9116-4341-a2ba-527526944008", - "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", - "service": "Policy", - "severity": "Low", - "text": "Use Azure Policy to control which services users can provision at the subscription/management group level", - "waf": "Security" + "checklist": "Cost Optimization Checklist", + "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "service": "Azure Monitor", + "severity": "Medium", + "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "Cost Optimization Checklist", + "guid": "45901365-d38e-443f-abcb-d868266abca2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Azure Backup", "severity": "Medium", - "text": "Use built-in policies where possible to minimize operational overhead.", - "waf": "Security" + "text": "check backup instances with the underlying datasource not found", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "description": "Assigning the Resource Policy Contributor role to specific scopes allows you to delegate policy management to relevant teams. For instance, a central IT team may oversee management group-level policies, while application teams handle policies for their subscriptions, enabling distributed governance with adherence to organizational standards.", - "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", - "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", - "service": "Policy", + "checklist": "Cost Optimization Checklist", + "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "VM", "severity": "Medium", - "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.", - "waf": "Security" + "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "19048384-5c98-46cb-8913-156a12476e49", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "Cost Optimization Checklist", + "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Azure Backup", "severity": "Medium", - "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.", - "waf": "Security" + "text": "Consider a good balance between site recovery storage and backup for non mission critical applications", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", - "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", - "service": "Policy", + "checklist": "Cost Optimization Checklist", + "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", + "service": "Azure Monitor", "severity": "Medium", - "text": "If any data sovereignty requirements exist, Azure Policies can be deployed to enforce them", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", - "waf": "Security" + "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", - "service": "Policy", + "checklist": "Cost Optimization Checklist", + "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Azure Monitor", "severity": "Medium", - "text": "For Sovereign Landing Zone, sovereignty policy baseline' policy initiative is deployed and and assigned at correct MG level.", - "waf": "Security" + "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)", + "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", - "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", - "service": "Policy", + "checklist": "Cost Optimization Checklist", + "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "VM", "severity": "Medium", - "text": "For Sovereign Landing Zone, sovereign Control objectives to policy mapping' is documented.", - "waf": "Security" + "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", - "service": "Policy", + "checklist": "Cost Optimization Checklist", + "guid": "d1e44a19-659d-4395-afd7-7289b835556d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Storage", "severity": "Medium", - "text": "For Sovereign Landing Zone, process is in place for CRUD of 'Sovereign Control objectives to policy mapping'.", - "waf": "Security" + "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "checklist": "Cost Optimization Checklist", + "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "VM", "severity": "Medium", - "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.", - "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "waf": "Operations" + "text": "Make sure advisor is configured for VM right sizing ", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Monitor", + "checklist": "Cost Optimization Checklist", + "description": "check by searching the Meter Category Licenses in the Cost analysys", + "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", + "service": "VM", "severity": "Medium", - "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Operations" + "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", - "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", + "checklist": "Cost Optimization Checklist", + "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "service": "VM", "severity": "Medium", - "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Operations" + "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "checklist": "Cost Optimization Checklist", + "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", "service": "VM", "severity": "Medium", - "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "Operations" + "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)", + "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "checklist": "Cost Optimization Checklist", + "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", "service": "VM", "severity": "Medium", - "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "Operations" + "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "90483845-c986-4cb2-a131-56a12476e49f", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Network Watcher", + "checklist": "Cost Optimization Checklist", + "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "VM", "severity": "Medium", - "text": "Use Network Watcher to proactively monitor traffic flows", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "Operations" + "text": "Only larger disks can be reserved => 1 TiB -", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Monitor", + "checklist": "Cost Optimization Checklist", + "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", + "service": "VM", "severity": "Medium", - "text": "Use Azure Monitor Logs for insights and reporting.", - "waf": "Operations" + "text": "After the right-sizing optimization", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "97be9951-9048-4384-9c98-6cb2913156a1", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", - "service": "Monitor", + "checklist": "Cost Optimization Checklist", + "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Azure SQL", "severity": "Medium", - "text": "Use Azure Monitor alerts for the generation of operational alerts.", - "waf": "Operations" + "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "Monitor", + "checklist": "Cost Optimization Checklist", + "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "VM", "severity": "Medium", - "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.", - "waf": "Operations" + "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Backup", + "checklist": "Cost Optimization Checklist", + "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "VM", "severity": "Medium", - "text": "When using Azure Backup, consider the different backup types (GRS, ZRS & LRS) as the default setting is GRS", - "waf": "Reliability" + "text": "Consider using a VMSS to match demand rather than flat sizing", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "VM", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Cost Optimization Checklist", + "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "AKS", "severity": "Medium", - "text": "Use Azure policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.", - "waf": "Security" + "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "description": "Azure Policy's guest configuration features can audit and remediate machine settings (e.g., OS, application, environment) to ensure resources align with expected configurations, and Update Management can enforce patch management for VMs.", - "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "VM", + "checklist": "Cost Optimization Checklist", + "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Azure Backup", "severity": "Medium", - "text": "Monitor VM security configuration drift via Azure Policy.", - "waf": "Security" + "text": "Move recovery points to vault-archive where applicable (Validate)", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", + "checklist": "Cost Optimization Checklist", + "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", + "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", + "service": "Databricks", "severity": "Medium", - "text": "Use Azure Site Recovery for Azure-to-Azure Virtual Machines disaster recovery scenarios. This enables you to replicate workloads across regions.", - "waf": "Operations" + "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "Backup", + "checklist": "Cost Optimization Checklist", + "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", + "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", + "service": "Azure Functions", "severity": "Medium", - "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.", - "waf": "Operations" + "text": "Functions - Reuse connections", + "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", + "waf": "Cost" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", - "severity": "High", - "text": "Leverage Availability Zones for your VMs in regions where they are supported.", - "waf": "Reliability" + "checklist": "Cost Optimization Checklist", + "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "service": "Azure Functions", + "severity": "Medium", + "text": "Functions - Cache data locally", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", + "waf": "Cost" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", - "severity": "High", - "text": "Avoid running a production workload on a single VM.", - "waf": "Reliability" + "checklist": "Cost Optimization Checklist", + "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Azure Functions", + "severity": "Medium", + "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "84101f59-1941-4195-a270-e28034290e3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", + "checklist": "Cost Optimization Checklist", + "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "Azure Functions", "severity": "Medium", - "text": "Azure Load Balancer and Application Gateway distribute incoming network traffic across multiple resources.", - "waf": "Reliability" + "text": "Functions - Keep your functions warm", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Cost" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "WAF", - "severity": "High", - "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.", - "waf": "Operations" + "checklist": "Cost Optimization Checklist", + "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Azure Functions", + "severity": "Medium", + "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7f408960-c626-44cb-a018-347c8d790cdf", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "WAF", + "checklist": "Cost Optimization Checklist", + "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", + "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", + "service": "Azure Functions", "severity": "Medium", - "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.", - "waf": "Operations" + "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.", + "waf": "Cost" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "5017f154-e3ab-4369-9829-e7e316183687", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "Key Vault", - "severity": "High", - "text": "Use Azure Key Vault to store your secrets and credentials", - "waf": "Security" + "checklist": "Cost Optimization Checklist", + "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", + "service": "Azure Functions", + "severity": "Medium", + "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", - "guid": "a0477a20-9945-4bda-9333-4f2491163418", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Front Door", "severity": "Medium", - "text": "Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets.", - "waf": "Security" + "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Front Door", "severity": "Medium", - "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", - "waf": "Security" + "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "dc055bcf-619e-48a1-9f98-879525d62688", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", + "service": "Storage", "severity": "Medium", - "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.", - "waf": "Security" + "text": "Consider archiving tiers for less used data", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "VM", "severity": "Medium", - "text": "Automate the certificate management and renewal process with public certificate authorities to ease administration.", - "waf": "Security" + "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "913156a1-2476-4e49-b541-acdce979377b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "Storage", "severity": "Medium", - "text": "Establish an automated process for key and certificate rotation.", - "waf": "Security" + "text": "Consider using standard SSD rather than Premium or Ultra where possible", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "Storage", "severity": "Medium", - "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.", - "waf": "Security" + "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", - "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "Site Recovery", "severity": "Medium", - "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.", - "waf": "Security" + "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", + "service": "Storage", "severity": "Medium", - "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.", - "waf": "Security" + "text": "Storage accounts: check hot tier and/or GRS necessary", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "91163418-2ba5-4275-8694-4008be7d7e48", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "VM", "severity": "Medium", - "text": "Use an Azure Key Vault per application per environment per region.", - "waf": "Security" + "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "25d62688-6d70-4ba6-a97b-e99519048384", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "Synapse", "severity": "Medium", - "text": "If you want to bring your own keys, this might not be supported across all considered services. Implement relevant mitigation so that inconsistencies don't hinder desired outcomes. Choose appropriate region pairs and disaster recovery regions that minimize latency.", - "waf": "Security" + "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", - "link": "https://learn.microsoft.com/industry/sovereignty/key-management", - "service": "Key Vault", + "checklist": "Cost Optimization Checklist", + "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "Synapse", "severity": "Medium", - "text": "For Sovereign Landing Zone, use Azure Key Vault managed HSM to store your secrets and credentials.", - "waf": "Security" + "text": "Export cost data to a storage account for additional data analysis.", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", - "service": "Entra", + "checklist": "Cost Optimization Checklist", + "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Synapse", "severity": "Medium", - "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.", - "waf": "Security" + "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.", + "waf": "Cost" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "09945bda-4333-44f2-9911-634182ba5275", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", - "service": "Defender", - "severity": "High", - "text": "Enable Defender Cloud Security Posture Management for all subscriptions.", - "waf": "Security" + "checklist": "Cost Optimization Checklist", + "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", + "service": "Synapse", + "severity": "Medium", + "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.", + "waf": "Cost" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", - "service": "Defender", - "severity": "High", - "text": "Enable a Defender Cloud Workload Protection Plan for Servers on all subscriptions.", - "waf": "Security" + "checklist": "Cost Optimization Checklist", + "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Synapse", + "severity": "Medium", + "text": "Create multiple Apache Spark pool definitions of various sizes.", + "waf": "Cost" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", - "service": "Defender", - "severity": "High", - "text": "Enable Defender Cloud Workload Protection Plans for Azure Resources on all subscriptions.", - "waf": "Security" + "checklist": "Cost Optimization Checklist", + "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "service": "Synapse", + "severity": "Medium", + "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Cost" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", - "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", + "checklist": "Cost Optimization Checklist", + "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", "service": "VM", - "severity": "High", - "text": "Enable Endpoint Protection on IaaS Servers.", - "waf": "Security" + "severity": "Medium", + "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", - "link": "https://learn.microsoft.com/azure/security-center/", + "checklist": "Cost Optimization Checklist", + "guid": "544451e1-92d3-4442-a3c7-628637a551c5", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", "service": "VM", "severity": "Medium", - "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.", - "waf": "Security" + "text": "Right-sizing all VMs", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "checklist": "Cost Optimization Checklist", + "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "VM", "severity": "Medium", - "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.", - "waf": "Security" + "text": "Swap VM sized with normalized and most recent sizes", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", - "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", - "service": "Entra", + "checklist": "Cost Optimization Checklist", + "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", "severity": "Medium", - "text": "For Sovereign Landing Zone, transparancy logs is enabled on the Entra ID tenant.", - "waf": "Security" + "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Cost" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", - "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", - "service": "Entra", + "checklist": "Cost Optimization Checklist", + "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", "severity": "Medium", - "text": "For Sovereign Landing Zone, customer Lockbox is enabled on the Entra ID tenant.", - "waf": "Security" + "text": "Containerizing an application can improve VM density and save money on scaling it", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Cost" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Storage", - "severity": "High", - "text": "Secure transfer to storage accounts should be enabled", - "waf": "Security" + "checklist": "Azure Data Factory Review Checklist", + "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", + "service": "Azure Data Factory", + "severity": "Medium", + "text": "Leverage FTA Resiliency Playbook for Azure Data Factory", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", - "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", - "service": "Storage", + "checklist": "Azure Data Factory Review Checklist", + "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "High", - "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.", - "waf": "Security" + "text": "Use zone redundant pipelines in regions that support Availability Zones", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", - "service": "Key Vault", - "severity": "High", - "text": "Use Key Vault secrets to avoid hard-coding sensitive information such as credentials (virtual machines user passwords), certificates or keys.", - "waf": "Operations" + "checklist": "Azure Data Factory Review Checklist", + "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", + "link": "https://learn.microsoft.com/azure/data-factory/source-control", + "service": "Azure Data Factory", + "severity": "Medium", + "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ", + "waf": "Reliability" }, { - "checklist": "Azure API Management Review", - "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", - "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", - "service": "APIM", + "checklist": "Azure Data Factory Review Checklist", + "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "Medium", - "text": "Implement an error handling policy at the global level", - "waf": "Operations" + "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ", + "waf": "Reliability" }, { - "checklist": "Azure API Management Review", - "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", - "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", - "service": "APIM", + "checklist": "Azure Data Factory Review Checklist", + "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "Medium", - "text": "Ensure all APIs policies include a element.", - "waf": "Operations" + "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region", + "waf": "Reliability" }, { - "checklist": "Azure API Management Review", - "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", - "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", - "service": "APIM", - "severity": "Medium", - "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs", - "waf": "Operations" + "checklist": "Azure Data Factory Review Checklist", + "description": "If your ADF Pipelines use Key Vault you don't have to do anything to replicate Key Vault. Key Vault is a managed service and Microsoft takes care of it for you", + "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Azure Data Factory", + "severity": "Low", + "text": "If using Keyvault integration, use SLA of Keyvault to understand your availablity", + "waf": "Reliability" }, { - "checklist": "Azure API Management Review", - "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", - "link": "https://learn.microsoft.com/azure/api-management/monetization-support", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Front Door", "severity": "Medium", - "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices", - "waf": "Operations" - }, - { - "checklist": "Azure API Management Review", - "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", - "service": "APIM", - "severity": "High", - "text": "Enable Diagnostics Settings to export logs to Azure Monitor", + "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal", "waf": "Operations" }, { - "checklist": "Azure API Management Review", - "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", + "guid": "553585a6-abe0-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "App Gateway", "severity": "Medium", - "text": "Enable Application Insights for more detailed telemetry", - "waf": "Operations" + "text": "Ensure you are using Application Gateway v2 SKU", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", - "service": "APIM", - "severity": "High", - "text": "Configure alerts on the most critical metrics", - "waf": "Operations" + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", + "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Load Balancer", + "severity": "Medium", + "text": "Ensure you are using the Standard SKU for your Azure Load Balancers", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", - "service": "APIM", - "severity": "High", - "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated", + "checklist": "Azure Application Delivery Networking", + "guid": "9432621a-8397-4654-a882-5bc856b7ef83", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", + "service": "Load Balancer", + "severity": "Medium", + "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", - "service": "APIM", - "severity": "High", - "text": "Protect incoming requests to APIs (data plane) with Azure AD", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", + "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "App Gateway", + "severity": "Medium", + "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.", + "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "severity": "Medium", - "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal", + "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "severity": "Medium", - "text": "Create appropriate groups to control the visibility of the products", + "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "06862505-2d9a-4874-9491-2837b00a3475", - "link": "https://learn.microsoft.com/azure/api-management/backends", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", + "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", + "service": "App Gateway", "severity": "Medium", - "text": "Use Backends feature to eliminate redundant API backend configurations", - "waf": "Operations" + "text": "Configure autoscaling with a minimum amount of instances of two.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Reliability" }, { - "checklist": "Azure API Management Review", - "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", + "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", + "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", + "service": "App Gateway", "severity": "Medium", - "text": "Use Named Values to store common values that can be used in policies", - "waf": "Operations" + "text": "Deploy Application Gateway across Availability Zones", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Reliability" }, { - "checklist": "Azure API Management Review", - "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Front Door", "severity": "Medium", - "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA", - "waf": "Reliability" + "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", - "link": "https://learn.microsoft.com/azure/api-management/high-availability", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "3f29812b-2363-4cef-b179-b599de0d5973", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "Front Door", "severity": "Medium", - "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%", - "waf": "Reliability" + "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", - "service": "APIM", + "ammp": true, + "arm-service": "microsoft.network/trafficManagerProfiles", + "checklist": "Azure Application Delivery Networking", + "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Traffic Manager", "severity": "High", - "text": "Ensure there is an automated backup routine", + "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Reliability" }, { - "checklist": "Azure API Management Review", - "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", - "link": "https://learn.microsoft.com/azure/api-management/retry-policy", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", + "severity": "Low", + "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", + "waf": "Security" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", "severity": "Medium", - "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.", - "waf": "Reliability" + "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", - "service": "APIM", - "severity": "Low", - "text": "If you need to log at high performance levels, consider Event Hubs policy", - "waf": "Operations" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "ae248989-b306-4591-9186-de482e3f0f0e", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "Front Door", + "severity": "High", + "text": "Deploy your WAF policy for Front Door in 'Prevention' mode.", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", - "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", - "service": "APIM", - "severity": "Medium", - "text": "Apply throttling policies to control the number of requests per second", - "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", - "waf": "Performance" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "Front Door", + "severity": "High", + "text": "Avoid combining Azure Traffic Manager and Azure Front Door.", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", - "service": "APIM", - "severity": "Medium", - "text": "Configure autoscaling to scale out the number of instances when the load increases", - "waf": "Performance" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "Front Door", + "severity": "High", + "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", - "service": "APIM", - "severity": "Medium", - "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.", + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", + "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "Front Door", + "severity": "Low", + "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.", "waf": "Performance" }, { - "checklist": "Azure API Management Review", - "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", - "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "Front Door", "severity": "Medium", - "text": "Use the premium tier for production workloads.", + "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.", "waf": "Reliability" }, { - "checklist": "Azure API Management Review", - "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", - "service": "APIM", - "severity": "Medium", - "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.", - "waf": "Reliability" + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", + "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "Front Door", + "severity": "Low", + "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.", + "waf": "Performance" }, { - "checklist": "Azure API Management Review", - "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", - "service": "APIM", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", + "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "Load Balancer", "severity": "High", - "text": "Be aware of APIM's limits", + "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability", "waf": "Reliability" }, { - "checklist": "Azure API Management Review", - "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", - "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", - "service": "APIM", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", + "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "Front Door", "severity": "High", - "text": "Ensure that the self-hosted gateway deployments are resilient.", - "waf": "Reliability" + "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.", + "waf": "Operations" }, { - "checklist": "Azure API Management Review", - "guid": "7519e385-a88b-4d34-966b-6269d686e890", - "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", + "service": "Front Door", "severity": "Medium", - "text": "Use Azure Front Door in front of APIM for multi-region deployment", - "waf": "Performance" + "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", + "waf": "Operations" }, { - "checklist": "Azure API Management Review", - "guid": "cd45c90e-7690-4753-930b-bf290c69c074", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", - "service": "APIM", - "severity": "Medium", - "text": "Deploy the service within a Virtual Network (VNet)", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", + "service": "Front Door", + "severity": "High", + "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", + "service": "Front Door", "severity": "Medium", - "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.", + "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", - "service": "APIM", - "severity": "Medium", - "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", + "service": "Front Door", + "severity": "High", + "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", - "service": "APIM", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", + "service": "Front Door", "severity": "High", - "text": "Disable Public Network Access", + "text": "Tune the Azure Front Door WAF for your workload. Reduce false positive detections.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", - "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", - "service": "APIM", - "severity": "Medium", - "text": "Simplify management with PowerShell automation scripts", - "waf": "Operations" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "Front Door", + "severity": "High", + "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", - "service": "APIM", - "severity": "Medium", - "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator", - "waf": "Operations" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", + "service": "Front Door", + "severity": "High", + "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", - "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", - "service": "APIM", - "severity": "Medium", - "text": "Promote usage of Visual Studio Code APIM extension for faster API development", - "waf": "Operations" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", + "service": "Front Door", + "severity": "High", + "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "354f1c03-8112-4965-85ad-c0074bddf231", - "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", + "service": "Front Door", "severity": "Medium", - "text": "Implement DevOps and CI/CD in your workflow", - "waf": "Operations" + "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", + "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "b6439493-426a-45f3-9697-cf65baee208d", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "b9620385-1cde-418f-914b-a84a06982ffc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", + "service": "Front Door", "severity": "Medium", - "text": "Secure APIs using client certificate authentication", + "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "2a67d143-1033-4c0a-8732-680896478f08", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", + "service": "Front Door", "severity": "Medium", - "text": "Secure backend services using client certificate authentication", + "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", - "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", - "service": "APIM", - "severity": "Medium", - "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs", + "checklist": "Azure Application Delivery Networking", + "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", + "service": "Front Door", + "severity": "Low", + "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", - "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", - "service": "APIM", + "checklist": "Azure Application Delivery Networking", + "guid": "00acd8a9-6975-414f-8491-2be6309893b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", + "service": "Front Door", "severity": "Medium", - "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs", + "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", - "service": "APIM", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", + "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", + "service": "App Gateway", "severity": "High", - "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.", + "text": "Enable the Azure Application Gateway WAF bot protection rule set The bot rules detect good and bad bots.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "f8af3d94-1d2b-4070-846f-849197524258", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", - "service": "APIM", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "App Gateway", "severity": "High", - "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated", + "text": "Enable request body inspection feature enabled in Azure Application Gateway WAF policy.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "791abd8b-7706-4e31-9569-afefde724be3", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", - "service": "APIM", - "severity": "Medium", - "text": "Use managed identities to authenticate to other Azure resources whenever possible", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", + "service": "App Gateway", + "severity": "High", + "text": "Tune the Azure Application Gateway WAF for your workload. Reduce false positive detections.", "waf": "Security" }, { - "checklist": "Azure API Management Review", - "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", - "service": "APIM", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "App Gateway", "severity": "High", - "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM", + "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", - "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", - "service": "App Services", - "severity": "Low", - "text": "Refer to baseline highly available zone-redundant web application architecture for best practices", - "waf": "Reliability" + "checklist": "Azure Application Delivery Networking", + "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", + "service": "App Gateway", + "severity": "Medium", + "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", + "waf": "Security" }, { - "checklist": "Azure App Service Review", - "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", - "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", + "service": "App Gateway", "severity": "Medium", - "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.", - "waf": "Reliability" + "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", + "waf": "Security" }, { - "checklist": "Azure App Service Review", - "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", - "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", - "service": "App Services", - "severity": "High", - "text": "Leverage Availability Zones where regionally applicable (requires Premium v2 or v3 tier)", - "waf": "Reliability" + "checklist": "Azure Application Delivery Networking", + "guid": "99937189-ff78-492a-b9ca-18d828d82b37", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", + "service": "App Gateway", + "severity": "Low", + "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", + "waf": "Security" }, { - "checklist": "Azure App Service Review", - "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", + "service": "App Gateway", "severity": "Medium", - "text": "Implement health checks", - "waf": "Reliability" - }, - { - "checklist": "Azure App Service Review", - "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", - "service": "App Services", - "severity": "High", - "text": "Refer to backup and restore best practices for Azure App Service", - "waf": "Reliability" + "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", + "waf": "Security" }, { - "checklist": "Azure App Service Review", - "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", - "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", - "service": "App Services", - "severity": "High", - "text": "Implement Azure App Service reliability best practices", - "waf": "Reliability" + "checklist": "Azure Application Delivery Networking", + "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", + "service": "App Gateway", + "severity": "Medium", + "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", + "waf": "Security" }, { - "checklist": "Azure App Service Review", - "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", - "service": "App Services", - "severity": "Low", - "text": "Familiarize with how to move an App Service app to another region During a disaster", - "waf": "Reliability" + "checklist": "Azure Application Delivery Networking", + "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "App Gateway", + "severity": "Medium", + "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.", + "waf": "Operations" }, { - "checklist": "Azure App Service Review", - "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", - "service": "App Services", - "severity": "High", - "text": "Familiarize with reliability support in Azure App Service", - "waf": "Reliability" + "checklist": "Azure Application Delivery Networking", + "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "Front Door", + "severity": "Medium", + "text": "Add diagnostic settings to save your Azure Front Door WAF logs.", + "waf": "Operations" }, { - "checklist": "Azure App Service Review", - "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "92664c60-47e3-4591-8b1b-8d557656e686", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", + "service": "App Gateway", "severity": "Medium", - "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan", - "waf": "Reliability" + "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.", + "waf": "Operations" }, { - "checklist": "Azure App Service Review", - "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "845f5f91-9c21-4674-a725-5ce890850e20", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "Front Door", "severity": "Medium", - "text": "Monitor App Service instances using Health checks", - "waf": "Reliability" + "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.", + "waf": "Operations" }, { - "checklist": "Azure App Service Review", - "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", + "service": "App Gateway", "severity": "Medium", - "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests", - "waf": "Reliability" + "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", + "waf": "Operations" }, { - "checklist": "Azure App Service Review", - "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", - "service": "App Services", - "severity": "Low", - "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website", - "waf": "Reliability" + "checklist": "Azure Application Delivery Networking", + "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", + "service": "App Gateway", + "severity": "Medium", + "text": "Use WAF Policies instead of the legacy WAF configuration.", + "waf": "Operations" }, { - "checklist": "Azure App Service Review", - "description": "Use Azure Key Vault to store any secrets the application needs. Key Vault provides a safe and audited environment for storing secrets and is well-integrated with App Service through the Key Vault SDK or App Service Key Vault References.", - "guid": "834ac932-223e-4ce8-8b12-3071a5416415", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", - "severity": "High", - "text": "Use Key Vault to store secrets", + "checklist": "Azure Application Delivery Networking", + "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", + "service": "App Gateway", + "severity": "Medium", + "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Use a Managed Identity to connect to Key Vault either using the Key Vault SDK or through App Service Key Vault References.", - "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", - "severity": "High", - "text": "Use Managed Identity to connect to Key Vault", + "checklist": "Azure Application Delivery Networking", + "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", + "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", + "service": "Front Door", + "severity": "Medium", + "text": "Make sure your origins only take traffic from your Azure Front Door instance.", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Store the App Service TLS certificate in Key Vault.", - "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "service": "App Gateway", "severity": "High", - "text": "Use Key Vault to store TLS certificate.", + "text": "You should encrypt traffic to the backend servers.", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Systems that process sensitive information should be isolated. To do so, use separate App Service Plans or App Service Environments and consider the use of different subscriptions or management groups.", - "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", - "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", - "service": "App Services", - "severity": "Medium", - "text": "Isolate systems that process sensitive information", + "checklist": "Azure Application Delivery Networking", + "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "service": "App Gateway", + "severity": "High", + "text": "You should use a Web Application Firewall.", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Local disks on App Service are not encrypted and sensitive data should not be stored on those. (For example: D:\\\\Local and %TMP%).", - "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", + "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", + "service": "App Gateway", "severity": "Medium", - "text": "Do not store sensitive data on local disk", + "text": "Redirect HTTP to HTTPS", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "For authenticated web application, use a well established Identity Provider like Azure AD or Azure AD B2C. Leverage the application framework of your choice to integrate with this provider or use the App Service Authentication / Authorization feature.", - "guid": "919ca0b2-c121-459e-814b-933df574eccc", - "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", + "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", + "service": "App Gateway", "severity": "Medium", - "text": "Use an established Identity Provider for authentication", - "waf": "Security" + "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing", + "waf": "Operations" }, { - "checklist": "Azure App Service Review", - "description": "Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.", - "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", - "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", + "service": "App Gateway", "severity": "High", - "text": "Deploy from a trusted environment", + "text": "Enable connection draining during planned service updates to prevent connection loss to existing membrs of the backend pool", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Disable basic authentication for both FTP/FTPS and for WebDeploy/SCM. This disables access to these services and enforces the use of Azure AD secured endpoints for deployment. Note that the SCM site can also be opened using Azure AD credentials.", - "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", - "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", - "service": "App Services", - "severity": "High", - "text": "Disable basic authentication", - "waf": "Security" + "checklist": "Azure Application Delivery Networking", + "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", + "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", + "service": "App Gateway", + "severity": "Low", + "text": "Create custom error pages to display a personalized user experience", + "waf": "Operations" }, { - "checklist": "Azure App Service Review", - "description": "Where possible use Managed Identity to connect to Azure AD secured resources. If this is not possible, store secrets in Key Vault and connect to Key Vault using a Managed Identity instead.", - "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", - "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", - "service": "App Services", - "severity": "High", - "text": "Use Managed Identity to connect to resources", + "checklist": "Azure Application Delivery Networking", + "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", + "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", + "service": "App Gateway", + "severity": "Medium", + "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Where using images stored in Azure Container Registry, pull these using a Managed Identity.", - "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", - "service": "App Services", - "severity": "High", - "text": "Pull containers using a Managed Identity", - "waf": "Security" + "checklist": "Azure Application Delivery Networking", + "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "App Gateway", + "severity": "Medium", + "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover", + "waf": "Performance" }, { - "checklist": "Azure App Service Review", - "description": "By configuring the diagnostic settings of App Service, you can send all telemetry to Log Analytics as the central destination for logging and monitoring. This allows you to monitor runtime activity of App Service such as HTTP logs, application logs, platform logs, ...", - "guid": "47768314-c115-4775-a2ea-55b46ad48408", - "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "29dcc19f-a8fa-4c35-8281-290577538793", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "App Gateway", "severity": "Medium", - "text": "Send App Service runtime logs to Log Analytics", - "waf": "Security" + "text": "Use transport layer load balancing", + "waf": "Performance" }, { - "checklist": "Azure App Service Review", - "description": "Set up a diagnostic setting to send the activity log to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the App Service resource itself.", - "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", + "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", + "service": "App Gateway", "severity": "Medium", - "text": "Send App Service activity logs to Log Analytics", + "text": "Configure routing based on host or domain name for multiple web applications on a single gateway", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Control outbound network access using a combination of regional VNet integration, network security groups and UDR's. Traffic should be routed to an NVA such as Azure Firewall. Ensure to monitor the Firewall's logs.", - "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", - "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", + "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", + "service": "App Gateway", "severity": "Medium", - "text": "Outbound network access should be controlled", + "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "You can provide a stable outbound IP by using VNet integration and using a VNet NAT Gateway or an NVA like Azure Firewall. This allows the receiving party to allow-list based on IP, should that be needed. Note that for communications towards Azure Services often there's no need to depend on the IP address and mechanics like Service Endpoints should be used instead. (Also the use of private endpoints on the receiving end avoids for SNAT to happen and provides a stable outbound IP range.)", - "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", - "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", + "service": "App Gateway", "severity": "Low", - "text": "Ensure a stable IP for outbound communications towards internet addresses", + "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Control inbound network access using a combination of App Service Access Restrictions, Service Endpoints or Private Endpoints. Different access restrictions can be required and configured for the web app itself and the SCM site.", - "guid": "0725769e-e669-41a4-a34a-c932223ece80", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", - "severity": "High", - "text": "Inbound network access should be controlled", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", + "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", + "service": "AKS", + "severity": "Low", + "text": "If required for AKS Windows workloads HostProcess containers can be used", + "waf": "Reliability" }, { - "checklist": "Azure App Service Review", - "description": "Protect against malicious inbound traffic using a Web Application Firewall like Application Gateway or Azure Front Door. Make sure to monitor the WAF's logs.", - "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", - "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", - "service": "App Services", - "severity": "High", - "text": "Use a WAF in front of App Service", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", + "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", + "service": "AKS", + "severity": "Low", + "text": "Use KEDA if running event-driven workloads", + "waf": "Performance" }, { - "checklist": "Azure App Service Review", - "description": "Make sure the WAF cannot be bypassed by locking down access to only the WAF. Use a combination of Access Restrictions, Service Endpoints and Private Endpoints.", - "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", + "link": "https://dapr.io/", + "service": "AKS", + "severity": "Low", + "text": "Use Dapr to ease microservice development", + "waf": "Operations" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", + "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", + "link": "https://learn.microsoft.com/azure/aks/uptime-sla", + "service": "AKS", "severity": "High", - "text": "Avoid for WAF to be bypassed", - "waf": "Security" + "text": "Use the SLA-backed AKS offering", + "waf": "Reliability" }, { - "checklist": "Azure App Service Review", - "description": "Set minimum TLS policy to 1.2 in App Service configuration.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", - "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", - "service": "App Services", - "severity": "Medium", - "text": "Set minimum TLS policy to 1.2", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", + "severity": "Low", + "text": "Use Disruption Budgets in your pod and deployment definitions", + "waf": "Reliability" }, { - "checklist": "Azure App Service Review", - "description": "Configure App Service to use HTTPS only. This causes App Service to redirect from HTTP to HTTPS. Strongly consider the use of HTTP Strict Transport Security (HSTS) in your code or from your WAF, which informs browsers that the site should only be accessed using HTTPS.", - "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", - "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", - "service": "App Services", + "checklist": "Azure AKS Review", + "guid": "3c763963-7a55-42d5-a15e-401955387e5c", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", + "service": "ACR", "severity": "High", - "text": "Use HTTPS only", - "waf": "Security" + "text": "If using a private registry, configure region replication to store images in multiple regions", + "waf": "Reliability" }, { - "checklist": "Azure App Service Review", - "description": "Do not use wildcards in your CORS configuration, as this allows all origins to access the service (thereby defeating the purpose of CORS). Specifically only allow the origins that you expect to be able to access the service.", - "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", - "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", - "service": "App Services", - "severity": "High", - "text": "Wildcards must not be used for CORS", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", + "service": "AKS", + "severity": "Low", + "text": "Use an external application such as kubecost to allocate costs to different users", + "waf": "Cost" }, { - "checklist": "Azure App Service Review", - "description": "Remote debugging must not be turned on in production as this opens additional ports on the service which increases the attack surface. Note that the service does turn of remote debugging automatically after 48 hours.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", - "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", - "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", - "service": "App Services", - "severity": "High", - "text": "Turn off remote debugging", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", + "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", + "service": "AKS", + "severity": "Low", + "text": "Use scale down mode to delete/deallocate nodes", + "waf": "Cost" }, { - "checklist": "Azure App Service Review", - "description": "Enable Defender for App Service. This (amongst other threats) detects communications to known malicious IP addresses. Review the recommendations from Defender for App Service as part of your operations.", - "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", - "service": "App Services", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", + "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", + "service": "AKS", "severity": "Medium", - "text": "Enable Defender for Cloud - Defender for App Service", - "waf": "Security" + "text": "When required use multi-instance partitioning GPU on AKS Clusters", + "waf": "Cost" }, { - "checklist": "Azure App Service Review", - "description": "Azure provides DDoS Basic protection on its network, which can be improved with intelligent DDoS Standard capabilities which learns about normal traffic patterns and can detect unusual behavior. DDoS Standard applies to a Virtual Network so it must be configured for the network resource in front of the app, such as Application Gateway or an NVA.", - "guid": "223ece80-b123-4071-a541-6415833ea3ad", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "App Services", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", + "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", + "service": "AKS", + "severity": "Low", + "text": "If running a Dev/Test cluster use NodePool Start/Stop", + "waf": "Cost" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", + "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", + "service": "AKS", "severity": "Medium", - "text": "Enable DDOS Protection Standard on the WAF VNet", + "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Where using images stored in Azure Container Registry, pull these over a virtual network from Azure Container Registry using its private endpoint and the app setting 'WEBSITE_PULL_IMAGE_OVER_VNET'.", - "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", - "service": "App Services", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", + "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "severity": "Medium", - "text": "Pull containers over a Virtual Network", + "text": "Separate applications from the control plane with user/system node pools", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Conduct a penetration test on the web application following the penetration testing rules of engagement.", - "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", - "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", - "service": "App Services", - "severity": "Medium", - "text": "Conduct a penetration test", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", + "severity": "Low", + "text": "Add taint to your system nodepool to make it dedicated", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", - "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", - "service": "App Services", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", + "link": "https://learn.microsoft.com/azure/container-registry/", + "service": "AKS", "severity": "Medium", - "text": "Deploy validated code", + "text": "Use a private registry for your images, such as ACR", "waf": "Security" }, { - "checklist": "Azure App Service Review", - "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", - "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", - "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", - "service": "App Services", - "severity": "High", - "text": "Use up-to-date platforms, languages, protocols and frameworks", + "checklist": "Azure AKS Review", + "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", + "link": "https://learn.microsoft.com/azure/security-center/container-security", + "service": "ACR", + "severity": "Medium", + "text": "Scan your images for vulnerabilities", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", + "service": "AKS", "severity": "High", - "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure", + "text": "Define app separation requirements (namespace/nodepool/cluster)", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "75089c20-990d-4927-b105-885576f76fc2", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", + "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", + "service": "AKS", "severity": "Medium", - "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure", + "text": "Store your secrets in Azure Key Vault with the CSI Secrets Store driver", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", + "link": "https://learn.microsoft.com/azure/aks/update-credentials", + "service": "AKS", "severity": "High", - "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'", + "text": "If using Service Principals for the cluster, refresh credentials periodically (like quarterly)", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", + "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", + "service": "AKS", "severity": "Medium", - "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)", + "text": "If required add Key Management Service etcd encryption", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", + "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", + "service": "AKS", + "severity": "Low", + "text": "If required consider using Confidential Compute for AKS", + "waf": "Security" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", + "service": "AKS", "severity": "Medium", - "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)", + "text": "Consider using Defender for Containers", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", + "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", + "service": "AKS", "severity": "High", - "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)", + "text": "Use managed identities instead of Service Principals", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", + "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", + "link": "https://learn.microsoft.com/azure/aks/managed-aad", + "service": "AKS", "severity": "Medium", - "text": "Has an RBAC model been created for use within VMware vSphere", + "text": "Integrate authentication with AAD (using the managed integration)", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", + "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", + "service": "AKS", "severity": "Medium", - "text": "RBAC permissions should be granted on ADDS groups and not on specific users", + "text": "Limit access to admin kubeconfig (get-credentials --admin)", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", - "service": "AVS", - "severity": "High", - "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", + "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", + "service": "AKS", + "severity": "Medium", + "text": "Integrate authorization with AAD RBAC", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", + "service": "AKS", "severity": "High", - "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations", + "text": "Use namespaces for restricting RBAC privilege in Kubernetes", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", - "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", - "service": "AVS", - "severity": "High", - "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand", - "waf": "Performance" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", - "service": "AVS", - "severity": "High", - "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'", - "waf": "Operations" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", + "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", + "service": "AKS", + "severity": "Medium", + "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", + "service": "AKS", "severity": "Medium", - "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection", - "waf": "Operations" + "text": "For AKS non-interactive logins use kubelogin (preview)", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", + "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", + "service": "AKS", "severity": "Medium", - "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity", - "waf": "Operations" + "text": "Disable AKS local accounts", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", - "service": "AVS", - "severity": "High", - "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).", - "waf": "Operations" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", + "service": "AKS", + "severity": "Low", + "text": "Configure if required Just-in-time cluster access", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", - "service": "AVS", - "severity": "High", - "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", + "service": "AKS", + "severity": "Low", + "text": "Configure if required AAD conditional access for AKS", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", - "service": "AVS", - "severity": "High", - "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", + "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", + "service": "AKS", + "severity": "Low", + "text": "If required for Windows AKS workloads configure gMSA ", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", + "service": "AKS", "severity": "Medium", - "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)", + "text": "For finer control consider using a managed Kubelet Identity", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", - "service": "AVS", - "severity": "High", - "text": "Limit use of CloudAdmin account to emergency access only", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", + "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", + "service": "AKS", + "severity": "Medium", + "text": "If using AGIC, do not share an AppGW across clusters", + "waf": "Reliability" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", - "service": "AVS", - "severity": "Medium", - "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", + "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", + "link": "https://learn.microsoft.com/azure/aks/http-application-routing", + "service": "AKS", + "severity": "High", + "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.", + "waf": "Reliability" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", + "service": "AKS", "severity": "Medium", - "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials", - "waf": "Security" + "text": "For Windows workloads use Accelerated Networking", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", + "guid": "ba7da7be-9952-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "severity": "High", - "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution", - "waf": "Security" + "text": "Use the standard ALB (as opposed to the basic one)", + "waf": "Reliability" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", + "service": "AKS", "severity": "Medium", - "text": "Is East-West traffic filtering implemented within NSX-T", + "text": "If using Azure CNI, consider using different Subnets for NodePools", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", - "service": "AVS", - "severity": "High", - "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", + "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", + "service": "AKS", + "severity": "Medium", + "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", + "guid": "a0f61565-9de5-458f-a372-49c831112dbd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "severity": "High", - "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads", - "waf": "Security" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", - "service": "AVS", - "severity": "Medium", - "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity", - "waf": "Security" + "text": "Choose the best CNI network plugin for your requirements (Azure CNI recommended)", + "waf": "Reliability" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "334fdf91-c234-4182-a652-75269440b4be", - "service": "AVS", - "severity": "Medium", - "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "High", + "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", - "service": "AVS", - "severity": "Medium", - "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "High", + "text": "If using Azure CNI, check the maximum pods/node (default 30)", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", - "service": "AVS", - "severity": "Medium", - "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "For internal apps organizations often open the whole AKS subnet in their firewalls. This opens network access to the nodes too, and potentially to the pods as well (if using Azure CNI). If LoadBalancer IPs are in a different subnet, only this one needs to be available to the app clients. Another reason is that if the IP addresses in the AKS subnet are a scarce resource, consuming its IP addresses for services will reduce the maximum scalability of the cluster .", + "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", + "link": "https://learn.microsoft.com/azure/aks/internal-lb", + "service": "AKS", + "severity": "Low", + "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", - "service": "AVS", - "severity": "Medium", - "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "High", + "text": "Size the service IP address range accordingly (it is going to limit the cluster scalability)", + "waf": "Reliability" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", + "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", + "service": "AKS", "severity": "Low", - "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)", + "text": "If required add your own CNI plugin", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a3592718-e6e2-4051-9267-6ae46691e883", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", + "service": "AKS", "severity": "Low", - "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible", - "waf": "Security" + "text": "If required configure Public IP per node in AKS", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5ac94222-3e13-4810-9230-81a941741583", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", + "link": "https://learn.microsoft.com/azure/aks/concepts-network", + "service": "AKS", "severity": "Medium", - "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)", - "waf": "Security" + "text": "Use an ingress controller to expose web-based apps instead of exposing them with LoadBalancer-type services", + "waf": "Reliability" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", - "service": "AVS", - "severity": "High", - "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", + "link": "https://learn.microsoft.com/azure/aks/nat-gateway", + "service": "AKS", + "severity": "Low", + "text": "Use Azure NAT Gateway as outboundType for scaling egress traffic", "waf": "Reliability" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d88408f3-7273-44c8-96ba-280214590146", - "service": "AVS", - "severity": "High", - "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", + "service": "AKS", + "severity": "Medium", + "text": "Use Dynamic allocations of IPs in order to avoid Azure CNI IP exhaustion", "waf": "Reliability" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", + "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", + "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", + "service": "AKS", "severity": "High", - "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement", - "waf": "Reliability" + "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", + "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", + "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", + "service": "AKS", "severity": "Medium", - "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.", - "waf": "Operations" + "text": "If using a public API endpoint, restrict the IP addresses that can access it", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", - "service": "AVS", - "severity": "Medium", - "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes", - "waf": "Operations" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", + "link": "https://learn.microsoft.com/azure/aks/private-clusters", + "service": "AKS", + "severity": "High", + "text": "Use private clusters if your requirements mandate it", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "severity": "Medium", - "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used", - "waf": "Cost" + "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", - "service": "AVS", - "severity": "Low", - "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution", - "waf": "Cost" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", + "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", + "severity": "High", + "text": "Enable a Kubernetes Network Policy option (Calico/Azure)", + "waf": "Security" }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "6691e883-5ac9-4422-83e1-3810523081a9", - "service": "AVS", - "severity": "Medium", - "text": "Consider the use of Azure Private-Link when using other Azure Native Services", + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", + "severity": "High", + "text": "Use Kubernetes network policies to increase intra-cluster security", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "severity": "High", - "text": "Ensure all required resource reside within the same Azure availability zone(s)", - "waf": "Performance" + "text": "Use a WAF for web workloads (UIs or APIs)", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", + "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", + "service": "AKS", "severity": "Medium", - "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads", + "text": "Use DDoS Standard in the AKS Virtual Network", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", + "link": "https://learn.microsoft.com/azure/aks/http-proxy", + "service": "AKS", + "severity": "Low", + "text": "If required add company HTTP Proxy", + "waf": "Security" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", + "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", + "service": "AKS", "severity": "Medium", - "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads", + "text": "Consider using a service mesh for advanced microservice communication management", "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", + "service": "AKS", "severity": "High", - "text": "Enable Diagnostic and metric logging on Azure VMware Solution", + "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", - "service": "AVS", - "severity": "Medium", - "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "337453a3-cc63-4963-9a65-22ac19e80696", + "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", + "service": "AKS", + "severity": "Low", + "text": "Check regularly Azure Advisor for recommendations on your cluster", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "589d457a-927c-4397-9d11-02cad6aae11e", - "service": "AVS", - "severity": "Medium", - "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", + "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", + "service": "AKS", + "severity": "Low", + "text": "Enable AKS auto-certificate rotation", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ee29711b-d352-4caa-ab79-b198dab81932", - "service": "AVS", - "severity": "Medium", - "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution", - "waf": "Security" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", - "service": "AVS", - "severity": "Medium", - "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", + "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", + "service": "AKS", + "severity": "High", + "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", + "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", + "service": "AKS", "severity": "High", - "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment", - "waf": "Security" + "text": "Use kured for Linux node upgrades in case you are not using node-image upgrade", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", + "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", + "service": "AKS", "severity": "High", - "text": "Are data processing implications (service provider / service consumer model) clear and documented", - "waf": "Security" + "text": "Have a regular process to upgrade the cluster node images periodically (weekly, for example)", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "547c1747-dc56-4068-a714-435cd19dd244", - "service": "AVS", - "severity": "Medium", - "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).", - "waf": "Security" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", + "service": "AKS", + "severity": "Low", + "text": "Consider gitops to deploy applications or cluster configuration to multiple clusters", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", - "service": "AVS", - "severity": "High", - "text": "Create dashboards to enable core Azure VMware Solution monitoring insights", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d7672c26-7602-4482-85a4-14527fbe855c", + "link": "https://learn.microsoft.com/azure/aks/command-invoke", + "service": "AKS", + "severity": "Low", + "text": "Consider using AKS command invoke on private clusters", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", - "service": "AVS", - "severity": "High", - "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", + "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", + "service": "AKS", + "severity": "Low", + "text": "For planned events consider using Node Auto Drain", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9659e396-80e7-4828-ac93-5657d02bff45", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", + "link": "https://learn.microsoft.com/azure/aks/faq", + "service": "AKS", "severity": "High", - "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware", + "text": "Develop own governance practices to make sure no changes are performed by operators in the node RG (aka 'infra RG')", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", - "service": "AVS", - "severity": "High", - "text": "Ensure alerts are configured for Azure Service Health alerts and notifications", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", + "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", + "severity": "Low", + "text": "Use custom Node RG (aka 'Infra RG') name", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", + "link": "https://kubernetes.io/docs/setup/release/notes/", + "service": "AKS", "severity": "Medium", - "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing", + "text": "Do not use deprecated Kubernetes APIs in your YAML manifests", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", + "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", + "service": "AKS", "severity": "Low", - "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?", + "text": "Taint Windows nodes", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", - "service": "AVS", - "severity": "High", - "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", + "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", + "service": "AKS", + "severity": "Low", + "text": "Keep windows containers patch level in sync with host patch level", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", - "service": "AVS", - "severity": "Medium", - "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "Via Diagnostic Settings at the cluster level", + "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", + "link": "https://learn.microsoft.com/azure/aks/monitor-aks", + "service": "AKS", + "severity": "Low", + "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", - "service": "AVS", - "severity": "Medium", - "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", + "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", + "service": "AKS", + "severity": "Low", + "text": "If required use nodePool snapshots", + "waf": "Cost" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", + "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", + "service": "AKS", + "severity": "Low", + "text": "Consider spot node pools for non time-sensitive workloads", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", - "service": "AVS", - "severity": "Medium", - "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", + "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", + "severity": "Low", + "text": "Consider AKS virtual node for quick bursting", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", - "service": "AVS", - "severity": "Medium", - "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", + "severity": "High", + "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", - "service": "AVS", - "severity": "Medium", - "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", + "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", + "severity": "High", + "text": "Store and analyze your cluster logs with Container Insights (or other tools like Telegraf/ElasticSearch)", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", + "service": "AKS", "severity": "Medium", - "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions", + "text": "Monitor CPU and memory utilization of the nodes", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1a4835ac-9422-423e-ae80-b123081a5417", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "severity": "Medium", - "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud", - "waf": "Security" + "text": "If using Azure CNI, monitor % of pod IPs consumed per node", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "I/O in the OS disk is a critical resource. If the OS in the nodes gets throttled on I/O, this could lead to unpredictable behavior, typically ending up in node being declared NotReady", + "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", + "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", + "service": "AKS", "severity": "Medium", - "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource", - "waf": "Reliability" + "text": "Monitor OS disk queue depth in nodes", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "be209d39-fda4-4777-a424-d116785c2fa5", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "severity": "Medium", - "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]", - "waf": "Reliability" + "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", + "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", + "service": "AKS", "severity": "Medium", - "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", - "waf": "Reliability" + "text": "Subscribe to resource health notifications for your AKS cluster", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "severity": "High", - "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible", - "waf": "Reliability" + "text": "Configure requests and limits in your pod specs", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8255461e-2aee-4345-9aec-8339248b262d", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "769ef669-1a48-435a-a942-223ece80b123", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "severity": "Medium", - "text": "Use the geopolitical region pair as the secondary disaster recovery environment", - "waf": "Reliability" + "text": "Enforce resource quotas for namespaces", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "081a5417-4158-433e-a3ad-3c2de733165c", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "AKS", "severity": "High", - "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions", - "waf": "Reliability" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", - "service": "AVS", - "severity": "Medium", - "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?", - "waf": "Reliability" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", - "service": "AVS", - "severity": "Medium", - "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]", - "waf": "Reliability" + "text": "Ensure your subscription has enough quota to scale out your nodepools", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", - "service": "AVS", - "severity": "Medium", - "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud", - "waf": "Reliability" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f4fd0602-7ab5-46f1-b66a-e9dea9654a65", + "link": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/", + "service": "AKS", + "severity": "High", + "text": "Configure Liveness and Readiness probes for all deployments", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", + "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "severity": "Medium", - "text": "Deploy your backup solution outside of vSan, on Azure native components", - "waf": "Reliability" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", - "service": "AVS", - "severity": "Low", - "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?", - "waf": "Reliability" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", - "service": "AVS", - "severity": "Low", - "text": "For manual deployments, all configuration and deployments must be documented", - "waf": "Operations" + "text": "Use the Cluster Autoscaler", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", + "guid": "831c2872-c693-4b39-a887-a561bada49bc", + "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", + "service": "AKS", "severity": "Low", - "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud", - "waf": "Operations" + "text": "Customize node configuration for AKS node pools", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", - "service": "AVS", - "severity": "Low", - "text": "For automated deployments, deploy a minimal private cloud and scale as needed", - "waf": "Operations" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", + "severity": "Medium", + "text": "Use the Horizontal Pod Autoscaler when required", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", - "service": "AVS", - "severity": "Low", - "text": "For automated deployments, request or reserve quota prior to starting the deployment", - "waf": "Operations" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "Larger nodes will bring higher performance and features such as ephemeral disks and accelerated networking, but they will increase the blast radius and decrease the scaling granularity", + "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", + "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", + "service": "AKS", + "severity": "High", + "text": "Consider an appropriate node size, not too large or too small", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", + "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", + "service": "AKS", "severity": "Low", - "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance", - "waf": "Operations" + "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", + "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", + "service": "AKS", "severity": "Low", - "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use", - "waf": "Operations" + "text": "Consider subscribing to EventGrid Events for AKS automation", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "255461e2-aee3-4553-afc8-339248b262d6", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", + "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", + "service": "AKS", "severity": "Low", - "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute", - "waf": "Operations" + "text": "For long running operation on an AKS cluster consider event termination", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", + "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", + "service": "AKS", "severity": "Low", - "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.", - "waf": "Operations" + "text": "If required consider using Azure Dedicated Hosts for AKS nodes", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", - "service": "AVS", - "severity": "Low", - "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs", - "waf": "Operations" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", + "guid": "24367b33-6971-45b1-952b-eee0b9b588de", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", + "severity": "High", + "text": "Use ephemeral OS disks", + "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", - "service": "AVS", - "severity": "Medium", - "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "AKS", + "severity": "High", + "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds", "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", - "service": "AVS", - "severity": "Medium", - "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", + "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", + "service": "AKS", + "severity": "Low", + "text": "For hyper performance storage option use Ultra Disks on AKS", "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "service": "AKS", "severity": "Medium", - "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)", + "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", + "service": "AKS", "severity": "Medium", - "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", + "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons", "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", + "service": "AKS", "severity": "Medium", - "text": "Define and enforce scale in/out maximum limits for your environment in the automations", + "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones", "waf": "Performance" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", + "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", + "service": "APIM", "severity": "Medium", - "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses", + "text": "Implement an error handling policy at the global level", "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", - "severity": "High", - "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "Reliability" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", - "severity": "High", - "text": "When using MON, you cannot enable MON on more than 100 Network extensions", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Reliability" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", + "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", + "service": "APIM", "severity": "Medium", - "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.", - "waf": "Performance" + "text": "Ensure all APIs policies include a element.", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e614658d-d457-4e92-9139-b821102cad6e", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", + "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", + "service": "APIM", "severity": "Medium", - "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance", - "waf": "Performance" + "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", + "link": "https://learn.microsoft.com/azure/api-management/monetization-support", + "service": "APIM", "severity": "Medium", - "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)", - "waf": "Reliability" + "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "AVS", - "severity": "Medium", - "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.", - "waf": "Reliability" + "checklist": "Azure API Management Review", + "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", + "service": "APIM", + "severity": "High", + "text": "Enable Diagnostics Settings to export logs to Azure Monitor", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", + "service": "APIM", "severity": "Medium", - "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions", - "waf": "Reliability" + "text": "Enable Application Insights for more detailed telemetry", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "AVS", - "severity": "Medium", - "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions", - "waf": "Reliability" + "checklist": "Azure API Management Review", + "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", + "service": "APIM", + "severity": "High", + "text": "Configure alerts on the most critical metrics", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", + "service": "APIM", "severity": "High", - "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor", - "waf": "Reliability" + "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", + "service": "APIM", "severity": "High", - "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements", - "waf": "Reliability" + "text": "Protect incoming requests to APIs (data plane) with Azure AD", + "waf": "Security" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "AVS", - "severity": "High", - "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.", - "waf": "Reliability" + "checklist": "Azure API Management Review", + "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", + "service": "APIM", + "severity": "Medium", + "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal", + "waf": "Security" + }, + { + "checklist": "Azure API Management Review", + "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", + "service": "APIM", + "severity": "Medium", + "text": "Create appropriate groups to control the visibility of the products", + "waf": "Security" + }, + { + "checklist": "Azure API Management Review", + "guid": "06862505-2d9a-4874-9491-2837b00a3475", + "link": "https://learn.microsoft.com/azure/api-management/backends", + "service": "APIM", + "severity": "Medium", + "text": "Use Backends feature to eliminate redundant API backend configurations", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "AVS", - "severity": "High", - "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.", - "waf": "Reliability" + "checklist": "Azure API Management Review", + "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", + "service": "APIM", + "severity": "Medium", + "text": "Use Named Values to store common values that can be used in policies", + "waf": "Operations" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "AVS", - "severity": "High", - "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.", + "checklist": "Azure API Management Review", + "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", + "service": "APIM", + "severity": "Medium", + "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA", "waf": "Reliability" }, { - "checklist": "Azure Function Review", - "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", - "severity": "High", - "text": "Select the right Function hosting plan based on your business & SLO requirements", + "checklist": "Azure API Management Review", + "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", + "link": "https://learn.microsoft.com/azure/api-management/high-availability", + "service": "APIM", + "severity": "Medium", + "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%", "waf": "Reliability" }, { - "checklist": "Azure Function Review", - "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", + "checklist": "Azure API Management Review", + "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", + "service": "APIM", "severity": "High", - "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)", + "text": "Ensure there is an automated backup routine", "waf": "Reliability" }, { - "checklist": "Azure Function Review", - "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", - "service": "Azure Functions", + "checklist": "Azure API Management Review", + "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", + "link": "https://learn.microsoft.com/azure/api-management/retry-policy", + "service": "APIM", "severity": "Medium", - "text": "Consider a Cross-Region DR strategy for critical workloads", + "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.", "waf": "Reliability" }, { - "checklist": "Azure Function Review", - "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Azure Functions", - "severity": "High", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", - "waf": "Reliability" + "checklist": "Azure API Management Review", + "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", + "service": "APIM", + "severity": "Low", + "text": "If you need to log at high performance levels, consider Event Hubs policy", + "waf": "Operations" }, { - "checklist": "Azure Function Review", - "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "Azure Functions", - "severity": "High", - "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan", - "waf": "Reliability" + "checklist": "Azure API Management Review", + "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", + "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", + "service": "APIM", + "severity": "Medium", + "text": "Apply throttling policies to control the number of requests per second", + "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", + "waf": "Performance" }, { - "checklist": "Azure Function Review", - "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", - "service": "Azure Functions", + "checklist": "Azure API Management Review", + "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", + "service": "APIM", "severity": "Medium", - "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled", - "waf": "Reliability" + "text": "Configure autoscaling to scale out the number of instances when the load increases", + "waf": "Performance" }, { - "checklist": "Azure Function Review", - "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "Azure Functions", + "checklist": "Azure API Management Review", + "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", + "service": "APIM", "severity": "Medium", - "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code", - "waf": "Operations" + "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.", + "waf": "Performance" }, { - "checklist": "Azure Bot Service", - "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", - "service": "Bot service", + "checklist": "Azure API Management Review", + "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", + "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", + "service": "APIM", "severity": "Medium", - "text": "Follow reliability support recommendations in Azure Bot Service", + "text": "Use the premium tier for production workloads.", "waf": "Reliability" }, { - "checklist": "Azure Bot Service", - "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", - "service": "Bot service", + "checklist": "Azure API Management Review", + "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", + "service": "APIM", "severity": "Medium", - "text": "Deploying bots with local data residency and regional compliance", + "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.", "waf": "Reliability" }, { - "checklist": "Azure Bot Service", - "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", - "service": "Bot service", - "severity": "Medium", - "text": "Azure Bot Service runs in active-active mode for both global and regional services. When an outage occurs, you don't need to detect errors or manage the service. Azure Bot Service automatically performs auto failover and auto recovery in a multi-region geographical architecture. For the EU bot regional service, Azure Bot Service provides two full regions inside Europe with active/active replication to ensure redundancy. For the global bot service, all available regions/geographies can be served as the global footprint.", + "checklist": "Azure API Management Review", + "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", + "service": "APIM", + "severity": "High", + "text": "Be aware of APIM's limits", "waf": "Reliability" }, { - "checklist": "Azure Spring Apps Review", - "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", - "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", - "service": "Spring Apps", - "severity": "Medium", - "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions", + "checklist": "Azure API Management Review", + "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", + "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", + "service": "APIM", + "severity": "High", + "text": "Ensure that the self-hosted gateway deployments are resilient.", "waf": "Reliability" }, { - "checklist": "Azure Spring Apps Review", - "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", - "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", - "service": "Spring Apps", + "checklist": "Azure API Management Review", + "guid": "7519e385-a88b-4d34-966b-6269d686e890", + "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", + "service": "APIM", "severity": "Medium", - "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", - "waf": "Reliability" + "text": "Use Azure Front Door in front of APIM for multi-region deployment", + "waf": "Performance" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", - "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", - "service": "Spring Apps", + "checklist": "Azure API Management Review", + "guid": "cd45c90e-7690-4753-930b-bf290c69c074", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", + "service": "APIM", "severity": "Medium", - "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", - "waf": "Reliability" + "text": "Deploy the service within a Virtual Network (VNet)", + "waf": "Security" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", - "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", - "service": "Spring Apps", + "checklist": "Azure API Management Review", + "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", + "service": "APIM", "severity": "Medium", - "text": "Use more than 1 app instance for your apps", - "waf": "Reliability" + "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.", + "waf": "Security" }, { - "checklist": "Azure Spring Apps Review", - "guid": "7504c230-6035-4183-95a5-85762acc6075", - "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", - "service": "Spring Apps", + "checklist": "Azure API Management Review", + "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", + "service": "APIM", "severity": "Medium", - "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", - "waf": "Reliability" + "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.", + "waf": "Security" }, { - "checklist": "Azure Spring Apps Review", - "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", - "service": "Spring Apps", + "checklist": "Azure API Management Review", + "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", + "service": "APIM", + "severity": "High", + "text": "Disable Public Network Access", + "waf": "Security" + }, + { + "checklist": "Azure API Management Review", + "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", + "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", + "service": "APIM", "severity": "Medium", - "text": "Set up autoscaling in Spring Cloud Gateway", - "waf": "Reliability" + "text": "Simplify management with PowerShell automation scripts", + "waf": "Operations" }, { - "checklist": "Azure Spring Apps Review", - "guid": "97411607-b6fd-4335-99d1-9885faf4e392", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", - "service": "Spring Apps", - "severity": "Low", - "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.", - "waf": "Reliability" + "checklist": "Azure API Management Review", + "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", + "service": "APIM", + "severity": "Medium", + "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator", + "waf": "Operations" }, { - "checklist": "Azure Spring Apps Review", - "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", - "link": "https://learn.microsoft.com/azure/spring-apps/overview", - "service": "Spring Apps", + "checklist": "Azure API Management Review", + "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", + "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", + "service": "APIM", "severity": "Medium", - "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.", - "waf": "Reliability" + "text": "Promote usage of Visual Studio Code APIM extension for faster API development", + "waf": "Operations" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage", - "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "354f1c03-8112-4965-85ad-c0074bddf231", + "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", + "service": "APIM", "severity": "Medium", - "text": "Consider the 'Azure security baseline for storage'", - "waf": "Security" + "text": "Implement DevOps and CI/CD in your workflow", + "waf": "Operations" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet", - "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", - "service": "Azure Storage", - "severity": "High", - "text": "Consider using private endpoints for Azure Storage", + "checklist": "Azure API Management Review", + "guid": "b6439493-426a-45f3-9697-cf65baee208d", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", + "service": "APIM", + "severity": "Medium", + "text": "Secure APIs using client certificate authentication", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription", - "guid": "30e37c3e-2971-41b2-963c-eee079b598de", - "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "2a67d143-1033-4c0a-8732-680896478f08", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", + "service": "APIM", "severity": "Medium", - "text": "Ensure older storage accounts are not using 'classic deployment model'", + "text": "Secure backend services using client certificate authentication", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.", - "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", - "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", - "service": "Azure Storage", - "severity": "High", - "text": "Enable Microsoft Defender for all of your storage accounts", + "checklist": "Azure API Management Review", + "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", + "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", + "service": "APIM", + "severity": "Medium", + "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.", - "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", + "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", + "service": "APIM", "severity": "Medium", - "text": "Enable 'soft delete' for blobs", + "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", - "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", - "severity": "Medium", - "text": "Disable 'soft delete' for blobs", + "checklist": "Azure API Management Review", + "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", + "service": "APIM", + "severity": "High", + "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.", - "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "f8af3d94-1d2b-4070-846f-849197524258", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", + "service": "APIM", "severity": "High", - "text": "Enable 'soft delete' for containers", + "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", - "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "791abd8b-7706-4e31-9569-afefde724be3", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", + "service": "APIM", "severity": "Medium", - "text": "Disable 'soft delete' for containers", + "text": "Use managed identities to authenticate to other Azure resources whenever possible", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion", - "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", + "service": "APIM", "severity": "High", - "text": "Enable resource locks on storage accounts", + "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.", - "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", - "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", - "service": "Azure Storage", + "checklist": "Cognitive Search Review Checklist", + "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", "severity": "High", - "text": "Consider immutable blobs", - "waf": "Security" + "text": "Enable 2 replicas to have 99.9% availability for read operations", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ", - "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Azure Storage", - "severity": "High", - "text": "Require HTTPS, i.e. disable port 80 on the storage account", - "waf": "Security" + "checklist": "Cognitive Search Review Checklist", + "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", + "severity": "Medium", + "text": "Enable 3 replicas to have 99.9% availability for read/write operations", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.", - "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", - "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", - "service": "Azure Storage", + "checklist": "Cognitive Search Review Checklist", + "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", + "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", + "service": "Cognitive Search", "severity": "High", - "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.", - "waf": "Security" + "text": "Leverage Availability Zones by enabling read and/or write replicas", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.", - "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", - "service": "Azure Storage", + "checklist": "Cognitive Search Review Checklist", + "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", + "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", + "service": "Cognitive Search", "severity": "Medium", - "text": "Limit shared access signature (SAS) tokens to HTTPS connections only", - "waf": "Security" + "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "AAD tokens should be favored over shared access signatures, wherever possible", - "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", - "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", - "service": "Azure Storage", - "severity": "High", - "text": "Use Azure Active Directory (Azure AD) tokens for blob access", - "waf": "Security" + "checklist": "Cognitive Search Review Checklist", + "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", + "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", + "service": "Cognitive Search", + "severity": "Medium", + "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.", - "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", - "service": "Azure Storage", + "checklist": "Cognitive Search Review Checklist", + "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", + "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", + "service": "Cognitive Search", "severity": "Medium", - "text": "Least privilege in IaM permissions", - "waf": "Security" + "text": "Use Azure Traffic Manager to coordinate requests", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ", - "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", - "service": "Azure Storage", + "checklist": "Cognitive Search Review Checklist", + "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", + "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", + "service": "Cognitive Search", "severity": "High", - "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.", - "waf": "Security" + "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ", - "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", - "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", - "service": "Azure Storage", + "checklist": "Azure Function Review", + "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", "severity": "High", - "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.", - "waf": "Security" + "text": "Select the right Function hosting plan based on your business & SLO requirements", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).", - "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", - "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", - "service": "Azure Storage", + "checklist": "Azure Function Review", + "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", "severity": "High", - "text": "Consider using Azure Monitor to audit control plane operations on the storage account", - "waf": "Security" + "text": "Leverage Availability Zones where regionally applicable (not available for Consumption tier)", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.", - "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", - "service": "Azure Storage", + "checklist": "Azure Function Review", + "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", + "service": "Azure Functions", "severity": "Medium", - "text": "When using storage account keys, consider enabling a 'key expiration policy'", - "waf": "Security" + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.", - "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", - "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", - "service": "Azure Storage", - "severity": "Medium", - "text": "Consider configuring an SAS expiration policy", - "waf": "Security" + "checklist": "Azure Function Review", + "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Azure Functions", + "severity": "High", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", + "waf": "Reliability" + }, + { + "checklist": "Azure Function Review", + "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "Azure Functions", + "severity": "High", + "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ", - "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", - "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", - "service": "Azure Storage", + "checklist": "Azure Function Review", + "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", + "service": "Azure Functions", "severity": "Medium", - "text": "Consider linking SAS to a stored access policy", - "waf": "Security" + "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", - "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", - "service": "Azure Storage", + "checklist": "Azure Function Review", + "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "Azure Functions", "severity": "Medium", - "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.", - "waf": "Security" - }, - { - "checklist": "Azure Storage Review Checklist", - "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.", - "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", - "service": "Azure Storage", - "severity": "High", - "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)", - "waf": "Security" + "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Function App code", + "waf": "Operations" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.", - "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", - "severity": "High", - "text": "Strive for short validity periods for ad-hoc SAS", + "checklist": "Service Bus Review Checklist", + "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", + "guid": "87af4a79-1f89-439b-ba47-768e14c11567", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key", + "service": "Service Bus", + "severity": "Low", + "text": "Use customer-managed key option in data at rest encryption when required", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.", - "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", + "checklist": "Service Bus Review Checklist", + "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.", + "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version", + "service": "Service Bus", "severity": "Medium", - "text": "Apply a narrow scope to a SAS", + "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ", - "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", - "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", - "service": "Azure Storage", + "checklist": "Service Bus Review Checklist", + "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", + "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies", + "service": "Service Bus", "severity": "Medium", - "text": "Consider scoping SAS to a specific client IP address, wherever possible", + "text": "Avoid using root account when it is not necessary", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.", - "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", - "service": "Azure Storage", - "severity": "Low", - "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ", + "checklist": "Service Bus Review Checklist", + "description": "A Service Bus client app running inside an Azure App Service application or in a virtual machine with enabled managed entities for Azure resources support does not need to handle SAS rules and keys, or any other access tokens. The client app only needs the endpoint address of the Service Bus Messaging namespace. ", + "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity", + "service": "Service Bus", + "severity": "Medium", + "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint", - "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", - "service": "Azure Storage", + "checklist": "Service Bus Review Checklist", + "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ", + "guid": "f615658d-e558-4f93-9249-b831112dbd7e", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus", + "service": "Service Bus", "severity": "High", - "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.", + "text": "Use least privilege data plane RBAC", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", - "service": "Azure Storage", + "checklist": "Service Bus Review Checklist", + "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.", + "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference", + "service": "Service Bus", "severity": "Medium", - "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.", + "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.", - "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", - "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", - "service": "Azure Storage", - "severity": "High", - "text": "Avoid overly broad CORS policies", + "checklist": "Service Bus Review Checklist", + "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", + "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service", + "service": "Service Bus", + "severity": "Medium", + "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.", - "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "Azure Storage", - "severity": "High", - "text": "Determine how data at rest should be encrypted. Understand the thread model for data.", + "checklist": "Service Bus Review Checklist", + "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", + "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a", + "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering", + "service": "Service Bus", + "severity": "Medium", + "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "Security" }, { - "checklist": "Azure Storage Review Checklist", - "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", - "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", - "service": "Azure Storage", + "checklist": "SAP Checklist", + "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", + "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", + "service": "SAP", "severity": "Medium", - "text": "Determine which/if platform encryption should be used.", - "waf": "Security" + "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Azure Storage Review Checklist", - "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", - "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", - "service": "Azure Storage", + "checklist": "SAP Checklist", + "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", + "service": "SAP", "severity": "Medium", - "text": "Determine which/if client-side encryption should be used.", - "waf": "Security" + "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.", + "training": "https://github.com/Azure/sap-automation", + "waf": "Operations" }, { - "checklist": "Azure Storage Review Checklist", - "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.", - "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", - "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", - "service": "Azure Storage", - "severity": "High", - "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ", - "waf": "Security" + "checklist": "SAP Checklist", + "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", + "service": "SAP", + "severity": "Medium", + "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally", + "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal", - "service": "Azure Storage", - "severity": "High", - "text": "Leverage a storagev2 account type for better performance and reliability", + "checklist": "SAP Checklist", + "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", + "service": "SAP", + "severity": "Medium", + "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.", "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "guid": "e05bbe20-9d49-4fda-9777-8424d116785c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Azure Storage", + "checklist": "SAP Checklist", + "guid": "b651423c-8552-42db-a545-5cb50c05527a", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "SAP", "severity": "High", - "text": "Leverage GRS, ZRS or GZRS storage for the highest availability", + "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "guid": "2fa56c56-ad48-4408-be72-734c486ba280", - "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance", - "service": "Azure Storage", + "checklist": "SAP Checklist", + "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", "severity": "Medium", - "text": "For write operation after failover, use customer-Managed Failover ", + "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc", - "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover", - "service": "Azure Storage", - "severity": "Medium", - "text": "Understand Microsoft-Managed Failover details", + "checklist": "SAP Checklist", + "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "SAP", + "severity": "High", + "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.", + "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", "waf": "Reliability" }, { - "checklist": "Azure Storage Review Checklist", - "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal", - "service": "Azure Storage", - "severity": "Medium", - "text": "Enable Soft Delete", + "checklist": "SAP Checklist", + "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "SAP", + "severity": "Low", + "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.", "waf": "Reliability" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", - "severity": "High", - "text": "Enable 2 replicas to have 99.9% availability for read operations", + "checklist": "SAP Checklist", + "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", + "service": "SAP", + "severity": "Medium", + "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.", "waf": "Reliability" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", - "severity": "Medium", - "text": "Enable 3 replicas to have 99.9% availability for read/write operations", + "checklist": "SAP Checklist", + "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", + "service": "SAP", + "severity": "Low", + "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.", + "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", "waf": "Reliability" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", - "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", - "service": "Cognitive Search", + "checklist": "SAP Checklist", + "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", "severity": "High", - "text": "Leverage Availability Zones by enabling read and/or write replicas", + "text": "Native database replication technology should be used to synchronize the database in a HA pair.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", - "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", - "service": "Cognitive Search", - "severity": "Medium", - "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions", + "checklist": "SAP Checklist", + "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", + "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", + "service": "SAP", + "severity": "High", + "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", - "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", - "service": "Cognitive Search", - "severity": "Medium", - "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services", + "checklist": "SAP Checklist", + "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", + "service": "SAP", + "severity": "High", + "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", "waf": "Reliability" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", - "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", - "service": "Cognitive Search", - "severity": "Medium", - "text": "Use Azure Traffic Manager to coordinate requests", + "checklist": "SAP Checklist", + "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", + "severity": "High", + "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", "waf": "Reliability" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", - "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", - "service": "Cognitive Search", + "checklist": "SAP Checklist", + "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", + "service": "SAP", "severity": "High", - "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files", + "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Cognitive Services Review Checklist", - "guid": "21c30d25-ffb7-4f6a-b9ea-b3fec328f787", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-cog_svcs_v1.docx", - "service": "Cognitive Services", - "severity": "Medium", - "text": "Leverage FTA HandBook for Cognitive Services", + "checklist": "SAP Checklist", + "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", + "severity": "High", + "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", "waf": "Reliability" }, { - "checklist": "Cognitive Services Review Checklist", - "guid": "78c34698-16b2-4763-aefe-1b9b599de0d5", - "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions", - "service": "Cognitive Services", - "severity": "Medium", - "text": "Backup Your Prompts", + "checklist": "SAP Checklist", + "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", + "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", + "service": "SAP", + "severity": "High", + "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", "waf": "Reliability" }, { - "checklist": "Cognitive Services Review Checklist", - "guid": "750ab2ab-039d-4a6d-95d7-c892adb107d5", - "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery", - "service": "Cognitive Services", + "checklist": "SAP Checklist", + "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", + "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", + "service": "SAP", "severity": "High", - "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service", + "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Cognitive Services Review Checklist", - "guid": "325af625-ca44-4e46-a5e2-223ace8bb123", - "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations", - "service": "Cognitive Services", - "severity": "Medium", - "text": "Backup Your ChatGPT conversations", + "checklist": "SAP Checklist", + "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", + "service": "SAP", + "severity": "High", + "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Cognitive Services Review Checklist", - "guid": "07ca5f17-f154-4e3a-a369-2829e7e31618", - "link": "https://learn.microsoft.com/azure/ai-services/speech-service/how-to-custom-speech-continuous-integration-continuous-deployment", - "service": "Cognitive Services", - "severity": "Medium", - "text": "CI/CD for custom speech", + "checklist": "SAP Checklist", + "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", + "service": "SAP", + "severity": "High", + "text": "Make sure the Floating IP is enabled on the Load balancer", + "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Cognitive Services Review Checklist", - "guid": "3687a046-7a1f-4893-9bda-43324f248116", - "link": "https://learn.microsoft.com/azure/ai-services/qnamaker/tutorials/export-knowledge-base", - "service": "Cognitive Services", - "severity": "Low", - "text": "Move a knowledge base using export-import", + "checklist": "SAP Checklist", + "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "SAP", + "severity": "High", + "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Container Apps Review", - "guid": "af416482-663c-4ed6-b195-b44c7068e09c", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support", - "service": "Container Apps", + "checklist": "SAP Checklist", + "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", + "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", + "service": "SAP", "severity": "High", - "text": "Leverage Availability Zones if regionally applicable", + "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.", "waf": "Reliability" }, { - "checklist": "Container Apps Review", - "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment", - "service": "Container Apps", + "checklist": "SAP Checklist", + "guid": "cbe05bbe-209d-4490-ba47-778424d11678", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", "severity": "High", - "text": "Use more than one replica and enable Zone Redundancy.", + "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Container Apps Review", - "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", - "service": "Container Apps", + "checklist": "SAP Checklist", + "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", + "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", + "service": "SAP", + "severity": "Medium", + "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.", + "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "waf": "Reliability" + }, + { + "checklist": "SAP Checklist", + "guid": "9674e7c7-7796-4181-8920-09f4429543ba", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", "severity": "High", - "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.", + "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Container Apps Review", - "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919", - "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", - "service": "Container Apps", + "checklist": "SAP Checklist", + "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "severity": "High", - "text": "Use Front Door or Traffic Manager to route traffic to the closest region", + "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx", - "service": "CosmosDB", - "severity": "Medium", - "text": "FTA Resiliency Playbook", + "checklist": "SAP Checklist", + "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", + "severity": "High", + "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", - "service": "CosmosDB", + "checklist": "SAP Checklist", + "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "severity": "High", - "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it", + "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "guid": "0d934a34-8b26-43e7-bd60-513a3649906e", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages", - "service": "CosmosDB", + "checklist": "SAP Checklist", + "guid": "ed46b937-913e-4018-9c62-8393ab037e53", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", + "service": "SAP", "severity": "Medium", - "text": "Run multiple replicas of the database (>1 ) in Prod", + "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe", - "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions", - "service": "CosmosDB", + "checklist": "SAP Checklist", + "guid": "f656e745-0cfb-453e-8008-0528fa21c933", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "severity": "Medium", - "text": "Leverage Multi-Region Writes", + "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "description": "Span Cosmos account across two or more regions with multi-region writes", - "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91", - "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", - "service": "CosmosDB", + "checklist": "SAP Checklist", + "guid": "7f684ebc-95da-425e-b329-e782dbed050f", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", + "service": "SAP", "severity": "Medium", - "text": "Distribute your data globally", + "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong", - "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0", - "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels", - "service": "CosmosDB", + "checklist": "SAP Checklist", + "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", "severity": "High", - "text": "Choose from several well-defined consistency models", + "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.", - "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe", - "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover", - "service": "CosmosDB", - "severity": "Medium", - "text": "Enable Service managed failover", + "checklist": "SAP Checklist", + "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", + "service": "SAP", + "severity": "High", + "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.", + "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.", - "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90", - "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore", - "service": "CosmosDB", - "severity": "Medium", - "text": "Enable Automatic Backups", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "checklist": "SAP Checklist", + "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", + "service": "SAP", + "severity": "High", + "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.", - "guid": "a6eb33f6-005c-4d92-9286-7655672d6121", - "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction", - "service": "CosmosDB", - "severity": "Medium", - "text": "Perform Periodic Backups", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "checklist": "SAP Checklist", + "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", + "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", + "service": "SAP", + "severity": "High", + "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.", "waf": "Reliability" }, { - "checklist": "CosmosDB Review Checklist", - "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.", - "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1", - "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction", - "service": "CosmosDB", + "checklist": "SAP Checklist", + "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", + "service": "SAP", "severity": "Medium", - "text": "Continous Backup with point-in-time restore in Azure Cosmos DB", - "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", - "waf": "Reliability" + "text": "Automate SAP System Start-Stop to manage costs.", + "waf": "Cost" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", - "service": "Azure Monitor", - "severity": "Medium", - "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", - "training": "https://azure.microsoft.com/pricing/reservations/", + "checklist": "SAP Checklist", + "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", + "severity": "Low", + "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.", "waf": "Cost" }, { - "checklist": "Cost Optimization Checklist", - "guid": "45901365-d38e-443f-abcb-d868266abca2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Azure Backup", - "severity": "Medium", - "text": "check backup instances with the underlying datasource not found", + "checklist": "SAP Checklist", + "guid": "9877f353-2591-4e8b-8381-e9043fed1010", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", + "severity": "Low", + "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.", "waf": "Cost" }, { - "checklist": "Cost Optimization Checklist", - "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", + "service": "SAP", + "severity": "High", + "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", + "waf": "Security" + }, + { + "checklist": "SAP Checklist", + "guid": "45911475-e39e-4530-accc-d979366bcda2", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "severity": "Medium", - "text": "Delete or archive unassociated services (disks, nics, ip addresses etc)", - "waf": "Cost" + "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Azure Backup", + "checklist": "SAP Checklist", + "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "severity": "Medium", - "text": "Consider a good balance between site recovery storage and backup for non mission critical applications", - "waf": "Cost" + "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", - "service": "Azure Monitor", + "checklist": "SAP Checklist", + "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", "severity": "Medium", - "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", - "waf": "Cost" + "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Azure Monitor", + "checklist": "SAP Checklist", + "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", + "service": "SAP", "severity": "Medium", - "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)", - "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", - "waf": "Cost" + "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", "severity": "Medium", - "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", - "waf": "Cost" + "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d1e44a19-659d-4395-afd7-7289b835556d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Storage", + "checklist": "SAP Checklist", + "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", + "service": "SAP", "severity": "Medium", - "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "waf": "Cost" + "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", + "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", + "service": "SAP", "severity": "Medium", - "text": "Make sure advisor is configured for VM right sizing ", - "waf": "Cost" + "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "description": "check by searching the Meter Category Licenses in the Cost analysys", - "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "16785d6f-a96c-496a-b885-18f482734c88", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", + "service": "SAP", "severity": "Medium", - "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently", - "waf": "Cost" + "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "a747c350-8d4c-449c-93af-393dbca77c48", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", + "service": "SAP", "severity": "Medium", - "text": " this can be also put under AHUB if you already have licenses https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", - "waf": "Cost" + "text": "Implement SSO to SAP HANA", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", + "service": "SAP", "severity": "Medium", - "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)", - "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", - "waf": "Cost" + "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", + "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", + "service": "SAP", "severity": "Medium", - "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.", - "waf": "Cost" + "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", + "service": "SAP", "severity": "Medium", - "text": "Only larger disks can be reserved => 1 TiB -", - "waf": "Cost" + "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", + "service": "SAP", "severity": "Medium", - "text": "After the right-sizing optimization", - "waf": "Cost" + "text": "Implement SSO to SAP BTP", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Azure SQL", + "checklist": "SAP Checklist", + "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", + "service": "SAP", "severity": "Medium", - "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", - "waf": "Cost" + "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "6ba28021-4591-4147-9e39-e5309cccd979", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", + "service": "SAP", "severity": "Medium", - "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount", - "waf": "Cost" + "text": "enforce existing Management Group policies to SAP Subscriptions", + "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "VM", - "severity": "Medium", - "text": "Consider using a VMSS to match demand rather than flat sizing", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", + "severity": "High", + "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", + "waf": "Operations" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Cost Optimization Checklist", - "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "AKS", - "severity": "Medium", - "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", + "severity": "High", + "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ", + "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Azure Backup", - "severity": "Medium", - "text": "Move recovery points to vault-archive where applicable (Validate)", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", + "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", + "service": "SAP", + "severity": "High", + "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)", + "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", - "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", - "service": "Databricks", - "severity": "Medium", - "text": "Consider using Spot VMs with fallback where possible. Consider autotermination of clusters.", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", + "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", + "service": "SAP", + "severity": "Low", + "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", - "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", - "service": "Azure Functions", - "severity": "Medium", - "text": "Functions - Reuse connections", - "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", + "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", + "service": "SAP", + "severity": "High", + "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview", - "service": "Azure Functions", - "severity": "Medium", - "text": "Functions - Cache data locally", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "e6e20617-3686-4af4-9791-f8935ada4332", + "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", + "service": "SAP", + "severity": "High", + "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Azure Functions", + "checklist": "SAP Checklist", + "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", + "service": "SAP", "severity": "Medium", - "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "Cost" + "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "Azure Functions", - "severity": "Medium", - "text": "Functions - Keep your functions warm", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", + "severity": "High", + "text": "Help protect your HANA database by using the Azure Backup service.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "Reliability" }, { - "checklist": "Cost Optimization Checklist", - "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Azure Functions", + "checklist": "SAP Checklist", + "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", + "service": "SAP", "severity": "Medium", - "text": "When using autoscale with different functions, there might be one driving all the autoscale for all the resources - consider moving it to a separate consumption plan (and consider higher plan for CPU)", - "waf": "Cost" + "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.", + "waf": "Reliability" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", - "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", - "service": "Azure Functions", - "severity": "Medium", - "text": "Function apps in a given plan are all scaled together, so any issues with scaling can affect all apps in the plan.", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", + "severity": "High", + "text": "Ensure time-zone matches between the operating system and the SAP system.", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", - "service": "Azure Functions", + "checklist": "SAP Checklist", + "guid": "c3c7abc0-716c-4486-893c-40e181d65539", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", + "service": "SAP", "severity": "Medium", - "text": "Am I billed for 'await time'? This question is typically asked in the context of a C# function that does an async operation and waits for the result, e.g. await Task.Delay(1000) or await client.GetAsync('http://google.com'). The answer is yes - the GB second calculation is based on the start and end time of the function and the memory usage over that period. What actually happens over that time in terms of CPU activity is not factored into the calculation.One exception to this rule is if you are using durable functions. You are not billed for time spent at awaits in orchestrator functions.apply demand shaping techinques where possible (dev environments?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", - "waf": "Cost" + "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Reliability" }, { - "checklist": "Cost Optimization Checklist", - "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Front Door", - "severity": "Medium", - "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.", + "checklist": "SAP Checklist", + "guid": "a491dfc4-9353-4213-9217-eef0949f9467", + "link": "https://azure.microsoft.com/pricing/offers/dev-test/", + "service": "SAP", + "severity": "Low", + "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.", "waf": "Cost" }, { - "checklist": "Cost Optimization Checklist", - "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", + "link": "https://learn.microsoft.com/azure/lighthouse/overview", + "service": "SAP", "severity": "Medium", - "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.", - "waf": "Cost" + "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", - "service": "Storage", + "checklist": "SAP Checklist", + "guid": "4d116785-d2fa-456c-96ad-48408fe72734", + "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", + "service": "SAP", "severity": "Medium", - "text": "Consider archiving tiers for less used data", - "waf": "Cost" + "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.", + "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "VM", - "severity": "Medium", - "text": "Check disk sizes where the size does not match the tier (i.e. A 513 GiB disk will pay a P30 (1TiB) and consider resizing", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", + "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", + "service": "SAP", + "severity": "Low", + "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "Storage", + "checklist": "SAP Checklist", + "guid": "14591147-5e39-4e53-89cc-cd979366bcda", + "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", + "service": "SAP", "severity": "Medium", - "text": "Consider using standard SSD rather than Premium or Ultra where possible", - "waf": "Cost" + "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "Storage", - "severity": "Medium", - "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", + "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", + "service": "SAP", + "severity": "High", + "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.", + "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "Site Recovery", + "checklist": "SAP Checklist", + "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "SAP", "severity": "Medium", - "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it", - "waf": "Cost" + "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", - "service": "Storage", + "checklist": "SAP Checklist", + "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", + "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", + "service": "SAP", "severity": "Medium", - "text": "Storage accounts: check hot tier and/or GRS necessary", - "waf": "Cost" + "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "73686af4-6791-4f89-95ad-a43324e13811", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", + "service": "SAP", "severity": "Medium", - "text": "Disks - validate use of Premium SSD disks everywhere: for example, non-prod could swap to Standard SSD or on-demand Premium SSD ", - "waf": "Cost" + "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "Synapse", - "severity": "Medium", - "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "616785d6-fa96-4c96-ad88-518f482734c8", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", + "severity": "High", + "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.", + "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "waf": "Performance" }, { - "checklist": "Cost Optimization Checklist", - "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "Synapse", + "checklist": "SAP Checklist", + "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", + "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", + "service": "SAP", "severity": "Medium", - "text": "Export cost data to a storage account for additional data analysis.", - "waf": "Cost" + "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.", + "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", + "waf": "Reliability" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Synapse", + "checklist": "SAP Checklist", + "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", + "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", + "service": "SAP", "severity": "Medium", - "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.", - "waf": "Cost" + "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.", + "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", + "waf": "Security" }, { - "checklist": "Cost Optimization Checklist", - "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", - "service": "Synapse", + "checklist": "SAP Checklist", + "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", + "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "service": "SAP", "severity": "Medium", - "text": "Enable the serverless Apache Spark automatic pause feature and set your timeout value accordingly.", - "waf": "Cost" + "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.", + "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Synapse", - "severity": "Medium", - "text": "Create multiple Apache Spark pool definitions of various sizes.", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", + "service": "SAP", + "severity": "Low", + "text": "Use inter-VM latency monitoring for latency-sensitive applications.", + "waf": "Performance" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "service": "Synapse", + "checklist": "SAP Checklist", + "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", "severity": "Medium", - "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "waf": "Reliability" }, { - "checklist": "Cost Optimization Checklist", - "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", "severity": "Medium", - "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.", + "waf": "Performance" }, { - "checklist": "Cost Optimization Checklist", - "guid": "544451e1-92d3-4442-a3c7-628637a551c5", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", - "severity": "Medium", - "text": "Right-sizing all VMs", - "waf": "Cost" + "checklist": "SAP Checklist", + "guid": "c027f893-f404-41a9-b33d-39d625a14964", + "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", + "service": "SAP", + "severity": "Low", + "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.", + "waf": "Performance" }, { - "checklist": "Cost Optimization Checklist", - "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", + "service": "SAP", "severity": "Medium", - "text": "Swap VM sized with normalized and most recent sizes", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.", + "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", + "waf": "Performance" }, { - "checklist": "Cost Optimization Checklist", - "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", + "service": "SAP", "severity": "Medium", - "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Cost" + "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.", + "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", + "waf": "Performance" }, { - "checklist": "Cost Optimization Checklist", - "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", + "severity": "High", + "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", + "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "waf": "Operations" + }, + { + "checklist": "SAP Checklist", + "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "SAP", "severity": "Medium", - "text": "Containerizing an application can improve VM density and save money on scaling it", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Cost" + "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", + "waf": "Security" }, { - "checklist": "Device Provisioning Service Review", - "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", - "service": "IoT Hub DPS", - "severity": "High", - "text": "Select the right Logic App hosting plan based on your business & SLO requirements", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", + "severity": "Medium", + "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "Operations" }, { - "checklist": "Device Provisioning Service Review", - "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "IoT Hub DPS", - "severity": "High", - "text": "Protect logic apps from region failures with zone redundancy and availability zones", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", + "severity": "Medium", + "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "Operations" }, { - "checklist": "Device Provisioning Service Review", - "guid": "8aed4fbf-0830-4883-899d-222a154af478", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "IoT Hub DPS", - "severity": "High", - "text": "Consider a Cross-Region DR strategy for critical workloads", + "checklist": "SAP Checklist", + "guid": "a3592829-e6e2-4061-9368-6af46791f893", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "service": "SAP", + "severity": "Medium", + "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions", + "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", "waf": "Reliability" }, { - "checklist": "Device Provisioning Service Review", - "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "IoT Hub DPS", + "checklist": "SAP Checklist", + "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", + "service": "SAP", "severity": "High", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", - "waf": "Reliability" + "text": "It is not supported to deploy any NVA between SAP application and SAP Database server", + "training": "https://me.sap.com/notes/2731110", + "waf": "Performance" }, { - "checklist": "Device Provisioning Service Review", - "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "IoT Hub DPS", + "checklist": "SAP Checklist", + "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", + "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", + "service": "SAP", "severity": "Medium", - "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", + "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", + "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", "waf": "Operations" }, { - "checklist": "Device Update Review", - "guid": "0e03f5ee-4648-423c-bb86-7239480f9171", - "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", - "service": "Device Update for IoT Hub", - "severity": "High", - "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled).", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", + "service": "SAP", + "severity": "Medium", + "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.", + "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Device Update Review", - "guid": "c0c273bd-00ad-419a-9f2f-fc72fb181e55", - "link": "https://learn.microsoft.com/en-us/azure/iot-dps/iot-dps-ha-dr#high-availability", - "service": "Device Update for IoT Hub", - "severity": "High", - "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the DPS instances from an affected region to the corresponding geo-paired region.", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", + "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", + "service": "SAP", + "severity": "Medium", + "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.", + "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Device Update Review", - "guid": "3af8abe6-07eb-4287-b393-6c4abe3702eb", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Device Update for IoT Hub", + "checklist": "SAP Checklist", + "guid": "82734c88-6ba2-4802-8459-11475e39e530", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", "severity": "High", - "text": "Consider a Cross-Region DR strategy for critical workloads", - "waf": "Reliability" + "text": "Public IP assignment to VM running SAP Workload is not recommended.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "waf": "Security" }, { - "checklist": "Device Update Review", - "guid": "bd91245c-fe32-4e98-a085-794a40f4bfe1", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Device Update for IoT Hub", + "checklist": "SAP Checklist", + "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", + "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "service": "SAP", "severity": "High", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", - "waf": "Reliability" + "text": "Consider reserving IP address on DR side when configuring ASR", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Operations" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", - "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", - "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", - "service": "Event Hubs", - "severity": "Low", - "text": "Use customer-managed key option in data at rest encryption when required", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Security" + "checklist": "SAP Checklist", + "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", + "severity": "High", + "text": "Avoid using overlapping IP address ranges for production and DR sites.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "waf": "Operations" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hubs namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Event Hubs namespace to require that clients send and receive data with a newer version of TLS. If an Event Hubs namespace requires a minimum version of TLS, then any requests made with an older version will fail. ", - "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", - "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "6e154e3a-a359-4282-ae6e-206173686af4", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", + "service": "SAP", "severity": "Medium", - "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Security" + "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.", + "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", + "waf": "Operations" }, { - "checklist": "Azure Event Hub Review", - "description": "When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has manage permissions for the entire namespace. It�s recommended that you treat this rule like an administrative root account and don�t use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", - "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", + "service": "SAP", "severity": "Medium", - "text": "Avoid using root account when it is not necessary", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", + "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", + "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", "waf": "Security" }, { - "checklist": "Azure Event Hub Review", - "description": "Managed identities for Azure resources can authorize access to Event Hubs resources using Azure AD credentials from applications running in Azure Virtual Machines (VMs), Function apps, Virtual Machine Scale Sets, and other services. By using managed identities for Azure resources together with Azure AD authentication, you can avoid storing credentials with your applications that run in the cloud. ", - "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", - "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", + "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", + "service": "SAP", "severity": "Medium", - "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" - }, - { - "checklist": "Azure Event Hub Review", - "description": "When creating permissions, provide fine-grained control over a client's access to Azure Event Hub. Permissions in Azure Event Hub can and should be scoped to the individual resource level e.g. consumer group, event hub entity, event hub namespaces, etc.", - "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", - "service": "Event Hubs", - "severity": "High", - "text": "Use least privilege data plane RBAC", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", "waf": "Security" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub resource logs include operational logs, virtual network and Kafka logs. Runtime audit logs capture aggregated diagnostic information for all data plane access operations (such as send or receive events) in Event Hubs.", - "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", - "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", "severity": "Medium", - "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", + "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", "waf": "Security" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Event Hub traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", - "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", - "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "SAP", "severity": "Medium", - "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", "waf": "Security" }, { - "checklist": "Azure Event Hub Review", - "description": "With IP firewall, you can restrict public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", - "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "5ada4332-4e13-4811-9231-81aa41742694", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", "severity": "Medium", - "text": "Consider only allowing access to Azure Event Hub namespace from specific IP addresses or ranges", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", "waf": "Security" }, { - "checklist": "Azure Event Hub Review", - "guid": "31d41e36-11c8-417b-8afb-c410d4391898", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "SAP", "severity": "Medium", - "text": "Leverage FTA Resillency HandBook", - "waf": "Reliability" - }, - { - "checklist": "Azure Event Hub Review", - "description": " This will be turned on automatically for a new EH namespace created from the portal with Premium, Dedicated, or Standard SKUs in a zone-enabled region. Both the EH metadata and the event data itself are replicated across zones", - "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", - "service": "Event Hubs", - "severity": "High", - "text": "Leverage Availability Zones if regionally applicable", - "waf": "Reliability" + "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", + "waf": "Performance" }, { - "checklist": "Azure Event Hub Review", - "guid": "20b56c56-ad58-4519-8f82-735c586bb281", - "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "SAP", "severity": "Medium", - "text": "Use the Premium or Dedicated SKUs for predicable performance", - "waf": "Reliability" - }, - { - "checklist": "Azure Event Hub Review", - "description": "The built-in geo-disaster recovery feature, when enabled, ensures that the entire configuration of anamespace (Event Hubs, Consumer Groups and settings) is continuously replicated from a primary namespace to a secondary namespace, and it allows a once-only failover move from the primary to the secondary at any time. Active/Passive feature is designed to make it easier to recover from and abandon a failed Azure region without having to change application configurations", - "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", - "service": "Event Hubs", - "severity": "High", - "text": "Plan for Geo Disaster Recovery using Active Passive configuration", - "waf": "Reliability" + "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.", + "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", + "waf": "Security" }, { - "checklist": "Azure Event Hub Review", - "description": "Should be used for DR configurations where an outage or loss of event data in the downed region cannot be tolerated. For these cases, follow the replication guidance and do not use the built-in geo-disaster recovery capability (active/passive). With Active/Active, Maintain multiple Event Hubs in different regions and namespaces, and events will be replicated between the hubs", - "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", - "service": "Event Hubs", - "severity": "Medium", - "text": "For Business Critical Applications, use Active Active configuration", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", + "service": "SAP", + "severity": "High", + "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "waf": "Performance" }, { - "checklist": "Azure Event Hub Review", - "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", - "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", + "service": "SAP", "severity": "Medium", - "text": "Design Resilient Event Hubs", - "waf": "Reliability" + "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.", + "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "waf": "Security" }, { - "checklist": "Identity Review Checklist", - "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", - "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", - "service": "Entra", + "checklist": "SAP Checklist", + "guid": "6791f893-5ada-4433-84e1-3811523181aa", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "SAP", "severity": "Medium", - "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library", - "waf": "Reliability" + "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.", + "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", + "waf": "Security" }, { - "checklist": "Identity Review Checklist", - "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", - "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", - "service": "AAD B2C", - "severity": "Medium", - "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", + "severity": "High", + "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Performance" }, { - "checklist": "Identity Review Checklist", - "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", - "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", - "service": "AAD B2C", + "checklist": "SAP Checklist", + "guid": "fa96c96a-d885-418f-9827-34c886ba2802", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "severity": "Medium", - "text": "Custom brand assets should be hosted on a CDN", + "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.", + "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", "waf": "Performance" }, { - "checklist": "Identity Review Checklist", - "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", - "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", - "service": "AAD B2C", - "severity": "Low", - "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", + "severity": "High", + "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Performance" }, { - "checklist": "Identity Review Checklist", - "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", - "severity": "Medium", - "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", + "severity": "High", + "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Cost" }, { - "checklist": "Identity Review Checklist", - "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", - "severity": "Medium", - "text": "Don't replicate! Replication can create issues with directory synchronization", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "402a9846-d515-4061-aff8-cd30088693fa", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", + "service": "SAP", + "severity": "High", + "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Performance" }, { - "checklist": "Identity Review Checklist", - "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "SAP Checklist", + "guid": "87585797-5551-4d53-bb7d-a94ee415734d", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", + "service": "SAP", "severity": "Medium", - "text": "Have active-active for multi-regions", - "waf": "Reliability" + "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering", + "waf": "Security" }, { - "checklist": "Identity Review Checklist", - "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", - "severity": "Medium", - "text": "Add Azure AD Domain service stamps to additional regions and locations", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", + "severity": "High", + "text": "Review SAP HANA database backups for Azure VMs.", + "waf": "Cost" }, { - "checklist": "Identity Review Checklist", - "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", + "checklist": "SAP Checklist", + "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", "severity": "Medium", - "text": "Use Replica Sets for DR", - "waf": "Reliability" + "text": "Review Site Recovery built-in monitoring, where used for SAP.", + "waf": "Cost" }, { - "checklist": "IoT Hub Review", - "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", - "service": "IoT", + "checklist": "SAP Checklist", + "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", + "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", + "service": "SAP", "severity": "High", - "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)", - "waf": "Reliability" + "text": "Review the Monitoring the SAP HANA System Landscape guidance.", + "waf": "Operations" }, { - "checklist": "IoT Hub Review", - "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", + "checklist": "SAP Checklist", + "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", + "service": "SAP", "severity": "Medium", - "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.", - "waf": "Reliability" + "text": "Review Oracle Database in Azure Linux VM backup strategies.", + "waf": "Operations" }, { - "checklist": "IoT Hub Review", - "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", - "service": "IoT", - "severity": "High", - "text": "Consider a Cross-Region DR strategy for critical workloads", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", + "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", + "service": "SAP", + "severity": "Medium", + "text": "Review the use of Azure Blob Storage with SQL Server 2016.", + "waf": "Operations" }, { - "checklist": "IoT Hub Review", - "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "severity": "High", - "text": "Learn how to trigger a manual failover.", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", + "service": "SAP", + "severity": "Medium", + "text": "Review the use of Automated Backup v2 for Azure VMs.", + "waf": "Operations" }, { - "checklist": "IoT Hub Review", - "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", - "service": "IoT", + "checklist": "SAP Checklist", + "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", + "service": "SAP", "severity": "High", - "text": "Learn how to fail back after a failover.", - "waf": "Reliability" + "text": "Enabling Write accelerator for M series when using premium disks(V1)", + "waf": "Operations" }, { - "checklist": "Azure Key Vault", - "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "High", - "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "service": "SAP", + "severity": "Medium", + "text": "Test availability zone latency.", + "waf": "Performance" }, { - "checklist": "Azure Key Vault", - "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", + "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", + "service": "SAP", "severity": "Medium", - "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.", - "waf": "Reliability" + "text": "Activate SAP EarlyWatch Alert for all SAP components.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", + "waf": "Performance" }, { - "checklist": "Azure Key Vault", - "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", + "service": "SAP", "severity": "Medium", - "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.", - "waf": "Reliability" + "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.", + "training": "https://me.sap.com/notes/0002879613", + "waf": "Performance" }, { - "checklist": "Azure Key Vault", - "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", + "service": "SAP", "severity": "Medium", - "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.", - "waf": "Reliability" + "text": "Review SQL Server performance monitoring using CCMS.", + "waf": "Performance" }, { - "checklist": "Azure Key Vault", - "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509", - "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", + "link": "https://me.sap.com/notes/500235", + "service": "SAP", "severity": "Medium", - "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.", - "waf": "Reliability" + "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).", + "training": "https://me.sap.com/notes/1100926/E", + "waf": "Performance" }, { - "checklist": "Azure Key Vault", - "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "Key Vault", - "severity": "High", - "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", + "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", + "service": "SAP", + "severity": "Medium", + "text": "Review SAP HANA studio alerts.", + "waf": "Performance" }, { - "checklist": "Azure Key Vault", - "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "Key Vault", - "severity": "Low", - "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", + "link": "https://me.sap.com/notes/1969700", + "service": "SAP", + "severity": "Medium", + "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.", + "waf": "Performance" }, { - "checklist": "Azure Key Vault", - "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c", - "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", - "service": "Key Vault", - "severity": "Low", - "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", + "severity": "Medium", + "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.", + "training": "https://learn.microsoft.com/azure/automation/update-management/overview", + "waf": "Security" }, { - "checklist": "Azure Key Vault", - "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04", - "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", - "service": "Key Vault", - "severity": "Low", - "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "08951710-79a2-492a-adbc-06d7a401545b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", + "severity": "Medium", + "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.", + "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", + "waf": "Security" }, { - "checklist": "Azure Key Vault", - "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection", - "service": "Key Vault", - "severity": "Medium", - "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", + "severity": "Low", + "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.", + "waf": "Security" }, { - "checklist": "Logic Apps checklist", - "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", - "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", - "service": "Logic Apps", + "checklist": "SAP Checklist", + "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", "severity": "High", - "text": "Select the right Logic App hosting plan based on your business & SLO requirements", - "waf": "Reliability" + "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.", + "training": "https://me.sap.com/notes/3019299/E", + "waf": "Security" }, { - "checklist": "Logic Apps checklist", - "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", - "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "Logic Apps", + "checklist": "SAP Checklist", + "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "severity": "High", - "text": "Protect logic apps from region failures with zone redundancy and availability zones", - "waf": "Reliability" + "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "waf": "Security" }, { - "checklist": "Logic Apps checklist", - "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", - "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Logic Apps", - "severity": "High", - "text": "Consider a Cross-Region DR strategy for critical workloads", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "SAP", + "severity": "Medium", + "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.", + "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", + "waf": "Security" }, { - "checklist": "Logic Apps checklist", - "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", - "link": "https://learn.microsoft.com/azure/app-service/environment/intro", - "service": "Logic Apps", + "checklist": "SAP Checklist", + "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "SAP", "severity": "High", - "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", - "waf": "Reliability" + "text": "Use Azure Key Vault to store your secrets and credentials", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "Security" }, { - "checklist": "Logic Apps checklist", - "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", - "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", - "service": "Logic Apps", + "checklist": "SAP Checklist", + "guid": "829e2edb-2173-4676-aff6-691b4935ada4", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "SAP", "severity": "Medium", - "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", - "waf": "Operations" + "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).", + "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", + "waf": "Security" }, { - "checklist": "MySQL Review Checklist", - "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", - "service": "Azure MySQL", + "checklist": "SAP Checklist", + "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "SAP", "severity": "Medium", - "text": "Leverage Flexible Server", - "waf": "Reliability" + "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "Security" }, { - "checklist": "MySQL Review Checklist", - "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", - "service": "Azure MySQL", + "checklist": "SAP Checklist", + "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", + "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", + "service": "SAP", "severity": "High", - "text": "Leverage Availability Zones where regionally applicable", - "waf": "Reliability" - }, - { - "checklist": "MySQL Review Checklist", - "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", - "service": "Azure MySQL", - "severity": "Medium", - "text": "Leverage Data-in replication for cross-region DR scenarios", - "waf": "Reliability" + "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed", + "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Front Door", - "severity": "Medium", - "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal", - "waf": "Operations" + "checklist": "SAP Checklist", + "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "severity": "High", + "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", - "guid": "553585a6-abe0-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "App Gateway", - "severity": "Medium", - "text": "Ensure you are using Application Gateway v2 SKU", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "checklist": "SAP Checklist", + "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", + "service": "SAP", + "severity": "High", + "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.", + "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", - "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Load Balancer", - "severity": "Medium", - "text": "Ensure you are using the Standard SKU for your Azure Load Balancers", + "checklist": "SAP Checklist", + "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "severity": "Low", + "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS", + "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "9432621a-8397-4654-a882-5bc856b7ef83", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", - "service": "Load Balancer", + "checklist": "SAP Checklist", + "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", + "service": "SAP", "severity": "Medium", - "text": "Ensure your Load Balancers frontend IP addresses are zone-redundant (unless you require zonal frontends).", + "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", - "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "App Gateway", - "severity": "Medium", - "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "checklist": "SAP Checklist", + "guid": "4935ada4-2223-4ece-a1b1-23181a541741", + "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", + "service": "SAP", + "severity": "High", + "text": "Use an Azure Key Vault per application per environment per region.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "description": "Administration of reverse proxies in general and WAF in particular is closer to the application than to networking, so they belong in the same subscription as the app. Centralizing the Application Gateway and WAF in the connectivity subscription might be OK if it is managed by one single team.", - "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", - "severity": "Medium", - "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "checklist": "SAP Checklist", + "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", + "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", + "service": "SAP", + "severity": "High", + "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.", + "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", - "severity": "Medium", - "text": "Use a DDoS Network or IP protection plans for all Public IP addresses in application landing zones.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "checklist": "SAP Checklist", + "guid": "209d490d-a477-4784-84d1-16785d2fa56c", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "service": "SAP", + "severity": "High", + "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes", + "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", - "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", - "service": "App Gateway", - "severity": "Medium", - "text": "Configure autoscaling with a minimum amount of instances of two.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Reliability" - }, - { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", - "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", - "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", - "service": "App Gateway", - "severity": "Medium", - "text": "Deploy Application Gateway across Availability Zones", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Reliability" + "checklist": "SAP Checklist", + "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", + "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", + "service": "SAP", + "severity": "High", + "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources", + "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Front Door", - "severity": "Medium", - "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "checklist": "SAP Checklist", + "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", + "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "service": "SAP", + "severity": "Low", + "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.", + "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3f29812b-2363-4cef-b179-b599de0d5973", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "Front Door", - "severity": "Medium", - "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "checklist": "SAP Checklist", + "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", + "service": "SAP", + "severity": "Low", + "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.", + "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", "waf": "Security" }, { - "ammp": true, - "arm-service": "microsoft.network/trafficManagerProfiles", - "checklist": "Azure Application Delivery Networking", - "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Traffic Manager", + "checklist": "SAP Checklist", + "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", "severity": "High", - "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Reliability" + "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", + "checklist": "SAP Checklist", + "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "severity": "Low", - "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", + "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.", + "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", + "checklist": "SAP Checklist", + "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", + "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", + "service": "SAP", "severity": "Medium", - "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "ae248989-b306-4591-9186-de482e3f0f0e", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "Front Door", + "checklist": "Azure Key Vault", + "guid": "6d37a33b-531c-4a91-871a-b69d8044f04e", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "High", - "text": "Deploy your WAF policy for Front Door in 'Prevention' mode.", - "waf": "Security" + "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "Front Door", - "severity": "High", - "text": "Avoid combining Azure Traffic Manager and Azure Front Door.", - "waf": "Security" + "checklist": "Azure Key Vault", + "guid": "7ba4d380-7b9e-4a8b-a0c3-2d8e49c11872", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Key Vault", + "severity": "Medium", + "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "Front Door", - "severity": "High", - "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.", - "waf": "Security" + "checklist": "Azure Key Vault", + "guid": "17fb86a2-eb45-42a4-9c34-52b92a2a1842", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#data-replication", + "service": "Key Vault", + "severity": "Medium", + "text": "The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. Familiarize yourself with the Key Vault's data replication.", + "waf": "Reliability" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", - "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "Front Door", - "severity": "Low", - "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.", - "waf": "Performance" + "checklist": "Azure Key Vault", + "guid": "614682ca-6e0c-4f34-9f03-c6d3f2b99a32", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions", + "service": "Key Vault", + "severity": "Medium", + "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.", + "waf": "Reliability" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "Front Door", + "checklist": "Azure Key Vault", + "guid": "9ef2b0d2-3206-4c94-b47a-4f07e6a1c509", + "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations", + "service": "Key Vault", "severity": "Medium", - "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.", + "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.", "waf": "Reliability" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", - "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "Front Door", + "checklist": "Azure Key Vault", + "guid": "2df045b1-c0f6-47d3-9a9b-99cf6999684e", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "Key Vault", + "severity": "High", + "text": "If you want protection against accidental or malicious deletion of your secrets, configure soft-delete and purge protection features on your key vault.", + "waf": "Reliability" + }, + { + "checklist": "Azure Key Vault", + "guid": "cbfa96b0-5249-4e6f-947c-d0e79509708c", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "Key Vault", "severity": "Low", - "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.", - "waf": "Performance" + "text": "Key Vault's soft-deleted resources are retained for a set period of 90 calendar days. Familiarize yourself with the Key Vault's soft-delete guidance.", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", - "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "Load Balancer", - "severity": "High", - "text": "Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability", + "checklist": "Azure Key Vault", + "guid": "e8659d11-7e02-4db0-848c-c6541dbab68c", + "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", + "service": "Key Vault", + "severity": "Low", + "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.", "waf": "Reliability" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", - "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "Front Door", - "severity": "High", - "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.", - "waf": "Operations" + "checklist": "Azure Key Vault", + "guid": "45c25e29-d0ef-4f07-aa04-0f8c64cbcc04", + "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", + "service": "Key Vault", + "severity": "Low", + "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.", + "waf": "Reliability" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", - "service": "Front Door", + "checklist": "Azure Key Vault", + "guid": "0f15640b-31e5-4de6-85a7-d2c652fa09d3", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview#purge-protection", + "service": "Key Vault", "severity": "Medium", - "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", - "waf": "Operations" + "text": "Purge protection is recommended when using keys for encryption to prevent data loss. Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI, PowerShell or Portal.", + "waf": "Reliability" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", + "service": "AVS", "severity": "High", - "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.", + "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "75089c20-990d-4927-b105-885576f76fc2", + "service": "AVS", "severity": "Medium", - "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.", + "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", + "service": "AVS", "severity": "High", - "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.", + "text": "Ensure that vCenter is connected to ADDS to enable authentication based on 'named user accounts'", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", - "service": "Front Door", - "severity": "High", - "text": "Tune the Azure Front Door WAF for your workload. Reduce false positive detections.", + "checklist": "Azure VMware Solution Design Review", + "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", + "service": "AVS", + "severity": "Medium", + "text": "Ensure that the connection from vCenter to ADDS is using a secure protocol (LDAPS)", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "Front Door", - "severity": "High", - "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.", + "checklist": "Azure VMware Solution Design Review", + "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", + "service": "AVS", + "severity": "Medium", + "text": "CloudAdmin account in vCenter IdP is used only as an emergency account (break-glass)", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", + "service": "AVS", "severity": "High", - "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.", + "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", - "service": "Front Door", - "severity": "High", - "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", + "service": "AVS", + "severity": "Medium", + "text": "Has an RBAC model been created for use within VMware vSphere", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", + "service": "AVS", "severity": "Medium", - "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", + "text": "RBAC permissions should be granted on ADDS groups and not on specific users", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "b9620385-1cde-418f-914b-a84a06982ffc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", - "service": "Front Door", - "severity": "Medium", - "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", + "checklist": "Azure VMware Solution Design Review", + "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", + "service": "AVS", + "severity": "High", + "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", - "service": "Front Door", - "severity": "Medium", - "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", + "checklist": "Azure VMware Solution Design Review", + "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", + "service": "AVS", + "severity": "High", + "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", - "service": "Front Door", - "severity": "Low", - "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", - "waf": "Security" + "checklist": "Azure VMware Solution Design Review", + "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", + "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", + "service": "AVS", + "severity": "High", + "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand", + "waf": "Performance" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "00acd8a9-6975-414f-8491-2be6309893b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", + "service": "AVS", + "severity": "High", + "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'", + "waf": "Operations" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", + "service": "AVS", "severity": "Medium", - "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", - "waf": "Security" + "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection", + "waf": "Operations" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", - "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", + "service": "AVS", + "severity": "Medium", + "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity", + "waf": "Operations" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", + "service": "AVS", "severity": "High", - "text": "Enable the Azure Application Gateway WAF bot protection rule set The bot rules detect good and bad bots.", - "waf": "Security" + "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).", + "waf": "Operations" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", + "service": "AVS", "severity": "High", - "text": "Enable request body inspection feature enabled in Azure Application Gateway WAF policy.", + "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", + "service": "AVS", "severity": "High", - "text": "Tune the Azure Application Gateway WAF for your workload. Reduce false positive detections.", + "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles", "waf": "Security" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", + "service": "AVS", + "severity": "Medium", + "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)", + "waf": "Security" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", + "service": "AVS", "severity": "High", - "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.", + "text": "Limit use of CloudAdmin account to emergency access only", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", + "service": "AVS", "severity": "Medium", - "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", + "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", + "service": "AVS", "severity": "Medium", - "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", + "text": "Is a process defined to regularly rotate cloudadmin (vCenter) and admin (NSX) credentials", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "99937189-ff78-492a-b9ca-18d828d82b37", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", - "service": "App Gateway", - "severity": "Low", - "text": "If you are not expecting traffic from all geographical regions, use geo-filters to block traffic from non-expected countries.", + "checklist": "Azure VMware Solution Design Review", + "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", + "service": "AVS", + "severity": "High", + "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", + "service": "AVS", "severity": "Medium", - "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", + "text": "Is East-West traffic filtering implemented within NSX-T", + "waf": "Security" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", + "service": "AVS", + "severity": "High", + "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions", + "waf": "Security" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", + "service": "AVS", + "severity": "High", + "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", + "service": "AVS", "severity": "Medium", - "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", + "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "334fdf91-c234-4182-a652-75269440b4be", + "service": "AVS", "severity": "Medium", - "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.", - "waf": "Operations" + "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", + "service": "AVS", "severity": "Medium", - "text": "Add diagnostic settings to save your Azure Front Door WAF logs.", - "waf": "Operations" + "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "92664c60-47e3-4591-8b1b-8d557656e686", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", + "service": "AVS", "severity": "Medium", - "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.", - "waf": "Operations" + "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "845f5f91-9c21-4674-a725-5ce890850e20", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", + "service": "AVS", "severity": "Medium", - "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.", - "waf": "Operations" + "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", - "service": "App Gateway", - "severity": "Medium", - "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", - "waf": "Operations" + "checklist": "Azure VMware Solution Design Review", + "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", + "service": "AVS", + "severity": "Low", + "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", - "service": "App Gateway", - "severity": "Medium", - "text": "Use WAF Policies instead of the legacy WAF configuration.", - "waf": "Operations" + "checklist": "Azure VMware Solution Design Review", + "guid": "a3592718-e6e2-4051-9267-6ae46691e883", + "service": "AVS", + "severity": "Low", + "text": "When in-guest encryption is used, store encryption keys in Azure Key vault when possible", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "5ac94222-3e13-4810-9230-81a941741583", + "service": "AVS", "severity": "Medium", - "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.", + "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", - "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", - "service": "Front Door", - "severity": "Medium", - "text": "Make sure your origins only take traffic from your Azure Front Door instance.", - "waf": "Security" + "checklist": "Azure VMware Solution Design Review", + "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", + "service": "AVS", + "severity": "High", + "text": "Ensure that the appropriate vSAN Data redundancy method is used (RAID specification)", + "waf": "Reliability" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "d88408f3-7273-44c8-96ba-280214590146", + "service": "AVS", "severity": "High", - "text": "You should encrypt traffic to the backend servers.", - "waf": "Security" + "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs", + "waf": "Reliability" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", + "service": "AVS", "severity": "High", - "text": "You should use a Web Application Firewall.", - "waf": "Security" + "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement", + "waf": "Reliability" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", - "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", + "service": "AVS", "severity": "Medium", - "text": "Redirect HTTP to HTTPS", - "waf": "Security" + "text": "Ensure that access constraints to ESXi are understood, there are access limits which might affect 3rd party solutions.", + "waf": "Operations" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", - "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", + "service": "AVS", "severity": "Medium", - "text": "Use gateway-managed cookies to direct traffic from a user session to the same server for processing", + "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes", "waf": "Operations" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", - "service": "App Gateway", - "severity": "High", - "text": "Enable connection draining during planned service updates to prevent connection loss to existing membrs of the backend pool", - "waf": "Security" + "checklist": "Azure VMware Solution Design Review", + "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", + "service": "AVS", + "severity": "Medium", + "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used", + "waf": "Cost" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", - "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", + "service": "AVS", "severity": "Low", - "text": "Create custom error pages to display a personalized user experience", - "waf": "Operations" + "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution", + "waf": "Cost" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", - "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "6691e883-5ac9-4422-83e1-3810523081a9", + "service": "AVS", "severity": "Medium", - "text": "Edit HTTP requests and response headers for easier routing and information exchange between the client and server", + "text": "Consider the use of Azure Private-Link when using other Azure Native Services", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "App Gateway", - "severity": "Medium", - "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover", + "checklist": "Azure VMware Solution Design Review", + "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", + "service": "AVS", + "severity": "High", + "text": "Ensure all required resource reside within the same Azure availability zone(s)", "waf": "Performance" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "29dcc19f-a8fa-4c35-8281-290577538793", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", + "service": "AVS", "severity": "Medium", - "text": "Use transport layer load balancing", - "waf": "Performance" + "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads", + "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", - "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", + "service": "AVS", "severity": "Medium", - "text": "Configure routing based on host or domain name for multiple web applications on a single gateway", + "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads", "waf": "Security" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", - "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", + "service": "AVS", + "severity": "High", + "text": "Enable Diagnostic and metric logging on Azure VMware Solution", + "waf": "Operations" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", + "service": "AVS", "severity": "Medium", - "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm", - "waf": "Security" + "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads", + "waf": "Operations" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", - "service": "App Gateway", - "severity": "Low", - "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols", - "waf": "Security" + "checklist": "Azure VMware Solution Design Review", + "guid": "589d457a-927c-4397-9d11-02cad6aae11e", + "service": "AVS", + "severity": "Medium", + "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads", + "waf": "Operations" }, { - "checklist": "PostgreSQL Review Checklist", - "guid": "65285269-441c-44bf-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview", - "service": "PostgreSQL", + "checklist": "Azure VMware Solution Design Review", + "guid": "ee29711b-d352-4caa-ab79-b198dab81932", + "service": "AVS", "severity": "Medium", - "text": "Leverage Flexible Server", - "waf": "Reliability" + "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution", + "waf": "Security" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", + "service": "AVS", + "severity": "Medium", + "text": "Are the applicable compliance baselines added to Microsoft Defender for Cloud", + "waf": "Security" }, { - "checklist": "PostgreSQL Review Checklist", - "guid": "016ccf31-ae5a-41eb-9888-9535e227896d", - "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability", - "service": "PostgreSQL", + "checklist": "Azure VMware Solution Design Review", + "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", + "service": "AVS", "severity": "High", - "text": "Leverage Availability Zones where regionally applicable", - "waf": "Reliability" + "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment", + "waf": "Security" }, { - "checklist": "PostgreSQL Review Checklist", - "guid": "31b67c67-be59-4519-8083-845d587cb391", - "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas", - "service": "PostgreSQL", - "severity": "Medium", - "text": "Leverage cross-region read replicas for BCDR", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", + "service": "AVS", + "severity": "High", + "text": "Are data processing implications (service provider / service consumer model) clear and documented", + "waf": "Security" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687", - "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "547c1747-dc56-4068-a714-435cd19dd244", + "service": "AVS", "severity": "Medium", - "text": "Leverage FTA Resillency Handbook", - "waf": "Reliability" + "text": "Consider using CMK (Customer Managed Key) for vSAN only if needed for compliance reason(s).", + "waf": "Security" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", + "service": "AVS", "severity": "High", - "text": "Plan for Data Center level outage", - "waf": "Reliability" + "text": "Create dashboards to enable core Azure VMware Solution monitoring insights", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets", - "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", - "severity": "Medium", - "text": "Practice Failover for BCDR", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", + "service": "AVS", + "severity": "High", + "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "97b15b8a-219a-44ab-bb57-879024d22678", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "9659e396-80e7-4828-ac93-5657d02bff45", + "service": "AVS", "severity": "High", - "text": "Plan a backup strategy and take regular backups", - "waf": "Reliability" + "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d", - "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet", - "service": "Purview", - "severity": "Low", - "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", + "service": "AVS", + "severity": "High", + "text": "Ensure alerts are configured for Azure Service Health alerts and notifications", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b", - "link": "https://learn.microsoft.com/purview/deployment-best-practices", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", + "service": "AVS", "severity": "Medium", - "text": "Follow Purview accounts architectures and deployment best practices", - "waf": "Reliability" + "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c", - "link": "https://learn.microsoft.com/purview/concept-best-practices-collections", - "service": "Purview", - "severity": "Medium", - "text": "Follow Collection Architectures and best practices", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", + "service": "AVS", + "severity": "Low", + "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b", - "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", + "service": "AVS", + "severity": "High", + "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning", + "waf": "Operations" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", + "service": "AVS", "severity": "Medium", - "text": "Follow Assest lifecycle best practices", - "waf": "Reliability" + "text": "Ensure vSphere content libraries are not placed on vSAN as vSAN is a finite resource", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed", - "link": "https://learn.microsoft.com/purview/concept-best-practices-automation", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", + "service": "AVS", "severity": "Medium", - "text": "Follow automation best practices", - "waf": "Reliability" + "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf", - "link": "https://learn.microsoft.com/purview/disaster-recovery", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", + "service": "AVS", "severity": "Medium", - "text": "Follow Backup and Migration Best practices", - "waf": "Reliability" + "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7", - "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", + "service": "AVS", "severity": "Medium", - "text": "Follow Purview Glossary Best Practices", - "waf": "Reliability" + "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790", - "link": "https://learn.microsoft.com/purview/concept-workflow", - "service": "Purview", - "severity": "Low", - "text": "Leverage Workflows ", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", + "service": "AVS", + "severity": "Medium", + "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e", - "link": "https://learn.microsoft.com/purview/concept-best-practices-security", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", + "service": "AVS", "severity": "Medium", - "text": "Follow Purview Security Best Practices", - "waf": "Reliability" + "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888", - "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", + "service": "AVS", "severity": "Medium", - "text": "Follow Purview Data Lineage Best Practices", - "waf": "Reliability" + "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud", + "waf": "Security" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "9579e76b-896e-4710-a7da-7be9956d14d3", - "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", + "service": "AVS", "severity": "Medium", - "text": "Follow Best Practices for Scanning Registered Sources", + "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed", - "link": "https://learn.microsoft.com/purview/concept-best-practices-classification", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", + "service": "AVS", "severity": "Medium", - "text": "Follow Classification Best Practices in Governance Portal", + "text": "Have all DR solutions been considered and a solution that is best for your business been decided upon? [SRM/JetStream/Zerto/Veeam/...]", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69", - "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", + "service": "AVS", "severity": "Medium", - "text": "Perform Sensitivity Labelling in the Purview Data Map", + "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96", - "link": "https://learn.microsoft.com/purview/concept-data-share", - "service": "Purview", - "severity": "Low", - "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", + "service": "AVS", + "severity": "High", + "text": "Use Automated recovery plans with either of the Disaster solutions, avoid manual tasks as much as possible", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4", - "link": "https://learn.microsoft.com/purview/concept-insights", - "service": "Purview", - "severity": "Low", - "text": "Leverage Data Estate Insights", + "checklist": "Azure VMware Solution Design Review", + "guid": "8255461e-2aee-4345-9aec-8339248b262d", + "service": "AVS", + "severity": "Medium", + "text": "Use the geopolitical region pair as the secondary disaster recovery environment", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab", - "link": "https://learn.microsoft.com/purview/catalog-adoption-insights", - "service": "Purview", - "severity": "Low", - "text": "Use Data stewardship and Catalog adoption", + "checklist": "Azure VMware Solution Design Review", + "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", + "service": "AVS", + "severity": "High", + "text": "Use 2 different address spaces between the regions, for example: 10.0.0.0/16 and 192.168.0.0/16 for the different regions", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581", - "link": "https://learn.microsoft.com/purview/concept-insights", - "service": "Purview", - "severity": "Low", - "text": "Use Inventory and Ownership", + "checklist": "Azure VMware Solution Design Review", + "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", + "service": "AVS", + "severity": "Medium", + "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9", - "link": "https://learn.microsoft.com/purview/glossary-insights", - "service": "Purview", - "severity": "Low", - "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels", + "checklist": "Azure VMware Solution Design Review", + "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", + "service": "AVS", + "severity": "Medium", + "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "b130a888-9579-4e76-a896-e710a7da7be9", - "link": "https://learn.microsoft.com/purview/compliance-manager", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", + "service": "AVS", "severity": "Medium", - "text": "Generate assessment scores", + "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f", - "link": "https://learn.microsoft.com/purview/compliance-manager-scoring", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", + "service": "AVS", "severity": "Medium", - "text": "Profiling- get summaries of data content", + "text": "Deploy your backup solution outside of vSan, on Azure native components", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1", - "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", + "service": "AVS", "severity": "Low", - "text": "Follow Microsoft Purview Data Owner access policies", + "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?", "waf": "Reliability" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac", - "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", + "service": "AVS", "severity": "Low", - "text": "Follow Self-service access policies", - "waf": "Reliability" + "text": "For manual deployments, all configuration and deployments must be documented", + "waf": "Operations" }, { - "checklist": "Microsoft Purview Review Checklist", - "guid": "b49e5b96-0332-44ec-b8cc-13318da61170", - "link": "https://learn.microsoft.com/purview/concept-policies-devops", - "service": "Purview", + "checklist": "Azure VMware Solution Design Review", + "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", + "service": "AVS", "severity": "Low", - "text": "Follow DevOps policies", - "waf": "Reliability" + "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud", + "waf": "Operations" }, { - "checklist": "Redis Resiliency checklist", - "guid": "65285269-440b-44be-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", - "service": "Redis", - "severity": "High", - "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", + "service": "AVS", + "severity": "Low", + "text": "For automated deployments, deploy a minimal private cloud and scale as needed", + "waf": "Operations" }, { - "checklist": "Redis Resiliency checklist", - "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", - "service": "Redis", - "severity": "Medium", - "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", + "service": "AVS", + "severity": "Low", + "text": "For automated deployments, request or reserve quota prior to starting the deployment", + "waf": "Operations" }, { - "checklist": "Redis Resiliency checklist", - "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", - "service": "Redis", - "severity": "Medium", - "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", + "service": "AVS", + "severity": "Low", + "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance", + "waf": "Operations" }, { - "checklist": "Redis Resiliency checklist", - "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", - "service": "Redis", - "severity": "Medium", - "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", + "service": "AVS", + "severity": "Low", + "text": "Implement human understandable names for ExR authorization keys to allow for easy identification of the keys purpose/use", + "waf": "Operations" }, { - "checklist": "Resiliency Review", - "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.", - "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs", - "service": "VMSS", + "checklist": "Azure VMware Solution Design Review", + "guid": "255461e2-aee3-4553-afc8-339248b262d6", + "service": "AVS", "severity": "Low", - "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency", - "waf": "Reliability" + "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute", + "waf": "Operations" }, { - "checklist": "Resiliency Review", - "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).", - "guid": "4d874a74-8b66-42d6-b150-512a66498f6d", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction", - "service": "VM", - "severity": "High", - "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", + "service": "AVS", + "severity": "Low", + "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.", + "waf": "Operations" }, { - "checklist": "Resiliency Review", - "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%", - "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "VM", - "severity": "High", - "text": "Use Premium or Ultra disks for production VMs", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", + "service": "AVS", + "severity": "Low", + "text": "When performing automated configuration of NSX-T segments with a single Tier-1 gateway, use Azure Portal APIs instead of NSX-Manager APIs", + "waf": "Operations" }, { - "checklist": "Resiliency Review", - "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.", - "guid": "b31e38c3-f298-412b-8363-cffe179b599d", - "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview", - "service": "VM", - "severity": "High", - "text": "Ensure Managed Disks are used for all VMs", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", + "service": "AVS", + "severity": "Medium", + "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution", + "waf": "Performance" }, { - "checklist": "Resiliency Review", - "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.", - "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4", - "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk", - "service": "VM", + "checklist": "Azure VMware Solution Design Review", + "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", + "service": "AVS", "severity": "Medium", - "text": "Do not use the Temp disk for anything that is not acceptable to be lost", - "waf": "Reliability" + "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action", + "waf": "Performance" }, { - "checklist": "Resiliency Review", - "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.", - "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", + "checklist": "Azure VMware Solution Design Review", + "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", + "service": "AVS", "severity": "Medium", - "text": "Leverage Availability Zones for your VMs in regions where they are supported", - "waf": "Reliability" + "text": "Scaling operations always need to be serialized within a single SDDC as only one scale operation can be performed at a time (even when multiple clusters are used)", + "waf": "Performance" }, { - "checklist": "Resiliency Review", - "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.", - "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "VM", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", + "service": "AVS", "severity": "Medium", - "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets", + "text": "Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", + "waf": "Performance" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", + "service": "AVS", + "severity": "Medium", + "text": "Define and enforce scale in/out maximum limits for your environment in the automations", + "waf": "Performance" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", + "service": "AVS", + "severity": "Medium", + "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses", + "waf": "Operations" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", + "severity": "High", + "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)", - "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", + "checklist": "Azure VMware Solution Design Review", + "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", "severity": "High", - "text": "Avoid running a production workload on a single VM", + "text": "When using MON, you cannot enable MON on more than 100 Network extensions", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.", - "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", - "severity": "High", - "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery", - "waf": "Reliability" + "checklist": "Azure VMware Solution Design Review", + "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", + "service": "AVS", + "severity": "Medium", + "text": "If using a VPN connection for migrations, adjust your MTU size accordingly.", + "waf": "Performance" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "e614658d-d457-4e92-9139-b821102cad6e", + "service": "AVS", + "severity": "Medium", + "text": "For low connectivity regions connecting into Azure (500Mbps or less), considering deploying the HCX WAN optimization appliance", + "waf": "Performance" }, { - "checklist": "Resiliency Review", - "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.", - "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d", - "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview", - "service": "VM", - "severity": "Low", - "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", + "service": "AVS", + "severity": "Medium", + "text": "Ensure that migrations are started from the on-premises appliance and NOT from the Cloud appliance (do NOT perform a reverse migration)", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.", - "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666", - "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests", - "service": "VM", + "checklist": "Azure VMware Solution Design Review", + "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "AVS", "severity": "Medium", - "text": "Increase quotas in DR region before testing failover with ASR", + "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.", - "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87", - "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events", - "service": "VM", - "severity": "Low", - "text": "Utilize Scheduled Events to prepare for VM maintenance", + "checklist": "Azure VMware Solution Design Review", + "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "AVS", + "severity": "Medium", + "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.", - "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "AVS", "severity": "Medium", - "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements", + "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.", - "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", - "severity": "Low", - "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts", + "checklist": "Azure VMware Solution Design Review", + "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "AVS", + "severity": "High", + "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.", - "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", - "severity": "Low", - "text": "Enable soft delete for Storage Account Containers", + "checklist": "Azure VMware Solution Design Review", + "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "AVS", + "severity": "High", + "text": "If using stretched cluster, ensure that the SLA provided will meet your requirements", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.", - "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", - "severity": "Low", - "text": "Enable soft delete for blobs", + "checklist": "Azure VMware Solution Design Review", + "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "AVS", + "severity": "High", + "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.", - "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about", - "service": "Azure Backup", - "severity": "Medium", - "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery", + "checklist": "Azure VMware Solution Design Review", + "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "AVS", + "severity": "High", + "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.", - "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae", - "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept", - "service": "Azure Backup", - "severity": "Low", - "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources", + "checklist": "Azure VMware Solution Design Review", + "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "AVS", + "severity": "High", + "text": "Have site disaster tolerance settings been properly considered and changed for your business if needed.", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.", - "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e", - "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault", - "service": "Azure Backup", - "severity": "Low", - "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups", + "checklist": "Device Provisioning Service Review", + "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", + "service": "IoT Hub DPS", + "severity": "High", + "text": "Select the right Logic App hosting plan based on your business & SLO requirements", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.", - "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146", - "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", - "service": "DNS", - "severity": "Low", - "text": "Implement DNS Failover using Azure DNS Private Resolvers", + "checklist": "Device Provisioning Service Review", + "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "IoT Hub DPS", + "severity": "High", + "text": "Protect logic apps from region failures with zone redundancy and availability zones", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.", - "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103", - "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters", - "service": "Data Gateways", - "severity": "Medium", - "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data", + "checklist": "Device Provisioning Service Review", + "guid": "8aed4fbf-0830-4883-899d-222a154af478", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "IoT Hub DPS", + "severity": "High", + "text": "Consider a Cross-Region DR strategy for critical workloads", "waf": "Reliability" }, { - "checklist": "Resiliency Review", - "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.", - "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", + "checklist": "Device Provisioning Service Review", + "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "IoT Hub DPS", "severity": "High", - "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability", + "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", - "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", - "service": "SAP", + "checklist": "Device Provisioning Service Review", + "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "IoT Hub DPS", "severity": "Medium", - "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "text": "Leverage Azure DevOps or GitHub to streamline CI/CD and safeguard your Logic App code", "waf": "Operations" }, { - "checklist": "SAP Checklist", - "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", - "service": "SAP", + "checklist": "CosmosDB Review Checklist", + "guid": "43e52f47-22d9-428c-8b1c-d521e54a29a9", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/pass-foundations-playbooks-CosmosDB_v1.docx", + "service": "CosmosDB", "severity": "Medium", - "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.", - "training": "https://github.com/Azure/sap-automation", - "waf": "Operations" + "text": "FTA Resiliency Playbook", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", - "service": "SAP", - "severity": "Medium", - "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally", + "checklist": "CosmosDB Review Checklist", + "guid": "de39ac0e-7c28-4dc9-9565-7202bff4564b", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", + "service": "CosmosDB", + "severity": "High", + "text": "Leverage Availablity Zones where regionally applicable and ofcourse if the service offers it", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", - "service": "SAP", + "checklist": "CosmosDB Review Checklist", + "guid": "0d934a34-8b26-43e7-bd60-513a3649906e", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#replica-outages", + "service": "CosmosDB", "severity": "Medium", - "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.", + "text": "Run multiple replicas of the database (>1 ) in Prod", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "b651423c-8552-42db-a545-5cb50c05527a", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "SAP", - "severity": "High", - "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "checklist": "CosmosDB Review Checklist", + "description": "Multi-region writes capability allows you to take advantage of the provisioned throughput for your databases and containers across the globe", + "guid": "bad38ead-53cc-47de-8d8a-aab3571449ab", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions", + "service": "CosmosDB", + "severity": "Medium", + "text": "Leverage Multi-Region Writes", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", + "checklist": "CosmosDB Review Checklist", + "description": "Span Cosmos account across two or more regions with multi-region writes", + "guid": "8153d89f-89dc-47b3-9be2-b1a27f7b9e91", + "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", + "service": "CosmosDB", "severity": "Medium", - "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "text": "Distribute your data globally", "waf": "Reliability" - }, - { - "checklist": "SAP Checklist", - "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "SAP", + }, + { + "checklist": "CosmosDB Review Checklist", + "description": "Choose from various consistency levels such as Eventual, Consistent Prefix, Session, Bounded Staleness and strong", + "guid": "9f8ea848-25ec-4140-bc32-2758e6ee9ac0", + "link": "https://learn.microsoft.com/azure/cosmos-db/consistency-levels", + "service": "CosmosDB", "severity": "High", - "text": "Set up ExpressRoute connections from on-premises to the primary and secondary Azure disaster recovery regions. Also, as an alternative to using ExpressRoute, consider setting up VPN connections from on-premises to the primary and secondary Azure disaster recovery regions.", - "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", + "text": "Choose from several well-defined consistency models", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "SAP", - "severity": "Low", - "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.", + "checklist": "CosmosDB Review Checklist", + "description": "Maintain business continuity during regional outages. Azure Cosmos DB supports service-managed failover during a regional outage. During a regional outage, Azure Cosmos DB continues to maintain its latency, availability, consistency, and throughput SLAs. To help make sure that your entire application is highly available, Azure Cosmos DB offers a manual failover API to simulate a regional outage. By using this API, you can carry out regular business continuity drills.", + "guid": "a47e4d1e-bb79-43f9-bf87-69e1032b72fe", + "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover", + "service": "CosmosDB", + "severity": "Medium", + "text": "Enable Service managed failover", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", - "service": "SAP", + "checklist": "CosmosDB Review Checklist", + "description": "Azure Cosmos DB automatically takes backups of your data at regular intervals. The automatic backups are taken without affecting the performance or availability of the database operations. All the backups are stored separately in a storage service.", + "guid": "3499c9c1-133d-42f7-a4b1-a5bd06ff1a90", + "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore", + "service": "CosmosDB", "severity": "Medium", - "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.", + "text": "Enable Automatic Backups", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", - "service": "SAP", - "severity": "Low", - "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.", - "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", + "checklist": "CosmosDB Review Checklist", + "description": "This mode is the default backup mode for all existing accounts. In this mode, backup is taken at a periodic interval and the data is restored by creating a request with the support team. In this mode, you configure a backup interval and retention for your account. The maximum retention period extends to a month. The minimum backup interval can be one hour.", + "guid": "a6eb33f6-005c-4d92-9286-7655672d6121", + "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction", + "service": "CosmosDB", + "severity": "Medium", + "text": "Perform Periodic Backups", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", - "severity": "High", - "text": "Native database replication technology should be used to synchronize the database in a HA pair.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", + "checklist": "CosmosDB Review Checklist", + "description": "Continous 7 day retention and 30 day retention backups. Azure Cosmos DB performs data backup in the background without consuming any extra provisioned throughput (RUs) or affecting the performance and availability of your database. Continuous backups are taken in every region where the account exists.", + "guid": "d43918a8-cd28-49be-b6b1-7cb8245461e1", + "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction", + "service": "CosmosDB", + "severity": "Medium", + "text": "Continous Backup with point-in-time restore in Azure Cosmos DB", + "training": "https://learn.microsoft.com/learn/modules/create-custom-azure-roles-with-rbac/", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", - "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", - "service": "SAP", - "severity": "High", - "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "checklist": "Azure Data Explorer Review Checklist", + "description": "Using the correct approach to feed a datalake with cold data and having the Kusto query engine at your disposal at the same time, as in the short-term storage", + "guid": "ba7da7be-9951-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export", + "service": "Azure Data Explorer", + "text": "Leverage External Tables and Continuous data export overview to reduce costs", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", - "service": "SAP", - "severity": "High", - "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "checklist": "Azure Data Explorer Review Checklist", + "description": "Azure Data Explorer provides an optional follower capability for a leader cluster to be followed by other follower clusters for read-only access to the leader's data and metadata. Changes in the leader, such as create, append, and drop are automatically synchronized to the follower. While the leaders could span Azure regions, the follower clusters should be hosted in the same region(s) as the leader. If the leader cluster is down or databases or tables are accidentally dropped, the follower clusters will lose access until access is recovered in the leader.", + "guid": "56a22586-f490-4641-addd-ea8a377cdeb3", + "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp", + "service": "Azure Data Explorer", + "text": "To share data, explore Leader-follower cluster configuration", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", - "severity": "High", - "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", + "checklist": "Azure Data Explorer Review Checklist", + "description": "Azure Data Explorer doesn't support automatic protection against the outage of an entire Azure region. This disruption can happen during a natural disaster, like an earthquake. If you require a solution for a disaster recovery situation, do the following steps to ensure business continuity. In these steps, you'll replicate your clusters, management, and data ingestion in two Azure paired regions.", + "guid": "861bb2bc-14ae-4a6e-95d8-d9a3adc218e6", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters", + "service": "Azure Data Explorer", + "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", - "service": "SAP", - "severity": "High", - "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "checklist": "Azure Data Explorer Review Checklist", + "guid": "436b0635-cb45-4e57-a603-324ace8cc123", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities", + "service": "Azure Data Explorer", + "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", - "severity": "High", - "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", + "checklist": "Azure Data Explorer Review Checklist", + "guid": "18ca6017-0265-4f4b-a46a-393af7f31728", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution", + "service": "Azure Data Explorer", + "text": "Ingest data into each cluster in parallel", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", - "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", - "service": "SAP", - "severity": "High", - "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", + "checklist": "Azure Data Explorer Review Checklist", + "description": "This configuration is also called 'always-on'. For critical application deployments with no tolerance for outages, you should use multiple Azure Data Explorer clusters across Azure paired regions.", + "guid": "58a9c279-9c42-4bb6-9d0c-65556246b338", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration", + "service": "Azure Data Explorer", + "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", - "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", - "service": "SAP", - "severity": "High", - "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "checklist": "Azure Data Explorer Review Checklist", + "description": "This configuration is identical to the active-active-active configuration, but only involves two Azure paired regions. Configure dual ingestion, processing, and curation. Users are routed to the nearest region. The cluster SKU must be the same across regions.", + "guid": "563a4dc7-4a74-48b6-922a-d190916a6649", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration", + "service": "Azure Data Explorer", + "text": "For critical applications, create Active-Active configuration in two paired regions", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", - "service": "SAP", - "severity": "High", - "text": "Most failover clusters for SAP application layer components (ASCS) and the DBMS layer require a virtual IP address for a failover cluster. Azure Load Balancer should handle the virtual IP address for all other cases. One design principle is to use one load balancer per cluster configuration. We recommend that you use the standard version of the load balancer (Standard Load Balancer SKU).", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "checklist": "Azure Data Explorer Review Checklist", + "description": "The Active-Hot configuration is similar to the Active-Active configuration in dual ingest, processing, and curation. While the standby cluster is online for ingestion, process, and curation, it isn't available to query. The standby cluster doesn't need to be in the same SKU as the primary cluster. It can be of a smaller SKU and scale, which may result in it being less performant. In a disaster scenario, users are redirected to the standby cluster, which can optionally be scaled up to increase performance.", + "guid": "8fadfe27-7de2-483b-8ac3-52baa9b75708", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-hot-standby-configuration", + "service": "Azure Data Explorer", + "text": "For applications, which required only read during failure, create Active-Hot standby configuration", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", - "service": "SAP", - "severity": "High", - "text": "Make sure the Floating IP is enabled on the Load balancer", - "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "checklist": "Azure Data Explorer Review Checklist", + "description": "This solution offers the least resiliency (highest RPO and RTO), is the lowest in cost and highest in effort. In this configuration, there's no data recovery cluster. Configure continuous export of curated data (unless raw and intermediate data is also required) to a storage account that is configured GRS (Geo Redundant Storage). A data recovery cluster is spun up if there is a disaster recovery scenario. At that time, DDLs, configuration, policies, and processes are applied. Data is ingested from storage with the ingestion property kustoCreationTime to over-ride the ingestion time that defaults to system time.", + "guid": "49aa8092-dc8e-4b9d-8bb7-3b26a5a67eba", + "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration", + "service": "Azure Data Explorer", + "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "SAP", - "severity": "High", - "text": "Before you deploy your high-availability infrastructure, and depending on the region you choose, determine whether to deploy with an Azure availability set or an availability zone.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "checklist": "Azure Data Explorer Review Checklist", + "description": "All database objects, policies, and configurations should be persisted in source control so they can be released to the cluster from your release automation tool.", + "guid": "5a907e1e-348e-4f25-9c27-d32e8bbac757", + "link": "https://learn.microsoft.com/azure/data-explorer/devops", + "service": "Azure Data Explorer", + "text": "Wrap DevOps and source control around all your code", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", - "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", - "service": "SAP", - "severity": "High", - "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.", + "checklist": "Azure Data Explorer Review Checklist", + "guid": "1559ab91-53e8-4908-ae28-b84c33b6b780", + "link": "https://learn.microsoft.com/azure/data-explorer/devops", + "service": "Azure Data Explorer", + "text": "Design, develop, and implement validation routines to ensure all clusters are in-sync from a data perspective.", + "training": "https://learn.microsoft.com/learn/modules/azure-active-directory/", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "cbe05bbe-209d-4490-ba47-778424d11678", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", - "severity": "High", - "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "checklist": "Azure Data Explorer Review Checklist", + "guid": "8b9fe5c4-1049-4d40-9a82-2c3474d00f18", + "link": "https://learn.microsoft.com/azure/data-explorer/devops", + "service": "Azure Data Explorer", + "text": "Be fully cognizant of what it takes to build a cluster from scratch. Leverage Infrastructure as a Code for your deployments", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", - "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", - "service": "SAP", + "checklist": "Identity Review Checklist", + "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", + "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", + "service": "Entra", "severity": "Medium", - "text": "You can't deploy Azure availability sets within an Azure availability zone unless you use proximity placement groups.", - "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "9674e7c7-7796-4181-8920-09f4429543ba", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", - "severity": "High", - "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "checklist": "Identity Review Checklist", + "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", + "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", + "service": "AAD B2C", + "severity": "Medium", + "text": "Make sure that your sign-in user flows are backed up and resilient. Make sure that the code that you use to sign-in your users are backed up and recoverable. Resilient interfaces with external processes", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", - "severity": "High", - "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.", + "checklist": "Identity Review Checklist", + "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", + "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", + "service": "AAD B2C", + "severity": "Medium", + "text": "Custom brand assets should be hosted on a CDN", + "waf": "Performance" + }, + { + "checklist": "Identity Review Checklist", + "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", + "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", + "service": "AAD B2C", + "severity": "Low", + "text": "Have multiple identiy providers (i.e., login with your microsoft, google, facebook accounts)", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", - "severity": "High", - "text": "Use one proximity placement group per SAP SID. Groups don't span across Availability Zones or Azure regions", + "checklist": "Identity Review Checklist", + "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "Medium", + "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", - "severity": "High", - "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "checklist": "Identity Review Checklist", + "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "Medium", + "text": "Don't replicate! Replication can create issues with directory synchronization", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "ed46b937-913e-4018-9c62-8393ab037e53", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", - "service": "SAP", + "checklist": "Identity Review Checklist", + "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "severity": "Medium", - "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "text": "Have active-active for multi-regions", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "f656e745-0cfb-453e-8008-0528fa21c933", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", + "checklist": "Identity Review Checklist", + "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "severity": "Medium", - "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.", + "text": "Add Azure AD Domain service stamps to additional regions and locations", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "7f684ebc-95da-425e-b329-e782dbed050f", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", - "service": "SAP", + "checklist": "Identity Review Checklist", + "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "severity": "Medium", - "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "text": "Use Replica Sets for DR", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", - "severity": "High", - "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "checklist": "Resiliency Review", + "description": "Automatic instance repairs ensure that unhealthy instances are promptly identified and replaced, maintaining a set of healthy instances within your scale set.", + "guid": "7e13c105-675c-41e9-95b4-59837ff7ae7c", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs", + "service": "VMSS", + "severity": "Low", + "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "Ensure that Azure Backup is utilized appropriately to meet your organization's resiliency requirements for Azure virtual machines (VMs).", + "guid": "4d874a74-8b66-42d6-b150-512a66498f6d", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction", + "service": "VM", "severity": "High", - "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.", - "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", + "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "Single Instance VMs using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks are guaranteed to have Virtual Machine Connectivity of at least 99.9%", + "guid": "8052d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "VM", "severity": "High", - "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", + "text": "Use Premium or Ultra disks for production VMs", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", - "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "Azure automatically replicates managed disks within a region to ensure data durability and protect against single-point failures.", + "guid": "b31e38c3-f298-412b-8363-cffe179b599d", + "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview", + "service": "VM", "severity": "High", - "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.", + "text": "Ensure Managed Disks are used for all VMs", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "Temporary disks are intended for short-term storage of non-persistent data such as page files, swap files, or SQL Server tempdb. Storing persistent data on temporary disks can lead to data loss during maintenance events or VM redeployment.", + "guid": "e0d5973c-d4ce-432c-8881-37f6f7c4c0d4", + "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk", + "service": "VM", "severity": "Medium", - "text": "Automate SAP System Start-Stop to manage costs.", - "waf": "Cost" - }, - { - "checklist": "SAP Checklist", - "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", - "severity": "Low", - "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.", - "waf": "Cost" - }, - { - "checklist": "SAP Checklist", - "guid": "9877f353-2591-4e8b-8381-e9043fed1010", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", - "severity": "Low", - "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.", - "waf": "Cost" + "text": "Do not use the Temp disk for anything that is not acceptable to be lost", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", - "service": "SAP", - "severity": "High", - "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "Co-locate your compute, storage, networking, and data resources across an availability zone, and replicate this arrangement in other availability zones.", + "guid": "e514548d-2447-4ec6-9138-b8200f1ce16e", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", + "severity": "Medium", + "text": "Leverage Availability Zones for your VMs in regions where they are supported", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "45911475-e39e-4530-accc-d979366bcda2", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "Use at least two VMs in Availability Sets to isolate VMs on different fault and update domains.", + "guid": "5a785d6f-e96c-496a-b884-4cf3b2b38c88", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "VM", "severity": "Medium", - "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", - "waf": "Security" + "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", - "severity": "Medium", - "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "Azure provides multiple options for VM redundancy to meet different requirements (Availability Zones, Virtual Machine Scale Sets, Availability Sets, Azure Site Recovery)", + "guid": "6ba2c021-4991-414a-9d3c-e574dccbd979", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", + "severity": "High", + "text": "Avoid running a production workload on a single VM", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", - "severity": "Medium", - "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "Azure Site Recovery enables you to achieve low RTO (Recovery Time Objective) for your Azure and hybrid VMs by providing continuous replication and failover capabilities.", + "guid": "2a6bcca2-b5fe-4a1e-af3d-d95d48c7c891", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", + "severity": "High", + "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", - "service": "SAP", - "severity": "Medium", - "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "By using Capacity Reservations, you can effectively manage capacity for critical workloads, ensuring resource availability in specified regions.", + "guid": "bd7bb012-f7b9-45e0-9e15-8e3ea3992c2d", + "link": "https://learn.microsoft.com/azure/virtual-machines/capacity-reservation-overview", + "service": "VM", + "severity": "Low", + "text": "Use Capacity Reservations for critical workloads that require guaranteed capacity", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "By ensuring that the necessary quotas are increased in your DR region before testing failover with ASR, you can avoid any potential resource constraints during the recovery process for failed over VMs.", + "guid": "e6e2065b-3a76-4af4-a691-e8939ada4666", + "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests", + "service": "VM", "severity": "Medium", - "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", - "waf": "Security" + "text": "Increase quotas in DR region before testing failover with ASR", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", - "service": "SAP", - "severity": "Medium", - "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "Scheduled Events is an Azure Metadata Service that provides information about upcoming maintenance events for virtual machines (VMs). By leveraging Scheduled Events, you can proactively prepare your applications for VM maintenance, minimizing disruption and improving the availability of your VMs.", + "guid": "6d3b475a-5c7a-4cbe-99bb-e64dd8902e87", + "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events", + "service": "VM", + "severity": "Low", + "text": "Utilize Scheduled Events to prepare for VM maintenance", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", - "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "Use Zone-redundant Storage (ZRS) in the primary region for scenarios that require high availability and for restricting replication to a particular country or region. For protection against regional disasters, use Geo-zone-redundant Storage (GZRS), which combines ZRS in the primary region with geo-replication to a secondary region?.", + "guid": "48c7c891-dcb1-4f7d-9769-ae568ba38d4a", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Azure Storage", "severity": "Medium", - "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", - "waf": "Security" + "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "16785d6f-a96c-496a-b885-18f482734c88", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", - "service": "SAP", - "severity": "Medium", - "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "Assigning a Delete lock to your storage account helps protect the availability of your data, minimizing the risk of disruptions to your business operations.", + "guid": "85e2213d-bd7b-4b01-8f7b-95e06e158e3e", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", + "severity": "Low", + "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "a747c350-8d4c-449c-93af-393dbca77c48", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", - "service": "SAP", - "severity": "Medium", - "text": "Implement SSO to SAP HANA", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "Container soft delete protects your data from being accidentally deleted by maintaining the deleted data in the system for a specified period of time.", + "guid": "a3992c2d-e6e2-4065-a3a7-6af4a691e893", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", + "severity": "Low", + "text": "Enable soft delete for Storage Account Containers", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", - "service": "SAP", - "severity": "Medium", - "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "Blob soft delete protects an individual blob and its versions, snapshots, and metadata from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time.", + "guid": "9ada4666-7e13-4c10-96b9-153d89f89dc7", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", + "severity": "Low", + "text": "Enable soft delete for blobs", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", - "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "Azure Backup enhanced soft delete provides critical protection against ransomware attacks by retaining deleted backups, enabling recovery from potential ransomware encryption or deletion.", + "guid": "b44be3b1-a27f-48b9-b91b-e1038df03a82", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about", + "service": "Azure Backup", "severity": "Medium", - "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.", - "waf": "Security" + "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", - "service": "SAP", - "severity": "Medium", - "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "Azure Backup's multi-user authorization enables fine-grained control over user access to backup resources, allowing you to restrict privileges and ensure proper authentication and authorization for backup operations.", + "guid": "2cd463cb-bbc8-4ac2-a9eb-c92a43da1dae", + "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept", + "service": "Azure Backup", + "severity": "Low", + "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", - "service": "SAP", - "severity": "Medium", - "text": "Implement SSO to SAP BTP", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "Azure Immutable Storage provides an additional layer of security by ensuring that backup data stored in the vault cannot be modified or deleted for a specified retention period. This helps safeguard your backups from ransomware attacks that may attempt to compromise or manipulate your backup data.", + "guid": "2cc88147-0607-4c1c-aa0e-614658dd458e", + "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault", + "service": "Azure Backup", + "severity": "Low", + "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", - "service": "SAP", - "severity": "Medium", - "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.", - "waf": "Security" + "checklist": "Resiliency Review", + "description": "To eliminate a single point of failure in your on-premises DNS services and ensure reliable DNS resolution during business continuity and disaster recovery scenarios, it is recommended to utilize Azure DNS Private Resolvers in multiple regions. By deploying two or more Azure DNS private resolvers across different regions, you can enable DNS failover and achieve resiliency in your DNS infrastructure.", + "guid": "43da1dae-2cc8-4814-9060-7c1cca0e6146", + "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", + "service": "DNS", + "severity": "Low", + "text": "Implement DNS Failover using Azure DNS Private Resolvers", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "6ba28021-4591-4147-9e39-e5309cccd979", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "Use an on-premises data gateway cluster to avoid single points of failure and to load balance traffic across gateways.", + "guid": "89f89dc7-b44b-4e3b-8a27-f8b9e91be103", + "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters", + "service": "Data Gateways", "severity": "Medium", - "text": "enforce existing Management Group policies to SAP Subscriptions", - "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", - "waf": "Operations" + "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "checklist": "Resiliency Review", + "description": "When choosing the best option for deploying NVAs in Azure, it is crucial to consider the vendor's recommendations and validate that the specific design has been vetted and validated by the NVA vendor. The vendor should also provide the necessary NVA configuration for seamless integration in Azure.", + "guid": "8b1188b3-c6a4-46ce-a544-451e192d3442", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "severity": "High", - "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", - "waf": "Operations" + "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "checklist": "Container Apps Review", + "guid": "af416482-663c-4ed6-b195-b44c7068e09c", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#availability-zone-support", + "service": "Container Apps", "severity": "High", - "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ", - "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", - "waf": "Operations" + "text": "Leverage Availability Zones if regionally applicable", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", - "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", - "service": "SAP", + "checklist": "Container Apps Review", + "guid": "95bc80ec-6499-4d14-a7d2-7d296b1d8abc", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#set-up-zone-redundancy-in-your-container-apps-environment", + "service": "Container Apps", "severity": "High", - "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)", - "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "waf": "Operations" - }, - { - "checklist": "SAP Checklist", - "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", - "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", - "service": "SAP", - "severity": "Low", - "text": "The Quota API is a REST API that you can use to view and manage quotas for Azure services. Consider using it if necessary.", - "waf": "Operations" + "text": "Use more than one replica and enable Zone Redundancy.", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", - "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", - "service": "SAP", + "checklist": "Container Apps Review", + "guid": "ccaa4fc2-fdbc-4432-8bb7-f7e6469e4dc3", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", + "service": "Container Apps", "severity": "High", - "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.", - "waf": "Operations" + "text": "For cross-region DR, deploy container apps in multiple regions and follow active/active or active/passive application guidance.", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "e6e20617-3686-4af4-9791-f8935ada4332", - "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", - "service": "SAP", + "checklist": "Container Apps Review", + "guid": "2ffada86-c031-4933-bf7d-0c45bc4e5919", + "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", + "service": "Container Apps", "severity": "High", - "text": "Ensure required services and features are available within the chosen deployment regions eg. ANF , Zone etc.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", - "waf": "Operations" + "text": "Use Front Door or Traffic Manager to route traffic to the closest region", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", - "service": "SAP", + "checklist": "Azure Spring Apps Review", + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "service": "Spring Apps", "severity": "Medium", - "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", - "waf": "Operations" - }, - { - "checklist": "SAP Checklist", - "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", - "severity": "High", - "text": "Help protect your HANA database by using the Azure Backup service.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", + "text": "Azure Spring Apps permits two deployments for every app, only one of which receives production traffic. You can achieve zero downtime with blue green deployment strategies. Blue green deployment is only available in Standard and Enterprise tiers. You could automate deployment using CI/CD with ADO/GitHub actions", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", - "service": "SAP", + "checklist": "Azure Spring Apps Review", + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "service": "Spring Apps", "severity": "Medium", - "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.", + "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", - "severity": "High", - "text": "Ensure time-zone matches between the operating system and the SAP system.", - "waf": "Operations" - }, - { - "checklist": "SAP Checklist", - "guid": "c3c7abc0-716c-4486-893c-40e181d65539", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", - "service": "SAP", + "checklist": "Azure Spring Apps Review", + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "service": "Spring Apps", "severity": "Medium", - "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", "waf": "Reliability" }, - { - "checklist": "SAP Checklist", - "guid": "a491dfc4-9353-4213-9217-eef0949f9467", - "link": "https://azure.microsoft.com/pricing/offers/dev-test/", - "service": "SAP", - "severity": "Low", - "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.", - "waf": "Cost" + { + "checklist": "Azure Spring Apps Review", + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "service": "Spring Apps", + "severity": "Medium", + "text": "Use more than 1 app instance for your apps", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", - "link": "https://learn.microsoft.com/azure/lighthouse/overview", - "service": "SAP", + "checklist": "Azure Spring Apps Review", + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "service": "Spring Apps", "severity": "Medium", - "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.", - "waf": "Operations" + "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "4d116785-d2fa-456c-96ad-48408fe72734", - "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", - "service": "SAP", + "checklist": "Azure Spring Apps Review", + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "service": "Spring Apps", "severity": "Medium", - "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.", - "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", - "waf": "Operations" + "text": "Set up autoscaling in Spring Cloud Gateway", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", - "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", - "service": "SAP", + "checklist": "Azure Spring Apps Review", + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "service": "Spring Apps", "severity": "Low", - "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", - "waf": "Operations" + "text": "Enable autoscale for the apps with Standard consumption & dedicated plan.", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "14591147-5e39-4e53-89cc-cd979366bcda", - "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", - "service": "SAP", + "checklist": "Azure Spring Apps Review", + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "service": "Spring Apps", "severity": "Medium", - "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", - "waf": "Operations" + "text": "Use Enterprise plan for commercial support of spring boot for mission critical apps. With other tiers you get OSS support.", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", - "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", - "service": "SAP", + "checklist": "IoT Hub Review", + "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", + "service": "IoT", "severity": "High", - "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.", - "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", - "waf": "Operations" + "text": "Leverage Availability Zones if regionally applicable (this is automatically enabled)", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "SAP", + "checklist": "IoT Hub Review", + "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", "severity": "Medium", - "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Operations" + "text": "Be aware of Microsoft-initiated failovers. These are exercised by Microsoft in rare situations to fail over all the IoT hubs from an affected region to the corresponding geo-paired region.", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", - "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", - "service": "SAP", - "severity": "Medium", - "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", - "waf": "Operations" + "checklist": "IoT Hub Review", + "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", + "service": "IoT", + "severity": "High", + "text": "Consider a Cross-Region DR strategy for critical workloads", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "73686af4-6791-4f89-95ad-a43324e13811", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", - "service": "SAP", - "severity": "Medium", - "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.", - "waf": "Operations" + "checklist": "IoT Hub Review", + "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", + "severity": "High", + "text": "Learn how to trigger a manual failover.", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "616785d6-fa96-4c96-ad88-518f482734c8", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", + "checklist": "IoT Hub Review", + "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", + "service": "IoT", "severity": "High", - "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.", - "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "waf": "Performance" + "text": "Learn how to fail back after a failover.", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", - "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "1fc2fc14-eea6-4e69-b8d9-a3edc218e687", + "link": "https://polite-sea-0995b240f.2.azurestaticapps.net/technical-delivery-playbook/azure-services/analytics/purview/", + "service": "Purview", "severity": "Medium", - "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.", - "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", + "text": "Leverage FTA Resillency Handbook", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", - "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", - "service": "SAP", - "severity": "Medium", - "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.", - "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", - "waf": "Security" + "checklist": "Microsoft Purview Review Checklist", + "guid": "ab067acb-49e5-4b96-8332-4ecf8cc13318", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", + "severity": "High", + "text": "Plan for Data Center level outage", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", - "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "description": "1. Create the new account 2. Migrate configuration items 3. Run scans 4. Migrate custom typedefs and custom assets 5. Migrate relationships 6. Migrate glossary terms 7. Assign classifications to assets 8. Assign contacts to assets", + "guid": "da611702-69f4-4fb4-aa3d-3ef7f3176c4b", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", "severity": "Medium", - "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.", - "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", - "waf": "Operations" + "text": "Practice Failover for BCDR", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", - "service": "SAP", - "severity": "Low", - "text": "Use inter-VM latency monitoring for latency-sensitive applications.", - "waf": "Performance" + "checklist": "Microsoft Purview Review Checklist", + "guid": "97b15b8a-219a-44ab-bb57-879024d22678", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", + "severity": "High", + "text": "Plan a backup strategy and take regular backups", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", - "severity": "Medium", - "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "checklist": "Microsoft Purview Review Checklist", + "guid": "6d20b56c-56a9-4581-89bf-8d8e5c586b7d", + "link": "https://learn.microsoft.com/purview/manage-kafka-dotnet", + "service": "Purview", + "severity": "Low", + "text": "Use Microsoft Purview's Event Hubs to subscribe and create entities to another account", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "8cdc15ac-c075-4ee9-a130-a8889579e76b", + "link": "https://learn.microsoft.com/purview/deployment-best-practices", + "service": "Purview", "severity": "Medium", - "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.", - "waf": "Performance" + "text": "Follow Purview accounts architectures and deployment best practices", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "c027f893-f404-41a9-b33d-39d625a14964", - "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", - "service": "SAP", - "severity": "Low", - "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.", - "waf": "Performance" + "checklist": "Microsoft Purview Review Checklist", + "guid": "896e710a-7da7-4be9-a56d-14d3c49d997c", + "link": "https://learn.microsoft.com/purview/concept-best-practices-collections", + "service": "Purview", + "severity": "Medium", + "text": "Follow Collection Architectures and best practices", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "b3d1325a-a225-4c6f-9e06-85edddea8a4b", + "link": "https://learn.microsoft.com/purview/concept-best-practices-asset-lifecycle", + "service": "Purview", "severity": "Medium", - "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.", - "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", - "waf": "Performance" + "text": "Follow Assest lifecycle best practices", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "7cdeb3c6-1fc2-4fc1-9eea-6e69d8d9a3ed", + "link": "https://learn.microsoft.com/purview/concept-best-practices-automation", + "service": "Purview", "severity": "Medium", - "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.", - "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", - "waf": "Performance" + "text": "Follow automation best practices", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", - "severity": "High", - "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", - "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", - "waf": "Operations" + "checklist": "Microsoft Purview Review Checklist", + "guid": "c218e687-ab06-47ac-a49e-5b9603324ecf", + "link": "https://learn.microsoft.com/purview/disaster-recovery", + "service": "Purview", + "severity": "Medium", + "text": "Follow Backup and Migration Best practices", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "8cc13318-da61-4170-869f-4fb4aa3d3ef7", + "link": "https://learn.microsoft.com/purview/concept-best-practices-glossary", + "service": "Purview", "severity": "Medium", - "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", - "waf": "Security" + "text": "Follow Purview Glossary Best Practices", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", - "severity": "Medium", - "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", - "waf": "Operations" + "checklist": "Microsoft Purview Review Checklist", + "guid": "f3176c4b-97b1-45b8-a219-a4abeb578790", + "link": "https://learn.microsoft.com/purview/concept-workflow", + "service": "Purview", + "severity": "Low", + "text": "Leverage Workflows ", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "24d22678-6d20-4b56-a56a-958119bf8d8e", + "link": "https://learn.microsoft.com/purview/concept-best-practices-security", + "service": "Purview", "severity": "Medium", - "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", - "waf": "Operations" + "text": "Follow Purview Security Best Practices", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "a3592829-e6e2-4061-9368-6af46791f893", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "5c586b7d-8cdc-415a-ac07-5ee9b130a888", + "link": "https://learn.microsoft.com/purview/concept-best-practices-lineage-azure-data-factory", + "service": "Purview", "severity": "Medium", - "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions", - "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", + "text": "Follow Purview Data Lineage Best Practices", "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", - "service": "SAP", - "severity": "High", - "text": "It is not supported to deploy any NVA between SAP application and SAP Database server", - "training": "https://me.sap.com/notes/2731110", - "waf": "Performance" + "checklist": "Microsoft Purview Review Checklist", + "guid": "9579e76b-896e-4710-a7da-7be9956d14d3", + "link": "https://learn.microsoft.com/purview/concept-best-practices-scanning", + "service": "Purview", + "severity": "Medium", + "text": "Follow Best Practices for Scanning Registered Sources", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", - "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "c49d997c-b3d1-4325-aa22-5c6f4e0685ed", + "link": "https://learn.microsoft.com/purview/concept-best-practices-classification", + "service": "Purview", "severity": "Medium", - "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", - "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "waf": "Operations" + "text": "Follow Classification Best Practices in Governance Portal", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "ddea8a4b-7cde-4b3c-91fc-2fc14eea6e69", + "link": "https://learn.microsoft.com/purview/sensitivity-labels-frequently-asked-questions", + "service": "Purview", "severity": "Medium", - "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.", - "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", - "waf": "Operations" + "text": "Perform Sensitivity Labelling in the Purview Data Map", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", - "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", - "service": "SAP", - "severity": "Medium", - "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.", - "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", - "waf": "Operations" + "checklist": "Microsoft Purview Review Checklist", + "guid": "d8d9a3ed-c218-4e68-9ab0-67acb49e5b96", + "link": "https://learn.microsoft.com/purview/concept-data-share", + "service": "Purview", + "severity": "Low", + "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "82734c88-6ba2-4802-8459-11475e39e530", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", - "severity": "High", - "text": "Public IP assignment to VM running SAP Workload is not recommended.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", - "waf": "Security" + "checklist": "Microsoft Purview Review Checklist", + "guid": "03324ecf-8cc1-4331-ada6-1170269f4fb4", + "link": "https://learn.microsoft.com/purview/concept-insights", + "service": "Purview", + "severity": "Low", + "text": "Leverage Data Estate Insights", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", - "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", - "service": "SAP", - "severity": "High", - "text": "Consider reserving IP address on DR side when configuring ASR", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "Operations" + "checklist": "Microsoft Purview Review Checklist", + "guid": "aa3d3ef7-f317-46c4-a97b-15b8a219a4ab", + "link": "https://learn.microsoft.com/purview/catalog-adoption-insights", + "service": "Purview", + "severity": "Low", + "text": "Use Data stewardship and Catalog adoption", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", - "severity": "High", - "text": "Avoid using overlapping IP address ranges for production and DR sites.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", - "waf": "Operations" + "checklist": "Microsoft Purview Review Checklist", + "guid": "eb578790-24d2-4267-a6d2-0b56c56a9581", + "link": "https://learn.microsoft.com/purview/concept-insights", + "service": "Purview", + "severity": "Low", + "text": "Use Inventory and Ownership", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "6e154e3a-a359-4282-ae6e-206173686af4", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", - "service": "SAP", - "severity": "Medium", - "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.", - "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", - "waf": "Operations" + "checklist": "Microsoft Purview Review Checklist", + "guid": "19bf8d8e-5c58-46b7-b8cd-c15acc075ee9", + "link": "https://learn.microsoft.com/purview/glossary-insights", + "service": "Purview", + "severity": "Low", + "text": "Leverage Insights for Glossary, Classifications, Sensitivity Labels", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "b130a888-9579-4e76-a896-e710a7da7be9", + "link": "https://learn.microsoft.com/purview/compliance-manager", + "service": "Purview", "severity": "Medium", - "text": "Use Azure Firewall to govern Azure outbound traffic to the internet, non-HTTP/S inbound connections, and East/West traffic filtering (if the organization requires it)", - "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", - "waf": "Security" + "text": "Generate assessment scores", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", - "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", - "service": "SAP", + "checklist": "Microsoft Purview Review Checklist", + "guid": "956d14d3-c49d-4997-ab3d-1325aa225c6f", + "link": "https://learn.microsoft.com/purview/compliance-manager-scoring", + "service": "Purview", "severity": "Medium", - "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", - "waf": "Security" + "text": "Profiling- get summaries of data content", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", - "severity": "Medium", - "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", - "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", - "waf": "Security" + "checklist": "Microsoft Purview Review Checklist", + "guid": "4e0685ed-ddea-48a4-a7cd-eb3c61fc2fc1", + "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts", + "service": "Purview", + "severity": "Low", + "text": "Follow Microsoft Purview Data Owner access policies", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "SAP", - "severity": "Medium", - "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", - "waf": "Security" + "checklist": "Microsoft Purview Review Checklist", + "guid": "4eea6e69-d8d9-4a3e-bc21-8e687ab067ac", + "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy", + "service": "Purview", + "severity": "Low", + "text": "Follow Self-service access policies", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "5ada4332-4e13-4811-9231-81aa41742694", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", - "severity": "Medium", - "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", - "waf": "Security" + "checklist": "Microsoft Purview Review Checklist", + "guid": "b49e5b96-0332-44ec-b8cc-13318da61170", + "link": "https://learn.microsoft.com/purview/concept-policies-devops", + "service": "Purview", + "severity": "Low", + "text": "Follow DevOps policies", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "SAP", - "severity": "Medium", - "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", - "waf": "Performance" + "checklist": "Azure Container Registry Security Review", + "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.", + "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e", + "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention", + "service": "ACR", + "severity": "High", + "text": "Disable Azure Container Registry image export", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "SAP", - "severity": "Medium", - "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.", - "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", + "checklist": "Azure Container Registry Security Review", + "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry", + "guid": "d503547c-d447-4e82-9128-a7100f1cac6d", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy", + "service": "ACR", + "severity": "High", + "text": "Enable Azure Policies for Azure Container Registry", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.", + "guid": "d345293c-7639-4637-a551-c5c04e401955", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push", + "service": "ACR", "severity": "High", - "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", - "waf": "Performance" + "text": "Sign and Verify containers with notation (Notary v2)", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.", + "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49", + "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys", + "service": "ACR", "severity": "Medium", - "text": "Make sure that internal deployments for Azure Load Balancer are set up to use Direct Server Return (DSR). This setting (Enabling Floating IP) will reduce latency when internal load balancer configurations are used for high-availability configurations on the DBMS layer.", - "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "text": "Encrypt registry with a customer managed key", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "6791f893-5ada-4433-84e1-3811523181aa", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "SAP", - "severity": "Medium", - "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.", - "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", + "checklist": "Azure Container Registry Security Review", + "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications", + "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", + "service": "ACR", + "severity": "High", + "text": "Use Managed Identities to connect instead of Service Principals", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead", + "guid": "be0e38ce-e297-411b-b363-caaab79b198d", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", + "service": "ACR", "severity": "High", - "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Performance" + "text": "Disable local authentication for management plane access", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "fa96c96a-d885-418f-9827-34c886ba2802", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", - "severity": "Medium", - "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.", - "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", - "waf": "Performance" + "checklist": "Azure Container Registry Security Review", + "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations", + "guid": "387e5ced-126c-4d13-8af5-b20c6998a646", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli", + "service": "ACR", + "severity": "High", + "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", - "severity": "High", - "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Performance" + "checklist": "Azure Container Registry Security Review", + "description": "Disable anonymous pull/push access", + "guid": "e338997e-41c7-47d7-acf6-a62a1194956d", + "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access", + "service": "ACR", + "severity": "Medium", + "text": "Disable Anonymous pull access", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token", + "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli", + "service": "ACR", "severity": "High", - "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Cost" + "text": "Disable repository-scoped access tokens", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "402a9846-d515-4061-aff8-cd30088693fa", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network", + "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee", + "service": "ACR", "severity": "High", - "text": "If using Load Balancer with Linux guest operating systems, check that the Linux network parameter net.ipv4.tcp_timestamps is set to 0.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Performance" + "text": "Deploy images from a trusted environment", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "87585797-5551-4d53-bb7d-a94ee415734d", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR", + "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy", + "service": "ACR", "severity": "Medium", - "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering", + "text": "Disable Azure ARM audience tokens for authentication", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", - "severity": "High", - "text": "Review SAP HANA database backups for Azure VMs.", - "waf": "Cost" + "checklist": "Azure Container Registry Security Review", + "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.", + "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6", + "link": "https://learn.microsoft.com/azure/container-registry/monitor-service", + "service": "ACR", + "severity": "Medium", + "text": "Enable diagnostics logging", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch", + "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", + "service": "ACR", "severity": "Medium", - "text": "Review Site Recovery built-in monitoring, where used for SAP.", - "waf": "Cost" + "text": "Control inbound network access with Private Link", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", - "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", - "service": "SAP", - "severity": "High", - "text": "Review the Monitoring the SAP HANA System Landscape guidance.", - "waf": "Operations" + "checklist": "Azure Container Registry Security Review", + "description": "Disable public network access if inbound network access is secured using Private Link", + "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access", + "service": "ACR", + "severity": "Medium", + "text": "Disable Public Network access", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "Only the ACR Premium SKU supports Private Link access", + "guid": "fc833934-8b26-42d6-ac5f-512925498f6d", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus", + "service": "ACR", "severity": "Medium", - "text": "Review Oracle Database in Azure Linux VM backup strategies.", - "waf": "Operations" + "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", - "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", - "service": "SAP", - "severity": "Medium", - "text": "Review the use of Azure Blob Storage with SQL Server 2016.", - "waf": "Operations" + "checklist": "Azure Container Registry Security Review", + "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities", + "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", + "service": "ACR", + "severity": "Low", + "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.", + "guid": "4451e1a2-d345-4293-a763-9637a551c5c0", + "service": "ACR", "severity": "Medium", - "text": "Review the use of Automated Backup v2 for Azure VMs.", - "waf": "Operations" + "text": "Deploy validated container images", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", - "service": "SAP", + "checklist": "Azure Container Registry Security Review", + "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.", + "guid": "4e401955-387e-45ce-b126-cd132af5b20c", + "service": "ACR", "severity": "High", - "text": "Enabling Write accelerator for M series when using premium disks(V1)", - "waf": "Operations" + "text": "Use up-to-date platforms, languages, protocols and frameworks", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "service": "SAP", + "checklist": "PostgreSQL Review Checklist", + "guid": "65285269-441c-44bf-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview", + "service": "PostgreSQL", "severity": "Medium", - "text": "Test availability zone latency.", - "waf": "Performance" + "text": "Leverage Flexible Server", + "waf": "Reliability" + }, + { + "checklist": "PostgreSQL Review Checklist", + "guid": "016ccf31-ae5a-41eb-9888-9535e227896d", + "link": "https://learn.microsoft.com/azure/postgresql/flexible-server/overview#architecture-and-high-availability", + "service": "PostgreSQL", + "severity": "High", + "text": "Leverage Availability Zones where regionally applicable", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", - "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", - "service": "SAP", + "checklist": "PostgreSQL Review Checklist", + "guid": "31b67c67-be59-4519-8083-845d587cb391", + "link": "https://learn.microsoft.com/azure/postgresql/single-server/concepts-business-continuity#cross-region-read-replicas", + "service": "PostgreSQL", "severity": "Medium", - "text": "Activate SAP EarlyWatch Alert for all SAP components.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", - "waf": "Performance" + "text": "Leverage cross-region read replicas for BCDR", + "waf": "Reliability" }, { - "checklist": "SAP Checklist", - "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Apply guidance from the Microsoft cloud security benchmark related to Storage", + "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", + "service": "Azure Storage", "severity": "Medium", - "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.", - "training": "https://me.sap.com/notes/0002879613", - "waf": "Performance" + "text": "Consider the 'Azure security baseline for storage'", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", - "service": "SAP", - "severity": "Medium", - "text": "Review SQL Server performance monitoring using CCMS.", - "waf": "Performance" + "checklist": "Azure Storage Review Checklist", + "description": "Azure Storage by default has a public IP address and is Internet-reachable. Private endpoints allow to securely expose Azure Storage only to those Azure Compute resources that need access, thus eliminating exposure to the public Internet", + "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", + "service": "Azure Storage", + "severity": "High", + "text": "Consider using private endpoints for Azure Storage", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", - "link": "https://me.sap.com/notes/500235", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Newly created storage accounts are created using the ARM deployment model, so that RBAC, auditing etc. are all enabled. Ensure that there are no old storage accounts with classic deployment model in a subscription", + "guid": "30e37c3e-2971-41b2-963c-eee079b598de", + "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", + "service": "Azure Storage", "severity": "Medium", - "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).", - "training": "https://me.sap.com/notes/1100926/E", - "waf": "Performance" + "text": "Ensure older storage accounts are not using 'classic deployment model'", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", - "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", - "service": "SAP", - "severity": "Medium", - "text": "Review SAP HANA studio alerts.", - "waf": "Performance" + "checklist": "Azure Storage Review Checklist", + "description": "Leverage Microsoft Defender to learn about suspicious activity and misconfigurations.", + "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", + "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", + "service": "Azure Storage", + "severity": "High", + "text": "Enable Microsoft Defender for all of your storage accounts", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", - "link": "https://me.sap.com/notes/1969700", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "The soft-delete mechanism allows to recover accidentally deleted blobs.", + "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", + "service": "Azure Storage", "severity": "Medium", - "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.", - "waf": "Performance" + "text": "Enable 'soft delete' for blobs", + "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", + "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", "severity": "Medium", - "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.", - "training": "https://learn.microsoft.com/azure/automation/update-management/overview", + "text": "Disable 'soft delete' for blobs", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "08951710-79a2-492a-adbc-06d7a401545b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", - "severity": "Medium", - "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.", - "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", + "checklist": "Azure Storage Review Checklist", + "description": "Soft delete for containers enables you to recover a container after it has been deleted, for example recover from an accidental delete operation.", + "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", + "service": "Azure Storage", + "severity": "High", + "text": "Enable 'soft delete' for containers", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", - "severity": "Low", - "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.", + "checklist": "Azure Storage Review Checklist", + "description": "Consider selectively disabling 'soft delete' for certain blob containers, for example if the application must ensure that deleted information is immediately deleted, e.g. for confidentiality, privacy or compliance reasons. ", + "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", + "severity": "Medium", + "text": "Disable 'soft delete' for containers", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Prevents accidental deletion of a storage account, by forcing the user to first remove the deletion lock, prior to deletion", + "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", "severity": "High", - "text": "Disable xp_cmdshell. The SQL Server feature xp_cmdshell enables a SQL Server internal operating system command shell. It's a potential risk in security audits.", - "training": "https://me.sap.com/notes/3019299/E", + "text": "Enable resource locks on storage accounts", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Consider 'legal hold' or 'time-based retention' policies for blobs, so that is is impossible to delete the blob, the container, or the storage account. Please note that 'impossible' actually means 'impossible'; once a storage account contains an immutable blob, the only way to 'get rid' of that storage account is by cancelling the Azure subscription.", + "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", + "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", + "service": "Azure Storage", "severity": "High", - "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "text": "Consider immutable blobs", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "SAP", - "severity": "Medium", - "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.", - "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", + "checklist": "Azure Storage Review Checklist", + "description": "Consider disabling unprotected HTTP/80 access to the storage account, so that all data transfers are encrypted, integrity protected, and the server is authenticated. ", + "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Azure Storage", + "severity": "High", + "text": "Require HTTPS, i.e. disable port 80 on the storage account", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "When configuring a custom domain (hostname) on a storage account, check whether you need TLS/HTTPS; if so, you might have to put Azure CDN in front of your storage account.", + "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", + "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", + "service": "Azure Storage", "severity": "High", - "text": "Use Azure Key Vault to store your secrets and credentials", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "829e2edb-2173-4676-aff6-691b4935ada4", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Requiring HTTPS when a client uses a SAS token to access blob data helps to minimize the risk of credential loss.", + "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", + "service": "Azure Storage", "severity": "Medium", - "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).", - "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", + "text": "Limit shared access signature (SAS) tokens to HTTPS connections only", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "AAD tokens should be favored over shared access signatures, wherever possible", + "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", + "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", + "service": "Azure Storage", + "severity": "High", + "text": "Use Azure Active Directory (Azure AD) tokens for blob access", + "waf": "Security" + }, + { + "checklist": "Azure Storage Review Checklist", + "description": "When assigning a role to a user, group, or application, grant that security principal only those permissions that are necessary for them to perform their tasks. Limiting access to resources helps prevent both unintentional and malicious misuse of your data.", + "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", + "service": "Azure Storage", "severity": "Medium", - "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "text": "Least privilege in IaM permissions", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", - "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS is analogous to a service SAS in terms of its scope and function, but offers security benefits over the service SAS. ", + "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", + "service": "Azure Storage", "severity": "High", - "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed", - "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", + "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Storage account keys ('shared keys') have very little audit capabilities. While it can be monitored on who/when fetched a copy of the keys, once the keys are in the hands of multiple people, it is impossible to attribute usage to a specific user. Solely relying on AAD authentication makes it easier to tie storage access to a user. ", + "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", + "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", + "service": "Azure Storage", "severity": "High", - "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", + "text": "Consider disabling storage account keys, so that only AAD access (and user delegation SAS) is supported.", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Use Activity Log data to identify 'when', 'who', 'what' and 'how' the security of your storage account is being viewed or changed (i.e. storage account keys, access policies, etc.).", + "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", + "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", + "service": "Azure Storage", "severity": "High", - "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.", - "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "text": "Consider using Azure Monitor to audit control plane operations on the storage account", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", - "severity": "Low", - "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS", - "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", + "checklist": "Azure Storage Review Checklist", + "description": "A key expiration policy enables you to set a reminder for the rotation of the account access keys. The reminder is displayed if the specified interval has elapsed and the keys have not yet been rotated.", + "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", + "service": "Azure Storage", + "severity": "Medium", + "text": "When using storage account keys, consider enabling a 'key expiration policy'", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "A SAS expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning.", + "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", + "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", + "service": "Azure Storage", "severity": "Medium", - "text": "Default to Microsoft-managed keys for principal encryption functionality and use customer-managed keys when required.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "text": "Consider configuring an SAS expiration policy", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "4935ada4-2223-4ece-a1b1-23181a541741", - "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", - "service": "SAP", - "severity": "High", - "text": "Use an Azure Key Vault per application per environment per region.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "checklist": "Azure Storage Review Checklist", + "description": "Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. ", + "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", + "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", + "service": "Azure Storage", + "severity": "Medium", + "text": "Consider linking SAS to a stored access policy", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", - "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", - "service": "SAP", - "severity": "High", - "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.", - "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", + "checklist": "Azure Storage Review Checklist", + "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", + "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", + "service": "Azure Storage", + "severity": "Medium", + "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "209d490d-a477-4784-84d1-16785d2fa56c", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Ideally, your application should be using a managed identity to authenticate to Azure Storage. If that is not possible, consider having the storage credential (connection string, storage account key, SAS, service principal credential) in Azure KeyVault or an equivalent service.", + "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", + "service": "Azure Storage", "severity": "High", - "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes", - "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", + "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", - "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "description": "Use near-term expiration times on an ad hoc SAS service SAS or account SAS. In this way, even if a SAS is compromised, it's valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.", + "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", "severity": "High", - "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources", - "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", + "text": "Strive for short validity periods for ad-hoc SAS", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", - "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", - "service": "SAP", - "severity": "Low", - "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.", - "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", + "checklist": "Azure Storage Review Checklist", + "description": "When creating a SAS, be as specific and restrictive as possible. Prefer a SAS for a single resource and operation over a SAS which gives much broader access.", + "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", + "severity": "Medium", + "text": "Apply a narrow scope to a SAS", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", - "service": "SAP", - "severity": "Low", - "text": "For even more powerful protection, consider using Microsoft Defender for Endpoint.", - "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", + "checklist": "Azure Storage Review Checklist", + "description": "A SAS can include parameters on which client IP addresses or address ranges are authorized to request a resource using the SAS. ", + "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", + "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", + "service": "Azure Storage", + "severity": "Medium", + "text": "Consider scoping SAS to a specific client IP address, wherever possible", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", - "severity": "High", - "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", + "checklist": "Azure Storage Review Checklist", + "description": "A SAS cannot constrain how much data a client uploads; given the pricing model of amount of storage over time, it might make sense to validate whether clients uploaded maliciously large contents.", + "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", + "service": "Azure Storage", + "severity": "Low", + "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", - "severity": "Low", - "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.", - "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", + "checklist": "Azure Storage Review Checklist", + "description": "When accessing blob storage via SFTP using a 'local user account', the 'usual' RBAC controls do not apply. Blob access via NFS or REST might be more restrictive than SFTP access. Unfortunately, as of early 2023, local users are the only form of identity management that is currently supported for the SFTP endpoint", + "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", + "service": "Azure Storage", + "severity": "High", + "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.", "waf": "Security" }, { - "checklist": "SAP Checklist", - "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", - "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", - "service": "SAP", + "checklist": "Azure Storage Review Checklist", + "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", + "service": "Azure Storage", "severity": "Medium", - "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "text": "SFTP: The SFTP endpoint does not support POSIX-like ACLs.", "waf": "Security" }, { - "checklist": "Service Bus Review Checklist", - "description": "Azure Service Bus Premium provides encryption of data at rest. If you use your own key, the data is still encrypted using the Microsoft-managed key, but in addition the Microsoft-managed key will be encrypted using the customer-managed key. ", - "guid": "87af4a79-1f89-439b-ba47-768e14c11567", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key", - "service": "Service Bus", - "severity": "Low", - "text": "Use customer-managed key option in data at rest encryption when required", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "checklist": "Azure Storage Review Checklist", + "description": "Storage supports CORS (Cross-Origin Resource Sharing), i.e. an HTTP feature that enables web apps from a different domain to loosen the same-origin policy. When enabling CORS, keep the CorsRules to the least privilege.", + "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", + "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", + "service": "Azure Storage", + "severity": "High", + "text": "Avoid overly broad CORS policies", "waf": "Security" }, { - "checklist": "Service Bus Review Checklist", - "description": "Communication between a client application and an Azure Service Bus namespace is encrypted using Transport Layer Security (TLS). Azure Service Bus namespaces permit clients to send and receive data with TLS 1.0 and above. To enforce stricter security measures, you can configure your Service Bus namespace to require that clients send and receive data with a newer version of TLS.", - "guid": "5c1ea55b-46a9-448f-b8ae-7d7e4b475b6c", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version", - "service": "Service Bus", - "severity": "Medium", - "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "checklist": "Azure Storage Review Checklist", + "description": "Data at rest is always encrypted server-side, and in addition might be encrypted client-side as well. Server-side encryption might happen using a platform-managed key (default) or customer-managed key. Client-side encryption might happen by either having the client supply an encryption/decryption key on a per-blob basis to Azure storage, or by completely handling encryption on the client-side. thus not relying on Azure Storage at all for confidentiality guarantees.", + "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "Azure Storage", + "severity": "High", + "text": "Determine how data at rest should be encrypted. Understand the thread model for data.", "waf": "Security" }, { - "checklist": "Service Bus Review Checklist", - "description": "When you create a Service Bus namespace, a SAS rule named RootManageSharedAccessKey is automatically created for the namespace. This policy has Manage permissions for the entire namespace. It's recommended that you treat this rule like an administrative root account and don't use it in your application. Using AAD as an authentication provider with RBAC is recommended. ", - "guid": "8bcbf59b-ce65-4de8-a03f-97879468d66a", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies", - "service": "Service Bus", + "checklist": "Azure Storage Review Checklist", + "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", + "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", + "service": "Azure Storage", "severity": "Medium", - "text": "Avoid using root account when it is not necessary", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", + "text": "Determine which/if platform encryption should be used.", "waf": "Security" }, { - "checklist": "Service Bus Review Checklist", - "description": "A Service Bus client app running inside an Azure App Service application or in a virtual machine with enabled managed entities for Azure resources support does not need to handle SAS rules and keys, or any other access tokens. The client app only needs the endpoint address of the Service Bus Messaging namespace. ", - "guid": "786d60f9-6c96-4ad8-a55d-04c2b39c986b", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity", - "service": "Service Bus", + "checklist": "Azure Storage Review Checklist", + "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", + "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", + "service": "Azure Storage", "severity": "Medium", - "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "text": "Determine which/if client-side encryption should be used.", "waf": "Security" }, { - "checklist": "Service Bus Review Checklist", - "description": "When creating permissions, provide fine-grained control over a client's access to Azure Service Bus. Permissions in Azure Service Bus can and should be scoped to the individual resource level e.g. queue, topic or subscription. ", - "guid": "f615658d-e558-4f93-9249-b831112dbd7e", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus", - "service": "Service Bus", + "checklist": "Azure Storage Review Checklist", + "description": "Leverage Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) to find storage accounts which allow anonymous blob access.", + "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", + "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", + "service": "Azure Storage", "severity": "High", - "text": "Use least privilege data plane RBAC", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "text": "Consider whether public blob access is needed, or whether it can be disabled for certain storage accounts. ", "waf": "Security" }, { - "checklist": "Service Bus Review Checklist", - "description": "Azure Service Bus resource logs include operational logs, virtual network and IP filtering logs. Runtime audit logs capture aggregated diagnostic information for various data plane access operations (such as send or receive messages) in Service Bus.", - "guid": "af12e7f9-43f6-4304-922d-929c2b1cd622", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference", - "service": "Service Bus", + "checklist": "Azure Storage Review Checklist", + "guid": "cb8eb8c0-aa62-4a25-a495-6eaa8dc4a243", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal", + "service": "Azure Storage", + "severity": "High", + "text": "Leverage a storagev2 account type for better performance and reliability", + "waf": "Reliability" + }, + { + "checklist": "Azure Storage Review Checklist", + "guid": "e05bbe20-9d49-4fda-9777-8424d116785c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Azure Storage", + "severity": "High", + "text": "Leverage GRS, ZRS or GZRS storage for the highest availability", + "waf": "Reliability" + }, + { + "checklist": "Azure Storage Review Checklist", + "guid": "2fa56c56-ad48-4408-be72-734c486ba280", + "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance", + "service": "Azure Storage", "severity": "Medium", - "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Security" + "text": "For write operation after failover, use customer-Managed Failover ", + "waf": "Reliability" }, { - "checklist": "Service Bus Review Checklist", - "description": "Azure Service Bus by default has a public IP address and is Internet-reachable. Private endpoints allow traffic between your virtual network and Azure Service Bus traverses over the Microsoft backbone network. In addition to that, you should disable public endpoints if those are not used. ", - "guid": "9ae669ca-48e4-4a85-b222-3ece8bb12307", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service", - "service": "Service Bus", + "checklist": "Azure Storage Review Checklist", + "guid": "dc0590cf-65de-48e1-909c-cbd579266bcc", + "link": "https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance#microsoft-managed-failover", + "service": "Azure Storage", "severity": "Medium", - "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Security" + "text": "Understand Microsoft-Managed Failover details", + "waf": "Reliability" }, { - "checklist": "Service Bus Review Checklist", - "description": "With IP firewall, you can restrict the public endpoint further to only a set of IPv4 addresses or IPv4 address ranges in CIDR (Classless Inter-Domain Routing) notation. ", - "guid": "ca5f06f1-58e3-4ea3-a92c-2de7e2165c3a", - "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering", - "service": "Service Bus", + "checklist": "Azure Storage Review Checklist", + "guid": "a274faa1-abfe-49d5-9d04-c3c4919cb1b3", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal", + "service": "Azure Storage", "severity": "Medium", - "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Security" + "text": "Enable Soft Delete", + "waf": "Reliability" } ], "metadata": { diff --git a/checklists/waf_checklist.es.json b/checklists/waf_checklist.es.json index afaf229fe..748db30cd 100644 --- a/checklists/waf_checklist.es.json +++ b/checklists/waf_checklist.es.json @@ -64,482 +64,697 @@ "waf": "Fiabilidad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", - "service": "Azure Monitor", - "text": "Reglas de recopilación de datos en Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Front Door", + "severity": "Medio", + "text": "Si usa certificados TLS administrados por el cliente con Azure Front Door, use la versión de certificado \"más reciente\". Reduzca el riesgo de interrupciones causadas por la renovación manual de certificados", + "waf": "Operaciones" }, { - "checklist": "Cost Optimization Checklist", - "guid": "45901365-d38e-443f-abcb-d868266abca2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Azure Backup", - "text": "Comprobar las instancias de copia de seguridad con la fuente de datos subyacente no encontrada", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", + "guid": "553585a6-abe0-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "App Gateway", + "severity": "Medio", + "text": "Asegúrese de que usa la SKU de Application Gateway v2", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "VM", - "text": "Eliminar o archivar servicios no asociados (discos, NIC, direcciones IP, etc.)", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", + "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Load Balancer", + "severity": "Medio", + "text": "Asegúrese de que usa la SKU estándar para Azure Load Balancers", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Azure Backup", - "text": "Considere un buen equilibrio entre el almacenamiento de recuperación del sitio y la copia de seguridad para aplicaciones que no son críticas", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "9432621a-8397-4654-a882-5bc856b7ef83", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", + "service": "Load Balancer", + "severity": "Medio", + "text": "Asegúrese de que las direcciones IP de front-end de Load Balancers tengan redundancia de zona (a menos que necesite front-end zonal).", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", - "service": "Azure Monitor", - "text": "Compruebe las oportunidades de gasto y ahorro entre las 40 áreas de trabajo de Log Analytics diferentes: use diferentes retenciones y recopilación de datos para áreas de trabajo que no sean de producción: cree un límite diario para el reconocimiento y el tamaño de los niveles: si establece un límite diario, además de crear una alerta cuando se alcance el límite, asegúrese de crear también una regla de alerta para que se le notifique cuando se alcance algún porcentaje (90 %, por ejemplo). - Considere la posibilidad de transformar el espacio de trabajo si es posible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", + "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "App Gateway", + "severity": "Medio", + "text": "Application Gateways v2 debe implementarse en subredes con prefijos IP iguales o mayores que /24", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Azure Monitor", - "text": "Aplique una política de purga de registros y automatización (si es necesario, los registros se pueden mover al almacenamiento en frío)", - "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "description": "La administración de proxies inversos en general y de WAF en particular está más cerca de la aplicación que de la red, por lo que pertenecen a la misma suscripción que la aplicación. La centralización de Application Gateway y WAF en la suscripción de conectividad puede ser correcta si la administra un solo equipo.", + "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", + "severity": "Medio", + "text": "Implemente Azure Application Gateway v2 o aplicaciones virtuales de red de asociados que se usan para proxy de conexiones HTTP(S) entrantes dentro de la red virtual de la zona de aterrizaje y con las aplicaciones que están protegiendo.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "VM", - "text": "Compruebe que los discos son realmente necesarios, si no: eliminar. Si son necesarios, busque niveles de almacenamiento más bajos o use una copia de seguridad:", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", + "severity": "Medio", + "text": "Use una red DDoS o planes de protección IP para todas las direcciones IP públicas en las zonas de aterrizaje de la aplicación.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d1e44a19-659d-4395-afd7-7289b835556d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Storage", - "text": "Considere la posibilidad de mover el almacenamiento no utilizado al nivel inferior, con reglas personalizadas: https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", + "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", + "service": "App Gateway", + "severity": "Medio", + "text": "Configure el escalado automático con una cantidad mínima de instancias de dos.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Fiabilidad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "VM", - "text": "Asegúrese de que el asesor está configurado para el tamaño correcto de la máquina virtual ", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", + "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", + "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", + "service": "App Gateway", + "severity": "Medio", + "text": "Implementación de Application Gateway en zonas de disponibilidad", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Fiabilidad" }, { - "checklist": "Cost Optimization Checklist", - "description": "comprobando la búsqueda de las licencias de categoría de contador en el análisis de costes", - "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", - "service": "VM", - "text": "ejecutar el script en todas las máquinas virtuales de Windows https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server: considere la posibilidad de implementar una directiva si las máquinas virtuales de Windows se crean con frecuencia", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Front Door", + "severity": "Medio", + "text": "Use Azure Front Door con directivas de WAF para entregar y ayudar a proteger aplicaciones HTTP/S globales que abarcan varias regiones de Azure.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "VM", - "text": " esto también se puede poner bajo AHUB si ya tiene licencias https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "3f29812b-2363-4cef-b179-b599de0d5973", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "Front Door", + "severity": "Medio", + "text": "Al usar Front Door y Application Gateway para ayudar a proteger las aplicaciones HTTP/S, use directivas de WAF en Front Door. Bloquee Application Gateway para recibir tráfico solo de Front Door.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "VM", - "text": "Consolide familias de máquinas virtuales reservadas con la opción de flexibilidad (no más de 4-5 familias)", - "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", - "waf": "Costar" + "ammp": true, + "arm-service": "microsoft.network/trafficManagerProfiles", + "checklist": "Azure Application Delivery Networking", + "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Traffic Manager", + "severity": "Alto", + "text": "Use el Administrador de tráfico para entregar aplicaciones globales que abarquen protocolos distintos de HTTP/S.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Fiabilidad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", - "service": "VM", - "text": "Uso de Azure Reserved Instances: esta característica le permite reservar máquinas virtuales durante un período de 1 o 3 años, lo que proporciona un importante ahorro de costos en comparación con los precios de pago por uso.", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", + "severity": "Bajo", + "text": "Si los usuarios solo necesitan acceso a aplicaciones internas, ¿se ha considerado Microsoft Entra ID Application Proxy como una alternativa a Azure Virtual Desktop (AVD)?", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "VM", - "text": "Solo se pueden reservar discos más grandes => 1 TiB -", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", + "severity": "Medio", + "text": "Para reducir el número de puertos de firewall abiertos para las conexiones entrantes en la red, considere la posibilidad de usar Microsoft Entra ID Application Proxy para proporcionar a los usuarios remotos acceso seguro y autenticado a las aplicaciones internas.", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", - "service": "VM", - "text": "Después de la optimización del tamaño correcto", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "ae248989-b306-4591-9186-de482e3f0f0e", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "Front Door", + "severity": "Alto", + "text": "Implemente la directiva de WAF para Front Door en modo de \"prevención\".", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Azure SQL", - "text": "Compruebe si corresponde y aplique la política/cambio https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "Front Door", + "severity": "Alto", + "text": "Evite combinar Azure Traffic Manager y Azure Front Door.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "VM", - "text": "El descuento de la parte de la licencia VM + (ahub + 3YRI) es de alrededor del 70% de descuento", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "Front Door", + "severity": "Alto", + "text": "Use el mismo nombre de dominio en Azure Front Door y su origen. Los nombres de host no coincidentes pueden causar errores sutiles.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "VM", - "text": "Considere la posibilidad de utilizar un VMSS para satisfacer la demanda en lugar de un tamaño fijo", - "waf": "Costar" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Cost Optimization Checklist", - "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "AKS", - "text": "Use el escalador automático de AKS para que coincida con el uso de los clústeres (asegúrese de que los requisitos de los pods coincidan con el escalador)", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", + "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "Front Door", + "severity": "Bajo", + "text": "Deshabilite los sondeos de estado cuando solo haya un origen en un grupo de orígenes de Azure Front Door.", + "waf": "Rendimiento" }, { - "checklist": "Cost Optimization Checklist", - "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Azure Backup", - "text": "Mover los puntos de recuperación al archivo de almacén cuando corresponda (Validar)", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "Front Door", + "severity": "Medio", + "text": "Seleccione puntos de conexión de sondeo de estado correctos para Azure Front Door. Considere la posibilidad de crear puntos de conexión de estado que comprueben todas las dependencias de la aplicación.", + "waf": "Fiabilidad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", - "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", - "service": "Databricks", - "text": "Considere la posibilidad de usar máquinas virtuales de acceso puntual con reserva siempre que sea posible. Considere la posibilidad de la terminación automática de clústeres.", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", + "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "Front Door", + "severity": "Bajo", + "text": "Use sondeos de estado de HEAD con Azure Front Door para reducir el tráfico que Front Door envía a la aplicación.", + "waf": "Rendimiento" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", - "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", - "service": "Azure Functions", - "text": "Funciones - Reutilizar conexiones", - "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", + "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "Load Balancer", + "severity": "Alto", + "text": "Use Azure NAT Gateway en lugar de reglas de salida de Load Balancer para mejorar la escalabilidad de SNAT", + "waf": "Fiabilidad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview", - "service": "Azure Functions", - "text": "Funciones: almacenar datos en caché localmente", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", + "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "Front Door", + "severity": "Alto", + "text": "Use certificados TLS administrados con Azure Front Door. Reduzca los costos operativos y el riesgo de interrupciones debido a las renovaciones de certificados.", + "waf": "Operaciones" }, { - "checklist": "Cost Optimization Checklist", - "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Azure Functions", - "text": "Funciones - Arranques en frío: utilice la funcionalidad 'Ejecutar desde el paquete'. De esta manera, el código se descarga como un único archivo zip. Esto puede, por ejemplo, resultar en mejoras significativas con las funciones de Javascript, que tienen muchos módulos de nodos. Utilice herramientas específicas del lenguaje para reducir el tamaño del paquete, por ejemplo, aplicaciones Javascript que sacuden el árbol.", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", + "service": "Front Door", + "severity": "Medio", + "text": "Defina la configuración de WAF de Azure Front Door como código. Mediante el uso de código, puede adoptar más fácilmente una nueva versión del conjunto de reglas y obtener protección adicional.", + "waf": "Operaciones" }, { - "checklist": "Cost Optimization Checklist", - "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "Azure Functions", - "text": "Funciones - Mantén tus funciones calientes", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", + "service": "Front Door", + "severity": "Alto", + "text": "Use TLS de un extremo a otro con Azure Front Door. Use TLS para las conexiones de los clientes a Front Door y de Front Door al origen.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Azure Functions", - "text": "Al usar el escalado automático con diferentes funciones, es posible que haya uno que controle todo el escalado automático para todos los recursos: considere la posibilidad de moverlo a un plan de consumo independiente (y considere un plan superior para la CPU)", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", + "service": "Front Door", + "severity": "Medio", + "text": "Use el redireccionamiento de HTTP a HTTPS con Azure Front Door. Apoye a los clientes más antiguos redirigiéndolos automáticamente a una solicitud HTTPS.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", - "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", - "service": "Azure Functions", - "text": "Las aplicaciones de funciones de un plan determinado se escalan juntas, por lo que cualquier problema con el escalado puede afectar a todas las aplicaciones del plan.", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", + "service": "Front Door", + "severity": "Alto", + "text": "Habilite el WAF de Azure Front Door. Proteja su aplicación de una variedad de ataques.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", - "service": "Azure Functions", - "text": "¿Se me factura por el \"tiempo de espera\"? Esta pregunta se suele formular en el contexto de una función de C# que realiza una operación asincrónica y espera el resultado, por ejemplo, await Task.Delay(1000) o await client. GetAsync('http://google.com'). La respuesta es sí: el segundo cálculo de GB se basa en la hora de inicio y finalización de la función y el uso de memoria durante ese período. Lo que realmente sucede durante ese tiempo en términos de actividad de la CPU no se tiene en cuenta en el cálculo. Una excepción a esta regla es si está utilizando funciones duraderas. No se le facturará por el tiempo empleado en las esperas en las funciones de orquestador.aplique técnicas de modelado de la demanda siempre que sea posible (¿entornos de desarrollo?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", + "service": "Front Door", + "severity": "Alto", + "text": "Ajuste el WAF de Azure Front Door para su carga de trabajo. Reduzca las detecciones de falsos positivos.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", "service": "Front Door", - "text": "Frontdoor: desactivar la página principal predeterminadaEn la configuración de la aplicación de la aplicación, establezca AzureWebJobsDisableHomepage en true. Esto devolverá un 204 (sin contenido) al PoP para que solo se devuelvan los datos del encabezado.", - "waf": "Costar" + "severity": "Alto", + "text": "Habilite la característica de inspección del cuerpo de la solicitud habilitada en la directiva WAF de Azure Front Door.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", "service": "Front Door", - "text": "Frontdoor: ruta a algo que no devuelve nada. Configure una función, un proxy de función o agregue una ruta en la aplicación web que devuelva 200 (correctamente) y envíe contenido mínimo o nulo. La ventaja de esto es que podrá cerrar la sesión cuando se llame.", - "waf": "Costar" + "severity": "Alto", + "text": "Habilite los conjuntos de reglas predeterminados de WAF de Azure Front Door. Los conjuntos de reglas predeterminados detectan y bloquean los ataques comunes.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", - "service": "Storage", - "text": "Considere la posibilidad de archivar niveles para los datos menos utilizados", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", + "service": "Front Door", + "severity": "Alto", + "text": "Habilite el conjunto de reglas de protección contra bots de Azure Front Door WAF. Las reglas de bots detectan bots buenos y malos.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "VM", - "text": "Compruebe los tamaños de disco en los que el tamaño no coincida con el nivel (es decir, un disco de 513 GiB pagará un P30 (1 TiB) y considere la posibilidad de cambiar el tamaño", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", + "service": "Front Door", + "severity": "Medio", + "text": "Use la versión más reciente del conjunto de reglas de WAF de Azure Front Door. Las actualizaciones del conjunto de reglas se actualizan periódicamente para tener en cuenta el panorama actual de amenazas.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "Storage", - "text": "Considere la posibilidad de utilizar un SSD estándar en lugar de Premium o Ultra siempre que sea posible", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "b9620385-1cde-418f-914b-a84a06982ffc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", + "service": "Front Door", + "severity": "Medio", + "text": "Agregue limitación de velocidad al WAF de Azure Front Door. La limitación de velocidad bloquea a los clientes que envían accidental o intencionadamente grandes cantidades de tráfico en un corto período de tiempo.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "Storage", - "text": "En el caso de las cuentas de almacenamiento, asegúrese de que el nivel elegido no suma cargos por transacción (puede ser más barato pasar al siguiente nivel)", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", + "service": "Front Door", + "severity": "Medio", + "text": "Use un umbral alto para los límites de frecuencia de WAF de Azure Front Door. Los umbrales de límite de velocidad altos evitan el bloqueo del tráfico legítimo, a la vez que proporcionan protección contra un número extremadamente alto de solicitudes que podrían sobrecargar su infraestructura. ", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "Site Recovery", - "text": "Para ASR, considere la posibilidad de usar discos SSD estándar si el RPO/RTO y el rendimiento de replicación lo permiten", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", + "service": "Front Door", + "severity": "Bajo", + "text": "Si no espera tráfico de todas las regiones geográficas, utilice filtros geográficos para bloquear el tráfico de países no esperados.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", - "service": "Storage", - "text": "Cuentas de almacenamiento: compruebe el nivel de acceso frecuente o GRS necesario", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "00acd8a9-6975-414f-8491-2be6309893b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", + "service": "Front Door", + "severity": "Medio", + "text": "Especifique la ubicación desconocida (ZZ) al filtrar geográficamente el tráfico con el WAF de Azure Front Door. Evite bloquear accidentalmente solicitudes legítimas cuando las direcciones IP no puedan coincidir geográficamente.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "VM", - "text": "Discos: valide el uso de discos SSD Premium en todas partes: por ejemplo, los que no son de producción podrían cambiar a SSD estándar o SSD Premium bajo demanda ", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", + "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", + "service": "App Gateway", + "severity": "Alto", + "text": "Habilitación del conjunto de reglas de protección contra bots de WAF de Azure Application Gateway Las reglas de bots detectan bots buenos y malos.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "Synapse", - "text": "Cree presupuestos para administrar los costos y cree alertas que notifiquen automáticamente a las partes interesadas sobre anomalías en el gasto y riesgos de gasto excesivo.", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "App Gateway", + "severity": "Alto", + "text": "Habilite la característica de inspección del cuerpo de la solicitud habilitada en la directiva WAF de Azure Application Gateway.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "Synapse", - "text": "Exporte los datos de costos a una cuenta de almacenamiento para realizar análisis de datos adicionales.", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", + "service": "App Gateway", + "severity": "Alto", + "text": "Ajuste el WAF de Azure Application Gateway para la carga de trabajo. Reduzca las detecciones de falsos positivos.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Synapse", - "text": "Controle los costos de un grupo de SQL dedicado pausando el recurso cuando no esté en uso.", - "waf": "Costar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "App Gateway", + "severity": "Alto", + "text": "Implemente la directiva de WAF para Application Gateway en modo de \"prevención\".", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", - "service": "Synapse", - "text": "Habilite la función de pausa automática de Apache Spark sin servidor y establezca el valor de tiempo de espera en consecuencia.", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", + "service": "App Gateway", + "severity": "Medio", + "text": "Agregue limitación de velocidad al WAF de Azure Application Gateway. La limitación de velocidad bloquea a los clientes que envían accidental o intencionadamente grandes cantidades de tráfico en un corto período de tiempo.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Synapse", - "text": "Cree varias definiciones de grupo de Apache Spark de varios tamaños.", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", + "service": "App Gateway", + "severity": "Medio", + "text": "Use un umbral alto para los límites de frecuencia de WAF de Azure Application Gateway. Los umbrales de límite de velocidad altos evitan el bloqueo del tráfico legítimo, a la vez que proporcionan protección contra un número extremadamente alto de solicitudes que podrían sobrecargar su infraestructura. ", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "service": "Synapse", - "text": "Compre unidades de confirmación (SCU) de Azure Synapse durante un año con un plan de compra anticipada para ahorrar en los costos de Azure Synapse Analytics.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "99937189-ff78-492a-b9ca-18d828d82b37", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", + "service": "App Gateway", + "severity": "Bajo", + "text": "Si no espera tráfico de todas las regiones geográficas, utilice filtros geográficos para bloquear el tráfico de países no esperados.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "VM", - "text": "Uso de máquinas virtuales de acceso puntual para trabajos interrumpibles: se trata de máquinas virtuales por las que se puede pujar y comprar a un precio reducido, lo que proporciona una solución rentable para cargas de trabajo no críticas.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", + "service": "App Gateway", + "severity": "Medio", + "text": "Especifique la ubicación desconocida (ZZ) al filtrar geográficamente el tráfico con el WAF de Azure Application Gateway. Evite bloquear accidentalmente solicitudes legítimas cuando las direcciones IP no puedan coincidir geográficamente.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "544451e1-92d3-4442-a3c7-628637a551c5", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", - "text": "Ajustar el tamaño de todas las máquinas virtuales", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", + "service": "App Gateway", + "severity": "Medio", + "text": "Use la versión más reciente del conjunto de reglas de WAF de Azure Application Gateway. Las actualizaciones del conjunto de reglas se actualizan periódicamente para tener en cuenta el panorama actual de amenazas.", + "waf": "Seguridad" }, { - "checklist": "Cost Optimization Checklist", - "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "VM", - "text": "Intercambiar el tamaño de la máquina virtual con los tamaños normalizados y más recientes", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "App Gateway", + "severity": "Medio", + "text": "Agregue la configuración de diagnóstico para guardar los registros de WAF de Azure Application Gateway.", + "waf": "Operaciones" }, { - "checklist": "Cost Optimization Checklist", - "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "Ajustar el tamaño de las máquinas virtuales: comience con la supervisión del uso por debajo del 5 % y, a continuación, trabaje hasta el 40 %", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "Front Door", + "severity": "Medio", + "text": "Agregue la configuración de diagnóstico para guardar los registros de WAF de Azure Front Door.", + "waf": "Operaciones" }, { - "checklist": "Cost Optimization Checklist", - "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "La inclusión de una aplicación en contenedores puede mejorar la densidad de la máquina virtual y ahorrar dinero en su escalado", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Costar" + "checklist": "Azure Application Delivery Networking", + "guid": "92664c60-47e3-4591-8b1b-8d557656e686", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", + "service": "App Gateway", + "severity": "Medio", + "text": "Envíe registros de WAF de Azure Application Gateway a Microsoft Sentinel.", + "waf": "Operaciones" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", - "service": "AVS", - "severity": "Alto", - "text": "Asegúrese de que los controladores de dominio ADDS se implementan en la suscripción de identidad en Azure nativo", - "waf": "Seguridad" + "checklist": "Azure Application Delivery Networking", + "guid": "845f5f91-9c21-4674-a725-5ce890850e20", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "Front Door", + "severity": "Medio", + "text": "Envíe registros de WAF de Azure Front Door a Microsoft Sentinel.", + "waf": "Operaciones" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "75089c20-990d-4927-b105-885576f76fc2", - "service": "AVS", + "checklist": "Azure Application Delivery Networking", + "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", + "service": "App Gateway", "severity": "Medio", - "text": "Asegúrese de que los sitios y servicios de ADDS están configurados para mantener las solicitudes de autenticación de los recursos basados en Azure (incluida Azure VMware Solution) locales en Azure", - "waf": "Seguridad" + "text": "Defina la configuración de WAF de Azure Application Gateway como código. Mediante el uso de código, puede adoptar más fácilmente una nueva versión del conjunto de reglas y obtener protección adicional.", + "waf": "Operaciones" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", - "service": "AVS", - "severity": "Alto", - "text": "Asegúrese de que vCenter esté conectado a ADDS para habilitar la autenticación basada en \"cuentas de usuario designadas\"", - "waf": "Seguridad" + "checklist": "Azure Application Delivery Networking", + "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", + "service": "App Gateway", + "severity": "Medio", + "text": "Utilice directivas de WAF en lugar de la configuración de WAF heredada.", + "waf": "Operaciones" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", - "service": "AVS", + "checklist": "Azure Application Delivery Networking", + "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", + "service": "App Gateway", "severity": "Medio", - "text": "Asegúrese de que la conexión de vCenter a ADDS utilice un protocolo seguro (LDAPS)", + "text": "Filtre el tráfico entrante en los back-end para que solo acepten conexiones de la subred de Application Gateway, por ejemplo, con grupos de seguridad de red.", "waf": "Seguridad" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", - "service": "AVS", + "checklist": "Azure Application Delivery Networking", + "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", + "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", + "service": "Front Door", "severity": "Medio", - "text": "La cuenta de CloudAdmin en vCenter IdP solo se utiliza como una cuenta de emergencia (break-glass)", + "text": "Asegúrese de que los orígenes solo toman tráfico de la instancia de Azure Front Door.", "waf": "Seguridad" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", - "service": "AVS", + "checklist": "Azure Application Delivery Networking", + "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "service": "App Gateway", "severity": "Alto", - "text": "Asegúrese de que NSX-Manager esté integrado con un proveedor de identidades externo (LDAPS)", + "text": "Debe cifrar el tráfico a los servidores backend.", "waf": "Seguridad" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", - "service": "AVS", - "severity": "Medio", - "text": "¿Se ha creado un modelo RBAC para su uso en VMware vSphere?", + "checklist": "Azure Application Delivery Networking", + "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "service": "App Gateway", + "severity": "Alto", + "text": "Debe utilizar un firewall de aplicaciones web.", "waf": "Seguridad" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", - "service": "AVS", + "checklist": "Azure Application Delivery Networking", + "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", + "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", + "service": "App Gateway", "severity": "Medio", - "text": "Los permisos RBAC deben concederse a grupos ADDS y no a usuarios específicos", - "waf": "Seguridad" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", - "service": "AVS", - "severity": "Alto", - "text": "Los permisos de RBAC en el recurso de Azure VMware Solution en Azure están \"bloqueados\" solo para un conjunto limitado de propietarios", + "text": "Redirigir HTTP a HTTPS", "waf": "Seguridad" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", + "checklist": "Azure Application Delivery Networking", + "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", + "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", + "service": "App Gateway", + "severity": "Medio", + "text": "Utilice cookies administradas por puerta de enlace para dirigir el tráfico de una sesión de usuario al mismo servidor para su procesamiento", + "waf": "Operaciones" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", + "service": "App Gateway", + "severity": "Alto", + "text": "Habilite el drenaje de conexiones durante las actualizaciones de servicio planificadas para evitar la pérdida de conexión a los miembros existentes del grupo de back-end", + "waf": "Seguridad" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", + "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", + "service": "App Gateway", + "severity": "Bajo", + "text": "Crear páginas de error personalizadas para mostrar una experiencia de usuario personalizada", + "waf": "Operaciones" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", + "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", + "service": "App Gateway", + "severity": "Medio", + "text": "Edite las solicitudes HTTP y los encabezados de respuesta para facilitar el enrutamiento y el intercambio de información entre el cliente y el servidor", + "waf": "Seguridad" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "App Gateway", + "severity": "Medio", + "text": "Configure Front Door para optimizar el enrutamiento del tráfico web global y el rendimiento del usuario final de primer nivel, así como la confiabilidad a través de una rápida conmutación por error global", + "waf": "Rendimiento" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "29dcc19f-a8fa-4c35-8281-290577538793", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "App Gateway", + "severity": "Medio", + "text": "Usar el equilibrio de carga de la capa de transporte", + "waf": "Rendimiento" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", + "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", + "service": "App Gateway", + "severity": "Medio", + "text": "Configure el enrutamiento basado en el host o el nombre de dominio para varias aplicaciones web en una sola puerta de enlace", + "waf": "Seguridad" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", + "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", + "service": "App Gateway", + "severity": "Medio", + "text": "Centralice la administración de certificados SSL para reducir la sobrecarga de cifrado y descifrado de una granja de servidores back-end", + "waf": "Seguridad" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", + "service": "App Gateway", + "severity": "Bajo", + "text": "Uso de Application Gateway para obtener compatibilidad nativa con los protocolos WebSocket y HTTP/2", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", + "service": "AVS", + "severity": "Alto", + "text": "Asegúrese de que los controladores de dominio ADDS se implementan en la suscripción de identidad en Azure nativo", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "75089c20-990d-4927-b105-885576f76fc2", + "service": "AVS", + "severity": "Medio", + "text": "Asegúrese de que los sitios y servicios de ADDS están configurados para mantener las solicitudes de autenticación de los recursos basados en Azure (incluida Azure VMware Solution) locales en Azure", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", + "service": "AVS", + "severity": "Alto", + "text": "Asegúrese de que vCenter esté conectado a ADDS para habilitar la autenticación basada en \"cuentas de usuario designadas\"", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", + "service": "AVS", + "severity": "Medio", + "text": "Asegúrese de que la conexión de vCenter a ADDS utilice un protocolo seguro (LDAPS)", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", + "service": "AVS", + "severity": "Medio", + "text": "La cuenta de CloudAdmin en vCenter IdP solo se utiliza como una cuenta de emergencia (break-glass)", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", + "service": "AVS", + "severity": "Alto", + "text": "Asegúrese de que NSX-Manager esté integrado con un proveedor de identidades externo (LDAPS)", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", + "service": "AVS", + "severity": "Medio", + "text": "¿Se ha creado un modelo RBAC para su uso en VMware vSphere?", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", + "service": "AVS", + "severity": "Medio", + "text": "Los permisos RBAC deben concederse a grupos ADDS y no a usuarios específicos", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", + "service": "AVS", + "severity": "Alto", + "text": "Los permisos de RBAC en el recurso de Azure VMware Solution en Azure están \"bloqueados\" solo para un conjunto limitado de propietarios", + "waf": "Seguridad" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", "service": "AVS", "severity": "Alto", "text": "Asegúrese de que todos los roles personalizados tengan el ámbito de las autorizaciones permitidas de CloudAdmin", @@ -1319,729 +1534,420 @@ "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", - "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", - "service": "App Services", - "severity": "Bajo", - "text": "Consulte la arquitectura de aplicación web de redundancia de zona de alta disponibilidad de línea de base para conocer los procedimientos recomendados", + "checklist": "Azure Spring Apps Review", + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "service": "Spring Apps", + "severity": "Medio", + "text": "Azure Spring Apps permite dos implementaciones para cada aplicación, de las cuales solo una recibe tráfico de producción. Puede lograr cero tiempo de inactividad con estrategias de implementación azul verde. La implementación azul verde solo está disponible en los niveles Estándar y Enterprise. Puede automatizar la implementación mediante CI/CD con acciones de ADO/GitHub", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", - "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", - "service": "App Services", + "checklist": "Azure Spring Apps Review", + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "service": "Spring Apps", "severity": "Medio", - "text": "Utilice los niveles Premium y Estándar. Estos niveles admiten ranuras de ensayo y copias de seguridad automatizadas.", + "text": "Las instancias de Azure Spring Apps se pueden crear en varias regiones para las aplicaciones y el tráfico se puede enrutar mediante Traffic Manager o Front Door.", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", - "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", - "service": "App Services", - "severity": "Alto", - "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente (requiere el nivel Premium v2 o v3)", + "checklist": "Azure Spring Apps Review", + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "service": "Spring Apps", + "severity": "Medio", + "text": "En la región admitida, Azure Spring Apps se puede implementar como zona redundante, lo que significa que las instancias se distribuyen automáticamente entre las zonas de disponibilidad. Esta función solo está disponible en los niveles Standard y Enterprise.", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "Azure Spring Apps Review", + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "service": "Spring Apps", "severity": "Medio", - "text": "Implementación de comprobaciones de estado", + "text": "Usar más de 1 instancia de aplicación para las aplicaciones", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", - "service": "App Services", - "severity": "Alto", - "text": "Consulte los procedimientos recomendados de copia de seguridad y restauración para Azure App Service", + "checklist": "Azure Spring Apps Review", + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "service": "Spring Apps", + "severity": "Medio", + "text": "Supervise Azure Spring Apps con registros, métricas y seguimiento. Integre ASA con la información de las aplicaciones, realice un seguimiento de los errores y cree libros de trabajo.", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", - "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", - "service": "App Services", - "severity": "Alto", - "text": "Implementación de los procedimientos recomendados de confiabilidad de Azure App Service", + "checklist": "Azure Spring Apps Review", + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "service": "Spring Apps", + "severity": "Medio", + "text": "Configuración del escalado automático en Spring Cloud Gateway", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", - "service": "App Services", + "checklist": "Azure Spring Apps Review", + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "service": "Spring Apps", "severity": "Bajo", - "text": "Familiarizarse con cómo mover una aplicación de App Service a otra región durante un desastre", - "waf": "Fiabilidad" - }, - { - "checklist": "Azure App Service Review", - "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", - "service": "App Services", - "severity": "Alto", - "text": "Familiarizarse con la compatibilidad con la confiabilidad en Azure App Service", + "text": "Habilite el escalado automático para las aplicaciones con el consumo estándar y el plan dedicado.", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "App Services", + "checklist": "Azure Spring Apps Review", + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "service": "Spring Apps", "severity": "Medio", - "text": "Asegúrese de que \"Siempre activado\" está habilitado para las aplicaciones de funciones que se ejecutan en un plan de App Service", + "text": "Use el plan Enterprise para obtener soporte comercial de Spring Boot para aplicaciones de misión crítica. Con otros niveles, obtienes soporte OSS.", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", + "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", + "service": "SAP", "severity": "Medio", - "text": "Supervisión de instancias de App Service mediante comprobaciones de estado", - "waf": "Fiabilidad" + "text": "Azure Center for SAP Solutions (ACSS) es una oferta de Azure que convierte a SAP en una carga de trabajo de nivel superior en Azure. ACSS es una solución integral que permite crear y ejecutar sistemas SAP como una carga de trabajo unificada en Azure y proporciona una base más fluida para la innovación. Puede aprovechar las funcionalidades de administración de los sistemas SAP nuevos y existentes basados en Azure.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "waf": "Operaciones" }, { - "checklist": "Azure App Service Review", - "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", + "service": "SAP", "severity": "Medio", - "text": "Supervisión de la disponibilidad y la capacidad de respuesta de la aplicación web o el sitio web mediante pruebas de disponibilidad de Application Insights", + "text": "Azure admite la automatización de implementaciones de SAP en Linux y Windows. SAP Deployment Automation Framework es una herramienta de orquestación de código abierto que puede implementar, instalar y mantener entornos SAP.", + "training": "https://github.com/Azure/sap-automation", + "waf": "Operaciones" + }, + { + "checklist": "SAP Checklist", + "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", + "service": "SAP", + "severity": "Medio", + "text": "Realice una recuperación a un momento dado de sus bases de datos de producción en cualquier momento y en un período de tiempo que cumpla con su RTO; La recuperación a un momento dado suele incluir errores del operador al eliminar datos en la capa DBMS o a través de SAP, por cierto", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", - "service": "App Services", - "severity": "Bajo", - "text": "Uso de la prueba estándar de Application Insights para supervisar la disponibilidad y la capacidad de respuesta de la aplicación web o el sitio web", + "checklist": "SAP Checklist", + "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", + "service": "SAP", + "severity": "Medio", + "text": "Pruebe los tiempos de copia de seguridad y recuperación para verificar que cumplen con los requisitos de RTO para restaurar todos los sistemas simultáneamente después de un desastre.", "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Use Azure Key Vault para almacenar los secretos que necesita la aplicación. Key Vault proporciona un entorno seguro y auditado para almacenar secretos y está bien integrado con App Service a través del SDK de Key Vault o las referencias de Key Vault de App Service.", - "guid": "834ac932-223e-4ce8-8b12-3071a5416415", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "b651423c-8552-42db-a545-5cb50c05527a", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "SAP", "severity": "Alto", - "text": "Uso de Key Vault para almacenar secretos", - "waf": "Seguridad" + "text": "Puede replicar el almacenamiento estándar entre regiones emparejadas, pero no puede usar el almacenamiento estándar para almacenar las bases de datos o los discos duros virtuales. Las copias de seguridad solo se pueden replicar entre las regiones emparejadas que utilice. Para todos los demás datos, ejecute la replicación mediante características nativas de DBMS, como SQL Server Always On o SAP HANA System Replication. Use una combinación de Site Recovery, rsync o robocopy y otro software de terceros para la capa de aplicación de SAP.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Use una identidad administrada para conectarse a Key Vault mediante el SDK de Key Vault o a través de las referencias de Key Vault de App Service.", - "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", - "severity": "Alto", - "text": "Uso de la identidad administrada para conectarse a Key Vault", - "waf": "Seguridad" + "checklist": "SAP Checklist", + "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", + "severity": "Medio", + "text": "Al usar Azure Availability Zones para lograr una alta disponibilidad, debe tener en cuenta la latencia entre los servidores de aplicaciones SAP y los servidores de bases de datos. En el caso de las zonas con latencias altas, es necesario implementar procedimientos operativos para garantizar que los servidores de aplicaciones SAP y los servidores de bases de datos se ejecuten en la misma zona en todo momento.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Almacene el certificado TLS de App Service en Key Vault.", - "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "SAP", "severity": "Alto", - "text": "Use Key Vault para almacenar el certificado TLS.", - "waf": "Seguridad" + "text": "Configure conexiones de ExpressRoute desde el entorno local a las regiones de recuperación ante desastres de Azure principal y secundaria. Además, como alternativa al uso de ExpressRoute, considere la posibilidad de configurar conexiones VPN desde el entorno local a las regiones de recuperación ante desastres de Azure principal y secundaria.", + "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Los sistemas que procesan información confidencial deben estar aislados. Para ello, use planes del Servicio de aplicaciones o entornos del Servicio de aplicaciones independientes y considere la posibilidad de usar suscripciones o grupos de administración diferentes.", - "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", - "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", - "service": "App Services", - "severity": "Medio", - "text": "Aísle los sistemas que procesan información confidencial", - "waf": "Seguridad" + "checklist": "SAP Checklist", + "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "SAP", + "severity": "Bajo", + "text": "Replique el contenido del almacén de claves, como certificados, secretos o claves, en todas las regiones para poder descifrar los datos de la región de recuperación ante desastres.", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Los discos locales de App Service no están cifrados y los datos confidenciales no deben almacenarse en ellos. (Por ejemplo: D:\\\\Local y %TMP%).", - "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", + "service": "SAP", "severity": "Medio", - "text": "No almacene datos confidenciales en el disco local", - "waf": "Seguridad" + "text": "Empareje las redes virtuales principal y de recuperación ante desastres. Por ejemplo, para la replicación del sistema HANA, una red virtual de base de datos de SAP HANA debe estar emparejada con la red virtual de base de datos de SAP HANA del sitio de recuperación ante desastres.", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "En el caso de la aplicación web autenticada, use un proveedor de identidades bien establecido, como Azure AD o Azure AD B2C. Aproveche el marco de aplicaciones de su elección para integrarse con este proveedor o use la característica de autenticación o autorización del Servicio de aplicaciones.", - "guid": "919ca0b2-c121-459e-814b-933df574eccc", - "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", - "service": "App Services", - "severity": "Medio", - "text": "Usar un proveedor de identidades establecido para la autenticación", - "waf": "Seguridad" + "checklist": "SAP Checklist", + "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", + "service": "SAP", + "severity": "Bajo", + "text": "Si usa el almacenamiento de Azure NetApp Files para las implementaciones de SAP, como mínimo, cree dos cuentas de Azure NetApp Files en el nivel Premium, en dos regiones.", + "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Implemente código en App Service desde un entorno controlado y de confianza, como una canalización de implementación de DevOps bien administrada y segura. De este modo, se evita el código que no se ha controlado la versión y se ha comprobado que se implementará desde un host malintencionado.", - "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", - "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", "severity": "Alto", - "text": "Implementación desde un entorno de confianza", - "waf": "Seguridad" + "text": "Se debe usar la tecnología de replicación de bases de datos nativas para sincronizar la base de datos en un par de alta disponibilidad.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Deshabilite la autenticación básica tanto para FTP/FTPS como para WebDeploy/SCM. Esto deshabilita el acceso a estos servicios y exige el uso de puntos de conexión protegidos de Azure AD para la implementación. Tenga en cuenta que el sitio de SCM también se puede abrir con credenciales de Azure AD.", - "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", - "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", + "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", + "service": "SAP", "severity": "Alto", - "text": "Deshabilitar la autenticación básica", - "waf": "Seguridad" + "text": "El CIDR de la red virtual (VNet) principal no debe entrar en conflicto ni superponerse con el CIDR de la red virtual del sitio de recuperación ante desastres", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Siempre que sea posible, use Managed Identity para conectarse a los recursos protegidos de Azure AD. Si esto no es posible, almacene los secretos en Key Vault y conéctese a Key Vault mediante una identidad administrada en su lugar.", - "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", - "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", + "service": "SAP", "severity": "Alto", - "text": "Uso de la identidad administrada para conectarse a los recursos", - "waf": "Seguridad" + "text": "Use Site Recovery para replicar un servidor de aplicaciones en un sitio de recuperación ante desastres. Site Recovery también puede ayudar a replicar máquinas virtuales de clúster de servicios centrales en el sitio de recuperación ante desastres. Al invocar la recuperación ante desastres, deberá volver a configurar el clúster de Linux Pacemaker en el sitio de recuperación ante desastres (por ejemplo, reemplazar el VIP o SBD, ejecutar corosync.conf, etc.).", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas mediante una identidad administrada.", - "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "severity": "Alto", - "text": "Extracción de contenedores mediante una identidad administrada", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "Al configurar las opciones de diagnóstico de App Service, puede enviar todos los datos de telemetría a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad en tiempo de ejecución de App Service, como los registros HTTP, los registros de aplicaciones, los registros de plataforma, ...", - "guid": "47768314-c115-4775-a2ea-55b46ad48408", - "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", - "service": "App Services", - "severity": "Medio", - "text": "Envío de registros en tiempo de ejecución de App Service a Log Analytics", - "waf": "Seguridad" + "text": "Considere la disponibilidad del software de SAP frente a puntos únicos de fallo. Esto incluye puntos únicos de falla dentro de aplicaciones como DBMS utilizados en las arquitecturas SAP NetWeaver y SAP S/4HANA, SAP ABAP y ASCS + SCS. También, otras herramientas como SAP Web Dispatcher.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Configure una configuración de diagnóstico para enviar el registro de actividad a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad del plano de control en el propio recurso de App Service.", - "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", - "service": "App Services", - "severity": "Medio", - "text": "Envío de registros de actividad de App Service a Log Analytics", - "waf": "Seguridad" + "checklist": "SAP Checklist", + "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", + "service": "SAP", + "severity": "Alto", + "text": "En el caso de SAP y bases de datos de SAP, considere la posibilidad de implementar clústeres de conmutación por error automática. En Windows, los clústeres de conmutación por error de Windows Server admiten la conmutación por error. En Linux, Linux Pacemaker o herramientas de terceros como SIOS Protection Suite y Veritas InfoScale admiten la conmutación por error.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Controle el acceso saliente a la red mediante una combinación de integración de red virtual regional, grupos de seguridad de red y UDR. El tráfico debe enrutarse a una aplicación virtual de red, como Azure Firewall. Asegúrese de supervisar los registros del cortafuegos.", - "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", - "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", - "service": "App Services", - "severity": "Medio", - "text": "El acceso a la red saliente debe controlarse", - "waf": "Seguridad" + "checklist": "SAP Checklist", + "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", + "severity": "Alto", + "text": "Azure no admite arquitecturas en las que las máquinas virtuales principal y secundaria compartan el almacenamiento de los datos de DBMS. Para la capa DBMS, el patrón de arquitectura común es replicar bases de datos al mismo tiempo y con pilas de almacenamiento diferentes a las que usan las máquinas virtuales principal y secundaria.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Puede proporcionar una dirección IP de salida estable mediante la integración de red virtual y una puerta de enlace NAT de red virtual o una aplicación virtual de red como Azure Firewall. Esto permite a la parte receptora incluir en la lista de permitidos en función de la IP, en caso de que sea necesario. Tenga en cuenta que para las comunicaciones con los servicios de Azure, a menudo no es necesario depender de la dirección IP y, en su lugar, se deben usar mecanismos como los puntos de conexión de servicio. (Además, el uso de puntos de conexión privados en el extremo receptor evita que se produzca SNAT y proporciona un intervalo de IP de salida estable).", - "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", - "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", - "service": "App Services", - "severity": "Bajo", - "text": "Garantizar una IP estable para las comunicaciones salientes hacia las direcciones de Internet", - "waf": "Seguridad" + "checklist": "SAP Checklist", + "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", + "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", + "service": "SAP", + "severity": "Alto", + "text": "Los datos de DBMS y los archivos de registro de transacciones y puesta al día se almacenan en el almacenamiento en bloque compatible con Azure o en Azure NetApp Files. Azure Files o Azure Premium Files no se admiten como almacenamiento para datos de DBMS o archivos de registro de puesta al día con la carga de trabajo de SAP.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Controle el acceso entrante a la red mediante una combinación de restricciones de acceso al Servicio de aplicaciones, puntos de conexión de servicio o puntos de conexión privados. Se pueden requerir y configurar diferentes restricciones de acceso para la propia aplicación web y el sitio de SCM.", - "guid": "0725769e-e669-41a4-a34a-c932223ece80", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", + "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", + "service": "SAP", "severity": "Alto", - "text": "El acceso a la red entrante debe controlarse", - "waf": "Seguridad" + "text": "Puede usar discos compartidos de Azure en Windows para componentes ASCS + SCS y escenarios específicos de alta disponibilidad. Configure los clústeres de conmutación por error por separado para los componentes de la capa de aplicación de SAP y la capa de DBMS. Actualmente, Azure no admite arquitecturas de alta disponibilidad que combinen componentes de la capa de aplicación de SAP y la capa de DBMS en un clúster de conmutación por error.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Protéjase contra el tráfico entrante malintencionado mediante un firewall de aplicaciones web como Application Gateway o Azure Front Door. Asegúrese de supervisar los registros del WAF.", - "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", - "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", - "service": "App Services", - "severity": "Alto", - "text": "Uso de un WAF delante de App Service", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "Asegúrese de que no se pueda omitir el WAF bloqueando el acceso solo al WAF. Use una combinación de restricciones de acceso, puntos de conexión de servicio y puntos de conexión privados.", - "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", - "severity": "Alto", - "text": "Evite que se omita WAF", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "Establezca la directiva TLS mínima en 1.2 en la configuración de App Service.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", - "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", - "service": "App Services", - "severity": "Medio", - "text": "Establezca la directiva TLS mínima en 1.2", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "Configure App Service para que use solo HTTPS. Esto hace que App Service se redirija de HTTP a HTTPS. Considere seriamente el uso de HTTP Strict Transport Security (HSTS) en su código o desde su WAF, que informa a los navegadores que solo se debe acceder al sitio mediante HTTPS.", - "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", - "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", - "service": "App Services", - "severity": "Alto", - "text": "Usar solo HTTPS", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "No utilice caracteres comodín en la configuración de CORS, ya que esto permite que todos los orígenes accedan al servicio (lo que anula el propósito de CORS). En concreto, solo permite los orígenes que esperas poder acceder al servicio.", - "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", - "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", + "service": "SAP", "severity": "Alto", - "text": "Los comodines no deben usarse para CORS", - "waf": "Seguridad" + "text": "La mayoría de los clústeres de conmutación por error para los componentes de la capa de aplicación (ASCS) de SAP y la capa de DBMS requieren una dirección IP virtual para un clúster de conmutación por error. Azure Load Balancer debe controlar la dirección IP virtual para todos los demás casos. Un principio de diseño es usar un equilibrador de carga por configuración de clúster. Te recomendamos que utilices la versión estándar del equilibrador de carga (SKU de equilibrador de carga estándar).", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "La depuración remota no debe estar activada en producción, ya que esto abre puertos adicionales en el servicio, lo que aumenta la superficie expuesta a ataques. Tenga en cuenta que el servicio desactiva la depuración remota automáticamente después de 48 horas.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", - "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", - "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", + "service": "SAP", "severity": "Alto", - "text": "Desactivar la depuración remota", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "Habilite Defender para App Service. Esto (entre otras amenazas) detecta comunicaciones a direcciones IP maliciosas conocidas. Revise las recomendaciones de Defender para App Service como parte de las operaciones.", - "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", - "service": "App Services", - "severity": "Medio", - "text": "Habilitación de Defender for Cloud: Defender for App Service", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "Azure proporciona protección básica contra DDoS en su red, que se puede mejorar con funcionalidades inteligentes de DDoS Standard que aprenden sobre los patrones de tráfico normales y pueden detectar comportamientos inusuales. DDoS Standard se aplica a una red virtual, por lo que debe configurarse para el recurso de red delante de la aplicación, como Application Gateway o una aplicación virtual de red.", - "guid": "223ece80-b123-4071-a541-6415833ea3ad", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "App Services", - "severity": "Medio", - "text": "Habilitación del estándar de protección DDoS en la red virtual de WAF", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas a través de una red virtual desde Azure Container Registry mediante su punto de conexión privado y la configuración de la aplicación \"WEBSITE_PULL_IMAGE_OVER_VNET\".", - "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", - "service": "App Services", - "severity": "Medio", - "text": "Extracción de contenedores a través de una red virtual", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "Realice una prueba de penetración en la aplicación web siguiendo las reglas de participación de las pruebas de penetración.", - "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", - "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", - "service": "App Services", - "severity": "Medio", - "text": "Realizar una prueba de penetración", - "waf": "Seguridad" - }, - { - "checklist": "Azure App Service Review", - "description": "Implemente código de confianza que se haya validado y analizado en busca de vulnerabilidades de acuerdo con las prácticas de DevSecOps.", - "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", - "service": "App Services", - "severity": "Medio", - "text": "Implementación de código validado", - "waf": "Seguridad" + "text": "Asegúrese de que la IP flotante esté habilitada en el equilibrador de carga", + "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "waf": "Fiabilidad" }, { - "checklist": "Azure App Service Review", - "description": "Utilice las versiones más recientes de plataformas, lenguajes de programación, protocolos y marcos compatibles.", - "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", - "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", - "service": "App Services", + "checklist": "SAP Checklist", + "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "SAP", "severity": "Alto", - "text": "Utilizar plataformas, lenguajes, protocolos y marcos actualizados", - "waf": "Seguridad" + "text": "Antes de implementar la infraestructura de alta disponibilidad, y en función de la región que elija, determine si desea realizar la implementación con un conjunto de disponibilidad de Azure o una zona de disponibilidad.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", - "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", + "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", + "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", "service": "SAP", - "severity": "Medio", - "text": "Azure Center for SAP Solutions (ACSS) es una oferta de Azure que convierte a SAP en una carga de trabajo de nivel superior en Azure. ACSS es una solución integral que permite crear y ejecutar sistemas SAP como una carga de trabajo unificada en Azure y proporciona una base más fluida para la innovación. Puede aprovechar las funcionalidades de administración de los sistemas SAP nuevos y existentes basados en Azure.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", - "waf": "Operaciones" + "severity": "Alto", + "text": "Si desea cumplir los acuerdos de nivel de servicio de infraestructura para las aplicaciones de los componentes de SAP (servicios centrales, servidores de aplicaciones y bases de datos), debe elegir las mismas opciones de alta disponibilidad (máquinas virtuales, conjuntos de disponibilidad, zonas de disponibilidad) para todos los componentes.", + "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", + "guid": "cbe05bbe-209d-4490-ba47-778424d11678", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", "service": "SAP", - "severity": "Medio", - "text": "Azure admite la automatización de implementaciones de SAP en Linux y Windows. SAP Deployment Automation Framework es una herramienta de orquestación de código abierto que puede implementar, instalar y mantener entornos SAP.", - "training": "https://github.com/Azure/sap-automation", - "waf": "Operaciones" + "severity": "Alto", + "text": "No mezcle servidores de diferentes roles en el mismo conjunto de disponibilidad. Mantenga las máquinas virtuales de servicios centrales, las máquinas virtuales de base de datos y las máquinas virtuales de aplicaciones en sus propios conjuntos de disponibilidad", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", + "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", + "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", "service": "SAP", "severity": "Medio", - "text": "Realice una recuperación a un momento dado de sus bases de datos de producción en cualquier momento y en un período de tiempo que cumpla con su RTO; La recuperación a un momento dado suele incluir errores del operador al eliminar datos en la capa DBMS o a través de SAP, por cierto", + "text": "No se pueden implementar conjuntos de disponibilidad de Azure dentro de una zona de disponibilidad de Azure a menos que se usen grupos de selección de ubicación de proximidad.", + "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", + "guid": "9674e7c7-7796-4181-8920-09f4429543ba", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", "service": "SAP", - "severity": "Medio", - "text": "Pruebe los tiempos de copia de seguridad y recuperación para verificar que cumplen con los requisitos de RTO para restaurar todos los sistemas simultáneamente después de un desastre.", + "severity": "Alto", + "text": "Al crear conjuntos de disponibilidad, use el número máximo de dominios de error y dominios de actualización disponibles. Por ejemplo, si implementa más de dos máquinas virtuales en un conjunto de disponibilidad, use el número máximo de dominios de error (tres) y suficientes dominios de actualización para limitar el efecto de posibles errores de hardware físico, interrupciones de red o interrupciones de energía, además del mantenimiento planeado de Azure. El número predeterminado de dominios de error es dos y no puede cambiarlo en línea más adelante.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "b651423c-8552-42db-a545-5cb50c05527a", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", "service": "SAP", "severity": "Alto", - "text": "Puede replicar el almacenamiento estándar entre regiones emparejadas, pero no puede usar el almacenamiento estándar para almacenar las bases de datos o los discos duros virtuales. Las copias de seguridad solo se pueden replicar entre las regiones emparejadas que utilice. Para todos los demás datos, ejecute la replicación mediante características nativas de DBMS, como SQL Server Always On o SAP HANA System Replication. Use una combinación de Site Recovery, rsync o robocopy y otro software de terceros para la capa de aplicación de SAP.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "text": "Cuando se usan grupos de selección con selección de ubicación de proximidad de Azure en una implementación de conjunto de disponibilidad, los tres componentes de SAP (servicios centrales, servidor de aplicaciones y base de datos) deben estar en el mismo grupo con selección de ubicación de proximidad.", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", "service": "SAP", - "severity": "Medio", - "text": "Al usar Azure Availability Zones para lograr una alta disponibilidad, debe tener en cuenta la latencia entre los servidores de aplicaciones SAP y los servidores de bases de datos. En el caso de las zonas con latencias altas, es necesario implementar procedimientos operativos para garantizar que los servidores de aplicaciones SAP y los servidores de bases de datos se ejecuten en la misma zona en todo momento.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "severity": "Alto", + "text": "Use un grupo de selección de ubicación de proximidad por SID de SAP. Los grupos no abarcan zonas de disponibilidad ni regiones de Azure", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", "service": "SAP", "severity": "Alto", - "text": "Configure conexiones de ExpressRoute desde el entorno local a las regiones de recuperación ante desastres de Azure principal y secundaria. Además, como alternativa al uso de ExpressRoute, considere la posibilidad de configurar conexiones VPN desde el entorno local a las regiones de recuperación ante desastres de Azure principal y secundaria.", - "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", + "text": "Utilice uno de los siguientes servicios para ejecutar clústeres de servicios centrales de SAP, en función del sistema operativo.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "guid": "ed46b937-913e-4018-9c62-8393ab037e53", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", "service": "SAP", - "severity": "Bajo", - "text": "Replique el contenido del almacén de claves, como certificados, secretos o claves, en todas las regiones para poder descifrar los datos de la región de recuperación ante desastres.", + "severity": "Medio", + "text": "Actualmente, Azure no admite la combinación de ASCS y alta disponibilidad de base de datos en el mismo clúster de Linux Pacemaker; sepáralos en grupos individuales. Sin embargo, puede combinar hasta cinco clústeres de servicios centrales en un par de máquinas virtuales.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", + "guid": "f656e745-0cfb-453e-8008-0528fa21c933", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", "service": "SAP", "severity": "Medio", - "text": "Empareje las redes virtuales principal y de recuperación ante desastres. Por ejemplo, para la replicación del sistema HANA, una red virtual de base de datos de SAP HANA debe estar emparejada con la red virtual de base de datos de SAP HANA del sitio de recuperación ante desastres.", + "text": "Implemente ambas máquinas virtuales en el par de alta disponibilidad en un conjunto de disponibilidad o en zonas de disponibilidad. Estas máquinas virtuales deben tener el mismo tamaño y la misma configuración de almacenamiento.", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", + "guid": "7f684ebc-95da-425e-b329-e782dbed050f", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", "service": "SAP", - "severity": "Bajo", - "text": "Si usa el almacenamiento de Azure NetApp Files para las implementaciones de SAP, como mínimo, cree dos cuentas de Azure NetApp Files en el nivel Premium, en dos regiones.", - "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", + "severity": "Medio", + "text": "Azure admite la instalación y configuración de SAP HANA y las instancias de ASCS/SCS y ERS en el mismo clúster de alta disponibilidad que se ejecuta en Red Hat Enterprise Linux (RHEL).", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", "service": "SAP", "severity": "Alto", - "text": "Se debe usar la tecnología de replicación de bases de datos nativas para sincronizar la base de datos en un par de alta disponibilidad.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", + "text": "Ejecute todos los sistemas de producción en SSD administradas Premium y use Azure NetApp Files o Ultra Disk Storage. Al menos el disco del sistema operativo debe estar en el nivel Premium para que pueda lograr un mejor rendimiento y el mejor Acuerdo de Nivel de Servicio.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", - "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", + "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", "service": "SAP", "severity": "Alto", - "text": "El CIDR de la red virtual (VNet) principal no debe entrar en conflicto ni superponerse con el CIDR de la red virtual del sitio de recuperación ante desastres", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "text": "Debe ejecutar SAP HANA en Azure solo en los tipos de almacenamiento certificados por SAP. Tenga en cuenta que ciertos volúmenes deben ejecutarse en determinadas configuraciones de disco, cuando corresponda. Estas configuraciones incluyen la habilitación del acelerador de escritura y el uso del almacenamiento premium. También debe asegurarse de que el sistema de archivos que se ejecuta en el almacenamiento es compatible con el DBMS que se ejecuta en la máquina.", + "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", + "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", "service": "SAP", "severity": "Alto", - "text": "Use Site Recovery para replicar un servidor de aplicaciones en un sitio de recuperación ante desastres. Site Recovery también puede ayudar a replicar máquinas virtuales de clúster de servicios centrales en el sitio de recuperación ante desastres. Al invocar la recuperación ante desastres, deberá volver a configurar el clúster de Linux Pacemaker en el sitio de recuperación ante desastres (por ejemplo, reemplazar el VIP o SBD, ejecutar corosync.conf, etc.).", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "text": "Considere la posibilidad de configurar la alta disponibilidad en función del tipo de almacenamiento que utilice para las cargas de trabajo de SAP. Algunos servicios de almacenamiento disponibles en Azure no son compatibles con Azure Site Recovery, por lo que la configuración de alta disponibilidad puede diferir.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", + "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", "service": "SAP", "severity": "Alto", - "text": "Considere la disponibilidad del software de SAP frente a puntos únicos de fallo. Esto incluye puntos únicos de falla dentro de aplicaciones como DBMS utilizados en las arquitecturas SAP NetWeaver y SAP S/4HANA, SAP ABAP y ASCS + SCS. También, otras herramientas como SAP Web Dispatcher.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", + "text": "Es posible que los diferentes servicios de almacenamiento nativos de Azure (como Azure Files, Azure NetApp Files, Azure Shared Disk) no estén disponibles en todas las regiones. Por lo tanto, para tener una configuración de SAP similar en la región de recuperación ante desastres después de la conmutación por error, asegúrese de que el servicio de almacenamiento correspondiente se ofrece en el sitio de recuperación ante desastres.", "waf": "Fiabilidad" }, { "checklist": "SAP Checklist", - "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", - "service": "SAP", - "severity": "Alto", - "text": "En el caso de SAP y bases de datos de SAP, considere la posibilidad de implementar clústeres de conmutación por error automática. En Windows, los clústeres de conmutación por error de Windows Server admiten la conmutación por error. En Linux, Linux Pacemaker o herramientas de terceros como SIOS Protection Suite y Veritas InfoScale admiten la conmutación por error.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", - "severity": "Alto", - "text": "Azure no admite arquitecturas en las que las máquinas virtuales principal y secundaria compartan el almacenamiento de los datos de DBMS. Para la capa DBMS, el patrón de arquitectura común es replicar bases de datos al mismo tiempo y con pilas de almacenamiento diferentes a las que usan las máquinas virtuales principal y secundaria.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", - "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", - "service": "SAP", - "severity": "Alto", - "text": "Los datos de DBMS y los archivos de registro de transacciones y puesta al día se almacenan en el almacenamiento en bloque compatible con Azure o en Azure NetApp Files. Azure Files o Azure Premium Files no se admiten como almacenamiento para datos de DBMS o archivos de registro de puesta al día con la carga de trabajo de SAP.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", - "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", - "service": "SAP", - "severity": "Alto", - "text": "Puede usar discos compartidos de Azure en Windows para componentes ASCS + SCS y escenarios específicos de alta disponibilidad. Configure los clústeres de conmutación por error por separado para los componentes de la capa de aplicación de SAP y la capa de DBMS. Actualmente, Azure no admite arquitecturas de alta disponibilidad que combinen componentes de la capa de aplicación de SAP y la capa de DBMS en un clúster de conmutación por error.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", - "service": "SAP", - "severity": "Alto", - "text": "La mayoría de los clústeres de conmutación por error para los componentes de la capa de aplicación (ASCS) de SAP y la capa de DBMS requieren una dirección IP virtual para un clúster de conmutación por error. Azure Load Balancer debe controlar la dirección IP virtual para todos los demás casos. Un principio de diseño es usar un equilibrador de carga por configuración de clúster. Te recomendamos que utilices la versión estándar del equilibrador de carga (SKU de equilibrador de carga estándar).", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", - "service": "SAP", - "severity": "Alto", - "text": "Asegúrese de que la IP flotante esté habilitada en el equilibrador de carga", - "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "SAP", - "severity": "Alto", - "text": "Antes de implementar la infraestructura de alta disponibilidad, y en función de la región que elija, determine si desea realizar la implementación con un conjunto de disponibilidad de Azure o una zona de disponibilidad.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", - "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", - "service": "SAP", - "severity": "Alto", - "text": "Si desea cumplir los acuerdos de nivel de servicio de infraestructura para las aplicaciones de los componentes de SAP (servicios centrales, servidores de aplicaciones y bases de datos), debe elegir las mismas opciones de alta disponibilidad (máquinas virtuales, conjuntos de disponibilidad, zonas de disponibilidad) para todos los componentes.", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "cbe05bbe-209d-4490-ba47-778424d11678", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", - "severity": "Alto", - "text": "No mezcle servidores de diferentes roles en el mismo conjunto de disponibilidad. Mantenga las máquinas virtuales de servicios centrales, las máquinas virtuales de base de datos y las máquinas virtuales de aplicaciones en sus propios conjuntos de disponibilidad", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", - "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", - "service": "SAP", - "severity": "Medio", - "text": "No se pueden implementar conjuntos de disponibilidad de Azure dentro de una zona de disponibilidad de Azure a menos que se usen grupos de selección de ubicación de proximidad.", - "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "9674e7c7-7796-4181-8920-09f4429543ba", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", - "severity": "Alto", - "text": "Al crear conjuntos de disponibilidad, use el número máximo de dominios de error y dominios de actualización disponibles. Por ejemplo, si implementa más de dos máquinas virtuales en un conjunto de disponibilidad, use el número máximo de dominios de error (tres) y suficientes dominios de actualización para limitar el efecto de posibles errores de hardware físico, interrupciones de red o interrupciones de energía, además del mantenimiento planeado de Azure. El número predeterminado de dominios de error es dos y no puede cambiarlo en línea más adelante.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", - "severity": "Alto", - "text": "Cuando se usan grupos de selección con selección de ubicación de proximidad de Azure en una implementación de conjunto de disponibilidad, los tres componentes de SAP (servicios centrales, servidor de aplicaciones y base de datos) deben estar en el mismo grupo con selección de ubicación de proximidad.", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", - "severity": "Alto", - "text": "Use un grupo de selección de ubicación de proximidad por SID de SAP. Los grupos no abarcan zonas de disponibilidad ni regiones de Azure", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", - "severity": "Alto", - "text": "Utilice uno de los siguientes servicios para ejecutar clústeres de servicios centrales de SAP, en función del sistema operativo.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "ed46b937-913e-4018-9c62-8393ab037e53", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", - "service": "SAP", - "severity": "Medio", - "text": "Actualmente, Azure no admite la combinación de ASCS y alta disponibilidad de base de datos en el mismo clúster de Linux Pacemaker; sepáralos en grupos individuales. Sin embargo, puede combinar hasta cinco clústeres de servicios centrales en un par de máquinas virtuales.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "f656e745-0cfb-453e-8008-0528fa21c933", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", - "severity": "Medio", - "text": "Implemente ambas máquinas virtuales en el par de alta disponibilidad en un conjunto de disponibilidad o en zonas de disponibilidad. Estas máquinas virtuales deben tener el mismo tamaño y la misma configuración de almacenamiento.", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "7f684ebc-95da-425e-b329-e782dbed050f", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", - "service": "SAP", - "severity": "Medio", - "text": "Azure admite la instalación y configuración de SAP HANA y las instancias de ASCS/SCS y ERS en el mismo clúster de alta disponibilidad que se ejecuta en Red Hat Enterprise Linux (RHEL).", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", - "severity": "Alto", - "text": "Ejecute todos los sistemas de producción en SSD administradas Premium y use Azure NetApp Files o Ultra Disk Storage. Al menos el disco del sistema operativo debe estar en el nivel Premium para que pueda lograr un mejor rendimiento y el mejor Acuerdo de Nivel de Servicio.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", - "service": "SAP", - "severity": "Alto", - "text": "Debe ejecutar SAP HANA en Azure solo en los tipos de almacenamiento certificados por SAP. Tenga en cuenta que ciertos volúmenes deben ejecutarse en determinadas configuraciones de disco, cuando corresponda. Estas configuraciones incluyen la habilitación del acelerador de escritura y el uso del almacenamiento premium. También debe asegurarse de que el sistema de archivos que se ejecuta en el almacenamiento es compatible con el DBMS que se ejecuta en la máquina.", - "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", - "service": "SAP", - "severity": "Alto", - "text": "Considere la posibilidad de configurar la alta disponibilidad en función del tipo de almacenamiento que utilice para las cargas de trabajo de SAP. Algunos servicios de almacenamiento disponibles en Azure no son compatibles con Azure Site Recovery, por lo que la configuración de alta disponibilidad puede diferir.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", - "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", - "service": "SAP", - "severity": "Alto", - "text": "Es posible que los diferentes servicios de almacenamiento nativos de Azure (como Azure Files, Azure NetApp Files, Azure Shared Disk) no estén disponibles en todas las regiones. Por lo tanto, para tener una configuración de SAP similar en la región de recuperación ante desastres después de la conmutación por error, asegúrese de que el servicio de almacenamiento correspondiente se ofrece en el sitio de recuperación ante desastres.", - "waf": "Fiabilidad" - }, - { - "checklist": "SAP Checklist", - "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", + "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", "service": "SAP", "severity": "Medio", "text": "Automatice SAP System Start-Stop para gestionar los costes.", @@ -3150,3637 +3056,3523 @@ "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", - "service": "Entra", - "severity": "Medio", - "text": "Use un inquilino de Entra para administrar los recursos de Azure, a menos que tenga un requisito normativo o empresarial claro para varios inquilinos.", - "waf": "Operaciones" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Entra", - "severity": "Bajo", - "text": "Asegúrese de que tiene un enfoque de automatización multiinquilino para administrar los inquilinos de Microsoft Entra ID", - "waf": "Operaciones" + "checklist": "Device Provisioning Service Review", + "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", + "service": "IoT Hub DPS", + "severity": "Alto", + "text": "Seleccione el plan de hospedaje de aplicaciones lógicas adecuado en función de los requisitos empresariales y de SLO", + "waf": "Fiabilidad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "Entra", - "severity": "Bajo", - "text": "Aprovechamiento de Azure Lighthouse para la administración multiinquilino", - "waf": "Operaciones" + "checklist": "Device Provisioning Service Review", + "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "IoT Hub DPS", + "severity": "Alto", + "text": "Proteja las aplicaciones lógicas de errores de región con redundancia de zona y zonas de disponibilidad", + "waf": "Fiabilidad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Entra", - "severity": "Medio", - "text": "Asegúrese de que el asociado usa Azure Lighthouse para administrar el inquilino", - "waf": "Costar" + "checklist": "Device Provisioning Service Review", + "guid": "8aed4fbf-0830-4883-899d-222a154af478", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "IoT Hub DPS", + "severity": "Alto", + "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas", + "waf": "Fiabilidad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "348ef254-c27d-442e-abba-c7571559ab91", - "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "service": "Entra", + "checklist": "Device Provisioning Service Review", + "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "IoT Hub DPS", "severity": "Alto", - "text": "Aplique un modelo RBAC que se alinee con su modelo operativo en la nube. Ámbito y asignación entre grupos de administración y suscripciones.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Seguridad" + "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3", + "waf": "Fiabilidad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", - "service": "Entra", - "severity": "Alto", - "text": "Utilice solo el tipo de autenticación Cuenta profesional o educativa para todos los tipos de cuenta. Evite usar la cuenta de Microsoft", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Seguridad" + "checklist": "Device Provisioning Service Review", + "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "IoT Hub DPS", + "severity": "Medio", + "text": "Aproveche Azure DevOps o GitHub para simplificar la CI/CD y proteger el código de la aplicación lógica", + "waf": "Operaciones" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "Entra", - "severity": "Medio", - "text": "Utilice solo grupos para asignar permisos. Agregue grupos locales al grupo solo de ID de Entra si ya existe un sistema de administración de grupos.", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Seguridad" + "checklist": "Logic Apps checklist", + "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", + "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", + "service": "Logic Apps", + "severity": "Alto", + "text": "Seleccione el plan de hospedaje de aplicaciones lógicas adecuado en función de los requisitos empresariales y de SLO", + "waf": "Fiabilidad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", - "service": "Entra", - "severity": "Bajo", - "text": "Aplicación de directivas de acceso condicional de Microsoft Entra ID para cualquier usuario con derechos en entornos de Azure", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Seguridad" + "checklist": "Logic Apps checklist", + "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", + "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "Logic Apps", + "severity": "Alto", + "text": "Proteja las aplicaciones lógicas de errores de región con redundancia de zona y zonas de disponibilidad", + "waf": "Fiabilidad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", - "service": "Entra", + "checklist": "Logic Apps checklist", + "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", + "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Logic Apps", "severity": "Alto", - "text": "Aplicación de la autenticación multifactor para cualquier usuario con derechos en los entornos de Azure", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Seguridad" + "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas", + "waf": "Fiabilidad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "14658d35-58fd-4772-99b8-21112df27ee4", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "Entra", - "severity": "Medio", - "text": "Aplique la administración de identidades privilegiadas (PIM) de Microsoft Entra ID para establecer el acceso permanente cero y los privilegios mínimos", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Seguridad" + "checklist": "Logic Apps checklist", + "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", + "link": "https://learn.microsoft.com/azure/app-service/environment/intro", + "service": "Logic Apps", + "severity": "Alto", + "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3", + "waf": "Fiabilidad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "Entra", + "checklist": "Logic Apps checklist", + "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", + "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", + "service": "Logic Apps", "severity": "Medio", - "text": "Si planea cambiar de servicios de dominio de Active Directory a servicios de dominio de Entra, evalúe la compatibilidad de todas las cargas de trabajo", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", - "waf": "Seguridad" + "text": "Aproveche Azure DevOps o GitHub para simplificar la CI/CD y proteger el código de la aplicación lógica", + "waf": "Operaciones" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", - "service": "Entra", + "checklist": "MySQL Review Checklist", + "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", + "service": "Azure MySQL", "severity": "Medio", - "text": "Integre los registros de identificador de Microsoft Entra con Azure Monitor central de la plataforma. Azure Monitor permite una única fuente de información en torno a los datos de registro y supervisión en Azure, lo que ofrece a las organizaciones opciones nativas en la nube para cumplir los requisitos relacionados con la recopilación y retención de registros.", - "waf": "Seguridad" + "text": "Aproveche el servidor flexible", + "waf": "Fiabilidad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "984a859c-773e-47d2-9162-3a765a917e1f", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", - "service": "Entra", + "checklist": "MySQL Review Checklist", + "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", + "service": "Azure MySQL", "severity": "Alto", - "text": "Implemente un acceso de emergencia o cuentas de emergencia para evitar el bloqueo de cuentas en todo el inquilino", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Seguridad" + "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente", + "waf": "Fiabilidad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "35037e68-9349-4c15-b371-228514f4cdff", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "Entra", + "checklist": "MySQL Review Checklist", + "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", + "service": "Azure MySQL", "severity": "Medio", - "text": "Evite el uso de cuentas sincronizadas locales para las asignaciones de roles de identificador de Microsoft Entra.", - "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", - "waf": "Seguridad" + "text": "Aproveche la replicación de entrada de datos para escenarios de recuperación ante desastres entre regiones", + "waf": "Fiabilidad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Entra", + "checklist": "Azure Blob Storage Review", + "description": "Aplicación de las instrucciones de la prueba comparativa de seguridad en la nube de Microsoft relacionadas con el almacenamiento", + "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", + "service": "Azure Storage", "severity": "Medio", - "text": "Cuando sea necesario, use Microsoft Entra ID Application Proxy para proporcionar a los usuarios remotos acceso seguro y autenticado a las aplicaciones internas (hospedadas en la nube o en el entorno local).", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "text": "Tenga en cuenta la \"línea base de seguridad de Azure para el almacenamiento\"", "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", - "service": "VNet", + "checklist": "Azure Blob Storage Review", + "description": "De forma predeterminada, Azure Storage tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten exponer de forma segura Azure Storage solo a los recursos de proceso de Azure que necesitan acceso, lo que elimina la exposición a la Internet pública", + "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", + "service": "Azure Storage", + "severity": "Alto", + "text": "Considere la posibilidad de usar puntos de conexión privados para Azure Storage", + "waf": "Seguridad" + }, + { + "checklist": "Azure Blob Storage Review", + "description": "Las cuentas de almacenamiento recién creadas se crean mediante el modelo de implementación de ARM, de modo que RBAC, auditoría, etc. están habilitados. Asegúrese de que no hay cuentas de almacenamiento antiguas con el modelo de implementación clásica en una suscripción", + "guid": "30e37c3e-2971-41b2-963c-eee079b598de", + "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", + "service": "Azure Storage", "severity": "Medio", - "text": "Aproveche un diseño de red basado en la topología de red radial tradicional para escenarios de red que requieren la máxima flexibilidad.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "Asegúrese de que las cuentas de almacenamiento más antiguas no usan el \"modelo de implementación clásica\"", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", - "service": "VNet", + "checklist": "Azure Blob Storage Review", + "description": "Aproveche Microsoft Defender para obtener información sobre la actividad sospechosa y los errores de configuración.", + "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", + "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", + "service": "Azure Storage", "severity": "Alto", - "text": "Asegúrese de que los servicios de redes compartidas, incluidas las puertas de enlace de ExpressRoute, las puertas de enlace de VPN y Azure Firewall o las aplicaciones virtuales de red de asociados en la red virtual del centro central. Si es necesario, implemente también servidores DNS.", - "waf": "Costar" + "text": "Habilitación de Microsoft Defender para todas las cuentas de almacenamiento", + "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "VNet", + "checklist": "Azure Blob Storage Review", + "description": "El mecanismo de eliminación temporal permite recuperar blobs eliminados accidentalmente.", + "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", + "service": "Azure Storage", "severity": "Medio", - "text": "Use una red DDoS o planes de protección IP para todas las direcciones IP públicas en las zonas de aterrizaje de la aplicación.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Habilitación de la \"eliminación temporal\" para blobs", "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", + "checklist": "Azure Blob Storage Review", + "description": "Considere la posibilidad de deshabilitar de forma selectiva la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimina inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ", + "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", "severity": "Medio", - "text": "Al implementar tecnologías de redes de asociados o aplicaciones virtuales de red, siga las instrucciones del proveedor de asociados", - "waf": "Fiabilidad" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", - "service": "ExpressRoute", - "severity": "Bajo", - "text": "Si necesita el tránsito entre ExpressRoute y las puertas de enlace de VPN en escenarios radiales, use Azure Route Server.", + "text": "Deshabilitación de la \"eliminación temporal\" de blobs", "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", - "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", - "service": "ARS", - "severity": "Bajo", - "text": "Si utiliza el servidor de rutas, utilice un prefijo /27 para la subred del servidor de rutas.", + "checklist": "Azure Blob Storage Review", + "description": "La eliminación temporal de contenedores permite recuperar un contenedor después de que se haya eliminado, por ejemplo, recuperarse de una operación de eliminación accidental.", + "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", + "service": "Azure Storage", + "severity": "Alto", + "text": "Habilitación de la \"eliminación temporal\" para los contenedores", "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", - "service": "VNet", + "checklist": "Azure Blob Storage Review", + "description": "Considere la posibilidad de deshabilitar de forma selectiva la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimina inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ", + "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", "severity": "Medio", - "text": "En el caso de las arquitecturas de red con varias topologías en estrella tipo hub-and-spoke en las regiones de Azure, use emparejamientos de red virtual global entre las redes virtuales del centro para conectar las regiones entre sí.", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", - "waf": "Rendimiento" + "text": "Deshabilitación de la \"eliminación temporal\" para contenedores", + "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", - "service": "VNet", - "severity": "Medio", - "text": "Use Azure Monitor para redes para supervisar el estado de un extremo a otro de las redes en Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "Operaciones" - }, - { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", - "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", - "severity": "Medio", - "text": "Al conectar redes virtuales de radio a la red virtual del centro central, tenga en cuenta los límites de emparejamiento de red virtual (500), el número máximo de prefijos que se pueden anunciar a través de ExpressRoute (1000)", - "waf": "Fiabilidad" - }, - { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", - "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", - "severity": "Medio", - "text": "Tenga en cuenta el límite de rutas por tabla de rutas (400).", - "waf": "Fiabilidad" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", - "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", - "service": "VNet", + "checklist": "Azure Blob Storage Review", + "description": "Evita la eliminación accidental de una cuenta de almacenamiento, obligando al usuario a quitar primero el bloqueo de eliminación, antes de la eliminación", + "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", "severity": "Alto", - "text": "Use la opción \"Permitir tráfico a la red virtual remota\" al configurar emparejamientos de red virtual", - "waf": "Fiabilidad" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Cuando use ExpressRoute Direct, configure MACsec para cifrar el tráfico en el nivel de capa dos entre los enrutadores de la organización y MSEE. El diagrama muestra este cifrado en el flujo.", + "text": "Habilitación de bloqueos de recursos en cuentas de almacenamiento", "waf": "Seguridad" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", - "severity": "Bajo", - "text": "En escenarios en los que MACsec no es una opción (por ejemplo, no usar ExpressRoute Direct), use una puerta de enlace de VPN para establecer túneles IPsec a través del emparejamiento privado de ExpressRoute.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "checklist": "Azure Blob Storage Review", + "description": "Considere la posibilidad de aplicar directivas de \"retención legal\" o \"retención basada en el tiempo\" para los blobs, de modo que sea imposible eliminar el blob, el contenedor o la cuenta de almacenamiento. Tenga en cuenta que 'imposible' en realidad significa 'imposible'; una vez que una cuenta de almacenamiento contiene un blob inmutable, la única manera de \"deshacerse\" de esa cuenta de almacenamiento es cancelando la suscripción de Azure.", + "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", + "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", + "service": "Azure Storage", + "severity": "Alto", + "text": "Considere la posibilidad de blobs inmutables", "waf": "Seguridad" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "558fd772-49b8-4211-82df-27ee412e7f98", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "ExpressRoute", + "checklist": "Azure Blob Storage Review", + "description": "Considere la posibilidad de deshabilitar el acceso HTTP/80 sin protección a la cuenta de almacenamiento, de modo que todas las transferencias de datos estén cifradas, protegidas por integridad y el servidor esté autenticado. ", + "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Azure Storage", "severity": "Alto", - "text": "Asegúrese de que no se usan espacios de direcciones IP superpuestos en las regiones de Azure y las ubicaciones locales", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "Requerir HTTPS, es decir, deshabilitar el puerto 80 en la cuenta de almacenamiento", "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", - "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", - "severity": "Bajo", - "text": "Utilice direcciones IP de los rangos de asignación de direcciones para Internet privadas (RFC 1918).", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "checklist": "Azure Blob Storage Review", + "description": "Al configurar un dominio personalizado (nombre de host) en una cuenta de almacenamiento, compruebe si necesita TLS/HTTPS; si es así, es posible que tenga que colocar Azure CDN delante de la cuenta de almacenamiento.", + "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", + "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", + "service": "Azure Storage", + "severity": "Alto", + "text": "Al aplicar HTTPS (deshabilitar HTTP), compruebe que no usa dominios personalizados (CNAME) para la cuenta de almacenamiento.", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", - "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", - "severity": "Alto", - "text": "Asegúrese de que no se desperdicie espacio de direcciones IP, no cree redes virtuales innecesariamente grandes (por ejemplo, /16)", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "Rendimiento" + "checklist": "Azure Blob Storage Review", + "description": "Requerir HTTPS cuando un cliente usa un token de SAS para acceder a los datos de blobs ayuda a minimizar el riesgo de pérdida de credenciales.", + "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", + "service": "Azure Storage", + "severity": "Medio", + "text": "Limitar los tokens de firma de acceso compartido (SAS) solo a las conexiones HTTPS", + "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", - "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", - "service": "VNet", + "checklist": "Azure Blob Storage Review", + "description": "Los tokens de AAD deben favorecerse sobre las firmas de acceso compartido, siempre que sea posible", + "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", + "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", + "service": "Azure Storage", "severity": "Alto", - "text": "Evite el uso de intervalos de direcciones IP superpuestos para los sitios de producción y recuperación ante desastres.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Fiabilidad" + "text": "Uso de tokens de Azure Active Directory (Azure AD) para el acceso a blobs", + "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", + "checklist": "Azure Blob Storage Review", + "description": "Al asignar un rol a un usuario, grupo o aplicación, conceda a esa entidad de seguridad solo los permisos necesarios para que pueda realizar sus tareas. Limitar el acceso a los recursos ayuda a evitar el uso indebido no intencionado y malintencionado de los datos.", + "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", + "service": "Azure Storage", "severity": "Medio", - "text": "En entornos en los que la resolución de nombres en Azure es todo lo que se requiere, use Azure Private DNS para la resolución con una zona delegada para la resolución de nombres (como \"azure.contoso.com\").", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Operaciones" + "text": "Privilegios mínimos en los permisos de IaM", + "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", - "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", - "service": "DNS", - "severity": "Medio", - "text": "En el caso de los entornos en los que se requiere la resolución de nombres en Azure y en el entorno local, considere la posibilidad de usar Azure DNS Private Resolver.", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "checklist": "Azure Blob Storage Review", + "description": "Una SAS de delegación de usuarios está protegida con credenciales de Azure Active Directory (Azure AD) y también con los permisos especificados para la SAS. Una SAS de delegación de usuarios es análoga a una SAS de servicio en cuanto a su ámbito y función, pero ofrece ventajas de seguridad sobre la SAS de servicio. ", + "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", + "service": "Azure Storage", + "severity": "Alto", + "text": "Al usar SAS, prefiera \"SAS de delegación de usuarios\" en lugar de SAS basada en claves de cuenta de almacenamiento.", "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", - "severity": "Bajo", - "text": "Las cargas de trabajo especiales que requieren e implementan su propio DNS (como Red Hat OpenShift) deben utilizar su solución DNS preferida.", - "waf": "Operaciones" + "checklist": "Azure Blob Storage Review", + "description": "Las claves de la cuenta de almacenamiento (\"claves compartidas\") tienen muy pocas funcionalidades de auditoría. Si bien se puede monitorear quién o cuándo obtuvo una copia de las claves, una vez que las claves están en manos de varias personas, es imposible atribuir el uso a un usuario específico. Confiar únicamente en la autenticación de AAD facilita la vinculación del acceso al almacenamiento a un usuario. ", + "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", + "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", + "service": "Azure Storage", + "severity": "Alto", + "text": "Considere la posibilidad de deshabilitar las claves de la cuenta de almacenamiento, de modo que solo se admita el acceso a AAD (y la SAS de delegación de usuarios).", + "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "614658d3-558f-4d77-849b-821112df27ee", - "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", - "service": "DNS", + "checklist": "Azure Blob Storage Review", + "description": "Use los datos del registro de actividad para identificar \"cuándo\", \"quién\", \"qué\" y \"cómo\" se está viendo o cambiando la seguridad de la cuenta de almacenamiento (es decir, claves de cuenta de almacenamiento, directivas de acceso, etc.).", + "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", + "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", + "service": "Azure Storage", "severity": "Alto", - "text": "Habilite el registro automático de Azure DNS para administrar automáticamente el ciclo de vida de los registros DNS de las máquinas virtuales implementadas en una red virtual.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "Operaciones" + "text": "Considere la posibilidad de usar Azure Monitor para auditar las operaciones del plano de control en la cuenta de almacenamiento", + "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", - "service": "Bastion", + "checklist": "Azure Blob Storage Review", + "description": "Una directiva de expiración de claves le permite establecer un recordatorio para la rotación de las claves de acceso a la cuenta. El recordatorio se muestra si ha transcurrido el intervalo especificado y las teclas aún no se han girado.", + "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", + "service": "Azure Storage", "severity": "Medio", - "text": "Considere la posibilidad de usar Azure Bastion para conectarse de forma segura a la red.", + "text": "Al usar claves de cuenta de almacenamiento, considere la posibilidad de habilitar una \"directiva de expiración de claves\"", "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", - "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", - "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", - "service": "Bastion", + "checklist": "Azure Blob Storage Review", + "description": "Una directiva de expiración de SAS especifica un intervalo recomendado durante el cual la SAS es válida. Las directivas de expiración de SAS se aplican a una SAS de servicio o a una SAS de cuenta. Cuando un usuario genera una SAS de servicio o una SAS de cuenta con un intervalo de validez mayor que el intervalo recomendado, verá una advertencia.", + "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", + "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", + "service": "Azure Storage", "severity": "Medio", - "text": "Use Azure Bastion en una subred /26 o superior.", + "text": "Considere la posibilidad de configurar una directiva de expiración de SAS", "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "WAF", + "checklist": "Azure Blob Storage Review", + "description": "Las directivas de acceso almacenadas ofrecen la opción de revocar los permisos de una SAS de servicio sin tener que volver a generar las claves de la cuenta de almacenamiento. ", + "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", + "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", + "service": "Azure Storage", "severity": "Medio", - "text": "Use directivas de Azure Front Door y WAF para proporcionar protección global en todas las regiones de Azure para las conexiones HTTP/S entrantes a una zona de aterrizaje.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "text": "Considere la posibilidad de vincular SAS a una directiva de acceso almacenada", "waf": "Seguridad" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "severity": "Bajo", - "text": "Al usar Azure Front Door y Azure Application Gateway para ayudar a proteger las aplicaciones HTTP/S, use directivas de WAF en Azure Front Door. Bloquee Azure Application Gateway para recibir tráfico solo de Azure Front Door.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "checklist": "Azure Blob Storage Review", + "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", + "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", + "service": "Azure Storage", + "severity": "Medio", + "text": "Considere la posibilidad de configurar el repositorio de código fuente de la aplicación para detectar cadenas de conexión protegidas y claves de cuenta de almacenamiento.", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", + "checklist": "Azure Blob Storage Review", + "description": "Lo ideal es que la aplicación use una identidad administrada para autenticarse en Azure Storage. Si esto no es posible, considere la posibilidad de tener la credencial de almacenamiento (cadena de conexión, clave de cuenta de almacenamiento, SAS, credencial de entidad de servicio) en Azure KeyVault o un servicio equivalente.", + "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", + "service": "Azure Storage", "severity": "Alto", - "text": "La implementación de WAF y otros servidores proxy inversos son necesarios para las conexiones HTTP/S entrantes, impleméntelos dentro de una red virtual de zona de aterrizaje y junto con las aplicaciones que protegen y exponen a Internet.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "Considere la posibilidad de almacenar cadenas de conexión en Azure KeyVault (en escenarios en los que las identidades administradas no son posibles)", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", + "checklist": "Azure Blob Storage Review", + "description": "Use los tiempos de expiración a corto plazo en una SAS de servicio SAS ad hoc o en una SAS de cuenta. De esta manera, incluso si una SAS se ve comprometida, es válida solo por un corto tiempo. Esta práctica es especialmente importante si no puede hacer referencia a una directiva de acceso almacenada. Los tiempos de expiración a corto plazo también limitan la cantidad de datos que se pueden escribir en un blob al limitar el tiempo disponible para cargarlo.", + "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", "severity": "Alto", - "text": "Use planes de protección IP o de red DDoS de Azure para ayudar a proteger los puntos de conexión de direcciones IP públicas dentro de las redes virtuales.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Esfuércese por obtener períodos de validez cortos para SAS ad-hoc", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b034c01e-110b-463a-b36e-e3346e57f225", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", - "service": "VNet", - "severity": "Alto", - "text": "Evalúe y revise la configuración y la estrategia del tráfico saliente de la red antes del próximo cambio importante. El 30 de septiembre de 2025, se retirará el acceso saliente predeterminado para las nuevas implementaciones y solo se permitirán las configuraciones de acceso explícitas", - "waf": "Fiabilidad" + "checklist": "Azure Blob Storage Review", + "description": "Al crear una SAS, sea lo más específico y restrictivo posible. Prefiera una SAS para un solo recurso y operación en lugar de una SAS que proporciona un acceso mucho más amplio.", + "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", + "severity": "Medio", + "text": "Aplicación de un ámbito limitado a una SAS", + "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", - "severity": "Alto", - "text": "Agregue configuraciones de diagnóstico para guardar registros relacionados con DDoS para todas las direcciones IP públicas protegidas (DDoS IP o Protección de red).", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "checklist": "Azure Blob Storage Review", + "description": "Una SAS puede incluir parámetros en los que las direcciones IP de cliente o los intervalos de direcciones están autorizados a solicitar un recurso mediante la SAS. ", + "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", + "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", + "service": "Azure Storage", + "severity": "Medio", + "text": "Considere la posibilidad de definir el ámbito de SAS en una dirección IP de cliente específica, siempre que sea posible", "waf": "Seguridad" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Asegúrese de que ha investigado la posibilidad de usar ExpressRoute como conexión principal a Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Rendimiento" + "checklist": "Azure Blob Storage Review", + "description": "Una SAS no puede restringir la cantidad de datos que carga un cliente; Dado el modelo de precios de la cantidad de almacenamiento a lo largo del tiempo, podría tener sentido validar si los clientes cargaron contenido de gran tamaño malintencionado.", + "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", + "service": "Azure Storage", + "severity": "Bajo", + "text": "Considere la posibilidad de comprobar los datos cargados, después de que los clientes hayan usado una SAS para cargar un archivo. ", + "waf": "Seguridad" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "description": "Puede usar la anteposición de AS y los pesos de conexión para influir en el tráfico de Azure al entorno local, y la gama completa de atributos de BGP en sus propios enrutadores para influir en el tráfico del entorno local a Azure.", - "guid": "f29812b2-363c-4efe-879b-599de0d5973c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Cuando use varios circuitos ExpressRoute o varias ubicaciones locales, asegúrese de optimizar el enrutamiento con atributos BGP, si se prefieren determinadas rutas de acceso.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Fiabilidad" + "checklist": "Azure Blob Storage Review", + "description": "Al acceder a Blob Storage a través de SFTP mediante una \"cuenta de usuario local\", no se aplican los controles RBAC \"habituales\". El acceso a blobs a través de NFS o REST puede ser más restrictivo que el acceso SFTP. Desafortunadamente, a partir de principios de 2023, los usuarios locales son la única forma de administración de identidades que actualmente se admite para el punto de conexión SFTP", + "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", + "service": "Azure Storage", + "severity": "Alto", + "text": "SFTP: Limite la cantidad de \"usuarios locales\" para el acceso SFTP y audite si el acceso es necesario a lo largo del tiempo.", + "waf": "Seguridad" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", - "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", + "checklist": "Azure Blob Storage Review", + "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", + "service": "Azure Storage", "severity": "Medio", - "text": "Asegúrese de que usa la SKU correcta para las puertas de enlace de ExpressRoute/VPN en función de los requisitos de ancho de banda y rendimiento.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Rendimiento" + "text": "SFTP: El punto de conexión SFTP no admite ACL similares a POSIX.", + "waf": "Seguridad" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", - "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", - "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", - "service": "ExpressRoute", + "checklist": "Azure Blob Storage Review", + "description": "El almacenamiento es compatible con CORS (Cross-Origin Resource Sharing), es decir, una función HTTP que permite a las aplicaciones web de un dominio diferente relajar la política del mismo origen. Al habilitar CORS, mantenga CorsRules con el mínimo privilegio.", + "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", + "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", + "service": "Azure Storage", "severity": "Alto", - "text": "Asegúrese de que usa circuitos ExpressRoute de datos ilimitados solo si alcanza el ancho de banda que justifica su costo.", - "waf": "Costar" + "text": "Evite las políticas de CORS demasiado amplias", + "waf": "Seguridad" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", - "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", - "service": "ExpressRoute", + "checklist": "Azure Blob Storage Review", + "description": "Los datos en reposo siempre están cifrados en el lado del servidor y, además, también pueden estar cifrados en el lado del cliente. El cifrado del lado del servidor puede realizarse mediante una clave administrada por la plataforma (predeterminada) o una clave administrada por el cliente. El cifrado del lado cliente puede producirse haciendo que el cliente proporcione una clave de cifrado y descifrado por blob a Azure Storage o controlando completamente el cifrado en el lado cliente. por lo tanto, no depende en absoluto de Azure Storage para obtener garantías de confidencialidad.", + "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "Azure Storage", "severity": "Alto", - "text": "Aproveche la SKU local de ExpressRoute para reducir el costo de los circuitos, si la ubicación de emparejamiento de los circuitos admite las regiones de Azure para la SKU local.", - "waf": "Costar" + "text": "Determine cómo se deben cifrar los datos en reposo. Comprender el modelo de subprocesos para los datos.", + "waf": "Seguridad" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", - "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", - "service": "ExpressRoute", + "checklist": "Azure Blob Storage Review", + "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", + "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", + "service": "Azure Storage", "severity": "Medio", - "text": "Implemente una puerta de enlace de ExpressRoute con redundancia de zona en las regiones de Azure admitidas.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Fiabilidad" + "text": "Determine qué cifrado de plataforma se debe usar o si se debe usar.", + "waf": "Seguridad" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", - "service": "ExpressRoute", + "checklist": "Azure Blob Storage Review", + "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", + "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", + "service": "Azure Storage", "severity": "Medio", - "text": "En escenarios que requieren un ancho de banda superior a 10 Gbps o puertos dedicados de 10/100 Gbps, use ExpressRoute Direct.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Rendimiento" + "text": "Determine qué cifrado del lado del cliente se debe usar o si.", + "waf": "Seguridad" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", - "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Cuando se requiera una latencia baja o el rendimiento del entorno local a Azure sea superior a 10 Gbps, habilite FastPath para omitir la puerta de enlace de ExpressRoute de la ruta de acceso de datos.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Rendimiento" + "checklist": "Azure Blob Storage Review", + "description": "Aproveche el Explorador de Resource Graph (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para buscar cuentas de almacenamiento que permitan el acceso anónimo a blobs.", + "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", + "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", + "service": "Azure Storage", + "severity": "Alto", + "text": "Considere si se necesita acceso público a blobs o si se puede deshabilitar para determinadas cuentas de almacenamiento. ", + "waf": "Seguridad" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", - "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", - "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", - "service": "VPN", - "severity": "Medio", - "text": "Use puertas de enlace de VPN con redundancia de zona para conectar sucursales o ubicaciones remotas a Azure (donde estén disponibles).", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "Fiabilidad" + "checklist": "Cost Optimization Checklist", + "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "service": "Azure Monitor", + "text": "Reglas de recopilación de datos en Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "Costar" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", - "service": "VPN", - "severity": "Medio", - "text": "Use dispositivos VPN redundantes en las instalaciones (activo/activo o activo/pasivo).", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "Fiabilidad" + "checklist": "Cost Optimization Checklist", + "guid": "45901365-d38e-443f-abcb-d868266abca2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Azure Backup", + "text": "Comprobar las instancias de copia de seguridad con la fuente de datos subyacente no encontrada", + "waf": "Costar" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "718cb437-b060-2589-8856-2e93a5c6633b", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", - "severity": "Alto", - "text": "Si usa ExpressRoute Direct, considere la posibilidad de usar circuitos locales de ExpressRoute a las regiones locales de Azure para ahorrar costos", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "checklist": "Cost Optimization Checklist", + "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "VM", + "text": "Eliminar o archivar servicios no asociados (discos, NIC, direcciones IP, etc.)", "waf": "Costar" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Cuando se requiere aislamiento de tráfico o ancho de banda dedicado, por ejemplo, para separar entornos de producción y no de producción, use circuitos ExpressRoute diferentes. Le ayudará a garantizar dominios de enrutamiento aislados y a aliviar los riesgos de vecinos ruidosos.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Azure Backup", + "text": "Considere un buen equilibrio entre el almacenamiento de recuperación del sitio y la copia de seguridad para aplicaciones que no son críticas", + "waf": "Costar" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b30e38c3-f298-412b-8363-cefe179b599d", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Supervise la disponibilidad y el uso de ExpressRoute mediante Express Route Insights integrado.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operaciones" + "checklist": "Cost Optimization Checklist", + "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", + "service": "Azure Monitor", + "text": "Compruebe las oportunidades de gasto y ahorro entre las 40 áreas de trabajo de Log Analytics diferentes: use diferentes retenciones y recopilación de datos para áreas de trabajo que no sean de producción: cree un límite diario para el reconocimiento y el tamaño de los niveles: si establece un límite diario, además de crear una alerta cuando se alcance el límite, asegúrese de crear también una regla de alerta para que se le notifique cuando se alcance algún porcentaje (90 %, por ejemplo). - Considere la posibilidad de transformar el espacio de trabajo si es posible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", + "waf": "Costar" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", - "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Use el Monitor de conexión para la supervisión de la conectividad en toda la red, especialmente entre el entorno local y Azure.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operaciones" + "checklist": "Cost Optimization Checklist", + "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Azure Monitor", + "text": "Aplique una política de purga de registros y automatización (si es necesario, los registros se pueden mover al almacenamiento en frío)", + "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", + "waf": "Costar" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", - "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Use circuitos ExpressRoute de diferentes ubicaciones de emparejamiento para obtener redundancia.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Fiabilidad" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Use VPN de sitio a sitio como conmutación por error de ExpressRoute, especialmente si solo usa un único circuito ExpressRoute.", - "waf": "Fiabilidad" - }, - { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", - "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", - "service": "ExpressRoute", - "severity": "Alto", - "text": "Si utiliza una tabla de rutas en GatewaySubnet, asegúrese de que las rutas de puerta de enlace se propagan.", - "waf": "Fiabilidad" - }, - { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "d581a947-69a2-4783-942e-9df3664324c8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", - "service": "ExpressRoute", - "severity": "Alto", - "text": "Si usa ExpressRoute, el enrutamiento local debe ser dinámico: en caso de que se produzca un error de conexión, debe converger a la conexión restante del circuito. La carga debe compartirse entre ambas conexiones, idealmente como activa/activa, aunque también se admite activa/pasiva.", - "waf": "Fiabilidad" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Asegúrese de que los dos vínculos físicos del circuito ExpressRoute están conectados a dos dispositivos perimetrales distintos de la red.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Fiabilidad" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Asegúrese de que la detección de reenvío bidireccional (BFD) esté habilitada y configurada en los dispositivos de enrutamiento perimetral del cliente o proveedor.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Fiabilidad" + "checklist": "Cost Optimization Checklist", + "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "VM", + "text": "Compruebe que los discos son realmente necesarios, si no: eliminar. Si son necesarios, busque niveles de almacenamiento más bajos o use una copia de seguridad:", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", + "waf": "Costar" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "ExpressRoute", - "severity": "Alto", - "text": "Conecte la puerta de enlace de ExpressRoute a dos o más circuitos de diferentes ubicaciones de emparejamiento para una mayor resistencia.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Fiabilidad" + "checklist": "Cost Optimization Checklist", + "guid": "d1e44a19-659d-4395-afd7-7289b835556d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Storage", + "text": "Considere la posibilidad de mover el almacenamiento no utilizado al nivel inferior, con reglas personalizadas: https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "waf": "Costar" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Configure registros de diagnóstico y alertas para la puerta de enlace de red virtual de ExpressRoute.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Operaciones" + "checklist": "Cost Optimization Checklist", + "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "VM", + "text": "Asegúrese de que el asesor está configurado para el tamaño correcto de la máquina virtual ", + "waf": "Costar" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5234c93f-b651-41dd-80c1-234177b91ced", - "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Evite el uso de circuitos ExpressRoute para la comunicación de red virtual a red virtual.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "description": "comprobando la búsqueda de las licencias de categoría de contador en el análisis de costes", + "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", + "service": "VM", + "text": "ejecutar el script en todas las máquinas virtuales de Windows https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server: considere la posibilidad de implementar una directiva si las máquinas virtuales de Windows se crean con frecuencia", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", - "severity": "Alto", - "text": "Use Azure Firewall para controlar el tráfico saliente de Azure a Internet, las conexiones entrantes que no son HTTP/S y el filtrado del tráfico Este/Oeste (si la organización lo requiere)", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "VM", + "text": " esto también se puede poner bajo AHUB si ya tiene licencias https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", - "severity": "Medio", - "text": "Cree una directiva global de Azure Firewall para controlar la posición de seguridad en todo el entorno de red global y asígnela a todas las instancias de Azure Firewall. Permita que las directivas granulares satisfagan los requisitos de regiones específicas delegando directivas de firewall incrementales a los equipos de seguridad locales a través del control de acceso basado en roles de Azure.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "VM", + "text": "Consolide familias de máquinas virtuales reservadas con la opción de flexibilidad (no más de 4-5 familias)", + "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", - "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", - "service": "Firewall", - "severity": "Bajo", - "text": "Configure los proveedores de seguridad SaaS de socios compatibles dentro de Firewall Manager si la organización desea utilizar dichas soluciones para ayudar a proteger las conexiones salientes.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", + "service": "VM", + "text": "Uso de Azure Reserved Instances: esta característica le permite reservar máquinas virtuales durante un período de 1 o 3 años, lo que proporciona un importante ahorro de costos en comparación con los precios de pago por uso.", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", - "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", - "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", - "service": "Firewall", - "severity": "Alto", - "text": "Use reglas de red basadas en FQDN y Azure Firewall con proxy DNS para filtrar el tráfico de salida a Internet a través de protocolos no admitidos por las reglas de aplicación.", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "VM", + "text": "Solo se pueden reservar discos más grandes => 1 TiB -", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", - "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", - "severity": "Alto", - "text": "Use Azure Firewall Premium para obtener seguridad y protección adicionales.", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", + "service": "VM", + "text": "Después de la optimización del tamaño correcto", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", - "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", - "severity": "Alto", - "text": "Configure el modo de inteligencia sobre amenazas de Azure Firewall en Alerta y denegación para obtener protección adicional.", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Azure SQL", + "text": "Compruebe si corresponde y aplique la política/cambio https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", - "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", - "service": "Firewall", - "severity": "Alto", - "text": "Configure el modo IDPS de Azure Firewall en Denegar para obtener protección adicional.", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "VM", + "text": "El descuento de la parte de la licencia VM + (ahub + 3YRI) es de alrededor del 70% de descuento", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", - "guid": "a3784907-9836-4271-aafc-93535f8ec08b", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", - "service": "Firewall", - "severity": "Alto", - "text": "En el caso de las subredes de las redes virtuales que no están conectadas a Virtual WAN, adjunte una tabla de rutas para que el tráfico de Internet se redirija a Azure Firewall o a una aplicación virtual de red", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "VM", + "text": "Considere la posibilidad de utilizar un VMSS para satisfacer la demanda en lugar de un tamaño fijo", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "715d833d-4708-4527-90ac-1b142c7045ba", - "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", - "service": "Firewall", - "severity": "Medio", - "text": "Agregue la configuración de diagnóstico para guardar registros, mediante la tabla de destino Recurso específico, para todas las implementaciones de Azure Firewall.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Operaciones" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Cost Optimization Checklist", + "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "AKS", + "text": "Use el escalador automático de AKS para que coincida con el uso de los clústeres (asegúrese de que los requisitos de los pods coincidan con el escalador)", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", - "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", - "service": "Firewall", - "severity": "Importante", - "text": "Migre de las reglas de Azure Firewall clásico (si existen) a la directiva de firewall.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Operaciones" + "checklist": "Cost Optimization Checklist", + "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Azure Backup", + "text": "Mover los puntos de recuperación al archivo de almacén cuando corresponda (Validar)", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", - "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", - "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", - "service": "Firewall", - "severity": "Alto", - "text": "Use un prefijo /26 para las subredes de Azure Firewall.", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", + "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", + "service": "Databricks", + "text": "Considere la posibilidad de usar máquinas virtuales de acceso puntual con reserva siempre que sea posible. Considere la posibilidad de la terminación automática de clústeres.", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", - "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", - "service": "Firewall", - "severity": "Medio", - "text": "Organice las reglas dentro de la directiva de firewall en grupos de recopilación de reglas y colecciones de reglas en función de su frecuencia de uso", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", + "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", + "service": "Azure Functions", + "text": "Funciones - Reutilizar conexiones", + "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", - "link": "https://learn.microsoft.com/azure/firewall/ip-groups", - "service": "Firewall", - "severity": "Medio", - "text": "Utilice grupos de IP o prefijos de IP para reducir el número de reglas de tabla de IP", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "service": "Azure Functions", + "text": "Funciones: almacenar datos en caché localmente", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", - "service": "Firewall", - "severity": "Medio", - "text": "Evite los comodines como IP de origen para los DNAT, como * o cualquiera, debe especificar las direcciones IP de origen para los DNAT entrantes", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Azure Functions", + "text": "Funciones - Arranques en frío: utilice la funcionalidad 'Ejecutar desde el paquete'. De esta manera, el código se descarga como un único archivo zip. Esto puede, por ejemplo, resultar en mejoras significativas con las funciones de Javascript, que tienen muchos módulos de nodos. Utilice herramientas específicas del lenguaje para reducir el tamaño del paquete, por ejemplo, aplicaciones Javascript que sacuden el árbol.", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", - "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", - "service": "Firewall", - "severity": "Medio", - "text": "Evite el agotamiento del puerto SNAT mediante la supervisión del uso del puerto SNAT, la evaluación de la configuración de la puerta de enlace NAT y la garantía de una conmutación por error sin problemas. Si el número de puertos se acerca al límite, es una señal de que el agotamiento de SNAT podría ser inminente.", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "Azure Functions", + "text": "Funciones - Mantén tus funciones calientes", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "346840b8-1064-496e-8396-4b1340172d52", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", - "service": "Firewall", - "severity": "Alto", - "text": "Habilitar la inspección TLS", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Azure Functions", + "text": "Al usar el escalado automático con diferentes funciones, es posible que haya uno que controle todo el escalado automático para todos los recursos: considere la posibilidad de moverlo a un plan de consumo independiente (y considere un plan superior para la CPU)", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", - "service": "Firewall", - "severity": "Bajo", - "text": "Utilice categorías web para permitir o denegar el acceso saliente a temas específicos.", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", + "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", + "service": "Azure Functions", + "text": "Las aplicaciones de funciones de un plan determinado se escalan juntas, por lo que cualquier problema con el escalado puede afectar a todas las aplicaciones del plan.", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", - "service": "Firewall", - "severity": "Medio", - "text": "Como parte de la inspección de TLS, planee la recepción de tráfico de Azure App Gateways para su inspección.", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", + "service": "Azure Functions", + "text": "¿Se me factura por el \"tiempo de espera\"? Esta pregunta se suele formular en el contexto de una función de C# que realiza una operación asincrónica y espera el resultado, por ejemplo, await Task.Delay(1000) o await client. GetAsync('http://google.com'). La respuesta es sí: el segundo cálculo de GB se basa en la hora de inicio y finalización de la función y el uso de memoria durante ese período. Lo que realmente sucede durante ese tiempo en términos de actividad de la CPU no se tiene en cuenta en el cálculo. Una excepción a esta regla es si está utilizando funciones duraderas. No se le facturará por el tiempo empleado en las esperas en las funciones de orquestador.aplique técnicas de modelado de la demanda siempre que sea posible (¿entornos de desarrollo?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", - "link": "https://learn.microsoft.com/azure/firewall/dns-details", - "service": "Firewall", - "severity": "Medio", - "text": "Habilitación de la configuración del proxy DNS de Azure Firewall ", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Front Door", + "text": "Frontdoor: desactivar la página principal predeterminadaEn la configuración de la aplicación de la aplicación, establezca AzureWebJobsDisableHomepage en true. Esto devolverá un 204 (sin contenido) al PoP para que solo se devuelvan los datos del encabezado.", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", - "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", - "service": "Firewall", - "severity": "Medio", - "text": "Asegúrese de que haya una asignación de directiva para denegar direcciones IP públicas vinculadas directamente a máquinas virtuales", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Front Door", + "text": "Frontdoor: ruta a algo que no devuelve nada. Configure una función, un proxy de función o agregue una ruta en la aplicación web que devuelva 200 (correctamente) y envíe contenido mínimo o nulo. La ventaja de esto es que podrá cerrar la sesión cuando se llame.", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", - "service": "Firewall", - "severity": "Bajo", - "text": "Integre Azure Firewall con Azure Monitor y habilite el registro de diagnóstico para almacenar y analizar los registros del firewall.", - "waf": "Operaciones" + "checklist": "Cost Optimization Checklist", + "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", + "service": "Storage", + "text": "Considere la posibilidad de archivar niveles para los datos menos utilizados", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", - "severity": "Bajo", - "text": "Implemente copias de seguridad para las reglas de firewall", - "waf": "Operaciones" + "checklist": "Cost Optimization Checklist", + "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "VM", + "text": "Compruebe los tamaños de disco en los que el tamaño no coincida con el nivel (es decir, un disco de 513 GiB pagará un P30 (1 TiB) y considere la posibilidad de cambiar el tamaño", + "waf": "Costar" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "App Gateway", - "severity": "Alto", - "text": "Asegúrese de que la comunicación del plano de control para los servicios PaaS de Azure insertados en una red virtual no se interrumpa, por ejemplo, con una ruta 0.0.0.0/0 o una regla de grupo de seguridad de red que bloquee el tráfico del plano de control.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "Storage", + "text": "Considere la posibilidad de utilizar un SSD estándar en lugar de Premium o Ultra siempre que sea posible", + "waf": "Costar" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "ExpressRoute", - "severity": "Medio", - "text": "Acceda a los servicios PaaS de Azure desde el entorno local a través de puntos de conexión privados y emparejamiento privado de ExpressRoute. Este método evita el tránsito a través de la Internet pública.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "Storage", + "text": "En el caso de las cuentas de almacenamiento, asegúrese de que el nivel elegido no suma cargos por transacción (puede ser más barato pasar al siguiente nivel)", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", - "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "VNet", - "severity": "Medio", - "text": "No habilite los puntos de conexión de servicio de red virtual de forma predeterminada en todas las subredes.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "Site Recovery", + "text": "Para ASR, considere la posibilidad de usar discos SSD estándar si el RPO/RTO y el rendimiento de replicación lo permiten", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", - "severity": "Medio", - "text": "Filtre el tráfico de salida a los servicios PaaS de Azure mediante FQDN en lugar de direcciones IP en Azure Firewall o una aplicación virtual de red para evitar la filtración de datos. Si usa Private Link, puede bloquear todos los FQDN, de lo contrario, permita solo los servicios PaaS necesarios.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", + "service": "Storage", + "text": "Cuentas de almacenamiento: compruebe el nivel de acceso frecuente o GRS necesario", + "waf": "Costar" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", - "service": "ExpressRoute", - "severity": "Alto", - "text": "Use al menos un prefijo /27 para las subredes de puerta de enlace", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "VM", + "text": "Discos: valide el uso de discos SSD Premium en todas partes: por ejemplo, los que no son de producción podrían cambiar a SSD estándar o SSD Premium bajo demanda ", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", - "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", - "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", - "service": "NSG", - "severity": "Medio", - "text": "No confíe en las reglas predeterminadas de entrada del grupo de seguridad de red que usan la etiqueta de servicio VirtualNetwork para limitar la conectividad.", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "Synapse", + "text": "Cree presupuestos para administrar los costos y cree alertas que notifiquen automáticamente a las partes interesadas sobre anomalías en el gasto y riesgos de gasto excesivo.", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", - "service": "NSG", - "severity": "Medio", - "text": "Use grupos de seguridad de red para ayudar a proteger el tráfico entre subredes, así como el tráfico este/oeste a través de la plataforma (tráfico entre zonas de aterrizaje).", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "Synapse", + "text": "Exporte los datos de costos a una cuenta de almacenamiento para realizar análisis de datos adicionales.", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", - "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", - "service": "NSG", - "severity": "Medio", - "text": "El equipo de aplicaciones debe usar grupos de seguridad de aplicaciones en los grupos de seguridad de red de nivel de subred para ayudar a proteger las máquinas virtuales de varios niveles dentro de la zona de aterrizaje.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Synapse", + "text": "Controle los costos de un grupo de SQL dedicado pausando el recurso cuando no esté en uso.", + "waf": "Costar" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", + "service": "Synapse", + "text": "Habilite la función de pausa automática de Apache Spark sin servidor y establezca el valor de tiempo de espera en consecuencia.", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", - "severity": "Medio", - "text": "Use grupos de seguridad de red y grupos de seguridad de aplicaciones para microsegmentar el tráfico dentro de la zona de aterrizaje y evitar el uso de una aplicación virtual de red central para filtrar los flujos de tráfico.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Synapse", + "text": "Cree varias definiciones de grupo de Apache Spark de varios tamaños.", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "guid": "dfe237de-143b-416c-91d7-aa9b64704489", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", - "severity": "Medio", - "text": "Habilite los registros de flujo de red virtual e introdúzcalos en Análisis de tráfico para obtener información sobre los flujos de tráfico internos y externos.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "Seguridad" + "checklist": "Cost Optimization Checklist", + "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "service": "Synapse", + "text": "Compre unidades de confirmación (SCU) de Azure Synapse durante un año con un plan de compra anticipada para ahorrar en los costos de Azure Synapse Analytics.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Costar" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", - "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "NSG", - "severity": "Medio", - "text": "Tenga en cuenta el límite de reglas de grupo de seguridad de red por grupo de seguridad de red (1000).", - "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "waf": "Fiabilidad" + "checklist": "Cost Optimization Checklist", + "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "VM", + "text": "Uso de máquinas virtuales de acceso puntual para trabajos interrumpibles: se trata de máquinas virtuales por las que se puede pujar y comprar a un precio reducido, lo que proporciona una solución rentable para cargas de trabajo no críticas.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Costar" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", - "service": "VWAN", - "severity": "Medio", - "text": "Considere la posibilidad de utilizar Virtual WAN para simplificar la administración de redes de Azure y asegúrese de que el escenario se describe explícitamente en la lista de diseños de enrutamiento de Virtual WAN", - "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", - "waf": "Operaciones" + "checklist": "Cost Optimization Checklist", + "guid": "544451e1-92d3-4442-a3c7-628637a551c5", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", + "text": "Ajustar el tamaño de todas las máquinas virtuales", + "waf": "Costar" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "severity": "Medio", - "text": "Use un centro de conectividad de Virtual WAN por región de Azure para conectar varias zonas de aterrizaje entre sí en las regiones de Azure a través de una instancia global común de Azure Virtual WAN.", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "VM", + "text": "Intercambiar el tamaño de la máquina virtual con los tamaños normalizados y más recientes", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Costar" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "severity": "Bajo", - "text": "Siga el principio \"el tráfico de Azure permanece en Azure\" para que la comunicación entre los recursos de Azure se produzca a través de la red troncal de Microsoft", - "waf": "Rendimiento" + "checklist": "Cost Optimization Checklist", + "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "Ajustar el tamaño de las máquinas virtuales: comience con la supervisión del uso por debajo del 5 % y, a continuación, trabaje hasta el 40 %", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Costar" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", - "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "severity": "Medio", - "text": "Para la protección y el filtrado del tráfico de Internet saliente, implemente Azure Firewall en centros seguros", + "checklist": "Cost Optimization Checklist", + "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "La inclusión de una aplicación en contenedores puede mejorar la densidad de la máquina virtual y ahorrar dinero en su escalado", "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Seguridad" - }, - { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "VWAN", - "severity": "Medio", - "text": "Asegúrese de que la arquitectura de red está dentro de los límites de Azure Virtual WAN.", - "waf": "Fiabilidad" + "waf": "Costar" }, { - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", - "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", - "service": "VWAN", + "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", + "service": "Entra", "severity": "Medio", - "text": "Use Azure Monitor Insights para Virtual WAN para supervisar la topología de un extremo a otro de Virtual WAN, el estado y las métricas clave.", + "text": "Use un inquilino de Entra para administrar los recursos de Azure, a menos que tenga un requisito normativo o empresarial claro para varios inquilinos.", "waf": "Operaciones" }, { - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", - "service": "VWAN", - "severity": "Medio", - "text": "Asegúrese de que las implementaciones de IaC no deshabiliten el tráfico de sucursal a sucursal en Virtual WAN, a menos que estos flujos se bloqueen explícitamente.", - "waf": "Fiabilidad" + "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Entra", + "severity": "Bajo", + "text": "Asegúrese de que tiene un enfoque de automatización multiinquilino para administrar los inquilinos de Microsoft Entra ID", + "waf": "Operaciones" }, { - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", - "service": "VWAN", - "severity": "Medio", - "text": "Use AS-Path como preferencia de enrutamiento del centro, ya que es más flexible que ExpressRoute o VPN.", - "waf": "Fiabilidad" + "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "Entra", + "severity": "Bajo", + "text": "Aprovechamiento de Azure Lighthouse para la administración multiinquilino", + "waf": "Operaciones" }, { - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", - "service": "VWAN", + "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Entra", "severity": "Medio", - "text": "Asegúrese de que las implementaciones de IaC configuran la propagación basada en etiquetas en Virtual WAN, de lo contrario, la conectividad entre los centros virtuales se verá afectada.", - "waf": "Fiabilidad" + "text": "Asegúrese de que el asociado usa Azure Lighthouse para administrar el inquilino", + "waf": "Costar" }, { "ammp": true, - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "guid": "9c75dfef-573c-461c-a698-68598595581a", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", - "service": "VWAN", + "guid": "348ef254-c27d-442e-abba-c7571559ab91", + "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", + "service": "Entra", "severity": "Alto", - "text": "Asigne suficiente espacio IP a los centros virtuales, idealmente un prefijo /23.", - "waf": "Fiabilidad" + "text": "Aplique un modelo RBAC que se alinee con su modelo operativo en la nube. Ámbito y asignación entre grupos de administración y suscripciones.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Seguridad" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", + "service": "Entra", "severity": "Alto", - "text": "Aproveche Azure Policy estratégicamente, defina controles para su entorno y use iniciativas de directivas para agrupar directivas relacionadas.", - "waf": "Seguridad" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", - "severity": "Medio", - "text": "Asigne los requisitos normativos y de cumplimiento normativo a las definiciones de Azure Policy y a las asignaciones de roles de Azure.", - "waf": "Seguridad" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "223ace8c-b123-408c-a501-7f154e3ab369", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", - "severity": "Medio", - "text": null, + "text": "Utilice solo el tipo de autenticación Cuenta profesional o educativa para todos los tipos de cuenta. Evite usar la cuenta de Microsoft", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "3829e7e3-1618-4368-9a04-77a209945bda", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "Entra", "severity": "Medio", - "text": "Administre las asignaciones de directivas en el nivel más alto adecuado con exclusiones en los niveles inferiores, si es necesario.", + "text": "Utilice solo grupos para asignar permisos. Agregue grupos locales al grupo solo de ID de Entra si ya existe un sistema de administración de grupos.", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "43334f24-9116-4341-a2ba-527526944008", - "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", - "service": "Policy", + "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", + "service": "Entra", "severity": "Bajo", - "text": "Use Azure Policy para controlar qué servicios pueden aprovisionar los usuarios en el nivel de suscripción o grupo de administración", + "text": "Aplicación de directivas de acceso condicional de Microsoft Entra ID para cualquier usuario con derechos en entornos de Azure", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", "waf": "Seguridad" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", - "severity": "Medio", - "text": null, - "waf": null - }, - { - "checklist": "Azure Landing Zone Review", - "description": "La asignación del rol Colaborador de directivas de recursos a ámbitos específicos le permite delegar la administración de directivas a los equipos pertinentes. Por ejemplo, un equipo de TI central puede supervisar las directivas a nivel de grupo de administración, mientras que los equipos de aplicaciones se encargan de las directivas de sus suscripciones, lo que permite la gobernanza distribuida con el cumplimiento de los estándares de la organización.", - "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", - "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", - "service": "Policy", - "severity": "Medio", - "text": "Asigne el rol integrado Colaborador de directivas de recursos en un ámbito determinado para habilitar la gobernanza de nivel de aplicación.", - "waf": null + "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", + "service": "Entra", + "severity": "Alto", + "text": "Aplicación de la autenticación multifactor para cualquier usuario con derechos en los entornos de Azure", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "19048384-5c98-46cb-8913-156a12476e49", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "guid": "14658d35-58fd-4772-99b8-21112df27ee4", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "Entra", "severity": "Medio", - "text": "Limite el número de asignaciones de Azure Policy realizadas en el ámbito del grupo de administración raíz para evitar la administración a través de exclusiones en ámbitos heredados.", - "waf": null + "text": "Aplique la administración de identidades privilegiadas (PIM) de Microsoft Entra ID para establecer el acceso permanente cero y los privilegios mínimos", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", - "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", - "service": "Policy", + "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "Entra", "severity": "Medio", - "text": "Si existen requisitos de soberanía de datos, se pueden implementar directivas de Azure para aplicarlos", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "text": "Si planea cambiar de servicios de dominio de Active Directory a servicios de dominio de Entra, evalúe la compatibilidad de todas las cargas de trabajo", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", - "service": "Policy", + "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", + "service": "Entra", "severity": "Medio", - "text": "En el caso de la Zona de Aterrizaje Soberana, la iniciativa política de referencia de la política de soberanía se despliega y asigna al nivel correcto de MG.", - "waf": null + "text": "Integre los registros de identificador de Microsoft Entra con Azure Monitor central de la plataforma. Azure Monitor permite una única fuente de información en torno a los datos de registro y supervisión en Azure, lo que ofrece a las organizaciones opciones nativas en la nube para cumplir los requisitos relacionados con la recopilación y retención de registros.", + "waf": "Seguridad" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", - "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", - "service": "Policy", - "severity": null, - "text": "En el caso de la Zona de Aterrizaje Soberana, se documentan los objetivos de control soberano para el mapeo de políticas.", + "guid": "984a859c-773e-47d2-9162-3a765a917e1f", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "service": "Entra", + "severity": "Alto", + "text": "Implemente un acceso de emergencia o cuentas de emergencia para evitar el bloqueo de cuentas en todo el inquilino", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", - "service": "Policy", + "guid": "35037e68-9349-4c15-b371-228514f4cdff", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "Entra", "severity": "Medio", - "text": "En el caso de la Zona de Aterrizaje Soberana, existe un proceso para el CRUD de \"Objetivos de Control Soberano para el mapeo de políticas\".", + "text": "Evite el uso de cuentas sincronizadas locales para las asignaciones de roles de identificador de Microsoft Entra.", + "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Entra", "severity": "Medio", - "text": null, - "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "waf": "Operaciones" + "text": "Cuando sea necesario, use Microsoft Entra ID Application Proxy para proporcionar a los usuarios remotos acceso seguro y autenticado a las aplicaciones internas (hospedadas en la nube o en el entorno local).", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Monitor", + "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", + "service": "VNet", "severity": "Medio", - "text": "Exporte los registros a Azure Storage si los requisitos de retención de registros superan los doce años. Use el almacenamiento inmutable con una directiva de escritura única y lectura múltiple para que los datos no se puedan borrar ni modificar durante un intervalo especificado por el usuario.", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": null + "text": "Aproveche un diseño de red basado en la topología de red radial tradicional para escenarios de red que requieren la máxima flexibilidad.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Seguridad" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", - "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", - "service": "VM", - "severity": "Medio", - "text": "Supervise el desfase de configuración de la máquina virtual (VM) a nivel de sistema operativo mediante Azure Policy. La habilitación de las funcionalidades de auditoría de Azure Automanage Machine Configuration a través de la directiva ayuda a las cargas de trabajo del equipo de aplicaciones a consumir inmediatamente las funcionalidades de características con poco esfuerzo.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Operaciones" + "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", + "service": "VNet", + "severity": "Alto", + "text": "Asegúrese de que los servicios de redes compartidas, incluidas las puertas de enlace de ExpressRoute, las puertas de enlace de VPN y Azure Firewall o las aplicaciones virtuales de red de asociados en la red virtual del centro central. Si es necesario, implemente también servidores DNS.", + "waf": "Costar" }, { "checklist": "Azure Landing Zone Review", - "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", + "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "VNet", "severity": "Medio", - "text": "Use Azure Update Manager como mecanismo de aplicación de revisiones para máquinas virtuales Windows y Linux en Azure.", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "Operaciones" + "text": "Use una red DDoS o planes de protección IP para todas las direcciones IP públicas en las zonas de aterrizaje de la aplicación.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", + "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "severity": "Medio", - "text": null, - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "Operaciones" + "text": "Al implementar tecnologías de redes de asociados o aplicaciones virtuales de red, siga las instrucciones del proveedor de asociados", + "waf": "Fiabilidad" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "90483845-c986-4cb2-a131-56a12476e49f", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Network Watcher", - "severity": "Medio", - "text": "Utilice Network Watcher para supervisar de forma proactiva los flujos de tráfico", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "Operaciones" + "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", + "service": "ExpressRoute", + "severity": "Bajo", + "text": "Si necesita el tránsito entre ExpressRoute y las puertas de enlace de VPN en escenarios radiales, use Azure Route Server.", + "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Monitor", - "severity": "Medio", - "text": "Use los registros de Azure Monitor para obtener información e informes.", - "waf": "Operaciones" + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", + "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", + "service": "ARS", + "severity": "Bajo", + "text": "Si utiliza el servidor de rutas, utilice un prefijo /27 para la subred del servidor de rutas.", + "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "97be9951-9048-4384-9c98-6cb2913156a1", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", - "service": "Monitor", - "severity": null, - "text": null, - "waf": "Operaciones" + "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", + "service": "VNet", + "severity": "Medio", + "text": "En el caso de las arquitecturas de red con varias topologías en estrella tipo hub-and-spoke en las regiones de Azure, use emparejamientos de red virtual global entre las redes virtuales del centro para conectar las regiones entre sí.", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", + "waf": "Rendimiento" }, { "checklist": "Azure Landing Zone Review", - "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "Monitor", + "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", + "service": "VNet", "severity": "Medio", - "text": "Al usar el seguimiento de cambios e inventario a través de cuentas de Azure Automation, asegúrese de que ha seleccionado las regiones admitidas para vincular el área de trabajo de Log Analytics y las cuentas de automatización.", + "text": "Use Azure Monitor para redes para supervisar el estado de un extremo a otro de las redes en Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", "waf": "Operaciones" }, { "checklist": "Azure Landing Zone Review", - "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Backup", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", + "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "severity": "Medio", - "text": "Al usar Azure Backup, tenga en cuenta los diferentes tipos de copia de seguridad (GRS, ZRS Y LRS), ya que la configuración predeterminada es GRS", + "text": "Al conectar redes virtuales de radio a la red virtual del centro central, tenga en cuenta los límites de emparejamiento de red virtual (500), el número máximo de prefijos que se pueden anunciar a través de ExpressRoute (1000)", "waf": "Fiabilidad" }, { "checklist": "Azure Landing Zone Review", - "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "VM", + "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", + "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "severity": "Medio", - "text": "Use directivas de Azure para implementar automáticamente configuraciones de software a través de extensiones de máquina virtual y aplicar una configuración de máquina virtual de línea base compatible.", - "waf": "Seguridad" + "text": "Tenga en cuenta el límite de rutas por tabla de rutas (400).", + "waf": "Fiabilidad" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "description": "Las características de configuración de invitado de Azure Policy pueden auditar y corregir la configuración de la máquina (por ejemplo, el sistema operativo, la aplicación, el entorno) para asegurarse de que los recursos se alinean con las configuraciones esperadas, y Update Management puede aplicar la administración de revisiones para las máquinas virtuales.", - "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "VM", - "severity": "Medio", - "text": "Supervise el desfase de la configuración de seguridad de la máquina virtual a través de Azure Policy.", - "waf": "Seguridad" + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", + "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", + "service": "VNet", + "severity": "Alto", + "text": "Use la opción \"Permitir tráfico a la red virtual remota\" al configurar emparejamientos de red virtual", + "waf": "Fiabilidad" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", + "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", + "service": "ExpressRoute", "severity": "Medio", - "text": "Use Azure Site Recovery para escenarios de recuperación ante desastres de Azure a Azure Virtual Machines. Esto le permite replicar cargas de trabajo en todas las regiones.", - "waf": "Operaciones" + "text": "Cuando use ExpressRoute Direct, configure MACsec para cifrar el tráfico en el nivel de capa dos entre los enrutadores de la organización y MSEE. El diagrama muestra este cifrado en el flujo.", + "waf": "Seguridad" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "Backup", - "severity": "Medio", - "text": "Use funcionalidades de copia de seguridad nativas de Azure o una solución de copia de seguridad de terceros compatible con Azure.", - "waf": "Operaciones" + "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", + "severity": "Bajo", + "text": "En escenarios en los que MACsec no es una opción (por ejemplo, no usar ExpressRoute Direct), use una puerta de enlace de VPN para establecer túneles IPsec a través del emparejamiento privado de ExpressRoute.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "Seguridad" }, { "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", + "guid": "558fd772-49b8-4211-82df-27ee412e7f98", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "ExpressRoute", "severity": "Alto", - "text": "Aproveche las zonas de disponibilidad para las máquinas virtuales en las regiones en las que se admiten.", - "waf": "Fiabilidad" + "text": "Asegúrese de que no se usan espacios de direcciones IP superpuestos en las regiones de Azure y las ubicaciones locales", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", + "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", + "severity": "Bajo", + "text": "Utilice direcciones IP de los rangos de asignación de direcciones para Internet privadas (RFC 1918).", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Seguridad" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", + "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", "severity": "Alto", - "text": "Evite ejecutar una carga de trabajo de producción en una sola máquina virtual.", - "waf": "Fiabilidad" + "text": "Asegúrese de que no se desperdicie espacio de direcciones IP, no cree redes virtuales innecesariamente grandes (por ejemplo, /16)", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Rendimiento" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "84101f59-1941-4195-a270-e28034290e3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", - "severity": "Medio", - "text": "Azure Load Balancer y Application Gateway distribuyen el tráfico de red entrante entre varios recursos.", + "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", + "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", + "service": "VNet", + "severity": "Alto", + "text": "Evite el uso de intervalos de direcciones IP superpuestos para los sitios de producción y recuperación ante desastres.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", "waf": "Fiabilidad" }, { - "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "WAF", - "severity": "Alto", - "text": "Agregue la configuración de diagnóstico para guardar los registros de WAF de los servicios de entrega de aplicaciones, como Azure Front Door y Azure Application Gateway. Revise periódicamente los registros para comprobar si hay ataques y detecciones de falsos positivos.", + "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", + "severity": "Medio", + "text": "En entornos en los que la resolución de nombres en Azure es todo lo que se requiere, use Azure Private DNS para la resolución con una zona delegada para la resolución de nombres (como \"azure.contoso.com\").", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", "waf": "Operaciones" }, { "checklist": "Azure Landing Zone Review", - "guid": "7f408960-c626-44cb-a018-347c8d790cdf", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "WAF", + "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", + "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", + "service": "DNS", "severity": "Medio", - "text": "Envíe registros de WAF desde los servicios de entrega de aplicaciones, como Azure Front Door y Azure Application Gateway, a Microsoft Sentinel. Detecte ataques e integre la telemetría de WAF en su entorno general de Azure.", + "text": "En el caso de los entornos en los que se requiere la resolución de nombres en Azure y en el entorno local, considere la posibilidad de usar Azure DNS Private Resolver.", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", + "severity": "Bajo", + "text": "Las cargas de trabajo especiales que requieren e implementan su propio DNS (como Red Hat OpenShift) deben utilizar su solución DNS preferida.", "waf": "Operaciones" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "5017f154-e3ab-4369-9829-e7e316183687", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "Key Vault", + "guid": "614658d3-558f-4d77-849b-821112df27ee", + "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", + "service": "DNS", "severity": "Alto", - "text": "Uso de Azure Key Vault para almacenar los secretos y las credenciales", - "waf": "Seguridad" + "text": "Habilite el registro automático de Azure DNS para administrar automáticamente el ciclo de vida de los registros DNS de las máquinas virtuales implementadas en una red virtual.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "Operaciones" }, { "checklist": "Azure Landing Zone Review", - "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", - "guid": "a0477a20-9945-4bda-9333-4f2491163418", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", - "service": "Key Vault", + "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "service": "Bastion", "severity": "Medio", - "text": "Use diferentes instancias de Azure Key Vaults para diferentes aplicaciones y regiones para evitar límites de escala de transacciones y restringir el acceso a los secretos.", + "text": "Considere la posibilidad de usar Azure Bastion para conectarse de forma segura a la red.", "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", + "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", + "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", + "service": "Bastion", "severity": "Medio", - "text": "Aprovisione Azure Key Vault con las directivas de eliminación temporal y purga habilitadas para permitir la protección de retención de los objetos eliminados.", + "text": "Use Azure Bastion en una subred /26 o superior.", "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "dc055bcf-619e-48a1-9f98-879525d62688", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "WAF", "severity": "Medio", - "text": "Siga un modelo de privilegios mínimos limitando la autorización para eliminar claves, secretos y certificados de forma permanente a roles de identificador personalizados especializados de Microsoft Entra.", + "text": "Use directivas de Azure Front Door y WAF para proporcionar protección global en todas las regiones de Azure para las conexiones HTTP/S entrantes a una zona de aterrizaje.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Seguridad" }, { "checklist": "Azure Landing Zone Review", - "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "Medio", - "text": "Automatice el proceso de gestión y renovación de certificados con autoridades de certificación públicas para facilitar la administración.", + "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", + "severity": "Bajo", + "text": "Al usar Azure Front Door y Azure Application Gateway para ayudar a proteger las aplicaciones HTTP/S, use directivas de WAF en Azure Front Door. Bloquee Azure Application Gateway para recibir tráfico solo de Azure Front Door.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "Seguridad" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "913156a1-2476-4e49-b541-acdce979377b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "Medio", - "text": "Establezca un proceso automatizado para la rotación de claves y certificados.", + "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", + "severity": "Alto", + "text": "La implementación de WAF y otros servidores proxy inversos son necesarios para las conexiones HTTP/S entrantes, impleméntelos dentro de una red virtual de zona de aterrizaje y junto con las aplicaciones que protegen y exponen a Internet.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", "waf": "Seguridad" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "Medio", - "text": "Habilite el firewall y el punto de conexión de servicio de red virtual o el punto de conexión privado en el almacén para controlar el acceso al almacén de claves.", + "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", + "severity": "Alto", + "text": "Use planes de protección IP o de red DDoS de Azure para ayudar a proteger los puntos de conexión de direcciones IP públicas dentro de las redes virtuales.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Seguridad" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", - "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", - "service": "Key Vault", - "severity": "Medio", - "text": "Use el área de trabajo de Log Analytics de Azure Monitor central de la plataforma para auditar el uso de claves, certificados y secretos en cada instancia de Key Vault.", - "waf": "Seguridad" + "guid": "b034c01e-110b-463a-b36e-e3346e57f225", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "service": "VNet", + "severity": "Alto", + "text": "Evalúe y revise la configuración y la estrategia del tráfico saliente de la red antes del próximo cambio importante. El 30 de septiembre de 2025, se retirará el acceso saliente predeterminado para las nuevas implementaciones y solo se permitirán las configuraciones de acceso explícitas", + "waf": "Fiabilidad" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "Medio", - "text": "Delegue la creación de instancias de Key Vault y el acceso con privilegios, y use Azure Policy para aplicar una configuración coherente y compatible.", + "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", + "severity": "Alto", + "text": "Agregue configuraciones de diagnóstico para guardar registros relacionados con DDoS para todas las direcciones IP públicas protegidas (DDoS IP o Protección de red).", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Seguridad" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "91163418-2ba5-4275-8694-4008be7d7e48", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", + "service": "ExpressRoute", "severity": "Medio", - "text": "Use una instancia de Azure Key Vault por aplicación, por entorno, por región.", - "waf": "Seguridad" + "text": "Asegúrese de que ha investigado la posibilidad de usar ExpressRoute como conexión principal a Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Rendimiento" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "25d62688-6d70-4ba6-a97b-e99519048384", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "description": "Puede usar la anteposición de AS y los pesos de conexión para influir en el tráfico de Azure al entorno local, y la gama completa de atributos de BGP en sus propios enrutadores para influir en el tráfico del entorno local a Azure.", + "guid": "f29812b2-363c-4efe-879b-599de0d5973c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "severity": "Medio", - "text": "Si desea traer sus propias claves, es posible que esto no sea compatible con todos los servicios considerados. Implemente la mitigación pertinente para que las inconsistencias no obstaculicen los resultados deseados. Elija los pares de regiones y las regiones de recuperación ante desastres adecuados que minimicen la latencia.", - "waf": "Seguridad" + "text": "Cuando use varios circuitos ExpressRoute o varias ubicaciones locales, asegúrese de optimizar el enrutamiento con atributos BGP, si se prefieren determinadas rutas de acceso.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Fiabilidad" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", - "link": "https://learn.microsoft.com/industry/sovereignty/key-management", - "service": "Key Vault", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", + "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "severity": "Medio", - "text": "En el caso de la zona de aterrizaje soberana, use el HSM administrado de Azure Key Vault para almacenar los secretos y las credenciales.", - "waf": "Seguridad" + "text": "Asegúrese de que usa la SKU correcta para las puertas de enlace de ExpressRoute/VPN en función de los requisitos de ancho de banda y rendimiento.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Rendimiento" }, { + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", - "service": "Entra", - "severity": "Medio", - "text": "Use las funcionalidades de informes de Microsoft Entra ID para generar informes de auditoría de control de acceso.", - "waf": "Seguridad" + "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", + "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", + "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", + "service": "ExpressRoute", + "severity": "Alto", + "text": "Asegúrese de que usa circuitos ExpressRoute de datos ilimitados solo si alcanza el ancho de banda que justifica su costo.", + "waf": "Costar" }, { "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "09945bda-4333-44f2-9911-634182ba5275", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", - "service": "Defender", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", + "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", + "service": "ExpressRoute", "severity": "Alto", - "text": "Habilite la administración de la posición de seguridad en la nube de Defender para todas las suscripciones.", - "waf": "Seguridad" + "text": "Aproveche la SKU local de ExpressRoute para reducir el costo de los circuitos, si la ubicación de emparejamiento de los circuitos admite las regiones de Azure para la SKU local.", + "waf": "Costar" }, { - "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", - "service": "Defender", - "severity": "Alto", - "text": "Habilite un plan de protección de cargas de trabajo en la nube de Defender para servidores en todas las suscripciones.", - "waf": "Seguridad" + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", + "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", + "service": "ExpressRoute", + "severity": "Medio", + "text": "Implemente una puerta de enlace de ExpressRoute con redundancia de zona en las regiones de Azure admitidas.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Fiabilidad" }, { - "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", - "service": "Defender", - "severity": "Alto", - "text": "Habilite los planes de protección de cargas de trabajo en la nube de Defender para recursos de Azure en todas las suscripciones.", - "waf": "Seguridad" + "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "service": "ExpressRoute", + "severity": "Medio", + "text": "En escenarios que requieren un ancho de banda superior a 10 Gbps o puertos dedicados de 10/100 Gbps, use ExpressRoute Direct.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Rendimiento" + }, + { + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", + "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", + "service": "ExpressRoute", + "severity": "Medio", + "text": "Cuando se requiera una latencia baja o el rendimiento del entorno local a Azure sea superior a 10 Gbps, habilite FastPath para omitir la puerta de enlace de ExpressRoute de la ruta de acceso de datos.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Rendimiento" + }, + { + "arm-service": "microsoft.network/vpnGateways", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", + "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", + "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", + "service": "VPN", + "severity": "Medio", + "text": "Use puertas de enlace de VPN con redundancia de zona para conectar sucursales o ubicaciones remotas a Azure (donde estén disponibles).", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "Fiabilidad" + }, + { + "arm-service": "microsoft.network/vpnGateways", + "checklist": "Azure Landing Zone Review", + "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", + "service": "VPN", + "severity": "Medio", + "text": "Use dispositivos VPN redundantes en las instalaciones (activo/activo o activo/pasivo).", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "Fiabilidad" }, { "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", - "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", - "service": "VM", + "guid": "718cb437-b060-2589-8856-2e93a5c6633b", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", "severity": "Alto", - "text": "Habilite Endpoint Protection en servidores IaaS.", - "waf": "Seguridad" + "text": "Si usa ExpressRoute Direct, considere la posibilidad de usar circuitos locales de ExpressRoute a las regiones locales de Azure para ahorrar costos", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Costar" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", - "link": "https://learn.microsoft.com/azure/security-center/", - "service": "VM", + "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", + "service": "ExpressRoute", "severity": "Medio", - "text": "Supervise el desfase de revisiones del sistema operativo base a través de los registros de Azure Monitor y Defender for Cloud.", + "text": "Cuando se requiere aislamiento de tráfico o ancho de banda dedicado, por ejemplo, para separar entornos de producción y no de producción, use circuitos ExpressRoute diferentes. Le ayudará a garantizar dominios de enrutamiento aislados y a aliviar los riesgos de vecinos ruidosos.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Seguridad" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "guid": "b30e38c3-f298-412b-8363-cefe179b599d", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", + "service": "ExpressRoute", "severity": "Medio", - "text": "Conecte las configuraciones de recursos predeterminadas a un área de trabajo centralizada de Log Analytics de Azure Monitor.", - "waf": "Seguridad" + "text": "Supervise la disponibilidad y el uso de ExpressRoute mediante Express Route Insights integrado.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operaciones" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", - "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", - "service": "Entra", + "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", + "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", + "service": "ExpressRoute", "severity": "Medio", - "text": "En el caso de la zona de aterrizaje soberana, los registros de transparencia están habilitados en el inquilino de Entra ID.", - "waf": "Seguridad" + "text": "Use el Monitor de conexión para la supervisión de la conectividad en toda la red, especialmente entre el entorno local y Azure.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Operaciones" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", - "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", - "service": "Entra", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", + "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", + "service": "ExpressRoute", "severity": "Medio", - "text": "En el caso de la zona de aterrizaje soberana, la caja de seguridad del cliente está habilitada en el inquilino de Entra ID.", - "waf": "Seguridad" + "text": "Use circuitos ExpressRoute de diferentes ubicaciones de emparejamiento para obtener redundancia.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Fiabilidad" }, { - "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Storage", - "severity": "Alto", - "text": "La transferencia segura a cuentas de almacenamiento debe estar habilitada", - "waf": "Seguridad" + "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", + "service": "ExpressRoute", + "severity": "Medio", + "text": "Use VPN de sitio a sitio como conmutación por error de ExpressRoute, especialmente si solo usa un único circuito ExpressRoute.", + "waf": "Fiabilidad" }, { "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", - "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", - "service": "Storage", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", + "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", + "service": "ExpressRoute", "severity": "Alto", - "text": "Habilite la eliminación temporal del contenedor para que la cuenta de almacenamiento recupere un contenedor eliminado y su contenido.", - "waf": "Seguridad" + "text": "Si utiliza una tabla de rutas en GatewaySubnet, asegúrese de que las rutas de puerta de enlace se propagan.", + "waf": "Fiabilidad" }, { "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", - "service": "Key Vault", + "guid": "d581a947-69a2-4783-942e-9df3664324c8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", + "service": "ExpressRoute", "severity": "Alto", - "text": "Use secretos de Key Vault para evitar codificar de forma rígida información confidencial, como credenciales (máquinas virtuales, contraseñas de usuario), certificados o claves.", - "waf": "Operaciones" - }, - { - "checklist": "Azure API Management Review", - "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", - "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", - "service": "APIM", - "severity": "Medio", - "text": "Implementar una política de control de errores a nivel global", - "waf": "Operaciones" - }, - { - "checklist": "Azure API Management Review", - "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", - "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", - "service": "APIM", - "severity": "Medio", - "text": "Asegúrese de que todas las políticas de API incluyan un elemento.", - "waf": "Operaciones" + "text": "Si usa ExpressRoute, el enrutamiento local debe ser dinámico: en caso de que se produzca un error de conexión, debe converger a la conexión restante del circuito. La carga debe compartirse entre ambas conexiones, idealmente como activa/activa, aunque también se admite activa/pasiva.", + "waf": "Fiabilidad" }, { - "checklist": "Azure API Management Review", - "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", - "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", - "service": "APIM", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", + "service": "ExpressRoute", "severity": "Medio", - "text": "Uso de fragmentos de políticas para evitar repetir las mismas definiciones de políticas en varias API", - "waf": "Operaciones" + "text": "Asegúrese de que los dos vínculos físicos del circuito ExpressRoute están conectados a dos dispositivos perimetrales distintos de la red.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Fiabilidad" }, { - "checklist": "Azure API Management Review", - "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", - "link": "https://learn.microsoft.com/azure/api-management/monetization-support", - "service": "APIM", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", + "service": "ExpressRoute", "severity": "Medio", - "text": "Si planeas monetizar tus API, revisa el artículo \"Soporte de monetización\" para conocer las prácticas recomendadas", - "waf": "Operaciones" + "text": "Asegúrese de que la detección de reenvío bidireccional (BFD) esté habilitada y configurada en los dispositivos de enrutamiento perimetral del cliente o proveedor.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Fiabilidad" }, { - "checklist": "Azure API Management Review", - "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", - "service": "APIM", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "ExpressRoute", "severity": "Alto", - "text": "Habilitación de la configuración de diagnóstico para exportar registros a Azure Monitor", - "waf": "Operaciones" + "text": "Conecte la puerta de enlace de ExpressRoute a dos o más circuitos de diferentes ubicaciones de emparejamiento para una mayor resistencia.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Fiabilidad" }, { - "checklist": "Azure API Management Review", - "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", - "service": "APIM", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", + "service": "ExpressRoute", "severity": "Medio", - "text": "Habilitación de Application Insights para obtener telemetría más detallada", - "waf": "Operaciones" - }, - { - "checklist": "Azure API Management Review", - "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", - "service": "APIM", - "severity": "Alto", - "text": "Configurar alertas sobre las métricas más críticas", + "text": "Configure registros de diagnóstico y alertas para la puerta de enlace de red virtual de ExpressRoute.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "Operaciones" }, { - "checklist": "Azure API Management Review", - "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", - "service": "APIM", - "severity": "Alto", - "text": "Asegúrese de que los certificados SSL personalizados se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura", - "waf": "Seguridad" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "5234c93f-b651-41dd-80c1-234177b91ced", + "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", + "service": "ExpressRoute", + "severity": "Medio", + "text": "Evite el uso de circuitos ExpressRoute para la comunicación de red virtual a red virtual.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Rendimiento" }, { - "checklist": "Azure API Management Review", - "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", - "service": "APIM", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "severity": "Alto", - "text": "Protección de las solicitudes entrantes a las API (plano de datos) con Azure AD", + "text": "Use Azure Firewall para controlar el tráfico saliente de Azure a Internet, las conexiones entrantes que no son HTTP/S y el filtrado del tráfico Este/Oeste (si la organización lo requiere)", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", "severity": "Medio", - "text": "Usar el identificador de Microsoft Entra para autenticar a los usuarios en el Portal para desarrolladores", + "text": "Cree una directiva global de Azure Firewall para controlar la posición de seguridad en todo el entorno de red global y asígnela a todas las instancias de Azure Firewall. Permita que las directivas granulares satisfagan los requisitos de regiones específicas delegando directivas de firewall incrementales a los equipos de seguridad locales a través del control de acceso basado en roles de Azure.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", - "service": "APIM", - "severity": "Medio", - "text": "Crear grupos adecuados para controlar la visibilidad de los productos", + "checklist": "Azure Landing Zone Review", + "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", + "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", + "service": "Firewall", + "severity": "Bajo", + "text": "Configure los proveedores de seguridad SaaS de socios compatibles dentro de Firewall Manager si la organización desea utilizar dichas soluciones para ayudar a proteger las conexiones salientes.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "06862505-2d9a-4874-9491-2837b00a3475", - "link": "https://learn.microsoft.com/azure/api-management/backends", - "service": "APIM", - "severity": "Medio", - "text": "Utilice la función Backends para eliminar las configuraciones redundantes de back-end de la API", - "waf": "Operaciones" - }, - { - "checklist": "Azure API Management Review", - "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", - "service": "APIM", - "severity": "Medio", - "text": "Usar valores con nombre para almacenar valores comunes que se pueden usar en directivas", - "waf": "Operaciones" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", + "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", + "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", + "service": "Firewall", + "severity": "Alto", + "text": "Use reglas de red basadas en FQDN y Azure Firewall con proxy DNS para filtrar el tráfico de salida a Internet a través de protocolos no admitidos por las reglas de aplicación.", + "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", - "service": "APIM", - "severity": "Medio", - "text": "En el caso de la recuperación ante desastres, aproveche el nivel premium con implementaciones escaladas en dos o más regiones para un acuerdo de nivel de servicio del 99,99 %", - "waf": "Fiabilidad" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", + "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", + "severity": "Alto", + "text": "Use Azure Firewall Premium para obtener seguridad y protección adicionales.", + "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", - "link": "https://learn.microsoft.com/azure/api-management/high-availability", - "service": "APIM", - "severity": "Medio", - "text": "Implemente al menos una unidad en dos o más zonas de disponibilidad para obtener un SLA aumentado del 99,99 %", - "waf": "Fiabilidad" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", + "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", + "severity": "Alto", + "text": "Configure el modo de inteligencia sobre amenazas de Azure Firewall en Alerta y denegación para obtener protección adicional.", + "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", - "service": "APIM", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", + "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", + "service": "Firewall", "severity": "Alto", - "text": "Asegúrese de que haya una rutina de copia de seguridad automatizada", - "waf": "Fiabilidad" + "text": "Configure el modo IDPS de Azure Firewall en Denegar para obtener protección adicional.", + "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", - "link": "https://learn.microsoft.com/azure/api-management/retry-policy", - "service": "APIM", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", + "guid": "a3784907-9836-4271-aafc-93535f8ec08b", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "service": "Firewall", + "severity": "Alto", + "text": "En el caso de las subredes de las redes virtuales que no están conectadas a Virtual WAN, adjunte una tabla de rutas para que el tráfico de Internet se redirija a Azure Firewall o a una aplicación virtual de red", + "waf": "Seguridad" + }, + { + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "715d833d-4708-4527-90ac-1b142c7045ba", + "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", + "service": "Firewall", "severity": "Medio", - "text": "Use directivas para agregar una dirección URL de back-end de conmutación por error y el almacenamiento en caché para reducir las llamadas con errores.", - "waf": "Fiabilidad" + "text": "Agregue la configuración de diagnóstico para guardar registros, mediante la tabla de destino Recurso específico, para todas las implementaciones de Azure Firewall.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Operaciones" }, { - "checklist": "Azure API Management Review", - "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", - "service": "APIM", - "severity": "Bajo", - "text": "Si necesita iniciar sesión en niveles de alto rendimiento, tenga en cuenta la directiva de Event Hubs", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", + "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", + "service": "Firewall", + "severity": "Importante", + "text": "Migre de las reglas de Azure Firewall clásico (si existen) a la directiva de firewall.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "Operaciones" }, { - "checklist": "Azure API Management Review", - "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", - "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", - "service": "APIM", - "severity": "Medio", - "text": "Aplicación de directivas de limitación para controlar el número de solicitudes por segundo", - "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", - "waf": "Rendimiento" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", + "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", + "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", + "service": "Firewall", + "severity": "Alto", + "text": "Use un prefijo /26 para las subredes de Azure Firewall.", + "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", + "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", + "service": "Firewall", "severity": "Medio", - "text": "Configurar el escalado automático para escalar horizontalmente el número de instancias cuando aumenta la carga", + "text": "Organice las reglas dentro de la directiva de firewall en grupos de recopilación de reglas y colecciones de reglas en función de su frecuencia de uso", "waf": "Rendimiento" }, { - "checklist": "Azure API Management Review", - "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", + "link": "https://learn.microsoft.com/azure/firewall/ip-groups", + "service": "Firewall", "severity": "Medio", - "text": "Implemente puertas de enlace autohospedadas en las que Azure no tenga una región cercana a las API de back-end.", + "text": "Utilice grupos de IP o prefijos de IP para reducir el número de reglas de tabla de IP", "waf": "Rendimiento" }, { - "checklist": "Azure API Management Review", - "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", - "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", + "service": "Firewall", "severity": "Medio", - "text": "Use el nivel premium para las cargas de trabajo de producción.", - "waf": "Fiabilidad" + "text": "Evite los comodines como IP de origen para los DNAT, como * o cualquiera, debe especificar las direcciones IP de origen para los DNAT entrantes", + "waf": "Rendimiento" }, { - "checklist": "Azure API Management Review", - "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", + "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", + "service": "Firewall", "severity": "Medio", - "text": "En el modelo de varias regiones, use directivas para enrutar las solicitudes a los back-ends regionales en función de la disponibilidad o la latencia.", - "waf": "Fiabilidad" - }, - { - "checklist": "Azure API Management Review", - "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", - "service": "APIM", - "severity": "Alto", - "text": "Tenga en cuenta los límites de APIM", - "waf": "Fiabilidad" + "text": "Evite el agotamiento del puerto SNAT mediante la supervisión del uso del puerto SNAT, la evaluación de la configuración de la puerta de enlace NAT y la garantía de una conmutación por error sin problemas. Si el número de puertos se acerca al límite, es una señal de que el agotamiento de SNAT podría ser inminente.", + "waf": "Rendimiento" }, { - "checklist": "Azure API Management Review", - "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", - "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "346840b8-1064-496e-8396-4b1340172d52", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", + "service": "Firewall", "severity": "Alto", - "text": "Asegúrese de que las implementaciones de puerta de enlace autohospedadas sean resistentes.", - "waf": "Fiabilidad" + "text": "Habilitar la inspección TLS", + "waf": "Rendimiento" }, { - "checklist": "Azure API Management Review", - "guid": "7519e385-a88b-4d34-966b-6269d686e890", - "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", - "service": "APIM", - "severity": "Medio", - "text": "Uso de Azure Front Door delante de APIM para la implementación en varias regiones", + "checklist": "Azure Landing Zone Review", + "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", + "service": "Firewall", + "severity": "Bajo", + "text": "Utilice categorías web para permitir o denegar el acceso saliente a temas específicos.", "waf": "Rendimiento" }, { - "checklist": "Azure API Management Review", - "guid": "cd45c90e-7690-4753-930b-bf290c69c074", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", + "service": "Firewall", "severity": "Medio", - "text": "Implementación del servicio dentro de una red virtual (VNet)", - "waf": "Seguridad" + "text": "Como parte de la inspección de TLS, planee la recepción de tráfico de Azure App Gateways para su inspección.", + "waf": "Rendimiento" }, { - "checklist": "Azure API Management Review", - "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "service": "Firewall", "severity": "Medio", - "text": "Implemente grupos de seguridad de red (NSG) en las subredes para restringir o supervisar el tráfico hacia/desde APIM.", + "text": "Habilitación de la configuración del proxy DNS de Azure Firewall ", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", + "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", + "service": "Firewall", "severity": "Medio", - "text": "Implemente puntos de conexión privados para filtrar el tráfico entrante cuando APIM no se implemente en una red virtual.", - "waf": "Seguridad" - }, - { - "checklist": "Azure API Management Review", - "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", - "service": "APIM", - "severity": "Alto", - "text": "Deshabilitar el acceso a la red pública", + "text": "Asegúrese de que haya una asignación de directiva para denegar direcciones IP públicas vinculadas directamente a máquinas virtuales", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", - "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", - "service": "APIM", - "severity": "Medio", - "text": "Simplifique la administración con scripts de automatización de PowerShell", + "checklist": "Azure Landing Zone Review", + "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "service": "Firewall", + "severity": "Bajo", + "text": "Integre Azure Firewall con Azure Monitor y habilite el registro de diagnóstico para almacenar y analizar los registros del firewall.", "waf": "Operaciones" }, { - "checklist": "Azure API Management Review", - "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", - "service": "APIM", - "severity": "Medio", - "text": "Configure APIM a través de la infraestructura como código. Revise las prácticas recomendadas de DevOps desde el acelerador de zonas de aterrizaje de API de Cloud Adaption Framework", + "checklist": "Azure Landing Zone Review", + "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", + "severity": "Bajo", + "text": "Implemente copias de seguridad para las reglas de firewall", "waf": "Operaciones" }, { - "checklist": "Azure API Management Review", - "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", - "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", - "service": "APIM", - "severity": "Medio", - "text": "Promover el uso de la extensión APIM de Visual Studio Code para un desarrollo de API más rápido", - "waf": "Operaciones" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "App Gateway", + "severity": "Alto", + "text": "Asegúrese de que la comunicación del plano de control para los servicios PaaS de Azure insertados en una red virtual no se interrumpa, por ejemplo, con una ruta 0.0.0.0/0 o una regla de grupo de seguridad de red que bloquee el tráfico del plano de control.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "354f1c03-8112-4965-85ad-c0074bddf231", - "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", - "service": "APIM", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "ExpressRoute", "severity": "Medio", - "text": "Implemente DevOps y CI/CD en su flujo de trabajo", - "waf": "Operaciones" + "text": "Acceda a los servicios PaaS de Azure desde el entorno local a través de puntos de conexión privados y emparejamiento privado de ExpressRoute. Este método evita el tránsito a través de la Internet pública.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "b6439493-426a-45f3-9697-cf65baee208d", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", + "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "VNet", "severity": "Medio", - "text": "API seguras mediante la autenticación de certificados de cliente", + "text": "No habilite los puntos de conexión de servicio de red virtual de forma predeterminada en todas las subredes.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "2a67d143-1033-4c0a-8732-680896478f08", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "severity": "Medio", - "text": "Servicios de back-end seguros mediante la autenticación de certificados de cliente", + "text": "Filtre el tráfico de salida a los servicios PaaS de Azure mediante FQDN en lugar de direcciones IP en Azure Firewall o una aplicación virtual de red para evitar la filtración de datos. Si usa Private Link, puede bloquear todos los FQDN, de lo contrario, permita solo los servicios PaaS necesarios.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", - "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", - "service": "APIM", - "severity": "Medio", - "text": "Revise el artículo \"Recomendaciones para mitigar las 10 principales amenazas de seguridad de la API de OWASP\" y compruebe qué se aplica a sus API", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", + "service": "ExpressRoute", + "severity": "Alto", + "text": "Use al menos un prefijo /27 para las subredes de puerta de enlace", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", - "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", + "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", + "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", + "service": "NSG", "severity": "Medio", - "text": "Utilice la función Autorizaciones para simplificar la administración del token de OAuth 2.0 para las API de back-end", + "text": "No confíe en las reglas predeterminadas de entrada del grupo de seguridad de red que usan la etiqueta de servicio VirtualNetwork para limitar la conectividad.", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", - "service": "APIM", - "severity": "Alto", - "text": "Utilice la versión más reciente de TLS al cifrar la información en tránsito. Deshabilite los protocolos y cifrados obsoletos e innecesarios cuando sea posible.", + "checklist": "Azure Landing Zone Review", + "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", + "service": "NSG", + "severity": "Medio", + "text": "Use grupos de seguridad de red para ayudar a proteger el tráfico entre subredes, así como el tráfico este/oeste a través de la plataforma (tráfico entre zonas de aterrizaje).", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "f8af3d94-1d2b-4070-846f-849197524258", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", - "service": "APIM", - "severity": "Alto", - "text": "Asegúrese de que los secretos (valores con nombre) se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura", + "checklist": "Azure Landing Zone Review", + "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", + "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", + "service": "NSG", + "severity": "Medio", + "text": "El equipo de aplicaciones debe usar grupos de seguridad de aplicaciones en los grupos de seguridad de red de nivel de subred para ayudar a proteger las máquinas virtuales de varios niveles dentro de la zona de aterrizaje.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "791abd8b-7706-4e31-9569-afefde724be3", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", - "service": "APIM", + "checklist": "Azure Landing Zone Review", + "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "severity": "Medio", - "text": "Uso de identidades administradas para autenticarse en otros recursos de Azure siempre que sea posible", + "text": "Use grupos de seguridad de red y grupos de seguridad de aplicaciones para microsegmentar el tráfico dentro de la zona de aterrizaje y evitar el uso de una aplicación virtual de red central para filtrar los flujos de tráfico.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "Seguridad" }, { - "checklist": "Azure API Management Review", - "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", - "service": "APIM", - "severity": "Alto", - "text": "Uso del firewall de aplicaciones web (WAF) mediante la implementación de Application Gateway delante de APIM", + "checklist": "Azure Landing Zone Review", + "guid": "dfe237de-143b-416c-91d7-aa9b64704489", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", + "severity": "Medio", + "text": "Habilite los registros de flujo de red virtual e introdúzcalos en Análisis de tráfico para obtener información sobre los flujos de tráfico internos y externos.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", "waf": "Seguridad" }, { - "checklist": "Azure Bot Service", - "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", - "service": "Bot service", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", + "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "NSG", "severity": "Medio", - "text": "Siga las recomendaciones de soporte técnico de confiabilidad en Azure Bot Service", + "text": "Tenga en cuenta el límite de reglas de grupo de seguridad de red por grupo de seguridad de red (1000).", + "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", "waf": "Fiabilidad" }, { - "checklist": "Azure Bot Service", - "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", - "service": "Bot service", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", + "service": "VWAN", "severity": "Medio", - "text": "Implementación de bots con residencia de datos local y cumplimiento regional", - "waf": "Fiabilidad" + "text": "Considere la posibilidad de utilizar Virtual WAN para simplificar la administración de redes de Azure y asegúrese de que el escenario se describe explícitamente en la lista de diseños de enrutamiento de Virtual WAN", + "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", + "waf": "Operaciones" }, { - "checklist": "Azure Bot Service", - "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", - "service": "Bot service", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "severity": "Medio", - "text": "Azure Bot Service se ejecuta en modo activo-activo para los servicios globales y regionales. Cuando se produce una interrupción, no es necesario detectar errores ni administrar el servicio. Azure Bot Service realiza automáticamente la conmutación por error y la recuperación automáticas en una arquitectura geográfica de varias regiones. En el caso del servicio regional de bots de la UE, Azure Bot Service proporciona dos regiones completas dentro de Europa con replicación activa/activa para garantizar la redundancia. En el caso del servicio de bot global, todas las regiones o zonas geográficas disponibles se pueden servir como superficie global.", - "waf": "Fiabilidad" + "text": "Use un centro de conectividad de Virtual WAN por región de Azure para conectar varias zonas de aterrizaje entre sí en las regiones de Azure a través de una instancia global común de Azure Virtual WAN.", + "waf": "Rendimiento" }, { - "checklist": "Device Provisioning Service Review", - "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", - "service": "IoT Hub DPS", - "severity": "Alto", - "text": "Seleccione el plan de hospedaje de aplicaciones lógicas adecuado en función de los requisitos empresariales y de SLO", - "waf": "Fiabilidad" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "Bajo", + "text": "Siga el principio \"el tráfico de Azure permanece en Azure\" para que la comunicación entre los recursos de Azure se produzca a través de la red troncal de Microsoft", + "waf": "Rendimiento" }, { - "checklist": "Device Provisioning Service Review", - "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "IoT Hub DPS", - "severity": "Alto", - "text": "Proteja las aplicaciones lógicas de errores de región con redundancia de zona y zonas de disponibilidad", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", + "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "Medio", + "text": "Para la protección y el filtrado del tráfico de Internet saliente, implemente Azure Firewall en centros seguros", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Seguridad" + }, + { + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "VWAN", + "severity": "Medio", + "text": "Asegúrese de que la arquitectura de red está dentro de los límites de Azure Virtual WAN.", "waf": "Fiabilidad" }, { - "checklist": "Device Provisioning Service Review", - "guid": "8aed4fbf-0830-4883-899d-222a154af478", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "IoT Hub DPS", - "severity": "Alto", - "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", + "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", + "service": "VWAN", + "severity": "Medio", + "text": "Use Azure Monitor Insights para Virtual WAN para supervisar la topología de un extremo a otro de Virtual WAN, el estado y las métricas clave.", + "waf": "Operaciones" + }, + { + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", + "service": "VWAN", + "severity": "Medio", + "text": "Asegúrese de que las implementaciones de IaC no deshabiliten el tráfico de sucursal a sucursal en Virtual WAN, a menos que estos flujos se bloqueen explícitamente.", "waf": "Fiabilidad" }, { - "checklist": "Device Provisioning Service Review", - "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "IoT Hub DPS", - "severity": "Alto", - "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", + "service": "VWAN", + "severity": "Medio", + "text": "Use AS-Path como preferencia de enrutamiento del centro, ya que es más flexible que ExpressRoute o VPN.", "waf": "Fiabilidad" }, { - "checklist": "Device Provisioning Service Review", - "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "IoT Hub DPS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", + "service": "VWAN", "severity": "Medio", - "text": "Aproveche Azure DevOps o GitHub para simplificar la CI/CD y proteger el código de la aplicación lógica", - "waf": "Operaciones" + "text": "Asegúrese de que las implementaciones de IaC configuran la propagación basada en etiquetas en Virtual WAN, de lo contrario, la conectividad entre los centros virtuales se verá afectada.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Function Review", - "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", + "ammp": true, + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "9c75dfef-573c-461c-a698-68598595581a", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", + "service": "VWAN", "severity": "Alto", - "text": "Seleccione el plan de hospedaje de funciones adecuado en función de los requisitos de su empresa y SLO", + "text": "Asigne suficiente espacio IP a los centros virtuales, idealmente un prefijo /23.", "waf": "Fiabilidad" }, { - "checklist": "Azure Function Review", - "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "Alto", - "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente (no disponible para el nivel de consumo)", - "waf": "Fiabilidad" + "text": "Aproveche Azure Policy estratégicamente, defina controles para su entorno y use iniciativas de directivas para agrupar directivas relacionadas.", + "waf": "Seguridad" }, { - "checklist": "Azure Function Review", - "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", - "service": "Azure Functions", + "checklist": "Azure Landing Zone Review", + "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "Medio", - "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas", - "waf": "Fiabilidad" + "text": "Asigne los requisitos normativos y de cumplimiento normativo a las definiciones de Azure Policy y a las asignaciones de roles de Azure.", + "waf": "Seguridad" }, { - "checklist": "Azure Function Review", - "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Azure Functions", - "severity": "Alto", - "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "223ace8c-b123-408c-a501-7f154e3ab369", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "Medio", + "text": null, + "waf": "Seguridad" }, { - "checklist": "Azure Function Review", - "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "Azure Functions", - "severity": "Alto", - "text": "Asegúrese de que \"Siempre activado\" esté habilitado para todas las aplicaciones de funciones que se ejecutan en el plan de App Service", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "3829e7e3-1618-4368-9a04-77a209945bda", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "Medio", + "text": "Administre las asignaciones de directivas en el nivel más alto adecuado con exclusiones en los niveles inferiores, si es necesario.", + "waf": "Seguridad" }, { - "checklist": "Azure Function Review", - "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", - "service": "Azure Functions", + "checklist": "Azure Landing Zone Review", + "guid": "43334f24-9116-4341-a2ba-527526944008", + "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", + "service": "Policy", + "severity": "Bajo", + "text": "Use Azure Policy para controlar qué servicios pueden aprovisionar los usuarios en el nivel de suscripción o grupo de administración", + "waf": "Seguridad" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "Medio", - "text": "Empareje una aplicación de funciones con su propia cuenta de almacenamiento. Intente no volver a usar las cuentas de almacenamiento para las aplicaciones de funciones a menos que estén estrechamente acopladas", - "waf": "Fiabilidad" + "text": null, + "waf": null }, { - "checklist": "Azure Function Review", - "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "Azure Functions", + "checklist": "Azure Landing Zone Review", + "description": "La asignación del rol Colaborador de directivas de recursos a ámbitos específicos le permite delegar la administración de directivas a los equipos pertinentes. Por ejemplo, un equipo de TI central puede supervisar las directivas a nivel de grupo de administración, mientras que los equipos de aplicaciones se encargan de las directivas de sus suscripciones, lo que permite la gobernanza distribuida con el cumplimiento de los estándares de la organización.", + "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", + "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", + "service": "Policy", "severity": "Medio", - "text": "Aproveche Azure DevOps o GitHub para optimizar la CI/CD y proteger el código de la aplicación de funciones", - "waf": "Operaciones" + "text": "Asigne el rol integrado Colaborador de directivas de recursos en un ámbito determinado para habilitar la gobernanza de nivel de aplicación.", + "waf": null }, { - "checklist": "Identity Review Checklist", - "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", - "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", - "service": "Entra", + "checklist": "Azure Landing Zone Review", + "guid": "19048384-5c98-46cb-8913-156a12476e49", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "Medio", - "text": "Use el token revocable de larga duración, almacene en caché el token y adquiera el token de forma silenciosa mediante la biblioteca de identidades de Microsoft", - "waf": "Fiabilidad" + "text": "Limite el número de asignaciones de Azure Policy realizadas en el ámbito del grupo de administración raíz para evitar la administración a través de exclusiones en ámbitos heredados.", + "waf": null }, { - "checklist": "Identity Review Checklist", - "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", - "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", - "service": "AAD B2C", + "checklist": "Azure Landing Zone Review", + "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", + "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", + "service": "Policy", "severity": "Medio", - "text": "Asegúrese de que los flujos de usuario de inicio de sesión estén respaldados y sean resistentes. Asegúrese de que se ha realizado una copia de seguridad del código que usa para iniciar sesión en los usuarios y se puede recuperar. Interfaces resilientes con procesos externos", - "waf": "Fiabilidad" + "text": "Si existen requisitos de soberanía de datos, se pueden implementar directivas de Azure para aplicarlos", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "waf": "Seguridad" }, { - "checklist": "Identity Review Checklist", - "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", - "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", - "service": "AAD B2C", + "checklist": "Azure Landing Zone Review", + "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", + "service": "Policy", "severity": "Medio", - "text": "Los activos de marca personalizados deben estar alojados en una CDN", - "waf": "Rendimiento" + "text": "En el caso de la Zona de Aterrizaje Soberana, la iniciativa política de referencia de la política de soberanía se despliega y asigna al nivel correcto de MG.", + "waf": null }, { - "checklist": "Identity Review Checklist", - "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", - "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", - "service": "AAD B2C", - "severity": "Bajo", - "text": "Tener varios proveedores de identidad (es decir, iniciar sesión con sus cuentas de Microsoft, Google, Facebook)", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", + "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", + "service": "Policy", + "severity": null, + "text": "En el caso de la Zona de Aterrizaje Soberana, se documentan los objetivos de control soberano para el mapeo de políticas.", + "waf": "Seguridad" }, { - "checklist": "Identity Review Checklist", - "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure Landing Zone Review", + "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", + "service": "Policy", "severity": "Medio", - "text": "Siga las reglas de la máquina virtual para la alta disponibilidad en el nivel de máquina virtual (discos premium, dos o más en una región, en diferentes zonas de disponibilidad)", - "waf": "Fiabilidad" + "text": "En el caso de la Zona de Aterrizaje Soberana, existe un proceso para el CRUD de \"Objetivos de Control Soberano para el mapeo de políticas\".", + "waf": "Seguridad" }, { - "checklist": "Identity Review Checklist", - "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure Landing Zone Review", + "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "severity": "Medio", - "text": "¡No repliques! La replicación puede crear problemas con la sincronización de directorios", - "waf": "Fiabilidad" + "text": null, + "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "waf": "Operaciones" }, { - "checklist": "Identity Review Checklist", - "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure Landing Zone Review", + "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Monitor", "severity": "Medio", - "text": "Tener activo-activo para varias regiones", - "waf": "Fiabilidad" + "text": "Exporte los registros a Azure Storage si los requisitos de retención de registros superan los doce años. Use el almacenamiento inmutable con una directiva de escritura única y lectura múltiple para que los datos no se puedan borrar ni modificar durante un intervalo especificado por el usuario.", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": null }, { - "checklist": "Identity Review Checklist", - "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", + "checklist": "Azure Landing Zone Review", + "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", + "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", + "service": "VM", "severity": "Medio", - "text": "Adición de stamps de servicio de dominio de Azure AD a regiones y ubicaciones adicionales", - "waf": "Fiabilidad" + "text": "Supervise el desfase de configuración de la máquina virtual (VM) a nivel de sistema operativo mediante Azure Policy. La habilitación de las funcionalidades de auditoría de Azure Automanage Machine Configuration a través de la directiva ayuda a las cargas de trabajo del equipo de aplicaciones a consumir inmediatamente las funcionalidades de características con poco esfuerzo.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Operaciones" }, { - "checklist": "Identity Review Checklist", - "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", + "checklist": "Azure Landing Zone Review", + "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "severity": "Medio", - "text": "Uso de conjuntos de réplicas para recuperación ante desastres", - "waf": "Fiabilidad" + "text": "Use Azure Update Manager como mecanismo de aplicación de revisiones para máquinas virtuales Windows y Linux en Azure.", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "Operaciones" }, { - "checklist": "MySQL Review Checklist", - "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", - "service": "Azure MySQL", + "checklist": "Azure Landing Zone Review", + "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "severity": "Medio", - "text": "Aproveche el servidor flexible", - "waf": "Fiabilidad" + "text": null, + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "Operaciones" }, { - "checklist": "MySQL Review Checklist", - "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", - "service": "Azure MySQL", - "severity": "Alto", - "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "90483845-c986-4cb2-a131-56a12476e49f", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Network Watcher", + "severity": "Medio", + "text": "Utilice Network Watcher para supervisar de forma proactiva los flujos de tráfico", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "Operaciones" }, { - "checklist": "MySQL Review Checklist", - "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", - "service": "Azure MySQL", + "checklist": "Azure Landing Zone Review", + "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Monitor", + "severity": "Medio", + "text": "Use los registros de Azure Monitor para obtener información e informes.", + "waf": "Operaciones" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "97be9951-9048-4384-9c98-6cb2913156a1", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", + "service": "Monitor", + "severity": null, + "text": null, + "waf": "Operaciones" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "Monitor", "severity": "Medio", - "text": "Aproveche la replicación de entrada de datos para escenarios de recuperación ante desastres entre regiones", - "waf": "Fiabilidad" + "text": "Al usar el seguimiento de cambios e inventario a través de cuentas de Azure Automation, asegúrese de que ha seleccionado las regiones admitidas para vincular el área de trabajo de Log Analytics y las cuentas de automatización.", + "waf": "Operaciones" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", - "service": "Azure Data Factory", + "checklist": "Azure Landing Zone Review", + "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Backup", "severity": "Medio", - "text": "Aproveche el cuaderno de estrategias de resistencia de FTA para Azure Data Factory", + "text": "Al usar Azure Backup, tenga en cuenta los diferentes tipos de copia de seguridad (GRS, ZRS Y LRS), ya que la configuración predeterminada es GRS", "waf": "Fiabilidad" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", - "severity": "Alto", - "text": "Uso de canalizaciones con redundancia de zona en regiones que admiten zonas de disponibilidad", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "VM", + "severity": "Medio", + "text": "Use directivas de Azure para implementar automáticamente configuraciones de software a través de extensiones de máquina virtual y aplicar una configuración de máquina virtual de línea base compatible.", + "waf": "Seguridad" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", - "link": "https://learn.microsoft.com/azure/data-factory/source-control", - "service": "Azure Data Factory", + "checklist": "Azure Landing Zone Review", + "description": "Las características de configuración de invitado de Azure Policy pueden auditar y corregir la configuración de la máquina (por ejemplo, el sistema operativo, la aplicación, el entorno) para asegurarse de que los recursos se alinean con las configuraciones esperadas, y Update Management puede aplicar la administración de revisiones para las máquinas virtuales.", + "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "VM", "severity": "Medio", - "text": "Uso de DevOps para realizar copias de seguridad de las plantillas de ARM con la integración de Github/Azure DevOps ", - "waf": "Fiabilidad" + "text": "Supervise el desfase de la configuración de seguridad de la máquina virtual a través de Azure Policy.", + "waf": "Seguridad" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "checklist": "Azure Landing Zone Review", + "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", "severity": "Medio", - "text": "Asegúrese de replicar las máquinas virtuales de Integration Runtime autohospedadas en otra región ", - "waf": "Fiabilidad" + "text": "Use Azure Site Recovery para escenarios de recuperación ante desastres de Azure a Azure Virtual Machines. Esto le permite replicar cargas de trabajo en todas las regiones.", + "waf": "Operaciones" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "checklist": "Azure Landing Zone Review", + "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "Backup", "severity": "Medio", - "text": "Asegúrese de replicar o duplicar la red en la región hermana. Tiene que hacer una copia de la red virtual en otra región", - "waf": "Fiabilidad" + "text": "Use funcionalidades de copia de seguridad nativas de Azure o una solución de copia de seguridad de terceros compatible con Azure.", + "waf": "Operaciones" }, { - "checklist": "Azure Data Factory Review Checklist", - "description": "Si las canalizaciones de ADF usan Key Vault, no tiene que hacer nada para replicar Key Vault. Key Vault es un servicio administrado y Microsoft se encarga de ello por ti", - "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Azure Data Factory", - "severity": "Bajo", - "text": "Si utiliza la integración de Keyvault, utilice el Acuerdo de Nivel de Servicio de Keyvault para comprender su disponibilidad", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", + "severity": "Alto", + "text": "Aproveche las zonas de disponibilidad para las máquinas virtuales en las regiones en las que se admiten.", "waf": "Fiabilidad" }, { - "checklist": "Redis Resiliency checklist", - "guid": "65285269-440b-44be-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", - "service": "Redis", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", "severity": "Alto", - "text": "Habilite la redundancia de zona para Azure Cache for Redis. Azure Cache for Redis admite configuraciones con redundancia de zona en los niveles Premium y Enterprise. Una caché con redundancia de zona puede colocar sus nodos en diferentes zonas de disponibilidad de Azure en la misma región. Elimina la interrupción del centro de datos o de la zona de disponibilidad como único punto de error y aumenta la disponibilidad general de la memoria caché.", + "text": "Evite ejecutar una carga de trabajo de producción en una sola máquina virtual.", "waf": "Fiabilidad" }, { - "checklist": "Redis Resiliency checklist", - "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", - "service": "Redis", + "checklist": "Azure Landing Zone Review", + "guid": "84101f59-1941-4195-a270-e28034290e3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", "severity": "Medio", - "text": "Configure la persistencia de datos para una instancia de Azure Cache for Redis. Dado que los datos de caché se almacenan en la memoria, un error poco frecuente y no planeado de varios nodos puede hacer que se eliminen todos los datos. Para evitar la pérdida completa de datos, la persistencia de Redis permite tomar instantáneas periódicas de los datos en memoria y almacenarlas en la cuenta de almacenamiento.", + "text": "Azure Load Balancer y Application Gateway distribuyen el tráfico de red entrante entre varios recursos.", "waf": "Fiabilidad" }, { - "checklist": "Redis Resiliency checklist", - "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", - "service": "Redis", - "severity": "Medio", - "text": "Use una cuenta de almacenamiento con redundancia geográfica para conservar los datos de Azure Cache for Redis o con redundancia zonal donde la redundancia geográfica no esté disponible", - "waf": "Fiabilidad" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "WAF", + "severity": "Alto", + "text": "Agregue la configuración de diagnóstico para guardar los registros de WAF de los servicios de entrega de aplicaciones, como Azure Front Door y Azure Application Gateway. Revise periódicamente los registros para comprobar si hay ataques y detecciones de falsos positivos.", + "waf": "Operaciones" }, { - "checklist": "Redis Resiliency checklist", - "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", - "service": "Redis", + "checklist": "Azure Landing Zone Review", + "guid": "7f408960-c626-44cb-a018-347c8d790cdf", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "WAF", "severity": "Medio", - "text": "Configure la replicación geográfica pasiva para instancias de Azure Cache for Redis Premium. La replicación geográfica es un mecanismo para vincular dos o más instancias de Azure Cache for Redis, que normalmente abarcan dos regiones de Azure. La replicación geográfica está diseñada principalmente para la recuperación ante desastres entre regiones. Dos instancias de caché de nivel Premium se conectan a través de la replicación geográfica de una manera que proporciona lecturas y escrituras en la caché principal, y esos datos se replican en la caché secundaria.", - "waf": "Fiabilidad" + "text": "Envíe registros de WAF desde los servicios de entrega de aplicaciones, como Azure Front Door y Azure Application Gateway, a Microsoft Sentinel. Detecte ataques e integre la telemetría de WAF en su entorno general de Azure.", + "waf": "Operaciones" }, { - "checklist": "IoT Hub Review", - "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", - "service": "IoT", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "5017f154-e3ab-4369-9829-e7e316183687", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "Key Vault", "severity": "Alto", - "text": "Aproveche las zonas de disponibilidad si corresponden regionalmente (esto se habilita automáticamente)", - "waf": "Fiabilidad" + "text": "Uso de Azure Key Vault para almacenar los secretos y las credenciales", + "waf": "Seguridad" }, { - "checklist": "IoT Hub Review", - "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", + "checklist": "Azure Landing Zone Review", + "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", + "guid": "a0477a20-9945-4bda-9333-4f2491163418", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", + "service": "Key Vault", "severity": "Medio", - "text": "Tenga en cuenta las conmutaciones por error iniciadas por Microsoft. Microsoft los ejerce en situaciones excepcionales para conmutar por error todos los centros de IoT de una región afectada a la región emparejada geográficamente correspondiente.", - "waf": "Fiabilidad" + "text": "Use diferentes instancias de Azure Key Vaults para diferentes aplicaciones y regiones para evitar límites de escala de transacciones y restringir el acceso a los secretos.", + "waf": "Seguridad" }, { - "checklist": "IoT Hub Review", - "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", - "service": "IoT", - "severity": "Alto", - "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "Medio", + "text": "Aprovisione Azure Key Vault con las directivas de eliminación temporal y purga habilitadas para permitir la protección de retención de los objetos eliminados.", + "waf": "Seguridad" }, { - "checklist": "IoT Hub Review", - "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "severity": "Alto", - "text": "Obtenga información sobre cómo desencadenar una conmutación por error manual.", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "dc055bcf-619e-48a1-9f98-879525d62688", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "Medio", + "text": "Siga un modelo de privilegios mínimos limitando la autorización para eliminar claves, secretos y certificados de forma permanente a roles de identificador personalizados especializados de Microsoft Entra.", + "waf": "Seguridad" }, { - "checklist": "IoT Hub Review", - "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", - "service": "IoT", - "severity": "Alto", - "text": "Obtenga información sobre cómo conmutar por recuperación después de una conmutación por error.", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "Medio", + "text": "Automatice el proceso de gestión y renovación de certificados con autoridades de certificación públicas para facilitar la administración.", + "waf": "Seguridad" }, { - "checklist": "Azure Spring Apps Review", - "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", - "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "913156a1-2476-4e49-b541-acdce979377b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medio", - "text": "Azure Spring Apps permite dos implementaciones para cada aplicación, de las cuales solo una recibe tráfico de producción. Puede lograr cero tiempo de inactividad con estrategias de implementación azul verde. La implementación azul verde solo está disponible en los niveles Estándar y Enterprise. Puede automatizar la implementación mediante CI/CD con acciones de ADO/GitHub", - "waf": "Fiabilidad" + "text": "Establezca un proceso automatizado para la rotación de claves y certificados.", + "waf": "Seguridad" }, { - "checklist": "Azure Spring Apps Review", - "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", - "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medio", - "text": "Las instancias de Azure Spring Apps se pueden crear en varias regiones para las aplicaciones y el tráfico se puede enrutar mediante Traffic Manager o Front Door.", - "waf": "Fiabilidad" + "text": "Habilite el firewall y el punto de conexión de servicio de red virtual o el punto de conexión privado en el almacén para controlar el acceso al almacén de claves.", + "waf": "Seguridad" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", - "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", + "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", + "service": "Key Vault", "severity": "Medio", - "text": "En la región admitida, Azure Spring Apps se puede implementar como zona redundante, lo que significa que las instancias se distribuyen automáticamente entre las zonas de disponibilidad. Esta función solo está disponible en los niveles Standard y Enterprise.", - "waf": "Fiabilidad" + "text": "Use el área de trabajo de Log Analytics de Azure Monitor central de la plataforma para auditar el uso de claves, certificados y secretos en cada instancia de Key Vault.", + "waf": "Seguridad" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", - "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medio", - "text": "Usar más de 1 instancia de aplicación para las aplicaciones", - "waf": "Fiabilidad" + "text": "Delegue la creación de instancias de Key Vault y el acceso con privilegios, y use Azure Policy para aplicar una configuración coherente y compatible.", + "waf": "Seguridad" }, { - "checklist": "Azure Spring Apps Review", - "guid": "7504c230-6035-4183-95a5-85762acc6075", - "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", - "service": "Spring Apps", - "severity": "Medio", - "text": "Supervise Azure Spring Apps con registros, métricas y seguimiento. Integre ASA con la información de las aplicaciones, realice un seguimiento de los errores y cree libros de trabajo.", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "91163418-2ba5-4275-8694-4008be7d7e48", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "Medio", + "text": "Use una instancia de Azure Key Vault por aplicación, por entorno, por región.", + "waf": "Seguridad" }, { - "checklist": "Azure Spring Apps Review", - "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "25d62688-6d70-4ba6-a97b-e99519048384", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "Medio", - "text": "Configuración del escalado automático en Spring Cloud Gateway", - "waf": "Fiabilidad" + "text": "Si desea traer sus propias claves, es posible que esto no sea compatible con todos los servicios considerados. Implemente la mitigación pertinente para que las inconsistencias no obstaculicen los resultados deseados. Elija los pares de regiones y las regiones de recuperación ante desastres adecuados que minimicen la latencia.", + "waf": "Seguridad" }, { - "checklist": "Azure Spring Apps Review", - "guid": "97411607-b6fd-4335-99d1-9885faf4e392", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", - "service": "Spring Apps", - "severity": "Bajo", - "text": "Habilite el escalado automático para las aplicaciones con el consumo estándar y el plan dedicado.", - "waf": "Fiabilidad" + "checklist": "Azure Landing Zone Review", + "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", + "link": "https://learn.microsoft.com/industry/sovereignty/key-management", + "service": "Key Vault", + "severity": "Medio", + "text": "En el caso de la zona de aterrizaje soberana, use el HSM administrado de Azure Key Vault para almacenar los secretos y las credenciales.", + "waf": "Seguridad" }, { - "checklist": "Azure Spring Apps Review", - "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", - "link": "https://learn.microsoft.com/azure/spring-apps/overview", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", + "service": "Entra", "severity": "Medio", - "text": "Use el plan Enterprise para obtener soporte comercial de Spring Boot para aplicaciones de misión crítica. Con otros niveles, obtienes soporte OSS.", - "waf": "Fiabilidad" + "text": "Use las funcionalidades de informes de Microsoft Entra ID para generar informes de auditoría de control de acceso.", + "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Aplicación de las instrucciones de la prueba comparativa de seguridad en la nube de Microsoft relacionadas con el almacenamiento", - "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", - "service": "Azure Storage", - "severity": "Medio", - "text": "Tenga en cuenta la \"línea base de seguridad de Azure para el almacenamiento\"", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "09945bda-4333-44f2-9911-634182ba5275", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", + "service": "Defender", + "severity": "Alto", + "text": "Habilite la administración de la posición de seguridad en la nube de Defender para todas las suscripciones.", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "De forma predeterminada, Azure Storage tiene una dirección IP pública y es accesible desde Internet. Los puntos de conexión privados permiten exponer de forma segura Azure Storage solo a los recursos de proceso de Azure que necesitan acceso, lo que elimina la exposición a la Internet pública", - "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", + "service": "Defender", "severity": "Alto", - "text": "Considere la posibilidad de usar puntos de conexión privados para Azure Storage", + "text": "Habilite un plan de protección de cargas de trabajo en la nube de Defender para servidores en todas las suscripciones.", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Las cuentas de almacenamiento recién creadas se crean mediante el modelo de implementación de ARM, de modo que RBAC, auditoría, etc. están habilitados. Asegúrese de que no hay cuentas de almacenamiento antiguas con el modelo de implementación clásica en una suscripción", - "guid": "30e37c3e-2971-41b2-963c-eee079b598de", - "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", - "service": "Azure Storage", - "severity": "Medio", - "text": "Asegúrese de que las cuentas de almacenamiento más antiguas no usan el \"modelo de implementación clásica\"", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", + "service": "Defender", + "severity": "Alto", + "text": "Habilite los planes de protección de cargas de trabajo en la nube de Defender para recursos de Azure en todas las suscripciones.", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Aproveche Microsoft Defender para obtener información sobre la actividad sospechosa y los errores de configuración.", - "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", - "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", + "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", + "service": "VM", "severity": "Alto", - "text": "Habilitación de Microsoft Defender para todas las cuentas de almacenamiento", + "text": "Habilite Endpoint Protection en servidores IaaS.", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "El mecanismo de eliminación temporal permite recuperar blobs eliminados accidentalmente.", - "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", + "link": "https://learn.microsoft.com/azure/security-center/", + "service": "VM", "severity": "Medio", - "text": "Habilitación de la \"eliminación temporal\" para blobs", + "text": "Supervise el desfase de revisiones del sistema operativo base a través de los registros de Azure Monitor y Defender for Cloud.", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Considere la posibilidad de deshabilitar de forma selectiva la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimina inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ", - "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "severity": "Medio", - "text": "Deshabilitación de la \"eliminación temporal\" de blobs", + "text": "Conecte las configuraciones de recursos predeterminadas a un área de trabajo centralizada de Log Analytics de Azure Monitor.", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "La eliminación temporal de contenedores permite recuperar un contenedor después de que se haya eliminado, por ejemplo, recuperarse de una operación de eliminación accidental.", - "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", - "service": "Azure Storage", - "severity": "Alto", - "text": "Habilitación de la \"eliminación temporal\" para los contenedores", + "checklist": "Azure Landing Zone Review", + "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", + "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", + "service": "Entra", + "severity": "Medio", + "text": "En el caso de la zona de aterrizaje soberana, los registros de transparencia están habilitados en el inquilino de Entra ID.", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Considere la posibilidad de deshabilitar de forma selectiva la \"eliminación temporal\" para determinados contenedores de blobs, por ejemplo, si la aplicación debe asegurarse de que la información eliminada se elimina inmediatamente, por ejemplo, por motivos de confidencialidad, privacidad o cumplimiento. ", - "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", + "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", + "service": "Entra", "severity": "Medio", - "text": "Deshabilitación de la \"eliminación temporal\" para contenedores", + "text": "En el caso de la zona de aterrizaje soberana, la caja de seguridad del cliente está habilitada en el inquilino de Entra ID.", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Evita la eliminación accidental de una cuenta de almacenamiento, obligando al usuario a quitar primero el bloqueo de eliminación, antes de la eliminación", - "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Storage", "severity": "Alto", - "text": "Habilitación de bloqueos de recursos en cuentas de almacenamiento", + "text": "La transferencia segura a cuentas de almacenamiento debe estar habilitada", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Considere la posibilidad de aplicar directivas de \"retención legal\" o \"retención basada en el tiempo\" para los blobs, de modo que sea imposible eliminar el blob, el contenedor o la cuenta de almacenamiento. Tenga en cuenta que 'imposible' en realidad significa 'imposible'; una vez que una cuenta de almacenamiento contiene un blob inmutable, la única manera de \"deshacerse\" de esa cuenta de almacenamiento es cancelando la suscripción de Azure.", - "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", - "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", + "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", + "service": "Storage", "severity": "Alto", - "text": "Considere la posibilidad de blobs inmutables", + "text": "Habilite la eliminación temporal del contenedor para que la cuenta de almacenamiento recupere un contenedor eliminado y su contenido.", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Considere la posibilidad de deshabilitar el acceso HTTP/80 sin protección a la cuenta de almacenamiento, de modo que todas las transferencias de datos estén cifradas, protegidas por integridad y el servidor esté autenticado. ", - "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", + "service": "Key Vault", "severity": "Alto", - "text": "Requerir HTTPS, es decir, deshabilitar el puerto 80 en la cuenta de almacenamiento", - "waf": "Seguridad" + "text": "Use secretos de Key Vault para evitar codificar de forma rígida información confidencial, como credenciales (máquinas virtuales, contraseñas de usuario), certificados o claves.", + "waf": "Operaciones" }, { - "checklist": "Azure Blob Storage Review", - "description": "Al configurar un dominio personalizado (nombre de host) en una cuenta de almacenamiento, compruebe si necesita TLS/HTTPS; si es así, es posible que tenga que colocar Azure CDN delante de la cuenta de almacenamiento.", - "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", - "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", - "service": "Azure Storage", - "severity": "Alto", - "text": "Al aplicar HTTPS (deshabilitar HTTP), compruebe que no usa dominios personalizados (CNAME) para la cuenta de almacenamiento.", - "waf": "Seguridad" + "checklist": "Azure API Management Review", + "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", + "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", + "service": "APIM", + "severity": "Medio", + "text": "Implementar una política de control de errores a nivel global", + "waf": "Operaciones" }, { - "checklist": "Azure Blob Storage Review", - "description": "Requerir HTTPS cuando un cliente usa un token de SAS para acceder a los datos de blobs ayuda a minimizar el riesgo de pérdida de credenciales.", - "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", + "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", + "service": "APIM", "severity": "Medio", - "text": "Limitar los tokens de firma de acceso compartido (SAS) solo a las conexiones HTTPS", - "waf": "Seguridad" + "text": "Asegúrese de que todas las políticas de API incluyan un elemento.", + "waf": "Operaciones" }, { - "checklist": "Azure Blob Storage Review", - "description": "Los tokens de AAD deben favorecerse sobre las firmas de acceso compartido, siempre que sea posible", - "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", - "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", + "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", + "service": "APIM", + "severity": "Medio", + "text": "Uso de fragmentos de políticas para evitar repetir las mismas definiciones de políticas en varias API", + "waf": "Operaciones" + }, + { + "checklist": "Azure API Management Review", + "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", + "link": "https://learn.microsoft.com/azure/api-management/monetization-support", + "service": "APIM", + "severity": "Medio", + "text": "Si planeas monetizar tus API, revisa el artículo \"Soporte de monetización\" para conocer las prácticas recomendadas", + "waf": "Operaciones" + }, + { + "checklist": "Azure API Management Review", + "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", + "service": "APIM", "severity": "Alto", - "text": "Uso de tokens de Azure Active Directory (Azure AD) para el acceso a blobs", - "waf": "Seguridad" + "text": "Habilitación de la configuración de diagnóstico para exportar registros a Azure Monitor", + "waf": "Operaciones" }, { - "checklist": "Azure Blob Storage Review", - "description": "Al asignar un rol a un usuario, grupo o aplicación, conceda a esa entidad de seguridad solo los permisos necesarios para que pueda realizar sus tareas. Limitar el acceso a los recursos ayuda a evitar el uso indebido no intencionado y malintencionado de los datos.", - "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", + "service": "APIM", "severity": "Medio", - "text": "Privilegios mínimos en los permisos de IaM", - "waf": "Seguridad" + "text": "Habilitación de Application Insights para obtener telemetría más detallada", + "waf": "Operaciones" }, { - "checklist": "Azure Blob Storage Review", - "description": "Una SAS de delegación de usuarios está protegida con credenciales de Azure Active Directory (Azure AD) y también con los permisos especificados para la SAS. Una SAS de delegación de usuarios es análoga a una SAS de servicio en cuanto a su ámbito y función, pero ofrece ventajas de seguridad sobre la SAS de servicio. ", - "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", + "service": "APIM", "severity": "Alto", - "text": "Al usar SAS, prefiera \"SAS de delegación de usuarios\" en lugar de SAS basada en claves de cuenta de almacenamiento.", - "waf": "Seguridad" + "text": "Configurar alertas sobre las métricas más críticas", + "waf": "Operaciones" }, { - "checklist": "Azure Blob Storage Review", - "description": "Las claves de la cuenta de almacenamiento (\"claves compartidas\") tienen muy pocas funcionalidades de auditoría. Si bien se puede monitorear quién o cuándo obtuvo una copia de las claves, una vez que las claves están en manos de varias personas, es imposible atribuir el uso a un usuario específico. Confiar únicamente en la autenticación de AAD facilita la vinculación del acceso al almacenamiento a un usuario. ", - "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", - "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", + "service": "APIM", "severity": "Alto", - "text": "Considere la posibilidad de deshabilitar las claves de la cuenta de almacenamiento, de modo que solo se admita el acceso a AAD (y la SAS de delegación de usuarios).", + "text": "Asegúrese de que los certificados SSL personalizados se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Use los datos del registro de actividad para identificar \"cuándo\", \"quién\", \"qué\" y \"cómo\" se está viendo o cambiando la seguridad de la cuenta de almacenamiento (es decir, claves de cuenta de almacenamiento, directivas de acceso, etc.).", - "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", - "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", + "service": "APIM", "severity": "Alto", - "text": "Considere la posibilidad de usar Azure Monitor para auditar las operaciones del plano de control en la cuenta de almacenamiento", + "text": "Protección de las solicitudes entrantes a las API (plano de datos) con Azure AD", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Una directiva de expiración de claves le permite establecer un recordatorio para la rotación de las claves de acceso a la cuenta. El recordatorio se muestra si ha transcurrido el intervalo especificado y las teclas aún no se han girado.", - "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", + "service": "APIM", "severity": "Medio", - "text": "Al usar claves de cuenta de almacenamiento, considere la posibilidad de habilitar una \"directiva de expiración de claves\"", + "text": "Usar el identificador de Microsoft Entra para autenticar a los usuarios en el Portal para desarrolladores", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Una directiva de expiración de SAS especifica un intervalo recomendado durante el cual la SAS es válida. Las directivas de expiración de SAS se aplican a una SAS de servicio o a una SAS de cuenta. Cuando un usuario genera una SAS de servicio o una SAS de cuenta con un intervalo de validez mayor que el intervalo recomendado, verá una advertencia.", - "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", - "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", + "service": "APIM", "severity": "Medio", - "text": "Considere la posibilidad de configurar una directiva de expiración de SAS", + "text": "Crear grupos adecuados para controlar la visibilidad de los productos", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Las directivas de acceso almacenadas ofrecen la opción de revocar los permisos de una SAS de servicio sin tener que volver a generar las claves de la cuenta de almacenamiento. ", - "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", - "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "06862505-2d9a-4874-9491-2837b00a3475", + "link": "https://learn.microsoft.com/azure/api-management/backends", + "service": "APIM", "severity": "Medio", - "text": "Considere la posibilidad de vincular SAS a una directiva de acceso almacenada", - "waf": "Seguridad" + "text": "Utilice la función Backends para eliminar las configuraciones redundantes de back-end de la API", + "waf": "Operaciones" }, { - "checklist": "Azure Blob Storage Review", - "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", - "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", + "service": "APIM", "severity": "Medio", - "text": "Considere la posibilidad de configurar el repositorio de código fuente de la aplicación para detectar cadenas de conexión protegidas y claves de cuenta de almacenamiento.", - "waf": "Seguridad" + "text": "Usar valores con nombre para almacenar valores comunes que se pueden usar en directivas", + "waf": "Operaciones" }, { - "checklist": "Azure Blob Storage Review", - "description": "Lo ideal es que la aplicación use una identidad administrada para autenticarse en Azure Storage. Si esto no es posible, considere la posibilidad de tener la credencial de almacenamiento (cadena de conexión, clave de cuenta de almacenamiento, SAS, credencial de entidad de servicio) en Azure KeyVault o un servicio equivalente.", - "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", - "service": "Azure Storage", - "severity": "Alto", - "text": "Considere la posibilidad de almacenar cadenas de conexión en Azure KeyVault (en escenarios en los que las identidades administradas no son posibles)", - "waf": "Seguridad" + "checklist": "Azure API Management Review", + "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", + "service": "APIM", + "severity": "Medio", + "text": "En el caso de la recuperación ante desastres, aproveche el nivel premium con implementaciones escaladas en dos o más regiones para un acuerdo de nivel de servicio del 99,99 %", + "waf": "Fiabilidad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Use los tiempos de expiración a corto plazo en una SAS de servicio SAS ad hoc o en una SAS de cuenta. De esta manera, incluso si una SAS se ve comprometida, es válida solo por un corto tiempo. Esta práctica es especialmente importante si no puede hacer referencia a una directiva de acceso almacenada. Los tiempos de expiración a corto plazo también limitan la cantidad de datos que se pueden escribir en un blob al limitar el tiempo disponible para cargarlo.", - "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", + "link": "https://learn.microsoft.com/azure/api-management/high-availability", + "service": "APIM", + "severity": "Medio", + "text": "Implemente al menos una unidad en dos o más zonas de disponibilidad para obtener un SLA aumentado del 99,99 %", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure API Management Review", + "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", + "service": "APIM", "severity": "Alto", - "text": "Esfuércese por obtener períodos de validez cortos para SAS ad-hoc", - "waf": "Seguridad" + "text": "Asegúrese de que haya una rutina de copia de seguridad automatizada", + "waf": "Fiabilidad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Al crear una SAS, sea lo más específico y restrictivo posible. Prefiera una SAS para un solo recurso y operación en lugar de una SAS que proporciona un acceso mucho más amplio.", - "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", + "link": "https://learn.microsoft.com/azure/api-management/retry-policy", + "service": "APIM", "severity": "Medio", - "text": "Aplicación de un ámbito limitado a una SAS", - "waf": "Seguridad" + "text": "Use directivas para agregar una dirección URL de back-end de conmutación por error y el almacenamiento en caché para reducir las llamadas con errores.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Una SAS puede incluir parámetros en los que las direcciones IP de cliente o los intervalos de direcciones están autorizados a solicitar un recurso mediante la SAS. ", - "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", - "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", + "service": "APIM", + "severity": "Bajo", + "text": "Si necesita iniciar sesión en niveles de alto rendimiento, tenga en cuenta la directiva de Event Hubs", + "waf": "Operaciones" + }, + { + "checklist": "Azure API Management Review", + "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", + "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", + "service": "APIM", "severity": "Medio", - "text": "Considere la posibilidad de definir el ámbito de SAS en una dirección IP de cliente específica, siempre que sea posible", - "waf": "Seguridad" + "text": "Aplicación de directivas de limitación para controlar el número de solicitudes por segundo", + "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", + "waf": "Rendimiento" }, { - "checklist": "Azure Blob Storage Review", - "description": "Una SAS no puede restringir la cantidad de datos que carga un cliente; Dado el modelo de precios de la cantidad de almacenamiento a lo largo del tiempo, podría tener sentido validar si los clientes cargaron contenido de gran tamaño malintencionado.", - "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", - "service": "Azure Storage", - "severity": "Bajo", - "text": "Considere la posibilidad de comprobar los datos cargados, después de que los clientes hayan usado una SAS para cargar un archivo. ", - "waf": "Seguridad" + "checklist": "Azure API Management Review", + "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", + "service": "APIM", + "severity": "Medio", + "text": "Configurar el escalado automático para escalar horizontalmente el número de instancias cuando aumenta la carga", + "waf": "Rendimiento" }, { - "checklist": "Azure Blob Storage Review", - "description": "Al acceder a Blob Storage a través de SFTP mediante una \"cuenta de usuario local\", no se aplican los controles RBAC \"habituales\". El acceso a blobs a través de NFS o REST puede ser más restrictivo que el acceso SFTP. Desafortunadamente, a partir de principios de 2023, los usuarios locales son la única forma de administración de identidades que actualmente se admite para el punto de conexión SFTP", - "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", - "service": "Azure Storage", - "severity": "Alto", - "text": "SFTP: Limite la cantidad de \"usuarios locales\" para el acceso SFTP y audite si el acceso es necesario a lo largo del tiempo.", - "waf": "Seguridad" + "checklist": "Azure API Management Review", + "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", + "service": "APIM", + "severity": "Medio", + "text": "Implemente puertas de enlace autohospedadas en las que Azure no tenga una región cercana a las API de back-end.", + "waf": "Rendimiento" }, { - "checklist": "Azure Blob Storage Review", - "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", + "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", + "service": "APIM", "severity": "Medio", - "text": "SFTP: El punto de conexión SFTP no admite ACL similares a POSIX.", - "waf": "Seguridad" + "text": "Use el nivel premium para las cargas de trabajo de producción.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Blob Storage Review", - "description": "El almacenamiento es compatible con CORS (Cross-Origin Resource Sharing), es decir, una función HTTP que permite a las aplicaciones web de un dominio diferente relajar la política del mismo origen. Al habilitar CORS, mantenga CorsRules con el mínimo privilegio.", - "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", - "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", + "service": "APIM", + "severity": "Medio", + "text": "En el modelo de varias regiones, use directivas para enrutar las solicitudes a los back-ends regionales en función de la disponibilidad o la latencia.", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure API Management Review", + "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", + "service": "APIM", "severity": "Alto", - "text": "Evite las políticas de CORS demasiado amplias", - "waf": "Seguridad" + "text": "Tenga en cuenta los límites de APIM", + "waf": "Fiabilidad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Los datos en reposo siempre están cifrados en el lado del servidor y, además, también pueden estar cifrados en el lado del cliente. El cifrado del lado del servidor puede realizarse mediante una clave administrada por la plataforma (predeterminada) o una clave administrada por el cliente. El cifrado del lado cliente puede producirse haciendo que el cliente proporcione una clave de cifrado y descifrado por blob a Azure Storage o controlando completamente el cifrado en el lado cliente. por lo tanto, no depende en absoluto de Azure Storage para obtener garantías de confidencialidad.", - "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", + "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", + "service": "APIM", "severity": "Alto", - "text": "Determine cómo se deben cifrar los datos en reposo. Comprender el modelo de subprocesos para los datos.", - "waf": "Seguridad" + "text": "Asegúrese de que las implementaciones de puerta de enlace autohospedadas sean resistentes.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Blob Storage Review", - "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", - "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "7519e385-a88b-4d34-966b-6269d686e890", + "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", + "service": "APIM", "severity": "Medio", - "text": "Determine qué cifrado de plataforma se debe usar o si se debe usar.", - "waf": "Seguridad" + "text": "Uso de Azure Front Door delante de APIM para la implementación en varias regiones", + "waf": "Rendimiento" }, { - "checklist": "Azure Blob Storage Review", - "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", - "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", - "service": "Azure Storage", + "checklist": "Azure API Management Review", + "guid": "cd45c90e-7690-4753-930b-bf290c69c074", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", + "service": "APIM", "severity": "Medio", - "text": "Determine qué cifrado del lado del cliente se debe usar o si.", + "text": "Implementación del servicio dentro de una red virtual (VNet)", "waf": "Seguridad" }, { - "checklist": "Azure Blob Storage Review", - "description": "Aproveche el Explorador de Resource Graph (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para buscar cuentas de almacenamiento que permitan el acceso anónimo a blobs.", - "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", - "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", - "service": "Azure Storage", - "severity": "Alto", - "text": "Considere si se necesita acceso público a blobs o si se puede deshabilitar para determinadas cuentas de almacenamiento. ", + "checklist": "Azure API Management Review", + "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", + "service": "APIM", + "severity": "Medio", + "text": "Implemente grupos de seguridad de red (NSG) en las subredes para restringir o supervisar el tráfico hacia/desde APIM.", "waf": "Seguridad" }, { - "checklist": "Logic Apps checklist", - "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", - "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", - "service": "Logic Apps", - "severity": "Alto", - "text": "Seleccione el plan de hospedaje de aplicaciones lógicas adecuado en función de los requisitos empresariales y de SLO", - "waf": "Fiabilidad" + "checklist": "Azure API Management Review", + "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", + "service": "APIM", + "severity": "Medio", + "text": "Implemente puntos de conexión privados para filtrar el tráfico entrante cuando APIM no se implemente en una red virtual.", + "waf": "Seguridad" }, { - "checklist": "Logic Apps checklist", - "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", - "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "Logic Apps", + "checklist": "Azure API Management Review", + "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", + "service": "APIM", "severity": "Alto", - "text": "Proteja las aplicaciones lógicas de errores de región con redundancia de zona y zonas de disponibilidad", - "waf": "Fiabilidad" + "text": "Deshabilitar el acceso a la red pública", + "waf": "Seguridad" }, { - "checklist": "Logic Apps checklist", - "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", - "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Logic Apps", - "severity": "Alto", - "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas", - "waf": "Fiabilidad" + "checklist": "Azure API Management Review", + "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", + "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", + "service": "APIM", + "severity": "Medio", + "text": "Simplifique la administración con scripts de automatización de PowerShell", + "waf": "Operaciones" }, { - "checklist": "Logic Apps checklist", - "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", - "link": "https://learn.microsoft.com/azure/app-service/environment/intro", - "service": "Logic Apps", - "severity": "Alto", - "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3", - "waf": "Fiabilidad" + "checklist": "Azure API Management Review", + "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", + "service": "APIM", + "severity": "Medio", + "text": "Configure APIM a través de la infraestructura como código. Revise las prácticas recomendadas de DevOps desde el acelerador de zonas de aterrizaje de API de Cloud Adaption Framework", + "waf": "Operaciones" }, { - "checklist": "Logic Apps checklist", - "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", - "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", - "service": "Logic Apps", + "checklist": "Azure API Management Review", + "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", + "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", + "service": "APIM", "severity": "Medio", - "text": "Aproveche Azure DevOps o GitHub para simplificar la CI/CD y proteger el código de la aplicación lógica", + "text": "Promover el uso de la extensión APIM de Visual Studio Code para un desarrollo de API más rápido", "waf": "Operaciones" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Front Door", + "checklist": "Azure API Management Review", + "guid": "354f1c03-8112-4965-85ad-c0074bddf231", + "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", + "service": "APIM", "severity": "Medio", - "text": "Si usa certificados TLS administrados por el cliente con Azure Front Door, use la versión de certificado \"más reciente\". Reduzca el riesgo de interrupciones causadas por la renovación manual de certificados", + "text": "Implemente DevOps y CI/CD en su flujo de trabajo", "waf": "Operaciones" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", - "guid": "553585a6-abe0-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "App Gateway", + "checklist": "Azure API Management Review", + "guid": "b6439493-426a-45f3-9697-cf65baee208d", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", + "service": "APIM", "severity": "Medio", - "text": "Asegúrese de que usa la SKU de Application Gateway v2", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "text": "API seguras mediante la autenticación de certificados de cliente", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", - "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Load Balancer", + "checklist": "Azure API Management Review", + "guid": "2a67d143-1033-4c0a-8732-680896478f08", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", + "service": "APIM", "severity": "Medio", - "text": "Asegúrese de que usa la SKU estándar para Azure Load Balancers", + "text": "Servicios de back-end seguros mediante la autenticación de certificados de cliente", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "9432621a-8397-4654-a882-5bc856b7ef83", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", - "service": "Load Balancer", + "checklist": "Azure API Management Review", + "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", + "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", + "service": "APIM", "severity": "Medio", - "text": "Asegúrese de que las direcciones IP de front-end de Load Balancers tengan redundancia de zona (a menos que necesite front-end zonal).", + "text": "Revise el artículo \"Recomendaciones para mitigar las 10 principales amenazas de seguridad de la API de OWASP\" y compruebe qué se aplica a sus API", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", - "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "App Gateway", + "checklist": "Azure API Management Review", + "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", + "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", + "service": "APIM", "severity": "Medio", - "text": "Application Gateways v2 debe implementarse en subredes con prefijos IP iguales o mayores que /24", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "text": "Utilice la función Autorizaciones para simplificar la administración del token de OAuth 2.0 para las API de back-end", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "description": "La administración de proxies inversos en general y de WAF en particular está más cerca de la aplicación que de la red, por lo que pertenecen a la misma suscripción que la aplicación. La centralización de Application Gateway y WAF en la suscripción de conectividad puede ser correcta si la administra un solo equipo.", - "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", - "severity": "Medio", - "text": "Implemente Azure Application Gateway v2 o aplicaciones virtuales de red de asociados que se usan para proxy de conexiones HTTP(S) entrantes dentro de la red virtual de la zona de aterrizaje y con las aplicaciones que están protegiendo.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "checklist": "Azure API Management Review", + "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", + "service": "APIM", + "severity": "Alto", + "text": "Utilice la versión más reciente de TLS al cifrar la información en tránsito. Deshabilite los protocolos y cifrados obsoletos e innecesarios cuando sea posible.", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", - "severity": "Medio", - "text": "Use una red DDoS o planes de protección IP para todas las direcciones IP públicas en las zonas de aterrizaje de la aplicación.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "checklist": "Azure API Management Review", + "guid": "f8af3d94-1d2b-4070-846f-849197524258", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", + "service": "APIM", + "severity": "Alto", + "text": "Asegúrese de que los secretos (valores con nombre) se almacenan en Azure Key Vault para que se pueda acceder a ellos y actualizarlos de forma segura", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", - "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", - "service": "App Gateway", + "checklist": "Azure API Management Review", + "guid": "791abd8b-7706-4e31-9569-afefde724be3", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", + "service": "APIM", "severity": "Medio", - "text": "Configure el escalado automático con una cantidad mínima de instancias de dos.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Fiabilidad" + "text": "Uso de identidades administradas para autenticarse en otros recursos de Azure siempre que sea posible", + "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", - "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", - "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", - "service": "App Gateway", - "severity": "Medio", - "text": "Implementación de Application Gateway en zonas de disponibilidad", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Fiabilidad" + "checklist": "Azure API Management Review", + "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", + "service": "APIM", + "severity": "Alto", + "text": "Uso del firewall de aplicaciones web (WAF) mediante la implementación de Application Gateway delante de APIM", + "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Front Door", - "severity": "Medio", - "text": "Use Azure Front Door con directivas de WAF para entregar y ayudar a proteger aplicaciones HTTP/S globales que abarcan varias regiones de Azure.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Seguridad" + "checklist": "Azure App Service Review", + "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", + "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", + "service": "App Services", + "severity": "Bajo", + "text": "Consulte la arquitectura de aplicación web de redundancia de zona de alta disponibilidad de línea de base para conocer los procedimientos recomendados", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3f29812b-2363-4cef-b179-b599de0d5973", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "Front Door", + "checklist": "Azure App Service Review", + "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", + "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", + "service": "App Services", "severity": "Medio", - "text": "Al usar Front Door y Application Gateway para ayudar a proteger las aplicaciones HTTP/S, use directivas de WAF en Front Door. Bloquee Application Gateway para recibir tráfico solo de Front Door.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Seguridad" + "text": "Utilice los niveles Premium y Estándar. Estos niveles admiten ranuras de ensayo y copias de seguridad automatizadas.", + "waf": "Fiabilidad" }, { - "ammp": true, - "arm-service": "microsoft.network/trafficManagerProfiles", - "checklist": "Azure Application Delivery Networking", - "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Traffic Manager", + "checklist": "Azure App Service Review", + "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", + "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", + "service": "App Services", "severity": "Alto", - "text": "Use el Administrador de tráfico para entregar aplicaciones globales que abarquen protocolos distintos de HTTP/S.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente (requiere el nivel Premium v2 o v3)", "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", - "severity": "Bajo", - "text": "Si los usuarios solo necesitan acceso a aplicaciones internas, ¿se ha considerado Microsoft Entra ID Application Proxy como una alternativa a Azure Virtual Desktop (AVD)?", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "Seguridad" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", + "checklist": "Azure App Service Review", + "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "severity": "Medio", - "text": "Para reducir el número de puertos de firewall abiertos para las conexiones entrantes en la red, considere la posibilidad de usar Microsoft Entra ID Application Proxy para proporcionar a los usuarios remotos acceso seguro y autenticado a las aplicaciones internas.", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Seguridad" + "text": "Implementación de comprobaciones de estado", + "waf": "Fiabilidad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "ae248989-b306-4591-9186-de482e3f0f0e", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "Front Door", + "checklist": "Azure App Service Review", + "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", + "service": "App Services", "severity": "Alto", - "text": "Implemente la directiva de WAF para Front Door en modo de \"prevención\".", - "waf": "Seguridad" + "text": "Consulte los procedimientos recomendados de copia de seguridad y restauración para Azure App Service", + "waf": "Fiabilidad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "Front Door", + "checklist": "Azure App Service Review", + "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", + "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", + "service": "App Services", "severity": "Alto", - "text": "Evite combinar Azure Traffic Manager y Azure Front Door.", - "waf": "Seguridad" + "text": "Implementación de los procedimientos recomendados de confiabilidad de Azure App Service", + "waf": "Fiabilidad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "Front Door", + "checklist": "Azure App Service Review", + "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", + "service": "App Services", + "severity": "Bajo", + "text": "Familiarizarse con cómo mover una aplicación de App Service a otra región durante un desastre", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure App Service Review", + "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", + "service": "App Services", "severity": "Alto", - "text": "Use el mismo nombre de dominio en Azure Front Door y su origen. Los nombres de host no coincidentes pueden causar errores sutiles.", - "waf": "Seguridad" + "text": "Familiarizarse con la compatibilidad con la confiabilidad en Azure App Service", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", - "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "Front Door", - "severity": "Bajo", - "text": "Deshabilite los sondeos de estado cuando solo haya un origen en un grupo de orígenes de Azure Front Door.", - "waf": "Rendimiento" + "checklist": "Azure App Service Review", + "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "App Services", + "severity": "Medio", + "text": "Asegúrese de que \"Siempre activado\" está habilitado para las aplicaciones de funciones que se ejecutan en un plan de App Service", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "Front Door", + "checklist": "Azure App Service Review", + "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "severity": "Medio", - "text": "Seleccione puntos de conexión de sondeo de estado correctos para Azure Front Door. Considere la posibilidad de crear puntos de conexión de estado que comprueben todas las dependencias de la aplicación.", + "text": "Supervisión de instancias de App Service mediante comprobaciones de estado", "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", - "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "Front Door", - "severity": "Bajo", - "text": "Use sondeos de estado de HEAD con Azure Front Door para reducir el tráfico que Front Door envía a la aplicación.", - "waf": "Rendimiento" + "checklist": "Azure App Service Review", + "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", + "service": "App Services", + "severity": "Medio", + "text": "Supervisión de la disponibilidad y la capacidad de respuesta de la aplicación web o el sitio web mediante pruebas de disponibilidad de Application Insights", + "waf": "Fiabilidad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", - "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "Load Balancer", - "severity": "Alto", - "text": "Use Azure NAT Gateway en lugar de reglas de salida de Load Balancer para mejorar la escalabilidad de SNAT", + "checklist": "Azure App Service Review", + "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", + "service": "App Services", + "severity": "Bajo", + "text": "Uso de la prueba estándar de Application Insights para supervisar la disponibilidad y la capacidad de respuesta de la aplicación web o el sitio web", "waf": "Fiabilidad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", - "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Use Azure Key Vault para almacenar los secretos que necesita la aplicación. Key Vault proporciona un entorno seguro y auditado para almacenar secretos y está bien integrado con App Service a través del SDK de Key Vault o las referencias de Key Vault de App Service.", + "guid": "834ac932-223e-4ce8-8b12-3071a5416415", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "severity": "Alto", - "text": "Use certificados TLS administrados con Azure Front Door. Reduzca los costos operativos y el riesgo de interrupciones debido a las renovaciones de certificados.", - "waf": "Operaciones" + "text": "Uso de Key Vault para almacenar secretos", + "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", - "service": "Front Door", - "severity": "Medio", - "text": "Defina la configuración de WAF de Azure Front Door como código. Mediante el uso de código, puede adoptar más fácilmente una nueva versión del conjunto de reglas y obtener protección adicional.", - "waf": "Operaciones" + "checklist": "Azure App Service Review", + "description": "Use una identidad administrada para conectarse a Key Vault mediante el SDK de Key Vault o a través de las referencias de Key Vault de App Service.", + "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", + "severity": "Alto", + "text": "Uso de la identidad administrada para conectarse a Key Vault", + "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Almacene el certificado TLS de App Service en Key Vault.", + "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", + "service": "App Services", "severity": "Alto", - "text": "Use TLS de un extremo a otro con Azure Front Door. Use TLS para las conexiones de los clientes a Front Door y de Front Door al origen.", + "text": "Use Key Vault para almacenar el certificado TLS.", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Los sistemas que procesan información confidencial deben estar aislados. Para ello, use planes del Servicio de aplicaciones o entornos del Servicio de aplicaciones independientes y considere la posibilidad de usar suscripciones o grupos de administración diferentes.", + "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", + "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", + "service": "App Services", "severity": "Medio", - "text": "Use el redireccionamiento de HTTP a HTTPS con Azure Front Door. Apoye a los clientes más antiguos redirigiéndolos automáticamente a una solicitud HTTPS.", + "text": "Aísle los sistemas que procesan información confidencial", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", - "service": "Front Door", - "severity": "Alto", - "text": "Habilite el WAF de Azure Front Door. Proteja su aplicación de una variedad de ataques.", + "checklist": "Azure App Service Review", + "description": "Los discos locales de App Service no están cifrados y los datos confidenciales no deben almacenarse en ellos. (Por ejemplo: D:\\\\Local y %TMP%).", + "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", + "service": "App Services", + "severity": "Medio", + "text": "No almacene datos confidenciales en el disco local", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", - "service": "Front Door", - "severity": "Alto", - "text": "Ajuste el WAF de Azure Front Door para su carga de trabajo. Reduzca las detecciones de falsos positivos.", + "checklist": "Azure App Service Review", + "description": "En el caso de la aplicación web autenticada, use un proveedor de identidades bien establecido, como Azure AD o Azure AD B2C. Aproveche el marco de aplicaciones de su elección para integrarse con este proveedor o use la característica de autenticación o autorización del Servicio de aplicaciones.", + "guid": "919ca0b2-c121-459e-814b-933df574eccc", + "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", + "service": "App Services", + "severity": "Medio", + "text": "Usar un proveedor de identidades establecido para la autenticación", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Implemente código en App Service desde un entorno controlado y de confianza, como una canalización de implementación de DevOps bien administrada y segura. De este modo, se evita el código que no se ha controlado la versión y se ha comprobado que se implementará desde un host malintencionado.", + "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", + "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", + "service": "App Services", "severity": "Alto", - "text": "Habilite la característica de inspección del cuerpo de la solicitud habilitada en la directiva WAF de Azure Front Door.", + "text": "Implementación desde un entorno de confianza", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Deshabilite la autenticación básica tanto para FTP/FTPS como para WebDeploy/SCM. Esto deshabilita el acceso a estos servicios y exige el uso de puntos de conexión protegidos de Azure AD para la implementación. Tenga en cuenta que el sitio de SCM también se puede abrir con credenciales de Azure AD.", + "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", + "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", + "service": "App Services", "severity": "Alto", - "text": "Habilite los conjuntos de reglas predeterminados de WAF de Azure Front Door. Los conjuntos de reglas predeterminados detectan y bloquean los ataques comunes.", + "text": "Deshabilitar la autenticación básica", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Siempre que sea posible, use Managed Identity para conectarse a los recursos protegidos de Azure AD. Si esto no es posible, almacene los secretos en Key Vault y conéctese a Key Vault mediante una identidad administrada en su lugar.", + "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", + "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", + "service": "App Services", "severity": "Alto", - "text": "Habilite el conjunto de reglas de protección contra bots de Azure Front Door WAF. Las reglas de bots detectan bots buenos y malos.", + "text": "Uso de la identidad administrada para conectarse a los recursos", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", - "service": "Front Door", - "severity": "Medio", - "text": "Use la versión más reciente del conjunto de reglas de WAF de Azure Front Door. Las actualizaciones del conjunto de reglas se actualizan periódicamente para tener en cuenta el panorama actual de amenazas.", + "checklist": "Azure App Service Review", + "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas mediante una identidad administrada.", + "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", + "service": "App Services", + "severity": "Alto", + "text": "Extracción de contenedores mediante una identidad administrada", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "b9620385-1cde-418f-914b-a84a06982ffc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Al configurar las opciones de diagnóstico de App Service, puede enviar todos los datos de telemetría a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad en tiempo de ejecución de App Service, como los registros HTTP, los registros de aplicaciones, los registros de plataforma, ...", + "guid": "47768314-c115-4775-a2ea-55b46ad48408", + "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", + "service": "App Services", "severity": "Medio", - "text": "Agregue limitación de velocidad al WAF de Azure Front Door. La limitación de velocidad bloquea a los clientes que envían accidental o intencionadamente grandes cantidades de tráfico en un corto período de tiempo.", + "text": "Envío de registros en tiempo de ejecución de App Service a Log Analytics", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Configure una configuración de diagnóstico para enviar el registro de actividad a Log Analytics como destino central para el registro y la supervisión. Esto le permite supervisar la actividad del plano de control en el propio recurso de App Service.", + "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "service": "App Services", "severity": "Medio", - "text": "Use un umbral alto para los límites de frecuencia de WAF de Azure Front Door. Los umbrales de límite de velocidad altos evitan el bloqueo del tráfico legítimo, a la vez que proporcionan protección contra un número extremadamente alto de solicitudes que podrían sobrecargar su infraestructura. ", - "waf": "Seguridad" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", - "service": "Front Door", - "severity": "Bajo", - "text": "Si no espera tráfico de todas las regiones geográficas, utilice filtros geográficos para bloquear el tráfico de países no esperados.", + "text": "Envío de registros de actividad de App Service a Log Analytics", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "00acd8a9-6975-414f-8491-2be6309893b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Controle el acceso saliente a la red mediante una combinación de integración de red virtual regional, grupos de seguridad de red y UDR. El tráfico debe enrutarse a una aplicación virtual de red, como Azure Firewall. Asegúrese de supervisar los registros del cortafuegos.", + "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", + "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", + "service": "App Services", "severity": "Medio", - "text": "Especifique la ubicación desconocida (ZZ) al filtrar geográficamente el tráfico con el WAF de Azure Front Door. Evite bloquear accidentalmente solicitudes legítimas cuando las direcciones IP no puedan coincidir geográficamente.", + "text": "El acceso a la red saliente debe controlarse", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", - "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", - "service": "App Gateway", - "severity": "Alto", - "text": "Habilitación del conjunto de reglas de protección contra bots de WAF de Azure Application Gateway Las reglas de bots detectan bots buenos y malos.", + "checklist": "Azure App Service Review", + "description": "Puede proporcionar una dirección IP de salida estable mediante la integración de red virtual y una puerta de enlace NAT de red virtual o una aplicación virtual de red como Azure Firewall. Esto permite a la parte receptora incluir en la lista de permitidos en función de la IP, en caso de que sea necesario. Tenga en cuenta que para las comunicaciones con los servicios de Azure, a menudo no es necesario depender de la dirección IP y, en su lugar, se deben usar mecanismos como los puntos de conexión de servicio. (Además, el uso de puntos de conexión privados en el extremo receptor evita que se produzca SNAT y proporciona un intervalo de IP de salida estable).", + "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", + "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", + "service": "App Services", + "severity": "Bajo", + "text": "Garantizar una IP estable para las comunicaciones salientes hacia las direcciones de Internet", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "description": "Controle el acceso entrante a la red mediante una combinación de restricciones de acceso al Servicio de aplicaciones, puntos de conexión de servicio o puntos de conexión privados. Se pueden requerir y configurar diferentes restricciones de acceso para la propia aplicación web y el sitio de SCM.", + "guid": "0725769e-e669-41a4-a34a-c932223ece80", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "severity": "Alto", - "text": "Habilite la característica de inspección del cuerpo de la solicitud habilitada en la directiva WAF de Azure Application Gateway.", + "text": "El acceso a la red entrante debe controlarse", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "description": "Protéjase contra el tráfico entrante malintencionado mediante un firewall de aplicaciones web como Application Gateway o Azure Front Door. Asegúrese de supervisar los registros del WAF.", + "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", + "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", + "service": "App Services", "severity": "Alto", - "text": "Ajuste el WAF de Azure Application Gateway para la carga de trabajo. Reduzca las detecciones de falsos positivos.", + "text": "Uso de un WAF delante de App Service", "waf": "Seguridad" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "description": "Asegúrese de que no se pueda omitir el WAF bloqueando el acceso solo al WAF. Use una combinación de restricciones de acceso, puntos de conexión de servicio y puntos de conexión privados.", + "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "severity": "Alto", - "text": "Implemente la directiva de WAF para Application Gateway en modo de \"prevención\".", + "text": "Evite que se omita WAF", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "description": "Establezca la directiva TLS mínima en 1.2 en la configuración de App Service.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", + "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", + "service": "App Services", "severity": "Medio", - "text": "Agregue limitación de velocidad al WAF de Azure Application Gateway. La limitación de velocidad bloquea a los clientes que envían accidental o intencionadamente grandes cantidades de tráfico en un corto período de tiempo.", + "text": "Establezca la directiva TLS mínima en 1.2", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", - "service": "App Gateway", - "severity": "Medio", - "text": "Use un umbral alto para los límites de frecuencia de WAF de Azure Application Gateway. Los umbrales de límite de velocidad altos evitan el bloqueo del tráfico legítimo, a la vez que proporcionan protección contra un número extremadamente alto de solicitudes que podrían sobrecargar su infraestructura. ", + "checklist": "Azure App Service Review", + "description": "Configure App Service para que use solo HTTPS. Esto hace que App Service se redirija de HTTP a HTTPS. Considere seriamente el uso de HTTP Strict Transport Security (HSTS) en su código o desde su WAF, que informa a los navegadores que solo se debe acceder al sitio mediante HTTPS.", + "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", + "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", + "service": "App Services", + "severity": "Alto", + "text": "Usar solo HTTPS", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "99937189-ff78-492a-b9ca-18d828d82b37", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", - "service": "App Gateway", - "severity": "Bajo", - "text": "Si no espera tráfico de todas las regiones geográficas, utilice filtros geográficos para bloquear el tráfico de países no esperados.", + "checklist": "Azure App Service Review", + "description": "No utilice caracteres comodín en la configuración de CORS, ya que esto permite que todos los orígenes accedan al servicio (lo que anula el propósito de CORS). En concreto, solo permite los orígenes que esperas poder acceder al servicio.", + "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", + "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", + "service": "App Services", + "severity": "Alto", + "text": "Los comodines no deben usarse para CORS", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", - "service": "App Gateway", - "severity": "Medio", - "text": "Especifique la ubicación desconocida (ZZ) al filtrar geográficamente el tráfico con el WAF de Azure Application Gateway. Evite bloquear accidentalmente solicitudes legítimas cuando las direcciones IP no puedan coincidir geográficamente.", + "checklist": "Azure App Service Review", + "description": "La depuración remota no debe estar activada en producción, ya que esto abre puertos adicionales en el servicio, lo que aumenta la superficie expuesta a ataques. Tenga en cuenta que el servicio desactiva la depuración remota automáticamente después de 48 horas.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", + "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", + "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", + "service": "App Services", + "severity": "Alto", + "text": "Desactivar la depuración remota", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "description": "Habilite Defender para App Service. Esto (entre otras amenazas) detecta comunicaciones a direcciones IP maliciosas conocidas. Revise las recomendaciones de Defender para App Service como parte de las operaciones.", + "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", + "service": "App Services", "severity": "Medio", - "text": "Use la versión más reciente del conjunto de reglas de WAF de Azure Application Gateway. Las actualizaciones del conjunto de reglas se actualizan periódicamente para tener en cuenta el panorama actual de amenazas.", + "text": "Habilitación de Defender for Cloud: Defender for App Service", "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "description": "Azure proporciona protección básica contra DDoS en su red, que se puede mejorar con funcionalidades inteligentes de DDoS Standard que aprenden sobre los patrones de tráfico normales y pueden detectar comportamientos inusuales. DDoS Standard se aplica a una red virtual, por lo que debe configurarse para el recurso de red delante de la aplicación, como Application Gateway o una aplicación virtual de red.", + "guid": "223ece80-b123-4071-a541-6415833ea3ad", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "App Services", "severity": "Medio", - "text": "Agregue la configuración de diagnóstico para guardar los registros de WAF de Azure Application Gateway.", - "waf": "Operaciones" + "text": "Habilitación del estándar de protección DDoS en la red virtual de WAF", + "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Cuando use imágenes almacenadas en Azure Container Registry, extráigalas a través de una red virtual desde Azure Container Registry mediante su punto de conexión privado y la configuración de la aplicación \"WEBSITE_PULL_IMAGE_OVER_VNET\".", + "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", + "service": "App Services", "severity": "Medio", - "text": "Agregue la configuración de diagnóstico para guardar los registros de WAF de Azure Front Door.", - "waf": "Operaciones" + "text": "Extracción de contenedores a través de una red virtual", + "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "92664c60-47e3-4591-8b1b-8d557656e686", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "description": "Realice una prueba de penetración en la aplicación web siguiendo las reglas de participación de las pruebas de penetración.", + "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", + "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", + "service": "App Services", "severity": "Medio", - "text": "Envíe registros de WAF de Azure Application Gateway a Microsoft Sentinel.", - "waf": "Operaciones" + "text": "Realizar una prueba de penetración", + "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "845f5f91-9c21-4674-a725-5ce890850e20", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "Front Door", + "checklist": "Azure App Service Review", + "description": "Implemente código de confianza que se haya validado y analizado en busca de vulnerabilidades de acuerdo con las prácticas de DevSecOps.", + "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", + "service": "App Services", "severity": "Medio", - "text": "Envíe registros de WAF de Azure Front Door a Microsoft Sentinel.", - "waf": "Operaciones" + "text": "Implementación de código validado", + "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", - "service": "App Gateway", - "severity": "Medio", - "text": "Defina la configuración de WAF de Azure Application Gateway como código. Mediante el uso de código, puede adoptar más fácilmente una nueva versión del conjunto de reglas y obtener protección adicional.", - "waf": "Operaciones" + "checklist": "Azure App Service Review", + "description": "Utilice las versiones más recientes de plataformas, lenguajes de programación, protocolos y marcos compatibles.", + "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", + "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", + "service": "App Services", + "severity": "Alto", + "text": "Utilizar plataformas, lenguajes, protocolos y marcos actualizados", + "waf": "Seguridad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", - "service": "App Gateway", + "checklist": "Azure Bot Service", + "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", + "service": "Bot service", "severity": "Medio", - "text": "Utilice directivas de WAF en lugar de la configuración de WAF heredada.", - "waf": "Operaciones" + "text": "Siga las recomendaciones de soporte técnico de confiabilidad en Azure Bot Service", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", - "service": "App Gateway", + "checklist": "Azure Bot Service", + "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", + "service": "Bot service", "severity": "Medio", - "text": "Filtre el tráfico entrante en los back-end para que solo acepten conexiones de la subred de Application Gateway, por ejemplo, con grupos de seguridad de red.", - "waf": "Seguridad" + "text": "Implementación de bots con residencia de datos local y cumplimiento regional", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", - "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", - "service": "Front Door", + "checklist": "Azure Bot Service", + "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", + "service": "Bot service", "severity": "Medio", - "text": "Asegúrese de que los orígenes solo toman tráfico de la instancia de Azure Front Door.", - "waf": "Seguridad" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", - "service": "App Gateway", - "severity": "Alto", - "text": "Debe cifrar el tráfico a los servidores backend.", - "waf": "Seguridad" + "text": "Azure Bot Service se ejecuta en modo activo-activo para los servicios globales y regionales. Cuando se produce una interrupción, no es necesario detectar errores ni administrar el servicio. Azure Bot Service realiza automáticamente la conmutación por error y la recuperación automáticas en una arquitectura geográfica de varias regiones. En el caso del servicio regional de bots de la UE, Azure Bot Service proporciona dos regiones completas dentro de Europa con replicación activa/activa para garantizar la redundancia. En el caso del servicio de bot global, todas las regiones o zonas geográficas disponibles se pueden servir como superficie global.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", - "service": "App Gateway", + "checklist": "Redis Resiliency checklist", + "guid": "65285269-440b-44be-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", + "service": "Redis", "severity": "Alto", - "text": "Debe utilizar un firewall de aplicaciones web.", - "waf": "Seguridad" + "text": "Habilite la redundancia de zona para Azure Cache for Redis. Azure Cache for Redis admite configuraciones con redundancia de zona en los niveles Premium y Enterprise. Una caché con redundancia de zona puede colocar sus nodos en diferentes zonas de disponibilidad de Azure en la misma región. Elimina la interrupción del centro de datos o de la zona de disponibilidad como único punto de error y aumenta la disponibilidad general de la memoria caché.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", - "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", - "service": "App Gateway", - "severity": "Medio", - "text": "Redirigir HTTP a HTTPS", - "waf": "Seguridad" + "checklist": "Redis Resiliency checklist", + "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", + "service": "Redis", + "severity": "Medio", + "text": "Configure la persistencia de datos para una instancia de Azure Cache for Redis. Dado que los datos de caché se almacenan en la memoria, un error poco frecuente y no planeado de varios nodos puede hacer que se eliminen todos los datos. Para evitar la pérdida completa de datos, la persistencia de Redis permite tomar instantáneas periódicas de los datos en memoria y almacenarlas en la cuenta de almacenamiento.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", - "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", - "service": "App Gateway", + "checklist": "Redis Resiliency checklist", + "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", + "service": "Redis", "severity": "Medio", - "text": "Utilice cookies administradas por puerta de enlace para dirigir el tráfico de una sesión de usuario al mismo servidor para su procesamiento", - "waf": "Operaciones" + "text": "Use una cuenta de almacenamiento con redundancia geográfica para conservar los datos de Azure Cache for Redis o con redundancia zonal donde la redundancia geográfica no esté disponible", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", - "service": "App Gateway", - "severity": "Alto", - "text": "Habilite el drenaje de conexiones durante las actualizaciones de servicio planificadas para evitar la pérdida de conexión a los miembros existentes del grupo de back-end", - "waf": "Seguridad" + "checklist": "Redis Resiliency checklist", + "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", + "service": "Redis", + "severity": "Medio", + "text": "Configure la replicación geográfica pasiva para instancias de Azure Cache for Redis Premium. La replicación geográfica es un mecanismo para vincular dos o más instancias de Azure Cache for Redis, que normalmente abarcan dos regiones de Azure. La replicación geográfica está diseñada principalmente para la recuperación ante desastres entre regiones. Dos instancias de caché de nivel Premium se conectan a través de la replicación geográfica de una manera que proporciona lecturas y escrituras en la caché principal, y esos datos se replican en la caché secundaria.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", - "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", - "service": "App Gateway", - "severity": "Bajo", - "text": "Crear páginas de error personalizadas para mostrar una experiencia de usuario personalizada", - "waf": "Operaciones" + "checklist": "IoT Hub Review", + "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", + "service": "IoT", + "severity": "Alto", + "text": "Aproveche las zonas de disponibilidad si corresponden regionalmente (esto se habilita automáticamente)", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", - "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", - "service": "App Gateway", + "checklist": "IoT Hub Review", + "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", "severity": "Medio", - "text": "Edite las solicitudes HTTP y los encabezados de respuesta para facilitar el enrutamiento y el intercambio de información entre el cliente y el servidor", - "waf": "Seguridad" + "text": "Tenga en cuenta las conmutaciones por error iniciadas por Microsoft. Microsoft los ejerce en situaciones excepcionales para conmutar por error todos los centros de IoT de una región afectada a la región emparejada geográficamente correspondiente.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "App Gateway", - "severity": "Medio", - "text": "Configure Front Door para optimizar el enrutamiento del tráfico web global y el rendimiento del usuario final de primer nivel, así como la confiabilidad a través de una rápida conmutación por error global", - "waf": "Rendimiento" + "checklist": "IoT Hub Review", + "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", + "service": "IoT", + "severity": "Alto", + "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "29dcc19f-a8fa-4c35-8281-290577538793", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "App Gateway", - "severity": "Medio", - "text": "Usar el equilibrio de carga de la capa de transporte", - "waf": "Rendimiento" + "checklist": "IoT Hub Review", + "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", + "severity": "Alto", + "text": "Obtenga información sobre cómo desencadenar una conmutación por error manual.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", - "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", - "service": "App Gateway", - "severity": "Medio", - "text": "Configure el enrutamiento basado en el host o el nombre de dominio para varias aplicaciones web en una sola puerta de enlace", - "waf": "Seguridad" + "checklist": "IoT Hub Review", + "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", + "service": "IoT", + "severity": "Alto", + "text": "Obtenga información sobre cómo conmutar por recuperación después de una conmutación por error.", + "waf": "Fiabilidad" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", - "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", - "service": "App Gateway", + "checklist": "Azure Data Factory Review Checklist", + "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", + "service": "Azure Data Factory", "severity": "Medio", - "text": "Centralice la administración de certificados SSL para reducir la sobrecarga de cifrado y descifrado de una granja de servidores back-end", - "waf": "Seguridad" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", - "service": "App Gateway", - "severity": "Bajo", - "text": "Uso de Application Gateway para obtener compatibilidad nativa con los protocolos WebSocket y HTTP/2", - "waf": "Seguridad" + "text": "Aproveche el cuaderno de estrategias de resistencia de FTA para Azure Data Factory", + "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub proporciona cifrado de datos en reposo. Si usa su propia clave, los datos se siguen cifrando con la clave administrada por Microsoft, pero además la clave administrada por Microsoft se cifrará con la clave administrada por el cliente. ", - "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", - "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", - "service": "Event Hubs", - "severity": "Bajo", - "text": "Usar la opción de clave administrada por el cliente en el cifrado de datos en reposo cuando sea necesario", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "Seguridad" + "checklist": "Azure Data Factory Review Checklist", + "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", + "severity": "Alto", + "text": "Uso de canalizaciones con redundancia de zona en regiones que admiten zonas de disponibilidad", + "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "Los espacios de nombres de Azure Event Hubs permiten a los clientes enviar y recibir datos con TLS 1.0 y versiones posteriores. Para aplicar medidas de seguridad más estrictas, puede configurar el espacio de nombres de Event Hubs para requerir que los clientes envíen y reciban datos con una versión más reciente de TLS. Si un espacio de nombres de Event Hubs requiere una versión mínima de TLS, se producirá un error en las solicitudes realizadas con una versión anterior. ", - "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", - "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", - "service": "Event Hubs", + "checklist": "Azure Data Factory Review Checklist", + "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", + "link": "https://learn.microsoft.com/azure/data-factory/source-control", + "service": "Azure Data Factory", "severity": "Medio", - "text": "Aplicar una versión mínima requerida de Seguridad de la capa de transporte (TLS) para las solicitudes ", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Seguridad" + "text": "Uso de DevOps para realizar copias de seguridad de las plantillas de ARM con la integración de Github/Azure DevOps ", + "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "Al crear un espacio de nombres de Event Hubs, se crea automáticamente una regla de directiva denominada RootManageSharedAccessKey para el espacio de nombres. Esta directiva tiene permisos de administración para todo el espacio de nombres. Se recomienda tratar esta regla como una cuenta raíz administrativa y no usarla en la aplicación. Se recomienda usar AAD como proveedor de autenticación con RBAC. ", - "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", - "service": "Event Hubs", + "checklist": "Azure Data Factory Review Checklist", + "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "Medio", - "text": "Evite usar la cuenta raíz cuando no sea necesario", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "Seguridad" + "text": "Asegúrese de replicar las máquinas virtuales de Integration Runtime autohospedadas en otra región ", + "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "Las identidades administradas para los recursos de Azure pueden autorizar el acceso a los recursos de Event Hubs mediante credenciales de Azure AD desde aplicaciones que se ejecutan en Azure Virtual Machines (VM), aplicaciones de funciones, conjuntos de escalado de máquinas virtuales y otros servicios. Mediante el uso de identidades administradas para los recursos de Azure junto con la autenticación de Azure AD, puede evitar el almacenamiento de credenciales con las aplicaciones que se ejecutan en la nube. ", - "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", - "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", - "service": "Event Hubs", + "checklist": "Azure Data Factory Review Checklist", + "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "Medio", - "text": "Siempre que sea posible, la aplicación debe usar una identidad administrada para autenticarse en Azure Event Hub. Si no es así, considere la posibilidad de tener la credencial de almacenamiento (SAS, credencial de entidad de servicio) en Azure Key Vault o en un servicio equivalente", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Seguridad" + "text": "Asegúrese de replicar o duplicar la red en la región hermana. Tiene que hacer una copia de la red virtual en otra región", + "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "Al crear permisos, proporcione un control específico sobre el acceso de un cliente al Centro de eventos de Azure. Los permisos del Centro de eventos de Azure pueden y deben limitarse al nivel de recurso individual, por ejemplo, grupo de consumidores, entidad del centro de eventos, espacios de nombres del centro de eventos, etc.", - "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", - "service": "Event Hubs", - "severity": "Alto", - "text": "Uso de RBAC de plano de datos con privilegios mínimos", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "Seguridad" + "checklist": "Azure Data Factory Review Checklist", + "description": "Si las canalizaciones de ADF usan Key Vault, no tiene que hacer nada para replicar Key Vault. Key Vault es un servicio administrado y Microsoft se encarga de ello por ti", + "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Azure Data Factory", + "severity": "Bajo", + "text": "Si utiliza la integración de Keyvault, utilice el Acuerdo de Nivel de Servicio de Keyvault para comprender su disponibilidad", + "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "Los registros de recursos del Centro de eventos de Azure incluyen registros operativos, registros de red virtual y registros de Kafka. Los registros de auditoría en tiempo de ejecución capturan información de diagnóstico agregada para todas las operaciones de acceso al plano de datos (como eventos de envío o recepción) en Event Hubs.", - "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", - "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", - "service": "Event Hubs", + "checklist": "Identity Review Checklist", + "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", + "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", + "service": "Entra", "severity": "Medio", - "text": "Habilite el registro para la investigación de seguridad. Use Azure Monitor para capturar métricas y registros, como registros de recursos, registros de auditoría en tiempo de ejecución y registros de Kafka", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "Seguridad" + "text": "Use el token revocable de larga duración, almacene en caché el token y adquiera el token de forma silenciosa mediante la biblioteca de identidades de Microsoft", + "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "De forma predeterminada, Azure Event Hub tiene una dirección IP pública y es accesible a través de Internet. Los puntos de conexión privados permiten el tráfico entre la red virtual y Azure Event Hubs a través de la red troncal de Microsoft. Además de eso, debe deshabilitar los puntos de conexión públicos si no se usan. ", - "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", - "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", - "service": "Event Hubs", + "checklist": "Identity Review Checklist", + "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", + "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", + "service": "AAD B2C", "severity": "Medio", - "text": "Considere la posibilidad de usar puntos de conexión privados para acceder al Centro de eventos de Azure y deshabilitar el acceso a la red pública cuando corresponda.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Seguridad" + "text": "Asegúrese de que los flujos de usuario de inicio de sesión estén respaldados y sean resistentes. Asegúrese de que se ha realizado una copia de seguridad del código que usa para iniciar sesión en los usuarios y se puede recuperar. Interfaces resilientes con procesos externos", + "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "Con el firewall IP, puede restringir aún más el punto de conexión público a solo un conjunto de direcciones IPv4 o rangos de direcciones IPv4 en notación CIDR (Classless Inter-Domain Routing). ", - "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", - "service": "Event Hubs", + "checklist": "Identity Review Checklist", + "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", + "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", + "service": "AAD B2C", "severity": "Medio", - "text": "Considere la posibilidad de permitir solo el acceso al espacio de nombres del Centro de eventos de Azure desde direcciones IP o intervalos específicos", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Seguridad" + "text": "Los activos de marca personalizados deben estar alojados en una CDN", + "waf": "Rendimiento" }, { - "checklist": "Azure Event Hub Review", - "guid": "31d41e36-11c8-417b-8afb-c410d4391898", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", - "service": "Event Hubs", - "severity": "Medio", - "text": "Aproveche el Manual de Resiliencia de los TLC", + "checklist": "Identity Review Checklist", + "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", + "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", + "service": "AAD B2C", + "severity": "Bajo", + "text": "Tener varios proveedores de identidad (es decir, iniciar sesión con sus cuentas de Microsoft, Google, Facebook)", "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": " Esto se activará automáticamente para un nuevo espacio de nombres EH creado desde el portal con SKU Premium, Dedicado o Estándar en una región habilitada para zonas. Tanto los metadatos de EH como los propios datos de eventos se replican en todas las zonas", - "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", - "service": "Event Hubs", - "severity": "Alto", - "text": "Aproveche las zonas de disponibilidad si corresponde regionalmente", + "checklist": "Identity Review Checklist", + "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "Medio", + "text": "Siga las reglas de la máquina virtual para la alta disponibilidad en el nivel de máquina virtual (discos premium, dos o más en una región, en diferentes zonas de disponibilidad)", "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "guid": "20b56c56-ad58-4519-8f82-735c586bb281", - "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", - "service": "Event Hubs", + "checklist": "Identity Review Checklist", + "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "severity": "Medio", - "text": "Usa las SKU Premium o Dedicadas para obtener un rendimiento predecible", + "text": "¡No repliques! La replicación puede crear problemas con la sincronización de directorios", "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "La característica integrada de recuperación ante desastres geográfica, cuando está habilitada, garantiza que toda la configuración de un espacio de nombres (Event Hubs, grupos de consumidores y configuración) se replique continuamente desde un espacio de nombres principal a un espacio de nombres secundario, y permite un movimiento de conmutación por error de una sola vez del principal al secundario en cualquier momento. La característica Activo/Pasivo está diseñada para facilitar la recuperación y el abandono de una región de Azure con errores sin tener que cambiar las configuraciones de la aplicación", - "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", - "service": "Event Hubs", - "severity": "Alto", - "text": "Planeación de la recuperación ante desastres geográfica mediante la configuración pasiva activa", + "checklist": "Identity Review Checklist", + "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "Medio", + "text": "Tener activo-activo para varias regiones", "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "description": "Debe utilizarse para configuraciones de recuperación ante desastres en las que no se puede tolerar una interrupción o pérdida de datos de eventos en la región inactiva. En estos casos, siga las instrucciones de replicación y no use la capacidad de recuperación ante desastres geográfica integrada (activa/pasiva). Con Activo/Activo, mantenga varios centros de eventos en diferentes regiones y espacios de nombres, y los eventos se replicarán entre los centros", - "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", - "service": "Event Hubs", + "checklist": "Identity Review Checklist", + "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "severity": "Medio", - "text": "En el caso de las aplicaciones críticas para la empresa, use la configuración Active Active", + "text": "Adición de stamps de servicio de dominio de Azure AD a regiones y ubicaciones adicionales", "waf": "Fiabilidad" }, { - "checklist": "Azure Event Hub Review", - "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", - "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", - "service": "Event Hubs", + "checklist": "Identity Review Checklist", + "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "severity": "Medio", - "text": "Diseño de centros de eventos resilientes", + "text": "Uso de conjuntos de réplicas para recuperación ante desastres", "waf": "Fiabilidad" }, { @@ -7816,11 +7608,219 @@ "severity": "Medio", "text": "Si usa Azure Disks y AZ, considere la posibilidad de tener grupos de nodos dentro de una zona para el disco LRS con VolumeBindingMode:WaitForFirstConsumer para aprovisionar el almacenamiento en la zona correcta o use el disco ZRS para los grupos de nodos que abarquen varias zonas", "waf": "Rendimiento" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub proporciona cifrado de datos en reposo. Si usa su propia clave, los datos se siguen cifrando con la clave administrada por Microsoft, pero además la clave administrada por Microsoft se cifrará con la clave administrada por el cliente. ", + "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", + "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", + "service": "Event Hubs", + "severity": "Bajo", + "text": "Usar la opción de clave administrada por el cliente en el cifrado de datos en reposo cuando sea necesario", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Los espacios de nombres de Azure Event Hubs permiten a los clientes enviar y recibir datos con TLS 1.0 y versiones posteriores. Para aplicar medidas de seguridad más estrictas, puede configurar el espacio de nombres de Event Hubs para requerir que los clientes envíen y reciban datos con una versión más reciente de TLS. Si un espacio de nombres de Event Hubs requiere una versión mínima de TLS, se producirá un error en las solicitudes realizadas con una versión anterior. ", + "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", + "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", + "service": "Event Hubs", + "severity": "Medio", + "text": "Aplicar una versión mínima requerida de Seguridad de la capa de transporte (TLS) para las solicitudes ", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Al crear un espacio de nombres de Event Hubs, se crea automáticamente una regla de directiva denominada RootManageSharedAccessKey para el espacio de nombres. Esta directiva tiene permisos de administración para todo el espacio de nombres. Se recomienda tratar esta regla como una cuenta raíz administrativa y no usarla en la aplicación. Se recomienda usar AAD como proveedor de autenticación con RBAC. ", + "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", + "service": "Event Hubs", + "severity": "Medio", + "text": "Evite usar la cuenta raíz cuando no sea necesario", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Las identidades administradas para los recursos de Azure pueden autorizar el acceso a los recursos de Event Hubs mediante credenciales de Azure AD desde aplicaciones que se ejecutan en Azure Virtual Machines (VM), aplicaciones de funciones, conjuntos de escalado de máquinas virtuales y otros servicios. Mediante el uso de identidades administradas para los recursos de Azure junto con la autenticación de Azure AD, puede evitar el almacenamiento de credenciales con las aplicaciones que se ejecutan en la nube. ", + "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", + "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", + "service": "Event Hubs", + "severity": "Medio", + "text": "Siempre que sea posible, la aplicación debe usar una identidad administrada para autenticarse en Azure Event Hub. Si no es así, considere la posibilidad de tener la credencial de almacenamiento (SAS, credencial de entidad de servicio) en Azure Key Vault o en un servicio equivalente", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Al crear permisos, proporcione un control específico sobre el acceso de un cliente al Centro de eventos de Azure. Los permisos del Centro de eventos de Azure pueden y deben limitarse al nivel de recurso individual, por ejemplo, grupo de consumidores, entidad del centro de eventos, espacios de nombres del centro de eventos, etc.", + "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", + "service": "Event Hubs", + "severity": "Alto", + "text": "Uso de RBAC de plano de datos con privilegios mínimos", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Los registros de recursos del Centro de eventos de Azure incluyen registros operativos, registros de red virtual y registros de Kafka. Los registros de auditoría en tiempo de ejecución capturan información de diagnóstico agregada para todas las operaciones de acceso al plano de datos (como eventos de envío o recepción) en Event Hubs.", + "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", + "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", + "service": "Event Hubs", + "severity": "Medio", + "text": "Habilite el registro para la investigación de seguridad. Use Azure Monitor para capturar métricas y registros, como registros de recursos, registros de auditoría en tiempo de ejecución y registros de Kafka", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Event Hub Review", + "description": "De forma predeterminada, Azure Event Hub tiene una dirección IP pública y es accesible a través de Internet. Los puntos de conexión privados permiten el tráfico entre la red virtual y Azure Event Hubs a través de la red troncal de Microsoft. Además de eso, debe deshabilitar los puntos de conexión públicos si no se usan. ", + "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", + "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", + "service": "Event Hubs", + "severity": "Medio", + "text": "Considere la posibilidad de usar puntos de conexión privados para acceder al Centro de eventos de Azure y deshabilitar el acceso a la red pública cuando corresponda.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Con el firewall IP, puede restringir aún más el punto de conexión público a solo un conjunto de direcciones IPv4 o rangos de direcciones IPv4 en notación CIDR (Classless Inter-Domain Routing). ", + "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", + "service": "Event Hubs", + "severity": "Medio", + "text": "Considere la posibilidad de permitir solo el acceso al espacio de nombres del Centro de eventos de Azure desde direcciones IP o intervalos específicos", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Seguridad" + }, + { + "checklist": "Azure Event Hub Review", + "guid": "31d41e36-11c8-417b-8afb-c410d4391898", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", + "service": "Event Hubs", + "severity": "Medio", + "text": "Aproveche el Manual de Resiliencia de los TLC", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Event Hub Review", + "description": " Esto se activará automáticamente para un nuevo espacio de nombres EH creado desde el portal con SKU Premium, Dedicado o Estándar en una región habilitada para zonas. Tanto los metadatos de EH como los propios datos de eventos se replican en todas las zonas", + "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", + "service": "Event Hubs", + "severity": "Alto", + "text": "Aproveche las zonas de disponibilidad si corresponde regionalmente", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Event Hub Review", + "guid": "20b56c56-ad58-4519-8f82-735c586bb281", + "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", + "service": "Event Hubs", + "severity": "Medio", + "text": "Usa las SKU Premium o Dedicadas para obtener un rendimiento predecible", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Event Hub Review", + "description": "La característica integrada de recuperación ante desastres geográfica, cuando está habilitada, garantiza que toda la configuración de un espacio de nombres (Event Hubs, grupos de consumidores y configuración) se replique continuamente desde un espacio de nombres principal a un espacio de nombres secundario, y permite un movimiento de conmutación por error de una sola vez del principal al secundario en cualquier momento. La característica Activo/Pasivo está diseñada para facilitar la recuperación y el abandono de una región de Azure con errores sin tener que cambiar las configuraciones de la aplicación", + "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", + "service": "Event Hubs", + "severity": "Alto", + "text": "Planeación de la recuperación ante desastres geográfica mediante la configuración pasiva activa", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Debe utilizarse para configuraciones de recuperación ante desastres en las que no se puede tolerar una interrupción o pérdida de datos de eventos en la región inactiva. En estos casos, siga las instrucciones de replicación y no use la capacidad de recuperación ante desastres geográfica integrada (activa/pasiva). Con Activo/Activo, mantenga varios centros de eventos en diferentes regiones y espacios de nombres, y los eventos se replicarán entre los centros", + "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", + "service": "Event Hubs", + "severity": "Medio", + "text": "En el caso de las aplicaciones críticas para la empresa, use la configuración Active Active", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Event Hub Review", + "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", + "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", + "service": "Event Hubs", + "severity": "Medio", + "text": "Diseño de centros de eventos resilientes", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Function Review", + "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "severity": "Alto", + "text": "Seleccione el plan de hospedaje de funciones adecuado en función de los requisitos de su empresa y SLO", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Function Review", + "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "severity": "Alto", + "text": "Aproveche las zonas de disponibilidad cuando corresponda regionalmente (no disponible para el nivel de consumo)", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Function Review", + "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", + "service": "Azure Functions", + "severity": "Medio", + "text": "Considere la posibilidad de una estrategia de recuperación ante desastres entre regiones para cargas de trabajo críticas", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Function Review", + "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Azure Functions", + "severity": "Alto", + "text": "Si se implementa en un entorno aislado, use o migre a App Service Environment (ASE) v3", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Function Review", + "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "Azure Functions", + "severity": "Alto", + "text": "Asegúrese de que \"Siempre activado\" esté habilitado para todas las aplicaciones de funciones que se ejecutan en el plan de App Service", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Function Review", + "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", + "service": "Azure Functions", + "severity": "Medio", + "text": "Empareje una aplicación de funciones con su propia cuenta de almacenamiento. Intente no volver a usar las cuentas de almacenamiento para las aplicaciones de funciones a menos que estén estrechamente acopladas", + "waf": "Fiabilidad" + }, + { + "checklist": "Azure Function Review", + "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "Azure Functions", + "severity": "Medio", + "text": "Aproveche Azure DevOps o GitHub para optimizar la CI/CD y proteger el código de la aplicación de funciones", + "waf": "Operaciones" } ], "metadata": { "name": "WAF checklist", - "timestamp": "June 17, 2024" + "timestamp": "June 24, 2024" }, "severities": [ { diff --git a/checklists/waf_checklist.ja.json b/checklists/waf_checklist.ja.json index 5268acb5d..63c89fe2f 100644 --- a/checklists/waf_checklist.ja.json +++ b/checklists/waf_checklist.ja.json @@ -1,469 +1,410 @@ { "items": [ { - "checklist": "Cognitive Search Review Checklist", - "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", - "severity": "高い", - "text": "2 つのレプリカで読み取り操作の可用性を 99.9% にする", + "checklist": "Azure Bot Service", + "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", + "service": "Bot service", + "severity": "中程度", + "text": "Azure Bot Service の信頼性サポートの推奨事項に従う", "waf": "確実" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", + "checklist": "Azure Bot Service", + "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", + "service": "Bot service", "severity": "中程度", - "text": "3 つのレプリカで読み取り/書き込み操作の可用性を 99.9% に向上させる", + "text": "ローカル データ所在地とリージョン コンプライアンスを備えたボットのデプロイ", "waf": "確実" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", - "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", - "service": "Cognitive Search", - "severity": "高い", - "text": "読み取りレプリカや書き込みレプリカを有効にすることでアベイラビリティーゾーンを活用する", + "checklist": "Azure Bot Service", + "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", + "service": "Bot service", + "severity": "中程度", + "text": "Azure Bot Service は、グローバル サービスとリージョン サービスの両方に対してアクティブ/アクティブ モードで実行されます。停止が発生した場合、エラーを検出したり、サービスを管理したりする必要はありません。Azure Bot Service は、複数リージョンの地理的アーキテクチャで自動フェールオーバーと自動復旧を自動的に実行します。EU ボット リージョン サービスの場合、Azure Bot Service は、冗長性を確保するために、アクティブ/アクティブ レプリケーションを備えたヨーロッパ内の 2 つの完全なリージョンを提供します。グローバル ボット サービスの場合、使用可能なすべてのリージョン/地域をグローバル フットプリントとして提供できます。", "waf": "確実" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", - "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", - "service": "Cognitive Search", - "severity": "中程度", - "text": "リージョンの冗長性については、地理的リージョン間で検索インデックスをレプリケートする自動化された方法が提供されないため、検索用に 2 つ以上のリージョンにサービスを手動で作成します", + "checklist": "Logic Apps checklist", + "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", + "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", + "service": "Logic Apps", + "severity": "高い", + "text": "ビジネスと SLO の要件に基づいて適切なロジック アプリのホスティング プランを選択する", "waf": "確実" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", - "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", - "service": "Cognitive Search", - "severity": "中程度", - "text": "複数のサービス間でデータを同期するには、複数のサービスでコンテンツを更新するためにインデクサーを使用するか、複数のサービスでコンテンツの更新をプッシュするために REST API を使用する", + "checklist": "Logic Apps checklist", + "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", + "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "Logic Apps", + "severity": "高い", + "text": "ゾーンの冗長性と可用性ゾーンを使用してリージョンの障害からロジック アプリを保護する", "waf": "確実" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", - "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", - "service": "Cognitive Search", - "severity": "中程度", - "text": "Azure Traffic Manager を使用して要求を調整する", + "checklist": "Logic Apps checklist", + "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", + "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Logic Apps", + "severity": "高い", + "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する", "waf": "確実" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", - "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", - "service": "Cognitive Search", + "checklist": "Logic Apps checklist", + "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", + "link": "https://learn.microsoft.com/azure/app-service/environment/intro", + "service": "Logic Apps", "severity": "高い", - "text": "Azure Cognitive Search インデックスをバックアップおよび復元します。このサンプル コードを使用して、インデックス定義とスナップショットを一連の Json ファイルにバックアップします", + "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します", "waf": "確実" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", - "service": "Azure Monitor", - "text": "Azure Monitor のデータ収集ルール - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "費用" + "checklist": "Logic Apps checklist", + "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", + "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", + "service": "Logic Apps", + "severity": "中程度", + "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、ロジック アプリ コードを保護", + "waf": "オペレーションズ" }, { - "checklist": "Cost Optimization Checklist", - "guid": "45901365-d38e-443f-abcb-d868266abca2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Azure Backup", - "text": "基になるデータソースが見つからないバックアップインスタンスを確認する", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "ストレージに関連する Microsoft クラウド セキュリティ ベンチマークのガイダンスを適用する", + "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", + "service": "Azure Storage", + "severity": "中程度", + "text": "\"ストレージの Azure セキュリティ ベースライン\" を検討する", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "VM", - "text": "関連づけられていないサービス(ディスク、NIC、IPアドレスなど)を削除またはアーカイブする", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "既定では、Azure Storage にはパブリック IP アドレスがあり、インターネットにアクセス可能です。プライベート エンドポイントを使用すると、アクセスが必要な Azure コンピューティング リソースにのみ Azure Storage を安全に公開できるため、パブリック インターネットへの露出を排除できます", + "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", + "service": "Azure Storage", + "severity": "高い", + "text": "Azure Storage にプライベート エンドポイントを使用することを検討する", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Azure Backup", - "text": "ミッション クリティカルでないアプリケーションの Site Recovery ストレージとバックアップのバランスを考慮する", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "新しく作成されたストレージ アカウントは、RBAC や監査などがすべて有効になるように、ARM デプロイ モデルを使用して作成されます。サブスクリプションにクラシック デプロイ モデルの古いストレージ アカウントがないことを確認する", + "guid": "30e37c3e-2971-41b2-963c-eee079b598de", + "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", + "service": "Azure Storage", + "severity": "中程度", + "text": "古いストレージ アカウントで \"クラシック デプロイ モデル\" が使用されていないことを確認する", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", - "service": "Azure Monitor", - "text": "40 の異なるログ分析ワークスペース間で支出と節約の機会を確認する - 非運用ワークスペースに異なる保持とデータ収集を使用する - 認識と階層サイズ設定のための日次上限を作成する - 日次上限を設定する場合は、上限に達したときにアラートを作成するだけでなく、ある割合 (90% など) に達したときに通知されるアラート ルールも作成してください。- 可能であればワークスペースの変革を検討する - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "Microsoft Defender を活用して、不審なアクティビティや構成ミスについて学習します。", + "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", + "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", + "service": "Azure Storage", + "severity": "高い", + "text": "すべてのストレージ アカウントに対して Microsoft Defender を有効にする", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Azure Monitor", - "text": "ログのパージポリシーと自動化を適用する(必要に応じて、ログをコールドストレージに移動できます)", - "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "論理的な削除メカニズムを使用すると、誤って削除された BLOB を回復できます。", + "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", + "service": "Azure Storage", + "severity": "中程度", + "text": "BLOB の \"論理的な削除\" を有効にする", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "VM", - "text": "ディスクが本当に必要かどうかを確認し、必要でない場合は削除します。必要な場合は、下位のストレージ階層を見つけるか、バックアップを使用します。", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由などから、削除された情報がすぐに削除されるようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください。", + "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", + "severity": "中程度", + "text": "BLOB の '論理的な削除' を無効にする", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d1e44a19-659d-4395-afd7-7289b835556d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Storage", - "text": "未使用のストレージを下位階層に移動し、カスタマイズされたルールを使用することを検討する - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "コンテナーの論理的な削除を使用すると、コンテナーが削除された後に回復できます (たとえば、偶発的な削除操作から回復します)。", + "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", + "service": "Azure Storage", + "severity": "高い", + "text": "コンテナーの \"論理的な削除\" を有効にする", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "VM", - "text": "advisor が VM の適切なサイズ設定用に構成されていることを確認する", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由などから、削除された情報がすぐに削除されるようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください。", + "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", + "severity": "中程度", + "text": "コンテナーの \"論理的な削除\" を無効にする", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "description": "コスト分析でメーターカテゴリライセンスを検索して確認してください", - "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", - "service": "VM", - "text": "すべての Windows VM でスクリプトを実行する https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- Windows VM が頻繁に作成される場合は、ポリシーの実装を検討してください", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "削除前に削除ロックを最初に解除するようにユーザーに強制することで、ストレージ アカウントが誤って削除されないようにします", + "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", + "severity": "高い", + "text": "ストレージ アカウントでのリソース ロックの有効化", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "VM", - "text": "これは、すでにライセンスを持っている場合は、AHUBの下に置くこともできます https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "BLOB の \"訴訟ホールド\" または \"時間ベースの保持\" ポリシーを検討して、BLOB、コンテナー、またはストレージ アカウントを削除できないようにします。「不可能」は実際には「不可能」を意味することに注意してください。ストレージ アカウントに不変の BLOB が含まれる場合、そのストレージ アカウントを \"取り除く\" 唯一の方法は、Azure サブスクリプションを取り消すことです。", + "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", + "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", + "service": "Azure Storage", + "severity": "高い", + "text": "不変の BLOB を検討する", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "VM", - "text": "予約済み VM ファミリを柔軟性オプションで統合する (4 から 5 ファミリ以下)", - "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "ストレージ アカウントへの保護されていない HTTP/80 アクセスを無効にして、すべてのデータ転送が暗号化され、整合性が保護され、サーバーが認証されるようにすることを検討してください。", + "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Azure Storage", + "severity": "高い", + "text": "HTTPS を要求する (つまり、ストレージ アカウントのポート 80 を無効にする)", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", - "service": "VM", - "text": "Azure 予約インスタンスを利用する: この機能を使用すると、VM を 1 年または 3 年間予約できるため、PAYG 価格と比較して大幅なコスト削減が実現します。", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "ストレージ アカウントでカスタム ドメイン (ホスト名) を構成する場合は、TLS/HTTPS が必要かどうかを確認します。その場合は、ストレージ アカウントの前に Azure CDN を配置する必要があります。", + "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", + "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", + "service": "Azure Storage", + "severity": "高い", + "text": "HTTPS を適用する (HTTP を無効にする) 場合は、ストレージ アカウントにカスタム ドメイン (CNAME) を使用していないことを確認します。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "VM", - "text": "より大きなディスクのみ予約できます => 1 TiB -", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "クライアントが SAS トークンを使用して BLOB データにアクセスするときに HTTPS を要求すると、資格情報が失われるリスクを最小限に抑えることができます。", + "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", + "service": "Azure Storage", + "severity": "中程度", + "text": "Shared Access Signature (SAS) トークンを HTTPS 接続のみに制限する", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", - "service": "VM", - "text": "適切なサイズ最適化の後", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "AAD トークンは、可能な限り、共有アクセス署名よりも優先する必要があります", + "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", + "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", + "service": "Azure Storage", + "severity": "高い", + "text": "BLOB アクセスに Azure Active Directory (Azure AD) トークンを使用する", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Azure SQL", - "text": "該当するかどうかを確認し、ポリシー/変更 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations を適用します", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "ユーザー、グループ、またはアプリケーションにロールを割り当てる場合は、タスクの実行に必要なアクセス許可のみをセキュリティ プリンシパルに付与します。リソースへのアクセスを制限することで、意図しないデータの誤用と悪意のあるデータの誤用の両方を防ぐことができます。", + "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", + "service": "Azure Storage", + "severity": "中程度", + "text": "IaM アクセス許可の最小特権", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "VM", - "text": "VM +ライセンス部分の割引(ahub + 3YRI)は約70%の割引です", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "ユーザー委任 SAS は、Azure Active Directory (Azure AD) 資格情報と、SAS に指定されたアクセス許可によってセキュリティで保護されます。ユーザー委任 SAS は、そのスコープと機能の点でサービス SAS に似ていますが、サービス SAS よりもセキュリティ上の利点があります。", + "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", + "service": "Azure Storage", + "severity": "高い", + "text": "SAS を使用する場合は、ストレージ アカウント キー ベースの SAS よりも \"ユーザー委任 SAS\" を優先します。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "VM", - "text": "需要に合わせて、フラットなサイジングではなく、VMSS の使用を検討してください", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "ストレージ アカウント キー (\"共有キー\") には、監査機能がほとんどありません。誰がいつキーのコピーを取得したかを監視できますが、キーが複数の人の手に渡ると、使用状況を特定のユーザーに帰属させることは不可能です。AAD 認証のみに依存することで、ストレージへのアクセスをユーザーに結び付けやすくなります。", + "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", + "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", + "service": "Azure Storage", + "severity": "高い", + "text": "ストレージ アカウント キーを無効にして、AAD アクセス (およびユーザー委任 SAS) のみがサポートされるようにすることを検討してください。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Cost Optimization Checklist", - "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "AKS", - "text": "AKS オートスケーラーを使用してクラスターの使用量に一致させる (ポッドの要件がスケーラーと一致していることを確認する)", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "アクティビティ ログ データを使用して、ストレージ アカウントのセキュリティ (ストレージ アカウント キー、アクセス ポリシーなど) が \"いつ、誰が、何を、\"どのように\" 表示または変更されているかを特定します。", + "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", + "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", + "service": "Azure Storage", + "severity": "高い", + "text": "Azure Monitor を使用して、ストレージ アカウントに対するコントロール プレーン操作を監査することを検討してください", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Azure Backup", - "text": "該当する場合は、復旧ポイントを vault-archive に移動します (検証)", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "キーの有効期限ポリシーを使用すると、アカウントアクセスキーのローテーションのリマインダーを設定できます。リマインダーは、指定した間隔が経過し、キーがまだローテーションされていない場合に表示されます。", + "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", + "service": "Azure Storage", + "severity": "中程度", + "text": "ストレージ アカウント キーを使用する場合は、\"キーの有効期限ポリシー\" を有効にすることを検討してください", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", - "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", - "service": "Databricks", - "text": "可能な場合は、フォールバックでスポット VM を使用することを検討してください。クラスターの自動終了を検討してください。", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "SAS 有効期限ポリシーでは、SAS が有効である推奨間隔を指定します。SAS 有効期限ポリシーは、サービス SAS またはアカウント SAS に適用されます。ユーザーがサービス SAS またはアカウント SAS を、推奨間隔よりも長い有効期間で生成すると、警告が表示されます。", + "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", + "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", + "service": "Azure Storage", + "severity": "中程度", + "text": "SAS 有効期限ポリシーの構成を検討する", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", - "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", - "service": "Azure Functions", - "text": "関数 - 接続の再利用", - "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "保存されているアクセス ポリシーを使用すると、ストレージ アカウント キーを再生成することなく、サービス SAS のアクセス許可を取り消すことができます。", + "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", + "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", + "service": "Azure Storage", + "severity": "中程度", + "text": "保存されているアクセス ポリシーに SAS をリンクすることを検討する", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview", - "service": "Azure Functions", - "text": "関数 - データをローカルにキャッシュする", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", + "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", + "service": "Azure Storage", + "severity": "中程度", + "text": "チェックインされた接続文字列とストレージ アカウント キーを検出するようにアプリケーションのソース コード リポジトリを構成することを検討してください。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Azure Functions", - "text": "関数 - コールド スタート - 「パッケージから実行」機能を使用します。このようにして、コードは単一のzipファイルとしてダウンロードされます。これにより、たとえば、多くのノードモジュールを持つJavascript関数が大幅に改善される可能性があります。言語固有のツールを使用してパッケージサイズを縮小します (ツリーを揺るがす Javascript アプリケーションなど)。", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "理想的には、アプリケーションでマネージド ID を使用して Azure Storage に対する認証を行う必要があります。それが不可能な場合は、ストレージ資格情報 (接続文字列、ストレージ アカウント キー、SAS、サービス プリンシパル資格情報) を Azure KeyVault または同等のサービスに用意することを検討してください。", + "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", + "service": "Azure Storage", + "severity": "高い", + "text": "接続文字列を Azure KeyVault に格納することを検討する (マネージド ID が不可能なシナリオの場合)", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "Azure Functions", - "text": "関数 - 関数を暖かく保つ", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "アドホック SAS サービス SAS またはアカウント SAS で、有効期限が近づいています。このように、SAS が侵害された場合でも、有効期間は短時間です。この方法は、保存されているアクセス ポリシーを参照できない場合に特に重要です。また、有効期限が近いと、BLOB にアップロードできる時間が制限されるため、BLOB に書き込めるデータの量も制限されます。", + "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", + "severity": "高い", + "text": "アドホックSASの有効期間を短くする", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Azure Functions", - "text": "さまざまな関数で自動スケーリングを使用する場合、すべてのリソースのすべての自動スケーリングを駆動する 1 つが存在する可能性があるため、別の従量課金プランに移行することを検討してください (また、CPU のより高いプランを検討してください)", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "SAS を作成するときは、できるだけ具体的かつ制限的にしてください。1 つのリソースと操作には、より広範なアクセスを提供する SAS よりも SAS を優先します。", + "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", + "severity": "中程度", + "text": "SAS に狭いスコープを適用する", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", - "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", - "service": "Azure Functions", - "text": "特定のプランの関数アプリはすべて一緒にスケーリングされるため、スケーリングに関する問題はプラン内のすべてのアプリに影響を与える可能性があります。", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "SAS には、SAS を使用してリソースを要求する権限をクライアント IP アドレスまたはアドレス範囲に与えるパラメーターを含めることができます。", + "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", + "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", + "service": "Azure Storage", + "severity": "中程度", + "text": "可能な限り、SAS のスコープを特定のクライアント IP アドレスに設定することを検討してください", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", - "service": "Azure Functions", - "text": "「待機時間」に対して請求されますか?この質問は、通常、非同期操作を実行して結果を待機する C# 関数のコンテキストで尋ねられます (例: await Task.Delay(1000) や await client)。GetAsync('http://google.com') です。答えはイエスです-GB秒の計算は、関数の開始時刻と終了時刻、およびその期間のメモリ使用量に基づいています。その間に CPU アクティビティに関して実際に何が起こるかは、計算には考慮されません。この規則の 1 つの例外は、永続関数を使用している場合です。オーケストレーター関数で待機に費やされた時間に対しては課金されません。可能な場合は、デマンド シェーピング技術を適用します (開発環境?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "SAS は、クライアントがアップロードするデータの量を制限できません。時間の経過に伴うストレージ容量の価格モデルを考えると、クライアントが悪意を持って大きなコンテンツをアップロードしたかどうかを検証することは理にかなっているかもしれません。", + "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", + "service": "Azure Storage", + "severity": "低い", + "text": "クライアントが SAS を使用してファイルをアップロードした後、アップロードされたデータを確認することを検討してください。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Front Door", - "text": "Frontdoor - 既定のホームページをオフにするアプリのアプリケーション設定で、AzureWebJobsDisableHomepage を true に設定します。これにより、PoPに204(No Content)が返されるため、ヘッダーデータのみが返されます。", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "\"ローカル ユーザー アカウント\" を使用して SFTP 経由で BLOB ストレージにアクセスする場合、\"通常の\" RBAC 制御は適用されません。NFS または REST 経由の BLOB アクセスは、SFTP アクセスよりも制限が厳しい場合があります。残念ながら、2023 年初頭の時点で、SFTP エンドポイントで現在サポートされている ID 管理の形式はローカル ユーザーだけです", + "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", + "service": "Azure Storage", + "severity": "高い", + "text": "SFTP: SFTPアクセスの「ローカルユーザー」の数を制限し、時間の経過とともにアクセスが必要かどうかを監査します。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Front Door", - "text": "Frontdoor - 何も返さないものへのルーティング。関数、関数プロキシを設定するか、200 (OK) を返し、コンテンツを送信しない、または最小限のコンテンツを送信 するルートを Web アプリに追加します。これの利点は、呼び出されたときにログアウトできることです。", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", + "service": "Azure Storage", + "severity": "中程度", + "text": "SFTP: SFTP エンドポイントは、POSIX ライクな ACL をサポートしていません。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", - "service": "Storage", - "text": "使用頻度の低いデータの階層のアーカイブを検討する", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "VM", - "text": "サイズが階層と一致しない場合は、ディスク サイズを確認します (つまり、513 GiB のディスクは P30 (1TiB) を支払います) と、サイズ変更を検討してください", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "Storage", - "text": "可能な場合は、Premium や Ultra ではなく Standard SSD の使用を検討してください", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "Storage", - "text": "ストレージ アカウントの場合は、選択したレベルによってトランザクション料金が加算されていないことを確認します (次のレベルに移動する方が安くなる可能性があります)", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "Site Recovery", - "text": "ASR の場合、RPO/RTO とレプリケーション スループットで許可されている場合は、Standard SSD ディスクの使用を検討してください", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", - "service": "Storage", - "text": "ストレージ アカウント: 必要なホット層や GRS を確認する", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "VM", - "text": "ディスク - あらゆる場所で Premium SSD ディスクの使用を検証: たとえば、非運用環境を Standard SSD またはオンデマンド Premium SSD にスワップできます", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "Synapse", - "text": "予算を作成してコストを管理し、支出の異常や過剰支出のリスクを関係者に自動的に通知するアラートを作成します。", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "Synapse", - "text": "追加のデータ分析のために、コスト データをストレージ アカウントにエクスポートします。", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Synapse", - "text": "専用 SQL プールのコストを制御するには、リソースが使用されていないときに一時停止します。", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", - "service": "Synapse", - "text": "サーバーレス Apache Spark の自動一時停止機能を有効にし、それに応じてタイムアウト値を設定します。", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Synapse", - "text": "さまざまなサイズの複数の Apache Spark プール定義を作成します。", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "service": "Synapse", - "text": "Azure Synapse Analytics のコストを節約するために、事前購入プランで Azure Synapse コミット ユニット (SCU) を 1 年間購入します。", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "費用" - }, - { - "checklist": "Cost Optimization Checklist", - "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "VM", - "text": "中断可能なジョブにスポット VM を使用する: これらは、割引価格で入札および購入できる VM であり、重要でないワークロードにコスト効率の高いソリューションを提供します。", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "ストレージは、CORS (Cross-Origin Resource Sharing)、つまり、異なるドメインの Web アプリが同一生成元ポリシーを緩めることを可能にする HTTP 機能をサポートしています。CORS を有効にする場合は、CorsRules を最小の特権に保ちます。", + "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", + "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", + "service": "Azure Storage", + "severity": "高い", + "text": "過度に広範な CORS ポリシーを避ける", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "544451e1-92d3-4442-a3c7-628637a551c5", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", - "text": "すべての VM の適切なサイズ設定", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "保存データは常にサーバー側で暗号化され、さらにクライアント側でも暗号化される場合があります。サーバー側の暗号化は、プラットフォーム マネージド キー (既定) またはカスタマー マネージド キーを使用して行われる場合があります。クライアント側の暗号化は、クライアントが BLOB ごとに暗号化/暗号化解除キーを Azure Storage に提供するか、クライアント側で暗号化を完全に処理することによって行われます。そのため、機密性の保証を Azure Storage にまったく依存しません。", + "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "Azure Storage", + "severity": "高い", + "text": "保存データの暗号化方法を決定します。データのスレッド モデルを理解します。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "VM", - "text": "正規化されたサイズと最新のサイズでサイズをスワップする VM", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", + "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", + "service": "Azure Storage", + "severity": "中程度", + "text": "どのプラットフォーム暗号化を使用するか、または使用するかを決定します。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "VM の適切なサイズ設定 - 使用率を 5% 未満で監視することから始めて、その後 40% まで作業します", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", + "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", + "service": "Azure Storage", + "severity": "中程度", + "text": "クライアント側の暗号化を使用するかどうかを決定します。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "アプリケーションをコンテナー化すると、VM の密度が向上し、スケーリングにかかるコストを節約できます", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "費用" + "checklist": "Azure Blob Storage Review", + "description": "Resource Graph エクスプローラー (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) を利用して、匿名 BLOB アクセスを許可するストレージ アカウントを検索します。", + "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", + "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", + "service": "Azure Storage", + "severity": "高い", + "text": "パブリック BLOB アクセスが必要かどうか、または特定のストレージ アカウントに対して無効にできるかどうかを検討します。", + "waf": "安全" }, { "checklist": "Redis Resiliency checklist", @@ -1952,3434 +1893,3229 @@ "waf": "安全" }, { - "checklist": "Logic Apps checklist", - "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", - "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", - "service": "Logic Apps", - "severity": "高い", - "text": "ビジネスと SLO の要件に基づいて適切なロジック アプリのホスティング プランを選択する", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "service": "Azure Monitor", + "text": "Azure Monitor のデータ収集ルール - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "費用" }, { - "checklist": "Logic Apps checklist", - "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", - "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "Logic Apps", - "severity": "高い", - "text": "ゾーンの冗長性と可用性ゾーンを使用してリージョンの障害からロジック アプリを保護する", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "45901365-d38e-443f-abcb-d868266abca2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Azure Backup", + "text": "基になるデータソースが見つからないバックアップインスタンスを確認する", + "waf": "費用" }, { - "checklist": "Logic Apps checklist", - "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", - "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Logic Apps", - "severity": "高い", - "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "VM", + "text": "関連づけられていないサービス(ディスク、NIC、IPアドレスなど)を削除またはアーカイブする", + "waf": "費用" }, { - "checklist": "Logic Apps checklist", - "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", - "link": "https://learn.microsoft.com/azure/app-service/environment/intro", - "service": "Logic Apps", - "severity": "高い", - "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Azure Backup", + "text": "ミッション クリティカルでないアプリケーションの Site Recovery ストレージとバックアップのバランスを考慮する", + "waf": "費用" }, { - "checklist": "Logic Apps checklist", - "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", - "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", - "service": "Logic Apps", - "severity": "中程度", - "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、ロジック アプリ コードを保護", - "waf": "オペレーションズ" + "checklist": "Cost Optimization Checklist", + "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", + "service": "Azure Monitor", + "text": "40 の異なるログ分析ワークスペース間で支出と節約の機会を確認する - 非運用ワークスペースに異なる保持とデータ収集を使用する - 認識と階層サイズ設定のための日次上限を作成する - 日次上限を設定する場合は、上限に達したときにアラートを作成するだけでなく、ある割合 (90% など) に達したときに通知されるアラート ルールも作成してください。- 可能であればワークスペースの変革を検討する - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", + "waf": "費用" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", - "service": "Azure Data Factory", - "severity": "中程度", - "text": "Azure Data Factory の FTA 回復性プレイブックの活用", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Azure Monitor", + "text": "ログのパージポリシーと自動化を適用する(必要に応じて、ログをコールドストレージに移動できます)", + "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", + "waf": "費用" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", - "severity": "高い", - "text": "Availability Zones をサポートするリージョンでゾーン冗長パイプラインを使用するUse zone redundant pipelines in regions that support Availability Zones", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "VM", + "text": "ディスクが本当に必要かどうかを確認し、必要でない場合は削除します。必要な場合は、下位のストレージ階層を見つけるか、バックアップを使用します。", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", + "waf": "費用" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", - "link": "https://learn.microsoft.com/azure/data-factory/source-control", - "service": "Azure Data Factory", - "severity": "中程度", - "text": "DevOps を使用して Github と Azure DevOps の統合で ARM テンプレートをバックアップする", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "d1e44a19-659d-4395-afd7-7289b835556d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Storage", + "text": "未使用のストレージを下位階層に移動し、カスタマイズされたルールを使用することを検討する - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "waf": "費用" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", - "severity": "中程度", - "text": "セルフホステッド統合ランタイム VM を別のリージョンにレプリケートしてください", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "VM", + "text": "advisor が VM の適切なサイズ設定用に構成されていることを確認する", + "waf": "費用" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", - "severity": "中程度", - "text": "必ず、姉妹リージョンでネットワークをレプリケートまたは複製してください。別のリージョンに VNet のコピーを作成する必要があります", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "description": "コスト分析でメーターカテゴリライセンスを検索して確認してください", + "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", + "service": "VM", + "text": "すべての Windows VM でスクリプトを実行する https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- Windows VM が頻繁に作成される場合は、ポリシーの実装を検討してください", + "waf": "費用" }, { - "checklist": "Azure Data Factory Review Checklist", - "description": "ADF パイプラインで Key Vault が使用されている場合は、Key Vault をレプリケートするために何もする必要はありません。Key Vault はマネージド サービスであり、Microsoft が処理します", - "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Azure Data Factory", - "severity": "低い", - "text": "Keyvault 統合を使用している場合は、Keyvault の SLA を使用して可用性を把握します", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "VM", + "text": "これは、すでにライセンスを持っている場合は、AHUBの下に置くこともできます https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", - "service": "Entra", - "severity": "中程度", - "text": "マルチテナントに関する明確な規制要件またはビジネス要件がない限り、Azure リソースの管理には 1 つの Entra テナントを使用します。", - "waf": "オペレーションズ" + "checklist": "Cost Optimization Checklist", + "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "VM", + "text": "予約済み VM ファミリを柔軟性オプションで統合する (4 から 5 ファミリ以下)", + "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Entra", - "severity": "低い", - "text": "Microsoft Entra ID テナントを管理するためのマルチテナント自動化アプローチがあることを確認する", - "waf": "オペレーションズ" + "checklist": "Cost Optimization Checklist", + "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", + "service": "VM", + "text": "Azure 予約インスタンスを利用する: この機能を使用すると、VM を 1 年または 3 年間予約できるため、PAYG 価格と比較して大幅なコスト削減が実現します。", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "Entra", - "severity": "低い", - "text": "マルチテナント管理に Azure Lighthouse を活用する", - "waf": "オペレーションズ" + "checklist": "Cost Optimization Checklist", + "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "VM", + "text": "より大きなディスクのみ予約できます => 1 TiB -", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Entra", - "severity": "中程度", - "text": "パートナーによるテナントの管理に Azure Lighthouse が使用されていることを確認する", + "checklist": "Cost Optimization Checklist", + "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", + "service": "VM", + "text": "適切なサイズ最適化の後", "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "348ef254-c27d-442e-abba-c7571559ab91", - "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "service": "Entra", - "severity": "高い", - "text": "クラウド運用モデルに合わせた RBAC モデルを適用します。管理グループとサブスクリプション全体のスコープと割り当てを行います。", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Azure SQL", + "text": "該当するかどうかを確認し、ポリシー/変更 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations を適用します", + "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", - "service": "Entra", - "severity": "高い", - "text": "すべてのアカウントの種類で、認証の種類である職場または学校アカウントのみを使用します。Microsoft アカウントの使用は避けてください", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "VM", + "text": "VM +ライセンス部分の割引(ahub + 3YRI)は約70%の割引です", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "Entra", - "severity": "中程度", - "text": "アクセス許可の割り当てには、グループのみを使用します。グループ管理システムが既に導入されている場合は、オンプレミス グループを Entra ID のみのグループに追加します。", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "VM", + "text": "需要に合わせて、フラットなサイジングではなく、VMSS の使用を検討してください", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", - "service": "Entra", - "severity": "低い", - "text": "Azure 環境に対する権限を持つすべてのユーザーに Microsoft Entra ID 条件付きアクセス ポリシーを適用する", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Cost Optimization Checklist", + "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "AKS", + "text": "AKS オートスケーラーを使用してクラスターの使用量に一致させる (ポッドの要件がスケーラーと一致していることを確認する)", + "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", - "service": "Entra", - "severity": "高い", - "text": "Azure 環境に対する権限を持つすべてのユーザーに多要素認証を適用する", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Azure Backup", + "text": "該当する場合は、復旧ポイントを vault-archive に移動します (検証)", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "14658d35-58fd-4772-99b8-21112df27ee4", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "Entra", - "severity": "中程度", - "text": "Microsoft Entra ID Privileged Identity Management (PIM) を適用して、ゼロの永続的なアクセスと最小限の特権を確立します", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", + "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", + "service": "Databricks", + "text": "可能な場合は、フォールバックでスポット VM を使用することを検討してください。クラスターの自動終了を検討してください。", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "Entra", - "severity": "中程度", - "text": "Active Directory ドメイン サービスから Entra ドメイン サービスへの切り替えを計画している場合は、すべてのワークロードの互換性を評価します", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", + "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", + "service": "Azure Functions", + "text": "関数 - 接続の再利用", + "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", - "service": "Entra", - "severity": "中程度", - "text": "Microsoft Entra ID ログをプラットフォーム中心の Azure Monitor と統合します。Azure Monitor を使用すると、Azure のログと監視データに関する信頼できる唯一の情報源が得られ、ログの収集と保持に関する要件を満たすクラウド ネイティブ オプションが組織に提供されます。", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "service": "Azure Functions", + "text": "関数 - データをローカルにキャッシュする", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", + "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "984a859c-773e-47d2-9162-3a765a917e1f", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", - "service": "Entra", - "severity": "高い", - "text": "テナント全体のアカウント ロックアウトを防ぐために、緊急アクセスまたは非常用アカウントを実装する", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Azure Functions", + "text": "関数 - コールド スタート - 「パッケージから実行」機能を使用します。このようにして、コードは単一のzipファイルとしてダウンロードされます。これにより、たとえば、多くのノードモジュールを持つJavascript関数が大幅に改善される可能性があります。言語固有のツールを使用してパッケージサイズを縮小します (ツリーを揺るがす Javascript アプリケーションなど)。", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "35037e68-9349-4c15-b371-228514f4cdff", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "Entra", - "severity": "中程度", - "text": "Microsoft Entra ID ロールの割り当てにオンプレミスの同期アカウントを使用しないでください。", - "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "Azure Functions", + "text": "関数 - 関数を暖かく保つ", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Entra", - "severity": "中程度", - "text": "必要に応じて、Microsoft Entra ID アプリケーション プロキシを使用して、内部アプリケーション (クラウドまたはオンプレミスでホストされている) への安全で認証されたアクセスをリモート ユーザーに付与します。", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Azure Functions", + "text": "さまざまな関数で自動スケーリングを使用する場合、すべてのリソースのすべての自動スケーリングを駆動する 1 つが存在する可能性があるため、別の従量課金プランに移行することを検討してください (また、CPU のより高いプランを検討してください)", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", - "service": "VNet", - "severity": "中程度", - "text": "従来のハブアンドスポーク ネットワーク トポロジに基づくネットワーク設計を、最大限の柔軟性を必要とするネットワーク シナリオに活用します。", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", + "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", + "service": "Azure Functions", + "text": "特定のプランの関数アプリはすべて一緒にスケーリングされるため、スケーリングに関する問題はプラン内のすべてのアプリに影響を与える可能性があります。", + "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", - "service": "VNet", - "severity": "高い", - "text": "ExpressRoute ゲートウェイ、VPN ゲートウェイ、Azure Firewall などの共有ネットワーク サービス、または中央ハブ仮想ネットワーク内のパートナーの NVA を確認します。必要に応じて、DNS サーバーも展開します。", + "checklist": "Cost Optimization Checklist", + "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", + "service": "Azure Functions", + "text": "「待機時間」に対して請求されますか?この質問は、通常、非同期操作を実行して結果を待機する C# 関数のコンテキストで尋ねられます (例: await Task.Delay(1000) や await client)。GetAsync('http://google.com') です。答えはイエスです-GB秒の計算は、関数の開始時刻と終了時刻、およびその期間のメモリ使用量に基づいています。その間に CPU アクティビティに関して実際に何が起こるかは、計算には考慮されません。この規則の 1 つの例外は、永続関数を使用している場合です。オーケストレーター関数で待機に費やされた時間に対しては課金されません。可能な場合は、デマンド シェーピング技術を適用します (開発環境?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "VNet", - "severity": "中程度", - "text": "アプリケーション ランディング ゾーン内のすべてのパブリック IP アドレスに対して DDoS ネットワークまたは IP 保護プランを使用します。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Front Door", + "text": "Frontdoor - 既定のホームページをオフにするアプリのアプリケーション設定で、AzureWebJobsDisableHomepage を true に設定します。これにより、PoPに204(No Content)が返されるため、ヘッダーデータのみが返されます。", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", - "severity": "中程度", - "text": "パートナー ネットワーク テクノロジまたは NVA をデプロイする場合は、パートナー ベンダーのガイダンスに従ってください", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Front Door", + "text": "Frontdoor - 何も返さないものへのルーティング。関数、関数プロキシを設定するか、200 (OK) を返し、コンテンツを送信しない、または最小限のコンテンツを送信 するルートを Web アプリに追加します。これの利点は、呼び出されたときにログアウトできることです。", + "waf": "費用" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", - "service": "ExpressRoute", - "severity": "低い", - "text": "ハブ アンド スポーク シナリオで ExpressRoute と VPN ゲートウェイ間の転送が必要な場合は、Azure Route Server を使用します。", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", + "service": "Storage", + "text": "使用頻度の低いデータの階層のアーカイブを検討する", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", - "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", - "service": "ARS", - "severity": "低い", - "text": "Route Server を使用する場合は、Route Server サブネットに /27 プレフィックスを使用します。", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "VM", + "text": "サイズが階層と一致しない場合は、ディスク サイズを確認します (つまり、513 GiB のディスクは P30 (1TiB) を支払います) と、サイズ変更を検討してください", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", - "service": "VNet", - "severity": "中程度", - "text": "複数のハブ アンド スポーク トポロジを持つネットワーク アーキテクチャでは、ハブ VNet 間のグローバル仮想ネットワーク ピアリングを使用して、リージョンを相互に接続します。", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", - "waf": "パフォーマンス" + "checklist": "Cost Optimization Checklist", + "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "Storage", + "text": "可能な場合は、Premium や Ultra ではなく Standard SSD の使用を検討してください", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", - "service": "VNet", - "severity": "中程度", - "text": "Azure Monitor for Networks を使用して、Azure 上のネットワークのエンド ツー エンドの状態を監視します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "オペレーションズ" + "checklist": "Cost Optimization Checklist", + "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "Storage", + "text": "ストレージ アカウントの場合は、選択したレベルによってトランザクション料金が加算されていないことを確認します (次のレベルに移動する方が安くなる可能性があります)", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", - "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", - "severity": "中程度", - "text": "スポーク仮想ネットワークを中央ハブ仮想ネットワークに接続する場合は、ExpressRoute 経由でアドバタイズできるプレフィックスの最大数である VNet ピアリングの制限 (500) (1000) を考慮してください", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "Site Recovery", + "text": "ASR の場合、RPO/RTO とレプリケーション スループットで許可されている場合は、Standard SSD ディスクの使用を検討してください", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", - "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", - "severity": "中程度", - "text": "ルート テーブルあたりのルート数の制限 (400) を考慮します。", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", + "service": "Storage", + "text": "ストレージ アカウント: 必要なホット層や GRS を確認する", + "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", - "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", - "service": "VNet", - "severity": "高い", - "text": "VNet ピアリングを構成するときに [リモート仮想ネットワークへのトラフィックを許可する] 設定を使用します", - "waf": "確実" + "checklist": "Cost Optimization Checklist", + "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "VM", + "text": "ディスク - あらゆる場所で Premium SSD ディスクの使用を検証: たとえば、非運用環境を Standard SSD またはオンデマンド Premium SSD にスワップできます", + "waf": "費用" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", - "service": "ExpressRoute", - "severity": "中程度", - "text": "ExpressRoute Direct を使用している場合は、組織のルーターと MSEE 間のレイヤー 2 レベルでトラフィックを暗号化するために MACsec を構成します。この図は、この暗号化をフローで示しています。", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "Synapse", + "text": "予算を作成してコストを管理し、支出の異常や過剰支出のリスクを関係者に自動的に通知するアラートを作成します。", + "waf": "費用" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", - "severity": "低い", - "text": "MACsec がオプションではないシナリオ (ExpressRoute Direct を使用しない場合など) では、VPN ゲートウェイを使用して、ExpressRoute プライベート ピアリング経由で IPsec トンネルを確立します。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "Synapse", + "text": "追加のデータ分析のために、コスト データをストレージ アカウントにエクスポートします。", + "waf": "費用" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "558fd772-49b8-4211-82df-27ee412e7f98", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "ExpressRoute", - "severity": "高い", - "text": "Azure リージョンとオンプレミスの場所間で重複する IP アドレス空間が使用されていないことを確認します", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Synapse", + "text": "専用 SQL プールのコストを制御するには、リソースが使用されていないときに一時停止します。", + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", - "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", - "severity": "低い", - "text": "プライベート インターネットのアドレス割り当て範囲 (RFC 1918) の IP アドレスを使用します。", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", + "service": "Synapse", + "text": "サーバーレス Apache Spark の自動一時停止機能を有効にし、それに応じてタイムアウト値を設定します。", + "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", - "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", - "severity": "高い", - "text": "IP アドレス空間が無駄にならないようにし、不必要に大きな仮想ネットワーク (/16 など) を作成しないようにします", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "パフォーマンス" + "checklist": "Cost Optimization Checklist", + "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Synapse", + "text": "さまざまなサイズの複数の Apache Spark プール定義を作成します。", + "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", - "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", - "service": "VNet", - "severity": "高い", - "text": "運用サイトと DR サイトで重複する IP アドレス範囲を使用しないでください。", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "確実" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", - "severity": "中程度", - "text": "Azure での名前解決のみが必要な環境では、名前解決用の委任されたゾーン ('azure.contoso.com' など) を使用して解決に Azure プライベート DNS を使用します。", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "オペレーションズ" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", - "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", - "service": "DNS", - "severity": "中程度", - "text": "Azure とオンプレミスでの名前解決が必要な環境では、Azure DNS Private Resolver の使用を検討してください。", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", - "waf": "安全" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", - "severity": "低い", - "text": "独自の DNS (Red Hat OpenShift など) を必要としてデプロイする特別なワークロードでは、優先 DNS ソリューションを使用する必要があります。", - "waf": "オペレーションズ" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "614658d3-558f-4d77-849b-821112df27ee", - "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", - "service": "DNS", - "severity": "高い", - "text": "Azure DNS の自動登録を有効にすると、仮想ネットワーク内にデプロイされた仮想マシンの DNS レコードのライフサイクルが自動的に管理されます。", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "オペレーションズ" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", - "service": "Bastion", - "severity": "中程度", - "text": "Azure Bastion を使用してネットワークに安全に接続することを検討してください。", - "waf": "安全" - }, - { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", - "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", - "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", - "service": "Bastion", - "severity": "中程度", - "text": "Azure Bastion は、サブネット /26 以上で使用します。", - "waf": "安全" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "WAF", - "severity": "中程度", - "text": "Azure Front Door と WAF ポリシーを使用して、ランディング ゾーンへの受信 HTTP/S 接続に対して Azure リージョン全体でグローバル保護を提供します。", + "checklist": "Cost Optimization Checklist", + "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "service": "Synapse", + "text": "Azure Synapse Analytics のコストを節約するために、事前購入プランで Azure Synapse コミット ユニット (SCU) を 1 年間購入します。", "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "安全" + "waf": "費用" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "severity": "低い", - "text": "Azure Front Door と Azure Application Gateway を使用して HTTP/S アプリを保護する場合は、Azure Front Door で WAF ポリシーを使用します。Azure Application Gateway をロックダウンして、Azure Front Door からのトラフィックのみを受信するようにします。", + "checklist": "Cost Optimization Checklist", + "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "VM", + "text": "中断可能なジョブにスポット VM を使用する: これらは、割引価格で入札および購入できる VM であり、重要でないワークロードにコスト効率の高いソリューションを提供します。", "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "安全" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "severity": "高い", - "text": "WAF とその他のリバース プロキシは、受信 HTTP/S 接続に必要であり、ランディング ゾーン仮想ネットワーク内にデプロイし、保護してインターネットに公開しているアプリと共にデプロイします。", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "安全" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", - "severity": "高い", - "text": "Azure DDoS ネットワークまたは IP Protection プランを使用して、仮想ネットワーク内のパブリック IP アドレス エンドポイントを保護します。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b034c01e-110b-463a-b36e-e3346e57f225", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", - "service": "VNet", - "severity": "高い", - "text": "今後の破壊的変更の前に、ネットワーク送信トラフィックの構成と戦略を評価および確認します。2025 年 9 月 30 日に、新しいデプロイの既定の送信アクセスは廃止され、明示的なアクセス構成のみが許可されます", - "waf": "確実" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", - "severity": "高い", - "text": "診断設定を追加して、保護されているすべてのパブリック IP アドレス (DDoS IP またはネットワーク保護) の DDoS 関連ログを保存します。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", - "service": "ExpressRoute", - "severity": "中程度", - "text": "ExpressRoute を Azure へのプライマリ接続として使用する可能性を調査したことを確認します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "パフォーマンス" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "description": "AS パスのプリペンドと接続の重みを使用して、Azure からオンプレミスへのトラフィックに影響を与え、独自のルーターの全範囲の BGP 属性を使用して、オンプレミスから Azure へのトラフィックに影響を与えることができます。", - "guid": "f29812b2-363c-4efe-879b-599de0d5973c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", - "severity": "中程度", - "text": "複数の ExpressRoute 回線、または複数のオンプレミスの場所を使用する場合、特定のパスが優先される場合は、BGP 属性を使用してルーティングを最適化してください。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "確実" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", - "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", - "severity": "中程度", - "text": "帯域幅とパフォーマンスの要件に基づいて、ExpressRoute/VPN ゲートウェイに適切な SKU を使用していることを確認します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "パフォーマンス" - }, - { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", - "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", - "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", - "service": "ExpressRoute", - "severity": "高い", - "text": "無制限のデータ ExpressRoute 回線は、コストに見合った帯域幅に達した場合にのみ使用してください。", "waf": "費用" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", - "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", - "service": "ExpressRoute", - "severity": "高い", - "text": "回線のピアリングの場所がローカル SKU の Azure リージョンをサポートしている場合は、ExpressRoute のローカル SKU を利用して回線のコストを削減します。", + "checklist": "Cost Optimization Checklist", + "guid": "544451e1-92d3-4442-a3c7-628637a551c5", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", + "text": "すべての VM の適切なサイズ設定", "waf": "費用" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", - "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", - "service": "ExpressRoute", - "severity": "中程度", - "text": "サポートされている Azure リージョンにゾーン冗長 ExpressRoute ゲートウェイをデプロイします。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "確実" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", - "service": "ExpressRoute", - "severity": "中程度", - "text": "10 Gbps を超える帯域幅または専用の 10/100 Gbps ポートを必要とするシナリオでは、ExpressRoute Direct を使用します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "パフォーマンス" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", - "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", - "service": "ExpressRoute", - "severity": "中程度", - "text": "待機時間を短くする必要がある場合、またはオンプレミスから Azure へのスループットを 10 Gbps を超える必要がある場合は、FastPath を有効にして、データ パスから ExpressRoute ゲートウェイをバイパスします。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "パフォーマンス" - }, - { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", - "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", - "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", - "service": "VPN", - "severity": "中程度", - "text": "ゾーン冗長 VPN ゲートウェイを使用して、ブランチまたはリモートの場所を Azure に接続します (使用可能な場合)。", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "確実" - }, - { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", - "service": "VPN", - "severity": "中程度", - "text": "冗長 VPN アプライアンスをオンプレミス (アクティブ/アクティブまたはアクティブ/パッシブ) で使用します。", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "確実" - }, - { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "718cb437-b060-2589-8856-2e93a5c6633b", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", - "severity": "高い", - "text": "ExpressRoute Direct を使用する場合は、コストを節約するために、ローカルの Azure リージョンへの ExpressRoute Local 回線の使用を検討してください", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "checklist": "Cost Optimization Checklist", + "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "VM", + "text": "正規化されたサイズと最新のサイズでサイズをスワップする VM", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "費用" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", - "service": "ExpressRoute", - "severity": "中程度", - "text": "運用環境と非運用環境を分離する場合など、トラフィックの分離または専用の帯域幅が必要な場合は、異なる ExpressRoute 回線を使用します。これにより、ルーティング ドメインが分離され、ノイジー ネイバーのリスクが軽減されます。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "安全" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b30e38c3-f298-412b-8363-cefe179b599d", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", - "service": "ExpressRoute", - "severity": "中程度", - "text": "組み込みの Express Route Insights を使用して、ExpressRoute の可用性と使用率を監視します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "オペレーションズ" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", - "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", - "service": "ExpressRoute", - "severity": "中程度", - "text": "接続モニターは、ネットワーク全体 (特にオンプレミスと Azure 間) の接続を監視するために使用します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "オペレーションズ" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", - "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", - "service": "ExpressRoute", - "severity": "中程度", - "text": "冗長性のために、異なるピアリングの場所からの ExpressRoute 回線を使用します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "確実" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", - "service": "ExpressRoute", - "severity": "中程度", - "text": "ExpressRoute のフェールオーバーとしてサイト間 VPN を使用します (特に、1 つの ExpressRoute 回線のみを使用する場合)。", - "waf": "確実" - }, - { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", - "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", - "service": "ExpressRoute", - "severity": "高い", - "text": "GatewaySubnet でルート テーブルを使用している場合は、ゲートウェイ ルートが伝達されていることを確認します。", - "waf": "確実" - }, - { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "d581a947-69a2-4783-942e-9df3664324c8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", - "service": "ExpressRoute", - "severity": "高い", - "text": "ExpressRoute を使用する場合、オンプレミスのルーティングは動的である必要があり、接続障害が発生した場合は、回線の残りの接続に収束する必要があります。負荷は、アクティブ/パッシブもサポートされていますが、理想的にはアクティブ/アクティブとして両方の接続で共有する必要があります。", - "waf": "確実" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", - "service": "ExpressRoute", - "severity": "中程度", - "text": "ExpressRoute 回線の 2 つの物理リンクが、ネットワーク内の 2 つの異なるエッジ デバイスに接続されていることを確認します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "確実" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", - "service": "ExpressRoute", - "severity": "中程度", - "text": "Bidirectional Forwarding Detection(BFD)が有効で、顧客またはプロバイダーのエッジ ルーティング デバイスで設定されていることを確認します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "確実" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "ExpressRoute", - "severity": "高い", - "text": "回復性を高めるために、ExpressRoute ゲートウェイを異なるピアリングの場所から 2 つ以上の回線に接続します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "確実" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", - "service": "ExpressRoute", - "severity": "中程度", - "text": "ExpressRoute 仮想ネットワーク ゲートウェイの診断ログとアラートを構成します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "オペレーションズ" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5234c93f-b651-41dd-80c1-234177b91ced", - "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", - "service": "ExpressRoute", - "severity": "中程度", - "text": "VNet 間通信に ExpressRoute 回線を使用しないでください。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "パフォーマンス" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", - "severity": "高い", - "text": "Azure Firewall を使用して、インターネットへの Azure 送信トラフィック、HTTP/S 以外の受信接続、East/West トラフィック フィルター処理 (組織で必要な場合) を管理します", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", - "severity": "中程度", - "text": "グローバル ネットワーク環境全体のセキュリティ体制を管理するグローバル Azure Firewall ポリシーを作成し、それをすべての Azure Firewall インスタンスに割り当てます。Azure のロールベースのアクセス制御を介して増分ファイアウォール ポリシーをローカルのセキュリティ チームに委任することで、特定のリージョンの要件を満たすきめ細かなポリシーが可能になります。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", - "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", - "service": "Firewall", - "severity": "低い", - "text": "組織がそのようなソリューションを使用してアウトバウンド接続を保護する場合は、Firewall Manager 内でサポートされているパートナーの SaaS セキュリティ プロバイダーを構成します。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", - "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", - "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", - "service": "Firewall", - "severity": "高い", - "text": "FQDN ベースのネットワーク ルールと DNS プロキシを備えた Azure Firewall を使用して、アプリケーション ルールでサポートされていないプロトコルを介してインターネットへのエグレス トラフィックをフィルター処理します。", - "waf": "安全" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", - "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", - "severity": "高い", - "text": "Azure Firewall Premium を使用して、セキュリティと保護を強化します。", - "waf": "安全" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", - "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", - "severity": "高い", - "text": "保護を強化するために、Azure Firewall 脅威インテリジェンス モードを [アラート] と [拒否] に構成します。", - "waf": "安全" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", - "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", - "service": "Firewall", - "severity": "高い", - "text": "保護を強化するために、Azure Firewall IDPS モードを [拒否] に構成します。", - "waf": "安全" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", - "guid": "a3784907-9836-4271-aafc-93535f8ec08b", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", - "service": "Firewall", - "severity": "高い", - "text": "Virtual WAN に接続されていない VNet 内のサブネットの場合は、インターネット トラフィックが Azure Firewall またはネットワーク仮想アプライアンスにリダイレクトされるようにルート テーブルをアタッチします", - "waf": "安全" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "715d833d-4708-4527-90ac-1b142c7045ba", - "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", - "service": "Firewall", - "severity": "中程度", - "text": "すべての Azure Firewall デプロイのログを保存するための診断設定を、リソース固有の宛先テーブルに追加します。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "オペレーションズ" + "checklist": "Cost Optimization Checklist", + "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "VM の適切なサイズ設定 - 使用率を 5% 未満で監視することから始めて、その後 40% まで作業します", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", - "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", - "service": "Firewall", - "severity": "大事な", - "text": "Azure Firewall クラシック規則 (存在する場合) からファイアウォール ポリシーに移行します。", + "checklist": "Cost Optimization Checklist", + "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "アプリケーションをコンテナー化すると、VM の密度が向上し、スケーリングにかかるコストを節約できます", "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "オペレーションズ" + "waf": "費用" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", - "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", - "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", - "service": "Firewall", + "checklist": "IoT Hub Review", + "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", + "service": "IoT", "severity": "高い", - "text": "Azure Firewall サブネットに /26 プレフィックスを使用します。", - "waf": "安全" + "text": "Availability Zones (リージョンで適用可能な場合) を活用する (これは自動的に有効になります)", + "waf": "確実" }, { - "checklist": "Azure Landing Zone Review", - "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", - "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", - "service": "Firewall", + "checklist": "IoT Hub Review", + "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", "severity": "中程度", - "text": "ファイアウォール ポリシー内のルールをルール コレクション グループとルール コレクションに分類し、使用頻度に基づいて配置します", - "waf": "パフォーマンス" + "text": "Microsoft が開始するフェールオーバーに注意してください。これらは、まれに、影響を受けるリージョンから対応する geo ペア リージョンにすべての IoT ハブをフェールオーバーするために Microsoft によって実行されます。", + "waf": "確実" }, { - "checklist": "Azure Landing Zone Review", - "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", - "link": "https://learn.microsoft.com/azure/firewall/ip-groups", - "service": "Firewall", - "severity": "中程度", - "text": "IP グループまたは IP プレフィックスを使用して、IP テーブル ルールの数を減らす", - "waf": "パフォーマンス" + "checklist": "IoT Hub Review", + "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", + "service": "IoT", + "severity": "高い", + "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する", + "waf": "確実" }, { - "checklist": "Azure Landing Zone Review", - "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", - "service": "Firewall", - "severity": "中程度", - "text": "DNATS の送信元 IP としてワイルドカード (* や any など) は使用せず、受信 DNAT の送信元 IP を指定する必要があります", - "waf": "パフォーマンス" + "checklist": "IoT Hub Review", + "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", + "severity": "高い", + "text": "手動フェールオーバーをトリガーする方法を学習します。", + "waf": "確実" + }, + { + "checklist": "IoT Hub Review", + "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", + "service": "IoT", + "severity": "高い", + "text": "フェールオーバー後にフェールバックする方法を学習します。", + "waf": "確実" }, { "checklist": "Azure Landing Zone Review", - "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", - "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", - "service": "Firewall", + "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", + "service": "Entra", "severity": "中程度", - "text": "SNAT ポートの使用状況を監視し、NAT ゲートウェイの設定を評価し、シームレスなフェールオーバーを確保することで、SNAT ポートの枯渇を防ぎます。ポート数が制限に近づく場合は、SNAT の枯渇が差し迫っている可能性があります。", - "waf": "パフォーマンス" + "text": "マルチテナントに関する明確な規制要件またはビジネス要件がない限り、Azure リソースの管理には 1 つの Entra テナントを使用します。", + "waf": "オペレーションズ" }, { "checklist": "Azure Landing Zone Review", - "guid": "346840b8-1064-496e-8396-4b1340172d52", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", - "service": "Firewall", - "severity": "高い", - "text": "TLSインスペクションの有効化", - "waf": "パフォーマンス" + "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Entra", + "severity": "低い", + "text": "Microsoft Entra ID テナントを管理するためのマルチテナント自動化アプローチがあることを確認する", + "waf": "オペレーションズ" }, { "checklist": "Azure Landing Zone Review", - "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", - "service": "Firewall", + "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "Entra", "severity": "低い", - "text": "Web カテゴリを使用して、特定のトピックへの送信アクセスを許可または拒否します。", - "waf": "パフォーマンス" + "text": "マルチテナント管理に Azure Lighthouse を活用する", + "waf": "オペレーションズ" }, { "checklist": "Azure Landing Zone Review", - "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", - "service": "Firewall", + "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Entra", "severity": "中程度", - "text": "TLS 検査の一環として、検査のために Azure App Gateway からトラフィックを受信することを計画します。", - "waf": "パフォーマンス" + "text": "パートナーによるテナントの管理に Azure Lighthouse が使用されていることを確認する", + "waf": "費用" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", - "link": "https://learn.microsoft.com/azure/firewall/dns-details", - "service": "Firewall", - "severity": "中程度", - "text": "Azure Firewall DNS プロキシ構成を有効にする", + "guid": "348ef254-c27d-442e-abba-c7571559ab91", + "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", + "service": "Entra", + "severity": "高い", + "text": "クラウド運用モデルに合わせた RBAC モデルを適用します。管理グループとサブスクリプション全体のスコープと割り当てを行います。", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "安全" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", - "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", - "service": "Firewall", - "severity": "中程度", - "text": "仮想マシンに直接関連付けられているパブリック IP アドレスを拒否するポリシーの割り当てがあることを確認します", + "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", + "service": "Entra", + "severity": "高い", + "text": "すべてのアカウントの種類で、認証の種類である職場または学校アカウントのみを使用します。Microsoft アカウントの使用は避けてください", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", - "service": "Firewall", - "severity": "低い", - "text": "Azure Firewall を Azure Monitor と統合し、診断ログを有効にして、ファイアウォール ログを格納および分析します。", - "waf": "オペレーションズ" + "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "Entra", + "severity": "中程度", + "text": "アクセス許可の割り当てには、グループのみを使用します。グループ管理システムが既に導入されている場合は、オンプレミス グループを Entra ID のみのグループに追加します。", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", + "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", + "service": "Entra", "severity": "低い", - "text": "ファイアウォールルールのバックアップを実装する", - "waf": "オペレーションズ" + "text": "Azure 環境に対する権限を持つすべてのユーザーに Microsoft Entra ID 条件付きアクセス ポリシーを適用する", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "安全" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "App Gateway", + "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", + "service": "Entra", "severity": "高い", - "text": "仮想ネットワークに挿入された Azure PaaS サービスのコントロール プレーン通信が、たとえば、コントロール プレーンのトラフィックをブロックする 0.0.0.0/0 ルートや NSG ルールによって切断されていないことを確認します。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "text": "Azure 環境に対する権限を持つすべてのユーザーに多要素認証を適用する", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", "waf": "安全" }, { - "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "ExpressRoute", + "guid": "14658d35-58fd-4772-99b8-21112df27ee4", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "Entra", "severity": "中程度", - "text": "オンプレミスからプライベート エンドポイントと ExpressRoute プライベート ピアリングを介して Azure PaaS サービスにアクセスします。この方法では、パブリック インターネット経由のトランジットが回避されます。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "Microsoft Entra ID Privileged Identity Management (PIM) を適用して、ゼロの永続的なアクセスと最小限の特権を確立します", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", - "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "VNet", + "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "Entra", "severity": "中程度", - "text": "すべてのサブネットで仮想ネットワーク サービス エンドポイントを既定で有効にしないでください。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "text": "Active Directory ドメイン サービスから Entra ドメイン サービスへの切り替えを計画している場合は、すべてのワークロードの互換性を評価します", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", + "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", + "service": "Entra", "severity": "中程度", - "text": "Azure Firewall または NVA の IP アドレスの代わりに FQDN を使用して Azure PaaS サービスへのエグレス トラフィックをフィルター処理し、データ流出を防ぎます。Private Link を使用している場合は、すべての FQDN をブロックし、それ以外の場合は必要な PaaS サービスのみを許可できます。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "text": "Microsoft Entra ID ログをプラットフォーム中心の Azure Monitor と統合します。Azure Monitor を使用すると、Azure のログと監視データに関する信頼できる唯一の情報源が得られ、ログの収集と保持に関する要件を満たすクラウド ネイティブ オプションが組織に提供されます。", "waf": "安全" }, { "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", - "service": "ExpressRoute", + "guid": "984a859c-773e-47d2-9162-3a765a917e1f", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "service": "Entra", "severity": "高い", - "text": "Gateway サブネットに少なくとも /27 プレフィックスを使用する", + "text": "テナント全体のアカウント ロックアウトを防ぐために、緊急アクセスまたは非常用アカウントを実装する", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", - "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", - "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", - "service": "NSG", + "guid": "35037e68-9349-4c15-b371-228514f4cdff", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "Entra", "severity": "中程度", - "text": "接続を制限するために、VirtualNetwork サービス タグを使用する NSG 受信の既定の規則に依存しないでください。", + "text": "Microsoft Entra ID ロールの割り当てにオンプレミスの同期アカウントを使用しないでください。", + "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", - "service": "NSG", + "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Entra", "severity": "中程度", - "text": "NSG を使用して、サブネット間のトラフィックと、プラットフォーム全体の East/West トラフィック (ランディング ゾーン間のトラフィック) を保護します。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "text": "必要に応じて、Microsoft Entra ID アプリケーション プロキシを使用して、内部アプリケーション (クラウドまたはオンプレミスでホストされている) への安全で認証されたアクセスをリモート ユーザーに付与します。", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", - "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", - "service": "NSG", + "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", + "service": "VNet", "severity": "中程度", - "text": "アプリケーション チームは、サブネット レベルの NSG でアプリケーション セキュリティ グループを使用して、ランディング ゾーン内の多層 VM を保護する必要があります。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "text": "従来のハブアンドスポーク ネットワーク トポロジに基づくネットワーク設計を、最大限の柔軟性を必要とするネットワーク シナリオに活用します。", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", "waf": "安全" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", - "severity": "中程度", - "text": "NSG とアプリケーション セキュリティ グループを使用して、ランディング ゾーン内のトラフィックを細かくセグメント化し、中央の NVA を使用してトラフィック フローをフィルター処理しないようにします。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "安全" + "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", + "service": "VNet", + "severity": "高い", + "text": "ExpressRoute ゲートウェイ、VPN ゲートウェイ、Azure Firewall などの共有ネットワーク サービス、または中央ハブ仮想ネットワーク内のパートナーの NVA を確認します。必要に応じて、DNS サーバーも展開します。", + "waf": "費用" }, { "checklist": "Azure Landing Zone Review", - "guid": "dfe237de-143b-416c-91d7-aa9b64704489", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", + "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "VNet", "severity": "中程度", - "text": "VNet フロー ログを有効にして Traffic Analytics にフィードし、内部および外部のトラフィック フローに関する分析情報を取得します。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "text": "アプリケーション ランディング ゾーン内のすべてのパブリック IP アドレスに対して DDoS ネットワークまたは IP 保護プランを使用します。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", - "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "NSG", + "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "severity": "中程度", - "text": "NSG あたりの NSG ルールの制限 (1000) を検討します。", - "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "text": "パートナー ネットワーク テクノロジまたは NVA をデプロイする場合は、パートナー ベンダーのガイダンスに従ってください", "waf": "確実" }, { - "arm-service": "microsoft.network/virtualWans", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", - "service": "VWAN", - "severity": "中程度", - "text": "Azure ネットワーク管理を簡素化するために Virtual WAN を検討し、Virtual WAN ルーティング設計の一覧にシナリオが明示的に記述されていることを確認します", - "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", - "waf": "オペレーションズ" + "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", + "service": "ExpressRoute", + "severity": "低い", + "text": "ハブ アンド スポーク シナリオで ExpressRoute と VPN ゲートウェイ間の転送が必要な場合は、Azure Route Server を使用します。", + "waf": "安全" }, { - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "severity": "中程度", - "text": "Azure リージョンごとに Virtual WAN ハブを使用して、共通のグローバル Azure Virtual WAN を介して Azure リージョン間で複数のランディング ゾーンを接続します。", - "waf": "パフォーマンス" + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", + "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", + "service": "ARS", + "severity": "低い", + "text": "Route Server を使用する場合は、Route Server サブネットに /27 プレフィックスを使用します。", + "waf": "安全" }, { - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "severity": "低い", - "text": "\"Azure のトラフィックは Azure にとどまる\" という原則に従って、Azure のリソース間の通信が Microsoft バックボーン ネットワーク経由で行われるようにします", + "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", + "service": "VNet", + "severity": "中程度", + "text": "複数のハブ アンド スポーク トポロジを持つネットワーク アーキテクチャでは、ハブ VNet 間のグローバル仮想ネットワーク ピアリングを使用して、リージョンを相互に接続します。", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", "waf": "パフォーマンス" }, { - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", - "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", + "service": "VNet", "severity": "中程度", - "text": "送信インターネット トラフィックの保護とフィルター処理を行うには、セキュリティで保護されたハブに Azure Firewall をデプロイします", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" + "text": "Azure Monitor for Networks を使用して、Azure 上のネットワークのエンド ツー エンドの状態を監視します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "VWAN", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", + "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "severity": "中程度", - "text": "ネットワーク アーキテクチャが Azure Virtual WAN の制限内にあることを確認します。", + "text": "スポーク仮想ネットワークを中央ハブ仮想ネットワークに接続する場合は、ExpressRoute 経由でアドバタイズできるプレフィックスの最大数である VNet ピアリングの制限 (500) (1000) を考慮してください", "waf": "確実" }, { - "arm-service": "microsoft.network/virtualWans", "checklist": "Azure Landing Zone Review", - "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", - "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", - "service": "VWAN", + "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", + "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "severity": "中程度", - "text": "Azure Monitor Insights for Virtual WAN を使用して、Virtual WAN のエンドツーエンドのトポロジ、状態、主要なメトリックを監視します。", - "waf": "オペレーションズ" + "text": "ルート テーブルあたりのルート数の制限 (400) を考慮します。", + "waf": "確実" }, { - "arm-service": "microsoft.network/virtualWans", + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", - "service": "VWAN", - "severity": "中程度", - "text": "IaC デプロイで、これらのフローを明示的にブロックする必要がない限り、Virtual WAN のブランチ間トラフィックが無効にならないようにしてください。", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", + "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", + "service": "VNet", + "severity": "高い", + "text": "VNet ピアリングを構成するときに [リモート仮想ネットワークへのトラフィックを許可する] 設定を使用します", "waf": "確実" }, { - "arm-service": "microsoft.network/virtualWans", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", - "service": "VWAN", + "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", + "service": "ExpressRoute", "severity": "中程度", - "text": "AS-Path は ExpressRoute や VPN よりも柔軟性が高いため、ハブ ルーティングの基本設定として使用します。", - "waf": "確実" + "text": "ExpressRoute Direct を使用している場合は、組織のルーターと MSEE 間のレイヤー 2 レベルでトラフィックを暗号化するために MACsec を構成します。この図は、この暗号化をフローで示しています。", + "waf": "安全" }, { - "arm-service": "microsoft.network/virtualWans", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", - "service": "VWAN", - "severity": "中程度", - "text": "IaC デプロイで Virtual WAN でラベルベースの伝達が構成されていることを確認すると、仮想ハブ間の接続が損なわれます。", - "waf": "確実" + "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", + "severity": "低い", + "text": "MACsec がオプションではないシナリオ (ExpressRoute Direct を使用しない場合など) では、VPN ゲートウェイを使用して、ExpressRoute プライベート ピアリング経由で IPsec トンネルを確立します。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "安全" }, { "ammp": true, - "arm-service": "microsoft.network/virtualWans", + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "9c75dfef-573c-461c-a698-68598595581a", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", - "service": "VWAN", + "guid": "558fd772-49b8-4211-82df-27ee412e7f98", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "ExpressRoute", "severity": "高い", - "text": "仮想ハブに十分な IP 空間 (理想的には /23 プレフィックス) を割り当てます。", - "waf": "確実" + "text": "Azure リージョンとオンプレミスの場所間で重複する IP アドレス空間が使用されていないことを確認します", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "安全" + }, + { + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", + "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", + "severity": "低い", + "text": "プライベート インターネットのアドレス割り当て範囲 (RFC 1918) の IP アドレスを使用します。", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "安全" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", + "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", "severity": "高い", - "text": "Azure Policy を戦略的に活用し、環境の制御を定義し、ポリシー イニシアチブを使用して関連するポリシーをグループ化します。", - "waf": "安全" + "text": "IP アドレス空間が無駄にならないようにし、不必要に大きな仮想ネットワーク (/16 など) を作成しないようにします", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "パフォーマンス" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", - "severity": "中程度", - "text": "規制とコンプライアンスの要件を Azure Policy の定義と Azure ロールの割り当てにマップします。", - "waf": "安全" + "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", + "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", + "service": "VNet", + "severity": "高い", + "text": "運用サイトと DR サイトで重複する IP アドレス範囲を使用しないでください。", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "確実" }, { "checklist": "Azure Landing Zone Review", - "guid": "223ace8c-b123-408c-a501-7f154e3ab369", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", "severity": "中程度", - "text": "中間ルート管理グループで Azure Policy 定義を確立し、継承されたスコープで割り当てられるようにする", - "waf": "安全" + "text": "Azure での名前解決のみが必要な環境では、名前解決用の委任されたゾーン ('azure.contoso.com' など) を使用して解決に Azure プライベート DNS を使用します。", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "オペレーションズ" }, { "checklist": "Azure Landing Zone Review", - "guid": "3829e7e3-1618-4368-9a04-77a209945bda", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", + "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", + "service": "DNS", "severity": "中程度", - "text": "必要に応じて、ポリシーの割り当てを最下位レベルで管理し、最下位レベルで除外します。", + "text": "Azure とオンプレミスでの名前解決が必要な環境では、Azure DNS Private Resolver の使用を検討してください。", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "guid": "43334f24-9116-4341-a2ba-527526944008", - "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", - "service": "Policy", + "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", "severity": "低い", - "text": "Azure Policy を使用して、ユーザーがサブスクリプション/管理グループ レベルでプロビジョニングできるサービスを制御する", - "waf": "安全" + "text": "独自の DNS (Red Hat OpenShift など) を必要としてデプロイする特別なワークロードでは、優先 DNS ソリューションを使用する必要があります。", + "waf": "オペレーションズ" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "guid": "614658d3-558f-4d77-849b-821112df27ee", + "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", + "service": "DNS", + "severity": "高い", + "text": "Azure DNS の自動登録を有効にすると、仮想ネットワーク内にデプロイされた仮想マシンの DNS レコードのライフサイクルが自動的に管理されます。", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "オペレーションズ" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "service": "Bastion", "severity": "中程度", - "text": "可能な場合は組み込みのポリシーを使用して、運用上のオーバーヘッドを最小限に抑えます。", + "text": "Azure Bastion を使用してネットワークに安全に接続することを検討してください。", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "description": "リソース ポリシー共同作成者ロールを特定のスコープに割り当てると、ポリシー管理を関連するチームに委任できます。たとえば、中央の IT チームが管理グループ レベルのポリシーを監督し、アプリケーション チームがサブスクリプションのポリシーを処理することで、組織の標準に準拠した分散ガバナンスが可能になります。", - "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", - "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", - "service": "Policy", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", + "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", + "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", + "service": "Bastion", "severity": "中程度", - "text": "組み込みのリソース ポリシー共同作成者ロールを特定のスコープで割り当てて、アプリケーション レベルのガバナンスを有効にします。", + "text": "Azure Bastion は、サブネット /26 以上で使用します。", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "guid": "19048384-5c98-46cb-8913-156a12476e49", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "WAF", "severity": "中程度", - "text": "ルート管理グループのスコープで行われる Azure Policy 割り当ての数を制限して、継承されたスコープでの除外による管理を回避します。", + "text": "Azure Front Door と WAF ポリシーを使用して、ランディング ゾーンへの受信 HTTP/S 接続に対して Azure リージョン全体でグローバル保護を提供します。", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "安全" + }, + { + "checklist": "Azure Landing Zone Review", + "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", + "severity": "低い", + "text": "Azure Front Door と Azure Application Gateway を使用して HTTP/S アプリを保護する場合は、Azure Front Door で WAF ポリシーを使用します。Azure Application Gateway をロックダウンして、Azure Front Door からのトラフィックのみを受信するようにします。", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "安全" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", - "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", - "service": "Policy", - "severity": "中程度", - "text": "データ主権の要件が存在する場合は、Azure ポリシーをデプロイして適用できます", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", + "severity": "高い", + "text": "WAF とその他のリバース プロキシは、受信 HTTP/S 接続に必要であり、ランディング ゾーン仮想ネットワーク内にデプロイし、保護してインターネットに公開しているアプリと共にデプロイします。", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", "waf": "安全" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", - "service": "Policy", - "severity": "中程度", - "text": "ソブリン・ランディング・ゾーンの場合、主権ポリシー・ベースラインのポリシー・イニシアチブがデプロイされ、正しいMGレベルで割り当てられます。", + "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", + "severity": "高い", + "text": "Azure DDoS ネットワークまたは IP Protection プランを使用して、仮想ネットワーク内のパブリック IP アドレス エンドポイントを保護します。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", - "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", - "service": "Policy", - "severity": "中程度", - "text": "ソブリン・ランディング・ゾーンについては、ソブリン制御の目標とポリシー・マッピングが文書化されています。", - "waf": "安全" + "guid": "b034c01e-110b-463a-b36e-e3346e57f225", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "service": "VNet", + "severity": "高い", + "text": "今後の破壊的変更の前に、ネットワーク送信トラフィックの構成と戦略を評価および確認します。2025 年 9 月 30 日に、新しいデプロイの既定の送信アクセスは廃止され、明示的なアクセス構成のみが許可されます", + "waf": "確実" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", - "service": "Policy", - "severity": "中程度", - "text": "ソブリン ランディング ゾーンでは、\"ソブリン制御の目標からポリシー マッピング\" の CRUD のプロセスが導入されています。", + "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", + "severity": "高い", + "text": "診断設定を追加して、保護されているすべてのパブリック IP アドレス (DDoS IP またはネットワーク保護) の DDoS 関連ログを保存します。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", + "service": "ExpressRoute", "severity": "中程度", - "text": "Azure ロールベースのアクセス制御 (Azure RBAC)、データ主権要件、またはデータ保持ポリシーで個別のワークスペースが義務付けられている場合を除き、1 つのモニター ログ ワークスペースを使用してプラットフォームを一元的に管理します。", - "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "waf": "オペレーションズ" + "text": "ExpressRoute を Azure へのプライマリ接続として使用する可能性を調査したことを確認します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "パフォーマンス" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Monitor", + "description": "AS パスのプリペンドと接続の重みを使用して、Azure からオンプレミスへのトラフィックに影響を与え、独自のルーターの全範囲の BGP 属性を使用して、オンプレミスから Azure へのトラフィックに影響を与えることができます。", + "guid": "f29812b2-363c-4efe-879b-599de0d5973c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "severity": "中程度", - "text": "ログの保持要件が 12 年を超える場合は、ログを Azure Storage にエクスポートします。不変ストレージと write-once、read-many ポリシーを使用して、ユーザーが指定した間隔でデータを消去および変更できないようにします。", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "オペレーションズ" + "text": "複数の ExpressRoute 回線、または複数のオンプレミスの場所を使用する場合、特定のパスが優先される場合は、BGP 属性を使用してルーティングを最適化してください。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "確実" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", - "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", - "service": "VM", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", + "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "severity": "中程度", - "text": "Azure Policy を使用して OS レベルの仮想マシン (VM) 構成のずれを監視します。ポリシーを使用して Azure Automanage Machine Configuration 監査機能を有効にすると、アプリケーション チームのワークロードは、わずかな労力で機能をすぐに使用できます。", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "オペレーションズ" + "text": "帯域幅とパフォーマンスの要件に基づいて、ExpressRoute/VPN ゲートウェイに適切な SKU を使用していることを確認します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "パフォーマンス" }, { + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", - "severity": "中程度", - "text": "Azure Update Manager を、Azure の Windows および Linux VM の修正プログラムの適用メカニズムとして使用します。", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "オペレーションズ" + "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", + "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", + "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", + "service": "ExpressRoute", + "severity": "高い", + "text": "無制限のデータ ExpressRoute 回線は、コストに見合った帯域幅に達した場合にのみ使用してください。", + "waf": "費用" }, { + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", - "severity": "中程度", - "text": "Azure Arc を使用して、Azure の外部にある Windows および Linux VM の修正プログラムの適用メカニズムとして Azure Update Manager を使用します。", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "オペレーションズ" + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", + "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", + "service": "ExpressRoute", + "severity": "高い", + "text": "回線のピアリングの場所がローカル SKU の Azure リージョンをサポートしている場合は、ExpressRoute のローカル SKU を利用して回線のコストを削減します。", + "waf": "費用" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "90483845-c986-4cb2-a131-56a12476e49f", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Network Watcher", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", + "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", + "service": "ExpressRoute", "severity": "中程度", - "text": "Network Watcher を使用してトラフィック フローをプロアクティブに監視する", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "オペレーションズ" + "text": "サポートされている Azure リージョンにゾーン冗長 ExpressRoute ゲートウェイをデプロイします。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "確実" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Monitor", + "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "service": "ExpressRoute", "severity": "中程度", - "text": "分析情報とレポートには Azure Monitor ログを使用します。", - "waf": "オペレーションズ" + "text": "10 Gbps を超える帯域幅または専用の 10/100 Gbps ポートを必要とするシナリオでは、ExpressRoute Direct を使用します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "パフォーマンス" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "97be9951-9048-4384-9c98-6cb2913156a1", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", - "service": "Monitor", + "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", + "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", + "service": "ExpressRoute", "severity": "中程度", - "text": "運用アラートの生成には、Azure Monitor アラートを使用します。", - "waf": "オペレーションズ" + "text": "待機時間を短くする必要がある場合、またはオンプレミスから Azure へのスループットを 10 Gbps を超える必要がある場合は、FastPath を有効にして、データ パスから ExpressRoute ゲートウェイをバイパスします。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "パフォーマンス" }, { + "arm-service": "microsoft.network/vpnGateways", "checklist": "Azure Landing Zone Review", - "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "Monitor", + "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", + "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", + "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", + "service": "VPN", "severity": "中程度", - "text": "Azure Automation アカウントを介して変更とインベントリの追跡を使用する場合は、Log Analytics ワークスペースと Automation アカウントをリンクするためにサポートされているリージョンを選択していることを確認してください。", - "waf": "オペレーションズ" + "text": "ゾーン冗長 VPN ゲートウェイを使用して、ブランチまたはリモートの場所を Azure に接続します (使用可能な場合)。", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "確実" }, { + "arm-service": "microsoft.network/vpnGateways", "checklist": "Azure Landing Zone Review", - "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Backup", + "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", + "service": "VPN", "severity": "中程度", - "text": "Azure Backup を使用する場合は、既定の設定が GRS であるため、さまざまなバックアップの種類 (GRS、ZRS、LRS) を考慮してください", + "text": "冗長 VPN アプライアンスをオンプレミス (アクティブ/アクティブまたはアクティブ/パッシブ) で使用します。", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", "waf": "確実" }, { + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "VM", - "severity": "中程度", - "text": "Azure ポリシーを使用して、VM 拡張機能を通じてソフトウェア構成を自動的にデプロイし、準拠したベースライン VM 構成を適用します。", - "waf": "安全" + "guid": "718cb437-b060-2589-8856-2e93a5c6633b", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", + "severity": "高い", + "text": "ExpressRoute Direct を使用する場合は、コストを節約するために、ローカルの Azure リージョンへの ExpressRoute Local 回線の使用を検討してください", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "費用" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "description": "Azure Policy のゲスト構成機能では、マシンの設定 (OS、アプリケーション、環境など) を監査して修復し、リソースが想定される構成と一致していることを確認できます。", - "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "VM", + "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", + "service": "ExpressRoute", "severity": "中程度", - "text": "VM のセキュリティ構成のドリフトを Azure Policy で監視します。", + "text": "運用環境と非運用環境を分離する場合など、トラフィックの分離または専用の帯域幅が必要な場合は、異なる ExpressRoute 回線を使用します。これにより、ルーティング ドメインが分離され、ノイジー ネイバーのリスクが軽減されます。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "安全" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", + "guid": "b30e38c3-f298-412b-8363-cefe179b599d", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", + "service": "ExpressRoute", "severity": "中程度", - "text": "Azure から Azure Virtual Machines へのディザスター リカバリー シナリオには、Azure Site Recovery を使用します。これにより、リージョン間でワークロードをレプリケートできます。", + "text": "組み込みの Express Route Insights を使用して、ExpressRoute の可用性と使用率を監視します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "オペレーションズ" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "Backup", + "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", + "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", + "service": "ExpressRoute", "severity": "中程度", - "text": "Azure ネイティブのバックアップ機能、または Azure 互換のサード パーティのバックアップ ソリューションを使用します。", + "text": "接続モニターは、ネットワーク全体 (特にオンプレミスと Azure 間) の接続を監視するために使用します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "オペレーションズ" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", - "severity": "高い", - "text": "Availability Zones は、サポートされているリージョンの VM に活用します。", - "waf": "確実" - }, - { - "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", - "severity": "高い", - "text": "運用ワークロードを 1 つの VM で実行することは避けてください。", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", + "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", + "service": "ExpressRoute", + "severity": "中程度", + "text": "冗長性のために、異なるピアリングの場所からの ExpressRoute 回線を使用します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "確実" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "84101f59-1941-4195-a270-e28034290e3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", + "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", + "service": "ExpressRoute", "severity": "中程度", - "text": "Azure Load Balancer と Application Gateway は、受信ネットワーク トラフィックを複数のリソースに分散します。", + "text": "ExpressRoute のフェールオーバーとしてサイト間 VPN を使用します (特に、1 つの ExpressRoute 回線のみを使用する場合)。", "waf": "確実" }, { "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "WAF", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", + "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", + "service": "ExpressRoute", "severity": "高い", - "text": "診断設定を追加して、Azure Front Door や Azure Application Gateway などのアプリケーション配信サービスから WAF ログを保存します。ログを定期的に確認して、攻撃や誤検知がないか確認します。", - "waf": "オペレーションズ" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "7f408960-c626-44cb-a018-347c8d790cdf", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "WAF", - "severity": "中程度", - "text": "Azure Front Door や Azure Application Gateway などのアプリケーション配信サービスから Microsoft Sentinel に WAF ログを送信します。攻撃を検出し、WAF テレメトリを Azure 環境全体に統合します。", - "waf": "オペレーションズ" + "text": "GatewaySubnet でルート テーブルを使用している場合は、ゲートウェイ ルートが伝達されていることを確認します。", + "waf": "確実" }, { "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "5017f154-e3ab-4369-9829-e7e316183687", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "Key Vault", + "guid": "d581a947-69a2-4783-942e-9df3664324c8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", + "service": "ExpressRoute", "severity": "高い", - "text": "Azure Key Vault を使用してシークレットと資格情報を格納する", - "waf": "安全" - }, - { - "checklist": "Azure Landing Zone Review", - "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", - "guid": "a0477a20-9945-4bda-9333-4f2491163418", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", - "service": "Key Vault", - "severity": "中程度", - "text": "アプリケーションやリージョンごとに異なる Azure Key Vault を使用して、トランザクションのスケール制限を回避し、シークレットへのアクセスを制限します。", - "waf": "安全" + "text": "ExpressRoute を使用する場合、オンプレミスのルーティングは動的である必要があり、接続障害が発生した場合は、回線の残りの接続に収束する必要があります。負荷は、アクティブ/パッシブもサポートされていますが、理想的にはアクティブ/アクティブとして両方の接続で共有する必要があります。", + "waf": "確実" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", + "service": "ExpressRoute", "severity": "中程度", - "text": "論理的な削除ポリシーと消去ポリシーを有効にして Azure Key Vault をプロビジョニングし、削除されたオブジェクトの保持保護を許可します。", - "waf": "安全" + "text": "ExpressRoute 回線の 2 つの物理リンクが、ネットワーク内の 2 つの異なるエッジ デバイスに接続されていることを確認します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "確実" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "dc055bcf-619e-48a1-9f98-879525d62688", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", + "service": "ExpressRoute", "severity": "中程度", - "text": "最小特権モデルに従って、キー、シークレット、証明書を完全に削除する承認を特殊なカスタム Microsoft Entra ID ロールに制限します。", - "waf": "安全" + "text": "Bidirectional Forwarding Detection(BFD)が有効で、顧客またはプロバイダーのエッジ ルーティング デバイスで設定されていることを確認します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "確実" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "中程度", - "text": "公的認証局による証明書の管理と更新プロセスを自動化し、管理を容易にします。", - "waf": "安全" + "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "ExpressRoute", + "severity": "高い", + "text": "回復性を高めるために、ExpressRoute ゲートウェイを異なるピアリングの場所から 2 つ以上の回線に接続します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "確実" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "913156a1-2476-4e49-b541-acdce979377b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", + "service": "ExpressRoute", "severity": "中程度", - "text": "キーと証明書のローテーションの自動化されたプロセスを確立します。", - "waf": "安全" + "text": "ExpressRoute 仮想ネットワーク ゲートウェイの診断ログとアラートを構成します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "オペレーションズ" }, { + "arm-service": "microsoft.network/expressRouteCircuits", "checklist": "Azure Landing Zone Review", - "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "guid": "5234c93f-b651-41dd-80c1-234177b91ced", + "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", + "service": "ExpressRoute", "severity": "中程度", - "text": "コンテナーでファイアウォールと仮想ネットワーク サービス エンドポイントまたはプライベート エンドポイントを有効にして、キー コンテナーへのアクセスを制御します。", - "waf": "安全" + "text": "VNet 間通信に ExpressRoute 回線を使用しないでください。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "パフォーマンス" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", - "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", - "service": "Key Vault", - "severity": "中程度", - "text": "プラットフォーム中央の Azure Monitor Log Analytics ワークスペースを使用して、Key Vault の各インスタンス内のキー、証明書、シークレットの使用状況を監査します。", + "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", + "severity": "高い", + "text": "Azure Firewall を使用して、インターネットへの Azure 送信トラフィック、HTTP/S 以外の受信接続、East/West トラフィック フィルター処理 (組織で必要な場合) を管理します", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", "severity": "中程度", - "text": "Key Vault のインスタンス化と特権アクセスを委任し、Azure Policy を使用して一貫性のある準拠構成を適用します。", + "text": "グローバル ネットワーク環境全体のセキュリティ体制を管理するグローバル Azure Firewall ポリシーを作成し、それをすべての Azure Firewall インスタンスに割り当てます。Azure のロールベースのアクセス制御を介して増分ファイアウォール ポリシーをローカルのセキュリティ チームに委任することで、特定のリージョンの要件を満たすきめ細かなポリシーが可能になります。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "guid": "91163418-2ba5-4275-8694-4008be7d7e48", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "中程度", - "text": "Azure Key Vault は、アプリケーションごと、環境ごと、リージョンごとに使用します。", + "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", + "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", + "service": "Firewall", + "severity": "低い", + "text": "組織がそのようなソリューションを使用してアウトバウンド接続を保護する場合は、Firewall Manager 内でサポートされているパートナーの SaaS セキュリティ プロバイダーを構成します。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "25d62688-6d70-4ba6-a97b-e99519048384", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "中程度", - "text": "独自のキーを持ち込む場合、これは考慮されているすべてのサービスでサポートされていない可能性があります。不整合が望ましい結果を妨げないように、関連する軽減策を実装します。待機時間を最小限に抑える適切なリージョン ペアとディザスター リカバリー リージョンを選択します。", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", + "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", + "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", + "service": "Firewall", + "severity": "高い", + "text": "FQDN ベースのネットワーク ルールと DNS プロキシを備えた Azure Firewall を使用して、アプリケーション ルールでサポートされていないプロトコルを介してインターネットへのエグレス トラフィックをフィルター処理します。", "waf": "安全" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", - "link": "https://learn.microsoft.com/industry/sovereignty/key-management", - "service": "Key Vault", - "severity": "中程度", - "text": "ソブリン ランディング ゾーンの場合は、Azure Key Vault マネージド HSM を使用してシークレットと資格情報を格納します。", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", + "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", + "severity": "高い", + "text": "Azure Firewall Premium を使用して、セキュリティと保護を強化します。", "waf": "安全" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", - "service": "Entra", - "severity": "中程度", - "text": "Microsoft Entra ID レポート機能を使用して、アクセス制御監査レポートを生成します。", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", + "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", + "severity": "高い", + "text": "保護を強化するために、Azure Firewall 脅威インテリジェンス モードを [アラート] と [拒否] に構成します。", "waf": "安全" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "09945bda-4333-44f2-9911-634182ba5275", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", - "service": "Defender", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", + "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", + "service": "Firewall", "severity": "高い", - "text": "すべてのサブスクリプションに対して Defender Cloud Security Posture Management を有効にします。", + "text": "保護を強化するために、Azure Firewall IDPS モードを [拒否] に構成します。", "waf": "安全" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", - "service": "Defender", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", + "guid": "a3784907-9836-4271-aafc-93535f8ec08b", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "service": "Firewall", "severity": "高い", - "text": "すべてのサブスクリプションでサーバーに対して Defender Cloud ワークロード保護プランを有効にします。", + "text": "Virtual WAN に接続されていない VNet 内のサブネットの場合は、インターネット トラフィックが Azure Firewall またはネットワーク仮想アプライアンスにリダイレクトされるようにルート テーブルをアタッチします", "waf": "安全" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", - "service": "Defender", - "severity": "高い", - "text": "すべてのサブスクリプションで Azure リソースの Defender Cloud Workload Protection プランを有効にします。", - "waf": "安全" + "guid": "715d833d-4708-4527-90ac-1b142c7045ba", + "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", + "service": "Firewall", + "severity": "中程度", + "text": "すべての Azure Firewall デプロイのログを保存するための診断設定を、リソース固有の宛先テーブルに追加します。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "オペレーションズ" }, { "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", - "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", - "service": "VM", - "severity": "高い", - "text": "IaaS サーバーで Endpoint Protection を有効にします。", - "waf": "安全" + "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", + "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", + "service": "Firewall", + "severity": "大事な", + "text": "Azure Firewall クラシック規則 (存在する場合) からファイアウォール ポリシーに移行します。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "オペレーションズ" }, { + "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", - "link": "https://learn.microsoft.com/azure/security-center/", - "service": "VM", - "severity": "中程度", - "text": "Azure Monitor ログと Defender for Cloud を使用して、基本オペレーティング システムの修正プログラムの適用誤差を監視します。", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", + "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", + "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", + "service": "Firewall", + "severity": "高い", + "text": "Azure Firewall サブネットに /26 プレフィックスを使用します。", "waf": "安全" }, { "checklist": "Azure Landing Zone Review", - "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", + "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", + "service": "Firewall", "severity": "中程度", - "text": "既定のリソース構成を一元化された Azure Monitor Log Analytics ワークスペースに接続します。", - "waf": "安全" + "text": "ファイアウォール ポリシー内のルールをルール コレクション グループとルール コレクションに分類し、使用頻度に基づいて配置します", + "waf": "パフォーマンス" }, { "checklist": "Azure Landing Zone Review", - "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", - "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", - "service": "Entra", + "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", + "link": "https://learn.microsoft.com/azure/firewall/ip-groups", + "service": "Firewall", "severity": "中程度", - "text": "ソブリン ランディング ゾーンの場合、透過性ログは Entra ID テナントで有効になっています。", - "waf": "安全" + "text": "IP グループまたは IP プレフィックスを使用して、IP テーブル ルールの数を減らす", + "waf": "パフォーマンス" }, { "checklist": "Azure Landing Zone Review", - "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", - "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", - "service": "Entra", + "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", + "service": "Firewall", "severity": "中程度", - "text": "ソブリン ランディング ゾーンの場合、Entra ID テナントでカスタマー ロックボックスが有効になっています。", - "waf": "安全" + "text": "DNATS の送信元 IP としてワイルドカード (* や any など) は使用せず、受信 DNAT の送信元 IP を指定する必要があります", + "waf": "パフォーマンス" }, { - "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Storage", - "severity": "高い", - "text": "ストレージ アカウントへの安全な転送を有効にする必要がある", - "waf": "安全" + "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", + "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", + "service": "Firewall", + "severity": "中程度", + "text": "SNAT ポートの使用状況を監視し、NAT ゲートウェイの設定を評価し、シームレスなフェールオーバーを確保することで、SNAT ポートの枯渇を防ぎます。ポート数が制限に近づく場合は、SNAT の枯渇が差し迫っている可能性があります。", + "waf": "パフォーマンス" }, { - "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", - "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", - "service": "Storage", + "guid": "346840b8-1064-496e-8396-4b1340172d52", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", + "service": "Firewall", "severity": "高い", - "text": "ストレージ アカウントのコンテナーの論理的な削除を有効にして、削除されたコンテナーとその内容を回復します。", - "waf": "安全" + "text": "TLSインスペクションの有効化", + "waf": "パフォーマンス" }, { - "ammp": true, "checklist": "Azure Landing Zone Review", - "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", - "service": "Key Vault", - "severity": "高い", - "text": "Key Vault シークレットを使用して、資格情報 (仮想マシン、ユーザー パスワード)、証明書、キーなどの機密情報をハードコーディングしないようにします。", - "waf": "オペレーションズ" - }, - { - "checklist": "Azure App Service Review", - "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", - "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", - "service": "App Services", + "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", + "service": "Firewall", "severity": "低い", - "text": "ベスト プラクティスについては、「ベースラインの高可用性ゾーン冗長 Web アプリケーション アーキテクチャ」を参照してください", - "waf": "確実" + "text": "Web カテゴリを使用して、特定のトピックへの送信アクセスを許可または拒否します。", + "waf": "パフォーマンス" }, { - "checklist": "Azure App Service Review", - "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", - "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", + "service": "Firewall", "severity": "中程度", - "text": "Premium レベルと Standard レベルを使用します。これらの層では、ステージング スロットと自動バックアップがサポートされています。", - "waf": "確実" - }, - { - "checklist": "Azure App Service Review", - "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", - "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", - "service": "App Services", - "severity": "高い", - "text": "リージョンで適用可能な場合は Availability Zones を活用します (Premium v2 または v3 レベルが必要)", - "waf": "確実" + "text": "TLS 検査の一環として、検査のために Azure App Gateway からトラフィックを受信することを計画します。", + "waf": "パフォーマンス" }, { - "checklist": "Azure App Service Review", - "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "service": "Firewall", "severity": "中程度", - "text": "ヘルスチェックの実装", - "waf": "確実" + "text": "Azure Firewall DNS プロキシ構成を有効にする", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", - "service": "App Services", - "severity": "高い", - "text": "「Azure App Service のバックアップと復元のベスト プラクティス」を参照してください", - "waf": "確実" + "checklist": "Azure Landing Zone Review", + "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", + "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", + "service": "Firewall", + "severity": "中程度", + "text": "仮想マシンに直接関連付けられているパブリック IP アドレスを拒否するポリシーの割り当てがあることを確認します", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", - "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", - "service": "App Services", - "severity": "高い", - "text": "Azure App Service の信頼性に関するベスト プラクティスを実装する", - "waf": "確実" + "checklist": "Azure Landing Zone Review", + "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "service": "Firewall", + "severity": "低い", + "text": "Azure Firewall を Azure Monitor と統合し、診断ログを有効にして、ファイアウォール ログを格納および分析します。", + "waf": "オペレーションズ" }, { - "checklist": "Azure App Service Review", - "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", "severity": "低い", - "text": "災害時に App Service アプリを別のリージョンに移動する方法を理解する", - "waf": "確実" + "text": "ファイアウォールルールのバックアップを実装する", + "waf": "オペレーションズ" }, { - "checklist": "Azure App Service Review", - "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", - "service": "App Services", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "App Gateway", "severity": "高い", - "text": "Azure App Service の信頼性サポートについて理解する", - "waf": "確実" + "text": "仮想ネットワークに挿入された Azure PaaS サービスのコントロール プレーン通信が、たとえば、コントロール プレーンのトラフィックをブロックする 0.0.0.0/0 ルートや NSG ルールによって切断されていないことを確認します。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "App Services", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "ExpressRoute", "severity": "中程度", - "text": "App Service プランで実行されている Function Apps に対して \"Always On\" が有効になっていることを確認する", - "waf": "確実" + "text": "オンプレミスからプライベート エンドポイントと ExpressRoute プライベート ピアリングを介して Azure PaaS サービスにアクセスします。この方法では、パブリック インターネット経由のトランジットが回避されます。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", + "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "VNet", "severity": "中程度", - "text": "正常性チェックを使用した App Service インスタンスの監視", - "waf": "確実" + "text": "すべてのサブネットで仮想ネットワーク サービス エンドポイントを既定で有効にしないでください。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "severity": "中程度", - "text": "Application Insights の可用性テストを使用して Web アプリまたは Web サイトの可用性と応答性を監視する", - "waf": "確実" + "text": "Azure Firewall または NVA の IP アドレスの代わりに FQDN を使用して Azure PaaS サービスへのエグレス トラフィックをフィルター処理し、データ流出を防ぎます。Private Link を使用している場合は、すべての FQDN をブロックし、それ以外の場合は必要な PaaS サービスのみを許可できます。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", - "service": "App Services", - "severity": "低い", - "text": "Application Insights Standard テストを使用して、Web アプリまたは Web サイトの可用性と応答性を監視する", - "waf": "確実" + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", + "service": "ExpressRoute", + "severity": "高い", + "text": "Gateway サブネットに少なくとも /27 プレフィックスを使用する", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "Azure Key Vault を使用して、アプリケーションに必要なシークレットを格納します。 Key Vault は、シークレットを格納するための安全で監査された環境を提供し、Key Vault SDK または App Service Key Vault リファレンスを通じて App Service と適切に統合されています。", - "guid": "834ac932-223e-4ce8-8b12-3071a5416415", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", - "severity": "高い", - "text": "Key Vault を使用してシークレットを格納する", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", + "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", + "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", + "service": "NSG", + "severity": "中程度", + "text": "接続を制限するために、VirtualNetwork サービス タグを使用する NSG 受信の既定の規則に依存しないでください。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "マネージド ID を使用して、Key Vault SDK または App Service Key Vault 参照を使用して Key Vault に接続します。", - "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", - "severity": "高い", - "text": "マネージド ID を使用して Key Vault に接続する", + "checklist": "Azure Landing Zone Review", + "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", + "service": "NSG", + "severity": "中程度", + "text": "NSG を使用して、サブネット間のトラフィックと、プラットフォーム全体の East/West トラフィック (ランディング ゾーン間のトラフィック) を保護します。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "App Service TLS 証明書を Key Vault に格納します。", - "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", - "service": "App Services", - "severity": "高い", - "text": "Key Vault を使用して TLS 証明書を格納します。", + "checklist": "Azure Landing Zone Review", + "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", + "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", + "service": "NSG", + "severity": "中程度", + "text": "アプリケーション チームは、サブネット レベルの NSG でアプリケーション セキュリティ グループを使用して、ランディング ゾーン内の多層 VM を保護する必要があります。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "機密情報を処理するシステムは分離する必要があります。 そのためには、個別の App Service プランまたは App Service Environment を使用し、異なるサブスクリプションまたは管理グループの使用を検討してください。", - "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", - "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "severity": "中程度", - "text": "機密情報を処理するシステムを分離する", + "text": "NSG とアプリケーション セキュリティ グループを使用して、ランディング ゾーン内のトラフィックを細かくセグメント化し、中央の NVA を使用してトラフィック フローをフィルター処理しないようにします。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "App Service のローカル ディスクは暗号化されていないため、機密データを格納しないでください。 (例: D:\\\\Local and %TMP%)。", - "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "dfe237de-143b-416c-91d7-aa9b64704489", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "severity": "中程度", - "text": "機密データをローカルディスクに保存しない", + "text": "VNet フロー ログを有効にして Traffic Analytics にフィードし、内部および外部のトラフィック フローに関する分析情報を取得します。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "認証された Web アプリケーションの場合は、Azure AD や Azure AD B2C などの確立された ID プロバイダーを使用します。 選択したアプリケーション フレームワークを利用して、このプロバイダーと統合するか、App Service の認証/承認機能を使用します。", - "guid": "919ca0b2-c121-459e-814b-933df574eccc", - "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", + "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "NSG", "severity": "中程度", - "text": "認証に確立された ID プロバイダーを使用する", - "waf": "安全" + "text": "NSG あたりの NSG ルールの制限 (1000) を検討します。", + "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "waf": "確実" }, { - "checklist": "Azure App Service Review", - "description": "適切に管理され、セキュリティで保護された DevOps デプロイ パイプラインなど、制御された信頼できる環境から App Service にコードをデプロイします。これにより、バージョン管理されておらず、悪意のあるホストからデプロイされることが確認されていないコードが回避されます。", - "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", - "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", - "service": "App Services", - "severity": "高い", - "text": "信頼できる環境からのデプロイ", - "waf": "安全" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", + "service": "VWAN", + "severity": "中程度", + "text": "Azure ネットワーク管理を簡素化するために Virtual WAN を検討し、Virtual WAN ルーティング設計の一覧にシナリオが明示的に記述されていることを確認します", + "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", + "waf": "オペレーションズ" }, { - "checklist": "Azure App Service Review", - "description": "FTP/FTPS と WebDeploy/SCM の両方の基本認証を無効にします。 これにより、これらのサービスへのアクセスが無効になり、デプロイに Azure AD で保護されたエンドポイントの使用が強制されます。 SCM サイトは、Azure AD 資格情報を使用して開くこともできます。", - "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", - "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", - "service": "App Services", - "severity": "高い", - "text": "基本認証の無効化", - "waf": "安全" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "中程度", + "text": "Azure リージョンごとに Virtual WAN ハブを使用して、共通のグローバル Azure Virtual WAN を介して Azure リージョン間で複数のランディング ゾーンを接続します。", + "waf": "パフォーマンス" }, { - "checklist": "Azure App Service Review", - "description": "可能な場合は、マネージド ID を使用して Azure AD のセキュリティで保護されたリソースに接続します。 これが不可能な場合は、Key Vault にシークレットを格納し、代わりにマネージド ID を使用して Key Vault に接続します。", - "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", - "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", - "service": "App Services", - "severity": "高い", - "text": "マネージド ID を使用してリソースに接続する", - "waf": "安全" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "低い", + "text": "\"Azure のトラフィックは Azure にとどまる\" という原則に従って、Azure のリソース間の通信が Microsoft バックボーン ネットワーク経由で行われるようにします", + "waf": "パフォーマンス" }, { - "checklist": "Azure App Service Review", - "description": "Azure Container Registry に格納されているイメージを使用する場合は、マネージド ID を使用してこれらをプルします。", - "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", - "service": "App Services", - "severity": "高い", - "text": "マネージド ID を使用してコンテナーをプルするPull containers using a Managed Identity", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", + "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "中程度", + "text": "送信インターネット トラフィックの保護とフィルター処理を行うには、セキュリティで保護されたハブに Azure Firewall をデプロイします", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "App Service の診断設定を構成することで、ログ記録と監視の中央の宛先として、すべてのテレメトリを Log Analytics に送信できます。これにより、HTTP ログ、アプリケーション ログ、プラットフォーム ログなどの App Service のランタイム アクティビティを監視できます。", - "guid": "47768314-c115-4775-a2ea-55b46ad48408", - "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", - "service": "App Services", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "VWAN", "severity": "中程度", - "text": "App Service ランタイム ログを Log Analytics に送信する", - "waf": "安全" + "text": "ネットワーク アーキテクチャが Azure Virtual WAN の制限内にあることを確認します。", + "waf": "確実" }, { - "checklist": "Azure App Service Review", - "description": "ログ記録と監視の中央の宛先としてアクティビティ ログを Log Analytics に送信するための診断設定を設定します。これにより、App Service リソース自体のコントロール プレーンのアクティビティを監視できます。", - "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", - "service": "App Services", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", + "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", + "service": "VWAN", "severity": "中程度", - "text": "App Service アクティビティ ログを Log Analytics に送信する", - "waf": "安全" + "text": "Azure Monitor Insights for Virtual WAN を使用して、Virtual WAN のエンドツーエンドのトポロジ、状態、主要なメトリックを監視します。", + "waf": "オペレーションズ" }, { - "checklist": "Azure App Service Review", - "description": "リージョンの VNet 統合、ネットワーク セキュリティ グループ、および UDR の組み合わせを使用して、送信ネットワーク アクセスを制御します。 トラフィックは、Azure Firewall などの NVA にルーティングする必要があります。 ファイアウォールのログを必ず監視してください。", - "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", - "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", - "service": "App Services", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", + "service": "VWAN", "severity": "中程度", - "text": "送信ネットワーク アクセスを制御する必要がある", - "waf": "安全" + "text": "IaC デプロイで、これらのフローを明示的にブロックする必要がない限り、Virtual WAN のブランチ間トラフィックが無効にならないようにしてください。", + "waf": "確実" }, { - "checklist": "Azure App Service Review", - "description": "VNet 統合を使用し、VNet NAT ゲートウェイまたは Azure Firewall などの NVA を使用することで、安定した送信 IP を提供できます。 これにより、受信側は必要に応じて IP に基づいて許可リストに登録できます。 多くの場合、Azure サービスへの通信では、IP アドレスに依存する必要はなく、代わりにサービス エンドポイントなどのメカニズムを使用する必要があります。 (また、受信側でプライベート エンドポイントを使用すると、SNAT の発生が回避され、安定した送信 IP 範囲が提供されます)。", - "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", - "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", - "service": "App Services", - "severity": "低い", - "text": "インターネットアドレスへの送信通信のIPを安定させる", - "waf": "安全" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", + "service": "VWAN", + "severity": "中程度", + "text": "AS-Path は ExpressRoute や VPN よりも柔軟性が高いため、ハブ ルーティングの基本設定として使用します。", + "waf": "確実" }, { - "checklist": "Azure App Service Review", - "description": "App Service のアクセス制限、サービス エンドポイント、またはプライベート エンドポイントの組み合わせを使用して、受信ネットワーク アクセスを制御します。Web アプリ自体と SCM サイトに対して異なるアクセス制限を要求し、構成できます。", - "guid": "0725769e-e669-41a4-a34a-c932223ece80", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", - "severity": "高い", - "text": "受信ネットワーク アクセスを制御する必要がある", - "waf": "安全" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", + "service": "VWAN", + "severity": "中程度", + "text": "IaC デプロイで Virtual WAN でラベルベースの伝達が構成されていることを確認すると、仮想ハブ間の接続が損なわれます。", + "waf": "確実" }, { - "checklist": "Azure App Service Review", - "description": "Application Gateway や Azure Front Door などの Web アプリケーション ファイアウォールを使用して、悪意のある受信トラフィックから保護します。 WAFのログを必ず監視してください。", - "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", - "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", - "service": "App Services", + "ammp": true, + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "9c75dfef-573c-461c-a698-68598595581a", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", + "service": "VWAN", "severity": "高い", - "text": "App Service の前で WAF を使用するUse a WAF in Front of App Service", - "waf": "安全" + "text": "仮想ハブに十分な IP 空間 (理想的には /23 プレフィックス) を割り当てます。", + "waf": "確実" }, { - "checklist": "Azure App Service Review", - "description": "WAFのみへのアクセスをロックダウンすることで、WAFをバイパスできないようにします。 アクセス制限、サービス・エンドポイントおよびプライベート・エンドポイントを組み合わせて使用します。", - "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "高い", - "text": "WAFをバイパスすることは避けてください", + "text": "Azure Policy を戦略的に活用し、環境の制御を定義し、ポリシー イニシアチブを使用して関連するポリシーをグループ化します。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "App Service の構成で最小 TLS ポリシーを 1.2 に設定します。", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", - "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "中程度", - "text": "最小 TLS ポリシーを 1.2 に設定します。", + "text": "規制とコンプライアンスの要件を Azure Policy の定義と Azure ロールの割り当てにマップします。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "HTTPS のみを使用するように App Service を構成します。 これにより、App Service は HTTP から HTTPS にリダイレクトされます。 HTTP Strict Transport Security (HSTS) をコード内または WAF から使用して、サイトに HTTPS を使用してのみアクセスする必要があることをブラウザーに通知することを強く検討してください。", - "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", - "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", - "service": "App Services", - "severity": "高い", - "text": "HTTPS のみを使用", + "checklist": "Azure Landing Zone Review", + "guid": "223ace8c-b123-408c-a501-7f154e3ab369", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "中程度", + "text": "中間ルート管理グループで Azure Policy 定義を確立し、継承されたスコープで割り当てられるようにする", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "CORS 構成では、すべての配信元がサービスにアクセスできるため、ワイルドカードを使用しないでください (これにより、CORS の目的が損なわれます)。具体的には、サービスにアクセスできると予想される配信元のみを許可します。", - "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", - "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", - "service": "App Services", - "severity": "高い", - "text": "ワイルドカードは CORS に使用しないでください", + "checklist": "Azure Landing Zone Review", + "guid": "3829e7e3-1618-4368-9a04-77a209945bda", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "中程度", + "text": "必要に応じて、ポリシーの割り当てを最下位レベルで管理し、最下位レベルで除外します。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "リモート デバッグは、サービスに追加のポートが開き、攻撃対象領域が増加するため、運用環境でオンにしないでください。このサービスは、48 時間後に自動的にリモート デバッグをオフにすることに注意してください。", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", - "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", - "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", - "service": "App Services", - "severity": "高い", - "text": "リモートデバッグをオフにする", + "checklist": "Azure Landing Zone Review", + "guid": "43334f24-9116-4341-a2ba-527526944008", + "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", + "service": "Policy", + "severity": "低い", + "text": "Azure Policy を使用して、ユーザーがサブスクリプション/管理グループ レベルでプロビジョニングできるサービスを制御する", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "Defender for App Service を有効にします。 これは(他の脅威の中でも)既知の悪意のあるIPアドレスへの通信を検出します。 操作の一環として、Defender for App Service からの推奨事項を確認します。", - "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "中程度", - "text": "Defender for Cloud を有効にする - Defender for App Service", + "text": "可能な場合は組み込みのポリシーを使用して、運用上のオーバーヘッドを最小限に抑えます。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "Azure は、ネットワーク上で DDoS Basic 保護を提供しており、通常のトラフィック パターンを学習し、異常な動作を検出できるインテリジェントな DDoS Standard 機能によって改善できます。DDoS Standard は仮想ネットワークに適用されるため、Application Gateway や NVA など、アプリの前にあるネットワーク リソース用に構成する必要があります。", - "guid": "223ece80-b123-4071-a541-6415833ea3ad", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "description": "リソース ポリシー共同作成者ロールを特定のスコープに割り当てると、ポリシー管理を関連するチームに委任できます。たとえば、中央の IT チームが管理グループ レベルのポリシーを監督し、アプリケーション チームがサブスクリプションのポリシーを処理することで、組織の標準に準拠した分散ガバナンスが可能になります。", + "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", + "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", + "service": "Policy", "severity": "中程度", - "text": "WAF VNet で DDoS Protection Standard を有効にするEnable DDOS Protection Standard on the WAF VNet", + "text": "組み込みのリソース ポリシー共同作成者ロールを特定のスコープで割り当てて、アプリケーション レベルのガバナンスを有効にします。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "Azure Container Registry に格納されているイメージを使用する場合は、プライベート エンドポイントとアプリ設定 \"WEBSITE_PULL_IMAGE_OVER_VNET\" を使用して、Azure Container Registry から仮想ネットワーク経由でイメージをプルします。", - "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "19048384-5c98-46cb-8913-156a12476e49", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "中程度", - "text": "Virtual Network 経由でコンテナーをプルする", + "text": "ルート管理グループのスコープで行われる Azure Policy 割り当ての数を制限して、継承されたスコープでの除外による管理を回避します。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "ペネトレーションテストのルールに従って、Webアプリケーションでペネトレーションテストを実施します。", - "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", - "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", + "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", + "service": "Policy", "severity": "中程度", - "text": "ペネトレーションテストの実施", + "text": "データ主権の要件が存在する場合は、Azure ポリシーをデプロイして適用できます", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "DevSecOps プラクティスに従って脆弱性が検証およびスキャンされた信頼できるコードをデプロイします。", - "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", - "service": "App Services", + "checklist": "Azure Landing Zone Review", + "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", + "service": "Policy", "severity": "中程度", - "text": "検証済みコードのデプロイ", + "text": "ソブリン・ランディング・ゾーンの場合、主権ポリシー・ベースラインのポリシー・イニシアチブがデプロイされ、正しいMGレベルで割り当てられます。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "サポートされているプラットフォーム、プログラミング言語、プロトコル、およびフレームワークの最新バージョンを使用します。", - "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", - "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", - "service": "App Services", - "severity": "高い", - "text": "最新のプラットフォーム、言語、プロトコル、フレームワークを使用", + "checklist": "Azure Landing Zone Review", + "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", + "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", + "service": "Policy", + "severity": "中程度", + "text": "ソブリン・ランディング・ゾーンについては、ソブリン制御の目標とポリシー・マッピングが文書化されています。", "waf": "安全" }, { - "checklist": "Azure Spring Apps Review", - "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", - "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", + "service": "Policy", "severity": "中程度", - "text": "Azure Spring Apps では、アプリごとに 2 つのデプロイが許可され、そのうちの 1 つだけが運用トラフィックを受信します。ブルーグリーンデプロイ戦略により、ダウンタイムをゼロにすることができます。ブルー グリーン デプロイは、Standard レベルと Enterprise レベルでのみ使用できます。CI/CD と ADO/GitHub Actions を使用してデプロイを自動化できます", - "waf": "確実" + "text": "ソブリン ランディング ゾーンでは、\"ソブリン制御の目標からポリシー マッピング\" の CRUD のプロセスが導入されています。", + "waf": "安全" }, { - "checklist": "Azure Spring Apps Review", - "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", - "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "severity": "中程度", - "text": "Azure Spring Apps インスタンスは、アプリケーション用に複数のリージョンに作成でき、トラフィックは Traffic Manager/Front Door によってルーティングできます。", - "waf": "確実" + "text": "Azure ロールベースのアクセス制御 (Azure RBAC)、データ主権要件、またはデータ保持ポリシーで個別のワークスペースが義務付けられている場合を除き、1 つのモニター ログ ワークスペースを使用してプラットフォームを一元的に管理します。", + "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "waf": "オペレーションズ" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", - "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Monitor", "severity": "中程度", - "text": "サポートされているリージョンでは、Azure Spring Apps をゾーン冗長としてデプロイできるため、インスタンスは可用性ゾーン間で自動的に分散されます。この機能は、Standard レベルと Enterprise レベルでのみ使用できます。", - "waf": "確実" + "text": "ログの保持要件が 12 年を超える場合は、ログを Azure Storage にエクスポートします。不変ストレージと write-once、read-many ポリシーを使用して、ユーザーが指定した間隔でデータを消去および変更できないようにします。", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "オペレーションズ" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", - "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", + "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", + "service": "VM", "severity": "中程度", - "text": "アプリに複数のアプリ インスタンスを使用する", - "waf": "確実" + "text": "Azure Policy を使用して OS レベルの仮想マシン (VM) 構成のずれを監視します。ポリシーを使用して Azure Automanage Machine Configuration 監査機能を有効にすると、アプリケーション チームのワークロードは、わずかな労力で機能をすぐに使用できます。", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "オペレーションズ" }, { - "checklist": "Azure Spring Apps Review", - "guid": "7504c230-6035-4183-95a5-85762acc6075", - "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "severity": "中程度", - "text": "Azure Spring Apps をログ、メトリック、トレースで監視します。ASA を Application Insights と統合し、障害を追跡し、ブックを作成します。", - "waf": "確実" + "text": "Azure Update Manager を、Azure の Windows および Linux VM の修正プログラムの適用メカニズムとして使用します。", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "オペレーションズ" }, { - "checklist": "Azure Spring Apps Review", - "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "severity": "中程度", - "text": "Spring Cloud Gateway で自動スケーリングを設定する", - "waf": "確実" - }, - { - "checklist": "Azure Spring Apps Review", - "guid": "97411607-b6fd-4335-99d1-9885faf4e392", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", - "service": "Spring Apps", - "severity": "低い", - "text": "Standard 従量課金プランと専用プランのアプリの自動スケーリングを有効にします。", - "waf": "確実" + "text": "Azure Arc を使用して、Azure の外部にある Windows および Linux VM の修正プログラムの適用メカニズムとして Azure Update Manager を使用します。", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "オペレーションズ" }, { - "checklist": "Azure Spring Apps Review", - "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", - "link": "https://learn.microsoft.com/azure/spring-apps/overview", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "90483845-c986-4cb2-a131-56a12476e49f", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Network Watcher", "severity": "中程度", - "text": "ミッション クリティカルなアプリの Spring Boot の商用サポートには、Enterprise プランを使用します。他のレベルでは、OSS のサポートを受けることができます。", - "waf": "確実" - }, - { - "checklist": "IoT Hub Review", - "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", - "service": "IoT", - "severity": "高い", - "text": "Availability Zones (リージョンで適用可能な場合) を活用する (これは自動的に有効になります)", - "waf": "確実" + "text": "Network Watcher を使用してトラフィック フローをプロアクティブに監視する", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "オペレーションズ" }, { - "checklist": "IoT Hub Review", - "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", + "checklist": "Azure Landing Zone Review", + "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Monitor", "severity": "中程度", - "text": "Microsoft が開始するフェールオーバーに注意してください。これらは、まれに、影響を受けるリージョンから対応する geo ペア リージョンにすべての IoT ハブをフェールオーバーするために Microsoft によって実行されます。", - "waf": "確実" - }, - { - "checklist": "IoT Hub Review", - "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", - "service": "IoT", - "severity": "高い", - "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する", - "waf": "確実" - }, - { - "checklist": "IoT Hub Review", - "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "severity": "高い", - "text": "手動フェールオーバーをトリガーする方法を学習します。", - "waf": "確実" + "text": "分析情報とレポートには Azure Monitor ログを使用します。", + "waf": "オペレーションズ" }, { - "checklist": "IoT Hub Review", - "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", - "service": "IoT", - "severity": "高い", - "text": "フェールオーバー後にフェールバックする方法を学習します。", - "waf": "確実" + "checklist": "Azure Landing Zone Review", + "guid": "97be9951-9048-4384-9c98-6cb2913156a1", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", + "service": "Monitor", + "severity": "中程度", + "text": "運用アラートの生成には、Azure Monitor アラートを使用します。", + "waf": "オペレーションズ" }, { - "checklist": "Identity Review Checklist", - "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", - "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", - "service": "Entra", + "checklist": "Azure Landing Zone Review", + "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "Monitor", "severity": "中程度", - "text": "有効期間の長い取り消し可能なトークンを使用し、トークンをキャッシュし、Microsoft ID ライブラリを使用してサイレントに取得します", - "waf": "確実" + "text": "Azure Automation アカウントを介して変更とインベントリの追跡を使用する場合は、Log Analytics ワークスペースと Automation アカウントをリンクするためにサポートされているリージョンを選択していることを確認してください。", + "waf": "オペレーションズ" }, { - "checklist": "Identity Review Checklist", - "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", - "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", - "service": "AAD B2C", + "checklist": "Azure Landing Zone Review", + "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Backup", "severity": "中程度", - "text": "サインイン ユーザー フローがバックアップされ、回復性があることを確認します。ユーザーのサインインに使用するコードがバックアップされ、回復可能であることを確認します。外部プロセスとの回復力のあるインターフェース", + "text": "Azure Backup を使用する場合は、既定の設定が GRS であるため、さまざまなバックアップの種類 (GRS、ZRS、LRS) を考慮してください", "waf": "確実" }, { - "checklist": "Identity Review Checklist", - "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", - "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", - "service": "AAD B2C", + "checklist": "Azure Landing Zone Review", + "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "VM", "severity": "中程度", - "text": "カスタムブランドアセットはCDNでホストする必要がある", - "waf": "パフォーマンス" + "text": "Azure ポリシーを使用して、VM 拡張機能を通じてソフトウェア構成を自動的にデプロイし、準拠したベースライン VM 構成を適用します。", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", - "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", - "service": "AAD B2C", - "severity": "低い", - "text": "複数のIDプロバイダーを持っている(つまり、Microsoft、Google、Facebookアカウントでログインする)", - "waf": "確実" + "checklist": "Azure Landing Zone Review", + "description": "Azure Policy のゲスト構成機能では、マシンの設定 (OS、アプリケーション、環境など) を監査して修復し、リソースが想定される構成と一致していることを確認できます。", + "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "VM", + "severity": "中程度", + "text": "VM のセキュリティ構成のドリフトを Azure Policy で監視します。", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure Landing Zone Review", + "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", "severity": "中程度", - "text": "VM レベルでの高可用性に関する VM ルールに従う (Premium ディスク、リージョン内の 2 つ以上、異なる可用性ゾーン内)", - "waf": "確実" + "text": "Azure から Azure Virtual Machines へのディザスター リカバリー シナリオには、Azure Site Recovery を使用します。これにより、リージョン間でワークロードをレプリケートできます。", + "waf": "オペレーションズ" }, { - "checklist": "Identity Review Checklist", - "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure Landing Zone Review", + "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "Backup", "severity": "中程度", - "text": "複製しないでください!レプリケーションにより、ディレクトリ同期に関する問題が発生する可能性があります", - "waf": "確実" + "text": "Azure ネイティブのバックアップ機能、または Azure 互換のサード パーティのバックアップ ソリューションを使用します。", + "waf": "オペレーションズ" }, { - "checklist": "Identity Review Checklist", - "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", - "severity": "中程度", - "text": "マルチリージョンのアクティブ/アクティブを持つ", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", + "severity": "高い", + "text": "Availability Zones は、サポートされているリージョンの VM に活用します。", "waf": "確実" }, { - "checklist": "Identity Review Checklist", - "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", - "severity": "中程度", - "text": "Azure AD Domain Service スタンプを追加のリージョンと場所に追加する", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", + "severity": "高い", + "text": "運用ワークロードを 1 つの VM で実行することは避けてください。", "waf": "確実" }, { - "checklist": "Identity Review Checklist", - "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", + "checklist": "Azure Landing Zone Review", + "guid": "84101f59-1941-4195-a270-e28034290e3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", "severity": "中程度", - "text": "DR にレプリカ セットを使用する", + "text": "Azure Load Balancer と Application Gateway は、受信ネットワーク トラフィックを複数のリソースに分散します。", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "WAF", "severity": "高い", - "text": "ADDS ドメイン コントローラーがネイティブ Azure の ID サブスクリプションにデプロイされていることを確認する", - "waf": "安全" + "text": "診断設定を追加して、Azure Front Door や Azure Application Gateway などのアプリケーション配信サービスから WAF ログを保存します。ログを定期的に確認して、攻撃や誤検知がないか確認します。", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "75089c20-990d-4927-b105-885576f76fc2", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "7f408960-c626-44cb-a018-347c8d790cdf", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "WAF", "severity": "中程度", - "text": "Azure ベースのリソース (Azure VMware Solution を含む) からの認証要求を Azure にローカルに保持するように ADDS サイトとサービスが構成されていることを確認します", - "waf": "安全" + "text": "Azure Front Door や Azure Application Gateway などのアプリケーション配信サービスから Microsoft Sentinel に WAF ログを送信します。攻撃を検出し、WAF テレメトリを Azure 環境全体に統合します。", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "5017f154-e3ab-4369-9829-e7e316183687", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "Key Vault", "severity": "高い", - "text": "vCenterがADDに接続されていることを確認し、「名前付きユーザーアカウント」に基づく認証を有効にします", + "text": "Azure Key Vault を使用してシークレットと資格情報を格納する", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", + "guid": "a0477a20-9945-4bda-9333-4f2491163418", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", + "service": "Key Vault", "severity": "中程度", - "text": "vCenter から ADDS への接続でセキュア プロトコル (LDAPS) が使用されていることを確認します", + "text": "アプリケーションやリージョンごとに異なる Azure Key Vault を使用して、トランザクションのスケール制限を回避し、シークレットへのアクセスを制限します。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "中程度", - "text": "vCenter IdP の CloudAdmin アカウントは、緊急アカウント(非常用アカウント)としてのみ使用されます", + "text": "論理的な削除ポリシーと消去ポリシーを有効にして Azure Key Vault をプロビジョニングし、削除されたオブジェクトの保持保護を許可します。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", - "service": "AVS", - "severity": "高い", - "text": "NSX-Manager が外部 ID プロバイダ (LDAPS) と統合されていることを確認します。", + "checklist": "Azure Landing Zone Review", + "guid": "dc055bcf-619e-48a1-9f98-879525d62688", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "中程度", + "text": "最小特権モデルに従って、キー、シークレット、証明書を完全に削除する承認を特殊なカスタム Microsoft Entra ID ロールに制限します。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "中程度", - "text": "VMware vSphere 内で使用するために RBAC モデルが作成されているか", + "text": "公的認証局による証明書の管理と更新プロセスを自動化し、管理を容易にします。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "913156a1-2476-4e49-b541-acdce979377b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "中程度", - "text": "RBAC アクセス許可は、特定のユーザーではなく、ADDS グループに付与する必要があります", + "text": "キーと証明書のローテーションの自動化されたプロセスを確立します。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", - "service": "AVS", - "severity": "高い", - "text": "Azure の Azure VMware Solution リソースに対する RBAC アクセス許可は、限られた所有者のセットのみに \"ロックダウン\" されます", + "checklist": "Azure Landing Zone Review", + "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "中程度", + "text": "コンテナーでファイアウォールと仮想ネットワーク サービス エンドポイントまたはプライベート エンドポイントを有効にして、キー コンテナーへのアクセスを制御します。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", - "service": "AVS", - "severity": "高い", - "text": "すべてのカスタム ロールのスコープが CloudAdmin で許可された承認で設定されていることを確認する", + "checklist": "Azure Landing Zone Review", + "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", + "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", + "service": "Key Vault", + "severity": "中程度", + "text": "プラットフォーム中央の Azure Monitor Log Analytics ワークスペースを使用して、Key Vault の各インスタンス内のキー、証明書、シークレットの使用状況を監査します。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", - "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", - "service": "AVS", - "severity": "高い", - "text": "お客様のユース ケースに適した Azure VMware Solution 接続モデルが選択されているか", - "waf": "パフォーマンス" + "checklist": "Azure Landing Zone Review", + "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "中程度", + "text": "Key Vault のインスタンス化と特権アクセスを委任し、Azure Policy を使用して一貫性のある準拠構成を適用します。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", - "service": "AVS", - "severity": "高い", - "text": "オンプレミスから Azure への ExpressRoute または VPN 接続が \"接続モニター\" を使用して監視されていることを確認する", - "waf": "オペレーションズ" + "checklist": "Azure Landing Zone Review", + "guid": "91163418-2ba5-4275-8694-4008be7d7e48", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "中程度", + "text": "Azure Key Vault は、アプリケーションごと、環境ごと、リージョンごとに使用します。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "25d62688-6d70-4ba6-a97b-e99519048384", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "中程度", - "text": "Azure VMware Solution バックエンドの ExpressRoute 接続を監視するために、Azure ネイティブ リソースから Azure VMware Solution 仮想マシンへの接続モニターが作成されていることを確認します", - "waf": "オペレーションズ" + "text": "独自のキーを持ち込む場合、これは考慮されているすべてのサービスでサポートされていない可能性があります。不整合が望ましい結果を妨げないように、関連する軽減策を実装します。待機時間を最小限に抑える適切なリージョン ペアとディザスター リカバリー リージョンを選択します。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", + "link": "https://learn.microsoft.com/industry/sovereignty/key-management", + "service": "Key Vault", "severity": "中程度", - "text": "エンド 2 エンドの接続を監視するために、オンプレミス リソースから Azure VMware Solution 仮想マシンへの接続モニターが作成されていることを確認します", - "waf": "オペレーションズ" + "text": "ソブリン ランディング ゾーンの場合は、Azure Key Vault マネージド HSM を使用してシークレットと資格情報を格納します。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", - "service": "AVS", - "severity": "高い", - "text": "ルート サーバーを使用する場合は、ルート サーバーから ExR ゲートウェイ、オンプレミスに伝達されるルートが 1000 を超えないようにします (ARS 制限)。", - "waf": "オペレーションズ" + "checklist": "Azure Landing Zone Review", + "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", + "service": "Entra", + "severity": "中程度", + "text": "Microsoft Entra ID レポート機能を使用して、アクセス制御監査レポートを生成します。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "09945bda-4333-44f2-9911-634182ba5275", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", + "service": "Defender", "severity": "高い", - "text": "Azure Portal で Azure VMware Solution リソースを管理するロールに対して Privileged Identity Management が実装されていますか (永続的なアクセス許可は許可されません)", + "text": "すべてのサブスクリプションに対して Defender Cloud Security Posture Management を有効にします。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", + "service": "Defender", "severity": "高い", - "text": "Privileged Identity Management 監査レポートは、Azure VMware Solution PIM ロールに対して実装する必要がある", + "text": "すべてのサブスクリプションでサーバーに対して Defender Cloud ワークロード保護プランを有効にします。", "waf": "安全" }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", - "service": "AVS", - "severity": "中程度", - "text": "Privileged Identity Management を使用している場合は、Azure VMware Solution のホストの自動置換通知用の有効な SMTP レコードを使用して、有効な Entra ID が有効なアカウントが作成されていることを確認します。(常任許可が必要)", + { + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", + "service": "Defender", + "severity": "高い", + "text": "すべてのサブスクリプションで Azure リソースの Defender Cloud Workload Protection プランを有効にします。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", + "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", + "service": "VM", "severity": "高い", - "text": "CloudAdmin アカウントの使用を緊急アクセスのみに制限する", + "text": "IaaS サーバーで Endpoint Protection を有効にします。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", + "link": "https://learn.microsoft.com/azure/security-center/", + "service": "VM", "severity": "中程度", - "text": "vCenter Server でカスタム RBAC ロールを作成して、vCenter 内に最小特権モデルを実装します", + "text": "Azure Monitor ログと Defender for Cloud を使用して、基本オペレーティング システムの修正プログラムの適用誤差を監視します。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "severity": "中程度", - "text": "cloudadmin (vCenter) と admin (NSX) の資格情報を定期的にローテーションするように定義されたプロセスです。", + "text": "既定のリソース構成を一元化された Azure Monitor Log Analytics ワークスペースに接続します。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", - "service": "AVS", - "severity": "高い", - "text": "一元化された ID プロバイダーを使用して、Azure VMware Solution で実行されているワークロード (VM) に使用する", + "checklist": "Azure Landing Zone Review", + "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", + "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", + "service": "Entra", + "severity": "中程度", + "text": "ソブリン ランディング ゾーンの場合、透過性ログは Entra ID テナントで有効になっています。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", + "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", + "service": "Entra", "severity": "中程度", - "text": "East-West トラフィック フィルタリングは NSX-T 内に実装されていますか", + "text": "ソブリン ランディング ゾーンの場合、Entra ID テナントでカスタマー ロックボックスが有効になっています。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Storage", "severity": "高い", - "text": "Azure VMware Solution 上のワークロードは、インターネットに直接公開されません。トラフィックは、Azure Application Gateway、Azure Firewall、またはサード パーティのソリューションによってフィルター処理され、検査されます", + "text": "ストレージ アカウントへの安全な転送を有効にする必要がある", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", + "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", + "service": "Storage", "severity": "高い", - "text": "監査とログ記録は、Azure VMware Solution および Azure VMware Solution ベースのワークロードへの受信インターネット要求に対して実装されます", + "text": "ストレージ アカウントのコンテナーの論理的な削除を有効にして、削除されたコンテナーとその内容を回復します。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", - "service": "AVS", - "severity": "中程度", - "text": "セッション監視は、疑わしい/悪意のあるアクティビティを特定するために、Azure VMware Solution または Azure VMware Solution ベースのワークロードからの送信インターネット接続に実装されます", - "waf": "安全" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", + "service": "Key Vault", + "severity": "高い", + "text": "Key Vault シークレットを使用して、資格情報 (仮想マシン、ユーザー パスワード)、証明書、キーなどの機密情報をハードコーディングしないようにします。", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "334fdf91-c234-4182-a652-75269440b4be", - "service": "AVS", + "checklist": "Identity Review Checklist", + "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", + "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", + "service": "Entra", "severity": "中程度", - "text": "Azure の ExR/VPN Gateway サブネットで DDoS Standard 保護が有効になっているか", - "waf": "安全" + "text": "有効期間の長い取り消し可能なトークンを使用し、トークンをキャッシュし、Microsoft ID ライブラリを使用してサイレントに取得します", + "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", - "service": "AVS", + "checklist": "Identity Review Checklist", + "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", + "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", + "service": "AAD B2C", "severity": "中程度", - "text": "専用の特権アクセス ワークステーション (PAW) を使用して、Azure VMware Solution、vCenter、NSX Manager、HCX Manager を管理する", - "waf": "安全" + "text": "サインイン ユーザー フローがバックアップされ、回復性があることを確認します。ユーザーのサインインに使用するコードがバックアップされ、回復可能であることを確認します。外部プロセスとの回復力のあるインターフェース", + "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", - "service": "AVS", + "checklist": "Identity Review Checklist", + "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", + "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", + "service": "AAD B2C", "severity": "中程度", - "text": "Azure VMware Solution で実行されているワークロードに対して Advanced Threat Detection (Microsoft Defender for Cloud 別名 ASC) を有効にする", - "waf": "安全" + "text": "カスタムブランドアセットはCDNでホストする必要がある", + "waf": "パフォーマンス" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", - "service": "AVS", + "checklist": "Identity Review Checklist", + "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", + "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", + "service": "AAD B2C", + "severity": "低い", + "text": "複数のIDプロバイダーを持っている(つまり、Microsoft、Google、Facebookアカウントでログインする)", + "waf": "確実" + }, + { + "checklist": "Identity Review Checklist", + "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "severity": "中程度", - "text": "Azure ARC for Servers を使用して、Azure ネイティブ テクノロジを使用して Azure VMware Solution で実行されているワークロードを適切に管理します (Azure ARC for Azure VMware Solution はまだ利用できません)", - "waf": "安全" + "text": "VM レベルでの高可用性に関する VM ルールに従う (Premium ディスク、リージョン内の 2 つ以上、異なる可用性ゾーン内)", + "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", - "service": "AVS", - "severity": "低い", - "text": "Azure VMware Solution 上のワークロードで、実行時に十分なデータ暗号化 (ゲスト内ディスク暗号化や SQL TDE など) が使用されるようにします。(保存時の vSAN 暗号化がデフォルトです)", - "waf": "安全" + "checklist": "Identity Review Checklist", + "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "中程度", + "text": "複製しないでください!レプリケーションにより、ディレクトリ同期に関する問題が発生する可能性があります", + "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a3592718-e6e2-4051-9267-6ae46691e883", - "service": "AVS", - "severity": "低い", - "text": "ゲスト内暗号化を使用する場合は、可能な場合は Azure Key Vault に暗号化キーを格納します", - "waf": "安全" + "checklist": "Identity Review Checklist", + "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "中程度", + "text": "マルチリージョンのアクティブ/アクティブを持つ", + "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5ac94222-3e13-4810-9230-81a941741583", - "service": "AVS", + "checklist": "Identity Review Checklist", + "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "severity": "中程度", - "text": "Azure VMware Solution で実行されているワークロードには、拡張セキュリティ更新プログラムのサポートの使用を検討してください (Azure VMware Solution は ESU の対象です)", - "waf": "安全" + "text": "Azure AD Domain Service スタンプを追加のリージョンと場所に追加する", + "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", - "service": "AVS", - "severity": "高い", - "text": "適切な vSAN データ冗長化方式(RAID 仕様)が使用されていることを確認します。", + "checklist": "Identity Review Checklist", + "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", + "severity": "中程度", + "text": "DR にレプリカ セットを使用する", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d88408f3-7273-44c8-96ba-280214590146", - "service": "AVS", - "severity": "高い", - "text": "許容障害ポリシーが vSAN ストレージのニーズを満たすために設定されていることを確認します", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", + "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", + "service": "AKS", + "severity": "低い", + "text": "AKS Windows ワークロードで必要な場合は、HostProcess コンテナーを使用できます", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", + "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", + "service": "AKS", + "severity": "低い", + "text": "イベント ドリブン ワークロードを実行する場合は KEDA を使用します", + "waf": "パフォーマンス" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", + "link": "https://dapr.io/", + "service": "AKS", + "severity": "低い", + "text": "Dapr を使用してマイクロサービス開発を容易にする", + "waf": "オペレーションズ" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", + "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", + "link": "https://learn.microsoft.com/azure/aks/uptime-sla", + "service": "AKS", "severity": "高い", - "text": "十分なクォータを要求し、拡張とディザスタリカバリの要件を考慮していることを確認します", + "text": "SLA でサポートされる AKS オファリングを使用する", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", - "service": "AVS", - "severity": "中程度", - "text": "ESXiへのアクセス制限を理解し、サードパーティのソリューションに影響を与える可能性のあるアクセス制限があることを確認してください。", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", + "severity": "低い", + "text": "ポッドとデプロイ定義でのディスラプション バジェットの使用", + "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", - "service": "AVS", - "severity": "中程度", - "text": "ESXi ホストの密度と効率に関するポリシーがあることを確認し、新しいノードを要求するためのリード タイムを念頭に置いてください", - "waf": "オペレーションズ" + "checklist": "Azure AKS Review", + "guid": "3c763963-7a55-42d5-a15e-401955387e5c", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", + "service": "ACR", + "severity": "高い", + "text": "プライベート レジストリを使用する場合は、複数のリージョンにイメージを格納するようにリージョン レプリケーションを構成します", + "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", - "service": "AVS", - "severity": "中程度", - "text": "Azure VMware Solution の適切なコスト管理プロセスが整っていることを確認する - Azure Cost Management を使用できます", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", + "service": "AKS", + "severity": "低い", + "text": "kubecost などの外部アプリケーションを使用して、さまざまなユーザーにコストを割り当てます", "waf": "費用" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", + "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", + "service": "AKS", "severity": "低い", - "text": "Azure VMware Solution を使用するためのコストを最適化するために Azure 予約インスタンスが使用されているか", + "text": "スケールダウンモードを使用してノードを削除/割り当て解除する", "waf": "費用" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6691e883-5ac9-4422-83e1-3810523081a9", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", + "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", + "service": "AKS", "severity": "中程度", - "text": "他の Azure Native Services を使用する場合は、Azure Private-Link の使用を検討してください", - "waf": "安全" + "text": "必要に応じて、AKS クラスターで複数インスタンスの分割 GPU を使用する", + "waf": "費用" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", - "service": "AVS", - "severity": "高い", - "text": "必要なすべてのリソースが同じ Azure 可用性ゾーン内に存在することを確認する", - "waf": "パフォーマンス" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", + "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", + "service": "AKS", + "severity": "低い", + "text": "Dev/Test クラスターを実行している場合は、NodePool Start/Stop を使用します。", + "waf": "費用" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", + "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", + "service": "AKS", "severity": "中程度", - "text": "Azure VMware Solution ゲスト VM ワークロードに対して Microsoft Defender for Cloud を有効にする", + "text": "Azure Policy for Kubernetes を使用してクラスターのコンプライアンスを確保する", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", + "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "severity": "中程度", - "text": "Azure Arc 対応サーバーを使用して Azure VMware Solution ゲスト VM のワークロードを管理する", + "text": "ユーザー/システムノードプールを使用してコントロールプレーンからアプリケーションを分離する", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", - "service": "AVS", - "severity": "高い", - "text": "Azure VMware Solution での診断ログとメトリック ログを有効にするEnable Diagnostic and metric logging on Azure VMware Solution", - "waf": "オペレーションズ" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", - "service": "AVS", - "severity": "中程度", - "text": "Log Analytics エージェントを Azure VMware Solution ゲスト VM ワークロードにデプロイする", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", + "severity": "低い", + "text": "システム ノードプールにテイントを追加して専用にする", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "589d457a-927c-4397-9d11-02cad6aae11e", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", + "link": "https://learn.microsoft.com/azure/container-registry/", + "service": "AKS", "severity": "中程度", - "text": "Azure VMware Solution VM ワークロードのバックアップ ポリシーとソリューションが文書化され、実装されていることを確認します", - "waf": "オペレーションズ" + "text": "イメージにはプライベート レジストリ (ACR など) を使用する", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ee29711b-d352-4caa-ab79-b198dab81932", - "service": "AVS", + "checklist": "Azure AKS Review", + "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", + "link": "https://learn.microsoft.com/azure/security-center/container-security", + "service": "ACR", "severity": "中程度", - "text": "Microsoft Defender for Cloud を使用して、Azure VMware Solution で実行されているワークロードのコンプライアンス監視を行う", + "text": "イメージをスキャンして脆弱性を検出する", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", - "service": "AVS", - "severity": "中程度", - "text": "適用可能なコンプライアンス ベースラインは Microsoft Defender for Cloud に追加されていますか", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", + "service": "AKS", + "severity": "高い", + "text": "アプリの分離要件を定義する (名前空間/ノードプール/クラスター)", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", - "service": "AVS", - "severity": "高い", - "text": "Azure VMware Solution のデプロイに使用する Azure リージョンを選択するときにデータ所在地が評価されましたか", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", + "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", + "service": "AKS", + "severity": "中程度", + "text": "CSI シークレット ストア ドライバーを使用して Azure Key Vault にシークレットを格納する", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", + "link": "https://learn.microsoft.com/azure/aks/update-credentials", + "service": "AKS", "severity": "高い", - "text": "データ処理への影響 (サービス プロバイダー/サービス コンシューマー モデル) が明確で文書化されているか", + "text": "クラスターにサービス プリンシパルを使用する場合は、資格情報を定期的に (四半期ごとなど) 更新します", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "547c1747-dc56-4068-a714-435cd19dd244", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", + "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", + "service": "AKS", "severity": "中程度", - "text": "コンプライアンス上の理由で必要な場合にのみ、vSAN に CMK (カスタマー マネージド キー) を使用することを検討してください。", + "text": "必要に応じて、キー管理サービスの etcd 暗号化を追加します", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", - "service": "AVS", - "severity": "高い", - "text": "Azure VMware Solution のコア監視分析情報を有効にするダッシュボードを作成するCreate dashboards to enable a core Azure VMware Solution monitoring insights", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", + "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", + "service": "AKS", + "severity": "低い", + "text": "必要に応じて、Confidential Compute for AKS の使用を検討してください", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", - "service": "AVS", - "severity": "高い", - "text": "Azure VMware Solution のパフォーマンス (CPU >80%、平均メモリ >80%、vSAN >70%) に関する自動アラートの重大しきい値の警告アラートを作成する", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", + "service": "AKS", + "severity": "中程度", + "text": "Defender for Containers の使用を検討する", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9659e396-80e7-4828-ac93-5657d02bff45", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", + "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", + "service": "AKS", "severity": "高い", - "text": "vSAN の消費量が 75% を下回っているかどうかを監視するための重要なアラートが作成されていることを確認します (これは VMware からのサポートしきい値です)。", - "waf": "オペレーションズ" + "text": "サービス プリンシパルの代わりにマネージド ID を使用するUse managed identities instead of Service Principals", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", - "service": "AVS", - "severity": "高い", - "text": "Azure Service Health のアラートと通知に対してアラートが構成されていることを確認する", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", + "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", + "link": "https://learn.microsoft.com/azure/aks/managed-aad", + "service": "AKS", + "severity": "中程度", + "text": "認証と AAD の統合 (マネージド統合を使用)", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", + "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", + "service": "AKS", "severity": "中程度", - "text": "処理のために Azure Storage アカウントまたは Azure EventHub に送信するように Azure VMware Solution ログを構成する", - "waf": "オペレーションズ" + "text": "管理者 kubeconfig へのアクセスを制限する (get-credentials --admin)", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", - "service": "AVS", - "severity": "低い", - "text": "VMware vSphere での詳細な分析情報が必要な場合:vRealize Operations や vRealize Network Insights がソリューションで使用されていますか?", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", + "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", + "service": "AKS", + "severity": "中程度", + "text": "承認と AAD RBAC の統合", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", + "service": "AKS", "severity": "高い", - "text": "仮想マシンの vSAN ストレージ ポリシーはシック プロビジョニングを適用するため、このポリシーがデフォルトのストレージ ポリシーではないことを確認します", - "waf": "オペレーションズ" + "text": "Kubernetes で RBAC 特権を制限するために名前空間を使用する", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", + "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", + "service": "AKS", "severity": "中程度", - "text": "vSAN は有限のリソースであるため、vSphere コンテンツ ライブラリが vSAN に配置されていないことを確認する", - "waf": "オペレーションズ" + "text": "ポッド ID アクセス管理の場合は、Azure AD ワークロード ID (プレビュー) を使用します", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", + "service": "AKS", "severity": "中程度", - "text": "バックアップ ソリューションのデータ リポジトリが vSAN ストレージの外部に保存されていることを確認します。Azure ネイティブまたはディスク プールでバックアップされるデータストア上", - "waf": "オペレーションズ" + "text": "AKS 非対話型ログインの場合は、kubelogin (プレビュー) を使用します", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", + "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", + "service": "AKS", "severity": "中程度", - "text": "Azure Arc for Servers を使用して Azure VMware Solution で実行されているワークロードがハイブリッド管理されていることを確認する (Arc for Azure VMware Solution はプレビュー段階です)", - "waf": "オペレーションズ" + "text": "AKS ローカル アカウントを無効にする", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", - "service": "AVS", - "severity": "中程度", - "text": "Azure VMware Solution で実行されているワークロードが Azure Log Analytics と Azure Monitor を使用して監視されていることを確認する", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", + "service": "AKS", + "severity": "低い", + "text": "必要に応じて Just-In-Time クラスター アクセスを構成する", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", - "service": "AVS", - "severity": "中程度", - "text": "Azure VMware Solution で実行されているワークロードを、既存の更新プログラム管理ツールまたは Azure Update Management に含める", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", + "service": "AKS", + "severity": "低い", + "text": "必要に応じて AKS の AAD 条件付きアクセスを構成する", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", - "service": "AVS", - "severity": "中程度", - "text": "Azure Policy を使用して、Azure の管理、監視、セキュリティ ソリューションに Azure VMware Solution ワークロードをオンボードする", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", + "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", + "service": "AKS", + "severity": "低い", + "text": "Windows AKS ワークロードで必要な場合は、gMSA を構成します", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", + "service": "AKS", "severity": "中程度", - "text": "Azure VMware Solution で実行されているワークロードが Microsoft Defender for Cloud にオンボードされていることを確認する", + "text": "より細かく制御するには、マネージドKubelet Identityの使用を検討してください", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", + "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", + "service": "AKS", "severity": "中程度", - "text": "vSAN は有限のリソースであるため、バックアップが vSAN に保存されないようにする", + "text": "AGIC を使用している場合は、クラスター間で AppGW を共有しないでください", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", - "service": "AVS", - "severity": "中程度", - "text": "すべてのDRソリューションが検討され、ビジネスに最適なソリューションが決定されましたか?[SRM/JetStream/Zerto/Veeam/...]", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", + "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", + "link": "https://learn.microsoft.com/azure/aks/http-application-routing", + "service": "AKS", + "severity": "高い", + "text": "AKS HTTP ルーティング アドオンを使用せず、代わりにアプリケーション ルーティング アドオンでマネージド NGINX イングレスを使用します。", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", + "service": "AKS", "severity": "中程度", - "text": "ディザスター リカバリー テクノロジがネイティブの Azure IaaS の場合は、Azure Site Recovery を使用します", - "waf": "確実" + "text": "Windows ワークロードの場合は、高速ネットワークを使用します", + "waf": "パフォーマンス" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", + "guid": "ba7da7be-9952-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "severity": "高い", - "text": "いずれかの災害ソリューションで自動復旧計画を使用し、手動タスクを可能な限り回避します", + "text": "標準のALBを使用する(基本的なALBとは対照的)", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8255461e-2aee-4345-9aec-8339248b262d", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", + "service": "AKS", "severity": "中程度", - "text": "地政学的リージョンのペアをセカンダリディザスタリカバリ環境として使用する", - "waf": "確実" + "text": "Azure CNI を使用する場合は、NodePool に異なるサブネットを使用することを検討してください", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", + "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", + "service": "AKS", + "severity": "中程度", + "text": "プライベート エンドポイント (推奨) または Virtual Network サービス エンドポイントを使用して、クラスターから PaaS サービスにアクセスする", + "waf": "安全" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", + "guid": "a0f61565-9de5-458f-a372-49c831112dbd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "severity": "高い", - "text": "リージョン間で 2 つの異なるアドレス空間を使用します (例: 10.0.0.0/16 と 192.168.0.0/16)。", + "text": "要件に最適な CNI ネットワーク プラグインを選択する (Azure CNI を推奨)", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", - "service": "AVS", - "severity": "中程度", - "text": "ExpressRoute Global Reach は、プライマリとセカンダリの Azure VMware Solution プライベート クラウド間の接続に使用されますか、それともネットワーク仮想アプライアンスを介してルーティングされますか?", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "高い", + "text": "Azure CNI を使用する場合は、ノードあたりのポッドの最大数を考慮して、サブネットのサイズを適切に設定します", + "waf": "パフォーマンス" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", - "service": "AVS", - "severity": "中程度", - "text": "すべてのバックアップソリューションが検討され、ビジネスに最適なソリューションが決定されましたか?[ MABS/CommVault/Metallic.io/Veeam/ . ]", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "高い", + "text": "Azure CNI を使用している場合は、最大ポッド数/ノード (既定値は 30) を確認します", + "waf": "パフォーマンス" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", - "service": "AVS", - "severity": "中程度", - "text": "バックアップ ソリューションを Azure VMware Solution プライベート クラウドと同じリージョンにデプロイする", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "内部アプリの場合、組織は多くの場合、ファイアウォールで AKS サブネット全体を開きます。これにより、ノードへのネットワーク アクセスも開かれ、場合によってはポッドへのネットワーク アクセスも開かれます (Azure CNI を使用している場合)。LoadBalancer の IP が別のサブネットにある場合は、この IP のみをアプリ クライアントで使用できる必要があります。もう 1 つの理由は、AKS サブネット内の IP アドレスが希少なリソースである場合、その IP アドレスをサービスに使用すると、クラスターの最大スケーラビリティが低下することです。", + "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", + "link": "https://learn.microsoft.com/azure/aks/internal-lb", + "service": "AKS", + "severity": "低い", + "text": "プライベート IP LoadBalancer サービスを使用する場合は、(AKS サブネットではなく) 専用サブネットを使用します", + "waf": "安全" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "高い", + "text": "それに応じて、サービスの IP アドレス範囲のサイズを設定します (クラスターのスケーラビリティが制限されます)。", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", + "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", + "service": "AKS", + "severity": "低い", + "text": "必要に応じて、独自のCNIプラグインを追加します", + "waf": "安全" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", + "service": "AKS", + "severity": "低い", + "text": "必要に応じて、AKS でノードごとにパブリック IP を構成する", + "waf": "パフォーマンス" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", + "link": "https://learn.microsoft.com/azure/aks/concepts-network", + "service": "AKS", "severity": "中程度", - "text": "バックアップ ソリューションを vSan の外部の Azure ネイティブ コンポーネントにデプロイする", + "text": "イングレス コントローラーを使用して、LoadBalancer タイプのサービスで公開する代わりに、Web ベースのアプリを公開します", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", + "link": "https://learn.microsoft.com/azure/aks/nat-gateway", + "service": "AKS", "severity": "低い", - "text": "Azure プラットフォームによって管理されている VMware コンポーネントの復元を要求するプロセスは用意されていますか?", + "text": "エグレス トラフィックをスケーリングするために Azure NAT Gateway を outboundType として使用する", "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", - "service": "AVS", - "severity": "低い", - "text": "手動デプロイの場合、すべての構成とデプロイを文書化する必要があります", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", + "service": "AKS", + "severity": "中程度", + "text": "Azure CNI IP の枯渇を回避するために IP の動的割り当てを使用する", + "waf": "確実" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", - "service": "AVS", - "severity": "低い", - "text": "手動デプロイの場合は、Azure VMware Solution プライベート クラウドでの偶発的なアクションを防ぐために、リソース ロックの実装を検討してください", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", + "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", + "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", + "service": "AKS", + "severity": "高い", + "text": "セキュリティ要件で義務付けられている場合は、AzFW/NVA を使用してエグレス トラフィックをフィルター処理します", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", - "service": "AVS", - "severity": "低い", - "text": "自動デプロイの場合は、最小限のプライベート クラウドをデプロイし、必要に応じてスケーリングします", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", + "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", + "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", + "service": "AKS", + "severity": "中程度", + "text": "パブリック API エンドポイントを使用している場合は、アクセスできる IP アドレスを制限します", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", - "service": "AVS", - "severity": "低い", - "text": "自動デプロイの場合は、デプロイを開始する前にクォータを要求または予約します", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", + "link": "https://learn.microsoft.com/azure/aks/private-clusters", + "service": "AKS", + "severity": "高い", + "text": "要件で必要な場合は、プライベート クラスターを使用します", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", - "service": "AVS", - "severity": "低い", - "text": "自動デプロイの場合は、適切なガバナンスのために、自動化または Azure Policy を使用して関連するリソース ロックが作成されていることを確認します", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", + "severity": "中程度", + "text": "Windows 2019 および 2022 AKS ノードでは、Calico ネットワーク ポリシーを使用できます", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", - "service": "AVS", - "severity": "低い", - "text": "ExR 認証キーに人間が理解できる名前を実装して、キーの目的/用途を簡単に識別できるようにします", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", + "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", + "severity": "高い", + "text": "Kubernetes ネットワーク ポリシー オプションを有効にする (Calico/Azure)", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "255461e2-aee3-4553-afc8-339248b262d6", - "service": "AVS", - "severity": "低い", - "text": "Azure VMware Solution と ExpressRoute のデプロイに個別のサービス プリンシパルを使用する場合は、キー コンテナーを使用してシークレットと承認キーを格納します", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", + "severity": "高い", + "text": "Kubernetesネットワークポリシーを使用してクラスタ内のセキュリティを強化", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", - "service": "AVS", - "severity": "低い", - "text": "Azure VMware Solution では限られた数の並列操作しかサポートされないため、Azure VMware Solution に多くのリソースをデプロイする必要がある場合に、IaC でアクションをシリアル化するためのリソースの依存関係を定義します。", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", + "severity": "高い", + "text": "Web ワークロード (UI または API) に WAF を使用するUse a WAF for a web workloads (UI or API)", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", - "service": "AVS", - "severity": "低い", - "text": "単一の Tier-1 ゲートウェイで NSX-T セグメントの自動構成を実行する場合は、NSX-Manager API ではなく Azure Portal API を使用します", - "waf": "オペレーションズ" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", + "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", + "service": "AKS", + "severity": "中程度", + "text": "AKS Virtual Network で DDoS Standard を使用するUse DDoS Standard in the AKS Virtual Network", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", - "service": "AVS", - "severity": "中程度", - "text": "自動スケールアウトを使用する場合は、Azure VMware Solution を実行しているサブスクリプションに対して十分な Azure VMware Solution クォータを申請してください", - "waf": "パフォーマンス" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", + "link": "https://learn.microsoft.com/azure/aks/http-proxy", + "service": "AKS", + "severity": "低い", + "text": "必要に応じて、会社の HTTP プロキシを追加します", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", + "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", + "service": "AKS", "severity": "中程度", - "text": "自動スケールインを使用する場合は、そのようなアクションを実行する前に、ストレージ ポリシーの要件を必ず考慮してください", - "waf": "パフォーマンス" + "text": "高度なマイクロサービス通信管理にサービスメッシュの使用を検討する", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", - "service": "AVS", - "severity": "中程度", - "text": "スケーリング操作は、一度に 1 つのスケール操作しか実行できないため、常に 1 つの SDDC 内でシリアル化する必要があります (複数のクラスタが使用されている場合でも)", - "waf": "パフォーマンス" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", + "service": "AKS", + "severity": "高い", + "text": "最も重要なメトリックに関するアラートを構成します (推奨事項については、「Container Insights」を参照してください)", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", - "service": "AVS", - "severity": "中程度", - "text": "アーキテクチャで使用されるサードパーティソリューションでのスケーリング操作を検討および検証します(サポートされているかどうか)", - "waf": "パフォーマンス" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "337453a3-cc63-4963-9a65-22ac19e80696", + "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", + "service": "AKS", + "severity": "低い", + "text": "Azure Advisor でクラスターの推奨事項を定期的に確認する", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", - "service": "AVS", - "severity": "中程度", - "text": "自動化で環境のスケールイン/スケールアウトの上限を定義して適用する", - "waf": "パフォーマンス" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", + "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", + "service": "AKS", + "severity": "低い", + "text": "AKS 自動証明書のローテーションを有効にする", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", - "service": "AVS", - "severity": "中程度", - "text": "監視ルールを実装して、自動スケーリング操作を監視し、成功と失敗を監視して、適切な (自動化された) 応答を有効にします", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", + "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", + "service": "AKS", + "severity": "高い", + "text": "kubernetes のバージョンを定期的に (四半期ごとなど) アップグレードする定期的なプロセスを行うか、AKS 自動アップグレード機能を使用します", "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", + "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", + "service": "AKS", "severity": "高い", - "text": "MONを使用する場合は、同時に構成されたVMの制限(HCXのMON制限[400 - 標準、1000 - 大規模アプライアンス])に注意してください", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "確実" + "text": "ノードイメージのアップグレードを使用していない場合は、Linuxノードのアップグレードにkuredを使用します", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", + "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", + "service": "AKS", "severity": "高い", - "text": "MON を使用する場合、100 を超えるネットワーク拡張で MON を有効にすることはできません", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "確実" + "text": "クラスタノードイメージを定期的に(毎週など)アップグレードする定期的なプロセスを用意します", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", - "service": "AVS", - "severity": "中程度", - "text": "移行に VPN 接続を使用する場合は、それに応じて MTU サイズを調整します。", - "waf": "パフォーマンス" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", + "service": "AKS", + "severity": "低い", + "text": "アプリケーションまたはクラスター構成を複数のクラスターにデプロイするために gitop を検討してください", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e614658d-d457-4e92-9139-b821102cad6e", - "service": "AVS", - "severity": "中程度", - "text": "Azure に接続する接続性の低いリージョン (500 Mbps 以下) の場合は、HCX WAN 最適化アプライアンスのデプロイを検討してください", - "waf": "パフォーマンス" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d7672c26-7602-4482-85a4-14527fbe855c", + "link": "https://learn.microsoft.com/azure/aks/command-invoke", + "service": "AKS", + "severity": "低い", + "text": "プライベート クラスターで AKS コマンド呼び出しを使用することを検討する", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", - "service": "AVS", - "severity": "中程度", - "text": "移行がオンプレミスアプライアンスから開始され、クラウドアプライアンスから開始されていないことを確認します(逆移行は実行しないでください)", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", + "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", + "service": "AKS", + "severity": "低い", + "text": "計画されたイベントの場合は、ノードの自動ドレインの使用を検討してください", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "AVS", - "severity": "中程度", - "text": "Azure NetApp Files を使用して Azure VMware Solution のストレージを拡張する場合は、VM に直接接続するのではなく、これを VMware データストアとして使用することを検討してください。", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", + "link": "https://learn.microsoft.com/azure/aks/faq", + "service": "AKS", + "severity": "高い", + "text": "独自のガバナンスプラクティスを開発して、ノードRG(別名「インフラRG」)のオペレーターによって変更が実行されないようにします", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "AVS", - "severity": "中程度", - "text": "専用の ExpressRoute ゲートウェイが外部データ ストレージ ソリューションに使用されていることを確認する", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", + "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", + "severity": "低い", + "text": "カスタムノードRG(別名「インフラRG」)名を使用", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "AVS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", + "link": "https://kubernetes.io/docs/setup/release/notes/", + "service": "AKS", "severity": "中程度", - "text": "外部データ ストレージ ソリューションに使用されている ExpressRoute ゲートウェイで FastPath が有効になっていることを確認します", - "waf": "確実" + "text": "非推奨の Kubernetes API を YAML マニフェストで使用しないでください", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "AVS", - "severity": "高い", - "text": "ストレッチ クラスタを使用している場合は、選択したディザスタ リカバリ ソリューションがベンダーによってサポートされていることを確認します", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", + "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", + "service": "AKS", + "severity": "低い", + "text": "Windows ノードのテイント", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "AVS", - "severity": "高い", - "text": "ストレッチ クラスターを使用する場合は、提供される SLA が要件を満たしていることを確認します", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", + "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", + "service": "AKS", + "severity": "低い", + "text": "Windows コンテナーのパッチ レベルをホストのパッチ レベルと同期させる", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "AVS", - "severity": "高い", - "text": "ストレッチ クラスターを使用している場合は、両方の ExpressRoute 回線が接続ハブに接続されていることを確認します。", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "クラスタレベルでの診断設定経由", + "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", + "link": "https://learn.microsoft.com/azure/aks/monitor-aks", + "service": "AKS", + "severity": "低い", + "text": "マスター ログ (API ログ) を Azure Monitor または任意のログ管理ソリューションに送信する", + "waf": "オペレーションズ" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "AVS", - "severity": "高い", - "text": "ストレッチ クラスターを使用している場合は、両方の ExpressRoute 回線で GlobalReach が有効になっていることを確認します。", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", + "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", + "service": "AKS", + "severity": "低い", + "text": "必要に応じて、nodePool スナップショットを使用します", + "waf": "費用" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "AVS", - "severity": "高い", - "text": "サイトの耐障害性の設定を適切に検討し、必要に応じてビジネスに合わせて変更しましたか?", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", + "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", + "service": "AKS", + "severity": "低い", + "text": "時間的制約のないワークロードのスポット ノード プールを検討する", + "waf": "オペレーションズ" }, { - "checklist": "Azure Function Review", - "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", - "severity": "高い", - "text": "ビジネスとSLOの要件に基づいて適切な関数ホスティングプランを選択します", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", + "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", + "severity": "低い", + "text": "クイック バーストのために AKS 仮想ノードを検討する", + "waf": "オペレーションズ" }, { - "checklist": "Azure Function Review", - "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", "severity": "高い", - "text": "リージョンで適用可能な場合は Availability Zones を活用します (従量課金レベルでは使用できません)", - "waf": "確実" + "text": "Container Insights (または Prometheus などの他のツール) を使用してクラスター メトリックを監視する", + "waf": "オペレーションズ" }, { - "checklist": "Azure Function Review", - "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", - "service": "Azure Functions", - "severity": "中程度", - "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", + "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", + "severity": "高い", + "text": "Container Insights(またはTelegraf/ElasticSearchなどの他のツール)を使用してクラスターログを保存および分析します", + "waf": "オペレーションズ" }, { - "checklist": "Azure Function Review", - "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Azure Functions", - "severity": "高い", - "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", + "service": "AKS", + "severity": "中程度", + "text": "ノードの CPU とメモリの使用率を監視する", + "waf": "オペレーションズ" }, { - "checklist": "Azure Function Review", - "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "Azure Functions", - "severity": "高い", - "text": "App Service プランで実行されているすべての関数アプリで \"Always On\" が有効になっていることを確認する", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1a4835ac-9422-423e-ae80-b123081a5417", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "中程度", + "text": "Azure CNI を使用している場合は、ノードごとに消費されるポッド IP の割合を監視します", + "waf": "オペレーションズ" }, { - "checklist": "Azure Function Review", - "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", - "service": "Azure Functions", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "OS ディスクの I/O は重要なリソースです。ノード内の OS が I/O で調整されると、予期しない動作が発生し、通常はノードが NotReady と宣言される可能性があります", + "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", + "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", + "service": "AKS", "severity": "中程度", - "text": "関数アプリを独自のストレージ アカウントにペアリングします。Function Apps のストレージ アカウントは、緊密に結合されていない限り、再利用しないようにしてください", - "waf": "確実" + "text": "ノード内の OS ディスク キューの深さを監視する", + "waf": "オペレーションズ" }, { - "checklist": "Azure Function Review", - "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "Azure Functions", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "be209d39-fda4-4777-a424-d116785c2fa5", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "severity": "中程度", - "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、関数アプリのコードを保護します", + "text": "AzFW/NVA でエグレス フィルター処理を使用しない場合は、標準の ALB によって割り当てられた SNAT ポートを監視します", "waf": "オペレーションズ" }, { - "checklist": "Azure Bot Service", - "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", - "service": "Bot service", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", + "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", + "service": "AKS", "severity": "中程度", - "text": "Azure Bot Service の信頼性サポートの推奨事項に従う", - "waf": "確実" + "text": "AKS クラスターのリソース正常性通知をサブスクライブするSubscribe to resource health notifications for your AKS cluster", + "waf": "オペレーションズ" }, { - "checklist": "Azure Bot Service", - "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", - "service": "Bot service", - "severity": "中程度", - "text": "ローカル データ所在地とリージョン コンプライアンスを備えたボットのデプロイ", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", + "severity": "高い", + "text": "ポッド仕様で要求と制限を構成する", + "waf": "オペレーションズ" }, { - "checklist": "Azure Bot Service", - "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", - "service": "Bot service", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "769ef669-1a48-435a-a942-223ece80b123", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "severity": "中程度", - "text": "Azure Bot Service は、グローバル サービスとリージョン サービスの両方に対してアクティブ/アクティブ モードで実行されます。停止が発生した場合、エラーを検出したり、サービスを管理したりする必要はありません。Azure Bot Service は、複数リージョンの地理的アーキテクチャで自動フェールオーバーと自動復旧を自動的に実行します。EU ボット リージョン サービスの場合、Azure Bot Service は、冗長性を確保するために、アクティブ/アクティブ レプリケーションを備えたヨーロッパ内の 2 つの完全なリージョンを提供します。グローバル ボット サービスの場合、使用可能なすべてのリージョン/地域をグローバル フットプリントとして提供できます。", - "waf": "確実" + "text": "名前空間のリソースクォータを適用する", + "waf": "オペレーションズ" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub は、保存データの暗号化を提供します。独自のキーを使用する場合、データは引き続き Microsoft マネージド キーを使用して暗号化されますが、さらに Microsoft マネージド キーはカスタマー マネージド キーを使用して暗号化されます。", - "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", - "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", - "service": "Event Hubs", - "severity": "低い", - "text": "必要に応じて、保存データの暗号化でカスタマー マネージド キー オプションを使用する", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "081a5417-4158-433e-a3ad-3c2de733165c", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "AKS", + "severity": "高い", + "text": "サブスクリプションにノードプールをスケールアウトするのに十分なクォータがあることを確認する", + "waf": "オペレーションズ" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hubs 名前空間を使用すると、クライアントは TLS 1.0 以降でデータを送受信できます。より厳格なセキュリティ対策を適用するには、クライアントが新しいバージョンの TLS を使用してデータを送受信するように Event Hubs 名前空間を構成できます。Event Hubs 名前空間で TLS の最小バージョンが必要な場合、古いバージョンで行われた要求はすべて失敗します。", - "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", - "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", + "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "severity": "中程度", - "text": "要求に最低限必要なバージョンのトランスポート層セキュリティ (TLS) を適用する", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "安全" + "text": "Cluster Autoscaler を使用する", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "description": "Event Hubs 名前空間を作成すると、名前空間に対して RootManageSharedAccessKey という名前のポリシー規則が自動的に作成されます。このポリシーには、名前空間全体に対する管理アクセス許可があります。このルールは、管理ルートアカウントのように扱い、アプリケーションでは使用しないことをお勧めします。RBAC で認証プロバイダーとして AAD を使用することをお勧めします。", - "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", - "service": "Event Hubs", - "severity": "中程度", - "text": "必要のない場合はrootアカウントの使用を避けてください", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", + "guid": "831c2872-c693-4b39-a887-a561bada49bc", + "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", + "service": "AKS", + "severity": "低い", + "text": "AKS ノード プールのノード構成をカスタマイズする", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure リソースのマネージド ID は、Azure Virtual Machines (VM)、関数アプリ、Virtual Machine Scale Sets、その他のサービスで実行されているアプリケーションから Azure AD 資格情報を使用して、Event Hubs リソースへのアクセスを承認できます。Azure リソースのマネージド ID を Azure AD 認証と共に使用することで、クラウドで実行されるアプリケーションに資格情報を格納することを回避できます。", - "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", - "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "severity": "中程度", - "text": "可能な場合は、アプリケーションでマネージド ID を使用して Azure Event Hub に対する認証を行う必要があります。そうでない場合は、ストレージ資格情報 (SAS、サービス プリンシパル資格情報) を Azure Key Vault または同等のサービスに用意することを検討してください", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "安全" + "text": "必要に応じてHorizontal Pod Autoscalerを使用します", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "description": "アクセス許可を作成するときは、Azure Event Hub へのクライアントのアクセスをきめ細かく制御します。Azure Event Hub のアクセス許可は、個々のリソース レベル (コンシューマー グループ、イベント ハブ エンティティ、イベント ハブ名前空間など) にスコープを設定する必要があり、またそうする必要があります。", - "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "ノードが大きくなると、パフォーマンスが向上し、エフェメラル ディスクや高速ネットワークなどの機能が提供されますが、爆発半径が大きくなり、スケーリングの粒度が低下します", + "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", + "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", + "service": "AKS", "severity": "高い", - "text": "最小特権データ プレーン RBAC を使用する", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "安全" + "text": "大きすぎず小さすぎない適切なノードサイズを検討してください", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub リソース ログには、操作ログ、仮想ネットワーク、Kafka ログが含まれます。ランタイム監査ログは、Event Hubs のすべてのデータ プレーン アクセス操作 (イベントの送受信など) に関する集計された診断情報をキャプチャします。", - "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", - "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", - "service": "Event Hubs", - "severity": "中程度", - "text": "セキュリティ調査のログ記録を有効にします。Azure Monitor を使用して、リソース ログ、ランタイム監査ログ、Kafka ログなどのメトリックとログをキャプチャします", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", + "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", + "service": "AKS", + "severity": "低い", + "text": "スケーラビリティのために 5,000 を超えるノードが必要な場合は、追加の AKS クラスターの使用を検討してください", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "description": "既定では、Azure Event Hub にはパブリック IP アドレスがあり、インターネットに到達できます。プライベート エンドポイントを使用すると、仮想ネットワークと Azure Event Hub の間のトラフィックが Microsoft のバックボーン ネットワークを経由するようになります。それに加えて、パブリックエンドポイントを使用しない場合は無効にする必要があります。", - "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", - "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", - "service": "Event Hubs", - "severity": "中程度", - "text": "プライベート エンドポイントを使用して Azure Event Hub にアクセスし、該当する場合はパブリック ネットワーク アクセスを無効にすることを検討してください。", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", + "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", + "service": "AKS", + "severity": "低い", + "text": "AKS 自動化のために EventGrid イベントをサブスクライブすることを検討する", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "description": "IP ファイアウォールを使用すると、パブリック エンドポイントを、CIDR (Classless Inter-Domain Routing) 表記の一連の IPv4 アドレスまたは IPv4 アドレス範囲のみに制限できます。", - "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", - "service": "Event Hubs", - "severity": "中程度", - "text": "特定の IP アドレスまたは範囲からの Azure Event Hub 名前空間へのアクセスのみを許可することを検討してください", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", + "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", + "service": "AKS", + "severity": "低い", + "text": "AKS クラスターで実行時間の長い操作を行う場合は、イベントの終了を検討してください", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "guid": "31d41e36-11c8-417b-8afb-c410d4391898", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", - "service": "Event Hubs", - "severity": "中程度", - "text": "FTAレジリエンシーハンドブックの活用", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", + "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", + "service": "AKS", + "severity": "低い", + "text": "必要に応じて、AKS ノードに Azure Dedicated Hosts を使用することを検討してください", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "description": "これは、ゾーン対応リージョンの Premium、Dedicated、または Standard SKU を使用してポータルから作成された新しい EH 名前空間に対して自動的にオンになります。EH メタデータとイベント データ自体の両方がゾーン間でレプリケートされます", - "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", + "guid": "24367b33-6971-45b1-952b-eee0b9b588de", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", "severity": "高い", - "text": "Availability Zones の活用 (地域的に適用可能な場合)", - "waf": "確実" + "text": "エフェメラル OS ディスクを使用する", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "guid": "20b56c56-ad58-4519-8f82-735c586bb281", - "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", - "service": "Event Hubs", - "severity": "中程度", - "text": "予測可能なパフォーマンスのために Premium または Dedicated SKU を使用する", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "AKS", + "severity": "高い", + "text": "非エフェメラル ディスクの場合、複数のポッドを実行するには高いパフォーマンスが必要であり、既定の AKS ログ ローテーションしきい値で巨大なログが生成されるため、多くのポッド/ノードを実行する場合は、ノードに高い IOPS とより大きな OS ディスクを使用します", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "description": "組み込みの geo ディザスター リカバリー機能を有効にすると、名前空間の構成全体 (Event Hubs、コンシューマー グループ、設定) がプライマリ名前空間からセカンダリ名前空間に継続的にレプリケートされ、プライマリからセカンダリへのフェールオーバーをいつでも 1 回だけ行うことができます。アクティブ/パッシブ機能は、アプリケーション構成を変更することなく、障害が発生した Azure リージョンからの復旧と破棄を容易にするように設計されています", - "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", - "service": "Event Hubs", - "severity": "高い", - "text": "アクティブ パッシブ構成を使用した Geo ディザスター リカバリーの計画", - "waf": "確実" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", + "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", + "service": "AKS", + "severity": "低い", + "text": "ハイパー パフォーマンス ストレージ オプションの場合は、AKS 上の Ultra Disks を使用します", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "description": "ダウンしたリージョンでのイベントデータの停止または損失を許容できない DR 構成に使用する必要があります。このような場合は、レプリケーションのガイダンスに従い、組み込みの geo ディザスター リカバリー機能 (アクティブ/パッシブ) を使用しないでください。アクティブ/アクティブでは、異なるリージョンと名前空間で複数の Event Hubs を保持し、イベントはハブ間でレプリケートされます", - "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "service": "AKS", "severity": "中程度", - "text": "ビジネス クリティカルなアプリケーションの場合は、アクティブ アクティブ構成を使用します", - "waf": "確実" + "text": "クラスター内に状態を保持することは避け、外部 (AzStorage、AzSQL、Cosmos など) にデータを格納します", + "waf": "パフォーマンス" }, { - "checklist": "Azure Event Hub Review", - "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", - "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", + "service": "AKS", + "severity": "中程度", + "text": "AzFiles Standard を使用する場合は、パフォーマンス上の理由から AzFiles Premium や ANF を検討してください", + "waf": "パフォーマンス" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", + "service": "AKS", "severity": "中程度", - "text": "回復力のある Event Hubs の設計", - "waf": "確実" + "text": "Azure ディスクと AZ を使用する場合は、適切なゾーンにストレージをプロビジョニングするために VolumeBindingMode:WaitForFirstConsumer を使用して LRS ディスクのゾーン内にノードプールを配置するか、複数のゾーンにまたがるノードプールに ZRS ディスクを使用することを検討してください", + "waf": "パフォーマンス" }, { "checklist": "Azure Application Delivery Networking", @@ -5598,2152 +5334,2261 @@ "waf": "確実" }, { - "ammp": true, + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", + "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "Front Door", + "severity": "高い", + "text": "Azure Front Door でマネージド TLS 証明書を使用します。運用コストと、証明書の更新による停止のリスクを軽減します。", + "waf": "オペレーションズ" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", + "service": "Front Door", + "severity": "中程度", + "text": "Azure Front Door WAF の構成をコードとして定義します。コードを使用すると、新しいルール セット バージョンをより簡単に採用し、追加の保護を得ることができます。", + "waf": "オペレーションズ" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", + "service": "Front Door", + "severity": "高い", + "text": "Azure Front Door でエンド ツー エンドの TLS を使用します。クライアントから Front Door への接続、および Front Door から配信元への接続には TLS を使用します。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", + "service": "Front Door", + "severity": "中程度", + "text": "Azure Front Door で HTTP から HTTPS へのリダイレクトを使用します。古いクライアントをHTTPSリクエストに自動的にリダイレクトすることでサポートします。", + "waf": "安全" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", + "service": "Front Door", + "severity": "高い", + "text": "Azure Front Door WAF を有効にします。さまざまな攻撃からアプリケーションを保護します。", + "waf": "安全" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", + "service": "Front Door", + "severity": "高い", + "text": "ワークロードに合わせて Azure Front Door WAF を調整します。誤検知を減らします。", + "waf": "安全" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "Front Door", + "severity": "高い", + "text": "Azure Front Door WAF ポリシーで要求本文検査機能を有効にします。", + "waf": "安全" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", + "service": "Front Door", + "severity": "高い", + "text": "Azure Front Door WAF の既定の規則セットを有効にします。既定のルール セットは、一般的な攻撃を検出してブロックします。", + "waf": "安全" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", + "service": "Front Door", + "severity": "高い", + "text": "Azure Front Door WAF ボット保護ルール セットを有効にします。ボットルールは、良いボットと悪いボットを検出します。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", + "service": "Front Door", + "severity": "中程度", + "text": "最新の Azure Front Door WAF ルール セット バージョンを使用します。ルール セットの更新は、現在の脅威の状況を考慮して定期的に更新されます。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "b9620385-1cde-418f-914b-a84a06982ffc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", + "service": "Front Door", + "severity": "中程度", + "text": "Azure Front Door WAF にレート制限を追加します。レート制限は、クライアントが短期間に大量のトラフィックを誤ってまたは意図的に送信することをブロックします。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", + "service": "Front Door", + "severity": "中程度", + "text": "Azure Front Door WAF のレート制限には、高いしきい値を使用します。高いレート制限しきい値は、正当なトラフィックのブロックを回避しながら、インフラストラクチャを圧倒する可能性のある非常に多数の要求に対する保護を提供します。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", + "service": "Front Door", + "severity": "低い", + "text": "すべての地域からのトラフィックが想定されていない場合は、地域フィルタを使用して、想定外の国からのトラフィックをブロックします。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "00acd8a9-6975-414f-8491-2be6309893b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", + "service": "Front Door", + "severity": "中程度", + "text": "Azure Front Door WAF を使用してトラフィックをジオフィルター処理するときに、不明な (ZZ) 場所を指定します。IP アドレスを地理的に一致させることができない場合に、正当な要求を誤ってブロックしないようにします。", + "waf": "安全" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", + "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", + "service": "App Gateway", + "severity": "高い", + "text": "Azure Application Gateway WAF ボット保護ルール セットを有効にする ボット ルールは、良いボットと悪いボットを検出します。", + "waf": "安全" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "App Gateway", + "severity": "高い", + "text": "Azure Application Gateway WAF ポリシーで有効になっている要求本文検査機能を有効にします。", + "waf": "安全" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", + "service": "App Gateway", + "severity": "高い", + "text": "ワークロードに合わせて Azure Application Gateway WAF を調整します。誤検知を減らします。", + "waf": "安全" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "App Gateway", + "severity": "高い", + "text": "Application Gateway の WAF ポリシーを \"防止\" モードでデプロイします。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", + "service": "App Gateway", + "severity": "中程度", + "text": "Azure Application Gateway WAF にレート制限を追加します。レート制限は、クライアントが短期間に大量のトラフィックを誤ってまたは意図的に送信することをブロックします。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", + "service": "App Gateway", + "severity": "中程度", + "text": "Azure Application Gateway の WAF レート制限には高いしきい値を使用します。高いレート制限しきい値は、正当なトラフィックのブロックを回避しながら、インフラストラクチャを圧倒する可能性のある非常に多数の要求に対する保護を提供します。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "99937189-ff78-492a-b9ca-18d828d82b37", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", + "service": "App Gateway", + "severity": "低い", + "text": "すべての地域からのトラフィックが想定されていない場合は、地域フィルタを使用して、想定外の国からのトラフィックをブロックします。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", + "service": "App Gateway", + "severity": "中程度", + "text": "Azure Application Gateway WAF でトラフィックを geo フィルタリングするときに、不明 (ZZ) の場所を指定します。IP アドレスを地理的に一致させることができない場合に、正当な要求を誤ってブロックしないようにします。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", + "service": "App Gateway", + "severity": "中程度", + "text": "最新バージョンの Azure Application Gateway WAF ルール セットを使用します。ルール セットの更新は、現在の脅威の状況を考慮して定期的に更新されます。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "App Gateway", + "severity": "中程度", + "text": "診断設定を追加して、Azure Application Gateway の WAF ログを保存します。", + "waf": "オペレーションズ" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "Front Door", + "severity": "中程度", + "text": "診断設定を追加して、Azure Front Door WAF ログを保存します。", + "waf": "オペレーションズ" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "92664c60-47e3-4591-8b1b-8d557656e686", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", + "service": "App Gateway", + "severity": "中程度", + "text": "Azure Application Gateway WAF ログを Microsoft Sentinel に送信します。", + "waf": "オペレーションズ" + }, + { "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", - "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "guid": "845f5f91-9c21-4674-a725-5ce890850e20", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", "service": "Front Door", - "severity": "高い", - "text": "Azure Front Door でマネージド TLS 証明書を使用します。運用コストと、証明書の更新による停止のリスクを軽減します。", + "severity": "中程度", + "text": "Azure Front Door WAF ログを Microsoft Sentinel に送信します。", "waf": "オペレーションズ" }, { "checklist": "Azure Application Delivery Networking", - "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", - "service": "Front Door", + "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", + "service": "App Gateway", "severity": "中程度", - "text": "Azure Front Door WAF の構成をコードとして定義します。コードを使用すると、新しいルール セット バージョンをより簡単に採用し、追加の保護を得ることができます。", + "text": "Azure Application Gateway の WAF 構成をコードとして定義します。コードを使用すると、新しいルール セット バージョンをより簡単に採用し、追加の保護を得ることができます。", "waf": "オペレーションズ" }, { - "ammp": true, "checklist": "Azure Application Delivery Networking", - "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", - "service": "Front Door", - "severity": "高い", - "text": "Azure Front Door でエンド ツー エンドの TLS を使用します。クライアントから Front Door への接続、および Front Door から配信元への接続には TLS を使用します。", - "waf": "安全" + "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", + "service": "App Gateway", + "severity": "中程度", + "text": "従来のWAF構成のかわりにWAFポリシーを使用します。", + "waf": "オペレーションズ" }, { "checklist": "Azure Application Delivery Networking", - "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", - "service": "Front Door", + "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", + "service": "App Gateway", "severity": "中程度", - "text": "Azure Front Door で HTTP から HTTPS へのリダイレクトを使用します。古いクライアントをHTTPSリクエストに自動的にリダイレクトすることでサポートします。", + "text": "バックエンドの受信トラフィックをフィルター処理して、Application Gateway サブネットからの接続 (NSG など) のみを受け入れるようにします。", "waf": "安全" }, { - "ammp": true, "checklist": "Azure Application Delivery Networking", - "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", + "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", + "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", "service": "Front Door", - "severity": "高い", - "text": "Azure Front Door WAF を有効にします。さまざまな攻撃からアプリケーションを保護します。", + "severity": "中程度", + "text": "配信元が Azure Front Door インスタンスからのトラフィックのみを受け取るようにします。", "waf": "安全" }, { - "ammp": true, "checklist": "Azure Application Delivery Networking", - "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", - "service": "Front Door", + "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "service": "App Gateway", "severity": "高い", - "text": "ワークロードに合わせて Azure Front Door WAF を調整します。誤検知を減らします。", + "text": "バックエンド・サーバーへのトラフィックを暗号化する必要があります。", "waf": "安全" }, { - "ammp": true, "checklist": "Azure Application Delivery Networking", - "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "Front Door", + "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "service": "App Gateway", "severity": "高い", - "text": "Azure Front Door WAF ポリシーで要求本文検査機能を有効にします。", + "text": "Web アプリケーション ファイアウォールを使用する必要があります。", "waf": "安全" }, { - "ammp": true, "checklist": "Azure Application Delivery Networking", - "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", - "service": "Front Door", - "severity": "高い", - "text": "Azure Front Door WAF の既定の規則セットを有効にします。既定のルール セットは、一般的な攻撃を検出してブロックします。", + "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", + "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", + "service": "App Gateway", + "severity": "中程度", + "text": "HTTPをHTTPSにリダイレクトする", "waf": "安全" }, { - "ammp": true, "checklist": "Azure Application Delivery Networking", - "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", - "service": "Front Door", + "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", + "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", + "service": "App Gateway", + "severity": "中程度", + "text": "ゲートウェイ管理の Cookie を使用して、ユーザー セッションから同じサーバーにトラフィックを送信して処理する", + "waf": "オペレーションズ" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", + "service": "App Gateway", "severity": "高い", - "text": "Azure Front Door WAF ボット保護ルール セットを有効にします。ボットルールは、良いボットと悪いボットを検出します。", + "text": "計画されたサービス更新中に接続ドレインを有効にして、バックエンド プールの既存のメンバーへの接続が失われないようにします", "waf": "安全" }, { "checklist": "Azure Application Delivery Networking", - "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", - "service": "Front Door", - "severity": "中程度", - "text": "最新の Azure Front Door WAF ルール セット バージョンを使用します。ルール セットの更新は、現在の脅威の状況を考慮して定期的に更新されます。", - "waf": "安全" + "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", + "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", + "service": "App Gateway", + "severity": "低い", + "text": "カスタムエラーページを作成して、パーソナライズされたユーザーエクスペリエンスを表示する", + "waf": "オペレーションズ" }, { "checklist": "Azure Application Delivery Networking", - "guid": "b9620385-1cde-418f-914b-a84a06982ffc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", - "service": "Front Door", + "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", + "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", + "service": "App Gateway", "severity": "中程度", - "text": "Azure Front Door WAF にレート制限を追加します。レート制限は、クライアントが短期間に大量のトラフィックを誤ってまたは意図的に送信することをブロックします。", + "text": "HTTPリクエストとレスポンスヘッダーを編集して、クライアントとサーバー間のルーティングと情報交換を容易にします", "waf": "安全" }, { "checklist": "Azure Application Delivery Networking", - "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", - "service": "Front Door", + "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "App Gateway", "severity": "中程度", - "text": "Azure Front Door WAF のレート制限には、高いしきい値を使用します。高いレート制限しきい値は、正当なトラフィックのブロックを回避しながら、インフラストラクチャを圧倒する可能性のある非常に多数の要求に対する保護を提供します。", - "waf": "安全" + "text": "Front Door を構成して、グローバルな Web トラフィック ルーティングとトップレベルのエンド ユーザーのパフォーマンスを最適化し、迅速なグローバル フェールオーバーを通じて信頼性を確保します", + "waf": "パフォーマンス" }, { "checklist": "Azure Application Delivery Networking", - "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", - "service": "Front Door", - "severity": "低い", - "text": "すべての地域からのトラフィックが想定されていない場合は、地域フィルタを使用して、想定外の国からのトラフィックをブロックします。", - "waf": "安全" + "guid": "29dcc19f-a8fa-4c35-8281-290577538793", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "App Gateway", + "severity": "中程度", + "text": "トランスポート層の負荷分散を使用する", + "waf": "パフォーマンス" }, { "checklist": "Azure Application Delivery Networking", - "guid": "00acd8a9-6975-414f-8491-2be6309893b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", - "service": "Front Door", + "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", + "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", + "service": "App Gateway", "severity": "中程度", - "text": "Azure Front Door WAF を使用してトラフィックをジオフィルター処理するときに、不明な (ZZ) 場所を指定します。IP アドレスを地理的に一致させることができない場合に、正当な要求を誤ってブロックしないようにします。", + "text": "1 つのゲートウェイ上の複数の Web アプリケーションのホスト名またはドメイン名に基づいてルーティングを構成する", "waf": "安全" }, { - "ammp": true, "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", - "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", + "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", + "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", "service": "App Gateway", - "severity": "高い", - "text": "Azure Application Gateway WAF ボット保護ルール セットを有効にする ボット ルールは、良いボットと悪いボットを検出します。", + "severity": "中程度", + "text": "SSL証明書管理を一元化して、バックエンドサーバーファームからの暗号化と復号化のオーバーヘッドを削減", "waf": "安全" }, { - "ammp": true, "checklist": "Azure Application Delivery Networking", - "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", "service": "App Gateway", - "severity": "高い", - "text": "Azure Application Gateway WAF ポリシーで有効になっている要求本文検査機能を有効にします。", + "severity": "低い", + "text": "Application Gateway を使用して WebSocket と HTTP/2 プロトコルをネイティブにサポートする", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", - "service": "App Gateway", + "checklist": "Azure Function Review", + "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", "severity": "高い", - "text": "ワークロードに合わせて Azure Application Gateway WAF を調整します。誤検知を減らします。", - "waf": "安全" + "text": "ビジネスとSLOの要件に基づいて適切な関数ホスティングプランを選択します", + "waf": "確実" + }, + { + "checklist": "Azure Function Review", + "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "severity": "高い", + "text": "リージョンで適用可能な場合は Availability Zones を活用します (従量課金レベルでは使用できません)", + "waf": "確実" + }, + { + "checklist": "Azure Function Review", + "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", + "service": "Azure Functions", + "severity": "中程度", + "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する", + "waf": "確実" + }, + { + "checklist": "Azure Function Review", + "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Azure Functions", + "severity": "高い", + "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します", + "waf": "確実" + }, + { + "checklist": "Azure Function Review", + "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "Azure Functions", + "severity": "高い", + "text": "App Service プランで実行されているすべての関数アプリで \"Always On\" が有効になっていることを確認する", + "waf": "確実" + }, + { + "checklist": "Azure Function Review", + "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", + "service": "Azure Functions", + "severity": "中程度", + "text": "関数アプリを独自のストレージ アカウントにペアリングします。Function Apps のストレージ アカウントは、緊密に結合されていない限り、再利用しないようにしてください", + "waf": "確実" + }, + { + "checklist": "Azure Function Review", + "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "Azure Functions", + "severity": "中程度", + "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、関数アプリのコードを保護します", + "waf": "オペレーションズ" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "service": "Spring Apps", + "severity": "中程度", + "text": "Azure Spring Apps では、アプリごとに 2 つのデプロイが許可され、そのうちの 1 つだけが運用トラフィックを受信します。ブルーグリーンデプロイ戦略により、ダウンタイムをゼロにすることができます。ブルー グリーン デプロイは、Standard レベルと Enterprise レベルでのみ使用できます。CI/CD と ADO/GitHub Actions を使用してデプロイを自動化できます", + "waf": "確実" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "service": "Spring Apps", + "severity": "中程度", + "text": "Azure Spring Apps インスタンスは、アプリケーション用に複数のリージョンに作成でき、トラフィックは Traffic Manager/Front Door によってルーティングできます。", + "waf": "確実" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "service": "Spring Apps", + "severity": "中程度", + "text": "サポートされているリージョンでは、Azure Spring Apps をゾーン冗長としてデプロイできるため、インスタンスは可用性ゾーン間で自動的に分散されます。この機能は、Standard レベルと Enterprise レベルでのみ使用できます。", + "waf": "確実" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "App Gateway", - "severity": "高い", - "text": "Application Gateway の WAF ポリシーを \"防止\" モードでデプロイします。", - "waf": "安全" + "checklist": "Azure Spring Apps Review", + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "service": "Spring Apps", + "severity": "中程度", + "text": "アプリに複数のアプリ インスタンスを使用する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", - "service": "App Gateway", + "checklist": "Azure Spring Apps Review", + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "service": "Spring Apps", "severity": "中程度", - "text": "Azure Application Gateway WAF にレート制限を追加します。レート制限は、クライアントが短期間に大量のトラフィックを誤ってまたは意図的に送信することをブロックします。", - "waf": "安全" + "text": "Azure Spring Apps をログ、メトリック、トレースで監視します。ASA を Application Insights と統合し、障害を追跡し、ブックを作成します。", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", - "service": "App Gateway", + "checklist": "Azure Spring Apps Review", + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "service": "Spring Apps", "severity": "中程度", - "text": "Azure Application Gateway の WAF レート制限には高いしきい値を使用します。高いレート制限しきい値は、正当なトラフィックのブロックを回避しながら、インフラストラクチャを圧倒する可能性のある非常に多数の要求に対する保護を提供します。", - "waf": "安全" + "text": "Spring Cloud Gateway で自動スケーリングを設定する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "99937189-ff78-492a-b9ca-18d828d82b37", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", - "service": "App Gateway", + "checklist": "Azure Spring Apps Review", + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "service": "Spring Apps", "severity": "低い", - "text": "すべての地域からのトラフィックが想定されていない場合は、地域フィルタを使用して、想定外の国からのトラフィックをブロックします。", - "waf": "安全" + "text": "Standard 従量課金プランと専用プランのアプリの自動スケーリングを有効にします。", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", - "service": "App Gateway", + "checklist": "Azure Spring Apps Review", + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "service": "Spring Apps", "severity": "中程度", - "text": "Azure Application Gateway WAF でトラフィックを geo フィルタリングするときに、不明 (ZZ) の場所を指定します。IP アドレスを地理的に一致させることができない場合に、正当な要求を誤ってブロックしないようにします。", - "waf": "安全" + "text": "ミッション クリティカルなアプリの Spring Boot の商用サポートには、Enterprise プランを使用します。他のレベルでは、OSS のサポートを受けることができます。", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", - "service": "App Gateway", - "severity": "中程度", - "text": "最新バージョンの Azure Application Gateway WAF ルール セットを使用します。ルール セットの更新は、現在の脅威の状況を考慮して定期的に更新されます。", - "waf": "安全" + "checklist": "Device Provisioning Service Review", + "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", + "service": "IoT Hub DPS", + "severity": "高い", + "text": "ビジネスと SLO の要件に基づいて適切なロジック アプリのホスティング プランを選択する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "App Gateway", - "severity": "中程度", - "text": "診断設定を追加して、Azure Application Gateway の WAF ログを保存します。", - "waf": "オペレーションズ" + "checklist": "Device Provisioning Service Review", + "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "IoT Hub DPS", + "severity": "高い", + "text": "ゾーンの冗長性と可用性ゾーンを使用してリージョンの障害からロジック アプリを保護する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "Front Door", - "severity": "中程度", - "text": "診断設定を追加して、Azure Front Door WAF ログを保存します。", - "waf": "オペレーションズ" + "checklist": "Device Provisioning Service Review", + "guid": "8aed4fbf-0830-4883-899d-222a154af478", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "IoT Hub DPS", + "severity": "高い", + "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "92664c60-47e3-4591-8b1b-8d557656e686", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", - "service": "App Gateway", - "severity": "中程度", - "text": "Azure Application Gateway WAF ログを Microsoft Sentinel に送信します。", - "waf": "オペレーションズ" + "checklist": "Device Provisioning Service Review", + "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "IoT Hub DPS", + "severity": "高い", + "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "845f5f91-9c21-4674-a725-5ce890850e20", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "Front Door", + "checklist": "Device Provisioning Service Review", + "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "IoT Hub DPS", "severity": "中程度", - "text": "Azure Front Door WAF ログを Microsoft Sentinel に送信します。", + "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、ロジック アプリ コードを保護", "waf": "オペレーションズ" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", - "service": "App Gateway", - "severity": "中程度", - "text": "Azure Application Gateway の WAF 構成をコードとして定義します。コードを使用すると、新しいルール セット バージョンをより簡単に採用し、追加の保護を得ることができます。", - "waf": "オペレーションズ" + "checklist": "Azure App Service Review", + "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", + "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", + "service": "App Services", + "severity": "低い", + "text": "ベスト プラクティスについては、「ベースラインの高可用性ゾーン冗長 Web アプリケーション アーキテクチャ」を参照してください", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", + "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", + "service": "App Services", "severity": "中程度", - "text": "従来のWAF構成のかわりにWAFポリシーを使用します。", - "waf": "オペレーションズ" + "text": "Premium レベルと Standard レベルを使用します。これらの層では、ステージング スロットと自動バックアップがサポートされています。", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", - "service": "App Gateway", - "severity": "中程度", - "text": "バックエンドの受信トラフィックをフィルター処理して、Application Gateway サブネットからの接続 (NSG など) のみを受け入れるようにします。", - "waf": "安全" + "checklist": "Azure App Service Review", + "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", + "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", + "service": "App Services", + "severity": "高い", + "text": "リージョンで適用可能な場合は Availability Zones を活用します (Premium v2 または v3 レベルが必要)", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", - "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", - "service": "Front Door", + "checklist": "Azure App Service Review", + "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "severity": "中程度", - "text": "配信元が Azure Front Door インスタンスからのトラフィックのみを受け取るようにします。", - "waf": "安全" + "text": "ヘルスチェックの実装", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", + "service": "App Services", "severity": "高い", - "text": "バックエンド・サーバーへのトラフィックを暗号化する必要があります。", - "waf": "安全" + "text": "「Azure App Service のバックアップと復元のベスト プラクティス」を参照してください", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", + "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", + "service": "App Services", "severity": "高い", - "text": "Web アプリケーション ファイアウォールを使用する必要があります。", - "waf": "安全" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", - "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", - "service": "App Gateway", - "severity": "中程度", - "text": "HTTPをHTTPSにリダイレクトする", - "waf": "安全" + "text": "Azure App Service の信頼性に関するベスト プラクティスを実装する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", - "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", - "service": "App Gateway", - "severity": "中程度", - "text": "ゲートウェイ管理の Cookie を使用して、ユーザー セッションから同じサーバーにトラフィックを送信して処理する", - "waf": "オペレーションズ" + "checklist": "Azure App Service Review", + "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", + "service": "App Services", + "severity": "低い", + "text": "災害時に App Service アプリを別のリージョンに移動する方法を理解する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", + "service": "App Services", "severity": "高い", - "text": "計画されたサービス更新中に接続ドレインを有効にして、バックエンド プールの既存のメンバーへの接続が失われないようにします", - "waf": "安全" + "text": "Azure App Service の信頼性サポートについて理解する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", - "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", - "service": "App Gateway", - "severity": "低い", - "text": "カスタムエラーページを作成して、パーソナライズされたユーザーエクスペリエンスを表示する", - "waf": "オペレーションズ" + "checklist": "Azure App Service Review", + "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "App Services", + "severity": "中程度", + "text": "App Service プランで実行されている Function Apps に対して \"Always On\" が有効になっていることを確認する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", - "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "severity": "中程度", - "text": "HTTPリクエストとレスポンスヘッダーを編集して、クライアントとサーバー間のルーティングと情報交換を容易にします", - "waf": "安全" + "text": "正常性チェックを使用した App Service インスタンスの監視", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "App Gateway", + "checklist": "Azure App Service Review", + "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", + "service": "App Services", "severity": "中程度", - "text": "Front Door を構成して、グローバルな Web トラフィック ルーティングとトップレベルのエンド ユーザーのパフォーマンスを最適化し、迅速なグローバル フェールオーバーを通じて信頼性を確保します", - "waf": "パフォーマンス" + "text": "Application Insights の可用性テストを使用して Web アプリまたは Web サイトの可用性と応答性を監視する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "29dcc19f-a8fa-4c35-8281-290577538793", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "App Gateway", - "severity": "中程度", - "text": "トランスポート層の負荷分散を使用する", - "waf": "パフォーマンス" + "checklist": "Azure App Service Review", + "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", + "service": "App Services", + "severity": "低い", + "text": "Application Insights Standard テストを使用して、Web アプリまたは Web サイトの可用性と応答性を監視する", + "waf": "確実" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", - "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", - "service": "App Gateway", - "severity": "中程度", - "text": "1 つのゲートウェイ上の複数の Web アプリケーションのホスト名またはドメイン名に基づいてルーティングを構成する", + "checklist": "Azure App Service Review", + "description": "Azure Key Vault を使用して、アプリケーションに必要なシークレットを格納します。 Key Vault は、シークレットを格納するための安全で監査された環境を提供し、Key Vault SDK または App Service Key Vault リファレンスを通じて App Service と適切に統合されています。", + "guid": "834ac932-223e-4ce8-8b12-3071a5416415", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", + "severity": "高い", + "text": "Key Vault を使用してシークレットを格納する", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", - "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", - "service": "App Gateway", - "severity": "中程度", - "text": "SSL証明書管理を一元化して、バックエンドサーバーファームからの暗号化と復号化のオーバーヘッドを削減", + "checklist": "Azure App Service Review", + "description": "マネージド ID を使用して、Key Vault SDK または App Service Key Vault 参照を使用して Key Vault に接続します。", + "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", + "severity": "高い", + "text": "マネージド ID を使用して Key Vault に接続する", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", - "service": "App Gateway", - "severity": "低い", - "text": "Application Gateway を使用して WebSocket と HTTP/2 プロトコルをネイティブにサポートする", + "checklist": "Azure App Service Review", + "description": "App Service TLS 証明書を Key Vault に格納します。", + "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", + "service": "App Services", + "severity": "高い", + "text": "Key Vault を使用して TLS 証明書を格納します。", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "ストレージに関連する Microsoft クラウド セキュリティ ベンチマークのガイダンスを適用する", - "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "機密情報を処理するシステムは分離する必要があります。 そのためには、個別の App Service プランまたは App Service Environment を使用し、異なるサブスクリプションまたは管理グループの使用を検討してください。", + "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", + "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", + "service": "App Services", "severity": "中程度", - "text": "\"ストレージの Azure セキュリティ ベースライン\" を検討する", + "text": "機密情報を処理するシステムを分離する", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "既定では、Azure Storage にはパブリック IP アドレスがあり、インターネットにアクセス可能です。プライベート エンドポイントを使用すると、アクセスが必要な Azure コンピューティング リソースにのみ Azure Storage を安全に公開できるため、パブリック インターネットへの露出を排除できます", - "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", - "service": "Azure Storage", - "severity": "高い", - "text": "Azure Storage にプライベート エンドポイントを使用することを検討する", + "checklist": "Azure App Service Review", + "description": "App Service のローカル ディスクは暗号化されていないため、機密データを格納しないでください。 (例: D:\\\\Local and %TMP%)。", + "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", + "service": "App Services", + "severity": "中程度", + "text": "機密データをローカルディスクに保存しない", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "新しく作成されたストレージ アカウントは、RBAC や監査などがすべて有効になるように、ARM デプロイ モデルを使用して作成されます。サブスクリプションにクラシック デプロイ モデルの古いストレージ アカウントがないことを確認する", - "guid": "30e37c3e-2971-41b2-963c-eee079b598de", - "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "認証された Web アプリケーションの場合は、Azure AD や Azure AD B2C などの確立された ID プロバイダーを使用します。 選択したアプリケーション フレームワークを利用して、このプロバイダーと統合するか、App Service の認証/承認機能を使用します。", + "guid": "919ca0b2-c121-459e-814b-933df574eccc", + "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", + "service": "App Services", "severity": "中程度", - "text": "古いストレージ アカウントで \"クラシック デプロイ モデル\" が使用されていないことを確認する", + "text": "認証に確立された ID プロバイダーを使用する", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "Microsoft Defender を活用して、不審なアクティビティや構成ミスについて学習します。", - "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", - "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "適切に管理され、セキュリティで保護された DevOps デプロイ パイプラインなど、制御された信頼できる環境から App Service にコードをデプロイします。これにより、バージョン管理されておらず、悪意のあるホストからデプロイされることが確認されていないコードが回避されます。", + "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", + "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", + "service": "App Services", "severity": "高い", - "text": "すべてのストレージ アカウントに対して Microsoft Defender を有効にする", + "text": "信頼できる環境からのデプロイ", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "論理的な削除メカニズムを使用すると、誤って削除された BLOB を回復できます。", - "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", - "service": "Azure Storage", - "severity": "中程度", - "text": "BLOB の \"論理的な削除\" を有効にする", + "checklist": "Azure App Service Review", + "description": "FTP/FTPS と WebDeploy/SCM の両方の基本認証を無効にします。 これにより、これらのサービスへのアクセスが無効になり、デプロイに Azure AD で保護されたエンドポイントの使用が強制されます。 SCM サイトは、Azure AD 資格情報を使用して開くこともできます。", + "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", + "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", + "service": "App Services", + "severity": "高い", + "text": "基本認証の無効化", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由などから、削除された情報がすぐに削除されるようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください。", - "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", - "severity": "中程度", - "text": "BLOB の '論理的な削除' を無効にする", + "checklist": "Azure App Service Review", + "description": "可能な場合は、マネージド ID を使用して Azure AD のセキュリティで保護されたリソースに接続します。 これが不可能な場合は、Key Vault にシークレットを格納し、代わりにマネージド ID を使用して Key Vault に接続します。", + "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", + "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", + "service": "App Services", + "severity": "高い", + "text": "マネージド ID を使用してリソースに接続する", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "コンテナーの論理的な削除を使用すると、コンテナーが削除された後に回復できます (たとえば、偶発的な削除操作から回復します)。", - "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "Azure Container Registry に格納されているイメージを使用する場合は、マネージド ID を使用してこれらをプルします。", + "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", + "service": "App Services", "severity": "高い", - "text": "コンテナーの \"論理的な削除\" を有効にする", + "text": "マネージド ID を使用してコンテナーをプルするPull containers using a Managed Identity", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "たとえば、機密性、プライバシー、コンプライアンス上の理由などから、削除された情報がすぐに削除されるようにアプリケーションで確認する必要がある場合など、特定の BLOB コンテナーに対して \"論理的な削除\" を選択的に無効にすることを検討してください。", - "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "App Service の診断設定を構成することで、ログ記録と監視の中央の宛先として、すべてのテレメトリを Log Analytics に送信できます。これにより、HTTP ログ、アプリケーション ログ、プラットフォーム ログなどの App Service のランタイム アクティビティを監視できます。", + "guid": "47768314-c115-4775-a2ea-55b46ad48408", + "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", + "service": "App Services", "severity": "中程度", - "text": "コンテナーの \"論理的な削除\" を無効にする", + "text": "App Service ランタイム ログを Log Analytics に送信する", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "削除前に削除ロックを最初に解除するようにユーザーに強制することで、ストレージ アカウントが誤って削除されないようにします", - "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", - "severity": "高い", - "text": "ストレージ アカウントでのリソース ロックの有効化", + "checklist": "Azure App Service Review", + "description": "ログ記録と監視の中央の宛先としてアクティビティ ログを Log Analytics に送信するための診断設定を設定します。これにより、App Service リソース自体のコントロール プレーンのアクティビティを監視できます。", + "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "service": "App Services", + "severity": "中程度", + "text": "App Service アクティビティ ログを Log Analytics に送信する", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "BLOB の \"訴訟ホールド\" または \"時間ベースの保持\" ポリシーを検討して、BLOB、コンテナー、またはストレージ アカウントを削除できないようにします。「不可能」は実際には「不可能」を意味することに注意してください。ストレージ アカウントに不変の BLOB が含まれる場合、そのストレージ アカウントを \"取り除く\" 唯一の方法は、Azure サブスクリプションを取り消すことです。", - "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", - "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", - "service": "Azure Storage", - "severity": "高い", - "text": "不変の BLOB を検討する", + "checklist": "Azure App Service Review", + "description": "リージョンの VNet 統合、ネットワーク セキュリティ グループ、および UDR の組み合わせを使用して、送信ネットワーク アクセスを制御します。 トラフィックは、Azure Firewall などの NVA にルーティングする必要があります。 ファイアウォールのログを必ず監視してください。", + "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", + "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", + "service": "App Services", + "severity": "中程度", + "text": "送信ネットワーク アクセスを制御する必要がある", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "ストレージ アカウントへの保護されていない HTTP/80 アクセスを無効にして、すべてのデータ転送が暗号化され、整合性が保護され、サーバーが認証されるようにすることを検討してください。", - "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Azure Storage", - "severity": "高い", - "text": "HTTPS を要求する (つまり、ストレージ アカウントのポート 80 を無効にする)", + "checklist": "Azure App Service Review", + "description": "VNet 統合を使用し、VNet NAT ゲートウェイまたは Azure Firewall などの NVA を使用することで、安定した送信 IP を提供できます。 これにより、受信側は必要に応じて IP に基づいて許可リストに登録できます。 多くの場合、Azure サービスへの通信では、IP アドレスに依存する必要はなく、代わりにサービス エンドポイントなどのメカニズムを使用する必要があります。 (また、受信側でプライベート エンドポイントを使用すると、SNAT の発生が回避され、安定した送信 IP 範囲が提供されます)。", + "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", + "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", + "service": "App Services", + "severity": "低い", + "text": "インターネットアドレスへの送信通信のIPを安定させる", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "ストレージ アカウントでカスタム ドメイン (ホスト名) を構成する場合は、TLS/HTTPS が必要かどうかを確認します。その場合は、ストレージ アカウントの前に Azure CDN を配置する必要があります。", - "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", - "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "App Service のアクセス制限、サービス エンドポイント、またはプライベート エンドポイントの組み合わせを使用して、受信ネットワーク アクセスを制御します。Web アプリ自体と SCM サイトに対して異なるアクセス制限を要求し、構成できます。", + "guid": "0725769e-e669-41a4-a34a-c932223ece80", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "severity": "高い", - "text": "HTTPS を適用する (HTTP を無効にする) 場合は、ストレージ アカウントにカスタム ドメイン (CNAME) を使用していないことを確認します。", + "text": "受信ネットワーク アクセスを制御する必要がある", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "クライアントが SAS トークンを使用して BLOB データにアクセスするときに HTTPS を要求すると、資格情報が失われるリスクを最小限に抑えることができます。", - "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", - "service": "Azure Storage", - "severity": "中程度", - "text": "Shared Access Signature (SAS) トークンを HTTPS 接続のみに制限する", + "checklist": "Azure App Service Review", + "description": "Application Gateway や Azure Front Door などの Web アプリケーション ファイアウォールを使用して、悪意のある受信トラフィックから保護します。 WAFのログを必ず監視してください。", + "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", + "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", + "service": "App Services", + "severity": "高い", + "text": "App Service の前で WAF を使用するUse a WAF in Front of App Service", "waf": "安全" }, - { - "checklist": "Azure Blob Storage Review", - "description": "AAD トークンは、可能な限り、共有アクセス署名よりも優先する必要があります", - "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", - "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", - "service": "Azure Storage", + { + "checklist": "Azure App Service Review", + "description": "WAFのみへのアクセスをロックダウンすることで、WAFをバイパスできないようにします。 アクセス制限、サービス・エンドポイントおよびプライベート・エンドポイントを組み合わせて使用します。", + "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "severity": "高い", - "text": "BLOB アクセスに Azure Active Directory (Azure AD) トークンを使用する", + "text": "WAFをバイパスすることは避けてください", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "ユーザー、グループ、またはアプリケーションにロールを割り当てる場合は、タスクの実行に必要なアクセス許可のみをセキュリティ プリンシパルに付与します。リソースへのアクセスを制限することで、意図しないデータの誤用と悪意のあるデータの誤用の両方を防ぐことができます。", - "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "App Service の構成で最小 TLS ポリシーを 1.2 に設定します。", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", + "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", + "service": "App Services", "severity": "中程度", - "text": "IaM アクセス許可の最小特権", + "text": "最小 TLS ポリシーを 1.2 に設定します。", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "ユーザー委任 SAS は、Azure Active Directory (Azure AD) 資格情報と、SAS に指定されたアクセス許可によってセキュリティで保護されます。ユーザー委任 SAS は、そのスコープと機能の点でサービス SAS に似ていますが、サービス SAS よりもセキュリティ上の利点があります。", - "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "HTTPS のみを使用するように App Service を構成します。 これにより、App Service は HTTP から HTTPS にリダイレクトされます。 HTTP Strict Transport Security (HSTS) をコード内または WAF から使用して、サイトに HTTPS を使用してのみアクセスする必要があることをブラウザーに通知することを強く検討してください。", + "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", + "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", + "service": "App Services", "severity": "高い", - "text": "SAS を使用する場合は、ストレージ アカウント キー ベースの SAS よりも \"ユーザー委任 SAS\" を優先します。", + "text": "HTTPS のみを使用", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "ストレージ アカウント キー (\"共有キー\") には、監査機能がほとんどありません。誰がいつキーのコピーを取得したかを監視できますが、キーが複数の人の手に渡ると、使用状況を特定のユーザーに帰属させることは不可能です。AAD 認証のみに依存することで、ストレージへのアクセスをユーザーに結び付けやすくなります。", - "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", - "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "CORS 構成では、すべての配信元がサービスにアクセスできるため、ワイルドカードを使用しないでください (これにより、CORS の目的が損なわれます)。具体的には、サービスにアクセスできると予想される配信元のみを許可します。", + "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", + "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", + "service": "App Services", "severity": "高い", - "text": "ストレージ アカウント キーを無効にして、AAD アクセス (およびユーザー委任 SAS) のみがサポートされるようにすることを検討してください。", + "text": "ワイルドカードは CORS に使用しないでください", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "アクティビティ ログ データを使用して、ストレージ アカウントのセキュリティ (ストレージ アカウント キー、アクセス ポリシーなど) が \"いつ、誰が、何を、\"どのように\" 表示または変更されているかを特定します。", - "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", - "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "リモート デバッグは、サービスに追加のポートが開き、攻撃対象領域が増加するため、運用環境でオンにしないでください。このサービスは、48 時間後に自動的にリモート デバッグをオフにすることに注意してください。", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", + "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", + "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", + "service": "App Services", "severity": "高い", - "text": "Azure Monitor を使用して、ストレージ アカウントに対するコントロール プレーン操作を監査することを検討してください", + "text": "リモートデバッグをオフにする", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "キーの有効期限ポリシーを使用すると、アカウントアクセスキーのローテーションのリマインダーを設定できます。リマインダーは、指定した間隔が経過し、キーがまだローテーションされていない場合に表示されます。", - "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "Defender for App Service を有効にします。 これは(他の脅威の中でも)既知の悪意のあるIPアドレスへの通信を検出します。 操作の一環として、Defender for App Service からの推奨事項を確認します。", + "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", + "service": "App Services", "severity": "中程度", - "text": "ストレージ アカウント キーを使用する場合は、\"キーの有効期限ポリシー\" を有効にすることを検討してください", + "text": "Defender for Cloud を有効にする - Defender for App Service", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "SAS 有効期限ポリシーでは、SAS が有効である推奨間隔を指定します。SAS 有効期限ポリシーは、サービス SAS またはアカウント SAS に適用されます。ユーザーがサービス SAS またはアカウント SAS を、推奨間隔よりも長い有効期間で生成すると、警告が表示されます。", - "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", - "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "Azure は、ネットワーク上で DDoS Basic 保護を提供しており、通常のトラフィック パターンを学習し、異常な動作を検出できるインテリジェントな DDoS Standard 機能によって改善できます。DDoS Standard は仮想ネットワークに適用されるため、Application Gateway や NVA など、アプリの前にあるネットワーク リソース用に構成する必要があります。", + "guid": "223ece80-b123-4071-a541-6415833ea3ad", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "App Services", "severity": "中程度", - "text": "SAS 有効期限ポリシーの構成を検討する", + "text": "WAF VNet で DDoS Protection Standard を有効にするEnable DDOS Protection Standard on the WAF VNet", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "保存されているアクセス ポリシーを使用すると、ストレージ アカウント キーを再生成することなく、サービス SAS のアクセス許可を取り消すことができます。", - "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", - "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "Azure Container Registry に格納されているイメージを使用する場合は、プライベート エンドポイントとアプリ設定 \"WEBSITE_PULL_IMAGE_OVER_VNET\" を使用して、Azure Container Registry から仮想ネットワーク経由でイメージをプルします。", + "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", + "service": "App Services", "severity": "中程度", - "text": "保存されているアクセス ポリシーに SAS をリンクすることを検討する", + "text": "Virtual Network 経由でコンテナーをプルする", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", - "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "ペネトレーションテストのルールに従って、Webアプリケーションでペネトレーションテストを実施します。", + "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", + "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", + "service": "App Services", "severity": "中程度", - "text": "チェックインされた接続文字列とストレージ アカウント キーを検出するようにアプリケーションのソース コード リポジトリを構成することを検討してください。", + "text": "ペネトレーションテストの実施", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "理想的には、アプリケーションでマネージド ID を使用して Azure Storage に対する認証を行う必要があります。それが不可能な場合は、ストレージ資格情報 (接続文字列、ストレージ アカウント キー、SAS、サービス プリンシパル資格情報) を Azure KeyVault または同等のサービスに用意することを検討してください。", - "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", - "service": "Azure Storage", - "severity": "高い", - "text": "接続文字列を Azure KeyVault に格納することを検討する (マネージド ID が不可能なシナリオの場合)", + "checklist": "Azure App Service Review", + "description": "DevSecOps プラクティスに従って脆弱性が検証およびスキャンされた信頼できるコードをデプロイします。", + "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", + "service": "App Services", + "severity": "中程度", + "text": "検証済みコードのデプロイ", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "アドホック SAS サービス SAS またはアカウント SAS で、有効期限が近づいています。このように、SAS が侵害された場合でも、有効期間は短時間です。この方法は、保存されているアクセス ポリシーを参照できない場合に特に重要です。また、有効期限が近いと、BLOB にアップロードできる時間が制限されるため、BLOB に書き込めるデータの量も制限されます。", - "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", + "checklist": "Azure App Service Review", + "description": "サポートされているプラットフォーム、プログラミング言語、プロトコル、およびフレームワークの最新バージョンを使用します。", + "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", + "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", + "service": "App Services", "severity": "高い", - "text": "アドホックSASの有効期間を短くする", + "text": "最新のプラットフォーム、言語、プロトコル、フレームワークを使用", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "SAS を作成するときは、できるだけ具体的かつ制限的にしてください。1 つのリソースと操作には、より広範なアクセスを提供する SAS よりも SAS を優先します。", - "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", - "severity": "中程度", - "text": "SAS に狭いスコープを適用する", + "checklist": "Azure VMware Solution Design Review", + "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", + "service": "AVS", + "severity": "高い", + "text": "ADDS ドメイン コントローラーがネイティブ Azure の ID サブスクリプションにデプロイされていることを確認する", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "SAS には、SAS を使用してリソースを要求する権限をクライアント IP アドレスまたはアドレス範囲に与えるパラメーターを含めることができます。", - "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", - "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "75089c20-990d-4927-b105-885576f76fc2", + "service": "AVS", "severity": "中程度", - "text": "可能な限り、SAS のスコープを特定のクライアント IP アドレスに設定することを検討してください", - "waf": "安全" - }, - { - "checklist": "Azure Blob Storage Review", - "description": "SAS は、クライアントがアップロードするデータの量を制限できません。時間の経過に伴うストレージ容量の価格モデルを考えると、クライアントが悪意を持って大きなコンテンツをアップロードしたかどうかを検証することは理にかなっているかもしれません。", - "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", - "service": "Azure Storage", - "severity": "低い", - "text": "クライアントが SAS を使用してファイルをアップロードした後、アップロードされたデータを確認することを検討してください。", + "text": "Azure ベースのリソース (Azure VMware Solution を含む) からの認証要求を Azure にローカルに保持するように ADDS サイトとサービスが構成されていることを確認します", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "\"ローカル ユーザー アカウント\" を使用して SFTP 経由で BLOB ストレージにアクセスする場合、\"通常の\" RBAC 制御は適用されません。NFS または REST 経由の BLOB アクセスは、SFTP アクセスよりも制限が厳しい場合があります。残念ながら、2023 年初頭の時点で、SFTP エンドポイントで現在サポートされている ID 管理の形式はローカル ユーザーだけです", - "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", + "service": "AVS", "severity": "高い", - "text": "SFTP: SFTPアクセスの「ローカルユーザー」の数を制限し、時間の経過とともにアクセスが必要かどうかを監査します。", + "text": "vCenterがADDに接続されていることを確認し、「名前付きユーザーアカウント」に基づく認証を有効にします", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", + "service": "AVS", "severity": "中程度", - "text": "SFTP: SFTP エンドポイントは、POSIX ライクな ACL をサポートしていません。", + "text": "vCenter から ADDS への接続でセキュア プロトコル (LDAPS) が使用されていることを確認します", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "ストレージは、CORS (Cross-Origin Resource Sharing)、つまり、異なるドメインの Web アプリが同一生成元ポリシーを緩めることを可能にする HTTP 機能をサポートしています。CORS を有効にする場合は、CorsRules を最小の特権に保ちます。", - "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", - "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", - "service": "Azure Storage", - "severity": "高い", - "text": "過度に広範な CORS ポリシーを避ける", + "checklist": "Azure VMware Solution Design Review", + "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", + "service": "AVS", + "severity": "中程度", + "text": "vCenter IdP の CloudAdmin アカウントは、緊急アカウント(非常用アカウント)としてのみ使用されます", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "保存データは常にサーバー側で暗号化され、さらにクライアント側でも暗号化される場合があります。サーバー側の暗号化は、プラットフォーム マネージド キー (既定) またはカスタマー マネージド キーを使用して行われる場合があります。クライアント側の暗号化は、クライアントが BLOB ごとに暗号化/暗号化解除キーを Azure Storage に提供するか、クライアント側で暗号化を完全に処理することによって行われます。そのため、機密性の保証を Azure Storage にまったく依存しません。", - "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", + "service": "AVS", "severity": "高い", - "text": "保存データの暗号化方法を決定します。データのスレッド モデルを理解します。", + "text": "NSX-Manager が外部 ID プロバイダ (LDAPS) と統合されていることを確認します。", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", - "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", + "service": "AVS", "severity": "中程度", - "text": "どのプラットフォーム暗号化を使用するか、または使用するかを決定します。", + "text": "VMware vSphere 内で使用するために RBAC モデルが作成されているか", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", - "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", + "service": "AVS", "severity": "中程度", - "text": "クライアント側の暗号化を使用するかどうかを決定します。", + "text": "RBAC アクセス許可は、特定のユーザーではなく、ADDS グループに付与する必要があります", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "Resource Graph エクスプローラー (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) を利用して、匿名 BLOB アクセスを許可するストレージ アカウントを検索します。", - "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", - "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", + "service": "AVS", "severity": "高い", - "text": "パブリック BLOB アクセスが必要かどうか、または特定のストレージ アカウントに対して無効にできるかどうかを検討します。", + "text": "Azure の Azure VMware Solution リソースに対する RBAC アクセス許可は、限られた所有者のセットのみに \"ロックダウン\" されます", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", - "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", - "service": "APIM", - "severity": "中程度", - "text": "グローバルレベルでのエラー処理ポリシーの実装", - "waf": "オペレーションズ" + "checklist": "Azure VMware Solution Design Review", + "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", + "service": "AVS", + "severity": "高い", + "text": "すべてのカスタム ロールのスコープが CloudAdmin で許可された承認で設定されていることを確認する", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", - "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", - "service": "APIM", - "severity": "中程度", - "text": "すべての API ポリシーに要素が含まれていることを確認します。", - "waf": "オペレーションズ" + "checklist": "Azure VMware Solution Design Review", + "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", + "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", + "service": "AVS", + "severity": "高い", + "text": "お客様のユース ケースに適した Azure VMware Solution 接続モデルが選択されているか", + "waf": "パフォーマンス" }, { - "checklist": "Azure API Management Review", - "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", - "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", - "service": "APIM", - "severity": "中程度", - "text": "ポリシーフラグメントを使用して、複数の API で同じポリシー定義を繰り返さないようにする", + "checklist": "Azure VMware Solution Design Review", + "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", + "service": "AVS", + "severity": "高い", + "text": "オンプレミスから Azure への ExpressRoute または VPN 接続が \"接続モニター\" を使用して監視されていることを確認する", "waf": "オペレーションズ" }, { - "checklist": "Azure API Management Review", - "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", - "link": "https://learn.microsoft.com/azure/api-management/monetization-support", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", + "service": "AVS", "severity": "中程度", - "text": "API の収益化を計画している場合は、「収益化のサポート」の記事でおすすめの方法をご確認ください", - "waf": "オペレーションズ" - }, - { - "checklist": "Azure API Management Review", - "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", - "service": "APIM", - "severity": "高い", - "text": "診断設定を有効にしてログを Azure Monitor にエクスポートする", + "text": "Azure VMware Solution バックエンドの ExpressRoute 接続を監視するために、Azure ネイティブ リソースから Azure VMware Solution 仮想マシンへの接続モニターが作成されていることを確認します", "waf": "オペレーションズ" }, { - "checklist": "Azure API Management Review", - "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", + "service": "AVS", "severity": "中程度", - "text": "Application Insights を有効にして、より詳細なテレメトリを実現する", + "text": "エンド 2 エンドの接続を監視するために、オンプレミス リソースから Azure VMware Solution 仮想マシンへの接続モニターが作成されていることを確認します", "waf": "オペレーションズ" }, { - "checklist": "Azure API Management Review", - "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", + "service": "AVS", "severity": "高い", - "text": "最も重要なメトリックに関するアラートを構成する", + "text": "ルート サーバーを使用する場合は、ルート サーバーから ExR ゲートウェイ、オンプレミスに伝達されるルートが 1000 を超えないようにします (ARS 制限)。", "waf": "オペレーションズ" }, { - "checklist": "Azure API Management Review", - "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", + "service": "AVS", "severity": "高い", - "text": "カスタム SSL 証明書が Azure Key Vault に格納され、安全にアクセスして更新できるようにする", + "text": "Azure Portal で Azure VMware Solution リソースを管理するロールに対して Privileged Identity Management が実装されていますか (永続的なアクセス許可は許可されません)", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", + "service": "AVS", "severity": "高い", - "text": "Azure AD を使用して API (データ プレーン) への受信要求を保護する", + "text": "Privileged Identity Management 監査レポートは、Azure VMware Solution PIM ロールに対して実装する必要がある", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", + "service": "AVS", "severity": "中程度", - "text": "Microsoft Entra ID を使用して開発者ポータルでユーザーを認証する", + "text": "Privileged Identity Management を使用している場合は、Azure VMware Solution のホストの自動置換通知用の有効な SMTP レコードを使用して、有効な Entra ID が有効なアカウントが作成されていることを確認します。(常任許可が必要)", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", - "service": "APIM", - "severity": "中程度", - "text": "適切なグループを作成して、製品の可視性を制御します", + "checklist": "Azure VMware Solution Design Review", + "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", + "service": "AVS", + "severity": "高い", + "text": "CloudAdmin アカウントの使用を緊急アクセスのみに制限する", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "06862505-2d9a-4874-9491-2837b00a3475", - "link": "https://learn.microsoft.com/azure/api-management/backends", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", + "service": "AVS", "severity": "中程度", - "text": "バックエンド機能を使用して、冗長な API バックエンド構成を排除します", - "waf": "オペレーションズ" + "text": "vCenter Server でカスタム RBAC ロールを作成して、vCenter 内に最小特権モデルを実装します", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", + "service": "AVS", "severity": "中程度", - "text": "名前付き値を使用して、ポリシーで使用できる共通の値を格納します", - "waf": "オペレーションズ" + "text": "cloudadmin (vCenter) と admin (NSX) の資格情報を定期的にローテーションするように定義されたプロセスです。", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", - "service": "APIM", - "severity": "中程度", - "text": "DR の場合は、99.99% の SLA で 2 つ以上のリージョンにスケーリングされたデプロイで Premium レベルを活用します", - "waf": "確実" + "checklist": "Azure VMware Solution Design Review", + "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", + "service": "AVS", + "severity": "高い", + "text": "一元化された ID プロバイダーを使用して、Azure VMware Solution で実行されているワークロード (VM) に使用する", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", - "link": "https://learn.microsoft.com/azure/api-management/high-availability", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", + "service": "AVS", "severity": "中程度", - "text": "少なくとも 1 つのユニットを 2 つ以上の可用性ゾーンにデプロイして、SLA を 99.99% に向上させる", - "waf": "確実" + "text": "East-West トラフィック フィルタリングは NSX-T 内に実装されていますか", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", + "service": "AVS", "severity": "高い", - "text": "自動バックアップ・ルーチンがあることを確認する", - "waf": "確実" + "text": "Azure VMware Solution 上のワークロードは、インターネットに直接公開されません。トラフィックは、Azure Application Gateway、Azure Firewall、またはサード パーティのソリューションによってフィルター処理され、検査されます", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", - "link": "https://learn.microsoft.com/azure/api-management/retry-policy", - "service": "APIM", - "severity": "中程度", - "text": "ポリシーを使用して、フェイルオーバー・バックエンドURLとキャッシュを追加し、コールの失敗を減らします。", - "waf": "確実" + "checklist": "Azure VMware Solution Design Review", + "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", + "service": "AVS", + "severity": "高い", + "text": "監査とログ記録は、Azure VMware Solution および Azure VMware Solution ベースのワークロードへの受信インターネット要求に対して実装されます", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", - "service": "APIM", - "severity": "低い", - "text": "高パフォーマンス レベルでログを記録する必要がある場合は、Event Hubs ポリシーを検討してください", - "waf": "オペレーションズ" + "checklist": "Azure VMware Solution Design Review", + "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", + "service": "AVS", + "severity": "中程度", + "text": "セッション監視は、疑わしい/悪意のあるアクティビティを特定するために、Azure VMware Solution または Azure VMware Solution ベースのワークロードからの送信インターネット接続に実装されます", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", - "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "334fdf91-c234-4182-a652-75269440b4be", + "service": "AVS", "severity": "中程度", - "text": "調整ポリシーを適用して、毎秒の要求数を制御する", - "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", - "waf": "パフォーマンス" + "text": "Azure の ExR/VPN Gateway サブネットで DDoS Standard 保護が有効になっているか", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", + "service": "AVS", "severity": "中程度", - "text": "負荷が増加したときにインスタンスの数をスケールアウトするように自動スケーリングを構成する", - "waf": "パフォーマンス" + "text": "専用の特権アクセス ワークステーション (PAW) を使用して、Azure VMware Solution、vCenter、NSX Manager、HCX Manager を管理する", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", + "service": "AVS", "severity": "中程度", - "text": "セルフホステッド ゲートウェイをデプロイする場所は、バックエンド API に近いリージョンが Azure にありません。", - "waf": "パフォーマンス" + "text": "Azure VMware Solution で実行されているワークロードに対して Advanced Threat Detection (Microsoft Defender for Cloud 別名 ASC) を有効にする", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", - "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", + "service": "AVS", "severity": "中程度", - "text": "運用環境のワークロードには Premium レベルを使用します。", - "waf": "確実" + "text": "Azure ARC for Servers を使用して、Azure ネイティブ テクノロジを使用して Azure VMware Solution で実行されているワークロードを適切に管理します (Azure ARC for Azure VMware Solution はまだ利用できません)", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", + "service": "AVS", + "severity": "低い", + "text": "Azure VMware Solution 上のワークロードで、実行時に十分なデータ暗号化 (ゲスト内ディスク暗号化や SQL TDE など) が使用されるようにします。(保存時の vSAN 暗号化がデフォルトです)", + "waf": "安全" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "a3592718-e6e2-4051-9267-6ae46691e883", + "service": "AVS", + "severity": "低い", + "text": "ゲスト内暗号化を使用する場合は、可能な場合は Azure Key Vault に暗号化キーを格納します", + "waf": "安全" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "5ac94222-3e13-4810-9230-81a941741583", + "service": "AVS", "severity": "中程度", - "text": "複数リージョン モデルでは、ポリシーを使用して、可用性または待機時間に基づいてリージョン バックエンドに要求をルーティングします。", + "text": "Azure VMware Solution で実行されているワークロードには、拡張セキュリティ更新プログラムのサポートの使用を検討してください (Azure VMware Solution は ESU の対象です)", + "waf": "安全" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", + "service": "AVS", + "severity": "高い", + "text": "適切な vSAN データ冗長化方式(RAID 仕様)が使用されていることを確認します。", "waf": "確実" }, { - "checklist": "Azure API Management Review", - "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "d88408f3-7273-44c8-96ba-280214590146", + "service": "AVS", "severity": "高い", - "text": "APIM の制限に注意する", + "text": "許容障害ポリシーが vSAN ストレージのニーズを満たすために設定されていることを確認します", "waf": "確実" }, { - "checklist": "Azure API Management Review", - "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", - "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", + "service": "AVS", "severity": "高い", - "text": "セルフホステッド ゲートウェイのデプロイに回復性があることを確認します。", + "text": "十分なクォータを要求し、拡張とディザスタリカバリの要件を考慮していることを確認します", "waf": "確実" }, { - "checklist": "Azure API Management Review", - "guid": "7519e385-a88b-4d34-966b-6269d686e890", - "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", + "service": "AVS", "severity": "中程度", - "text": "複数リージョンのデプロイに APIM の前で Azure Front Door を使用するUse Azure Front Door in front of APIM for multi-region deployment", - "waf": "パフォーマンス" + "text": "ESXiへのアクセス制限を理解し、サードパーティのソリューションに影響を与える可能性のあるアクセス制限があることを確認してください。", + "waf": "オペレーションズ" }, { - "checklist": "Azure API Management Review", - "guid": "cd45c90e-7690-4753-930b-bf290c69c074", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", + "service": "AVS", "severity": "中程度", - "text": "仮想ネットワーク (VNet) 内にサービスをデプロイするDeploy the service within a Virtual Network (VNet)", - "waf": "安全" + "text": "ESXi ホストの密度と効率に関するポリシーがあることを確認し、新しいノードを要求するためのリード タイムを念頭に置いてください", + "waf": "オペレーションズ" }, { - "checklist": "Azure API Management Review", - "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", + "service": "AVS", "severity": "中程度", - "text": "ネットワーク セキュリティ グループ (NSG) をサブネットにデプロイして、APIM との間のトラフィックを制限または監視します。", - "waf": "安全" + "text": "Azure VMware Solution の適切なコスト管理プロセスが整っていることを確認する - Azure Cost Management を使用できます", + "waf": "費用" }, { - "checklist": "Azure API Management Review", - "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", + "service": "AVS", + "severity": "低い", + "text": "Azure VMware Solution を使用するためのコストを最適化するために Azure 予約インスタンスが使用されているか", + "waf": "費用" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "6691e883-5ac9-4422-83e1-3810523081a9", + "service": "AVS", "severity": "中程度", - "text": "プライベート エンドポイントをデプロイして、APIM が VNet にデプロイされていない場合に受信トラフィックをフィルター処理します。", + "text": "他の Azure Native Services を使用する場合は、Azure Private-Link の使用を検討してください", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", + "service": "AVS", "severity": "高い", - "text": "パブリックネットワークアクセスの無効化", - "waf": "安全" + "text": "必要なすべてのリソースが同じ Azure 可用性ゾーン内に存在することを確認する", + "waf": "パフォーマンス" }, { - "checklist": "Azure API Management Review", - "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", - "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", + "service": "AVS", "severity": "中程度", - "text": "PowerShell 自動化スクリプトで管理を簡素化", - "waf": "オペレーションズ" + "text": "Azure VMware Solution ゲスト VM ワークロードに対して Microsoft Defender for Cloud を有効にする", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", + "service": "AVS", "severity": "中程度", - "text": "Infrastructure-as-code を使用して APIM を構成します。Cloud Adaption Framework APIM Landing Zone Accelerator から DevOps のベスト プラクティスを確認する", - "waf": "オペレーションズ" + "text": "Azure Arc 対応サーバーを使用して Azure VMware Solution ゲスト VM のワークロードを管理する", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", - "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", - "service": "APIM", - "severity": "中程度", - "text": "Visual Studio Code APIM 拡張機能の使用を促進して API 開発を迅速化する", + "checklist": "Azure VMware Solution Design Review", + "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", + "service": "AVS", + "severity": "高い", + "text": "Azure VMware Solution での診断ログとメトリック ログを有効にするEnable Diagnostic and metric logging on Azure VMware Solution", "waf": "オペレーションズ" }, { - "checklist": "Azure API Management Review", - "guid": "354f1c03-8112-4965-85ad-c0074bddf231", - "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", + "service": "AVS", "severity": "中程度", - "text": "DevOpsとCI/CDをワークフローに実装する", + "text": "Log Analytics エージェントを Azure VMware Solution ゲスト VM ワークロードにデプロイする", "waf": "オペレーションズ" }, { - "checklist": "Azure API Management Review", - "guid": "b6439493-426a-45f3-9697-cf65baee208d", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", - "service": "APIM", - "severity": "中程度", - "text": "クライアント証明書認証を使用した API の保護", - "waf": "安全" - }, - { - "checklist": "Azure API Management Review", - "guid": "2a67d143-1033-4c0a-8732-680896478f08", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "589d457a-927c-4397-9d11-02cad6aae11e", + "service": "AVS", "severity": "中程度", - "text": "クライアント証明書認証を使用したバックエンド サービスのセキュリティ保護", - "waf": "安全" + "text": "Azure VMware Solution VM ワークロードのバックアップ ポリシーとソリューションが文書化され、実装されていることを確認します", + "waf": "オペレーションズ" }, { - "checklist": "Azure API Management Review", - "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", - "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "ee29711b-d352-4caa-ab79-b198dab81932", + "service": "AVS", "severity": "中程度", - "text": "「OWASP API Security Top 10 の脅威を軽減するための推奨事項」の記事を確認し、API に適用できるものを確認します", + "text": "Microsoft Defender for Cloud を使用して、Azure VMware Solution で実行されているワークロードのコンプライアンス監視を行う", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", - "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", + "service": "AVS", "severity": "中程度", - "text": "承認機能を使用して、バックエンド API の OAuth 2.0 トークンの管理を簡素化します", + "text": "適用可能なコンプライアンス ベースラインは Microsoft Defender for Cloud に追加されていますか", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", + "service": "AVS", "severity": "高い", - "text": "転送中の情報を暗号化する場合は、最新のTLSバージョンを使用します。可能であれば、古くて不要なプロトコルと暗号を無効にします。", + "text": "Azure VMware Solution のデプロイに使用する Azure リージョンを選択するときにデータ所在地が評価されましたか", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "f8af3d94-1d2b-4070-846f-849197524258", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", + "service": "AVS", "severity": "高い", - "text": "シークレット (名前付き値) が Azure Key Vault に格納され、安全にアクセスして更新できるようにする", + "text": "データ処理への影響 (サービス プロバイダー/サービス コンシューマー モデル) が明確で文書化されているか", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "791abd8b-7706-4e31-9569-afefde724be3", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "547c1747-dc56-4068-a714-435cd19dd244", + "service": "AVS", "severity": "中程度", - "text": "可能な限りマネージド ID を使用して、他の Azure リソースに対する認証を行う", + "text": "コンプライアンス上の理由で必要な場合にのみ、vSAN に CMK (カスタマー マネージド キー) を使用することを検討してください。", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", + "service": "AVS", "severity": "高い", - "text": "Web アプリケーション ファイアウォール (WAF) を使用するには、APIM の前に Application Gateway をデプロイします", - "waf": "安全" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", - "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", - "service": "AKS", - "severity": "低い", - "text": "AKS Windows ワークロードで必要な場合は、HostProcess コンテナーを使用できます", - "waf": "確実" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", - "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", - "service": "AKS", - "severity": "低い", - "text": "イベント ドリブン ワークロードを実行する場合は KEDA を使用します", - "waf": "パフォーマンス" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", - "link": "https://dapr.io/", - "service": "AKS", - "severity": "低い", - "text": "Dapr を使用してマイクロサービス開発を容易にする", + "text": "Azure VMware Solution のコア監視分析情報を有効にするダッシュボードを作成するCreate dashboards to enable a core Azure VMware Solution monitoring insights", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", - "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", - "link": "https://learn.microsoft.com/azure/aks/uptime-sla", - "service": "AKS", - "severity": "高い", - "text": "SLA でサポートされる AKS オファリングを使用する", - "waf": "確実" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", - "severity": "低い", - "text": "ポッドとデプロイ定義でのディスラプション バジェットの使用", - "waf": "確実" - }, - { - "checklist": "Azure AKS Review", - "guid": "3c763963-7a55-42d5-a15e-401955387e5c", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", - "service": "ACR", - "severity": "高い", - "text": "プライベート レジストリを使用する場合は、複数のリージョンにイメージを格納するようにリージョン レプリケーションを構成します", - "waf": "確実" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", - "service": "AKS", - "severity": "低い", - "text": "kubecost などの外部アプリケーションを使用して、さまざまなユーザーにコストを割り当てます", - "waf": "費用" + "checklist": "Azure VMware Solution Design Review", + "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", + "service": "AVS", + "severity": "高い", + "text": "Azure VMware Solution のパフォーマンス (CPU >80%、平均メモリ >80%、vSAN >70%) に関する自動アラートの重大しきい値の警告アラートを作成する", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", - "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", - "service": "AKS", - "severity": "低い", - "text": "スケールダウンモードを使用してノードを削除/割り当て解除する", - "waf": "費用" + "checklist": "Azure VMware Solution Design Review", + "guid": "9659e396-80e7-4828-ac93-5657d02bff45", + "service": "AVS", + "severity": "高い", + "text": "vSAN の消費量が 75% を下回っているかどうかを監視するための重要なアラートが作成されていることを確認します (これは VMware からのサポートしきい値です)。", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", - "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", + "service": "AVS", + "severity": "高い", + "text": "Azure Service Health のアラートと通知に対してアラートが構成されていることを確認する", + "waf": "オペレーションズ" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", + "service": "AVS", "severity": "中程度", - "text": "必要に応じて、AKS クラスターで複数インスタンスの分割 GPU を使用する", - "waf": "費用" + "text": "処理のために Azure Storage アカウントまたは Azure EventHub に送信するように Azure VMware Solution ログを構成する", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", - "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", + "service": "AVS", "severity": "低い", - "text": "Dev/Test クラスターを実行している場合は、NodePool Start/Stop を使用します。", - "waf": "費用" + "text": "VMware vSphere での詳細な分析情報が必要な場合:vRealize Operations や vRealize Network Insights がソリューションで使用されていますか?", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", - "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", - "service": "AKS", - "severity": "中程度", - "text": "Azure Policy for Kubernetes を使用してクラスターのコンプライアンスを確保する", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", + "service": "AVS", + "severity": "高い", + "text": "仮想マシンの vSAN ストレージ ポリシーはシック プロビジョニングを適用するため、このポリシーがデフォルトのストレージ ポリシーではないことを確認します", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", - "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", + "service": "AVS", "severity": "中程度", - "text": "ユーザー/システムノードプールを使用してコントロールプレーンからアプリケーションを分離する", - "waf": "安全" + "text": "vSAN は有限のリソースであるため、vSphere コンテンツ ライブラリが vSAN に配置されていないことを確認する", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", - "severity": "低い", - "text": "システム ノードプールにテイントを追加して専用にする", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", + "service": "AVS", + "severity": "中程度", + "text": "バックアップ ソリューションのデータ リポジトリが vSAN ストレージの外部に保存されていることを確認します。Azure ネイティブまたはディスク プールでバックアップされるデータストア上", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", - "link": "https://learn.microsoft.com/azure/container-registry/", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", + "service": "AVS", "severity": "中程度", - "text": "イメージにはプライベート レジストリ (ACR など) を使用する", - "waf": "安全" + "text": "Azure Arc for Servers を使用して Azure VMware Solution で実行されているワークロードがハイブリッド管理されていることを確認する (Arc for Azure VMware Solution はプレビュー段階です)", + "waf": "オペレーションズ" }, { - "checklist": "Azure AKS Review", - "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", - "link": "https://learn.microsoft.com/azure/security-center/container-security", - "service": "ACR", + "checklist": "Azure VMware Solution Design Review", + "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", + "service": "AVS", "severity": "中程度", - "text": "イメージをスキャンして脆弱性を検出する", - "waf": "安全" + "text": "Azure VMware Solution で実行されているワークロードが Azure Log Analytics と Azure Monitor を使用して監視されていることを確認する", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", - "service": "AKS", - "severity": "高い", - "text": "アプリの分離要件を定義する (名前空間/ノードプール/クラスター)", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", + "service": "AVS", + "severity": "中程度", + "text": "Azure VMware Solution で実行されているワークロードを、既存の更新プログラム管理ツールまたは Azure Update Management に含める", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", - "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", + "service": "AVS", "severity": "中程度", - "text": "CSI シークレット ストア ドライバーを使用して Azure Key Vault にシークレットを格納する", - "waf": "安全" + "text": "Azure Policy を使用して、Azure の管理、監視、セキュリティ ソリューションに Azure VMware Solution ワークロードをオンボードする", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", - "link": "https://learn.microsoft.com/azure/aks/update-credentials", - "service": "AKS", - "severity": "高い", - "text": "クラスターにサービス プリンシパルを使用する場合は、資格情報を定期的に (四半期ごとなど) 更新します", + "checklist": "Azure VMware Solution Design Review", + "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", + "service": "AVS", + "severity": "中程度", + "text": "Azure VMware Solution で実行されているワークロードが Microsoft Defender for Cloud にオンボードされていることを確認する", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", - "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", + "service": "AVS", "severity": "中程度", - "text": "必要に応じて、キー管理サービスの etcd 暗号化を追加します", - "waf": "安全" + "text": "vSAN は有限のリソースであるため、バックアップが vSAN に保存されないようにする", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", - "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", - "service": "AKS", - "severity": "低い", - "text": "必要に応じて、Confidential Compute for AKS の使用を検討してください", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", + "service": "AVS", + "severity": "中程度", + "text": "すべてのDRソリューションが検討され、ビジネスに最適なソリューションが決定されましたか?[SRM/JetStream/Zerto/Veeam/...]", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", + "service": "AVS", "severity": "中程度", - "text": "Defender for Containers の使用を検討する", - "waf": "安全" + "text": "ディザスター リカバリー テクノロジがネイティブの Azure IaaS の場合は、Azure Site Recovery を使用します", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", - "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", + "service": "AVS", "severity": "高い", - "text": "サービス プリンシパルの代わりにマネージド ID を使用するUse managed identities instead of Service Principals", - "waf": "安全" + "text": "いずれかの災害ソリューションで自動復旧計画を使用し、手動タスクを可能な限り回避します", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", - "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", - "link": "https://learn.microsoft.com/azure/aks/managed-aad", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "8255461e-2aee-4345-9aec-8339248b262d", + "service": "AVS", "severity": "中程度", - "text": "認証と AAD の統合 (マネージド統合を使用)", - "waf": "安全" + "text": "地政学的リージョンのペアをセカンダリディザスタリカバリ環境として使用する", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", - "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", - "service": "AKS", - "severity": "中程度", - "text": "管理者 kubeconfig へのアクセスを制限する (get-credentials --admin)", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", + "service": "AVS", + "severity": "高い", + "text": "リージョン間で 2 つの異なるアドレス空間を使用します (例: 10.0.0.0/16 と 192.168.0.0/16)。", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", - "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", + "service": "AVS", "severity": "中程度", - "text": "承認と AAD RBAC の統合", - "waf": "安全" + "text": "ExpressRoute Global Reach は、プライマリとセカンダリの Azure VMware Solution プライベート クラウド間の接続に使用されますか、それともネットワーク仮想アプライアンスを介してルーティングされますか?", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", - "service": "AKS", - "severity": "高い", - "text": "Kubernetes で RBAC 特権を制限するために名前空間を使用する", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", + "service": "AVS", + "severity": "中程度", + "text": "すべてのバックアップソリューションが検討され、ビジネスに最適なソリューションが決定されましたか?[ MABS/CommVault/Metallic.io/Veeam/ . ]", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", - "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", + "service": "AVS", "severity": "中程度", - "text": "ポッド ID アクセス管理の場合は、Azure AD ワークロード ID (プレビュー) を使用します", - "waf": "安全" + "text": "バックアップ ソリューションを Azure VMware Solution プライベート クラウドと同じリージョンにデプロイする", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", + "service": "AVS", "severity": "中程度", - "text": "AKS 非対話型ログインの場合は、kubelogin (プレビュー) を使用します", - "waf": "安全" + "text": "バックアップ ソリューションを vSan の外部の Azure ネイティブ コンポーネントにデプロイする", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", - "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", - "service": "AKS", - "severity": "中程度", - "text": "AKS ローカル アカウントを無効にする", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", + "service": "AVS", + "severity": "低い", + "text": "Azure プラットフォームによって管理されている VMware コンポーネントの復元を要求するプロセスは用意されていますか?", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", + "service": "AVS", "severity": "低い", - "text": "必要に応じて Just-In-Time クラスター アクセスを構成する", - "waf": "安全" + "text": "手動デプロイの場合、すべての構成とデプロイを文書化する必要があります", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", + "service": "AVS", "severity": "低い", - "text": "必要に応じて AKS の AAD 条件付きアクセスを構成する", - "waf": "安全" + "text": "手動デプロイの場合は、Azure VMware Solution プライベート クラウドでの偶発的なアクションを防ぐために、リソース ロックの実装を検討してください", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", - "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", + "service": "AVS", "severity": "低い", - "text": "Windows AKS ワークロードで必要な場合は、gMSA を構成します", - "waf": "安全" + "text": "自動デプロイの場合は、最小限のプライベート クラウドをデプロイし、必要に応じてスケーリングします", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", - "service": "AKS", - "severity": "中程度", - "text": "より細かく制御するには、マネージドKubelet Identityの使用を検討してください", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", + "service": "AVS", + "severity": "低い", + "text": "自動デプロイの場合は、デプロイを開始する前にクォータを要求または予約します", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", - "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", - "service": "AKS", - "severity": "中程度", - "text": "AGIC を使用している場合は、クラスター間で AppGW を共有しないでください", - "waf": "確実" + "checklist": "Azure VMware Solution Design Review", + "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", + "service": "AVS", + "severity": "低い", + "text": "自動デプロイの場合は、適切なガバナンスのために、自動化または Azure Policy を使用して関連するリソース ロックが作成されていることを確認します", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", - "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", - "link": "https://learn.microsoft.com/azure/aks/http-application-routing", - "service": "AKS", - "severity": "高い", - "text": "AKS HTTP ルーティング アドオンを使用せず、代わりにアプリケーション ルーティング アドオンでマネージド NGINX イングレスを使用します。", - "waf": "確実" + "checklist": "Azure VMware Solution Design Review", + "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", + "service": "AVS", + "severity": "低い", + "text": "ExR 認証キーに人間が理解できる名前を実装して、キーの目的/用途を簡単に識別できるようにします", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", - "service": "AKS", - "severity": "中程度", - "text": "Windows ワークロードの場合は、高速ネットワークを使用します", - "waf": "パフォーマンス" + "checklist": "Azure VMware Solution Design Review", + "guid": "255461e2-aee3-4553-afc8-339248b262d6", + "service": "AVS", + "severity": "低い", + "text": "Azure VMware Solution と ExpressRoute のデプロイに個別のサービス プリンシパルを使用する場合は、キー コンテナーを使用してシークレットと承認キーを格納します", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", - "guid": "ba7da7be-9952-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", - "severity": "高い", - "text": "標準のALBを使用する(基本的なALBとは対照的)", - "waf": "確実" + "checklist": "Azure VMware Solution Design Review", + "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", + "service": "AVS", + "severity": "低い", + "text": "Azure VMware Solution では限られた数の並列操作しかサポートされないため、Azure VMware Solution に多くのリソースをデプロイする必要がある場合に、IaC でアクションをシリアル化するためのリソースの依存関係を定義します。", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", + "service": "AVS", + "severity": "低い", + "text": "単一の Tier-1 ゲートウェイで NSX-T セグメントの自動構成を実行する場合は、NSX-Manager API ではなく Azure Portal API を使用します", + "waf": "オペレーションズ" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", + "service": "AVS", "severity": "中程度", - "text": "Azure CNI を使用する場合は、NodePool に異なるサブネットを使用することを検討してください", - "waf": "安全" + "text": "自動スケールアウトを使用する場合は、Azure VMware Solution を実行しているサブスクリプションに対して十分な Azure VMware Solution クォータを申請してください", + "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", - "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", + "service": "AVS", "severity": "中程度", - "text": "プライベート エンドポイント (推奨) または Virtual Network サービス エンドポイントを使用して、クラスターから PaaS サービスにアクセスする", - "waf": "安全" + "text": "自動スケールインを使用する場合は、そのようなアクションを実行する前に、ストレージ ポリシーの要件を必ず考慮してください", + "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", - "guid": "a0f61565-9de5-458f-a372-49c831112dbd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", - "severity": "高い", - "text": "要件に最適な CNI ネットワーク プラグインを選択する (Azure CNI を推奨)", - "waf": "確実" + "checklist": "Azure VMware Solution Design Review", + "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", + "service": "AVS", + "severity": "中程度", + "text": "スケーリング操作は、一度に 1 つのスケール操作しか実行できないため、常に 1 つの SDDC 内でシリアル化する必要があります (複数のクラスタが使用されている場合でも)", + "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "高い", - "text": "Azure CNI を使用する場合は、ノードあたりのポッドの最大数を考慮して、サブネットのサイズを適切に設定します", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", + "service": "AVS", + "severity": "中程度", + "text": "アーキテクチャで使用されるサードパーティソリューションでのスケーリング操作を検討および検証します(サポートされているかどうか)", "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "高い", - "text": "Azure CNI を使用している場合は、最大ポッド数/ノード (既定値は 30) を確認します", + "checklist": "Azure VMware Solution Design Review", + "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", + "service": "AVS", + "severity": "中程度", + "text": "自動化で環境のスケールイン/スケールアウトの上限を定義して適用する", "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "内部アプリの場合、組織は多くの場合、ファイアウォールで AKS サブネット全体を開きます。これにより、ノードへのネットワーク アクセスも開かれ、場合によってはポッドへのネットワーク アクセスも開かれます (Azure CNI を使用している場合)。LoadBalancer の IP が別のサブネットにある場合は、この IP のみをアプリ クライアントで使用できる必要があります。もう 1 つの理由は、AKS サブネット内の IP アドレスが希少なリソースである場合、その IP アドレスをサービスに使用すると、クラスターの最大スケーラビリティが低下することです。", - "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", - "link": "https://learn.microsoft.com/azure/aks/internal-lb", - "service": "AKS", - "severity": "低い", - "text": "プライベート IP LoadBalancer サービスを使用する場合は、(AKS サブネットではなく) 専用サブネットを使用します", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", + "service": "AVS", + "severity": "中程度", + "text": "監視ルールを実装して、自動スケーリング操作を監視し、成功と失敗を監視して、適切な (自動化された) 応答を有効にします", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", "severity": "高い", - "text": "それに応じて、サービスの IP アドレス範囲のサイズを設定します (クラスターのスケーラビリティが制限されます)。", + "text": "MONを使用する場合は、同時に構成されたVMの制限(HCXのMON制限[400 - 標準、1000 - 大規模アプライアンス])に注意してください", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", - "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", - "service": "AKS", - "severity": "低い", - "text": "必要に応じて、独自のCNIプラグインを追加します", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", + "severity": "高い", + "text": "MON を使用する場合、100 を超えるネットワーク拡張で MON を有効にすることはできません", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", - "service": "AKS", - "severity": "低い", - "text": "必要に応じて、AKS でノードごとにパブリック IP を構成する", + "checklist": "Azure VMware Solution Design Review", + "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", + "service": "AVS", + "severity": "中程度", + "text": "移行に VPN 接続を使用する場合は、それに応じて MTU サイズを調整します。", "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", - "link": "https://learn.microsoft.com/azure/aks/concepts-network", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "e614658d-d457-4e92-9139-b821102cad6e", + "service": "AVS", "severity": "中程度", - "text": "イングレス コントローラーを使用して、LoadBalancer タイプのサービスで公開する代わりに、Web ベースのアプリを公開します", - "waf": "確実" + "text": "Azure に接続する接続性の低いリージョン (500 Mbps 以下) の場合は、HCX WAN 最適化アプライアンスのデプロイを検討してください", + "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", - "link": "https://learn.microsoft.com/azure/aks/nat-gateway", - "service": "AKS", - "severity": "低い", - "text": "エグレス トラフィックをスケーリングするために Azure NAT Gateway を outboundType として使用する", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", + "service": "AVS", + "severity": "中程度", + "text": "移行がオンプレミスアプライアンスから開始され、クラウドアプライアンスから開始されていないことを確認します(逆移行は実行しないでください)", "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "AVS", "severity": "中程度", - "text": "Azure CNI IP の枯渇を回避するために IP の動的割り当てを使用する", + "text": "Azure NetApp Files を使用して Azure VMware Solution のストレージを拡張する場合は、VM に直接接続するのではなく、これを VMware データストアとして使用することを検討してください。", "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", - "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", - "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", - "service": "AKS", - "severity": "高い", - "text": "セキュリティ要件で義務付けられている場合は、AzFW/NVA を使用してエグレス トラフィックをフィルター処理します", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "AVS", + "severity": "中程度", + "text": "専用の ExpressRoute ゲートウェイが外部データ ストレージ ソリューションに使用されていることを確認する", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", - "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", - "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "AVS", "severity": "中程度", - "text": "パブリック API エンドポイントを使用している場合は、アクセスできる IP アドレスを制限します", - "waf": "安全" + "text": "外部データ ストレージ ソリューションに使用されている ExpressRoute ゲートウェイで FastPath が有効になっていることを確認します", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", - "link": "https://learn.microsoft.com/azure/aks/private-clusters", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "AVS", "severity": "高い", - "text": "要件で必要な場合は、プライベート クラスターを使用します", - "waf": "安全" + "text": "ストレッチ クラスタを使用している場合は、選択したディザスタ リカバリ ソリューションがベンダーによってサポートされていることを確認します", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", - "severity": "中程度", - "text": "Windows 2019 および 2022 AKS ノードでは、Calico ネットワーク ポリシーを使用できます", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "AVS", + "severity": "高い", + "text": "ストレッチ クラスターを使用する場合は、提供される SLA が要件を満たしていることを確認します", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", - "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "AVS", "severity": "高い", - "text": "Kubernetes ネットワーク ポリシー オプションを有効にする (Calico/Azure)", - "waf": "安全" + "text": "ストレッチ クラスターを使用している場合は、両方の ExpressRoute 回線が接続ハブに接続されていることを確認します。", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "AVS", "severity": "高い", - "text": "Kubernetesネットワークポリシーを使用してクラスタ内のセキュリティを強化", - "waf": "安全" + "text": "ストレッチ クラスターを使用している場合は、両方の ExpressRoute 回線で GlobalReach が有効になっていることを確認します。", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "AVS", "severity": "高い", - "text": "Web ワークロード (UI または API) に WAF を使用するUse a WAF for a web workloads (UI or API)", - "waf": "安全" + "text": "サイトの耐障害性の設定を適切に検討し、必要に応じてビジネスに合わせて変更しましたか?", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", - "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", + "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", + "service": "APIM", "severity": "中程度", - "text": "AKS Virtual Network で DDoS Standard を使用するUse DDoS Standard in the AKS Virtual Network", - "waf": "安全" + "text": "グローバルレベルでのエラー処理ポリシーの実装", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", - "link": "https://learn.microsoft.com/azure/aks/http-proxy", - "service": "AKS", - "severity": "低い", - "text": "必要に応じて、会社の HTTP プロキシを追加します", - "waf": "安全" + "checklist": "Azure API Management Review", + "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", + "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", + "service": "APIM", + "severity": "中程度", + "text": "すべての API ポリシーに要素が含まれていることを確認します。", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", - "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", + "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", + "service": "APIM", "severity": "中程度", - "text": "高度なマイクロサービス通信管理にサービスメッシュの使用を検討する", - "waf": "安全" + "text": "ポリシーフラグメントを使用して、複数の API で同じポリシー定義を繰り返さないようにする", + "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", - "service": "AKS", - "severity": "高い", - "text": "最も重要なメトリックに関するアラートを構成します (推奨事項については、「Container Insights」を参照してください)", + "checklist": "Azure API Management Review", + "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", + "link": "https://learn.microsoft.com/azure/api-management/monetization-support", + "service": "APIM", + "severity": "中程度", + "text": "API の収益化を計画している場合は、「収益化のサポート」の記事でおすすめの方法をご確認ください", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "337453a3-cc63-4963-9a65-22ac19e80696", - "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", - "service": "AKS", - "severity": "低い", - "text": "Azure Advisor でクラスターの推奨事項を定期的に確認する", + "checklist": "Azure API Management Review", + "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", + "service": "APIM", + "severity": "高い", + "text": "診断設定を有効にしてログを Azure Monitor にエクスポートする", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", - "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", - "service": "AKS", - "severity": "低い", - "text": "AKS 自動証明書のローテーションを有効にする", + "checklist": "Azure API Management Review", + "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", + "service": "APIM", + "severity": "中程度", + "text": "Application Insights を有効にして、より詳細なテレメトリを実現する", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", - "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", + "service": "APIM", "severity": "高い", - "text": "kubernetes のバージョンを定期的に (四半期ごとなど) アップグレードする定期的なプロセスを行うか、AKS 自動アップグレード機能を使用します", + "text": "最も重要なメトリックに関するアラートを構成する", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", - "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", + "service": "APIM", + "severity": "高い", + "text": "カスタム SSL 証明書が Azure Key Vault に格納され、安全にアクセスして更新できるようにする", + "waf": "安全" + }, + { + "checklist": "Azure API Management Review", + "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", + "service": "APIM", "severity": "高い", - "text": "ノードイメージのアップグレードを使用していない場合は、Linuxノードのアップグレードにkuredを使用します", - "waf": "オペレーションズ" + "text": "Azure AD を使用して API (データ プレーン) への受信要求を保護する", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", - "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", - "service": "AKS", - "severity": "高い", - "text": "クラスタノードイメージを定期的に(毎週など)アップグレードする定期的なプロセスを用意します", - "waf": "オペレーションズ" + "checklist": "Azure API Management Review", + "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", + "service": "APIM", + "severity": "中程度", + "text": "Microsoft Entra ID を使用して開発者ポータルでユーザーを認証する", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", - "service": "AKS", - "severity": "低い", - "text": "アプリケーションまたはクラスター構成を複数のクラスターにデプロイするために gitop を検討してください", - "waf": "オペレーションズ" + "checklist": "Azure API Management Review", + "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", + "service": "APIM", + "severity": "中程度", + "text": "適切なグループを作成して、製品の可視性を制御します", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d7672c26-7602-4482-85a4-14527fbe855c", - "link": "https://learn.microsoft.com/azure/aks/command-invoke", - "service": "AKS", - "severity": "低い", - "text": "プライベート クラスターで AKS コマンド呼び出しを使用することを検討する", + "checklist": "Azure API Management Review", + "guid": "06862505-2d9a-4874-9491-2837b00a3475", + "link": "https://learn.microsoft.com/azure/api-management/backends", + "service": "APIM", + "severity": "中程度", + "text": "バックエンド機能を使用して、冗長な API バックエンド構成を排除します", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", - "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", - "service": "AKS", - "severity": "低い", - "text": "計画されたイベントの場合は、ノードの自動ドレインの使用を検討してください", + "checklist": "Azure API Management Review", + "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", + "service": "APIM", + "severity": "中程度", + "text": "名前付き値を使用して、ポリシーで使用できる共通の値を格納します", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", - "link": "https://learn.microsoft.com/azure/aks/faq", - "service": "AKS", - "severity": "高い", - "text": "独自のガバナンスプラクティスを開発して、ノードRG(別名「インフラRG」)のオペレーターによって変更が実行されないようにします", - "waf": "オペレーションズ" + "checklist": "Azure API Management Review", + "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", + "service": "APIM", + "severity": "中程度", + "text": "DR の場合は、99.99% の SLA で 2 つ以上のリージョンにスケーリングされたデプロイで Premium レベルを活用します", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", - "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", - "severity": "低い", - "text": "カスタムノードRG(別名「インフラRG」)名を使用", - "waf": "オペレーションズ" + "checklist": "Azure API Management Review", + "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", + "link": "https://learn.microsoft.com/azure/api-management/high-availability", + "service": "APIM", + "severity": "中程度", + "text": "少なくとも 1 つのユニットを 2 つ以上の可用性ゾーンにデプロイして、SLA を 99.99% に向上させる", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", - "link": "https://kubernetes.io/docs/setup/release/notes/", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", + "service": "APIM", + "severity": "高い", + "text": "自動バックアップ・ルーチンがあることを確認する", + "waf": "確実" + }, + { + "checklist": "Azure API Management Review", + "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", + "link": "https://learn.microsoft.com/azure/api-management/retry-policy", + "service": "APIM", "severity": "中程度", - "text": "非推奨の Kubernetes API を YAML マニフェストで使用しないでください", - "waf": "オペレーションズ" + "text": "ポリシーを使用して、フェイルオーバー・バックエンドURLとキャッシュを追加し、コールの失敗を減らします。", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", - "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", + "service": "APIM", "severity": "低い", - "text": "Windows ノードのテイント", + "text": "高パフォーマンス レベルでログを記録する必要がある場合は、Event Hubs ポリシーを検討してください", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", - "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", - "service": "AKS", - "severity": "低い", - "text": "Windows コンテナーのパッチ レベルをホストのパッチ レベルと同期させる", - "waf": "オペレーションズ" + "checklist": "Azure API Management Review", + "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", + "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", + "service": "APIM", + "severity": "中程度", + "text": "調整ポリシーを適用して、毎秒の要求数を制御する", + "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", + "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "クラスタレベルでの診断設定経由", - "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", - "link": "https://learn.microsoft.com/azure/aks/monitor-aks", - "service": "AKS", - "severity": "低い", - "text": "マスター ログ (API ログ) を Azure Monitor または任意のログ管理ソリューションに送信する", - "waf": "オペレーションズ" + "checklist": "Azure API Management Review", + "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", + "service": "APIM", + "severity": "中程度", + "text": "負荷が増加したときにインスタンスの数をスケールアウトするように自動スケーリングを構成する", + "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", - "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", - "service": "AKS", - "severity": "低い", - "text": "必要に応じて、nodePool スナップショットを使用します", - "waf": "費用" + "checklist": "Azure API Management Review", + "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", + "service": "APIM", + "severity": "中程度", + "text": "セルフホステッド ゲートウェイをデプロイする場所は、バックエンド API に近いリージョンが Azure にありません。", + "waf": "パフォーマンス" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", - "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", - "service": "AKS", - "severity": "低い", - "text": "時間的制約のないワークロードのスポット ノード プールを検討する", - "waf": "オペレーションズ" + "checklist": "Azure API Management Review", + "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", + "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", + "service": "APIM", + "severity": "中程度", + "text": "運用環境のワークロードには Premium レベルを使用します。", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", - "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", - "severity": "低い", - "text": "クイック バーストのために AKS 仮想ノードを検討する", - "waf": "オペレーションズ" + "checklist": "Azure API Management Review", + "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", + "service": "APIM", + "severity": "中程度", + "text": "複数リージョン モデルでは、ポリシーを使用して、可用性または待機時間に基づいてリージョン バックエンドに要求をルーティングします。", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", + "service": "APIM", "severity": "高い", - "text": "Container Insights (または Prometheus などの他のツール) を使用してクラスター メトリックを監視する", - "waf": "オペレーションズ" + "text": "APIM の制限に注意する", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", - "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", + "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", + "service": "APIM", "severity": "高い", - "text": "Container Insights(またはTelegraf/ElasticSearchなどの他のツール)を使用してクラスターログを保存および分析します", - "waf": "オペレーションズ" + "text": "セルフホステッド ゲートウェイのデプロイに回復性があることを確認します。", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "7519e385-a88b-4d34-966b-6269d686e890", + "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", + "service": "APIM", + "severity": "中程度", + "text": "複数リージョンのデプロイに APIM の前で Azure Front Door を使用するUse Azure Front Door in front of APIM for multi-region deployment", + "waf": "パフォーマンス" + }, + { + "checklist": "Azure API Management Review", + "guid": "cd45c90e-7690-4753-930b-bf290c69c074", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", + "service": "APIM", "severity": "中程度", - "text": "ノードの CPU とメモリの使用率を監視する", - "waf": "オペレーションズ" + "text": "仮想ネットワーク (VNet) 内にサービスをデプロイするDeploy the service within a Virtual Network (VNet)", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1a4835ac-9422-423e-ae80-b123081a5417", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", + "service": "APIM", "severity": "中程度", - "text": "Azure CNI を使用している場合は、ノードごとに消費されるポッド IP の割合を監視します", - "waf": "オペレーションズ" + "text": "ネットワーク セキュリティ グループ (NSG) をサブネットにデプロイして、APIM との間のトラフィックを制限または監視します。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "OS ディスクの I/O は重要なリソースです。ノード内の OS が I/O で調整されると、予期しない動作が発生し、通常はノードが NotReady と宣言される可能性があります", - "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", - "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", + "service": "APIM", "severity": "中程度", - "text": "ノード内の OS ディスク キューの深さを監視する", - "waf": "オペレーションズ" + "text": "プライベート エンドポイントをデプロイして、APIM が VNet にデプロイされていない場合に受信トラフィックをフィルター処理します。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "be209d39-fda4-4777-a424-d116785c2fa5", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", - "severity": "中程度", - "text": "AzFW/NVA でエグレス フィルター処理を使用しない場合は、標準の ALB によって割り当てられた SNAT ポートを監視します", - "waf": "オペレーションズ" + "checklist": "Azure API Management Review", + "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", + "service": "APIM", + "severity": "高い", + "text": "パブリックネットワークアクセスの無効化", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", - "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", + "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", + "service": "APIM", "severity": "中程度", - "text": "AKS クラスターのリソース正常性通知をサブスクライブするSubscribe to resource health notifications for your AKS cluster", + "text": "PowerShell 自動化スクリプトで管理を簡素化", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", - "severity": "高い", - "text": "ポッド仕様で要求と制限を構成する", + "checklist": "Azure API Management Review", + "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", + "service": "APIM", + "severity": "中程度", + "text": "Infrastructure-as-code を使用して APIM を構成します。Cloud Adaption Framework APIM Landing Zone Accelerator から DevOps のベスト プラクティスを確認する", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "769ef669-1a48-435a-a942-223ece80b123", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", + "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", + "service": "APIM", "severity": "中程度", - "text": "名前空間のリソースクォータを適用する", + "text": "Visual Studio Code APIM 拡張機能の使用を促進して API 開発を迅速化する", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "081a5417-4158-433e-a3ad-3c2de733165c", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "AKS", - "severity": "高い", - "text": "サブスクリプションにノードプールをスケールアウトするのに十分なクォータがあることを確認する", + "checklist": "Azure API Management Review", + "guid": "354f1c03-8112-4965-85ad-c0074bddf231", + "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", + "service": "APIM", + "severity": "中程度", + "text": "DevOpsとCI/CDをワークフローに実装する", "waf": "オペレーションズ" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", - "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "b6439493-426a-45f3-9697-cf65baee208d", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", + "service": "APIM", "severity": "中程度", - "text": "Cluster Autoscaler を使用する", - "waf": "パフォーマンス" + "text": "クライアント証明書認証を使用した API の保護", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", - "guid": "831c2872-c693-4b39-a887-a561bada49bc", - "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", - "service": "AKS", - "severity": "低い", - "text": "AKS ノード プールのノード構成をカスタマイズする", - "waf": "パフォーマンス" + "checklist": "Azure API Management Review", + "guid": "2a67d143-1033-4c0a-8732-680896478f08", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", + "service": "APIM", + "severity": "中程度", + "text": "クライアント証明書認証を使用したバックエンド サービスのセキュリティ保護", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "Azure API Management Review", + "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", + "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", + "service": "APIM", "severity": "中程度", - "text": "必要に応じてHorizontal Pod Autoscalerを使用します", - "waf": "パフォーマンス" + "text": "「OWASP API Security Top 10 の脅威を軽減するための推奨事項」の記事を確認し、API に適用できるものを確認します", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "ノードが大きくなると、パフォーマンスが向上し、エフェメラル ディスクや高速ネットワークなどの機能が提供されますが、爆発半径が大きくなり、スケーリングの粒度が低下します", - "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", - "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", - "service": "AKS", - "severity": "高い", - "text": "大きすぎず小さすぎない適切なノードサイズを検討してください", - "waf": "パフォーマンス" + "checklist": "Azure API Management Review", + "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", + "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", + "service": "APIM", + "severity": "中程度", + "text": "承認機能を使用して、バックエンド API の OAuth 2.0 トークンの管理を簡素化します", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", - "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", - "service": "AKS", - "severity": "低い", - "text": "スケーラビリティのために 5,000 を超えるノードが必要な場合は、追加の AKS クラスターの使用を検討してください", - "waf": "パフォーマンス" + "checklist": "Azure API Management Review", + "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", + "service": "APIM", + "severity": "高い", + "text": "転送中の情報を暗号化する場合は、最新のTLSバージョンを使用します。可能であれば、古くて不要なプロトコルと暗号を無効にします。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", - "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", - "service": "AKS", - "severity": "低い", - "text": "AKS 自動化のために EventGrid イベントをサブスクライブすることを検討する", - "waf": "パフォーマンス" + "checklist": "Azure API Management Review", + "guid": "f8af3d94-1d2b-4070-846f-849197524258", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", + "service": "APIM", + "severity": "高い", + "text": "シークレット (名前付き値) が Azure Key Vault に格納され、安全にアクセスして更新できるようにする", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", - "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", - "service": "AKS", - "severity": "低い", - "text": "AKS クラスターで実行時間の長い操作を行う場合は、イベントの終了を検討してください", - "waf": "パフォーマンス" + "checklist": "Azure API Management Review", + "guid": "791abd8b-7706-4e31-9569-afefde724be3", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", + "service": "APIM", + "severity": "中程度", + "text": "可能な限りマネージド ID を使用して、他の Azure リソースに対する認証を行う", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", - "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", - "service": "AKS", - "severity": "低い", - "text": "必要に応じて、AKS ノードに Azure Dedicated Hosts を使用することを検討してください", - "waf": "パフォーマンス" + "checklist": "Azure API Management Review", + "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", + "service": "APIM", + "severity": "高い", + "text": "Web アプリケーション ファイアウォール (WAF) を使用するには、APIM の前に Application Gateway をデプロイします", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", - "guid": "24367b33-6971-45b1-952b-eee0b9b588de", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "checklist": "Cognitive Search Review Checklist", + "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", "severity": "高い", - "text": "エフェメラル OS ディスクを使用する", - "waf": "パフォーマンス" + "text": "2 つのレプリカで読み取り操作の可用性を 99.9% にする", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "AKS", - "severity": "高い", - "text": "非エフェメラル ディスクの場合、複数のポッドを実行するには高いパフォーマンスが必要であり、既定の AKS ログ ローテーションしきい値で巨大なログが生成されるため、多くのポッド/ノードを実行する場合は、ノードに高い IOPS とより大きな OS ディスクを使用します", - "waf": "パフォーマンス" + "checklist": "Cognitive Search Review Checklist", + "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", + "severity": "中程度", + "text": "3 つのレプリカで読み取り/書き込み操作の可用性を 99.9% に向上させる", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", - "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", - "service": "AKS", - "severity": "低い", - "text": "ハイパー パフォーマンス ストレージ オプションの場合は、AKS 上の Ultra Disks を使用します", - "waf": "パフォーマンス" + "checklist": "Cognitive Search Review Checklist", + "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", + "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", + "service": "Cognitive Search", + "severity": "高い", + "text": "読み取りレプリカや書き込みレプリカを有効にすることでアベイラビリティーゾーンを活用する", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", - "service": "AKS", + "checklist": "Cognitive Search Review Checklist", + "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", + "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", + "service": "Cognitive Search", "severity": "中程度", - "text": "クラスター内に状態を保持することは避け、外部 (AzStorage、AzSQL、Cosmos など) にデータを格納します", - "waf": "パフォーマンス" + "text": "リージョンの冗長性については、地理的リージョン間で検索インデックスをレプリケートする自動化された方法が提供されないため、検索用に 2 つ以上のリージョンにサービスを手動で作成します", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", - "service": "AKS", + "checklist": "Cognitive Search Review Checklist", + "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", + "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", + "service": "Cognitive Search", "severity": "中程度", - "text": "AzFiles Standard を使用する場合は、パフォーマンス上の理由から AzFiles Premium や ANF を検討してください", - "waf": "パフォーマンス" + "text": "複数のサービス間でデータを同期するには、複数のサービスでコンテンツを更新するためにインデクサーを使用するか、複数のサービスでコンテンツの更新をプッシュするために REST API を使用する", + "waf": "確実" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", - "service": "AKS", + "checklist": "Cognitive Search Review Checklist", + "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", + "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", + "service": "Cognitive Search", "severity": "中程度", - "text": "Azure ディスクと AZ を使用する場合は、適切なゾーンにストレージをプロビジョニングするために VolumeBindingMode:WaitForFirstConsumer を使用して LRS ディスクのゾーン内にノードプールを配置するか、複数のゾーンにまたがるノードプールに ZRS ディスクを使用することを検討してください", - "waf": "パフォーマンス" + "text": "Azure Traffic Manager を使用して要求を調整する", + "waf": "確実" + }, + { + "checklist": "Cognitive Search Review Checklist", + "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", + "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", + "service": "Cognitive Search", + "severity": "高い", + "text": "Azure Cognitive Search インデックスをバックアップおよび復元します。このサンプル コードを使用して、インデックス定義とスナップショットを一連の Json ファイルにバックアップします", + "waf": "確実" }, { "checklist": "MySQL Review Checklist", @@ -7773,54 +7618,209 @@ "waf": "確実" }, { - "checklist": "Device Provisioning Service Review", - "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", - "service": "IoT Hub DPS", + "checklist": "Azure Data Factory Review Checklist", + "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", + "service": "Azure Data Factory", + "severity": "中程度", + "text": "Azure Data Factory の FTA 回復性プレイブックの活用", + "waf": "確実" + }, + { + "checklist": "Azure Data Factory Review Checklist", + "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "高い", - "text": "ビジネスと SLO の要件に基づいて適切なロジック アプリのホスティング プランを選択する", + "text": "Availability Zones をサポートするリージョンでゾーン冗長パイプラインを使用するUse zone redundant pipelines in regions that support Availability Zones", "waf": "確実" }, { - "checklist": "Device Provisioning Service Review", - "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "IoT Hub DPS", + "checklist": "Azure Data Factory Review Checklist", + "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", + "link": "https://learn.microsoft.com/azure/data-factory/source-control", + "service": "Azure Data Factory", + "severity": "中程度", + "text": "DevOps を使用して Github と Azure DevOps の統合で ARM テンプレートをバックアップする", + "waf": "確実" + }, + { + "checklist": "Azure Data Factory Review Checklist", + "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", + "severity": "中程度", + "text": "セルフホステッド統合ランタイム VM を別のリージョンにレプリケートしてください", + "waf": "確実" + }, + { + "checklist": "Azure Data Factory Review Checklist", + "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", + "severity": "中程度", + "text": "必ず、姉妹リージョンでネットワークをレプリケートまたは複製してください。別のリージョンに VNet のコピーを作成する必要があります", + "waf": "確実" + }, + { + "checklist": "Azure Data Factory Review Checklist", + "description": "ADF パイプラインで Key Vault が使用されている場合は、Key Vault をレプリケートするために何もする必要はありません。Key Vault はマネージド サービスであり、Microsoft が処理します", + "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Azure Data Factory", + "severity": "低い", + "text": "Keyvault 統合を使用している場合は、Keyvault の SLA を使用して可用性を把握します", + "waf": "確実" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub は、保存データの暗号化を提供します。独自のキーを使用する場合、データは引き続き Microsoft マネージド キーを使用して暗号化されますが、さらに Microsoft マネージド キーはカスタマー マネージド キーを使用して暗号化されます。", + "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", + "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", + "service": "Event Hubs", + "severity": "低い", + "text": "必要に応じて、保存データの暗号化でカスタマー マネージド キー オプションを使用する", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "安全" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hubs 名前空間を使用すると、クライアントは TLS 1.0 以降でデータを送受信できます。より厳格なセキュリティ対策を適用するには、クライアントが新しいバージョンの TLS を使用してデータを送受信するように Event Hubs 名前空間を構成できます。Event Hubs 名前空間で TLS の最小バージョンが必要な場合、古いバージョンで行われた要求はすべて失敗します。", + "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", + "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", + "service": "Event Hubs", + "severity": "中程度", + "text": "要求に最低限必要なバージョンのトランスポート層セキュリティ (TLS) を適用する", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "安全" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Event Hubs 名前空間を作成すると、名前空間に対して RootManageSharedAccessKey という名前のポリシー規則が自動的に作成されます。このポリシーには、名前空間全体に対する管理アクセス許可があります。このルールは、管理ルートアカウントのように扱い、アプリケーションでは使用しないことをお勧めします。RBAC で認証プロバイダーとして AAD を使用することをお勧めします。", + "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", + "service": "Event Hubs", + "severity": "中程度", + "text": "必要のない場合はrootアカウントの使用を避けてください", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", + "waf": "安全" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Azure リソースのマネージド ID は、Azure Virtual Machines (VM)、関数アプリ、Virtual Machine Scale Sets、その他のサービスで実行されているアプリケーションから Azure AD 資格情報を使用して、Event Hubs リソースへのアクセスを承認できます。Azure リソースのマネージド ID を Azure AD 認証と共に使用することで、クラウドで実行されるアプリケーションに資格情報を格納することを回避できます。", + "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", + "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", + "service": "Event Hubs", + "severity": "中程度", + "text": "可能な場合は、アプリケーションでマネージド ID を使用して Azure Event Hub に対する認証を行う必要があります。そうでない場合は、ストレージ資格情報 (SAS、サービス プリンシパル資格情報) を Azure Key Vault または同等のサービスに用意することを検討してください", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "安全" + }, + { + "checklist": "Azure Event Hub Review", + "description": "アクセス許可を作成するときは、Azure Event Hub へのクライアントのアクセスをきめ細かく制御します。Azure Event Hub のアクセス許可は、個々のリソース レベル (コンシューマー グループ、イベント ハブ エンティティ、イベント ハブ名前空間など) にスコープを設定する必要があり、またそうする必要があります。", + "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", + "service": "Event Hubs", "severity": "高い", - "text": "ゾーンの冗長性と可用性ゾーンを使用してリージョンの障害からロジック アプリを保護する", + "text": "最小特権データ プレーン RBAC を使用する", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "安全" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub リソース ログには、操作ログ、仮想ネットワーク、Kafka ログが含まれます。ランタイム監査ログは、Event Hubs のすべてのデータ プレーン アクセス操作 (イベントの送受信など) に関する集計された診断情報をキャプチャします。", + "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", + "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", + "service": "Event Hubs", + "severity": "中程度", + "text": "セキュリティ調査のログ記録を有効にします。Azure Monitor を使用して、リソース ログ、ランタイム監査ログ、Kafka ログなどのメトリックとログをキャプチャします", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "安全" + }, + { + "checklist": "Azure Event Hub Review", + "description": "既定では、Azure Event Hub にはパブリック IP アドレスがあり、インターネットに到達できます。プライベート エンドポイントを使用すると、仮想ネットワークと Azure Event Hub の間のトラフィックが Microsoft のバックボーン ネットワークを経由するようになります。それに加えて、パブリックエンドポイントを使用しない場合は無効にする必要があります。", + "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", + "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", + "service": "Event Hubs", + "severity": "中程度", + "text": "プライベート エンドポイントを使用して Azure Event Hub にアクセスし、該当する場合はパブリック ネットワーク アクセスを無効にすることを検討してください。", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "安全" + }, + { + "checklist": "Azure Event Hub Review", + "description": "IP ファイアウォールを使用すると、パブリック エンドポイントを、CIDR (Classless Inter-Domain Routing) 表記の一連の IPv4 アドレスまたは IPv4 アドレス範囲のみに制限できます。", + "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", + "service": "Event Hubs", + "severity": "中程度", + "text": "特定の IP アドレスまたは範囲からの Azure Event Hub 名前空間へのアクセスのみを許可することを検討してください", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "安全" + }, + { + "checklist": "Azure Event Hub Review", + "guid": "31d41e36-11c8-417b-8afb-c410d4391898", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", + "service": "Event Hubs", + "severity": "中程度", + "text": "FTAレジリエンシーハンドブックの活用", "waf": "確実" }, { - "checklist": "Device Provisioning Service Review", - "guid": "8aed4fbf-0830-4883-899d-222a154af478", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "IoT Hub DPS", + "checklist": "Azure Event Hub Review", + "description": "これは、ゾーン対応リージョンの Premium、Dedicated、または Standard SKU を使用してポータルから作成された新しい EH 名前空間に対して自動的にオンになります。EH メタデータとイベント データ自体の両方がゾーン間でレプリケートされます", + "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", + "service": "Event Hubs", "severity": "高い", - "text": "重要なワークロードに対するリージョン間 DR 戦略を検討する", + "text": "Availability Zones の活用 (地域的に適用可能な場合)", "waf": "確実" }, { - "checklist": "Device Provisioning Service Review", - "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "IoT Hub DPS", + "checklist": "Azure Event Hub Review", + "guid": "20b56c56-ad58-4519-8f82-735c586bb281", + "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", + "service": "Event Hubs", + "severity": "中程度", + "text": "予測可能なパフォーマンスのために Premium または Dedicated SKU を使用する", + "waf": "確実" + }, + { + "checklist": "Azure Event Hub Review", + "description": "組み込みの geo ディザスター リカバリー機能を有効にすると、名前空間の構成全体 (Event Hubs、コンシューマー グループ、設定) がプライマリ名前空間からセカンダリ名前空間に継続的にレプリケートされ、プライマリからセカンダリへのフェールオーバーをいつでも 1 回だけ行うことができます。アクティブ/パッシブ機能は、アプリケーション構成を変更することなく、障害が発生した Azure リージョンからの復旧と破棄を容易にするように設計されています", + "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", + "service": "Event Hubs", "severity": "高い", - "text": "分離環境にデプロイする場合は、App Service Environment (ASE) v3 を使用するか、それらに移行します", + "text": "アクティブ パッシブ構成を使用した Geo ディザスター リカバリーの計画", "waf": "確実" }, { - "checklist": "Device Provisioning Service Review", - "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "IoT Hub DPS", + "checklist": "Azure Event Hub Review", + "description": "ダウンしたリージョンでのイベントデータの停止または損失を許容できない DR 構成に使用する必要があります。このような場合は、レプリケーションのガイダンスに従い、組み込みの geo ディザスター リカバリー機能 (アクティブ/パッシブ) を使用しないでください。アクティブ/アクティブでは、異なるリージョンと名前空間で複数の Event Hubs を保持し、イベントはハブ間でレプリケートされます", + "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", + "service": "Event Hubs", "severity": "中程度", - "text": "Azure DevOps または GitHub を活用して CI/CD を合理化し、ロジック アプリ コードを保護", - "waf": "オペレーションズ" + "text": "ビジネス クリティカルなアプリケーションの場合は、アクティブ アクティブ構成を使用します", + "waf": "確実" + }, + { + "checklist": "Azure Event Hub Review", + "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", + "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", + "service": "Event Hubs", + "severity": "中程度", + "text": "回復力のある Event Hubs の設計", + "waf": "確実" } ], "metadata": { "name": "WAF checklist", - "timestamp": "June 17, 2024" + "timestamp": "June 24, 2024" }, "severities": [ { @@ -7848,7 +7848,7 @@ }, { "description": "推奨事項は理解されているが、現在の要件では不要", - "name": "必要なし" + "name": "リスクの受け入れ" }, { "description": "現在のデザインには適用されません", diff --git a/checklists/waf_checklist.ko.json b/checklists/waf_checklist.ko.json index 3aed1e2e2..e1312fbf2 100644 --- a/checklists/waf_checklist.ko.json +++ b/checklists/waf_checklist.ko.json @@ -1,7826 +1,7826 @@ { "items": [ { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub는 미사용 데이터의 암호화를 제공합니다. 사용자 고유의 키를 사용하는 경우 데이터는 여전히 Microsoft 관리형 키를 사용하여 암호화되지만 Microsoft 관리형 키는 고객 관리형 키를 사용하여 암호화됩니다. ", - "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", - "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", + "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", + "service": "AKS", "severity": "낮다", - "text": "필요한 경우 미사용 데이터 암호화에서 고객 관리형 키 옵션 사용Use customer-managed key option in data at rest encryption when required", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "안전" + "text": "AKS Windows 워크로드에 필요한 경우 HostProcess 컨테이너를 사용할 수 있습니다.", + "waf": "신뢰도" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hubs 네임스페이스를 사용하면 클라이언트가 TLS 1.0 이상을 사용하여 데이터를 보내고 받을 수 있습니다. 더 엄격한 보안 조치를 적용하기 위해 클라이언트가 최신 버전의 TLS를 사용하여 데이터를 보내고 받도록 Event Hubs 네임스페이스를 구성할 수 있습니다. Event Hubs 네임스페이스에 최소 버전의 TLS가 필요한 경우 이전 버전으로 수행된 모든 요청이 실패합니다. ", - "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", - "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", - "service": "Event Hubs", - "severity": "보통", - "text": "요청에 필요한 최소 버전의 TLS(전송 계층 보안) 적용 ", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", + "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", + "service": "AKS", + "severity": "낮다", + "text": "이벤트 기반 워크로드를 실행하는 경우 KEDA 사용Use KEDA if running event-driven workloads", + "waf": "공연" }, { - "checklist": "Azure Event Hub Review", - "description": "Event Hubs 네임스페이스를 만들 때 네임스페이스에 대해 RootManageSharedAccessKey라는 정책 규칙이 자동으로 만들어집니다. 이 정책에는 전체 네임스페이스에 대한 관리 권한이 있습니다. 이 규칙을 관리 루트 계정처럼 취급하고 응용 프로그램에서 사용하지 않는 것이 좋습니다. RBAC에서 AAD를 인증 공급자로 사용하는 것이 좋습니다. ", - "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", - "service": "Event Hubs", - "severity": "보통", - "text": "필요하지 않은 경우 루트 계정을 사용하지 마십시오.", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", + "link": "https://dapr.io/", + "service": "AKS", + "severity": "낮다", + "text": "Dapr을 사용하여 마이크로 서비스 개발 용이", + "waf": "작업" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure 리소스에 대한 관리 ID는 Azure VM(Virtual Machines), 함수 앱, Virtual Machine Scale Sets 및 기타 서비스에서 실행되는 애플리케이션에서 Azure AD 자격 증명을 사용하여 Event Hubs 리소스에 대한 액세스 권한을 부여할 수 있습니다. Azure AD 인증과 함께 Azure 리소스에 대한 관리 ID를 사용하면 클라우드에서 실행되는 애플리케이션에 자격 증명을 저장하지 않아도 됩니다. ", - "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", - "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", - "service": "Event Hubs", - "severity": "보통", - "text": "가능한 경우 애플리케이션은 관리 ID를 사용하여 Azure Event Hub에 인증해야 합니다. 그렇지 않은 경우 Azure Key Vault 또는 동등한 서비스에 스토리지 자격 증명(SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", + "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", + "link": "https://learn.microsoft.com/azure/aks/uptime-sla", + "service": "AKS", + "severity": "높다", + "text": "SLA 지원 AKS 제품 사용", + "waf": "신뢰도" }, { - "checklist": "Azure Event Hub Review", - "description": "권한을 만들 때 Azure Event Hub에 대한 클라이언트의 액세스를 세밀하게 제어할 수 있습니다. Azure Event Hub의 사용 권한은 개별 리소스 수준(예: 소비자 그룹, 이벤트 허브 엔터티, 이벤트 허브 네임스페이스 등)으로 범위를 지정할 수 있으며 범위가 지정되어야 합니다.", - "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", + "severity": "낮다", + "text": "Pod 및 배포 정의에서 중단 예산 사용Use Disruption Budgets in your pod and deployment definitions", + "waf": "신뢰도" + }, + { + "checklist": "Azure AKS Review", + "guid": "3c763963-7a55-42d5-a15e-401955387e5c", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", + "service": "ACR", "severity": "높다", - "text": "최소 권한 데이터 평면 RBAC 사용", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "안전" + "text": "개인 레지스트리를 사용하는 경우 여러 지역에 이미지를 저장하도록 지역 복제를 구성합니다", + "waf": "신뢰도" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub 리소스 로그에는 작업 로그, 가상 네트워크 및 Kafka 로그가 포함됩니다. 런타임 감사 로그는 Event Hubs의 모든 데이터 평면 액세스 작업(예: 이벤트 보내기 또는 받기)에 대해 집계된 진단 정보를 캡처합니다.", - "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", - "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", - "service": "Event Hubs", - "severity": "보통", - "text": "보안 조사를 위해 로깅을 사용하도록 설정합니다. Azure Monitor를 사용하여 리소스 로그, 런타임 감사 로그 및 Kafka 로그와 같은 메트릭 및 로그를 캡처합니다.", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", + "service": "AKS", + "severity": "낮다", + "text": "kubecost와 같은 외부 애플리케이션을 사용하여 다른 사용자에게 비용 할당", + "waf": "비용" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure Event Hub는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 가상 네트워크와 Azure Event Hub 간의 트래픽이 Microsoft 백본 네트워크를 통해 트래버스할 수 있습니다. 또한 퍼블릭 엔드포인트를 사용하지 않는 경우 사용하지 않도록 설정해야 합니다. ", - "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", - "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", - "service": "Event Hubs", - "severity": "보통", - "text": "프라이빗 엔드포인트를 사용하여 Azure Event Hub에 액세스하고 해당하는 경우 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", + "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", + "service": "AKS", + "severity": "낮다", + "text": "축소 모드를 사용하여 노드 삭제/할당 취소", + "waf": "비용" }, { - "checklist": "Azure Event Hub Review", - "description": "IP 방화벽을 사용하면 퍼블릭 엔드포인트를 CIDR(Classless Inter-Domain Routing) 표기법의 IPv4 주소 또는 IPv4 주소 범위 집합으로만 추가로 제한할 수 있습니다. ", - "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", + "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", + "service": "AKS", "severity": "보통", - "text": "특정 IP 주소 또는 범위에서 Azure Event Hub 네임스페이스에 대한 액세스만 허용하는 것이 좋습니다", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "안전" + "text": "필요한 경우 AKS 클러스터에서 다중 인스턴스 분할 GPU 사용", + "waf": "비용" }, { - "checklist": "Azure Event Hub Review", - "guid": "31d41e36-11c8-417b-8afb-c410d4391898", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", - "service": "Event Hubs", - "severity": "보통", - "text": "FTA 탄력성 핸드북 활용", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", + "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", + "service": "AKS", + "severity": "낮다", + "text": "개발/테스트 클러스터를 실행하는 경우 NodePool 시작/중지를 사용합니다.", + "waf": "비용" }, { - "checklist": "Azure Event Hub Review", - "description": " 영역 사용 지역의 프리미엄, 전용 또는 표준 SKU를 사용하여 포털에서 만든 새 EH 네임스페이스에 대해 자동으로 설정됩니다. EH 메타데이터와 이벤트 데이터 자체는 모두 영역 간에 복제됩니다", - "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", - "service": "Event Hubs", - "severity": "높다", - "text": "지역적으로 적용 가능한 경우 가용성 영역 활용Leverage Availability Zones if regionally applicable", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", + "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", + "service": "AKS", + "severity": "보통", + "text": "Kubernetes용 Azure Policy를 사용하여 클러스터 규정 준수 보장", + "waf": "안전" }, { - "checklist": "Azure Event Hub Review", - "guid": "20b56c56-ad58-4519-8f82-735c586bb281", - "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", + "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "severity": "보통", - "text": "예측 가능한 성능을 위해 프리미엄 또는 전용 SKU 사용", - "waf": "신뢰도" + "text": "사용자/시스템 노드 풀이 있는 컨트롤 플레인에서 응용 프로그램 분리", + "waf": "안전" }, { - "checklist": "Azure Event Hub Review", - "description": "기본 제공 지역 재해 복구 기능을 사용하도록 설정하면 네임스페이스(Event Hubs, 소비자 그룹 및 설정)의 전체 구성이 기본 네임스페이스에서 보조 네임스페이스로 지속적으로 복제되며, 언제든지 한 번만 장애 조치(failover)를 주 네임스페이스에서 보조 네임스페이스로 이동할 수 있습니다. 활성/수동 기능은 애플리케이션 구성을 변경할 필요 없이 실패한 Azure 지역에서 더 쉽게 복구하고 중단할 수 있도록 설계되었습니다", - "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", - "service": "Event Hubs", - "severity": "높다", - "text": "Active Passive 구성을 사용하여 지역 재해 복구 계획Plan for Geo Disaster Recovery using Active Passive configuration", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", + "severity": "낮다", + "text": "시스템 nodepool에 taint를 추가하여 전용으로 만듭니다.", + "waf": "안전" }, { - "checklist": "Azure Event Hub Review", - "description": "다운된 지역에서 이벤트 데이터의 중단 또는 손실을 허용할 수 없는 DR 구성에 사용해야 합니다. 이러한 경우 복제 지침을 따르고 기본 제공 지역 재해 복구 기능(활성/수동)을 사용하지 마세요. 액티브/액티브를 사용하여 서로 다른 지역 및 네임스페이스에서 여러 Event Hubs를 유지 관리하면 허브 간에 이벤트가 복제됩니다", - "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", - "service": "Event Hubs", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", + "link": "https://learn.microsoft.com/azure/container-registry/", + "service": "AKS", "severity": "보통", - "text": "Business Critical Applications의 경우 Active Active 구성을 사용합니다.", - "waf": "신뢰도" + "text": "이미지에 개인 레지스트리(예: ACR) 사용", + "waf": "안전" }, { - "checklist": "Azure Event Hub Review", - "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", - "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", - "service": "Event Hubs", + "checklist": "Azure AKS Review", + "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", + "link": "https://learn.microsoft.com/azure/security-center/container-security", + "service": "ACR", "severity": "보통", - "text": "복원력 있는 Event Hubs 설계", - "waf": "신뢰도" + "text": "이미지에서 취약성 검사", + "waf": "안전" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", + "service": "AKS", "severity": "높다", - "text": "읽기 작업에 대해 99.9%의 가용성을 갖도록 복제본 2개 사용", - "waf": "신뢰도" + "text": "앱 분리 요구 사항 정의(네임스페이스/노드 풀/클러스터)", + "waf": "안전" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", + "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", + "service": "AKS", "severity": "보통", - "text": "읽기/쓰기 작업에 대해 99.9%의 가용성을 갖도록 복제본 3개 사용", - "waf": "신뢰도" + "text": "CSI 비밀 저장소 드라이버를 사용하여 Azure Key Vault에 비밀 저장", + "waf": "안전" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", - "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", - "service": "Cognitive Search", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", + "link": "https://learn.microsoft.com/azure/aks/update-credentials", + "service": "AKS", "severity": "높다", - "text": "읽기 및/또는 쓰기 복제본을 활성화하여 가용 영역 활용Leverage Availability Zones by enabling read and/or write replicas", - "waf": "신뢰도" + "text": "클러스터에 서비스 주체를 사용하는 경우 주기적으로(예: 분기별) 자격 증명을 새로 고칩니다", + "waf": "안전" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", - "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", - "service": "Cognitive Search", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", + "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", + "service": "AKS", "severity": "보통", - "text": "지역 중복의 경우 Manually create services in 2 or more regions for Search는 지리적 지역 간에 검색 인덱스를 복제하는 자동화된 방법을 제공하지 않습니다", - "waf": "신뢰도" + "text": "필요한 경우 키 관리 서비스 etcd 암호화를 추가합니다.", + "waf": "안전" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", - "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", - "service": "Cognitive Search", - "severity": "보통", - "text": "여러 서비스에서 데이터를 동기화하려면 인덱서를 사용하여 여러 서비스의 콘텐츠를 업데이트하거나 REST API를 사용하여 여러 서비스에서 콘텐츠 업데이트를 푸시합니다.", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", + "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", + "service": "AKS", + "severity": "낮다", + "text": "필요한 경우 AKS용 기밀 컴퓨팅을 사용하는 것이 좋습니다.", + "waf": "안전" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", - "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", - "service": "Cognitive Search", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", + "service": "AKS", "severity": "보통", - "text": "Azure Traffic Manager를 사용하여 요청 조정", - "waf": "신뢰도" - }, - { - "checklist": "Cognitive Search Review Checklist", - "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", - "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", - "service": "Cognitive Search", - "severity": "높다", - "text": "Azure Cognitive Search 인덱스를 백업 및 복원합니다. 이 샘플 코드를 사용하여 인덱스 정의 및 스냅샷을 일련의 Json 파일에 백업합니다", - "waf": "신뢰도" - }, - { - "checklist": "Device Provisioning Service Review", - "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", - "service": "IoT Hub DPS", - "severity": "높다", - "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 Logic App 호스팅 계획 선택Select the right Logic App hosting plan based on your business & SLO requirements", - "waf": "신뢰도" - }, - { - "checklist": "Device Provisioning Service Review", - "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "IoT Hub DPS", - "severity": "높다", - "text": "영역 중복 및 가용성 영역을 사용하여 지역 오류로부터 논리 앱 보호Protect logic apps from region failures with zone redundancy and availability zones", - "waf": "신뢰도" + "text": "컨테이너용 Defender 사용 고려", + "waf": "안전" }, { - "checklist": "Device Provisioning Service Review", - "guid": "8aed4fbf-0830-4883-899d-222a154af478", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "IoT Hub DPS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", + "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", + "service": "AKS", "severity": "높다", - "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려", - "waf": "신뢰도" + "text": "서비스 주체 대신 관리 ID 사용", + "waf": "안전" }, { - "checklist": "Device Provisioning Service Review", - "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "IoT Hub DPS", - "severity": "높다", - "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", + "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", + "link": "https://learn.microsoft.com/azure/aks/managed-aad", + "service": "AKS", + "severity": "보통", + "text": "AAD와 인증 통합(관리형 통합 사용)", + "waf": "안전" }, { - "checklist": "Device Provisioning Service Review", - "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "IoT Hub DPS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", + "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", + "service": "AKS", "severity": "보통", - "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 논리 앱 코드를 보호합니다.", - "waf": "작업" + "text": "관리자 kubeconfig에 대한 액세스 제한(get-credentials --admin)", + "waf": "안전" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", - "service": "Azure Data Factory", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", + "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", + "service": "AKS", "severity": "보통", - "text": "Azure Data Factory에 대한 FTA 복원력 플레이북 활용", - "waf": "신뢰도" + "text": "AAD RBAC와 권한 부여 통합", + "waf": "안전" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", + "service": "AKS", "severity": "높다", - "text": "가용성 영역을 지원하는 지역에서 영역 중복 파이프라인 사용Use zone redundant pipelines in regions that support Availability Zones", - "waf": "신뢰도" + "text": "쿠버네티스에서 RBAC 권한을 제한하기 위해 네임스페이스 사용", + "waf": "안전" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", - "link": "https://learn.microsoft.com/azure/data-factory/source-control", - "service": "Azure Data Factory", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", + "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", + "service": "AKS", "severity": "보통", - "text": "DevOps를 사용하여 Github/Azure DevOps 통합으로 ARM 템플릿 백업 ", - "waf": "신뢰도" + "text": "Pod ID 액세스 관리의 경우 Azure AD 워크로드 ID(미리 보기)를 사용합니다.", + "waf": "안전" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", + "service": "AKS", "severity": "보통", - "text": "다른 지역에서 자체 호스팅 통합 런타임 VM을 복제해야 합니다. ", - "waf": "신뢰도" + "text": "AKS 비대화형 로그인의 경우 kubelogin(미리 보기)을 사용합니다.", + "waf": "안전" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", + "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", + "service": "AKS", "severity": "보통", - "text": "자매 지역에서 네트워크를 복제하거나 복제해야 합니다. 다른 지역에서 Vnet의 복사본을 만들어야 합니다", - "waf": "신뢰도" + "text": "AKS 로컬 계정 사용 안 함", + "waf": "안전" }, { - "checklist": "Azure Data Factory Review Checklist", - "description": "ADF 파이프라인에서 Key Vault를 사용하는 경우 Key Vault를 복제하기 위해 아무 작업도 수행할 필요가 없습니다. Key Vault는 관리되는 서비스이며 Microsoft에서 처리합니다", - "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Azure Data Factory", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", + "service": "AKS", "severity": "낮다", - "text": "Keyvault 통합을 사용하는 경우 Keyvault의 SLA를 사용하여 가용성을 파악합니다", - "waf": "신뢰도" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Front Door", - "severity": "보통", - "text": "Azure Front Door에서 고객 관리형 TLS 인증서를 사용하는 경우 '최신' 인증서 버전을 사용합니다. 수동 인증서 갱신으로 인한 중단 위험 감소", - "waf": "작업" + "text": "필요한 경우 Just-in-time 클러스터 액세스 구성", + "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", - "guid": "553585a6-abe0-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "App Gateway", - "severity": "보통", - "text": "Application Gateway v2 SKU를 사용하고 있는지 확인합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", + "service": "AKS", + "severity": "낮다", + "text": "AKS에 필요한 경우 AAD 조건부 액세스 구성", "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", - "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Load Balancer", - "severity": "보통", - "text": "Azure Load Balancer에 표준 SKU를 사용하고 있는지 확인합니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", + "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", + "service": "AKS", + "severity": "낮다", + "text": "Windows AKS 워크로드에 필요한 경우 gMSA를 구성합니다. ", "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "9432621a-8397-4654-a882-5bc856b7ef83", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", - "service": "Load Balancer", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", + "service": "AKS", "severity": "보통", - "text": "Load Balancer 프런트 엔드 IP 주소가 영역 중복인지 확인합니다(영역 프런트 엔드가 필요하지 않은 경우).", + "text": "더 세밀하게 제어하려면 관리형 Kubelet ID를 사용하는 것이 좋습니다.", "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", - "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "App Gateway", - "severity": "보통", - "text": "Application Gateway v2는 IP 접두사가 /24보다 크거나 같은 서브넷에 배포해야 합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "안전" - }, - { - "checklist": "Azure Application Delivery Networking", - "description": "일반적으로 역방향 프록시 및 특히 WAF의 관리는 네트워킹보다 애플리케이션에 더 가깝기 때문에 앱과 동일한 구독에 속합니다. 연결 구독에서 Application Gateway 및 WAF를 중앙 집중화하는 것은 단일 팀에서 관리하는 경우 괜찮을 수 있습니다.", - "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", + "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", + "service": "AKS", "severity": "보통", - "text": "랜딩 영역 가상 네트워크 내에서 그리고 보안 중인 앱을 사용하여 인바운드 HTTP(S) 연결을 프록시하는 데 사용되는 Azure Application Gateway v2 또는 파트너 NVA를 배포합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "안전" + "text": "AGIC를 사용하는 경우 클러스터 간에 AppGW를 공유하지 마세요", + "waf": "신뢰도" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", - "severity": "보통", - "text": "애플리케이션 랜딩 존의 모든 공용 IP 주소에 대해 DDoS 네트워크 또는 IP 보호 계획을 사용합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", + "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", + "link": "https://learn.microsoft.com/azure/aks/http-application-routing", + "service": "AKS", + "severity": "높다", + "text": "AKS HTTP 라우팅 추가 기능을 사용하지 말고, 애플리케이션 라우팅 추가 기능과 함께 관리되는 NGINX 수신을 대신 사용합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", - "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", + "service": "AKS", "severity": "보통", - "text": "최소 인스턴스 수를 2개로 자동 크기 조정을 구성합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "신뢰도" + "text": "Windows 워크로드의 경우 가속화된 네트워킹을 사용합니다.", + "waf": "공연" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", - "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", - "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", - "service": "App Gateway", - "severity": "보통", - "text": "가용성 영역에 Application Gateway 배포", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", + "guid": "ba7da7be-9952-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", + "severity": "높다", + "text": "표준 ALB 사용(기본 ALB와 반대)", "waf": "신뢰도" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", + "service": "AKS", "severity": "보통", - "text": "WAF 정책과 함께 Azure Front Door를 사용하여 여러 Azure 지역에 걸쳐 있는 글로벌 HTTP/S 앱을 제공하고 보호할 수 있습니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Azure CNI를 사용하는 경우 NodePools에 다른 서브넷을 사용하는 것이 좋습니다.", "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3f29812b-2363-4cef-b179-b599de0d5973", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", + "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", + "service": "AKS", "severity": "보통", - "text": "Front Door 및 Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Front Door에서 WAF 정책을 사용합니다. Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "프라이빗 엔드포인트(기본 설정) 또는 Virtual Network 서비스 엔드포인트를 사용하여 클러스터에서 PaaS 서비스에 액세스", "waf": "안전" }, { - "ammp": true, - "arm-service": "microsoft.network/trafficManagerProfiles", - "checklist": "Azure Application Delivery Networking", - "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Traffic Manager", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", + "guid": "a0f61565-9de5-458f-a372-49c831112dbd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "severity": "높다", - "text": "Traffic Manager를 사용하여 HTTP/S 이외의 프로토콜에 걸쳐 있는 글로벌 앱을 제공합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "요구 사항에 가장 적합한 CNI 네트워크 플러그 인 선택(Azure CNI 권장)", "waf": "신뢰도" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", - "severity": "낮다", - "text": "사용자가 내부 애플리케이션에만 액세스해야 하는 경우 Microsoft Entra ID 애플리케이션 프록시가 AVD(Azure Virtual Desktop)의 대안으로 고려되었나요?", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "높다", + "text": "Azure CNI를 사용하는 경우 노드당 최대 Pod 수를 고려하여 서브넷 크기를 적절하게 조정합니다", + "waf": "공연" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", - "severity": "보통", - "text": "네트워크에서 들어오는 연결에 대해 열려 있는 방화벽 포트 수를 줄이려면 Microsoft Entra ID 애플리케이션 프록시를 사용하여 원격 사용자에게 내부 애플리케이션에 대한 안전하고 인증된 액세스를 제공하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "높다", + "text": "Azure CNI를 사용하는 경우 최대 Pod/노드(기본값 30)를 확인합니다.", + "waf": "공연" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "ae248989-b306-4591-9186-de482e3f0f0e", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "Front Door", - "severity": "높다", - "text": "'방지' 모드에서 Front Door에 대한 WAF 정책을 배포합니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "내부 앱의 경우 조직은 방화벽에서 전체 AKS 서브넷을 여는 경우가 많습니다. 이렇게 하면 노드에 대한 네트워크 액세스도 열리고 잠재적으로 Pod에 대한 액세스도 열립니다(Azure CNI를 사용하는 경우). LoadBalancer IP가 다른 서브넷에 있는 경우 앱 클라이언트에서 이 IP만 사용할 수 있어야 합니다. 또 다른 이유는 AKS 서브넷의 IP 주소가 부족한 리소스인 경우 서비스에 해당 IP 주소를 사용하면 클러스터의 최대 확장성이 감소하기 때문입니다.", + "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", + "link": "https://learn.microsoft.com/azure/aks/internal-lb", + "service": "AKS", + "severity": "낮다", + "text": "개인 IP LoadBalancer 서비스를 사용하는 경우 AKS 서브넷이 아닌 전용 서브넷을 사용합니다", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "severity": "높다", - "text": "Azure Traffic Manager와 Azure Front Door를 결합하지 마세요.", - "waf": "안전" + "text": "그에 따라 서비스 IP 주소 범위의 크기를 조정합니다(클러스터 확장성이 제한됨).", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "Front Door", - "severity": "높다", - "text": "Azure Front Door 및 원본에서 동일한 도메인 이름을 사용합니다. 호스트 이름이 일치하지 않으면 미묘한 버그가 발생할 수 있습니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", + "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", + "service": "AKS", + "severity": "낮다", + "text": "필요한 경우 자체 CNI 플러그인을 추가합니다.", "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", - "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", + "service": "AKS", "severity": "낮다", - "text": "Azure Front Door 원본 그룹에 원본이 하나만 있는 경우 상태 프로브를 사용하지 않도록 설정합니다.", + "text": "필요한 경우 AKS에서 노드당 공용 IP 구성", "waf": "공연" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", + "link": "https://learn.microsoft.com/azure/aks/concepts-network", + "service": "AKS", "severity": "보통", - "text": "Azure Front Door에 대한 양호한 상태 프로브 엔드포인트를 선택합니다. 애플리케이션의 모든 종속성을 확인하는 상태 엔드포인트를 빌드하는 것이 좋습니다.", + "text": "수신 컨트롤러를 사용하여 LoadBalancer 유형 서비스를 사용하여 노출하는 대신 웹 기반 앱을 노출합니다", "waf": "신뢰도" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", - "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", + "link": "https://learn.microsoft.com/azure/aks/nat-gateway", + "service": "AKS", "severity": "낮다", - "text": "Azure Front Door와 함께 HEAD 상태 프로브를 사용하여 Front Door가 애플리케이션으로 보내는 트래픽을 줄입니다.", - "waf": "공연" + "text": "송신 트래픽 크기 조정을 위해 Azure NAT Gateway를 outboundType으로 사용", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", - "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "Load Balancer", - "severity": "높다", - "text": "SNAT 확장성 향상을 위해 Load Balancer 아웃바운드 규칙 대신 Azure NAT Gateway 사용", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", + "service": "AKS", + "severity": "보통", + "text": "Azure CNI IP 소모를 방지하기 위해 IP의 동적 할당 사용", "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", - "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", + "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", + "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", + "service": "AKS", "severity": "높다", - "text": "Azure Front Door에서 관리형 TLS 인증서를 사용합니다. 운영 비용을 줄이고 인증서 갱신으로 인한 중단 위험을 줄입니다.", - "waf": "작업" + "text": "보안 요구 사항에 필요한 경우 AzFW/NVA를 사용하여 송신 트래픽 필터링", + "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", + "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", + "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", + "service": "AKS", "severity": "보통", - "text": "Azure Front Door WAF 구성을 코드로 정의합니다. 코드를 사용하면 새 규칙 집합 버전을 보다 쉽게 채택하고 추가 보호를 얻을 수 있습니다.", - "waf": "작업" + "text": "퍼블릭 API 엔드포인트를 사용하는 경우 액세스할 수 있는 IP 주소를 제한합니다", + "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", + "link": "https://learn.microsoft.com/azure/aks/private-clusters", + "service": "AKS", "severity": "높다", - "text": "Azure Front Door에서 엔드투엔드 TLS를 사용합니다. 클라이언트에서 Front Door로, Front Door에서 원본으로 연결하는 데 TLS를 사용합니다.", + "text": "요구 사항에 따라 개인 클러스터를 사용합니다", "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "severity": "보통", - "text": "Azure Front Door에서 HTTP에서 HTTPS로 리디렉션을 사용합니다. 이전 클라이언트를 HTTPS 요청으로 자동 리디렉션하여 지원합니다.", - "waf": "안전" - }, - { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", - "service": "Front Door", - "severity": "높다", - "text": "Azure Front Door WAF를 사용하도록 설정합니다. 다양한 공격으로부터 애플리케이션을 보호합니다.", + "text": "Windows 2019 및 2022 AKS 노드의 경우 Calico 네트워크 정책을 사용할 수 있습니다. ", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", + "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "severity": "높다", - "text": "워크로드에 맞게 Azure Front Door WAF를 튜닝합니다. 가양성 탐지를 줄입니다.", + "text": "Kubernetes 네트워크 정책 옵션 사용(Calico/Azure)", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "severity": "높다", - "text": "Azure Front Door WAF 정책에서 요청 본문 검사 기능을 사용하도록 설정합니다.", + "text": "쿠버네티스 네트워크 정책을 사용하여 클러스터 내 보안 강화", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "severity": "높다", - "text": "Azure Front Door WAF 기본 규칙 집합을 사용하도록 설정합니다. 기본 규칙 집합은 일반적인 공격을 탐지하고 차단합니다.", + "text": "웹 워크로드(UI 또는 API)에 WAF 사용Use a WAF for web workloads (UIs or APIs)", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", - "service": "Front Door", - "severity": "높다", - "text": "Azure Front Door WAF 봇 보호 규칙 집합을 사용하도록 설정합니다. 봇 규칙은 좋은 봇과 나쁜 봇을 감지합니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", + "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", + "service": "AKS", + "severity": "보통", + "text": "AKS Virtual Network에서 DDoS 표준 사용Use DDoS Standard in the AKS Virtual Network", "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", - "service": "Front Door", - "severity": "보통", - "text": "최신 Azure Front Door WAF 규칙 집합 버전을 사용합니다. 규칙 집합 업데이트는 현재 위협 환경을 고려하기 위해 정기적으로 업데이트됩니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", + "link": "https://learn.microsoft.com/azure/aks/http-proxy", + "service": "AKS", + "severity": "낮다", + "text": "필요한 경우 회사 HTTP 프록시를 추가합니다.", "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "b9620385-1cde-418f-914b-a84a06982ffc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", + "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", + "service": "AKS", "severity": "보통", - "text": "Azure Front Door WAF에 속도 제한을 추가합니다. 속도 제한은 클라이언트가 실수로 또는 의도적으로 짧은 시간에 많은 양의 트래픽을 보내는 것을 차단합니다.", + "text": "고급 마이크로서비스 통신 관리를 위해 서비스 메시를 사용하는 것이 좋습니다", "waf": "안전" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", - "service": "Front Door", - "severity": "보통", - "text": "Azure Front Door WAF 속도 제한에 높은 임계값을 사용합니다. 높은 속도 제한 임계값은 합법적인 트래픽 차단을 방지하는 동시에 인프라를 압도할 수 있는 매우 많은 수의 요청에 대한 보호 기능을 제공합니다. ", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", + "service": "AKS", + "severity": "높다", + "text": "가장 중요한 메트릭에 대한 경고 구성(권장 사항은 Container Insights 참조)", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "337453a3-cc63-4963-9a65-22ac19e80696", + "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", + "service": "AKS", "severity": "낮다", - "text": "모든 지역에서 트래픽이 발생하지 않을 것으로 예상되는 경우 지역 필터를 사용하여 예상하지 못한 국가의 트래픽을 차단합니다.", - "waf": "안전" + "text": "Azure Advisor에서 클러스터에 대한 권장 사항을 정기적으로 확인합니다.", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "00acd8a9-6975-414f-8491-2be6309893b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", - "service": "Front Door", - "severity": "보통", - "text": "Azure Front Door WAF를 사용하여 트래픽을 지리적으로 필터링할 때 알 수 없는(ZZ) 위치를 지정합니다. IP 주소를 지리적으로 일치시킬 수 없는 경우 합법적인 요청을 실수로 차단하지 않도록 합니다.", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", + "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", + "service": "AKS", + "severity": "낮다", + "text": "AKS 자동 인증서 회전 사용", + "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", - "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", + "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", + "service": "AKS", "severity": "높다", - "text": "Azure Application Gateway WAF 봇 보호 규칙 집합 사용Enable the Azure Application Gateway WAF bot protection rule set 봇 규칙은 좋은 봇과 나쁜 봇을 검색합니다.", - "waf": "안전" + "text": "kubernetes 버전을 주기적으로(예: 분기별) 업그레이드하거나 AKS 자동 업그레이드 기능을 사용하는 정기적인 프로세스가 있습니다.", + "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", + "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", + "service": "AKS", "severity": "높다", - "text": "Azure Application Gateway WAF 정책에서 요청 본문 검사 기능을 사용하도록 설정합니다.", - "waf": "안전" + "text": "node-image upgrade를 사용하지 않는 경우 Linux 노드 업그레이드에 kured를 사용합니다.", + "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", + "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", + "service": "AKS", "severity": "높다", - "text": "워크로드에 대한 Azure Application Gateway WAF를 조정합니다. 가양성 탐지를 줄입니다.", - "waf": "안전" + "text": "클러스터 노드 이미지를 주기적으로(예: 매주) 업그레이드하는 정기적인 프로세스가 있습니다.", + "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "App Gateway", - "severity": "높다", - "text": "'방지' 모드에서 Application Gateway에 대한 WAF 정책을 배포합니다.", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", + "service": "AKS", + "severity": "낮다", + "text": "gitops를 고려하여 애플리케이션 또는 클러스터 구성을 여러 클러스터에 배포합니다.", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", - "service": "App Gateway", - "severity": "보통", - "text": "Azure Application Gateway WAF에 속도 제한을 추가합니다. 속도 제한은 클라이언트가 실수로 또는 의도적으로 짧은 시간에 많은 양의 트래픽을 보내는 것을 차단합니다.", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d7672c26-7602-4482-85a4-14527fbe855c", + "link": "https://learn.microsoft.com/azure/aks/command-invoke", + "service": "AKS", + "severity": "낮다", + "text": "프라이빗 클러스터에서 AKS 명령 호출을 사용하는 것이 좋습니다.", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", - "service": "App Gateway", - "severity": "보통", - "text": "Azure Application Gateway WAF 속도 제한에 높은 임계값을 사용합니다. 높은 속도 제한 임계값은 합법적인 트래픽 차단을 방지하는 동시에 인프라를 압도할 수 있는 매우 많은 수의 요청에 대한 보호 기능을 제공합니다. ", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", + "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", + "service": "AKS", + "severity": "낮다", + "text": "계획된 이벤트의 경우 노드 자동 드레인 사용을 고려하십시오.", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "99937189-ff78-492a-b9ca-18d828d82b37", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", - "service": "App Gateway", - "severity": "낮다", - "text": "모든 지역에서 트래픽이 발생하지 않을 것으로 예상되는 경우 지역 필터를 사용하여 예상하지 못한 국가의 트래픽을 차단합니다.", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", + "link": "https://learn.microsoft.com/azure/aks/faq", + "service": "AKS", + "severity": "높다", + "text": "노드 RG(일명 '인프라 RG')의 운영자가 변경을 수행하지 않도록 자체 거버넌스 관행을 개발합니다.", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", - "service": "App Gateway", - "severity": "보통", - "text": "Azure Application Gateway WAF를 사용하여 트래픽을 지리적으로 필터링할 때 알 수 없는(ZZ) 위치를 지정합니다. IP 주소를 지리적으로 일치시킬 수 없는 경우 합법적인 요청을 실수로 차단하지 않도록 합니다.", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", + "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", + "severity": "낮다", + "text": "사용자 정의 노드 RG (일명 '인프라 RG') 이름 사용", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", + "link": "https://kubernetes.io/docs/setup/release/notes/", + "service": "AKS", "severity": "보통", - "text": "최신 Azure Application Gateway WAF 규칙 집합 버전을 사용합니다. 규칙 집합 업데이트는 현재 위협 환경을 고려하기 위해 정기적으로 업데이트됩니다.", - "waf": "안전" + "text": "YAML 매니페스트에서 더 이상 사용되지 않는 Kubernetes API를 사용하지 마십시오.", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "App Gateway", - "severity": "보통", - "text": "진단 설정을 추가하여 Azure Application Gateway WAF 로그를 저장합니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", + "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", + "service": "AKS", + "severity": "낮다", + "text": "테인트 Windows 노드", "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "Front Door", - "severity": "보통", - "text": "진단 설정을 추가하여 Azure Front Door WAF 로그를 저장합니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", + "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", + "service": "AKS", + "severity": "낮다", + "text": "Windows 컨테이너 패치 수준을 호스트 패치 수준과 동기화된 상태로 유지", "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "92664c60-47e3-4591-8b1b-8d557656e686", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", - "service": "App Gateway", - "severity": "보통", - "text": "Azure Application Gateway WAF 로그를 Microsoft Sentinel로 보냅니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "클러스터 수준의 진단 설정을 통해Via Diagnostic Settings at the cluster level", + "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", + "link": "https://learn.microsoft.com/azure/aks/monitor-aks", + "service": "AKS", + "severity": "낮다", + "text": "마스터 로그(즉, API 로그)를 Azure Monitor 또는 기본 로그 관리 솔루션으로 보냅니다", "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "845f5f91-9c21-4674-a725-5ce890850e20", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "Front Door", - "severity": "보통", - "text": "Azure Front Door WAF 로그를 Microsoft Sentinel로 보냅니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", + "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", + "service": "AKS", + "severity": "낮다", + "text": "필요한 경우 nodePool 스냅샷을 사용합니다.", + "waf": "비용" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", + "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", + "service": "AKS", + "severity": "낮다", + "text": "시간에 민감하지 않은 워크로드에 대한 스폿 노드 풀 고려", "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", - "service": "App Gateway", - "severity": "보통", - "text": "Azure Application Gateway WAF 구성을 코드로 정의합니다. 코드를 사용하면 새 규칙 집합 버전을 보다 쉽게 채택하고 추가 보호를 얻을 수 있습니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", + "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", + "severity": "낮다", + "text": "빠른 버스팅을 위해 AKS 가상 노드 고려", "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", - "service": "App Gateway", - "severity": "보통", - "text": "레거시 WAF 구성 대신 WAF 정책을 사용합니다.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", + "severity": "높다", + "text": "Container Insights(또는 Prometheus와 같은 다른 도구)를 사용하여 클러스터 지표 모니터링", "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", - "service": "App Gateway", - "severity": "보통", - "text": "Application Gateway 서브넷의 연결(예: NSG 사용)만 허용하도록 백 엔드에서 인바운드 트래픽을 필터링합니다.", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", + "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", + "severity": "높다", + "text": "Container Insights(또는 Telegraf/ElasticSearch와 같은 다른 도구)를 사용하여 클러스터 로그를 저장하고 분석합니다.", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", - "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", - "service": "Front Door", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", + "service": "AKS", "severity": "보통", - "text": "원본이 Azure Front Door 인스턴스의 트래픽만 가져와야 합니다.", - "waf": "안전" + "text": "노드의 CPU 및 메모리 사용률 모니터링", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", - "service": "App Gateway", - "severity": "높다", - "text": "백 엔드 서버에 대한 트래픽을 암호화해야 합니다.", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1a4835ac-9422-423e-ae80-b123081a5417", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "보통", + "text": "Azure CNI를 사용하는 경우 노드당 사용되는 Pod IP의 %를 모니터링합니다.", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", - "service": "App Gateway", - "severity": "높다", - "text": "웹 응용 프로그램 방화벽을 사용해야 합니다.", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "OS 디스크의 I/O는 중요한 리소스입니다. 노드의 OS가 I/O에서 제한되면 예측할 수 없는 동작이 발생할 수 있으며, 일반적으로 노드가 NotReady로 선언됩니다", + "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", + "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", + "service": "AKS", + "severity": "보통", + "text": "노드에서 OS 디스크 큐 크기 모니터링Monitor OS disk queue depth in nodes", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", - "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "be209d39-fda4-4777-a424-d116785c2fa5", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "severity": "보통", - "text": "HTTP를 HTTPS로 리디렉션", - "waf": "안전" + "text": "AzFW/NVA에서 송신 필터링을 사용하지 않는 경우 표준 ALB 할당 SNAT 포트를 모니터링합니다", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", - "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", + "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", + "service": "AKS", "severity": "보통", - "text": "게이트웨이 관리 쿠키를 사용하여 처리를 위해 사용자 세션에서 동일한 서버로 트래픽을 전달합니다.", + "text": "AKS 클러스터에 대한 Resource Health 알림 구독Subscribe to resource health notifications for your AKS cluster", "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "severity": "높다", - "text": "계획된 서비스 업데이트 중에 연결 드레이닝을 사용하도록 설정하여 백 엔드 풀의 기존 멤버에 대한 연결 손실을 방지합니다.", - "waf": "안전" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", - "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", - "service": "App Gateway", - "severity": "낮다", - "text": "사용자 지정 오류 페이지를 만들어 개인화된 사용자 환경 표시", + "text": "Pod 규격에서 요청 및 제한 구성", "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", - "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "769ef669-1a48-435a-a942-223ece80b123", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "severity": "보통", - "text": "HTTP 요청 및 응답 헤더를 편집하여 클라이언트와 서버 간의 라우팅 및 정보 교환을 보다 쉽게 할 수 있습니다.", - "waf": "안전" + "text": "네임스페이스에 대한 리소스 할당량 적용Enforce resource quotas for namespaces", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "App Gateway", - "severity": "보통", - "text": "빠른 글로벌 장애 조치(failover)를 통해 글로벌 웹 트래픽 라우팅 및 최상위 계층 최종 사용자 성능 및 안정성을 최적화하도록 Front Door 구성", - "waf": "공연" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "081a5417-4158-433e-a3ad-3c2de733165c", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "AKS", + "severity": "높다", + "text": "구독에 노드 풀을 확장할 수 있는 충분한 할당량이 있는지 확인합니다.", + "waf": "작업" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "29dcc19f-a8fa-4c35-8281-290577538793", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", + "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "severity": "보통", - "text": "전송 계층 부하 분산 사용Use transport layer load balancing", + "text": "Cluster Autoscaler 사용", "waf": "공연" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", - "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", - "service": "App Gateway", - "severity": "보통", - "text": "단일 게이트웨이에서 여러 웹 응용 프로그램에 대한 호스트 또는 도메인 이름을 기반으로 라우팅 구성Configure routing based on host or domain name for multiple web applications on a single gateway", - "waf": "안전" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", + "guid": "831c2872-c693-4b39-a887-a561bada49bc", + "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", + "service": "AKS", + "severity": "낮다", + "text": "AKS 노드 풀에 대한 노드 구성 사용자 지정", + "waf": "공연" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", - "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", - "service": "App Gateway", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "severity": "보통", - "text": "SSL 인증서 관리를 중앙 집중화하여 백엔드 서버 팜의 암호화 및 암호 해독 오버헤드를 줄입니다.", - "waf": "안전" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", - "service": "App Gateway", - "severity": "낮다", - "text": "WebSocket 및 HTTP/2 프로토콜에 대한 기본 지원을 위해 Application Gateway 사용", - "waf": "안전" + "text": "필요한 경우 Horizontal Pod Autoscaler 사용", + "waf": "공연" }, { - "checklist": "IoT Hub Review", - "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", - "service": "IoT", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "노드가 클수록 임시 디스크 및 가속화된 네트워킹과 같은 더 높은 성능과 기능을 제공하지만 폭발 반경이 증가하고 크기 조정 세분성이 감소합니다", + "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", + "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", + "service": "AKS", "severity": "높다", - "text": "지역적으로 적용 가능한 경우 가용성 영역 활용(자동으로 활성화됨)", - "waf": "신뢰도" + "text": "너무 크거나 너무 작지 않은 적절한 노드 크기를 고려합니다", + "waf": "공연" }, { - "checklist": "IoT Hub Review", - "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "severity": "보통", - "text": "Microsoft에서 시작한 장애 조치(failover)에 유의하세요. 드문 경우지만 Microsoft는 영향을 받는 지역의 모든 IoT Hub를 해당 지역 쌍을 이루는 지역으로 장애 조치(failover)하기 위해 이러한 작업을 수행합니다.", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", + "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", + "service": "AKS", + "severity": "낮다", + "text": "확장성을 위해 5,000개 이상의 노드가 필요한 경우 추가 AKS 클러스터를 사용하는 것이 좋습니다", + "waf": "공연" }, { - "checklist": "IoT Hub Review", - "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", - "service": "IoT", - "severity": "높다", - "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", + "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", + "service": "AKS", + "severity": "낮다", + "text": "AKS 자동화를 위해 EventGrid 이벤트를 구독하는 것이 좋습니다.", + "waf": "공연" }, { - "checklist": "IoT Hub Review", - "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "severity": "높다", - "text": "수동 장애 조치(failover)를 트리거하는 방법을 알아봅니다.", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", + "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", + "service": "AKS", + "severity": "낮다", + "text": "AKS 클러스터에서 장기 실행 작업의 경우 이벤트 종료를 고려합니다.", + "waf": "공연" }, { - "checklist": "IoT Hub Review", - "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", - "service": "IoT", - "severity": "높다", - "text": "장애 조치(failover) 후 장애 복구(failback)하는 방법을 알아봅니다.", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", + "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", + "service": "AKS", + "severity": "낮다", + "text": "필요한 경우 AKS 노드에 Azure Dedicated Host를 사용하는 것이 좋습니다", + "waf": "공연" }, { - "checklist": "Azure Function Review", - "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", + "guid": "24367b33-6971-45b1-952b-eee0b9b588de", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", "severity": "높다", - "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 기능 호스팅 계획을 선택하십시오.", - "waf": "신뢰도" + "text": "임시 OS 디스크 사용", + "waf": "공연" }, { - "checklist": "Azure Function Review", - "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "AKS", "severity": "높다", - "text": "지역적으로 적용 가능한 가용성 영역 활용(소비 계층에는 사용할 수 없음)", - "waf": "신뢰도" + "text": "임시 디스크가 아닌 디스크의 경우 여러 Pod를 실행하는 데 고성능이 필요하고 기본 AKS 로그 회전 임계값을 사용하여 대규모 로그를 생성하므로 많은 Pod/노드를 실행할 때 노드에 높은 IOPS 및 더 큰 OS 디스크를 사용합니다", + "waf": "공연" }, { - "checklist": "Azure Function Review", - "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", - "service": "Azure Functions", - "severity": "보통", - "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", + "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", + "service": "AKS", + "severity": "낮다", + "text": "고성능 스토리지 옵션의 경우 AKS에서 Ultra Disks를 사용합니다.", + "waf": "공연" }, { - "checklist": "Azure Function Review", - "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Azure Functions", - "severity": "높다", - "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "service": "AKS", + "severity": "보통", + "text": "클러스터에서 상태를 유지하지 않고 외부(AzStorage, AzSQL, Cosmos 등)에 데이터를 저장합니다.", + "waf": "공연" }, { - "checklist": "Azure Function Review", - "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "Azure Functions", - "severity": "높다", - "text": "App Service 계획에서 실행되는 모든 함수 앱에 대해 'Always On'이 사용하도록 설정되어 있는지 확인합니다.", - "waf": "신뢰도" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", + "service": "AKS", + "severity": "보통", + "text": "AzFiles 표준을 사용하는 경우 성능상의 이유로 AzFiles 프리미엄 및/또는 ANF를 고려합니다", + "waf": "공연" }, { - "checklist": "Azure Function Review", - "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", - "service": "Azure Functions", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", + "service": "AKS", "severity": "보통", - "text": "함수 앱을 자체 스토리지 계정에 페어링합니다. 긴밀하게 결합되지 않는 한 함수 앱에 대한 스토리지 계정을 다시 사용하지 마세요", - "waf": "신뢰도" + "text": "Azure 디스크 및 AZ를 사용하는 경우 올바른 영역에 스토리지를 프로비전하기 위해 VolumeBindingMode::WaitForFirstConsumer를 사용하여 LRS 디스크의 영역 내에 노드 풀을 사용하거나 여러 영역에 걸쳐 있는 노드 풀에 ZRS 디스크를 사용하는 것이 좋습니다", + "waf": "공연" }, { - "checklist": "Azure Function Review", - "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "Azure Functions", + "checklist": "Azure API Management Review", + "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", + "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", + "service": "APIM", "severity": "보통", - "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 함수 앱 코드를 보호합니다.", + "text": "전역 수준에서 오류 처리 정책 구현", "waf": "작업" }, { - "checklist": "Azure App Service Review", - "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", - "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", - "service": "App Services", - "severity": "낮다", - "text": "모범 사례는 기준 고가용성 영역 중복 웹 애플리케이션 아키텍처를 참조하세요.", - "waf": "신뢰도" + "checklist": "Azure API Management Review", + "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", + "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", + "service": "APIM", + "severity": "보통", + "text": "모든 API 정책에 요소가 포함되어 있는지 확인합니다.", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", - "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", + "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", + "service": "APIM", "severity": "보통", - "text": "프리미엄 및 표준 계층을 사용합니다. 이러한 계층은 스테이징 슬롯 및 자동 백업을 지원합니다.", - "waf": "신뢰도" + "text": "정책 조각을 사용하여 여러 API에서 동일한 정책 정의를 반복하지 않도록 합니다.", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", - "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", + "link": "https://learn.microsoft.com/azure/api-management/monetization-support", + "service": "APIM", + "severity": "보통", + "text": "API로 수익을 창출할 계획이라면 '수익 창출 지원' 도움말에서 권장사항을 확인하세요", + "waf": "작업" + }, + { + "checklist": "Azure API Management Review", + "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", + "service": "APIM", "severity": "높다", - "text": "지역적으로 적용 가능한 경우 가용성 영역 활용(프리미엄 v2 또는 v3 계층 필요)", - "waf": "신뢰도" + "text": "진단 설정을 사용하도록 설정하여 로그를 Azure Monitor로 내보내기", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", + "service": "APIM", "severity": "보통", - "text": "상태 확인 구현", - "waf": "신뢰도" + "text": "더 자세한 원격 분석을 위해 Application Insights 사용", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", + "service": "APIM", "severity": "높다", - "text": "Azure App Service에 대한 백업 및 복원 모범 사례를 참조하세요.", - "waf": "신뢰도" + "text": "가장 중요한 메트릭에 대한 경고 구성", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", - "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", + "service": "APIM", "severity": "높다", - "text": "Azure App Service 안정성 모범 사례 구현", - "waf": "신뢰도" + "text": "사용자 지정 SSL 인증서가 안전하게 액세스하고 업데이트할 수 있도록 Azure Key Vault에 저장되어 있는지 확인합니다", + "waf": "안전" }, { - "checklist": "Azure App Service Review", - "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", - "service": "App Services", - "severity": "낮다", - "text": "App Service 앱을 다른 지역으로 이동하는 방법을 숙지합니다. 재해가 발생하는 동안", - "waf": "신뢰도" + "checklist": "Azure API Management Review", + "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", + "service": "APIM", + "severity": "높다", + "text": "Azure AD를 사용하여 API(데이터 평면)에 들어오는 요청 보호", + "waf": "안전" }, { - "checklist": "Azure App Service Review", - "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", - "service": "App Services", - "severity": "높다", - "text": "Azure App Service의 안정성 지원 숙지", - "waf": "신뢰도" + "checklist": "Azure API Management Review", + "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", + "service": "APIM", + "severity": "보통", + "text": "Microsoft Entra ID를 사용하여 개발자 포털에서 사용자 인증", + "waf": "안전" }, { - "checklist": "Azure App Service Review", - "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", + "service": "APIM", "severity": "보통", - "text": "App Service 계획에서 실행되는 Function Apps에 대해 \"Always On\"이 사용하도록 설정되어 있는지 확인합니다.", - "waf": "신뢰도" + "text": "제품의 가시성을 제어하기 위해 적절한 그룹을 만듭니다", + "waf": "안전" }, { - "checklist": "Azure App Service Review", - "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "06862505-2d9a-4874-9491-2837b00a3475", + "link": "https://learn.microsoft.com/azure/api-management/backends", + "service": "APIM", "severity": "보통", - "text": "상태 검사를 사용하여 App Service 인스턴스 모니터링Monitor App Service instances using Health checks", - "waf": "신뢰도" + "text": "백엔드 기능을 사용하여 중복 API 백엔드 구성 제거", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", + "service": "APIM", "severity": "보통", - "text": "Application Insights 가용성 테스트를 사용하여 웹앱 또는 웹 사이트의 가용성 및 응답성 모니터링", + "text": "명명된 값을 사용하여 정책에서 사용할 수 있는 공통 값 저장", + "waf": "작업" + }, + { + "checklist": "Azure API Management Review", + "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", + "service": "APIM", + "severity": "보통", + "text": "DR의 경우 99.99% SLA를 위해 둘 이상의 지역에 걸쳐 확장된 배포와 함께 프리미엄 계층을 활용합니다", "waf": "신뢰도" }, { - "checklist": "Azure App Service Review", - "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", - "service": "App Services", - "severity": "낮다", - "text": "Application Insights 표준 테스트를 사용하여 웹앱 또는 웹 사이트의 가용성 및 응답성 모니터링", + "checklist": "Azure API Management Review", + "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", + "link": "https://learn.microsoft.com/azure/api-management/high-availability", + "service": "APIM", + "severity": "보통", + "text": "99.99%의 SLA 증가를 위해 둘 이상의 가용성 영역에 하나 이상의 단위를 배포합니다.", "waf": "신뢰도" }, { - "checklist": "Azure App Service Review", - "description": "Azure Key Vault를 사용하여 애플리케이션에 필요한 모든 비밀을 저장합니다. Key Vault는 비밀을 저장하기 위한 안전하고 감사된 환경을 제공하며 Key Vault SDK 또는 App Service Key Vault 참조를 통해 App Service와 잘 통합됩니다.", - "guid": "834ac932-223e-4ce8-8b12-3071a5416415", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", + "service": "APIM", "severity": "높다", - "text": "Key Vault를 사용하여 비밀 저장", - "waf": "안전" + "text": "자동화된 백업 루틴이 있는지 확인", + "waf": "신뢰도" }, { - "checklist": "Azure App Service Review", - "description": "관리 ID를 사용하여 Key Vault SDK를 사용하거나 App Service Key Vault 참조를 통해 Key Vault에 연결합니다.", - "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", - "severity": "높다", - "text": "관리 ID를 사용하여 Key Vault에 연결", - "waf": "안전" + "checklist": "Azure API Management Review", + "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", + "link": "https://learn.microsoft.com/azure/api-management/retry-policy", + "service": "APIM", + "severity": "보통", + "text": "정책을 사용하여 장애 조치 백엔드 URL 및 캐싱을 추가하여 실패한 호출을 줄입니다.", + "waf": "신뢰도" }, { - "checklist": "Azure App Service Review", - "description": "App Service TLS 인증서를 Key Vault에 저장합니다.", - "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", - "service": "App Services", - "severity": "높다", - "text": "Key Vault를 사용하여 TLS 인증서를 저장합니다.", - "waf": "안전" + "checklist": "Azure API Management Review", + "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", + "service": "APIM", + "severity": "낮다", + "text": "고성능 수준에서 기록해야 하는 경우 Event Hubs 정책을 고려합니다", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "description": "중요한 정보를 처리하는 시스템은 격리해야 합니다. 이렇게 하려면 별도의 App Service 계획 또는 App Service Environment를 사용하고 다른 구독 또는 관리 그룹을 사용하는 것이 좋습니다.", - "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", - "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", + "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", + "service": "APIM", "severity": "보통", - "text": "민감한 정보를 처리하는 시스템 격리", - "waf": "안전" + "text": "제한 정책을 적용하여 초당 요청 수 제어Apply throttling policies to control the number of requests per second", + "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", + "waf": "공연" }, { - "checklist": "Azure App Service Review", - "description": "App Service의 로컬 디스크는 암호화되지 않으며 중요한 데이터를 저장해서는 안 됩니다. (예: D:\\\\Local and %TMP%).", - "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", + "service": "APIM", "severity": "보통", - "text": "로컬 디스크에 중요한 데이터를 저장하지 마십시오.", - "waf": "안전" + "text": "부하가 증가할 때 인스턴스 수를 확장하도록 자동 크기 조정 구성Configure autoscaling to scale out the number of instances when the load increases", + "waf": "공연" }, { - "checklist": "Azure App Service Review", - "description": "인증된 웹 애플리케이션의 경우 Azure AD 또는 Azure AD B2C와 같이 잘 설정된 ID 공급자를 사용합니다. 선택한 애플리케이션 프레임워크를 활용하여 이 공급자와 통합하거나 App Service 인증/권한 부여 기능을 사용합니다.", - "guid": "919ca0b2-c121-459e-814b-933df574eccc", - "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", + "service": "APIM", "severity": "보통", - "text": "인증에 설정된 ID 공급자 사용", - "waf": "안전" + "text": "Azure에 백 엔드 API에 가까운 지역이 없는 자체 호스팅 게이트웨이를 배포합니다.", + "waf": "공연" }, { - "checklist": "Azure App Service Review", - "description": "잘 관리되고 안전한 DevOps 배포 파이프라인과 같이 제어되고 신뢰할 수 있는 환경에서 App Service에 코드를 배포합니다. 이렇게 하면 버전이 제어되지 않고 악성 호스트에서 배포되는 것으로 확인되지 않은 코드를 방지할 수 있습니다.", - "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", - "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", - "service": "App Services", - "severity": "높다", - "text": "신뢰할 수 있는 환경에서 배포", - "waf": "안전" + "checklist": "Azure API Management Review", + "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", + "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", + "service": "APIM", + "severity": "보통", + "text": "프로덕션 워크로드에 프리미엄 계층을 사용합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure App Service Review", - "description": "FTP/FTPS 및 WebDeploy/SCM 모두에 대한 기본 인증을 사용 안함으로 설정합니다. 이렇게 하면 이러한 서비스에 대한 액세스가 비활성화되고 배포에 Azure AD 보안 엔드포인트가 사용됩니다. SCM 사이트는 Azure AD 자격 증명을 사용하여 열 수도 있습니다.", - "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", - "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", - "service": "App Services", - "severity": "높다", - "text": "기본 인증 사용 안 함", - "waf": "안전" + "checklist": "Azure API Management Review", + "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", + "service": "APIM", + "severity": "보통", + "text": "다중 리전 모델에서는 Policies를 사용하여 가용성 또는 지연 시간에 따라 리전 백엔드로 요청을 라우팅합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure App Service Review", - "description": "가능한 경우 관리 ID를 사용하여 Azure AD 보안 리소스에 연결합니다. 이렇게 할 수 없는 경우 Key Vault에 비밀을 저장하고 대신 관리 ID를 사용하여 Key Vault에 연결합니다.", - "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", - "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", + "service": "APIM", "severity": "높다", - "text": "관리 ID를 사용하여 리소스에 연결", - "waf": "안전" + "text": "APIM의 제한에 유의해야 합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure App Service Review", - "description": "Azure Container Registry에 저장된 이미지를 사용하는 경우 관리 ID를 사용하여 끌어옵니다.", - "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", + "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", + "service": "APIM", "severity": "높다", - "text": "관리 ID를 사용하여 컨테이너 끌어오기", - "waf": "안전" + "text": "자체 호스팅 게이트웨이 배포가 복원력이 있는지 확인합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure App Service Review", - "description": "App Service의 진단 설정을 구성하면 모든 원격 분석을 로깅 및 모니터링의 중앙 대상으로 Log Analytics에 보낼 수 있습니다. 이를 통해 HTTP 로그, 애플리케이션 로그, 플랫폼 로그 등과 같은 App Service의 런타임 활동을 모니터링할 수 있습니다.", - "guid": "47768314-c115-4775-a2ea-55b46ad48408", - "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "7519e385-a88b-4d34-966b-6269d686e890", + "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", + "service": "APIM", "severity": "보통", - "text": "Log Analytics에 App Service 런타임 로그 보내기Send App Service runtime logs to Log Analytics", - "waf": "안전" + "text": "다중 지역 배포를 위해 APIM 앞에서 Azure Front Door 사용Use Azure Front Door in front of APIM for multi-region deployment", + "waf": "공연" }, { - "checklist": "Azure App Service Review", - "description": "활동 로그를 Log Analytics에 로깅 및 모니터링의 중앙 대상으로 보내도록 진단 설정을 지정합니다. 이렇게 하면 App Service 리소스 자체에서 컨트롤 플레인 작업을 모니터링할 수 있습니다.", - "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "cd45c90e-7690-4753-930b-bf290c69c074", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", + "service": "APIM", "severity": "보통", - "text": "Log Analytics에 App Service 활동 로그 보내기Send App Service activity logs to Log Analytics", + "text": "VNet(Virtual Network) 내에 서비스 배포Deploy the service within a Virtual Network (VNet)", "waf": "안전" }, { - "checklist": "Azure App Service Review", - "description": "지역 VNet 통합, 네트워크 보안 그룹 및 UDR의 조합을 사용하여 아웃바운드 네트워크 액세스를 제어합니다. 트래픽은 Azure Firewall과 같은 NVA로 라우팅되어야 합니다. 방화벽의 로그를 모니터링해야 합니다.", - "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", - "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", + "service": "APIM", "severity": "보통", - "text": "아웃바운드 네트워크 액세스를 제어해야 함", - "waf": "안전" - }, - { - "checklist": "Azure App Service Review", - "description": "VNet 통합을 사용하고 VNet NAT Gateway 또는 NVA와 같은 Azure Firewall을 사용하여 안정적인 아웃바운드 IP를 제공할 수 있습니다. 이렇게 하면 필요한 경우 수신 당사자가 IP를 기반으로 허용 목록을 만들 수 있습니다. Azure 서비스에 대한 통신의 경우 IP 주소에 의존할 필요가 없는 경우가 많으며 서비스 엔드포인트와 같은 메커니즘을 대신 사용해야 합니다. (또한 수신 끝에서 프라이빗 엔드포인트를 사용하면 SNAT가 발생하지 않고 안정적인 아웃바운드 IP 범위를 제공합니다.)", - "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", - "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", - "service": "App Services", - "severity": "낮다", - "text": "인터넷 주소에 대한 아웃바운드 통신을 위한 안정적인 IP 보장", - "waf": "안전" - }, - { - "checklist": "Azure App Service Review", - "description": "App Service 액세스 제한, 서비스 엔드포인트 또는 프라이빗 엔드포인트의 조합을 사용하여 인바운드 네트워크 액세스를 제어합니다. 웹앱 자체 및 SCM 사이트에 대해 서로 다른 액세스 제한이 필요하고 구성될 수 있습니다.", - "guid": "0725769e-e669-41a4-a34a-c932223ece80", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", - "severity": "높다", - "text": "인바운드 네트워크 액세스를 제어해야 합니다.", + "text": "서브넷에 NSG(네트워크 보안 그룹)를 배포하여 APIM에서 들어오고 나가는 트래픽을 제한하거나 모니터링합니다.", "waf": "안전" }, { - "checklist": "Azure App Service Review", - "description": "Application Gateway 또는 Azure Front Door와 같은 Web Application Firewall을 사용하여 악의적인 인바운드 트래픽으로부터 보호합니다. WAF의 로그를 모니터링해야 합니다.", - "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", - "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", - "service": "App Services", - "severity": "높다", - "text": "App Service 앞에서 WAF 사용Use a WAF in front of App Service", + "checklist": "Azure API Management Review", + "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", + "service": "APIM", + "severity": "보통", + "text": "프라이빗 엔드포인트를 배포하여 APIM이 VNet에 배포되지 않은 경우 들어오는 트래픽을 필터링합니다.", "waf": "안전" }, { - "checklist": "Azure App Service Review", - "description": "WAF에 대한 액세스만 잠궈 WAF를 우회할 수 없는지 확인합니다. 액세스 제한, 서비스 엔드포인트 및 프라이빗 엔드포인트의 조합을 사용합니다.", - "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", + "service": "APIM", "severity": "높다", - "text": "WAF가 우회되지 않도록 방지", + "text": "공용 네트워크 액세스 사용 안 함", "waf": "안전" }, { - "checklist": "Azure App Service Review", - "description": "App Service 구성에서 최소 TLS 정책을 1.2로 설정합니다.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", - "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", + "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", + "service": "APIM", "severity": "보통", - "text": "최소 TLS 정책을 1.2로 설정합니다.", - "waf": "안전" - }, - { - "checklist": "Azure App Service Review", - "description": "HTTPS만 사용하도록 App Service를 구성합니다. 이로 인해 App Service가 HTTP에서 HTTPS로 리디렉션됩니다. 코드 또는 WAF에서 HSTS(HTTP Strict Transport Security)를 사용하여 HTTPS를 통해서만 사이트에 액세스해야 함을 브라우저에 알리는 것이 좋습니다.", - "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", - "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", - "service": "App Services", - "severity": "높다", - "text": "HTTPS만 사용", - "waf": "안전" + "text": "PowerShell 자동화 스크립트로 관리 간소화", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "description": "CORS 구성에서 와일드카드를 사용하면 모든 원본이 서비스에 액세스할 수 있으므로 CORS의 목적에 어긋나므로 사용하지 마세요. 특히 서비스에 액세스할 수 있을 것으로 예상되는 원본만 허용합니다.", - "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", - "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", - "service": "App Services", - "severity": "높다", - "text": "와일드카드는 CORS에 사용할 수 없습니다.", - "waf": "안전" + "checklist": "Azure API Management Review", + "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", + "service": "APIM", + "severity": "보통", + "text": "Infrastructure-as-code를 통해 APIM을 구성합니다. Cloud Adaption Framework APIM 랜딩 존 가속기에서 DevOps 모범 사례 검토", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "description": "원격 디버깅은 서비스에서 추가 포트를 열어 공격 노출 영역을 증가시키므로 프로덕션에서 켜면 안 됩니다. 서비스는 48시간 후에 자동으로 원격 디버깅을 설정합니다.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", - "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", - "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", - "service": "App Services", - "severity": "높다", - "text": "원격 디버깅 끄기", - "waf": "안전" + "checklist": "Azure API Management Review", + "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", + "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", + "service": "APIM", + "severity": "보통", + "text": "더 빠른 API 개발을 위해 Visual Studio Code APIM 확장 사용 촉진", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "description": "App Service용 Defender를 사용하도록 설정합니다. 이는 다른 위협 중에서도 알려진 악성 IP 주소에 대한 통신을 탐지합니다. 작업의 일부로 App Service용 Defender의 권장 사항을 검토합니다.", - "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "354f1c03-8112-4965-85ad-c0074bddf231", + "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", + "service": "APIM", "severity": "보통", - "text": "클라우드용 Defender 사용 - App Service용 Defender", - "waf": "안전" + "text": "워크플로에서 DevOps 및 CI/CD 구현", + "waf": "작업" }, { - "checklist": "Azure App Service Review", - "description": "Azure는 네트워크에서 DDoS 기본 보호를 제공하며, 정상적인 트래픽 패턴을 학습하고 비정상적인 동작을 감지할 수 있는 지능형 DDoS 표준 기능으로 개선할 수 있습니다. DDoS 표준은 Virtual Network에 적용되므로 Application Gateway 또는 NVA와 같은 앱 앞의 네트워크 리소스에 대해 구성해야 합니다.", - "guid": "223ece80-b123-4071-a541-6415833ea3ad", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "b6439493-426a-45f3-9697-cf65baee208d", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", + "service": "APIM", "severity": "보통", - "text": "WAF VNet에서 DDOS 보호 표준 사용Enable DDOS Protection Standard on the WAF VNet", + "text": "클라이언트 인증서 인증을 사용하여 API 보안", "waf": "안전" }, { - "checklist": "Azure App Service Review", - "description": "Azure Container Registry에 저장된 이미지를 사용하는 경우 프라이빗 엔드포인트 및 앱 설정 'WEBSITE_PULL_IMAGE_OVER_VNET'를 사용하여 Azure Container Registry에서 가상 네트워크를 통해 끌어옵니다.", - "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "2a67d143-1033-4c0a-8732-680896478f08", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", + "service": "APIM", "severity": "보통", - "text": "Virtual Network를 통해 컨테이너 끌어오기", + "text": "클라이언트 인증서 인증을 사용한 보안 백엔드 서비스", "waf": "안전" }, { - "checklist": "Azure App Service Review", - "description": "참여의 침투 테스트 규칙에 따라 웹 응용 프로그램에 대한 침투 테스트를 수행합니다.", - "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", - "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", + "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", + "service": "APIM", "severity": "보통", - "text": "침투 테스트 수행", + "text": "'OWASP API 보안 상위 10개 위협을 완화하기 위한 권장 사항' 문서를 검토하고 API에 적용할 수 있는 항목을 확인합니다.", "waf": "안전" }, { - "checklist": "Azure App Service Review", - "description": "DevSecOps 사례에 따라 취약성을 검증하고 검사한 신뢰할 수 있는 코드를 배포합니다.", - "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", + "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", + "service": "APIM", "severity": "보통", - "text": "유효성이 검사된 코드 배포", + "text": "권한 부여 기능을 사용하여 백엔드 API에 대한 OAuth 2.0 토큰 관리 간소화", "waf": "안전" }, { - "checklist": "Azure App Service Review", - "description": "지원되는 플랫폼, 프로그래밍 언어, 프로토콜 및 프레임워크의 최신 버전을 사용합니다.", - "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", - "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", - "service": "App Services", + "checklist": "Azure API Management Review", + "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", + "service": "APIM", "severity": "높다", - "text": "최신 플랫폼, 언어, 프로토콜 및 프레임워크 사용", + "text": "전송 중인 정보를 암호화할 때 최신 TLS 버전을 사용합니다. 가능한 경우 오래되고 불필요한 프로토콜과 암호를 사용하지 않도록 설정합니다.", "waf": "안전" }, { "checklist": "Azure API Management Review", - "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", - "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", + "guid": "f8af3d94-1d2b-4070-846f-849197524258", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", "service": "APIM", - "severity": "보통", - "text": "전역 수준에서 오류 처리 정책 구현", - "waf": "작업" + "severity": "높다", + "text": "비밀(명명된 값)이 안전하게 액세스하고 업데이트할 수 있도록 Azure Key Vault에 저장되었는지 확인합니다.", + "waf": "안전" }, { "checklist": "Azure API Management Review", - "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", - "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", + "guid": "791abd8b-7706-4e31-9569-afefde724be3", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", "service": "APIM", "severity": "보통", - "text": "모든 API 정책에 요소가 포함되어 있는지 확인합니다.", - "waf": "작업" + "text": "가능할 때마다 관리 ID를 사용하여 다른 Azure 리소스에 인증", + "waf": "안전" }, { "checklist": "Azure API Management Review", - "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", - "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", + "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", "service": "APIM", - "severity": "보통", - "text": "정책 조각을 사용하여 여러 API에서 동일한 정책 정의를 반복하지 않도록 합니다.", - "waf": "작업" + "severity": "높다", + "text": "APIM 앞에 Application Gateway를 배포하여 WAF(웹 애플리케이션 방화벽) 사용Use Web Application Firewall (WAF) by deploying Application Gateway in of APIM", + "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", - "link": "https://learn.microsoft.com/azure/api-management/monetization-support", - "service": "APIM", + "checklist": "IoT Hub Review", + "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", + "service": "IoT", + "severity": "높다", + "text": "지역적으로 적용 가능한 경우 가용성 영역 활용(자동으로 활성화됨)", + "waf": "신뢰도" + }, + { + "checklist": "IoT Hub Review", + "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", "severity": "보통", - "text": "API로 수익을 창출할 계획이라면 '수익 창출 지원' 도움말에서 권장사항을 확인하세요", - "waf": "작업" + "text": "Microsoft에서 시작한 장애 조치(failover)에 유의하세요. 드문 경우지만 Microsoft는 영향을 받는 지역의 모든 IoT Hub를 해당 지역 쌍을 이루는 지역으로 장애 조치(failover)하기 위해 이러한 작업을 수행합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", - "service": "APIM", + "checklist": "IoT Hub Review", + "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", + "service": "IoT", "severity": "높다", - "text": "진단 설정을 사용하도록 설정하여 로그를 Azure Monitor로 내보내기", - "waf": "작업" + "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", - "service": "APIM", - "severity": "보통", - "text": "더 자세한 원격 분석을 위해 Application Insights 사용", - "waf": "작업" + "checklist": "IoT Hub Review", + "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", + "severity": "높다", + "text": "수동 장애 조치(failover)를 트리거하는 방법을 알아봅니다.", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", - "service": "APIM", + "checklist": "IoT Hub Review", + "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", + "service": "IoT", "severity": "높다", - "text": "가장 중요한 메트릭에 대한 경고 구성", - "waf": "작업" + "text": "장애 조치(failover) 후 장애 복구(failback)하는 방법을 알아봅니다.", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", - "service": "APIM", + "checklist": "Logic Apps checklist", + "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", + "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", + "service": "Logic Apps", "severity": "높다", - "text": "사용자 지정 SSL 인증서가 안전하게 액세스하고 업데이트할 수 있도록 Azure Key Vault에 저장되어 있는지 확인합니다", - "waf": "안전" + "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 Logic App 호스팅 계획 선택Select the right Logic App hosting plan based on your business & SLO requirements", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", - "service": "APIM", + "checklist": "Logic Apps checklist", + "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", + "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "Logic Apps", "severity": "높다", - "text": "Azure AD를 사용하여 API(데이터 평면)에 들어오는 요청 보호", - "waf": "안전" + "text": "영역 중복 및 가용성 영역을 사용하여 지역 오류로부터 논리 앱 보호Protect logic apps from region failures with zone redundancy and availability zones", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", - "service": "APIM", - "severity": "보통", - "text": "Microsoft Entra ID를 사용하여 개발자 포털에서 사용자 인증", - "waf": "안전" + "checklist": "Logic Apps checklist", + "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", + "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Logic Apps", + "severity": "높다", + "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", - "service": "APIM", - "severity": "보통", - "text": "제품의 가시성을 제어하기 위해 적절한 그룹을 만듭니다", - "waf": "안전" + "checklist": "Logic Apps checklist", + "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", + "link": "https://learn.microsoft.com/azure/app-service/environment/intro", + "service": "Logic Apps", + "severity": "높다", + "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "06862505-2d9a-4874-9491-2837b00a3475", - "link": "https://learn.microsoft.com/azure/api-management/backends", - "service": "APIM", + "checklist": "Logic Apps checklist", + "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", + "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", + "service": "Logic Apps", "severity": "보통", - "text": "백엔드 기능을 사용하여 중복 API 백엔드 구성 제거", + "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 논리 앱 코드를 보호합니다.", "waf": "작업" }, { - "checklist": "Azure API Management Review", - "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", - "service": "APIM", - "severity": "보통", - "text": "명명된 값을 사용하여 정책에서 사용할 수 있는 공통 값 저장", - "waf": "작업" + "checklist": "Cognitive Search Review Checklist", + "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", + "severity": "높다", + "text": "읽기 작업에 대해 99.9%의 가용성을 갖도록 복제본 2개 사용", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", - "service": "APIM", + "checklist": "Cognitive Search Review Checklist", + "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", "severity": "보통", - "text": "DR의 경우 99.99% SLA를 위해 둘 이상의 지역에 걸쳐 확장된 배포와 함께 프리미엄 계층을 활용합니다", + "text": "읽기/쓰기 작업에 대해 99.9%의 가용성을 갖도록 복제본 3개 사용", "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", - "link": "https://learn.microsoft.com/azure/api-management/high-availability", - "service": "APIM", + "checklist": "Cognitive Search Review Checklist", + "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", + "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", + "service": "Cognitive Search", + "severity": "높다", + "text": "읽기 및/또는 쓰기 복제본을 활성화하여 가용 영역 활용Leverage Availability Zones by enabling read and/or write replicas", + "waf": "신뢰도" + }, + { + "checklist": "Cognitive Search Review Checklist", + "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", + "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", + "service": "Cognitive Search", "severity": "보통", - "text": "99.99%의 SLA 증가를 위해 둘 이상의 가용성 영역에 하나 이상의 단위를 배포합니다.", + "text": "지역 중복의 경우 Manually create services in 2 or more regions for Search는 지리적 지역 간에 검색 인덱스를 복제하는 자동화된 방법을 제공하지 않습니다", "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", - "service": "APIM", - "severity": "높다", - "text": "자동화된 백업 루틴이 있는지 확인", + "checklist": "Cognitive Search Review Checklist", + "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", + "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", + "service": "Cognitive Search", + "severity": "보통", + "text": "여러 서비스에서 데이터를 동기화하려면 인덱서를 사용하여 여러 서비스의 콘텐츠를 업데이트하거나 REST API를 사용하여 여러 서비스에서 콘텐츠 업데이트를 푸시합니다.", "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", - "link": "https://learn.microsoft.com/azure/api-management/retry-policy", - "service": "APIM", + "checklist": "Cognitive Search Review Checklist", + "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", + "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", + "service": "Cognitive Search", "severity": "보통", - "text": "정책을 사용하여 장애 조치 백엔드 URL 및 캐싱을 추가하여 실패한 호출을 줄입니다.", + "text": "Azure Traffic Manager를 사용하여 요청 조정", "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", - "service": "APIM", - "severity": "낮다", - "text": "고성능 수준에서 기록해야 하는 경우 Event Hubs 정책을 고려합니다", - "waf": "작업" + "checklist": "Cognitive Search Review Checklist", + "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", + "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", + "service": "Cognitive Search", + "severity": "높다", + "text": "Azure Cognitive Search 인덱스를 백업 및 복원합니다. 이 샘플 코드를 사용하여 인덱스 정의 및 스냅샷을 일련의 Json 파일에 백업합니다", + "waf": "신뢰도" }, { - "checklist": "Azure API Management Review", - "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", - "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", - "service": "APIM", - "severity": "보통", - "text": "제한 정책을 적용하여 초당 요청 수 제어Apply throttling policies to control the number of requests per second", - "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", - "waf": "공연" + "checklist": "Azure VMware Solution Design Review", + "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", + "service": "AVS", + "severity": "높다", + "text": "ADDS 도메인 컨트롤러가 네이티브 Azure의 ID 구독에 배포되었는지 확인합니다.", + "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "75089c20-990d-4927-b105-885576f76fc2", + "service": "AVS", "severity": "보통", - "text": "부하가 증가할 때 인스턴스 수를 확장하도록 자동 크기 조정 구성Configure autoscaling to scale out the number of instances when the load increases", - "waf": "공연" + "text": "ADDS 사이트 및 서비스가 Azure 기반 리소스(Azure VMware Solution 포함)의 인증 요청을 Azure에 로컬로 유지하도록 구성되어 있는지 확인합니다.", + "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", - "service": "APIM", - "severity": "보통", - "text": "Azure에 백 엔드 API에 가까운 지역이 없는 자체 호스팅 게이트웨이를 배포합니다.", - "waf": "공연" + "checklist": "Azure VMware Solution Design Review", + "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", + "service": "AVS", + "severity": "높다", + "text": "vCenter가 ADDS에 연결되어 있는지 확인하여 '명명된 사용자 계정'을 기반으로 인증을 사용하도록 설정합니다.", + "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", - "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", + "service": "AVS", "severity": "보통", - "text": "프로덕션 워크로드에 프리미엄 계층을 사용합니다.", - "waf": "신뢰도" + "text": "vCenter에서 ADDS로의 연결이 보안 프로토콜(LDAPS)을 사용하고 있는지 확인합니다.", + "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", + "service": "AVS", "severity": "보통", - "text": "다중 리전 모델에서는 Policies를 사용하여 가용성 또는 지연 시간에 따라 리전 백엔드로 요청을 라우팅합니다.", - "waf": "신뢰도" + "text": "vCenter IdP의 CloudAdmin 계정은 긴급 계정으로만 사용됩니다(Break-glass).", + "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", - "service": "APIM", - "severity": "높다", - "text": "APIM의 제한에 유의해야 합니다.", - "waf": "신뢰도" - }, - { - "checklist": "Azure API Management Review", - "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", - "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", + "service": "AVS", "severity": "높다", - "text": "자체 호스팅 게이트웨이 배포가 복원력이 있는지 확인합니다.", - "waf": "신뢰도" + "text": "NSX-Manager가 외부 ID 제공자(LDAPS)와 통합되었는지 확인합니다.", + "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "7519e385-a88b-4d34-966b-6269d686e890", - "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", + "service": "AVS", "severity": "보통", - "text": "다중 지역 배포를 위해 APIM 앞에서 Azure Front Door 사용Use Azure Front Door in front of APIM for multi-region deployment", - "waf": "공연" + "text": "VMware vSphere에서 사용하기 위해 RBAC 모델이 생성되었습니까?", + "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "cd45c90e-7690-4753-930b-bf290c69c074", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", + "service": "AVS", "severity": "보통", - "text": "VNet(Virtual Network) 내에 서비스 배포Deploy the service within a Virtual Network (VNet)", + "text": "RBAC 권한은 특정 사용자가 아닌 ADDS 그룹에 부여해야 합니다", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", - "service": "APIM", - "severity": "보통", - "text": "서브넷에 NSG(네트워크 보안 그룹)를 배포하여 APIM에서 들어오고 나가는 트래픽을 제한하거나 모니터링합니다.", + "checklist": "Azure VMware Solution Design Review", + "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", + "service": "AVS", + "severity": "높다", + "text": "Azure의 Azure VMware Solution 리소스에 대한 RBAC 권한은 제한된 소유자 집합으로만 '잠김'됩니다", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", - "service": "APIM", - "severity": "보통", - "text": "프라이빗 엔드포인트를 배포하여 APIM이 VNet에 배포되지 않은 경우 들어오는 트래픽을 필터링합니다.", + "checklist": "Azure VMware Solution Design Review", + "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", + "service": "AVS", + "severity": "높다", + "text": "모든 사용자 지정 역할의 범위가 CloudAdmin 허용 권한 부여로 지정되었는지 확인합니다.", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", + "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", + "service": "AVS", "severity": "높다", - "text": "공용 네트워크 액세스 사용 안 함", - "waf": "안전" + "text": "현재 고객 사용 사례에 대해 올바른 Azure VMware Solution 연결 모델을 선택했습니까?", + "waf": "공연" }, { - "checklist": "Azure API Management Review", - "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", - "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", - "service": "APIM", - "severity": "보통", - "text": "PowerShell 자동화 스크립트로 관리 간소화", + "checklist": "Azure VMware Solution Design Review", + "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", + "service": "AVS", + "severity": "높다", + "text": "'연결 모니터'를 사용하여 온-프레미스에서 Azure로의 ExpressRoute 또는 VPN 연결이 모니터링되는지 확인합니다.", "waf": "작업" }, { - "checklist": "Azure API Management Review", - "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", + "service": "AVS", "severity": "보통", - "text": "Infrastructure-as-code를 통해 APIM을 구성합니다. Cloud Adaption Framework APIM 랜딩 존 가속기에서 DevOps 모범 사례 검토", + "text": "Azure VMware Solution 백 엔드 ExpressRoute 연결을 모니터링하기 위해 Azure 네이티브 리소스에서 Azure VMware Solution 가상 머신으로 연결 모니터가 만들어졌는지 확인합니다.", "waf": "작업" }, { - "checklist": "Azure API Management Review", - "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", - "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", + "service": "AVS", "severity": "보통", - "text": "더 빠른 API 개발을 위해 Visual Studio Code APIM 확장 사용 촉진", + "text": "엔드-2-엔드 연결을 모니터링하기 위해 온-프레미스 리소스에서 Azure VMware Solution 가상 머신으로 연결 모니터가 만들어졌는지 확인합니다.", "waf": "작업" }, { - "checklist": "Azure API Management Review", - "guid": "354f1c03-8112-4965-85ad-c0074bddf231", - "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", - "service": "APIM", - "severity": "보통", - "text": "워크플로에서 DevOps 및 CI/CD 구현", + "checklist": "Azure VMware Solution Design Review", + "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", + "service": "AVS", + "severity": "높다", + "text": "경로 서버를 사용하는 경우 경로 서버에서 ExR 게이트웨이로, 온-프레미스로 1,000개 이상의 경로가 전파되지 않도록 합니다(ARS 제한).", "waf": "작업" }, { - "checklist": "Azure API Management Review", - "guid": "b6439493-426a-45f3-9697-cf65baee208d", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", - "service": "APIM", - "severity": "보통", - "text": "클라이언트 인증서 인증을 사용하여 API 보안", + "checklist": "Azure VMware Solution Design Review", + "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", + "service": "AVS", + "severity": "높다", + "text": "Azure Portal에서 Azure VMware Solution 리소스를 관리하는 역할에 대해 Privileged Identity Management가 구현되어 있나요(고정 권한이 허용되지 않음).", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "2a67d143-1033-4c0a-8732-680896478f08", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", - "service": "APIM", - "severity": "보통", - "text": "클라이언트 인증서 인증을 사용한 보안 백엔드 서비스", + "checklist": "Azure VMware Solution Design Review", + "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", + "service": "AVS", + "severity": "높다", + "text": "Azure VMware Solution PIM 역할에 대해 Privileged Identity Management 감사 보고를 구현해야 합니다.", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", - "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", + "service": "AVS", "severity": "보통", - "text": "'OWASP API 보안 상위 10개 위협을 완화하기 위한 권장 사항' 문서를 검토하고 API에 적용할 수 있는 항목을 확인합니다.", + "text": "Privileged Identity Management를 사용하는 경우 Azure VMware Solution 자동 호스트 교체 알림에 대한 유효한 SMTP 레코드를 사용하여 유효한 Entra ID 사용 계정을 만들었는지 확인합니다. (상시 권한 필요)", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", - "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", + "service": "AVS", + "severity": "높다", + "text": "CloudAdmin 계정 사용을 긴급 액세스로만 제한", + "waf": "안전" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", + "service": "AVS", "severity": "보통", - "text": "권한 부여 기능을 사용하여 백엔드 API에 대한 OAuth 2.0 토큰 관리 간소화", + "text": "vCenter에서 사용자 지정 RBAC 역할을 만들어 vCenter 내에서 최소 권한 모델 구현", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", - "service": "APIM", - "severity": "높다", - "text": "전송 중인 정보를 암호화할 때 최신 TLS 버전을 사용합니다. 가능한 경우 오래되고 불필요한 프로토콜과 암호를 사용하지 않도록 설정합니다.", + "checklist": "Azure VMware Solution Design Review", + "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", + "service": "AVS", + "severity": "보통", + "text": "cloudadmin(vCenter) 및 admin(NSX) 자격 증명을 정기적으로 순환하도록 정의된 프로세스입니다.", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "f8af3d94-1d2b-4070-846f-849197524258", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", + "service": "AVS", "severity": "높다", - "text": "비밀(명명된 값)이 안전하게 액세스하고 업데이트할 수 있도록 Azure Key Vault에 저장되었는지 확인합니다.", + "text": "Azure VMware Solution에서 실행되는 워크로드(VM)에 사용할 중앙 집중식 ID 공급자 사용", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "791abd8b-7706-4e31-9569-afefde724be3", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", + "service": "AVS", "severity": "보통", - "text": "가능할 때마다 관리 ID를 사용하여 다른 Azure 리소스에 인증", + "text": "NSX-T 내에서 East-West 트래픽 필터링이 구현되었는지 여부", "waf": "안전" }, { - "checklist": "Azure API Management Review", - "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", + "service": "AVS", "severity": "높다", - "text": "APIM 앞에 Application Gateway를 배포하여 WAF(웹 애플리케이션 방화벽) 사용Use Web Application Firewall (WAF) by deploying Application Gateway in of APIM", + "text": "Azure VMware Solution의 워크로드는 인터넷에 직접 노출되지 않습니다. 트래픽은 Azure Application Gateway, Azure Firewall 또는 제3자 솔루션에 의해 필터링되고 검사됩니다", "waf": "안전" }, { - "checklist": "Identity Review Checklist", - "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", - "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", - "service": "Entra", - "severity": "보통", - "text": "장기 취소 가능 토큰을 사용하고, 토큰을 캐시하고, Microsoft ID 라이브러리를 사용하여 자동으로 획득합니다.", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", + "service": "AVS", + "severity": "높다", + "text": "감사 및 로깅은 Azure VMware Solution 및 Azure VMware Solution 기반 워크로드에 대한 인바운드 인터넷 요청에 대해 구현됩니다", + "waf": "안전" }, { - "checklist": "Identity Review Checklist", - "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", - "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", - "service": "AAD B2C", + "checklist": "Azure VMware Solution Design Review", + "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", + "service": "AVS", "severity": "보통", - "text": "로그인 사용자 흐름이 백업되고 복원력이 있는지 확인합니다. 사용자를 로그인하는 데 사용하는 코드가 백업되고 복구 가능한지 확인합니다. 외부 프로세스와의 복원력 있는 인터페이스", - "waf": "신뢰도" + "text": "세션 모니터링은 의심스러운/악의적인 활동을 식별하기 위해 Azure VMware Solution 또는 Azure VMware Solution 기반 워크로드의 아웃바운드 인터넷 연결에 대해 구현됩니다", + "waf": "안전" }, { - "checklist": "Identity Review Checklist", - "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", - "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", - "service": "AAD B2C", + "checklist": "Azure VMware Solution Design Review", + "guid": "334fdf91-c234-4182-a652-75269440b4be", + "service": "AVS", "severity": "보통", - "text": "사용자 지정 브랜드 자산은 CDN에서 호스팅되어야 합니다.", - "waf": "공연" - }, - { - "checklist": "Identity Review Checklist", - "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", - "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", - "service": "AAD B2C", - "severity": "낮다", - "text": "여러 ID 공급자가 있어야 합니다(예: Microsoft, Google, Facebook 계정으로 로그인).", - "waf": "신뢰도" + "text": "Azure의 ExR/VPN Gateway 서브넷에서 DDoS 표준 보호를 사용할 수 있나요?", + "waf": "안전" }, { - "checklist": "Identity Review Checklist", - "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure VMware Solution Design Review", + "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", + "service": "AVS", "severity": "보통", - "text": "VM 수준에서 고가용성을 위한 VM 규칙(프리미엄 디스크, 서로 다른 가용성 영역에 있는 지역에 두 개 이상)을 따릅니다.", - "waf": "신뢰도" + "text": "전용 PAW(Privileged Access Workstation)를 사용하여 Azure VMware Solution, vCenter, NSX Manager 및 HCX Manager 관리", + "waf": "안전" }, { - "checklist": "Identity Review Checklist", - "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure VMware Solution Design Review", + "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", + "service": "AVS", "severity": "보통", - "text": "복제하지 마세요! 복제로 인해 디렉터리 동기화에 문제가 발생할 수 있습니다", - "waf": "신뢰도" + "text": "Azure VMware Solution에서 실행되는 워크로드에 대해 Advanced Threat Detection(클라우드용 Microsoft Defender 또는 ASC) 사용", + "waf": "안전" }, { - "checklist": "Identity Review Checklist", - "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure VMware Solution Design Review", + "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", + "service": "AVS", "severity": "보통", - "text": "다중 지역에 대해 활성-활성 상태 보유", - "waf": "신뢰도" + "text": "서버용 Azure ARC를 사용하여 Azure 네이티브 기술을 사용하여 Azure VMware Solution에서 실행되는 워크로드를 적절하게 제어합니다(Azure VMware Solution용 Azure ARC는 아직 사용할 수 없음).", + "waf": "안전" }, { - "checklist": "Identity Review Checklist", - "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", + "checklist": "Azure VMware Solution Design Review", + "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", + "service": "AVS", + "severity": "낮다", + "text": "Azure VMware Solution의 워크로드가 런타임 중에 충분한 데이터 암호화(예: 게스트 내 디스크 암호화 및 SQL TDE)를 사용하는지 확인합니다. (vSAN 미사용 암호화가 기본값임)", + "waf": "안전" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "a3592718-e6e2-4051-9267-6ae46691e883", + "service": "AVS", + "severity": "낮다", + "text": "게스트 내 암호화를 사용하는 경우 가능한 경우 Azure Key Vault에 암호화 키를 저장합니다", + "waf": "안전" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "5ac94222-3e13-4810-9230-81a941741583", + "service": "AVS", "severity": "보통", - "text": "추가 지역 및 위치에 Azure AD 도메인 서비스 스탬프 추가Add Azure AD Domain service stamps to additional regions and locations", + "text": "Azure VMware Solution에서 실행되는 워크로드에 대해 확장된 보안 업데이트 지원을 사용하는 것이 좋습니다(Azure VMware Solution은 ESU에 적합함).", + "waf": "안전" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", + "service": "AVS", + "severity": "높다", + "text": "적절한 vSAN 데이터 이중화 방법이 사용되는지 확인합니다(RAID 규격).", "waf": "신뢰도" }, { - "checklist": "Identity Review Checklist", - "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", - "severity": "보통", - "text": "DR에 복제본 세트 사용", + "checklist": "Azure VMware Solution Design Review", + "guid": "d88408f3-7273-44c8-96ba-280214590146", + "service": "AVS", + "severity": "높다", + "text": "vSAN 스토리지 요구 사항을 충족하기 위해 장애 허용 정책이 적용되어 있는지 확인합니다", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", - "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", + "service": "AVS", + "severity": "높다", + "text": "충분한 할당량을 요청했는지 확인하고 성장 및 재해 복구 요구 사항을 고려했는지 확인합니다", + "waf": "신뢰도" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", + "service": "AVS", "severity": "보통", - "text": "ACSS(Azure Center for SAP solutions)는 SAP를 Azure의 최상위 워크로드로 만드는 Azure 제품입니다. ACSS는 Azure에서 SAP 시스템을 통합 워크로드로 만들고 실행할 수 있도록 하는 엔드투엔드 솔루션으로, 혁신을 위한 보다 원활한 기반을 제공합니다. 신규 및 기존 Azure 기반 SAP 시스템 모두에 대한 관리 기능을 활용할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "text": "ESXi에 대한 액세스 제약 조건을 이해하고 타사 솔루션에 영향을 줄 수 있는 액세스 제한이 있는지 확인합니다.", "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", + "service": "AVS", "severity": "보통", - "text": "Azure는 Linux 및 Windows에서 SAP 배포 자동화를 지원합니다. SAP Deployment Automation Framework는 SAP 환경을 배포, 설치 및 유지 관리할 수 있는 오픈 소스 오케스트레이션 도구입니다.", - "training": "https://github.com/Azure/sap-automation", + "text": "새 노드 요청에 대한 리드 타임을 염두에 두고 ESXi 호스트 밀도 및 효율성에 대한 정책이 있는지 확인합니다", "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", + "service": "AVS", "severity": "보통", - "text": "RTO를 충족하는 시점과 시간 프레임에서 프로덕션 데이터베이스에 대한 특정 시점으로 복구를 수행합니다. 특정 시점 복구에는 일반적으로 DBMS 계층 또는 SAP를 통해 데이터를 삭제하는 운영자 오류가 포함됩니다", - "waf": "신뢰도" + "text": "Azure VMware Solution에 대한 적절한 비용 관리 프로세스가 있는지 확인 - Azure Cost Management를 사용할 수 있습니다.", + "waf": "비용" }, { - "checklist": "SAP Checklist", - "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", + "service": "AVS", + "severity": "낮다", + "text": "Azure VMware Solution 사용 비용을 최적화하는 데 사용되는 Azure 예약 인스턴스입니까?", + "waf": "비용" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "6691e883-5ac9-4422-83e1-3810523081a9", + "service": "AVS", "severity": "보통", - "text": "백업 및 복구 시간을 테스트하여 재해 발생 후 모든 시스템을 동시에 복원하기 위한 RTO 요구 사항을 충족하는지 확인합니다.", - "waf": "신뢰도" + "text": "다른 Azure 네이티브 서비스를 사용할 때 Azure Private-Link 사용 고려", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "b651423c-8552-42db-a545-5cb50c05527a", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", + "service": "AVS", "severity": "높다", - "text": "쌍을 이루는 지역 간에 표준 스토리지를 복제할 수 있지만 표준 스토리지를 사용하여 데이터베이스 또는 가상 하드 디스크를 저장할 수는 없습니다. 사용하는 쌍을 이루는 지역 간에만 백업을 복제할 수 있습니다. 다른 모든 데이터의 경우 SQL Server Always On 또는 SAP HANA 시스템 복제와 같은 네이티브 DBMS 기능을 사용하여 복제를 실행합니다. SAP 애플리케이션 계층에 Site Recovery, rsync 또는 robocopy 및 기타 타사 소프트웨어의 조합을 사용합니다.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", - "waf": "신뢰도" + "text": "필요한 모든 리소스가 동일한 Azure 가용성 영역 내에 있는지 확인합니다.", + "waf": "공연" }, { - "checklist": "SAP Checklist", - "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", + "service": "AVS", "severity": "보통", - "text": "Azure 가용성 영역을 사용하여 고가용성을 달성하는 경우 SAP 애플리케이션 서버와 데이터베이스 서버 간의 대기 시간을 고려해야 합니다. 대기 시간이 긴 영역의 경우 SAP 애플리케이션 서버와 데이터베이스 서버가 항상 동일한 영역에서 실행되도록 운영 절차를 마련해야 합니다.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", - "waf": "신뢰도" + "text": "Azure VMware Solution 게스트 VM 워크로드에 대해 클라우드용 Microsoft Defender 사용", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", + "service": "AVS", + "severity": "보통", + "text": "Azure Arc 지원 서버를 사용하여 Azure VMware Solution 게스트 VM 워크로드 관리", + "waf": "안전" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", + "service": "AVS", "severity": "높다", - "text": "온-프레미스에서 기본 및 보조 Azure 재해 복구 지역으로의 ExpressRoute 연결을 설정합니다. 또한 ExpressRoute를 사용하는 대신 온-프레미스에서 주 및 보조 Azure 재해 복구 지역으로 VPN 연결을 설정하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", - "waf": "신뢰도" + "text": "Azure VMware Solution에서 진단 및 메트릭 로깅 사용Enable Diagnostic and metric logging on Azure VMware Solution", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "SAP", - "severity": "낮다", - "text": "DR 지역에서 데이터의 암호를 해독할 수 있도록 지역 간에 인증서, 비밀 또는 키와 같은 키 자격 증명 모음 콘텐츠를 복제합니다.", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", + "service": "AVS", + "severity": "보통", + "text": "Azure VMware Solution 게스트 VM 워크로드에 Log Analytics 에이전트 배포", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "589d457a-927c-4397-9d11-02cad6aae11e", + "service": "AVS", "severity": "보통", - "text": "기본 및 재해 복구 가상 네트워크를 피어링합니다. 예를 들어 HANA 시스템 복제의 경우 SAP HANA DB 가상 네트워크를 재해 복구 사이트의 SAP HANA DB 가상 네트워크에 피어링해야 합니다.", - "waf": "신뢰도" + "text": "Azure VMware Solution VM 워크로드에 대한 백업 정책 및 솔루션을 문서화하고 구현했는지 확인합니다.", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", - "service": "SAP", - "severity": "낮다", - "text": "SAP 배포에 Azure NetApp Files 스토리지를 사용하는 경우 최소한 두 지역의 프리미엄 계층에 두 개의 Azure NetApp Files 계정을 만듭니다.", - "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "ee29711b-d352-4caa-ab79-b198dab81932", + "service": "AVS", + "severity": "보통", + "text": "클라우드용 Microsoft Defender를 사용하여 Azure VMware Solution에서 실행되는 워크로드의 규정 준수 모니터링", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", - "severity": "높다", - "text": "기본 데이터베이스 복제 기술을 사용하여 HA 쌍의 데이터베이스를 동기화해야 합니다.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", + "service": "AVS", + "severity": "보통", + "text": "적용 가능한 규정 준수 기준이 클라우드용 Microsoft Defender에 추가되었나요?", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", - "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", + "service": "AVS", "severity": "높다", - "text": "기본 VNet(가상 네트워크)에 대한 CIDR은 DR 사이트 VNet의 CIDR과 충돌하거나 겹치지 않아야 합니다", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", - "waf": "신뢰도" + "text": "Azure VMware Solution 배포에 사용할 Azure 지역을 선택할 때 데이터 보존이 평가되었나요?", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", + "service": "AVS", "severity": "높다", - "text": "Site Recovery를 사용하여 응용 프로그램 서버를 DR 사이트에 복제합니다. Site Recovery는 중앙 서비스 클러스터 VM을 DR 사이트에 복제하는 데도 도움이 될 수 있습니다. DR을 호출할 때 DR 사이트에서 Linux Pacemaker 클러스터를 다시 구성해야 합니다(예: VIP 또는 SBD 바꾸기, corosync.conf 실행 등).", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", - "waf": "신뢰도" + "text": "데이터 처리의 영향(서비스 제공자/서비스 소비자 모델)이 명확하고 문서화되어 있습니까?", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", - "severity": "높다", - "text": "단일 장애 지점에 대한 SAP 소프트웨어의 가용성을 고려합니다. 여기에는 SAP NetWeaver 및 SAP S/4HANA 아키텍처, SAP ABAP 및 ASCS + SCS에서 사용되는 DBMS와 같은 애플리케이션 내의 단일 실패 지점이 포함됩니다. 또한 SAP Web Dispatcher와 같은 다른 도구도 있습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "547c1747-dc56-4068-a714-435cd19dd244", + "service": "AVS", + "severity": "보통", + "text": "규정 준수를 위해 필요한 경우에만 vSAN에 CMK(고객 관리 키)를 사용하는 것이 좋습니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", + "service": "AVS", "severity": "높다", - "text": "SAP 및 SAP 데이터베이스의 경우 자동 장애 조치(failover) 클러스터를 구현하는 것이 좋습니다. Windows에서 Windows Server 장애 조치(failover) 클러스터링은 장애 조치(failover)를 지원합니다. Linux에서 Linux Pacemaker 또는 SIOS Protection Suite 및 Veritas InfoScale과 같은 타사 툴은 장애 조치를 지원합니다.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "신뢰도" + "text": "핵심 Azure VMware Solution 모니터링 인사이트를 사용하도록 설정하는 대시보드 만들기", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", + "service": "AVS", "severity": "높다", - "text": "Azure는 기본 및 보조 VM이 DBMS 데이터에 대한 스토리지를 공유하는 아키텍처를 지원하지 않습니다. DBMS 계층의 경우 일반적인 아키텍처 패턴은 기본 및 보조 VM에서 사용하는 것과 다른 스토리지 스택을 사용하여 동시에 데이터베이스를 복제하는 것입니다.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", - "waf": "신뢰도" + "text": "Azure VMware Solution 성능에 대한 자동 경고에 대한 중요 임계값에 대한 경고 만들기(CPU >80%, 평균 메모리>80%, vSAN>70%)", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", - "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "9659e396-80e7-4828-ac93-5657d02bff45", + "service": "AVS", "severity": "높다", - "text": "DBMS 데이터 및 트랜잭션/다시 실행 로그 파일은 Azure 지원 블록 스토리지 또는 Azure NetApp Files에 저장됩니다. Azure Files 또는 Azure Premium Files는 DBMS 데이터 및/또는 SAP 워크로드가 있는 다시 실행 로그 파일에 대한 스토리지로 지원되지 않습니다.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", - "waf": "신뢰도" + "text": "VMware의 지원 임계값이므로 vSAN 사용량이 75% 미만인지 모니터링하기 위해 중요한 경고가 생성되었는지 확인합니다.", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", - "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", + "service": "AVS", "severity": "높다", - "text": "ASCS + SCS 구성 요소 및 특정 고가용성 시나리오에 대해 Windows에서 Azure 공유 디스크를 사용할 수 있습니다. SAP 애플리케이션 계층 구성 요소 및 DBMS 계층에 대해 장애 조치(failover) 클러스터를 별도로 설정합니다. Azure는 현재 SAP 애플리케이션 계층 구성 요소와 DBMS 계층을 하나의 장애 조치(failover) 클러스터로 결합하는 고가용성 아키텍처를 지원하지 않습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "신뢰도" + "text": "Azure Service Health 경고 및 알림에 대해 경고가 구성되었는지 확인", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", - "service": "SAP", - "severity": "높다", - "text": "SAP ASCS(애플리케이션 계층 구성 요소) 및 DBMS 계층에 대한 대부분의 장애 조치(failover) 클러스터에는 장애 조치(failover) 클러스터에 대한 가상 IP 주소가 필요합니다. Azure Load Balancer는 다른 모든 경우에 대한 가상 IP 주소를 처리해야 합니다. 한 가지 설계 원칙은 클러스터 구성당 하나의 부하 분산 장치를 사용하는 것입니다. 부하 분산 장치의 표준 버전(표준 Load Balancer SKU)을 사용하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", + "service": "AVS", + "severity": "보통", + "text": "처리를 위해 Azure Storage 계정 또는 Azure EventHub로 보내도록 Azure VMware Solution 로깅 구성", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", - "service": "SAP", - "severity": "높다", - "text": "로드 밸런서에서 유동 IP가 사용하도록 설정되어 있는지 확인합니다.", - "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", + "service": "AVS", + "severity": "낮다", + "text": "VMware vSphere에 대한 심층적인 통찰력이 필요한 경우: 솔루션에서 vRealize Operations 및/또는 vRealize Network Insights가 사용됩니까?", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", + "service": "AVS", "severity": "높다", - "text": "고가용성 인프라를 배포하기 전에 선택한 지역에 따라 Azure 가용성 집합 또는 가용성 영역을 사용하여 배포할지 여부를 결정합니다.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "신뢰도" + "text": "VM에 대한 vSAN 스토리지 정책은 씩 프로비저닝을 적용하므로 기본 스토리지 정책이 아닌지 확인합니다.", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", - "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", - "service": "SAP", - "severity": "높다", - "text": "SAP 구성 요소(중앙 서비스, 애플리케이션 서버 및 데이터베이스)용 애플리케이션에 대한 인프라 SLA를 충족하려면 모든 구성 요소에 대해 동일한 고가용성 옵션(VM, 가용성 집합, 가용성 영역)을 선택해야 합니다.", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", + "service": "AVS", + "severity": "보통", + "text": "vSAN은 유한한 리소스이므로 vSphere 컨텐츠 라이브러리가 vSAN에 배치되지 않도록 합니다.", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "cbe05bbe-209d-4490-ba47-778424d11678", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", - "severity": "높다", - "text": "동일한 가용성 집합에 서로 다른 역할의 서버를 혼합하지 마십시오. 중앙 서비스 VM, 데이터베이스 VM, 애플리케이션 VM을 자체 가용성 집합으로 유지", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", + "service": "AVS", + "severity": "보통", + "text": "백업 솔루션에 대한 데이터 저장소가 vSAN 스토리지 외부에 저장되어 있는지 확인합니다. Azure 네이티브 또는 디스크 풀 지원 데이터 저장소에서", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", - "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", + "service": "AVS", "severity": "보통", - "text": "근접 배치 그룹을 사용하지 않는 한 Azure 가용성 영역 내에 Azure 가용성 집합을 배포할 수 없습니다.", - "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "waf": "신뢰도" + "text": "Azure VMware Solution에서 실행되는 워크로드가 서버용 Azure Arc를 사용하여 하이브리드 관리되는지 확인합니다(Arc for Azure VMware Solution은 미리 보기 상태임).", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "9674e7c7-7796-4181-8920-09f4429543ba", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", - "severity": "높다", - "text": "가용성 집합을 만들 때 사용 가능한 최대 장애 도메인 및 업데이트 도메인 수를 사용합니다. 예를 들어 하나의 가용성 집합에 두 개 이상의 VM을 배포하는 경우 Azure의 계획된 유지 관리 외에도 잠재적인 물리적 하드웨어 오류, 네트워크 중단 또는 전원 중단의 영향을 제한하기 위해 최대 장애 도메인 수(3개)와 충분한 업데이트 도메인을 사용합니다. 장애 도메인의 기본 수는 2개이며 나중에 온라인으로 변경할 수 없습니다.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", + "service": "AVS", + "severity": "보통", + "text": "Azure Log Analytics 및 Azure Monitor를 사용하여 Azure VMware Solution에서 실행되는 워크로드를 모니터링하는지 확인합니다.", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", - "severity": "높다", - "text": "가용성 집합 배포에서 Azure 근접 배치 그룹을 사용하는 경우 세 가지 SAP 구성 요소(중앙 서비스, 애플리케이션 서버 및 데이터베이스)가 모두 동일한 근접 배치 그룹에 있어야 합니다.", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", + "service": "AVS", + "severity": "보통", + "text": "기존 업데이트 관리 도구 또는 Azure 업데이트 관리에 Azure VMware Solution에서 실행되는 워크로드 포함", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", - "severity": "높다", - "text": "SAP SID당 하나의 근접 배치 그룹을 사용합니다. 그룹은 가용성 영역 또는 Azure 지역에 걸쳐 있지 않습니다.", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", + "service": "AVS", + "severity": "보통", + "text": "Azure Policy를 사용하여 Azure 관리, 모니터링 및 보안 솔루션에서 Azure VMware Solution 워크로드 온보딩", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", - "severity": "높다", - "text": "운영 체제에 따라 다음 서비스 중 하나를 사용하여 SAP 중앙 서비스 클러스터를 실행합니다.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "신뢰도" + "checklist": "Azure VMware Solution Design Review", + "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", + "service": "AVS", + "severity": "보통", + "text": "Azure VMware Solution에서 실행되는 워크로드가 클라우드용 Microsoft Defender에 온보딩되었는지 확인", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "ed46b937-913e-4018-9c62-8393ab037e53", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", + "service": "AVS", "severity": "보통", - "text": "Azure는 현재 동일한 Linux Pacemaker 클러스터에서 ASCS와 DB HA의 결합을 지원하지 않습니다. 개별 클러스터로 분리합니다. 그러나 최대 5개의 여러 중앙 서비스 클러스터를 한 쌍의 VM으로 결합할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "text": "vSAN은 유한한 리소스이므로 백업이 vSAN에 저장되지 않도록 합니다.", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "f656e745-0cfb-453e-8008-0528fa21c933", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", + "service": "AVS", "severity": "보통", - "text": "가용성 집합 또는 가용성 영역의 고가용성 쌍에 두 VM을 모두 배포합니다. 이러한 VM은 크기가 동일하고 스토리지 구성이 동일해야 합니다.", + "text": "모든 DR 솔루션을 고려하고 비즈니스에 가장 적합한 솔루션을 결정했습니까? [SRM/제트스트림/제르토/빔/...]", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "7f684ebc-95da-425e-b329-e782dbed050f", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", + "service": "AVS", "severity": "보통", - "text": "Azure는 RHEL(Red Hat Enterprise Linux)에서 실행되는 동일한 고가용성 클러스터에 SAP HANA, ASCS/SCS 및 ERS 인스턴스의 설치 및 구성을 지원합니다.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "text": "재해 복구 기술이 네이티브 Azure IaaS인 경우 Azure Site Recovery 사용Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", + "service": "AVS", "severity": "높다", - "text": "프리미엄 관리형 SSD에서 모든 프로덕션 시스템을 실행하고 Azure NetApp Files 또는 Ultra Disk Storage를 사용합니다. 적어도 OS 디스크는 프리미엄 계층에 있어야 더 나은 성능과 최상의 SLA를 달성할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "text": "재해 솔루션 중 하나와 함께 자동화된 복구 계획을 사용하고 가능한 한 수동 작업을 피하십시오.", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", - "service": "SAP", - "severity": "높다", - "text": "Azure의 SAP HANA는 SAP에서 인증한 스토리지 유형에서만 실행해야 합니다. 특정 볼륨은 해당되는 경우 특정 디스크 구성에서 실행되어야 합니다. 이러한 구성에는 Write Accelerator 사용 및 Premium Storage 사용이 포함됩니다. 또한 스토리지에서 실행되는 파일 시스템이 시스템에서 실행되는 DBMS와 호환되는지 확인해야 합니다.", - "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", + "checklist": "Azure VMware Solution Design Review", + "guid": "8255461e-2aee-4345-9aec-8339248b262d", + "service": "AVS", + "severity": "보통", + "text": "지정학적 지역 쌍을 보조 재해 복구 환경으로 사용Use the geopolitical region pair as the secondary disaster recovery environment", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", + "service": "AVS", "severity": "높다", - "text": "SAP 워크로드에 사용하는 스토리지 유형에 따라 고가용성을 구성하는 것이 좋습니다. Azure에서 사용할 수 있는 일부 스토리지 서비스는 Azure Site Recovery에서 지원되지 않으므로 고가용성 구성이 다를 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", + "text": "지역 간에 2개의 서로 다른 주소 공간을 사용합니다(예: 서로 다른 지역에 대해 10.0.0.0/16 및 192.168.0.0/16).", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", - "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", - "service": "SAP", - "severity": "높다", - "text": "일부 지역에서는 다양한 네이티브 Azure Storage 서비스(예: Azure Files, Azure NetApp Files, Azure Shared Disk)를 사용하지 못할 수 있습니다. 따라서 장애 조치(failover) 후 DR 지역에서 유사한 SAP를 설정하려면 해당 스토리지 서비스가 DR 사이트에서 제공되는지 확인합니다.", + "checklist": "Azure VMware Solution Design Review", + "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", + "service": "AVS", + "severity": "보통", + "text": "ExpressRoute Global Reach는 기본 및 보조 Azure VMware Solution 프라이빗 클라우드 간의 연결에 사용되나요, 아니면 네트워크 가상 어플라이언스를 통해 라우팅이 수행되나요?", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", + "service": "AVS", "severity": "보통", - "text": "SAP System Start-Stop을 자동화하여 비용을 관리합니다.", - "waf": "비용" + "text": "모든 백업 솔루션을 고려하고 비즈니스에 가장 적합한 솔루션을 결정했습니까? [ MABS/CommVault/Metallic.io/Veeam/입니다. ]", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", - "severity": "낮다", - "text": "SAP HANA와 함께 Azure Premium Storage를 사용하는 경우 Azure 표준 SSD 스토리지를 사용하여 비용에 민감한 스토리지 솔루션을 선택할 수 있습니다. 그러나 표준 SSD 또는 표준 HDD Azure Storage를 선택하면 개별 VM의 SLA에 영향을 줍니다. 또한 비프로덕션 환경과 같이 I/O 처리량이 낮고 대기 시간이 짧은 시스템의 경우 더 낮은 시리즈 VM을 사용할 수 있습니다.", - "waf": "비용" + "checklist": "Azure VMware Solution Design Review", + "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", + "service": "AVS", + "severity": "보통", + "text": "Azure VMware Solution 프라이빗 클라우드와 동일한 지역에 백업 솔루션 배포Deploy your backup solution in the same region as your Azure VMware Solution private cloud", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "9877f353-2591-4e8b-8381-e9043fed1010", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", - "severity": "낮다", - "text": "저렴한 대체 구성(다목적)으로 비프로덕션 HANA 데이터베이스 서버 VM에 대해 저성능 SKU를 선택할 수 있습니다. 그러나 E 시리즈와 같은 일부 VM 유형은 HANA 인증(SAP HANA 하드웨어 디렉터리)되지 않았거나 1ms 미만의 스토리지 대기 시간을 달성할 수 없습니다.", - "waf": "비용" + "checklist": "Azure VMware Solution Design Review", + "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", + "service": "AVS", + "severity": "보통", + "text": "vSan의 외부, Azure 네이티브 구성 요소에 백업 솔루션 배포", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", - "service": "SAP", - "severity": "높다", - "text": "관리 그룹, 구독, 리소스 그룹 및 리소스에 대한 RBAC 모델 적용Enforce a RBAC model for management groups, subscriptions, resource groups and resources", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", + "service": "AVS", + "severity": "낮다", + "text": "Azure 플랫폼에서 관리하는 VMware 구성 요소의 복원을 요청하는 프로세스가 마련되어 있나요?", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "45911475-e39e-4530-accc-d979366bcda2", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", - "severity": "보통", - "text": "클라우드 커넥터를 통해 SAP 클라우드 애플리케이션에서 SAP 온-프레미스(IaaS 포함)로 ID를 전달하기 위한 보안 주체 전파 적용", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", + "service": "AVS", + "severity": "낮다", + "text": "수동 배포의 경우 모든 구성 및 배포를 문서화해야 합니다", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", - "severity": "보통", - "text": "SAML을 사용하여 Azure AD로 SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics 및 SAP C4C와 같은 SAP SaaS 애플리케이션에 대한 SSO를 구현합니다.", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", + "service": "AVS", + "severity": "낮다", + "text": "수동 배포의 경우 Azure VMware Solution 프라이빗 클라우드에서 실수로 인한 작업을 방지하기 위해 리소스 잠금을 구현하는 것이 좋습니다", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", - "severity": "보통", - "text": "SAML을 사용하여 SAP Fiori 및 SAP Web GUI와 같은 SAP NetWeaver 기반 웹 애플리케이션에 대한 SSO를 구현합니다.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", + "service": "AVS", + "severity": "낮다", + "text": "자동화된 배포의 경우 최소한의 프라이빗 클라우드를 배포하고 필요에 따라 확장합니다", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", - "service": "SAP", - "severity": "보통", - "text": "SAML을 사용하여 SAP Fiori 및 SAP Web GUI와 같은 SAP NetWeaver 기반 웹 애플리케이션에 대한 SSO를 구현합니다.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", + "service": "AVS", + "severity": "낮다", + "text": "자동화된 배포의 경우 배포를 시작하기 전에 할당량을 요청하거나 예약합니다", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", - "severity": "보통", - "text": "SAP NetWeaver SSO 또는 파트너 솔루션을 사용하여 SAP GUI에 대한 SSO를 구현할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", + "service": "AVS", + "severity": "낮다", + "text": "자동화된 배포의 경우 적절한 거버넌스를 위해 자동화 또는 Azure Policy를 통해 관련 리소스 잠금을 만들어야 합니다", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", - "service": "SAP", - "severity": "보통", - "text": "SAP GUI 및 웹 브라우저 액세스를 위한 SSO의 경우 구성 및 유지 관리가 용이하여 SNC/Kerberos/SPNEGO(간단하고 보호된 GSSAPI 협상 메커니즘)를 구현합니다. X.509 클라이언트 인증서를 사용하는 SSO의 경우 SAP SSO 솔루션의 구성 요소인 SAP 보안 로그인 서버를 고려합니다.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", + "service": "AVS", + "severity": "낮다", + "text": "ExR 인증 키에 대해 사람이 이해할 수 있는 이름을 구현하여 키의 목적/용도를 쉽게 식별할 수 있습니다.", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", - "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", - "service": "SAP", - "severity": "보통", - "text": "SAP GUI 및 웹 브라우저 액세스를 위한 SSO의 경우 구성 및 유지 관리가 용이하여 SNC/Kerberos/SPNEGO(간단하고 보호된 GSSAPI 협상 메커니즘)를 구현합니다. X.509 클라이언트 인증서를 사용하는 SSO의 경우 SAP SSO 솔루션의 구성 요소인 SAP 보안 로그인 서버를 고려합니다.", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "255461e2-aee3-4553-afc8-339248b262d6", + "service": "AVS", + "severity": "낮다", + "text": "Azure VMware Solution 및 ExpressRoute를 배포하는 데 별도의 서비스 원칙을 사용하는 경우 Key Vault를 사용하여 비밀 및 권한 부여 키를 저장합니다", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "16785d6f-a96c-496a-b885-18f482734c88", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", - "service": "SAP", - "severity": "보통", - "text": "SAP NetWeaver용 OAuth를 사용하여 SSO를 구현하여 타사 또는 사용자 지정 애플리케이션이 SAP NetWeaver OData 서비스에 액세스할 수 있도록 합니다.", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", + "service": "AVS", + "severity": "낮다", + "text": "Azure VMware Solution은 제한된 수의 병렬 작업만 지원하므로 많은 리소스를 Azure VMware Solution 배포해야 하는 경우 IaC에서 작업을 직렬화하기 위한 리소스 종속성을 정의합니다.", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "a747c350-8d4c-449c-93af-393dbca77c48", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", - "service": "SAP", - "severity": "보통", - "text": "SAP HANA에 대한 SSO 구현", - "waf": "안전" + "checklist": "Azure VMware Solution Design Review", + "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", + "service": "AVS", + "severity": "낮다", + "text": "단일 Tier-1 게이트웨이를 사용하여 NSX-T 세그먼트의 자동화된 구성을 수행하는 경우 NSX-Manager API 대신 Azure Portal API를 사용합니다", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", + "service": "AVS", "severity": "보통", - "text": "Azure AD를 RISE에서 호스트되는 SAP 시스템의 ID 공급자로 간주합니다. 자세한 내용은 Azure AD와 서비스 통합을 참조하세요.", - "waf": "안전" + "text": "자동화된 스케일 아웃을 사용하려는 경우 Azure VMware Solution을 실행하는 구독에 대해 충분한 Azure VMware Solution 할당량을 적용해야 합니다", + "waf": "공연" }, { - "checklist": "SAP Checklist", - "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", - "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", + "service": "AVS", "severity": "보통", - "text": "SAP에 액세스하는 애플리케이션의 경우 보안 주체 전파를 사용하여 SSO를 설정할 수 있습니다.", - "waf": "안전" + "text": "자동 축소를 사용하려는 경우 이러한 작업을 수행하기 전에 스토리지 정책 요구 사항을 고려해야 합니다", + "waf": "공연" }, { - "checklist": "SAP Checklist", - "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", + "service": "AVS", "severity": "보통", - "text": "SAP IAS(Identity Authentication Service)가 필요한 SAP BTP 서비스 또는 SaaS 솔루션을 사용하는 경우 SAP Cloud Identity Authentication Services와 Azure AD 간에 SSO를 구현하여 해당 SAP 서비스에 액세스하는 것이 좋습니다. 이 통합을 통해 SAP IAS는 프록시 ID 공급자 역할을 하고 중앙 사용자 저장소 및 ID 공급자인 Azure AD에 인증 요청을 전달할 수 있습니다.", - "waf": "안전" + "text": "한 번에 하나의 크기 조정 작업만 수행할 수 있으므로 크기 조정 작업은 항상 단일 SDDC 내에서 직렬화되어야 합니다(여러 클러스터를 사용하는 경우에도)", + "waf": "공연" }, { - "checklist": "SAP Checklist", - "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", + "service": "AVS", "severity": "보통", - "text": "SAP BTP에 대한 SSO 구현", - "waf": "안전" + "text": "아키텍처에 사용되는 제3자 솔루션에 대한 확장 작업을 고려하고 검증합니다(지원 여부)Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", + "waf": "공연" }, { - "checklist": "SAP Checklist", - "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", + "service": "AVS", "severity": "보통", - "text": "SAP SuccessFactors를 사용하는 경우 Azure AD 자동화된 사용자 프로비저닝을 사용하는 것이 좋습니다. 이 통합을 통해 SAP SuccessFactors에 새 직원을 추가할 때 Azure AD에서 해당 사용자 계정을 자동으로 만들 수 있습니다. 필요에 따라 Microsoft 365 또는 Azure AD 지원하는 기타 SaaS 애플리케이션에서 사용자 계정을 만들 수 있습니다. SAP SuccessFactors에 이메일 주소의 쓰기 저장을 사용합니다.", - "waf": "안전" + "text": "자동화에서 환경에 대한 규모 확장/축소 최대 한도 정의 및 적용Define and enforce scale in/out maximum limits for your environment in the automations", + "waf": "공연" }, { - "checklist": "SAP Checklist", - "guid": "6ba28021-4591-4147-9e39-e5309cccd979", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", + "service": "AVS", "severity": "보통", - "text": "SAP 구독에 기존 관리 그룹 정책 적용", - "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", + "text": "모니터링 규칙을 구현하여 자동화된 조정 작업을 모니터링하고 성공 및 실패를 모니터링하여 적절한(자동) 응답을 사용하도록 설정합니다.", "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", "severity": "높다", - "text": "긴밀하게 결합된 애플리케이션을 동일한 SAP 구독에 통합하여 추가적인 라우팅 및 관리 복잡성 방지", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", - "waf": "작업" + "text": "MON을 사용하는 경우 동시에 구성된 VM의 제한(HCX에 대한 MON 제한[400 - 표준, 1000 - 대형 어플라이언스])을 알고 있어야 합니다.", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", "severity": "높다", - "text": "구독을 배율 단위로 활용하고 리소스를 확장하려면 환경별로 구독을 배포하는 것이 좋습니다. 샌드박스, 비프로덕션, 프로덕션 ", - "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", - "waf": "작업" + "text": "MON을 사용하는 경우 100개 이상의 네트워크 확장에서 MON을 사용하도록 설정할 수 없습니다", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", - "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", - "service": "SAP", - "severity": "높다", - "text": "구독 프로비저닝의 일부로 할당량 증가 확인(예: 구독 내에서 사용 가능한 총 VM 코어)", - "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "waf": "작업" + "checklist": "Azure VMware Solution Design Review", + "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", + "service": "AVS", + "severity": "보통", + "text": "마이그레이션에 VPN 연결을 사용하는 경우 그에 따라 MTU 크기를 조정합니다.", + "waf": "공연" }, { - "checklist": "SAP Checklist", - "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", - "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", - "service": "SAP", - "severity": "낮다", - "text": "할당량 API는 Azure 서비스에 대한 할당량을 보고 관리하는 데 사용할 수 있는 REST API입니다. 필요한 경우 사용을 고려하십시오.", - "waf": "작업" + "checklist": "Azure VMware Solution Design Review", + "guid": "e614658d-d457-4e92-9139-b821102cad6e", + "service": "AVS", + "severity": "보통", + "text": "Azure(500Mbps 이하)에 연결하는 낮은 연결 지역의 경우 HCX WAN 최적화 어플라이언스 배포를 고려합니다.", + "waf": "공연" }, { - "checklist": "SAP Checklist", - "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", - "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", - "service": "SAP", - "severity": "높다", - "text": "가용성 영역에 배포하는 경우 할당량이 승인되면 VM의 영역 배포를 사용할 수 있는지 확인합니다. 필요한 구독, VM 시리즈, CPU 수 및 가용성 영역을 사용하여 지원 요청을 제출합니다.", - "waf": "작업" + "checklist": "Azure VMware Solution Design Review", + "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", + "service": "AVS", + "severity": "보통", + "text": "마이그레이션이 클라우드 어플라이언스가 아닌 온-프레미스 어플라이언스에서 시작되는지 확인합니다(역방향 마이그레이션을 수행하지 않음).", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "e6e20617-3686-4af4-9791-f8935ada4332", - "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", - "service": "SAP", - "severity": "높다", - "text": "예를 들어 선택한 배포 지역 내에서 필요한 서비스 및 기능을 사용할 수 있는지 확인합니다. ANF, 지역 등.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", - "waf": "작업" + "checklist": "Azure VMware Solution Design Review", + "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "AVS", + "severity": "보통", + "text": "Azure NetApp Files를 사용하여 Azure VMware Solution용 스토리지를 확장하는 경우 VM에 직접 연결하는 대신 VMware 데이터 저장소로 사용하는 것이 좋습니다.", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "AVS", "severity": "보통", - "text": "비용 분류 및 리소스 그룹화를 위해 Azure 리소스 태그 활용(BillTo, 부서(또는 사업부), 환경(프로덕션, 스테이지, 개발), 계층(웹 계층, 애플리케이션 계층), 애플리케이션 소유자, 프로젝트 이름)", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", - "waf": "작업" + "text": "전용 ExpressRoute 게이트웨이가 외부 데이터 스토리지 솔루션에 사용되고 있는지 확인합니다.", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", - "severity": "높다", - "text": "Azure Backup 서비스를 사용하여 HANA 데이터베이스를 보호할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", + "checklist": "Azure VMware Solution Design Review", + "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "AVS", + "severity": "보통", + "text": "외부 데이터 스토리지 솔루션에 사용되는 ExpressRoute 게이트웨이에서 FastPath를 사용하도록 설정되어 있는지 확인합니다.", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", - "service": "SAP", - "severity": "보통", - "text": "HANA, Oracle 또는 DB2 데이터베이스용 Azure NetApp Files를 배포하는 경우 Azure 애플리케이션 일치 스냅샷 도구(AzAcSnap)를 사용하여 애플리케이션 일치 스냅샷을 만듭니다. AzAcSnap은 Oracle 데이터베이스도 지원합니다. 개별 VM이 아닌 중앙 VM에서 AzAcSnap을 사용하는 것이 좋습니다.", + "checklist": "Azure VMware Solution Design Review", + "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "AVS", + "severity": "높다", + "text": "확장된 클러스터를 사용하는 경우 선택한 재해 복구 솔루션이 공급업체에서 지원되는지 확인합니다", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", + "checklist": "Azure VMware Solution Design Review", + "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "AVS", "severity": "높다", - "text": "운영 체제와 SAP 시스템 간의 표준 시간대 일치를 확인합니다.", - "waf": "작업" + "text": "확장된 클러스터를 사용하는 경우 제공된 SLA가 요구 사항을 충족하는지 확인합니다", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "c3c7abc0-716c-4486-893c-40e181d65539", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", - "service": "SAP", - "severity": "보통", - "text": "동일한 클러스터에서 서로 다른 애플리케이션 서비스를 그룹화하지 마세요. 예를 들어 DRBD와 중앙 서비스 클러스터를 동일한 클러스터에 결합하지 마세요. 그러나 동일한 Pacemaker 클러스터를 사용하여 약 5개의 서로 다른 중앙 서비스(다중 SID 클러스터)를 관리할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "checklist": "Azure VMware Solution Design Review", + "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "AVS", + "severity": "높다", + "text": "확장된 클러스터를 사용하는 경우 두 ExpressRoute 회로가 모두 연결 허브에 연결되어 있는지 확인합니다.", "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "a491dfc4-9353-4213-9217-eef0949f9467", - "link": "https://azure.microsoft.com/pricing/offers/dev-test/", - "service": "SAP", - "severity": "낮다", - "text": "Azure 실행 비용을 절감하고 최적화하기 위해 다시 알림 모델에서 개발/테스트 시스템을 실행하는 것이 좋습니다.", - "waf": "비용" + "checklist": "Azure VMware Solution Design Review", + "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "AVS", + "severity": "높다", + "text": "확장된 클러스터를 사용하는 경우 두 ExpressRoute 회로 모두에서 GlobalReach를 사용하도록 설정되어 있는지 확인합니다.", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", - "link": "https://learn.microsoft.com/azure/lighthouse/overview", - "service": "SAP", - "severity": "보통", - "text": "SAP 자산을 관리하여 고객과 파트너 관계를 맺는 경우 Azure Lighthouse를 사용하는 것이 좋습니다. Azure Lighthouse를 사용하면 관리 서비스 공급자가 Azure 네이티브 ID 서비스를 사용하여 고객 환경에 인증할 수 있습니다. 고객은 언제든지 액세스 권한을 취소하고 서비스 제공업체의 조치를 감사할 수 있으므로 고객의 손에 제어 권한을 부여합니다.", - "waf": "작업" + "checklist": "Azure VMware Solution Design Review", + "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "AVS", + "severity": "높다", + "text": "사이트 재해 허용 범위 설정을 적절하게 고려하고 필요한 경우 비즈니스에 맞게 변경하십시오.", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "4d116785-d2fa-456c-96ad-48408fe72734", - "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "스토리지와 관련된 Microsoft 클라우드 보안 벤치마크의 지침 적용", + "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", + "service": "Azure Storage", "severity": "보통", - "text": "Azure Update Manager를 사용하여 단일 VM 또는 여러 VM에 대해 사용 가능한 업데이트의 상태를 확인하고 정기적인 패치를 예약하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", - "waf": "작업" + "text": "'스토리지에 대한 Azure 보안 기준' 고려", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", - "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", - "service": "SAP", - "severity": "낮다", - "text": "SAP Landscape Management(LaMa)를 사용하여 SAP Basis 운영을 최적화하고 관리합니다. Azure용 SAP LaMa 커넥터를 사용하여 SAP 시스템을 재배치, 복사, 복제 및 새로 고칩니다.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", - "waf": "작업" + "checklist": "Azure Blob Storage Review", + "description": "Azure Storage는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 액세스가 필요한 Azure Compute 리소스에만 Azure Storage를 안전하게 노출할 수 있으므로 공용 인터넷에 노출되지 않습니다", + "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", + "service": "Azure Storage", + "severity": "높다", + "text": "Azure Storage에 프라이빗 엔드포인트를 사용하는 것이 좋습니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "14591147-5e39-4e53-89cc-cd979366bcda", - "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "새로 만든 저장소 계정은 ARM 배포 모델을 사용하여 만들어지므로 RBAC, 감사 등을 모두 사용할 수 있습니다. 구독에 클래식 배포 모델이 있는 이전 저장소 계정이 없는지 확인합니다.", + "guid": "30e37c3e-2971-41b2-963c-eee079b598de", + "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", + "service": "Azure Storage", "severity": "보통", - "text": "SAP용 Azure Monitor 솔루션을 사용하여 Azure에서 SAP 워크로드(SAP HANA, 고가용성 SUSE 클러스터 및 SQL 시스템)를 모니터링합니다. SAP Solution Manager를 사용하여 SAP용 Azure Monitor 솔루션을 보완하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", - "waf": "작업" + "text": "이전 스토리지 계정이 '클래식 배포 모델'을 사용하지 않는지 확인", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", - "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "Microsoft Defender를 활용하여 의심스러운 활동 및 잘못된 구성에 대해 알아봅니다.", + "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", + "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", + "service": "Azure Storage", "severity": "높다", - "text": "SAP용 VM 확장 검사를 실행합니다. SAP용 VM 확장은 VM(가상 머신)의 할당된 관리 ID를 사용하여 VM 모니터링 및 구성 데이터에 액세스합니다. 이 검사는 SAP 애플리케이션의 모든 성능 메트릭이 기본 SAP용 Azure 확장에서 제공되는지 확인합니다.", - "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", - "waf": "작업" + "text": "모든 스토리지 계정에 대해 Microsoft Defender 사용", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "일시 삭제 메커니즘을 사용하면 실수로 삭제된 Blob을 복구할 수 있습니다.", + "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", + "service": "Azure Storage", "severity": "보통", - "text": "액세스 제어 및 규정 준수 보고에 Azure Policy를 사용합니다. Azure Policy는 일관된 정책 준수와 빠른 위반 감지를 보장하기 위해 조직 전체 설정을 적용하는 기능을 제공합니다. ", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "작업" + "text": "Blob에 대해 '일시 삭제' 사용Enable 'soft delete' for blobs", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", - "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ", + "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", "severity": "보통", - "text": "Azure Network Watcher의 연결 모니터를 사용하여 SAP 데이터베이스 및 애플리케이션 서버에 대한 대기 시간 메트릭을 모니터링합니다. 또는 Azure Monitor를 사용하여 네트워크 대기 시간 측정값을 수집하고 표시합니다.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", - "waf": "작업" + "text": "Blob에 대해 '일시 삭제' 사용 안 함", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "73686af4-6791-4f89-95ad-a43324e13811", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", - "service": "SAP", - "severity": "보통", - "text": "프로비저닝된 Azure 인프라에서 SAP HANA에 대한 품질 검사를 수행하여 프로비저닝된 VM이 Azure의 SAP HANA 모범 사례를 준수하는지 확인합니다.", - "waf": "작업" + "checklist": "Azure Blob Storage Review", + "description": "컨테이너에 대한 일시 삭제를 사용하면 컨테이너가 삭제된 후 컨테이너를 복구할 수 있습니다(예: 실수로 인한 삭제 작업에서 복구).", + "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", + "service": "Azure Storage", + "severity": "높다", + "text": "컨테이너에 대해 '일시 삭제' 사용Enable 'soft delete' for containers", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "616785d6-fa96-4c96-ad88-518f482734c8", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", - "severity": "높다", - "text": "각 Azure 구독에 대해 영역 배포 전에 Azure 가용성 영역에서 대기 시간 테스트를 실행하여 Azure에서 SAP를 배포하기 위한 대기 시간이 짧은 영역을 선택합니다.", - "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "waf": "공연" - }, - { - "checklist": "SAP Checklist", - "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", - "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ", + "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", "severity": "보통", - "text": "복원력 보고서를 실행하여 프로비저닝된 전체 Azure 인프라(컴퓨팅, 데이터베이스, 네트워킹, 스토리지, Site Recovery)의 구성이 Azure용 클라우드 적응 프레임워크에서 정의한 구성을 준수하는지 확인합니다.", - "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", - "waf": "신뢰도" + "text": "컨테이너에 대해 '일시 삭제' 사용 안 함", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", - "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", - "service": "SAP", - "severity": "보통", - "text": "SAP용 Microsoft Sentinel 솔루션을 사용하여 위협 방지를 구현합니다. 이 솔루션을 사용하여 SAP 시스템을 모니터링하고 비즈니스 로직 및 애플리케이션 계층 전체에서 정교한 위협을 탐지할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", + "checklist": "Azure Blob Storage Review", + "description": "사용자가 삭제하기 전에 먼저 삭제 잠금을 제거하도록 강제하여 저장소 계정이 실수로 삭제되는 것을 방지합니다.", + "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", + "severity": "높다", + "text": "스토리지 계정에 대한 리소스 잠금 사용Enable resource locks on storage accounts", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", - "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "service": "SAP", - "severity": "보통", - "text": "Azure 태그 지정을 활용하여 리소스를 논리적으로 그룹화 및 추적하고, 배포를 자동화하고, 가장 중요한 것은 발생한 비용에 대한 가시성을 제공할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", - "waf": "작업" + "checklist": "Azure Blob Storage Review", + "description": "Blob에 대한 '법적 보존' 또는 '시간 기반 보존' 정책을 고려하면 Blob, 컨테이너 또는 스토리지 계정을 삭제할 수 없습니다. '불가능'은 실제로 '불가능'을 의미합니다. 스토리지 계정에 변경할 수 없는 Blob이 포함된 경우 해당 스토리지 계정을 '제거'하는 유일한 방법은 Azure 구독을 취소하는 것입니다.", + "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", + "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", + "service": "Azure Storage", + "severity": "높다", + "text": "변경할 수 없는 Blob 고려", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", - "service": "SAP", - "severity": "낮다", - "text": "대기 시간에 민감한 애플리케이션에 대해 VM 간 대기 시간 모니터링을 사용합니다.", - "waf": "공연" + "checklist": "Azure Blob Storage Review", + "description": "모든 데이터 전송이 암호화되고, 무결성이 보호되고, 서버가 인증되도록 스토리지 계정에 대한 보호되지 않는 HTTP/80 액세스를 사용하지 않도록 설정하는 것이 좋습니다. ", + "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Azure Storage", + "severity": "높다", + "text": "HTTPS 필요, 즉 스토리지 계정에서 포트 80 사용 안 함Require HTTPS, i.e. disable port 80 on the storage account", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", - "severity": "보통", - "text": "Azure Site Recovery 모니터링을 사용하여 SAP 애플리케이션 서버에 대한 재해 복구 서비스의 상태를 유지 관리합니다.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", - "waf": "신뢰도" + "checklist": "Azure Blob Storage Review", + "description": "스토리지 계정에서 사용자 지정 도메인(호스트 이름)을 구성할 때 TLS/HTTPS가 필요한지 여부를 확인합니다. 이 경우 저장소 계정 앞에 Azure CDN을 배치해야 할 수 있습니다.", + "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", + "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", + "service": "Azure Storage", + "severity": "높다", + "text": "HTTPS를 적용할 때(HTTP 사용 안 함) 스토리지 계정에 사용자 지정 도메인(CNAME)을 사용하지 않는지 확인합니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "클라이언트가 SAS 토큰을 사용하여 Blob 데이터에 액세스할 때 HTTPS를 요구하면 자격 증명 손실 위험을 최소화하는 데 도움이 됩니다.", + "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", + "service": "Azure Storage", "severity": "보통", - "text": "모든 데이터베이스 파일 시스템 및 실행 프로그램을 바이러스 백신 검사에서 제외합니다. 이를 포함하면 성능 문제가 발생할 수 있습니다. 제외 목록에 대한 규범적 세부 정보는 데이터베이스 공급업체에 문의하십시오. 예를 들어 Oracle은 바이러스 백신 검사에서 /oracle//sapdata를 제외할 것을 권장합니다.", - "waf": "공연" + "text": "SAS(공유 액세스 서명) 토큰을 HTTPS 연결로만 제한", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "c027f893-f404-41a9-b33d-39d625a14964", - "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", - "service": "SAP", - "severity": "낮다", - "text": "마이그레이션 후 비 HANA 데이터베이스에 대한 전체 데이터베이스 통계를 수집하는 것이 좋습니다. 예를 들어 SAP Note 1020260 - Oracle 통계 제공을 구현합니다.", - "waf": "공연" + "checklist": "Azure Blob Storage Review", + "description": "AAD 토큰은 가능한 경우 공유 액세스 서명보다 우선해야 합니다", + "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", + "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", + "service": "Azure Storage", + "severity": "높다", + "text": "Blob 액세스에 Azure AD(Azure Active Directory) 토큰 사용Use Azure Active Directory (Azure AD) tokens for blob access", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "사용자, 그룹 또는 응용 프로그램에 역할을 할당할 때 해당 보안 주체가 작업을 수행하는 데 필요한 권한만 부여합니다. 리소스에 대한 액세스를 제한하면 의도하지 않은 데이터 오용과 악의적인 데이터 오용을 모두 방지할 수 있습니다.", + "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", + "service": "Azure Storage", "severity": "보통", - "text": "Azure에서 SAP를 사용하는 모든 Oracle 배포에 Oracle ASM(Automatic Storage Management)을 사용하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", - "waf": "공연" + "text": "IaM 권한의 최소 권한", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", - "service": "SAP", - "severity": "보통", - "text": "Oracle을 실행하는 Azure의 SAP의 경우 SQL 스크립트 컬렉션은 성능 문제를 진단하는 데 도움이 될 수 있습니다. AWR(Automatic Workload Repository) 보고서에는 Oracle 시스템의 문제점을 진단하는 데 유용한 정보가 포함되어 있습니다. 여러 세션 동안 AWR 보고서를 실행하고 피크 시간을 선택하여 광범위한 분석 범위를 보장하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", - "waf": "공연" + "checklist": "Azure Blob Storage Review", + "description": "사용자 위임 SAS는 Azure AD(Azure Active Directory) 자격 증명과 SAS에 지정된 권한으로 보호됩니다. 사용자 위임 SAS는 범위와 기능 측면에서 서비스 SAS와 유사하지만 서비스 SAS에 비해 보안상의 이점을 제공합니다. ", + "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", + "service": "Azure Storage", + "severity": "높다", + "text": "SAS를 사용하는 경우 스토리지 계정 키 기반 SAS보다 '사용자 위임 SAS'를 선호합니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "스토리지 계정 키('공유 키')에는 감사 기능이 거의 없습니다. 누가/언제 키 사본을 가져왔는지 모니터링할 수 있지만, 키가 여러 사람의 손에 들어가면 특정 사용자의 사용을 귀속시키는 것은 불가능합니다. AAD 인증에만 의존하면 스토리지 액세스를 사용자에게 더 쉽게 연결할 수 있습니다. ", + "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", + "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", + "service": "Azure Storage", "severity": "높다", - "text": "Azure Site Recovery 모니터링을 사용하여 SAP 애플리케이션 서버에 대한 재해 복구 서비스의 상태를 유지 관리합니다.", - "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", - "waf": "작업" + "text": "AAD 액세스(및 사용자 위임 SAS)만 지원되도록 스토리지 계정 키를 사용하지 않도록 설정하는 것이 좋습니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "활동 로그 데이터를 사용하여 스토리지 계정의 보안을 보거나 변경하는 '시기', '누가', '무엇을' 및 '방법'(예: 스토리지 계정 키, 액세스 정책 등)을 식별합니다.", + "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", + "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", + "service": "Azure Storage", + "severity": "높다", + "text": "Azure Monitor를 사용하여 스토리지 계정에 대한 컨트롤 플레인 작업을 감사하는 것이 좋습니다.", + "waf": "안전" + }, + { + "checklist": "Azure Blob Storage Review", + "description": "키 만료 정책을 사용하면 계정 액세스 키 교체에 대한 미리 알림을 설정할 수 있습니다. 지정된 간격이 경과하고 키가 아직 회전되지 않은 경우 알림이 표시됩니다.", + "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", + "service": "Azure Storage", "severity": "보통", - "text": "HTTP/S 앱을 안전하게 배달하려면 Application Gateway v2를 사용하고 WAF 보호 및 정책이 사용하도록 설정되어 있는지 확인합니다.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", + "text": "스토리지 계정 키를 사용하는 경우 '키 만료 정책'을 사용하도록 설정하는 것이 좋습니다", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "SAS 만료 정책은 SAS가 유효한 권장 간격을 지정합니다. SAS 만료 정책은 서비스 SAS 또는 계정 SAS에 적용됩니다. 사용자가 권장 간격보다 큰 유효 간격을 사용하여 서비스 SAS 또는 계정 SAS를 생성하면 경고가 표시됩니다.", + "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", + "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", + "service": "Azure Storage", "severity": "보통", - "text": "Azure로 마이그레이션하는 동안 가상 머신의 DNS 또는 가상 이름이 변경되지 않은 경우 백그라운드 DNS 및 가상 이름은 SAP 환경의 많은 시스템 인터페이스를 연결하며, 고객은 시간이 지남에 따라 개발자가 정의하는 인터페이스를 인식하는 경우에만 인식할 수 있습니다. 마이그레이션 후 가상 또는 DNS 이름이 변경될 때 다양한 시스템 간에 연결 문제가 발생하며, 이러한 유형의 문제를 방지하기 위해 DNS 별칭을 유지하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", - "waf": "작업" + "text": "SAS 만료 정책 구성 고려", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "저장된 액세스 정책은 스토리지 계정 키를 다시 생성할 필요 없이 서비스 SAS에 대한 권한을 취소하는 옵션을 제공합니다. ", + "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", + "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", + "service": "Azure Storage", "severity": "보통", - "text": "서로 다른 DNS 영역을 사용하여 각 환경(샌드박스, 개발, 사전 프로덕션 및 프로덕션)을 서로 구분합니다. 예외는 자체 VNet을 사용하는 SAP 배포의 경우입니다. 여기서는 프라이빗 DNS 영역이 필요하지 않을 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", - "waf": "작업" + "text": "SAS를 저장된 액세스 정책에 연결하는 것이 좋습니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "a3592829-e6e2-4061-9368-6af46791f893", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", + "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", + "service": "Azure Storage", "severity": "보통", - "text": "로컬 및 글로벌 VNet 피어링은 연결을 제공하며, 여러 Azure 지역에서 SAP 배포를 위한 랜딩 존 간의 연결을 보장하기 위해 선호되는 접근 방식입니다", - "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", - "waf": "신뢰도" + "text": "체크 인된 연결 문자열 및 저장소 계정 키를 검색하도록 응용 프로그램의 소스 코드 리포지토리를 구성하는 것이 좋습니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "이상적으로 애플리케이션은 관리 ID를 사용하여 Azure Storage에 인증해야 합니다. 이렇게 할 수 없는 경우 Azure KeyVault 또는 동등한 서비스에 스토리지 자격 증명(연결 문자열, 스토리지 계정 키, SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다.", + "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", + "service": "Azure Storage", "severity": "높다", - "text": "SAP 애플리케이션과 SAP 데이터베이스 서버 간에 NVA를 배포하는 것은 지원되지 않습니다", - "training": "https://me.sap.com/notes/2731110", - "waf": "공연" + "text": "Azure KeyVault에 연결 문자열을 저장하는 것이 좋습니다(관리 ID를 사용할 수 없는 시나리오에서).", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", - "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", - "service": "SAP", - "severity": "보통", - "text": "Azure 지역 및 온-프레미스 위치 간에 글로벌 전송 연결이 필요한 신규, 대규모 또는 글로벌 네트워크에서 Azure 배포에 Virtual WAN을 사용합니다. 이 방법을 사용하면 Azure 네트워킹에 대한 전이적 라우팅을 수동으로 설정할 필요가 없으며 Azure의 SAP 배포에 대한 표준을 따를 수 있습니다.", - "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "waf": "작업" + "checklist": "Azure Blob Storage Review", + "description": "임시 SAS 서비스 SAS 또는 계정 SAS에서 단기 만료 시간을 사용합니다. 이러한 방식으로 SAS가 손상되더라도 짧은 시간 동안만 유효합니다. 이 방법은 저장된 액세스 정책을 참조할 수 없는 경우에 특히 중요합니다. 또한 단기 만료 시간은 업로드에 사용할 수 있는 시간을 제한하여 Blob에 쓸 수 있는 데이터의 양을 제한합니다.", + "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", + "severity": "높다", + "text": "임시 SAS의 유효 기간을 단축하기 위해 노력", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "SAS를 만들 때는 가능한 한 구체적이고 제한적이어야 합니다. 훨씬 더 광범위한 액세스를 제공하는 SAS보다 단일 리소스 및 작업에 대해 SAS를 선호합니다.", + "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", "severity": "보통", - "text": "파트너 NVA를 사용하는 경우에만 지역 간에 NVA(네트워크 가상 어플라이언스)를 배포하는 것이 좋습니다. 네이티브 NVA가 있는 경우 지역 또는 VNet 간의 NVA가 필요하지 않습니다. 파트너 네트워킹 기술 및 NVA를 배포하는 경우 공급업체의 지침에 따라 Azure 네트워킹과 충돌하는 구성을 확인합니다.", - "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", - "waf": "작업" + "text": "SAS에 좁은 범위 적용", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", - "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "SAS에는 SAS를 사용하여 리소스를 요청할 수 있는 권한이 있는 클라이언트 IP 주소 또는 주소 범위에 대한 매개 변수가 포함될 수 있습니다. ", + "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", + "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", + "service": "Azure Storage", "severity": "보통", - "text": "Virtual WAN은 가상 WAN 기반 토폴로지에 대한 스포크 VNet 간의 연결을 관리하며(UDR[사용자 정의 라우팅] 또는 NVA를 설정할 필요 없음) 동일한 가상 허브의 VNet 간 트래픽에 대한 최대 네트워크 처리량은 초당 50기가비트입니다. 필요한 경우 SAP 랜딩 존은 VNet 피어링을 사용하여 다른 랜딩 존에 연결하고 이 대역폭 제한을 극복할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", - "waf": "작업" + "text": "가능한 경우 SAS의 범위를 특정 클라이언트 IP 주소로 지정하는 것이 좋습니다", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "82734c88-6ba2-4802-8459-11475e39e530", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", - "severity": "높다", - "text": "SAP 워크로드를 실행하는 VM에 대한 공용 IP 할당은 권장되지 않습니다.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "checklist": "Azure Blob Storage Review", + "description": "SAS는 클라이언트가 업로드하는 데이터의 양을 제한할 수 없습니다. 시간 경과에 따른 스토리지 양의 가격 책정 모델을 고려할 때 클라이언트가 악의적으로 큰 콘텐츠를 업로드했는지 여부를 확인하는 것이 합리적일 수 있습니다.", + "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", + "service": "Azure Storage", + "severity": "낮다", + "text": "클라이언트가 SAS를 사용하여 파일을 업로드한 후 업로드된 데이터를 확인하는 것이 좋습니다. ", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", - "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "description": "'로컬 사용자 계정'을 사용하여 SFTP를 통해 Blob Storage에 액세스하는 경우 '일반적인' RBAC 컨트롤이 적용되지 않습니다. NFS 또는 REST를 통한 Blob 액세스는 SFTP 액세스보다 더 제한적일 수 있습니다. 안타깝게도 2023년 초부터 로컬 사용자는 현재 SFTP 엔드포인트에 대해 지원되는 유일한 ID 관리 형태입니다", + "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", + "service": "Azure Storage", "severity": "높다", - "text": "ASR을 구성할 때 DR 쪽에서 IP 주소를 예약하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "작업" + "text": "SFTP: SFTP 액세스에 대한 '로컬 사용자'의 수를 제한하고 시간이 지남에 따라 액세스가 필요한지 여부를 감사합니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", + "service": "Azure Storage", + "severity": "보통", + "text": "SFTP: SFTP 엔드포인트는 POSIX와 유사한 ACL을 지원하지 않습니다.", + "waf": "안전" + }, + { + "checklist": "Azure Blob Storage Review", + "description": "스토리지는 CORS(Cross-Origin Resource Sharing), 즉 다른 도메인의 웹앱이 동일 출처 정책을 완화할 수 있도록 하는 HTTP 기능을 지원합니다. CORS를 사용하도록 설정할 때 CorsRules를 최소 권한으로 유지합니다.", + "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", + "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", + "service": "Azure Storage", "severity": "높다", - "text": "프로덕션 및 DR 사이트에 겹치는 IP 주소 범위를 사용하지 마십시오.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", - "waf": "작업" + "text": "지나치게 광범위한 CORS 정책 방지", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "6e154e3a-a359-4282-ae6e-206173686af4", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", - "service": "SAP", - "severity": "보통", - "text": "Azure는 VNet에서 여러 위임된 서브넷을 만드는 데 도움이 되지만 Azure NetApp Files용 VNet에는 위임된 서브넷이 하나만 존재할 수 있습니다. Azure NetApp Files에 대해 둘 이상의 위임된 서브넷을 사용하는 경우 새 볼륨을 만들려는 시도가 실패합니다.", - "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", - "waf": "작업" + "checklist": "Azure Blob Storage Review", + "description": "미사용 데이터는 항상 서버 쪽에서 암호화되며 클라이언트 쪽에서도 암호화될 수 있습니다. 서버 쪽 암호화는 플랫폼 관리형 키(기본값) 또는 고객 관리형 키를 사용하여 발생할 수 있습니다. 클라이언트 쪽 암호화는 클라이언트가 Azure Storage에 Blob별로 암호화/암호 해독 키를 제공하거나 클라이언트 쪽에서 암호화를 완전히 처리하여 발생할 수 있습니다. 따라서 기밀성 보장을 위해 Azure Storage에 전혀 의존하지 않습니다.", + "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "Azure Storage", + "severity": "높다", + "text": "미사용 데이터를 암호화하는 방법을 결정합니다. 데이터에 대한 스레드 모델을 이해합니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", + "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", + "service": "Azure Storage", "severity": "보통", - "text": "Azure Firewall을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, 비 HTTP/S 인바운드 연결 및 East/West 트래픽 필터링(조직에 필요한 경우)을 제어합니다", - "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", + "text": "사용해야 하는 플랫폼 암호화를 결정합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", - "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", - "service": "SAP", + "checklist": "Azure Blob Storage Review", + "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", + "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", + "service": "Azure Storage", "severity": "보통", - "text": "Application Gateway, SAP Web Dispatcher 및 기타 타사 서비스 간의 비교에서 볼 수 있듯이 Application Gateway가 SAP 웹앱에 대한 역방향 프록시 역할을 하는 경우 Application Gateway 및 Web Application Firewall에 제한 사항이 있습니다.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", + "text": "사용해야 하는 클라이언트 쪽 암호화를 결정합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", - "severity": "보통", - "text": "Azure Front Door 및 WAF 정책을 사용하여 랜딩 존에 대한 인바운드 HTTP/S 연결을 위해 Azure 지역에서 전역 보호를 제공합니다.", - "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", + "checklist": "Azure Blob Storage Review", + "description": "Resource Graph Explorer(resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true)를 활용하여 익명 Blob 액세스를 허용하는 스토리지 계정을 찾습니다.", + "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", + "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", + "service": "Azure Storage", + "severity": "높다", + "text": "공용 Blob 액세스가 필요한지 또는 특정 스토리지 계정에 대해 사용하지 않도록 설정할 수 있는지 여부를 고려합니다. ", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "SAP", + "checklist": "Azure Bot Service", + "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", + "service": "Bot service", "severity": "보통", - "text": "Azure Front Door 및 Application Gateway를 사용하여 HTTP/S 애플리케이션을 보호하는 경우 Azure Front Door의 Web Application Firewall 정책을 활용합니다. Azure Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", - "waf": "안전" + "text": "Azure Bot Service의 안정성 지원 권장 사항을 따릅니다", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "5ada4332-4e13-4811-9231-81aa41742694", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", + "checklist": "Azure Bot Service", + "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", + "service": "Bot service", "severity": "보통", - "text": "웹 애플리케이션 방화벽을 사용하여 트래픽이 인터넷에 노출될 때 트래픽을 검사합니다. 또 다른 옵션은 부하 분산 장치 또는 Application Gateway 또는 타사 솔루션과 같은 기본 제공 방화벽 기능이 있는 리소스와 함께 사용하는 것입니다.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", - "waf": "안전" + "text": "로컬 데이터 레지던시 및 지역 규정 준수를 통해 봇 배포Deploying bots with local data residency and regional compliance", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "SAP", + "checklist": "Azure Bot Service", + "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", + "service": "Bot service", "severity": "보통", - "text": "Azure 지역 및 온-프레미스 위치 간에 글로벌 전송 연결이 필요한 신규, 대규모 또는 글로벌 네트워크에서 Azure 배포에 Virtual WAN을 사용합니다. 이 방법을 사용하면 Azure 네트워킹에 대한 전이적 라우팅을 수동으로 설정할 필요가 없으며 Azure의 SAP 배포에 대한 표준을 따를 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", - "waf": "공연" + "text": "Azure Bot Service는 글로벌 및 지역 서비스 모두에 대해 활성-활성 모드로 실행됩니다. 중단이 발생하면 오류를 감지하거나 서비스를 관리할 필요가 없습니다. Azure Bot Service는 다중 지역 지리적 아키텍처에서 자동 장애 조치(failover) 및 자동 복구를 자동으로 수행합니다. EU 봇 지역 서비스의 경우 Azure Bot Service는 중복성을 보장하기 위해 활성/활성 복제가 있는 유럽 내 두 개의 전체 지역을 제공합니다. 글로벌 봇 서비스의 경우 사용 가능한 모든 지역/지역을 글로벌 공간으로 제공할 수 있습니다.", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "SAP", + "checklist": "MySQL Review Checklist", + "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", + "service": "Azure MySQL", "severity": "보통", - "text": "데이터 유출을 방지하려면 Azure Private Link를 사용하여 Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory 등과 같은 PaaS(Platform as a Service) 리소스에 안전하게 액세스합니다. Azure 프라이빗 엔드포인트는 VNet과 Azure Storage, Azure Backup 등과 같은 서비스 간의 트래픽을 보호하는 데도 도움이 될 수 있습니다. VNet과 프라이빗 엔드포인트 사용 서비스 간의 트래픽은 Microsoft 글로벌 네트워크를 통해 이동하므로 공용 인터넷에 노출되지 않습니다.", - "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", - "waf": "안전" + "text": "유연한 서버 활용", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", - "service": "SAP", + "checklist": "MySQL Review Checklist", + "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", + "service": "Azure MySQL", "severity": "높다", - "text": "SAP 애플리케이션 및 DBMS 계층에 사용되는 VM에서 Azure 가속 네트워킹이 사용하도록 설정되어 있는지 확인합니다.", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", - "waf": "공연" + "text": "지역적으로 적용 가능한 경우 가용 영역 활용Leverage Availability Zones where regionally applicable", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", - "service": "SAP", + "checklist": "MySQL Review Checklist", + "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", + "service": "Azure MySQL", "severity": "보통", - "text": "Azure Load Balancer에 대한 내부 배포가 DSR(Direct Server Return)을 사용하도록 설정되어 있는지 확인합니다. 이 설정(유동 IP 사용)은 DBMS 계층의 고가용성 구성에 내부 부하 분산 장치 구성을 사용할 때 대기 시간을 줄입니다.", - "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", - "waf": "안전" + "text": "지역 간 DR 시나리오에 입력 데이터 복제 활용", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "6791f893-5ada-4433-84e1-3811523181aa", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "SAP", - "severity": "보통", - "text": "ASG(애플리케이션 보안 그룹) 및 NSG 규칙을 사용하여 SAP 애플리케이션과 DBMS 계층 간에 네트워크 보안 액세스 제어 목록을 정의할 수 있습니다. ASG는 보안을 관리하는 데 도움이 되도록 가상 머신을 그룹화합니다.", - "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", - "waf": "안전" + "checklist": "Azure Function Review", + "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "severity": "높다", + "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 기능 호스팅 계획을 선택하십시오.", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "checklist": "Azure Function Review", + "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", "severity": "높다", - "text": "피어링되지 않은 다른 Azure VNet에 SAP 애플리케이션 계층 및 SAP DBMS를 배치하는 것은 지원되지 않습니다.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "공연" + "text": "지역적으로 적용 가능한 가용성 영역 활용(소비 계층에는 사용할 수 없음)", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "fa96c96a-d885-418f-9827-34c886ba2802", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", + "checklist": "Azure Function Review", + "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", + "service": "Azure Functions", "severity": "보통", - "text": "SAP 애플리케이션에서 네트워크 대기 시간을 최적화하려면 Azure 근접 배치 그룹을 사용하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", - "waf": "공연" + "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "checklist": "Azure Function Review", + "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Azure Functions", "severity": "높다", - "text": "온-프레미스와 Azure 간에 분할된 SAP 애플리케이션 서버 계층 및 DBMS 계층을 실행하는 것은 전혀 지원되지 않습니다. 두 계층 모두 온-프레미스 또는 Azure에 완전히 상주해야 합니다.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "공연" + "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", - "severity": "높다", - "text": "계층 간의 과도한 네트워크 트래픽으로 인해 발생할 수 있는 상당한 비용 때문에 다른 VNet에서 SAP 시스템의 DBMS(데이터베이스 관리 시스템) 및 애플리케이션 계층을 호스트하고 VNet 피어링과 연결하는 것은 권장되지 않습니다. Azure 가상 네트워크 내에서 서브넷을 사용하여 SAP 애플리케이션 계층과 DBMS 계층을 분리하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "비용" - }, - { - "checklist": "SAP Checklist", - "guid": "402a9846-d515-4061-aff8-cd30088693fa", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", - "service": "SAP", + "checklist": "Azure Function Review", + "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "Azure Functions", "severity": "높다", - "text": "Linux 게스트 운영 체제에서 Load Balancer를 사용하는 경우 Linux 네트워크 매개 변수 net.ipv4.tcp_timestamps가 0으로 설정되어 있는지 확인합니다.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "공연" + "text": "App Service 계획에서 실행되는 모든 함수 앱에 대해 'Always On'이 사용하도록 설정되어 있는지 확인합니다.", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "87585797-5551-4d53-bb7d-a94ee415734d", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", - "service": "SAP", + "checklist": "Azure Function Review", + "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", + "service": "Azure Functions", "severity": "보통", - "text": "SAP RISE/ECS 배포의 경우 가상 피어링은 고객의 기존 Azure 환경과의 연결을 설정하는 기본 방법입니다. SAP vnet과 고객 vnet은 모두 NSG(네트워크 보안 그룹)로 보호되므로 vnet 피어링을 통해 SAP 및 데이터베이스 포트에서 통신할 수 있습니다", - "waf": "안전" - }, - { - "checklist": "SAP Checklist", - "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", - "severity": "높다", - "text": "Azure VM에 대한 SAP HANA 데이터베이스 백업을 검토합니다.", - "waf": "비용" + "text": "함수 앱을 자체 스토리지 계정에 페어링합니다. 긴밀하게 결합되지 않는 한 함수 앱에 대한 스토리지 계정을 다시 사용하지 마세요", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", + "checklist": "Azure Function Review", + "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "Azure Functions", "severity": "보통", - "text": "SAP에 사용되는 Site Recovery 기본 제공 모니터링을 검토합니다.", - "waf": "비용" - }, - { - "checklist": "SAP Checklist", - "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", - "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", - "service": "SAP", - "severity": "높다", - "text": "SAP HANA 시스템 환경 모니터링 지침을 검토합니다.", + "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 함수 앱 코드를 보호합니다.", "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Front Door", "severity": "보통", - "text": "Azure Linux VM 백업 전략에서 Oracle Database를 검토합니다.", + "text": "Azure Front Door에서 고객 관리형 TLS 인증서를 사용하는 경우 '최신' 인증서 버전을 사용합니다. 수동 인증서 갱신으로 인한 중단 위험 감소", "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", - "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", + "guid": "553585a6-abe0-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "App Gateway", "severity": "보통", - "text": "SQL Server 2016에서 Azure Blob Storage 사용을 검토합니다.", - "waf": "작업" + "text": "Application Gateway v2 SKU를 사용하고 있는지 확인합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", + "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Load Balancer", "severity": "보통", - "text": "Azure VM에 대한 자동화된 Backup v2 사용을 검토합니다.", - "waf": "작업" - }, - { - "checklist": "SAP Checklist", - "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", - "service": "SAP", - "severity": "높다", - "text": "프리미엄 디스크(V1)를 사용할 때 M 시리즈에 쓰기 가속기 사용Enabling Write accelerator for M series when using premium disks(V1)", - "waf": "작업" + "text": "Azure Load Balancer에 표준 SKU를 사용하고 있는지 확인합니다.", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "9432621a-8397-4654-a882-5bc856b7ef83", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", + "service": "Load Balancer", "severity": "보통", - "text": "가용성 영역 대기 시간을 테스트합니다.", - "waf": "공연" + "text": "Load Balancer 프런트 엔드 IP 주소가 영역 중복인지 확인합니다(영역 프런트 엔드가 필요하지 않은 경우).", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", - "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", + "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "App Gateway", "severity": "보통", - "text": "모든 SAP 구성 요소에 대해 SAP EarlyWatch Alert를 활성화합니다.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", - "waf": "공연" + "text": "Application Gateway v2는 IP 접두사가 /24보다 크거나 같은 서브넷에 배포해야 합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "description": "일반적으로 역방향 프록시 및 특히 WAF의 관리는 네트워킹보다 애플리케이션에 더 가깝기 때문에 앱과 동일한 구독에 속합니다. 연결 구독에서 Application Gateway 및 WAF를 중앙 집중화하는 것은 단일 팀에서 관리하는 경우 괜찮을 수 있습니다.", + "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "severity": "보통", - "text": "SAP ABAPMeter 보고서 /SSA/CAT를 사용하여 SAP 애플리케이션 서버-데이터베이스 서버 대기 시간을 검토합니다.", - "training": "https://me.sap.com/notes/0002879613", - "waf": "공연" + "text": "랜딩 영역 가상 네트워크 내에서 그리고 보안 중인 앱을 사용하여 인바운드 HTTP(S) 연결을 프록시하는 데 사용되는 Azure Application Gateway v2 또는 파트너 NVA를 배포합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "severity": "보통", - "text": "CCMS를 사용하여 SQL Server 성능 모니터링을 검토합니다.", - "waf": "공연" + "text": "애플리케이션 랜딩 존의 모든 공용 IP 주소에 대해 DDoS 네트워크 또는 IP 보호 계획을 사용합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", - "link": "https://me.sap.com/notes/500235", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", + "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", + "service": "App Gateway", "severity": "보통", - "text": "SAP 애플리케이션 계층 VM과 DBMS VM(NIPING) 간의 네트워크 대기 시간을 테스트합니다.", - "training": "https://me.sap.com/notes/1100926/E", - "waf": "공연" + "text": "최소 인스턴스 수를 2개로 자동 크기 조정을 구성합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", - "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", + "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", + "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", + "service": "App Gateway", "severity": "보통", - "text": "SAP HANA Studio 경고를 검토합니다.", - "waf": "공연" + "text": "가용성 영역에 Application Gateway 배포", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", - "link": "https://me.sap.com/notes/1969700", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Front Door", "severity": "보통", - "text": "HANA_Configuration_Minichecks를 사용하여 SAP HANA 상태 검사를 수행합니다.", - "waf": "공연" + "text": "WAF 정책과 함께 Azure Front Door를 사용하여 여러 Azure 지역에 걸쳐 있는 글로벌 HTTP/S 앱을 제공하고 보호할 수 있습니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "3f29812b-2363-4cef-b179-b599de0d5973", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "Front Door", "severity": "보통", - "text": "Azure, 온-프레미스 또는 기타 클라우드 환경에서 Windows 및 Linux VM을 실행하는 경우 Azure Automation의 업데이트 관리 센터를 사용하여 보안 패치를 포함한 운영 체제 업데이트를 관리할 수 있습니다.", - "training": "https://learn.microsoft.com/azure/automation/update-management/overview", + "text": "Front Door 및 Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Front Door에서 WAF 정책을 사용합니다. Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "08951710-79a2-492a-adbc-06d7a401545b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", - "severity": "보통", - "text": "SAP는 SAP 시스템을 보호하기 위해 즉각적인 조치가 필요한 매우 중요한 보안 패치 또는 핫픽스를 릴리스하므로 SAP 보안 OSS 노트를 정기적으로 검토합니다.", - "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", - "waf": "안전" + "ammp": true, + "arm-service": "microsoft.network/trafficManagerProfiles", + "checklist": "Azure Application Delivery Networking", + "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Traffic Manager", + "severity": "높다", + "text": "Traffic Manager를 사용하여 HTTP/S 이외의 프로토콜에 걸쳐 있는 글로벌 앱을 제공합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", "severity": "낮다", - "text": "SQL Server SAP의 경우 SQL Server SAP 시스템에서 계정을 사용하지 않으므로 SQL Server 시스템 관리자 계정을 사용하지 않도록 설정할 수 있습니다. 원래 시스템 관리자 계정을 비활성화하기 전에 시스템 관리자 권한이 있는 다른 사용자가 서버에 액세스할 수 있는지 확인합니다.", + "text": "사용자가 내부 애플리케이션에만 액세스해야 하는 경우 Microsoft Entra ID 애플리케이션 프록시가 AVD(Azure Virtual Desktop)의 대안으로 고려되었나요?", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", - "severity": "높다", - "text": "xp_cmdshell 비활성화합니다. SQL Server 기능 xp_cmdshell SQL Server 내부 운영 체제 명령 셸을 사용할 수 있습니다. 이는 보안 감사에서 발생할 수 있는 잠재적 위험입니다.", - "training": "https://me.sap.com/notes/3019299/E", + "checklist": "Azure Application Delivery Networking", + "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", + "severity": "보통", + "text": "네트워크에서 들어오는 연결에 대해 열려 있는 방화벽 포트 수를 줄이려면 Microsoft Entra ID 애플리케이션 프록시를 사용하여 원격 사용자에게 내부 애플리케이션에 대한 안전하고 인증된 액세스를 제공하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "ae248989-b306-4591-9186-de482e3f0f0e", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "Front Door", "severity": "높다", - "text": "Azure에서 SAP HANA 데이터베이스 서버를 암호화하는 데는 SAP HANA 네이티브 암호화 기술이 사용됩니다. 또한 Azure에서 SQL Server를 사용하는 경우 TDE(투명한 데이터 암호화)를 사용하여 데이터 및 로그 파일을 보호하고 백업도 암호화되도록 합니다.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "text": "'방지' 모드에서 Front Door에 대한 WAF 정책을 배포합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "SAP", - "severity": "보통", - "text": "Azure Storage 암호화는 모든 Azure Resource Manager 및 클래식 스토리지 계정에 대해 사용하도록 설정되며 사용하지 않도록 설정할 수 없습니다. 데이터는 기본적으로 암호화되므로 Azure Storage 암호화를 사용하기 위해 코드 또는 애플리케이션을 수정할 필요가 없습니다.", - "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "Front Door", + "severity": "높다", + "text": "Azure Traffic Manager와 Azure Front Door를 결합하지 마세요.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "SAP", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "Front Door", "severity": "높다", - "text": "Azure Key Vault를 사용하여 비밀 및 자격 증명 저장", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "text": "Azure Front Door 및 원본에서 동일한 도메인 이름을 사용합니다. 호스트 이름이 일치하지 않으면 미묘한 버그가 발생할 수 있습니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "829e2edb-2173-4676-aff6-691b4935ada4", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "SAP", - "severity": "보통", - "text": "무단 변경으로부터 보호하기 위해 성공적인 배포 후 Azure 리소스를 잠그는 것이 좋습니다. 사용자 지정된 Azure 정책(Custome 역할)을 사용하여 구독별로 LOCK 제약 조건 및 규칙을 적용할 수도 있습니다.", - "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", - "waf": "안전" + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", + "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "Front Door", + "severity": "낮다", + "text": "Azure Front Door 원본 그룹에 원본이 하나만 있는 경우 상태 프로브를 사용하지 않도록 설정합니다.", + "waf": "공연" }, { - "checklist": "SAP Checklist", - "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "Front Door", "severity": "보통", - "text": "삭제된 개체에 대한 보존 보호를 허용하기 위해 일시 삭제 및 제거 정책을 사용하도록 설정된 Azure Key Vault를 프로비전합니다.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", - "waf": "안전" + "text": "Azure Front Door에 대한 양호한 상태 프로브 엔드포인트를 선택합니다. 애플리케이션의 모든 종속성을 확인하는 상태 엔드포인트를 빌드하는 것이 좋습니다.", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", - "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", + "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "Front Door", + "severity": "낮다", + "text": "Azure Front Door와 함께 HEAD 상태 프로브를 사용하여 Front Door가 애플리케이션으로 보내는 트래픽을 줄입니다.", + "waf": "공연" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", + "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "Load Balancer", "severity": "높다", - "text": "기존 요구 사항에 따라 규정 및 규정 준수 제어(내부/외부) - 필요한 Azure 정책 및 Azure RBAC 역할 결정", - "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", - "waf": "안전" + "text": "SNAT 확장성 향상을 위해 Load Balancer 아웃바운드 규칙 대신 Azure NAT Gateway 사용", + "waf": "신뢰도" }, { - "checklist": "SAP Checklist", - "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", + "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "Front Door", "severity": "높다", - "text": "SAP 환경에서 엔드포인트용 Microsoft Defender 사용하도록 설정하는 경우 모든 서버를 대상으로 하는 대신 DBMS 서버에서 데이터 및 로그 파일을 제외하는 것이 좋습니다. 대상 파일을 제외할 때 DBMS 공급업체의 권장 사항을 따릅니다.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", - "waf": "안전" + "text": "Azure Front Door에서 관리형 TLS 인증서를 사용합니다. 운영 비용을 줄이고 인증서 갱신으로 인한 중단 위험을 줄입니다.", + "waf": "작업" }, { - "checklist": "SAP Checklist", - "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", + "service": "Front Door", + "severity": "보통", + "text": "Azure Front Door WAF 구성을 코드로 정의합니다. 코드를 사용하면 새 규칙 집합 버전을 보다 쉽게 채택하고 추가 보호를 얻을 수 있습니다.", + "waf": "작업" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", + "service": "Front Door", "severity": "높다", - "text": "클라우드용 Microsoft Defender의 Just-In-Time 액세스 권한이 있는 SAP 관리자 사용자 지정 역할을 위임합니다.", - "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "text": "Azure Front Door에서 엔드투엔드 TLS를 사용합니다. 클라이언트에서 Front Door로, Front Door에서 원본으로 연결하는 데 TLS를 사용합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", - "severity": "낮다", - "text": "타사 보안 제품을 DIAG(SAP GUI)용 SNC(Secure Network Communications), RFC 및 HTTPS용 SPNEGO와 통합하여 전송 중인 데이터를 암호화합니다.", - "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", + "checklist": "Azure Application Delivery Networking", + "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", + "service": "Front Door", + "severity": "보통", + "text": "Azure Front Door에서 HTTP에서 HTTPS로 리디렉션을 사용합니다. 이전 클라이언트를 HTTPS 요청으로 자동 리디렉션하여 지원합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", - "service": "SAP", - "severity": "보통", - "text": "보안 주체 암호화 기능을 위해 기본적으로 Microsoft 관리형 키를 사용하고 필요한 경우 고객 관리형 키를 사용합니다.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", + "service": "Front Door", + "severity": "높다", + "text": "Azure Front Door WAF를 사용하도록 설정합니다. 다양한 공격으로부터 애플리케이션을 보호합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "4935ada4-2223-4ece-a1b1-23181a541741", - "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", - "service": "SAP", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", + "service": "Front Door", "severity": "높다", - "text": "애플리케이션, 환경, 지역당 Azure Key Vault를 사용합니다.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "text": "워크로드에 맞게 Azure Front Door WAF를 튜닝합니다. 가양성 탐지를 줄입니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", - "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", - "service": "SAP", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "Front Door", "severity": "높다", - "text": "비 HANA Windows 및 비 Windows 운영 체제에 대한 디스크 암호화 키 및 비밀을 제어하고 관리하려면 Azure Key Vault를 사용합니다. SAP HANA는 Azure Key Vault에서 지원되지 않으므로 SAP ABAP 또는 SSH 키와 같은 대체 방법을 사용해야 합니다.", - "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", + "text": "Azure Front Door WAF 정책에서 요청 본문 검사 기능을 사용하도록 설정합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "209d490d-a477-4784-84d1-16785d2fa56c", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", - "service": "SAP", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", + "service": "Front Door", "severity": "높다", - "text": "실수로 인한 네트워크 관련 변경을 방지하기 위해 Azure의 SAP 스포크 구독에 대한 RBAC(역할 기반 액세스 제어) 역할 사용자 지정", - "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", + "text": "Azure Front Door WAF 기본 규칙 집합을 사용하도록 설정합니다. 기본 규칙 집합은 일반적인 공격을 탐지하고 차단합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", - "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", - "service": "SAP", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", + "service": "Front Door", "severity": "높다", - "text": "나머지 SAP 자산에서 DMZ 및 NVA를 격리하고, Azure Private Link를 구성하고, Azure의 SAP 리소스를 안전하게 관리 및 제어합니다", - "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", + "text": "Azure Front Door WAF 봇 보호 규칙 집합을 사용하도록 설정합니다. 봇 규칙은 좋은 봇과 나쁜 봇을 감지합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", - "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", - "service": "SAP", - "severity": "낮다", - "text": "Azure에서 Microsoft 맬웨어 방지 소프트웨어를 사용하여 악성 파일, 애드웨어 및 기타 위협으로부터 가상 머신을 보호하는 것이 좋습니다.", - "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", + "checklist": "Azure Application Delivery Networking", + "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", + "service": "Front Door", + "severity": "보통", + "text": "최신 Azure Front Door WAF 규칙 집합 버전을 사용합니다. 규칙 집합 업데이트는 현재 위협 환경을 고려하기 위해 정기적으로 업데이트됩니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", - "service": "SAP", - "severity": "낮다", - "text": "더욱 강력한 보호를 위해 엔드포인트용 Microsoft Defender 사용하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", + "checklist": "Azure Application Delivery Networking", + "guid": "b9620385-1cde-418f-914b-a84a06982ffc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", + "service": "Front Door", + "severity": "보통", + "text": "Azure Front Door WAF에 속도 제한을 추가합니다. 속도 제한은 클라이언트가 실수로 또는 의도적으로 짧은 시간에 많은 양의 트래픽을 보내는 것을 차단합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", - "severity": "높다", - "text": "가상 네트워크 피어링을 통해 스포크 네트워크에 연결된 허브 가상 네트워크를 통해 모든 트래픽을 전달하여 SAP 애플리케이션 및 데이터베이스 서버를 인터넷 또는 온-프레미스 네트워크에서 격리합니다. 피어링된 가상 네트워크는 Azure의 SAP 솔루션이 공용 인터넷에서 격리되도록 보장합니다.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", + "checklist": "Azure Application Delivery Networking", + "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", + "service": "Front Door", + "severity": "보통", + "text": "Azure Front Door WAF 속도 제한에 높은 임계값을 사용합니다. 높은 속도 제한 임계값은 합법적인 트래픽 차단을 방지하는 동시에 인프라를 압도할 수 있는 매우 많은 수의 요청에 대한 보호 기능을 제공합니다. ", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", + "service": "Front Door", "severity": "낮다", - "text": "SAP Fiori와 같은 인터넷 연결 애플리케이션의 경우 보안 수준을 유지하면서 애플리케이션 요구 사항에 따라 부하를 분산해야 합니다. 계층 7 보안의 경우 Azure Marketplace에서 사용할 수 있는 타사 WAF(Web Application Firewall)를 사용할 수 있습니다.", - "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", + "text": "모든 지역에서 트래픽이 발생하지 않을 것으로 예상되는 경우 지역 필터를 사용하여 예상하지 못한 국가의 트래픽을 차단합니다.", "waf": "안전" }, { - "checklist": "SAP Checklist", - "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", - "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", - "service": "SAP", - "severity": "보통", - "text": "SAP용 Azure Monitor 솔루션에서 보안 통신을 사용하도록 설정하려면 루트 인증서 또는 서버 인증서를 사용하도록 선택할 수 있습니다. 루트 인증서를 사용하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "checklist": "Azure Application Delivery Networking", + "guid": "00acd8a9-6975-414f-8491-2be6309893b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", + "service": "Front Door", + "severity": "보통", + "text": "Azure Front Door WAF를 사용하여 트래픽을 지리적으로 필터링할 때 알 수 없는(ZZ) 위치를 지정합니다. IP 주소를 지리적으로 일치시킬 수 없는 경우 합법적인 요청을 실수로 차단하지 않도록 합니다.", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", - "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", - "service": "AKS", - "severity": "낮다", - "text": "AKS Windows 워크로드에 필요한 경우 HostProcess 컨테이너를 사용할 수 있습니다.", - "waf": "신뢰도" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", + "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", + "service": "App Gateway", + "severity": "높다", + "text": "Azure Application Gateway WAF 봇 보호 규칙 집합 사용Enable the Azure Application Gateway WAF bot protection rule set 봇 규칙은 좋은 봇과 나쁜 봇을 검색합니다.", + "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", - "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", - "service": "AKS", - "severity": "낮다", - "text": "이벤트 기반 워크로드를 실행하는 경우 KEDA 사용Use KEDA if running event-driven workloads", - "waf": "공연" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "App Gateway", + "severity": "높다", + "text": "Azure Application Gateway WAF 정책에서 요청 본문 검사 기능을 사용하도록 설정합니다.", + "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", - "link": "https://dapr.io/", - "service": "AKS", - "severity": "낮다", - "text": "Dapr을 사용하여 마이크로 서비스 개발 용이", - "waf": "작업" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", + "service": "App Gateway", + "severity": "높다", + "text": "워크로드에 대한 Azure Application Gateway WAF를 조정합니다. 가양성 탐지를 줄입니다.", + "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", - "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", - "link": "https://learn.microsoft.com/azure/aks/uptime-sla", - "service": "AKS", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "App Gateway", "severity": "높다", - "text": "SLA 지원 AKS 제품 사용", - "waf": "신뢰도" + "text": "'방지' 모드에서 Application Gateway에 대한 WAF 정책을 배포합니다.", + "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", - "severity": "낮다", - "text": "Pod 및 배포 정의에서 중단 예산 사용Use Disruption Budgets in your pod and deployment definitions", - "waf": "신뢰도" + "checklist": "Azure Application Delivery Networking", + "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", + "service": "App Gateway", + "severity": "보통", + "text": "Azure Application Gateway WAF에 속도 제한을 추가합니다. 속도 제한은 클라이언트가 실수로 또는 의도적으로 짧은 시간에 많은 양의 트래픽을 보내는 것을 차단합니다.", + "waf": "안전" }, { - "checklist": "Azure AKS Review", - "guid": "3c763963-7a55-42d5-a15e-401955387e5c", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", - "service": "ACR", - "severity": "높다", - "text": "개인 레지스트리를 사용하는 경우 여러 지역에 이미지를 저장하도록 지역 복제를 구성합니다", - "waf": "신뢰도" + "checklist": "Azure Application Delivery Networking", + "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", + "service": "App Gateway", + "severity": "보통", + "text": "Azure Application Gateway WAF 속도 제한에 높은 임계값을 사용합니다. 높은 속도 제한 임계값은 합법적인 트래픽 차단을 방지하는 동시에 인프라를 압도할 수 있는 매우 많은 수의 요청에 대한 보호 기능을 제공합니다. ", + "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "99937189-ff78-492a-b9ca-18d828d82b37", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", + "service": "App Gateway", "severity": "낮다", - "text": "kubecost와 같은 외부 애플리케이션을 사용하여 다른 사용자에게 비용 할당", - "waf": "비용" + "text": "모든 지역에서 트래픽이 발생하지 않을 것으로 예상되는 경우 지역 필터를 사용하여 예상하지 못한 국가의 트래픽을 차단합니다.", + "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", - "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", - "service": "AKS", - "severity": "낮다", - "text": "축소 모드를 사용하여 노드 삭제/할당 취소", - "waf": "비용" + "checklist": "Azure Application Delivery Networking", + "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", + "service": "App Gateway", + "severity": "보통", + "text": "Azure Application Gateway WAF를 사용하여 트래픽을 지리적으로 필터링할 때 알 수 없는(ZZ) 위치를 지정합니다. IP 주소를 지리적으로 일치시킬 수 없는 경우 합법적인 요청을 실수로 차단하지 않도록 합니다.", + "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", - "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", + "service": "App Gateway", "severity": "보통", - "text": "필요한 경우 AKS 클러스터에서 다중 인스턴스 분할 GPU 사용", - "waf": "비용" + "text": "최신 Azure Application Gateway WAF 규칙 집합 버전을 사용합니다. 규칙 집합 업데이트는 현재 위협 환경을 고려하기 위해 정기적으로 업데이트됩니다.", + "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", - "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", - "service": "AKS", - "severity": "낮다", - "text": "개발/테스트 클러스터를 실행하는 경우 NodePool 시작/중지를 사용합니다.", - "waf": "비용" + "checklist": "Azure Application Delivery Networking", + "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "App Gateway", + "severity": "보통", + "text": "진단 설정을 추가하여 Azure Application Gateway WAF 로그를 저장합니다.", + "waf": "작업" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", - "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "Front Door", "severity": "보통", - "text": "Kubernetes용 Azure Policy를 사용하여 클러스터 규정 준수 보장", - "waf": "안전" + "text": "진단 설정을 추가하여 Azure Front Door WAF 로그를 저장합니다.", + "waf": "작업" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", - "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "92664c60-47e3-4591-8b1b-8d557656e686", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", + "service": "App Gateway", "severity": "보통", - "text": "사용자/시스템 노드 풀이 있는 컨트롤 플레인에서 응용 프로그램 분리", - "waf": "안전" + "text": "Azure Application Gateway WAF 로그를 Microsoft Sentinel로 보냅니다.", + "waf": "작업" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", - "severity": "낮다", - "text": "시스템 nodepool에 taint를 추가하여 전용으로 만듭니다.", - "waf": "안전" + "checklist": "Azure Application Delivery Networking", + "guid": "845f5f91-9c21-4674-a725-5ce890850e20", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "Front Door", + "severity": "보통", + "text": "Azure Front Door WAF 로그를 Microsoft Sentinel로 보냅니다.", + "waf": "작업" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", - "link": "https://learn.microsoft.com/azure/container-registry/", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", + "service": "App Gateway", "severity": "보통", - "text": "이미지에 개인 레지스트리(예: ACR) 사용", - "waf": "안전" + "text": "Azure Application Gateway WAF 구성을 코드로 정의합니다. 코드를 사용하면 새 규칙 집합 버전을 보다 쉽게 채택하고 추가 보호를 얻을 수 있습니다.", + "waf": "작업" }, { - "checklist": "Azure AKS Review", - "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", - "link": "https://learn.microsoft.com/azure/security-center/container-security", - "service": "ACR", + "checklist": "Azure Application Delivery Networking", + "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", + "service": "App Gateway", "severity": "보통", - "text": "이미지에서 취약성 검사", - "waf": "안전" + "text": "레거시 WAF 구성 대신 WAF 정책을 사용합니다.", + "waf": "작업" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", - "service": "AKS", - "severity": "높다", - "text": "앱 분리 요구 사항 정의(네임스페이스/노드 풀/클러스터)", + "checklist": "Azure Application Delivery Networking", + "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", + "service": "App Gateway", + "severity": "보통", + "text": "Application Gateway 서브넷의 연결(예: NSG 사용)만 허용하도록 백 엔드에서 인바운드 트래픽을 필터링합니다.", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", - "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", + "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", + "service": "Front Door", "severity": "보통", - "text": "CSI 비밀 저장소 드라이버를 사용하여 Azure Key Vault에 비밀 저장", + "text": "원본이 Azure Front Door 인스턴스의 트래픽만 가져와야 합니다.", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", - "link": "https://learn.microsoft.com/azure/aks/update-credentials", - "service": "AKS", - "severity": "높다", - "text": "클러스터에 서비스 주체를 사용하는 경우 주기적으로(예: 분기별) 자격 증명을 새로 고칩니다", + "checklist": "Azure Application Delivery Networking", + "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "service": "App Gateway", + "severity": "높다", + "text": "백 엔드 서버에 대한 트래픽을 암호화해야 합니다.", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", - "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", - "service": "AKS", - "severity": "보통", - "text": "필요한 경우 키 관리 서비스 etcd 암호화를 추가합니다.", + "checklist": "Azure Application Delivery Networking", + "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "service": "App Gateway", + "severity": "높다", + "text": "웹 응용 프로그램 방화벽을 사용해야 합니다.", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", - "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", - "service": "AKS", - "severity": "낮다", - "text": "필요한 경우 AKS용 기밀 컴퓨팅을 사용하는 것이 좋습니다.", + "checklist": "Azure Application Delivery Networking", + "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", + "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", + "service": "App Gateway", + "severity": "보통", + "text": "HTTP를 HTTPS로 리디렉션", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", + "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", + "service": "App Gateway", "severity": "보통", - "text": "컨테이너용 Defender 사용 고려", - "waf": "안전" + "text": "게이트웨이 관리 쿠키를 사용하여 처리를 위해 사용자 세션에서 동일한 서버로 트래픽을 전달합니다.", + "waf": "작업" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", - "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", + "service": "App Gateway", "severity": "높다", - "text": "서비스 주체 대신 관리 ID 사용", + "text": "계획된 서비스 업데이트 중에 연결 드레이닝을 사용하도록 설정하여 백 엔드 풀의 기존 멤버에 대한 연결 손실을 방지합니다.", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", - "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", - "link": "https://learn.microsoft.com/azure/aks/managed-aad", - "service": "AKS", - "severity": "보통", - "text": "AAD와 인증 통합(관리형 통합 사용)", - "waf": "안전" + "checklist": "Azure Application Delivery Networking", + "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", + "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", + "service": "App Gateway", + "severity": "낮다", + "text": "사용자 지정 오류 페이지를 만들어 개인화된 사용자 환경 표시", + "waf": "작업" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", - "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", + "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", + "service": "App Gateway", "severity": "보통", - "text": "관리자 kubeconfig에 대한 액세스 제한(get-credentials --admin)", + "text": "HTTP 요청 및 응답 헤더를 편집하여 클라이언트와 서버 간의 라우팅 및 정보 교환을 보다 쉽게 할 수 있습니다.", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", - "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "App Gateway", "severity": "보통", - "text": "AAD RBAC와 권한 부여 통합", - "waf": "안전" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", - "service": "AKS", - "severity": "높다", - "text": "쿠버네티스에서 RBAC 권한을 제한하기 위해 네임스페이스 사용", - "waf": "안전" + "text": "빠른 글로벌 장애 조치(failover)를 통해 글로벌 웹 트래픽 라우팅 및 최상위 계층 최종 사용자 성능 및 안정성을 최적화하도록 Front Door 구성", + "waf": "공연" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", - "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "29dcc19f-a8fa-4c35-8281-290577538793", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "App Gateway", "severity": "보통", - "text": "Pod ID 액세스 관리의 경우 Azure AD 워크로드 ID(미리 보기)를 사용합니다.", - "waf": "안전" + "text": "전송 계층 부하 분산 사용Use transport layer load balancing", + "waf": "공연" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", + "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", + "service": "App Gateway", "severity": "보통", - "text": "AKS 비대화형 로그인의 경우 kubelogin(미리 보기)을 사용합니다.", + "text": "단일 게이트웨이에서 여러 웹 응용 프로그램에 대한 호스트 또는 도메인 이름을 기반으로 라우팅 구성Configure routing based on host or domain name for multiple web applications on a single gateway", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", - "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", + "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", + "service": "App Gateway", "severity": "보통", - "text": "AKS 로컬 계정 사용 안 함", - "waf": "안전" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", - "service": "AKS", - "severity": "낮다", - "text": "필요한 경우 Just-in-time 클러스터 액세스 구성", - "waf": "안전" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", - "service": "AKS", - "severity": "낮다", - "text": "AKS에 필요한 경우 AAD 조건부 액세스 구성", + "text": "SSL 인증서 관리를 중앙 집중화하여 백엔드 서버 팜의 암호화 및 암호 해독 오버헤드를 줄입니다.", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", - "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", - "service": "AKS", + "checklist": "Azure Application Delivery Networking", + "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", + "service": "App Gateway", "severity": "낮다", - "text": "Windows AKS 워크로드에 필요한 경우 gMSA를 구성합니다. ", - "waf": "안전" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", - "service": "AKS", - "severity": "보통", - "text": "더 세밀하게 제어하려면 관리형 Kubelet ID를 사용하는 것이 좋습니다.", + "text": "WebSocket 및 HTTP/2 프로토콜에 대한 기본 지원을 위해 Application Gateway 사용", "waf": "안전" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", - "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", - "service": "AKS", - "severity": "보통", - "text": "AGIC를 사용하는 경우 클러스터 간에 AppGW를 공유하지 마세요", + "checklist": "Device Provisioning Service Review", + "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", + "service": "IoT Hub DPS", + "severity": "높다", + "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 Logic App 호스팅 계획 선택Select the right Logic App hosting plan based on your business & SLO requirements", "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", - "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", - "link": "https://learn.microsoft.com/azure/aks/http-application-routing", - "service": "AKS", + "checklist": "Device Provisioning Service Review", + "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "IoT Hub DPS", "severity": "높다", - "text": "AKS HTTP 라우팅 추가 기능을 사용하지 말고, 애플리케이션 라우팅 추가 기능과 함께 관리되는 NGINX 수신을 대신 사용합니다.", + "text": "영역 중복 및 가용성 영역을 사용하여 지역 오류로부터 논리 앱 보호Protect logic apps from region failures with zone redundancy and availability zones", "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", - "service": "AKS", - "severity": "보통", - "text": "Windows 워크로드의 경우 가속화된 네트워킹을 사용합니다.", - "waf": "공연" + "checklist": "Device Provisioning Service Review", + "guid": "8aed4fbf-0830-4883-899d-222a154af478", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "IoT Hub DPS", + "severity": "높다", + "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", - "guid": "ba7da7be-9952-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "checklist": "Device Provisioning Service Review", + "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "IoT Hub DPS", "severity": "높다", - "text": "표준 ALB 사용(기본 ALB와 반대)", + "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다", "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", - "service": "AKS", + "checklist": "Device Provisioning Service Review", + "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "IoT Hub DPS", "severity": "보통", - "text": "Azure CNI를 사용하는 경우 NodePools에 다른 서브넷을 사용하는 것이 좋습니다.", - "waf": "안전" + "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 논리 앱 코드를 보호합니다.", + "waf": "작업" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", - "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", - "service": "AKS", - "severity": "보통", - "text": "프라이빗 엔드포인트(기본 설정) 또는 Virtual Network 서비스 엔드포인트를 사용하여 클러스터에서 PaaS 서비스에 액세스", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "service": "Azure Monitor", + "text": "Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview 의 데이터 수집 규칙", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", - "guid": "a0f61565-9de5-458f-a372-49c831112dbd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", - "severity": "높다", - "text": "요구 사항에 가장 적합한 CNI 네트워크 플러그 인 선택(Azure CNI 권장)", - "waf": "신뢰도" + "checklist": "Cost Optimization Checklist", + "guid": "45901365-d38e-443f-abcb-d868266abca2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Azure Backup", + "text": "기본 데이터 원본을 찾을 수 없는 백업 인스턴스 확인", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "높다", - "text": "Azure CNI를 사용하는 경우 노드당 최대 Pod 수를 고려하여 서브넷 크기를 적절하게 조정합니다", - "waf": "공연" + "checklist": "Cost Optimization Checklist", + "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "VM", + "text": "연결되지 않은 서비스(디스크, NIC, IP 주소 등) 삭제 또는 보관", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "높다", - "text": "Azure CNI를 사용하는 경우 최대 Pod/노드(기본값 30)를 확인합니다.", - "waf": "공연" + "checklist": "Cost Optimization Checklist", + "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Azure Backup", + "text": "중요 업무용 응용 프로그램에 대한 Site Recovery 저장소와 백업 간의 적절한 균형을 고려합니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "내부 앱의 경우 조직은 방화벽에서 전체 AKS 서브넷을 여는 경우가 많습니다. 이렇게 하면 노드에 대한 네트워크 액세스도 열리고 잠재적으로 Pod에 대한 액세스도 열립니다(Azure CNI를 사용하는 경우). LoadBalancer IP가 다른 서브넷에 있는 경우 앱 클라이언트에서 이 IP만 사용할 수 있어야 합니다. 또 다른 이유는 AKS 서브넷의 IP 주소가 부족한 리소스인 경우 서비스에 해당 IP 주소를 사용하면 클러스터의 최대 확장성이 감소하기 때문입니다.", - "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", - "link": "https://learn.microsoft.com/azure/aks/internal-lb", - "service": "AKS", - "severity": "낮다", - "text": "개인 IP LoadBalancer 서비스를 사용하는 경우 AKS 서브넷이 아닌 전용 서브넷을 사용합니다", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", + "service": "Azure Monitor", + "text": "40개의 서로 다른 로그 분석 작업 영역 간의 지출 및 절감 기회 확인 - 비프로덕션 작업 영역에 대해 서로 다른 보존 및 데이터 수집 사용-인식 및 계층 크기 조정을 위한 일일 한도 만들기 - 일일 한도를 설정하는 경우 한도에 도달할 때 경고를 만드는 것 외에도 특정 비율(예: 90%)에 도달했을 때 알림을 받을 경고 규칙도 만들어야 합니다. - 가능한 경우 작업 영역 변환 고려 - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "높다", - "text": "그에 따라 서비스 IP 주소 범위의 크기를 조정합니다(클러스터 확장성이 제한됨).", - "waf": "신뢰도" + "checklist": "Cost Optimization Checklist", + "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Azure Monitor", + "text": "제거 로그 정책 및 자동화 적용(필요한 경우 로그를 콜드 스토리지로 이동할 수 있음)", + "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", - "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", - "service": "AKS", - "severity": "낮다", - "text": "필요한 경우 자체 CNI 플러그인을 추가합니다.", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "VM", + "text": "디스크가 실제로 필요한지 확인하고, 그렇지 않은 경우 삭제하십시오. 필요한 경우 더 낮은 스토리지 계층을 찾거나 백업을 사용합니다.", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", - "service": "AKS", - "severity": "낮다", - "text": "필요한 경우 AKS에서 노드당 공용 IP 구성", - "waf": "공연" + "checklist": "Cost Optimization Checklist", + "guid": "d1e44a19-659d-4395-afd7-7289b835556d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Storage", + "text": "사용자 지정 규칙을 사용하여 사용하지 않는 스토리지를 하위 계층으로 이동하는 것이 좋습니다 - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", - "link": "https://learn.microsoft.com/azure/aks/concepts-network", - "service": "AKS", - "severity": "보통", - "text": "수신 컨트롤러를 사용하여 LoadBalancer 유형 서비스를 사용하여 노출하는 대신 웹 기반 앱을 노출합니다", - "waf": "신뢰도" + "checklist": "Cost Optimization Checklist", + "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "VM", + "text": "Advisor가 VM 올바른 크기 조정에 대해 구성되어 있는지 확인합니다. ", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", - "link": "https://learn.microsoft.com/azure/aks/nat-gateway", - "service": "AKS", - "severity": "낮다", - "text": "송신 트래픽 크기 조정을 위해 Azure NAT Gateway를 outboundType으로 사용", - "waf": "신뢰도" + "checklist": "Cost Optimization Checklist", + "description": "Cost analysys에서 Meter Category Licenses를 검색하여 확인합니다.", + "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", + "service": "VM", + "text": "모든 Windows VM에서 스크립트 실행 https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- Windows VM을 자주 만드는 경우 정책 구현을 고려합니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", - "service": "AKS", - "severity": "보통", - "text": "Azure CNI IP 소모를 방지하기 위해 IP의 동적 할당 사용", - "waf": "신뢰도" + "checklist": "Cost Optimization Checklist", + "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "VM", + "text": " 이미 라이선스가 있는 경우 AHUB에 넣을 수도 https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", - "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", - "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", - "service": "AKS", - "severity": "높다", - "text": "보안 요구 사항에 필요한 경우 AzFW/NVA를 사용하여 송신 트래픽 필터링", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "VM", + "text": "유연성 옵션을 사용하여 예약된 VM 제품군 통합(4-5개 이하의 제품군)", + "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", - "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", - "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", - "service": "AKS", - "severity": "보통", - "text": "퍼블릭 API 엔드포인트를 사용하는 경우 액세스할 수 있는 IP 주소를 제한합니다", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", + "service": "VM", + "text": "Azure Reserved Instances 활용: 이 기능을 사용하면 1년 또는 3년 동안 VM을 예약할 수 있으므로 PAYG 가격에 비해 상당한 비용 절감 효과를 얻을 수 있습니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", - "link": "https://learn.microsoft.com/azure/aks/private-clusters", - "service": "AKS", - "severity": "높다", - "text": "요구 사항에 따라 개인 클러스터를 사용합니다", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "VM", + "text": "더 큰 디스크만 예약할 수 있습니다 => 1TiB -", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", - "severity": "보통", - "text": "Windows 2019 및 2022 AKS 노드의 경우 Calico 네트워크 정책을 사용할 수 있습니다. ", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", + "service": "VM", + "text": "적절한 크기 최적화 후", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", - "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", - "severity": "높다", - "text": "Kubernetes 네트워크 정책 옵션 사용(Calico/Azure)", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Azure SQL", + "text": "적용 가능한 경우 확인 및 정책/변경 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations 시행", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", - "severity": "높다", - "text": "쿠버네티스 네트워크 정책을 사용하여 클러스터 내 보안 강화", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "VM", + "text": "VM + 라이선스 부분 할인(ahub + 3YRI)은 약 70% 할인입니다.", + "waf": "비용" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "VM", + "text": "플랫 사이징보다는 VMSS를 사용하여 수요에 맞추는 것이 좋습니다", + "waf": "비용" }, { "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "checklist": "Cost Optimization Checklist", + "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", "service": "AKS", - "severity": "높다", - "text": "웹 워크로드(UI 또는 API)에 WAF 사용Use a WAF for web workloads (UIs or APIs)", - "waf": "안전" + "text": "AKS 자동 크기 조정기를 사용하여 클러스터 사용량과 일치시킵니다(Pod 요구 사항이 스케일러와 일치하는지 확인).", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", - "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", - "service": "AKS", - "severity": "보통", - "text": "AKS Virtual Network에서 DDoS 표준 사용Use DDoS Standard in the AKS Virtual Network", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Azure Backup", + "text": "해당하는 경우 복구 지점을 자격 증명 모음 보관으로 이동(유효성 검사)Move recovery points to vault-archive where applicable (Validate)", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", - "link": "https://learn.microsoft.com/azure/aks/http-proxy", - "service": "AKS", - "severity": "낮다", - "text": "필요한 경우 회사 HTTP 프록시를 추가합니다.", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", + "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", + "service": "Databricks", + "text": "가능한 경우 대체와 함께 스폿 VM을 사용하는 것이 좋습니다. 클러스터의 자동 종료를 고려합니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", - "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", - "service": "AKS", - "severity": "보통", - "text": "고급 마이크로서비스 통신 관리를 위해 서비스 메시를 사용하는 것이 좋습니다", - "waf": "안전" + "checklist": "Cost Optimization Checklist", + "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", + "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", + "service": "Azure Functions", + "text": "함수 - 연결 재사용", + "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", - "service": "AKS", - "severity": "높다", - "text": "가장 중요한 메트릭에 대한 경고 구성(권장 사항은 Container Insights 참조)", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "service": "Azure Functions", + "text": "함수 - 로컬에 데이터 캐시", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "337453a3-cc63-4963-9a65-22ac19e80696", - "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", - "service": "AKS", - "severity": "낮다", - "text": "Azure Advisor에서 클러스터에 대한 권장 사항을 정기적으로 확인합니다.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Azure Functions", + "text": "기능 - 콜드 스타트 - '패키지에서 실행' 기능을 사용합니다. 이렇게 하면 코드가 단일 zip 파일로 다운로드됩니다. 예를 들어, 이것은 많은 노드 모듈이 있는 Javascript 함수를 크게 개선할 수 있습니다. 언어별 도구를 사용하여 패키지 크기를 줄입니다(예: 트리 쉐이킹 Javascript 애플리케이션).", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", - "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", - "service": "AKS", - "severity": "낮다", - "text": "AKS 자동 인증서 회전 사용", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "Azure Functions", + "text": "기능 - 기능을 따뜻하게 유지", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", - "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", - "service": "AKS", - "severity": "높다", - "text": "kubernetes 버전을 주기적으로(예: 분기별) 업그레이드하거나 AKS 자동 업그레이드 기능을 사용하는 정기적인 프로세스가 있습니다.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Azure Functions", + "text": "다른 함수와 함께 자동 크기 조정을 사용하는 경우 모든 리소스에 대한 모든 자동 크기 조정을 구동하는 것이 있을 수 있으므로 별도의 소비 계획으로 이동하는 것이 좋습니다(CPU에 대한 더 높은 계획 고려).", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", - "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", - "service": "AKS", - "severity": "높다", - "text": "node-image upgrade를 사용하지 않는 경우 Linux 노드 업그레이드에 kured를 사용합니다.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", + "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", + "service": "Azure Functions", + "text": "지정된 계획의 함수 앱은 모두 함께 크기가 조정되므로 크기 조정과 관련된 모든 문제는 계획의 모든 앱에 영향을 줄 수 있습니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", - "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", - "service": "AKS", - "severity": "높다", - "text": "클러스터 노드 이미지를 주기적으로(예: 매주) 업그레이드하는 정기적인 프로세스가 있습니다.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", + "service": "Azure Functions", + "text": "'대기 시간'에 대한 요금이 청구되나요? 이 질문은 일반적으로 비동기 작업을 수행하고 결과를 기다리는 C # 함수 (예 : await Task.Delay(1000) 또는 await client )의 컨텍스트에서 묻습니다. GetAsync('http://google.com')입니다. 대답은 '예'입니다 - GB 초 계산은 함수의 시작 및 종료 시간과 해당 기간 동안의 메모리 사용량을 기반으로 합니다. CPU 작업 측면에서 해당 시간 동안 실제로 발생하는 일은 계산에 포함되지 않습니다. 이 규칙의 한 가지 예외는 지속성 함수를 사용하는 경우입니다. 오케스트레이터 함수에서 대기하는 데 소요된 시간에 대해서는 요금이 청구되지 않습니다.가능한 경우 수요 형성 기술을 적용합니다(개발 환경?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", - "service": "AKS", - "severity": "낮다", - "text": "gitops를 고려하여 애플리케이션 또는 클러스터 구성을 여러 클러스터에 배포합니다.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Front Door", + "text": "Frontdoor - 기본 홈페이지 끄기앱의 애플리케이션 설정에서 AzureWebJobsDisableHomepage를 true로 설정합니다. 이렇게 하면 PoP에 204(콘텐츠 없음)가 반환되므로 헤더 데이터만 반환됩니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d7672c26-7602-4482-85a4-14527fbe855c", - "link": "https://learn.microsoft.com/azure/aks/command-invoke", - "service": "AKS", - "severity": "낮다", - "text": "프라이빗 클러스터에서 AKS 명령 호출을 사용하는 것이 좋습니다.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Front Door", + "text": "Frontdoor 프론트도어 - 아무것도 반환하지 않는 무언가로 라우팅합니다. 함수, 함수 프록시를 설정하거나 WebApp에서 200(정상)을 반환하고 콘텐츠를 보내지 않거나 최소한으로 보내는 경로를 추가합니다. 이것의 장점은 호출될 때 로그아웃할 수 있다는 것입니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", - "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", - "service": "AKS", - "severity": "낮다", - "text": "계획된 이벤트의 경우 노드 자동 드레인 사용을 고려하십시오.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", + "service": "Storage", + "text": "덜 사용되는 데이터에 대한 보관 계층 고려", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", - "link": "https://learn.microsoft.com/azure/aks/faq", - "service": "AKS", - "severity": "높다", - "text": "노드 RG(일명 '인프라 RG')의 운영자가 변경을 수행하지 않도록 자체 거버넌스 관행을 개발합니다.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "VM", + "text": "크기가 계층과 일치하지 않는 디스크 크기를 확인합니다(예: 513GiB 디스크는 P30(1TiB)를 지불하고 크기 조정을 고려합니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", - "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", - "severity": "낮다", - "text": "사용자 정의 노드 RG (일명 '인프라 RG') 이름 사용", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "Storage", + "text": "가능하면 프리미엄 또는 울트라 대신 표준 SSD를 사용하는 것이 좋습니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", - "link": "https://kubernetes.io/docs/setup/release/notes/", - "service": "AKS", - "severity": "보통", - "text": "YAML 매니페스트에서 더 이상 사용되지 않는 Kubernetes API를 사용하지 마십시오.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "Storage", + "text": "스토리지 계정의 경우 선택한 계층이 트랜잭션 요금을 합산하지 않는지 확인합니다(다음 계층으로 이동하는 것이 더 저렴할 수 있음).", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", - "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", - "service": "AKS", - "severity": "낮다", - "text": "테인트 Windows 노드", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "Site Recovery", + "text": "ASR의 경우 RPO/RTO 및 복제 처리량이 허용하는 경우 표준 SSD 디스크를 사용하는 것이 좋습니다", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", - "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", - "service": "AKS", - "severity": "낮다", - "text": "Windows 컨테이너 패치 수준을 호스트 패치 수준과 동기화된 상태로 유지", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", + "service": "Storage", + "text": "스토리지 계정: 핫 계층 및/또는 GRS 필요 확인", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "클러스터 수준의 진단 설정을 통해Via Diagnostic Settings at the cluster level", - "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", - "link": "https://learn.microsoft.com/azure/aks/monitor-aks", - "service": "AKS", - "severity": "낮다", - "text": "마스터 로그(즉, API 로그)를 Azure Monitor 또는 기본 로그 관리 솔루션으로 보냅니다", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "VM", + "text": "디스크 - 모든 곳에서 프리미엄 SSD 디스크 사용의 유효성을 검사합니다. 예를 들어 비프로덕션은 표준 SSD 또는 주문형 프리미엄 SSD로 교환할 수 있습니다. ", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", - "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", - "service": "AKS", - "severity": "낮다", - "text": "필요한 경우 nodePool 스냅샷을 사용합니다.", + "checklist": "Cost Optimization Checklist", + "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "Synapse", + "text": "예산을 만들어 비용을 관리하고 이해 관계자에게 지출 이상 및 초과 지출 위험을 자동으로 알리는 경고를 만듭니다.", "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", - "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", - "service": "AKS", - "severity": "낮다", - "text": "시간에 민감하지 않은 워크로드에 대한 스폿 노드 풀 고려", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "Synapse", + "text": "추가 데이터 분석을 위해 비용 데이터를 스토리지 계정으로 내보냅니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", - "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", - "severity": "낮다", - "text": "빠른 버스팅을 위해 AKS 가상 노드 고려", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Synapse", + "text": "리소스를 사용하지 않을 때 일시 중지하여 전용 SQL 풀에 대한 비용을 제어합니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", - "severity": "높다", - "text": "Container Insights(또는 Prometheus와 같은 다른 도구)를 사용하여 클러스터 지표 모니터링", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", + "service": "Synapse", + "text": "서버리스 Apache Spark 자동 일시 중지 기능을 활성화하고 그에 따라 제한 시간 값을 설정합니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", - "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", - "severity": "높다", - "text": "Container Insights(또는 Telegraf/ElasticSearch와 같은 다른 도구)를 사용하여 클러스터 로그를 저장하고 분석합니다.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Synapse", + "text": "다양한 크기의 Apache Spark 풀 정의를 여러 개 만듭니다.", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", - "service": "AKS", - "severity": "보통", - "text": "노드의 CPU 및 메모리 사용률 모니터링", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "service": "Synapse", + "text": "사전 구매 플랜으로 1년 동안 Azure Synapse SCU(커밋 단위)를 구매하여 Azure Synapse Analytics 비용을 절감하세요.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1a4835ac-9422-423e-ae80-b123081a5417", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "보통", - "text": "Azure CNI를 사용하는 경우 노드당 사용되는 Pod IP의 %를 모니터링합니다.", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "VM", + "text": "인터럽트 가능한 작업에 스폿 VM 사용: 할인된 가격으로 입찰 및 구매할 수 있는 VM으로, 중요하지 않은 워크로드에 비용 효율적인 솔루션을 제공합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "OS 디스크의 I/O는 중요한 리소스입니다. 노드의 OS가 I/O에서 제한되면 예측할 수 없는 동작이 발생할 수 있으며, 일반적으로 노드가 NotReady로 선언됩니다", - "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", - "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", - "service": "AKS", - "severity": "보통", - "text": "노드에서 OS 디스크 큐 크기 모니터링Monitor OS disk queue depth in nodes", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "544451e1-92d3-4442-a3c7-628637a551c5", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", + "text": "모든 VM의 적절한 크기 조정", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "be209d39-fda4-4777-a424-d116785c2fa5", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", - "severity": "보통", - "text": "AzFW/NVA에서 송신 필터링을 사용하지 않는 경우 표준 ALB 할당 SNAT 포트를 모니터링합니다", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "VM", + "text": "VM 크기를 정규화된 최신 크기로 바꾸기", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", - "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", - "service": "AKS", - "severity": "보통", - "text": "AKS 클러스터에 대한 Resource Health 알림 구독Subscribe to resource health notifications for your AKS cluster", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "적절한 크기 조정 VM - 사용량을 5% 미만으로 모니터링하는 것으로 시작한 다음 최대 40%까지 작업", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", - "severity": "높다", - "text": "Pod 규격에서 요청 및 제한 구성", - "waf": "작업" + "checklist": "Cost Optimization Checklist", + "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "애플리케이션을 컨테이너화하면 VM 밀도를 개선하고 확장 비용을 절감할 수 있습니다", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "비용" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "769ef669-1a48-435a-a942-223ece80b123", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "Identity Review Checklist", + "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", + "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", + "service": "Entra", "severity": "보통", - "text": "네임스페이스에 대한 리소스 할당량 적용Enforce resource quotas for namespaces", - "waf": "작업" + "text": "장기 취소 가능 토큰을 사용하고, 토큰을 캐시하고, Microsoft ID 라이브러리를 사용하여 자동으로 획득합니다.", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "081a5417-4158-433e-a3ad-3c2de733165c", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "AKS", - "severity": "높다", - "text": "구독에 노드 풀을 확장할 수 있는 충분한 할당량이 있는지 확인합니다.", - "waf": "작업" + "checklist": "Identity Review Checklist", + "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", + "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", + "service": "AAD B2C", + "severity": "보통", + "text": "로그인 사용자 흐름이 백업되고 복원력이 있는지 확인합니다. 사용자를 로그인하는 데 사용하는 코드가 백업되고 복구 가능한지 확인합니다. 외부 프로세스와의 복원력 있는 인터페이스", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", - "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "Identity Review Checklist", + "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", + "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", + "service": "AAD B2C", "severity": "보통", - "text": "Cluster Autoscaler 사용", + "text": "사용자 지정 브랜드 자산은 CDN에서 호스팅되어야 합니다.", "waf": "공연" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", - "guid": "831c2872-c693-4b39-a887-a561bada49bc", - "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", - "service": "AKS", + "checklist": "Identity Review Checklist", + "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", + "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", + "service": "AAD B2C", "severity": "낮다", - "text": "AKS 노드 풀에 대한 노드 구성 사용자 지정", - "waf": "공연" + "text": "여러 ID 공급자가 있어야 합니다(예: Microsoft, Google, Facebook 계정으로 로그인).", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "Identity Review Checklist", + "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "severity": "보통", - "text": "필요한 경우 Horizontal Pod Autoscaler 사용", - "waf": "공연" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "노드가 클수록 임시 디스크 및 가속화된 네트워킹과 같은 더 높은 성능과 기능을 제공하지만 폭발 반경이 증가하고 크기 조정 세분성이 감소합니다", - "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", - "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", - "service": "AKS", - "severity": "높다", - "text": "너무 크거나 너무 작지 않은 적절한 노드 크기를 고려합니다", - "waf": "공연" + "text": "VM 수준에서 고가용성을 위한 VM 규칙(프리미엄 디스크, 서로 다른 가용성 영역에 있는 지역에 두 개 이상)을 따릅니다.", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", - "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", - "service": "AKS", - "severity": "낮다", - "text": "확장성을 위해 5,000개 이상의 노드가 필요한 경우 추가 AKS 클러스터를 사용하는 것이 좋습니다", - "waf": "공연" + "checklist": "Identity Review Checklist", + "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "보통", + "text": "복제하지 마세요! 복제로 인해 디렉터리 동기화에 문제가 발생할 수 있습니다", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", - "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", - "service": "AKS", - "severity": "낮다", - "text": "AKS 자동화를 위해 EventGrid 이벤트를 구독하는 것이 좋습니다.", - "waf": "공연" + "checklist": "Identity Review Checklist", + "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "보통", + "text": "다중 지역에 대해 활성-활성 상태 보유", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", - "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", - "service": "AKS", - "severity": "낮다", - "text": "AKS 클러스터에서 장기 실행 작업의 경우 이벤트 종료를 고려합니다.", - "waf": "공연" + "checklist": "Identity Review Checklist", + "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", + "severity": "보통", + "text": "추가 지역 및 위치에 Azure AD 도메인 서비스 스탬프 추가Add Azure AD Domain service stamps to additional regions and locations", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", - "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", - "service": "AKS", + "checklist": "Identity Review Checklist", + "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", + "severity": "보통", + "text": "DR에 복제본 세트 사용", + "waf": "신뢰도" + }, + { + "checklist": "Azure App Service Review", + "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", + "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", + "service": "App Services", "severity": "낮다", - "text": "필요한 경우 AKS 노드에 Azure Dedicated Host를 사용하는 것이 좋습니다", - "waf": "공연" + "text": "모범 사례는 기준 고가용성 영역 중복 웹 애플리케이션 아키텍처를 참조하세요.", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", - "guid": "24367b33-6971-45b1-952b-eee0b9b588de", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "checklist": "Azure App Service Review", + "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", + "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", + "service": "App Services", + "severity": "보통", + "text": "프리미엄 및 표준 계층을 사용합니다. 이러한 계층은 스테이징 슬롯 및 자동 백업을 지원합니다.", + "waf": "신뢰도" + }, + { + "checklist": "Azure App Service Review", + "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", + "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", + "service": "App Services", "severity": "높다", - "text": "임시 OS 디스크 사용", - "waf": "공연" + "text": "지역적으로 적용 가능한 경우 가용성 영역 활용(프리미엄 v2 또는 v3 계층 필요)", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "AKS", + "checklist": "Azure App Service Review", + "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", + "severity": "보통", + "text": "상태 확인 구현", + "waf": "신뢰도" + }, + { + "checklist": "Azure App Service Review", + "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", + "service": "App Services", "severity": "높다", - "text": "임시 디스크가 아닌 디스크의 경우 여러 Pod를 실행하는 데 고성능이 필요하고 기본 AKS 로그 회전 임계값을 사용하여 대규모 로그를 생성하므로 많은 Pod/노드를 실행할 때 노드에 높은 IOPS 및 더 큰 OS 디스크를 사용합니다", - "waf": "공연" + "text": "Azure App Service에 대한 백업 및 복원 모범 사례를 참조하세요.", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", - "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", - "service": "AKS", - "severity": "낮다", - "text": "고성능 스토리지 옵션의 경우 AKS에서 Ultra Disks를 사용합니다.", - "waf": "공연" + "checklist": "Azure App Service Review", + "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", + "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", + "service": "App Services", + "severity": "높다", + "text": "Azure App Service 안정성 모범 사례 구현", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", - "service": "AKS", - "severity": "보통", - "text": "클러스터에서 상태를 유지하지 않고 외부(AzStorage, AzSQL, Cosmos 등)에 데이터를 저장합니다.", - "waf": "공연" + "checklist": "Azure App Service Review", + "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", + "service": "App Services", + "severity": "낮다", + "text": "App Service 앱을 다른 지역으로 이동하는 방법을 숙지합니다. 재해가 발생하는 동안", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", - "service": "AKS", - "severity": "보통", - "text": "AzFiles 표준을 사용하는 경우 성능상의 이유로 AzFiles 프리미엄 및/또는 ANF를 고려합니다", - "waf": "공연" + "checklist": "Azure App Service Review", + "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", + "service": "App Services", + "severity": "높다", + "text": "Azure App Service의 안정성 지원 숙지", + "waf": "신뢰도" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", - "service": "AKS", + "checklist": "Azure App Service Review", + "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "App Services", "severity": "보통", - "text": "Azure 디스크 및 AZ를 사용하는 경우 올바른 영역에 스토리지를 프로비전하기 위해 VolumeBindingMode::WaitForFirstConsumer를 사용하여 LRS 디스크의 영역 내에 노드 풀을 사용하거나 여러 영역에 걸쳐 있는 노드 풀에 ZRS 디스크를 사용하는 것이 좋습니다", - "waf": "공연" + "text": "App Service 계획에서 실행되는 Function Apps에 대해 \"Always On\"이 사용하도록 설정되어 있는지 확인합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", - "service": "Entra", + "checklist": "Azure App Service Review", + "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "severity": "보통", - "text": "다중 테넌트에 대한 명확한 규정 또는 비즈니스 요구 사항이 없는 한 Azure 리소스를 관리하기 위해 하나의 Entra 테넌트를 사용합니다.", - "waf": "작업" + "text": "상태 검사를 사용하여 App Service 인스턴스 모니터링Monitor App Service instances using Health checks", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Entra", - "severity": "낮다", - "text": "Microsoft Entra ID 테넌트를 관리하기 위한 다중 테넌트 자동화 접근 방식이 있는지 확인합니다.", - "waf": "작업" + "checklist": "Azure App Service Review", + "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", + "service": "App Services", + "severity": "보통", + "text": "Application Insights 가용성 테스트를 사용하여 웹앱 또는 웹 사이트의 가용성 및 응답성 모니터링", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "Entra", + "checklist": "Azure App Service Review", + "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", + "service": "App Services", "severity": "낮다", - "text": "다중 테넌트 관리를 위해 Azure Lighthouse 활용", - "waf": "작업" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Entra", - "severity": "보통", - "text": "Azure Lighthouse가 파트너별로 테넌트를 관리하는 데 사용되는지 확인합니다.", - "waf": "비용" + "text": "Application Insights 표준 테스트를 사용하여 웹앱 또는 웹 사이트의 가용성 및 응답성 모니터링", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "348ef254-c27d-442e-abba-c7571559ab91", - "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "service": "Entra", + "checklist": "Azure App Service Review", + "description": "Azure Key Vault를 사용하여 애플리케이션에 필요한 모든 비밀을 저장합니다. Key Vault는 비밀을 저장하기 위한 안전하고 감사된 환경을 제공하며 Key Vault SDK 또는 App Service Key Vault 참조를 통해 App Service와 잘 통합됩니다.", + "guid": "834ac932-223e-4ce8-8b12-3071a5416415", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "severity": "높다", - "text": "클라우드 운영 모델에 맞는 RBAC 모델을 적용합니다. 관리 그룹 및 구독에서 범위 지정 및 할당Scope and Assign across Management Groups and Subscriptions.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "text": "Key Vault를 사용하여 비밀 저장", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", - "service": "Entra", + "checklist": "Azure App Service Review", + "description": "관리 ID를 사용하여 Key Vault SDK를 사용하거나 App Service Key Vault 참조를 통해 Key Vault에 연결합니다.", + "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "severity": "높다", - "text": "모든 계정 유형에 대해 인증 유형 회사 또는 학교 계정만 사용합니다. Microsoft 계정 사용 금지", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "text": "관리 ID를 사용하여 Key Vault에 연결", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "Entra", - "severity": "보통", - "text": "그룹만 사용하여 권한을 할당합니다. 그룹 관리 시스템이 이미 있는 경우 Entra ID 전용 그룹에 온-프레미스 그룹을 추가합니다.", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "checklist": "Azure App Service Review", + "description": "App Service TLS 인증서를 Key Vault에 저장합니다.", + "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", + "service": "App Services", + "severity": "높다", + "text": "Key Vault를 사용하여 TLS 인증서를 저장합니다.", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", - "service": "Entra", - "severity": "낮다", - "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 Microsoft Entra ID 조건부 액세스 정책 적용", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "안전" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", - "service": "Entra", - "severity": "높다", - "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 다단계 인증 적용", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "checklist": "Azure App Service Review", + "description": "중요한 정보를 처리하는 시스템은 격리해야 합니다. 이렇게 하려면 별도의 App Service 계획 또는 App Service Environment를 사용하고 다른 구독 또는 관리 그룹을 사용하는 것이 좋습니다.", + "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", + "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", + "service": "App Services", + "severity": "보통", + "text": "민감한 정보를 처리하는 시스템 격리", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "14658d35-58fd-4772-99b8-21112df27ee4", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "Entra", + "checklist": "Azure App Service Review", + "description": "App Service의 로컬 디스크는 암호화되지 않으며 중요한 데이터를 저장해서는 안 됩니다. (예: D:\\\\Local and %TMP%).", + "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", + "service": "App Services", "severity": "보통", - "text": "Microsoft Entra ID PIM(Privileged Identity Management)을 적용하여 제로 스탠딩 액세스 및 최소 권한 설정", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "text": "로컬 디스크에 중요한 데이터를 저장하지 마십시오.", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "Entra", + "checklist": "Azure App Service Review", + "description": "인증된 웹 애플리케이션의 경우 Azure AD 또는 Azure AD B2C와 같이 잘 설정된 ID 공급자를 사용합니다. 선택한 애플리케이션 프레임워크를 활용하여 이 공급자와 통합하거나 App Service 인증/권한 부여 기능을 사용합니다.", + "guid": "919ca0b2-c121-459e-814b-933df574eccc", + "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", + "service": "App Services", "severity": "보통", - "text": "Active Directory 도메인 서비스에서 Entra 도메인 서비스로 전환하려는 경우 모든 워크로드의 호환성을 평가합니다", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "text": "인증에 설정된 ID 공급자 사용", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", - "service": "Entra", - "severity": "보통", - "text": "Microsoft Entra ID 로그를 플랫폼 중앙 Azure Monitor와 통합합니다. Azure Monitor를 사용하면 Azure의 로그 및 모니터링 데이터에 대한 단일 정보 원본을 사용할 수 있으므로 조직에 로그 수집 및 보존에 대한 요구 사항을 충족할 수 있는 클라우드 네이티브 옵션을 제공합니다.", + "checklist": "Azure App Service Review", + "description": "잘 관리되고 안전한 DevOps 배포 파이프라인과 같이 제어되고 신뢰할 수 있는 환경에서 App Service에 코드를 배포합니다. 이렇게 하면 버전이 제어되지 않고 악성 호스트에서 배포되는 것으로 확인되지 않은 코드를 방지할 수 있습니다.", + "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", + "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", + "service": "App Services", + "severity": "높다", + "text": "신뢰할 수 있는 환경에서 배포", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "984a859c-773e-47d2-9162-3a765a917e1f", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", - "service": "Entra", + "checklist": "Azure App Service Review", + "description": "FTP/FTPS 및 WebDeploy/SCM 모두에 대한 기본 인증을 사용 안함으로 설정합니다. 이렇게 하면 이러한 서비스에 대한 액세스가 비활성화되고 배포에 Azure AD 보안 엔드포인트가 사용됩니다. SCM 사이트는 Azure AD 자격 증명을 사용하여 열 수도 있습니다.", + "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", + "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", + "service": "App Services", "severity": "높다", - "text": "테넌트 전체 계정 잠금을 방지하기 위해 긴급 액세스 또는 비상 계정을 구현합니다", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "text": "기본 인증 사용 안 함", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "35037e68-9349-4c15-b371-228514f4cdff", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "Entra", - "severity": "보통", - "text": "Microsoft Entra ID 역할 할당에 온-프레미스 동기화된 계정을 사용하지 마세요.", - "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", + "checklist": "Azure App Service Review", + "description": "가능한 경우 관리 ID를 사용하여 Azure AD 보안 리소스에 연결합니다. 이렇게 할 수 없는 경우 Key Vault에 비밀을 저장하고 대신 관리 ID를 사용하여 Key Vault에 연결합니다.", + "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", + "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", + "service": "App Services", + "severity": "높다", + "text": "관리 ID를 사용하여 리소스에 연결", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Entra", - "severity": "보통", - "text": "필요한 경우 Microsoft Entra ID 애플리케이션 프록시를 사용하여 원격 사용자에게 내부 애플리케이션(클라우드 또는 온-프레미스에서 호스트됨)에 대한 안전하고 인증된 액세스를 제공합니다.", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "checklist": "Azure App Service Review", + "description": "Azure Container Registry에 저장된 이미지를 사용하는 경우 관리 ID를 사용하여 끌어옵니다.", + "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", + "service": "App Services", + "severity": "높다", + "text": "관리 ID를 사용하여 컨테이너 끌어오기", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", - "service": "VNet", + "checklist": "Azure App Service Review", + "description": "App Service의 진단 설정을 구성하면 모든 원격 분석을 로깅 및 모니터링의 중앙 대상으로 Log Analytics에 보낼 수 있습니다. 이를 통해 HTTP 로그, 애플리케이션 로그, 플랫폼 로그 등과 같은 App Service의 런타임 활동을 모니터링할 수 있습니다.", + "guid": "47768314-c115-4775-a2ea-55b46ad48408", + "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", + "service": "App Services", "severity": "보통", - "text": "최대한의 유연성이 필요한 네트워크 시나리오를 위해 기존의 허브 앤 스포크(hub-and-spoke) 네트워크 토폴로지를 기반으로 하는 네트워크 설계를 활용합니다.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "Log Analytics에 App Service 런타임 로그 보내기Send App Service runtime logs to Log Analytics", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", - "service": "VNet", - "severity": "높다", - "text": "ExpressRoute 게이트웨이, VPN 게이트웨이 및 Azure Firewall 또는 중앙 허브 가상 네트워크의 파트너 NVA를 포함한 공유 네트워킹 서비스를 확인합니다. 필요한 경우 DNS 서버도 배포합니다.", - "waf": "비용" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "VNet", + "checklist": "Azure App Service Review", + "description": "활동 로그를 Log Analytics에 로깅 및 모니터링의 중앙 대상으로 보내도록 진단 설정을 지정합니다. 이렇게 하면 App Service 리소스 자체에서 컨트롤 플레인 작업을 모니터링할 수 있습니다.", + "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "service": "App Services", "severity": "보통", - "text": "애플리케이션 랜딩 존의 모든 공용 IP 주소에 대해 DDoS 네트워크 또는 IP 보호 계획을 사용합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Log Analytics에 App Service 활동 로그 보내기Send App Service activity logs to Log Analytics", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", + "checklist": "Azure App Service Review", + "description": "지역 VNet 통합, 네트워크 보안 그룹 및 UDR의 조합을 사용하여 아웃바운드 네트워크 액세스를 제어합니다. 트래픽은 Azure Firewall과 같은 NVA로 라우팅되어야 합니다. 방화벽의 로그를 모니터링해야 합니다.", + "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", + "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", + "service": "App Services", "severity": "보통", - "text": "파트너 네트워킹 기술 또는 NVA를 배포할 때 파트너 공급업체의 지침을 따릅니다", - "waf": "신뢰도" + "text": "아웃바운드 네트워크 액세스를 제어해야 함", + "waf": "안전" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", - "service": "ExpressRoute", + "checklist": "Azure App Service Review", + "description": "VNet 통합을 사용하고 VNet NAT Gateway 또는 NVA와 같은 Azure Firewall을 사용하여 안정적인 아웃바운드 IP를 제공할 수 있습니다. 이렇게 하면 필요한 경우 수신 당사자가 IP를 기반으로 허용 목록을 만들 수 있습니다. Azure 서비스에 대한 통신의 경우 IP 주소에 의존할 필요가 없는 경우가 많으며 서비스 엔드포인트와 같은 메커니즘을 대신 사용해야 합니다. (또한 수신 끝에서 프라이빗 엔드포인트를 사용하면 SNAT가 발생하지 않고 안정적인 아웃바운드 IP 범위를 제공합니다.)", + "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", + "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", + "service": "App Services", "severity": "낮다", - "text": "허브 및 스포크 시나리오에서 ExpressRoute와 VPN 게이트웨이 간의 전송이 필요한 경우 Azure Route Server를 사용합니다.", + "text": "인터넷 주소에 대한 아웃바운드 통신을 위한 안정적인 IP 보장", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", - "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", - "service": "ARS", - "severity": "낮다", - "text": "Route Server를 사용하는 경우 Route Server 서브넷에 /27 접두사를 사용합니다.", + "checklist": "Azure App Service Review", + "description": "App Service 액세스 제한, 서비스 엔드포인트 또는 프라이빗 엔드포인트의 조합을 사용하여 인바운드 네트워크 액세스를 제어합니다. 웹앱 자체 및 SCM 사이트에 대해 서로 다른 액세스 제한이 필요하고 구성될 수 있습니다.", + "guid": "0725769e-e669-41a4-a34a-c932223ece80", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", + "severity": "높다", + "text": "인바운드 네트워크 액세스를 제어해야 합니다.", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", - "service": "VNet", - "severity": "보통", - "text": "Azure 지역에 걸쳐 여러 허브 및 스포크 토폴로지가 있는 네트워크 아키텍처의 경우 허브 VNet 간에 글로벌 가상 네트워크 피어링을 사용하여 지역을 서로 연결합니다.", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", - "waf": "공연" + "checklist": "Azure App Service Review", + "description": "Application Gateway 또는 Azure Front Door와 같은 Web Application Firewall을 사용하여 악의적인 인바운드 트래픽으로부터 보호합니다. WAF의 로그를 모니터링해야 합니다.", + "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", + "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", + "service": "App Services", + "severity": "높다", + "text": "App Service 앞에서 WAF 사용Use a WAF in front of App Service", + "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", - "service": "VNet", - "severity": "보통", - "text": "네트워크용 Azure Monitor를 사용하여 Azure에서 네트워크의 엔드투엔드 상태를 모니터링합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "작업" + "checklist": "Azure App Service Review", + "description": "WAF에 대한 액세스만 잠궈 WAF를 우회할 수 없는지 확인합니다. 액세스 제한, 서비스 엔드포인트 및 프라이빗 엔드포인트의 조합을 사용합니다.", + "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", + "severity": "높다", + "text": "WAF가 우회되지 않도록 방지", + "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", - "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", + "checklist": "Azure App Service Review", + "description": "App Service 구성에서 최소 TLS 정책을 1.2로 설정합니다.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", + "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", + "service": "App Services", "severity": "보통", - "text": "스포크 가상 네트워크를 중앙 허브 가상 네트워크에 연결할 때 ExpressRoute를 통해 보급할 수 있는 최대 접두사 수(1000)인 VNet 피어링 제한(500)을 고려합니다", - "waf": "신뢰도" + "text": "최소 TLS 정책을 1.2로 설정합니다.", + "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", - "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", - "severity": "보통", - "text": "경로 테이블당 경로 제한(400)을 고려합니다.", - "waf": "신뢰도" + "checklist": "Azure App Service Review", + "description": "HTTPS만 사용하도록 App Service를 구성합니다. 이로 인해 App Service가 HTTP에서 HTTPS로 리디렉션됩니다. 코드 또는 WAF에서 HSTS(HTTP Strict Transport Security)를 사용하여 HTTPS를 통해서만 사이트에 액세스해야 함을 브라우저에 알리는 것이 좋습니다.", + "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", + "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", + "service": "App Services", + "severity": "높다", + "text": "HTTPS만 사용", + "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", - "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", - "service": "VNet", + "checklist": "Azure App Service Review", + "description": "CORS 구성에서 와일드카드를 사용하면 모든 원본이 서비스에 액세스할 수 있으므로 CORS의 목적에 어긋나므로 사용하지 마세요. 특히 서비스에 액세스할 수 있을 것으로 예상되는 원본만 허용합니다.", + "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", + "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", + "service": "App Services", "severity": "높다", - "text": "VNet 피어링을 구성할 때 '원격 가상 네트워크에 대한 트래픽 허용' 설정을 사용합니다", - "waf": "신뢰도" + "text": "와일드카드는 CORS에 사용할 수 없습니다.", + "waf": "안전" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", - "service": "ExpressRoute", - "severity": "보통", - "text": "ExpressRoute Direct를 사용하는 경우 조직의 라우터와 MSEE 간의 계층 2 수준에서 트래픽을 암호화하도록 MACsec을 구성합니다. 다이어그램은 흐름에서 이 암호화를 보여 줍니다.", + "checklist": "Azure App Service Review", + "description": "원격 디버깅은 서비스에서 추가 포트를 열어 공격 노출 영역을 증가시키므로 프로덕션에서 켜면 안 됩니다. 서비스는 48시간 후에 자동으로 원격 디버깅을 설정합니다.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", + "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", + "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", + "service": "App Services", + "severity": "높다", + "text": "원격 디버깅 끄기", "waf": "안전" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", - "severity": "낮다", - "text": "MACsec을 사용할 수 없는 시나리오(예: ExpressRoute Direct를 사용하지 않는 경우)의 경우 VPN Gateway를 사용하여 ExpressRoute 개인 피어링을 통해 IPsec 터널을 설정합니다.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "checklist": "Azure App Service Review", + "description": "App Service용 Defender를 사용하도록 설정합니다. 이는 다른 위협 중에서도 알려진 악성 IP 주소에 대한 통신을 탐지합니다. 작업의 일부로 App Service용 Defender의 권장 사항을 검토합니다.", + "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", + "service": "App Services", + "severity": "보통", + "text": "클라우드용 Defender 사용 - App Service용 Defender", "waf": "안전" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "558fd772-49b8-4211-82df-27ee412e7f98", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "ExpressRoute", - "severity": "높다", - "text": "Azure 지역 및 온-프레미스 위치에서 겹치는 IP 주소 공간이 사용되지 않는지 확인합니다.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "checklist": "Azure App Service Review", + "description": "Azure는 네트워크에서 DDoS 기본 보호를 제공하며, 정상적인 트래픽 패턴을 학습하고 비정상적인 동작을 감지할 수 있는 지능형 DDoS 표준 기능으로 개선할 수 있습니다. DDoS 표준은 Virtual Network에 적용되므로 Application Gateway 또는 NVA와 같은 앱 앞의 네트워크 리소스에 대해 구성해야 합니다.", + "guid": "223ece80-b123-4071-a541-6415833ea3ad", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "App Services", + "severity": "보통", + "text": "WAF VNet에서 DDOS 보호 표준 사용Enable DDOS Protection Standard on the WAF VNet", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", - "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", - "severity": "낮다", - "text": "개인 인터넷에 대한 주소 할당 범위의 IP 주소를 사용합니다(RFC 1918).", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "checklist": "Azure App Service Review", + "description": "Azure Container Registry에 저장된 이미지를 사용하는 경우 프라이빗 엔드포인트 및 앱 설정 'WEBSITE_PULL_IMAGE_OVER_VNET'를 사용하여 Azure Container Registry에서 가상 네트워크를 통해 끌어옵니다.", + "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", + "service": "App Services", + "severity": "보통", + "text": "Virtual Network를 통해 컨테이너 끌어오기", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", - "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", - "severity": "높다", - "text": "IP 주소 공간이 낭비되지 않는지 확인하고 불필요하게 큰 가상 네트워크(예: /16)를 만들지 마세요.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "공연" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", - "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", - "service": "VNet", - "severity": "높다", - "text": "프로덕션 및 DR 사이트에 겹치는 IP 주소 범위를 사용하지 마십시오.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "신뢰도" + "checklist": "Azure App Service Review", + "description": "참여의 침투 테스트 규칙에 따라 웹 응용 프로그램에 대한 침투 테스트를 수행합니다.", + "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", + "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", + "service": "App Services", + "severity": "보통", + "text": "침투 테스트 수행", + "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", + "checklist": "Azure App Service Review", + "description": "DevSecOps 사례에 따라 취약성을 검증하고 검사한 신뢰할 수 있는 코드를 배포합니다.", + "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", + "service": "App Services", "severity": "보통", - "text": "Azure에서 이름 확인만 필요한 환경의 경우 이름 확인을 위해 위임된 영역(예: 'azure.contoso.com')을 사용하여 확인을 위해 Azure 프라이빗 DNS를 사용합니다.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "작업" + "text": "유효성이 검사된 코드 배포", + "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", - "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", - "service": "DNS", - "severity": "보통", - "text": "Azure 및 온-프레미스에서 이름 확인이 필요한 환경의 경우 Azure DNS Private Resolver를 사용하는 것이 좋습니다.", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "checklist": "Azure App Service Review", + "description": "지원되는 플랫폼, 프로그래밍 언어, 프로토콜 및 프레임워크의 최신 버전을 사용합니다.", + "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", + "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", + "service": "App Services", + "severity": "높다", + "text": "최신 플랫폼, 언어, 프로토콜 및 프레임워크 사용", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub는 미사용 데이터의 암호화를 제공합니다. 사용자 고유의 키를 사용하는 경우 데이터는 여전히 Microsoft 관리형 키를 사용하여 암호화되지만 Microsoft 관리형 키는 고객 관리형 키를 사용하여 암호화됩니다. ", + "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", + "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", + "service": "Event Hubs", "severity": "낮다", - "text": "자체 DNS(예: Red Hat OpenShift)를 요구하고 배포하는 특수 워크로드는 선호하는 DNS 솔루션을 사용해야 합니다.", - "waf": "작업" + "text": "필요한 경우 미사용 데이터 암호화에서 고객 관리형 키 옵션 사용Use customer-managed key option in data at rest encryption when required", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "614658d3-558f-4d77-849b-821112df27ee", - "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", - "service": "DNS", - "severity": "높다", - "text": "Azure DNS에 대한 자동 등록을 사용하도록 설정하여 가상 네트워크 내에 배포된 가상 머신에 대한 DNS 레코드의 수명 주기를 자동으로 관리합니다.", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "작업" + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hubs 네임스페이스를 사용하면 클라이언트가 TLS 1.0 이상을 사용하여 데이터를 보내고 받을 수 있습니다. 더 엄격한 보안 조치를 적용하기 위해 클라이언트가 최신 버전의 TLS를 사용하여 데이터를 보내고 받도록 Event Hubs 네임스페이스를 구성할 수 있습니다. Event Hubs 네임스페이스에 최소 버전의 TLS가 필요한 경우 이전 버전으로 수행된 모든 요청이 실패합니다. ", + "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", + "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", + "service": "Event Hubs", + "severity": "보통", + "text": "요청에 필요한 최소 버전의 TLS(전송 계층 보안) 적용 ", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", - "service": "Bastion", + "checklist": "Azure Event Hub Review", + "description": "Event Hubs 네임스페이스를 만들 때 네임스페이스에 대해 RootManageSharedAccessKey라는 정책 규칙이 자동으로 만들어집니다. 이 정책에는 전체 네임스페이스에 대한 관리 권한이 있습니다. 이 규칙을 관리 루트 계정처럼 취급하고 응용 프로그램에서 사용하지 않는 것이 좋습니다. RBAC에서 AAD를 인증 공급자로 사용하는 것이 좋습니다. ", + "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", + "service": "Event Hubs", "severity": "보통", - "text": "Azure Bastion을 사용하여 네트워크에 안전하게 연결하는 것이 좋습니다.", + "text": "필요하지 않은 경우 루트 계정을 사용하지 마십시오.", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", - "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", - "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", - "service": "Bastion", + "checklist": "Azure Event Hub Review", + "description": "Azure 리소스에 대한 관리 ID는 Azure VM(Virtual Machines), 함수 앱, Virtual Machine Scale Sets 및 기타 서비스에서 실행되는 애플리케이션에서 Azure AD 자격 증명을 사용하여 Event Hubs 리소스에 대한 액세스 권한을 부여할 수 있습니다. Azure AD 인증과 함께 Azure 리소스에 대한 관리 ID를 사용하면 클라우드에서 실행되는 애플리케이션에 자격 증명을 저장하지 않아도 됩니다. ", + "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", + "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", + "service": "Event Hubs", "severity": "보통", - "text": "서브넷 /26 이상에서 Azure Bastion을 사용합니다.", + "text": "가능한 경우 애플리케이션은 관리 ID를 사용하여 Azure Event Hub에 인증해야 합니다. 그렇지 않은 경우 Azure Key Vault 또는 동등한 서비스에 스토리지 자격 증명(SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "WAF", - "severity": "보통", - "text": "Azure Front Door 및 WAF 정책을 사용하여 랜딩 존에 대한 인바운드 HTTP/S 연결을 위해 Azure 지역에서 전역 보호를 제공합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "checklist": "Azure Event Hub Review", + "description": "권한을 만들 때 Azure Event Hub에 대한 클라이언트의 액세스를 세밀하게 제어할 수 있습니다. Azure Event Hub의 사용 권한은 개별 리소스 수준(예: 소비자 그룹, 이벤트 허브 엔터티, 이벤트 허브 네임스페이스 등)으로 범위를 지정할 수 있으며 범위가 지정되어야 합니다.", + "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", + "service": "Event Hubs", + "severity": "높다", + "text": "최소 권한 데이터 평면 RBAC 사용", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "severity": "낮다", - "text": "Azure Front Door 및 Azure Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Azure Front Door에서 WAF 정책을 사용합니다. Azure Front Door에서만 트래픽을 수신하도록 Azure Application Gateway를 잠급니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub 리소스 로그에는 작업 로그, 가상 네트워크 및 Kafka 로그가 포함됩니다. 런타임 감사 로그는 Event Hubs의 모든 데이터 평면 액세스 작업(예: 이벤트 보내기 또는 받기)에 대해 집계된 진단 정보를 캡처합니다.", + "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", + "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", + "service": "Event Hubs", + "severity": "보통", + "text": "보안 조사를 위해 로깅을 사용하도록 설정합니다. Azure Monitor를 사용하여 리소스 로그, 런타임 감사 로그 및 Kafka 로그와 같은 메트릭 및 로그를 캡처합니다.", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "severity": "높다", - "text": "WAF 및 기타 역방향 프록시 배포는 인바운드 HTTP/S 연결에 필요하며, 랜딩 존 가상 네트워크 내에 배포하고 보호하고 인터넷에 노출하는 앱과 함께 배포합니다.", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "checklist": "Azure Event Hub Review", + "description": "Azure Event Hub는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 가상 네트워크와 Azure Event Hub 간의 트래픽이 Microsoft 백본 네트워크를 통해 트래버스할 수 있습니다. 또한 퍼블릭 엔드포인트를 사용하지 않는 경우 사용하지 않도록 설정해야 합니다. ", + "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", + "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", + "service": "Event Hubs", + "severity": "보통", + "text": "프라이빗 엔드포인트를 사용하여 Azure Event Hub에 액세스하고 해당하는 경우 공용 네트워크 액세스를 사용하지 않도록 설정하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", - "severity": "높다", - "text": "Azure DDoS 네트워크 또는 IP 보호 계획을 사용하여 가상 네트워크 내에서 공용 IP 주소 엔드포인트를 보호할 수 있습니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "checklist": "Azure Event Hub Review", + "description": "IP 방화벽을 사용하면 퍼블릭 엔드포인트를 CIDR(Classless Inter-Domain Routing) 표기법의 IPv4 주소 또는 IPv4 주소 범위 집합으로만 추가로 제한할 수 있습니다. ", + "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", + "service": "Event Hubs", + "severity": "보통", + "text": "특정 IP 주소 또는 범위에서 Azure Event Hub 네임스페이스에 대한 액세스만 허용하는 것이 좋습니다", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b034c01e-110b-463a-b36e-e3346e57f225", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", - "service": "VNet", - "severity": "높다", - "text": "예정된 호환성이 손상되는 변경 전에 네트워크 아웃바운드 트래픽 구성 및 전략을 평가하고 검토합니다. 2025년 9월 30일에 새 배포에 대한 기본 아웃바운드 액세스가 사용 중지되고 명시적 액세스 구성만 허용됩니다", + "checklist": "Azure Event Hub Review", + "guid": "31d41e36-11c8-417b-8afb-c410d4391898", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", + "service": "Event Hubs", + "severity": "보통", + "text": "FTA 탄력성 핸드북 활용", "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", + "checklist": "Azure Event Hub Review", + "description": " 영역 사용 지역의 프리미엄, 전용 또는 표준 SKU를 사용하여 포털에서 만든 새 EH 네임스페이스에 대해 자동으로 설정됩니다. EH 메타데이터와 이벤트 데이터 자체는 모두 영역 간에 복제됩니다", + "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", + "service": "Event Hubs", "severity": "높다", - "text": "보호된 모든 공용 IP 주소(DDoS IP 또는 네트워크 보호)에 대한 DDoS 관련 로그를 저장하는 진단 설정을 추가합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "안전" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", - "service": "ExpressRoute", - "severity": "보통", - "text": "ExpressRoute를 Azure에 대한 기본 연결로 사용할 수 있는지 조사했는지 확인합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "공연" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "description": "AS-path 접두사 및 연결 가중치를 사용하여 Azure에서 온-프레미스로의 트래픽에 영향을 주고, 자체 라우터의 전체 BGP 특성 범위를 사용하여 온-프레미스에서 Azure로의 트래픽에 영향을 줄 수 있습니다.", - "guid": "f29812b2-363c-4efe-879b-599de0d5973c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", - "severity": "보통", - "text": "여러 ExpressRoute 회로 또는 여러 온-프레미스 위치를 사용하는 경우 특정 경로를 선호하는 경우 BGP 특성을 사용하여 라우팅을 최적화해야 합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "지역적으로 적용 가능한 경우 가용성 영역 활용Leverage Availability Zones if regionally applicable", "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", - "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", + "checklist": "Azure Event Hub Review", + "guid": "20b56c56-ad58-4519-8f82-735c586bb281", + "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", + "service": "Event Hubs", "severity": "보통", - "text": "대역폭 및 성능 요구 사항에 따라 ExpressRoute/VPN 게이트웨이에 적합한 SKU를 사용하고 있는지 확인합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "공연" - }, - { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", - "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", - "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", - "service": "ExpressRoute", - "severity": "높다", - "text": "비용을 정당화하는 대역폭에 도달하는 경우에만 무제한 데이터 ExpressRoute 회로를 사용해야 합니다.", - "waf": "비용" + "text": "예측 가능한 성능을 위해 프리미엄 또는 전용 SKU 사용", + "waf": "신뢰도" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", - "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", - "service": "ExpressRoute", + "checklist": "Azure Event Hub Review", + "description": "기본 제공 지역 재해 복구 기능을 사용하도록 설정하면 네임스페이스(Event Hubs, 소비자 그룹 및 설정)의 전체 구성이 기본 네임스페이스에서 보조 네임스페이스로 지속적으로 복제되며, 언제든지 한 번만 장애 조치(failover)를 주 네임스페이스에서 보조 네임스페이스로 이동할 수 있습니다. 활성/수동 기능은 애플리케이션 구성을 변경할 필요 없이 실패한 Azure 지역에서 더 쉽게 복구하고 중단할 수 있도록 설계되었습니다", + "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", + "service": "Event Hubs", "severity": "높다", - "text": "회로의 피어링 위치가 로컬 SKU에 대한 Azure 지역을 지원하는 경우 ExpressRoute의 로컬 SKU를 활용하여 회로 비용을 줄입니다.", - "waf": "비용" + "text": "Active Passive 구성을 사용하여 지역 재해 복구 계획Plan for Geo Disaster Recovery using Active Passive configuration", + "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", - "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", - "service": "ExpressRoute", + "checklist": "Azure Event Hub Review", + "description": "다운된 지역에서 이벤트 데이터의 중단 또는 손실을 허용할 수 없는 DR 구성에 사용해야 합니다. 이러한 경우 복제 지침을 따르고 기본 제공 지역 재해 복구 기능(활성/수동)을 사용하지 마세요. 액티브/액티브를 사용하여 서로 다른 지역 및 네임스페이스에서 여러 Event Hubs를 유지 관리하면 허브 간에 이벤트가 복제됩니다", + "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", + "service": "Event Hubs", "severity": "보통", - "text": "지원되는 Azure 지역에 영역 중복 ExpressRoute 게이트웨이를 배포합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "Business Critical Applications의 경우 Active Active 구성을 사용합니다.", "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", - "service": "ExpressRoute", + "checklist": "Azure Event Hub Review", + "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", + "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", + "service": "Event Hubs", "severity": "보통", - "text": "10Gbps보다 높은 대역폭 또는 전용 10/100Gbps 포트가 필요한 시나리오의 경우 ExpressRoute Direct를 사용합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "공연" + "text": "복원력 있는 Event Hubs 설계", + "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", - "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", - "service": "ExpressRoute", + "checklist": "Azure Spring Apps Review", + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "service": "Spring Apps", "severity": "보통", - "text": "짧은 대기 시간이 필요하거나 온-프레미스에서 Azure로의 처리량이 10Gbps보다 커야 하는 경우 FastPath를 사용하여 데이터 경로에서 ExpressRoute 게이트웨이를 우회합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "공연" + "text": "Azure Spring Apps는 모든 앱에 대해 두 개의 배포를 허용하며, 그 중 하나만 프로덕션 트래픽을 수신합니다. 블루-그린 배포 전략을 통해 가동 중지 시간 제로를 달성할 수 있습니다. 파란색 녹색 배포는 표준 및 엔터프라이즈 계층에서만 사용할 수 있습니다. ADO/GitHub 작업과 함께 CI/CD를 사용하여 배포를 자동화할 수 있습니다.", + "waf": "신뢰도" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", - "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", - "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", - "service": "VPN", + "checklist": "Azure Spring Apps Review", + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "service": "Spring Apps", "severity": "보통", - "text": "영역 중복 VPN Gateway를 사용하여 분기 또는 원격 위치를 Azure(사용 가능한 경우)에 연결합니다.", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "text": "Azure Spring Apps 인스턴스는 애플리케이션에 대해 여러 지역에서 만들 수 있으며 Traffic Manager/Front Door에서 트래픽을 라우팅할 수 있습니다.", "waf": "신뢰도" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", - "service": "VPN", + "checklist": "Azure Spring Apps Review", + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "service": "Spring Apps", "severity": "보통", - "text": "온-프레미스에서 중복 VPN 어플라이언스(활성/활성 또는 활성/수동)를 사용합니다.", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "text": "지원되는 지역에서 Azure Spring Apps는 영역 중복으로 배포할 수 있으며, 이는 인스턴스가 가용성 영역에 자동으로 분산됨을 의미합니다. 이 기능은 Standard 및 Enterprise 계층에서만 사용할 수 있습니다.", "waf": "신뢰도" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "718cb437-b060-2589-8856-2e93a5c6633b", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", - "severity": "높다", - "text": "ExpressRoute Direct를 사용하는 경우 비용을 절감하기 위해 로컬 Azure 지역에 대한 ExpressRoute 로컬 회로를 사용하는 것이 좋습니다", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "비용" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", - "service": "ExpressRoute", + "checklist": "Azure Spring Apps Review", + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "service": "Spring Apps", "severity": "보통", - "text": "트래픽 격리 또는 전용 대역폭이 필요한 경우(예: 프로덕션 환경과 비프로덕션 환경을 분리하기 위해) 다른 ExpressRoute 회로를 사용합니다. 격리된 라우팅 도메인을 보장하고 시끄러운 이웃 위험을 완화하는 데 도움이 됩니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "안전" + "text": "앱에 1개 이상의 앱 인스턴스 사용", + "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b30e38c3-f298-412b-8363-cefe179b599d", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", - "service": "ExpressRoute", + "checklist": "Azure Spring Apps Review", + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "service": "Spring Apps", "severity": "보통", - "text": "기본 제공 Express Route Insights를 사용하여 ExpressRoute 가용성 및 사용률을 모니터링합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "작업" + "text": "로그, 메트릭 및 추적을 사용하여 Azure Spring Apps를 모니터링합니다. ASA를 Application Insights와 통합하고, 오류를 추적하고, 통합 문서를 만듭니다.", + "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", - "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", - "service": "ExpressRoute", + "checklist": "Azure Spring Apps Review", + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "service": "Spring Apps", "severity": "보통", - "text": "네트워크 전체, 특히 온-프레미스와 Azure 간의 연결을 모니터링하려면 연결 모니터를 사용합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "작업" + "text": "Spring Cloud Gateway에서 자동 크기 조정 설정", + "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", - "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", - "service": "ExpressRoute", - "severity": "보통", - "text": "중복성을 위해 서로 다른 피어링 위치의 ExpressRoute 회로를 사용합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "checklist": "Azure Spring Apps Review", + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "service": "Spring Apps", + "severity": "낮다", + "text": "표준 소비 및 전용 플랜이 있는 앱에 대해 자동 크기 조정을 사용하도록 설정합니다.", "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", - "service": "ExpressRoute", + "checklist": "Azure Spring Apps Review", + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "service": "Spring Apps", "severity": "보통", - "text": "특히 단일 ExpressRoute 회로만 사용하는 경우 사이트 간 VPN을 ExpressRoute의 장애 조치(failover)로 사용합니다.", + "text": "중요 업무용 앱에 대한 Spring Boot의 상업적 지원을 위해 Enterprise 플랜을 사용합니다. 다른 계층에서는 OSS 지원을 받을 수 있습니다.", "waf": "신뢰도" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", - "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", - "service": "ExpressRoute", - "severity": "높다", - "text": "GatewaySubnet에서 경로 테이블을 사용하는 경우 게이트웨이 경로가 전파되었는지 확인합니다.", + "checklist": "Azure Data Factory Review Checklist", + "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", + "service": "Azure Data Factory", + "severity": "보통", + "text": "Azure Data Factory에 대한 FTA 복원력 플레이북 활용", "waf": "신뢰도" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "d581a947-69a2-4783-942e-9df3664324c8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", - "service": "ExpressRoute", + "checklist": "Azure Data Factory Review Checklist", + "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "높다", - "text": "ExpressRoute를 사용하는 경우 온-프레미스 라우팅은 동적이어야 하며, 연결 오류가 발생할 경우 회로의 나머지 연결로 수렴되어야 합니다. 로드는 두 연결 모두에서 이상적으로는 액티브/액티브로 공유되어야 하지만 액티브/패시브도 지원됩니다.", + "text": "가용성 영역을 지원하는 지역에서 영역 중복 파이프라인 사용Use zone redundant pipelines in regions that support Availability Zones", "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", - "service": "ExpressRoute", + "checklist": "Azure Data Factory Review Checklist", + "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", + "link": "https://learn.microsoft.com/azure/data-factory/source-control", + "service": "Azure Data Factory", "severity": "보통", - "text": "ExpressRoute 회로의 두 물리적 링크가 네트워크에 있는 두 개의 고유한 에지 디바이스에 연결되어 있는지 확인합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "DevOps를 사용하여 Github/Azure DevOps 통합으로 ARM 템플릿 백업 ", "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", - "service": "ExpressRoute", + "checklist": "Azure Data Factory Review Checklist", + "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "보통", - "text": "BFD(Bidirectional Forwarding Detection)가 고객 또는 프로바이더 에지 라우팅 디바이스에서 활성화되고 구성되도록 보장합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "다른 지역에서 자체 호스팅 통합 런타임 VM을 복제해야 합니다. ", "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "ExpressRoute", - "severity": "높다", - "text": "복원력을 높이기 위해 서로 다른 피어링 위치에서 둘 이상의 회로에 ExpressRoute 게이트웨이를 연결합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "checklist": "Azure Data Factory Review Checklist", + "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", + "severity": "보통", + "text": "자매 지역에서 네트워크를 복제하거나 복제해야 합니다. 다른 지역에서 Vnet의 복사본을 만들어야 합니다", "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", - "service": "ExpressRoute", - "severity": "보통", - "text": "ExpressRoute 가상 네트워크 게이트웨이에 대한 진단 로그 및 경고를 구성합니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "작업" + "checklist": "Azure Data Factory Review Checklist", + "description": "ADF 파이프라인에서 Key Vault를 사용하는 경우 Key Vault를 복제하기 위해 아무 작업도 수행할 필요가 없습니다. Key Vault는 관리되는 서비스이며 Microsoft에서 처리합니다", + "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Azure Data Factory", + "severity": "낮다", + "text": "Keyvault 통합을 사용하는 경우 Keyvault의 SLA를 사용하여 가용성을 파악합니다", + "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5234c93f-b651-41dd-80c1-234177b91ced", - "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", - "service": "ExpressRoute", + "checklist": "SAP Checklist", + "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", + "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", + "service": "SAP", "severity": "보통", - "text": "VNet 간 통신에 ExpressRoute 회로를 사용하지 마세요.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "공연" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", - "severity": "높다", - "text": "Azure Firewall을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, 비 HTTP/S 인바운드 연결 및 East/West 트래픽 필터링(조직에 필요한 경우)을 제어합니다", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "안전" + "text": "ACSS(Azure Center for SAP solutions)는 SAP를 Azure의 최상위 워크로드로 만드는 Azure 제품입니다. ACSS는 Azure에서 SAP 시스템을 통합 워크로드로 만들고 실행할 수 있도록 하는 엔드투엔드 솔루션으로, 혁신을 위한 보다 원활한 기반을 제공합니다. 신규 및 기존 Azure 기반 SAP 시스템 모두에 대한 관리 기능을 활용할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", + "checklist": "SAP Checklist", + "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", + "service": "SAP", "severity": "보통", - "text": "글로벌 Azure Firewall 정책을 만들어 글로벌 네트워크 환경에서 보안 태세를 제어하고 모든 Azure Firewall 인스턴스에 할당합니다. Azure 역할 기반 액세스 제어를 통해 증분 방화벽 정책을 로컬 보안 팀에 위임하여 특정 지역의 요구 사항을 충족하는 세분화된 정책을 허용합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "안전" + "text": "Azure는 Linux 및 Windows에서 SAP 배포 자동화를 지원합니다. SAP Deployment Automation Framework는 SAP 환경을 배포, 설치 및 유지 관리할 수 있는 오픈 소스 오케스트레이션 도구입니다.", + "training": "https://github.com/Azure/sap-automation", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", - "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", - "service": "Firewall", - "severity": "낮다", - "text": "조직에서 이러한 솔루션을 사용하여 아웃바운드 연결을 보호하려는 경우 Firewall Manager 내에서 지원되는 파트너 SaaS 보안 공급자를 구성합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", + "service": "SAP", + "severity": "보통", + "text": "RTO를 충족하는 시점과 시간 프레임에서 프로덕션 데이터베이스에 대한 특정 시점으로 복구를 수행합니다. 특정 시점 복구에는 일반적으로 DBMS 계층 또는 SAP를 통해 데이터를 삭제하는 운영자 오류가 포함됩니다", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", - "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", - "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", - "service": "Firewall", - "severity": "높다", - "text": "FQDN 기반 네트워크 규칙 및 DNS 프록시와 함께 Azure Firewall을 사용하여 애플리케이션 규칙에서 지원하지 않는 프로토콜을 통해 인터넷으로의 송신 트래픽을 필터링합니다.", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", + "service": "SAP", + "severity": "보통", + "text": "백업 및 복구 시간을 테스트하여 재해 발생 후 모든 시스템을 동시에 복원하기 위한 RTO 요구 사항을 충족하는지 확인합니다.", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", - "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", + "checklist": "SAP Checklist", + "guid": "b651423c-8552-42db-a545-5cb50c05527a", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "SAP", "severity": "높다", - "text": "추가 보안 및 보호를 위해 Azure Firewall 프리미엄을 사용합니다.", - "waf": "안전" + "text": "쌍을 이루는 지역 간에 표준 스토리지를 복제할 수 있지만 표준 스토리지를 사용하여 데이터베이스 또는 가상 하드 디스크를 저장할 수는 없습니다. 사용하는 쌍을 이루는 지역 간에만 백업을 복제할 수 있습니다. 다른 모든 데이터의 경우 SQL Server Always On 또는 SAP HANA 시스템 복제와 같은 네이티브 DBMS 기능을 사용하여 복제를 실행합니다. SAP 애플리케이션 계층에 Site Recovery, rsync 또는 robocopy 및 기타 타사 소프트웨어의 조합을 사용합니다.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", - "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", - "severity": "높다", - "text": "추가 보호를 위해 Azure Firewall 위협 인텔리전스 모드를 경고 및 거부로 구성합니다.", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", + "severity": "보통", + "text": "Azure 가용성 영역을 사용하여 고가용성을 달성하는 경우 SAP 애플리케이션 서버와 데이터베이스 서버 간의 대기 시간을 고려해야 합니다. 대기 시간이 긴 영역의 경우 SAP 애플리케이션 서버와 데이터베이스 서버가 항상 동일한 영역에서 실행되도록 운영 절차를 마련해야 합니다.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", - "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", - "service": "Firewall", + "checklist": "SAP Checklist", + "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "SAP", "severity": "높다", - "text": "추가 보호를 위해 Azure Firewall IDPS 모드를 거부로 구성합니다.", - "waf": "안전" + "text": "온-프레미스에서 기본 및 보조 Azure 재해 복구 지역으로의 ExpressRoute 연결을 설정합니다. 또한 ExpressRoute를 사용하는 대신 온-프레미스에서 주 및 보조 Azure 재해 복구 지역으로 VPN 연결을 설정하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", - "guid": "a3784907-9836-4271-aafc-93535f8ec08b", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", - "service": "Firewall", - "severity": "높다", - "text": "Virtual WAN에 연결되지 않은 VNet의 서브넷의 경우 인터넷 트래픽이 Azure Firewall 또는 네트워크 가상 어플라이언스로 리디렉션되도록 경로 테이블을 연결합니다", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "SAP", + "severity": "낮다", + "text": "DR 지역에서 데이터의 암호를 해독할 수 있도록 지역 간에 인증서, 비밀 또는 키와 같은 키 자격 증명 모음 콘텐츠를 복제합니다.", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "715d833d-4708-4527-90ac-1b142c7045ba", - "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", - "service": "Firewall", + "checklist": "SAP Checklist", + "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", + "service": "SAP", "severity": "보통", - "text": "모든 Azure Firewall 배포에 대해 리소스별 대상 테이블을 사용하여 로그를 저장하는 진단 설정을 추가합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "작업" + "text": "기본 및 재해 복구 가상 네트워크를 피어링합니다. 예를 들어 HANA 시스템 복제의 경우 SAP HANA DB 가상 네트워크를 재해 복구 사이트의 SAP HANA DB 가상 네트워크에 피어링해야 합니다.", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", - "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", - "service": "Firewall", - "severity": "중요하다", - "text": "Azure Firewall 클래식 규칙(있는 경우)에서 방화벽 정책으로 마이그레이션합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "작업" + "checklist": "SAP Checklist", + "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", + "service": "SAP", + "severity": "낮다", + "text": "SAP 배포에 Azure NetApp Files 스토리지를 사용하는 경우 최소한 두 지역의 프리미엄 계층에 두 개의 Azure NetApp Files 계정을 만듭니다.", + "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", - "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", - "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", - "service": "Firewall", + "checklist": "SAP Checklist", + "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", "severity": "높다", - "text": "Azure Firewall 서브넷에 /26 접두사를 사용합니다.", - "waf": "안전" + "text": "기본 데이터베이스 복제 기술을 사용하여 HA 쌍의 데이터베이스를 동기화해야 합니다.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", - "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", - "service": "Firewall", - "severity": "보통", - "text": "방화벽 정책 내의 규칙을 Rule Collection Groups(규칙 컬렉션 그룹) 및 Rule Collections(규칙 컬렉션)로 정렬하고 사용 빈도에 따라 정렬합니다", - "waf": "공연" + "checklist": "SAP Checklist", + "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", + "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", + "service": "SAP", + "severity": "높다", + "text": "기본 VNet(가상 네트워크)에 대한 CIDR은 DR 사이트 VNet의 CIDR과 충돌하거나 겹치지 않아야 합니다", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", - "link": "https://learn.microsoft.com/azure/firewall/ip-groups", - "service": "Firewall", - "severity": "보통", - "text": "IP 그룹 또는 IP 접두사를 사용하여 IP 테이블 규칙 수 줄이기", - "waf": "공연" + "checklist": "SAP Checklist", + "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", + "service": "SAP", + "severity": "높다", + "text": "Site Recovery를 사용하여 응용 프로그램 서버를 DR 사이트에 복제합니다. Site Recovery는 중앙 서비스 클러스터 VM을 DR 사이트에 복제하는 데도 도움이 될 수 있습니다. DR을 호출할 때 DR 사이트에서 Linux Pacemaker 클러스터를 다시 구성해야 합니다(예: VIP 또는 SBD 바꾸기, corosync.conf 실행 등).", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", - "service": "Firewall", - "severity": "보통", - "text": "와일드카드를 DNAT의 소스 IP로 사용하지 않으려면 * 또는 any와 같이 수신 DNAT에 대한 소스 IP를 지정해야 합니다", - "waf": "공연" + "checklist": "SAP Checklist", + "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", + "severity": "높다", + "text": "단일 장애 지점에 대한 SAP 소프트웨어의 가용성을 고려합니다. 여기에는 SAP NetWeaver 및 SAP S/4HANA 아키텍처, SAP ABAP 및 ASCS + SCS에서 사용되는 DBMS와 같은 애플리케이션 내의 단일 실패 지점이 포함됩니다. 또한 SAP Web Dispatcher와 같은 다른 도구도 있습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", - "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", - "service": "Firewall", - "severity": "보통", - "text": "SNAT 포트 사용량을 모니터링하고, NAT 게이트웨이 설정을 평가하고, 원활한 장애 조치(failover)를 보장하여 SNAT 포트 소모를 방지합니다. 포트 수가 제한에 가까워지면 SNAT 소모가 임박했다는 신호입니다.", - "waf": "공연" + "checklist": "SAP Checklist", + "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", + "service": "SAP", + "severity": "높다", + "text": "SAP 및 SAP 데이터베이스의 경우 자동 장애 조치(failover) 클러스터를 구현하는 것이 좋습니다. Windows에서 Windows Server 장애 조치(failover) 클러스터링은 장애 조치(failover)를 지원합니다. Linux에서 Linux Pacemaker 또는 SIOS Protection Suite 및 Veritas InfoScale과 같은 타사 툴은 장애 조치를 지원합니다.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "346840b8-1064-496e-8396-4b1340172d52", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", - "service": "Firewall", + "checklist": "SAP Checklist", + "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", "severity": "높다", - "text": "TLS 검사 활성화", - "waf": "공연" + "text": "Azure는 기본 및 보조 VM이 DBMS 데이터에 대한 스토리지를 공유하는 아키텍처를 지원하지 않습니다. DBMS 계층의 경우 일반적인 아키텍처 패턴은 기본 및 보조 VM에서 사용하는 것과 다른 스토리지 스택을 사용하여 동시에 데이터베이스를 복제하는 것입니다.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", - "service": "Firewall", - "severity": "낮다", - "text": "웹 범주를 사용하여 특정 주제에 대한 아웃바운드 액세스를 허용하거나 거부할 수 있습니다.", - "waf": "공연" + "checklist": "SAP Checklist", + "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", + "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", + "service": "SAP", + "severity": "높다", + "text": "DBMS 데이터 및 트랜잭션/다시 실행 로그 파일은 Azure 지원 블록 스토리지 또는 Azure NetApp Files에 저장됩니다. Azure Files 또는 Azure Premium Files는 DBMS 데이터 및/또는 SAP 워크로드가 있는 다시 실행 로그 파일에 대한 스토리지로 지원되지 않습니다.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", - "service": "Firewall", - "severity": "보통", - "text": "TLS 검사의 일환으로 검사를 위해 Azure App Gateway에서 트래픽을 수신하도록 계획합니다.", - "waf": "공연" + "checklist": "SAP Checklist", + "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", + "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", + "service": "SAP", + "severity": "높다", + "text": "ASCS + SCS 구성 요소 및 특정 고가용성 시나리오에 대해 Windows에서 Azure 공유 디스크를 사용할 수 있습니다. SAP 애플리케이션 계층 구성 요소 및 DBMS 계층에 대해 장애 조치(failover) 클러스터를 별도로 설정합니다. Azure는 현재 SAP 애플리케이션 계층 구성 요소와 DBMS 계층을 하나의 장애 조치(failover) 클러스터로 결합하는 고가용성 아키텍처를 지원하지 않습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", - "link": "https://learn.microsoft.com/azure/firewall/dns-details", - "service": "Firewall", - "severity": "보통", - "text": "Azure Firewall DNS 프록시 구성 사용 ", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", + "service": "SAP", + "severity": "높다", + "text": "SAP ASCS(애플리케이션 계층 구성 요소) 및 DBMS 계층에 대한 대부분의 장애 조치(failover) 클러스터에는 장애 조치(failover) 클러스터에 대한 가상 IP 주소가 필요합니다. Azure Load Balancer는 다른 모든 경우에 대한 가상 IP 주소를 처리해야 합니다. 한 가지 설계 원칙은 클러스터 구성당 하나의 부하 분산 장치를 사용하는 것입니다. 부하 분산 장치의 표준 버전(표준 Load Balancer SKU)을 사용하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", - "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", - "service": "Firewall", - "severity": "보통", - "text": "Virtual Machines에 직접 연결된 공용 IP 주소를 거부하는 정책 할당이 있는지 확인합니다.", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", + "service": "SAP", + "severity": "높다", + "text": "로드 밸런서에서 유동 IP가 사용하도록 설정되어 있는지 확인합니다.", + "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", - "service": "Firewall", - "severity": "낮다", - "text": "Azure Firewall을 Azure Monitor와 통합하고 진단 로깅을 사용하도록 설정하여 방화벽 로그를 저장하고 분석합니다.", - "waf": "작업" + "checklist": "SAP Checklist", + "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "SAP", + "severity": "높다", + "text": "고가용성 인프라를 배포하기 전에 선택한 지역에 따라 Azure 가용성 집합 또는 가용성 영역을 사용하여 배포할지 여부를 결정합니다.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", - "severity": "낮다", - "text": "방화벽 규칙에 대한 백업 구현", - "waf": "작업" + "checklist": "SAP Checklist", + "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", + "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", + "service": "SAP", + "severity": "높다", + "text": "SAP 구성 요소(중앙 서비스, 애플리케이션 서버 및 데이터베이스)용 애플리케이션에 대한 인프라 SLA를 충족하려면 모든 구성 요소에 대해 동일한 고가용성 옵션(VM, 가용성 집합, 가용성 영역)을 선택해야 합니다.", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "App Gateway", + "checklist": "SAP Checklist", + "guid": "cbe05bbe-209d-4490-ba47-778424d11678", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", "severity": "높다", - "text": "가상 네트워크에 삽입된 Azure PaaS 서비스에 대한 컨트롤 플레인 통신이 중단되지 않았는지 확인합니다(예: 0.0.0.0/0 경로 또는 컨트롤 플레인 트래픽을 차단하는 NSG 규칙).", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "안전" + "text": "동일한 가용성 집합에 서로 다른 역할의 서버를 혼합하지 마십시오. 중앙 서비스 VM, 데이터베이스 VM, 애플리케이션 VM을 자체 가용성 집합으로 유지", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "신뢰도" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "ExpressRoute", + "checklist": "SAP Checklist", + "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", + "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", + "service": "SAP", "severity": "보통", - "text": "프라이빗 엔드포인트 및 ExpressRoute 프라이빗 피어링을 통해 온-프레미스에서 Azure PaaS 서비스에 액세스합니다. 이 방법을 사용하면 공용 인터넷을 통한 전송을 방지할 수 있습니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "안전" + "text": "근접 배치 그룹을 사용하지 않는 한 Azure 가용성 영역 내에 Azure 가용성 집합을 배포할 수 없습니다.", + "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", - "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "VNet", - "severity": "보통", - "text": "모든 서브넷에서 기본적으로 가상 네트워크 서비스 엔드포인트를 사용하도록 설정하지 마세요.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "9674e7c7-7796-4181-8920-09f4429543ba", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", + "severity": "높다", + "text": "가용성 집합을 만들 때 사용 가능한 최대 장애 도메인 및 업데이트 도메인 수를 사용합니다. 예를 들어 하나의 가용성 집합에 두 개 이상의 VM을 배포하는 경우 Azure의 계획된 유지 관리 외에도 잠재적인 물리적 하드웨어 오류, 네트워크 중단 또는 전원 중단의 영향을 제한하기 위해 최대 장애 도메인 수(3개)와 충분한 업데이트 도메인을 사용합니다. 장애 도메인의 기본 수는 2개이며 나중에 온라인으로 변경할 수 없습니다.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", - "severity": "보통", - "text": "데이터 반출을 방지하기 위해 Azure Firewall 또는 NVA의 IP 주소 대신 FQDN을 사용하여 Azure PaaS 서비스에 대한 송신 트래픽을 필터링합니다. Private Link를 사용하는 경우 모든 FQDN을 차단할 수 있으며, 그렇지 않으면 필요한 PaaS 서비스만 허용할 수 있습니다.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", + "severity": "높다", + "text": "가용성 집합 배포에서 Azure 근접 배치 그룹을 사용하는 경우 세 가지 SAP 구성 요소(중앙 서비스, 애플리케이션 서버 및 데이터베이스)가 모두 동일한 근접 배치 그룹에 있어야 합니다.", + "waf": "신뢰도" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", - "service": "ExpressRoute", + "checklist": "SAP Checklist", + "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "severity": "높다", - "text": "게이트웨이 서브넷에 /27 이상의 접두사를 사용합니다", - "waf": "안전" + "text": "SAP SID당 하나의 근접 배치 그룹을 사용합니다. 그룹은 가용성 영역 또는 Azure 지역에 걸쳐 있지 않습니다.", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", - "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", - "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", - "service": "NSG", - "severity": "보통", - "text": "VirtualNetwork 서비스 태그를 사용하여 연결을 제한하는 NSG 인바운드 기본 규칙을 사용하지 마세요.", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", + "severity": "높다", + "text": "운영 체제에 따라 다음 서비스 중 하나를 사용하여 SAP 중앙 서비스 클러스터를 실행합니다.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", - "service": "NSG", + "checklist": "SAP Checklist", + "guid": "ed46b937-913e-4018-9c62-8393ab037e53", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", + "service": "SAP", "severity": "보통", - "text": "NSG를 사용하여 서브넷 간의 트래픽과 플랫폼 전체의 East/West 트래픽(랜딩 존 간 트래픽)을 보호할 수 있습니다.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "안전" + "text": "Azure는 현재 동일한 Linux Pacemaker 클러스터에서 ASCS와 DB HA의 결합을 지원하지 않습니다. 개별 클러스터로 분리합니다. 그러나 최대 5개의 여러 중앙 서비스 클러스터를 한 쌍의 VM으로 결합할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", - "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", - "service": "NSG", + "checklist": "SAP Checklist", + "guid": "f656e745-0cfb-453e-8008-0528fa21c933", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "severity": "보통", - "text": "애플리케이션 팀은 서브넷 수준 NSG에서 애플리케이션 보안 그룹을 사용하여 랜딩 존 내의 다중 계층 VM을 보호해야 합니다.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "안전" + "text": "가용성 집합 또는 가용성 영역의 고가용성 쌍에 두 VM을 모두 배포합니다. 이러한 VM은 크기가 동일하고 스토리지 구성이 동일해야 합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", + "checklist": "SAP Checklist", + "guid": "7f684ebc-95da-425e-b329-e782dbed050f", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", + "service": "SAP", "severity": "보통", - "text": "NSG 및 애플리케이션 보안 그룹을 사용하여 랜딩 존 내에서 트래픽을 마이크로 세그먼트화하고 중앙 NVA를 사용하여 트래픽 흐름을 필터링하지 않도록 합니다.", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "안전" + "text": "Azure는 RHEL(Red Hat Enterprise Linux)에서 실행되는 동일한 고가용성 클러스터에 SAP HANA, ASCS/SCS 및 ERS 인스턴스의 설치 및 구성을 지원합니다.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "dfe237de-143b-416c-91d7-aa9b64704489", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", - "severity": "보통", - "text": "VNet 흐름 로그를 사용하도록 설정하고 트래픽 분석에 제공하여 내부 및 외부 트래픽 흐름에 대한 인사이트를 얻습니다.", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", + "severity": "높다", + "text": "프리미엄 관리형 SSD에서 모든 프로덕션 시스템을 실행하고 Azure NetApp Files 또는 Ultra Disk Storage를 사용합니다. 적어도 OS 디스크는 프리미엄 계층에 있어야 더 나은 성능과 최상의 SLA를 달성할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", - "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "NSG", - "severity": "보통", - "text": "NSG당 NSG 규칙의 제한(1000)을 고려합니다.", - "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "checklist": "SAP Checklist", + "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", + "service": "SAP", + "severity": "높다", + "text": "Azure의 SAP HANA는 SAP에서 인증한 스토리지 유형에서만 실행해야 합니다. 특정 볼륨은 해당되는 경우 특정 디스크 구성에서 실행되어야 합니다. 이러한 구성에는 Write Accelerator 사용 및 Premium Storage 사용이 포함됩니다. 또한 스토리지에서 실행되는 파일 시스템이 시스템에서 실행되는 DBMS와 호환되는지 확인해야 합니다.", + "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", "waf": "신뢰도" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", - "service": "VWAN", - "severity": "보통", - "text": "간소화된 Azure 네트워킹 관리를 위해 Virtual WAN을 고려하고 시나리오가 Virtual WAN 라우팅 디자인 목록에 명시적으로 설명되어 있는지 확인합니다", - "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", - "waf": "작업" + "checklist": "SAP Checklist", + "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", + "service": "SAP", + "severity": "높다", + "text": "SAP 워크로드에 사용하는 스토리지 유형에 따라 고가용성을 구성하는 것이 좋습니다. Azure에서 사용할 수 있는 일부 스토리지 서비스는 Azure Site Recovery에서 지원되지 않으므로 고가용성 구성이 다를 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", + "waf": "신뢰도" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "checklist": "SAP Checklist", + "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", + "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", + "service": "SAP", + "severity": "높다", + "text": "일부 지역에서는 다양한 네이티브 Azure Storage 서비스(예: Azure Files, Azure NetApp Files, Azure Shared Disk)를 사용하지 못할 수 있습니다. 따라서 장애 조치(failover) 후 DR 지역에서 유사한 SAP를 설정하려면 해당 스토리지 서비스가 DR 사이트에서 제공되는지 확인합니다.", + "waf": "신뢰도" + }, + { + "checklist": "SAP Checklist", + "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", + "service": "SAP", "severity": "보통", - "text": "Azure 지역당 Virtual WAN 허브를 사용하여 공통 글로벌 Azure Virtual WAN을 통해 Azure 지역 간에 여러 랜딩 존을 함께 연결합니다.", - "waf": "공연" + "text": "SAP System Start-Stop을 자동화하여 비용을 관리합니다.", + "waf": "비용" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "checklist": "SAP Checklist", + "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", "severity": "낮다", - "text": "Azure의 리소스 간 통신이 Microsoft 백본 네트워크를 통해 발생하도록 'Azure의 트래픽은 Azure에 유지' 원칙에 따라", - "waf": "공연" + "text": "SAP HANA와 함께 Azure Premium Storage를 사용하는 경우 Azure 표준 SSD 스토리지를 사용하여 비용에 민감한 스토리지 솔루션을 선택할 수 있습니다. 그러나 표준 SSD 또는 표준 HDD Azure Storage를 선택하면 개별 VM의 SLA에 영향을 줍니다. 또한 비프로덕션 환경과 같이 I/O 처리량이 낮고 대기 시간이 짧은 시스템의 경우 더 낮은 시리즈 VM을 사용할 수 있습니다.", + "waf": "비용" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", - "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "severity": "보통", - "text": "아웃바운드 인터넷 트래픽 보호 및 필터링을 위해 보안 허브에 Azure Firewall을 배포합니다", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "9877f353-2591-4e8b-8381-e9043fed1010", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", + "severity": "낮다", + "text": "저렴한 대체 구성(다목적)으로 비프로덕션 HANA 데이터베이스 서버 VM에 대해 저성능 SKU를 선택할 수 있습니다. 그러나 E 시리즈와 같은 일부 VM 유형은 HANA 인증(SAP HANA 하드웨어 디렉터리)되지 않았거나 1ms 미만의 스토리지 대기 시간을 달성할 수 없습니다.", + "waf": "비용" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "VWAN", - "severity": "보통", - "text": "네트워크 아키텍처가 Azure Virtual WAN 제한 내에 있는지 확인합니다.", - "waf": "신뢰도" + "checklist": "SAP Checklist", + "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", + "service": "SAP", + "severity": "높다", + "text": "관리 그룹, 구독, 리소스 그룹 및 리소스에 대한 RBAC 모델 적용Enforce a RBAC model for management groups, subscriptions, resource groups and resources", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", + "waf": "안전" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", - "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", - "service": "VWAN", + "checklist": "SAP Checklist", + "guid": "45911475-e39e-4530-accc-d979366bcda2", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "severity": "보통", - "text": "Virtual WAN용 Azure Monitor Insights를 사용하여 Virtual WAN의 엔드투엔드 토폴로지, 상태 및 주요 메트릭을 모니터링합니다.", - "waf": "작업" + "text": "클라우드 커넥터를 통해 SAP 클라우드 애플리케이션에서 SAP 온-프레미스(IaaS 포함)로 ID를 전달하기 위한 보안 주체 전파 적용", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", + "waf": "안전" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", - "service": "VWAN", + "checklist": "SAP Checklist", + "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "severity": "보통", - "text": "이러한 흐름을 명시적으로 차단해야 하는 경우가 아니면 IaC 배포가 Virtual WAN에서 분기 간 트래픽을 사용하지 않도록 설정하지 않는지 확인합니다.", - "waf": "신뢰도" + "text": "SAML을 사용하여 Azure AD로 SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics 및 SAP C4C와 같은 SAP SaaS 애플리케이션에 대한 SSO를 구현합니다.", + "waf": "안전" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", - "service": "VWAN", + "checklist": "SAP Checklist", + "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", "severity": "보통", - "text": "AS-Path는 ExpressRoute 또는 VPN보다 유연하므로 허브 라우팅 기본 설정으로 사용합니다.", - "waf": "신뢰도" + "text": "SAML을 사용하여 SAP Fiori 및 SAP Web GUI와 같은 SAP NetWeaver 기반 웹 애플리케이션에 대한 SSO를 구현합니다.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "waf": "안전" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", - "service": "VWAN", + "checklist": "SAP Checklist", + "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", + "service": "SAP", "severity": "보통", - "text": "IaC 배포가 Virtual WAN에서 레이블 기반 전파를 구성하는지 확인하며, 그렇지 않으면 가상 허브 간의 연결이 손상됩니다.", - "waf": "신뢰도" + "text": "SAML을 사용하여 SAP Fiori 및 SAP Web GUI와 같은 SAP NetWeaver 기반 웹 애플리케이션에 대한 SSO를 구현합니다.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", + "waf": "안전" }, { - "ammp": true, - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "9c75dfef-573c-461c-a698-68598595581a", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", - "service": "VWAN", - "severity": "높다", - "text": "가상 허브에 충분한 IP 공간(이상적으로는 /23 접두사)을 할당합니다.", - "waf": "신뢰도" + "checklist": "SAP Checklist", + "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", + "severity": "보통", + "text": "SAP NetWeaver SSO 또는 파트너 솔루션을 사용하여 SAP GUI에 대한 SSO를 구현할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", - "severity": "높다", - "text": "Azure Policy를 전략적으로 활용하고, 정책 이니셔티브를 사용하여 관련 정책을 그룹화하고, 환경에 대한 컨트롤을 정의합니다.", + "checklist": "SAP Checklist", + "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", + "service": "SAP", + "severity": "보통", + "text": "SAP GUI 및 웹 브라우저 액세스를 위한 SSO의 경우 구성 및 유지 관리가 용이하여 SNC/Kerberos/SPNEGO(간단하고 보호된 GSSAPI 협상 메커니즘)를 구현합니다. X.509 클라이언트 인증서를 사용하는 SSO의 경우 SAP SSO 솔루션의 구성 요소인 SAP 보안 로그인 서버를 고려합니다.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "SAP Checklist", + "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", + "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", + "service": "SAP", "severity": "보통", - "text": "규정 및 규정 준수 요구 사항을 Azure Policy 정의 및 Azure 역할 할당에 매핑합니다.", + "text": "SAP GUI 및 웹 브라우저 액세스를 위한 SSO의 경우 구성 및 유지 관리가 용이하여 SNC/Kerberos/SPNEGO(간단하고 보호된 GSSAPI 협상 메커니즘)를 구현합니다. X.509 클라이언트 인증서를 사용하는 SSO의 경우 SAP SSO 솔루션의 구성 요소인 SAP 보안 로그인 서버를 고려합니다.", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "223ace8c-b123-408c-a501-7f154e3ab369", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "SAP Checklist", + "guid": "16785d6f-a96c-496a-b885-18f482734c88", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", + "service": "SAP", "severity": "보통", - "text": "상속된 범위에서 할당할 수 있도록 중간 루트 관리 그룹에서 Azure Policy 정의를 설정합니다.", + "text": "SAP NetWeaver용 OAuth를 사용하여 SSO를 구현하여 타사 또는 사용자 지정 애플리케이션이 SAP NetWeaver OData 서비스에 액세스할 수 있도록 합니다.", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3829e7e3-1618-4368-9a04-77a209945bda", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "SAP Checklist", + "guid": "a747c350-8d4c-449c-93af-393dbca77c48", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", + "service": "SAP", "severity": "보통", - "text": "필요한 경우 최하위 수준에서 제외를 사용하여 가장 적절한 수준에서 정책 할당을 관리합니다.", + "text": "SAP HANA에 대한 SSO 구현", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "43334f24-9116-4341-a2ba-527526944008", - "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", - "service": "Policy", - "severity": "낮다", - "text": "Azure Policy를 사용하여 사용자가 구독/관리 그룹 수준에서 프로비전할 수 있는 서비스 제어", + "checklist": "SAP Checklist", + "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", + "service": "SAP", + "severity": "보통", + "text": "Azure AD를 RISE에서 호스트되는 SAP 시스템의 ID 공급자로 간주합니다. 자세한 내용은 Azure AD와 서비스 통합을 참조하세요.", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "SAP Checklist", + "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", + "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", + "service": "SAP", "severity": "보통", - "text": "가능한 경우 기본 제공 정책을 사용하여 운영 오버헤드를 최소화합니다.", + "text": "SAP에 액세스하는 애플리케이션의 경우 보안 주체 전파를 사용하여 SSO를 설정할 수 있습니다.", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "description": "특정 범위에 Resource Policy Contributor 역할을 할당하면 관련 팀에 정책 관리를 위임할 수 있습니다. 예를 들어 중앙 IT 팀은 관리 그룹 수준 정책을 감독하고 응용 프로그램 팀은 구독에 대한 정책을 처리하여 조직 표준을 준수하는 분산 거버넌스를 가능하게 할 수 있습니다.", - "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", - "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", - "service": "Policy", - "severity": "보통", - "text": "특정 범위에서 기본 제공 Resource Policy 기여자 역할을 할당하여 응용 프로그램 수준 거버넌스를 사용하도록 설정합니다.", - "waf": "안전" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "19048384-5c98-46cb-8913-156a12476e49", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "SAP Checklist", + "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", + "service": "SAP", "severity": "보통", - "text": "상속된 범위에서 제외를 통해 관리하지 않도록 루트 관리 그룹 범위에서 수행된 Azure Policy 할당 수를 제한합니다.", + "text": "SAP IAS(Identity Authentication Service)가 필요한 SAP BTP 서비스 또는 SaaS 솔루션을 사용하는 경우 SAP Cloud Identity Authentication Services와 Azure AD 간에 SSO를 구현하여 해당 SAP 서비스에 액세스하는 것이 좋습니다. 이 통합을 통해 SAP IAS는 프록시 ID 공급자 역할을 하고 중앙 사용자 저장소 및 ID 공급자인 Azure AD에 인증 요청을 전달할 수 있습니다.", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", - "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", - "service": "Policy", + "checklist": "SAP Checklist", + "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", + "service": "SAP", "severity": "보통", - "text": "데이터 주권 요구 사항이 있는 경우 Azure Policy를 배포하여 적용할 수 있습니다", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "text": "SAP BTP에 대한 SSO 구현", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", - "service": "Policy", + "checklist": "SAP Checklist", + "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", + "service": "SAP", "severity": "보통", - "text": "Sovereign Landing Zone의 경우 주권 정책 기준의 정책 이니셔티브가 배포되고 올바른 MG 수준에서 할당됩니다.", + "text": "SAP SuccessFactors를 사용하는 경우 Azure AD 자동화된 사용자 프로비저닝을 사용하는 것이 좋습니다. 이 통합을 통해 SAP SuccessFactors에 새 직원을 추가할 때 Azure AD에서 해당 사용자 계정을 자동으로 만들 수 있습니다. 필요에 따라 Microsoft 365 또는 Azure AD 지원하는 기타 SaaS 애플리케이션에서 사용자 계정을 만들 수 있습니다. SAP SuccessFactors에 이메일 주소의 쓰기 저장을 사용합니다.", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", - "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", - "service": "Policy", + "checklist": "SAP Checklist", + "guid": "6ba28021-4591-4147-9e39-e5309cccd979", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", + "service": "SAP", "severity": "보통", - "text": "Sovereign Landing Zone의 경우 정책 매핑에 대한 주권 제어 목표가 문서화되어 있습니다.", - "waf": "안전" + "text": "SAP 구독에 기존 관리 그룹 정책 적용", + "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", - "service": "Policy", - "severity": "보통", - "text": "Sovereign Landing Zone의 경우 '정책 매핑에 대한 Sovereign Control 목표'의 CRUD에 대한 프로세스가 마련되어 있습니다.", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", + "severity": "높다", + "text": "긴밀하게 결합된 애플리케이션을 동일한 SAP 구독에 통합하여 추가적인 라우팅 및 관리 복잡성 방지", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", - "severity": "보통", - "text": "Azure RBAC(Azure 역할 기반 액세스 제어), 데이터 주권 요구 사항 또는 데이터 보존 정책에 별도의 작업 영역이 필요한 경우를 제외하고 단일 모니터 로그 작업 영역을 사용하여 플랫폼을 중앙에서 관리합니다.", - "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "checklist": "SAP Checklist", + "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", + "severity": "높다", + "text": "구독을 배율 단위로 활용하고 리소스를 확장하려면 환경별로 구독을 배포하는 것이 좋습니다. 샌드박스, 비프로덕션, 프로덕션 ", + "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Monitor", - "severity": "보통", - "text": "로그 보존 요구 사항이 12년을 초과하는 경우 로그를 Azure Storage로 내보냅니다. 변경 불가능한 스토리지를 한 번 쓰기, 여러 번 읽기 정책과 함께 사용하여 사용자가 지정한 간격 동안 데이터를 지우거나 수정할 수 없도록 합니다.", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "checklist": "SAP Checklist", + "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", + "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", + "service": "SAP", + "severity": "높다", + "text": "구독 프로비저닝의 일부로 할당량 증가 확인(예: 구독 내에서 사용 가능한 총 VM 코어)", + "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", - "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", - "service": "VM", - "severity": "보통", - "text": "Azure Policy를 사용하여 OS 수준 VM(가상 머신) 구성 드리프트를 모니터링합니다. 정책을 통해 Azure Automanage Machine Configuration 감사 기능을 사용하도록 설정하면 애플리케이션 팀 워크로드가 적은 노력으로 기능 기능을 즉시 사용할 수 있습니다.", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "checklist": "SAP Checklist", + "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", + "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", + "service": "SAP", + "severity": "낮다", + "text": "할당량 API는 Azure 서비스에 대한 할당량을 보고 관리하는 데 사용할 수 있는 REST API입니다. 필요한 경우 사용을 고려하십시오.", "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", - "severity": "보통", - "text": "Azure에서 Windows 및 Linux VM에 대한 패치 메커니즘으로 Azure Update Manager를 사용합니다.", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "checklist": "SAP Checklist", + "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", + "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", + "service": "SAP", + "severity": "높다", + "text": "가용성 영역에 배포하는 경우 할당량이 승인되면 VM의 영역 배포를 사용할 수 있는지 확인합니다. 필요한 구독, VM 시리즈, CPU 수 및 가용성 영역을 사용하여 지원 요청을 제출합니다.", "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", - "severity": "보통", - "text": "Azure Arc를 사용하여 Azure 외부의 Windows 및 Linux VM에 대한 패치 메커니즘으로 Azure Update Manager를 사용합니다.", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "checklist": "SAP Checklist", + "guid": "e6e20617-3686-4af4-9791-f8935ada4332", + "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", + "service": "SAP", + "severity": "높다", + "text": "예를 들어 선택한 배포 지역 내에서 필요한 서비스 및 기능을 사용할 수 있는지 확인합니다. ANF, 지역 등.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "90483845-c986-4cb2-a131-56a12476e49f", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Network Watcher", + "checklist": "SAP Checklist", + "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", + "service": "SAP", "severity": "보통", - "text": "Network Watcher를 사용하여 트래픽 흐름을 사전에 모니터링", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "text": "비용 분류 및 리소스 그룹화를 위해 Azure 리소스 태그 활용(BillTo, 부서(또는 사업부), 환경(프로덕션, 스테이지, 개발), 계층(웹 계층, 애플리케이션 계층), 애플리케이션 소유자, 프로젝트 이름)", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Monitor", - "severity": "보통", - "text": "인사이트 및 보고를 위해 Azure Monitor 로그를 사용합니다.", - "waf": "작업" + "checklist": "SAP Checklist", + "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", + "severity": "높다", + "text": "Azure Backup 서비스를 사용하여 HANA 데이터베이스를 보호할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "97be9951-9048-4384-9c98-6cb2913156a1", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", - "service": "Monitor", + "checklist": "SAP Checklist", + "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", + "service": "SAP", "severity": "보통", - "text": "Azure Monitor 경고를 사용하여 운영 경고를 생성합니다.", - "waf": "작업" + "text": "HANA, Oracle 또는 DB2 데이터베이스용 Azure NetApp Files를 배포하는 경우 Azure 애플리케이션 일치 스냅샷 도구(AzAcSnap)를 사용하여 애플리케이션 일치 스냅샷을 만듭니다. AzAcSnap은 Oracle 데이터베이스도 지원합니다. 개별 VM이 아닌 중앙 VM에서 AzAcSnap을 사용하는 것이 좋습니다.", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "Monitor", - "severity": "보통", - "text": "Azure Automation 계정을 통해 변경 및 인벤토리 추적을 사용하는 경우 Log Analytics 작업 영역과 자동화 계정을 함께 연결하기 위해 지원되는 지역을 선택했는지 확인합니다.", + "checklist": "SAP Checklist", + "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", + "severity": "높다", + "text": "운영 체제와 SAP 시스템 간의 표준 시간대 일치를 확인합니다.", "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Backup", + "checklist": "SAP Checklist", + "guid": "c3c7abc0-716c-4486-893c-40e181d65539", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", + "service": "SAP", "severity": "보통", - "text": "Azure Backup을 사용하는 경우 기본 설정은 GRS이므로 다양한 백업 유형(GRS, ZRS & LRS)을 고려합니다", + "text": "동일한 클러스터에서 서로 다른 애플리케이션 서비스를 그룹화하지 마세요. 예를 들어 DRBD와 중앙 서비스 클러스터를 동일한 클러스터에 결합하지 마세요. 그러나 동일한 Pacemaker 클러스터를 사용하여 약 5개의 서로 다른 중앙 서비스(다중 SID 클러스터)를 관리할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "VM", - "severity": "보통", - "text": "Azure 정책을 사용하여 VM 확장을 통해 소프트웨어 구성을 자동으로 배포하고 규격 기준 VM 구성을 적용합니다.", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "a491dfc4-9353-4213-9217-eef0949f9467", + "link": "https://azure.microsoft.com/pricing/offers/dev-test/", + "service": "SAP", + "severity": "낮다", + "text": "Azure 실행 비용을 절감하고 최적화하기 위해 다시 알림 모델에서 개발/테스트 시스템을 실행하는 것이 좋습니다.", + "waf": "비용" }, { - "checklist": "Azure Landing Zone Review", - "description": "Azure Policy의 게스트 구성 기능은 컴퓨터 설정(예: OS, 애플리케이션, 환경)을 감사하고 수정하여 리소스가 예상 구성에 맞는지 확인할 수 있으며, 업데이트 관리는 VM에 대한 패치 관리를 적용할 수 있습니다.", - "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", + "link": "https://learn.microsoft.com/azure/lighthouse/overview", + "service": "SAP", "severity": "보통", - "text": "Azure Policy를 통해 VM 보안 구성 드리프트를 모니터링합니다.", - "waf": "안전" + "text": "SAP 자산을 관리하여 고객과 파트너 관계를 맺는 경우 Azure Lighthouse를 사용하는 것이 좋습니다. Azure Lighthouse를 사용하면 관리 서비스 공급자가 Azure 네이티브 ID 서비스를 사용하여 고객 환경에 인증할 수 있습니다. 고객은 언제든지 액세스 권한을 취소하고 서비스 제공업체의 조치를 감사할 수 있으므로 고객의 손에 제어 권한을 부여합니다.", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "4d116785-d2fa-456c-96ad-48408fe72734", + "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", + "service": "SAP", "severity": "보통", - "text": "Azure-Azure Virtual Machines 재해 복구 시나리오에 Azure Site Recovery를 사용합니다. 이렇게 하면 지역 간에 워크로드를 복제할 수 있습니다.", + "text": "Azure Update Manager를 사용하여 단일 VM 또는 여러 VM에 대해 사용 가능한 업데이트의 상태를 확인하고 정기적인 패치를 예약하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "Backup", - "severity": "보통", - "text": "Azure 네이티브 백업 기능 또는 Azure 호환 제3자 백업 솔루션을 사용합니다.", + "checklist": "SAP Checklist", + "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", + "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", + "service": "SAP", + "severity": "낮다", + "text": "SAP Landscape Management(LaMa)를 사용하여 SAP Basis 운영을 최적화하고 관리합니다. Azure용 SAP LaMa 커넥터를 사용하여 SAP 시스템을 재배치, 복사, 복제 및 새로 고칩니다.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", - "severity": "높다", - "text": "VM이 지원되는 지역에서 VM에 대한 가용성 영역을 활용합니다.", - "waf": "신뢰도" + "checklist": "SAP Checklist", + "guid": "14591147-5e39-4e53-89cc-cd979366bcda", + "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", + "service": "SAP", + "severity": "보통", + "text": "SAP용 Azure Monitor 솔루션을 사용하여 Azure에서 SAP 워크로드(SAP HANA, 고가용성 SUSE 클러스터 및 SQL 시스템)를 모니터링합니다. SAP Solution Manager를 사용하여 SAP용 Azure Monitor 솔루션을 보완하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", + "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", + "service": "SAP", "severity": "높다", - "text": "단일 VM에서 프로덕션 워크로드를 실행하지 마세요.", - "waf": "신뢰도" + "text": "SAP용 VM 확장 검사를 실행합니다. SAP용 VM 확장은 VM(가상 머신)의 할당된 관리 ID를 사용하여 VM 모니터링 및 구성 데이터에 액세스합니다. 이 검사는 SAP 애플리케이션의 모든 성능 메트릭이 기본 SAP용 Azure 확장에서 제공되는지 확인합니다.", + "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "84101f59-1941-4195-a270-e28034290e3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "SAP", "severity": "보통", - "text": "Azure Load Balancer 및 Application Gateway는 들어오는 네트워크 트래픽을 여러 리소스에 분산합니다.", - "waf": "신뢰도" + "text": "액세스 제어 및 규정 준수 보고에 Azure Policy를 사용합니다. Azure Policy는 일관된 정책 준수와 빠른 위반 감지를 보장하기 위해 조직 전체 설정을 적용하는 기능을 제공합니다. ", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "WAF", - "severity": "높다", - "text": "Azure Front Door 및 Azure Application Gateway와 같은 애플리케이션 배달 서비스에서 WAF 로그를 저장하는 진단 설정을 추가합니다. 로그를 정기적으로 검토하여 공격 및 가양성 탐지를 확인합니다.", + "checklist": "SAP Checklist", + "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", + "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", + "service": "SAP", + "severity": "보통", + "text": "Azure Network Watcher의 연결 모니터를 사용하여 SAP 데이터베이스 및 애플리케이션 서버에 대한 대기 시간 메트릭을 모니터링합니다. 또는 Azure Monitor를 사용하여 네트워크 대기 시간 측정값을 수집하고 표시합니다.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7f408960-c626-44cb-a018-347c8d790cdf", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "WAF", + "checklist": "SAP Checklist", + "guid": "73686af4-6791-4f89-95ad-a43324e13811", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", + "service": "SAP", "severity": "보통", - "text": "Azure Front Door 및 Azure Application Gateway와 같은 애플리케이션 배달 서비스에서 Microsoft Sentinel로 WAF 로그를 보냅니다. 공격을 감지하고 WAF 원격 분석을 전체 Azure 환경에 통합합니다.", + "text": "프로비저닝된 Azure 인프라에서 SAP HANA에 대한 품질 검사를 수행하여 프로비저닝된 VM이 Azure의 SAP HANA 모범 사례를 준수하는지 확인합니다.", "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "5017f154-e3ab-4369-9829-e7e316183687", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "616785d6-fa96-4c96-ad88-518f482734c8", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", "severity": "높다", - "text": "Azure Key Vault를 사용하여 비밀 및 자격 증명 저장", - "waf": "안전" + "text": "각 Azure 구독에 대해 영역 배포 전에 Azure 가용성 영역에서 대기 시간 테스트를 실행하여 Azure에서 SAP를 배포하기 위한 대기 시간이 짧은 영역을 선택합니다.", + "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "waf": "공연" }, { - "checklist": "Azure Landing Zone Review", - "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", - "guid": "a0477a20-9945-4bda-9333-4f2491163418", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", + "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", + "service": "SAP", "severity": "보통", - "text": "다양한 애플리케이션 및 지역에 대해 서로 다른 Azure Key Vault를 사용하여 트랜잭션 규모 제한을 방지하고 비밀에 대한 액세스를 제한합니다.", - "waf": "안전" + "text": "복원력 보고서를 실행하여 프로비저닝된 전체 Azure 인프라(컴퓨팅, 데이터베이스, 네트워킹, 스토리지, Site Recovery)의 구성이 Azure용 클라우드 적응 프레임워크에서 정의한 구성을 준수하는지 확인합니다.", + "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", + "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", + "service": "SAP", "severity": "보통", - "text": "삭제된 개체에 대한 보존 보호를 허용하기 위해 일시 삭제 및 제거 정책을 사용하도록 설정된 Azure Key Vault를 프로비전합니다.", + "text": "SAP용 Microsoft Sentinel 솔루션을 사용하여 위협 방지를 구현합니다. 이 솔루션을 사용하여 SAP 시스템을 모니터링하고 비즈니스 로직 및 애플리케이션 계층 전체에서 정교한 위협을 탐지할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "dc055bcf-619e-48a1-9f98-879525d62688", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", + "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "service": "SAP", "severity": "보통", - "text": "키, 비밀 및 인증서를 영구적으로 삭제할 수 있는 권한 부여를 특수 사용자 지정 Microsoft Entra ID 역할로 제한하여 최소 권한 모델을 따릅니다.", - "waf": "안전" + "text": "Azure 태그 지정을 활용하여 리소스를 논리적으로 그룹화 및 추적하고, 배포를 자동화하고, 가장 중요한 것은 발생한 비용에 대한 가시성을 제공할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "보통", - "text": "공용 인증 기관을 통해 인증서 관리 및 갱신 프로세스를 자동화하여 관리를 용이하게 합니다.", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", + "service": "SAP", + "severity": "낮다", + "text": "대기 시간에 민감한 애플리케이션에 대해 VM 간 대기 시간 모니터링을 사용합니다.", + "waf": "공연" }, { - "checklist": "Azure Landing Zone Review", - "guid": "913156a1-2476-4e49-b541-acdce979377b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", "severity": "보통", - "text": "키 및 인증서 교체를 위한 자동화된 프로세스를 설정합니다.", - "waf": "안전" + "text": "Azure Site Recovery 모니터링을 사용하여 SAP 애플리케이션 서버에 대한 재해 복구 서비스의 상태를 유지 관리합니다.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "waf": "신뢰도" }, { - "checklist": "Azure Landing Zone Review", - "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", "severity": "보통", - "text": "자격 증명 모음에서 방화벽 및 가상 네트워크 서비스 엔드포인트 또는 프라이빗 엔드포인트를 사용하도록 설정하여 키 자격 증명 모음에 대한 액세스를 제어합니다.", - "waf": "안전" + "text": "모든 데이터베이스 파일 시스템 및 실행 프로그램을 바이러스 백신 검사에서 제외합니다. 이를 포함하면 성능 문제가 발생할 수 있습니다. 제외 목록에 대한 규범적 세부 정보는 데이터베이스 공급업체에 문의하십시오. 예를 들어 Oracle은 바이러스 백신 검사에서 /oracle//sapdata를 제외할 것을 권장합니다.", + "waf": "공연" }, { - "checklist": "Azure Landing Zone Review", - "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", - "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", - "service": "Key Vault", - "severity": "보통", - "text": "플랫폼 중앙 Azure Monitor Log Analytics 작업 영역을 사용하여 Key Vault의 각 인스턴스 내에서 키, 인증서 및 비밀 사용을 감사합니다.", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "c027f893-f404-41a9-b33d-39d625a14964", + "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", + "service": "SAP", + "severity": "낮다", + "text": "마이그레이션 후 비 HANA 데이터베이스에 대한 전체 데이터베이스 통계를 수집하는 것이 좋습니다. 예를 들어 SAP Note 1020260 - Oracle 통계 제공을 구현합니다.", + "waf": "공연" }, { - "checklist": "Azure Landing Zone Review", - "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", + "service": "SAP", "severity": "보통", - "text": "Key Vault 인스턴스화 및 권한 있는 액세스를 위임하고 Azure Policy를 사용하여 일관된 규정 준수 구성을 적용합니다.", - "waf": "안전" + "text": "Azure에서 SAP를 사용하는 모든 Oracle 배포에 Oracle ASM(Automatic Storage Management)을 사용하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", + "waf": "공연" }, { - "checklist": "Azure Landing Zone Review", - "guid": "91163418-2ba5-4275-8694-4008be7d7e48", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", + "service": "SAP", "severity": "보통", - "text": "애플리케이션, 환경, 지역당 Azure Key Vault를 사용합니다.", - "waf": "안전" + "text": "Oracle을 실행하는 Azure의 SAP의 경우 SQL 스크립트 컬렉션은 성능 문제를 진단하는 데 도움이 될 수 있습니다. AWR(Automatic Workload Repository) 보고서에는 Oracle 시스템의 문제점을 진단하는 데 유용한 정보가 포함되어 있습니다. 여러 세션 동안 AWR 보고서를 실행하고 피크 시간을 선택하여 광범위한 분석 범위를 보장하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", + "waf": "공연" }, { - "checklist": "Azure Landing Zone Review", - "guid": "25d62688-6d70-4ba6-a97b-e99519048384", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", + "severity": "높다", + "text": "Azure Site Recovery 모니터링을 사용하여 SAP 애플리케이션 서버에 대한 재해 복구 서비스의 상태를 유지 관리합니다.", + "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "waf": "작업" + }, + { + "checklist": "SAP Checklist", + "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "SAP", "severity": "보통", - "text": "자체 키를 가져오려는 경우 고려되는 모든 서비스에서 지원되지 않을 수 있습니다. 불일치가 원하는 결과를 방해하지 않도록 관련 완화를 구현합니다. 대기 시간을 최소화하는 적절한 지역 쌍과 재해 복구 지역을 선택합니다.", + "text": "HTTP/S 앱을 안전하게 배달하려면 Application Gateway v2를 사용하고 WAF 보호 및 정책이 사용하도록 설정되어 있는지 확인합니다.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", "waf": "안전" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", - "link": "https://learn.microsoft.com/industry/sovereignty/key-management", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", "severity": "보통", - "text": "Sovereign Landing Zone의 경우 Azure Key Vault 관리형 HSM을 사용하여 비밀 및 자격 증명을 저장합니다.", - "waf": "안전" + "text": "Azure로 마이그레이션하는 동안 가상 머신의 DNS 또는 가상 이름이 변경되지 않은 경우 백그라운드 DNS 및 가상 이름은 SAP 환경의 많은 시스템 인터페이스를 연결하며, 고객은 시간이 지남에 따라 개발자가 정의하는 인터페이스를 인식하는 경우에만 인식할 수 있습니다. 마이그레이션 후 가상 또는 DNS 이름이 변경될 때 다양한 시스템 간에 연결 문제가 발생하며, 이러한 유형의 문제를 방지하기 위해 DNS 별칭을 유지하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", - "service": "Entra", + "checklist": "SAP Checklist", + "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", "severity": "보통", - "text": "Microsoft Entra ID 보고 기능을 사용하여 액세스 제어 감사 보고서를 생성합니다.", - "waf": "안전" + "text": "서로 다른 DNS 영역을 사용하여 각 환경(샌드박스, 개발, 사전 프로덕션 및 프로덕션)을 서로 구분합니다. 예외는 자체 VNet을 사용하는 SAP 배포의 경우입니다. 여기서는 프라이빗 DNS 영역이 필요하지 않을 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "09945bda-4333-44f2-9911-634182ba5275", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", - "service": "Defender", - "severity": "높다", - "text": "모든 구독에 대해 Defender 클라우드 보안 태세 관리를 사용하도록 설정합니다.", - "waf": "안전" + "checklist": "SAP Checklist", + "guid": "a3592829-e6e2-4061-9368-6af46791f893", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "service": "SAP", + "severity": "보통", + "text": "로컬 및 글로벌 VNet 피어링은 연결을 제공하며, 여러 Azure 지역에서 SAP 배포를 위한 랜딩 존 간의 연결을 보장하기 위해 선호되는 접근 방식입니다", + "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", + "waf": "신뢰도" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", - "service": "Defender", - "severity": "높다", - "text": "모든 구독에서 서버에 대한 Defender 클라우드 워크로드 보호 계획을 사용하도록 설정합니다.", - "waf": "안전" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", - "service": "Defender", - "severity": "높다", - "text": "모든 구독에서 Azure 리소스에 대한 Defender 클라우드 워크로드 보호 계획을 사용하도록 설정합니다.", - "waf": "안전" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", - "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", - "service": "VM", + "checklist": "SAP Checklist", + "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", + "service": "SAP", "severity": "높다", - "text": "IaaS 서버에서 Endpoint Protection을 사용하도록 설정합니다.", - "waf": "안전" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", - "link": "https://learn.microsoft.com/azure/security-center/", - "service": "VM", - "severity": "보통", - "text": "Azure Monitor 로그 및 클라우드용 Defender를 통해 기본 운영 체제 패치 드리프트를 모니터링합니다.", - "waf": "안전" + "text": "SAP 애플리케이션과 SAP 데이터베이스 서버 간에 NVA를 배포하는 것은 지원되지 않습니다", + "training": "https://me.sap.com/notes/2731110", + "waf": "공연" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "checklist": "SAP Checklist", + "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", + "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", + "service": "SAP", "severity": "보통", - "text": "기본 리소스 구성을 중앙 집중식 Azure Monitor Log Analytics 작업 영역에 연결합니다.", - "waf": "안전" + "text": "Azure 지역 및 온-프레미스 위치 간에 글로벌 전송 연결이 필요한 신규, 대규모 또는 글로벌 네트워크에서 Azure 배포에 Virtual WAN을 사용합니다. 이 방법을 사용하면 Azure 네트워킹에 대한 전이적 라우팅을 수동으로 설정할 필요가 없으며 Azure의 SAP 배포에 대한 표준을 따를 수 있습니다.", + "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", - "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", - "service": "Entra", + "checklist": "SAP Checklist", + "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", + "service": "SAP", "severity": "보통", - "text": "Sovereign Landing Zone의 경우 Entra ID 테넌트에서 투명 로그가 사용하도록 설정됩니다.", - "waf": "안전" + "text": "파트너 NVA를 사용하는 경우에만 지역 간에 NVA(네트워크 가상 어플라이언스)를 배포하는 것이 좋습니다. 네이티브 NVA가 있는 경우 지역 또는 VNet 간의 NVA가 필요하지 않습니다. 파트너 네트워킹 기술 및 NVA를 배포하는 경우 공급업체의 지침에 따라 Azure 네트워킹과 충돌하는 구성을 확인합니다.", + "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", + "waf": "작업" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", - "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", - "service": "Entra", + "checklist": "SAP Checklist", + "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", + "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", + "service": "SAP", "severity": "보통", - "text": "Sovereign Landing Zone의 경우 Entra ID 테넌트에서 고객 Lockbox를 사용할 수 있습니다.", - "waf": "안전" + "text": "Virtual WAN은 가상 WAN 기반 토폴로지에 대한 스포크 VNet 간의 연결을 관리하며(UDR[사용자 정의 라우팅] 또는 NVA를 설정할 필요 없음) 동일한 가상 허브의 VNet 간 트래픽에 대한 최대 네트워크 처리량은 초당 50기가비트입니다. 필요한 경우 SAP 랜딩 존은 VNet 피어링을 사용하여 다른 랜딩 존에 연결하고 이 대역폭 제한을 극복할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", + "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Storage", + "checklist": "SAP Checklist", + "guid": "82734c88-6ba2-4802-8459-11475e39e530", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", "severity": "높다", - "text": "스토리지 계정에 대한 보안 전송을 사용하도록 설정해야 함", + "text": "SAP 워크로드를 실행하는 VM에 대한 공용 IP 할당은 권장되지 않습니다.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", "waf": "안전" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", - "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", - "service": "Storage", + "checklist": "SAP Checklist", + "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", + "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "service": "SAP", "severity": "높다", - "text": "스토리지 계정에 대해 컨테이너 일시 삭제를 사용하도록 설정하여 삭제된 컨테이너와 해당 콘텐츠를 복구합니다.", - "waf": "안전" + "text": "ASR을 구성할 때 DR 쪽에서 IP 주소를 예약하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "작업" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", - "service": "Key Vault", + "checklist": "SAP Checklist", + "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", "severity": "높다", - "text": "Key Vault 비밀을 사용하여 자격 증명(가상 머신 사용자 암호), 인증서 또는 키와 같은 중요한 정보를 하드 코딩하지 않도록 합니다.", + "text": "프로덕션 및 DR 사이트에 겹치는 IP 주소 범위를 사용하지 마십시오.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", "waf": "작업" }, { - "checklist": "Azure Bot Service", - "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", - "service": "Bot service", + "checklist": "SAP Checklist", + "guid": "6e154e3a-a359-4282-ae6e-206173686af4", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", + "service": "SAP", "severity": "보통", - "text": "Azure Bot Service의 안정성 지원 권장 사항을 따릅니다", - "waf": "신뢰도" + "text": "Azure는 VNet에서 여러 위임된 서브넷을 만드는 데 도움이 되지만 Azure NetApp Files용 VNet에는 위임된 서브넷이 하나만 존재할 수 있습니다. Azure NetApp Files에 대해 둘 이상의 위임된 서브넷을 사용하는 경우 새 볼륨을 만들려는 시도가 실패합니다.", + "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", + "waf": "작업" }, { - "checklist": "Azure Bot Service", - "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", - "service": "Bot service", + "checklist": "SAP Checklist", + "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", + "service": "SAP", "severity": "보통", - "text": "로컬 데이터 레지던시 및 지역 규정 준수를 통해 봇 배포Deploying bots with local data residency and regional compliance", - "waf": "신뢰도" + "text": "Azure Firewall을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, 비 HTTP/S 인바운드 연결 및 East/West 트래픽 필터링(조직에 필요한 경우)을 제어합니다", + "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", + "waf": "안전" }, { - "checklist": "Azure Bot Service", - "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", - "service": "Bot service", + "checklist": "SAP Checklist", + "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", + "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", + "service": "SAP", "severity": "보통", - "text": "Azure Bot Service는 글로벌 및 지역 서비스 모두에 대해 활성-활성 모드로 실행됩니다. 중단이 발생하면 오류를 감지하거나 서비스를 관리할 필요가 없습니다. Azure Bot Service는 다중 지역 지리적 아키텍처에서 자동 장애 조치(failover) 및 자동 복구를 자동으로 수행합니다. EU 봇 지역 서비스의 경우 Azure Bot Service는 중복성을 보장하기 위해 활성/활성 복제가 있는 유럽 내 두 개의 전체 지역을 제공합니다. 글로벌 봇 서비스의 경우 사용 가능한 모든 지역/지역을 글로벌 공간으로 제공할 수 있습니다.", - "waf": "신뢰도" + "text": "Application Gateway, SAP Web Dispatcher 및 기타 타사 서비스 간의 비교에서 볼 수 있듯이 Application Gateway가 SAP 웹앱에 대한 역방향 프록시 역할을 하는 경우 Application Gateway 및 Web Application Firewall에 제한 사항이 있습니다.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", + "waf": "안전" }, { - "checklist": "Redis Resiliency checklist", - "guid": "65285269-440b-44be-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", - "service": "Redis", - "severity": "높다", - "text": "Azure Cache for Redis에 대한 영역 중복성을 사용하도록 설정합니다. Azure Cache for Redis는 프리미엄 및 엔터프라이즈 계층에서 영역 중복 구성을 지원합니다. 영역 중복 캐시는 동일한 지역의 여러 Azure 가용성 영역에 노드를 배치할 수 있습니다. 데이터 센터 또는 AZ 중단을 단일 장애 지점으로 제거하고 캐시의 전반적인 가용성을 높입니다.", - "waf": "신뢰도" + "checklist": "SAP Checklist", + "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", + "severity": "보통", + "text": "Azure Front Door 및 WAF 정책을 사용하여 랜딩 존에 대한 인바운드 HTTP/S 연결을 위해 Azure 지역에서 전역 보호를 제공합니다.", + "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", + "waf": "안전" }, { - "checklist": "Redis Resiliency checklist", - "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", - "service": "Redis", + "checklist": "SAP Checklist", + "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "SAP", "severity": "보통", - "text": "Azure Cache for Redis 인스턴스에 대한 데이터 지속성을 구성합니다. 캐시 데이터는 메모리에 저장되기 때문에 드물게 계획되지 않은 여러 노드의 오류로 인해 모든 데이터가 삭제될 수 있습니다. 데이터가 완전히 손실되는 것을 방지하기 위해 Redis 지속성을 사용하면 메모리 내 데이터의 주기적인 스냅숏을 만들어 저장소 계정에 저장할 수 있습니다.", - "waf": "신뢰도" + "text": "Azure Front Door 및 Application Gateway를 사용하여 HTTP/S 애플리케이션을 보호하는 경우 Azure Front Door의 Web Application Firewall 정책을 활용합니다. Azure Front Door에서만 트래픽을 수신하도록 Application Gateway를 잠급니다.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", + "waf": "안전" }, { - "checklist": "Redis Resiliency checklist", - "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", - "service": "Redis", + "checklist": "SAP Checklist", + "guid": "5ada4332-4e13-4811-9231-81aa41742694", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", "severity": "보통", - "text": "지역 중복 스토리지 계정을 사용하여 Azure Cache for Redis 데이터를 유지하거나 지역 중복을 사용할 수 없는 경우 영역 중복을 유지합니다", - "waf": "신뢰도" + "text": "웹 애플리케이션 방화벽을 사용하여 트래픽이 인터넷에 노출될 때 트래픽을 검사합니다. 또 다른 옵션은 부하 분산 장치 또는 Application Gateway 또는 타사 솔루션과 같은 기본 제공 방화벽 기능이 있는 리소스와 함께 사용하는 것입니다.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", + "waf": "안전" }, { - "checklist": "Redis Resiliency checklist", - "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", - "service": "Redis", + "checklist": "SAP Checklist", + "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "SAP", "severity": "보통", - "text": "프리미엄 Azure Cache for Redis 인스턴스에 대한 수동 지역 복제를 구성합니다. 지역에서 복제는 일반적으로 두 개의 Azure 지역에 걸쳐 있는 둘 이상의 Azure Cache for Redis 인스턴스를 연결하는 메커니즘입니다. 지역에서 복제는 주로 지역 간 재해 복구를 위해 설계되었습니다. 두 개의 프리미엄 계층 캐시 인스턴스는 주 캐시에 대한 읽기 및 쓰기를 제공하는 방식으로 지역 복제를 통해 연결되며, 해당 데이터는 보조 캐시에 복제됩니다.", - "waf": "신뢰도" + "text": "Azure 지역 및 온-프레미스 위치 간에 글로벌 전송 연결이 필요한 신규, 대규모 또는 글로벌 네트워크에서 Azure 배포에 Virtual WAN을 사용합니다. 이 방법을 사용하면 Azure 네트워킹에 대한 전이적 라우팅을 수동으로 설정할 필요가 없으며 Azure의 SAP 배포에 대한 표준을 따를 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", + "waf": "공연" }, { - "checklist": "Logic Apps checklist", - "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", - "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", - "service": "Logic Apps", - "severity": "높다", - "text": "비즈니스 및 SLO 요구 사항에 따라 올바른 Logic App 호스팅 계획 선택Select the right Logic App hosting plan based on your business & SLO requirements", - "waf": "신뢰도" + "checklist": "SAP Checklist", + "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "SAP", + "severity": "보통", + "text": "데이터 유출을 방지하려면 Azure Private Link를 사용하여 Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory 등과 같은 PaaS(Platform as a Service) 리소스에 안전하게 액세스합니다. Azure 프라이빗 엔드포인트는 VNet과 Azure Storage, Azure Backup 등과 같은 서비스 간의 트래픽을 보호하는 데도 도움이 될 수 있습니다. VNet과 프라이빗 엔드포인트 사용 서비스 간의 트래픽은 Microsoft 글로벌 네트워크를 통해 이동하므로 공용 인터넷에 노출되지 않습니다.", + "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", + "waf": "안전" }, { - "checklist": "Logic Apps checklist", - "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", - "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "Logic Apps", + "checklist": "SAP Checklist", + "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", + "service": "SAP", "severity": "높다", - "text": "영역 중복 및 가용성 영역을 사용하여 지역 오류로부터 논리 앱 보호Protect logic apps from region failures with zone redundancy and availability zones", - "waf": "신뢰도" + "text": "SAP 애플리케이션 및 DBMS 계층에 사용되는 VM에서 Azure 가속 네트워킹이 사용하도록 설정되어 있는지 확인합니다.", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "waf": "공연" }, { - "checklist": "Logic Apps checklist", - "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", - "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Logic Apps", - "severity": "높다", - "text": "중요한 워크로드에 대한 지역 간 DR 전략 고려", - "waf": "신뢰도" + "checklist": "SAP Checklist", + "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", + "service": "SAP", + "severity": "보통", + "text": "Azure Load Balancer에 대한 내부 배포가 DSR(Direct Server Return)을 사용하도록 설정되어 있는지 확인합니다. 이 설정(유동 IP 사용)은 DBMS 계층의 고가용성 구성에 내부 부하 분산 장치 구성을 사용할 때 대기 시간을 줄입니다.", + "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "waf": "안전" }, { - "checklist": "Logic Apps checklist", - "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", - "link": "https://learn.microsoft.com/azure/app-service/environment/intro", - "service": "Logic Apps", + "checklist": "SAP Checklist", + "guid": "6791f893-5ada-4433-84e1-3811523181aa", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "SAP", + "severity": "보통", + "text": "ASG(애플리케이션 보안 그룹) 및 NSG 규칙을 사용하여 SAP 애플리케이션과 DBMS 계층 간에 네트워크 보안 액세스 제어 목록을 정의할 수 있습니다. ASG는 보안을 관리하는 데 도움이 되도록 가상 머신을 그룹화합니다.", + "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", "severity": "높다", - "text": "격리된 환경에 배포하는 경우 ASE(App Service Environment) v3을 사용하거나 마이그레이션합니다", - "waf": "신뢰도" + "text": "피어링되지 않은 다른 Azure VNet에 SAP 애플리케이션 계층 및 SAP DBMS를 배치하는 것은 지원되지 않습니다.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "공연" }, { - "checklist": "Logic Apps checklist", - "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", - "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", - "service": "Logic Apps", + "checklist": "SAP Checklist", + "guid": "fa96c96a-d885-418f-9827-34c886ba2802", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "severity": "보통", - "text": "Azure DevOps 또는 GitHub를 활용하여 CI/CD를 간소화하고 논리 앱 코드를 보호합니다.", - "waf": "작업" + "text": "SAP 애플리케이션에서 네트워크 대기 시간을 최적화하려면 Azure 근접 배치 그룹을 사용하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", + "waf": "공연" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", - "service": "Azure Monitor", - "text": "Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview 의 데이터 수집 규칙", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", + "severity": "높다", + "text": "온-프레미스와 Azure 간에 분할된 SAP 애플리케이션 서버 계층 및 DBMS 계층을 실행하는 것은 전혀 지원되지 않습니다. 두 계층 모두 온-프레미스 또는 Azure에 완전히 상주해야 합니다.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "공연" }, { - "checklist": "Cost Optimization Checklist", - "guid": "45901365-d38e-443f-abcb-d868266abca2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Azure Backup", - "text": "기본 데이터 원본을 찾을 수 없는 백업 인스턴스 확인", + "checklist": "SAP Checklist", + "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", + "severity": "높다", + "text": "계층 간의 과도한 네트워크 트래픽으로 인해 발생할 수 있는 상당한 비용 때문에 다른 VNet에서 SAP 시스템의 DBMS(데이터베이스 관리 시스템) 및 애플리케이션 계층을 호스트하고 VNet 피어링과 연결하는 것은 권장되지 않습니다. Azure 가상 네트워크 내에서 서브넷을 사용하여 SAP 애플리케이션 계층과 DBMS 계층을 분리하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", "waf": "비용" }, { - "checklist": "Cost Optimization Checklist", - "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "VM", - "text": "연결되지 않은 서비스(디스크, NIC, IP 주소 등) 삭제 또는 보관", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "402a9846-d515-4061-aff8-cd30088693fa", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", + "service": "SAP", + "severity": "높다", + "text": "Linux 게스트 운영 체제에서 Load Balancer를 사용하는 경우 Linux 네트워크 매개 변수 net.ipv4.tcp_timestamps가 0으로 설정되어 있는지 확인합니다.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "공연" }, { - "checklist": "Cost Optimization Checklist", - "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Azure Backup", - "text": "중요 업무용 응용 프로그램에 대한 Site Recovery 저장소와 백업 간의 적절한 균형을 고려합니다.", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "87585797-5551-4d53-bb7d-a94ee415734d", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", + "service": "SAP", + "severity": "보통", + "text": "SAP RISE/ECS 배포의 경우 가상 피어링은 고객의 기존 Azure 환경과의 연결을 설정하는 기본 방법입니다. SAP vnet과 고객 vnet은 모두 NSG(네트워크 보안 그룹)로 보호되므로 vnet 피어링을 통해 SAP 및 데이터베이스 포트에서 통신할 수 있습니다", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", - "service": "Azure Monitor", - "text": "40개의 서로 다른 로그 분석 작업 영역 간의 지출 및 절감 기회 확인 - 비프로덕션 작업 영역에 대해 서로 다른 보존 및 데이터 수집 사용-인식 및 계층 크기 조정을 위한 일일 한도 만들기 - 일일 한도를 설정하는 경우 한도에 도달할 때 경고를 만드는 것 외에도 특정 비율(예: 90%)에 도달했을 때 알림을 받을 경고 규칙도 만들어야 합니다. - 가능한 경우 작업 영역 변환 고려 - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", + "checklist": "SAP Checklist", + "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", + "severity": "높다", + "text": "Azure VM에 대한 SAP HANA 데이터베이스 백업을 검토합니다.", "waf": "비용" }, { - "checklist": "Cost Optimization Checklist", - "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Azure Monitor", - "text": "제거 로그 정책 및 자동화 적용(필요한 경우 로그를 콜드 스토리지로 이동할 수 있음)", - "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", + "checklist": "SAP Checklist", + "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", + "severity": "보통", + "text": "SAP에 사용되는 Site Recovery 기본 제공 모니터링을 검토합니다.", "waf": "비용" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "VM", - "text": "디스크가 실제로 필요한지 확인하고, 그렇지 않은 경우 삭제하십시오. 필요한 경우 더 낮은 스토리지 계층을 찾거나 백업을 사용합니다.", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", + "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", + "service": "SAP", + "severity": "높다", + "text": "SAP HANA 시스템 환경 모니터링 지침을 검토합니다.", + "waf": "작업" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d1e44a19-659d-4395-afd7-7289b835556d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Storage", - "text": "사용자 지정 규칙을 사용하여 사용하지 않는 스토리지를 하위 계층으로 이동하는 것이 좋습니다 - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", + "service": "SAP", + "severity": "보통", + "text": "Azure Linux VM 백업 전략에서 Oracle Database를 검토합니다.", + "waf": "작업" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "VM", - "text": "Advisor가 VM 올바른 크기 조정에 대해 구성되어 있는지 확인합니다. ", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", + "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", + "service": "SAP", + "severity": "보통", + "text": "SQL Server 2016에서 Azure Blob Storage 사용을 검토합니다.", + "waf": "작업" }, { - "checklist": "Cost Optimization Checklist", - "description": "Cost analysys에서 Meter Category Licenses를 검색하여 확인합니다.", - "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", - "service": "VM", - "text": "모든 Windows VM에서 스크립트 실행 https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- Windows VM을 자주 만드는 경우 정책 구현을 고려합니다.", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", + "service": "SAP", + "severity": "보통", + "text": "Azure VM에 대한 자동화된 Backup v2 사용을 검토합니다.", + "waf": "작업" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "VM", - "text": " 이미 라이선스가 있는 경우 AHUB에 넣을 수도 https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", + "service": "SAP", + "severity": "높다", + "text": "프리미엄 디스크(V1)를 사용할 때 M 시리즈에 쓰기 가속기 사용Enabling Write accelerator for M series when using premium disks(V1)", + "waf": "작업" }, { - "checklist": "Cost Optimization Checklist", - "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "VM", - "text": "유연성 옵션을 사용하여 예약된 VM 제품군 통합(4-5개 이하의 제품군)", - "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "service": "SAP", + "severity": "보통", + "text": "가용성 영역 대기 시간을 테스트합니다.", + "waf": "공연" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", - "service": "VM", - "text": "Azure Reserved Instances 활용: 이 기능을 사용하면 1년 또는 3년 동안 VM을 예약할 수 있으므로 PAYG 가격에 비해 상당한 비용 절감 효과를 얻을 수 있습니다.", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", + "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", + "service": "SAP", + "severity": "보통", + "text": "모든 SAP 구성 요소에 대해 SAP EarlyWatch Alert를 활성화합니다.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", + "waf": "공연" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "VM", - "text": "더 큰 디스크만 예약할 수 있습니다 => 1TiB -", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", + "service": "SAP", + "severity": "보통", + "text": "SAP ABAPMeter 보고서 /SSA/CAT를 사용하여 SAP 애플리케이션 서버-데이터베이스 서버 대기 시간을 검토합니다.", + "training": "https://me.sap.com/notes/0002879613", + "waf": "공연" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", - "service": "VM", - "text": "적절한 크기 최적화 후", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", + "service": "SAP", + "severity": "보통", + "text": "CCMS를 사용하여 SQL Server 성능 모니터링을 검토합니다.", + "waf": "공연" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Azure SQL", - "text": "적용 가능한 경우 확인 및 정책/변경 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations 시행", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", + "link": "https://me.sap.com/notes/500235", + "service": "SAP", + "severity": "보통", + "text": "SAP 애플리케이션 계층 VM과 DBMS VM(NIPING) 간의 네트워크 대기 시간을 테스트합니다.", + "training": "https://me.sap.com/notes/1100926/E", + "waf": "공연" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "VM", - "text": "VM + 라이선스 부분 할인(ahub + 3YRI)은 약 70% 할인입니다.", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", + "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", + "service": "SAP", + "severity": "보통", + "text": "SAP HANA Studio 경고를 검토합니다.", + "waf": "공연" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "VM", - "text": "플랫 사이징보다는 VMSS를 사용하여 수요에 맞추는 것이 좋습니다", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", + "link": "https://me.sap.com/notes/1969700", + "service": "SAP", + "severity": "보통", + "text": "HANA_Configuration_Minichecks를 사용하여 SAP HANA 상태 검사를 수행합니다.", + "waf": "공연" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Cost Optimization Checklist", - "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "AKS", - "text": "AKS 자동 크기 조정기를 사용하여 클러스터 사용량과 일치시킵니다(Pod 요구 사항이 스케일러와 일치하는지 확인).", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", + "severity": "보통", + "text": "Azure, 온-프레미스 또는 기타 클라우드 환경에서 Windows 및 Linux VM을 실행하는 경우 Azure Automation의 업데이트 관리 센터를 사용하여 보안 패치를 포함한 운영 체제 업데이트를 관리할 수 있습니다.", + "training": "https://learn.microsoft.com/azure/automation/update-management/overview", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Azure Backup", - "text": "해당하는 경우 복구 지점을 자격 증명 모음 보관으로 이동(유효성 검사)Move recovery points to vault-archive where applicable (Validate)", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "08951710-79a2-492a-adbc-06d7a401545b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", + "severity": "보통", + "text": "SAP는 SAP 시스템을 보호하기 위해 즉각적인 조치가 필요한 매우 중요한 보안 패치 또는 핫픽스를 릴리스하므로 SAP 보안 OSS 노트를 정기적으로 검토합니다.", + "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", - "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", - "service": "Databricks", - "text": "가능한 경우 대체와 함께 스폿 VM을 사용하는 것이 좋습니다. 클러스터의 자동 종료를 고려합니다.", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", + "severity": "낮다", + "text": "SQL Server SAP의 경우 SQL Server SAP 시스템에서 계정을 사용하지 않으므로 SQL Server 시스템 관리자 계정을 사용하지 않도록 설정할 수 있습니다. 원래 시스템 관리자 계정을 비활성화하기 전에 시스템 관리자 권한이 있는 다른 사용자가 서버에 액세스할 수 있는지 확인합니다.", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", - "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", - "service": "Azure Functions", - "text": "함수 - 연결 재사용", - "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", + "severity": "높다", + "text": "xp_cmdshell 비활성화합니다. SQL Server 기능 xp_cmdshell SQL Server 내부 운영 체제 명령 셸을 사용할 수 있습니다. 이는 보안 감사에서 발생할 수 있는 잠재적 위험입니다.", + "training": "https://me.sap.com/notes/3019299/E", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview", - "service": "Azure Functions", - "text": "함수 - 로컬에 데이터 캐시", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "severity": "높다", + "text": "Azure에서 SAP HANA 데이터베이스 서버를 암호화하는 데는 SAP HANA 네이티브 암호화 기술이 사용됩니다. 또한 Azure에서 SQL Server를 사용하는 경우 TDE(투명한 데이터 암호화)를 사용하여 데이터 및 로그 파일을 보호하고 백업도 암호화되도록 합니다.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Azure Functions", - "text": "기능 - 콜드 스타트 - '패키지에서 실행' 기능을 사용합니다. 이렇게 하면 코드가 단일 zip 파일로 다운로드됩니다. 예를 들어, 이것은 많은 노드 모듈이 있는 Javascript 함수를 크게 개선할 수 있습니다. 언어별 도구를 사용하여 패키지 크기를 줄입니다(예: 트리 쉐이킹 Javascript 애플리케이션).", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "SAP", + "severity": "보통", + "text": "Azure Storage 암호화는 모든 Azure Resource Manager 및 클래식 스토리지 계정에 대해 사용하도록 설정되며 사용하지 않도록 설정할 수 없습니다. 데이터는 기본적으로 암호화되므로 Azure Storage 암호화를 사용하기 위해 코드 또는 애플리케이션을 수정할 필요가 없습니다.", + "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "SAP", + "severity": "높다", + "text": "Azure Key Vault를 사용하여 비밀 및 자격 증명 저장", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "829e2edb-2173-4676-aff6-691b4935ada4", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "SAP", + "severity": "보통", + "text": "무단 변경으로부터 보호하기 위해 성공적인 배포 후 Azure 리소스를 잠그는 것이 좋습니다. 사용자 지정된 Azure 정책(Custome 역할)을 사용하여 구독별로 LOCK 제약 조건 및 규칙을 적용할 수도 있습니다.", + "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "SAP", + "severity": "보통", + "text": "삭제된 개체에 대한 보존 보호를 허용하기 위해 일시 삭제 및 제거 정책을 사용하도록 설정된 Azure Key Vault를 프로비전합니다.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", + "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", + "service": "SAP", + "severity": "높다", + "text": "기존 요구 사항에 따라 규정 및 규정 준수 제어(내부/외부) - 필요한 Azure 정책 및 Azure RBAC 역할 결정", + "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "severity": "높다", + "text": "SAP 환경에서 엔드포인트용 Microsoft Defender 사용하도록 설정하는 경우 모든 서버를 대상으로 하는 대신 DBMS 서버에서 데이터 및 로그 파일을 제외하는 것이 좋습니다. 대상 파일을 제외할 때 DBMS 공급업체의 권장 사항을 따릅니다.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", + "service": "SAP", + "severity": "높다", + "text": "클라우드용 Microsoft Defender의 Just-In-Time 액세스 권한이 있는 SAP 관리자 사용자 지정 역할을 위임합니다.", + "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "severity": "낮다", + "text": "타사 보안 제품을 DIAG(SAP GUI)용 SNC(Secure Network Communications), RFC 및 HTTPS용 SPNEGO와 통합하여 전송 중인 데이터를 암호화합니다.", + "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", + "service": "SAP", + "severity": "보통", + "text": "보안 주체 암호화 기능을 위해 기본적으로 Microsoft 관리형 키를 사용하고 필요한 경우 고객 관리형 키를 사용합니다.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "4935ada4-2223-4ece-a1b1-23181a541741", + "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", + "service": "SAP", + "severity": "높다", + "text": "애플리케이션, 환경, 지역당 Azure Key Vault를 사용합니다.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", + "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", + "service": "SAP", + "severity": "높다", + "text": "비 HANA Windows 및 비 Windows 운영 체제에 대한 디스크 암호화 키 및 비밀을 제어하고 관리하려면 Azure Key Vault를 사용합니다. SAP HANA는 Azure Key Vault에서 지원되지 않으므로 SAP ABAP 또는 SSH 키와 같은 대체 방법을 사용해야 합니다.", + "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "209d490d-a477-4784-84d1-16785d2fa56c", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "service": "SAP", + "severity": "높다", + "text": "실수로 인한 네트워크 관련 변경을 방지하기 위해 Azure의 SAP 스포크 구독에 대한 RBAC(역할 기반 액세스 제어) 역할 사용자 지정", + "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", + "waf": "안전" + }, + { + "checklist": "SAP Checklist", + "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", + "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", + "service": "SAP", + "severity": "높다", + "text": "나머지 SAP 자산에서 DMZ 및 NVA를 격리하고, Azure Private Link를 구성하고, Azure의 SAP 리소스를 안전하게 관리 및 제어합니다", + "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "Azure Functions", - "text": "기능 - 기능을 따뜻하게 유지", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", + "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "service": "SAP", + "severity": "낮다", + "text": "Azure에서 Microsoft 맬웨어 방지 소프트웨어를 사용하여 악성 파일, 애드웨어 및 기타 위협으로부터 가상 머신을 보호하는 것이 좋습니다.", + "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Azure Functions", - "text": "다른 함수와 함께 자동 크기 조정을 사용하는 경우 모든 리소스에 대한 모든 자동 크기 조정을 구동하는 것이 있을 수 있으므로 별도의 소비 계획으로 이동하는 것이 좋습니다(CPU에 대한 더 높은 계획 고려).", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", + "service": "SAP", + "severity": "낮다", + "text": "더욱 강력한 보호를 위해 엔드포인트용 Microsoft Defender 사용하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", - "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", - "service": "Azure Functions", - "text": "지정된 계획의 함수 앱은 모두 함께 크기가 조정되므로 크기 조정과 관련된 모든 문제는 계획의 모든 앱에 영향을 줄 수 있습니다.", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", + "severity": "높다", + "text": "가상 네트워크 피어링을 통해 스포크 네트워크에 연결된 허브 가상 네트워크를 통해 모든 트래픽을 전달하여 SAP 애플리케이션 및 데이터베이스 서버를 인터넷 또는 온-프레미스 네트워크에서 격리합니다. 피어링된 가상 네트워크는 Azure의 SAP 솔루션이 공용 인터넷에서 격리되도록 보장합니다.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", - "service": "Azure Functions", - "text": "'대기 시간'에 대한 요금이 청구되나요? 이 질문은 일반적으로 비동기 작업을 수행하고 결과를 기다리는 C # 함수 (예 : await Task.Delay(1000) 또는 await client )의 컨텍스트에서 묻습니다. GetAsync('http://google.com')입니다. 대답은 '예'입니다 - GB 초 계산은 함수의 시작 및 종료 시간과 해당 기간 동안의 메모리 사용량을 기반으로 합니다. CPU 작업 측면에서 해당 시간 동안 실제로 발생하는 일은 계산에 포함되지 않습니다. 이 규칙의 한 가지 예외는 지속성 함수를 사용하는 경우입니다. 오케스트레이터 함수에서 대기하는 데 소요된 시간에 대해서는 요금이 청구되지 않습니다.가능한 경우 수요 형성 기술을 적용합니다(개발 환경?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "severity": "낮다", + "text": "SAP Fiori와 같은 인터넷 연결 애플리케이션의 경우 보안 수준을 유지하면서 애플리케이션 요구 사항에 따라 부하를 분산해야 합니다. 계층 7 보안의 경우 Azure Marketplace에서 사용할 수 있는 타사 WAF(Web Application Firewall)를 사용할 수 있습니다.", + "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Front Door", - "text": "Frontdoor - 기본 홈페이지 끄기앱의 애플리케이션 설정에서 AzureWebJobsDisableHomepage를 true로 설정합니다. 이렇게 하면 PoP에 204(콘텐츠 없음)가 반환되므로 헤더 데이터만 반환됩니다.", - "waf": "비용" + "checklist": "SAP Checklist", + "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", + "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", + "service": "SAP", + "severity": "보통", + "text": "SAP용 Azure Monitor 솔루션에서 보안 통신을 사용하도록 설정하려면 루트 인증서 또는 서버 인증서를 사용하도록 선택할 수 있습니다. 루트 인증서를 사용하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Front Door", - "text": "Frontdoor 프론트도어 - 아무것도 반환하지 않는 무언가로 라우팅합니다. 함수, 함수 프록시를 설정하거나 WebApp에서 200(정상)을 반환하고 콘텐츠를 보내지 않거나 최소한으로 보내는 경로를 추가합니다. 이것의 장점은 호출될 때 로그아웃할 수 있다는 것입니다.", - "waf": "비용" + "checklist": "Redis Resiliency checklist", + "guid": "65285269-440b-44be-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", + "service": "Redis", + "severity": "높다", + "text": "Azure Cache for Redis에 대한 영역 중복성을 사용하도록 설정합니다. Azure Cache for Redis는 프리미엄 및 엔터프라이즈 계층에서 영역 중복 구성을 지원합니다. 영역 중복 캐시는 동일한 지역의 여러 Azure 가용성 영역에 노드를 배치할 수 있습니다. 데이터 센터 또는 AZ 중단을 단일 장애 지점으로 제거하고 캐시의 전반적인 가용성을 높입니다.", + "waf": "신뢰도" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", - "service": "Storage", - "text": "덜 사용되는 데이터에 대한 보관 계층 고려", - "waf": "비용" + "checklist": "Redis Resiliency checklist", + "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", + "service": "Redis", + "severity": "보통", + "text": "Azure Cache for Redis 인스턴스에 대한 데이터 지속성을 구성합니다. 캐시 데이터는 메모리에 저장되기 때문에 드물게 계획되지 않은 여러 노드의 오류로 인해 모든 데이터가 삭제될 수 있습니다. 데이터가 완전히 손실되는 것을 방지하기 위해 Redis 지속성을 사용하면 메모리 내 데이터의 주기적인 스냅숏을 만들어 저장소 계정에 저장할 수 있습니다.", + "waf": "신뢰도" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "VM", - "text": "크기가 계층과 일치하지 않는 디스크 크기를 확인합니다(예: 513GiB 디스크는 P30(1TiB)를 지불하고 크기 조정을 고려합니다.", - "waf": "비용" + "checklist": "Redis Resiliency checklist", + "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", + "service": "Redis", + "severity": "보통", + "text": "지역 중복 스토리지 계정을 사용하여 Azure Cache for Redis 데이터를 유지하거나 지역 중복을 사용할 수 없는 경우 영역 중복을 유지합니다", + "waf": "신뢰도" }, { - "checklist": "Cost Optimization Checklist", - "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "Storage", - "text": "가능하면 프리미엄 또는 울트라 대신 표준 SSD를 사용하는 것이 좋습니다.", - "waf": "비용" + "checklist": "Redis Resiliency checklist", + "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", + "service": "Redis", + "severity": "보통", + "text": "프리미엄 Azure Cache for Redis 인스턴스에 대한 수동 지역 복제를 구성합니다. 지역에서 복제는 일반적으로 두 개의 Azure 지역에 걸쳐 있는 둘 이상의 Azure Cache for Redis 인스턴스를 연결하는 메커니즘입니다. 지역에서 복제는 주로 지역 간 재해 복구를 위해 설계되었습니다. 두 개의 프리미엄 계층 캐시 인스턴스는 주 캐시에 대한 읽기 및 쓰기를 제공하는 방식으로 지역 복제를 통해 연결되며, 해당 데이터는 보조 캐시에 복제됩니다.", + "waf": "신뢰도" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "Storage", - "text": "스토리지 계정의 경우 선택한 계층이 트랜잭션 요금을 합산하지 않는지 확인합니다(다음 계층으로 이동하는 것이 더 저렴할 수 있음).", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", + "service": "Entra", + "severity": "보통", + "text": "다중 테넌트에 대한 명확한 규정 또는 비즈니스 요구 사항이 없는 한 Azure 리소스를 관리하기 위해 하나의 Entra 테넌트를 사용합니다.", + "waf": "작업" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "Site Recovery", - "text": "ASR의 경우 RPO/RTO 및 복제 처리량이 허용하는 경우 표준 SSD 디스크를 사용하는 것이 좋습니다", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Entra", + "severity": "낮다", + "text": "Microsoft Entra ID 테넌트를 관리하기 위한 다중 테넌트 자동화 접근 방식이 있는지 확인합니다.", + "waf": "작업" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", - "service": "Storage", - "text": "스토리지 계정: 핫 계층 및/또는 GRS 필요 확인", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "Entra", + "severity": "낮다", + "text": "다중 테넌트 관리를 위해 Azure Lighthouse 활용", + "waf": "작업" }, { - "checklist": "Cost Optimization Checklist", - "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "VM", - "text": "디스크 - 모든 곳에서 프리미엄 SSD 디스크 사용의 유효성을 검사합니다. 예를 들어 비프로덕션은 표준 SSD 또는 주문형 프리미엄 SSD로 교환할 수 있습니다. ", + "checklist": "Azure Landing Zone Review", + "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Entra", + "severity": "보통", + "text": "Azure Lighthouse가 파트너별로 테넌트를 관리하는 데 사용되는지 확인합니다.", "waf": "비용" }, { - "checklist": "Cost Optimization Checklist", - "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "Synapse", - "text": "예산을 만들어 비용을 관리하고 이해 관계자에게 지출 이상 및 초과 지출 위험을 자동으로 알리는 경고를 만듭니다.", - "waf": "비용" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "348ef254-c27d-442e-abba-c7571559ab91", + "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", + "service": "Entra", + "severity": "높다", + "text": "클라우드 운영 모델에 맞는 RBAC 모델을 적용합니다. 관리 그룹 및 구독에서 범위 지정 및 할당Scope and Assign across Management Groups and Subscriptions.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "Synapse", - "text": "추가 데이터 분석을 위해 비용 데이터를 스토리지 계정으로 내보냅니다.", - "waf": "비용" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", + "service": "Entra", + "severity": "높다", + "text": "모든 계정 유형에 대해 인증 유형 회사 또는 학교 계정만 사용합니다. Microsoft 계정 사용 금지", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Synapse", - "text": "리소스를 사용하지 않을 때 일시 중지하여 전용 SQL 풀에 대한 비용을 제어합니다.", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "Entra", + "severity": "보통", + "text": "그룹만 사용하여 권한을 할당합니다. 그룹 관리 시스템이 이미 있는 경우 Entra ID 전용 그룹에 온-프레미스 그룹을 추가합니다.", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", - "service": "Synapse", - "text": "서버리스 Apache Spark 자동 일시 중지 기능을 활성화하고 그에 따라 제한 시간 값을 설정합니다.", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", + "service": "Entra", + "severity": "낮다", + "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 Microsoft Entra ID 조건부 액세스 정책 적용", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Synapse", - "text": "다양한 크기의 Apache Spark 풀 정의를 여러 개 만듭니다.", - "waf": "비용" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", + "service": "Entra", + "severity": "높다", + "text": "Azure 환경에 대한 권한이 있는 모든 사용자에 대해 다단계 인증 적용", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "service": "Synapse", - "text": "사전 구매 플랜으로 1년 동안 Azure Synapse SCU(커밋 단위)를 구매하여 Azure Synapse Analytics 비용을 절감하세요.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "14658d35-58fd-4772-99b8-21112df27ee4", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "Entra", + "severity": "보통", + "text": "Microsoft Entra ID PIM(Privileged Identity Management)을 적용하여 제로 스탠딩 액세스 및 최소 권한 설정", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "VM", - "text": "인터럽트 가능한 작업에 스폿 VM 사용: 할인된 가격으로 입찰 및 구매할 수 있는 VM으로, 중요하지 않은 워크로드에 비용 효율적인 솔루션을 제공합니다.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "Entra", + "severity": "보통", + "text": "Active Directory 도메인 서비스에서 Entra 도메인 서비스로 전환하려는 경우 모든 워크로드의 호환성을 평가합니다", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "544451e1-92d3-4442-a3c7-628637a551c5", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", - "text": "모든 VM의 적절한 크기 조정", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", + "service": "Entra", + "severity": "보통", + "text": "Microsoft Entra ID 로그를 플랫폼 중앙 Azure Monitor와 통합합니다. Azure Monitor를 사용하면 Azure의 로그 및 모니터링 데이터에 대한 단일 정보 원본을 사용할 수 있으므로 조직에 로그 수집 및 보존에 대한 요구 사항을 충족할 수 있는 클라우드 네이티브 옵션을 제공합니다.", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "VM", - "text": "VM 크기를 정규화된 최신 크기로 바꾸기", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "비용" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "984a859c-773e-47d2-9162-3a765a917e1f", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "service": "Entra", + "severity": "높다", + "text": "테넌트 전체 계정 잠금을 방지하기 위해 긴급 액세스 또는 비상 계정을 구현합니다", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "적절한 크기 조정 VM - 사용량을 5% 미만으로 모니터링하는 것으로 시작한 다음 최대 40%까지 작업", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "35037e68-9349-4c15-b371-228514f4cdff", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "Entra", + "severity": "보통", + "text": "Microsoft Entra ID 역할 할당에 온-프레미스 동기화된 계정을 사용하지 마세요.", + "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", + "waf": "안전" }, { - "checklist": "Cost Optimization Checklist", - "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "애플리케이션을 컨테이너화하면 VM 밀도를 개선하고 확장 비용을 절감할 수 있습니다", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Entra", + "severity": "보통", + "text": "필요한 경우 Microsoft Entra ID 애플리케이션 프록시를 사용하여 원격 사용자에게 내부 애플리케이션(클라우드 또는 온-프레미스에서 호스트됨)에 대한 안전하고 인증된 액세스를 제공합니다.", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "안전" }, { - "checklist": "MySQL Review Checklist", - "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", - "service": "Azure MySQL", + "checklist": "Azure Landing Zone Review", + "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", + "service": "VNet", "severity": "보통", - "text": "유연한 서버 활용", - "waf": "신뢰도" + "text": "최대한의 유연성이 필요한 네트워크 시나리오를 위해 기존의 허브 앤 스포크(hub-and-spoke) 네트워크 토폴로지를 기반으로 하는 네트워크 설계를 활용합니다.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "안전" }, { - "checklist": "MySQL Review Checklist", - "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", - "service": "Azure MySQL", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", + "service": "VNet", "severity": "높다", - "text": "지역적으로 적용 가능한 경우 가용 영역 활용Leverage Availability Zones where regionally applicable", - "waf": "신뢰도" + "text": "ExpressRoute 게이트웨이, VPN 게이트웨이 및 Azure Firewall 또는 중앙 허브 가상 네트워크의 파트너 NVA를 포함한 공유 네트워킹 서비스를 확인합니다. 필요한 경우 DNS 서버도 배포합니다.", + "waf": "비용" }, { - "checklist": "MySQL Review Checklist", - "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", - "service": "Azure MySQL", + "checklist": "Azure Landing Zone Review", + "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "VNet", "severity": "보통", - "text": "지역 간 DR 시나리오에 입력 데이터 복제 활용", - "waf": "신뢰도" + "text": "애플리케이션 랜딩 존의 모든 공용 IP 주소에 대해 DDoS 네트워크 또는 IP 보호 계획을 사용합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "스토리지와 관련된 Microsoft 클라우드 보안 벤치마크의 지침 적용", - "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "severity": "보통", - "text": "'스토리지에 대한 Azure 보안 기준' 고려", + "text": "파트너 네트워킹 기술 또는 NVA를 배포할 때 파트너 공급업체의 지침을 따릅니다", + "waf": "신뢰도" + }, + { + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", + "service": "ExpressRoute", + "severity": "낮다", + "text": "허브 및 스포크 시나리오에서 ExpressRoute와 VPN 게이트웨이 간의 전송이 필요한 경우 Azure Route Server를 사용합니다.", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "Azure Storage는 기본적으로 공용 IP 주소를 가지며 인터넷에 연결할 수 있습니다. 프라이빗 엔드포인트를 사용하면 액세스가 필요한 Azure Compute 리소스에만 Azure Storage를 안전하게 노출할 수 있으므로 공용 인터넷에 노출되지 않습니다", - "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", - "service": "Azure Storage", - "severity": "높다", - "text": "Azure Storage에 프라이빗 엔드포인트를 사용하는 것이 좋습니다.", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", + "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", + "service": "ARS", + "severity": "낮다", + "text": "Route Server를 사용하는 경우 Route Server 서브넷에 /27 접두사를 사용합니다.", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "새로 만든 저장소 계정은 ARM 배포 모델을 사용하여 만들어지므로 RBAC, 감사 등을 모두 사용할 수 있습니다. 구독에 클래식 배포 모델이 있는 이전 저장소 계정이 없는지 확인합니다.", - "guid": "30e37c3e-2971-41b2-963c-eee079b598de", - "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", + "service": "VNet", "severity": "보통", - "text": "이전 스토리지 계정이 '클래식 배포 모델'을 사용하지 않는지 확인", - "waf": "안전" + "text": "Azure 지역에 걸쳐 여러 허브 및 스포크 토폴로지가 있는 네트워크 아키텍처의 경우 허브 VNet 간에 글로벌 가상 네트워크 피어링을 사용하여 지역을 서로 연결합니다.", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", + "waf": "공연" }, { - "checklist": "Azure Blob Storage Review", - "description": "Microsoft Defender를 활용하여 의심스러운 활동 및 잘못된 구성에 대해 알아봅니다.", - "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", - "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", - "service": "Azure Storage", - "severity": "높다", - "text": "모든 스토리지 계정에 대해 Microsoft Defender 사용", - "waf": "안전" + "checklist": "Azure Landing Zone Review", + "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", + "service": "VNet", + "severity": "보통", + "text": "네트워크용 Azure Monitor를 사용하여 Azure에서 네트워크의 엔드투엔드 상태를 모니터링합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "waf": "작업" }, { - "checklist": "Azure Blob Storage Review", - "description": "일시 삭제 메커니즘을 사용하면 실수로 삭제된 Blob을 복구할 수 있습니다.", - "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", + "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "severity": "보통", - "text": "Blob에 대해 '일시 삭제' 사용Enable 'soft delete' for blobs", - "waf": "안전" + "text": "스포크 가상 네트워크를 중앙 허브 가상 네트워크에 연결할 때 ExpressRoute를 통해 보급할 수 있는 최대 접두사 수(1000)인 VNet 피어링 제한(500)을 고려합니다", + "waf": "신뢰도" }, { - "checklist": "Azure Blob Storage Review", - "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ", - "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", + "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "severity": "보통", - "text": "Blob에 대해 '일시 삭제' 사용 안 함", - "waf": "안전" + "text": "경로 테이블당 경로 제한(400)을 고려합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure Blob Storage Review", - "description": "컨테이너에 대한 일시 삭제를 사용하면 컨테이너가 삭제된 후 컨테이너를 복구할 수 있습니다(예: 실수로 인한 삭제 작업에서 복구).", - "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", + "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", + "service": "VNet", "severity": "높다", - "text": "컨테이너에 대해 '일시 삭제' 사용Enable 'soft delete' for containers", - "waf": "안전" + "text": "VNet 피어링을 구성할 때 '원격 가상 네트워크에 대한 트래픽 허용' 설정을 사용합니다", + "waf": "신뢰도" }, { - "checklist": "Azure Blob Storage Review", - "description": "예를 들어 애플리케이션이 기밀성, 개인 정보 보호 또는 규정 준수를 위해 삭제된 정보가 즉시 삭제되도록 해야 하는 경우와 같이 특정 Blob 컨테이너에 대해 '일시 삭제'를 선택적으로 사용하지 않도록 설정하는 것이 좋습니다. ", - "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", + "service": "ExpressRoute", "severity": "보통", - "text": "컨테이너에 대해 '일시 삭제' 사용 안 함", + "text": "ExpressRoute Direct를 사용하는 경우 조직의 라우터와 MSEE 간의 계층 2 수준에서 트래픽을 암호화하도록 MACsec을 구성합니다. 다이어그램은 흐름에서 이 암호화를 보여 줍니다.", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "사용자가 삭제하기 전에 먼저 삭제 잠금을 제거하도록 강제하여 저장소 계정이 실수로 삭제되는 것을 방지합니다.", - "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", - "severity": "높다", - "text": "스토리지 계정에 대한 리소스 잠금 사용Enable resource locks on storage accounts", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", + "severity": "낮다", + "text": "MACsec을 사용할 수 없는 시나리오(예: ExpressRoute Direct를 사용하지 않는 경우)의 경우 VPN Gateway를 사용하여 ExpressRoute 개인 피어링을 통해 IPsec 터널을 설정합니다.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "Blob에 대한 '법적 보존' 또는 '시간 기반 보존' 정책을 고려하면 Blob, 컨테이너 또는 스토리지 계정을 삭제할 수 없습니다. '불가능'은 실제로 '불가능'을 의미합니다. 스토리지 계정에 변경할 수 없는 Blob이 포함된 경우 해당 스토리지 계정을 '제거'하는 유일한 방법은 Azure 구독을 취소하는 것입니다.", - "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", - "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", - "service": "Azure Storage", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "558fd772-49b8-4211-82df-27ee412e7f98", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "ExpressRoute", "severity": "높다", - "text": "변경할 수 없는 Blob 고려", + "text": "Azure 지역 및 온-프레미스 위치에서 겹치는 IP 주소 공간이 사용되지 않는지 확인합니다.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "모든 데이터 전송이 암호화되고, 무결성이 보호되고, 서버가 인증되도록 스토리지 계정에 대한 보호되지 않는 HTTP/80 액세스를 사용하지 않도록 설정하는 것이 좋습니다. ", - "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Azure Storage", - "severity": "높다", - "text": "HTTPS 필요, 즉 스토리지 계정에서 포트 80 사용 안 함Require HTTPS, i.e. disable port 80 on the storage account", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", + "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", + "severity": "낮다", + "text": "개인 인터넷에 대한 주소 할당 범위의 IP 주소를 사용합니다(RFC 1918).", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "스토리지 계정에서 사용자 지정 도메인(호스트 이름)을 구성할 때 TLS/HTTPS가 필요한지 여부를 확인합니다. 이 경우 저장소 계정 앞에 Azure CDN을 배치해야 할 수 있습니다.", - "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", - "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", + "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", "severity": "높다", - "text": "HTTPS를 적용할 때(HTTP 사용 안 함) 스토리지 계정에 사용자 지정 도메인(CNAME)을 사용하지 않는지 확인합니다.", - "waf": "안전" - }, - { - "checklist": "Azure Blob Storage Review", - "description": "클라이언트가 SAS 토큰을 사용하여 Blob 데이터에 액세스할 때 HTTPS를 요구하면 자격 증명 손실 위험을 최소화하는 데 도움이 됩니다.", - "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", - "service": "Azure Storage", - "severity": "보통", - "text": "SAS(공유 액세스 서명) 토큰을 HTTPS 연결로만 제한", - "waf": "안전" + "text": "IP 주소 공간이 낭비되지 않는지 확인하고 불필요하게 큰 가상 네트워크(예: /16)를 만들지 마세요.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "공연" }, { - "checklist": "Azure Blob Storage Review", - "description": "AAD 토큰은 가능한 경우 공유 액세스 서명보다 우선해야 합니다", - "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", - "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", + "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", + "service": "VNet", "severity": "높다", - "text": "Blob 액세스에 Azure AD(Azure Active Directory) 토큰 사용Use Azure Active Directory (Azure AD) tokens for blob access", - "waf": "안전" + "text": "프로덕션 및 DR 사이트에 겹치는 IP 주소 범위를 사용하지 마십시오.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "신뢰도" }, { - "checklist": "Azure Blob Storage Review", - "description": "사용자, 그룹 또는 응용 프로그램에 역할을 할당할 때 해당 보안 주체가 작업을 수행하는 데 필요한 권한만 부여합니다. 리소스에 대한 액세스를 제한하면 의도하지 않은 데이터 오용과 악의적인 데이터 오용을 모두 방지할 수 있습니다.", - "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", "severity": "보통", - "text": "IaM 권한의 최소 권한", - "waf": "안전" + "text": "Azure에서 이름 확인만 필요한 환경의 경우 이름 확인을 위해 위임된 영역(예: 'azure.contoso.com')을 사용하여 확인을 위해 Azure 프라이빗 DNS를 사용합니다.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "작업" }, { - "checklist": "Azure Blob Storage Review", - "description": "사용자 위임 SAS는 Azure AD(Azure Active Directory) 자격 증명과 SAS에 지정된 권한으로 보호됩니다. 사용자 위임 SAS는 범위와 기능 측면에서 서비스 SAS와 유사하지만 서비스 SAS에 비해 보안상의 이점을 제공합니다. ", - "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", - "service": "Azure Storage", - "severity": "높다", - "text": "SAS를 사용하는 경우 스토리지 계정 키 기반 SAS보다 '사용자 위임 SAS'를 선호합니다.", + "checklist": "Azure Landing Zone Review", + "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", + "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", + "service": "DNS", + "severity": "보통", + "text": "Azure 및 온-프레미스에서 이름 확인이 필요한 환경의 경우 Azure DNS Private Resolver를 사용하는 것이 좋습니다.", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "스토리지 계정 키('공유 키')에는 감사 기능이 거의 없습니다. 누가/언제 키 사본을 가져왔는지 모니터링할 수 있지만, 키가 여러 사람의 손에 들어가면 특정 사용자의 사용을 귀속시키는 것은 불가능합니다. AAD 인증에만 의존하면 스토리지 액세스를 사용자에게 더 쉽게 연결할 수 있습니다. ", - "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", - "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", - "service": "Azure Storage", - "severity": "높다", - "text": "AAD 액세스(및 사용자 위임 SAS)만 지원되도록 스토리지 계정 키를 사용하지 않도록 설정하는 것이 좋습니다.", - "waf": "안전" + "checklist": "Azure Landing Zone Review", + "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", + "severity": "낮다", + "text": "자체 DNS(예: Red Hat OpenShift)를 요구하고 배포하는 특수 워크로드는 선호하는 DNS 솔루션을 사용해야 합니다.", + "waf": "작업" }, { - "checklist": "Azure Blob Storage Review", - "description": "활동 로그 데이터를 사용하여 스토리지 계정의 보안을 보거나 변경하는 '시기', '누가', '무엇을' 및 '방법'(예: 스토리지 계정 키, 액세스 정책 등)을 식별합니다.", - "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", - "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "614658d3-558f-4d77-849b-821112df27ee", + "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", + "service": "DNS", "severity": "높다", - "text": "Azure Monitor를 사용하여 스토리지 계정에 대한 컨트롤 플레인 작업을 감사하는 것이 좋습니다.", - "waf": "안전" + "text": "Azure DNS에 대한 자동 등록을 사용하도록 설정하여 가상 네트워크 내에 배포된 가상 머신에 대한 DNS 레코드의 수명 주기를 자동으로 관리합니다.", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "작업" }, { - "checklist": "Azure Blob Storage Review", - "description": "키 만료 정책을 사용하면 계정 액세스 키 교체에 대한 미리 알림을 설정할 수 있습니다. 지정된 간격이 경과하고 키가 아직 회전되지 않은 경우 알림이 표시됩니다.", - "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "service": "Bastion", "severity": "보통", - "text": "스토리지 계정 키를 사용하는 경우 '키 만료 정책'을 사용하도록 설정하는 것이 좋습니다", + "text": "Azure Bastion을 사용하여 네트워크에 안전하게 연결하는 것이 좋습니다.", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "SAS 만료 정책은 SAS가 유효한 권장 간격을 지정합니다. SAS 만료 정책은 서비스 SAS 또는 계정 SAS에 적용됩니다. 사용자가 권장 간격보다 큰 유효 간격을 사용하여 서비스 SAS 또는 계정 SAS를 생성하면 경고가 표시됩니다.", - "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", - "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", + "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", + "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", + "service": "Bastion", "severity": "보통", - "text": "SAS 만료 정책 구성 고려", + "text": "서브넷 /26 이상에서 Azure Bastion을 사용합니다.", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "저장된 액세스 정책은 스토리지 계정 키를 다시 생성할 필요 없이 서비스 SAS에 대한 권한을 취소하는 옵션을 제공합니다. ", - "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", - "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", - "service": "Azure Storage", + "checklist": "Azure Landing Zone Review", + "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "WAF", "severity": "보통", - "text": "SAS를 저장된 액세스 정책에 연결하는 것이 좋습니다.", + "text": "Azure Front Door 및 WAF 정책을 사용하여 랜딩 존에 대한 인바운드 HTTP/S 연결을 위해 Azure 지역에서 전역 보호를 제공합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", - "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", - "service": "Azure Storage", - "severity": "보통", - "text": "체크 인된 연결 문자열 및 저장소 계정 키를 검색하도록 응용 프로그램의 소스 코드 리포지토리를 구성하는 것이 좋습니다.", + "checklist": "Azure Landing Zone Review", + "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", + "severity": "낮다", + "text": "Azure Front Door 및 Azure Application Gateway를 사용하여 HTTP/S 앱을 보호하는 경우 Azure Front Door에서 WAF 정책을 사용합니다. Azure Front Door에서만 트래픽을 수신하도록 Azure Application Gateway를 잠급니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "이상적으로 애플리케이션은 관리 ID를 사용하여 Azure Storage에 인증해야 합니다. 이렇게 할 수 없는 경우 Azure KeyVault 또는 동등한 서비스에 스토리지 자격 증명(연결 문자열, 스토리지 계정 키, SAS, 서비스 주체 자격 증명)을 사용하는 것이 좋습니다.", - "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", "severity": "높다", - "text": "Azure KeyVault에 연결 문자열을 저장하는 것이 좋습니다(관리 ID를 사용할 수 없는 시나리오에서).", + "text": "WAF 및 기타 역방향 프록시 배포는 인바운드 HTTP/S 연결에 필요하며, 랜딩 존 가상 네트워크 내에 배포하고 보호하고 인터넷에 노출하는 앱과 함께 배포합니다.", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "임시 SAS 서비스 SAS 또는 계정 SAS에서 단기 만료 시간을 사용합니다. 이러한 방식으로 SAS가 손상되더라도 짧은 시간 동안만 유효합니다. 이 방법은 저장된 액세스 정책을 참조할 수 없는 경우에 특히 중요합니다. 또한 단기 만료 시간은 업로드에 사용할 수 있는 시간을 제한하여 Blob에 쓸 수 있는 데이터의 양을 제한합니다.", - "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", "severity": "높다", - "text": "임시 SAS의 유효 기간을 단축하기 위해 노력", - "waf": "안전" - }, - { - "checklist": "Azure Blob Storage Review", - "description": "SAS를 만들 때는 가능한 한 구체적이고 제한적이어야 합니다. 훨씬 더 광범위한 액세스를 제공하는 SAS보다 단일 리소스 및 작업에 대해 SAS를 선호합니다.", - "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", - "severity": "보통", - "text": "SAS에 좁은 범위 적용", + "text": "Azure DDoS 네트워크 또는 IP 보호 계획을 사용하여 가상 네트워크 내에서 공용 IP 주소 엔드포인트를 보호할 수 있습니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "SAS에는 SAS를 사용하여 리소스를 요청할 수 있는 권한이 있는 클라이언트 IP 주소 또는 주소 범위에 대한 매개 변수가 포함될 수 있습니다. ", - "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", - "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", - "service": "Azure Storage", - "severity": "보통", - "text": "가능한 경우 SAS의 범위를 특정 클라이언트 IP 주소로 지정하는 것이 좋습니다", - "waf": "안전" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b034c01e-110b-463a-b36e-e3346e57f225", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "service": "VNet", + "severity": "높다", + "text": "예정된 호환성이 손상되는 변경 전에 네트워크 아웃바운드 트래픽 구성 및 전략을 평가하고 검토합니다. 2025년 9월 30일에 새 배포에 대한 기본 아웃바운드 액세스가 사용 중지되고 명시적 액세스 구성만 허용됩니다", + "waf": "신뢰도" }, { - "checklist": "Azure Blob Storage Review", - "description": "SAS는 클라이언트가 업로드하는 데이터의 양을 제한할 수 없습니다. 시간 경과에 따른 스토리지 양의 가격 책정 모델을 고려할 때 클라이언트가 악의적으로 큰 콘텐츠를 업로드했는지 여부를 확인하는 것이 합리적일 수 있습니다.", - "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", - "service": "Azure Storage", - "severity": "낮다", - "text": "클라이언트가 SAS를 사용하여 파일을 업로드한 후 업로드된 데이터를 확인하는 것이 좋습니다. ", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", + "severity": "높다", + "text": "보호된 모든 공용 IP 주소(DDoS IP 또는 네트워크 보호)에 대한 DDoS 관련 로그를 저장하는 진단 설정을 추가합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "안전" }, { - "checklist": "Azure Blob Storage Review", - "description": "'로컬 사용자 계정'을 사용하여 SFTP를 통해 Blob Storage에 액세스하는 경우 '일반적인' RBAC 컨트롤이 적용되지 않습니다. NFS 또는 REST를 통한 Blob 액세스는 SFTP 액세스보다 더 제한적일 수 있습니다. 안타깝게도 2023년 초부터 로컬 사용자는 현재 SFTP 엔드포인트에 대해 지원되는 유일한 ID 관리 형태입니다", - "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", - "service": "Azure Storage", - "severity": "높다", - "text": "SFTP: SFTP 액세스에 대한 '로컬 사용자'의 수를 제한하고 시간이 지남에 따라 액세스가 필요한지 여부를 감사합니다.", - "waf": "안전" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", + "service": "ExpressRoute", + "severity": "보통", + "text": "ExpressRoute를 Azure에 대한 기본 연결로 사용할 수 있는지 조사했는지 확인합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "공연" }, { - "checklist": "Azure Blob Storage Review", - "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", - "service": "Azure Storage", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "description": "AS-path 접두사 및 연결 가중치를 사용하여 Azure에서 온-프레미스로의 트래픽에 영향을 주고, 자체 라우터의 전체 BGP 특성 범위를 사용하여 온-프레미스에서 Azure로의 트래픽에 영향을 줄 수 있습니다.", + "guid": "f29812b2-363c-4efe-879b-599de0d5973c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", "severity": "보통", - "text": "SFTP: SFTP 엔드포인트는 POSIX와 유사한 ACL을 지원하지 않습니다.", - "waf": "안전" + "text": "여러 ExpressRoute 회로 또는 여러 온-프레미스 위치를 사용하는 경우 특정 경로를 선호하는 경우 BGP 특성을 사용하여 라우팅을 최적화해야 합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "신뢰도" }, { - "checklist": "Azure Blob Storage Review", - "description": "스토리지는 CORS(Cross-Origin Resource Sharing), 즉 다른 도메인의 웹앱이 동일 출처 정책을 완화할 수 있도록 하는 HTTP 기능을 지원합니다. CORS를 사용하도록 설정할 때 CorsRules를 최소 권한으로 유지합니다.", - "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", - "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", - "service": "Azure Storage", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", + "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", + "severity": "보통", + "text": "대역폭 및 성능 요구 사항에 따라 ExpressRoute/VPN 게이트웨이에 적합한 SKU를 사용하고 있는지 확인합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "공연" + }, + { + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", + "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", + "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", + "service": "ExpressRoute", "severity": "높다", - "text": "지나치게 광범위한 CORS 정책 방지", - "waf": "안전" + "text": "비용을 정당화하는 대역폭에 도달하는 경우에만 무제한 데이터 ExpressRoute 회로를 사용해야 합니다.", + "waf": "비용" }, { - "checklist": "Azure Blob Storage Review", - "description": "미사용 데이터는 항상 서버 쪽에서 암호화되며 클라이언트 쪽에서도 암호화될 수 있습니다. 서버 쪽 암호화는 플랫폼 관리형 키(기본값) 또는 고객 관리형 키를 사용하여 발생할 수 있습니다. 클라이언트 쪽 암호화는 클라이언트가 Azure Storage에 Blob별로 암호화/암호 해독 키를 제공하거나 클라이언트 쪽에서 암호화를 완전히 처리하여 발생할 수 있습니다. 따라서 기밀성 보장을 위해 Azure Storage에 전혀 의존하지 않습니다.", - "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "Azure Storage", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", + "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", + "service": "ExpressRoute", "severity": "높다", - "text": "미사용 데이터를 암호화하는 방법을 결정합니다. 데이터에 대한 스레드 모델을 이해합니다.", - "waf": "안전" + "text": "회로의 피어링 위치가 로컬 SKU에 대한 Azure 지역을 지원하는 경우 ExpressRoute의 로컬 SKU를 활용하여 회로 비용을 줄입니다.", + "waf": "비용" }, { - "checklist": "Azure Blob Storage Review", - "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", - "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", - "service": "Azure Storage", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", + "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", + "service": "ExpressRoute", "severity": "보통", - "text": "사용해야 하는 플랫폼 암호화를 결정합니다.", - "waf": "안전" + "text": "지원되는 Azure 지역에 영역 중복 ExpressRoute 게이트웨이를 배포합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "신뢰도" }, { - "checklist": "Azure Blob Storage Review", - "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", - "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", - "service": "Azure Storage", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "service": "ExpressRoute", "severity": "보통", - "text": "사용해야 하는 클라이언트 쪽 암호화를 결정합니다.", - "waf": "안전" + "text": "10Gbps보다 높은 대역폭 또는 전용 10/100Gbps 포트가 필요한 시나리오의 경우 ExpressRoute Direct를 사용합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "공연" }, { - "checklist": "Azure Blob Storage Review", - "description": "Resource Graph Explorer(resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true)를 활용하여 익명 Blob 액세스를 허용하는 스토리지 계정을 찾습니다.", - "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", - "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", - "service": "Azure Storage", - "severity": "높다", - "text": "공용 Blob 액세스가 필요한지 또는 특정 스토리지 계정에 대해 사용하지 않도록 설정할 수 있는지 여부를 고려합니다. ", - "waf": "안전" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", + "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", + "service": "ExpressRoute", + "severity": "보통", + "text": "짧은 대기 시간이 필요하거나 온-프레미스에서 Azure로의 처리량이 10Gbps보다 커야 하는 경우 FastPath를 사용하여 데이터 경로에서 ExpressRoute 게이트웨이를 우회합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", - "service": "AVS", - "severity": "높다", - "text": "ADDS 도메인 컨트롤러가 네이티브 Azure의 ID 구독에 배포되었는지 확인합니다.", - "waf": "안전" + "arm-service": "microsoft.network/vpnGateways", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", + "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", + "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", + "service": "VPN", + "severity": "보통", + "text": "영역 중복 VPN Gateway를 사용하여 분기 또는 원격 위치를 Azure(사용 가능한 경우)에 연결합니다.", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "75089c20-990d-4927-b105-885576f76fc2", - "service": "AVS", + "arm-service": "microsoft.network/vpnGateways", + "checklist": "Azure Landing Zone Review", + "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", + "service": "VPN", "severity": "보통", - "text": "ADDS 사이트 및 서비스가 Azure 기반 리소스(Azure VMware Solution 포함)의 인증 요청을 Azure에 로컬로 유지하도록 구성되어 있는지 확인합니다.", - "waf": "안전" + "text": "온-프레미스에서 중복 VPN 어플라이언스(활성/활성 또는 활성/수동)를 사용합니다.", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", - "service": "AVS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "718cb437-b060-2589-8856-2e93a5c6633b", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", "severity": "높다", - "text": "vCenter가 ADDS에 연결되어 있는지 확인하여 '명명된 사용자 계정'을 기반으로 인증을 사용하도록 설정합니다.", - "waf": "안전" + "text": "ExpressRoute Direct를 사용하는 경우 비용을 절감하기 위해 로컬 Azure 지역에 대한 ExpressRoute 로컬 회로를 사용하는 것이 좋습니다", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "비용" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", + "service": "ExpressRoute", "severity": "보통", - "text": "vCenter에서 ADDS로의 연결이 보안 프로토콜(LDAPS)을 사용하고 있는지 확인합니다.", + "text": "트래픽 격리 또는 전용 대역폭이 필요한 경우(예: 프로덕션 환경과 비프로덕션 환경을 분리하기 위해) 다른 ExpressRoute 회로를 사용합니다. 격리된 라우팅 도메인을 보장하고 시끄러운 이웃 위험을 완화하는 데 도움이 됩니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b30e38c3-f298-412b-8363-cefe179b599d", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", + "service": "ExpressRoute", "severity": "보통", - "text": "vCenter IdP의 CloudAdmin 계정은 긴급 계정으로만 사용됩니다(Break-glass).", - "waf": "안전" + "text": "기본 제공 Express Route Insights를 사용하여 ExpressRoute 가용성 및 사용률을 모니터링합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", - "service": "AVS", - "severity": "높다", - "text": "NSX-Manager가 외부 ID 제공자(LDAPS)와 통합되었는지 확인합니다.", - "waf": "안전" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", + "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", + "service": "ExpressRoute", + "severity": "보통", + "text": "네트워크 전체, 특히 온-프레미스와 Azure 간의 연결을 모니터링하려면 연결 모니터를 사용합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", + "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", + "service": "ExpressRoute", "severity": "보통", - "text": "VMware vSphere에서 사용하기 위해 RBAC 모델이 생성되었습니까?", - "waf": "안전" + "text": "중복성을 위해 서로 다른 피어링 위치의 ExpressRoute 회로를 사용합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", + "service": "ExpressRoute", "severity": "보통", - "text": "RBAC 권한은 특정 사용자가 아닌 ADDS 그룹에 부여해야 합니다", - "waf": "안전" + "text": "특히 단일 ExpressRoute 회로만 사용하는 경우 사이트 간 VPN을 ExpressRoute의 장애 조치(failover)로 사용합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", - "service": "AVS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", + "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", + "service": "ExpressRoute", "severity": "높다", - "text": "Azure의 Azure VMware Solution 리소스에 대한 RBAC 권한은 제한된 소유자 집합으로만 '잠김'됩니다", - "waf": "안전" + "text": "GatewaySubnet에서 경로 테이블을 사용하는 경우 게이트웨이 경로가 전파되었는지 확인합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", - "service": "AVS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "d581a947-69a2-4783-942e-9df3664324c8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", + "service": "ExpressRoute", "severity": "높다", - "text": "모든 사용자 지정 역할의 범위가 CloudAdmin 허용 권한 부여로 지정되었는지 확인합니다.", - "waf": "안전" + "text": "ExpressRoute를 사용하는 경우 온-프레미스 라우팅은 동적이어야 하며, 연결 오류가 발생할 경우 회로의 나머지 연결로 수렴되어야 합니다. 로드는 두 연결 모두에서 이상적으로는 액티브/액티브로 공유되어야 하지만 액티브/패시브도 지원됩니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", - "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", - "service": "AVS", - "severity": "높다", - "text": "현재 고객 사용 사례에 대해 올바른 Azure VMware Solution 연결 모델을 선택했습니까?", - "waf": "공연" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", + "service": "ExpressRoute", + "severity": "보통", + "text": "ExpressRoute 회로의 두 물리적 링크가 네트워크에 있는 두 개의 고유한 에지 디바이스에 연결되어 있는지 확인합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", + "service": "ExpressRoute", + "severity": "보통", + "text": "BFD(Bidirectional Forwarding Detection)가 고객 또는 프로바이더 에지 라우팅 디바이스에서 활성화되고 구성되도록 보장합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "신뢰도" + }, + { + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "ExpressRoute", "severity": "높다", - "text": "'연결 모니터'를 사용하여 온-프레미스에서 Azure로의 ExpressRoute 또는 VPN 연결이 모니터링되는지 확인합니다.", - "waf": "작업" + "text": "복원력을 높이기 위해 서로 다른 피어링 위치에서 둘 이상의 회로에 ExpressRoute 게이트웨이를 연결합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", + "service": "ExpressRoute", "severity": "보통", - "text": "Azure VMware Solution 백 엔드 ExpressRoute 연결을 모니터링하기 위해 Azure 네이티브 리소스에서 Azure VMware Solution 가상 머신으로 연결 모니터가 만들어졌는지 확인합니다.", + "text": "ExpressRoute 가상 네트워크 게이트웨이에 대한 진단 로그 및 경고를 구성합니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "5234c93f-b651-41dd-80c1-234177b91ced", + "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", + "service": "ExpressRoute", "severity": "보통", - "text": "엔드-2-엔드 연결을 모니터링하기 위해 온-프레미스 리소스에서 Azure VMware Solution 가상 머신으로 연결 모니터가 만들어졌는지 확인합니다.", - "waf": "작업" + "text": "VNet 간 통신에 ExpressRoute 회로를 사용하지 마세요.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "severity": "높다", - "text": "경로 서버를 사용하는 경우 경로 서버에서 ExR 게이트웨이로, 온-프레미스로 1,000개 이상의 경로가 전파되지 않도록 합니다(ARS 제한).", - "waf": "작업" + "text": "Azure Firewall을 사용하여 인터넷에 대한 Azure 아웃바운드 트래픽, 비 HTTP/S 인바운드 연결 및 East/West 트래픽 필터링(조직에 필요한 경우)을 제어합니다", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", - "service": "AVS", - "severity": "높다", - "text": "Azure Portal에서 Azure VMware Solution 리소스를 관리하는 역할에 대해 Privileged Identity Management가 구현되어 있나요(고정 권한이 허용되지 않음).", + "checklist": "Azure Landing Zone Review", + "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", + "severity": "보통", + "text": "글로벌 Azure Firewall 정책을 만들어 글로벌 네트워크 환경에서 보안 태세를 제어하고 모든 Azure Firewall 인스턴스에 할당합니다. Azure 역할 기반 액세스 제어를 통해 증분 방화벽 정책을 로컬 보안 팀에 위임하여 특정 지역의 요구 사항을 충족하는 세분화된 정책을 허용합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", - "service": "AVS", - "severity": "높다", - "text": "Azure VMware Solution PIM 역할에 대해 Privileged Identity Management 감사 보고를 구현해야 합니다.", + "checklist": "Azure Landing Zone Review", + "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", + "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", + "service": "Firewall", + "severity": "낮다", + "text": "조직에서 이러한 솔루션을 사용하여 아웃바운드 연결을 보호하려는 경우 Firewall Manager 내에서 지원되는 파트너 SaaS 보안 공급자를 구성합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", - "service": "AVS", - "severity": "보통", - "text": "Privileged Identity Management를 사용하는 경우 Azure VMware Solution 자동 호스트 교체 알림에 대한 유효한 SMTP 레코드를 사용하여 유효한 Entra ID 사용 계정을 만들었는지 확인합니다. (상시 권한 필요)", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", + "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", + "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", + "service": "Firewall", + "severity": "높다", + "text": "FQDN 기반 네트워크 규칙 및 DNS 프록시와 함께 Azure Firewall을 사용하여 애플리케이션 규칙에서 지원하지 않는 프로토콜을 통해 인터넷으로의 송신 트래픽을 필터링합니다.", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", + "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", "severity": "높다", - "text": "CloudAdmin 계정 사용을 긴급 액세스로만 제한", + "text": "추가 보안 및 보호를 위해 Azure Firewall 프리미엄을 사용합니다.", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", - "service": "AVS", - "severity": "보통", - "text": "vCenter에서 사용자 지정 RBAC 역할을 만들어 vCenter 내에서 최소 권한 모델 구현", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", + "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", + "severity": "높다", + "text": "추가 보호를 위해 Azure Firewall 위협 인텔리전스 모드를 경고 및 거부로 구성합니다.", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", - "service": "AVS", - "severity": "보통", - "text": "cloudadmin(vCenter) 및 admin(NSX) 자격 증명을 정기적으로 순환하도록 정의된 프로세스입니다.", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", + "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", + "service": "Firewall", + "severity": "높다", + "text": "추가 보호를 위해 Azure Firewall IDPS 모드를 거부로 구성합니다.", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", + "guid": "a3784907-9836-4271-aafc-93535f8ec08b", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "service": "Firewall", "severity": "높다", - "text": "Azure VMware Solution에서 실행되는 워크로드(VM)에 사용할 중앙 집중식 ID 공급자 사용", + "text": "Virtual WAN에 연결되지 않은 VNet의 서브넷의 경우 인터넷 트래픽이 Azure Firewall 또는 네트워크 가상 어플라이언스로 리디렉션되도록 경로 테이블을 연결합니다", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "715d833d-4708-4527-90ac-1b142c7045ba", + "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", + "service": "Firewall", "severity": "보통", - "text": "NSX-T 내에서 East-West 트래픽 필터링이 구현되었는지 여부", - "waf": "안전" + "text": "모든 Azure Firewall 배포에 대해 리소스별 대상 테이블을 사용하여 로그를 저장하는 진단 설정을 추가합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", - "service": "AVS", - "severity": "높다", - "text": "Azure VMware Solution의 워크로드는 인터넷에 직접 노출되지 않습니다. 트래픽은 Azure Application Gateway, Azure Firewall 또는 제3자 솔루션에 의해 필터링되고 검사됩니다", - "waf": "안전" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", + "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", + "service": "Firewall", + "severity": "중요하다", + "text": "Azure Firewall 클래식 규칙(있는 경우)에서 방화벽 정책으로 마이그레이션합니다.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", + "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", + "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", + "service": "Firewall", "severity": "높다", - "text": "감사 및 로깅은 Azure VMware Solution 및 Azure VMware Solution 기반 워크로드에 대한 인바운드 인터넷 요청에 대해 구현됩니다", - "waf": "안전" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", - "service": "AVS", - "severity": "보통", - "text": "세션 모니터링은 의심스러운/악의적인 활동을 식별하기 위해 Azure VMware Solution 또는 Azure VMware Solution 기반 워크로드의 아웃바운드 인터넷 연결에 대해 구현됩니다", + "text": "Azure Firewall 서브넷에 /26 접두사를 사용합니다.", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "334fdf91-c234-4182-a652-75269440b4be", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", + "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", + "service": "Firewall", "severity": "보통", - "text": "Azure의 ExR/VPN Gateway 서브넷에서 DDoS 표준 보호를 사용할 수 있나요?", - "waf": "안전" + "text": "방화벽 정책 내의 규칙을 Rule Collection Groups(규칙 컬렉션 그룹) 및 Rule Collections(규칙 컬렉션)로 정렬하고 사용 빈도에 따라 정렬합니다", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", + "link": "https://learn.microsoft.com/azure/firewall/ip-groups", + "service": "Firewall", "severity": "보통", - "text": "전용 PAW(Privileged Access Workstation)를 사용하여 Azure VMware Solution, vCenter, NSX Manager 및 HCX Manager 관리", - "waf": "안전" + "text": "IP 그룹 또는 IP 접두사를 사용하여 IP 테이블 규칙 수 줄이기", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", + "service": "Firewall", "severity": "보통", - "text": "Azure VMware Solution에서 실행되는 워크로드에 대해 Advanced Threat Detection(클라우드용 Microsoft Defender 또는 ASC) 사용", - "waf": "안전" + "text": "와일드카드를 DNAT의 소스 IP로 사용하지 않으려면 * 또는 any와 같이 수신 DNAT에 대한 소스 IP를 지정해야 합니다", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", + "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", + "service": "Firewall", "severity": "보통", - "text": "서버용 Azure ARC를 사용하여 Azure 네이티브 기술을 사용하여 Azure VMware Solution에서 실행되는 워크로드를 적절하게 제어합니다(Azure VMware Solution용 Azure ARC는 아직 사용할 수 없음).", - "waf": "안전" + "text": "SNAT 포트 사용량을 모니터링하고, NAT 게이트웨이 설정을 평가하고, 원활한 장애 조치(failover)를 보장하여 SNAT 포트 소모를 방지합니다. 포트 수가 제한에 가까워지면 SNAT 소모가 임박했다는 신호입니다.", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", - "service": "AVS", - "severity": "낮다", - "text": "Azure VMware Solution의 워크로드가 런타임 중에 충분한 데이터 암호화(예: 게스트 내 디스크 암호화 및 SQL TDE)를 사용하는지 확인합니다. (vSAN 미사용 암호화가 기본값임)", - "waf": "안전" + "checklist": "Azure Landing Zone Review", + "guid": "346840b8-1064-496e-8396-4b1340172d52", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", + "service": "Firewall", + "severity": "높다", + "text": "TLS 검사 활성화", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a3592718-e6e2-4051-9267-6ae46691e883", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", + "service": "Firewall", "severity": "낮다", - "text": "게스트 내 암호화를 사용하는 경우 가능한 경우 Azure Key Vault에 암호화 키를 저장합니다", - "waf": "안전" + "text": "웹 범주를 사용하여 특정 주제에 대한 아웃바운드 액세스를 허용하거나 거부할 수 있습니다.", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5ac94222-3e13-4810-9230-81a941741583", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", + "service": "Firewall", "severity": "보통", - "text": "Azure VMware Solution에서 실행되는 워크로드에 대해 확장된 보안 업데이트 지원을 사용하는 것이 좋습니다(Azure VMware Solution은 ESU에 적합함).", - "waf": "안전" + "text": "TLS 검사의 일환으로 검사를 위해 Azure App Gateway에서 트래픽을 수신하도록 계획합니다.", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", - "service": "AVS", - "severity": "높다", - "text": "적절한 vSAN 데이터 이중화 방법이 사용되는지 확인합니다(RAID 규격).", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "service": "Firewall", + "severity": "보통", + "text": "Azure Firewall DNS 프록시 구성 사용 ", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d88408f3-7273-44c8-96ba-280214590146", - "service": "AVS", - "severity": "높다", - "text": "vSAN 스토리지 요구 사항을 충족하기 위해 장애 허용 정책이 적용되어 있는지 확인합니다", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", + "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", + "service": "Firewall", + "severity": "보통", + "text": "Virtual Machines에 직접 연결된 공용 IP 주소를 거부하는 정책 할당이 있는지 확인합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", - "service": "AVS", - "severity": "높다", - "text": "충분한 할당량을 요청했는지 확인하고 성장 및 재해 복구 요구 사항을 고려했는지 확인합니다", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "service": "Firewall", + "severity": "낮다", + "text": "Azure Firewall을 Azure Monitor와 통합하고 진단 로깅을 사용하도록 설정하여 방화벽 로그를 저장하고 분석합니다.", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", - "service": "AVS", - "severity": "보통", - "text": "ESXi에 대한 액세스 제약 조건을 이해하고 타사 솔루션에 영향을 줄 수 있는 액세스 제한이 있는지 확인합니다.", + "checklist": "Azure Landing Zone Review", + "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", + "severity": "낮다", + "text": "방화벽 규칙에 대한 백업 구현", "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", - "service": "AVS", - "severity": "보통", - "text": "새 노드 요청에 대한 리드 타임을 염두에 두고 ESXi 호스트 밀도 및 효율성에 대한 정책이 있는지 확인합니다", - "waf": "작업" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "App Gateway", + "severity": "높다", + "text": "가상 네트워크에 삽입된 Azure PaaS 서비스에 대한 컨트롤 플레인 통신이 중단되지 않았는지 확인합니다(예: 0.0.0.0/0 경로 또는 컨트롤 플레인 트래픽을 차단하는 NSG 규칙).", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "ExpressRoute", "severity": "보통", - "text": "Azure VMware Solution에 대한 적절한 비용 관리 프로세스가 있는지 확인 - Azure Cost Management를 사용할 수 있습니다.", - "waf": "비용" + "text": "프라이빗 엔드포인트 및 ExpressRoute 프라이빗 피어링을 통해 온-프레미스에서 Azure PaaS 서비스에 액세스합니다. 이 방법을 사용하면 공용 인터넷을 통한 전송을 방지할 수 있습니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", - "service": "AVS", - "severity": "낮다", - "text": "Azure VMware Solution 사용 비용을 최적화하는 데 사용되는 Azure 예약 인스턴스입니까?", - "waf": "비용" + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", + "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "VNet", + "severity": "보통", + "text": "모든 서브넷에서 기본적으로 가상 네트워크 서비스 엔드포인트를 사용하도록 설정하지 마세요.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6691e883-5ac9-4422-83e1-3810523081a9", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "severity": "보통", - "text": "다른 Azure 네이티브 서비스를 사용할 때 Azure Private-Link 사용 고려", + "text": "데이터 반출을 방지하기 위해 Azure Firewall 또는 NVA의 IP 주소 대신 FQDN을 사용하여 Azure PaaS 서비스에 대한 송신 트래픽을 필터링합니다. Private Link를 사용하는 경우 모든 FQDN을 차단할 수 있으며, 그렇지 않으면 필요한 PaaS 서비스만 허용할 수 있습니다.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", - "service": "AVS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", + "service": "ExpressRoute", "severity": "높다", - "text": "필요한 모든 리소스가 동일한 Azure 가용성 영역 내에 있는지 확인합니다.", - "waf": "공연" + "text": "게이트웨이 서브넷에 /27 이상의 접두사를 사용합니다", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", + "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", + "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", + "service": "NSG", "severity": "보통", - "text": "Azure VMware Solution 게스트 VM 워크로드에 대해 클라우드용 Microsoft Defender 사용", + "text": "VirtualNetwork 서비스 태그를 사용하여 연결을 제한하는 NSG 인바운드 기본 규칙을 사용하지 마세요.", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", + "service": "NSG", "severity": "보통", - "text": "Azure Arc 지원 서버를 사용하여 Azure VMware Solution 게스트 VM 워크로드 관리", + "text": "NSG를 사용하여 서브넷 간의 트래픽과 플랫폼 전체의 East/West 트래픽(랜딩 존 간 트래픽)을 보호할 수 있습니다.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", - "service": "AVS", - "severity": "높다", - "text": "Azure VMware Solution에서 진단 및 메트릭 로깅 사용Enable Diagnostic and metric logging on Azure VMware Solution", - "waf": "작업" + "checklist": "Azure Landing Zone Review", + "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", + "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", + "service": "NSG", + "severity": "보통", + "text": "애플리케이션 팀은 서브넷 수준 NSG에서 애플리케이션 보안 그룹을 사용하여 랜딩 존 내의 다중 계층 VM을 보호해야 합니다.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "severity": "보통", - "text": "Azure VMware Solution 게스트 VM 워크로드에 Log Analytics 에이전트 배포", - "waf": "작업" + "text": "NSG 및 애플리케이션 보안 그룹을 사용하여 랜딩 존 내에서 트래픽을 마이크로 세그먼트화하고 중앙 NVA를 사용하여 트래픽 흐름을 필터링하지 않도록 합니다.", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "589d457a-927c-4397-9d11-02cad6aae11e", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "dfe237de-143b-416c-91d7-aa9b64704489", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "severity": "보통", - "text": "Azure VMware Solution VM 워크로드에 대한 백업 정책 및 솔루션을 문서화하고 구현했는지 확인합니다.", - "waf": "작업" + "text": "VNet 흐름 로그를 사용하도록 설정하고 트래픽 분석에 제공하여 내부 및 외부 트래픽 흐름에 대한 인사이트를 얻습니다.", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ee29711b-d352-4caa-ab79-b198dab81932", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", + "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "NSG", "severity": "보통", - "text": "클라우드용 Microsoft Defender를 사용하여 Azure VMware Solution에서 실행되는 워크로드의 규정 준수 모니터링", - "waf": "안전" + "text": "NSG당 NSG 규칙의 제한(1000)을 고려합니다.", + "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", - "service": "AVS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", + "service": "VWAN", "severity": "보통", - "text": "적용 가능한 규정 준수 기준이 클라우드용 Microsoft Defender에 추가되었나요?", - "waf": "안전" + "text": "간소화된 Azure 네트워킹 관리를 위해 Virtual WAN을 고려하고 시나리오가 Virtual WAN 라우팅 디자인 목록에 명시적으로 설명되어 있는지 확인합니다", + "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", - "service": "AVS", - "severity": "높다", - "text": "Azure VMware Solution 배포에 사용할 Azure 지역을 선택할 때 데이터 보존이 평가되었나요?", - "waf": "안전" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "보통", + "text": "Azure 지역당 Virtual WAN 허브를 사용하여 공통 글로벌 Azure Virtual WAN을 통해 Azure 지역 간에 여러 랜딩 존을 함께 연결합니다.", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", - "service": "AVS", - "severity": "높다", - "text": "데이터 처리의 영향(서비스 제공자/서비스 소비자 모델)이 명확하고 문서화되어 있습니까?", - "waf": "안전" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "낮다", + "text": "Azure의 리소스 간 통신이 Microsoft 백본 네트워크를 통해 발생하도록 'Azure의 트래픽은 Azure에 유지' 원칙에 따라", + "waf": "공연" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "547c1747-dc56-4068-a714-435cd19dd244", - "service": "AVS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", + "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "severity": "보통", - "text": "규정 준수를 위해 필요한 경우에만 vSAN에 CMK(고객 관리 키)를 사용하는 것이 좋습니다.", + "text": "아웃바운드 인터넷 트래픽 보호 및 필터링을 위해 보안 허브에 Azure Firewall을 배포합니다", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", - "service": "AVS", - "severity": "높다", - "text": "핵심 Azure VMware Solution 모니터링 인사이트를 사용하도록 설정하는 대시보드 만들기", - "waf": "작업" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "VWAN", + "severity": "보통", + "text": "네트워크 아키텍처가 Azure Virtual WAN 제한 내에 있는지 확인합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", - "service": "AVS", - "severity": "높다", - "text": "Azure VMware Solution 성능에 대한 자동 경고에 대한 중요 임계값에 대한 경고 만들기(CPU >80%, 평균 메모리>80%, vSAN>70%)", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", + "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", + "service": "VWAN", + "severity": "보통", + "text": "Virtual WAN용 Azure Monitor Insights를 사용하여 Virtual WAN의 엔드투엔드 토폴로지, 상태 및 주요 메트릭을 모니터링합니다.", "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9659e396-80e7-4828-ac93-5657d02bff45", - "service": "AVS", - "severity": "높다", - "text": "VMware의 지원 임계값이므로 vSAN 사용량이 75% 미만인지 모니터링하기 위해 중요한 경고가 생성되었는지 확인합니다.", - "waf": "작업" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", + "service": "VWAN", + "severity": "보통", + "text": "이러한 흐름을 명시적으로 차단해야 하는 경우가 아니면 IaC 배포가 Virtual WAN에서 분기 간 트래픽을 사용하지 않도록 설정하지 않는지 확인합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", - "service": "AVS", - "severity": "높다", - "text": "Azure Service Health 경고 및 알림에 대해 경고가 구성되었는지 확인", - "waf": "작업" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", + "service": "VWAN", + "severity": "보통", + "text": "AS-Path는 ExpressRoute 또는 VPN보다 유연하므로 허브 라우팅 기본 설정으로 사용합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", - "service": "AVS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", + "service": "VWAN", "severity": "보통", - "text": "처리를 위해 Azure Storage 계정 또는 Azure EventHub로 보내도록 Azure VMware Solution 로깅 구성", - "waf": "작업" + "text": "IaC 배포가 Virtual WAN에서 레이블 기반 전파를 구성하는지 확인하며, 그렇지 않으면 가상 허브 간의 연결이 손상됩니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", - "service": "AVS", - "severity": "낮다", - "text": "VMware vSphere에 대한 심층적인 통찰력이 필요한 경우: 솔루션에서 vRealize Operations 및/또는 vRealize Network Insights가 사용됩니까?", - "waf": "작업" + "ammp": true, + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "9c75dfef-573c-461c-a698-68598595581a", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", + "service": "VWAN", + "severity": "높다", + "text": "가상 허브에 충분한 IP 공간(이상적으로는 /23 접두사)을 할당합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "높다", - "text": "VM에 대한 vSAN 스토리지 정책은 씩 프로비저닝을 적용하므로 기본 스토리지 정책이 아닌지 확인합니다.", - "waf": "작업" + "text": "Azure Policy를 전략적으로 활용하고, 정책 이니셔티브를 사용하여 관련 정책을 그룹화하고, 환경에 대한 컨트롤을 정의합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "보통", - "text": "vSAN은 유한한 리소스이므로 vSphere 컨텐츠 라이브러리가 vSAN에 배치되지 않도록 합니다.", - "waf": "작업" + "text": "규정 및 규정 준수 요구 사항을 Azure Policy 정의 및 Azure 역할 할당에 매핑합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "223ace8c-b123-408c-a501-7f154e3ab369", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "보통", - "text": "백업 솔루션에 대한 데이터 저장소가 vSAN 스토리지 외부에 저장되어 있는지 확인합니다. Azure 네이티브 또는 디스크 풀 지원 데이터 저장소에서", - "waf": "작업" + "text": "상속된 범위에서 할당할 수 있도록 중간 루트 관리 그룹에서 Azure Policy 정의를 설정합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "3829e7e3-1618-4368-9a04-77a209945bda", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "보통", - "text": "Azure VMware Solution에서 실행되는 워크로드가 서버용 Azure Arc를 사용하여 하이브리드 관리되는지 확인합니다(Arc for Azure VMware Solution은 미리 보기 상태임).", - "waf": "작업" + "text": "필요한 경우 최하위 수준에서 제외를 사용하여 가장 적절한 수준에서 정책 할당을 관리합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", - "service": "AVS", - "severity": "보통", - "text": "Azure Log Analytics 및 Azure Monitor를 사용하여 Azure VMware Solution에서 실행되는 워크로드를 모니터링하는지 확인합니다.", - "waf": "작업" + "checklist": "Azure Landing Zone Review", + "guid": "43334f24-9116-4341-a2ba-527526944008", + "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", + "service": "Policy", + "severity": "낮다", + "text": "Azure Policy를 사용하여 사용자가 구독/관리 그룹 수준에서 프로비전할 수 있는 서비스 제어", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "보통", - "text": "기존 업데이트 관리 도구 또는 Azure 업데이트 관리에 Azure VMware Solution에서 실행되는 워크로드 포함", - "waf": "작업" + "text": "가능한 경우 기본 제공 정책을 사용하여 운영 오버헤드를 최소화합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "description": "특정 범위에 Resource Policy Contributor 역할을 할당하면 관련 팀에 정책 관리를 위임할 수 있습니다. 예를 들어 중앙 IT 팀은 관리 그룹 수준 정책을 감독하고 응용 프로그램 팀은 구독에 대한 정책을 처리하여 조직 표준을 준수하는 분산 거버넌스를 가능하게 할 수 있습니다.", + "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", + "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", + "service": "Policy", "severity": "보통", - "text": "Azure Policy를 사용하여 Azure 관리, 모니터링 및 보안 솔루션에서 Azure VMware Solution 워크로드 온보딩", - "waf": "작업" + "text": "특정 범위에서 기본 제공 Resource Policy 기여자 역할을 할당하여 응용 프로그램 수준 거버넌스를 사용하도록 설정합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "19048384-5c98-46cb-8913-156a12476e49", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "보통", - "text": "Azure VMware Solution에서 실행되는 워크로드가 클라우드용 Microsoft Defender에 온보딩되었는지 확인", + "text": "상속된 범위에서 제외를 통해 관리하지 않도록 루트 관리 그룹 범위에서 수행된 Azure Policy 할당 수를 제한합니다.", "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", + "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", + "service": "Policy", "severity": "보통", - "text": "vSAN은 유한한 리소스이므로 백업이 vSAN에 저장되지 않도록 합니다.", - "waf": "신뢰도" + "text": "데이터 주권 요구 사항이 있는 경우 Azure Policy를 배포하여 적용할 수 있습니다", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", + "service": "Policy", "severity": "보통", - "text": "모든 DR 솔루션을 고려하고 비즈니스에 가장 적합한 솔루션을 결정했습니까? [SRM/제트스트림/제르토/빔/...]", - "waf": "신뢰도" + "text": "Sovereign Landing Zone의 경우 주권 정책 기준의 정책 이니셔티브가 배포되고 올바른 MG 수준에서 할당됩니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", + "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", + "service": "Policy", "severity": "보통", - "text": "재해 복구 기술이 네이티브 Azure IaaS인 경우 Azure Site Recovery 사용Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", - "waf": "신뢰도" + "text": "Sovereign Landing Zone의 경우 정책 매핑에 대한 주권 제어 목표가 문서화되어 있습니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", - "service": "AVS", - "severity": "높다", - "text": "재해 솔루션 중 하나와 함께 자동화된 복구 계획을 사용하고 가능한 한 수동 작업을 피하십시오.", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", + "service": "Policy", + "severity": "보통", + "text": "Sovereign Landing Zone의 경우 '정책 매핑에 대한 Sovereign Control 목표'의 CRUD에 대한 프로세스가 마련되어 있습니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8255461e-2aee-4345-9aec-8339248b262d", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "severity": "보통", - "text": "지정학적 지역 쌍을 보조 재해 복구 환경으로 사용Use the geopolitical region pair as the secondary disaster recovery environment", - "waf": "신뢰도" + "text": "Azure RBAC(Azure 역할 기반 액세스 제어), 데이터 주권 요구 사항 또는 데이터 보존 정책에 별도의 작업 영역이 필요한 경우를 제외하고 단일 모니터 로그 작업 영역을 사용하여 플랫폼을 중앙에서 관리합니다.", + "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", - "service": "AVS", - "severity": "높다", - "text": "지역 간에 2개의 서로 다른 주소 공간을 사용합니다(예: 서로 다른 지역에 대해 10.0.0.0/16 및 192.168.0.0/16).", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Monitor", + "severity": "보통", + "text": "로그 보존 요구 사항이 12년을 초과하는 경우 로그를 Azure Storage로 내보냅니다. 변경 불가능한 스토리지를 한 번 쓰기, 여러 번 읽기 정책과 함께 사용하여 사용자가 지정한 간격 동안 데이터를 지우거나 수정할 수 없도록 합니다.", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", - "service": "AVS", - "severity": "보통", - "text": "ExpressRoute Global Reach는 기본 및 보조 Azure VMware Solution 프라이빗 클라우드 간의 연결에 사용되나요, 아니면 네트워크 가상 어플라이언스를 통해 라우팅이 수행되나요?", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", + "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", + "service": "VM", + "severity": "보통", + "text": "Azure Policy를 사용하여 OS 수준 VM(가상 머신) 구성 드리프트를 모니터링합니다. 정책을 통해 Azure Automanage Machine Configuration 감사 기능을 사용하도록 설정하면 애플리케이션 팀 워크로드가 적은 노력으로 기능 기능을 즉시 사용할 수 있습니다.", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "severity": "보통", - "text": "모든 백업 솔루션을 고려하고 비즈니스에 가장 적합한 솔루션을 결정했습니까? [ MABS/CommVault/Metallic.io/Veeam/입니다. ]", - "waf": "신뢰도" + "text": "Azure에서 Windows 및 Linux VM에 대한 패치 메커니즘으로 Azure Update Manager를 사용합니다.", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "severity": "보통", - "text": "Azure VMware Solution 프라이빗 클라우드와 동일한 지역에 백업 솔루션 배포Deploy your backup solution in the same region as your Azure VMware Solution private cloud", - "waf": "신뢰도" + "text": "Azure Arc를 사용하여 Azure 외부의 Windows 및 Linux VM에 대한 패치 메커니즘으로 Azure Update Manager를 사용합니다.", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "90483845-c986-4cb2-a131-56a12476e49f", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Network Watcher", "severity": "보통", - "text": "vSan의 외부, Azure 네이티브 구성 요소에 백업 솔루션 배포", - "waf": "신뢰도" + "text": "Network Watcher를 사용하여 트래픽 흐름을 사전에 모니터링", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", - "service": "AVS", - "severity": "낮다", - "text": "Azure 플랫폼에서 관리하는 VMware 구성 요소의 복원을 요청하는 프로세스가 마련되어 있나요?", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Monitor", + "severity": "보통", + "text": "인사이트 및 보고를 위해 Azure Monitor 로그를 사용합니다.", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", - "service": "AVS", - "severity": "낮다", - "text": "수동 배포의 경우 모든 구성 및 배포를 문서화해야 합니다", + "checklist": "Azure Landing Zone Review", + "guid": "97be9951-9048-4384-9c98-6cb2913156a1", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", + "service": "Monitor", + "severity": "보통", + "text": "Azure Monitor 경고를 사용하여 운영 경고를 생성합니다.", "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", - "service": "AVS", - "severity": "낮다", - "text": "수동 배포의 경우 Azure VMware Solution 프라이빗 클라우드에서 실수로 인한 작업을 방지하기 위해 리소스 잠금을 구현하는 것이 좋습니다", + "checklist": "Azure Landing Zone Review", + "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "Monitor", + "severity": "보통", + "text": "Azure Automation 계정을 통해 변경 및 인벤토리 추적을 사용하는 경우 Log Analytics 작업 영역과 자동화 계정을 함께 연결하기 위해 지원되는 지역을 선택했는지 확인합니다.", "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", - "service": "AVS", - "severity": "낮다", - "text": "자동화된 배포의 경우 최소한의 프라이빗 클라우드를 배포하고 필요에 따라 확장합니다", - "waf": "작업" + "checklist": "Azure Landing Zone Review", + "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Backup", + "severity": "보통", + "text": "Azure Backup을 사용하는 경우 기본 설정은 GRS이므로 다양한 백업 유형(GRS, ZRS & LRS)을 고려합니다", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", - "service": "AVS", - "severity": "낮다", - "text": "자동화된 배포의 경우 배포를 시작하기 전에 할당량을 요청하거나 예약합니다", - "waf": "작업" + "checklist": "Azure Landing Zone Review", + "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "VM", + "severity": "보통", + "text": "Azure 정책을 사용하여 VM 확장을 통해 소프트웨어 구성을 자동으로 배포하고 규격 기준 VM 구성을 적용합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", - "service": "AVS", - "severity": "낮다", - "text": "자동화된 배포의 경우 적절한 거버넌스를 위해 자동화 또는 Azure Policy를 통해 관련 리소스 잠금을 만들어야 합니다", - "waf": "작업" + "checklist": "Azure Landing Zone Review", + "description": "Azure Policy의 게스트 구성 기능은 컴퓨터 설정(예: OS, 애플리케이션, 환경)을 감사하고 수정하여 리소스가 예상 구성에 맞는지 확인할 수 있으며, 업데이트 관리는 VM에 대한 패치 관리를 적용할 수 있습니다.", + "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "VM", + "severity": "보통", + "text": "Azure Policy를 통해 VM 보안 구성 드리프트를 모니터링합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", - "service": "AVS", - "severity": "낮다", - "text": "ExR 인증 키에 대해 사람이 이해할 수 있는 이름을 구현하여 키의 목적/용도를 쉽게 식별할 수 있습니다.", + "checklist": "Azure Landing Zone Review", + "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", + "severity": "보통", + "text": "Azure-Azure Virtual Machines 재해 복구 시나리오에 Azure Site Recovery를 사용합니다. 이렇게 하면 지역 간에 워크로드를 복제할 수 있습니다.", "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "255461e2-aee3-4553-afc8-339248b262d6", - "service": "AVS", - "severity": "낮다", - "text": "Azure VMware Solution 및 ExpressRoute를 배포하는 데 별도의 서비스 원칙을 사용하는 경우 Key Vault를 사용하여 비밀 및 권한 부여 키를 저장합니다", + "checklist": "Azure Landing Zone Review", + "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "Backup", + "severity": "보통", + "text": "Azure 네이티브 백업 기능 또는 Azure 호환 제3자 백업 솔루션을 사용합니다.", "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", - "service": "AVS", - "severity": "낮다", - "text": "Azure VMware Solution은 제한된 수의 병렬 작업만 지원하므로 많은 리소스를 Azure VMware Solution 배포해야 하는 경우 IaC에서 작업을 직렬화하기 위한 리소스 종속성을 정의합니다.", - "waf": "작업" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", + "severity": "높다", + "text": "VM이 지원되는 지역에서 VM에 대한 가용성 영역을 활용합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", - "service": "AVS", - "severity": "낮다", - "text": "단일 Tier-1 게이트웨이를 사용하여 NSX-T 세그먼트의 자동화된 구성을 수행하는 경우 NSX-Manager API 대신 Azure Portal API를 사용합니다", - "waf": "작업" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", + "severity": "높다", + "text": "단일 VM에서 프로덕션 워크로드를 실행하지 마세요.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "84101f59-1941-4195-a270-e28034290e3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", "severity": "보통", - "text": "자동화된 스케일 아웃을 사용하려는 경우 Azure VMware Solution을 실행하는 구독에 대해 충분한 Azure VMware Solution 할당량을 적용해야 합니다", - "waf": "공연" + "text": "Azure Load Balancer 및 Application Gateway는 들어오는 네트워크 트래픽을 여러 리소스에 분산합니다.", + "waf": "신뢰도" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", - "service": "AVS", - "severity": "보통", - "text": "자동 축소를 사용하려는 경우 이러한 작업을 수행하기 전에 스토리지 정책 요구 사항을 고려해야 합니다", - "waf": "공연" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "WAF", + "severity": "높다", + "text": "Azure Front Door 및 Azure Application Gateway와 같은 애플리케이션 배달 서비스에서 WAF 로그를 저장하는 진단 설정을 추가합니다. 로그를 정기적으로 검토하여 공격 및 가양성 탐지를 확인합니다.", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "7f408960-c626-44cb-a018-347c8d790cdf", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "WAF", "severity": "보통", - "text": "한 번에 하나의 크기 조정 작업만 수행할 수 있으므로 크기 조정 작업은 항상 단일 SDDC 내에서 직렬화되어야 합니다(여러 클러스터를 사용하는 경우에도)", - "waf": "공연" + "text": "Azure Front Door 및 Azure Application Gateway와 같은 애플리케이션 배달 서비스에서 Microsoft Sentinel로 WAF 로그를 보냅니다. 공격을 감지하고 WAF 원격 분석을 전체 Azure 환경에 통합합니다.", + "waf": "작업" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "5017f154-e3ab-4369-9829-e7e316183687", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "Key Vault", + "severity": "높다", + "text": "Azure Key Vault를 사용하여 비밀 및 자격 증명 저장", + "waf": "안전" + }, + { + "checklist": "Azure Landing Zone Review", + "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", + "guid": "a0477a20-9945-4bda-9333-4f2491163418", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", + "service": "Key Vault", "severity": "보통", - "text": "아키텍처에 사용되는 제3자 솔루션에 대한 확장 작업을 고려하고 검증합니다(지원 여부)Consider and validate scaling operations on 3rd party solutions used in the architecture (supported or not)", - "waf": "공연" + "text": "다양한 애플리케이션 및 지역에 대해 서로 다른 Azure Key Vault를 사용하여 트랜잭션 규모 제한을 방지하고 비밀에 대한 액세스를 제한합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "보통", - "text": "자동화에서 환경에 대한 규모 확장/축소 최대 한도 정의 및 적용Define and enforce scale in/out maximum limits for your environment in the automations", - "waf": "공연" + "text": "삭제된 개체에 대한 보존 보호를 허용하기 위해 일시 삭제 및 제거 정책을 사용하도록 설정된 Azure Key Vault를 프로비전합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "dc055bcf-619e-48a1-9f98-879525d62688", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "보통", - "text": "모니터링 규칙을 구현하여 자동화된 조정 작업을 모니터링하고 성공 및 실패를 모니터링하여 적절한(자동) 응답을 사용하도록 설정합니다.", - "waf": "작업" + "text": "키, 비밀 및 인증서를 영구적으로 삭제할 수 있는 권한 부여를 특수 사용자 지정 Microsoft Entra ID 역할로 제한하여 최소 권한 모델을 따릅니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", - "severity": "높다", - "text": "MON을 사용하는 경우 동시에 구성된 VM의 제한(HCX에 대한 MON 제한[400 - 표준, 1000 - 대형 어플라이언스])을 알고 있어야 합니다.", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "보통", + "text": "공용 인증 기관을 통해 인증서 관리 및 갱신 프로세스를 자동화하여 관리를 용이하게 합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", - "severity": "높다", - "text": "MON을 사용하는 경우 100개 이상의 네트워크 확장에서 MON을 사용하도록 설정할 수 없습니다", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "913156a1-2476-4e49-b541-acdce979377b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "보통", + "text": "키 및 인증서 교체를 위한 자동화된 프로세스를 설정합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "보통", - "text": "마이그레이션에 VPN 연결을 사용하는 경우 그에 따라 MTU 크기를 조정합니다.", - "waf": "공연" + "text": "자격 증명 모음에서 방화벽 및 가상 네트워크 서비스 엔드포인트 또는 프라이빗 엔드포인트를 사용하도록 설정하여 키 자격 증명 모음에 대한 액세스를 제어합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e614658d-d457-4e92-9139-b821102cad6e", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", + "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", + "service": "Key Vault", "severity": "보통", - "text": "Azure(500Mbps 이하)에 연결하는 낮은 연결 지역의 경우 HCX WAN 최적화 어플라이언스 배포를 고려합니다.", - "waf": "공연" + "text": "플랫폼 중앙 Azure Monitor Log Analytics 작업 영역을 사용하여 Key Vault의 각 인스턴스 내에서 키, 인증서 및 비밀 사용을 감사합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "보통", - "text": "마이그레이션이 클라우드 어플라이언스가 아닌 온-프레미스 어플라이언스에서 시작되는지 확인합니다(역방향 마이그레이션을 수행하지 않음).", - "waf": "신뢰도" + "text": "Key Vault 인스턴스화 및 권한 있는 액세스를 위임하고 Azure Policy를 사용하여 일관된 규정 준수 구성을 적용합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "91163418-2ba5-4275-8694-4008be7d7e48", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "보통", - "text": "Azure NetApp Files를 사용하여 Azure VMware Solution용 스토리지를 확장하는 경우 VM에 직접 연결하는 대신 VMware 데이터 저장소로 사용하는 것이 좋습니다.", - "waf": "신뢰도" + "text": "애플리케이션, 환경, 지역당 Azure Key Vault를 사용합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "25d62688-6d70-4ba6-a97b-e99519048384", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "보통", - "text": "전용 ExpressRoute 게이트웨이가 외부 데이터 스토리지 솔루션에 사용되고 있는지 확인합니다.", - "waf": "신뢰도" + "text": "자체 키를 가져오려는 경우 고려되는 모든 서비스에서 지원되지 않을 수 있습니다. 불일치가 원하는 결과를 방해하지 않도록 관련 완화를 구현합니다. 대기 시간을 최소화하는 적절한 지역 쌍과 재해 복구 지역을 선택합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", + "link": "https://learn.microsoft.com/industry/sovereignty/key-management", + "service": "Key Vault", "severity": "보통", - "text": "외부 데이터 스토리지 솔루션에 사용되는 ExpressRoute 게이트웨이에서 FastPath를 사용하도록 설정되어 있는지 확인합니다.", - "waf": "신뢰도" + "text": "Sovereign Landing Zone의 경우 Azure Key Vault 관리형 HSM을 사용하여 비밀 및 자격 증명을 저장합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "AVS", - "severity": "높다", - "text": "확장된 클러스터를 사용하는 경우 선택한 재해 복구 솔루션이 공급업체에서 지원되는지 확인합니다", - "waf": "신뢰도" + "checklist": "Azure Landing Zone Review", + "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", + "service": "Entra", + "severity": "보통", + "text": "Microsoft Entra ID 보고 기능을 사용하여 액세스 제어 감사 보고서를 생성합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "09945bda-4333-44f2-9911-634182ba5275", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", + "service": "Defender", "severity": "높다", - "text": "확장된 클러스터를 사용하는 경우 제공된 SLA가 요구 사항을 충족하는지 확인합니다", - "waf": "신뢰도" + "text": "모든 구독에 대해 Defender 클라우드 보안 태세 관리를 사용하도록 설정합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", + "service": "Defender", "severity": "높다", - "text": "확장된 클러스터를 사용하는 경우 두 ExpressRoute 회로가 모두 연결 허브에 연결되어 있는지 확인합니다.", - "waf": "신뢰도" + "text": "모든 구독에서 서버에 대한 Defender 클라우드 워크로드 보호 계획을 사용하도록 설정합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", + "service": "Defender", "severity": "높다", - "text": "확장된 클러스터를 사용하는 경우 두 ExpressRoute 회로 모두에서 GlobalReach를 사용하도록 설정되어 있는지 확인합니다.", - "waf": "신뢰도" + "text": "모든 구독에서 Azure 리소스에 대한 Defender 클라우드 워크로드 보호 계획을 사용하도록 설정합니다.", + "waf": "안전" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", + "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", + "service": "VM", "severity": "높다", - "text": "사이트 재해 허용 범위 설정을 적절하게 고려하고 필요한 경우 비즈니스에 맞게 변경하십시오.", - "waf": "신뢰도" - }, - { - "checklist": "Azure Spring Apps Review", - "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", - "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", - "service": "Spring Apps", - "severity": "보통", - "text": "Azure Spring Apps는 모든 앱에 대해 두 개의 배포를 허용하며, 그 중 하나만 프로덕션 트래픽을 수신합니다. 블루-그린 배포 전략을 통해 가동 중지 시간 제로를 달성할 수 있습니다. 파란색 녹색 배포는 표준 및 엔터프라이즈 계층에서만 사용할 수 있습니다. ADO/GitHub 작업과 함께 CI/CD를 사용하여 배포를 자동화할 수 있습니다.", - "waf": "신뢰도" + "text": "IaaS 서버에서 Endpoint Protection을 사용하도록 설정합니다.", + "waf": "안전" }, { - "checklist": "Azure Spring Apps Review", - "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", - "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", + "link": "https://learn.microsoft.com/azure/security-center/", + "service": "VM", "severity": "보통", - "text": "Azure Spring Apps 인스턴스는 애플리케이션에 대해 여러 지역에서 만들 수 있으며 Traffic Manager/Front Door에서 트래픽을 라우팅할 수 있습니다.", - "waf": "신뢰도" + "text": "Azure Monitor 로그 및 클라우드용 Defender를 통해 기본 운영 체제 패치 드리프트를 모니터링합니다.", + "waf": "안전" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", - "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "severity": "보통", - "text": "지원되는 지역에서 Azure Spring Apps는 영역 중복으로 배포할 수 있으며, 이는 인스턴스가 가용성 영역에 자동으로 분산됨을 의미합니다. 이 기능은 Standard 및 Enterprise 계층에서만 사용할 수 있습니다.", - "waf": "신뢰도" + "text": "기본 리소스 구성을 중앙 집중식 Azure Monitor Log Analytics 작업 영역에 연결합니다.", + "waf": "안전" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", - "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", + "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", + "service": "Entra", "severity": "보통", - "text": "앱에 1개 이상의 앱 인스턴스 사용", - "waf": "신뢰도" + "text": "Sovereign Landing Zone의 경우 Entra ID 테넌트에서 투명 로그가 사용하도록 설정됩니다.", + "waf": "안전" }, { - "checklist": "Azure Spring Apps Review", - "guid": "7504c230-6035-4183-95a5-85762acc6075", - "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", + "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", + "service": "Entra", "severity": "보통", - "text": "로그, 메트릭 및 추적을 사용하여 Azure Spring Apps를 모니터링합니다. ASA를 Application Insights와 통합하고, 오류를 추적하고, 통합 문서를 만듭니다.", - "waf": "신뢰도" + "text": "Sovereign Landing Zone의 경우 Entra ID 테넌트에서 고객 Lockbox를 사용할 수 있습니다.", + "waf": "안전" }, { - "checklist": "Azure Spring Apps Review", - "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", - "service": "Spring Apps", - "severity": "보통", - "text": "Spring Cloud Gateway에서 자동 크기 조정 설정", - "waf": "신뢰도" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Storage", + "severity": "높다", + "text": "스토리지 계정에 대한 보안 전송을 사용하도록 설정해야 함", + "waf": "안전" }, { - "checklist": "Azure Spring Apps Review", - "guid": "97411607-b6fd-4335-99d1-9885faf4e392", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", - "service": "Spring Apps", - "severity": "낮다", - "text": "표준 소비 및 전용 플랜이 있는 앱에 대해 자동 크기 조정을 사용하도록 설정합니다.", - "waf": "신뢰도" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", + "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", + "service": "Storage", + "severity": "높다", + "text": "스토리지 계정에 대해 컨테이너 일시 삭제를 사용하도록 설정하여 삭제된 컨테이너와 해당 콘텐츠를 복구합니다.", + "waf": "안전" }, { - "checklist": "Azure Spring Apps Review", - "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", - "link": "https://learn.microsoft.com/azure/spring-apps/overview", - "service": "Spring Apps", - "severity": "보통", - "text": "중요 업무용 앱에 대한 Spring Boot의 상업적 지원을 위해 Enterprise 플랜을 사용합니다. 다른 계층에서는 OSS 지원을 받을 수 있습니다.", - "waf": "신뢰도" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", + "service": "Key Vault", + "severity": "높다", + "text": "Key Vault 비밀을 사용하여 자격 증명(가상 머신 사용자 암호), 인증서 또는 키와 같은 중요한 정보를 하드 코딩하지 않도록 합니다.", + "waf": "작업" } ], "metadata": { "name": "WAF checklist", - "timestamp": "June 17, 2024" + "timestamp": "June 24, 2024" }, "severities": [ { diff --git a/checklists/waf_checklist.pt.json b/checklists/waf_checklist.pt.json index 2b82884ea..b5c689c53 100644 --- a/checklists/waf_checklist.pt.json +++ b/checklists/waf_checklist.pt.json @@ -1,762 +1,532 @@ { "items": [ { - "checklist": "Logic Apps checklist", - "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", - "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", - "service": "Logic Apps", - "severity": "Alto", - "text": "Selecione o plano de hospedagem de aplicativo lógico certo com base em seus requisitos de negócios e SLO", + "checklist": "MySQL Review Checklist", + "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", + "service": "Azure MySQL", + "severity": "Média", + "text": "Aproveite o servidor flexível", "waf": "Fiabilidade" }, { - "checklist": "Logic Apps checklist", - "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", - "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "Logic Apps", + "checklist": "MySQL Review Checklist", + "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", + "service": "Azure MySQL", "severity": "Alto", - "text": "Proteja aplicativos lógicos contra falhas de região com redundância de zona e zonas de disponibilidade", + "text": "Aproveite as zonas de disponibilidade quando aplicável regionalmente", "waf": "Fiabilidade" }, { - "checklist": "Logic Apps checklist", - "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", - "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Logic Apps", - "severity": "Alto", - "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas", + "checklist": "MySQL Review Checklist", + "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", + "service": "Azure MySQL", + "severity": "Média", + "text": "Aproveite a replicação de dados para cenários de DR entre regiões", "waf": "Fiabilidade" }, { - "checklist": "Logic Apps checklist", - "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", - "link": "https://learn.microsoft.com/azure/app-service/environment/intro", - "service": "Logic Apps", - "severity": "Alto", - "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3", - "waf": "Fiabilidade" + "checklist": "Cost Optimization Checklist", + "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "service": "Azure Monitor", + "text": "Regras de coleta de dados no Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "Custar" }, { - "checklist": "Logic Apps checklist", - "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", - "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", - "service": "Logic Apps", - "severity": "Média", - "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código de Aplicativo Lógico", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "45901365-d38e-443f-abcb-d868266abca2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Azure Backup", + "text": "Verificar instâncias de backup com a fonte de dados subjacente não encontrada", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Aplicar as orientações do benchmark de segurança na nuvem da Microsoft relacionadas ao armazenamento", - "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", - "service": "Azure Storage", - "severity": "Média", - "text": "Considere a 'linha de base de segurança do Azure para armazenamento'", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "VM", + "text": "Excluir ou arquivar serviços não associados (discos, nics, endereços IP etc.)", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "O Armazenamento do Azure, por padrão, tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem expor com segurança o Armazenamento do Azure apenas aos recursos de Computação do Azure que precisam de acesso, eliminando assim a exposição à Internet pública", - "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", - "service": "Azure Storage", - "severity": "Alto", - "text": "Considere o uso de pontos de extremidade privados para o Armazenamento do Azure", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Azure Backup", + "text": "Considere um bom equilíbrio entre recuperação de local, armazenamento e backup para aplicativos não essenciais", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "As contas de armazenamento recém-criadas são criadas usando o modelo de implantação ARM, para que o RBAC, a auditoria, etc., estejam todos habilitados. Verifique se não há contas de armazenamento antigas com modelo de implantação clássico em uma assinatura", - "guid": "30e37c3e-2971-41b2-963c-eee079b598de", - "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", - "service": "Azure Storage", - "severity": "Média", - "text": "Verifique se as contas de armazenamento mais antigas não estão usando o 'modelo de implantação clássico'", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", + "service": "Azure Monitor", + "text": "Verifique os gastos e as oportunidades de economia entre os 40 diferentes espaços de trabalho de análise de log - use retenção e coleta de dados diferentes para espaços de trabalho não prod - crie limite diário para reconhecimento e dimensionamento de camadas - Se você definir um limite diário, além de criar um alerta quando o limite for atingido, certifique-se de também criar uma regra de alerta para ser notificado quando alguma porcentagem for atingida (90%, por exemplo). - considerar a transformação do espaço de trabalho, se possível - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Aproveite o Microsoft Defender para saber mais sobre atividades suspeitas e configurações incorretas.", - "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", - "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", - "service": "Azure Storage", - "severity": "Alto", - "text": "Habilitar o Microsoft Defender para todas as suas contas de armazenamento", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Azure Monitor", + "text": "Impor uma política de log de limpeza e automação (se necessário, os logs podem ser movidos para armazenamento frio)", + "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "O mecanismo soft-delete permite recuperar blobs excluídos acidentalmente.", - "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", - "service": "Azure Storage", - "severity": "Média", - "text": "Ativar 'exclusão suave' para blobs", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "VM", + "text": "Verifique se os discos são realmente necessários, se não: excluir. Se forem necessários, encontre níveis de armazenamento mais baixos ou use backup -", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo tiver que garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ", - "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", - "severity": "Média", - "text": "Desativar 'exclusão suave' para blobs", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "d1e44a19-659d-4395-afd7-7289b835556d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Storage", + "text": "Considere mover o armazenamento não utilizado para o nível inferior, com regra personalizada - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "A exclusão suave para contêineres permite que você recupere um contêiner depois que ele tenha sido excluído, por exemplo, recuperar de uma operação de exclusão acidental.", - "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", - "service": "Azure Storage", - "severity": "Alto", - "text": "Ativar 'exclusão suave' para contêineres", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "VM", + "text": "Verifique se o Advisor está configurado para o dimensionamento correto da VM ", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo tiver que garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ", - "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", - "severity": "Média", - "text": "Desativar 'exclusão suave' para contêineres", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "description": "verifique pesquisando as Licenças de Categoria de Medidor na Análise de Custos", + "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", + "service": "VM", + "text": "executar o script em todas as VMs do Windows https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- considere implementar uma diretiva se as VMs do Windows forem criadas com frequência", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Evita a exclusão acidental de uma conta de armazenamento, forçando o usuário a remover primeiro o bloqueio de exclusão, antes da exclusão", - "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", - "severity": "Alto", - "text": "Habilitar bloqueios de recursos em contas de armazenamento", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "VM", + "text": " isso também pode ser colocado no AHUB se você já tiver licenças https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Considere políticas de \"retenção legal\" ou \"retenção baseada em tempo\" para blobs, de modo que seja impossível excluir o blob, o contêiner ou a conta de armazenamento. Por favor, note que \"impossível\" significa na verdade \"impossível\"; uma vez que uma conta de armazenamento contém um blob imutável, a única maneira de 'se livrar' dessa conta de armazenamento é cancelando a assinatura do Azure.", - "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", - "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", - "service": "Azure Storage", - "severity": "Alto", - "text": "Considere blobs imutáveis", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "VM", + "text": "Consolidar famílias de VM reservadas com opção de flexibilidade (não mais do que 4-5 famílias)", + "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Considere desabilitar o acesso HTTP/80 desprotegido à conta de armazenamento, para que todas as transferências de dados sejam criptografadas, protegidas por integridade e o servidor seja autenticado. ", - "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Azure Storage", - "severity": "Alto", - "text": "Exigir HTTPS, ou seja, desativar a porta 80 na conta de armazenamento", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", + "service": "VM", + "text": "Utilize instâncias reservadas do Azure: esse recurso permite reservar VMs por um período de 1 ou 3 anos, proporcionando uma economia significativa em comparação com os preços do PAYG.", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Ao configurar um domínio personalizado (nome do host) em uma conta de armazenamento, verifique se você precisa de TLS/HTTPS; em caso afirmativo, talvez seja necessário colocar a CDN do Azure na frente da sua conta de armazenamento.", - "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", - "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", - "service": "Azure Storage", - "severity": "Alto", - "text": "Ao impor HTTPS (desabilitando HTTP), verifique se você não usa domínios personalizados (CNAME) para a conta de armazenamento.", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "VM", + "text": "Somente discos maiores podem ser reservados => 1 TiB -", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Exigir HTTPS quando um cliente usa um token SAS para acessar dados de blob ajuda a minimizar o risco de perda de credenciais.", - "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", - "service": "Azure Storage", - "severity": "Média", - "text": "Limitar tokens de assinatura de acesso compartilhado (SAS) somente a conexões HTTPS", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", + "service": "VM", + "text": "Após a otimização do dimensionamento correto", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Os tokens AAD devem ser favorecidos em relação às assinaturas de acesso compartilhado, sempre que possível", - "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", - "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", - "service": "Azure Storage", - "severity": "Alto", - "text": "Usar tokens do Azure Active Directory (Azure AD) para acesso de blob", - "waf": "Segurança" - }, - { - "checklist": "Azure Blob Storage Review", - "description": "Ao atribuir uma função a um usuário, grupo ou aplicativo, conceda a essa entidade de segurança apenas as permissões necessárias para que eles executem suas tarefas. Limitar o acesso aos recursos ajuda a evitar o uso indevido não intencional e mal-intencionado de seus dados.", - "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", - "service": "Azure Storage", - "severity": "Média", - "text": "Privilégio mínimo nas permissões do IaM", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Azure SQL", + "text": "Verifique se aplicável e aplique a política/alteração https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Uma SAS de delegação de usuário é protegida com credenciais do Azure Active Directory (Azure AD) e também pelas permissões especificadas para a SAS. Uma SAS de delegação de usuário é análoga a uma SAS de serviço em termos de escopo e função, mas oferece benefícios de segurança em relação à SAS de serviço. ", - "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", - "service": "Azure Storage", - "severity": "Alto", - "text": "Ao usar o SAS, prefira o SAS de delegação de usuário ao SAS baseado em chave de conta de armazenamento.", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "VM", + "text": "O desconto da peça de licença VM + (ahub + 3YRI) é de cerca de 70% de desconto", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "As chaves de conta de armazenamento ('chaves compartilhadas') têm pouquíssimos recursos de auditoria. Embora possa ser monitorado em quem/quando foi obtida uma cópia das chaves, uma vez que as chaves estão nas mãos de várias pessoas, é impossível atribuir o uso a um usuário específico. Depender exclusivamente da autenticação do AAD facilita a vinculação do acesso ao armazenamento a um usuário. ", - "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", - "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", - "service": "Azure Storage", - "severity": "Alto", - "text": "Considere desabilitar as chaves de conta de armazenamento, para que somente o acesso ao AAD (e a delegação de usuários SAS) seja suportado.", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "VM", + "text": "Considere o uso de um VMSS para corresponder à demanda em vez de dimensionamento simples", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Use os dados do Registro de atividades para identificar \"quando\", \"quem\", \"o que\" e \"como\" a segurança da sua conta de armazenamento está sendo visualizada ou alterada (ou seja, chaves de conta de armazenamento, políticas de acesso, etc.).", - "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", - "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", - "service": "Azure Storage", - "severity": "Alto", - "text": "Considere usar o Azure Monitor para auditar as operações do plano de controle na conta de armazenamento", - "waf": "Segurança" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Cost Optimization Checklist", + "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "AKS", + "text": "Use o autoscaler AKS para corresponder ao uso de clusters (verifique se os requisitos dos pods correspondem ao dimensionador)", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Uma política de expiração de chave permite que você defina um lembrete para a rotação das chaves de acesso da conta. O lembrete será exibido se o intervalo especificado tiver decorrido e as teclas ainda não tiverem sido giradas.", - "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", - "service": "Azure Storage", - "severity": "Média", - "text": "Ao usar chaves de conta de armazenamento, considere habilitar uma 'política de expiração de chave'", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Azure Backup", + "text": "Mover pontos de recuperação para o vault-archive, quando aplicável (Validar)", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Uma diretiva de expiração SAS especifica um intervalo recomendado sobre o qual a SAS é válida. As políticas de expiração do SAS se aplicam a um SAS de serviço ou a um SAS de conta. Quando um usuário gera SAS de serviço ou SAS de conta com um intervalo de validade maior do que o intervalo recomendado, ele verá um aviso.", - "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", - "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", - "service": "Azure Storage", - "severity": "Média", - "text": "Considere configurar uma política de expiração SAS", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", + "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", + "service": "Databricks", + "text": "Considere o uso de VMs spot com fallback sempre que possível. Considere o autotermination de clusters.", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "As políticas de acesso armazenado oferecem a opção de revogar permissões para uma SAS de serviço sem precisar gerar novamente as chaves da conta de armazenamento. ", - "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", - "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", - "service": "Azure Storage", - "severity": "Média", - "text": "Considere vincular o SAS a uma política de acesso armazenado", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", + "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", + "service": "Azure Functions", + "text": "Funções - Reutilizar conexões", + "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", - "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", - "service": "Azure Storage", - "severity": "Média", - "text": "Considere configurar o repositório de código-fonte do aplicativo para detectar cadeias de conexão com check-in e chaves de conta de armazenamento.", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "service": "Azure Functions", + "text": "Funções - Armazenar dados em cache localmente", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Idealmente, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Armazenamento do Azure. Se isso não for possível, considere ter a credencial de armazenamento (cadeia de conexão, chave de conta de armazenamento, SAS, credencial da entidade de serviço) no Azure KeyVault ou em um serviço equivalente.", - "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", - "service": "Azure Storage", - "severity": "Alto", - "text": "Considere armazenar cadeias de conexão no Cofre de Chaves do Azure (em cenários em que identidades gerenciadas não são possíveis)", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Azure Functions", + "text": "Funções - Partidas a frio - Use a funcionalidade 'Executar do pacote'. Dessa forma, o código é baixado como um único arquivo zip. Isso pode, por exemplo, resultar em melhorias significativas com as funções Javascript, que possuem muitos módulos de nó. Use ferramentas específicas de linguagem para reduzir o tamanho do pacote, por exemplo, aplicativos Javascript que agitam árvores.", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Use tempos de expiração de curto prazo em um SAS de serviço SAS ad hoc ou SAS de conta. Dessa forma, mesmo que um SAS seja comprometido, ele é válido apenas por um curto período de tempo. Essa prática é especialmente importante se você não puder fazer referência a uma política de acesso armazenado. Os tempos de expiração de curto prazo também limitam a quantidade de dados que podem ser gravados em um blob, limitando o tempo disponível para carregar nele.", - "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", - "severity": "Alto", - "text": "Esforce-se por curtos períodos de validade para SAS ad-hoc", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "Azure Functions", + "text": "Funções - Mantenha suas funções aquecidas", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Ao criar um SAS, seja o mais específico e restritivo possível. Prefira um SAS para um único recurso e operação em vez de um SAS que dá acesso muito mais amplo.", - "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", - "severity": "Média", - "text": "Aplicar um escopo restrito a uma SAS", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Azure Functions", + "text": "Ao usar o dimensionamento automático com funções diferentes, pode haver um que conduza todo o dimensionamento automático para todos os recursos - considere movê-lo para um plano de consumo separado (e considere um plano mais alto para a CPU)", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Uma SAS pode incluir parâmetros nos quais endereços IP de cliente ou intervalos de endereços estão autorizados a solicitar um recurso usando a SAS. ", - "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", - "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", - "service": "Azure Storage", - "severity": "Média", - "text": "Considere a definição do escopo do SAS para um endereço IP de cliente específico, sempre que possível", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", + "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", + "service": "Azure Functions", + "text": "Os aplicativos de função em um determinado plano são todos dimensionados juntos, portanto, quaisquer problemas com o dimensionamento podem afetar todos os aplicativos no plano.", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Um SAS não pode restringir a quantidade de dados que um cliente carrega; Dado o modelo de precificação da quantidade de armazenamento ao longo do tempo, pode fazer sentido validar se os clientes carregaram conteúdo maliciosamente grande.", - "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", - "service": "Azure Storage", - "severity": "Baixo", - "text": "Considere verificar os dados carregados, depois que os clientes usaram um SAS para carregar um arquivo. ", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", + "service": "Azure Functions", + "text": "Sou cobrado por 'tempo de espera'? Essa pergunta geralmente é feita no contexto de uma função C# que faz uma operação assíncrona e aguarda o resultado, por exemplo, aguardar Task.Delay(1000) ou aguardar cliente. GetAsync('http://google.com'). A resposta é sim - o segundo cálculo de GB é baseado na hora de início e término da função e no uso de memória durante esse período. O que realmente acontece ao longo desse tempo em termos de atividade da CPU não é levado em consideração no cálculo. Uma exceção a essa regra é se você estiver usando funções duráveis. Você não é cobrado pelo tempo gasto em espera em funções de orquestrador.aplique técnicas de modelagem de demanda sempre que possível (ambientes de desenvolvimento?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Ao acessar o armazenamento de blob via SFTP usando uma 'conta de usuário local', os controles RBAC 'normais' não se aplicam. O acesso a blobs via NFS ou REST pode ser mais restritivo do que o acesso a SFTP. Infelizmente, no início de 2023, os usuários locais são a única forma de gerenciamento de identidade que atualmente é suportada para o ponto de extremidade SFTP", - "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", - "service": "Azure Storage", - "severity": "Alto", - "text": "SFTP: Limite a quantidade de 'usuários locais' para acesso SFTP e audite se o acesso é necessário ao longo do tempo.", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Front Door", + "text": "Frontdoor - Desativar a página inicial padrãoNas configurações do aplicativo do seu aplicativo, defina AzureWebJobsDisableHomepage como true. Isso retornará um 204 (Sem Conteúdo) para o PoP para que apenas os dados de cabeçalho sejam retornados.", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", - "service": "Azure Storage", - "severity": "Média", - "text": "SFTP: O ponto de extremidade SFTP não oferece suporte a ACLs do tipo POSIX.", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Front Door", + "text": "Frontdoor - Rota para algo que não retorna nada. Configure uma Função, Proxy de Função ou adicione uma rota em seu WebApp que retorne 200 (OK) e envie conteúdo nulo ou mínimo. A vantagem disso é que você poderá fazer logout quando for chamado.", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "O armazenamento oferece suporte a CORS (Cross-Origin Resource Sharing), ou seja, um recurso HTTP que permite que aplicativos Web de um domínio diferente afrouxem a política de mesma origem. Ao habilitar o CORS, mantenha o CorsRules com o menor privilégio.", - "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", - "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", - "service": "Azure Storage", - "severity": "Alto", - "text": "Evite políticas CORS excessivamente amplas", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", + "service": "Storage", + "text": "Considere níveis de arquivamento para dados menos usados", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Os dados em repouso são sempre criptografados no lado do servidor e, além disso, também podem ser criptografados no lado do cliente. A criptografia do lado do servidor pode acontecer usando uma chave gerenciada por plataforma (padrão) ou uma chave gerenciada pelo cliente. A criptografia do lado do cliente pode acontecer fazendo com que o cliente forneça uma chave de criptografia/descriptografia por blob para o armazenamento do Azure ou manipulando completamente a criptografia no lado do cliente. portanto, não depende do Armazenamento do Azure para garantias de confidencialidade.", - "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "Azure Storage", - "severity": "Alto", - "text": "Determine como os dados em repouso devem ser criptografados. Entenda o modelo de thread para dados.", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "VM", + "text": "Verifique os tamanhos de disco em que o tamanho não corresponde à camada (ou seja, um disco de 513 GiB pagará um P30 (1TiB) e considere o redimensionamento", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", - "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", - "service": "Azure Storage", - "severity": "Média", - "text": "Determine qual/se a criptografia de plataforma deve ser usada.", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "Storage", + "text": "Considere usar SSD padrão em vez de Premium ou Ultra sempre que possível", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", - "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", - "service": "Azure Storage", - "severity": "Média", - "text": "Determine qual/se a criptografia do lado do cliente deve ser usada.", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "Storage", + "text": "Para contas de armazenamento, verifique se a camada escolhida não está somando encargos de transação (pode ser mais barato passar para a próxima camada)", + "waf": "Custar" }, { - "checklist": "Azure Blob Storage Review", - "description": "Aproveite o Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para localizar contas de armazenamento que permitem acesso anônimo a blobs.", - "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", - "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", - "service": "Azure Storage", - "severity": "Alto", - "text": "Considere se o acesso de blob público é necessário ou se pode ser desabilitado para determinadas contas de armazenamento. ", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "Site Recovery", + "text": "Para ASR, considere o uso de discos SSD padrão se o RPO/RTO e a taxa de transferência de replicação permitirem", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", - "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", - "service": "APIM", - "severity": "Média", - "text": "Implementar uma política de tratamento de erros em nível global", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", + "service": "Storage", + "text": "Contas de armazenamento: verifique o hot tier e/ou o GRS necessário", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", - "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", - "service": "APIM", - "severity": "Média", - "text": "Certifique-se de que todas as políticas de APIs incluam um elemento .", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "VM", + "text": "Discos - valide o uso de discos SSD Premium em todos os lugares: por exemplo, não-prod pode trocar para SSD padrão ou SSD Premium sob demanda ", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", - "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", - "service": "APIM", - "severity": "Média", - "text": "Usar fragmentos de política para evitar a repetição das mesmas definições de políticas em várias APIs", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "Synapse", + "text": "Crie orçamentos para gerenciar custos e crie alertas que notifiquem automaticamente as partes interessadas sobre anomalias de gastos e riscos de gastos excessivos.", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", - "link": "https://learn.microsoft.com/azure/api-management/monetization-support", - "service": "APIM", - "severity": "Média", - "text": "Se você estiver planejando monetizar suas APIs, consulte o artigo 'suporte à monetização' para obter as práticas recomendadas", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "Synapse", + "text": "Exporte dados de custo para uma conta de armazenamento para análise de dados adicionais.", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", - "service": "APIM", - "severity": "Alto", - "text": "Habilitar Configurações de Diagnóstico para exportar logs para o Azure Monitor", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Synapse", + "text": "Controle os custos de um pool SQL dedicado pausando o recurso quando ele não estiver em uso.", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", - "service": "APIM", - "severity": "Média", - "text": "Habilite o Application Insights para telemetria mais detalhada", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", + "service": "Synapse", + "text": "Habilite o recurso de pausa automática do Apache Spark sem servidor e defina seu valor de tempo limite de acordo.", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", - "service": "APIM", - "severity": "Alto", - "text": "Configurar alertas sobre as métricas mais críticas", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Synapse", + "text": "Crie várias definições de pool do Apache Spark de vários tamanhos.", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", - "service": "APIM", - "severity": "Alto", - "text": "Certifique-se de que os certificados SSL personalizados sejam armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "service": "Synapse", + "text": "Adquira unidades de confirmação (SCU) do Azure Synapse por um ano com um plano de pré-compra para economizar nos custos do Azure Synapse Analytics.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", - "service": "APIM", - "severity": "Alto", - "text": "Proteger solicitações de entrada para APIs (plano de dados) com o Azure AD", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "VM", + "text": "Usar VMs spot para trabalhos interruptíveis: são VMs que podem ser licitadas e compradas a um preço com desconto, fornecendo uma solução econômica para cargas de trabalho não críticas.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", - "service": "APIM", - "severity": "Média", - "text": "Usar o Microsoft Entra ID para autenticar usuários no Portal do Desenvolvedor", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "544451e1-92d3-4442-a3c7-628637a551c5", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", + "text": "Dimensionamento correto de todas as VMs", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", - "service": "APIM", - "severity": "Média", - "text": "Criar grupos apropriados para controlar a visibilidade dos produtos", - "waf": "Segurança" + "checklist": "Cost Optimization Checklist", + "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "VM", + "text": "Trocar VM dimensionada com tamanhos normalizados e mais recentes", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "06862505-2d9a-4874-9491-2837b00a3475", - "link": "https://learn.microsoft.com/azure/api-management/backends", - "service": "APIM", - "severity": "Média", - "text": "Use o recurso Back-ends para eliminar configurações redundantes de back-end de API", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "VMs de dimensionamento correto - comece com o monitoramento do uso abaixo de 5% e, em seguida, trabalhe até 40%", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", - "service": "APIM", - "severity": "Média", - "text": "Usar Valores Nomeados para armazenar valores comuns que podem ser usados em políticas", - "waf": "Operações" + "checklist": "Cost Optimization Checklist", + "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "A conteinerização de um aplicativo pode melhorar a densidade da VM e economizar dinheiro no dimensionamento", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Custar" }, { - "checklist": "Azure API Management Review", - "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", - "service": "APIM", - "severity": "Média", - "text": "Para DR, aproveite o nível premium com implantações dimensionadas em duas ou mais regiões para um SLA de 99,99%", + "checklist": "Azure Function Review", + "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "severity": "Alto", + "text": "Selecione o plano de hospedagem de função certo com base em seus requisitos de negócios e SLO", "waf": "Fiabilidade" }, { - "checklist": "Azure API Management Review", - "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", - "link": "https://learn.microsoft.com/azure/api-management/high-availability", - "service": "APIM", + "checklist": "Azure Function Review", + "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "severity": "Alto", + "text": "Aproveitar zonas de disponibilidade quando aplicável regionalmente (não disponível para a camada de consumo)", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure Function Review", + "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", + "service": "Azure Functions", "severity": "Média", - "text": "Implante pelo menos uma unidade em duas ou mais zonas de disponibilidade para um SLA aumentado de 99,99%", + "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas", "waf": "Fiabilidade" }, { - "checklist": "Azure API Management Review", - "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", - "service": "APIM", + "checklist": "Azure Function Review", + "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Azure Functions", "severity": "Alto", - "text": "Verifique se há uma rotina de backup automatizada", + "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3", "waf": "Fiabilidade" }, { - "checklist": "Azure API Management Review", - "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", - "link": "https://learn.microsoft.com/azure/api-management/retry-policy", - "service": "APIM", - "severity": "Média", - "text": "Use Políticas para adicionar uma URL de back-end de failover e cache para reduzir chamadas com falha.", + "checklist": "Azure Function Review", + "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "Azure Functions", + "severity": "Alto", + "text": "Verifique se 'Sempre Ativado' está habilitado para todos os Aplicativos de Função em execução no Plano do Serviço de Aplicativo", "waf": "Fiabilidade" }, { - "checklist": "Azure API Management Review", - "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", - "service": "APIM", - "severity": "Baixo", - "text": "Se você precisar registrar em níveis de alto desempenho, considere a política de Hubs de Eventos", - "waf": "Operações" - }, - { - "checklist": "Azure API Management Review", - "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", - "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", - "service": "APIM", - "severity": "Média", - "text": "Aplicar políticas de limitação para controlar o número de solicitações por segundo", - "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", - "waf": "Desempenho" - }, - { - "checklist": "Azure API Management Review", - "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", - "service": "APIM", - "severity": "Média", - "text": "Configurar o dimensionamento automático para dimensionar o número de instâncias quando a carga aumenta", - "waf": "Desempenho" - }, - { - "checklist": "Azure API Management Review", - "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", - "service": "APIM", - "severity": "Média", - "text": "Implante gateways auto-hospedados onde o Azure não tem uma região próxima às APIs de back-end.", - "waf": "Desempenho" - }, - { - "checklist": "Azure API Management Review", - "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", - "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", - "service": "APIM", + "checklist": "Azure Function Review", + "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", + "service": "Azure Functions", "severity": "Média", - "text": "Use a camada premium para cargas de trabalho de produção.", + "text": "Emparelhe um aplicativo de função com sua própria conta de armazenamento. Tente não reutilizar contas de armazenamento para aplicativos de função, a menos que eles estejam firmemente acoplados", "waf": "Fiabilidade" }, { - "checklist": "Azure API Management Review", - "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", - "service": "APIM", + "checklist": "Azure Function Review", + "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "Azure Functions", "severity": "Média", - "text": "No modelo de várias regiões, use Políticas para rotear as solicitações para back-ends regionais com base na disponibilidade ou latência.", - "waf": "Fiabilidade" - }, - { - "checklist": "Azure API Management Review", - "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", - "service": "APIM", - "severity": "Alto", - "text": "Esteja atento aos limites da APIM", - "waf": "Fiabilidade" + "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código do Aplicativo de Função", + "waf": "Operações" }, { - "checklist": "Azure API Management Review", - "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", - "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", - "service": "APIM", + "checklist": "Redis Resiliency checklist", + "guid": "65285269-440b-44be-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", + "service": "Redis", "severity": "Alto", - "text": "Certifique-se de que as implantações de gateway auto-hospedado sejam resilientes.", + "text": "Habilite a redundância de zona para o Cache do Azure para Redis. O Cache do Azure para Redis dá suporte a configurações redundantes de zona nas camadas Premium e Enterprise. Um cache redundante de zona pode colocar seus nós em diferentes zonas de disponibilidade do Azure na mesma região. Ele elimina a interrupção do data center ou AZ como um único ponto de falha e aumenta a disponibilidade geral do cache.", "waf": "Fiabilidade" }, { - "checklist": "Azure API Management Review", - "guid": "7519e385-a88b-4d34-966b-6269d686e890", - "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", - "service": "APIM", - "severity": "Média", - "text": "Usar o Azure Front Door na frente do APIM para implantação em várias regiões", - "waf": "Desempenho" - }, - { - "checklist": "Azure API Management Review", - "guid": "cd45c90e-7690-4753-930b-bf290c69c074", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", - "service": "APIM", - "severity": "Média", - "text": "Implantar o serviço em uma rede virtual (VNet)", - "waf": "Segurança" - }, - { - "checklist": "Azure API Management Review", - "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", - "service": "APIM", - "severity": "Média", - "text": "Implante NSG (grupos de segurança de rede) em suas sub-redes para restringir ou monitorar o tráfego de/para APIM.", - "waf": "Segurança" - }, - { - "checklist": "Azure API Management Review", - "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", - "service": "APIM", - "severity": "Média", - "text": "Implante pontos de extremidade privados para filtrar o tráfego de entrada quando o APIM não for implantado em uma rede virtual.", - "waf": "Segurança" - }, - { - "checklist": "Azure API Management Review", - "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", - "service": "APIM", - "severity": "Alto", - "text": "Desabilitar o acesso à rede pública", - "waf": "Segurança" - }, - { - "checklist": "Azure API Management Review", - "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", - "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", - "service": "APIM", - "severity": "Média", - "text": "Simplifique o gerenciamento com scripts de automação do PowerShell", - "waf": "Operações" - }, - { - "checklist": "Azure API Management Review", - "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", - "service": "APIM", - "severity": "Média", - "text": "Configure APIM via Infrastructure-as-code. Analise as práticas recomendadas de DevOps do Cloud Adaption Framework APIM Landing Zone Accelerator", - "waf": "Operações" - }, - { - "checklist": "Azure API Management Review", - "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", - "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", - "service": "APIM", - "severity": "Média", - "text": "Promover o uso da extensão API do Visual Studio Code para um desenvolvimento de API mais rápido", - "waf": "Operações" - }, - { - "checklist": "Azure API Management Review", - "guid": "354f1c03-8112-4965-85ad-c0074bddf231", - "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", - "service": "APIM", - "severity": "Média", - "text": "Implemente DevOps e CI/CD em seu fluxo de trabalho", - "waf": "Operações" - }, - { - "checklist": "Azure API Management Review", - "guid": "b6439493-426a-45f3-9697-cf65baee208d", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", - "service": "APIM", - "severity": "Média", - "text": "APIs seguras usando autenticação de certificado de cliente", - "waf": "Segurança" - }, - { - "checklist": "Azure API Management Review", - "guid": "2a67d143-1033-4c0a-8732-680896478f08", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", - "service": "APIM", - "severity": "Média", - "text": "Serviços de back-end seguros usando autenticação de certificado de cliente", - "waf": "Segurança" - }, - { - "checklist": "Azure API Management Review", - "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", - "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", - "service": "APIM", + "checklist": "Redis Resiliency checklist", + "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", + "service": "Redis", "severity": "Média", - "text": "Consulte o artigo \"Recomendações para mitigar as 10 principais ameaças da segurança da API OWASP\" e verifique o que é aplicável às suas APIs", - "waf": "Segurança" + "text": "Configure a persistência de dados para uma instância do Cache do Azure para Redis. Como os dados do cache são armazenados na memória, uma falha rara e não planejada de vários nós pode fazer com que todos os dados sejam descartados. Para evitar a perda completa de dados, a persistência do Redis permite que você tire instantâneos periódicos de dados na memória e os armazene em sua conta de armazenamento.", + "waf": "Fiabilidade" }, { - "checklist": "Azure API Management Review", - "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", - "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", - "service": "APIM", + "checklist": "Redis Resiliency checklist", + "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", + "service": "Redis", "severity": "Média", - "text": "Usar o recurso Autorizações para simplificar o gerenciamento do token OAuth 2.0 para suas APIs de back-end", - "waf": "Segurança" - }, - { - "checklist": "Azure API Management Review", - "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", - "service": "APIM", - "severity": "Alto", - "text": "Use a versão mais recente do TLS ao criptografar informações em trânsito. Desative protocolos e cifras desatualizados e desnecessários quando possível.", - "waf": "Segurança" - }, - { - "checklist": "Azure API Management Review", - "guid": "f8af3d94-1d2b-4070-846f-849197524258", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", - "service": "APIM", - "severity": "Alto", - "text": "Certifique-se de que os segredos (valores nomeados) sejam armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança", - "waf": "Segurança" + "text": "Use a conta de armazenamento com redundância geográfica para persistir o Cache do Azure para dados Redis ou zonalmente redundante onde a redundância geográfica não está disponível", + "waf": "Fiabilidade" }, { - "checklist": "Azure API Management Review", - "guid": "791abd8b-7706-4e31-9569-afefde724be3", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", - "service": "APIM", + "checklist": "Redis Resiliency checklist", + "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", + "service": "Redis", "severity": "Média", - "text": "Use identidades gerenciadas para autenticar em outros recursos do Azure sempre que possível", - "waf": "Segurança" - }, - { - "checklist": "Azure API Management Review", - "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", - "service": "APIM", - "severity": "Alto", - "text": "Usar o WAF (Web Application Firewall) implantando o Application Gateway na frente do APIM", - "waf": "Segurança" + "text": "Configure a replicação geográfica passiva para instâncias do Cache Premium do Azure para Redis. A replicação geográfica é um mecanismo para vincular duas ou mais instâncias do Cache do Azure para Redis, normalmente abrangendo duas regiões do Azure. A replicação geográfica foi projetada principalmente para recuperação de desastres entre regiões. Duas instâncias de cache de camada Premium são conectadas por meio de replicação geográfica de uma forma que fornece leituras e gravações no cache primário e que os dados são replicados para o cache secundário.", + "waf": "Fiabilidade" }, { "checklist": "Azure Landing Zone Review", @@ -2477,5350 +2247,5580 @@ "waf": "Fiabilidade" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", - "severity": "Alto", - "text": "Permitir que 2 réplicas tenham 99,9% de disponibilidade para operações de leitura", + "checklist": "Azure App Service Review", + "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", + "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", + "service": "App Services", + "severity": "Baixo", + "text": "Consulte a arquitetura de aplicativo Web com redundância de zona altamente disponível da linha de base para obter as práticas recomendadas", "waf": "Fiabilidade" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", - "severity": "Média", - "text": "Permitir que 3 réplicas tenham 99,9% de disponibilidade para operações de leitura/gravação", + "checklist": "Azure App Service Review", + "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", + "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", + "service": "App Services", + "severity": "Média", + "text": "Use as camadas Premium e Standard. Esses níveis oferecem suporte a slots de preparo e backups automatizados.", "waf": "Fiabilidade" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", - "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", - "service": "Cognitive Search", + "checklist": "Azure App Service Review", + "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", + "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", + "service": "App Services", "severity": "Alto", - "text": "Aproveite as zonas de disponibilidade habilitando réplicas de leitura e/ou gravação", + "text": "Aproveite as zonas de disponibilidade quando aplicável regionalmente (requer a camada Premium v2 ou v3)", "waf": "Fiabilidade" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", - "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", - "service": "Cognitive Search", + "checklist": "Azure App Service Review", + "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "severity": "Média", - "text": "Para redução regional, crie manualmente serviços em 2 ou mais regiões para a Pesquisa, pois não fornece um método automatizado de replicação de índices de pesquisa entre regiões geográficas", + "text": "Implementar verificações de integridade", "waf": "Fiabilidade" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", - "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", - "service": "Cognitive Search", - "severity": "Média", - "text": "Para sincronizar dados em vários serviços: Use indexadores para atualizar conteúdo em vários serviços ou Use APIs REST para enviar atualizações de conteúdo em vários serviços", + "checklist": "Azure App Service Review", + "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", + "service": "App Services", + "severity": "Alto", + "text": "Consulte as práticas recomendadas de backup e restauração para o Serviço de Aplicativo do Azure", "waf": "Fiabilidade" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", - "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", - "service": "Cognitive Search", - "severity": "Média", - "text": "Usar o Gerenciador de Tráfego do Azure para coordenar solicitações", + "checklist": "Azure App Service Review", + "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", + "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", + "service": "App Services", + "severity": "Alto", + "text": "Implementar práticas recomendadas de confiabilidade do Serviço de Aplicativo do Azure", "waf": "Fiabilidade" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", - "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", - "service": "Cognitive Search", + "checklist": "Azure App Service Review", + "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", + "service": "App Services", + "severity": "Baixo", + "text": "Familiarizar-se com como mover um aplicativo do Serviço de Aplicativo para outra região durante um desastre", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure App Service Review", + "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", + "service": "App Services", "severity": "Alto", - "text": "Backup e restauração de um índice de pesquisa cognitiva do Azure. Use este código de exemplo para fazer backup da definição de índice e instantâneo em uma série de arquivos Json", + "text": "Familiarizar-se com o suporte de confiabilidade no Serviço de Aplicativo do Azure", "waf": "Fiabilidade" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", - "service": "Azure Monitor", - "text": "Regras de coleta de dados no Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "Custar" + "checklist": "Azure App Service Review", + "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "App Services", + "severity": "Média", + "text": "Verifique se \"Sempre Ativo\" está habilitado para Aplicativos de Função em execução em um plano de serviço de aplicativo", + "waf": "Fiabilidade" }, { - "checklist": "Cost Optimization Checklist", - "guid": "45901365-d38e-443f-abcb-d868266abca2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Azure Backup", - "text": "Verificar instâncias de backup com a fonte de dados subjacente não encontrada", - "waf": "Custar" + "checklist": "Azure App Service Review", + "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", + "severity": "Média", + "text": "Monitorar instâncias do Serviço de Aplicativo usando verificações de integridade", + "waf": "Fiabilidade" }, { - "checklist": "Cost Optimization Checklist", - "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "VM", - "text": "Excluir ou arquivar serviços não associados (discos, nics, endereços IP etc.)", - "waf": "Custar" + "checklist": "Azure App Service Review", + "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", + "service": "App Services", + "severity": "Média", + "text": "Monitorar a disponibilidade e a capacidade de resposta do aplicativo Web ou site usando testes de disponibilidade do Application Insights", + "waf": "Fiabilidade" }, { - "checklist": "Cost Optimization Checklist", - "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Azure Backup", - "text": "Considere um bom equilíbrio entre recuperação de local, armazenamento e backup para aplicativos não essenciais", - "waf": "Custar" + "checklist": "Azure App Service Review", + "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", + "service": "App Services", + "severity": "Baixo", + "text": "Usar o teste Application Insights Standard para monitorar a disponibilidade e a capacidade de resposta do aplicativo Web ou site", + "waf": "Fiabilidade" }, { - "checklist": "Cost Optimization Checklist", - "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", - "service": "Azure Monitor", - "text": "Verifique os gastos e as oportunidades de economia entre os 40 diferentes espaços de trabalho de análise de log - use retenção e coleta de dados diferentes para espaços de trabalho não prod - crie limite diário para reconhecimento e dimensionamento de camadas - Se você definir um limite diário, além de criar um alerta quando o limite for atingido, certifique-se de também criar uma regra de alerta para ser notificado quando alguma porcentagem for atingida (90%, por exemplo). - considerar a transformação do espaço de trabalho, se possível - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Use o Cofre de Chaves do Azure para armazenar quaisquer segredos de que o aplicativo precisa. O Cofre de Chaves fornece um ambiente seguro e auditado para armazenar segredos e está bem integrado ao Serviço de Aplicativo por meio do SDK do Cofre de Chaves ou das Referências do Cofre de Chaves do Serviço de Aplicativo.", + "guid": "834ac932-223e-4ce8-8b12-3071a5416415", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", + "severity": "Alto", + "text": "Usar o Cofre de Chaves para armazenar segredos", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Azure Monitor", - "text": "Impor uma política de log de limpeza e automação (se necessário, os logs podem ser movidos para armazenamento frio)", - "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Use uma Identidade Gerenciada para se conectar ao Cofre de Chaves usando o SDK do Cofre de Chaves ou por meio das Referências do Cofre de Chaves do Serviço de Aplicativo.", + "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", + "severity": "Alto", + "text": "Usar a Identidade Gerenciada para se conectar ao Cofre de Chaves", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "VM", - "text": "Verifique se os discos são realmente necessários, se não: excluir. Se forem necessários, encontre níveis de armazenamento mais baixos ou use backup -", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Armazene o certificado TLS do Serviço de Aplicativo no Cofre de Chaves.", + "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", + "service": "App Services", + "severity": "Alto", + "text": "Use o Cofre de Chaves para armazenar o certificado TLS.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d1e44a19-659d-4395-afd7-7289b835556d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Storage", - "text": "Considere mover o armazenamento não utilizado para o nível inferior, com regra personalizada - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Os sistemas que processam informações confidenciais devem ser isolados. Para fazer isso, use Planos do Serviço de Aplicativo ou Ambientes do Serviço de Aplicativo separados e considere o uso de assinaturas ou grupos de gerenciamento diferentes.", + "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", + "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", + "service": "App Services", + "severity": "Média", + "text": "Isolar sistemas que processam informações confidenciais", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "VM", - "text": "Verifique se o Advisor está configurado para o dimensionamento correto da VM ", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Os discos locais no Serviço de Aplicativo não são criptografados e os dados confidenciais não devem ser armazenados neles. (Por exemplo: D:\\\\Local e %TMP%).", + "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", + "service": "App Services", + "severity": "Média", + "text": "Não armazene dados confidenciais no disco local", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "description": "verifique pesquisando as Licenças de Categoria de Medidor na Análise de Custos", - "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", - "service": "VM", - "text": "executar o script em todas as VMs do Windows https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- considere implementar uma diretiva se as VMs do Windows forem criadas com frequência", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Para aplicativos Web autenticados, use um Provedor de Identidade bem estabelecido, como o Azure AD ou o Azure AD B2C. Aproveite a estrutura de aplicativo de sua escolha para se integrar a esse provedor ou use o recurso de Autenticação/Autorização do Serviço de Aplicativo.", + "guid": "919ca0b2-c121-459e-814b-933df574eccc", + "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", + "service": "App Services", + "severity": "Média", + "text": "Usar um provedor de identidade estabelecido para autenticação", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "VM", - "text": " isso também pode ser colocado no AHUB se você já tiver licenças https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Implante código no Serviço de Aplicativo a partir de um ambiente controlado e confiável, como um pipeline de implantação de DevOps bem gerenciado e seguro. Isso evita que o código que não foi controlado por versão e verificado para ser implantado a partir de um host mal-intencionado.", + "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", + "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", + "service": "App Services", + "severity": "Alto", + "text": "Implantar a partir de um ambiente confiável", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "VM", - "text": "Consolidar famílias de VM reservadas com opção de flexibilidade (não mais do que 4-5 famílias)", - "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Desative a autenticação básica para FTP/FTPS e WebDeploy/SCM. Isso desabilita o acesso a esses serviços e impõe o uso de pontos de extremidade protegidos do Azure AD para implantação. Observe que o site do SCM também pode ser aberto usando credenciais do Azure AD.", + "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", + "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", + "service": "App Services", + "severity": "Alto", + "text": "Desabilitar a autenticação básica", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", - "service": "VM", - "text": "Utilize instâncias reservadas do Azure: esse recurso permite reservar VMs por um período de 1 ou 3 anos, proporcionando uma economia significativa em comparação com os preços do PAYG.", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Sempre que possível, use a Identidade Gerenciada para se conectar aos recursos protegidos do Azure AD. Se isso não for possível, armazene segredos no Cofre de Chaves e conecte-se ao Cofre de Chaves usando uma Identidade Gerenciada.", + "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", + "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", + "service": "App Services", + "severity": "Alto", + "text": "Usar a Identidade Gerenciada para se conectar a recursos", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "VM", - "text": "Somente discos maiores podem ser reservados => 1 TiB -", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Onde estiver usando imagens armazenadas no Registro de Contêiner do Azure, extraia-as usando uma Identidade Gerenciada.", + "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", + "service": "App Services", + "severity": "Alto", + "text": "Extrair contêineres usando uma identidade gerenciada", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", - "service": "VM", - "text": "Após a otimização do dimensionamento correto", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Ao definir as configurações de diagnóstico do Serviço de Aplicativo, você pode enviar toda a telemetria para o Log Analytics como o destino central para registro em log e monitoramento. Isso permite que você monitore a atividade de tempo de execução do Serviço de Aplicativo, como logs HTTP, logs de aplicativos, logs de plataforma, ...", + "guid": "47768314-c115-4775-a2ea-55b46ad48408", + "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", + "service": "App Services", + "severity": "Média", + "text": "Enviar logs de tempo de execução do Serviço de Aplicativo para o Log Analytics", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Azure SQL", - "text": "Verifique se aplicável e aplique a política/alteração https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Configure uma configuração de diagnóstico para enviar o log de atividades para o Log Analytics como o destino central para registro e monitoramento. Isso permite que você monitore a atividade do plano de controle no próprio recurso do Serviço de Aplicativo.", + "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "service": "App Services", + "severity": "Média", + "text": "Enviar logs de atividade do Serviço de Aplicativo para o Log Analytics", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "VM", - "text": "O desconto da peça de licença VM + (ahub + 3YRI) é de cerca de 70% de desconto", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Controle o acesso à rede de saída usando uma combinação de integração regional de VNet, grupos de segurança de rede e UDR's. O tráfego deve ser roteado para um NVA, como o Firewall do Azure. Certifique-se de monitorar os logs do Firewall.", + "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", + "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", + "service": "App Services", + "severity": "Média", + "text": "O acesso à rede de saída deve ser controlado", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "VM", - "text": "Considere o uso de um VMSS para corresponder à demanda em vez de dimensionamento simples", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Você pode fornecer um IP de saída estável usando a integração de rede virtual e um gateway NAT de rede virtual ou um NVA como o Firewall do Azure. Isso permite que a parte receptora permita uma lista com base no IP, caso seja necessário. Observe que, para comunicações com os Serviços do Azure, geralmente não há necessidade de depender do endereço IP e mecânicas como Pontos de Extremidade de Serviço devem ser usadas. (Além disso, o uso de pontos de extremidade privados na extremidade de recebimento evita que o SNAT aconteça e fornece um intervalo de IP de saída estável.)", + "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", + "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", + "service": "App Services", + "severity": "Baixo", + "text": "Garantir um IP estável para comunicações de saída para endereços de Internet", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Cost Optimization Checklist", - "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "AKS", - "text": "Use o autoscaler AKS para corresponder ao uso de clusters (verifique se os requisitos dos pods correspondem ao dimensionador)", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Controle o acesso à rede de entrada usando uma combinação de Restrições de Acesso do Serviço de Aplicativo, Pontos de Extremidade de Serviço ou Pontos de Extremidade Privados. Diferentes restrições de acesso podem ser necessárias e configuradas para o próprio aplicativo Web e o site do SCM.", + "guid": "0725769e-e669-41a4-a34a-c932223ece80", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", + "severity": "Alto", + "text": "O acesso à rede de entrada deve ser controlado", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Azure Backup", - "text": "Mover pontos de recuperação para o vault-archive, quando aplicável (Validar)", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Proteja-se contra tráfego de entrada mal-intencionado usando um Firewall de Aplicativo Web, como o Gateway de Aplicativo ou o Azure Front Door. Certifique-se de monitorar os logs do WAF.", + "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", + "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", + "service": "App Services", + "severity": "Alto", + "text": "Usar um WAF na frente do Serviço de Aplicativo", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", - "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", - "service": "Databricks", - "text": "Considere o uso de VMs spot com fallback sempre que possível. Considere o autotermination de clusters.", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Certifique-se de que o WAF não pode ser ignorado bloqueando o acesso apenas ao WAF. Use uma combinação de Restrições de Acesso, Pontos de Extremidade de Serviço e Pontos de Extremidade Privados.", + "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", + "severity": "Alto", + "text": "Evite que o WAF seja ignorado", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", - "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", - "service": "Azure Functions", - "text": "Funções - Reutilizar conexões", - "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Defina a política TLS mínima como 1.2 na configuração do Serviço de Aplicativo.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", + "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", + "service": "App Services", + "severity": "Média", + "text": "Definir a política TLS mínima como 1.2", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview", - "service": "Azure Functions", - "text": "Funções - Armazenar dados em cache localmente", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", - "waf": "Custar" + "checklist": "Azure App Service Review", + "description": "Configure o Serviço de Aplicativo para usar somente HTTPS. Isso faz com que o Serviço de Aplicativo redirecione de HTTP para HTTPS. Considere fortemente o uso de HTTP Strict Transport Security (HSTS) em seu código ou a partir de seu WAF, que informa aos navegadores que o site só deve ser acessado usando HTTPS.", + "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", + "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", + "service": "App Services", + "severity": "Alto", + "text": "Usar somente HTTPS", + "waf": "Segurança" + }, + { + "checklist": "Azure App Service Review", + "description": "Não use curingas em sua configuração do CORS, pois isso permite que todas as origens acessem o serviço (derrotando assim o propósito do CORS). Especificamente, permita apenas as origens que você espera poder acessar o serviço.", + "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", + "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", + "service": "App Services", + "severity": "Alto", + "text": "Curingas não devem ser usados para CORS", + "waf": "Segurança" + }, + { + "checklist": "Azure App Service Review", + "description": "A depuração remota não deve ser ativada na produção, pois isso abre portas adicionais no serviço, o que aumenta a superfície de ataque. Observe que o serviço ativa a depuração remota automaticamente após 48 horas.", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", + "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", + "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", + "service": "App Services", + "severity": "Alto", + "text": "Desativar a depuração remota", + "waf": "Segurança" + }, + { + "checklist": "Azure App Service Review", + "description": "Habilite o Defender para o Serviço de Aplicativo. Isso (entre outras ameaças) detecta comunicações com endereços IP mal-intencionados conhecidos. Analise as recomendações do Defender for App Service como parte de suas operações.", + "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", + "service": "App Services", + "severity": "Média", + "text": "Habilitar o Defender for Cloud - Defender for App Service", + "waf": "Segurança" + }, + { + "checklist": "Azure App Service Review", + "description": "O Azure fornece proteção contra DDoS Basic em sua rede, que pode ser aprimorada com recursos inteligentes de DDoS Standard que aprendem sobre padrões normais de tráfego e podem detectar comportamentos incomuns. O DDoS Standard se aplica a uma Rede Virtual, portanto, ele deve ser configurado para o recurso de rede na frente do aplicativo, como o Application Gateway ou um NVA.", + "guid": "223ece80-b123-4071-a541-6415833ea3ad", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "App Services", + "severity": "Média", + "text": "Habilitar o padrão de proteção DDOS na rede virtual WAF", + "waf": "Segurança" + }, + { + "checklist": "Azure App Service Review", + "description": "Ao usar imagens armazenadas no Registro de Contêiner do Azure, extraia-as por uma rede virtual do Registro de Contêiner do Azure usando seu ponto de extremidade privado e a configuração do aplicativo 'WEBSITE_PULL_IMAGE_OVER_VNET'.", + "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", + "service": "App Services", + "severity": "Média", + "text": "Extrair contêineres por uma rede virtual", + "waf": "Segurança" + }, + { + "checklist": "Azure App Service Review", + "description": "Realizar um teste de penetração na aplicação web seguindo as regras de teste de penetração de engajamento.", + "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", + "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", + "service": "App Services", + "severity": "Média", + "text": "Realizar um teste de penetração", + "waf": "Segurança" + }, + { + "checklist": "Azure App Service Review", + "description": "Implante código confiável que foi validado e verificado em busca de vulnerabilidades de acordo com as práticas de DevSecOps.", + "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", + "service": "App Services", + "severity": "Média", + "text": "Implantar código validado", + "waf": "Segurança" + }, + { + "checklist": "Azure App Service Review", + "description": "Use as versões mais recentes de plataformas, linguagens de programação, protocolos e estruturas suportadas.", + "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", + "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", + "service": "App Services", + "severity": "Alto", + "text": "Use plataformas, linguagens, protocolos e frameworks atualizados", + "waf": "Segurança" + }, + { + "checklist": "Azure Bot Service", + "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", + "service": "Bot service", + "severity": "Média", + "text": "Siga as recomendações de suporte de confiabilidade no Serviço de Bot do Azure", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure Bot Service", + "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", + "service": "Bot service", + "severity": "Média", + "text": "Implantando bots com residência de dados local e conformidade regional", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure Bot Service", + "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", + "service": "Bot service", + "severity": "Média", + "text": "O Serviço de Bot do Azure é executado no modo ativo-ativo para serviços globais e regionais. Quando ocorre uma paralisação, você não precisa detectar erros ou gerenciar o serviço. O Serviço de Bot do Azure executa automaticamente o failover automático e a recuperação automática em uma arquitetura geográfica de várias regiões. Para o serviço regional de bot da UE, o Serviço de Bot do Azure fornece duas regiões completas dentro da Europa com replicação ativa/ativa para garantir redundância. Para o serviço de bot global, todas as regiões/geografias disponíveis podem ser servidas como a presença global.", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Front Door", + "severity": "Média", + "text": "Se você usar certificados TLS gerenciados pelo cliente com o Azure Front Door, use a versão de certificado 'Mais recente'. Reduzir o risco de paralisações causadas pela renovação manual de certificados", + "waf": "Operações" + }, + { + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", + "guid": "553585a6-abe0-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "App Gateway", + "severity": "Média", + "text": "Verifique se você está usando o SKU do Application Gateway v2", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Segurança" + }, + { + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", + "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Load Balancer", + "severity": "Média", + "text": "Verifique se você está usando a SKU padrão para seus Balanceadores de Carga do Azure", + "waf": "Segurança" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "9432621a-8397-4654-a882-5bc856b7ef83", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", + "service": "Load Balancer", + "severity": "Média", + "text": "Verifique se os endereços IP de front-end dos Load Balancers são redundantes por zona (a menos que você precise de frontends zonais).", + "waf": "Segurança" + }, + { + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", + "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "App Gateway", + "severity": "Média", + "text": "Seus Application Gateways v2 devem ser implantados em sub-redes com prefixos IP iguais ou maiores que /24", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Segurança" + }, + { + "checklist": "Azure Application Delivery Networking", + "description": "A administração de proxies reversos em geral e do WAF em particular está mais próxima do aplicativo do que da rede, portanto, eles pertencem à mesma assinatura que o aplicativo. Centralizar o Application Gateway e o WAF na assinatura de conectividade pode ser OK se for gerenciado por uma única equipe.", + "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", + "severity": "Média", + "text": "Implante o Gateway de Aplicativo do Azure v2 ou NVAs de parceiros usados para fazer proxy de conexões HTTP(S) de entrada na rede virtual da zona de aterrissagem e com os aplicativos que eles estão protegendo.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Segurança" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", + "severity": "Média", + "text": "Use uma rede DDoS ou planos de proteção IP para todos os endereços IP públicos nas zonas de aterrissagem do aplicativo.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Segurança" + }, + { + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", + "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", + "service": "App Gateway", + "severity": "Média", + "text": "Configure o dimensionamento automático com uma quantidade mínima de duas instâncias.", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", + "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", + "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", + "service": "App Gateway", + "severity": "Média", + "text": "Implantar o Application Gateway em zonas de disponibilidade", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Front Door", + "severity": "Média", + "text": "Use o Azure Front Door com políticas WAF para fornecer e ajudar a proteger aplicativos HTTP/S globais que abrangem várias regiões do Azure.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Segurança" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "3f29812b-2363-4cef-b179-b599de0d5973", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "Front Door", + "severity": "Média", + "text": "Ao usar o Front Door e o Application Gateway para ajudar a proteger aplicativos HTTP/S, use políticas WAF no Front Door. Bloqueie o Application Gateway para receber tráfego somente do Front Door.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Segurança" + }, + { + "ammp": true, + "arm-service": "microsoft.network/trafficManagerProfiles", + "checklist": "Azure Application Delivery Networking", + "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Traffic Manager", + "severity": "Alto", + "text": "Use o Gerenciador de Tráfego para fornecer aplicativos globais que abrangem protocolos diferentes de HTTP/S.", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", + "severity": "Baixo", + "text": "Se os usuários precisarem apenas de acesso a aplicativos internos, o Proxy de Aplicativo de ID do Microsoft Entra foi considerado uma alternativa à Área de Trabalho Virtual (AVD) do Azure?", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", + "waf": "Segurança" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", + "severity": "Média", + "text": "Para reduzir o número de portas de firewall abertas para conexões de entrada em sua rede, considere o uso do Microsoft Entra ID Application Proxy para dar aos usuários remotos acesso seguro e autenticado a aplicativos internos.", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Azure Functions", - "text": "Funções - Partidas a frio - Use a funcionalidade 'Executar do pacote'. Dessa forma, o código é baixado como um único arquivo zip. Isso pode, por exemplo, resultar em melhorias significativas com as funções Javascript, que possuem muitos módulos de nó. Use ferramentas específicas de linguagem para reduzir o tamanho do pacote, por exemplo, aplicativos Javascript que agitam árvores.", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "ae248989-b306-4591-9186-de482e3f0f0e", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "Front Door", + "severity": "Alto", + "text": "Implante sua política de WAF para Front Door no modo 'Prevenção'.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "Azure Functions", - "text": "Funções - Mantenha suas funções aquecidas", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "Front Door", + "severity": "Alto", + "text": "Evite combinar o Gerenciador de Tráfego do Azure e o Azure Front Door.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Azure Functions", - "text": "Ao usar o dimensionamento automático com funções diferentes, pode haver um que conduza todo o dimensionamento automático para todos os recursos - considere movê-lo para um plano de consumo separado (e considere um plano mais alto para a CPU)", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "Front Door", + "severity": "Alto", + "text": "Use o mesmo nome de domínio no Azure Front Door e sua origem. Nomes de host incompatíveis podem causar bugs sutis.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", - "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", - "service": "Azure Functions", - "text": "Os aplicativos de função em um determinado plano são todos dimensionados juntos, portanto, quaisquer problemas com o dimensionamento podem afetar todos os aplicativos no plano.", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", + "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "Front Door", + "severity": "Baixo", + "text": "Desabilite os testes de integridade quando houver apenas uma origem em um grupo de origem do Azure Front Door.", + "waf": "Desempenho" }, { - "checklist": "Cost Optimization Checklist", - "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", - "service": "Azure Functions", - "text": "Sou cobrado por 'tempo de espera'? Essa pergunta geralmente é feita no contexto de uma função C# que faz uma operação assíncrona e aguarda o resultado, por exemplo, aguardar Task.Delay(1000) ou aguardar cliente. GetAsync('http://google.com'). A resposta é sim - o segundo cálculo de GB é baseado na hora de início e término da função e no uso de memória durante esse período. O que realmente acontece ao longo desse tempo em termos de atividade da CPU não é levado em consideração no cálculo. Uma exceção a essa regra é se você estiver usando funções duráveis. Você não é cobrado pelo tempo gasto em espera em funções de orquestrador.aplique técnicas de modelagem de demanda sempre que possível (ambientes de desenvolvimento?) https://github.com/Azure-Samples/functions-csharp-premium-scaler", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "Front Door", + "severity": "Média", + "text": "Selecione bons pontos de extremidade de teste de integridade para o Azure Front Door. Considere a criação de pontos de extremidade de integridade que verifiquem todas as dependências do seu aplicativo.", + "waf": "Fiabilidade" }, { - "checklist": "Cost Optimization Checklist", - "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", + "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", "service": "Front Door", - "text": "Frontdoor - Desativar a página inicial padrãoNas configurações do aplicativo do seu aplicativo, defina AzureWebJobsDisableHomepage como true. Isso retornará um 204 (Sem Conteúdo) para o PoP para que apenas os dados de cabeçalho sejam retornados.", - "waf": "Custar" + "severity": "Baixo", + "text": "Use testes de integridade do HEAD com o Azure Front Door para reduzir o tráfego que o Front Door envia para seu aplicativo.", + "waf": "Desempenho" }, { - "checklist": "Cost Optimization Checklist", - "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", + "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "Load Balancer", + "severity": "Alto", + "text": "Usar o Gateway NAT do Azure em vez das regras de saída do Load Balancer para melhor escalabilidade do SNAT", + "waf": "Fiabilidade" + }, + { + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", + "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", "service": "Front Door", - "text": "Frontdoor - Rota para algo que não retorna nada. Configure uma Função, Proxy de Função ou adicione uma rota em seu WebApp que retorne 200 (OK) e envie conteúdo nulo ou mínimo. A vantagem disso é que você poderá fazer logout quando for chamado.", - "waf": "Custar" + "severity": "Alto", + "text": "Use certificados TLS gerenciados com o Azure Front Door. Reduza o custo operacional e o risco de paralisações devido a renovações de certificados.", + "waf": "Operações" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", - "service": "Storage", - "text": "Considere níveis de arquivamento para dados menos usados", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", + "service": "Front Door", + "severity": "Média", + "text": "Defina sua configuração do WAF do Azure Front Door como código. Usando o código, você pode adotar mais facilmente a nova versão do conjunto de regras e obter proteção adicional.", + "waf": "Operações" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "VM", - "text": "Verifique os tamanhos de disco em que o tamanho não corresponde à camada (ou seja, um disco de 513 GiB pagará um P30 (1TiB) e considere o redimensionamento", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", + "service": "Front Door", + "severity": "Alto", + "text": "Use o TLS de ponta a ponta com o Azure Front Door. Use o TLS para conexões de seus clientes com o Front Door e do Front Door com sua origem.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "Storage", - "text": "Considere usar SSD padrão em vez de Premium ou Ultra sempre que possível", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", + "service": "Front Door", + "severity": "Média", + "text": "Use o redirecionamento HTTP para HTTPS com o Azure Front Door. Ofereça suporte a clientes mais antigos redirecionando-os para uma solicitação HTTPS automaticamente.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "Storage", - "text": "Para contas de armazenamento, verifique se a camada escolhida não está somando encargos de transação (pode ser mais barato passar para a próxima camada)", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", + "service": "Front Door", + "severity": "Alto", + "text": "Habilite o WAF do Azure Front Door. Proteja seu aplicativo contra uma série de ataques.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "Site Recovery", - "text": "Para ASR, considere o uso de discos SSD padrão se o RPO/RTO e a taxa de transferência de replicação permitirem", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", + "service": "Front Door", + "severity": "Alto", + "text": "Ajuste o WAF do Azure Front Door para sua carga de trabalho. Reduza as detecções de falsos positivos.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", - "service": "Storage", - "text": "Contas de armazenamento: verifique o hot tier e/ou o GRS necessário", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "Front Door", + "severity": "Alto", + "text": "Habilite o recurso de inspeção do corpo de solicitação habilitado na política WAF do Azure Front Door.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "VM", - "text": "Discos - valide o uso de discos SSD Premium em todos os lugares: por exemplo, não-prod pode trocar para SSD padrão ou SSD Premium sob demanda ", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", + "service": "Front Door", + "severity": "Alto", + "text": "Habilite os conjuntos de regras padrão do WAF do Azure Front Door. Os conjuntos de regras padrão detectam e bloqueiam ataques comuns.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "Synapse", - "text": "Crie orçamentos para gerenciar custos e crie alertas que notifiquem automaticamente as partes interessadas sobre anomalias de gastos e riscos de gastos excessivos.", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", + "service": "Front Door", + "severity": "Alto", + "text": "Habilite o conjunto de regras de proteção de bot do WAF do Azure Front Door. As regras de bot detectam bots bons e ruins.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "Synapse", - "text": "Exporte dados de custo para uma conta de armazenamento para análise de dados adicionais.", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", + "service": "Front Door", + "severity": "Média", + "text": "Use a versão mais recente do conjunto de regras do WAF do Azure Front Door. As atualizações do conjunto de regras são atualizadas regularmente para levar em conta o cenário atual de ameaças.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Synapse", - "text": "Controle os custos de um pool SQL dedicado pausando o recurso quando ele não estiver em uso.", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "guid": "b9620385-1cde-418f-914b-a84a06982ffc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", + "service": "Front Door", + "severity": "Média", + "text": "Adicione o limite de taxa ao WAF do Azure Front Door. A limitação de taxa bloqueia clientes que enviam acidentalmente ou intencionalmente grandes quantidades de tráfego em um curto período de tempo.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", - "service": "Synapse", - "text": "Habilite o recurso de pausa automática do Apache Spark sem servidor e defina seu valor de tempo limite de acordo.", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", + "service": "Front Door", + "severity": "Média", + "text": "Use um limite alto para os limites de taxa do WAF do Azure Front Door. Limites de limite de taxa alta evitam o bloqueio de tráfego legítimo, ao mesmo tempo em que fornecem proteção contra um número extremamente alto de solicitações que podem sobrecarregar sua infraestrutura. ", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Synapse", - "text": "Crie várias definições de pool do Apache Spark de vários tamanhos.", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", + "service": "Front Door", + "severity": "Baixo", + "text": "Se você não está esperando tráfego de todas as regiões geográficas, use filtros geográficos para bloquear o tráfego de países não esperados.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "service": "Synapse", - "text": "Adquira unidades de confirmação (SCU) do Azure Synapse por um ano com um plano de pré-compra para economizar nos custos do Azure Synapse Analytics.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "guid": "00acd8a9-6975-414f-8491-2be6309893b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", + "service": "Front Door", + "severity": "Média", + "text": "Especifique o local desconhecido (ZZ) ao filtrar geograficamente o tráfego com o WAF do Azure Front Door. Evite bloquear acidentalmente solicitações legítimas quando os endereços IP não puderem ser correspondidos geograficamente.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "VM", - "text": "Usar VMs spot para trabalhos interruptíveis: são VMs que podem ser licitadas e compradas a um preço com desconto, fornecendo uma solução econômica para cargas de trabalho não críticas.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", + "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", + "service": "App Gateway", + "severity": "Alto", + "text": "Habilitar o conjunto de regras de proteção de bot WAF do Gateway de Aplicativo do Azure As regras de bot detectam bots bons e ruins.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "544451e1-92d3-4442-a3c7-628637a551c5", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", - "text": "Dimensionamento correto de todas as VMs", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "App Gateway", + "severity": "Alto", + "text": "Habilite o recurso de inspeção do corpo de solicitação habilitado na política WAF do Gateway de Aplicativo do Azure.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "VM", - "text": "Trocar VM dimensionada com tamanhos normalizados e mais recentes", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", + "service": "App Gateway", + "severity": "Alto", + "text": "Ajuste o WAF do Gateway de Aplicativo do Azure para sua carga de trabalho. Reduza as detecções de falsos positivos.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "VMs de dimensionamento correto - comece com o monitoramento do uso abaixo de 5% e, em seguida, trabalhe até 40%", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Custar" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "App Gateway", + "severity": "Alto", + "text": "Implante sua política de WAF para o Application Gateway no modo 'Prevenção'.", + "waf": "Segurança" }, { - "checklist": "Cost Optimization Checklist", - "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "A conteinerização de um aplicativo pode melhorar a densidade da VM e economizar dinheiro no dimensionamento", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Custar" + "checklist": "Azure Application Delivery Networking", + "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", + "service": "App Gateway", + "severity": "Média", + "text": "Adicione o limite de taxa ao WAF do Gateway de Aplicativo do Azure. A limitação de taxa bloqueia clientes que enviam acidentalmente ou intencionalmente grandes quantidades de tráfego em um curto período de tempo.", + "waf": "Segurança" }, { - "checklist": "MySQL Review Checklist", - "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", - "service": "Azure MySQL", + "checklist": "Azure Application Delivery Networking", + "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", + "service": "App Gateway", "severity": "Média", - "text": "Aproveite o servidor flexível", - "waf": "Fiabilidade" + "text": "Use um limite alto para os limites de taxa do WAF do Gateway de Aplicativo do Azure. Limites de limite de taxa alta evitam o bloqueio de tráfego legítimo, ao mesmo tempo em que fornecem proteção contra um número extremamente alto de solicitações que podem sobrecarregar sua infraestrutura. ", + "waf": "Segurança" }, { - "checklist": "MySQL Review Checklist", - "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", - "service": "Azure MySQL", - "severity": "Alto", - "text": "Aproveite as zonas de disponibilidade quando aplicável regionalmente", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "99937189-ff78-492a-b9ca-18d828d82b37", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", + "service": "App Gateway", + "severity": "Baixo", + "text": "Se você não está esperando tráfego de todas as regiões geográficas, use filtros geográficos para bloquear o tráfego de países não esperados.", + "waf": "Segurança" }, { - "checklist": "MySQL Review Checklist", - "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", - "service": "Azure MySQL", + "checklist": "Azure Application Delivery Networking", + "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", + "service": "App Gateway", "severity": "Média", - "text": "Aproveite a replicação de dados para cenários de DR entre regiões", - "waf": "Fiabilidade" + "text": "Especifique o local desconhecido (ZZ) ao filtrar geograficamente o tráfego com o WAF do Gateway de Aplicativo do Azure. Evite bloquear acidentalmente solicitações legítimas quando os endereços IP não puderem ser correspondidos geograficamente.", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", - "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", + "service": "App Gateway", "severity": "Média", - "text": "O Azure Center for SAP solutions (ACSS) é uma oferta do Azure que torna o SAP uma carga de trabalho de nível superior no Azure. O ACSS é uma solução de ponta a ponta que permite criar e executar sistemas SAP como uma carga de trabalho unificada no Azure e fornece uma base mais perfeita para a inovação. Você pode aproveitar os recursos de gerenciamento para sistemas SAP novos e existentes baseados no Azure.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", - "waf": "Operações" + "text": "Use a versão mais recente do conjunto de regras do WAF do Gateway de Aplicativo do Azure. As atualizações do conjunto de regras são atualizadas regularmente para levar em conta o cenário atual de ameaças.", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "App Gateway", "severity": "Média", - "text": "O Azure dá suporte à automação de implantações SAP no Linux e no Windows. O SAP Deployment Automation Framework é uma ferramenta de orquestração de código aberto que pode implantar, instalar e manter ambientes SAP.", - "training": "https://github.com/Azure/sap-automation", + "text": "Adicione configurações de diagnóstico para salvar seus logs WAF do Gateway de Aplicativo do Azure.", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "Front Door", "severity": "Média", - "text": "Executar uma recuperação point-in-time para seus bancos de dados de produção em qualquer ponto e em um período de tempo que atenda ao seu RTO; A recuperação point-in-time normalmente inclui erros do operador excluindo dados na camada DBMS ou por meio do SAP, incidentalmente", - "waf": "Fiabilidade" + "text": "Adicione configurações de diagnóstico para salvar seus logs do WAF do Azure Front Door.", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "92664c60-47e3-4591-8b1b-8d557656e686", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", + "service": "App Gateway", "severity": "Média", - "text": "Teste os tempos de backup e recuperação para verificar se eles atendem aos requisitos de RTO para restaurar todos os sistemas simultaneamente após um desastre.", - "waf": "Fiabilidade" - }, - { - "checklist": "SAP Checklist", - "guid": "b651423c-8552-42db-a545-5cb50c05527a", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "SAP", - "severity": "Alto", - "text": "Você pode replicar o armazenamento padrão entre regiões emparelhadas, mas não pode usar o armazenamento padrão para armazenar seus bancos de dados ou discos rígidos virtuais. Você pode replicar backups somente entre regiões emparelhadas que você usa. Para todos os outros dados, execute sua replicação usando recursos nativos de DBMS, como SQL Server Always On ou SAP HANA System Replication. Use uma combinação de Site Recovery, rsync ou robocopy e outros softwares de terceiros para a camada de aplicativos SAP.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", - "waf": "Fiabilidade" + "text": "Envie logs do WAF do Gateway de Aplicativo do Azure para o Microsoft Sentinel.", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "845f5f91-9c21-4674-a725-5ce890850e20", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "Front Door", "severity": "Média", - "text": "Ao usar as Zonas de Disponibilidade do Azure para obter alta disponibilidade, você deve considerar a latência entre servidores de aplicativos SAP e servidores de banco de dados. Para zonas com altas latências, os procedimentos operacionais precisam estar em vigor para garantir que os servidores de aplicativos SAP e os servidores de banco de dados estejam sendo executados na mesma zona o tempo todo.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", - "waf": "Fiabilidade" + "text": "Envie logs do WAF do Azure Front Door para o Microsoft Sentinel.", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "SAP", - "severity": "Alto", - "text": "Configure conexões de Rota Expressa do local para as regiões primária e secundária de recuperação de desastres do Azure. Além disso, como alternativa ao uso da Rota Expressa, considere configurar conexões VPN locais para as regiões primária e secundária de recuperação de desastres do Azure.", - "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", + "service": "App Gateway", + "severity": "Média", + "text": "Defina sua configuração do WAF do Gateway de Aplicativo do Azure como código. Usando o código, você pode adotar mais facilmente a nova versão do conjunto de regras e obter proteção adicional.", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "SAP", - "severity": "Baixo", - "text": "Replique o conteúdo do cofre de chaves, como certificados, segredos ou chaves entre regiões, para que você possa descriptografar dados na região de recuperação de desastres.", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", + "service": "App Gateway", + "severity": "Média", + "text": "Use políticas de WAF em vez da configuração de WAF herdada.", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", - "service": "SAP", - "severity": "Média", - "text": "Emparelhar as redes virtuais primária e de recuperação de desastres. Por exemplo, para a replicação do sistema HANA, uma rede virtual SAP HANA DB precisa ser emparelhada para a rede virtual SAP HANA DB do site de recuperação de desastres.", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", + "service": "App Gateway", + "severity": "Média", + "text": "Filtre o tráfego de entrada nos back-ends para que eles só aceitem conexões da sub-rede do Application Gateway, por exemplo, com NSGs.", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", - "service": "SAP", - "severity": "Baixo", - "text": "Se você usar o armazenamento do Azure NetApp Files para suas implantações SAP, no mínimo, crie duas contas do Azure NetApp Files na camada Premium, em duas regiões.", - "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", + "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", + "service": "Front Door", + "severity": "Média", + "text": "Certifique-se de que suas origens recebam apenas o tráfego de sua instância do Azure Front Door.", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "service": "App Gateway", "severity": "Alto", - "text": "A tecnologia de replicação de banco de dados nativo deve ser usada para sincronizar o banco de dados em um par de HA.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", - "waf": "Fiabilidade" + "text": "Você deve criptografar o tráfego para os servidores de back-end.", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", - "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "service": "App Gateway", "severity": "Alto", - "text": "O CIDR da rede virtual primária (VNet) não deve entrar em conflito ou se sobrepor ao CIDR da VNet do site de recuperação de desastres", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", - "waf": "Fiabilidade" + "text": "Você deve usar um Web Application Firewall.", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", - "service": "SAP", - "severity": "Alto", - "text": "Use a Recuperação de Site para replicar um servidor de aplicativos para um site de recuperação de desastres. A Recuperação de Site também pode ajudar na replicação de VMs de cluster de serviços centrais para o site de recuperação de desastres. Ao invocar o DR, você precisará reconfigurar o cluster do Linux Pacemaker no site de DR (por exemplo, substitua o VIP ou o SBD, execute o corosync.conf e muito mais).", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", + "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", + "service": "App Gateway", + "severity": "Média", + "text": "Redirecionar HTTP para HTTPS", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", - "severity": "Alto", - "text": "Considere a disponibilidade do software SAP em relação a pontos únicos de falha. Isso inclui pontos únicos de falha em aplicativos como SGBDs utilizados nas arquiteturas SAP NetWeaver e SAP S/4HANA, SAP ABAP e ASCS + SCS. Além disso, outras ferramentas, como o SAP Web Dispatcher.", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", + "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", + "service": "App Gateway", + "severity": "Média", + "text": "Usar cookies gerenciados por gateway para direcionar o tráfego de uma sessão de usuário para o mesmo servidor para processamento", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", - "service": "SAP", + "checklist": "Azure Application Delivery Networking", + "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", + "service": "App Gateway", "severity": "Alto", - "text": "Para bancos de dados SAP e SAP, considere a implementação de clusters de failover automático. No Windows, o Clustering de Failover do Windows Server oferece suporte a failover. No Linux, Linux Pacemaker ou ferramentas de terceiros como SIOS Protection Suite e Veritas InfoScale suportam failover.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidade" + "text": "Habilite a drenagem de conexão durante as atualizações de serviço planejadas para evitar a perda de conexão com membrs existentes do pool de back-end", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", - "service": "SAP", - "severity": "Alto", - "text": "O Azure não oferece suporte a arquiteturas nas quais as VMs primária e secundária compartilham armazenamento para dados DBMS. Para a camada DBMS, o padrão de arquitetura comum é replicar bancos de dados ao mesmo tempo e com pilhas de armazenamento diferentes daquelas que as VMs primária e secundária usam.", - "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", + "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", + "service": "App Gateway", + "severity": "Baixo", + "text": "Criar páginas de erro personalizadas para exibir uma experiência de usuário personalizada", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", - "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", - "service": "SAP", - "severity": "Alto", - "text": "Os dados do DBMS e os arquivos de log de transação/refazer são armazenados no armazenamento em bloco com suporte do Azure ou nos Arquivos do Azure NetApp. Os Arquivos do Azure ou os Arquivos Premium do Azure não têm suporte como armazenamento para dados DBMS e/ou arquivos de log de refazer com a carga de trabalho SAP.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", + "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", + "service": "App Gateway", + "severity": "Média", + "text": "Edite solicitações HTTP e cabeçalhos de resposta para facilitar o roteamento e a troca de informações entre o cliente e o servidor", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", - "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", - "service": "SAP", - "severity": "Alto", - "text": "Você pode usar discos compartilhados do Azure no Windows para componentes ASCS + SCS e cenários específicos de alta disponibilidade. Configure seus clusters de failover separadamente para componentes da camada de aplicativo SAP e a camada DBMS. No momento, o Azure não oferece suporte a arquiteturas de alta disponibilidade que combinam componentes da camada de aplicativo SAP e a camada DBMS em um cluster de failover.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "App Gateway", + "severity": "Média", + "text": "Configure o Front Door para otimizar o roteamento de tráfego global da Web e o desempenho do usuário final de nível superior e a confiabilidade por meio de failover global rápido", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", - "service": "SAP", - "severity": "Alto", - "text": "A maioria dos clusters de failover para ASCS (Application Layer Components, componentes da camada de aplicativo) SAP e a camada DBMS exigem um endereço IP virtual para um cluster de failover. O Balanceador de Carga do Azure deve manipular o endereço IP virtual para todos os outros casos. Um princípio de design é usar um balanceador de carga por configuração de cluster. Recomendamos que você use a versão padrão do balanceador de carga (SKU do Standard Load Balancer).", - "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "29dcc19f-a8fa-4c35-8281-290577538793", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "App Gateway", + "severity": "Média", + "text": "Usar balanceamento de carga da camada de transporte", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", - "service": "SAP", - "severity": "Alto", - "text": "Verifique se o IP flutuante está habilitado no balanceador de carga", - "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", + "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", + "service": "App Gateway", + "severity": "Média", + "text": "Configurar o roteamento com base no host ou nome de domínio para vários aplicativos Web em um único gateway", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "SAP", - "severity": "Alto", - "text": "Antes de implantar sua infraestrutura de alta disponibilidade, e dependendo da região escolhida, determine se deseja implantar com um conjunto de disponibilidade do Azure ou uma zona de disponibilidade.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", + "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", + "service": "App Gateway", + "severity": "Média", + "text": "Centralize o gerenciamento de certificados SSL para reduzir a sobrecarga de criptografia e descriptografia de um farm de servidores back-end", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", - "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", - "service": "SAP", - "severity": "Alto", - "text": "Se desejar atender aos SLAs de infraestrutura de seus aplicativos para componentes SAP (serviços centrais, servidores de aplicativos e bancos de dados), você deverá escolher as mesmas opções de alta disponibilidade (VMs, conjuntos de disponibilidade, zonas de disponibilidade) para todos os componentes.", - "waf": "Fiabilidade" + "checklist": "Azure Application Delivery Networking", + "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", + "service": "App Gateway", + "severity": "Baixo", + "text": "Usar o Application Gateway para suporte nativo para protocolos WebSocket e HTTP/2", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "cbe05bbe-209d-4490-ba47-778424d11678", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", - "severity": "Alto", - "text": "Não misture servidores de funções diferentes no mesmo conjunto de disponibilidade. Mantenha VMs de serviços centrais, VMs de banco de dados, VMs de aplicativos em seus próprios conjuntos de disponibilidade", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", + "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", + "service": "AKS", + "severity": "Baixo", + "text": "Se necessário para cargas de trabalho do AKS Windows, os contêineres HostProcess podem ser usados", "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", - "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", - "service": "SAP", - "severity": "Média", - "text": "Você não pode implantar conjuntos de disponibilidade do Azure em uma zona de disponibilidade do Azure, a menos que use grupos de posicionamento de proximidade.", - "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "waf": "Fiabilidade" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", + "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", + "service": "AKS", + "severity": "Baixo", + "text": "Usar o KEDA se estiver executando cargas de trabalho orientadas a eventos", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "9674e7c7-7796-4181-8920-09f4429543ba", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", + "link": "https://dapr.io/", + "service": "AKS", + "severity": "Baixo", + "text": "Use o Dapr para facilitar o desenvolvimento de microsserviços", + "waf": "Operações" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", + "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", + "link": "https://learn.microsoft.com/azure/aks/uptime-sla", + "service": "AKS", "severity": "Alto", - "text": "Ao criar conjuntos de disponibilidade, use o número máximo de domínios de falha e atualize domínios disponíveis. Por exemplo, se você implantar mais de duas VMs em um conjunto de disponibilidade, use o número máximo de domínios de falha (três) e domínios de atualização suficientes para limitar o efeito de possíveis falhas de hardware físico, interrupções de rede ou interrupções de energia, além da manutenção planejada do Azure. O número padrão de domínios de falha é dois e você não pode alterá-lo online mais tarde.", - "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "text": "Use a oferta AKS apoiada por SLA", "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", - "severity": "Alto", - "text": "Quando você usa grupos de posicionamento de proximidade do Azure em uma implantação de conjunto de disponibilidade, todos os três componentes SAP (serviços centrais, servidor de aplicativos e banco de dados) devem estar no mesmo grupo de posicionamento de proximidade.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", + "severity": "Baixo", + "text": "Usar orçamentos de interrupção em seu pod e definições de implantação", "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", + "checklist": "Azure AKS Review", + "guid": "3c763963-7a55-42d5-a15e-401955387e5c", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", + "service": "ACR", "severity": "Alto", - "text": "Use um grupo de posicionamento de proximidade por SAP SID. Os grupos não se estendem por zonas de disponibilidade ou regiões do Azure", + "text": "Se estiver usando um registro privado, configure a replicação de região para armazenar imagens em várias regiões", "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", - "severity": "Alto", - "text": "Use um dos seguintes serviços para executar clusters de serviços centrais SAP, dependendo do sistema operacional.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidade" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", + "service": "AKS", + "severity": "Baixo", + "text": "Use um aplicativo externo, como kubecost, para alocar custos para diferentes usuários", + "waf": "Custar" }, { - "checklist": "SAP Checklist", - "guid": "ed46b937-913e-4018-9c62-8393ab037e53", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", + "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", + "service": "AKS", + "severity": "Baixo", + "text": "Usar o modo de redução para excluir/desalocar nós", + "waf": "Custar" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", + "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", + "service": "AKS", "severity": "Média", - "text": "No momento, o Azure não oferece suporte à combinação de ASCS e HA de banco de dados no mesmo cluster do Linux Pacemaker; Separe-os em agrupamentos individuais. No entanto, você pode combinar até cinco clusters de serviços centrais em um par de VMs.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidade" + "text": "Quando necessário, use a GPU de partioning de várias instâncias em clusters AKS", + "waf": "Custar" }, { - "checklist": "SAP Checklist", - "guid": "f656e745-0cfb-453e-8008-0528fa21c933", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", + "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", + "service": "AKS", + "severity": "Baixo", + "text": "Se estiver executando um cluster de desenvolvimento/teste, use NodePool Start/Stop", + "waf": "Custar" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", + "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", + "service": "AKS", "severity": "Média", - "text": "Implante ambas as VMs no par de alta disponibilidade em um conjunto de disponibilidade ou em zonas de disponibilidade. Essas VMs devem ter o mesmo tamanho e a mesma configuração de armazenamento.", - "waf": "Fiabilidade" + "text": "Usar a Política do Azure para Kubernetes para garantir a conformidade do cluster", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "7f684ebc-95da-425e-b329-e782dbed050f", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", + "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "severity": "Média", - "text": "O Azure oferece suporte à instalação e configuração de instâncias SAP HANA e ASCS/SCS e ERS no mesmo cluster de alta disponibilidade em execução no Red Hat Enterprise Linux (RHEL).", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", - "waf": "Fiabilidade" + "text": "Separe os aplicativos do plano de controle com pools de nós de usuário/sistema", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", - "severity": "Alto", - "text": "Execute todos os sistemas de produção em SSDs gerenciados Premium e use o Azure NetApp Files ou o Ultra Disk Storage. Pelo menos o disco do sistema operacional deve estar na camada Premium para que você possa obter melhor desempenho e o melhor SLA.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", - "waf": "Fiabilidade" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", + "severity": "Baixo", + "text": "Adicione mancha ao seu nodepool do sistema para torná-lo dedicado", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", - "service": "SAP", - "severity": "Alto", - "text": "Você deve executar o SAP HANA no Azure somente nos tipos de armazenamento certificados pela SAP. Observe que determinados volumes devem ser executados em determinadas configurações de disco, quando aplicável. Essas configurações incluem a habilitação do Acelerador de Gravação e o uso do armazenamento Premium. Você também precisa garantir que o sistema de arquivos executado no armazenamento seja compatível com o DBMS executado na máquina.", - "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", - "waf": "Fiabilidade" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", + "link": "https://learn.microsoft.com/azure/container-registry/", + "service": "AKS", + "severity": "Média", + "text": "Usar um registro privado para suas imagens, como o ACR", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", - "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", - "service": "SAP", - "severity": "Alto", - "text": "Considere configurar a alta disponibilidade dependendo do tipo de armazenamento usado para suas cargas de trabalho SAP. Alguns serviços de armazenamento disponíveis no Azure não têm suporte no Azure Site Recovery, portanto, sua configuração de alta disponibilidade pode ser diferente.", - "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", - "waf": "Fiabilidade" + "checklist": "Azure AKS Review", + "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", + "link": "https://learn.microsoft.com/azure/security-center/container-security", + "service": "ACR", + "severity": "Média", + "text": "Analise suas imagens em busca de vulnerabilidades", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", - "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", + "service": "AKS", "severity": "Alto", - "text": "Diferentes serviços de armazenamento nativos do Azure (como Arquivos do Azure, Arquivos do Azure NetApp, Disco Compartilhado do Azure) podem não estar disponíveis em todas as regiões. Portanto, para ter uma configuração SAP semelhante na região de DR após o failover, certifique-se de que o respectivo serviço de armazenamento seja oferecido no local de DR.", - "waf": "Fiabilidade" + "text": "Definir requisitos de separação de aplicativos (namespace/nodepool/cluster)", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", + "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", + "service": "AKS", "severity": "Média", - "text": "Automatize o Start-Stop do sistema SAP para gerenciar custos.", - "waf": "Custar" + "text": "Armazene seus segredos no Cofre de Chaves do Azure com o driver do CSI Secrets Store", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", - "severity": "Baixo", - "text": "No caso de usar o Armazenamento Premium do Azure com o SAP HANA, o armazenamento SSD padrão do Azure pode ser usado para selecionar uma solução de armazenamento econômica. No entanto, observe que escolher o armazenamento padrão SSD ou HDD padrão do Azure afetará o SLA das VMs individuais. Além disso, para sistemas com menor taxa de transferência de E/S e baixa latência, como ambientes que não são de produção, VMs de série mais baixa podem ser usadas.", - "waf": "Custar" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", + "link": "https://learn.microsoft.com/azure/aks/update-credentials", + "service": "AKS", + "severity": "Alto", + "text": "Se estiver usando entidades de serviço para o cluster, atualize as credenciais periodicamente (como trimestralmente)", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "9877f353-2591-4e8b-8381-e9043fed1010", - "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", - "service": "SAP", - "severity": "Baixo", - "text": "Como uma configuração alternativa de baixo custo (multiuso), você pode escolher uma SKU de baixo desempenho para suas VMs de servidor de banco de dados HANA que não são de produção. No entanto, é importante observar que alguns tipos de VM, como a série E, não são certificados pelo HANA (SAP HANA Hardware Directory) ou não podem atingir latência de armazenamento inferior a 1ms.", - "waf": "Custar" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", + "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", + "service": "AKS", + "severity": "Média", + "text": "Se necessário, adicione criptografia etcd do Serviço de Gerenciamento de Chaves", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", - "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", - "service": "SAP", - "severity": "Alto", - "text": "Impor um modelo RBAC para grupos de gerenciamento, assinaturas, grupos de recursos e recursos", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", + "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", + "service": "AKS", + "severity": "Baixo", + "text": "Se necessário, considere o uso de computação confidencial para AKS", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "45911475-e39e-4530-accc-d979366bcda2", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", + "service": "AKS", "severity": "Média", - "text": "Impor a propagação principal para encaminhar a identidade do aplicativo de nuvem SAP para o SAP local (incluindo IaaS) por meio do conector de nuvem", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", + "text": "Considere o uso do Defender for Containers", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", - "service": "SAP", - "severity": "Média", - "text": "Implemente SSO em aplicativos SAP SaaS como SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics e SAP C4C com o Azure AD usando SAML.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", + "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", + "service": "AKS", + "severity": "Alto", + "text": "Usar identidades gerenciadas em vez de entidades de serviço", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", + "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", + "link": "https://learn.microsoft.com/azure/aks/managed-aad", + "service": "AKS", "severity": "Média", - "text": "Implemente SSO em aplicativos Web baseados no SAP NetWeaver, como SAP Fiori e SAP Web GUI, usando SAML.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "text": "Integrar autenticação com AAD (usando a integração gerenciada)", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", - "service": "SAP", - "severity": "Média", - "text": "Implemente SSO em aplicativos Web baseados no SAP NetWeaver, como SAP Fiori e SAP Web GUI, usando SAML.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", + "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", + "service": "AKS", + "severity": "Média", + "text": "Limitar o acesso ao admin kubeconfig (get-credentials --admin)", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", + "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", + "service": "AKS", "severity": "Média", - "text": "Você pode implementar o SSO no SAP GUI usando o SAP NetWeaver SSO ou uma solução de parceiro.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "text": "Integrar autorização com AAD RBAC", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", - "service": "SAP", - "severity": "Média", - "text": "Para SSO para SAP GUI e acesso ao navegador web, implemente SNC / Kerberos / SPNEGO (mecanismo de negociação GSSAPI simples e protegido) devido a sua facilidade de configuração e manutenção. Para SSO com certificados de cliente X.509, considere o SAP Secure Login Server, que é um componente da solução SAP SSO.", - "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", + "service": "AKS", + "severity": "Alto", + "text": "Usar namespaces para restringir o privilégio RBAC no Kubernetes", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", - "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", + "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", + "service": "AKS", "severity": "Média", - "text": "Para SSO para SAP GUI e acesso ao navegador web, implemente SNC / Kerberos / SPNEGO (mecanismo de negociação GSSAPI simples e protegido) devido a sua facilidade de configuração e manutenção. Para SSO com certificados de cliente X.509, considere o SAP Secure Login Server, que é um componente da solução SAP SSO.", + "text": "Para o Gerenciamento de Acesso à Identidade de Pod, use a Identidade de Carga de Trabalho do Azure AD (visualização)", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "16785d6f-a96c-496a-b885-18f482734c88", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", + "service": "AKS", "severity": "Média", - "text": "Implemente o SSO usando o OAuth for SAP NetWeaver para permitir que aplicativos de terceiros ou personalizados acessem os serviços OData do SAP NetWeaver.", + "text": "Para logins não interativos do AKS, use kubelogin (visualização)", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "a747c350-8d4c-449c-93af-393dbca77c48", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", + "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", + "service": "AKS", "severity": "Média", - "text": "Implementar SSO no SAP HANA", + "text": "Desativar contas locais do AKS", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", - "service": "SAP", - "severity": "Média", - "text": "Considere o Azure AD um provedor de identidade para sistemas SAP hospedados no RISE. Para obter mais informações, consulte Integrando o serviço ao Azure AD.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", + "service": "AKS", + "severity": "Baixo", + "text": "Configurar, se necessário, o acesso ao cluster just-in-time", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", - "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", - "service": "SAP", - "severity": "Média", - "text": "Para aplicativos que acessam o SAP, convém usar a propagação principal para estabelecer o SSO.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", + "service": "AKS", + "severity": "Baixo", + "text": "Configurar, se necessário, o acesso condicional do AAD para AKS", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", - "service": "SAP", - "severity": "Média", - "text": "Se você estiver usando serviços SAP BTP ou soluções SaaS que exigem o SAP Identity Authentication Service (IAS), considere implementar SSO entre o SAP Cloud Identity Authentication Services e o Azure AD para acessar esses serviços SAP. Essa integração permite que o SAP IAS atue como um provedor de identidade de proxy e encaminhe solicitações de autenticação para o Azure AD como o repositório central do usuário e o provedor de identidade.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", + "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", + "service": "AKS", + "severity": "Baixo", + "text": "Se necessário para cargas de trabalho do Windows AKS, configure o gMSA ", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", + "service": "AKS", "severity": "Média", - "text": "Implementar SSO no SAP BTP", + "text": "Para um controle mais fino, considere usar uma Identidade Kubelet gerenciada", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", - "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", + "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", + "service": "AKS", "severity": "Média", - "text": "Se você estiver usando o SAP SuccessFactors, considere usar o provisionamento automatizado de usuários do Azure AD. Com essa integração, à medida que você adiciona novos funcionários ao SAP SuccessFactors, pode criar automaticamente suas contas de usuário no Azure AD. Opcionalmente, você pode criar contas de usuário no Microsoft 365 ou em outros aplicativos SaaS com suporte no Azure AD. Use write-back do endereço de e-mail para SAP SuccessFactors.", - "waf": "Segurança" + "text": "Se estiver usando AGIC, não compartilhe um AppGW entre clusters", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "6ba28021-4591-4147-9e39-e5309cccd979", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", + "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", + "link": "https://learn.microsoft.com/azure/aks/http-application-routing", + "service": "AKS", + "severity": "Alto", + "text": "Não use AKS HTTP Routing Add-On, use em vez disso a entrada NGINX gerenciada com o complemento de roteamento de aplicativo.", + "waf": "Fiabilidade" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", + "service": "AKS", "severity": "Média", - "text": "impor políticas existentes do Grupo de Gerenciamento às assinaturas SAP", - "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", - "waf": "Operações" + "text": "Para cargas de trabalho do Windows, use a Rede Acelerada", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", + "guid": "ba7da7be-9952-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "severity": "Alto", - "text": "Integre aplicativos fortemente acoplados na mesma assinatura SAP para evitar complexidade adicional de roteamento e gerenciamento", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", - "waf": "Operações" + "text": "Use o ALB padrão (em oposição ao básico)", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", - "severity": "Alto", - "text": "Aproveite a assinatura como unidade de escala e dimensione nossos recursos, considere implantar a assinatura por ambiente, por exemplo. Sandbox, não-prod, prod ", - "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", + "service": "AKS", + "severity": "Média", + "text": "Se estiver usando o CNI do Azure, considere usar sub-redes diferentes para NodePools", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", - "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", - "service": "SAP", - "severity": "Alto", - "text": "Garantir o aumento da cota como parte do provisionamento de assinatura (por exemplo, total de núcleos de VM disponíveis em uma assinatura)", - "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", + "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", + "service": "AKS", + "severity": "Média", + "text": "Usar Pontos de Extremidade Privados (preferencial) ou Pontos de Extremidade de Serviço de Rede Virtual para acessar serviços de PaaS do cluster", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", - "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", - "service": "SAP", - "severity": "Baixo", - "text": "A API de Cota é uma API REST que você pode usar para exibir e gerenciar cotas para serviços do Azure. Considere usá-lo, se necessário.", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", + "guid": "a0f61565-9de5-458f-a372-49c831112dbd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", + "severity": "Alto", + "text": "Escolha o melhor plug-in de rede CNI para seus requisitos (Azure CNI recomendado)", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", - "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "severity": "Alto", - "text": "Se estiver implantando em uma zona de disponibilidade, verifique se a implantação da zona da VM estará disponível depois que a cota for aprovada. Envie uma solicitação de suporte com a assinatura, a série VM, o número de CPUs e a zona de disponibilidade necessárias.", - "waf": "Operações" + "text": "Se estiver usando o Azure CNI, dimensione sua sub-rede de acordo considerando o número máximo de pods por nó", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "e6e20617-3686-4af4-9791-f8935ada4332", - "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "severity": "Alto", - "text": "Certifique-se de que os serviços e recursos necessários estejam disponíveis nas regiões de implantação escolhidas, por exemplo. ANF, Zona etc.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", - "waf": "Operações" + "text": "Se estiver usando o Azure CNI, verifique o máximo de pods/nó (padrão 30)", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", - "service": "SAP", - "severity": "Média", - "text": "Aproveite a marca de recurso do Azure para categorização de custos e agrupamento de recursos (: BillTo, Departamento (ou Unidade de Negócios), Ambiente (Produção, Estágio, Desenvolvimento), Camada (Camada da Web, Camada de Aplicativo), Proprietário do Aplicativo, ProjectName)", - "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "Para aplicativos internos, as organizações geralmente abrem toda a sub-rede AKS em seus firewalls. Isso abre o acesso de rede para os nós também e, potencialmente, para os pods também (se estiver usando o Azure CNI). Se os IPs do LoadBalancer estiverem em uma sub-rede diferente, somente este precisará estar disponível para os clientes do aplicativo. Outra razão é que, se os endereços IP na sub-rede AKS são um recurso escasso, consumir seus endereços IP para serviços reduzirá a escalabilidade máxima do cluster.", + "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", + "link": "https://learn.microsoft.com/azure/aks/internal-lb", + "service": "AKS", + "severity": "Baixo", + "text": "Se estiver usando serviços LoadBalancer de IP privado, use uma sub-rede dedicada (não a sub-rede AKS)", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "severity": "Alto", - "text": "Ajude a proteger seu banco de dados HANA usando o serviço de Backup do Azure.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", + "text": "Dimensione o intervalo de endereços IP do serviço de acordo (isso limitará a escalabilidade do cluster)", "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", - "service": "SAP", - "severity": "Média", - "text": "Se você implantar os Arquivos NetApp do Azure para seu banco de dados HANA, Oracle ou DB2, use a ferramenta Azure Application Consistent Snapshot (AzAcSnap) para tirar instantâneos consistentes com o aplicativo. O AzAcSnap também suporta bancos de dados Oracle. Considere usar o AzAcSnap em uma VM central em vez de em VMs individuais.", - "waf": "Fiabilidade" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", + "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", + "service": "AKS", + "severity": "Baixo", + "text": "Se necessário, adicione seu próprio plugin CNI", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", - "severity": "Alto", - "text": "Garanta as correspondências de fuso horário entre o sistema operacional e o sistema SAP.", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", + "service": "AKS", + "severity": "Baixo", + "text": "Se necessário, configure o IP público por nó no AKS", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "c3c7abc0-716c-4486-893c-40e181d65539", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", + "link": "https://learn.microsoft.com/azure/aks/concepts-network", + "service": "AKS", "severity": "Média", - "text": "Não agrupe serviços de aplicativos diferentes no mesmo cluster. Por exemplo, não combine clusters DRBD e de serviços centrais no mesmo cluster. No entanto, você pode usar o mesmo cluster do Pacemaker para gerenciar aproximadamente cinco serviços centrais diferentes (cluster multi-SID).", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "text": "Usar um controlador de entrada para expor aplicativos baseados na Web em vez de expô-los com serviços do tipo LoadBalancer", "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "a491dfc4-9353-4213-9217-eef0949f9467", - "link": "https://azure.microsoft.com/pricing/offers/dev-test/", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", + "link": "https://learn.microsoft.com/azure/aks/nat-gateway", + "service": "AKS", "severity": "Baixo", - "text": "Considere executar sistemas de desenvolvimento/teste em um modelo de soneca para economizar e otimizar os custos de execução do Azure.", - "waf": "Custar" - }, - { - "checklist": "SAP Checklist", - "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", - "link": "https://learn.microsoft.com/azure/lighthouse/overview", - "service": "SAP", - "severity": "Média", - "text": "Se você faz parceria com clientes gerenciando suas propriedades SAP, considere o Farol do Azure. O Azure Lighthouse permite que os provedores de serviços gerenciados usem os serviços de identidade nativos do Azure para se autenticar no ambiente dos clientes. Ele coloca o controle nas mãos dos clientes, porque eles podem revogar o acesso a qualquer momento e auditar as ações dos prestadores de serviços.", - "waf": "Operações" + "text": "Usar o Gateway NAT do Azure como outboundType para dimensionar o tráfego de saída", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "4d116785-d2fa-456c-96ad-48408fe72734", - "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", + "service": "AKS", "severity": "Média", - "text": "Use o Azure Update Manager para verificar o status das atualizações disponíveis para uma única VM ou várias VMs e considere agendar patches regulares.", - "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", - "waf": "Operações" + "text": "Usar alocações dinâmicas de IPs para evitar o esgotamento de IP do CNI do Azure", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", - "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", - "service": "SAP", - "severity": "Baixo", - "text": "Otimize e gerencie as operações do SAP Basis usando o SAP Landscape Management (LaMa). Use o conector SAP LaMa para Azure para realocar, copiar, clonar e atualizar sistemas SAP.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", + "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", + "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", + "service": "AKS", + "severity": "Alto", + "text": "Filtre o tráfego de saída com AzFW/NVA se seus requisitos de segurança exigirem", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "14591147-5e39-4e53-89cc-cd979366bcda", - "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", + "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", + "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", + "service": "AKS", "severity": "Média", - "text": "Use as soluções do Azure Monitor for SAP para monitorar suas cargas de trabalho SAP (SAP HANA, clusters SUSE de alta disponibilidade e sistemas SQL) no Azure. Considere complementar o Azure Monitor para soluções SAP com o SAP Solution Manager.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", - "waf": "Operações" + "text": "Se estiver usando um ponto de extremidade de API público, restrinja os endereços IP que podem acessá-lo", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", - "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", + "link": "https://learn.microsoft.com/azure/aks/private-clusters", + "service": "AKS", "severity": "Alto", - "text": "Execute uma verificação de extensão de VM para SAP. A Extensão de VM para SAP usa a identidade gerenciada atribuída de uma máquina virtual (VM) para acessar dados de monitoramento e configuração de VM. A verificação garante que todas as métricas de desempenho em seu aplicativo SAP venham da Extensão do Azure para SAP subjacente.", - "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", - "waf": "Operações" + "text": "Use clusters privados se seus requisitos exigirem", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "severity": "Média", - "text": "Use a Política do Azure para controle de acesso e relatórios de conformidade. A Política do Azure fornece a capacidade de impor configurações em toda a organização para garantir a adesão consistente à política e a detecção rápida de violações. ", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "Operações" + "text": "Para os nós AKS do Windows 2019 e 2022, as Diretivas de Rede Calico podem ser usadas ", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", - "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", - "service": "SAP", - "severity": "Média", - "text": "Use o Monitor de Conexão no Inspetor de Rede do Azure para monitorar métricas de latência para bancos de dados SAP e servidores de aplicativos. Ou colete e exiba medições de latência de rede usando o Azure Monitor.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", + "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", + "severity": "Alto", + "text": "Habilitar uma opção de Política de Rede do Kubernetes (Calico/Azure)", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "73686af4-6791-4f89-95ad-a43324e13811", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", - "service": "SAP", - "severity": "Média", - "text": "Execute uma verificação de qualidade para o SAP HANA na infraestrutura provisionada do Azure para verificar se as VMs provisionadas estão em conformidade com as práticas recomendadas do SAP HANA no Azure.", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", + "severity": "Alto", + "text": "Usar diretivas de rede do Kubernetes para aumentar a segurança intra-cluster", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "616785d6-fa96-4c96-ad88-518f482734c8", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "severity": "Alto", - "text": "Para cada assinatura do Azure, execute um teste de latência nas zonas de disponibilidade do Azure antes da implantação zonal para escolher zonas de baixa latência para implantação do SAP no Azure.", - "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "waf": "Desempenho" + "text": "Usar um WAF para cargas de trabalho da Web (UIs ou APIs)", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", - "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", + "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", + "service": "AKS", "severity": "Média", - "text": "Execute o Relatório de Resiliência para garantir que a configuração de toda a infraestrutura provisionada do Azure (Computação, Banco de Dados, Rede, Armazenamento, Recuperação de Site) esteja em conformidade com a configuração definida pelo Cloud Adaption Framework para Azure.", - "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", - "waf": "Fiabilidade" + "text": "Usar DDoS Standard na Rede Virtual AKS", + "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", - "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", + "link": "https://learn.microsoft.com/azure/aks/http-proxy", + "service": "AKS", + "severity": "Baixo", + "text": "Se necessário, adicione o proxy HTTP da empresa", + "waf": "Segurança" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", + "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", + "service": "AKS", "severity": "Média", - "text": "Implemente a proteção contra ameaças usando a solução Microsoft Sentinel para SAP. Use esta solução para monitorar seus sistemas SAP e detectar ameaças sofisticadas em toda a lógica de negócios e camadas de aplicativos.", - "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", + "text": "Considere o uso de uma malha de serviço para gerenciamento avançado de comunicação de microsserviços", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", - "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "service": "SAP", - "severity": "Média", - "text": "A marcação do Azure pode ser aproveitada para agrupar e controlar recursos logicamente, automatizar suas implantações e, o mais importante, fornecer visibilidade sobre os custos incorridos.", - "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", + "service": "AKS", + "severity": "Alto", + "text": "Configurar alertas nas métricas mais críticas (consulte Insights de contêiner para obter recomendações)", + "waf": "Operações" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "337453a3-cc63-4963-9a65-22ac19e80696", + "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", + "service": "AKS", + "severity": "Baixo", + "text": "Verifique regularmente o Azure Advisor para obter recomendações sobre o seu cluster", + "waf": "Operações" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", + "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", + "service": "AKS", + "severity": "Baixo", + "text": "Habilitar a rotação automática do certificado AKS", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", - "service": "SAP", - "severity": "Baixo", - "text": "Use o monitoramento de latência entre VMs para aplicativos sensíveis à latência.", - "waf": "Desempenho" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", + "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", + "service": "AKS", + "severity": "Alto", + "text": "Tenha um processo regular para atualizar sua versão do kubernetes periodicamente (trimestralmente, por exemplo), ou use o recurso de atualização automática do AKS", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", - "service": "SAP", - "severity": "Média", - "text": "Use o monitoramento do Azure Site Recovery para manter a integridade do serviço de recuperação de desastres para servidores de aplicativos SAP.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", - "waf": "Fiabilidade" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", + "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", + "service": "AKS", + "severity": "Alto", + "text": "Use kured para atualizações de nó do Linux caso você não esteja usando a atualização de imagem de nó", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", - "service": "SAP", - "severity": "Média", - "text": "Exclua todos os sistemas de arquivos de banco de dados e programas executáveis das verificações antivírus. Incluí-los pode levar a problemas de desempenho. Verifique com os fornecedores do banco de dados para obter detalhes prescritivos na lista de exclusão. Por exemplo, a Oracle recomenda excluir /oracle//sapdata das verificações antivírus.", - "waf": "Desempenho" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", + "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", + "service": "AKS", + "severity": "Alto", + "text": "Tenha um processo regular para atualizar as imagens do nó do cluster periodicamente (semanalmente, por exemplo)", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "c027f893-f404-41a9-b33d-39d625a14964", - "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", + "service": "AKS", "severity": "Baixo", - "text": "Considere a coleta de estatísticas completas de banco de dados para bancos de dados não-HANA após a migração. Por exemplo, implemente a nota SAP 1020260 - Entrega de estatísticas Oracle.", - "waf": "Desempenho" + "text": "Considere gitops para implantar aplicativos ou configuração de cluster em vários clusters", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", - "service": "SAP", - "severity": "Média", - "text": "Considere o uso do Oracle Automatic Storage Management (ASM) para todas as implantações Oracle que usam SAP no Azure.", - "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", - "waf": "Desempenho" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d7672c26-7602-4482-85a4-14527fbe855c", + "link": "https://learn.microsoft.com/azure/aks/command-invoke", + "service": "AKS", + "severity": "Baixo", + "text": "Considere o uso do comando AKS invoke em clusters privados", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", - "service": "SAP", - "severity": "Média", - "text": "Para SAP no Azure executando Oracle, uma coleção de scripts SQL pode ajudá-lo a diagnosticar problemas de desempenho. Os relatórios do Automatic Workload Repository (AWR) contêm informações valiosas para diagnosticar problemas no sistema Oracle. Recomendamos que você execute um relatório AWR durante várias sessões e escolha horários de pico para ele, para garantir uma ampla cobertura para a análise.", - "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", - "waf": "Desempenho" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", + "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", + "service": "AKS", + "severity": "Baixo", + "text": "Para eventos planejados, considere o uso do Dreno Automático de Nó", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", + "link": "https://learn.microsoft.com/azure/aks/faq", + "service": "AKS", "severity": "Alto", - "text": "Use o monitoramento do Azure Site Recovery para manter a integridade do serviço de recuperação de desastres para servidores de aplicativos SAP.", - "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "text": "Desenvolver práticas próprias de governança para garantir que nenhuma alteração seja realizada pelos operadores no nó RG (também conhecido como 'infra RG')", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "SAP", - "severity": "Média", - "text": "Para a entrega segura de aplicativos HTTP/S, use o Application Gateway v2 e verifique se a proteção e as políticas do WAF estão habilitadas.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", - "waf": "Segurança" - }, - { - "checklist": "SAP Checklist", - "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", - "severity": "Média", - "text": "Se o DNS ou o nome virtual da máquina virtual não for alterado durante a migração para o Azure, o DNS em segundo plano e os nomes virtuais conectam muitas interfaces do sistema no cenário SAP, e os clientes só às vezes estão cientes das interfaces que os desenvolvedores definem ao longo do tempo. Surgem desafios de conexão entre vários sistemas quando os nomes virtuais ou DNS mudam após as migrações, e é recomendável manter os aliases DNS para evitar esses tipos de dificuldades.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", + "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", + "severity": "Baixo", + "text": "Use o nome personalizado do Node RG (também conhecido como 'Infra RG')", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", + "link": "https://kubernetes.io/docs/setup/release/notes/", + "service": "AKS", "severity": "Média", - "text": "Use zonas DNS diferentes para distinguir cada ambiente (sandbox, desenvolvimento, pré-produção e produção) um do outro. A exceção é para implantações SAP com sua própria VNet; aqui, zonas DNS privadas podem não ser necessárias.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "text": "Não use APIs do Kubernetes preteridas em seus manifestos do YAML", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "a3592829-e6e2-4061-9368-6af46791f893", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", - "service": "SAP", - "severity": "Média", - "text": "Emparelhamento de rede virtual local e global fornecem conectividade e são as abordagens preferidas para garantir a conectividade entre zonas de aterrissagem para implantações SAP em várias regiões do Azure", - "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", - "waf": "Fiabilidade" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", + "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", + "service": "AKS", + "severity": "Baixo", + "text": "Manchar os nós do Windows", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", - "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", - "service": "SAP", - "severity": "Alto", - "text": "Não há suporte para implantar qualquer NVA entre o aplicativo SAP e o servidor de banco de dados SAP", - "training": "https://me.sap.com/notes/2731110", - "waf": "Desempenho" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", + "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", + "service": "AKS", + "severity": "Baixo", + "text": "Mantenha o nível de patch dos contêineres do Windows sincronizado com o nível do patch do host", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", - "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", - "service": "SAP", - "severity": "Média", - "text": "Use a WAN Virtual para implantações do Azure em redes novas, grandes ou globais onde você precisa de conectividade de trânsito global entre regiões do Azure e locais locais. Com essa abordagem, você não precisará configurar manualmente o roteamento transitivo para a rede do Azure e poderá seguir um padrão para implantações do SAP no Azure.", - "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "Por meio de Configurações de Diagnóstico no nível do cluster", + "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", + "link": "https://learn.microsoft.com/azure/aks/monitor-aks", + "service": "AKS", + "severity": "Baixo", + "text": "Envie logs mestre (também conhecidos como logs de API) para o Azure Monitor ou sua solução de gerenciamento de logs preferida", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", - "service": "SAP", - "severity": "Média", - "text": "Considere a implantação de dispositivos virtuais de rede (NVAs) entre regiões somente se NVAs de parceiros forem usados. NVAs entre regiões ou VNets não são necessários se NVAs nativos estiverem presentes. Ao implantar tecnologias de rede de parceiros e NVAs, siga as orientações do fornecedor para verificar configurações conflitantes com a rede do Azure.", - "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", + "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", + "service": "AKS", + "severity": "Baixo", + "text": "Se necessário, use instantâneos do nodePool", + "waf": "Custar" }, { - "checklist": "SAP Checklist", - "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", - "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", - "service": "SAP", - "severity": "Média", - "text": "A WAN virtual gerencia a conectividade entre VNets spoke para topologias baseadas em WAN virtual (não há necessidade de configurar o roteamento definido pelo usuário [UDR] ou NVAs), e a taxa de transferência máxima de rede para o tráfego de VNet-to-VNet no mesmo hub virtual é de 50 gigabits por segundo. Se necessário, as zonas de aterrissagem SAP podem usar o emparelhamento de VNet para se conectar a outras zonas de aterrissagem e superar essa limitação de largura de banda.", - "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", + "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", + "service": "AKS", + "severity": "Baixo", + "text": "Considere pools de nós spot para cargas de trabalho não sensíveis ao tempo", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "82734c88-6ba2-4802-8459-11475e39e530", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", - "severity": "Alto", - "text": "A atribuição de IP público à VM que executa o SAP Workload não é recomendada.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", - "waf": "Segurança" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", + "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", + "severity": "Baixo", + "text": "Considere o nó virtual AKS para intermitência rápida", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", - "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", "severity": "Alto", - "text": "Considere reservar o endereço IP no lado do DR ao configurar o ASR", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "Monitore suas métricas de cluster com o Container Insights (ou outras ferramentas como o Prometheus)", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", + "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", "severity": "Alto", - "text": "Evite usar intervalos de endereços IP sobrepostos para sites de produção e DR.", - "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "text": "Armazene e analise seus logs de cluster com o Container Insights (ou outras ferramentas como Telegraf/ElasticSearch)", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "6e154e3a-a359-4282-ae6e-206173686af4", - "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", + "service": "AKS", "severity": "Média", - "text": "Embora o Azure ajude você a criar várias sub-redes delegadas em uma rede virtual, apenas uma sub-rede delegada pode existir em uma rede virtual para arquivos do Azure NetApp. As tentativas de criar um novo volume falharão se você usar mais de uma sub-rede delegada para Arquivos do Azure NetApp.", - "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", + "text": "Monitorar a utilização da CPU e da memória dos nós", "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", - "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", - "service": "SAP", - "severity": "Média", - "text": "Usar o Firewall do Azure para controlar o tráfego de saída do Azure para a Internet, conexões de entrada não HTTP/S e filtragem de tráfego Leste/Oeste (se a organização exigir)", - "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", - "waf": "Segurança" - }, - { - "checklist": "SAP Checklist", - "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", - "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", - "service": "SAP", - "severity": "Média", - "text": "O Application Gateway e o Web Application Firewall têm limitações quando o Application Gateway serve como um proxy reverso para aplicativos Web SAP, conforme mostrado na comparação entre o Application Gateway, o SAP Web Dispatcher e outros serviços de terceiros.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", - "waf": "Segurança" - }, - { - "checklist": "SAP Checklist", - "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", - "severity": "Média", - "text": "Use as políticas do Azure Front Door e do WAF para fornecer proteção global entre as regiões do Azure para conexões HTTP/S de entrada para uma zona de aterrissagem.", - "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", - "waf": "Segurança" - }, - { - "checklist": "SAP Checklist", - "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1a4835ac-9422-423e-ae80-b123081a5417", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "severity": "Média", - "text": "Aproveite as políticas do Web Application Firewall no Azure Front Door quando estiver usando o Azure Front Door e o Application Gateway para proteger aplicativos HTTP/S. Bloqueie o Gateway de Aplicativo para receber tráfego somente do Azure Front Door.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", - "waf": "Segurança" + "text": "Se estiver usando o Azure CNI, monitore a % de IPs de pod consumidos por nó", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "5ada4332-4e13-4811-9231-81aa41742694", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "A E/S no disco do sistema operacional é um recurso crítico. Se o sistema operacional nos nós for limitado na E/S, isso pode levar a um comportamento imprevisível, geralmente terminando no nó sendo declarado NotReady", + "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", + "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", + "service": "AKS", "severity": "Média", - "text": "Use um firewall de aplicativo Web para verificar seu tráfego quando ele estiver exposto à Internet. Outra opção é usá-lo com seu balanceador de carga ou com recursos que tenham recursos internos de firewall, como o Application Gateway ou soluções de terceiros.", - "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", - "waf": "Segurança" + "text": "Monitorar a profundidade da fila de disco do sistema operacional nos nós", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "be209d39-fda4-4777-a424-d116785c2fa5", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "severity": "Média", - "text": "Use a WAN Virtual para implantações do Azure em redes novas, grandes ou globais onde você precisa de conectividade de trânsito global entre regiões do Azure e locais locais. Com essa abordagem, você não precisará configurar manualmente o roteamento transitivo para a rede do Azure e poderá seguir um padrão para implantações do SAP no Azure.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", - "waf": "Desempenho" + "text": "Se não estiver usando filtragem de saída com AzFW/NVA, monitore as portas SNAT ALB alocadas padrão", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", + "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", + "service": "AKS", "severity": "Média", - "text": "Para evitar o vazamento de dados, use o Link Privado do Azure para acessar com segurança recursos de plataforma como serviço, como Armazenamento de Blobs do Azure, Arquivos do Azure, Azure Data Lake Storage Gen2, Azure Data Factory e muito mais. O Ponto de Extremidade Privado do Azure também pode ajudar a proteger o tráfego entre VNets e serviços como o Armazenamento do Azure, o Backup do Azure e muito mais. O tráfego entre sua rede virtual e o serviço habilitado para ponto de extremidade privado viaja pela rede global da Microsoft, o que impede sua exposição à Internet pública.", - "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", - "waf": "Segurança" + "text": "Assine as notificações de integridade de recursos para seu cluster AKS", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "severity": "Alto", - "text": "Verifique se a rede acelerada do Azure está habilitada nas VMs usadas nas camadas de aplicativo SAP e DBMS.", - "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", - "waf": "Desempenho" - }, - { - "checklist": "SAP Checklist", - "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", - "service": "SAP", - "severity": "Média", - "text": "Verifique se as implantações internas do Azure Load Balancer estão configuradas para usar DSR (Direct Server Return). Essa configuração (Habilitando IP flutuante) reduzirá a latência quando as configurações internas do balanceador de carga forem usadas para configurações de alta disponibilidade na camada DBMS.", - "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", - "waf": "Segurança" + "text": "Configurar solicitações e limites nas especificações do pod", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "6791f893-5ada-4433-84e1-3811523181aa", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "769ef669-1a48-435a-a942-223ece80b123", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "severity": "Média", - "text": "Você pode usar as regras ASG (grupo de segurança de aplicativo) e NSG para definir listas de controle de acesso de segurança de rede entre o aplicativo SAP e as camadas DBMS. Os ASGs agrupam máquinas virtuais para ajudar a gerenciar sua segurança.", - "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", - "waf": "Segurança" + "text": "Impor cotas de recursos para namespaces", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "081a5417-4158-433e-a3ad-3c2de733165c", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "AKS", "severity": "Alto", - "text": "Não há suporte para a colocação da camada de aplicativo SAP e do SGBD SAP em diferentes VNets do Azure que não são emparelhadas.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Desempenho" + "text": "Verifique se sua assinatura tem cota suficiente para expandir seus nodepools", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "fa96c96a-d885-418f-9827-34c886ba2802", - "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", + "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "severity": "Média", - "text": "Para obter a latência de rede ideal com aplicativos SAP, considere o uso de grupos de posicionamento de proximidade do Azure.", - "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", - "waf": "Desempenho" - }, - { - "checklist": "SAP Checklist", - "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", - "severity": "Alto", - "text": "NÃO há suporte para executar uma camada do SAP Application Server e uma camada de DBMS dividida entre o local e o Azure. Ambas as camadas precisam residir completamente no local ou no Azure.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "text": "Usar o Autoscaler de Cluster", "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", - "link": "https://me.sap.com/notes/2015553", - "service": "SAP", - "severity": "Alto", - "text": "Não é recomendado hospedar o sistema de gerenciamento de banco de dados (DBMS) e as camadas de aplicativos dos sistemas SAP em diferentes VNets e conectá-los ao emparelhamento de VNet devido aos custos substanciais que o tráfego de rede excessivo entre as camadas pode produzir. Recomende o uso de sub-redes na rede virtual do Azure para separar a camada de aplicativo SAP e a camada DBMS.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", - "waf": "Custar" - }, - { - "checklist": "SAP Checklist", - "guid": "402a9846-d515-4061-aff8-cd30088693fa", - "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", - "service": "SAP", - "severity": "Alto", - "text": "Se estiver usando o Load Balancer com sistemas operacionais convidados Linux, verifique se o parâmetro de rede Linux net.ipv4.tcp_timestamps está definido como 0.", - "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", + "guid": "831c2872-c693-4b39-a887-a561bada49bc", + "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", + "service": "AKS", + "severity": "Baixo", + "text": "Personalizar a configuração do nó para pools de nós AKS", "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "87585797-5551-4d53-bb7d-a94ee415734d", - "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "severity": "Média", - "text": "Para implantações SAP RISE/ECS, o emparelhamento virtual é a maneira preferida de estabelecer conectividade com o ambiente existente do Azure do cliente. Tanto a vnet do SAP quanto a(s) vnet(s) do cliente são protegidas com grupos de segurança de rede (NSG), permitindo a comunicação nas portas SAP e de banco de dados por meio do emparelhamento vnet", - "waf": "Segurança" + "text": "Use o Autoscaler do Pod Horizontal quando necessário", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", - "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "Nós maiores trarão maior desempenho e recursos, como discos efêmeros e rede acelerada, mas aumentarão o raio de explosão e diminuirão a granularidade de dimensionamento", + "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", + "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", + "service": "AKS", "severity": "Alto", - "text": "Revise os backups de banco de dados do SAP HANA para VMs do Azure.", - "waf": "Custar" + "text": "Considere um tamanho de nó apropriado, não muito grande ou muito pequeno", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", - "service": "SAP", - "severity": "Média", - "text": "Revise o monitoramento interno do Site Recovery, quando usado para SAP.", - "waf": "Custar" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", + "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", + "service": "AKS", + "severity": "Baixo", + "text": "Se mais de 5000 nós forem necessários para escalabilidade, considere o uso de um cluster AKS adicional", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", - "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", - "service": "SAP", - "severity": "Alto", - "text": "Revise as diretrizes de monitoramento do cenário do sistema SAP HANA.", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", + "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", + "service": "AKS", + "severity": "Baixo", + "text": "Considere assinar o EventGrid Events para automação AKS", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", - "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", - "service": "SAP", - "severity": "Média", - "text": "Revise o Banco de Dados Oracle nas estratégias de backup de VM do Linux do Azure.", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", + "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", + "service": "AKS", + "severity": "Baixo", + "text": "Para operações de longa duração em um cluster AKS, considere o encerramento do evento", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", - "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", - "service": "SAP", - "severity": "Média", - "text": "Analise o uso do Armazenamento de Blobs do Azure com o SQL Server 2016.", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", + "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", + "service": "AKS", + "severity": "Baixo", + "text": "Se necessário, considere usar hosts dedicados do Azure para nós AKS", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", - "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", - "service": "SAP", - "severity": "Média", - "text": "Analise o uso do Backup Automatizado v2 para VMs do Azure.", - "waf": "Operações" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", + "guid": "24367b33-6971-45b1-952b-eee0b9b588de", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", + "severity": "Alto", + "text": "Usar discos efêmeros do sistema operacional", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "AKS", "severity": "Alto", - "text": "Ativando o acelerador de gravação para a série M ao usar discos premium (V1)", - "waf": "Operações" + "text": "Para discos não efêmeros, use IOPS altos e discos maiores do sistema operacional para os nós ao executar muitos pods/nó, pois requer alto desempenho para executar vários pods e gerará logs enormes com limites de rotação de log AKS padrão", + "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", - "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", - "service": "SAP", - "severity": "Média", - "text": "Testar a latência da zona de disponibilidade.", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", + "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", + "service": "AKS", + "severity": "Baixo", + "text": "Para a opção de armazenamento de hiperdesempenho, use Ultra Disks no AKS", "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", - "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "service": "AKS", "severity": "Média", - "text": "Ative o SAP EarlyWatch Alert para todos os componentes SAP.", - "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", + "text": "Evite manter o estado no cluster e armazene dados fora (AzStorage, AzSQL, Cosmos, etc)", "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", - "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", + "service": "AKS", "severity": "Média", - "text": "Revise a latência do servidor de aplicativos SAP para o servidor de banco de dados usando o relatório SAP ABAPMeter /SSA/CAT.", - "training": "https://me.sap.com/notes/0002879613", + "text": "Se estiver usando o AzFiles Standard, considere o AzFiles Premium e/ou ANF por motivos de desempenho", "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", - "service": "SAP", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", + "service": "AKS", "severity": "Média", - "text": "Revise o monitoramento de desempenho do SQL Server usando o CCMS.", + "text": "Se estiver usando Discos e AZs do Azure, considere ter nodepools dentro de uma zona para disco LRS com VolumeBindingMode:WaitForFirstConsumer para provisionar armazenamento na zona direita ou use o disco ZRS para nodepools abrangendo várias zonas", "waf": "Desempenho" }, { - "checklist": "SAP Checklist", - "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", - "link": "https://me.sap.com/notes/500235", - "service": "SAP", - "severity": "Média", - "text": "Teste a latência de rede entre VMs de camada de aplicativo SAP e VMs DBMS (NIPING).", - "training": "https://me.sap.com/notes/1100926/E", - "waf": "Desempenho" + "checklist": "Logic Apps checklist", + "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", + "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", + "service": "Logic Apps", + "severity": "Alto", + "text": "Selecione o plano de hospedagem de aplicativo lógico certo com base em seus requisitos de negócios e SLO", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", - "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", - "service": "SAP", - "severity": "Média", - "text": "Revise os alertas do SAP HANA Studio.", - "waf": "Desempenho" + "checklist": "Logic Apps checklist", + "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", + "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "Logic Apps", + "severity": "Alto", + "text": "Proteja aplicativos lógicos contra falhas de região com redundância de zona e zonas de disponibilidade", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", - "link": "https://me.sap.com/notes/1969700", - "service": "SAP", - "severity": "Média", - "text": "Execute verificações de integridade do SAP HANA usando HANA_Configuration_Minichecks.", - "waf": "Desempenho" + "checklist": "Logic Apps checklist", + "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", + "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Logic Apps", + "severity": "Alto", + "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", - "severity": "Média", - "text": "Se você executar VMs do Windows e Linux no Azure, no local ou em outros ambientes de nuvem, poderá usar o Centro de gerenciamento de atualizações na Automação do Azure para gerenciar atualizações do sistema operacional, incluindo patches de segurança.", - "training": "https://learn.microsoft.com/azure/automation/update-management/overview", - "waf": "Segurança" + "checklist": "Logic Apps checklist", + "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", + "link": "https://learn.microsoft.com/azure/app-service/environment/intro", + "service": "Logic Apps", + "severity": "Alto", + "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "08951710-79a2-492a-adbc-06d7a401545b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", - "service": "SAP", + "checklist": "Logic Apps checklist", + "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", + "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", + "service": "Logic Apps", "severity": "Média", - "text": "Analise rotineiramente as notas de OSS de segurança do SAP porque o SAP lança patches de segurança altamente críticos, ou hot fixes, que exigem ação imediata para proteger seus sistemas SAP.", - "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", - "waf": "Segurança" + "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código de Aplicativo Lógico", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", - "severity": "Baixo", - "text": "Para SAP no SQL Server, você pode desabilitar a conta de administrador do sistema do SQL Server porque os sistemas SAP no SQL Server não usam a conta. Certifique-se de que outro usuário com direitos de administrador do sistema possa acessar o servidor antes de desabilitar a conta de administrador do sistema original.", - "waf": "Segurança" + "checklist": "Device Provisioning Service Review", + "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", + "service": "IoT Hub DPS", + "severity": "Alto", + "text": "Selecione o plano de hospedagem de aplicativo lógico certo com base em seus requisitos de negócios e SLO", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "service": "SAP", + "checklist": "Device Provisioning Service Review", + "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "IoT Hub DPS", "severity": "Alto", - "text": "Desative xp_cmdshell. O recurso do SQL Server xp_cmdshell habilita um shell de comando do sistema operacional interno do SQL Server. É um risco potencial em auditorias de segurança.", - "training": "https://me.sap.com/notes/3019299/E", - "waf": "Segurança" + "text": "Proteja aplicativos lógicos contra falhas de região com redundância de zona e zonas de disponibilidade", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "Device Provisioning Service Review", + "guid": "8aed4fbf-0830-4883-899d-222a154af478", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "IoT Hub DPS", "severity": "Alto", - "text": "A criptografia de servidores de banco de dados SAP HANA no Azure usa a tecnologia de criptografia nativa do SAP HANA. Além disso, se você estiver usando o SQL Server no Azure, use a TDE (Criptografia de Dados Transparente) para proteger seus dados e arquivos de log e garantir que seus backups também sejam criptografados.", - "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", - "waf": "Segurança" + "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "SAP", + "checklist": "Device Provisioning Service Review", + "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "IoT Hub DPS", + "severity": "Alto", + "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3", + "waf": "Fiabilidade" + }, + { + "checklist": "Device Provisioning Service Review", + "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "IoT Hub DPS", + "severity": "Média", + "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código de Aplicativo Lógico", + "waf": "Operações" + }, + { + "checklist": "Azure API Management Review", + "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", + "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", + "service": "APIM", "severity": "Média", - "text": "A criptografia de Armazenamento do Azure está habilitada para todas as contas clássicas e do Gerenciador de Recursos do Azure e não pode ser desabilitada. Como seus dados são criptografados por padrão, você não precisa modificar seu código ou aplicativos para usar a criptografia do Armazenamento do Azure.", - "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", - "waf": "Segurança" + "text": "Implementar uma política de tratamento de erros em nível global", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "SAP", - "severity": "Alto", - "text": "Usar o Cofre de Chaves do Azure para armazenar seus segredos e credenciais", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", - "waf": "Segurança" + "checklist": "Azure API Management Review", + "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", + "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", + "service": "APIM", + "severity": "Média", + "text": "Certifique-se de que todas as políticas de APIs incluam um elemento .", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "829e2edb-2173-4676-aff6-691b4935ada4", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "SAP", + "checklist": "Azure API Management Review", + "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", + "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", + "service": "APIM", "severity": "Média", - "text": "É recomendável BLOQUEAR os Recursos do Azure após a implantação bem-sucedida para proteger contra alterações não autorizadas. Você também pode impor restrições e regras LOCK em sua base por assinatura usando políticas personalizadas do Azure (função Personalizada).", - "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", - "waf": "Segurança" + "text": "Usar fragmentos de política para evitar a repetição das mesmas definições de políticas em várias APIs", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", - "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", - "service": "SAP", + "checklist": "Azure API Management Review", + "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", + "link": "https://learn.microsoft.com/azure/api-management/monetization-support", + "service": "APIM", "severity": "Média", - "text": "Provisione o Cofre de Chaves do Azure com as políticas de exclusão e limpeza suaves habilitadas para permitir a proteção de retenção para objetos excluídos.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", - "waf": "Segurança" + "text": "Se você estiver planejando monetizar suas APIs, consulte o artigo 'suporte à monetização' para obter as práticas recomendadas", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", - "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", - "service": "SAP", + "checklist": "Azure API Management Review", + "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", + "service": "APIM", "severity": "Alto", - "text": "Com base nos requisitos existentes, controles normativos e de conformidade (internos/externos) - Determine quais Políticas do Azure e a função RBAC do Azure são necessárias", - "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", - "waf": "Segurança" + "text": "Habilitar Configurações de Diagnóstico para exportar logs para o Azure Monitor", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "Azure API Management Review", + "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", + "service": "APIM", + "severity": "Média", + "text": "Habilite o Application Insights para telemetria mais detalhada", + "waf": "Operações" + }, + { + "checklist": "Azure API Management Review", + "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", + "service": "APIM", "severity": "Alto", - "text": "Ao habilitar o Microsoft Defender for Endpoint no ambiente SAP, recomende excluir arquivos de dados e de log em servidores DBMS em vez de direcionar todos os servidores. Siga as recomendações do fornecedor do DBMS ao excluir arquivos de destino.", - "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", - "waf": "Segurança" + "text": "Configurar alertas sobre as métricas mais críticas", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", - "service": "SAP", + "checklist": "Azure API Management Review", + "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", + "service": "APIM", "severity": "Alto", - "text": "Delegue uma função personalizada de administrador SAP com acesso just-in-time do Microsoft Defender for Cloud.", - "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "text": "Certifique-se de que os certificados SSL personalizados sejam armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", - "severity": "Baixo", - "text": "criptografar dados em trânsito integrando o produto de segurança de terceiros com comunicações de rede seguras (SNC) para DIAG (SAP GUI), RFC e SPNEGO para HTTPS", - "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", + "checklist": "Azure API Management Review", + "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", + "service": "APIM", + "severity": "Alto", + "text": "Proteger solicitações de entrada para APIs (plano de dados) com o Azure AD", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", - "service": "SAP", + "checklist": "Azure API Management Review", + "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", + "service": "APIM", "severity": "Média", - "text": "O padrão é chaves gerenciadas pela Microsoft para a funcionalidade de criptografia principal e use chaves gerenciadas pelo cliente quando necessário.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "text": "Usar o Microsoft Entra ID para autenticar usuários no Portal do Desenvolvedor", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "4935ada4-2223-4ece-a1b1-23181a541741", - "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", - "service": "SAP", - "severity": "Alto", - "text": "Use um Cofre de Chaves do Azure por aplicativo, por ambiente, por região.", - "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "checklist": "Azure API Management Review", + "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", + "service": "APIM", + "severity": "Média", + "text": "Criar grupos apropriados para controlar a visibilidade dos produtos", "waf": "Segurança" }, { - "checklist": "SAP Checklist", - "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", - "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", - "service": "SAP", - "severity": "Alto", - "text": "Para controlar e gerenciar chaves de criptografia de disco e segredos para sistemas operacionais Windows e não Windows HANA, use o Cofre de Chaves do Azure. O SAP HANA não tem suporte com o Cofre de Chaves do Azure, portanto, você deve usar métodos alternativos, como chaves SAP ABAP ou SSH.", - "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", - "waf": "Segurança" + "checklist": "Azure API Management Review", + "guid": "06862505-2d9a-4874-9491-2837b00a3475", + "link": "https://learn.microsoft.com/azure/api-management/backends", + "service": "APIM", + "severity": "Média", + "text": "Use o recurso Back-ends para eliminar configurações redundantes de back-end de API", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "209d490d-a477-4784-84d1-16785d2fa56c", - "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", - "service": "SAP", - "severity": "Alto", - "text": "Personalizar funções RBAC (controle de acesso baseado em função) para SAP em assinaturas spoke do Azure para evitar alterações acidentais relacionadas à rede", - "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", - "waf": "Segurança" + "checklist": "Azure API Management Review", + "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", + "service": "APIM", + "severity": "Média", + "text": "Usar Valores Nomeados para armazenar valores comuns que podem ser usados em políticas", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", - "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", - "service": "SAP", - "severity": "Alto", - "text": "Isole DMZs e NVAs do restante do estado SAP, configure o Azure Private Link e gerencie e controle com segurança os recursos do SAP no Azure", - "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", - "waf": "Segurança" + "checklist": "Azure API Management Review", + "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", + "service": "APIM", + "severity": "Média", + "text": "Para DR, aproveite o nível premium com implantações dimensionadas em duas ou mais regiões para um SLA de 99,99%", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", - "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", - "service": "SAP", - "severity": "Baixo", - "text": "Considere usar o software antimalware da Microsoft no Azure para proteger suas máquinas virtuais contra arquivos mal-intencionados, adware e outras ameaças.", - "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", - "waf": "Segurança" + "checklist": "Azure API Management Review", + "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", + "link": "https://learn.microsoft.com/azure/api-management/high-availability", + "service": "APIM", + "severity": "Média", + "text": "Implante pelo menos uma unidade em duas ou mais zonas de disponibilidade para um SLA aumentado de 99,99%", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", - "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", - "service": "SAP", - "severity": "Baixo", - "text": "Para obter uma proteção ainda mais poderosa, considere usar o Microsoft Defender for Endpoint.", - "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", - "waf": "Segurança" + "checklist": "Azure API Management Review", + "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", + "service": "APIM", + "severity": "Alto", + "text": "Verifique se há uma rotina de backup automatizada", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", - "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", - "service": "SAP", - "severity": "Alto", - "text": "Isole os servidores de aplicativo e banco de dados SAP da Internet ou da rede local passando todo o tráfego pela rede virtual de hub, que está conectada à rede spoke por emparelhamento de rede virtual. As redes virtuais emparelhadas garantem que a solução SAP no Azure seja isolada da Internet pública.", - "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", - "waf": "Segurança" + "checklist": "Azure API Management Review", + "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", + "link": "https://learn.microsoft.com/azure/api-management/retry-policy", + "service": "APIM", + "severity": "Média", + "text": "Use Políticas para adicionar uma URL de back-end de failover e cache para reduzir chamadas com falha.", + "waf": "Fiabilidade" }, { - "checklist": "SAP Checklist", - "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", - "service": "SAP", + "checklist": "Azure API Management Review", + "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", + "service": "APIM", "severity": "Baixo", - "text": "Para aplicativos voltados para a Internet, como o SAP Fiori, certifique-se de distribuir a carga por requisitos de aplicativo, mantendo os níveis de segurança. Para segurança de Camada 7, você pode usar um WAF (Web Application Firewall) de terceiros disponível no Azure Marketplace.", - "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", - "waf": "Segurança" + "text": "Se você precisar registrar em níveis de alto desempenho, considere a política de Hubs de Eventos", + "waf": "Operações" }, { - "checklist": "SAP Checklist", - "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", - "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", - "service": "SAP", + "checklist": "Azure API Management Review", + "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", + "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", + "service": "APIM", "severity": "Média", - "text": "Para habilitar a comunicação segura no Azure Monitor para soluções SAP, você pode optar por usar um certificado raiz ou um certificado de servidor. É altamente recomendável que você use certificados raiz.", - "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", - "waf": "Segurança" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", - "service": "AVS", - "severity": "Alto", - "text": "Verifique se os controladores de domínio ADDS estão implantados na assinatura de identidade no Azure nativo", - "waf": "Segurança" + "text": "Aplicar políticas de limitação para controlar o número de solicitações por segundo", + "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", + "waf": "Desempenho" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "75089c20-990d-4927-b105-885576f76fc2", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", + "service": "APIM", "severity": "Média", - "text": "Verifique se os sites e serviços do ADDS estão configurados para manter as solicitações de autenticação de recursos baseados no Azure (incluindo a Solução VMware do Azure) locais para o Azure", - "waf": "Segurança" + "text": "Configurar o dimensionamento automático para dimensionar o número de instâncias quando a carga aumenta", + "waf": "Desempenho" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", - "service": "AVS", - "severity": "Alto", - "text": "Verifique se o vCenter está conectado ao ADDS para habilitar a autenticação com base em 'contas de usuário nomeadas'", - "waf": "Segurança" + "checklist": "Azure API Management Review", + "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", + "service": "APIM", + "severity": "Média", + "text": "Implante gateways auto-hospedados onde o Azure não tem uma região próxima às APIs de back-end.", + "waf": "Desempenho" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", + "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", + "service": "APIM", "severity": "Média", - "text": "Verifique se a conexão do vCenter com o ADDS está usando um protocolo seguro (LDAPS)", - "waf": "Segurança" + "text": "Use a camada premium para cargas de trabalho de produção.", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", + "service": "APIM", "severity": "Média", - "text": "A conta do CloudAdmin no vCenter IdP é usada apenas como uma conta de emergência (break-glass)", - "waf": "Segurança" + "text": "No modelo de várias regiões, use Políticas para rotear as solicitações para back-ends regionais com base na disponibilidade ou latência.", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", + "service": "APIM", "severity": "Alto", - "text": "Certifique-se de que o NSX-Manager esteja integrado a um provedor de identidade externo (LDAPS)", - "waf": "Segurança" + "text": "Esteja atento aos limites da APIM", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", + "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", + "service": "APIM", + "severity": "Alto", + "text": "Certifique-se de que as implantações de gateway auto-hospedado sejam resilientes.", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure API Management Review", + "guid": "7519e385-a88b-4d34-966b-6269d686e890", + "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", + "service": "APIM", "severity": "Média", - "text": "Foi criado um modelo RBAC para uso no VMware vSphere", - "waf": "Segurança" + "text": "Usar o Azure Front Door na frente do APIM para implantação em várias regiões", + "waf": "Desempenho" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "cd45c90e-7690-4753-930b-bf290c69c074", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", + "service": "APIM", "severity": "Média", - "text": "As permissões RBAC devem ser concedidas em grupos ADDS e não em usuários específicos", + "text": "Implantar o serviço em uma rede virtual (VNet)", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", - "service": "AVS", - "severity": "Alto", - "text": "As permissões RBAC no recurso Solução VMware do Azure no Azure são 'bloqueadas' apenas para um conjunto limitado de proprietários", + "checklist": "Azure API Management Review", + "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", + "service": "APIM", + "severity": "Média", + "text": "Implante NSG (grupos de segurança de rede) em suas sub-redes para restringir ou monitorar o tráfego de/para APIM.", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", - "service": "AVS", - "severity": "Alto", - "text": "Certifique-se de que todas as funções personalizadas tenham escopo com autorizações permitidas do CloudAdmin", + "checklist": "Azure API Management Review", + "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", + "service": "APIM", + "severity": "Média", + "text": "Implante pontos de extremidade privados para filtrar o tráfego de entrada quando o APIM não for implantado em uma rede virtual.", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", - "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", + "service": "APIM", "severity": "Alto", - "text": "O modelo de conectividade correto da Solução VMware do Azure está selecionado para o caso de uso do cliente em mãos?", - "waf": "Desempenho" + "text": "Desabilitar o acesso à rede pública", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", - "service": "AVS", - "severity": "Alto", - "text": "Garantir que as conexões de Rota Expressa ou VPN do local para o Azure sejam monitoradas usando o 'monitor de conexão'", + "checklist": "Azure API Management Review", + "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", + "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", + "service": "APIM", + "severity": "Média", + "text": "Simplifique o gerenciamento com scripts de automação do PowerShell", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", + "service": "APIM", "severity": "Média", - "text": "Verifique se um monitor de conexão foi criado a partir de um recurso nativo do Azure para uma máquina virtual da Solução VMware do Azure para monitorar a conexão de Rota Expressa de back-end da Solução VMware do Azure", + "text": "Configure APIM via Infrastructure-as-code. Analise as práticas recomendadas de DevOps do Cloud Adaption Framework APIM Landing Zone Accelerator", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", + "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", + "service": "APIM", "severity": "Média", - "text": "Verifique se um monitor de conexão é criado a partir de um recurso local para uma máquina virtual da Solução VMware do Azure para monitorar a conectividade de ponta 2", + "text": "Promover o uso da extensão API do Visual Studio Code para um desenvolvimento de API mais rápido", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", - "service": "AVS", - "severity": "Alto", - "text": "Quando o servidor de rotas for usado, certifique-se de que não mais de 1000 rotas sejam propagadas do servidor de rotas para o gateway ExR para o local (limite ARS).", + "checklist": "Azure API Management Review", + "guid": "354f1c03-8112-4965-85ad-c0074bddf231", + "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", + "service": "APIM", + "severity": "Média", + "text": "Implemente DevOps e CI/CD em seu fluxo de trabalho", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", - "service": "AVS", - "severity": "Alto", - "text": "O Gerenciamento de Identidades Privilegiadas é implementado para funções que gerenciam o recurso da Solução VMware do Azure no Portal do Azure (não são permitidas permissões permanentes)", - "waf": "Segurança" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", - "service": "AVS", - "severity": "Alto", - "text": "Os relatórios de auditoria do Gerenciamento de Identidades Privilegiadas devem ser implementados para as funções PIM da Solução VMware do Azure", + "checklist": "Azure API Management Review", + "guid": "b6439493-426a-45f3-9697-cf65baee208d", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", + "service": "APIM", + "severity": "Média", + "text": "APIs seguras usando autenticação de certificado de cliente", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "2a67d143-1033-4c0a-8732-680896478f08", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", + "service": "APIM", "severity": "Média", - "text": "Se o uso do Gerenciamento de Identidades Privilegiadas estiver sendo usado, certifique-se de que uma conta válida habilitada para ID do Entra seja criada com um registro SMTP válido para notificações de substituição automática do Host da Solução VMware do Azure. (permissões permanentes necessárias)", + "text": "Serviços de back-end seguros usando autenticação de certificado de cliente", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", - "service": "AVS", - "severity": "Alto", - "text": "Limitar o uso da conta do CloudAdmin apenas ao acesso de emergência", + "checklist": "Azure API Management Review", + "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", + "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", + "service": "APIM", + "severity": "Média", + "text": "Consulte o artigo \"Recomendações para mitigar as 10 principais ameaças da segurança da API OWASP\" e verifique o que é aplicável às suas APIs", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", + "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", + "service": "APIM", "severity": "Média", - "text": "Criar funções RBAC personalizadas no vCenter para implementar um modelo de privilégios mínimos dentro do vCenter", + "text": "Usar o recurso Autorizações para simplificar o gerenciamento do token OAuth 2.0 para suas APIs de back-end", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", - "service": "AVS", - "severity": "Média", - "text": "É um processo definido para alternar regularmente as credenciais cloudadmin (vCenter) e admin (NSX)", + "checklist": "Azure API Management Review", + "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", + "service": "APIM", + "severity": "Alto", + "text": "Use a versão mais recente do TLS ao criptografar informações em trânsito. Desative protocolos e cifras desatualizados e desnecessários quando possível.", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "f8af3d94-1d2b-4070-846f-849197524258", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", + "service": "APIM", "severity": "Alto", - "text": "Usar um provedor de identidade centralizado a ser usado para cargas de trabalho (VMs) em execução na Solução VMware do Azure", + "text": "Certifique-se de que os segredos (valores nomeados) sejam armazenados em um Cofre de Chaves do Azure para que possam ser acessados e atualizados com segurança", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "791abd8b-7706-4e31-9569-afefde724be3", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", + "service": "APIM", "severity": "Média", - "text": "A filtragem de tráfego Leste-Oeste é implementada no NSX-T", + "text": "Use identidades gerenciadas para autenticar em outros recursos do Azure sempre que possível", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", - "service": "AVS", + "checklist": "Azure API Management Review", + "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", + "service": "APIM", "severity": "Alto", - "text": "As cargas de trabalho na Solução VMware do Azure não são diretamente expostas à Internet. O tráfego é filtrado e inspecionado pelo Gateway de Aplicativo do Azure, pelo Firewall do Azure ou por soluções de terceiros", + "text": "Usar o WAF (Web Application Firewall) implantando o Application Gateway na frente do APIM", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", - "service": "AVS", - "severity": "Alto", - "text": "A auditoria e o registro em log são implementados para solicitações de entrada da Internet para cargas de trabalho baseadas na Solução VMware do Azure e na Solução VMware do Azure", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "4620dc87-e948-4ce8-8426-f3e6e5d7bd85", + "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", + "service": "SAP", + "severity": "Média", + "text": "O Azure Center for SAP solutions (ACSS) é uma oferta do Azure que torna o SAP uma carga de trabalho de nível superior no Azure. O ACSS é uma solução de ponta a ponta que permite criar e executar sistemas SAP como uma carga de trabalho unificada no Azure e fornece uma base mais perfeita para a inovação. Você pode aproveitar os recursos de gerenciamento para sistemas SAP novos e existentes baseados no Azure.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-center-sap-solutions/?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "5d75e99d-624d-4afe-91d9-e17adc580790", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", + "service": "SAP", "severity": "Média", - "text": "O monitoramento de sessão é implementado para conexões de saída da Internet a partir da Solução VMware do Azure ou cargas de trabalho baseadas na Solução VMware do Azure para identificar atividades suspeitas/mal-intencionadas", - "waf": "Segurança" + "text": "O Azure dá suporte à automação de implantações SAP no Linux e no Windows. O SAP Deployment Automation Framework é uma ferramenta de orquestração de código aberto que pode implantar, instalar e manter ambientes SAP.", + "training": "https://github.com/Azure/sap-automation", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "334fdf91-c234-4182-a652-75269440b4be", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "d17f6f39-a377-48a2-931f-5ead3ebe33a8", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", + "service": "SAP", "severity": "Média", - "text": "A proteção padrão contra DDoS está habilitada na sub-rede do Gateway ExR/VPN no Azure", - "waf": "Segurança" + "text": "Executar uma recuperação point-in-time para seus bancos de dados de produção em qualquer ponto e em um período de tempo que atenda ao seu RTO; A recuperação point-in-time normalmente inclui erros do operador excluindo dados na camada DBMS ou por meio do SAP, incidentalmente", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", + "service": "SAP", "severity": "Média", - "text": "Usar uma estação de trabalho de acesso privilegiado (PAW) dedicada para gerenciar a Solução VMware do Azure, o vCenter, o gerenciador NSX e o gerenciador HCX", - "waf": "Segurança" + "text": "Teste os tempos de backup e recuperação para verificar se eles atendem aos requisitos de RTO para restaurar todos os sistemas simultaneamente após um desastre.", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", - "service": "AVS", - "severity": "Média", - "text": "Habilitar a Detecção Avançada de Ameaças (Microsoft Defender for Cloud, também conhecido como ASC) para cargas de trabalho em execução na Solução VMware do Azure", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "b651423c-8552-42db-a545-5cb50c05527a", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "SAP", + "severity": "Alto", + "text": "Você pode replicar o armazenamento padrão entre regiões emparelhadas, mas não pode usar o armazenamento padrão para armazenar seus bancos de dados ou discos rígidos virtuais. Você pode replicar backups somente entre regiões emparelhadas que você usa. Para todos os outros dados, execute sua replicação usando recursos nativos de DBMS, como SQL Server Always On ou SAP HANA System Replication. Use uma combinação de Site Recovery, rsync ou robocopy e outros softwares de terceiros para a camada de aplicativos SAP.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "aa208dca-784f-46c6-9014-cc919c542dc9", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", "severity": "Média", - "text": "Usar o Azure ARC for Servers para controlar corretamente as cargas de trabalho em execução na Solução VMware do Azure usando tecnologias nativas do Azure (o Azure ARC for Azure VMware Solution ainda não está disponível)", - "waf": "Segurança" + "text": "Ao usar as Zonas de Disponibilidade do Azure para obter alta disponibilidade, você deve considerar a latência entre servidores de aplicativos SAP e servidores de banco de dados. Para zonas com altas latências, os procedimentos operacionais precisam estar em vigor para garantir que os servidores de aplicativos SAP e os servidores de banco de dados estejam sendo executados na mesma zona o tempo todo.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", - "service": "AVS", - "severity": "Baixo", - "text": "Garanta que as cargas de trabalho na Solução VMware do Azure usem criptografia de dados suficiente durante o tempo de execução (como criptografia de disco convidado e SQL TDE). (a criptografia vSAN em repouso é padrão)", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "ba07c007-1f90-43e9-aa4f-601346b80352", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "SAP", + "severity": "Alto", + "text": "Configure conexões de Rota Expressa do local para as regiões primária e secundária de recuperação de desastres do Azure. Além disso, como alternativa ao uso da Rota Expressa, considere configurar conexões VPN locais para as regiões primária e secundária de recuperação de desastres do Azure.", + "training": "https://learn.microsoft.com/azure/expressroute/use-s2s-vpn-as-backup-for-expressroute-privatepeering", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a3592718-e6e2-4051-9267-6ae46691e883", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "d2b30195-b11d-4a8f-a672-28b2b4169a7c", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "SAP", "severity": "Baixo", - "text": "Quando a criptografia no convidado é usada, armazene chaves de criptografia no cofre de chaves do Azure quando possível", - "waf": "Segurança" + "text": "Replique o conteúdo do cofre de chaves, como certificados, segredos ou chaves entre regiões, para que você possa descriptografar dados na região de recuperação de desastres.", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5ac94222-3e13-4810-9230-81a941741583", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "05f1101d-250f-40e7-b2a1-b674ab50edbd", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", + "service": "SAP", "severity": "Média", - "text": "Considere usar o suporte estendido de atualização de segurança para cargas de trabalho em execução na Solução VMware do Azure (a Solução VMware do Azure é qualificada para ESU)", - "waf": "Segurança" + "text": "Emparelhar as redes virtuais primária e de recuperação de desastres. Por exemplo, para a replicação do sistema HANA, uma rede virtual SAP HANA DB precisa ser emparelhada para a rede virtual SAP HANA DB do site de recuperação de desastres.", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "d3351bf7-628a-46de-917d-dfc11d3b6b40", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", + "service": "SAP", + "severity": "Baixo", + "text": "Se você usar o armazenamento do Azure NetApp Files para suas implantações SAP, no mínimo, crie duas contas do Azure NetApp Files na camada Premium, em duas regiões.", + "training": "https://learn.microsoft.com/training/modules/choose-service-level-azure-netapp-files-hpc-applications/2-identify-decision-criteria", + "waf": "Fiabilidade" + }, + { + "checklist": "SAP Checklist", + "guid": "726a1d3e-5508-4a06-9d54-93f4b50040c1", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", "severity": "Alto", - "text": "Certifique-se de que o método de redundância de dados vSAN apropriado seja usado (especificação RAID)", + "text": "A tecnologia de replicação de banco de dados nativo deve ser usada para sincronizar o banco de dados em um par de HA.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/?source=recommendations", "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d88408f3-7273-44c8-96ba-280214590146", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "6561f847-3db5-4ff8-9200-5ad3c3b436ad", + "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", + "service": "SAP", "severity": "Alto", - "text": "Certifique-se de que a política de falha na tolerância esteja em vigor para atender às suas necessidades de armazenamento vSAN", + "text": "O CIDR da rede virtual primária (VNet) não deve entrar em conflito ou se sobrepor ao CIDR da VNet do site de recuperação de desastres", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", + "service": "SAP", "severity": "Alto", - "text": "Certifique-se de ter solicitado cota suficiente, garantindo que você tenha considerado o crescimento e o requisito de recuperação de desastres", + "text": "Use a Recuperação de Site para replicar um servidor de aplicativos para um site de recuperação de desastres. A Recuperação de Site também pode ajudar na replicação de VMs de cluster de serviços centrais para o site de recuperação de desastres. Ao invocar o DR, você precisará reconfigurar o cluster do Linux Pacemaker no site de DR (por exemplo, substitua o VIP ou o SBD, execute o corosync.conf e muito mais).", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/", "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", - "service": "AVS", - "severity": "Média", - "text": "Certifique-se de que as restrições de acesso ao ESXi sejam compreendidas, há limites de acesso que podem afetar as soluções de terceiros 3rd.", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "8300cb30-766b-4084-b126-0dd8fb1269a1", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", + "severity": "Alto", + "text": "Considere a disponibilidade do software SAP em relação a pontos únicos de falha. Isso inclui pontos únicos de falha em aplicativos como SGBDs utilizados nas arquiteturas SAP NetWeaver e SAP S/4HANA, SAP ABAP e ASCS + SCS. Além disso, outras ferramentas, como o SAP Web Dispatcher.", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/2-explore-high-availability-disaster-recovery-support-azure-for-sap-workloads?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", - "service": "AVS", - "severity": "Média", - "text": "Certifique-se de ter uma política em torno da densidade e eficiência do host ESXi, tendo em mente o prazo de espera para solicitar novos nós", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "56402f11-ccbe-42c3-a2f6-c6f6f38ab579", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", + "service": "SAP", + "severity": "Alto", + "text": "Para bancos de dados SAP e SAP, considere a implementação de clusters de failover automático. No Windows, o Clustering de Failover do Windows Server oferece suporte a failover. No Linux, Linux Pacemaker ou ferramentas de terceiros como SIOS Protection Suite e Veritas InfoScale suportam failover.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", - "service": "AVS", - "severity": "Média", - "text": "Garantir que um bom processo de gerenciamento de custos esteja em vigor para a Solução VMware do Azure - o Gerenciamento de Custos do Azure pode ser usado", - "waf": "Custar" + "checklist": "SAP Checklist", + "guid": "afae6bec-2671-49ae-bc69-140b8ec8d320", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", + "service": "SAP", + "severity": "Alto", + "text": "O Azure não oferece suporte a arquiteturas nas quais as VMs primária e secundária compartilham armazenamento para dados DBMS. Para a camada DBMS, o padrão de arquitetura comum é replicar bancos de dados ao mesmo tempo e com pilhas de armazenamento diferentes daquelas que as VMs primária e secundária usam.", + "training": "https://learn.microsoft.com/training/paths/ensure-business-continuity-implement-disaster-recovery/?source=recommendationshttps%3A%2F%2Flearn.microsoft.com%2Fja-jp%2Ftraining%2Fpaths%2Fensure-business-continuity-implement-disaster-recovery%2F%3Fsource%3Drecommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", - "service": "AVS", - "severity": "Baixo", - "text": "As instâncias reservadas do Azure são usadas para otimizar o custo de uso da Solução VMware do Azure", - "waf": "Custar" + "checklist": "SAP Checklist", + "guid": "ac614e95-6767-4bc3-b8a4-9953533da6ba", + "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", + "service": "SAP", + "severity": "Alto", + "text": "Os dados do DBMS e os arquivos de log de transação/refazer são armazenados no armazenamento em bloco com suporte do Azure ou nos Arquivos do Azure NetApp. Os Arquivos do Azure ou os Arquivos Premium do Azure não têm suporte como armazenamento para dados DBMS e/ou arquivos de log de refazer com a carga de trabalho SAP.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-databases/2-explore-database-support-azure-for-sap-workloads", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6691e883-5ac9-4422-83e1-3810523081a9", - "service": "AVS", - "severity": "Média", - "text": "Considere o uso do Azure Private-Link ao usar outros Serviços Nativos do Azure", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "1f737179-8e7f-4e1a-a30c-e5a649a3092b", + "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", + "service": "SAP", + "severity": "Alto", + "text": "Você pode usar discos compartilhados do Azure no Windows para componentes ASCS + SCS e cenários específicos de alta disponibilidade. Configure seus clusters de failover separadamente para componentes da camada de aplicativo SAP e a camada DBMS. No momento, o Azure não oferece suporte a arquiteturas de alta disponibilidade que combinam componentes da camada de aplicativo SAP e a camada DBMS em um cluster de failover.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "a78b3d31-3170-44f2-b5d7-651a29f4ccf5", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", + "service": "SAP", "severity": "Alto", - "text": "Verifique se todos os recursos necessários residem na(s) mesma(s) zona(s) de disponibilidade do Azure", - "waf": "Desempenho" + "text": "A maioria dos clusters de failover para ASCS (Application Layer Components, componentes da camada de aplicativo) SAP e a camada DBMS exigem um endereço IP virtual para um cluster de failover. O Balanceador de Carga do Azure deve manipular o endereço IP virtual para todos os outros casos. Um princípio de design é usar um balanceador de carga por configuração de cluster. Recomendamos que você use a versão padrão do balanceador de carga (SKU do Standard Load Balancer).", + "training": "https://learn.microsoft.com/training/modules/implement-high-availability-for-sap-workloads-azure/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", - "service": "AVS", - "severity": "Média", - "text": "Habilitar cargas de trabalho de VM convidada do Microsoft Defender for Cloud for Azure VMware Solution", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "1a541741-5833-4fb4-ae3c-2df743165c3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-ha-ports-overview?source=recommendations", + "service": "SAP", + "severity": "Alto", + "text": "Verifique se o IP flutuante está habilitado no balanceador de carga", + "training": "https://learn.microsoft.com/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", - "service": "AVS", - "severity": "Média", - "text": "Usar servidores habilitados para Arc do Azure para gerenciar suas cargas de trabalho de VM convidada da Solução VMware do Azure", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "c47cc4f3-f105-452c-845e-9b307b3856c1", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "SAP", + "severity": "Alto", + "text": "Antes de implantar sua infraestrutura de alta disponibilidade, e dependendo da região escolhida, determine se deseja implantar com um conjunto de disponibilidade do Azure ou uma zona de disponibilidade.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "844f69c3-07e5-4ec1-bff7-4be27bcf5fea", + "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", + "service": "SAP", "severity": "Alto", - "text": "Habilitar o log de diagnóstico e de métrica na solução VMware do Azure", - "waf": "Operações" + "text": "Se desejar atender aos SLAs de infraestrutura de seus aplicativos para componentes SAP (serviços centrais, servidores de aplicativos e bancos de dados), você deverá escolher as mesmas opções de alta disponibilidade (VMs, conjuntos de disponibilidade, zonas de disponibilidade) para todos os componentes.", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", - "service": "AVS", - "severity": "Média", - "text": "Implantar os agentes do Log Analytics nas cargas de trabalho da VM convidada da Solução VMware do Azure", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "cbe05bbe-209d-4490-ba47-778424d11678", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", + "severity": "Alto", + "text": "Não misture servidores de funções diferentes no mesmo conjunto de disponibilidade. Mantenha VMs de serviços centrais, VMs de banco de dados, VMs de aplicativos em seus próprios conjuntos de disponibilidade", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "589d457a-927c-4397-9d11-02cad6aae11e", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "f2201000-d045-40a6-a79a-d7cdc01b4d86", + "link": "https://learn.microsoft.com/azure/virtual-machines/co-location", + "service": "SAP", "severity": "Média", - "text": "Verifique se você tem uma política e uma solução de backup documentadas e implementadas para cargas de trabalho de VM da Solução VMware do Azure", - "waf": "Operações" + "text": "Você não pode implantar conjuntos de disponibilidade do Azure em uma zona de disponibilidade do Azure, a menos que use grupos de posicionamento de proximidade.", + "training": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ee29711b-d352-4caa-ab79-b198dab81932", - "service": "AVS", - "severity": "Média", - "text": "Usar o Microsoft Defender for Cloud para monitoramento de conformidade de cargas de trabalho em execução no Azure VMware Solution", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "9674e7c7-7796-4181-8920-09f4429543ba", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", + "service": "SAP", + "severity": "Alto", + "text": "Ao criar conjuntos de disponibilidade, use o número máximo de domínios de falha e atualize domínios disponíveis. Por exemplo, se você implantar mais de duas VMs em um conjunto de disponibilidade, use o número máximo de domínios de falha (três) e domínios de atualização suficientes para limitar o efeito de possíveis falhas de hardware físico, interrupções de rede ou interrupções de energia, além da manutenção planejada do Azure. O número padrão de domínios de falha é dois e você não pode alterá-lo online mais tarde.", + "training": "https://learn.microsoft.com/training/modules/configure-virtual-machine-availability/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", - "service": "AVS", - "severity": "Média", - "text": "São as linhas de base de conformidade aplicáveis adicionadas ao Microsoft Defender for Cloud", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "ae4ecb95-b70f-428f-8b9a-4c5b7e3478a2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", + "severity": "Alto", + "text": "Quando você usa grupos de posicionamento de proximidade do Azure em uma implantação de conjunto de disponibilidade, todos os três componentes SAP (serviços centrais, servidor de aplicativos e banco de dados) devem estar no mesmo grupo de posicionamento de proximidade.", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "5d2fa56c-56ad-4484-88fe-72734c486ba2", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "severity": "Alto", - "text": "A residência de dados foi avaliada ao selecionar regiões do Azure a serem usadas para a implantação da Solução VMware do Azure", - "waf": "Segurança" + "text": "Use um grupo de posicionamento de proximidade por SAP SID. Os grupos não se estendem por zonas de disponibilidade ou regiões do Azure", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "bca3b10e-0ff5-4aec-ac16-4c4bd1a1c13f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", "severity": "Alto", - "text": "As implicações do processamento de dados (modelo de prestador de serviços / consumidor de serviços) são claras e documentadas", - "waf": "Segurança" + "text": "Use um dos seguintes serviços para executar clusters de serviços centrais SAP, dependendo do sistema operacional.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "547c1747-dc56-4068-a714-435cd19dd244", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "ed46b937-913e-4018-9c62-8393ab037e53", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", + "service": "SAP", "severity": "Média", - "text": "Considere o uso de CMK (Customer Managed Key) para vSAN somente se necessário por motivo(s) de conformidade.", - "waf": "Segurança" + "text": "No momento, o Azure não oferece suporte à combinação de ASCS e HA de banco de dados no mesmo cluster do Linux Pacemaker; Separe-os em agrupamentos individuais. No entanto, você pode combinar até cinco clusters de serviços centrais em um par de VMs.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", - "service": "AVS", - "severity": "Alto", - "text": "Criar painéis para habilitar os principais insights de monitoramento da Solução VMware do Azure", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "f656e745-0cfb-453e-8008-0528fa21c933", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", + "service": "SAP", + "severity": "Média", + "text": "Implante ambas as VMs no par de alta disponibilidade em um conjunto de disponibilidade ou em zonas de disponibilidade. Essas VMs devem ter o mesmo tamanho e a mesma configuração de armazenamento.", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", - "service": "AVS", - "severity": "Alto", - "text": "Criar alertas de aviso para limites críticos para alertas automáticos sobre o desempenho da solução VMware do Azure (CPU >80%, memória média >80%, vSAN >70%)", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "7f684ebc-95da-425e-b329-e782dbed050f", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", + "service": "SAP", + "severity": "Média", + "text": "O Azure oferece suporte à instalação e configuração de instâncias SAP HANA e ASCS/SCS e ERS no mesmo cluster de alta disponibilidade em execução no Red Hat Enterprise Linux (RHEL).", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9659e396-80e7-4828-ac93-5657d02bff45", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "07991f7d-6598-4d90-9431-45c62605d3a5", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", "severity": "Alto", - "text": "Certifique-se de que o alerta crítico seja criado para monitorar se o consumo de vSAN está abaixo de 75%, pois esse é um limite de suporte do VMware", - "waf": "Operações" + "text": "Execute todos os sistemas de produção em SSDs gerenciados Premium e use o Azure NetApp Files ou o Ultra Disk Storage. Pelo menos o disco do sistema operacional deve estar na camada Premium para que você possa obter melhor desempenho e o melhor SLA.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "73cdaecc-7d74-48d8-a040-88416eebc98c", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", + "service": "SAP", "severity": "Alto", - "text": "Verifique se os alertas estão configurados para alertas e notificações de Integridade do Serviço do Azure", - "waf": "Operações" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", - "service": "AVS", - "severity": "Média", - "text": "Configurar o log da Solução VMware do Azure para ser enviado a uma conta de Armazenamento do Azure ou ao Azure EventHub para processamento", - "waf": "Operações" + "text": "Você deve executar o SAP HANA no Azure somente nos tipos de armazenamento certificados pela SAP. Observe que determinados volumes devem ser executados em determinadas configurações de disco, quando aplicável. Essas configurações incluem a habilitação do Acelerador de Gravação e o uso do armazenamento Premium. Você também precisa garantir que o sistema de arquivos executado no armazenamento seja compatível com o DBMS executado na máquina.", + "training": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", - "service": "AVS", - "severity": "Baixo", - "text": "Se for necessário um insight profundo no VMware vSphere: o vRealize Operations e/ou o vRealize Network Insights são usados na solução?", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "51904867-a70e-4fa0-b4ff-3e6292846d7c", + "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", + "service": "SAP", + "severity": "Alto", + "text": "Considere configurar a alta disponibilidade dependendo do tipo de armazenamento usado para suas cargas de trabalho SAP. Alguns serviços de armazenamento disponíveis no Azure não têm suporte no Azure Site Recovery, portanto, sua configuração de alta disponibilidade pode ser diferente.", + "training": "https://learn.microsoft.com/training/modules/implement-disaster-recovery-for-sap-workloads-azure/2-explore-disaster-recovery-sap-workloads", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "1ac2d928-c9b7-42c6-ba18-23b1aea78693", + "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", + "service": "SAP", "severity": "Alto", - "text": "Verifique se a política de armazenamento vSAN para VMs NÃO é a política de armazenamento padrão, pois essa política aplica provisionamento espesso", - "waf": "Operações" + "text": "Diferentes serviços de armazenamento nativos do Azure (como Arquivos do Azure, Arquivos do Azure NetApp, Disco Compartilhado do Azure) podem não estar disponíveis em todas as regiões. Portanto, para ter uma configuração SAP semelhante na região de DR após o failover, certifique-se de que o respectivo serviço de armazenamento seja oferecido no local de DR.", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "925d1f8c-01f3-4a67-948e-aabf0a1fad60", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", + "service": "SAP", "severity": "Média", - "text": "Verifique se as bibliotecas de conteúdo do vSphere não são colocadas no vSAN, pois o vSAN é um recurso finito", - "waf": "Operações" + "text": "Automatize o Start-Stop do sistema SAP para gerenciar custos.", + "waf": "Custar" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", - "service": "AVS", - "severity": "Média", - "text": "Certifique-se de que os repositórios de dados da solução de backup sejam armazenados fora do armazenamento vSAN. No nativo do Azure ou em um armazenamento de dados com backup de pool de discos", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "71dc00cd-4392-4262-8949-20c05e6c0333", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", + "severity": "Baixo", + "text": "No caso de usar o Armazenamento Premium do Azure com o SAP HANA, o armazenamento SSD padrão do Azure pode ser usado para selecionar uma solução de armazenamento econômica. No entanto, observe que escolher o armazenamento padrão SSD ou HDD padrão do Azure afetará o SLA das VMs individuais. Além disso, para sistemas com menor taxa de transferência de E/S e baixa latência, como ambientes que não são de produção, VMs de série mais baixa podem ser usadas.", + "waf": "Custar" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", - "service": "AVS", - "severity": "Média", - "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam gerenciadas de forma híbrida usando o Azure Arc for Servers (a Solução VMware do Arc for Azure está em visualização)", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "9877f353-2591-4e8b-8381-e9043fed1010", + "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", + "service": "SAP", + "severity": "Baixo", + "text": "Como uma configuração alternativa de baixo custo (multiuso), você pode escolher uma SKU de baixo desempenho para suas VMs de servidor de banco de dados HANA que não são de produção. No entanto, é importante observar que alguns tipos de VM, como a série E, não são certificados pelo HANA (SAP HANA Hardware Directory) ou não podem atingir latência de armazenamento inferior a 1ms.", + "waf": "Custar" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", - "service": "AVS", - "severity": "Média", - "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam monitoradas usando o Azure Log Analytics e o Azure Monitor", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "fda1dbf3-dc95-4d48-a7c7-91dca0f6c565", + "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", + "service": "SAP", + "severity": "Alto", + "text": "Impor um modelo RBAC para grupos de gerenciamento, assinaturas, grupos de recursos e recursos", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "45911475-e39e-4530-accc-d979366bcda2", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "severity": "Média", - "text": "Incluir cargas de trabalho em execução na Solução VMware do Azure nas ferramentas de gerenciamento de atualizações existentes ou no Gerenciamento de Atualizações do Azure", - "waf": "Operações" + "text": "Impor a propagação principal para encaminhar a identidade do aplicativo de nuvem SAP para o SAP local (incluindo IaaS) por meio do conector de nuvem", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/2-explore-azure-virtual-machine-auth-access-control", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "750ab1ab-039d-495d-94c7-c8929cb107d5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", + "service": "SAP", "severity": "Média", - "text": "Usar a Política do Azure para integrar cargas de trabalho da Solução VMware do Azure nas soluções de Gerenciamento, Monitoramento e Segurança do Azure", - "waf": "Operações" + "text": "Implemente SSO em aplicativos SAP SaaS como SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics e SAP C4C com o Azure AD usando SAML.", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "325ae525-ba34-4d46-a5e2-213ace7bb122", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", "severity": "Média", - "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam integradas ao Microsoft Defender for Cloud", + "text": "Implemente SSO em aplicativos Web baseados no SAP NetWeaver, como SAP Fiori e SAP Web GUI, usando SAML.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", + "service": "SAP", "severity": "Média", - "text": "Certifique-se de que os backups não sejam armazenados no vSAN, pois o vSAN é um recurso finito", - "waf": "Fiabilidade" + "text": "Implemente SSO em aplicativos Web baseados no SAP NetWeaver, como SAP Fiori e SAP Web GUI, usando SAML.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/6-exercise-integrate-azure-active-directory-sap-fiori", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "f29676ef-0c9c-4c4d-ab21-a55504c0c829", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", + "service": "SAP", "severity": "Média", - "text": "Todas as soluções de DR foram consideradas e uma solução que é melhor para o seu negócio foi decidida? [SRM/JetStream/Zerto/Veeam/...]", - "waf": "Fiabilidade" + "text": "Você pode implementar o SSO no SAP GUI usando o SAP NetWeaver SSO ou uma solução de parceiro.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/8-exercise-integrate-azure-active-directory-sap-netweaver", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", + "service": "SAP", "severity": "Média", - "text": "Usar o Azure Site Recovery quando a tecnologia de Recuperação de Desastres for IaaS nativa do Azure", - "waf": "Fiabilidade" + "text": "Para SSO para SAP GUI e acesso ao navegador web, implemente SNC / Kerberos / SPNEGO (mecanismo de negociação GSSAPI simples e protegido) devido a sua facilidade de configuração e manutenção. Para SSO com certificados de cliente X.509, considere o SAP Secure Login Server, que é um componente da solução SAP SSO.", + "training": "https://learn.microsoft.com/training/modules/explore-identity-services/9-exercise-integrate-active-directory-sap-single-sign-on", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", - "service": "AVS", - "severity": "Alto", - "text": "Use planos de recuperação automatizados com qualquer uma das soluções de desastre, evite ao máximo tarefas manuais", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "6c8bcbf4-5bbe-4609-b8a0-3e97778424d6", + "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", + "service": "SAP", + "severity": "Média", + "text": "Para SSO para SAP GUI e acesso ao navegador web, implemente SNC / Kerberos / SPNEGO (mecanismo de negociação GSSAPI simples e protegido) devido a sua facilidade de configuração e manutenção. Para SSO com certificados de cliente X.509, considere o SAP Secure Login Server, que é um componente da solução SAP SSO.", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8255461e-2aee-4345-9aec-8339248b262d", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "16785d6f-a96c-496a-b885-18f482734c88", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", + "service": "SAP", "severity": "Média", - "text": "Usar o par de regiões geopolíticas como o ambiente secundário de recuperação de desastres", - "waf": "Fiabilidade" + "text": "Implemente o SSO usando o OAuth for SAP NetWeaver para permitir que aplicativos de terceiros ou personalizados acessem os serviços OData do SAP NetWeaver.", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", - "service": "AVS", - "severity": "Alto", - "text": "Use 2 espaços de endereço diferentes entre as regiões, por exemplo: 10.0.0.0/16 e 192.168.0.0/16 para as diferentes regiões", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "a747c350-8d4c-449c-93af-393dbca77c48", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", + "service": "SAP", + "severity": "Média", + "text": "Implementar SSO no SAP HANA", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "c7bae5bf-daf9-4761-9c56-f92891890aa4", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", + "service": "SAP", "severity": "Média", - "text": "O ExpressRoute Global Reach será usado para conectividade entre as Nuvens Privadas da Solução VMware do Azure primária e secundária ou o roteamento é feito por meio de dispositivos virtuais de rede?", - "waf": "Fiabilidade" + "text": "Considere o Azure AD um provedor de identidade para sistemas SAP hospedados no RISE. Para obter mais informações, consulte Integrando o serviço ao Azure AD.", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "e4e48226-ce54-44b6-bb6b-bfa15bd8f753", + "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", + "service": "SAP", "severity": "Média", - "text": "Todas as soluções de backup foram consideradas e uma solução que é melhor para o seu negócio foi decidida? [ MABS/CommVault/Metallic.io/Veeam/ . ]", - "waf": "Fiabilidade" + "text": "Para aplicativos que acessam o SAP, convém usar a propagação principal para estabelecer o SSO.", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "59921095-4980-4fc1-a5b6-524a5a560c79", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", + "service": "SAP", "severity": "Média", - "text": "Implante sua solução de backup na mesma região que sua nuvem privada da Solução VMware do Azure", - "waf": "Fiabilidade" + "text": "Se você estiver usando serviços SAP BTP ou soluções SaaS que exigem o SAP Identity Authentication Service (IAS), considere implementar SSO entre o SAP Cloud Identity Authentication Services e o Azure AD para acessar esses serviços SAP. Essa integração permite que o SAP IAS atue como um provedor de identidade de proxy e encaminhe solicitações de autenticação para o Azure AD como o repositório central do usuário e o provedor de identidade.", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "a709c664-317e-41e4-9e34-67d9016a86f4", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", + "service": "SAP", "severity": "Média", - "text": "Implante sua solução de backup fora do vSan, em componentes nativos do Azure", - "waf": "Fiabilidade" + "text": "Implementar SSO no SAP BTP", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", - "service": "AVS", - "severity": "Baixo", - "text": "Existe um processo para solicitar uma restauração dos componentes VMware gerenciados pela Plataforma Azure?", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "01f11b7f-38df-4251-9c76-4dec19abd3e8", + "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", + "service": "SAP", + "severity": "Média", + "text": "Se você estiver usando o SAP SuccessFactors, considere usar o provisionamento automatizado de usuários do Azure AD. Com essa integração, à medida que você adiciona novos funcionários ao SAP SuccessFactors, pode criar automaticamente suas contas de usuário no Azure AD. Opcionalmente, você pode criar contas de usuário no Microsoft 365 ou em outros aplicativos SaaS com suporte no Azure AD. Use write-back do endereço de e-mail para SAP SuccessFactors.", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", - "service": "AVS", - "severity": "Baixo", - "text": "Para implantações manuais, todas as configurações e implantações devem ser documentadas", + "checklist": "SAP Checklist", + "guid": "6ba28021-4591-4147-9e39-e5309cccd979", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", + "service": "SAP", + "severity": "Média", + "text": "impor políticas existentes do Grupo de Gerenciamento às assinaturas SAP", + "training": "https://learn.microsoft.com/training/modules/enterprise-scale-organization/4-management-group-subscription-organization", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", - "service": "AVS", - "severity": "Baixo", - "text": "Para implantações manuais, considere implementar bloqueios de recursos para evitar ações acidentais em sua nuvem privada de solução VMware do Azure", + "checklist": "SAP Checklist", + "guid": "366bcda2-750a-4b1a-a039-d95d54c7c892", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", + "severity": "Alto", + "text": "Integre aplicativos fortemente acoplados na mesma assinatura SAP para evitar complexidade adicional de roteamento e gerenciamento", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-subscriptions", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", - "service": "AVS", - "severity": "Baixo", - "text": "Para implantações automatizadas, implante uma nuvem privada mínima e dimensione conforme necessário", + "checklist": "SAP Checklist", + "guid": "9cb107d5-325a-4e52-9ba3-4d4685e2213a", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", + "severity": "Alto", + "text": "Aproveite a assinatura como unidade de escala e dimensione nossos recursos, considere implantar a assinatura por ambiente, por exemplo. Sandbox, não-prod, prod ", + "training": "https://learn.microsoft.com/training/modules/configure-subscriptions/?source=recommendations", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", - "service": "AVS", - "severity": "Baixo", - "text": "Para implantações automatizadas, solicite ou reserve cota antes de iniciar a implantação", + "checklist": "SAP Checklist", + "guid": "ce7bb122-f7c9-45f0-9e15-4e3aa3592829", + "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", + "service": "SAP", + "severity": "Alto", + "text": "Garantir o aumento da cota como parte do provisionamento de assinatura (por exemplo, total de núcleos de VM disponíveis em uma assinatura)", + "training": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "ce4fab2f-433a-4d59-a5a9-3d1032e03ebc", + "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", + "service": "SAP", "severity": "Baixo", - "text": "Para implantação automatizada, verifique se os bloqueios de recursos relevantes são criados por meio da automação ou da Política do Azure para uma governança adequada", + "text": "A API de Cota é uma API REST que você pode usar para exibir e gerenciar cotas para serviços do Azure. Considere usá-lo, se necessário.", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", - "service": "AVS", - "severity": "Baixo", - "text": "Implemente nomes humanos compreensíveis para chaves de autorização ExR para permitir a fácil identificação da finalidade/uso das chaves", + "checklist": "SAP Checklist", + "guid": "cbfad17b-f240-42bf-a1d8-f4f4cee661c8", + "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", + "service": "SAP", + "severity": "Alto", + "text": "Se estiver implantando em uma zona de disponibilidade, verifique se a implantação da zona da VM estará disponível depois que a cota for aprovada. Envie uma solicitação de suporte com a assinatura, a série VM, o número de CPUs e a zona de disponibilidade necessárias.", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "255461e2-aee3-4553-afc8-339248b262d6", - "service": "AVS", - "severity": "Baixo", - "text": "Usar o Cofre de chaves para armazenar segredos e chaves de autorização quando Princípios de Serviço separados são usados para implantar a Solução VMware do Azure e a Rota Expressa", + "checklist": "SAP Checklist", + "guid": "e6e20617-3686-4af4-9791-f8935ada4332", + "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", + "service": "SAP", + "severity": "Alto", + "text": "Certifique-se de que os serviços e recursos necessários estejam disponíveis nas regiões de implantação escolhidas, por exemplo. ANF, Zona etc.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/migrate/azure-best-practices/multiple-regions?source=recommendations", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", - "service": "AVS", - "severity": "Baixo", - "text": "Defina dependências de recursos para serializar ações no IaC quando muitos recursos precisarem ser implantados no/na Solução VMware do Azure, pois a Solução VMware do Azure oferece suporte apenas a um número limitado de operações paralelas.", + "checklist": "SAP Checklist", + "guid": "4e138115-2318-41aa-9174-26943ff8ae7d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", + "service": "SAP", + "severity": "Média", + "text": "Aproveite a marca de recurso do Azure para categorização de custos e agrupamento de recursos (: BillTo, Departamento (ou Unidade de Negócios), Ambiente (Produção, Estágio, Desenvolvimento), Camada (Camada da Web, Camada de Aplicativo), Proprietário do Aplicativo, ProjectName)", + "training": "https://learn.microsoft.com/training/paths/implement-resource-mgmt-security/", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", - "service": "AVS", - "severity": "Baixo", - "text": "Ao executar a configuração automatizada de segmentos NSX-T com um único gateway de Camada 1, use as APIs do Portal do Azure em vez das APIs do NSX-Manager", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "2f7c95f0-6e15-44e3-aa35-92829e6e2061", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", + "severity": "Alto", + "text": "Ajude a proteger seu banco de dados HANA usando o serviço de Backup do Azure.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-backup-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "302a2fbf-3745-4a5f-a365-c9d1a16ca22c", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", + "service": "SAP", "severity": "Média", - "text": "Ao pretender usar a expansão automatizada, certifique-se de aplicar cota suficiente da Solução VMware do Azure para as assinaturas que executam a Solução VMware do Azure", - "waf": "Desempenho" + "text": "Se você implantar os Arquivos NetApp do Azure para seu banco de dados HANA, Oracle ou DB2, use a ferramenta Azure Application Consistent Snapshot (AzAcSnap) para tirar instantâneos consistentes com o aplicativo. O AzAcSnap também suporta bancos de dados Oracle. Considere usar o AzAcSnap em uma VM central em vez de em VMs individuais.", + "waf": "Fiabilidade" + }, + { + "checklist": "SAP Checklist", + "guid": "42d37218-a3a7-45df-bff6-1173e7f249ea", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", + "severity": "Alto", + "text": "Garanta as correspondências de fuso horário entre o sistema operacional e o sistema SAP.", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "c3c7abc0-716c-4486-893c-40e181d65539", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", + "service": "SAP", "severity": "Média", - "text": "Ao pretender usar o scale-in automatizado, certifique-se de levar em consideração os requisitos da política de armazenamento antes de executar essa ação", - "waf": "Desempenho" + "text": "Não agrupe serviços de aplicativos diferentes no mesmo cluster. Por exemplo, não combine clusters DRBD e de serviços centrais no mesmo cluster. No entanto, você pode usar o mesmo cluster do Pacemaker para gerenciar aproximadamente cinco serviços centrais diferentes (cluster multi-SID).", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", - "service": "AVS", - "severity": "Média", - "text": "As operações de dimensionamento sempre precisam ser serializadas em um único SDDC, pois apenas uma operação de escala pode ser executada por vez (mesmo quando vários clusters são usados)", - "waf": "Desempenho" + "checklist": "SAP Checklist", + "guid": "a491dfc4-9353-4213-9217-eef0949f9467", + "link": "https://azure.microsoft.com/pricing/offers/dev-test/", + "service": "SAP", + "severity": "Baixo", + "text": "Considere executar sistemas de desenvolvimento/teste em um modelo de soneca para economizar e otimizar os custos de execução do Azure.", + "waf": "Custar" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "b7056168-6199-4732-a514-cdbb2d5c9c54", + "link": "https://learn.microsoft.com/azure/lighthouse/overview", + "service": "SAP", "severity": "Média", - "text": "Considerar e validar operações de dimensionamento em soluções de terceiros 3rd usadas na arquitetura (suportadas ou não)", - "waf": "Desempenho" + "text": "Se você faz parceria com clientes gerenciando suas propriedades SAP, considere o Farol do Azure. O Azure Lighthouse permite que os provedores de serviços gerenciados usem os serviços de identidade nativos do Azure para se autenticar no ambiente dos clientes. Ele coloca o controle nas mãos dos clientes, porque eles podem revogar o acesso a qualquer momento e auditar as ações dos prestadores de serviços.", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "4d116785-d2fa-456c-96ad-48408fe72734", + "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", + "service": "SAP", "severity": "Média", - "text": "Definir e impor limites máximos de entrada/saída de escala para seu ambiente nas automações", - "waf": "Desempenho" + "text": "Use o Azure Update Manager para verificar o status das atualizações disponíveis para uma única VM ou várias VMs e considere agendar patches regulares.", + "training": "https://learn.microsoft.com/training/modules/keep-your-virtual-machines-updated/?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", - "service": "AVS", - "severity": "Média", - "text": "Implementar regras de monitoramento para monitorar operações de dimensionamento automatizadas e monitorar o sucesso e a falha para habilitar respostas apropriadas (automatizadas)", + "checklist": "SAP Checklist", + "guid": "76c8bcbf-45bb-4e60-ad8a-03e97778424d", + "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", + "service": "SAP", + "severity": "Baixo", + "text": "Otimize e gerencie as operações do SAP Basis usando o SAP Landscape Management (LaMa). Use o conector SAP LaMa para Azure para realocar, copiar, clonar e atualizar sistemas SAP.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-remote-management/?source=recommendations", "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", - "severity": "Alto", - "text": "Ao usar o MON, esteja ciente dos limites de VMs configuradas simulataneamente (MON Limit for HCX [400 - standard, 1000 - Larger appliance])", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "14591147-5e39-4e53-89cc-cd979366bcda", + "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", + "service": "SAP", + "severity": "Média", + "text": "Use as soluções do Azure Monitor for SAP para monitorar suas cargas de trabalho SAP (SAP HANA, clusters SUSE de alta disponibilidade e sistemas SQL) no Azure. Considere complementar o Azure Monitor para soluções SAP com o SAP Solution Manager.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "2750ab1a-b039-4d95-b54c-7c8929cb107d", + "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", + "service": "SAP", "severity": "Alto", - "text": "Ao usar o MON, você não pode habilitar o MON em mais de 100 extensões de rede", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "Fiabilidade" + "text": "Execute uma verificação de extensão de VM para SAP. A Extensão de VM para SAP usa a identidade gerenciada atribuída de uma máquina virtual (VM) para acessar dados de monitoramento e configuração de VM. A verificação garante que todas as métricas de desempenho em seu aplicativo SAP venham da Extensão do Azure para SAP subjacente.", + "training": "https://learn.microsoft.com/training/modules/configure-azure-enhanced-monitoring-extension-for-sap/?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "5325ae52-5ba3-44d4-985e-2213ace7bb12", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "SAP", "severity": "Média", - "text": "Se estiver usando uma conexão VPN para migrações, ajuste o tamanho da MTU de acordo.", - "waf": "Desempenho" + "text": "Use a Política do Azure para controle de acesso e relatórios de conformidade. A Política do Azure fornece a capacidade de impor configurações em toda a organização para garantir a adesão consistente à política e a detecção rápida de violações. ", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e614658d-d457-4e92-9139-b821102cad6e", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "523181aa-4174-4269-93ff-8ae7d7d47431", + "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", + "service": "SAP", "severity": "Média", - "text": "Para regiões de baixa conectividade conectadas ao Azure (500Mbps ou menos), considere implantar o dispositivo de otimização de WAN HCX", - "waf": "Desempenho" + "text": "Use o Monitor de Conexão no Inspetor de Rede do Azure para monitorar métricas de latência para bancos de dados SAP e servidores de aplicativos. Ou colete e exiba medições de latência de rede usando o Azure Monitor.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/collecting-and-displaying-niping-network-latency-measurements/ba-p/1833979", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "73686af4-6791-4f89-95ad-a43324e13811", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", + "service": "SAP", "severity": "Média", - "text": "Certifique-se de que as migrações sejam iniciadas a partir do dispositivo local e NÃO do dispositivo em nuvem (NÃO execute uma migração reversa)", - "waf": "Fiabilidade" + "text": "Execute uma verificação de qualidade para o SAP HANA na infraestrutura provisionada do Azure para verificar se as VMs provisionadas estão em conformidade com as práticas recomendadas do SAP HANA no Azure.", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "AVS", - "severity": "Média", - "text": "Quando o Azure Netapp Files for usado para estender o armazenamento para a Solução VMware do Azure, considere usá-lo como um armazenamento de dados VMware em vez de anexá-lo diretamente a uma VM.", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "616785d6-fa96-4c96-ad88-518f482734c8", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", + "service": "SAP", + "severity": "Alto", + "text": "Para cada assinatura do Azure, execute um teste de latência nas zonas de disponibilidade do Azure antes da implantação zonal para escolher zonas de baixa latência para implantação do SAP no Azure.", + "training": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "waf": "Desempenho" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "410adcba-db46-424f-a6c4-05ecde75c52e", + "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", + "service": "SAP", "severity": "Média", - "text": "Verifique se um ExpressRoute Gateway dedicado está sendo usado para soluções de armazenamento de dados externos", + "text": "Execute o Relatório de Resiliência para garantir que a configuração de toda a infraestrutura provisionada do Azure (Computação, Banco de Dados, Rede, Armazenamento, Recuperação de Site) esteja em conformidade com a configuração definida pelo Cloud Adaption Framework para Azure.", + "training": "https://learn.microsoft.com/training/paths/azure-well-architected-framework/", "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "AVS", + "checklist": "SAP Checklist", + "guid": "86ba2802-1459-4114-95e3-9e5309cccd97", + "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", + "service": "SAP", "severity": "Média", - "text": "Verifique se o FastPath está habilitado no ExpressRoute Gateway que está sendo usado para soluções de armazenamento de dados externos", - "waf": "Fiabilidade" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "AVS", - "severity": "Alto", - "text": "Se estiver usando cluster estendido, verifique se a solução de recuperação de desastres selecionada é suportada pelo fornecedor", - "waf": "Fiabilidade" + "text": "Implemente a proteção contra ameaças usando a solução Microsoft Sentinel para SAP. Use esta solução para monitorar seus sistemas SAP e detectar ameaças sofisticadas em toda a lógica de negócios e camadas de aplicativos.", + "training": "https://learn.microsoft.com/training/modules/plan-microsoft-sentinel-deployment-sap/?source=recommendations", + "waf": "Segurança" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "AVS", - "severity": "Alto", - "text": "Se estiver usando cluster estendido, verifique se o SLA fornecido atenderá aos seus requisitos", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "579266bc-ca27-45fa-a1ab-fe9d55d04c3c", + "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "service": "SAP", + "severity": "Média", + "text": "A marcação do Azure pode ser aproveitada para agrupar e controlar recursos logicamente, automatizar suas implantações e, o mais importante, fornecer visibilidade sobre os custos incorridos.", + "training": "https://learn.microsoft.com/training/modules/analyze-costs-create-budgets-azure-cost-management/?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "AVS", - "severity": "Alto", - "text": "Se estiver usando cluster estendido, verifique se ambos os circuitos da Rota Expressa estão conectados ao hub de conectividade.", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "04b8e5e5-13cb-4b22-af62-5a8ecfcf0337", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", + "service": "SAP", + "severity": "Baixo", + "text": "Use o monitoramento de latência entre VMs para aplicativos sensíveis à latência.", + "waf": "Desempenho" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "AVS", - "severity": "Alto", - "text": "Se estiver usando cluster estendido, verifique se ambos os circuitos da Rota Expressa têm o GlobalReach habilitado.", + "checklist": "SAP Checklist", + "guid": "07e5ed53-3d96-43d8-87ea-631b77da5aba", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", + "service": "SAP", + "severity": "Média", + "text": "Use o monitoramento do Azure Site Recovery para manter a integridade do serviço de recuperação de desastres para servidores de aplicativos SAP.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-storage/?source=recommendations", "waf": "Fiabilidade" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "AVS", - "severity": "Alto", - "text": "Faça com que as configurações de tolerância a desastres do site tenham sido devidamente consideradas e alteradas para sua empresa, se necessário.", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "abb6af9c-982c-4cf1-83fb-329fafd1ee56", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", + "service": "SAP", + "severity": "Média", + "text": "Exclua todos os sistemas de arquivos de banco de dados e programas executáveis das verificações antivírus. Incluí-los pode levar a problemas de desempenho. Verifique com os fornecedores do banco de dados para obter detalhes prescritivos na lista de exclusão. Por exemplo, a Oracle recomenda excluir /oracle//sapdata das verificações antivírus.", + "waf": "Desempenho" }, { - "checklist": "Redis Resiliency checklist", - "guid": "65285269-440b-44be-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", - "service": "Redis", - "severity": "Alto", - "text": "Habilite a redundância de zona para o Cache do Azure para Redis. O Cache do Azure para Redis dá suporte a configurações redundantes de zona nas camadas Premium e Enterprise. Um cache redundante de zona pode colocar seus nós em diferentes zonas de disponibilidade do Azure na mesma região. Ele elimina a interrupção do data center ou AZ como um único ponto de falha e aumenta a disponibilidade geral do cache.", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "c027f893-f404-41a9-b33d-39d625a14964", + "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", + "service": "SAP", + "severity": "Baixo", + "text": "Considere a coleta de estatísticas completas de banco de dados para bancos de dados não-HANA após a migração. Por exemplo, implemente a nota SAP 1020260 - Entrega de estatísticas Oracle.", + "waf": "Desempenho" }, { - "checklist": "Redis Resiliency checklist", - "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", - "service": "Redis", - "severity": "Média", - "text": "Configure a persistência de dados para uma instância do Cache do Azure para Redis. Como os dados do cache são armazenados na memória, uma falha rara e não planejada de vários nós pode fazer com que todos os dados sejam descartados. Para evitar a perda completa de dados, a persistência do Redis permite que você tire instantâneos periódicos de dados na memória e os armazene em sua conta de armazenamento.", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "fdafb1f5-3eee-4354-a8c9-deb8127ebc2e", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", + "service": "SAP", + "severity": "Média", + "text": "Considere o uso do Oracle Automatic Storage Management (ASM) para todas as implantações Oracle que usam SAP no Azure.", + "training": "https://learn.microsoft.com/training/paths/administer-infrastructure-resources-in-azure/?source=recommendations", + "waf": "Desempenho" }, { - "checklist": "Redis Resiliency checklist", - "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", - "service": "Redis", + "checklist": "SAP Checklist", + "guid": "33c5d5bf-daf3-4f0d-bd50-6010fdcec22e", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", + "service": "SAP", "severity": "Média", - "text": "Use a conta de armazenamento com redundância geográfica para persistir o Cache do Azure para dados Redis ou zonalmente redundante onde a redundância geográfica não está disponível", - "waf": "Fiabilidade" + "text": "Para SAP no Azure executando Oracle, uma coleção de scripts SQL pode ajudá-lo a diagnosticar problemas de desempenho. Os relatórios do Automatic Workload Repository (AWR) contêm informações valiosas para diagnosticar problemas no sistema Oracle. Recomendamos que você execute um relatório AWR durante várias sessões e escolha horários de pico para ele, para garantir uma ampla cobertura para a análise.", + "training": "https://learn.microsoft.com/ja-jp/azure/well-architected/oracle-iaas/performance-efficiency", + "waf": "Desempenho" }, { - "checklist": "Redis Resiliency checklist", - "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", - "service": "Redis", - "severity": "Média", - "text": "Configure a replicação geográfica passiva para instâncias do Cache Premium do Azure para Redis. A replicação geográfica é um mecanismo para vincular duas ou mais instâncias do Cache do Azure para Redis, normalmente abrangendo duas regiões do Azure. A replicação geográfica foi projetada principalmente para recuperação de desastres entre regiões. Duas instâncias de cache de camada Premium são conectadas por meio de replicação geográfica de uma forma que fornece leituras e gravações no cache primário e que os dados são replicados para o cache secundário.", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "d89fd98d-23e4-4b40-a92e-32db9365522c", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", + "severity": "Alto", + "text": "Use o monitoramento do Azure Site Recovery para manter a integridade do serviço de recuperação de desastres para servidores de aplicativos SAP.", + "training": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure Spring Apps Review", - "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", - "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", - "service": "Spring Apps", + "checklist": "SAP Checklist", + "guid": "5ba34d46-85e2-4213-ace7-bb122f7c95f0", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "SAP", "severity": "Média", - "text": "Os Aplicativos Spring do Azure permitem duas implantações para cada aplicativo, apenas um dos quais recebe tráfego de produção. Você pode obter tempo de inatividade zero com estratégias de implantação em verde azul. A implantação verde azul só está disponível nas camadas Standard e Enterprise. Você pode automatizar a implantação usando CI/CD com ações do ADO/GitHub", - "waf": "Fiabilidade" + "text": "Para a entrega segura de aplicativos HTTP/S, use o Application Gateway v2 e verifique se a proteção e as políticas do WAF estão habilitadas.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/", + "waf": "Segurança" }, { - "checklist": "Azure Spring Apps Review", - "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", - "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", - "service": "Spring Apps", + "checklist": "SAP Checklist", + "guid": "fa9d30bc-1b82-4e4b-bfdf-6b017938b9e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", "severity": "Média", - "text": "As instâncias do Azure Spring Apps podem ser criadas em várias regiões para seus aplicativos e o tráfego pode ser roteado pelo Gerenciador de Tráfego/Front Door.", - "waf": "Fiabilidade" + "text": "Se o DNS ou o nome virtual da máquina virtual não for alterado durante a migração para o Azure, o DNS em segundo plano e os nomes virtuais conectam muitas interfaces do sistema no cenário SAP, e os clientes só às vezes estão cientes das interfaces que os desenvolvedores definem ao longo do tempo. Surgem desafios de conexão entre vários sistemas quando os nomes virtuais ou DNS mudam após as migrações, e é recomendável manter os aliases DNS para evitar esses tipos de dificuldades.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "Operações" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", - "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", - "service": "Spring Apps", + "checklist": "SAP Checklist", + "guid": "a2858f78-105b-4f52-b7a9-5b0f4439743b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "service": "SAP", "severity": "Média", - "text": "Na região com suporte, os Aplicativos Spring do Azure podem ser implantados como zona redundante, o que significa que as instâncias são distribuídas automaticamente entre zonas de disponibilidade. Esse recurso só está disponível nas camadas Standard e Enterprise.", - "waf": "Fiabilidade" + "text": "Use zonas DNS diferentes para distinguir cada ambiente (sandbox, desenvolvimento, pré-produção e produção) um do outro. A exceção é para implantações SAP com sua própria VNet; aqui, zonas DNS privadas podem não ser necessárias.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/4-explore-name-resolution", + "waf": "Operações" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", - "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", - "service": "Spring Apps", + "checklist": "SAP Checklist", + "guid": "a3592829-e6e2-4061-9368-6af46791f893", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", + "service": "SAP", "severity": "Média", - "text": "Usar mais de 1 instância de aplicativo para seus aplicativos", + "text": "Emparelhamento de rede virtual local e global fornecem conectividade e são as abordagens preferidas para garantir a conectividade entre zonas de aterrissagem para implantações SAP em várias regiões do Azure", + "training": "https://learn.microsoft.com/training/modules/configure-vnet-peering/?source=recommendations", "waf": "Fiabilidade" }, { - "checklist": "Azure Spring Apps Review", - "guid": "7504c230-6035-4183-95a5-85762acc6075", - "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", - "service": "Spring Apps", - "severity": "Média", - "text": "Monitore os Aplicativos Spring do Azure com logs, métricas e rastreamento. Integre o ASA com insights de aplicativos e rastreie falhas e crie pastas de trabalho.", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "41742694-3ff8-4ae7-b7d4-743176c8bcbf", + "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", + "service": "SAP", + "severity": "Alto", + "text": "Não há suporte para implantar qualquer NVA entre o aplicativo SAP e o servidor de banco de dados SAP", + "training": "https://me.sap.com/notes/2731110", + "waf": "Desempenho" }, { - "checklist": "Azure Spring Apps Review", - "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", - "service": "Spring Apps", + "checklist": "SAP Checklist", + "guid": "7d4bc7d2-c34a-452e-8f1d-6ae3c8eafcc3", + "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", + "service": "SAP", "severity": "Média", - "text": "Configurar o dimensionamento automático no Spring Cloud Gateway", - "waf": "Fiabilidade" + "text": "Use a WAN Virtual para implantações do Azure em redes novas, grandes ou globais onde você precisa de conectividade de trânsito global entre regiões do Azure e locais locais. Com essa abordagem, você não precisará configurar manualmente o roteamento transitivo para a rede do Azure e poderá seguir um padrão para implantações do SAP no Azure.", + "training": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "waf": "Operações" }, { - "checklist": "Azure Spring Apps Review", - "guid": "97411607-b6fd-4335-99d1-9885faf4e392", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", - "service": "Spring Apps", - "severity": "Baixo", - "text": "Habilite o dimensionamento automático para os aplicativos com o plano de consumo padrão e dedicado.", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "0cedb1f6-ae6c-492b-8b17-8061f50b16d3", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", + "service": "SAP", + "severity": "Média", + "text": "Considere a implantação de dispositivos virtuais de rede (NVAs) entre regiões somente se NVAs de parceiros forem usados. NVAs entre regiões ou VNets não são necessários se NVAs nativos estiverem presentes. Ao implantar tecnologias de rede de parceiros e NVAs, siga as orientações do fornecedor para verificar configurações conflitantes com a rede do Azure.", + "training": "https://learn.microsoft.com/training/modules/control-network-traffic-flow-with-routes/?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure Spring Apps Review", - "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", - "link": "https://learn.microsoft.com/azure/spring-apps/overview", - "service": "Spring Apps", + "checklist": "SAP Checklist", + "guid": "facc08c6-ea95-4641-91cd-fa09e573adbd", + "link": "https://learn.microsoft.com/azure/architecture/networking/hub-spoke-vwan-architecture", + "service": "SAP", "severity": "Média", - "text": "Use o plano Enterprise para suporte comercial de inicialização spring para aplicativos de missão crítica. Com outras camadas, você obtém suporte a OSS.", - "waf": "Fiabilidade" + "text": "A WAN virtual gerencia a conectividade entre VNets spoke para topologias baseadas em WAN virtual (não há necessidade de configurar o roteamento definido pelo usuário [UDR] ou NVAs), e a taxa de transferência máxima de rede para o tráfego de VNet-to-VNet no mesmo hub virtual é de 50 gigabits por segundo. Se necessário, as zonas de aterrissagem SAP podem usar o emparelhamento de VNet para se conectar a outras zonas de aterrissagem e superar essa limitação de largura de banda.", + "training": "https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure Event Hub Review", - "description": "O Hub de Eventos do Azure fornece criptografia de dados em repouso. Se você usar sua própria chave, os dados ainda serão criptografados usando a chave gerenciada pela Microsoft, mas, além disso, a chave gerenciada pela Microsoft será criptografada usando a chave gerenciada pelo cliente. ", - "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", - "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", - "service": "Event Hubs", - "severity": "Baixo", - "text": "Usar a opção de chave gerenciada pelo cliente na criptografia de dados em repouso quando necessário", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "checklist": "SAP Checklist", + "guid": "82734c88-6ba2-4802-8459-11475e39e530", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", + "severity": "Alto", + "text": "A atribuição de IP público à VM que executa o SAP Workload não é recomendada.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", "waf": "Segurança" }, { - "checklist": "Azure Event Hub Review", - "description": "Os namespaces dos Hubs de Eventos do Azure permitem que os clientes enviem e recebam dados com TLS 1.0 e superior. Para impor medidas de segurança mais rígidas, você pode configurar o namespace dos Hubs de Eventos para exigir que os clientes enviem e recebam dados com uma versão mais recente do TLS. Se um namespace de Hubs de Eventos exigir uma versão mínima do TLS, todas as solicitações feitas com uma versão mais antiga falharão. ", - "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", - "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", - "service": "Event Hubs", - "severity": "Média", - "text": "Impor uma versão mínima necessária do TLS (Transport Layer Security) para solicitações ", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "9cccd979-366b-4cda-8750-ab1ab039d95d", + "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", + "service": "SAP", + "severity": "Alto", + "text": "Considere reservar o endereço IP no lado do DR ao configurar o ASR", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "Operações" }, { - "checklist": "Azure Event Hub Review", - "description": "Quando você cria um namespace de Hubs de Eventos, uma regra de política chamada RootManageSharedAccessKey é criada automaticamente para o namespace. Essa política tem permissões de gerenciamento para todo o namespace. É recomendável que você trate essa regra como uma conta raiz administrativa e não a use em seu aplicativo. Recomenda-se o uso do AAD como um provedor de autenticação com RBAC. ", - "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", - "service": "Event Hubs", - "severity": "Média", - "text": "Evite usar conta root quando não for necessário", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "Segurança" + "checklist": "SAP Checklist", + "guid": "54c7c892-9cb1-407d-9325-ae525ba34d46", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "SAP", + "severity": "Alto", + "text": "Evite usar intervalos de endereços IP sobrepostos para sites de produção e DR.", + "training": "https://learn.microsoft.com/training/modules/design-ip-addressing-for-azure/?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure Event Hub Review", - "description": "As identidades gerenciadas para recursos do Azure podem autorizar o acesso a recursos dos Hubs de Eventos usando credenciais do Azure AD de aplicativos em execução em VMs (Máquinas Virtuais) do Azure, aplicativos de Função, Conjuntos de Dimensionamento de Máquina Virtual e outros serviços. Usando identidades gerenciadas para recursos do Azure junto com a autenticação do Azure AD, você pode evitar o armazenamento de credenciais com seus aplicativos executados na nuvem. ", - "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", - "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "6e154e3a-a359-4282-ae6e-206173686af4", + "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", + "service": "SAP", "severity": "Média", - "text": "Quando possível, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Hub de Eventos do Azure. Caso contrário, considere ter a credencial de armazenamento (SAS, credencial da entidade de serviço) no Cofre de Chaves do Azure ou em um serviço equivalente", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "Segurança" + "text": "Embora o Azure ajude você a criar várias sub-redes delegadas em uma rede virtual, apenas uma sub-rede delegada pode existir em uma rede virtual para arquivos do Azure NetApp. As tentativas de criar um novo volume falharão se você usar mais de uma sub-rede delegada para Arquivos do Azure NetApp.", + "training": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-network-topologies?source=recommendations", + "waf": "Operações" }, { - "checklist": "Azure Event Hub Review", - "description": "Ao criar permissões, forneça controle refinado sobre o acesso de um cliente ao Hub de Eventos do Azure. As permissões no Hub de Eventos do Azure podem e devem ter o escopo definido para o nível de recurso individual, por exemplo, grupo de consumidores, entidade de hub de eventos, namespaces de hub de eventos, etc.", - "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", - "service": "Event Hubs", - "severity": "Alto", - "text": "Usar RBAC do plano de dados de privilégios mínimos", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "checklist": "SAP Checklist", + "guid": "d8a03e97-7784-424d-9167-85d6fa96c96a", + "link": "https://learn.microsoft.com/azure/well-architected/services/networking/azure-firewall?toc=%2Fazure%2Ffirewall%2Ftoc.json&bc=%2Fazure%2Ffirewall%2Fbreadcrumb%2Ftoc.json", + "service": "SAP", + "severity": "Média", + "text": "Usar o Firewall do Azure para controlar o tráfego de saída do Azure para a Internet, conexões de entrada não HTTP/S e filtragem de tráfego Leste/Oeste (se a organização exigir)", + "training": "https://learn.microsoft.com/training/paths/secure-networking-infrastructure/", "waf": "Segurança" }, { - "checklist": "Azure Event Hub Review", - "description": "Os logs de recursos do Hub de Eventos do Azure incluem logs operacionais, logs de rede virtual e logs de Kafka. Os logs de auditoria de tempo de execução capturam informações de diagnóstico agregadas para todas as operações de acesso ao plano de dados (como eventos de envio ou recebimento) nos Hubs de Eventos.", - "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", - "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "91a65e40-be90-45b3-9f73-f3edbf8dc324", + "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", + "service": "SAP", "severity": "Média", - "text": "Habilite o registro em log para investigação de segurança. Use o Azure Monitor para capturar métricas e logs como logs de recursos, logs de auditoria de tempo de execução e logs Kafka", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "text": "O Application Gateway e o Web Application Firewall têm limitações quando o Application Gateway serve como um proxy reverso para aplicativos Web SAP, conforme mostrado na comparação entre o Application Gateway, o SAP Web Dispatcher e outros serviços de terceiros.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959506.html", "waf": "Segurança" }, { - "checklist": "Azure Event Hub Review", - "description": "Por padrão, o Hub de Eventos do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem que o tráfego entre sua rede virtual e o Hub de Eventos do Azure percorra a rede de backbone da Microsoft. Além disso, você deve desabilitar os pontos de extremidade públicos se eles não forem usados. ", - "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", - "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "5e39e530-9ccc-4d97-a366-bcda2750ab1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", "severity": "Média", - "text": "Considere o uso de pontos de extremidade privados para acessar o Hub de Eventos do Azure e desabilitar o acesso à rede pública quando aplicável.", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "text": "Use as políticas do Azure Front Door e do WAF para fornecer proteção global entre as regiões do Azure para conexões HTTP/S de entrada para uma zona de aterrissagem.", + "training": "https://learn.microsoft.com/training/paths/secure-application-delivery/", "waf": "Segurança" }, { - "checklist": "Azure Event Hub Review", - "description": "Com o firewall IP, você pode restringir ainda mais o ponto de extremidade público a apenas um conjunto de endereços IPv4 ou intervalos de endereços IPv4 na notação CIDR (Roteamento entre Domínios Sem Classe). ", - "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "b039d95d-54c7-4c89-89cb-107d5325ae52", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "SAP", "severity": "Média", - "text": "Considere permitir apenas o acesso ao namespace do Hub de Eventos do Azure a partir de endereços IP ou intervalos específicos", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "text": "Aproveite as políticas do Web Application Firewall no Azure Front Door quando estiver usando o Azure Front Door e o Application Gateway para proteger aplicativos HTTP/S. Bloqueie o Gateway de Aplicativo para receber tráfego somente do Azure Front Door.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", "waf": "Segurança" }, { - "checklist": "Azure Event Hub Review", - "guid": "31d41e36-11c8-417b-8afb-c410d4391898", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "5ada4332-4e13-4811-9231-81aa41742694", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "SAP", "severity": "Média", - "text": "Aproveite o Manual de Resilência do FTA", - "waf": "Fiabilidade" + "text": "Use um firewall de aplicativo Web para verificar seu tráfego quando ele estiver exposto à Internet. Outra opção é usá-lo com seu balanceador de carga ou com recursos que tenham recursos internos de firewall, como o Application Gateway ou soluções de terceiros.", + "training": "https://learn.microsoft.com/training/modules/introduction-azure-web-application-firewall/?source=recommendations", + "waf": "Segurança" }, { - "checklist": "Azure Event Hub Review", - "description": " Isso será ativado automaticamente para um novo namespace de EH criado a partir do portal com SKUs Premium, Dedicado ou Standard em uma região habilitada para região. Os metadados do EH e os próprios dados do evento são replicados entre zonas", - "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", - "service": "Event Hubs", - "severity": "Alto", - "text": "Aproveite as zonas de disponibilidade, se aplicável regionalmente", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "e73de7d5-6f36-4217-a526-e1a621ecddde", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "SAP", + "severity": "Média", + "text": "Use a WAN Virtual para implantações do Azure em redes novas, grandes ou globais onde você precisa de conectividade de trânsito global entre regiões do Azure e locais locais. Com essa abordagem, você não precisará configurar manualmente o roteamento transitivo para a rede do Azure e poderá seguir um padrão para implantações do SAP no Azure.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/10-explore-azure-front-door", + "waf": "Desempenho" }, { - "checklist": "Azure Event Hub Review", - "guid": "20b56c56-ad58-4519-8f82-735c586bb281", - "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "3c536a3e-1b6b-4e87-95ca-15edb47251c0", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "SAP", "severity": "Média", - "text": "Use os SKUs Premium ou Dedicado para desempenho previsível", - "waf": "Fiabilidade" + "text": "Para evitar o vazamento de dados, use o Link Privado do Azure para acessar com segurança recursos de plataforma como serviço, como Armazenamento de Blobs do Azure, Arquivos do Azure, Azure Data Lake Storage Gen2, Azure Data Factory e muito mais. O Ponto de Extremidade Privado do Azure também pode ajudar a proteger o tráfego entre VNets e serviços como o Armazenamento do Azure, o Backup do Azure e muito mais. O tráfego entre sua rede virtual e o serviço habilitado para ponto de extremidade privado viaja pela rede global da Microsoft, o que impede sua exposição à Internet pública.", + "training": "https://learn.microsoft.com/training/modules/design-implement-private-access-to-azure-services/?source=recommendations", + "waf": "Segurança" }, { - "checklist": "Azure Event Hub Review", - "description": "O recurso interno de recuperação de desastres geográficos, quando habilitado, garante que toda a configuração de um namespace (Hubs de Eventos, Grupos de Consumidores e configurações) seja replicada continuamente de um namespace primário para um namespace secundário e permite uma movimentação de failover única do primário para o secundário a qualquer momento. O recurso Ativo/Passivo foi projetado para facilitar a recuperação e o abandono de uma região do Azure com falha sem precisar alterar as configurações do aplicativo", - "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "85e2213a-ce7b-4b12-8f7c-95f06e154e3a", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", + "service": "SAP", "severity": "Alto", - "text": "Planejar a recuperação de desastres geográficos usando a configuração passiva ativa", - "waf": "Fiabilidade" + "text": "Verifique se a rede acelerada do Azure está habilitada nas VMs usadas nas camadas de aplicativo SAP e DBMS.", + "training": "https://learn.microsoft.com/training/paths/azure-fundamentals-describe-azure-architecture-services/?source=recommendations", + "waf": "Desempenho" }, { - "checklist": "Azure Event Hub Review", - "description": "Deve ser usado para configurações de DR em que uma interrupção ou perda de dados de eventos na região derrubada não pode ser tolerada. Para esses casos, siga as diretrizes de replicação e não use o recurso interno de recuperação de desastres geográficos (ativo/passivo). Com Ativo/Ativo, mantenha vários Hubs de Eventos em diferentes regiões e namespaces, e os eventos serão replicados entre os hubs", - "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "3ff8ae7d-7d47-4431-96c8-bcbf45bbe609", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-multivip-overview", + "service": "SAP", "severity": "Média", - "text": "Para aplicativos críticos para os negócios, use a configuração ativa", - "waf": "Fiabilidade" + "text": "Verifique se as implantações internas do Azure Load Balancer estão configuradas para usar DSR (Direct Server Return). Essa configuração (Habilitando IP flutuante) reduzirá a latência quando as configurações internas do balanceador de carga forem usadas para configurações de alta disponibilidade na camada DBMS.", + "training": "https://learn.microsoft.com/ja-jp/training/modules/load-balancing-non-https-traffic-azure/?source=recommendations", + "waf": "Segurança" }, { - "checklist": "Azure Event Hub Review", - "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", - "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", - "service": "Event Hubs", + "checklist": "SAP Checklist", + "guid": "6791f893-5ada-4433-84e1-3811523181aa", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "SAP", "severity": "Média", - "text": "Projetar Hubs de Eventos Resilientes", - "waf": "Fiabilidade" + "text": "Você pode usar as regras ASG (grupo de segurança de aplicativo) e NSG para definir listas de controle de acesso de segurança de rede entre o aplicativo SAP e as camadas DBMS. Os ASGs agrupam máquinas virtuais para ajudar a gerenciar sua segurança.", + "training": "https://learn.microsoft.com/training/modules/configure-network-security-groups/?source=recommendations", + "waf": "Segurança" }, { - "checklist": "IoT Hub Review", - "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", - "service": "IoT", + "checklist": "SAP Checklist", + "guid": "45bbe609-d8a0-43e9-9778-424d616785d6", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", "severity": "Alto", - "text": "Aproveitar zonas de disponibilidade, se aplicável regionalmente (isso é habilitado automaticamente)", - "waf": "Fiabilidade" + "text": "Não há suporte para a colocação da camada de aplicativo SAP e do SGBD SAP em diferentes VNets do Azure que não são emparelhadas.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Desempenho" }, { - "checklist": "IoT Hub Review", - "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", + "checklist": "SAP Checklist", + "guid": "fa96c96a-d885-418f-9827-34c886ba2802", + "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", + "service": "SAP", "severity": "Média", - "text": "Esteja ciente dos failovers iniciados pela Microsoft. Eles são exercidos pela Microsoft em raras situações para fazer failover de todos os hubs IoT de uma região afetada para a região geo-emparelhada correspondente.", - "waf": "Fiabilidade" + "text": "Para obter a latência de rede ideal com aplicativos SAP, considere o uso de grupos de posicionamento de proximidade do Azure.", + "training": "https://learn.microsoft.com/azure/virtual-machines/co-location#planned-maintenance-and-proximity-placement-groups", + "waf": "Desempenho" }, { - "checklist": "IoT Hub Review", - "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", - "service": "IoT", + "checklist": "SAP Checklist", + "guid": "18c8b61c-855a-4405-b6ed-266455e4f4ce", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", "severity": "Alto", - "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas", - "waf": "Fiabilidade" + "text": "NÃO há suporte para executar uma camada do SAP Application Server e uma camada de DBMS dividida entre o local e o Azure. Ambas as camadas precisam residir completamente no local ou no Azure.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Desempenho" }, { - "checklist": "IoT Hub Review", - "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", + "checklist": "SAP Checklist", + "guid": "b65c878b-4b14-4f4e-92d8-d873936493f2", + "link": "https://me.sap.com/notes/2015553", + "service": "SAP", "severity": "Alto", - "text": "Saiba como acionar um failover manual.", - "waf": "Fiabilidade" + "text": "Não é recomendado hospedar o sistema de gerenciamento de banco de dados (DBMS) e as camadas de aplicativos dos sistemas SAP em diferentes VNets e conectá-los ao emparelhamento de VNet devido aos custos substanciais que o tráfego de rede excessivo entre as camadas pode produzir. Recomende o uso de sub-redes na rede virtual do Azure para separar a camada de aplicativo SAP e a camada DBMS.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", + "waf": "Custar" }, { - "checklist": "IoT Hub Review", - "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", - "service": "IoT", + "checklist": "SAP Checklist", + "guid": "402a9846-d515-4061-aff8-cd30088693fa", + "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel", + "service": "SAP", "severity": "Alto", - "text": "Saiba como fazer failback após um failover.", - "waf": "Fiabilidade" + "text": "Se estiver usando o Load Balancer com sistemas operacionais convidados Linux, verifique se o parâmetro de rede Linux net.ipv4.tcp_timestamps está definido como 0.", + "training": "https://learn.microsoft.com/training/modules/implement-ha-sap-netweaver-anydb/?source=recommendations", + "waf": "Desempenho" }, { - "checklist": "Azure Bot Service", - "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", - "service": "Bot service", + "checklist": "SAP Checklist", + "guid": "87585797-5551-4d53-bb7d-a94ee415734d", + "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", + "service": "SAP", "severity": "Média", - "text": "Siga as recomendações de suporte de confiabilidade no Serviço de Bot do Azure", - "waf": "Fiabilidade" + "text": "Para implantações SAP RISE/ECS, o emparelhamento virtual é a maneira preferida de estabelecer conectividade com o ambiente existente do Azure do cliente. Tanto a vnet do SAP quanto a(s) vnet(s) do cliente são protegidas com grupos de segurança de rede (NSG), permitindo a comunicação nas portas SAP e de banco de dados por meio do emparelhamento vnet", + "waf": "Segurança" }, { - "checklist": "Azure Bot Service", - "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", - "service": "Bot service", - "severity": "Média", - "text": "Implantando bots com residência de dados local e conformidade regional", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "ff5136bd-dcf1-4d2b-ae52-39333efdf45a", + "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", + "service": "SAP", + "severity": "Alto", + "text": "Revise os backups de banco de dados do SAP HANA para VMs do Azure.", + "waf": "Custar" }, { - "checklist": "Azure Bot Service", - "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", - "service": "Bot service", + "checklist": "SAP Checklist", + "guid": "cafde29d-a0af-4bcd-87c0-0f299d63f0e8", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", + "service": "SAP", "severity": "Média", - "text": "O Serviço de Bot do Azure é executado no modo ativo-ativo para serviços globais e regionais. Quando ocorre uma paralisação, você não precisa detectar erros ou gerenciar o serviço. O Serviço de Bot do Azure executa automaticamente o failover automático e a recuperação automática em uma arquitetura geográfica de várias regiões. Para o serviço regional de bot da UE, o Serviço de Bot do Azure fornece duas regiões completas dentro da Europa com replicação ativa/ativa para garantir redundância. Para o serviço de bot global, todas as regiões/geografias disponíveis podem ser servidas como a presença global.", - "waf": "Fiabilidade" - }, - { - "checklist": "Device Provisioning Service Review", - "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", - "service": "IoT Hub DPS", - "severity": "Alto", - "text": "Selecione o plano de hospedagem de aplicativo lógico certo com base em seus requisitos de negócios e SLO", - "waf": "Fiabilidade" + "text": "Revise o monitoramento interno do Site Recovery, quando usado para SAP.", + "waf": "Custar" }, { - "checklist": "Device Provisioning Service Review", - "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "IoT Hub DPS", + "checklist": "SAP Checklist", + "guid": "82d7b8de-d3f1-44a0-830b-38e200e82acf", + "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", + "service": "SAP", "severity": "Alto", - "text": "Proteja aplicativos lógicos contra falhas de região com redundância de zona e zonas de disponibilidade", - "waf": "Fiabilidade" + "text": "Revise as diretrizes de monitoramento do cenário do sistema SAP HANA.", + "waf": "Operações" }, { - "checklist": "Device Provisioning Service Review", - "guid": "8aed4fbf-0830-4883-899d-222a154af478", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "IoT Hub DPS", - "severity": "Alto", - "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "c823873a-2bec-4c2a-b684-a1ce8ae80efd", + "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", + "service": "SAP", + "severity": "Média", + "text": "Revise o Banco de Dados Oracle nas estratégias de backup de VM do Linux do Azure.", + "waf": "Operações" }, { - "checklist": "Device Provisioning Service Review", - "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "IoT Hub DPS", - "severity": "Alto", - "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "2943b6d8-1d31-4e19-ade7-78e6b26d1962", + "link": "https://learn.microsoft.com/sql/relational-databases/tutorial-use-azure-blob-storage-service-with-sql-server-2016?view=sql-server-ver16", + "service": "SAP", + "severity": "Média", + "text": "Analise o uso do Armazenamento de Blobs do Azure com o SQL Server 2016.", + "waf": "Operações" }, { - "checklist": "Device Provisioning Service Review", - "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "IoT Hub DPS", + "checklist": "SAP Checklist", + "guid": "b82e650f-676d-417d-994d-fc33ca54ec14", + "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", + "service": "SAP", "severity": "Média", - "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código de Aplicativo Lógico", + "text": "Analise o uso do Backup Automatizado v2 para VMs do Azure.", "waf": "Operações" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Front Door", - "severity": "Média", - "text": "Se você usar certificados TLS gerenciados pelo cliente com o Azure Front Door, use a versão de certificado 'Mais recente'. Reduzir o risco de paralisações causadas pela renovação manual de certificados", + "checklist": "SAP Checklist", + "guid": "347c2dcc-e6eb-4b04-80c5-628b171aa62d", + "service": "SAP", + "severity": "Alto", + "text": "Ativando o acelerador de gravação para a série M ao usar discos premium (V1)", "waf": "Operações" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", - "guid": "553585a6-abe0-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "App Gateway", - "severity": "Média", - "text": "Verifique se você está usando o SKU do Application Gateway v2", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Segurança" - }, - { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", - "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Load Balancer", + "checklist": "SAP Checklist", + "guid": "b96512cf-996f-4b17-b9b8-6b16db1a2a94", + "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/AvZone-Latency-Test", + "service": "SAP", "severity": "Média", - "text": "Verifique se você está usando a SKU padrão para seus Balanceadores de Carga do Azure", - "waf": "Segurança" + "text": "Testar a latência da zona de disponibilidade.", + "waf": "Desempenho" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "9432621a-8397-4654-a882-5bc856b7ef83", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", - "service": "Load Balancer", + "checklist": "SAP Checklist", + "guid": "9fd7ffd4-da11-49f6-a374-8d03e94c511d", + "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", + "service": "SAP", "severity": "Média", - "text": "Verifique se os endereços IP de front-end dos Load Balancers são redundantes por zona (a menos que você precise de frontends zonais).", - "waf": "Segurança" + "text": "Ative o SAP EarlyWatch Alert para todos os componentes SAP.", + "training": "https://help.sap.com/docs/SUPPORT_CONTENT/techops/3362700736.html", + "waf": "Desempenho" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", - "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "App Gateway", + "checklist": "SAP Checklist", + "guid": "b9b140cf-413a-483d-aad2-8802c4e3c017", + "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", + "service": "SAP", "severity": "Média", - "text": "Seus Application Gateways v2 devem ser implantados em sub-redes com prefixos IP iguais ou maiores que /24", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Segurança" + "text": "Revise a latência do servidor de aplicativos SAP para o servidor de banco de dados usando o relatório SAP ABAPMeter /SSA/CAT.", + "training": "https://me.sap.com/notes/0002879613", + "waf": "Desempenho" }, { - "checklist": "Azure Application Delivery Networking", - "description": "A administração de proxies reversos em geral e do WAF em particular está mais próxima do aplicativo do que da rede, portanto, eles pertencem à mesma assinatura que o aplicativo. Centralizar o Application Gateway e o WAF na assinatura de conectividade pode ser OK se for gerenciado por uma única equipe.", - "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", + "checklist": "SAP Checklist", + "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", + "service": "SAP", "severity": "Média", - "text": "Implante o Gateway de Aplicativo do Azure v2 ou NVAs de parceiros usados para fazer proxy de conexões HTTP(S) de entrada na rede virtual da zona de aterrissagem e com os aplicativos que eles estão protegendo.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Segurança" + "text": "Revise o monitoramento de desempenho do SQL Server usando o CCMS.", + "waf": "Desempenho" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", + "checklist": "SAP Checklist", + "guid": "35709da7-fc7d-4efe-bb20-2e91547b7390", + "link": "https://me.sap.com/notes/500235", + "service": "SAP", "severity": "Média", - "text": "Use uma rede DDoS ou planos de proteção IP para todos os endereços IP públicos nas zonas de aterrissagem do aplicativo.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Segurança" + "text": "Teste a latência de rede entre VMs de camada de aplicativo SAP e VMs DBMS (NIPING).", + "training": "https://me.sap.com/notes/1100926/E", + "waf": "Desempenho" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", - "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", - "service": "App Gateway", + "checklist": "SAP Checklist", + "guid": "9e9bb4c8-e934-4e4b-a13c-6f7c7c38eb43", + "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", + "service": "SAP", "severity": "Média", - "text": "Configure o dimensionamento automático com uma quantidade mínima de duas instâncias.", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Fiabilidade" + "text": "Revise os alertas do SAP HANA Studio.", + "waf": "Desempenho" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", - "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", - "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", - "service": "App Gateway", + "checklist": "SAP Checklist", + "guid": "f1a92ab5-9509-4b57-86ff-b0ade361b694", + "link": "https://me.sap.com/notes/1969700", + "service": "SAP", "severity": "Média", - "text": "Implantar o Application Gateway em zonas de disponibilidade", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "Fiabilidade" + "text": "Execute verificações de integridade do SAP HANA usando HANA_Configuration_Minichecks.", + "waf": "Desempenho" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "18dffcf3-248c-4039-a67c-dec8e3a5f804", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", "severity": "Média", - "text": "Use o Azure Front Door com políticas WAF para fornecer e ajudar a proteger aplicativos HTTP/S globais que abrangem várias regiões do Azure.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Se você executar VMs do Windows e Linux no Azure, no local ou em outros ambientes de nuvem, poderá usar o Centro de gerenciamento de atualizações na Automação do Azure para gerenciar atualizações do sistema operacional, incluindo patches de segurança.", + "training": "https://learn.microsoft.com/azure/automation/update-management/overview", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3f29812b-2363-4cef-b179-b599de0d5973", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "08951710-79a2-492a-adbc-06d7a401545b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", + "service": "SAP", "severity": "Média", - "text": "Ao usar o Front Door e o Application Gateway para ajudar a proteger aplicativos HTTP/S, use políticas WAF no Front Door. Bloqueie o Application Gateway para receber tráfego somente do Front Door.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "Analise rotineiramente as notas de OSS de segurança do SAP porque o SAP lança patches de segurança altamente críticos, ou hot fixes, que exigem ação imediata para proteger seus sistemas SAP.", + "training": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", "waf": "Segurança" }, { - "ammp": true, - "arm-service": "microsoft.network/trafficManagerProfiles", - "checklist": "Azure Application Delivery Networking", - "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Traffic Manager", - "severity": "Alto", - "text": "Use o Gerenciador de Tráfego para fornecer aplicativos globais que abrangem protocolos diferentes de HTTP/S.", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "Fiabilidade" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", + "checklist": "SAP Checklist", + "guid": "1b8b394e-ae64-4a74-8933-357b523ea0a0", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", "severity": "Baixo", - "text": "Se os usuários precisarem apenas de acesso a aplicativos internos, o Proxy de Aplicativo de ID do Microsoft Entra foi considerado uma alternativa à Área de Trabalho Virtual (AVD) do Azure?", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", + "text": "Para SAP no SQL Server, você pode desabilitar a conta de administrador do sistema do SQL Server porque os sistemas SAP no SQL Server não usam a conta. Certifique-se de que outro usuário com direitos de administrador do sistema possa acessar o servidor antes de desabilitar a conta de administrador do sistema original.", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", - "severity": "Média", - "text": "Para reduzir o número de portas de firewall abertas para conexões de entrada em sua rede, considere o uso do Microsoft Entra ID Application Proxy para dar aos usuários remotos acesso seguro e autenticado a aplicativos internos.", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "checklist": "SAP Checklist", + "guid": "5a76a033-ced9-4eef-9a43-5e4f96634c8e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", + "service": "SAP", + "severity": "Alto", + "text": "Desative xp_cmdshell. O recurso do SQL Server xp_cmdshell habilita um shell de comando do sistema operacional interno do SQL Server. É um risco potencial em auditorias de segurança.", + "training": "https://me.sap.com/notes/3019299/E", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "ae248989-b306-4591-9186-de482e3f0f0e", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "cf65de8e-1309-4ccc-b579-266bcca275fa", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "severity": "Alto", - "text": "Implante sua política de WAF para Front Door no modo 'Prevenção'.", + "text": "A criptografia de servidores de banco de dados SAP HANA no Azure usa a tecnologia de criptografia nativa do SAP HANA. Além disso, se você estiver usando o SQL Server no Azure, use a TDE (Criptografia de Dados Transparente) para proteger seus dados e arquivos de log e garantir que seus backups também sejam criptografados.", + "training": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-database-security", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "Front Door", - "severity": "Alto", - "text": "Evite combinar o Gerenciador de Tráfego do Azure e o Azure Front Door.", + "checklist": "SAP Checklist", + "guid": "a1abfe9d-55d0-44c3-a491-9cb1b3d1325a", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "SAP", + "severity": "Média", + "text": "A criptografia de Armazenamento do Azure está habilitada para todas as contas clássicas e do Gerenciador de Recursos do Azure e não pode ser desabilitada. Como seus dados são criptografados por padrão, você não precisa modificar seu código ou aplicativos para usar a criptografia do Armazenamento do Azure.", + "training": "https://learn.microsoft.com/training/modules/encrypt-sector-data/?source=recommendations", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "ce9bd3bb-0cdb-43b5-9eb2-ec14eeaa3592", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "SAP", "severity": "Alto", - "text": "Use o mesmo nome de domínio no Azure Front Door e sua origem. Nomes de host incompatíveis podem causar bugs sutis.", + "text": "Usar o Cofre de Chaves do Azure para armazenar seus segredos e credenciais", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", - "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "Front Door", - "severity": "Baixo", - "text": "Desabilite os testes de integridade quando houver apenas uma origem em um grupo de origem do Azure Front Door.", - "waf": "Desempenho" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "829e2edb-2173-4676-aff6-691b4935ada4", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "SAP", "severity": "Média", - "text": "Selecione bons pontos de extremidade de teste de integridade para o Azure Front Door. Considere a criação de pontos de extremidade de integridade que verifiquem todas as dependências do seu aplicativo.", - "waf": "Fiabilidade" - }, - { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", - "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "Front Door", - "severity": "Baixo", - "text": "Use testes de integridade do HEAD com o Azure Front Door para reduzir o tráfego que o Front Door envia para seu aplicativo.", - "waf": "Desempenho" + "text": "É recomendável BLOQUEAR os Recursos do Azure após a implantação bem-sucedida para proteger contra alterações não autorizadas. Você também pode impor restrições e regras LOCK em sua base por assinatura usando políticas personalizadas do Azure (função Personalizada).", + "training": "https://learn.microsoft.com/training/modules/use-azure-resource-manager/?source=recommendations", + "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", - "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "Load Balancer", - "severity": "Alto", - "text": "Usar o Gateway NAT do Azure em vez das regras de saída do Load Balancer para melhor escalabilidade do SNAT", - "waf": "Fiabilidade" + "checklist": "SAP Checklist", + "guid": "2223ece8-1b12-4318-8a54-17415833fb4a", + "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", + "service": "SAP", + "severity": "Média", + "text": "Provisione o Cofre de Chaves do Azure com as políticas de exclusão e limpeza suaves habilitadas para permitir a proteção de retenção para objetos excluídos.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", + "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", - "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "e3c2df74-3165-4c3a-abe0-5bbe209d490d", + "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", + "service": "SAP", "severity": "Alto", - "text": "Use certificados TLS gerenciados com o Azure Front Door. Reduza o custo operacional e o risco de paralisações devido a renovações de certificados.", - "waf": "Operações" + "text": "Com base nos requisitos existentes, controles normativos e de conformidade (internos/externos) - Determine quais Políticas do Azure e a função RBAC do Azure são necessárias", + "training": "https://learn.microsoft.com/training/paths/describe-azure-management-governance/?source=recommendations", + "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", - "service": "Front Door", - "severity": "Média", - "text": "Defina sua configuração do WAF do Azure Front Door como código. Usando o código, você pode adotar mais facilmente a nova versão do conjunto de regras e obter proteção adicional.", - "waf": "Operações" + "checklist": "SAP Checklist", + "guid": "a4777842-4d11-4678-9d2f-a56c56ad4840", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "severity": "Alto", + "text": "Ao habilitar o Microsoft Defender for Endpoint no ambiente SAP, recomende excluir arquivos de dados e de log em servidores DBMS em vez de direcionar todos os servidores. Siga as recomendações do fornecedor do DBMS ao excluir arquivos de destino.", + "training": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/microsoft-defender-endpoint-mde-for-sap-applications-on-windows/ba-p/3912268", + "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "8fe72734-c486-4ba2-a0dc-0591cf65de8e", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", + "service": "SAP", "severity": "Alto", - "text": "Use o TLS de ponta a ponta com o Azure Front Door. Use o TLS para conexões de seus clientes com o Front Door e do Front Door com sua origem.", + "text": "Delegue uma função personalizada de administrador SAP com acesso just-in-time do Microsoft Defender for Cloud.", + "training": "https://learn.microsoft.com/training/modules/secure-vms-with-azure-security-center/?source=recommendations", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", - "service": "Front Door", - "severity": "Média", - "text": "Use o redirecionamento HTTP para HTTPS com o Azure Front Door. Ofereça suporte a clientes mais antigos redirecionando-os para uma solicitação HTTPS automaticamente.", + "checklist": "SAP Checklist", + "guid": "1309cccd-5792-466b-aca2-75faa1abfe9d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", + "severity": "Baixo", + "text": "criptografar dados em trânsito integrando o produto de segurança de terceiros com comunicações de rede seguras (SNC) para DIAG (SAP GUI), RFC e SPNEGO para HTTPS", + "training": "https://learn.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", - "service": "Front Door", - "severity": "Alto", - "text": "Habilite o WAF do Azure Front Door. Proteja seu aplicativo contra uma série de ataques.", + "checklist": "SAP Checklist", + "guid": "eeaa3592-829e-42ed-a217-3676aff6691b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", + "service": "SAP", + "severity": "Média", + "text": "O padrão é chaves gerenciadas pela Microsoft para a funcionalidade de criptografia principal e use chaves gerenciadas pelo cliente quando necessário.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "4935ada4-2223-4ece-a1b1-23181a541741", + "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", + "service": "SAP", "severity": "Alto", - "text": "Ajuste o WAF do Azure Front Door para sua carga de trabalho. Reduza as detecções de falsos positivos.", + "text": "Use um Cofre de Chaves do Azure por aplicativo, por ambiente, por região.", + "training": "https://learn.microsoft.com/training/modules/manage-secrets-with-azure-key-vault/?source=recommendations", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "abc9634d-c44d-41e9-a530-e8444e16aa3c", + "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", + "service": "SAP", "severity": "Alto", - "text": "Habilite o recurso de inspeção do corpo de solicitação habilitado na política WAF do Azure Front Door.", + "text": "Para controlar e gerenciar chaves de criptografia de disco e segredos para sistemas operacionais Windows e não Windows HANA, use o Cofre de Chaves do Azure. O SAP HANA não tem suporte com o Cofre de Chaves do Azure, portanto, você deve usar métodos alternativos, como chaves SAP ABAP ou SSH.", + "training": "https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/?source=recommendations", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "209d490d-a477-4784-84d1-16785d2fa56c", + "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", + "service": "SAP", "severity": "Alto", - "text": "Habilite os conjuntos de regras padrão do WAF do Azure Front Door. Os conjuntos de regras padrão detectam e bloqueiam ataques comuns.", + "text": "Personalizar funções RBAC (controle de acesso baseado em função) para SAP em assinaturas spoke do Azure para evitar alterações acidentais relacionadas à rede", + "training": "https://learn.microsoft.com/training/modules/secure-azure-resources-with-rbac/?source=recommendations", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "56ad4840-8fe7-4273-9c48-6ba280dc0591", + "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", + "service": "SAP", "severity": "Alto", - "text": "Habilite o conjunto de regras de proteção de bot do WAF do Azure Front Door. As regras de bot detectam bots bons e ruins.", + "text": "Isole DMZs e NVAs do restante do estado SAP, configure o Azure Private Link e gerencie e controle com segurança os recursos do SAP no Azure", + "training": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?tabs=portal", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", - "service": "Front Door", - "severity": "Média", - "text": "Use a versão mais recente do conjunto de regras do WAF do Azure Front Door. As atualizações do conjunto de regras são atualizadas regularmente para levar em conta o cenário atual de ameaças.", + "checklist": "SAP Checklist", + "guid": "e124ba34-df68-45ed-bce9-bd3bb0cdb3b5", + "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", + "service": "SAP", + "severity": "Baixo", + "text": "Considere usar o software antimalware da Microsoft no Azure para proteger suas máquinas virtuais contra arquivos mal-intencionados, adware e outras ameaças.", + "training": "https://azure.microsoft.com/blog/deploying-antimalware-solutions-on-azure-virtual-machines/", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "b9620385-1cde-418f-914b-a84a06982ffc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", - "service": "Front Door", - "severity": "Média", - "text": "Adicione o limite de taxa ao WAF do Azure Front Door. A limitação de taxa bloqueia clientes que enviam acidentalmente ou intencionalmente grandes quantidades de tráfego em um curto período de tempo.", + "checklist": "SAP Checklist", + "guid": "5eb2ec14-eeaa-4359-8829-e2edb2173676", + "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", + "service": "SAP", + "severity": "Baixo", + "text": "Para obter uma proteção ainda mais poderosa, considere usar o Microsoft Defender for Endpoint.", + "training": "https://learn.microsoft.com/training/modules/implement-endpoint-protection-use-microsoft-defender/?source=recommendations", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", - "service": "Front Door", - "severity": "Média", - "text": "Use um limite alto para os limites de taxa do WAF do Azure Front Door. Limites de limite de taxa alta evitam o bloqueio de tráfego legítimo, ao mesmo tempo em que fornecem proteção contra um número extremamente alto de solicitações que podem sobrecarregar sua infraestrutura. ", + "checklist": "SAP Checklist", + "guid": "87a924c4-25c2-419f-a2f0-96c7c4fe4525", + "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", + "service": "SAP", + "severity": "Alto", + "text": "Isole os servidores de aplicativo e banco de dados SAP da Internet ou da rede local passando todo o tráfego pela rede virtual de hub, que está conectada à rede spoke por emparelhamento de rede virtual. As redes virtuais emparelhadas garantem que a solução SAP no Azure seja isolada da Internet pública.", + "training": "https://learn.microsoft.com/training/modules/explore-azure-networking/?source=recommendations", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "491ca1c4-3d40-42c0-9d85-b8933999590b", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", + "service": "SAP", "severity": "Baixo", - "text": "Se você não está esperando tráfego de todas as regiões geográficas, use filtros geográficos para bloquear o tráfego de países não esperados.", + "text": "Para aplicativos voltados para a Internet, como o SAP Fiori, certifique-se de distribuir a carga por requisitos de aplicativo, mantendo os níveis de segurança. Para segurança de Camada 7, você pode usar um WAF (Web Application Firewall) de terceiros disponível no Azure Marketplace.", + "training": "https://learn.microsoft.com/training/modules/simplify-cloud-procurement-governance-azure-marketplace/?source=recommendations", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "00acd8a9-6975-414f-8491-2be6309893b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", - "service": "Front Door", + "checklist": "SAP Checklist", + "guid": "9fc945b9-0527-47af-8200-9d652fe02fcc", + "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", + "service": "SAP", "severity": "Média", - "text": "Especifique o local desconhecido (ZZ) ao filtrar geograficamente o tráfego com o WAF do Azure Front Door. Evite bloquear acidentalmente solicitações legítimas quando os endereços IP não puderem ser correspondidos geograficamente.", + "text": "Para habilitar a comunicação segura no Azure Monitor para soluções SAP, você pode optar por usar um certificado raiz ou um certificado de servidor. É altamente recomendável que você use certificados raiz.", + "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", - "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", + "service": "AVS", "severity": "Alto", - "text": "Habilitar o conjunto de regras de proteção de bot WAF do Gateway de Aplicativo do Azure As regras de bot detectam bots bons e ruins.", + "text": "Verifique se os controladores de domínio ADDS estão implantados na assinatura de identidade no Azure nativo", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "App Gateway", - "severity": "Alto", - "text": "Habilite o recurso de inspeção do corpo de solicitação habilitado na política WAF do Gateway de Aplicativo do Azure.", + "checklist": "Azure VMware Solution Design Review", + "guid": "75089c20-990d-4927-b105-885576f76fc2", + "service": "AVS", + "severity": "Média", + "text": "Verifique se os sites e serviços do ADDS estão configurados para manter as solicitações de autenticação de recursos baseados no Azure (incluindo a Solução VMware do Azure) locais para o Azure", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", + "service": "AVS", "severity": "Alto", - "text": "Ajuste o WAF do Gateway de Aplicativo do Azure para sua carga de trabalho. Reduza as detecções de falsos positivos.", + "text": "Verifique se o vCenter está conectado ao ADDS para habilitar a autenticação com base em 'contas de usuário nomeadas'", "waf": "Segurança" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "App Gateway", - "severity": "Alto", - "text": "Implante sua política de WAF para o Application Gateway no modo 'Prevenção'.", + "checklist": "Azure VMware Solution Design Review", + "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", + "service": "AVS", + "severity": "Média", + "text": "Verifique se a conexão do vCenter com o ADDS está usando um protocolo seguro (LDAPS)", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", + "service": "AVS", "severity": "Média", - "text": "Adicione o limite de taxa ao WAF do Gateway de Aplicativo do Azure. A limitação de taxa bloqueia clientes que enviam acidentalmente ou intencionalmente grandes quantidades de tráfego em um curto período de tempo.", + "text": "A conta do CloudAdmin no vCenter IdP é usada apenas como uma conta de emergência (break-glass)", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", - "service": "App Gateway", - "severity": "Média", - "text": "Use um limite alto para os limites de taxa do WAF do Gateway de Aplicativo do Azure. Limites de limite de taxa alta evitam o bloqueio de tráfego legítimo, ao mesmo tempo em que fornecem proteção contra um número extremamente alto de solicitações que podem sobrecarregar sua infraestrutura. ", + "checklist": "Azure VMware Solution Design Review", + "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", + "service": "AVS", + "severity": "Alto", + "text": "Certifique-se de que o NSX-Manager esteja integrado a um provedor de identidade externo (LDAPS)", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "99937189-ff78-492a-b9ca-18d828d82b37", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", - "service": "App Gateway", - "severity": "Baixo", - "text": "Se você não está esperando tráfego de todas as regiões geográficas, use filtros geográficos para bloquear o tráfego de países não esperados.", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", + "service": "AVS", + "severity": "Média", + "text": "Foi criado um modelo RBAC para uso no VMware vSphere", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", + "service": "AVS", "severity": "Média", - "text": "Especifique o local desconhecido (ZZ) ao filtrar geograficamente o tráfego com o WAF do Gateway de Aplicativo do Azure. Evite bloquear acidentalmente solicitações legítimas quando os endereços IP não puderem ser correspondidos geograficamente.", + "text": "As permissões RBAC devem ser concedidas em grupos ADDS e não em usuários específicos", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", - "service": "App Gateway", - "severity": "Média", - "text": "Use a versão mais recente do conjunto de regras do WAF do Gateway de Aplicativo do Azure. As atualizações do conjunto de regras são atualizadas regularmente para levar em conta o cenário atual de ameaças.", + "checklist": "Azure VMware Solution Design Review", + "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", + "service": "AVS", + "severity": "Alto", + "text": "As permissões RBAC no recurso Solução VMware do Azure no Azure são 'bloqueadas' apenas para um conjunto limitado de proprietários", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "App Gateway", - "severity": "Média", - "text": "Adicione configurações de diagnóstico para salvar seus logs WAF do Gateway de Aplicativo do Azure.", - "waf": "Operações" + "checklist": "Azure VMware Solution Design Review", + "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", + "service": "AVS", + "severity": "Alto", + "text": "Certifique-se de que todas as funções personalizadas tenham escopo com autorizações permitidas do CloudAdmin", + "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "Front Door", - "severity": "Média", - "text": "Adicione configurações de diagnóstico para salvar seus logs do WAF do Azure Front Door.", - "waf": "Operações" + "checklist": "Azure VMware Solution Design Review", + "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", + "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", + "service": "AVS", + "severity": "Alto", + "text": "O modelo de conectividade correto da Solução VMware do Azure está selecionado para o caso de uso do cliente em mãos?", + "waf": "Desempenho" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "92664c60-47e3-4591-8b1b-8d557656e686", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", - "service": "App Gateway", - "severity": "Média", - "text": "Envie logs do WAF do Gateway de Aplicativo do Azure para o Microsoft Sentinel.", + "checklist": "Azure VMware Solution Design Review", + "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", + "service": "AVS", + "severity": "Alto", + "text": "Garantir que as conexões de Rota Expressa ou VPN do local para o Azure sejam monitoradas usando o 'monitor de conexão'", "waf": "Operações" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "845f5f91-9c21-4674-a725-5ce890850e20", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", + "service": "AVS", "severity": "Média", - "text": "Envie logs do WAF do Azure Front Door para o Microsoft Sentinel.", + "text": "Verifique se um monitor de conexão foi criado a partir de um recurso nativo do Azure para uma máquina virtual da Solução VMware do Azure para monitorar a conexão de Rota Expressa de back-end da Solução VMware do Azure", "waf": "Operações" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", + "service": "AVS", "severity": "Média", - "text": "Defina sua configuração do WAF do Gateway de Aplicativo do Azure como código. Usando o código, você pode adotar mais facilmente a nova versão do conjunto de regras e obter proteção adicional.", + "text": "Verifique se um monitor de conexão é criado a partir de um recurso local para uma máquina virtual da Solução VMware do Azure para monitorar a conectividade de ponta 2", "waf": "Operações" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", - "service": "App Gateway", - "severity": "Média", - "text": "Use políticas de WAF em vez da configuração de WAF herdada.", + "checklist": "Azure VMware Solution Design Review", + "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", + "service": "AVS", + "severity": "Alto", + "text": "Quando o servidor de rotas for usado, certifique-se de que não mais de 1000 rotas sejam propagadas do servidor de rotas para o gateway ExR para o local (limite ARS).", "waf": "Operações" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", - "service": "App Gateway", - "severity": "Média", - "text": "Filtre o tráfego de entrada nos back-ends para que eles só aceitem conexões da sub-rede do Application Gateway, por exemplo, com NSGs.", + "checklist": "Azure VMware Solution Design Review", + "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", + "service": "AVS", + "severity": "Alto", + "text": "O Gerenciamento de Identidades Privilegiadas é implementado para funções que gerenciam o recurso da Solução VMware do Azure no Portal do Azure (não são permitidas permissões permanentes)", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", - "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", - "service": "Front Door", - "severity": "Média", - "text": "Certifique-se de que suas origens recebam apenas o tráfego de sua instância do Azure Front Door.", + "checklist": "Azure VMware Solution Design Review", + "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", + "service": "AVS", + "severity": "Alto", + "text": "Os relatórios de auditoria do Gerenciamento de Identidades Privilegiadas devem ser implementados para as funções PIM da Solução VMware do Azure", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", - "service": "App Gateway", - "severity": "Alto", - "text": "Você deve criptografar o tráfego para os servidores de back-end.", + "checklist": "Azure VMware Solution Design Review", + "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", + "service": "AVS", + "severity": "Média", + "text": "Se o uso do Gerenciamento de Identidades Privilegiadas estiver sendo usado, certifique-se de que uma conta válida habilitada para ID do Entra seja criada com um registro SMTP válido para notificações de substituição automática do Host da Solução VMware do Azure. (permissões permanentes necessárias)", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", + "service": "AVS", "severity": "Alto", - "text": "Você deve usar um Web Application Firewall.", + "text": "Limitar o uso da conta do CloudAdmin apenas ao acesso de emergência", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", - "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", + "service": "AVS", "severity": "Média", - "text": "Redirecionar HTTP para HTTPS", + "text": "Criar funções RBAC personalizadas no vCenter para implementar um modelo de privilégios mínimos dentro do vCenter", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", - "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", + "service": "AVS", "severity": "Média", - "text": "Usar cookies gerenciados por gateway para direcionar o tráfego de uma sessão de usuário para o mesmo servidor para processamento", - "waf": "Operações" + "text": "É um processo definido para alternar regularmente as credenciais cloudadmin (vCenter) e admin (NSX)", + "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", + "service": "AVS", "severity": "Alto", - "text": "Habilite a drenagem de conexão durante as atualizações de serviço planejadas para evitar a perda de conexão com membrs existentes do pool de back-end", + "text": "Usar um provedor de identidade centralizado a ser usado para cargas de trabalho (VMs) em execução na Solução VMware do Azure", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", - "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", - "service": "App Gateway", - "severity": "Baixo", - "text": "Criar páginas de erro personalizadas para exibir uma experiência de usuário personalizada", - "waf": "Operações" + "checklist": "Azure VMware Solution Design Review", + "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", + "service": "AVS", + "severity": "Média", + "text": "A filtragem de tráfego Leste-Oeste é implementada no NSX-T", + "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", - "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", - "service": "App Gateway", - "severity": "Média", - "text": "Edite solicitações HTTP e cabeçalhos de resposta para facilitar o roteamento e a troca de informações entre o cliente e o servidor", + "checklist": "Azure VMware Solution Design Review", + "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", + "service": "AVS", + "severity": "Alto", + "text": "As cargas de trabalho na Solução VMware do Azure não são diretamente expostas à Internet. O tráfego é filtrado e inspecionado pelo Gateway de Aplicativo do Azure, pelo Firewall do Azure ou por soluções de terceiros", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "App Gateway", - "severity": "Média", - "text": "Configure o Front Door para otimizar o roteamento de tráfego global da Web e o desempenho do usuário final de nível superior e a confiabilidade por meio de failover global rápido", - "waf": "Desempenho" + "checklist": "Azure VMware Solution Design Review", + "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", + "service": "AVS", + "severity": "Alto", + "text": "A auditoria e o registro em log são implementados para solicitações de entrada da Internet para cargas de trabalho baseadas na Solução VMware do Azure e na Solução VMware do Azure", + "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "29dcc19f-a8fa-4c35-8281-290577538793", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", + "service": "AVS", "severity": "Média", - "text": "Usar balanceamento de carga da camada de transporte", - "waf": "Desempenho" + "text": "O monitoramento de sessão é implementado para conexões de saída da Internet a partir da Solução VMware do Azure ou cargas de trabalho baseadas na Solução VMware do Azure para identificar atividades suspeitas/mal-intencionadas", + "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", - "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "334fdf91-c234-4182-a652-75269440b4be", + "service": "AVS", "severity": "Média", - "text": "Configurar o roteamento com base no host ou nome de domínio para vários aplicativos Web em um único gateway", + "text": "A proteção padrão contra DDoS está habilitada na sub-rede do Gateway ExR/VPN no Azure", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", - "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", + "service": "AVS", "severity": "Média", - "text": "Centralize o gerenciamento de certificados SSL para reduzir a sobrecarga de criptografia e descriptografia de um farm de servidores back-end", + "text": "Usar uma estação de trabalho de acesso privilegiado (PAW) dedicada para gerenciar a Solução VMware do Azure, o vCenter, o gerenciador NSX e o gerenciador HCX", "waf": "Segurança" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", - "service": "App Gateway", - "severity": "Baixo", - "text": "Usar o Application Gateway para suporte nativo para protocolos WebSocket e HTTP/2", + "checklist": "Azure VMware Solution Design Review", + "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", + "service": "AVS", + "severity": "Média", + "text": "Habilitar a Detecção Avançada de Ameaças (Microsoft Defender for Cloud, também conhecido como ASC) para cargas de trabalho em execução na Solução VMware do Azure", "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", - "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", - "service": "App Services", - "severity": "Baixo", - "text": "Consulte a arquitetura de aplicativo Web com redundância de zona altamente disponível da linha de base para obter as práticas recomendadas", - "waf": "Fiabilidade" + "checklist": "Azure VMware Solution Design Review", + "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", + "service": "AVS", + "severity": "Média", + "text": "Usar o Azure ARC for Servers para controlar corretamente as cargas de trabalho em execução na Solução VMware do Azure usando tecnologias nativas do Azure (o Azure ARC for Azure VMware Solution ainda não está disponível)", + "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", - "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", - "service": "App Services", - "severity": "Média", - "text": "Use as camadas Premium e Standard. Esses níveis oferecem suporte a slots de preparo e backups automatizados.", - "waf": "Fiabilidade" + "checklist": "Azure VMware Solution Design Review", + "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", + "service": "AVS", + "severity": "Baixo", + "text": "Garanta que as cargas de trabalho na Solução VMware do Azure usem criptografia de dados suficiente durante o tempo de execução (como criptografia de disco convidado e SQL TDE). (a criptografia vSAN em repouso é padrão)", + "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", - "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", - "service": "App Services", - "severity": "Alto", - "text": "Aproveite as zonas de disponibilidade quando aplicável regionalmente (requer a camada Premium v2 ou v3)", - "waf": "Fiabilidade" + "checklist": "Azure VMware Solution Design Review", + "guid": "a3592718-e6e2-4051-9267-6ae46691e883", + "service": "AVS", + "severity": "Baixo", + "text": "Quando a criptografia no convidado é usada, armazene chaves de criptografia no cofre de chaves do Azure quando possível", + "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "5ac94222-3e13-4810-9230-81a941741583", + "service": "AVS", "severity": "Média", - "text": "Implementar verificações de integridade", - "waf": "Fiabilidade" + "text": "Considere usar o suporte estendido de atualização de segurança para cargas de trabalho em execução na Solução VMware do Azure (a Solução VMware do Azure é qualificada para ESU)", + "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", + "service": "AVS", "severity": "Alto", - "text": "Consulte as práticas recomendadas de backup e restauração para o Serviço de Aplicativo do Azure", + "text": "Certifique-se de que o método de redundância de dados vSAN apropriado seja usado (especificação RAID)", "waf": "Fiabilidade" }, { - "checklist": "Azure App Service Review", - "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", - "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "d88408f3-7273-44c8-96ba-280214590146", + "service": "AVS", "severity": "Alto", - "text": "Implementar práticas recomendadas de confiabilidade do Serviço de Aplicativo do Azure", - "waf": "Fiabilidade" - }, - { - "checklist": "Azure App Service Review", - "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", - "service": "App Services", - "severity": "Baixo", - "text": "Familiarizar-se com como mover um aplicativo do Serviço de Aplicativo para outra região durante um desastre", + "text": "Certifique-se de que a política de falha na tolerância esteja em vigor para atender às suas necessidades de armazenamento vSAN", "waf": "Fiabilidade" }, { - "checklist": "Azure App Service Review", - "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", + "service": "AVS", "severity": "Alto", - "text": "Familiarizar-se com o suporte de confiabilidade no Serviço de Aplicativo do Azure", + "text": "Certifique-se de ter solicitado cota suficiente, garantindo que você tenha considerado o crescimento e o requisito de recuperação de desastres", "waf": "Fiabilidade" }, { - "checklist": "Azure App Service Review", - "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", + "service": "AVS", "severity": "Média", - "text": "Verifique se \"Sempre Ativo\" está habilitado para Aplicativos de Função em execução em um plano de serviço de aplicativo", - "waf": "Fiabilidade" + "text": "Certifique-se de que as restrições de acesso ao ESXi sejam compreendidas, há limites de acesso que podem afetar as soluções de terceiros 3rd.", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", + "service": "AVS", "severity": "Média", - "text": "Monitorar instâncias do Serviço de Aplicativo usando verificações de integridade", - "waf": "Fiabilidade" + "text": "Certifique-se de ter uma política em torno da densidade e eficiência do host ESXi, tendo em mente o prazo de espera para solicitar novos nós", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", + "service": "AVS", "severity": "Média", - "text": "Monitorar a disponibilidade e a capacidade de resposta do aplicativo Web ou site usando testes de disponibilidade do Application Insights", - "waf": "Fiabilidade" + "text": "Garantir que um bom processo de gerenciamento de custos esteja em vigor para a Solução VMware do Azure - o Gerenciamento de Custos do Azure pode ser usado", + "waf": "Custar" }, { - "checklist": "Azure App Service Review", - "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", + "service": "AVS", "severity": "Baixo", - "text": "Usar o teste Application Insights Standard para monitorar a disponibilidade e a capacidade de resposta do aplicativo Web ou site", - "waf": "Fiabilidade" - }, - { - "checklist": "Azure App Service Review", - "description": "Use o Cofre de Chaves do Azure para armazenar quaisquer segredos de que o aplicativo precisa. O Cofre de Chaves fornece um ambiente seguro e auditado para armazenar segredos e está bem integrado ao Serviço de Aplicativo por meio do SDK do Cofre de Chaves ou das Referências do Cofre de Chaves do Serviço de Aplicativo.", - "guid": "834ac932-223e-4ce8-8b12-3071a5416415", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", - "severity": "Alto", - "text": "Usar o Cofre de Chaves para armazenar segredos", - "waf": "Segurança" + "text": "As instâncias reservadas do Azure são usadas para otimizar o custo de uso da Solução VMware do Azure", + "waf": "Custar" }, { - "checklist": "Azure App Service Review", - "description": "Use uma Identidade Gerenciada para se conectar ao Cofre de Chaves usando o SDK do Cofre de Chaves ou por meio das Referências do Cofre de Chaves do Serviço de Aplicativo.", - "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", - "severity": "Alto", - "text": "Usar a Identidade Gerenciada para se conectar ao Cofre de Chaves", + "checklist": "Azure VMware Solution Design Review", + "guid": "6691e883-5ac9-4422-83e1-3810523081a9", + "service": "AVS", + "severity": "Média", + "text": "Considere o uso do Azure Private-Link ao usar outros Serviços Nativos do Azure", "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "description": "Armazene o certificado TLS do Serviço de Aplicativo no Cofre de Chaves.", - "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", + "service": "AVS", "severity": "Alto", - "text": "Use o Cofre de Chaves para armazenar o certificado TLS.", - "waf": "Segurança" - }, - { - "checklist": "Azure App Service Review", - "description": "Os sistemas que processam informações confidenciais devem ser isolados. Para fazer isso, use Planos do Serviço de Aplicativo ou Ambientes do Serviço de Aplicativo separados e considere o uso de assinaturas ou grupos de gerenciamento diferentes.", - "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", - "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", - "service": "App Services", - "severity": "Média", - "text": "Isolar sistemas que processam informações confidenciais", - "waf": "Segurança" + "text": "Verifique se todos os recursos necessários residem na(s) mesma(s) zona(s) de disponibilidade do Azure", + "waf": "Desempenho" }, { - "checklist": "Azure App Service Review", - "description": "Os discos locais no Serviço de Aplicativo não são criptografados e os dados confidenciais não devem ser armazenados neles. (Por exemplo: D:\\\\Local e %TMP%).", - "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", + "service": "AVS", "severity": "Média", - "text": "Não armazene dados confidenciais no disco local", + "text": "Habilitar cargas de trabalho de VM convidada do Microsoft Defender for Cloud for Azure VMware Solution", "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "description": "Para aplicativos Web autenticados, use um Provedor de Identidade bem estabelecido, como o Azure AD ou o Azure AD B2C. Aproveite a estrutura de aplicativo de sua escolha para se integrar a esse provedor ou use o recurso de Autenticação/Autorização do Serviço de Aplicativo.", - "guid": "919ca0b2-c121-459e-814b-933df574eccc", - "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", + "service": "AVS", "severity": "Média", - "text": "Usar um provedor de identidade estabelecido para autenticação", + "text": "Usar servidores habilitados para Arc do Azure para gerenciar suas cargas de trabalho de VM convidada da Solução VMware do Azure", "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "description": "Implante código no Serviço de Aplicativo a partir de um ambiente controlado e confiável, como um pipeline de implantação de DevOps bem gerenciado e seguro. Isso evita que o código que não foi controlado por versão e verificado para ser implantado a partir de um host mal-intencionado.", - "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", - "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", + "service": "AVS", "severity": "Alto", - "text": "Implantar a partir de um ambiente confiável", - "waf": "Segurança" + "text": "Habilitar o log de diagnóstico e de métrica na solução VMware do Azure", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Desative a autenticação básica para FTP/FTPS e WebDeploy/SCM. Isso desabilita o acesso a esses serviços e impõe o uso de pontos de extremidade protegidos do Azure AD para implantação. Observe que o site do SCM também pode ser aberto usando credenciais do Azure AD.", - "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", - "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", - "service": "App Services", - "severity": "Alto", - "text": "Desabilitar a autenticação básica", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", + "service": "AVS", + "severity": "Média", + "text": "Implantar os agentes do Log Analytics nas cargas de trabalho da VM convidada da Solução VMware do Azure", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Sempre que possível, use a Identidade Gerenciada para se conectar aos recursos protegidos do Azure AD. Se isso não for possível, armazene segredos no Cofre de Chaves e conecte-se ao Cofre de Chaves usando uma Identidade Gerenciada.", - "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", - "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", - "service": "App Services", - "severity": "Alto", - "text": "Usar a Identidade Gerenciada para se conectar a recursos", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "589d457a-927c-4397-9d11-02cad6aae11e", + "service": "AVS", + "severity": "Média", + "text": "Verifique se você tem uma política e uma solução de backup documentadas e implementadas para cargas de trabalho de VM da Solução VMware do Azure", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Onde estiver usando imagens armazenadas no Registro de Contêiner do Azure, extraia-as usando uma Identidade Gerenciada.", - "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", - "service": "App Services", - "severity": "Alto", - "text": "Extrair contêineres usando uma identidade gerenciada", + "checklist": "Azure VMware Solution Design Review", + "guid": "ee29711b-d352-4caa-ab79-b198dab81932", + "service": "AVS", + "severity": "Média", + "text": "Usar o Microsoft Defender for Cloud para monitoramento de conformidade de cargas de trabalho em execução no Azure VMware Solution", "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "description": "Ao definir as configurações de diagnóstico do Serviço de Aplicativo, você pode enviar toda a telemetria para o Log Analytics como o destino central para registro em log e monitoramento. Isso permite que você monitore a atividade de tempo de execução do Serviço de Aplicativo, como logs HTTP, logs de aplicativos, logs de plataforma, ...", - "guid": "47768314-c115-4775-a2ea-55b46ad48408", - "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", + "service": "AVS", "severity": "Média", - "text": "Enviar logs de tempo de execução do Serviço de Aplicativo para o Log Analytics", + "text": "São as linhas de base de conformidade aplicáveis adicionadas ao Microsoft Defender for Cloud", "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "description": "Configure uma configuração de diagnóstico para enviar o log de atividades para o Log Analytics como o destino central para registro e monitoramento. Isso permite que você monitore a atividade do plano de controle no próprio recurso do Serviço de Aplicativo.", - "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", - "service": "App Services", - "severity": "Média", - "text": "Enviar logs de atividade do Serviço de Aplicativo para o Log Analytics", + "checklist": "Azure VMware Solution Design Review", + "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", + "service": "AVS", + "severity": "Alto", + "text": "A residência de dados foi avaliada ao selecionar regiões do Azure a serem usadas para a implantação da Solução VMware do Azure", "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "description": "Controle o acesso à rede de saída usando uma combinação de integração regional de VNet, grupos de segurança de rede e UDR's. O tráfego deve ser roteado para um NVA, como o Firewall do Azure. Certifique-se de monitorar os logs do Firewall.", - "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", - "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", - "service": "App Services", - "severity": "Média", - "text": "O acesso à rede de saída deve ser controlado", + "checklist": "Azure VMware Solution Design Review", + "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", + "service": "AVS", + "severity": "Alto", + "text": "As implicações do processamento de dados (modelo de prestador de serviços / consumidor de serviços) são claras e documentadas", "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "description": "Você pode fornecer um IP de saída estável usando a integração de rede virtual e um gateway NAT de rede virtual ou um NVA como o Firewall do Azure. Isso permite que a parte receptora permita uma lista com base no IP, caso seja necessário. Observe que, para comunicações com os Serviços do Azure, geralmente não há necessidade de depender do endereço IP e mecânicas como Pontos de Extremidade de Serviço devem ser usadas. (Além disso, o uso de pontos de extremidade privados na extremidade de recebimento evita que o SNAT aconteça e fornece um intervalo de IP de saída estável.)", - "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", - "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", - "service": "App Services", - "severity": "Baixo", - "text": "Garantir um IP estável para comunicações de saída para endereços de Internet", + "checklist": "Azure VMware Solution Design Review", + "guid": "547c1747-dc56-4068-a714-435cd19dd244", + "service": "AVS", + "severity": "Média", + "text": "Considere o uso de CMK (Customer Managed Key) para vSAN somente se necessário por motivo(s) de conformidade.", "waf": "Segurança" }, { - "checklist": "Azure App Service Review", - "description": "Controle o acesso à rede de entrada usando uma combinação de Restrições de Acesso do Serviço de Aplicativo, Pontos de Extremidade de Serviço ou Pontos de Extremidade Privados. Diferentes restrições de acesso podem ser necessárias e configuradas para o próprio aplicativo Web e o site do SCM.", - "guid": "0725769e-e669-41a4-a34a-c932223ece80", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", + "service": "AVS", "severity": "Alto", - "text": "O acesso à rede de entrada deve ser controlado", - "waf": "Segurança" + "text": "Criar painéis para habilitar os principais insights de monitoramento da Solução VMware do Azure", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Proteja-se contra tráfego de entrada mal-intencionado usando um Firewall de Aplicativo Web, como o Gateway de Aplicativo ou o Azure Front Door. Certifique-se de monitorar os logs do WAF.", - "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", - "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", + "service": "AVS", "severity": "Alto", - "text": "Usar um WAF na frente do Serviço de Aplicativo", - "waf": "Segurança" + "text": "Criar alertas de aviso para limites críticos para alertas automáticos sobre o desempenho da solução VMware do Azure (CPU >80%, memória média >80%, vSAN >70%)", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Certifique-se de que o WAF não pode ser ignorado bloqueando o acesso apenas ao WAF. Use uma combinação de Restrições de Acesso, Pontos de Extremidade de Serviço e Pontos de Extremidade Privados.", - "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "9659e396-80e7-4828-ac93-5657d02bff45", + "service": "AVS", "severity": "Alto", - "text": "Evite que o WAF seja ignorado", - "waf": "Segurança" + "text": "Certifique-se de que o alerta crítico seja criado para monitorar se o consumo de vSAN está abaixo de 75%, pois esse é um limite de suporte do VMware", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Defina a política TLS mínima como 1.2 na configuração do Serviço de Aplicativo.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", - "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", + "service": "AVS", + "severity": "Alto", + "text": "Verifique se os alertas estão configurados para alertas e notificações de Integridade do Serviço do Azure", + "waf": "Operações" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", + "service": "AVS", "severity": "Média", - "text": "Definir a política TLS mínima como 1.2", - "waf": "Segurança" + "text": "Configurar o log da Solução VMware do Azure para ser enviado a uma conta de Armazenamento do Azure ou ao Azure EventHub para processamento", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Configure o Serviço de Aplicativo para usar somente HTTPS. Isso faz com que o Serviço de Aplicativo redirecione de HTTP para HTTPS. Considere fortemente o uso de HTTP Strict Transport Security (HSTS) em seu código ou a partir de seu WAF, que informa aos navegadores que o site só deve ser acessado usando HTTPS.", - "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", - "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", - "service": "App Services", - "severity": "Alto", - "text": "Usar somente HTTPS", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", + "service": "AVS", + "severity": "Baixo", + "text": "Se for necessário um insight profundo no VMware vSphere: o vRealize Operations e/ou o vRealize Network Insights são usados na solução?", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Não use curingas em sua configuração do CORS, pois isso permite que todas as origens acessem o serviço (derrotando assim o propósito do CORS). Especificamente, permita apenas as origens que você espera poder acessar o serviço.", - "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", - "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", + "service": "AVS", "severity": "Alto", - "text": "Curingas não devem ser usados para CORS", - "waf": "Segurança" + "text": "Verifique se a política de armazenamento vSAN para VMs NÃO é a política de armazenamento padrão, pois essa política aplica provisionamento espesso", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "A depuração remota não deve ser ativada na produção, pois isso abre portas adicionais no serviço, o que aumenta a superfície de ataque. Observe que o serviço ativa a depuração remota automaticamente após 48 horas.", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", - "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", - "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", - "service": "App Services", - "severity": "Alto", - "text": "Desativar a depuração remota", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", + "service": "AVS", + "severity": "Média", + "text": "Verifique se as bibliotecas de conteúdo do vSphere não são colocadas no vSAN, pois o vSAN é um recurso finito", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Habilite o Defender para o Serviço de Aplicativo. Isso (entre outras ameaças) detecta comunicações com endereços IP mal-intencionados conhecidos. Analise as recomendações do Defender for App Service como parte de suas operações.", - "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", + "service": "AVS", "severity": "Média", - "text": "Habilitar o Defender for Cloud - Defender for App Service", - "waf": "Segurança" + "text": "Certifique-se de que os repositórios de dados da solução de backup sejam armazenados fora do armazenamento vSAN. No nativo do Azure ou em um armazenamento de dados com backup de pool de discos", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "O Azure fornece proteção contra DDoS Basic em sua rede, que pode ser aprimorada com recursos inteligentes de DDoS Standard que aprendem sobre padrões normais de tráfego e podem detectar comportamentos incomuns. O DDoS Standard se aplica a uma Rede Virtual, portanto, ele deve ser configurado para o recurso de rede na frente do aplicativo, como o Application Gateway ou um NVA.", - "guid": "223ece80-b123-4071-a541-6415833ea3ad", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", + "service": "AVS", "severity": "Média", - "text": "Habilitar o padrão de proteção DDOS na rede virtual WAF", - "waf": "Segurança" + "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam gerenciadas de forma híbrida usando o Azure Arc for Servers (a Solução VMware do Arc for Azure está em visualização)", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Ao usar imagens armazenadas no Registro de Contêiner do Azure, extraia-as por uma rede virtual do Registro de Contêiner do Azure usando seu ponto de extremidade privado e a configuração do aplicativo 'WEBSITE_PULL_IMAGE_OVER_VNET'.", - "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", + "service": "AVS", "severity": "Média", - "text": "Extrair contêineres por uma rede virtual", - "waf": "Segurança" + "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam monitoradas usando o Azure Log Analytics e o Azure Monitor", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Realizar um teste de penetração na aplicação web seguindo as regras de teste de penetração de engajamento.", - "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", - "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", + "service": "AVS", "severity": "Média", - "text": "Realizar um teste de penetração", - "waf": "Segurança" + "text": "Incluir cargas de trabalho em execução na Solução VMware do Azure nas ferramentas de gerenciamento de atualizações existentes ou no Gerenciamento de Atualizações do Azure", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Implante código confiável que foi validado e verificado em busca de vulnerabilidades de acordo com as práticas de DevSecOps.", - "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", - "service": "App Services", + "checklist": "Azure VMware Solution Design Review", + "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", + "service": "AVS", "severity": "Média", - "text": "Implantar código validado", - "waf": "Segurança" + "text": "Usar a Política do Azure para integrar cargas de trabalho da Solução VMware do Azure nas soluções de Gerenciamento, Monitoramento e Segurança do Azure", + "waf": "Operações" }, { - "checklist": "Azure App Service Review", - "description": "Use as versões mais recentes de plataformas, linguagens de programação, protocolos e estruturas suportadas.", - "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", - "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", - "service": "App Services", - "severity": "Alto", - "text": "Use plataformas, linguagens, protocolos e frameworks atualizados", + "checklist": "Azure VMware Solution Design Review", + "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", + "service": "AVS", + "severity": "Média", + "text": "Garantir que as cargas de trabalho em execução na Solução VMware do Azure sejam integradas ao Microsoft Defender for Cloud", "waf": "Segurança" }, { - "checklist": "Identity Review Checklist", - "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", - "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", - "service": "Entra", + "checklist": "Azure VMware Solution Design Review", + "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", + "service": "AVS", "severity": "Média", - "text": "Use o token revogável de longa duração, armazene seu token em cache e adquira o token silenciosamente usando a Microsoft Identity Library", + "text": "Certifique-se de que os backups não sejam armazenados no vSAN, pois o vSAN é um recurso finito", "waf": "Fiabilidade" }, { - "checklist": "Identity Review Checklist", - "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", - "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", - "service": "AAD B2C", + "checklist": "Azure VMware Solution Design Review", + "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", + "service": "AVS", "severity": "Média", - "text": "Certifique-se de que os fluxos de usuário de entrada sejam armazenados em backup e resilientes. Certifique-se de que o código que você usa para entrar em seus usuários é de backup e recuperável. Interfaces resilientes com processos externos", + "text": "Todas as soluções de DR foram consideradas e uma solução que é melhor para o seu negócio foi decidida? [SRM/JetStream/Zerto/Veeam/...]", "waf": "Fiabilidade" }, { - "checklist": "Identity Review Checklist", - "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", - "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", - "service": "AAD B2C", + "checklist": "Azure VMware Solution Design Review", + "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", + "service": "AVS", "severity": "Média", - "text": "Os ativos de marca personalizados devem ser hospedados em uma CDN", - "waf": "Desempenho" + "text": "Usar o Azure Site Recovery quando a tecnologia de Recuperação de Desastres for IaaS nativa do Azure", + "waf": "Fiabilidade" }, { - "checklist": "Identity Review Checklist", - "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", - "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", - "service": "AAD B2C", - "severity": "Baixo", - "text": "Ter vários provedores de identidade (ou seja, fazer login com suas contas da Microsoft, Google, Facebook)", + "checklist": "Azure VMware Solution Design Review", + "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", + "service": "AVS", + "severity": "Alto", + "text": "Use planos de recuperação automatizados com qualquer uma das soluções de desastre, evite ao máximo tarefas manuais", "waf": "Fiabilidade" }, { - "checklist": "Identity Review Checklist", - "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure VMware Solution Design Review", + "guid": "8255461e-2aee-4345-9aec-8339248b262d", + "service": "AVS", "severity": "Média", - "text": "Siga as regras de VM para alta disponibilidade no nível da VM (discos premium, dois ou mais em uma região, em zonas de disponibilidade diferentes)", + "text": "Usar o par de regiões geopolíticas como o ambiente secundário de recuperação de desastres", "waf": "Fiabilidade" }, { - "checklist": "Identity Review Checklist", - "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure VMware Solution Design Review", + "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", + "service": "AVS", + "severity": "Alto", + "text": "Use 2 espaços de endereço diferentes entre as regiões, por exemplo: 10.0.0.0/16 e 192.168.0.0/16 para as diferentes regiões", + "waf": "Fiabilidade" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", + "service": "AVS", "severity": "Média", - "text": "Não replique! A replicação pode criar problemas com a sincronização de diretórios", + "text": "O ExpressRoute Global Reach será usado para conectividade entre as Nuvens Privadas da Solução VMware do Azure primária e secundária ou o roteamento é feito por meio de dispositivos virtuais de rede?", "waf": "Fiabilidade" }, { - "checklist": "Identity Review Checklist", - "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure VMware Solution Design Review", + "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", + "service": "AVS", "severity": "Média", - "text": "Ter ativo-ativo para várias regiões", + "text": "Todas as soluções de backup foram consideradas e uma solução que é melhor para o seu negócio foi decidida? [ MABS/CommVault/Metallic.io/Veeam/ . ]", "waf": "Fiabilidade" }, { - "checklist": "Identity Review Checklist", - "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", + "checklist": "Azure VMware Solution Design Review", + "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", + "service": "AVS", "severity": "Média", - "text": "Adicionar carimbos de serviço de Domínio do Azure AD a regiões e locais adicionais", + "text": "Implante sua solução de backup na mesma região que sua nuvem privada da Solução VMware do Azure", "waf": "Fiabilidade" }, { - "checklist": "Identity Review Checklist", - "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", + "checklist": "Azure VMware Solution Design Review", + "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", + "service": "AVS", "severity": "Média", - "text": "Usar conjuntos de réplicas para DR", + "text": "Implante sua solução de backup fora do vSan, em componentes nativos do Azure", "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", - "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", + "service": "AVS", "severity": "Baixo", - "text": "Se necessário para cargas de trabalho do AKS Windows, os contêineres HostProcess podem ser usados", + "text": "Existe um processo para solicitar uma restauração dos componentes VMware gerenciados pela Plataforma Azure?", "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", - "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", + "service": "AVS", "severity": "Baixo", - "text": "Usar o KEDA se estiver executando cargas de trabalho orientadas a eventos", - "waf": "Desempenho" + "text": "Para implantações manuais, todas as configurações e implantações devem ser documentadas", + "waf": "Operações" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", - "link": "https://dapr.io/", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", + "service": "AVS", "severity": "Baixo", - "text": "Use o Dapr para facilitar o desenvolvimento de microsserviços", + "text": "Para implantações manuais, considere implementar bloqueios de recursos para evitar ações acidentais em sua nuvem privada de solução VMware do Azure", "waf": "Operações" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", - "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", - "link": "https://learn.microsoft.com/azure/aks/uptime-sla", - "service": "AKS", - "severity": "Alto", - "text": "Use a oferta AKS apoiada por SLA", - "waf": "Fiabilidade" + "checklist": "Azure VMware Solution Design Review", + "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", + "service": "AVS", + "severity": "Baixo", + "text": "Para implantações automatizadas, implante uma nuvem privada mínima e dimensione conforme necessário", + "waf": "Operações" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", + "service": "AVS", "severity": "Baixo", - "text": "Usar orçamentos de interrupção em seu pod e definições de implantação", - "waf": "Fiabilidade" + "text": "Para implantações automatizadas, solicite ou reserve cota antes de iniciar a implantação", + "waf": "Operações" }, { - "checklist": "Azure AKS Review", - "guid": "3c763963-7a55-42d5-a15e-401955387e5c", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", - "service": "ACR", - "severity": "Alto", - "text": "Se estiver usando um registro privado, configure a replicação de região para armazenar imagens em várias regiões", - "waf": "Fiabilidade" + "checklist": "Azure VMware Solution Design Review", + "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", + "service": "AVS", + "severity": "Baixo", + "text": "Para implantação automatizada, verifique se os bloqueios de recursos relevantes são criados por meio da automação ou da Política do Azure para uma governança adequada", + "waf": "Operações" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", + "service": "AVS", "severity": "Baixo", - "text": "Use um aplicativo externo, como kubecost, para alocar custos para diferentes usuários", - "waf": "Custar" + "text": "Implemente nomes humanos compreensíveis para chaves de autorização ExR para permitir a fácil identificação da finalidade/uso das chaves", + "waf": "Operações" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", - "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "255461e2-aee3-4553-afc8-339248b262d6", + "service": "AVS", "severity": "Baixo", - "text": "Usar o modo de redução para excluir/desalocar nós", - "waf": "Custar" + "text": "Usar o Cofre de chaves para armazenar segredos e chaves de autorização quando Princípios de Serviço separados são usados para implantar a Solução VMware do Azure e a Rota Expressa", + "waf": "Operações" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", - "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", - "service": "AKS", - "severity": "Média", - "text": "Quando necessário, use a GPU de partioning de várias instâncias em clusters AKS", - "waf": "Custar" + "checklist": "Azure VMware Solution Design Review", + "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", + "service": "AVS", + "severity": "Baixo", + "text": "Defina dependências de recursos para serializar ações no IaC quando muitos recursos precisarem ser implantados no/na Solução VMware do Azure, pois a Solução VMware do Azure oferece suporte apenas a um número limitado de operações paralelas.", + "waf": "Operações" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", - "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", + "service": "AVS", "severity": "Baixo", - "text": "Se estiver executando um cluster de desenvolvimento/teste, use NodePool Start/Stop", - "waf": "Custar" + "text": "Ao executar a configuração automatizada de segmentos NSX-T com um único gateway de Camada 1, use as APIs do Portal do Azure em vez das APIs do NSX-Manager", + "waf": "Operações" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", - "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", + "service": "AVS", "severity": "Média", - "text": "Usar a Política do Azure para Kubernetes para garantir a conformidade do cluster", - "waf": "Segurança" + "text": "Ao pretender usar a expansão automatizada, certifique-se de aplicar cota suficiente da Solução VMware do Azure para as assinaturas que executam a Solução VMware do Azure", + "waf": "Desempenho" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", - "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", + "service": "AVS", "severity": "Média", - "text": "Separe os aplicativos do plano de controle com pools de nós de usuário/sistema", - "waf": "Segurança" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", - "severity": "Baixo", - "text": "Adicione mancha ao seu nodepool do sistema para torná-lo dedicado", - "waf": "Segurança" + "text": "Ao pretender usar o scale-in automatizado, certifique-se de levar em consideração os requisitos da política de armazenamento antes de executar essa ação", + "waf": "Desempenho" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", - "link": "https://learn.microsoft.com/azure/container-registry/", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", + "service": "AVS", "severity": "Média", - "text": "Usar um registro privado para suas imagens, como o ACR", - "waf": "Segurança" + "text": "As operações de dimensionamento sempre precisam ser serializadas em um único SDDC, pois apenas uma operação de escala pode ser executada por vez (mesmo quando vários clusters são usados)", + "waf": "Desempenho" }, { - "checklist": "Azure AKS Review", - "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", - "link": "https://learn.microsoft.com/azure/security-center/container-security", - "service": "ACR", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", + "service": "AVS", "severity": "Média", - "text": "Analise suas imagens em busca de vulnerabilidades", - "waf": "Segurança" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", - "service": "AKS", - "severity": "Alto", - "text": "Definir requisitos de separação de aplicativos (namespace/nodepool/cluster)", - "waf": "Segurança" + "text": "Considerar e validar operações de dimensionamento em soluções de terceiros 3rd usadas na arquitetura (suportadas ou não)", + "waf": "Desempenho" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", - "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", + "service": "AVS", "severity": "Média", - "text": "Armazene seus segredos no Cofre de Chaves do Azure com o driver do CSI Secrets Store", - "waf": "Segurança" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", - "link": "https://learn.microsoft.com/azure/aks/update-credentials", - "service": "AKS", - "severity": "Alto", - "text": "Se estiver usando entidades de serviço para o cluster, atualize as credenciais periodicamente (como trimestralmente)", - "waf": "Segurança" + "text": "Definir e impor limites máximos de entrada/saída de escala para seu ambiente nas automações", + "waf": "Desempenho" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", - "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", + "service": "AVS", "severity": "Média", - "text": "Se necessário, adicione criptografia etcd do Serviço de Gerenciamento de Chaves", - "waf": "Segurança" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", - "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", - "service": "AKS", - "severity": "Baixo", - "text": "Se necessário, considere o uso de computação confidencial para AKS", - "waf": "Segurança" + "text": "Implementar regras de monitoramento para monitorar operações de dimensionamento automatizadas e monitorar o sucesso e a falha para habilitar respostas apropriadas (automatizadas)", + "waf": "Operações" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", - "service": "AKS", - "severity": "Média", - "text": "Considere o uso do Defender for Containers", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", + "severity": "Alto", + "text": "Ao usar o MON, esteja ciente dos limites de VMs configuradas simulataneamente (MON Limit for HCX [400 - standard, 1000 - Larger appliance])", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", - "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", "severity": "Alto", - "text": "Usar identidades gerenciadas em vez de entidades de serviço", - "waf": "Segurança" + "text": "Ao usar o MON, você não pode habilitar o MON em mais de 100 extensões de rede", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", - "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", - "link": "https://learn.microsoft.com/azure/aks/managed-aad", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", + "service": "AVS", "severity": "Média", - "text": "Integrar autenticação com AAD (usando a integração gerenciada)", - "waf": "Segurança" + "text": "Se estiver usando uma conexão VPN para migrações, ajuste o tamanho da MTU de acordo.", + "waf": "Desempenho" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", - "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "e614658d-d457-4e92-9139-b821102cad6e", + "service": "AVS", "severity": "Média", - "text": "Limitar o acesso ao admin kubeconfig (get-credentials --admin)", - "waf": "Segurança" + "text": "Para regiões de baixa conectividade conectadas ao Azure (500Mbps ou menos), considere implantar o dispositivo de otimização de WAN HCX", + "waf": "Desempenho" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", - "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", + "service": "AVS", "severity": "Média", - "text": "Integrar autorização com AAD RBAC", - "waf": "Segurança" + "text": "Certifique-se de que as migrações sejam iniciadas a partir do dispositivo local e NÃO do dispositivo em nuvem (NÃO execute uma migração reversa)", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", - "service": "AKS", - "severity": "Alto", - "text": "Usar namespaces para restringir o privilégio RBAC no Kubernetes", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "AVS", + "severity": "Média", + "text": "Quando o Azure Netapp Files for usado para estender o armazenamento para a Solução VMware do Azure, considere usá-lo como um armazenamento de dados VMware em vez de anexá-lo diretamente a uma VM.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", - "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "AVS", "severity": "Média", - "text": "Para o Gerenciamento de Acesso à Identidade de Pod, use a Identidade de Carga de Trabalho do Azure AD (visualização)", - "waf": "Segurança" + "text": "Verifique se um ExpressRoute Gateway dedicado está sendo usado para soluções de armazenamento de dados externos", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "AVS", "severity": "Média", - "text": "Para logins não interativos do AKS, use kubelogin (visualização)", - "waf": "Segurança" + "text": "Verifique se o FastPath está habilitado no ExpressRoute Gateway que está sendo usado para soluções de armazenamento de dados externos", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", - "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", - "service": "AKS", - "severity": "Média", - "text": "Desativar contas locais do AKS", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "AVS", + "severity": "Alto", + "text": "Se estiver usando cluster estendido, verifique se a solução de recuperação de desastres selecionada é suportada pelo fornecedor", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", - "service": "AKS", - "severity": "Baixo", - "text": "Configurar, se necessário, o acesso ao cluster just-in-time", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "AVS", + "severity": "Alto", + "text": "Se estiver usando cluster estendido, verifique se o SLA fornecido atenderá aos seus requisitos", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", - "service": "AKS", - "severity": "Baixo", - "text": "Configurar, se necessário, o acesso condicional do AAD para AKS", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "AVS", + "severity": "Alto", + "text": "Se estiver usando cluster estendido, verifique se ambos os circuitos da Rota Expressa estão conectados ao hub de conectividade.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", - "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", - "service": "AKS", - "severity": "Baixo", - "text": "Se necessário para cargas de trabalho do Windows AKS, configure o gMSA ", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "AVS", + "severity": "Alto", + "text": "Se estiver usando cluster estendido, verifique se ambos os circuitos da Rota Expressa têm o GlobalReach habilitado.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", - "service": "AKS", - "severity": "Média", - "text": "Para um controle mais fino, considere usar uma Identidade Kubelet gerenciada", - "waf": "Segurança" + "checklist": "Azure VMware Solution Design Review", + "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "AVS", + "severity": "Alto", + "text": "Faça com que as configurações de tolerância a desastres do site tenham sido devidamente consideradas e alteradas para sua empresa, se necessário.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", - "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Aplicar as orientações do benchmark de segurança na nuvem da Microsoft relacionadas ao armazenamento", + "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", + "service": "Azure Storage", "severity": "Média", - "text": "Se estiver usando AGIC, não compartilhe um AppGW entre clusters", - "waf": "Fiabilidade" + "text": "Considere a 'linha de base de segurança do Azure para armazenamento'", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", - "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", - "link": "https://learn.microsoft.com/azure/aks/http-application-routing", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "O Armazenamento do Azure, por padrão, tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem expor com segurança o Armazenamento do Azure apenas aos recursos de Computação do Azure que precisam de acesso, eliminando assim a exposição à Internet pública", + "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", + "service": "Azure Storage", "severity": "Alto", - "text": "Não use AKS HTTP Routing Add-On, use em vez disso a entrada NGINX gerenciada com o complemento de roteamento de aplicativo.", - "waf": "Fiabilidade" + "text": "Considere o uso de pontos de extremidade privados para o Armazenamento do Azure", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "As contas de armazenamento recém-criadas são criadas usando o modelo de implantação ARM, para que o RBAC, a auditoria, etc., estejam todos habilitados. Verifique se não há contas de armazenamento antigas com modelo de implantação clássico em uma assinatura", + "guid": "30e37c3e-2971-41b2-963c-eee079b598de", + "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", + "service": "Azure Storage", "severity": "Média", - "text": "Para cargas de trabalho do Windows, use a Rede Acelerada", - "waf": "Desempenho" + "text": "Verifique se as contas de armazenamento mais antigas não estão usando o 'modelo de implantação clássico'", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", - "guid": "ba7da7be-9952-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Aproveite o Microsoft Defender para saber mais sobre atividades suspeitas e configurações incorretas.", + "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", + "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", + "service": "Azure Storage", "severity": "Alto", - "text": "Use o ALB padrão (em oposição ao básico)", - "waf": "Fiabilidade" + "text": "Habilitar o Microsoft Defender para todas as suas contas de armazenamento", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "O mecanismo soft-delete permite recuperar blobs excluídos acidentalmente.", + "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", + "service": "Azure Storage", "severity": "Média", - "text": "Se estiver usando o CNI do Azure, considere usar sub-redes diferentes para NodePools", + "text": "Ativar 'exclusão suave' para blobs", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", - "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo tiver que garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ", + "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", "severity": "Média", - "text": "Usar Pontos de Extremidade Privados (preferencial) ou Pontos de Extremidade de Serviço de Rede Virtual para acessar serviços de PaaS do cluster", + "text": "Desativar 'exclusão suave' para blobs", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", - "guid": "a0f61565-9de5-458f-a372-49c831112dbd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "A exclusão suave para contêineres permite que você recupere um contêiner depois que ele tenha sido excluído, por exemplo, recuperar de uma operação de exclusão acidental.", + "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", + "service": "Azure Storage", "severity": "Alto", - "text": "Escolha o melhor plug-in de rede CNI para seus requisitos (Azure CNI recomendado)", - "waf": "Fiabilidade" + "text": "Ativar 'exclusão suave' para contêineres", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "Alto", - "text": "Se estiver usando o Azure CNI, dimensione sua sub-rede de acordo considerando o número máximo de pods por nó", - "waf": "Desempenho" + "checklist": "Azure Blob Storage Review", + "description": "Considere desativar seletivamente a \"exclusão suave\" para determinados contêineres de blob, por exemplo, se o aplicativo tiver que garantir que as informações excluídas sejam imediatamente excluídas, por exemplo, por motivos de confidencialidade, privacidade ou conformidade. ", + "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", + "severity": "Média", + "text": "Desativar 'exclusão suave' para contêineres", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Evita a exclusão acidental de uma conta de armazenamento, forçando o usuário a remover primeiro o bloqueio de exclusão, antes da exclusão", + "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", "severity": "Alto", - "text": "Se estiver usando o Azure CNI, verifique o máximo de pods/nó (padrão 30)", - "waf": "Desempenho" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "Para aplicativos internos, as organizações geralmente abrem toda a sub-rede AKS em seus firewalls. Isso abre o acesso de rede para os nós também e, potencialmente, para os pods também (se estiver usando o Azure CNI). Se os IPs do LoadBalancer estiverem em uma sub-rede diferente, somente este precisará estar disponível para os clientes do aplicativo. Outra razão é que, se os endereços IP na sub-rede AKS são um recurso escasso, consumir seus endereços IP para serviços reduzirá a escalabilidade máxima do cluster.", - "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", - "link": "https://learn.microsoft.com/azure/aks/internal-lb", - "service": "AKS", - "severity": "Baixo", - "text": "Se estiver usando serviços LoadBalancer de IP privado, use uma sub-rede dedicada (não a sub-rede AKS)", + "text": "Habilitar bloqueios de recursos em contas de armazenamento", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Considere políticas de \"retenção legal\" ou \"retenção baseada em tempo\" para blobs, de modo que seja impossível excluir o blob, o contêiner ou a conta de armazenamento. Por favor, note que \"impossível\" significa na verdade \"impossível\"; uma vez que uma conta de armazenamento contém um blob imutável, a única maneira de 'se livrar' dessa conta de armazenamento é cancelando a assinatura do Azure.", + "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", + "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", + "service": "Azure Storage", "severity": "Alto", - "text": "Dimensione o intervalo de endereços IP do serviço de acordo (isso limitará a escalabilidade do cluster)", - "waf": "Fiabilidade" + "text": "Considere blobs imutáveis", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", - "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", - "service": "AKS", - "severity": "Baixo", - "text": "Se necessário, adicione seu próprio plugin CNI", + "checklist": "Azure Blob Storage Review", + "description": "Considere desabilitar o acesso HTTP/80 desprotegido à conta de armazenamento, para que todas as transferências de dados sejam criptografadas, protegidas por integridade e o servidor seja autenticado. ", + "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Azure Storage", + "severity": "Alto", + "text": "Exigir HTTPS, ou seja, desativar a porta 80 na conta de armazenamento", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", - "service": "AKS", - "severity": "Baixo", - "text": "Se necessário, configure o IP público por nó no AKS", - "waf": "Desempenho" + "checklist": "Azure Blob Storage Review", + "description": "Ao configurar um domínio personalizado (nome do host) em uma conta de armazenamento, verifique se você precisa de TLS/HTTPS; em caso afirmativo, talvez seja necessário colocar a CDN do Azure na frente da sua conta de armazenamento.", + "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", + "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", + "service": "Azure Storage", + "severity": "Alto", + "text": "Ao impor HTTPS (desabilitando HTTP), verifique se você não usa domínios personalizados (CNAME) para a conta de armazenamento.", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", - "link": "https://learn.microsoft.com/azure/aks/concepts-network", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Exigir HTTPS quando um cliente usa um token SAS para acessar dados de blob ajuda a minimizar o risco de perda de credenciais.", + "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", + "service": "Azure Storage", "severity": "Média", - "text": "Usar um controlador de entrada para expor aplicativos baseados na Web em vez de expô-los com serviços do tipo LoadBalancer", - "waf": "Fiabilidade" + "text": "Limitar tokens de assinatura de acesso compartilhado (SAS) somente a conexões HTTPS", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", - "link": "https://learn.microsoft.com/azure/aks/nat-gateway", - "service": "AKS", - "severity": "Baixo", - "text": "Usar o Gateway NAT do Azure como outboundType para dimensionar o tráfego de saída", - "waf": "Fiabilidade" + "checklist": "Azure Blob Storage Review", + "description": "Os tokens AAD devem ser favorecidos em relação às assinaturas de acesso compartilhado, sempre que possível", + "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", + "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", + "service": "Azure Storage", + "severity": "Alto", + "text": "Usar tokens do Azure Active Directory (Azure AD) para acesso de blob", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Ao atribuir uma função a um usuário, grupo ou aplicativo, conceda a essa entidade de segurança apenas as permissões necessárias para que eles executem suas tarefas. Limitar o acesso aos recursos ajuda a evitar o uso indevido não intencional e mal-intencionado de seus dados.", + "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", + "service": "Azure Storage", "severity": "Média", - "text": "Usar alocações dinâmicas de IPs para evitar o esgotamento de IP do CNI do Azure", - "waf": "Fiabilidade" + "text": "Privilégio mínimo nas permissões do IaM", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", - "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", - "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Uma SAS de delegação de usuário é protegida com credenciais do Azure Active Directory (Azure AD) e também pelas permissões especificadas para a SAS. Uma SAS de delegação de usuário é análoga a uma SAS de serviço em termos de escopo e função, mas oferece benefícios de segurança em relação à SAS de serviço. ", + "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", + "service": "Azure Storage", "severity": "Alto", - "text": "Filtre o tráfego de saída com AzFW/NVA se seus requisitos de segurança exigirem", + "text": "Ao usar o SAS, prefira o SAS de delegação de usuário ao SAS baseado em chave de conta de armazenamento.", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", - "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", - "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", - "service": "AKS", - "severity": "Média", - "text": "Se estiver usando um ponto de extremidade de API público, restrinja os endereços IP que podem acessá-lo", + "checklist": "Azure Blob Storage Review", + "description": "As chaves de conta de armazenamento ('chaves compartilhadas') têm pouquíssimos recursos de auditoria. Embora possa ser monitorado em quem/quando foi obtida uma cópia das chaves, uma vez que as chaves estão nas mãos de várias pessoas, é impossível atribuir o uso a um usuário específico. Depender exclusivamente da autenticação do AAD facilita a vinculação do acesso ao armazenamento a um usuário. ", + "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", + "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", + "service": "Azure Storage", + "severity": "Alto", + "text": "Considere desabilitar as chaves de conta de armazenamento, para que somente o acesso ao AAD (e a delegação de usuários SAS) seja suportado.", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", - "link": "https://learn.microsoft.com/azure/aks/private-clusters", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Use os dados do Registro de atividades para identificar \"quando\", \"quem\", \"o que\" e \"como\" a segurança da sua conta de armazenamento está sendo visualizada ou alterada (ou seja, chaves de conta de armazenamento, políticas de acesso, etc.).", + "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", + "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", + "service": "Azure Storage", "severity": "Alto", - "text": "Use clusters privados se seus requisitos exigirem", + "text": "Considere usar o Azure Monitor para auditar as operações do plano de controle na conta de armazenamento", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Uma política de expiração de chave permite que você defina um lembrete para a rotação das chaves de acesso da conta. O lembrete será exibido se o intervalo especificado tiver decorrido e as teclas ainda não tiverem sido giradas.", + "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", + "service": "Azure Storage", "severity": "Média", - "text": "Para os nós AKS do Windows 2019 e 2022, as Diretivas de Rede Calico podem ser usadas ", + "text": "Ao usar chaves de conta de armazenamento, considere habilitar uma 'política de expiração de chave'", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", - "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", - "severity": "Alto", - "text": "Habilitar uma opção de Política de Rede do Kubernetes (Calico/Azure)", + "checklist": "Azure Blob Storage Review", + "description": "Uma diretiva de expiração SAS especifica um intervalo recomendado sobre o qual a SAS é válida. As políticas de expiração do SAS se aplicam a um SAS de serviço ou a um SAS de conta. Quando um usuário gera SAS de serviço ou SAS de conta com um intervalo de validade maior do que o intervalo recomendado, ele verá um aviso.", + "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", + "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", + "service": "Azure Storage", + "severity": "Média", + "text": "Considere configurar uma política de expiração SAS", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", - "severity": "Alto", - "text": "Usar diretivas de rede do Kubernetes para aumentar a segurança intra-cluster", + "checklist": "Azure Blob Storage Review", + "description": "As políticas de acesso armazenado oferecem a opção de revogar permissões para uma SAS de serviço sem precisar gerar novamente as chaves da conta de armazenamento. ", + "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", + "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", + "service": "Azure Storage", + "severity": "Média", + "text": "Considere vincular o SAS a uma política de acesso armazenado", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", + "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", + "service": "Azure Storage", + "severity": "Média", + "text": "Considere configurar o repositório de código-fonte do aplicativo para detectar cadeias de conexão com check-in e chaves de conta de armazenamento.", + "waf": "Segurança" + }, + { + "checklist": "Azure Blob Storage Review", + "description": "Idealmente, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Armazenamento do Azure. Se isso não for possível, considere ter a credencial de armazenamento (cadeia de conexão, chave de conta de armazenamento, SAS, credencial da entidade de serviço) no Azure KeyVault ou em um serviço equivalente.", + "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", + "service": "Azure Storage", "severity": "Alto", - "text": "Usar um WAF para cargas de trabalho da Web (UIs ou APIs)", + "text": "Considere armazenar cadeias de conexão no Cofre de Chaves do Azure (em cenários em que identidades gerenciadas não são possíveis)", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", - "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", - "service": "AKS", - "severity": "Média", - "text": "Usar DDoS Standard na Rede Virtual AKS", + "checklist": "Azure Blob Storage Review", + "description": "Use tempos de expiração de curto prazo em um SAS de serviço SAS ad hoc ou SAS de conta. Dessa forma, mesmo que um SAS seja comprometido, ele é válido apenas por um curto período de tempo. Essa prática é especialmente importante se você não puder fazer referência a uma política de acesso armazenado. Os tempos de expiração de curto prazo também limitam a quantidade de dados que podem ser gravados em um blob, limitando o tempo disponível para carregar nele.", + "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", + "severity": "Alto", + "text": "Esforce-se por curtos períodos de validade para SAS ad-hoc", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", - "link": "https://learn.microsoft.com/azure/aks/http-proxy", - "service": "AKS", - "severity": "Baixo", - "text": "Se necessário, adicione o proxy HTTP da empresa", + "checklist": "Azure Blob Storage Review", + "description": "Ao criar um SAS, seja o mais específico e restritivo possível. Prefira um SAS para um único recurso e operação em vez de um SAS que dá acesso muito mais amplo.", + "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", + "severity": "Média", + "text": "Aplicar um escopo restrito a uma SAS", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", - "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Uma SAS pode incluir parâmetros nos quais endereços IP de cliente ou intervalos de endereços estão autorizados a solicitar um recurso usando a SAS. ", + "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", + "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", + "service": "Azure Storage", "severity": "Média", - "text": "Considere o uso de uma malha de serviço para gerenciamento avançado de comunicação de microsserviços", + "text": "Considere a definição do escopo do SAS para um endereço IP de cliente específico, sempre que possível", "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", - "service": "AKS", - "severity": "Alto", - "text": "Configurar alertas nas métricas mais críticas (consulte Insights de contêiner para obter recomendações)", - "waf": "Operações" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "337453a3-cc63-4963-9a65-22ac19e80696", - "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Um SAS não pode restringir a quantidade de dados que um cliente carrega; Dado o modelo de precificação da quantidade de armazenamento ao longo do tempo, pode fazer sentido validar se os clientes carregaram conteúdo maliciosamente grande.", + "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", + "service": "Azure Storage", "severity": "Baixo", - "text": "Verifique regularmente o Azure Advisor para obter recomendações sobre o seu cluster", - "waf": "Operações" + "text": "Considere verificar os dados carregados, depois que os clientes usaram um SAS para carregar um arquivo. ", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", - "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", - "service": "AKS", - "severity": "Baixo", - "text": "Habilitar a rotação automática do certificado AKS", - "waf": "Operações" + "checklist": "Azure Blob Storage Review", + "description": "Ao acessar o armazenamento de blob via SFTP usando uma 'conta de usuário local', os controles RBAC 'normais' não se aplicam. O acesso a blobs via NFS ou REST pode ser mais restritivo do que o acesso a SFTP. Infelizmente, no início de 2023, os usuários locais são a única forma de gerenciamento de identidade que atualmente é suportada para o ponto de extremidade SFTP", + "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", + "service": "Azure Storage", + "severity": "Alto", + "text": "SFTP: Limite a quantidade de 'usuários locais' para acesso SFTP e audite se o acesso é necessário ao longo do tempo.", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", - "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", - "service": "AKS", - "severity": "Alto", - "text": "Tenha um processo regular para atualizar sua versão do kubernetes periodicamente (trimestralmente, por exemplo), ou use o recurso de atualização automática do AKS", - "waf": "Operações" + "checklist": "Azure Blob Storage Review", + "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", + "service": "Azure Storage", + "severity": "Média", + "text": "SFTP: O ponto de extremidade SFTP não oferece suporte a ACLs do tipo POSIX.", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", - "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "O armazenamento oferece suporte a CORS (Cross-Origin Resource Sharing), ou seja, um recurso HTTP que permite que aplicativos Web de um domínio diferente afrouxem a política de mesma origem. Ao habilitar o CORS, mantenha o CorsRules com o menor privilégio.", + "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", + "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", + "service": "Azure Storage", "severity": "Alto", - "text": "Use kured para atualizações de nó do Linux caso você não esteja usando a atualização de imagem de nó", - "waf": "Operações" + "text": "Evite políticas CORS excessivamente amplas", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", - "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", - "service": "AKS", + "checklist": "Azure Blob Storage Review", + "description": "Os dados em repouso são sempre criptografados no lado do servidor e, além disso, também podem ser criptografados no lado do cliente. A criptografia do lado do servidor pode acontecer usando uma chave gerenciada por plataforma (padrão) ou uma chave gerenciada pelo cliente. A criptografia do lado do cliente pode acontecer fazendo com que o cliente forneça uma chave de criptografia/descriptografia por blob para o armazenamento do Azure ou manipulando completamente a criptografia no lado do cliente. portanto, não depende do Armazenamento do Azure para garantias de confidencialidade.", + "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "Azure Storage", "severity": "Alto", - "text": "Tenha um processo regular para atualizar as imagens do nó do cluster periodicamente (semanalmente, por exemplo)", - "waf": "Operações" + "text": "Determine como os dados em repouso devem ser criptografados. Entenda o modelo de thread para dados.", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", - "service": "AKS", - "severity": "Baixo", - "text": "Considere gitops para implantar aplicativos ou configuração de cluster em vários clusters", - "waf": "Operações" + "checklist": "Azure Blob Storage Review", + "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", + "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", + "service": "Azure Storage", + "severity": "Média", + "text": "Determine qual/se a criptografia de plataforma deve ser usada.", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d7672c26-7602-4482-85a4-14527fbe855c", - "link": "https://learn.microsoft.com/azure/aks/command-invoke", - "service": "AKS", - "severity": "Baixo", - "text": "Considere o uso do comando AKS invoke em clusters privados", - "waf": "Operações" + "checklist": "Azure Blob Storage Review", + "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", + "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", + "service": "Azure Storage", + "severity": "Média", + "text": "Determine qual/se a criptografia do lado do cliente deve ser usada.", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", - "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", - "service": "AKS", - "severity": "Baixo", - "text": "Para eventos planejados, considere o uso do Dreno Automático de Nó", - "waf": "Operações" + "checklist": "Azure Blob Storage Review", + "description": "Aproveite o Resource Graph Explorer (resources | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true) para localizar contas de armazenamento que permitem acesso anônimo a blobs.", + "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", + "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", + "service": "Azure Storage", + "severity": "Alto", + "text": "Considere se o acesso de blob público é necessário ou se pode ser desabilitado para determinadas contas de armazenamento. ", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", - "link": "https://learn.microsoft.com/azure/aks/faq", - "service": "AKS", - "severity": "Alto", - "text": "Desenvolver práticas próprias de governança para garantir que nenhuma alteração seja realizada pelos operadores no nó RG (também conhecido como 'infra RG')", - "waf": "Operações" + "checklist": "Azure Spring Apps Review", + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "service": "Spring Apps", + "severity": "Média", + "text": "Os Aplicativos Spring do Azure permitem duas implantações para cada aplicativo, apenas um dos quais recebe tráfego de produção. Você pode obter tempo de inatividade zero com estratégias de implantação em verde azul. A implantação verde azul só está disponível nas camadas Standard e Enterprise. Você pode automatizar a implantação usando CI/CD com ações do ADO/GitHub", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", - "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", - "severity": "Baixo", - "text": "Use o nome personalizado do Node RG (também conhecido como 'Infra RG')", - "waf": "Operações" + "checklist": "Azure Spring Apps Review", + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "service": "Spring Apps", + "severity": "Média", + "text": "As instâncias do Azure Spring Apps podem ser criadas em várias regiões para seus aplicativos e o tráfego pode ser roteado pelo Gerenciador de Tráfego/Front Door.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", - "link": "https://kubernetes.io/docs/setup/release/notes/", - "service": "AKS", + "checklist": "Azure Spring Apps Review", + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "service": "Spring Apps", "severity": "Média", - "text": "Não use APIs do Kubernetes preteridas em seus manifestos do YAML", - "waf": "Operações" + "text": "Na região com suporte, os Aplicativos Spring do Azure podem ser implantados como zona redundante, o que significa que as instâncias são distribuídas automaticamente entre zonas de disponibilidade. Esse recurso só está disponível nas camadas Standard e Enterprise.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", - "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", - "service": "AKS", - "severity": "Baixo", - "text": "Manchar os nós do Windows", - "waf": "Operações" + "checklist": "Azure Spring Apps Review", + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "service": "Spring Apps", + "severity": "Média", + "text": "Usar mais de 1 instância de aplicativo para seus aplicativos", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", - "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", - "service": "AKS", - "severity": "Baixo", - "text": "Mantenha o nível de patch dos contêineres do Windows sincronizado com o nível do patch do host", - "waf": "Operações" + "checklist": "Azure Spring Apps Review", + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "service": "Spring Apps", + "severity": "Média", + "text": "Monitore os Aplicativos Spring do Azure com logs, métricas e rastreamento. Integre o ASA com insights de aplicativos e rastreie falhas e crie pastas de trabalho.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "Por meio de Configurações de Diagnóstico no nível do cluster", - "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", - "link": "https://learn.microsoft.com/azure/aks/monitor-aks", - "service": "AKS", - "severity": "Baixo", - "text": "Envie logs mestre (também conhecidos como logs de API) para o Azure Monitor ou sua solução de gerenciamento de logs preferida", - "waf": "Operações" + "checklist": "Azure Spring Apps Review", + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "service": "Spring Apps", + "severity": "Média", + "text": "Configurar o dimensionamento automático no Spring Cloud Gateway", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", - "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", - "service": "AKS", + "checklist": "Azure Spring Apps Review", + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "service": "Spring Apps", "severity": "Baixo", - "text": "Se necessário, use instantâneos do nodePool", - "waf": "Custar" + "text": "Habilite o dimensionamento automático para os aplicativos com o plano de consumo padrão e dedicado.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", - "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", - "service": "AKS", - "severity": "Baixo", - "text": "Considere pools de nós spot para cargas de trabalho não sensíveis ao tempo", - "waf": "Operações" + "checklist": "Azure Spring Apps Review", + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "service": "Spring Apps", + "severity": "Média", + "text": "Use o plano Enterprise para suporte comercial de inicialização spring para aplicativos de missão crítica. Com outras camadas, você obtém suporte a OSS.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", - "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "description": "O Hub de Eventos do Azure fornece criptografia de dados em repouso. Se você usar sua própria chave, os dados ainda serão criptografados usando a chave gerenciada pela Microsoft, mas, além disso, a chave gerenciada pela Microsoft será criptografada usando a chave gerenciada pelo cliente. ", + "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", + "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", + "service": "Event Hubs", "severity": "Baixo", - "text": "Considere o nó virtual AKS para intermitência rápida", - "waf": "Operações" + "text": "Usar a opção de chave gerenciada pelo cliente na criptografia de dados em repouso quando necessário", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", - "severity": "Alto", - "text": "Monitore suas métricas de cluster com o Container Insights (ou outras ferramentas como o Prometheus)", - "waf": "Operações" + "checklist": "Azure Event Hub Review", + "description": "Os namespaces dos Hubs de Eventos do Azure permitem que os clientes enviem e recebam dados com TLS 1.0 e superior. Para impor medidas de segurança mais rígidas, você pode configurar o namespace dos Hubs de Eventos para exigir que os clientes enviem e recebam dados com uma versão mais recente do TLS. Se um namespace de Hubs de Eventos exigir uma versão mínima do TLS, todas as solicitações feitas com uma versão mais antiga falharão. ", + "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", + "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", + "service": "Event Hubs", + "severity": "Média", + "text": "Impor uma versão mínima necessária do TLS (Transport Layer Security) para solicitações ", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", - "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", - "severity": "Alto", - "text": "Armazene e analise seus logs de cluster com o Container Insights (ou outras ferramentas como Telegraf/ElasticSearch)", - "waf": "Operações" + "checklist": "Azure Event Hub Review", + "description": "Quando você cria um namespace de Hubs de Eventos, uma regra de política chamada RootManageSharedAccessKey é criada automaticamente para o namespace. Essa política tem permissões de gerenciamento para todo o namespace. É recomendável que você trate essa regra como uma conta raiz administrativa e não a use em seu aplicativo. Recomenda-se o uso do AAD como um provedor de autenticação com RBAC. ", + "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", + "service": "Event Hubs", + "severity": "Média", + "text": "Evite usar conta root quando não for necessário", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "description": "As identidades gerenciadas para recursos do Azure podem autorizar o acesso a recursos dos Hubs de Eventos usando credenciais do Azure AD de aplicativos em execução em VMs (Máquinas Virtuais) do Azure, aplicativos de Função, Conjuntos de Dimensionamento de Máquina Virtual e outros serviços. Usando identidades gerenciadas para recursos do Azure junto com a autenticação do Azure AD, você pode evitar o armazenamento de credenciais com seus aplicativos executados na nuvem. ", + "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", + "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", + "service": "Event Hubs", "severity": "Média", - "text": "Monitorar a utilização da CPU e da memória dos nós", - "waf": "Operações" + "text": "Quando possível, seu aplicativo deve estar usando uma identidade gerenciada para autenticar no Hub de Eventos do Azure. Caso contrário, considere ter a credencial de armazenamento (SAS, credencial da entidade de serviço) no Cofre de Chaves do Azure ou em um serviço equivalente", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1a4835ac-9422-423e-ae80-b123081a5417", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "description": "Ao criar permissões, forneça controle refinado sobre o acesso de um cliente ao Hub de Eventos do Azure. As permissões no Hub de Eventos do Azure podem e devem ter o escopo definido para o nível de recurso individual, por exemplo, grupo de consumidores, entidade de hub de eventos, namespaces de hub de eventos, etc.", + "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", + "service": "Event Hubs", + "severity": "Alto", + "text": "Usar RBAC do plano de dados de privilégios mínimos", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "waf": "Segurança" + }, + { + "checklist": "Azure Event Hub Review", + "description": "Os logs de recursos do Hub de Eventos do Azure incluem logs operacionais, logs de rede virtual e logs de Kafka. Os logs de auditoria de tempo de execução capturam informações de diagnóstico agregadas para todas as operações de acesso ao plano de dados (como eventos de envio ou recebimento) nos Hubs de Eventos.", + "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", + "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", + "service": "Event Hubs", "severity": "Média", - "text": "Se estiver usando o Azure CNI, monitore a % de IPs de pod consumidos por nó", - "waf": "Operações" + "text": "Habilite o registro em log para investigação de segurança. Use o Azure Monitor para capturar métricas e logs como logs de recursos, logs de auditoria de tempo de execução e logs Kafka", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "A E/S no disco do sistema operacional é um recurso crítico. Se o sistema operacional nos nós for limitado na E/S, isso pode levar a um comportamento imprevisível, geralmente terminando no nó sendo declarado NotReady", - "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", - "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "description": "Por padrão, o Hub de Eventos do Azure tem um endereço IP público e pode ser acessado pela Internet. Os pontos de extremidade privados permitem que o tráfego entre sua rede virtual e o Hub de Eventos do Azure percorra a rede de backbone da Microsoft. Além disso, você deve desabilitar os pontos de extremidade públicos se eles não forem usados. ", + "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", + "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", + "service": "Event Hubs", "severity": "Média", - "text": "Monitorar a profundidade da fila de disco do sistema operacional nos nós", - "waf": "Operações" + "text": "Considere o uso de pontos de extremidade privados para acessar o Hub de Eventos do Azure e desabilitar o acesso à rede pública quando aplicável.", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "be209d39-fda4-4777-a424-d116785c2fa5", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "description": "Com o firewall IP, você pode restringir ainda mais o ponto de extremidade público a apenas um conjunto de endereços IPv4 ou intervalos de endereços IPv4 na notação CIDR (Roteamento entre Domínios Sem Classe). ", + "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", + "service": "Event Hubs", "severity": "Média", - "text": "Se não estiver usando filtragem de saída com AzFW/NVA, monitore as portas SNAT ALB alocadas padrão", - "waf": "Operações" + "text": "Considere permitir apenas o acesso ao namespace do Hub de Eventos do Azure a partir de endereços IP ou intervalos específicos", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "Segurança" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", - "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "guid": "31d41e36-11c8-417b-8afb-c410d4391898", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", + "service": "Event Hubs", "severity": "Média", - "text": "Assine as notificações de integridade de recursos para seu cluster AKS", - "waf": "Operações" + "text": "Aproveite o Manual de Resilência do FTA", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "description": " Isso será ativado automaticamente para um novo namespace de EH criado a partir do portal com SKUs Premium, Dedicado ou Standard em uma região habilitada para região. Os metadados do EH e os próprios dados do evento são replicados entre zonas", + "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", + "service": "Event Hubs", "severity": "Alto", - "text": "Configurar solicitações e limites nas especificações do pod", - "waf": "Operações" + "text": "Aproveite as zonas de disponibilidade, se aplicável regionalmente", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "769ef669-1a48-435a-a942-223ece80b123", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "guid": "20b56c56-ad58-4519-8f82-735c586bb281", + "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", + "service": "Event Hubs", "severity": "Média", - "text": "Impor cotas de recursos para namespaces", - "waf": "Operações" + "text": "Use os SKUs Premium ou Dedicado para desempenho previsível", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "081a5417-4158-433e-a3ad-3c2de733165c", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "description": "O recurso interno de recuperação de desastres geográficos, quando habilitado, garante que toda a configuração de um namespace (Hubs de Eventos, Grupos de Consumidores e configurações) seja replicada continuamente de um namespace primário para um namespace secundário e permite uma movimentação de failover única do primário para o secundário a qualquer momento. O recurso Ativo/Passivo foi projetado para facilitar a recuperação e o abandono de uma região do Azure com falha sem precisar alterar as configurações do aplicativo", + "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", + "service": "Event Hubs", "severity": "Alto", - "text": "Verifique se sua assinatura tem cota suficiente para expandir seus nodepools", - "waf": "Operações" + "text": "Planejar a recuperação de desastres geográficos usando a configuração passiva ativa", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", - "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "Azure Event Hub Review", + "description": "Deve ser usado para configurações de DR em que uma interrupção ou perda de dados de eventos na região derrubada não pode ser tolerada. Para esses casos, siga as diretrizes de replicação e não use o recurso interno de recuperação de desastres geográficos (ativo/passivo). Com Ativo/Ativo, mantenha vários Hubs de Eventos em diferentes regiões e namespaces, e os eventos serão replicados entre os hubs", + "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", + "service": "Event Hubs", "severity": "Média", - "text": "Usar o Autoscaler de Cluster", - "waf": "Desempenho" + "text": "Para aplicativos críticos para os negócios, use a configuração ativa", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", - "guid": "831c2872-c693-4b39-a887-a561bada49bc", - "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", - "service": "AKS", - "severity": "Baixo", - "text": "Personalizar a configuração do nó para pools de nós AKS", - "waf": "Desempenho" + "checklist": "Azure Event Hub Review", + "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", + "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", + "service": "Event Hubs", + "severity": "Média", + "text": "Projetar Hubs de Eventos Resilientes", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", + "checklist": "IoT Hub Review", + "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", + "service": "IoT", + "severity": "Alto", + "text": "Aproveitar zonas de disponibilidade, se aplicável regionalmente (isso é habilitado automaticamente)", + "waf": "Fiabilidade" + }, + { + "checklist": "IoT Hub Review", + "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", "severity": "Média", - "text": "Use o Autoscaler do Pod Horizontal quando necessário", - "waf": "Desempenho" + "text": "Esteja ciente dos failovers iniciados pela Microsoft. Eles são exercidos pela Microsoft em raras situações para fazer failover de todos os hubs IoT de uma região afetada para a região geo-emparelhada correspondente.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "Nós maiores trarão maior desempenho e recursos, como discos efêmeros e rede acelerada, mas aumentarão o raio de explosão e diminuirão a granularidade de dimensionamento", - "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", - "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", - "service": "AKS", + "checklist": "IoT Hub Review", + "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", + "service": "IoT", "severity": "Alto", - "text": "Considere um tamanho de nó apropriado, não muito grande ou muito pequeno", - "waf": "Desempenho" + "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", - "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", - "service": "AKS", - "severity": "Baixo", - "text": "Se mais de 5000 nós forem necessários para escalabilidade, considere o uso de um cluster AKS adicional", - "waf": "Desempenho" + "checklist": "IoT Hub Review", + "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", + "severity": "Alto", + "text": "Saiba como acionar um failover manual.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", - "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", - "service": "AKS", - "severity": "Baixo", - "text": "Considere assinar o EventGrid Events para automação AKS", - "waf": "Desempenho" + "checklist": "IoT Hub Review", + "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", + "service": "IoT", + "severity": "Alto", + "text": "Saiba como fazer failback após um failover.", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", - "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", - "service": "AKS", - "severity": "Baixo", - "text": "Para operações de longa duração em um cluster AKS, considere o encerramento do evento", - "waf": "Desempenho" + "checklist": "Cognitive Search Review Checklist", + "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", + "severity": "Alto", + "text": "Permitir que 2 réplicas tenham 99,9% de disponibilidade para operações de leitura", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", - "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", - "service": "AKS", - "severity": "Baixo", - "text": "Se necessário, considere usar hosts dedicados do Azure para nós AKS", - "waf": "Desempenho" + "checklist": "Cognitive Search Review Checklist", + "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", + "severity": "Média", + "text": "Permitir que 3 réplicas tenham 99,9% de disponibilidade para operações de leitura/gravação", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", - "guid": "24367b33-6971-45b1-952b-eee0b9b588de", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "checklist": "Cognitive Search Review Checklist", + "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", + "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", + "service": "Cognitive Search", "severity": "Alto", - "text": "Usar discos efêmeros do sistema operacional", - "waf": "Desempenho" + "text": "Aproveite as zonas de disponibilidade habilitando réplicas de leitura e/ou gravação", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "AKS", - "severity": "Alto", - "text": "Para discos não efêmeros, use IOPS altos e discos maiores do sistema operacional para os nós ao executar muitos pods/nó, pois requer alto desempenho para executar vários pods e gerará logs enormes com limites de rotação de log AKS padrão", - "waf": "Desempenho" + "checklist": "Cognitive Search Review Checklist", + "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", + "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", + "service": "Cognitive Search", + "severity": "Média", + "text": "Para redução regional, crie manualmente serviços em 2 ou mais regiões para a Pesquisa, pois não fornece um método automatizado de replicação de índices de pesquisa entre regiões geográficas", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", - "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", - "service": "AKS", - "severity": "Baixo", - "text": "Para a opção de armazenamento de hiperdesempenho, use Ultra Disks no AKS", - "waf": "Desempenho" + "checklist": "Cognitive Search Review Checklist", + "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", + "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", + "service": "Cognitive Search", + "severity": "Média", + "text": "Para sincronizar dados em vários serviços: Use indexadores para atualizar conteúdo em vários serviços ou Use APIs REST para enviar atualizações de conteúdo em vários serviços", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", - "service": "AKS", + "checklist": "Cognitive Search Review Checklist", + "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", + "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", + "service": "Cognitive Search", "severity": "Média", - "text": "Evite manter o estado no cluster e armazene dados fora (AzStorage, AzSQL, Cosmos, etc)", - "waf": "Desempenho" + "text": "Usar o Gerenciador de Tráfego do Azure para coordenar solicitações", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", - "service": "AKS", - "severity": "Média", - "text": "Se estiver usando o AzFiles Standard, considere o AzFiles Premium e/ou ANF por motivos de desempenho", - "waf": "Desempenho" + "checklist": "Cognitive Search Review Checklist", + "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", + "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", + "service": "Cognitive Search", + "severity": "Alto", + "text": "Backup e restauração de um índice de pesquisa cognitiva do Azure. Use este código de exemplo para fazer backup da definição de índice e instantâneo em uma série de arquivos Json", + "waf": "Fiabilidade" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", - "service": "AKS", + "checklist": "Identity Review Checklist", + "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", + "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", + "service": "Entra", "severity": "Média", - "text": "Se estiver usando Discos e AZs do Azure, considere ter nodepools dentro de uma zona para disco LRS com VolumeBindingMode:WaitForFirstConsumer para provisionar armazenamento na zona direita ou use o disco ZRS para nodepools abrangendo várias zonas", - "waf": "Desempenho" + "text": "Use o token revogável de longa duração, armazene seu token em cache e adquira o token silenciosamente usando a Microsoft Identity Library", + "waf": "Fiabilidade" }, { - "checklist": "Azure Function Review", - "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", - "severity": "Alto", - "text": "Selecione o plano de hospedagem de função certo com base em seus requisitos de negócios e SLO", + "checklist": "Identity Review Checklist", + "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", + "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", + "service": "AAD B2C", + "severity": "Média", + "text": "Certifique-se de que os fluxos de usuário de entrada sejam armazenados em backup e resilientes. Certifique-se de que o código que você usa para entrar em seus usuários é de backup e recuperável. Interfaces resilientes com processos externos", "waf": "Fiabilidade" }, { - "checklist": "Azure Function Review", - "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", - "severity": "Alto", - "text": "Aproveitar zonas de disponibilidade quando aplicável regionalmente (não disponível para a camada de consumo)", + "checklist": "Identity Review Checklist", + "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", + "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", + "service": "AAD B2C", + "severity": "Média", + "text": "Os ativos de marca personalizados devem ser hospedados em uma CDN", + "waf": "Desempenho" + }, + { + "checklist": "Identity Review Checklist", + "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", + "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", + "service": "AAD B2C", + "severity": "Baixo", + "text": "Ter vários provedores de identidade (ou seja, fazer login com suas contas da Microsoft, Google, Facebook)", "waf": "Fiabilidade" }, { - "checklist": "Azure Function Review", - "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", - "service": "Azure Functions", + "checklist": "Identity Review Checklist", + "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "severity": "Média", - "text": "Considere uma estratégia de DR entre regiões para cargas de trabalho críticas", + "text": "Siga as regras de VM para alta disponibilidade no nível da VM (discos premium, dois ou mais em uma região, em zonas de disponibilidade diferentes)", "waf": "Fiabilidade" }, { - "checklist": "Azure Function Review", - "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Azure Functions", - "severity": "Alto", - "text": "Se estiver implantando em um ambiente isolado, use ou migre para o ASE (Ambiente do Serviço de Aplicativo) v3", + "checklist": "Identity Review Checklist", + "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "Média", + "text": "Não replique! A replicação pode criar problemas com a sincronização de diretórios", "waf": "Fiabilidade" }, { - "checklist": "Azure Function Review", - "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "Azure Functions", - "severity": "Alto", - "text": "Verifique se 'Sempre Ativado' está habilitado para todos os Aplicativos de Função em execução no Plano do Serviço de Aplicativo", + "checklist": "Identity Review Checklist", + "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "Média", + "text": "Ter ativo-ativo para várias regiões", "waf": "Fiabilidade" }, { - "checklist": "Azure Function Review", - "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", - "service": "Azure Functions", + "checklist": "Identity Review Checklist", + "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "severity": "Média", - "text": "Emparelhe um aplicativo de função com sua própria conta de armazenamento. Tente não reutilizar contas de armazenamento para aplicativos de função, a menos que eles estejam firmemente acoplados", + "text": "Adicionar carimbos de serviço de Domínio do Azure AD a regiões e locais adicionais", "waf": "Fiabilidade" }, { - "checklist": "Azure Function Review", - "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "Azure Functions", + "checklist": "Identity Review Checklist", + "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "severity": "Média", - "text": "Aproveite o Azure DevOps ou o GitHub para simplificar o CI/CD e proteger seu código do Aplicativo de Função", - "waf": "Operações" + "text": "Usar conjuntos de réplicas para DR", + "waf": "Fiabilidade" } ], "metadata": { "name": "WAF checklist", - "timestamp": "June 17, 2024" + "timestamp": "June 24, 2024" }, "severities": [ { diff --git a/checklists/waf_checklist.zh-Hant.json b/checklists/waf_checklist.zh-Hant.json index e91289bf1..99f2d0d20 100644 --- a/checklists/waf_checklist.zh-Hant.json +++ b/checklists/waf_checklist.zh-Hant.json @@ -1,6371 +1,6236 @@ { "items": [ { - "checklist": "MySQL Review Checklist", - "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", - "service": "Azure MySQL", - "severity": "中等", - "text": "利用靈活伺服器", + "checklist": "Device Provisioning Service Review", + "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", + "service": "IoT Hub DPS", + "severity": "高", + "text": "根據業務和 SLO 要求選擇正確的邏輯應用託管計劃", "waf": "可靠性" }, { - "checklist": "MySQL Review Checklist", - "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", - "service": "Azure MySQL", + "checklist": "Device Provisioning Service Review", + "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "IoT Hub DPS", "severity": "高", - "text": "利用區域適用的可用區", + "text": "使用區域冗餘和可用性區域保護邏輯應用免受區域故障的影響", "waf": "可靠性" }, { - "checklist": "MySQL Review Checklist", - "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", - "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", - "service": "Azure MySQL", - "severity": "中等", - "text": "將數據傳入複製用於跨區域災難恢復方案", + "checklist": "Device Provisioning Service Review", + "guid": "8aed4fbf-0830-4883-899d-222a154af478", + "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "IoT Hub DPS", + "severity": "高", + "text": "考慮為關鍵工作負載制定跨區域災難恢復策略", "waf": "可靠性" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", + "checklist": "Device Provisioning Service Review", + "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "IoT Hub DPS", "severity": "高", - "text": "使 2 個副本具有 99.9% 的讀取操作可用性", + "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3", "waf": "可靠性" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", - "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", - "service": "Cognitive Search", + "checklist": "Device Provisioning Service Review", + "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "IoT Hub DPS", "severity": "中等", - "text": "使 3 個副本具有 99.9% 的讀/寫操作可用性", - "waf": "可靠性" - }, - { - "checklist": "Cognitive Search Review Checklist", - "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", - "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", - "service": "Cognitive Search", - "severity": "高", - "text": "通過啟用讀取和/或寫入副本來利用可用區", - "waf": "可靠性" + "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護邏輯應用代碼", + "waf": "操作" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", - "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", - "service": "Cognitive Search", + "checklist": "Identity Review Checklist", + "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", + "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", + "service": "Entra", "severity": "中等", - "text": "對於區域冗餘，請在2個或更多區域中為搜索手動創建服務，因為它不提供跨地理區域複製搜索索引的自動方法", + "text": "使用長期可撤銷令牌，緩存令牌並使用 Microsoft 標識庫以靜默方式獲取令牌", "waf": "可靠性" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", - "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", - "service": "Cognitive Search", + "checklist": "Identity Review Checklist", + "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", + "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", + "service": "AAD B2C", "severity": "中等", - "text": "若要跨多個服務同步數據，請使用索引器更新多個服務上的內容，或使用 REST API 推送多個服務上的內容更新", + "text": "請確保登錄使用者流已備份並具有復原能力。請確保用於登錄使用者的代碼已備份且可恢復。與外部進程的彈性介面", "waf": "可靠性" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", - "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", - "service": "Cognitive Search", + "checklist": "Identity Review Checklist", + "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", + "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", + "service": "AAD B2C", "severity": "中等", - "text": "使用 Azure 流量管理器協調請求", - "waf": "可靠性" + "text": "自訂品牌資產應託管在CDN上", + "waf": "性能" }, { - "checklist": "Cognitive Search Review Checklist", - "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", - "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", - "service": "Cognitive Search", - "severity": "高", - "text": "備份和還原 Azure 認知搜索索引。使用此範例代碼將索引定義和快照備份到一系列 Json 檔", + "checklist": "Identity Review Checklist", + "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", + "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", + "service": "AAD B2C", + "severity": "低", + "text": "擁有多個標識提供者（即使用您的 Microsoft、Google、Facebook 帳戶登錄）", "waf": "可靠性" }, { - "checklist": "Redis Resiliency checklist", - "guid": "65285269-440b-44be-9d3e-0844276d4bdc", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", - "service": "Redis", - "severity": "高", - "text": "為 Azure Cache for Redis 啟用區域冗餘。Azure Cache for Redis 支持高級層和企業層中的區域冗餘配置。區域冗餘緩存可以將其節點放置在同一區域的不同 Azure 可用性區域中。它消除了作為單點故障的數據中心或可用區中斷，並提高了緩存的整體可用性。", + "checklist": "Identity Review Checklist", + "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", + "severity": "中等", + "text": "遵循 VM 規則，實現 VM 級別的高可用性（高級磁碟，一個區域中的兩個或更多磁碟，位於不同的可用性區域）", "waf": "可靠性" }, { - "checklist": "Redis Resiliency checklist", - "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", - "service": "Redis", + "checklist": "Identity Review Checklist", + "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "severity": "中等", - "text": "為 Azure Cache for Redis 實例配置數據持久性。由於緩存數據存儲在記憶體中，因此多個節點的罕見和計劃外故障可能會導致所有數據被丟棄。為了避免完全丟失數據，Redis 持久性允許您定期拍攝記憶體中數據的快照，並將其存儲到存儲帳戶中。", + "text": "不要複製！複製可能會產生目錄同步問題", "waf": "可靠性" }, { - "checklist": "Redis Resiliency checklist", - "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", - "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", - "service": "Redis", + "checklist": "Identity Review Checklist", + "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", + "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", + "service": "Windows AD", "severity": "中等", - "text": "使用異地冗餘存儲帳戶保留 Azure Cache for Redis 數據，或在異地冗餘不可用的情況下使用區域冗餘", + "text": "對多區域具有主動-主動", "waf": "可靠性" }, { - "checklist": "Redis Resiliency checklist", - "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", - "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", - "service": "Redis", + "checklist": "Identity Review Checklist", + "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "severity": "中等", - "text": "為高級 Azure Cache for Redis 實例配置被動異地複製。異地複製是一種用於連結兩個或多個 Azure Cache for Redis 實例的機制，通常跨越兩個 Azure 區域。異地複製主要用於跨區域災難恢復。兩個高級層緩存實例通過異地複製進行連接，從而提供對主緩存的讀取和寫入，並將數據複製到輔助緩存。", + "text": "將 Azure AD 域服務標記添加到其他區域和位置", "waf": "可靠性" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", - "service": "Azure Data Factory", + "checklist": "Identity Review Checklist", + "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", + "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", + "service": "Entra", "severity": "中等", - "text": "利用 Azure 數據工廠的 FTA 復原能力手冊", + "text": "將副本集用於DR", "waf": "可靠性" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", + "checklist": "IoT Hub Review", + "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", + "service": "IoT", "severity": "高", - "text": "在支援可用區的區域中使用區域冗餘管道", + "text": "利用可用區（如果區域適用）（這是自動啟用的）", "waf": "可靠性" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", - "link": "https://learn.microsoft.com/azure/data-factory/source-control", - "service": "Azure Data Factory", + "checklist": "IoT Hub Review", + "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", "severity": "中等", - "text": "使用 DevOps 透過 Github/Azure DevOps 集成備份 ARM 範本", + "text": "請注意 Microsoft 發起的故障轉移。Microsoft 在極少數情況下會執行這些操作，以將所有IoT中心從受影響的區域故障轉移到相應的異地配對區域。", "waf": "可靠性" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", - "severity": "中等", - "text": "請確保在另一個區域中複製自承載集成運行時 VM", + "checklist": "IoT Hub Review", + "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", + "service": "IoT", + "severity": "高", + "text": "考慮為關鍵工作負載制定跨區域災難恢復策略", "waf": "可靠性" }, { - "checklist": "Azure Data Factory Review Checklist", - "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", - "service": "Azure Data Factory", - "severity": "中等", - "text": "請確保在姊妹區域中複製或複製您的網路。必須在另一個區域創建 Vnet 的副本", + "checklist": "IoT Hub Review", + "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", + "service": "IoT", + "severity": "高", + "text": "瞭解如何觸發手動故障轉移。", "waf": "可靠性" }, { - "checklist": "Azure Data Factory Review Checklist", - "description": "如果ADF管道使用Key Vault，則無需執行任何操作即可複製Key Vault。Key Vault 是一項託管服務，Microsoft 會為你處理它", - "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", - "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", - "service": "Azure Data Factory", + "checklist": "IoT Hub Review", + "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", + "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", + "service": "IoT", + "severity": "高", + "text": "瞭解如何在故障轉移後進行故障回復。", + "waf": "可靠性" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", + "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", + "service": "AKS", "severity": "低", - "text": "如果使用 Keyvault 集成，請使用 Keyvault 的 SLA 來瞭解可用性", + "text": "如果 AKS Windows 工作負載需要，可以使用 HostProcess 容器", "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", - "service": "Entra", - "severity": "中等", - "text": "使用一個 Entra 租戶來管理 Azure 資源，除非你對多租戶有明確的法規或業務要求。", - "waf": "操作" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", + "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", + "service": "AKS", + "severity": "低", + "text": "如果運行事件驅動的工作負載，請使用KEDA", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Entra", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", + "link": "https://dapr.io/", + "service": "AKS", "severity": "低", - "text": "確保採用多租戶自動化方法來管理 Microsoft Entra ID 租戶", + "text": "使用 Dapr 簡化微服務開發", "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "Entra", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", + "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", + "link": "https://learn.microsoft.com/azure/aks/uptime-sla", + "service": "AKS", + "severity": "高", + "text": "使用 SLA 支援的 AKS 產品/服務", + "waf": "可靠性" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "severity": "低", - "text": "利用 Azure Lighthouse 進行多租戶管理", - "waf": "操作" + "text": "在容器和部署定義中使用中斷預算", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Entra", + "checklist": "Azure AKS Review", + "guid": "3c763963-7a55-42d5-a15e-401955387e5c", + "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", + "service": "ACR", + "severity": "高", + "text": "如果使用專用註冊表，請配置區域複製以將映像存儲在多個區域中", + "waf": "可靠性" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", + "service": "AKS", + "severity": "低", + "text": "使用外部應用（如 kubecost）將成本分配給不同的使用者", + "waf": "成本" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", + "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", + "service": "AKS", + "severity": "低", + "text": "使用縮減模式刪除/取消分配節點", + "waf": "成本" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", + "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", + "service": "AKS", "severity": "中等", - "text": "確保合作夥伴使用 Azure Lighthouse 管理租戶", + "text": "需要時，請在 AKS 群集上使用多實例分組 GPU", "waf": "成本" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "348ef254-c27d-442e-abba-c7571559ab91", - "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", - "service": "Entra", - "severity": "高", - "text": "強制實施與雲運營模型一致的 RBAC 模型。跨管理組和訂閱的範圍和分配。", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", + "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", + "service": "AKS", + "severity": "低", + "text": "如果運行開發/測試群集，請使用 NodePool Start/Stop", + "waf": "成本" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", - "service": "Entra", - "severity": "高", - "text": "僅對所有帳戶類型使用身份驗證類型「工作或學校帳戶」。避免使用 Microsoft 帳戶", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", + "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", + "service": "AKS", + "severity": "中等", + "text": "使用適用於 Kubernetes 的 Azure Policy 確保群集符合性", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "Entra", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", + "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "severity": "中等", - "text": "僅使用組來分配許可權。如果組管理系統已到位，則將本地組添加到僅 Entra ID 組。", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", + "text": "使用使用者/系統節點池將應用程式與控制平面分開", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", - "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", - "service": "Entra", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", + "link": "https://learn.microsoft.com/azure/aks/use-system-pools", + "service": "AKS", "severity": "低", - "text": "對任何有權訪問 Azure 環境的用戶強制實施 Microsoft Entra ID 條件訪問策略", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "text": "向系統節點池添加污點以使其專用", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", - "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", - "service": "Entra", - "severity": "高", - "text": "對有權訪問 Azure 環境的任何使用者強制實施多重身份驗證", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", + "link": "https://learn.microsoft.com/azure/container-registry/", + "service": "AKS", + "severity": "中等", + "text": "對映像使用專用註冊表，例如 ACR", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "14658d35-58fd-4772-99b8-21112df27ee4", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "Entra", + "checklist": "Azure AKS Review", + "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", + "link": "https://learn.microsoft.com/azure/security-center/container-security", + "service": "ACR", "severity": "中等", - "text": "強制實施 Microsoft Entra ID 特權身份管理 （PIM） 以建立零長期訪問許可權和最低許可權", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "text": "掃描映像以查找漏洞", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "Entra", - "severity": "中等", - "text": "如果計劃從 Active Directory 域服務切換到 Entra 域服務，請評估所有工作負載的相容性", - "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", + "service": "AKS", + "severity": "高", + "text": "定義應用分離要求（命名空間/節點池/集群）", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", - "service": "Entra", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", + "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", + "service": "AKS", "severity": "中等", - "text": "將 Microsoft Entra ID 日誌與平臺中心 Azure Monitor 集成。Azure Monitor 允許圍繞 Azure 中的日誌和監視數據提供單一事實源，從而為組織提供雲原生選項，以滿足有關日誌收集和保留的要求。", + "text": "使用 CSI 機密存儲驅動程式將機密存儲在 Azure Key Vault 中", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "984a859c-773e-47d2-9162-3a765a917e1f", - "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", - "service": "Entra", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", + "link": "https://learn.microsoft.com/azure/aks/update-credentials", + "service": "AKS", "severity": "高", - "text": "實施緊急訪問或打破玻璃帳戶，以防止租戶範圍的帳戶鎖定", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "text": "如果將服務主體用於群集，請定期刷新憑據（如每季度）", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "35037e68-9349-4c15-b371-228514f4cdff", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "Entra", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", + "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", + "service": "AKS", "severity": "中等", - "text": "避免將本地同步帳戶用於 Microsoft Entra ID 角色分配。", - "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", + "text": "如果需要，請添加金鑰管理服務 etcd 加密", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Entra", - "severity": "中等", - "text": "如果需要，請使用 Microsoft Entra ID 應用程式代理為遠端使用者提供對內部應用程式（託管在雲中或本地）的安全和經過身份驗證的訪問。", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", + "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", + "service": "AKS", + "severity": "低", + "text": "如果需要，請考慮使用適用於 AKS 的機密計算", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", - "service": "VNet", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", + "service": "AKS", "severity": "中等", - "text": "利用基於傳統中心輻射型網路拓撲的網路設計，滿足需要最大靈活性的網路方案。", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "考慮使用 Defender for Containers", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", - "service": "VNet", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", + "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", + "service": "AKS", "severity": "高", - "text": "確保共用網路服務（包括 ExpressRoute 閘道、VPN 閘道和 Azure 防火牆或合作夥伴 NVA）位於中心虛擬網路中。如有必要，還可以部署 DNS 伺服器。", - "waf": "成本" + "text": "使用託管標識而不是服務主體", + "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "VNet", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", + "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", + "link": "https://learn.microsoft.com/azure/aks/managed-aad", + "service": "AKS", "severity": "中等", - "text": "對應用程式登陸區域中的所有公共IP位址使用 DDoS 網路或IP防護計畫。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "將身份驗證與 AAD（使用託管集成）集成", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", - "service": "NVA", - "severity": "中等", - "text": "部署合作夥伴網路技術或 NVA 時，請遵循合作夥伴供應商的指導", - "waf": "可靠性" - }, - { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", - "service": "ExpressRoute", - "severity": "低", - "text": "如果需要在中心輻射型方案中的 ExpressRoute 和 VPN 閘道之間傳輸，請使用 Azure 路由伺服器。", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", + "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", + "service": "AKS", + "severity": "中等", + "text": "限制對管理員 kubeconfig （get-credentials --admin） 的訪問", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", - "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", - "service": "ARS", - "severity": "低", - "text": "如果使用 Route Server，請對 Route Server 子網使用 /27 前置綴。", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", + "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", + "service": "AKS", + "severity": "中等", + "text": "將授權與 AAD RBAC 集成", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", - "service": "VNet", - "severity": "中等", - "text": "對於跨 Azure 區域具有多個中心輻射型拓撲的網路體系結構，請使用中心 VNet 之間的全域虛擬網路對等互連將區域相互連接。", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", - "waf": "性能" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", + "service": "AKS", + "severity": "高", + "text": "在 Kubernetes 中使用命名空間限制 RBAC 許可權", + "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", - "service": "VNet", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", + "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", + "service": "AKS", "severity": "中等", - "text": "使用用於網路的 Azure Monitor 監視 Azure 上網路的端到端狀態。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "操作" + "text": "對於 Pod Identity Access Management，請使用 Azure AD 工作負載標識（預覽版）", + "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", - "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", + "service": "AKS", "severity": "中等", - "text": "將分支虛擬網路連接到中央中心虛擬網路時，請考慮 VNet 對等互連限制 （500），即可通過 ExpressRoute 播發的最大前綴數 （1000）", - "waf": "可靠性" + "text": "對於 AKS 非互動式登錄名，請使用 kubelogin（預覽版）", + "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", - "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", - "service": "VNet", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", + "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", + "service": "AKS", "severity": "中等", - "text": "考慮每個路由表的路由限制 （400）。", - "waf": "可靠性" + "text": "禁用 AKS 本地帳戶", + "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", - "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", - "service": "VNet", - "severity": "高", - "text": "配置 VNet 對等互連時，使用「允許流量流向遠端虛擬網路」設置", - "waf": "可靠性" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", + "service": "AKS", + "severity": "低", + "text": "如果需要，請配置 Just-in-time 群集訪問", + "waf": "安全" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", - "service": "ExpressRoute", - "severity": "中等", - "text": "使用 ExpressRoute Direct 時，請配置 MACsec，以便加密組織路由器和 MSEE 之間的第二層級別的流量。該圖顯示了流中的此加密。", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", + "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", + "service": "AKS", + "severity": "低", + "text": "如果需要，為 AKS 配置 AAD 條件訪問", "waf": "安全" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", + "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", + "service": "AKS", "severity": "低", - "text": "對於無法使用MACsec的方案（例如，不使用ExpressRoute Direct），請使用 VPN 閘道通過 ExpressRoute 專用對等互連建立 IPsec 隧道。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", + "text": "如果 Windows AKS 工作負載需要，請配置 gMSA", "waf": "安全" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "558fd772-49b8-4211-82df-27ee412e7f98", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "ExpressRoute", - "severity": "高", - "text": "確保在 Azure 區域和本地位置之間不使用重疊的 IP 位址空間", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", + "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", + "service": "AKS", + "severity": "中等", + "text": "為了獲得更精細的控制，請考慮使用託管的 Kubelet 身份", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", - "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", - "severity": "低", - "text": "使用專用 Internet 位址分配範圍 （RFC 1918） 中的 IP 位址。", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", + "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", + "service": "AKS", + "severity": "中等", + "text": "如果使用 AGIC，請勿跨集群共用 AppGW", + "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", - "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", - "service": "VNet", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", + "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", + "link": "https://learn.microsoft.com/azure/aks/http-application-routing", + "service": "AKS", "severity": "高", - "text": "確保IP位址空間不被浪費，不要創建不必要的大型虛擬網路（例如 /16）Ensure that that IP address space is not disdised， don't create un不必要的大型虛擬網路（例如 /16）Ensure that that IP address space is not waste， don't create un不必要的大型虛擬網络（例如 /16）Ensure that that IP address space is", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "text": "不要使用 AKS HTTP 路由載入項，而是將託管 NGINX 入口與應用程式路由載入項一起使用。", + "waf": "可靠性" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", + "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", + "service": "AKS", + "severity": "中等", + "text": "對於 Windows 工作負載，請使用加速網路", "waf": "性能" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", - "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", - "service": "VNet", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", + "guid": "ba7da7be-9952-4914-a384-5d997cb39132", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "severity": "高", - "text": "避免對生產網站和DR網站使用重疊的IP位址範圍。", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "text": "使用標準 ALB（而不是基本 ALB）", "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", + "service": "AKS", "severity": "中等", - "text": "對於只需要在 Azure 中進行名稱解析的環境，請使用 Azure 專用 DNS 進行解析，並使用委派區域進行名稱解析（例如“azure.contoso.com”）。", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "操作" + "text": "如果使用 Azure CNI，請考慮對 NodePool 使用不同的子網", + "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", - "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", - "service": "DNS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", + "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", + "service": "AKS", "severity": "中等", - "text": "對於需要跨 Azure 和本地進行名稱解析的環境，請考慮使用 Azure DNS 專用解析程式。", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "text": "使用專用終結點（首選）或虛擬網路服務終結點從群集訪問 PaaS 服務", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", - "service": "DNS", - "severity": "低", - "text": "需要並部署自己的 DNS（例如 Red Hat OpenShift）的特殊工作負載應使用其首選的 DNS 解決方案。", - "waf": "操作" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "614658d3-558f-4d77-849b-821112df27ee", - "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", - "service": "DNS", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", + "guid": "a0f61565-9de5-458f-a372-49c831112dbd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "severity": "高", - "text": "啟用 Azure DNS 的自動註冊，以自動管理虛擬網路中部署的虛擬機的 DNS 記錄的生命週期。", - "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", - "waf": "操作" + "text": "選擇最適合你要求的 CNI 網路外掛程式（建議使用 Azure CNI）", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", - "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", - "service": "Bastion", - "severity": "中等", - "text": "請考慮使用 Azure Bastion 安全地連接到網路。", - "waf": "安全" - }, - { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", - "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", - "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", - "service": "Bastion", - "severity": "中等", - "text": "在子網 /26 或更大範圍內使用 Azure Bastion。", - "waf": "安全" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", - "service": "WAF", - "severity": "中等", - "text": "使用 Azure Front Door 和 WAF 策略跨 Azure 區域為與登陸區域的入站 HTTP/S 連接提供全域保護。", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "安全" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", - "severity": "低", - "text": "使用 Azure Front Door 和 Azure 應用程式閘道幫助保護 HTTP/S 應用時，請使用 Azure Front Door 中的 WAF 策略。鎖定 Azure 應用程式閘道，以便僅接收來自 Azure Front Door 的流量。", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "高", + "text": "如果使用 Azure CNI，請根據每個節點的最大 Pod 數相應地調整子網的大小", + "waf": "性能" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "WAF", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "severity": "高", - "text": "部署 WAF 和其他反向代理是入站 HTTP/S 連接所必需的，將它們部署在登陸區域虛擬網路中，並與它們保護並公開給 Internet 的應用一起部署。", - "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", - "waf": "安全" + "text": "如果使用 Azure CNI，請檢查每個節點的最大 Pod 數（預設為 30）", + "waf": "性能" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", - "severity": "高", - "text": "使用 Azure DDoS 網路或 IP 保護計劃來幫助保護虛擬網路中的公共 IP 位址終結點。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "對於內部應用，組織通常會在其防火牆中打開整個AKS子網。這也會打開對節點的網路訪問，並可能打開對 Pod 的訪問（如果使用 Azure CNI）。如果 LoadBalancer IP 位於不同的子網中，則只有此子網可供應用用戶端使用。另一個原因是，如果 AKS 子網中的 IP 位址是稀缺資源，則將其 IP 位址用於服務會降低群集的最大可伸縮性。", + "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", + "link": "https://learn.microsoft.com/azure/aks/internal-lb", + "service": "AKS", + "severity": "低", + "text": "如果使用專用IP LoadBalancer服務，請使用專用子網（而不是 AKS 子網）", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b034c01e-110b-463a-b36e-e3346e57f225", - "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", - "service": "VNet", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", "severity": "高", - "text": "在即將到來的重大更改之前，評估和審查網路出站流量配置和策略。2025 年 9 月 30 日，新部署的預設出站訪問將停用，僅允許顯式訪問配置", + "text": "相應調整服務 IP 位址範圍的大小（這將限制群集的可伸縮性）", "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", - "service": "VNet", - "severity": "高", - "text": "添加診斷設置以保存所有受保護的公共IP位址（DDoS IP或網路保護）的 DDoS 相關日誌。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", + "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", + "service": "AKS", + "severity": "低", + "text": "如果需要，請添加您自己的 CNI 外掛程式", "waf": "安全" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", - "service": "ExpressRoute", - "severity": "中等", - "text": "確保已調查使用 ExpressRoute 作為與 Azure 的主要連接的可能性。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", + "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", + "service": "AKS", + "severity": "低", + "text": "如果需要，請在 AKS 中配置每個節點的公共 IP", "waf": "性能" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "description": "可以使用 AS 路徑前置和連接權重來影響從 Azure 到本地的流量，並使用自己的路由器中的全部 BGP 屬性來影響從本地到 Azure 的流量。", - "guid": "f29812b2-363c-4efe-879b-599de0d5973c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", + "link": "https://learn.microsoft.com/azure/aks/concepts-network", + "service": "AKS", "severity": "中等", - "text": "使用多條 ExpressRoute 線路或多個本地位置時，請確保使用 BGP 屬性優化路由（如果首選某些路徑）。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "使用入口控制器公開基於 Web 的應用，而不是使用 LoadBalancer 類型的服務公開它們", "waf": "可靠性" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", - "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", - "service": "ExpressRoute", - "severity": "中等", - "text": "確保根據頻寬和性能要求為 ExpressRoute/VPN 閘道使用正確的 SKU。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "性能" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", + "link": "https://learn.microsoft.com/azure/aks/nat-gateway", + "service": "AKS", + "severity": "低", + "text": "使用 Azure NAT 閘道作為 outboundType 來縮放出口流量", + "waf": "可靠性" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", - "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", - "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", - "service": "ExpressRoute", - "severity": "高", - "text": "確保僅當達到證明其成本合理的頻寬時，才使用無限數據的ExpressRoute線路。", - "waf": "成本" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", + "service": "AKS", + "severity": "中等", + "text": "使用IP的動態分配來避免 Azure CNI IP 耗盡", + "waf": "可靠性" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", - "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", + "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", + "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", + "service": "AKS", "severity": "高", - "text": "如果線路的對等互連位置支援本地 SKU 的 Azure 區域，則利用 ExpressRoute 的本地 SKU 來降低線路的成本。", - "waf": "成本" + "text": "如果安全要求要求，請使用 AzFW/NVA 篩選出口流量", + "waf": "安全" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", - "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", + "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", + "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", + "service": "AKS", "severity": "中等", - "text": "在受支援的 Azure 區域中部署區域冗餘 ExpressRoute 閘道。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "可靠性" + "text": "如果使用公共 API 終端節點，請限制可以存取它的 IP 位址", + "waf": "安全" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", - "service": "ExpressRoute", - "severity": "中等", - "text": "對於需要高於 10 Gbps 的頻寬或專用 10/100 Gbps 埠的方案，請使用 ExpressRoute Direct。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "性能" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", + "link": "https://learn.microsoft.com/azure/aks/private-clusters", + "service": "AKS", + "severity": "高", + "text": "如果要求要求，請使用私有集群", + "waf": "安全" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", - "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", + "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", "severity": "中等", - "text": "如果需要低延遲，或者從本地到 Azure 的輸送量必須大於 10 Gbps，請啟用 FastPath 以繞過數據路徑的 ExpressRoute 閘道。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "性能" + "text": "對於 Windows 2019 和 2022 AKS 節點，可以使用 Calico 網路策略", + "waf": "安全" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", - "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", - "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", - "service": "VPN", - "severity": "中等", - "text": "使用區域冗餘 VPN 閘道將分支或遠端位置連接到 Azure（如果可用）。", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "可靠性" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", + "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", + "link": "https://learn.microsoft.com/azure/aks/use-network-policies", + "service": "AKS", + "severity": "高", + "text": "啟用 Kubernetes 網路策略選項 （Calico/Azure）", + "waf": "安全" }, { - "arm-service": "microsoft.network/vpnGateways", - "checklist": "Azure Landing Zone Review", - "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", - "service": "VPN", - "severity": "中等", - "text": "在本地使用冗餘 VPN 設備（主動/主動或主動/被動）。", - "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", - "waf": "可靠性" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", + "severity": "高", + "text": "使用 Kubernetes 網路策略提高集群內安全性", + "waf": "安全" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "718cb437-b060-2589-8856-2e93a5c6633b", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", + "service": "AKS", "severity": "高", - "text": "如果使用 ExpressRoute Direct，請考慮使用本地 Azure 區域的 ExpressRoute 本地線路來節省成本", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "成本" + "text": "將 WAF 用於 Web 工作負載（UI 或 API）", + "waf": "安全" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", - "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", + "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", + "service": "AKS", "severity": "中等", - "text": "當需要流量隔離或專用頻寬時（例如，用於分離生產環境和非生產環境），請使用不同的 ExpressRoute 線路。它將幫助您確保隔離的路由域並減輕干擾鄰居風險。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "在 AKS 虛擬網路中使用 DDoS 標準", "waf": "安全" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b30e38c3-f298-412b-8363-cefe179b599d", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", + "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", + "link": "https://learn.microsoft.com/azure/aks/http-proxy", + "service": "AKS", + "severity": "低", + "text": "如果需要，請添加公司 HTTP 代理", + "waf": "安全" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", + "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", + "service": "AKS", "severity": "中等", - "text": "使用內置的 Express Route Insights 監視 ExpressRoute 的可用性和利用率。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "text": "考慮使用服務網格進行高級微服務通信管理", + "waf": "安全" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", + "service": "AKS", + "severity": "高", + "text": "設定有關最關鍵指標的警報（請參閱容器見解以獲取建議）", "waf": "操作" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", - "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", - "service": "ExpressRoute", - "severity": "中等", - "text": "使用連接監視器進行跨網路的連接監視，尤其是在本地和 Azure 之間。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "337453a3-cc63-4963-9a65-22ac19e80696", + "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", + "service": "AKS", + "severity": "低", + "text": "定期查看 Azure 顧問，瞭解有關群集的建議", "waf": "操作" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", - "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", - "service": "ExpressRoute", - "severity": "中等", - "text": "使用來自不同對等互連位置的 ExpressRoute 線路實現冗餘。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "可靠性" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", + "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", + "service": "AKS", + "severity": "低", + "text": "啟用 AKS 自動證書輪換", + "waf": "操作" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", - "service": "ExpressRoute", - "severity": "中等", - "text": "使用網站到網站 VPN 作為 ExpressRoute 的故障轉移，尤其是在僅使用單個 ExpressRoute 線路時。", - "waf": "可靠性" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", + "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", + "service": "AKS", + "severity": "高", + "text": "定期（例如，每季度）升級 kubernetes 版本，或使用 AKS 自動升級功能", + "waf": "操作" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", - "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", + "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", + "service": "AKS", "severity": "高", - "text": "如果在 GatewaySubnet 中使用路由表，請確保傳播閘道路由。", - "waf": "可靠性" + "text": "如果您不使用 node-image 升級，請使用 kured 進行 Linux 節點升級", + "waf": "操作" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "d581a947-69a2-4783-942e-9df3664324c8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", + "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", + "service": "AKS", "severity": "高", - "text": "如果使用 ExpressRoute，則本地路由應是動態的：如果連接失敗，它應收斂到線路的剩餘連接。理想情況下，負載應在兩個連接之間共用為主動/主動，但也支持主動/被動。", - "waf": "可靠性" + "text": "定期（例如，每周）升級群集節點映像的常規過程", + "waf": "操作" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", - "service": "ExpressRoute", - "severity": "中等", - "text": "確保 ExpressRoute 線路的兩個物理連結連接到網路中的兩個不同的邊緣設備。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "可靠性" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", + "service": "AKS", + "severity": "低", + "text": "考慮使用 gitops 將應用程式或集群配置部署到多個集群", + "waf": "操作" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", - "service": "ExpressRoute", - "severity": "中等", - "text": "確保在客戶或供應商邊緣路由設備上啟用並配置雙向轉發檢測 （BFD）。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "可靠性" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "d7672c26-7602-4482-85a4-14527fbe855c", + "link": "https://learn.microsoft.com/azure/aks/command-invoke", + "service": "AKS", + "severity": "低", + "text": "請考慮在專用群集上使用 AKS 命令調用", + "waf": "操作" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", - "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", + "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", + "service": "AKS", + "severity": "低", + "text": "對於計劃的事件，請考慮使用 Node Auto Drain", + "waf": "操作" + }, + { + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", + "link": "https://learn.microsoft.com/azure/aks/faq", + "service": "AKS", "severity": "高", - "text": "將 ExpressRoute 閘道連接到來自不同對等互連位置的兩條或多條線路，以提高復原能力。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "可靠性" + "text": "開發自己的治理實踐，以確保節點 RG（又名“基礎設施 RG”）中的操作員不會執行任何更改", + "waf": "操作" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", - "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", - "service": "ExpressRoute", - "severity": "中等", - "text": "為 ExpressRoute 虛擬網路閘道配置診斷日誌和警報。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", + "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", + "severity": "低", + "text": "使用自定義節點 RG（又名“Infra RG”）名稱", "waf": "操作" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "5234c93f-b651-41dd-80c1-234177b91ced", - "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", + "link": "https://kubernetes.io/docs/setup/release/notes/", + "service": "AKS", "severity": "中等", - "text": "避免使用 ExpressRoute 線路進行 VNet 到 VNet 通信。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "性能" + "text": "請勿在 YAML 清單中使用已棄用的 Kubernetes API", + "waf": "操作" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", - "severity": "高", - "text": "使用 Azure 防火牆管理發往 Internet 的 Azure 出站流量、非 HTTP/S 入站連接和東西向流量篩選（如果組織需要）", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", + "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", + "service": "AKS", + "severity": "低", + "text": "污染 Windows 節點", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", - "severity": "中等", - "text": "創建全域 Azure 防火牆策略以管理全球網路環境中的安全狀況，並將其分配給所有 Azure 防火牆實例。通過 Azure 基於角色的訪問控制將增量防火牆策略委託給本地安全團隊，允許精細策略滿足特定區域的要求。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", + "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", + "service": "AKS", + "severity": "低", + "text": "使 Windows 容器修補程式級別與主機修補程式級別保持同步", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", - "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "通過群集級別的診斷設置", + "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", + "link": "https://learn.microsoft.com/azure/aks/monitor-aks", + "service": "AKS", "severity": "低", - "text": "如果組織希望使用此類解決方案來幫助保護出站連接，請在 Firewall Manager 中配置受支援的合作夥伴 SaaS 安全提供者。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" + "text": "將主日誌（又名 API 紀錄）發送到 Azure Monitor 或首選日誌管理解決方案", + "waf": "操作" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", - "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", - "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", - "service": "Firewall", - "severity": "高", - "text": "使用基於 FQDN 的網路規則和具有 DNS 代理的 Azure 防火牆，通過應用程式規則不支援的協定篩選到 Internet 的出口流量。", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", + "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", + "service": "AKS", + "severity": "低", + "text": "如果需要，請使用 nodePool 快照", + "waf": "成本" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", - "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", - "severity": "高", - "text": "使用 Azure 防火牆高級版提供額外的安全性和保護。", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", + "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", + "service": "AKS", + "severity": "低", + "text": "考慮將現成節點池用於對時間敏感的工作負載", + "waf": "操作" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", - "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", - "link": "https://learn.microsoft.com/azure/firewall/premium-features", - "service": "Firewall", - "severity": "高", - "text": "將 Azure 防火牆威脅情報模式配置為「警報」和「拒絕」，以獲得額外保護。", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", + "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", + "severity": "低", + "text": "考慮用於快速突發的 AKS 虛擬節點", + "waf": "操作" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", - "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", "severity": "高", - "text": "將 Azure 防火牆 IDPS 模式配置為「拒絕」 ，以獲得額外的保護。", - "waf": "安全" + "text": "使用 Container Insights（或 Prometheus 等其他工具）監控集群指標", + "waf": "操作" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", - "guid": "a3784907-9836-4271-aafc-93535f8ec08b", - "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", + "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", + "service": "AKS", "severity": "高", - "text": "對於未連接到虛擬 WAN 的 VNet 中的子網，請附加路由表，以便將 Internet 流量重定向到 Azure 防火牆或網路虛擬設備", - "waf": "安全" + "text": "使用 Container Insights（或 Telegraf/ElasticSearch 等其他工具）存儲和分析集群日誌", + "waf": "操作" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "715d833d-4708-4527-90ac-1b142c7045ba", - "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", + "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", + "service": "AKS", "severity": "中等", - "text": "添加診斷設置，以使用「特定於資源」的目標表保存所有 Azure 防火牆部署的日誌。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "text": "監控節點的 CPU 和記憶體利用率", "waf": "操作" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", - "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", - "service": "Firewall", - "severity": "重要", - "text": "從 Azure 防火牆經典規則（如果存在）遷移到防火牆策略。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "1a4835ac-9422-423e-ae80-b123081a5417", + "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", + "service": "AKS", + "severity": "中等", + "text": "如果使用 Azure CNI，請監視每個節點消耗的 Pod IP 的百分比", "waf": "操作" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", - "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", - "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", - "service": "Firewall", - "severity": "高", - "text": "對 Azure 防火牆子網使用 /26 前置綴。", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "OS 磁碟上的 I/O 是關鍵資源。如果節點中的操作系統在 I/O 上受到限制，這可能會導致不可預知的行為，通常最終導致節點被聲明為 NotReady", + "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", + "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", + "service": "AKS", + "severity": "中等", + "text": "監視節點中的OS磁碟佇列深度", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", - "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "be209d39-fda4-4777-a424-d116785c2fa5", + "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", + "service": "AKS", "severity": "中等", - "text": "將防火牆策略中的規則排列到規則集合組和規則集合中，並根據它們的使用頻率", - "waf": "性能" + "text": "如果不對 AzFW/NVA 使用出口篩選，請監視標準 ALB 分配的 SNAT 連接埠", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", - "link": "https://learn.microsoft.com/azure/firewall/ip-groups", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", + "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", + "service": "AKS", "severity": "中等", - "text": "使用IP組或IP前置綴來減少IP表規則的數量", - "waf": "性能" + "text": "訂閱 AKS 群集的資源運行狀況通知", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", - "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", - "service": "Firewall", - "severity": "中等", - "text": "避免將通配符作為DNATS的源IP，例如*或任何通配符，您應該為傳入的DNAT指定源IP", - "waf": "性能" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", + "severity": "高", + "text": "在 Pod 規範中配置請求和限制", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", - "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "769ef669-1a48-435a-a942-223ece80b123", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", + "service": "AKS", "severity": "中等", - "text": "通過監控 SNAT 埠使用方式、評估 NAT 閘道設置和確保無縫故障轉移來防止 SNAT 埠耗盡。如果埠計數接近限制，則表明 SNAT 耗盡可能迫在眉睫。", - "waf": "性能" + "text": "強制實施命名空間的資源配額", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "346840b8-1064-496e-8396-4b1340172d52", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "081a5417-4158-433e-a3ad-3c2de733165c", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "AKS", "severity": "高", - "text": "啟用 TLS 檢查", - "waf": "性能" + "text": "確保訂閱具有足夠的配額來橫向擴展節點池", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", - "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", - "service": "Firewall", - "severity": "低", - "text": "使用 Web 類別允許或拒絕對特定主題的出站訪問。", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", + "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", + "severity": "中等", + "text": "使用群集自動縮放程式", "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", - "service": "Firewall", - "severity": "中等", - "text": "作為 TLS 檢查的一部分，請計劃從 Azure 應用閘道接收流量以進行檢查。", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", + "guid": "831c2872-c693-4b39-a887-a561bada49bc", + "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", + "service": "AKS", + "severity": "低", + "text": "自定義 AKS 節點池的節點配置", "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", - "link": "https://learn.microsoft.com/azure/firewall/dns-details", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", + "link": "https://learn.microsoft.com/azure/aks/concepts-scale", + "service": "AKS", "severity": "中等", - "text": "啟用 Azure 防火牆 DNS 代理配置", - "waf": "安全" + "text": "需要時使用 Horizontal Pod Autoscaler", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", - "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", - "service": "Firewall", - "severity": "中等", - "text": "確保有策略分配來拒絕直接綁定到虛擬機的公共IP位址", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "description": "更大的節點將帶來更高的性能和功能，例如臨時磁碟和加速網路，但它們會增加爆炸半徑並降低擴展粒度", + "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", + "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", + "service": "AKS", + "severity": "高", + "text": "考慮適當的節點大小，不要太大或太小", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", - "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", + "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", + "service": "AKS", "severity": "低", - "text": "將 Azure 防火牆與 Azure Monitor 集成，並啟用診斷日誌記錄來存儲和分析防火牆日誌。", - "waf": "操作" + "text": "如果可伸縮性需要超過 5000 個節點，請考慮使用其他 AKS 群集", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", - "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", - "service": "Firewall", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", + "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", + "service": "AKS", "severity": "低", - "text": "為防火牆規則實施備份", - "waf": "操作" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", - "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", - "service": "App Gateway", - "severity": "高", - "text": "確保注入虛擬網路的 Azure PaaS 服務的控制平面通信不會中斷，例如，使用 0.0.0.0/0 路由或阻止控制平面流量的 NSG 規則。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "安全" + "text": "考慮訂閱 EventGrid Events for AKS 自動化", + "waf": "性能" }, { - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "ExpressRoute", - "severity": "中等", - "text": "通過專用終結點和 ExpressRoute 專用對等互連從本地訪問 Azure PaaS 服務。此方法可避免通過公共 Internet 進行傳輸。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", + "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", + "service": "AKS", + "severity": "低", + "text": "若要在 AKS 群集上長時間運行操作，請考慮事件終止", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", - "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "VNet", - "severity": "中等", - "text": "默認情況下，不要在所有子網上啟用虛擬網路服務終結點。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", + "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", + "service": "AKS", + "severity": "低", + "text": "如果需要，請考慮將 Azure 專用主機用於 AKS 節點", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", - "link": "https://learn.microsoft.com/azure/app-service/networking-features", - "service": "Firewall", - "severity": "中等", - "text": "使用 FQDN 而不是 Azure 防火牆或 NVA 中的 IP 位址篩選到 Azure PaaS 服務的出口流量，以防止數據外洩。如果使用專用連結，則可以阻止所有 FQDN，否則僅允許所需的 PaaS 服務。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", + "guid": "24367b33-6971-45b1-952b-eee0b9b588de", + "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", + "service": "AKS", + "severity": "高", + "text": "使用臨時OS磁碟", + "waf": "性能" }, { - "ammp": true, - "arm-service": "microsoft.network/expressRouteCircuits", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", - "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", - "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", - "service": "ExpressRoute", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", + "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", + "service": "AKS", "severity": "高", - "text": "至少對閘道子網使用 /27 前置綴", - "waf": "安全" + "text": "對於非臨時磁碟，在運行多個 Pod/節點時，請為節點使用高 IOPS 和更大的 OS 磁碟，因為它需要高性能才能運行多個 Pod，並且會生成具有預設 AKS 日誌輪換閾值的大量日誌", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", - "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", - "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", - "service": "NSG", - "severity": "中等", - "text": "不要依賴使用 VirtualNetwork 服務標記的 NSG 入站預設規則來限制連接。", - "waf": "安全" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", + "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", + "service": "AKS", + "severity": "低", + "text": "對於超高性能存儲選項，請在 AKS 上使用超級磁碟For hyper performance storage option use Ultra Disks on AKS", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", - "service": "NSG", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", + "service": "AKS", "severity": "中等", - "text": "使用 NSG 説明保護跨子網的流量，以及跨平台的東/西流量（登陸區域之間的流量）。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "安全" + "text": "避免將狀態保留在群集中，並將數據存儲在外部（AzStorage、AzSQL、Cosmos 等）", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", - "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", - "service": "NSG", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", + "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", + "service": "AKS", "severity": "中等", - "text": "應用程式團隊應使用子網級別 NSG 的應用程式安全組來幫助保護登陸區域內的多層 VM。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "安全" + "text": "如果使用 AzFiles Standard，出於性能原因，請考慮使用 AzFiles Premium 和/或 ANF", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Azure AKS Review", + "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", + "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", + "service": "AKS", "severity": "中等", - "text": "使用 NSG 和應用程式安全組對登陸區域內的流量進行微分段，並避免使用中央 NVA 篩選流量。", - "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", - "waf": "安全" + "text": "如果使用 Azure 磁碟和可用區，請考慮在區域內為 LRS 磁碟設置節點池，並使用 VolumeBindingMode：WaitForFirstConsumer 在正確的區域中預配存儲，或將 ZRS 磁碟用於跨多個區域的節點池", + "waf": "性能" }, { - "checklist": "Azure Landing Zone Review", - "guid": "dfe237de-143b-416c-91d7-aa9b64704489", - "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", - "service": "NSG", - "severity": "中等", - "text": "啟用 VNet 流日誌並將其饋送到流量分析中，以深入了解內部和外部流量流。", - "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", - "waf": "安全" + "checklist": "Cognitive Search Review Checklist", + "guid": "41faa1ed-b7f0-447d-8cba-4a4905e5bb83", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", + "severity": "高", + "text": "使 2 個副本具有 99.9% 的讀取操作可用性", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", - "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "NSG", + "checklist": "Cognitive Search Review Checklist", + "guid": "7d956fd9-788a-4845-9b9f-c0340972d810", + "link": "https://learn.microsoft.com/azure/search/search-reliability#high-availability", + "service": "Cognitive Search", "severity": "中等", - "text": "考慮每個 NSG 的 NSG 規則限制 （1000）。", - "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "text": "使 3 個副本具有 99.9% 的讀/寫操作可用性", "waf": "可靠性" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", - "service": "VWAN", - "severity": "中等", - "text": "請考慮使用虛擬 WAN 簡化 Azure 網路管理，並確保在虛擬 WAN 路由設計清單中明確描述你的方案", - "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", - "waf": "操作" + "checklist": "Cognitive Search Review Checklist", + "guid": "44dc5f2b-a032-4d03-aae8-90c3f2c0a4c3", + "link": "https://learn.microsoft.com/azure/search/search-reliability#availability-zone-support", + "service": "Cognitive Search", + "severity": "高", + "text": "通過啟用讀取和/或寫入副本來利用可用區", + "waf": "可靠性" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", + "checklist": "Cognitive Search Review Checklist", + "guid": "cd0730f0-0ff1-4b77-9a2b-2a1f7dd5e291", + "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", + "service": "Cognitive Search", "severity": "中等", - "text": "使用每個 Azure 區域的虛擬 WAN 中心，通過通用的全域 Azure 虛擬 WAN 跨 Azure 區域將多個登陸區域連接在一起。", - "waf": "性能" + "text": "對於區域冗餘，請在2個或更多區域中為搜索手動創建服務，因為它不提供跨地理區域複製搜索索引的自動方法", + "waf": "可靠性" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "severity": "低", - "text": "遵循“Azure 中的流量保留在 Azure 中”原則，以便通過 Microsoft 主幹網络在 Azure 中跨資源進行通信", - "waf": "性能" - }, - { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", - "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", - "service": "VWAN", - "severity": "中等", - "text": "對於出站 Internet 流量保護和篩選，請在安全中心部署 Azure 防火牆", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" - }, - { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "VWAN", - "severity": "中等", - "text": "確保網路體系結構在 Azure 虛擬 WAN 限制範圍內。", - "waf": "可靠性" - }, - { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", - "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", - "service": "VWAN", - "severity": "中等", - "text": "使用適用於虛擬 WAN 的 Azure Monitor 見解監視虛擬 WAN 的端到端拓撲、狀態和關鍵指標。", - "waf": "操作" - }, - { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", - "service": "VWAN", - "severity": "中等", - "text": "請確保 IaC 部署不會在虛擬 WAN 中禁用分支到分支通信，除非應顯式阻止這些流。", - "waf": "可靠性" - }, - { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", - "service": "VWAN", + "checklist": "Cognitive Search Review Checklist", + "guid": "3c964882-aec9-4d44-9f68-4b5f2efbbdb6", + "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", + "service": "Cognitive Search", "severity": "中等", - "text": "使用 AS-Path 作為中心路由首選項，因為它比 ExpressRoute 或 VPN 更靈活。", + "text": "若要跨多個服務同步數據，請使用索引器更新多個服務上的內容，或使用 REST API 推送多個服務上的內容更新", "waf": "可靠性" }, { - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", - "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", - "service": "VWAN", + "checklist": "Cognitive Search Review Checklist", + "guid": "85ee93c9-f53c-4803-be51-e6e4aa37ff4e", + "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", + "service": "Cognitive Search", "severity": "中等", - "text": "請確保 IaC 部署在虛擬 WAN 中配置基於標籤的傳播，否則虛擬中心之間的連接將受到損害。", + "text": "使用 Azure 流量管理器協調請求", "waf": "可靠性" }, { - "ammp": true, - "arm-service": "microsoft.network/virtualWans", - "checklist": "Azure Landing Zone Review", - "guid": "9c75dfef-573c-461c-a698-68598595581a", - "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", - "service": "VWAN", + "checklist": "Cognitive Search Review Checklist", + "guid": "7be10278-57c1-4a61-8ee3-895aebfec5aa", + "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", + "service": "Cognitive Search", "severity": "高", - "text": "為虛擬中心分配足夠的IP空間，最好是 /23前置綴。", + "text": "備份和還原 Azure 認知搜索索引。使用此範例代碼將索引定義和快照備份到一系列 Json 檔", "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", - "severity": "高", - "text": "戰略性地利用 Azure Policy，為環境定義控制，使用策略計劃對相關策略進行分組。", + "checklist": "Azure Event Hub Review", + "description": "Azure 事件中心提供靜態數據加密。如果使用自己的金鑰，則仍使用 Microsoft 管理的金鑰對數據進行加密，但此外，Microsoft 管理的金鑰將使用客戶管理的密鑰進行加密。", + "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", + "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", + "service": "Event Hubs", + "severity": "低", + "text": "需要時，在靜態數據加密中使用客戶管理的金鑰選項", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "Azure Event Hub Review", + "description": "Azure 事件中心命名空間允許用戶端使用 TLS 1.0 及更高版本發送和接收數據。若要強制實施更嚴格的安全措施，可以將事件中心命名空間配置為要求用戶端使用較新版本的 TLS 發送和接收數據。如果事件中心命名空間需要最低版本的 TLS，則使用舊版本發出的任何請求都將失敗。", + "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", + "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", + "service": "Event Hubs", "severity": "中等", - "text": "將法規和合規性要求映射到 Azure Policy 定義和 Azure 角色分配。", + "text": "對請求強制實施傳輸層安全性 （TLS） 的最低要求版本", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "223ace8c-b123-408c-a501-7f154e3ab369", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "Azure Event Hub Review", + "description": "創建事件中心命名空間時，會自動為命名空間創建名為 RootManageSharedAccessKey 的策略規則。此策略具有整個命名空間的管理許可權。建議您將此規則視為管理根帳戶，不要在應用程式中使用它。建議將 AAD 用作 RBAC 的身份驗證提供程式。", + "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", + "service": "Event Hubs", "severity": "中等", - "text": "在中間根管理組建立 Azure Policy 定義，以便可以在繼承的範圍內分配這些定義", + "text": "避免在不必要的情況下使用root帳戶", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "3829e7e3-1618-4368-9a04-77a209945bda", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "Azure Event Hub Review", + "description": "Azure 資源的託管標識可以使用 Azure AD 憑據從 Azure 虛擬機 （VM）、函數應用、虛擬機規模集和其他服務中運行的應用程式授權訪問事件中心資源。通過將 Azure 資源的託管標識與 Azure AD 身份驗證結合使用，可以避免將憑據存儲在雲中運行的應用程式中。", + "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", + "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", + "service": "Event Hubs", "severity": "中等", - "text": "如果需要，在最高適當級別管理策略分配，在最低級別管理排除項。", + "text": "如果可能，應用程式應使用託管標識向 Azure 事件中心進行身份驗證。如果沒有，請考慮在 Azure Key Vault 或等效服務中擁有存儲憑據（SAS、服務主體憑據）", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "43334f24-9116-4341-a2ba-527526944008", - "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", - "service": "Policy", - "severity": "低", - "text": "使用 Azure Policy 控制使用者可以在訂閱/管理組級別預配哪些服務", + "checklist": "Azure Event Hub Review", + "description": "創建許可權時，請對用戶端對 Azure 事件中心的訪問提供精細控制。Azure 事件中心中的許可權可以而且應該限定為單個資源級別，例如消費者組、事件中心實體、事件中心命名空間等。", + "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", + "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", + "service": "Event Hubs", + "severity": "高", + "text": "使用最低特權數據平面 RBAC", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "Azure Event Hub Review", + "description": "Azure 事件中心資源日誌包括操作日誌、虛擬網路和 Kafka 日誌。運行時審核日誌捕獲事件中心中所有數據平面訪問操作（例如發送或接收事件）的聚合診斷資訊。", + "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", + "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", + "service": "Event Hubs", "severity": "中等", - "text": "盡可能使用內置策略，以最大程度地減少操作開銷。", + "text": "啟用記錄以進行安全調查。使用 Azure Monitor 捕獲指標和日誌，例如資源日誌、運行時審核日誌和 Kafka 紀錄", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "description": "通過將「資源策略參與者」角色分配給特定範圍，可以將策略管理委派給相關團隊。例如，中央IT團隊可以監督管理組級別的策略，而應用程式團隊則處理其訂閱的策略，從而在遵守組織標準的情況下實現分散式治理。", - "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", - "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", - "service": "Policy", + "checklist": "Azure Event Hub Review", + "description": "默認情況下，Azure 事件中心具有公共IP位址，並且可通過Internet訪問。專用終結點允許虛擬網路和 Azure 事件中心之間的流量遍歷 Microsoft 主幹網路。除此之外，如果未使用公共終結點，則應禁用這些終結點。", + "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", + "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", + "service": "Event Hubs", "severity": "中等", - "text": "在特定範圍內分配內置的「資源策略參與者」角色，以啟用應用程式級治理。", + "text": "請考慮使用專用終結點訪問 Azure 事件中心，並在適用時禁用公用網路訪問。", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "19048384-5c98-46cb-8913-156a12476e49", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Policy", + "checklist": "Azure Event Hub Review", + "description": "使用IP防火牆，可以將公共終結點進一步限製為僅一組IPv4位址或 CIDR（無類別域間路由）表示法的IPv4位址範圍。", + "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", + "service": "Event Hubs", "severity": "中等", - "text": "限制在根管理組範圍內進行的 Azure Policy 分配數，以避免在繼承範圍內通過排除項進行管理。", + "text": "請考慮僅允許從特定IP位址或範圍訪問 Azure 事件中心命名空間", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", - "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", - "service": "Policy", + "checklist": "Azure Event Hub Review", + "guid": "31d41e36-11c8-417b-8afb-c410d4391898", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", + "service": "Event Hubs", "severity": "中等", - "text": "如果存在任何數據主權要求，可以部署 Azure 策略來強制實施這些要求", - "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", - "waf": "安全" + "text": "利用 FTA 彈性手冊", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", - "service": "Policy", - "severity": "中等", - "text": "對於主權登陸區，主權政策基線的政策計劃將在正確的 MG 級別部署和分配。", - "waf": "安全" + "checklist": "Azure Event Hub Review", + "description": "對於從門戶創建的新 EH 命名空間，在啟用區域的區域中具有高級、專用或標準 SKU，將自動啟用此功能。EH 元數據和事件數據本身都是跨區域複製的", + "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", + "service": "Event Hubs", + "severity": "高", + "text": "利用可用區（如果區域適用）", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", - "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", - "service": "Policy", + "checklist": "Azure Event Hub Review", + "guid": "20b56c56-ad58-4519-8f82-735c586bb281", + "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", + "service": "Event Hubs", "severity": "中等", - "text": "對於主權登陸區，記錄了“主權控制目標”到策略映射“。", - "waf": "安全" + "text": "使用高級或專用 SKU 實現可預測的性能", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", - "service": "Policy", - "severity": "中等", - "text": "對於主權登陸區，CRUD的“主權控制目標到政策映射”的流程已經到位。", - "waf": "安全" + "checklist": "Azure Event Hub Review", + "description": "啟用內置異地災難恢復功能后，可確保命名空間的整個配置（事件中心、消費者組和設置）從主命名空間持續複製到輔助命名空間，並允許隨時從主命名空間向輔助命名空間進行一次故障轉移。主動/被動功能旨在更輕鬆地從失敗的 Azure 區域中恢復和放棄，而無需更改應用程式配置", + "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", + "service": "Event Hubs", + "severity": "高", + "text": "使用主動被動配置規劃異地災難恢復", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "checklist": "Azure Event Hub Review", + "description": "應用於無法容忍關閉區域中事件數據中斷或丟失的DR配置。對於這些情況，請遵循複製指南，不要使用內置的異地災難恢復功能（主動/被動）。使用「主動/主動」時，在不同區域和命名空間中維護多個事件中心，事件將在中心之間複製", + "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", + "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", + "service": "Event Hubs", "severity": "中等", - "text": "使用單個監視器日誌工作區集中管理平臺，但 Azure 基於角色的訪問控制 （Azure RBAC）、數據主權要求或數據保留策略要求使用單獨的工作區的情況除外。", - "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "waf": "操作" + "text": "對於業務關鍵型應用程式，請使用 Active Active 配置", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Monitor", - "severity": "中等", - "text": "如果日誌保留要求超過 12 年，請將日誌匯出到 Azure 存儲。將不可變存儲與一次寫入、多次讀取策略結合使用，使數據在使用者指定的時間間隔內不可擦除和不可修改。", - "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", - "waf": "操作" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", - "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", - "service": "VM", - "severity": "中等", - "text": "使用 Azure Policy 監視 OS 等級的虛擬機 （VM） 配置偏移。通過策略啟用 Azure Automanage 計算機配置審核功能可幫助應用程式團隊工作負載輕鬆立即使用功能。", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "操作" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", + "checklist": "Azure Event Hub Review", + "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", + "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", + "service": "Event Hubs", "severity": "中等", - "text": "使用 Azure 更新管理員作為 Azure 中 Windows 和 Linux VM 的修補機制。", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "操作" + "text": "設計可復原的事件中心", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", - "service": "VM", - "severity": "中等", - "text": "使用 Azure Arc 將 Azure Update Manager 用作 Azure 外部 Windows 和 Linux VM 的修補機制。", - "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", - "waf": "操作" + "checklist": "Redis Resiliency checklist", + "guid": "65285269-440b-44be-9d3e-0844276d4bdc", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", + "service": "Redis", + "severity": "高", + "text": "為 Azure Cache for Redis 啟用區域冗餘。Azure Cache for Redis 支持高級層和企業層中的區域冗餘配置。區域冗餘緩存可以將其節點放置在同一區域的不同 Azure 可用性區域中。它消除了作為單點故障的數據中心或可用區中斷，並提高了緩存的整體可用性。", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "90483845-c986-4cb2-a131-56a12476e49f", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Network Watcher", + "checklist": "Redis Resiliency checklist", + "guid": "bc178bdc-5a06-4ca7-8443-51e19dd34429", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", + "service": "Redis", "severity": "中等", - "text": "使用網路觀察程序主動監視流量", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "操作" + "text": "為 Azure Cache for Redis 實例配置數據持久性。由於緩存數據存儲在記憶體中，因此多個節點的罕見和計劃外故障可能會導致所有數據被丟棄。為了避免完全丟失數據，Redis 持久性允許您定期拍攝記憶體中數據的快照，並將其存儲到存儲帳戶中。", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Monitor", + "checklist": "Redis Resiliency checklist", + "guid": "eb722823-7a15-41c5-ab4e-4f1814387e5c", + "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", + "service": "Redis", "severity": "中等", - "text": "使用 Azure Monitor 紀錄獲取見解和報告。", - "waf": "操作" + "text": "使用異地冗餘存儲帳戶保留 Azure Cache for Redis 數據，或在異地冗餘不可用的情況下使用區域冗餘", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "97be9951-9048-4384-9c98-6cb2913156a1", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", - "service": "Monitor", + "checklist": "Redis Resiliency checklist", + "guid": "a8c26c9b-32ab-45bd-bc69-98a135e33789", + "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", + "service": "Redis", "severity": "中等", - "text": "使用 Azure Monitor 警報生成操作警報。", - "waf": "操作" + "text": "為高級 Azure Cache for Redis 實例配置被動異地複製。異地複製是一種用於連結兩個或多個 Azure Cache for Redis 實例的機制，通常跨越兩個 Azure 區域。異地複製主要用於跨區域災難恢復。兩個高級層緩存實例通過異地複製進行連接，從而提供對主緩存的讀取和寫入，並將數據複製到輔助緩存。", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "Monitor", - "severity": "中等", - "text": "通過 Azure 自動化帳戶使用更改和清單跟蹤時，請確保已選擇支援的區域來將 Log Analytics 工作區和自動化帳戶連結在一起。", - "waf": "操作" + "checklist": "Logic Apps checklist", + "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", + "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", + "service": "Logic Apps", + "severity": "高", + "text": "根據業務和 SLO 要求選擇正確的邏輯應用託管計劃", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", - "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", - "service": "Backup", - "severity": "中等", - "text": "使用 Azure 備份時，請考慮不同的備份類型（GRS、ZRS 和 LRS），因為預設設置為 GRS", + "checklist": "Logic Apps checklist", + "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", + "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", + "service": "Logic Apps", + "severity": "高", + "text": "使用區域冗餘和可用性區域保護邏輯應用免受區域故障的影響", "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "VM", - "severity": "中等", - "text": "使用 Azure 策略通過 VM 擴展自動部署軟體配置，並強制實施符合標準的基線 VM 配置。", - "waf": "安全" + "checklist": "Logic Apps checklist", + "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", + "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", + "service": "Logic Apps", + "severity": "高", + "text": "考慮為關鍵工作負載制定跨區域災難恢復策略", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "description": "Azure Policy 的來賓配置功能可以審核和修正計算機設置（例如，操作系統、應用程式、環境），以確保資源與預期配置一致，更新管理可以對 VM 強制實施修補程式管理。", - "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "VM", - "severity": "中等", - "text": "通過 Azure Policy 監視 VM 安全配置偏移。", - "waf": "安全" + "checklist": "Logic Apps checklist", + "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", + "link": "https://learn.microsoft.com/azure/app-service/environment/intro", + "service": "Logic Apps", + "severity": "高", + "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "VM", + "checklist": "Logic Apps checklist", + "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", + "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", + "service": "Logic Apps", "severity": "中等", - "text": "將 Azure Site Recovery 用於 Azure 到 Azure 虛擬機的災難恢復方案。這使您能夠跨區域複製工作負載。", + "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護邏輯應用代碼", "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "Backup", + "checklist": "Azure Bot Service", + "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", + "service": "Bot service", "severity": "中等", - "text": "使用 Azure 本機備份功能或與 Azure 相容的第三方備份解決方案。", - "waf": "操作" - }, - { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "VM", - "severity": "高", - "text": "在支援可用性區域的區域中對 VM 利用可用性區域。", + "text": "遵循 Azure 機器人服務中的可靠性支持建議", "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "VM", - "severity": "高", - "text": "避免在單個 VM 上運行生產工作負載。", + "checklist": "Azure Bot Service", + "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", + "service": "Bot service", + "severity": "中等", + "text": "部署具有本地數據駐留和區域合規性的機器人", "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "84101f59-1941-4195-a270-e28034290e3a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", + "checklist": "Azure Bot Service", + "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", + "service": "Bot service", "severity": "中等", - "text": "Azure 負載均衡器和應用程式閘道在多個資源之間分配傳入的網路流量。", + "text": "Azure 機器人服務在全域和區域服務的主動-主動模式下運行。發生中斷時，無需檢測錯誤或管理服務。Azure 機器人服務在多區域地理體系結構中自動執行自動故障轉移和自動恢復。對於歐盟機器人區域服務，Azure 機器人服務在歐洲境內提供兩個完整區域，並提供主動/主動複製，以確保冗餘。對於全球機器人服務，所有可用的區域/地理位置都可以作為全球足跡。", "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "WAF", - "severity": "高", - "text": "添加診斷設置以保存來自 Azure Front Door 和 Azure 應用程式閘道等應用程式交付服務的 WAF 紀錄。定期查看日誌，以檢查攻擊和誤報檢測。", - "waf": "操作" - }, - { - "checklist": "Azure Landing Zone Review", - "guid": "7f408960-c626-44cb-a018-347c8d790cdf", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "WAF", + "checklist": "Azure Application Delivery Networking", + "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Front Door", "severity": "中等", - "text": "將 WAF 日誌從應用程式交付服務（如 Azure Front Door 和 Azure 應用程式閘道）發送到 Microsoft Sentinel。檢測攻擊並將 WAF 遙測集成到整個 Azure 環境中。", + "text": "如果將客戶管理的 TLS 證書用於 Azure Front Door，請使用“最新”證書版本。降低手動續訂證書導致的中斷風險", "waf": "操作" }, { - "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "5017f154-e3ab-4369-9829-e7e316183687", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview", - "service": "Key Vault", - "severity": "高", - "text": "使用 Azure Key Vault 儲存機密和憑據", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", + "guid": "553585a6-abe0-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "App Gateway", + "severity": "中等", + "text": "確保使用應用程式閘道 v2 SKU", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", - "guid": "a0477a20-9945-4bda-9333-4f2491163418", - "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", - "service": "Key Vault", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", + "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Load Balancer", "severity": "中等", - "text": "對不同的應用程式和區域使用不同的 Azure Key Vault，以避免事務規模限制並限制對機密的訪問。", + "text": "確保將標準 SKU 用於 Azure 負載均衡器", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Azure Application Delivery Networking", + "guid": "9432621a-8397-4654-a882-5bc856b7ef83", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", + "service": "Load Balancer", "severity": "中等", - "text": "預配啟用軟刪除和清除策略的 Azure Key Vault，以允許對已刪除物件進行保留保護。", + "text": "確保負載均衡器前端IP位址是區域冗餘的（除非需要區域性前端）。", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "dc055bcf-619e-48a1-9f98-879525d62688", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "中等", - "text": "通過將永久刪除密鑰、機密和證書的授權限制為專用的自定義 Microsoft Entra ID 角色，遵循最低特權模型。", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", + "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "App Gateway", + "severity": "中等", + "text": "應用程式閘道 v2 應部署在IP前綴等於或大於 /24 的子網中", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Azure Application Delivery Networking", + "description": "一般而言，反向代理的管理，特別是 WAF 的管理更接近應用程式而不是網路，因此它們與應用程式屬於同一訂閱。如果應用程式閘道和 WAF 由單個團隊管理，則在連接訂閱中集中應用程式閘道和 WAF 可能是可以的。", + "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "severity": "中等", - "text": "使用公共證書頒發機構自動執行證書管理和續訂過程，以簡化管理。", + "text": "部署 Azure 應用程式閘道 v2 或合作夥伴 NVA，用於在登陸區域虛擬網路中代理入站 HTTP（S） 連接，並使用它們所保護的應用。", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "913156a1-2476-4e49-b541-acdce979377b", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Azure Application Delivery Networking", + "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "App Gateway", "severity": "中等", - "text": "建立金鑰和證書輪換的自動化流程。", + "text": "對應用程式登陸區域中的所有公共IP位址使用 DDoS 網路或IP保護計畫。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", + "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", + "service": "App Gateway", "severity": "中等", - "text": "在保管庫上啟用防火牆和虛擬網路服務終結點或專用終結點，以控制對密鑰保管庫的訪問。", - "waf": "安全" + "text": "使用至少兩個實例數配置自動縮放。", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", - "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", - "service": "Key Vault", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", + "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", + "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", + "service": "App Gateway", "severity": "中等", - "text": "使用平臺中心 Azure Monitor Log Analytics 工作區審核每個 Key Vault 實例中的金鑰、證書和機密使用方式。", - "waf": "安全" + "text": "跨可用性區域部署應用程式閘道", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Azure Application Delivery Networking", + "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Front Door", "severity": "中等", - "text": "委託 Key Vault 實例化和特權訪問，並使用 Azure Policy 強制實施一致的合規配置。", + "text": "將 Azure Front Door 與 WAF 策略配合使用，以交付和幫助保護跨多個 Azure 區域的全域 HTTP/S 應用。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "91163418-2ba5-4275-8694-4008be7d7e48", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", + "checklist": "Azure Application Delivery Networking", + "guid": "3f29812b-2363-4cef-b179-b599de0d5973", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "Front Door", "severity": "中等", - "text": "對每個應用程式、每個環境、每個區域使用 Azure Key Vault。", + "text": "使用 Front Door 和應用程式閘道幫助保護 HTTP/S 應用時，請在 Front Door 中使用 WAF 策略。鎖定應用程式閘道以僅接收來自 Front Door 的流量。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "25d62688-6d70-4ba6-a97b-e99519048384", - "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", - "service": "Key Vault", - "severity": "中等", - "text": "如果要自帶密鑰，則並非所有考慮的服務都支援此功能。實施相關的緩解措施，以免不一致阻礙預期結果。選擇適當的區域對和災難恢復區域，以最大程度地減少延遲。", - "waf": "安全" + "ammp": true, + "arm-service": "microsoft.network/trafficManagerProfiles", + "checklist": "Azure Application Delivery Networking", + "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "Traffic Manager", + "severity": "高", + "text": "使用流量管理器提供跨 HTTP/S 以外的協定的全域應用。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", - "link": "https://learn.microsoft.com/industry/sovereignty/key-management", - "service": "Key Vault", - "severity": "中等", - "text": "對於主權登陸區域，請使用 Azure Key Vault 託管的 HSM 來儲存機密和憑據。", + "checklist": "Azure Application Delivery Networking", + "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "Entra", + "severity": "低", + "text": "如果使用者只需要訪問內部應用程式，是否考慮將 Microsoft Entra ID 應用程式代理作為 Azure 虛擬桌面 （AVD） 的替代方法？", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", - "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", + "checklist": "Azure Application Delivery Networking", + "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", "service": "Entra", "severity": "中等", - "text": "使用 Microsoft Entra ID 報告功能生成訪問控制審核報告。", + "text": "若要減少為網路中的傳入連接打開的防火牆埠數，請考慮使用 Microsoft Entra ID 應用程式代理為遠端使用者提供對內部應用程式的安全且經過身份驗證的訪問。", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", "waf": "安全" }, { "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "09945bda-4333-44f2-9911-634182ba5275", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", - "service": "Defender", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "ae248989-b306-4591-9186-de482e3f0f0e", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "Front Door", "severity": "高", - "text": "為所有訂閱啟用Defender雲安全態勢管理。", + "text": "在「預防」模式下部署 Front Door 的 WAF 策略。", "waf": "安全" }, { "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", - "service": "Defender", + "checklist": "Azure Application Delivery Networking", + "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", + "service": "Front Door", "severity": "高", - "text": "在所有訂閱上為伺服器啟用Defender雲工作負載保護計劃。", + "text": "避免將 Azure 流量管理器和 Azure Front Door 結合使用。", "waf": "安全" }, { "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", - "service": "Defender", + "checklist": "Azure Application Delivery Networking", + "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", + "service": "Front Door", "severity": "高", - "text": "在所有訂閱上為 Azure 資源啟用 Defender 雲工作負載保護計劃。", + "text": "在 Azure Front Door 和源上使用相同的功能變數名稱。主機名不匹配可能會導致細微的錯誤。", "waf": "安全" }, + { + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", + "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", + "service": "Front Door", + "severity": "低", + "text": "當 Azure Front Door 源組中只有一個源時，禁用運行狀況探測。", + "waf": "性能" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", + "service": "Front Door", + "severity": "中等", + "text": "為 Azure Front Door 選擇良好的運行狀況探測終結點。請考慮構建運行狀況終結點，以檢查應用程式的所有依賴項。", + "waf": "可靠性" + }, + { + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", + "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", + "service": "Front Door", + "severity": "低", + "text": "將 HEAD 運行狀況探測與 Azure Front Door 配合使用，以減少 Front Door 發送到應用程式的流量。", + "waf": "性能" + }, { "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", - "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", - "service": "VM", + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", + "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", + "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", + "service": "Load Balancer", "severity": "高", - "text": "在 IaaS 伺服器上啟用 Endpoint Protection。", - "waf": "安全" + "text": "使用 Azure NAT 閘道而不是負載均衡器出站規則，以獲得更好的 SNAT 可伸縮性", + "waf": "可靠性" }, { - "checklist": "Azure Landing Zone Review", - "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", - "link": "https://learn.microsoft.com/azure/security-center/", - "service": "VM", - "severity": "中等", - "text": "通過 Azure Monitor 紀錄和 Defender for Cloud 監視基本作業系統修補偏移。", - "waf": "安全" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", + "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", + "service": "Front Door", + "severity": "高", + "text": "將託管 TLS 證書與 Azure Front Door 配合使用。降低運營成本和因證書續訂而導致的中斷風險。", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Monitor", + "checklist": "Azure Application Delivery Networking", + "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", + "service": "Front Door", "severity": "中等", - "text": "將預設資源配置連接到集中式 Azure Monitor Log Analytics 工作區。", - "waf": "安全" + "text": "將 Azure Front Door WAF 配置定義為代碼。通過使用代碼，您可以更輕鬆地採用新的規則集版本並獲得額外的保護。", + "waf": "操作" }, { - "checklist": "Azure Landing Zone Review", - "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", - "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", - "service": "Entra", - "severity": "中等", - "text": "對於主權登陸區域，在 Entra ID 租戶上啟用透明日誌。", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", + "service": "Front Door", + "severity": "高", + "text": "將端到端 TLS 與 Azure Front Door 配合使用。使用 TLS 進行從用戶端到 Front Door 的連接，以及從 Front Door 到源的連接。", "waf": "安全" }, { - "checklist": "Azure Landing Zone Review", - "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", - "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", - "service": "Entra", + "checklist": "Azure Application Delivery Networking", + "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", + "service": "Front Door", "severity": "中等", - "text": "對於 Sovereign Landing Zone，在 Entra ID 租戶上啟用了客戶密碼箱。", + "text": "將 HTTP 到 HTTPS 重定向與 Azure Front Door 配合使用。通過自動將較舊的用戶端重定向到 HTTPS 請求來支援它們。", "waf": "安全" }, { "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Storage", + "checklist": "Azure Application Delivery Networking", + "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", + "service": "Front Door", "severity": "高", - "text": "應啟用安全傳輸到存儲帳戶", + "text": "啟用 Azure Front Door WAF。保護您的應用程式免受一系列攻擊。", "waf": "安全" }, { "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", - "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", - "service": "Storage", + "checklist": "Azure Application Delivery Networking", + "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", + "service": "Front Door", "severity": "高", - "text": "為存儲帳戶啟用容器軟刪除，以恢復已刪除的容器及其內容。", + "text": "針對工作負載優化 Azure Front Door WAF。減少誤報檢測。", "waf": "安全" }, { "ammp": true, - "checklist": "Azure Landing Zone Review", - "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", - "service": "Key Vault", - "severity": "高", - "text": "使用 Key Vault 機密可避免對敏感資訊（如憑據（虛擬機器用戶密碼）、證書或密鑰）進行硬編碼。", - "waf": "操作" - }, - { - "checklist": "Azure App Service Review", - "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", - "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", - "service": "App Services", - "severity": "低", - "text": "有關最佳實踐，請參閱基線高可用性區域冗餘 Web 應用程式體系結構", - "waf": "可靠性" - }, - { - "checklist": "Azure App Service Review", - "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", - "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", - "service": "App Services", - "severity": "中等", - "text": "使用高級層和標準層。這些層支援暫存槽和自動備份。", - "waf": "可靠性" - }, - { - "checklist": "Azure App Service Review", - "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", - "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "Front Door", "severity": "高", - "text": "利用區域適用的可用性區域（需要高級 v2 或 v3 層）", - "waf": "可靠性" - }, - { - "checklist": "Azure App Service Review", - "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", - "severity": "中等", - "text": "實施健康檢查", - "waf": "可靠性" + "text": "啟用在 Azure Front Door WAF 策略中啟用的請求正文檢查功能。", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", - "service": "App Services", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", + "service": "Front Door", "severity": "高", - "text": "請參閱 Azure 應用服務的備份和還原最佳做法", - "waf": "可靠性" + "text": "啟用 Azure Front Door WAF 預設規則集。默認規則集檢測並阻止常見攻擊。", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", - "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", - "service": "App Services", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", + "service": "Front Door", "severity": "高", - "text": "實現 Azure 應用服務可靠性最佳做法", - "waf": "可靠性" + "text": "啟用 Azure Front Door WAF 機器人保護規則集。機器人規則檢測好的和壞的機器人。", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", - "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", - "service": "App Services", - "severity": "低", - "text": "熟悉如何在災難期間將應用服務應用移動到另一個區域", - "waf": "可靠性" + "checklist": "Azure Application Delivery Networking", + "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", + "service": "Front Door", + "severity": "中等", + "text": "使用最新的 Azure Front Door WAF 規則集版本。規則集更新會定期更新，以考慮當前的威脅形勢。", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", - "service": "App Services", - "severity": "高", - "text": "熟悉 Azure 應用服務中的可靠性支援", - "waf": "可靠性" + "checklist": "Azure Application Delivery Networking", + "guid": "b9620385-1cde-418f-914b-a84a06982ffc", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", + "service": "Front Door", + "severity": "中等", + "text": "向 Azure Front Door WAF 添加速率限制。速率限制會阻止客戶端在短時間內意外或有意發送大量流量。", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", + "service": "Front Door", "severity": "中等", - "text": "確保為在應用服務計劃上運行的函數應用啟用“Always On”", - "waf": "可靠性" + "text": "對 Azure Front Door WAF 速率限制使用高閾值。高速率限制閾值可避免阻止合法流量，同時仍可針對可能使基礎結構不堪重負的大量請求提供保護。", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", - "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", - "service": "App Services", - "severity": "中等", - "text": "使用運行狀況檢查監視應用服務實例", - "waf": "可靠性" + "checklist": "Azure Application Delivery Networking", + "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", + "service": "Front Door", + "severity": "低", + "text": "如果您不希望收到來自所有地理區域的流量，請使用地理篩選器來阻止來自非預期國家/地區的流量。", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "00acd8a9-6975-414f-8491-2be6309893b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", + "service": "Front Door", "severity": "中等", - "text": "使用 Application Insights 可用性測試監視 Web 應用或網站的可用性和回應能力", - "waf": "可靠性" + "text": "使用 Azure Front Door WAF 對流量進行地理篩選時，請指定未知 （ZZ） 位置。避免在IP位址無法進行地理匹配時意外阻止合法請求。", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", - "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", - "service": "App Services", - "severity": "低", - "text": "使用 Application Insights 標準測試監視 Web 應用或網站的可用性和回應能力", - "waf": "可靠性" + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", + "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", + "service": "App Gateway", + "severity": "高", + "text": "啟用 Azure 應用程式閘道 WAF 機器人保護規則集 機器人規則可檢測好機器人和壞機器人。", + "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "使用 Azure Key Vault 儲存應用程式所需的任何機密。 Key Vault 為儲存機密提供安全且經過審核的環境，並通過 Key Vault SDK 或應用服務 Key Vault 引用與應用服務很好地集成。", - "guid": "834ac932-223e-4ce8-8b12-3071a5416415", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", + "service": "App Gateway", "severity": "高", - "text": "使用 Key Vault 儲存機密", + "text": "啟用 Azure 應用程式閘道 WAF 策略中啟用的請求正文檢查功能。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "使用託管標識通過 Key Vault SDK 或透過應用服務 Key Vault 引用連接到 Key Vault。", - "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", - "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", - "service": "App Services", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", + "service": "App Gateway", "severity": "高", - "text": "使用託管標識連接到 Key VaultUse Managed Identity to connect to Key Vault", + "text": "針對工作負載優化 Azure 應用程式閘道 WAF。減少誤報檢測。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "將應用服務 TLS 證書存儲在 Key Vault 中。", - "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", - "service": "App Services", + "ammp": true, + "checklist": "Azure Application Delivery Networking", + "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", + "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", + "service": "App Gateway", "severity": "高", - "text": "使用 Key Vault 儲存 TLS 證書。", + "text": "在「防護」模式下部署應用程式閘道的 WAF 策略。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "處理敏感信息的系統應隔離。 為此，請使用單獨的應用服務計劃或應用服務環境，並考慮使用不同的訂閱或管理組。", - "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", - "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", + "service": "App Gateway", "severity": "中等", - "text": "隔離處理敏感信息的系統", + "text": "向 Azure 應用程式閘道 WAF 添加速率限制。速率限制會阻止客戶端在短時間內意外或有意發送大量流量。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "應用服務上的本地磁碟未加密，敏感數據不應存儲在這些磁碟上。 （例如：D：\\\\Local 和 %TMP%）。", - "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", + "service": "App Gateway", "severity": "中等", - "text": "不要將敏感數據存儲在本地磁碟上", + "text": "對 Azure 應用程式閘道 WAF 速率限制使用高閾值。高速率限制閾值可避免阻止合法流量，同時仍可針對可能使基礎結構不堪重負的大量請求提供保護。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "對於經過身份驗證的 Web 應用程式，請使用成熟的標識提供者，例如 Azure AD 或 Azure AD B2C。 利用所選的應用程式框架與此提供程式整合，或使用應用服務身份驗證/授權功能。", - "guid": "919ca0b2-c121-459e-814b-933df574eccc", - "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "99937189-ff78-492a-b9ca-18d828d82b37", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", + "service": "App Gateway", + "severity": "低", + "text": "如果您不希望收到來自所有地理區域的流量，請使用地理篩選器來阻止來自非預期國家/地區的流量。", + "waf": "安全" + }, + { + "checklist": "Azure Application Delivery Networking", + "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", + "service": "App Gateway", "severity": "中等", - "text": "使用已建立的身份提供程式進行身份驗證", + "text": "使用 Azure 應用程式閘道 WAF 對流量進行地理篩選時，請指定未知 （ZZ） 位置。避免在IP位址無法進行地理匹配時意外阻止合法請求。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "將代碼從受控且受信任的環境（例如管理良好且安全的 DevOps 部署管道）部署到應用服務。這樣可以避免未經版本控制和驗證從惡意主機部署的代碼。", - "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", - "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", - "service": "App Services", - "severity": "高", - "text": "從受信任的環境部署", + "checklist": "Azure Application Delivery Networking", + "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", + "service": "App Gateway", + "severity": "中等", + "text": "使用最新的 Azure 應用程式閘道 WAF 規則集版本。規則集更新會定期更新，以考慮當前的威脅形勢。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "禁用 FTP/FTPS 和 WebDeploy/SCM 的基本身份驗證。 這將禁止訪問這些服務，並強制使用 Azure AD 安全終結點進行部署。 請注意，還可以使用 Azure AD 憑據打開 SCM 網站。", - "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", - "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", - "service": "App Services", - "severity": "高", - "text": "禁用基本身份驗證", - "waf": "安全" + "checklist": "Azure Application Delivery Networking", + "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "App Gateway", + "severity": "中等", + "text": "添加診斷設置以保存 Azure 應用程式閘道 WAF 紀錄。", + "waf": "操作" }, { - "checklist": "Azure App Service Review", - "description": "如果可能，請使用託管標識連接到 Azure AD 受保護的資源。 如果無法做到這一點，請將機密存儲在 Key Vault 中，並改用託管標識連接到 Key Vault。", - "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", - "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", - "service": "App Services", - "severity": "高", - "text": "使用託管標識連接到資源", - "waf": "安全" + "checklist": "Azure Application Delivery Networking", + "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "Front Door", + "severity": "中等", + "text": "添加診斷設置以保存 Azure Front Door WAF 紀錄。", + "waf": "操作" }, { - "checklist": "Azure App Service Review", - "description": "如果使用 Azure 容器註冊表中儲存的映像，請使用託管標識拉取這些映像。", - "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", - "service": "App Services", - "severity": "高", - "text": "使用託管標識拉取容器", - "waf": "安全" + "checklist": "Azure Application Delivery Networking", + "guid": "92664c60-47e3-4591-8b1b-8d557656e686", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", + "service": "App Gateway", + "severity": "中等", + "text": "將 Azure 應用程式閘道 WAF 紀錄發送到 Microsoft Sentinel。", + "waf": "操作" }, { - "checklist": "Azure App Service Review", - "description": "通過配置應用服務的診斷設置，可以將所有遙測數據發送到Log Analytics，作為日誌記錄和監視的中心目標。這允許你監視應用服務的運行時活動，例如 HTTP 日誌、應用程式日誌、平臺日誌等。", - "guid": "47768314-c115-4775-a2ea-55b46ad48408", - "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "845f5f91-9c21-4674-a725-5ce890850e20", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "Front Door", "severity": "中等", - "text": "將應用服務運行時日誌發送到Log Analytics", - "waf": "安全" + "text": "將 Azure Front Door WAF 日誌發送到 Microsoft Sentinel。", + "waf": "操作" }, { - "checklist": "Azure App Service Review", - "description": "設置診斷設置，將活動日誌發送到Log Analytics，作為日誌記錄和監視的中心目標。這樣，你就可以監視應用服務資源本身上的控制平面活動。", - "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", - "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", + "service": "App Gateway", "severity": "中等", - "text": "將應用服務活動日誌發送到Log Analytics", - "waf": "安全" + "text": "將 Azure 應用程式閘道 WAF 設定定義為代碼。通過使用代碼，您可以更輕鬆地採用新的規則集版本並獲得額外的保護。", + "waf": "操作" }, { - "checklist": "Azure App Service Review", - "description": "使用區域 VNet 集成、網路安全組和 UDR 的組合來控制出站網路訪問。 流量應路由到 NVA，例如 Azure 防火牆。 確保監控防火牆的日誌。", - "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", - "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", + "service": "App Gateway", "severity": "中等", - "text": "應控制出站網路訪問", - "waf": "安全" + "text": "使用 WAF 策略而不是舊版 WAF 配置。", + "waf": "操作" }, { - "checklist": "Azure App Service Review", - "description": "可以使用 VNet 集成並使用 VNet NAT 閘道或 NVA（如 Azure 防火牆）來提供穩定的出站 IP。 這允許接收方根據需要根據IP列出允許清單。 請注意，對於與 Azure 服務的通信，通常不需要依賴於 IP 位址，應改用服務終結點等機制。 （此外，在接收端使用專用終結點可避免發生 SNAT，並提供穩定的出站 IP 範圍。", - "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", - "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", - "service": "App Services", - "severity": "低", - "text": "確保與互聯網位址的出站通信具有穩定的IP", + "checklist": "Azure Application Delivery Networking", + "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", + "service": "App Gateway", + "severity": "中等", + "text": "篩選後端中的入站流量，以便它們僅接受來自應用程式閘道子網的連接，例如使用NSG。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "使用應用服務訪問限制、服務終結點或專用終結點的組合來控制入站網路訪問。對於 Web 應用本身和 SCM 網站，可能需要和配置不同的訪問限制。", - "guid": "0725769e-e669-41a4-a34a-c932223ece80", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", - "severity": "高", - "text": "應控制入站網路訪問", + "checklist": "Azure Application Delivery Networking", + "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", + "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", + "service": "Front Door", + "severity": "中等", + "text": "確保源僅從 Azure Front Door 實例獲取流量。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "使用 Web 應用程式防火牆（如應用程式閘道或 Azure Front Door）防範惡意入站流量。 請務必監控 WAF 的日誌。", - "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", - "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", + "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", + "service": "App Gateway", "severity": "高", - "text": "在應用服務前面使用 WAF", + "text": "您應該對發往後端伺服器的流量進行加密。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "確保僅鎖定對 WAF 的訪問，從而無法繞過 WAF。 結合使用訪問限制、服務終結點和專用終結點。", - "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", - "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", + "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", + "service": "App Gateway", "severity": "高", - "text": "避免繞過 WAF", + "text": "您應該使用 Web 應用程式防火牆。", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "在應用服務配置中將最低 TLS 策略設置為 1.2。", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", - "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", + "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", + "service": "App Gateway", "severity": "中等", - "text": "將最低 TLS 策略設置為 1.2", + "text": "將 HTTP 重定向到 HTTPS", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "將應用服務配置為僅使用 HTTPS。 這會導致應用服務從 HTTP 重定向到 HTTPS。 強烈建議在代碼或 WAF 中使用 HTTP 嚴格傳輸安全性 （HSTS），這會通知瀏覽器只能使用 HTTPS 訪問網站。", - "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", - "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", - "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", - "service": "App Services", - "severity": "高", - "text": "僅使用 HTTPS", - "waf": "安全" + "checklist": "Azure Application Delivery Networking", + "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", + "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", + "service": "App Gateway", + "severity": "中等", + "text": "使用閘道管理的 Cookie 將流量從使用者工作階段定向到同一伺服器進行處理", + "waf": "操作" }, { - "checklist": "Azure App Service Review", - "description": "不要在 CORS 配置中使用通配符，因為這允許所有源訪問服務（從而破壞 CORS 的目的）。具體而言，僅允許您希望能夠訪問服務的源。", - "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", - "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", + "service": "App Gateway", "severity": "高", - "text": "不得將通配符用於 CORS", + "text": "在計劃的服務更新期間啟用連接耗盡，以防止與後端池的現有 membr 的連接丟失", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "不得在生產環境中啟用遠端調試，因為這會在服務上打開其他埠，從而增加攻擊面。請注意，該服務會在 48 小時後自動轉為遠端調試。", - "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", - "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", - "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", - "service": "App Services", - "severity": "高", - "text": "關閉遠端調試", - "waf": "安全" + "checklist": "Azure Application Delivery Networking", + "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", + "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", + "service": "App Gateway", + "severity": "低", + "text": "創建自訂錯誤頁面以顯示個人化的用戶體驗", + "waf": "操作" }, { - "checklist": "Azure App Service Review", - "description": "啟用 Defender for App Service。 這（除其他威脅外）檢測與已知惡意IP位址的通信。 在操作過程中查看 Defender for App Service 中的建議。", - "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", + "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", + "service": "App Gateway", "severity": "中等", - "text": "啟用 Defender for Cloud - Defender for App Service", + "text": "編輯 HTTP 請求和回應標頭，以便更輕鬆地在用戶端和伺服器之間進行路由和資訊交換", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "Azure 在其網路上提供 DDoS 基本保護，可以通過智慧 DDoS 標準功能進行改進，該功能可以瞭解正常的流量模式並檢測異常行為。DDoS 標準適用於虛擬網路，因此必須為應用前面的網路資源（例如應用程式閘道或 NVA）配置它。", - "guid": "223ece80-b123-4071-a541-6415833ea3ad", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", + "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", + "service": "App Gateway", "severity": "中等", - "text": "在 WAF VNet 上啟用 DDOS 保護標準", - "waf": "安全" + "text": "配置 Front Door，通過快速全域故障轉移優化全球 Web 流量路由和頂級最終使用者性能和可靠性", + "waf": "性能" }, { - "checklist": "Azure App Service Review", - "description": "如果使用 Azure 容器註冊表中儲存的映像，請使用其專用終結點和應用設置“WEBSITE_PULL_IMAGE_OVER_VNET”通過虛擬網络從 Azure 容器註冊表拉取這些映射。", - "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", - "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "29dcc19f-a8fa-4c35-8281-290577538793", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "App Gateway", "severity": "中等", - "text": "通過虛擬網路拉取容器", - "waf": "安全" + "text": "使用傳輸層負載平衡", + "waf": "性能" }, { - "checklist": "Azure App Service Review", - "description": "按照參與的滲透測試規則對 Web 應用程式進行滲透測試。", - "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", - "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", + "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", + "service": "App Gateway", "severity": "中等", - "text": "進行滲透測試", + "text": "根據主機名或域名為單個閘道上的多個 Web 應用程式配置路由", "waf": "安全" }, { - "checklist": "Azure App Service Review", - "description": "部署根據 DevSecOps 實踐驗證和掃描漏洞的受信任代碼。", - "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", - "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", - "service": "App Services", + "checklist": "Azure Application Delivery Networking", + "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", + "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", + "service": "App Gateway", "severity": "中等", - "text": "部署經過驗證的代碼", - "waf": "安全" - }, - { - "checklist": "Azure App Service Review", - "description": "使用最新版本的受支援平臺、程式設計語言、協定和框架。", - "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", - "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", - "service": "App Services", - "severity": "高", - "text": "使用最新的平臺、語言、協定和框架", + "text": "集中管理 SSL 證書，以減少後端伺服器場的加密和解密開銷", "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", - "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", - "service": "Azure Monitor", - "text": "Azure Monitor 中的數據收集規則 -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "成本" + "checklist": "Azure Application Delivery Networking", + "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", + "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", + "service": "App Gateway", + "severity": "低", + "text": "使用應用程式閘道對 WebSocket 和 HTTP/2 協定提供本機支援", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "45901365-d38e-443f-abcb-d868266abca2", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", - "service": "Azure Backup", - "text": "檢查未找到底層數據源的備份實例", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", + "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", + "service": "APIM", + "severity": "中等", + "text": "在全域級別實施錯誤處理策略", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", - "service": "VM", - "text": "刪除或存檔未關聯的服務（磁碟、網卡、IP 位址等）", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", + "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", + "service": "APIM", + "severity": "中等", + "text": "確保所有 API 策略都包含一個元素。", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", - "service": "Azure Backup", - "text": "考慮在網站恢復存儲和非任務關鍵型應用程式的備份之間取得良好的平衡", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", + "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", + "service": "APIM", + "severity": "中等", + "text": "使用策略片段可避免在多個 API 中重複相同的策略定義", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", - "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", - "service": "Azure Monitor", - "text": "檢查 40 個不同 Log Analytics 工作區之間的支出和節省機會 - 對非生產工作區使用不同的保留和數據收集 - 創建每日上限以實現意識和層大小調整 - 如果確實設置了每日上限，除了在達到上限時創建警報外，請確保還創建警報規則，以便在達到某個百分比（例如 90%）時收到通知。- 如果可能，考慮工作空間改造 - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", + "link": "https://learn.microsoft.com/azure/api-management/monetization-support", + "service": "APIM", + "severity": "中等", + "text": "如果您計劃通過 API 獲利，請查看“獲利支援”一文，瞭解最佳做法", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Azure Monitor", - "text": "強制執行清除日誌策略和自動化（如果需要，可以將記錄移至冷存儲）", - "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", + "service": "APIM", + "severity": "高", + "text": "啟用診斷設置以將日誌導出到 Azure Monitor", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "VM", - "text": "檢查磁碟是否確實需要，如果不是：刪除。如果需要，請尋找較低的儲存層或使用備份 -", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", + "service": "APIM", + "severity": "中等", + "text": "啟用 Application Insights 以獲取更詳細的遙測數據", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d1e44a19-659d-4395-afd7-7289b835556d", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", - "service": "Storage", - "text": "考慮使用自定義規則將未使用的存儲移動到較低層 - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure", - "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", + "service": "APIM", + "severity": "高", + "text": "針對最關鍵的指標配置警報", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "VM", - "text": "確保 advisor 配置為適合 VM 大小調整", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", + "service": "APIM", + "severity": "高", + "text": "確保自定義 SSL 證書儲存在 Azure Key Vault 中，以便可以安全地訪問和更新它們", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "description": "通過在成本分析系統中搜索計量類別許可證進行檢查", - "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", - "service": "VM", - "text": "在所有 Windows VM 上運行腳本 https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server - 如果頻繁創建 Windows VM，請考慮實施策略", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", + "service": "APIM", + "severity": "高", + "text": "使用 Azure AD 保護對 API（數據平面）的傳入請求", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", - "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", - "service": "VM", - "text": "如果您已經擁有許可證，也可以將其置於 AHUB https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", + "service": "APIM", + "severity": "中等", + "text": "使用 Microsoft Entra ID 在開發人員門戶中對用戶進行身份驗證", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", - "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", - "service": "VM", - "text": "使用靈活性選項（不超過 4-5 個系列）整合保留的 VM 系列", - "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", + "service": "APIM", + "severity": "中等", + "text": "創建適當的組來控制產品的可見性", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", - "service": "VM", - "text": "利用 Azure 預留實例：此功能允許將 VM 預留 1 年或 3 年，與 PAYG 價格相比，可顯著節省成本。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "06862505-2d9a-4874-9491-2837b00a3475", + "link": "https://learn.microsoft.com/azure/api-management/backends", + "service": "APIM", + "severity": "中等", + "text": "使用後端功能消除冗餘 API 後端配置", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", - "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", - "service": "VM", - "text": "只能保留較大的磁碟 => 1 TiB -", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", + "service": "APIM", + "severity": "中等", + "text": "使用命名值存儲可在策略中使用的通用值", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", - "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", - "service": "VM", - "text": "調整大小優化后", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", + "service": "APIM", + "severity": "中等", + "text": "對於DR，利用高級層，跨兩個或多個區域擴展部署，實現99.99%的SLA", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", - "service": "Azure SQL", - "text": "檢查是否適用並強制執行策略/更改 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", + "link": "https://learn.microsoft.com/azure/api-management/high-availability", + "service": "APIM", + "severity": "中等", + "text": "在兩個或多個可用區中部署至少一台設備，SLA 提高 99.99%", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", - "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", - "service": "VM", - "text": "虛擬機 + 許可證部分折扣 （ahub + 3YRI） 約為 70% 的折扣", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", + "service": "APIM", + "severity": "高", + "text": "確保有一個自動備份例程", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "VM", - "text": "考慮使用 VMSS 來滿足需求，而不是按比例調整", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", + "link": "https://learn.microsoft.com/azure/api-management/retry-policy", + "service": "APIM", + "severity": "中等", + "text": "使用策略添加故障轉移後端 URL 和緩存，以減少失敗的調用。", + "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Cost Optimization Checklist", - "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", - "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", - "service": "AKS", - "text": "使用 AKS 自動縮放程式符合群集使用方式（確保 Pod 要求與縮放程式符合）", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", + "service": "APIM", + "severity": "低", + "text": "如果需要以高性能級別進行日誌記錄，請考慮事件中心策略", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", - "service": "Azure Backup", - "text": "將恢復點移至保管庫存檔（如果適用）（驗證）", - "training": "https://azure.microsoft.com/pricing/reservations/", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", + "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", + "service": "APIM", + "severity": "中等", + "text": "應用限制策略來控制每秒的請求數", + "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", + "waf": "性能" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", - "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", - "service": "Databricks", - "text": "請考慮盡可能使用帶回退功能的現成 VM。考慮群集的自動終止。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", + "service": "APIM", + "severity": "中等", + "text": "配置自動縮放以在負載增加時橫向擴展實例數", + "waf": "性能" }, { - "checklist": "Cost Optimization Checklist", - "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", - "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", - "service": "Azure Functions", - "text": "功能 - 重用連接", - "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", + "service": "APIM", + "severity": "中等", + "text": "在 Azure 沒有靠近後端 API 的區域的地方部署自承載閘道。", + "waf": "性能" }, { - "checklist": "Cost Optimization Checklist", - "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", - "link": "https://learn.microsoft.com/azure/automation/update-management/overview", - "service": "Azure Functions", - "text": "函數 - 本地快取資料", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", + "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", + "service": "APIM", + "severity": "中等", + "text": "將高級層用於生產工作負載。", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", - "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", - "service": "Azure Functions", - "text": "函數 - 冷啟動 - 使用“從包運行”功能。這樣，代碼將下載為單個 zip 檔。例如，這可以顯著改進具有大量節點模組的 Javascript 函數。使用特定於語言的工具來減小包大小，例如，搖樹 Javascript 應用程式。", - "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", + "service": "APIM", + "severity": "中等", + "text": "在多區域模型中，使用策略根據可用性或延遲將請求路由到區域後端。", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", - "service": "Azure Functions", - "text": "功能 - 保持功能溫暖", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", + "service": "APIM", + "severity": "高", + "text": "注意APIM的局限性", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", - "link": "https://learn.microsoft.com/azure/governance/policy/overview", - "service": "Azure Functions", - "text": "使用具有不同功能的自動縮放時，可能會有一個資源驅動所有資源的所有自動縮放 - 請考慮將其移動到單獨的消耗計劃（並考慮更高的 CPU 計劃）", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", + "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", + "service": "APIM", + "severity": "高", + "text": "確保自承載閘道部署具有復原能力。", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", - "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", - "service": "Azure Functions", - "text": "給定計劃中的函數應用都縮放在一起，因此縮放的任何問題都可能影響計劃中的所有應用。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "7519e385-a88b-4d34-966b-6269d686e890", + "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", + "service": "APIM", + "severity": "中等", + "text": "在APIM前面使用 Azure Front Door 進行多區域部署", + "waf": "性能" }, { - "checklist": "Cost Optimization Checklist", - "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", - "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", - "service": "Azure Functions", - "text": "我需要為「等待時間」付費嗎？這個問題通常是在執行異步操作並等待結果的 C# 函數的上下文中提出的，例如 await Task.Delay（1000） 或 await client。GetAsync（'http：//google.com'）。答案是肯定的 - GB 秒計算基於函數的開始和結束時間以及該時間段內的記憶體使用方式。在這段時間內實際發生的CPU活動未計入計算。此規則的一個例外是，如果使用的是持久函數。您無需為在業務流程協調程式函數中等待所花費的時間付費。在可能的情況下應用需求塑造技術（開發環境？）https://github.com/Azure-Samples/functions-csharp-premium-scaler", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "cd45c90e-7690-4753-930b-bf290c69c074", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", + "service": "APIM", + "severity": "中等", + "text": "在虛擬網络 （VNet） 中部署服務Deploy the service within a Virtual Network （VNet）", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", - "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", - "service": "Front Door", - "text": "Frontdoor - 關閉預設主頁在應用的應用程式設置中，將 AzureWebJobsDisableHomepage 設置為 true。這將向PoP返回204（無內容），因此僅返回標頭數據。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", + "service": "APIM", + "severity": "中等", + "text": "將網路安全組 （NSG） 部署到子網，以限制或監視進出APIM的流量。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", - "service": "Front Door", - "text": "Frontdoor - 路由到不返回任何內容的內容。設置函數、函數代理，或在 WebApp 中添加返回 200 （OK） 且不發送內容或發送最少內容的路由。這樣做的好處是您可以在調用時註銷。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", + "service": "APIM", + "severity": "中等", + "text": "部署專用終結點以在未將APIM部署到 VNet 時篩選傳入流量。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", - "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", - "service": "Storage", - "text": "考慮為使用較少的數據存檔層", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", + "service": "APIM", + "severity": "高", + "text": "禁用公網訪問", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", - "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", - "service": "VM", - "text": "檢查大小與層不匹配的磁碟大小（即 513 GiB 磁碟將支付 P30 （1TiB） 並考慮調整大小", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", + "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", + "service": "APIM", + "severity": "中等", + "text": "使用 PowerShell 自動化腳本簡化管理", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", - "service": "Storage", - "text": "盡可能考慮使用標準 SSD，而不是 Premium 或 Ultra", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", + "service": "APIM", + "severity": "中等", + "text": "通過基礎架構即代碼配置APIM。查看 Cloud Adaption Framework 中的 DevOps 最佳實踐 APIM 登陸區域加速器", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", - "service": "Storage", - "text": "對於存儲帳戶，請確保所選層不會增加事務費用（移動到下一層可能會更便宜）", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", + "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", + "service": "APIM", + "severity": "中等", + "text": "促進 Visual Studio Code APIM 擴展的使用，以加快 API 開發速度", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", - "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", - "service": "Site Recovery", - "text": "對於 ASR，如果 RPO/RTO 和複製輸送量允許，請考慮使用標準 SSD 磁碟", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "354f1c03-8112-4965-85ad-c0074bddf231", + "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", + "service": "APIM", + "severity": "中等", + "text": "在工作流中實施DevOps和 CI/CD", + "waf": "操作" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", - "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", - "service": "Storage", - "text": "存儲帳戶：檢查熱層和/或 GRS 必填", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "b6439493-426a-45f3-9697-cf65baee208d", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", + "service": "APIM", + "severity": "中等", + "text": "使用用戶端證書身份驗證保護 API", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", - "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", - "service": "VM", - "text": "磁碟 - 驗證高級 SSD 磁碟在任何地方的使用方式：例如，非生產磁碟可以交換到標準 SSD 或按需高級 SSD", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "2a67d143-1033-4c0a-8732-680896478f08", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", + "service": "APIM", + "severity": "中等", + "text": "使用用戶端證書身份驗證保護後端服務", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", - "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", - "service": "Synapse", - "text": "創建預算以管理成本並創建警報，自動通知利益相關者支出異常和超支風險。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", + "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", + "service": "APIM", + "severity": "中等", + "text": "查看“緩解 OWASP API 安全前 10 大威脅的建議”一文，並查看適用於您的 API 的內容", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", - "link": "https://learn.microsoft.com/azure/virtual-machines/availability", - "service": "Synapse", - "text": "將成本數據匯出到存儲帳戶以進行其他數據分析。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", + "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", + "service": "APIM", + "severity": "中等", + "text": "使用授權功能簡化後端 API 的 OAuth 2.0 令牌管理", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Synapse", - "text": "通過在不使用資源時暫停資源來控制專用 SQL 池的成本。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", + "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", + "service": "APIM", + "severity": "高", + "text": "加密傳輸中的資訊時，請使用最新的 TLS 版本。盡可能禁用過時和不必要的協議和密碼。", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", - "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", - "service": "Synapse", - "text": "啟用無伺服器 Apache Spark 自動暫停功能，並相應地設置超時值。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "f8af3d94-1d2b-4070-846f-849197524258", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", + "service": "APIM", + "severity": "高", + "text": "確保機密（命名值）存儲在 Azure Key Vault 中，以便可以安全地訪問和更新它們", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Synapse", - "text": "創建多個不同大小的 Apache Spark 池定義。", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "791abd8b-7706-4e31-9569-afefde724be3", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", + "service": "APIM", + "severity": "中等", + "text": "盡可能使用託管標識向其他 Azure 資源進行身份驗證", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", - "service": "Synapse", - "text": "使用預購計劃購買為期一年的 Azure Synapse 提交單元 （SCU），以節省 Azure Synapse Analytics 成本。", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "成本" + "checklist": "Azure API Management Review", + "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", + "service": "APIM", + "severity": "高", + "text": "使用 APIM 前面部署應用程式閘道來使用 Web 應用程式防火牆 （WAF）", + "waf": "安全" }, { - "checklist": "Cost Optimization Checklist", - "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "VM", - "text": "將現成 VM 用於可中斷作業：這些 VM 可以以折扣價競標和購買，為非關鍵工作負載提供經濟高效的解決方案。", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "成本" + "checklist": "Azure App Service Review", + "guid": "b32e1aa1-4813-4602-88fe-27ca2891f421", + "link": "https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/zone-redundant?source=recommendations", + "service": "App Services", + "severity": "低", + "text": "有關最佳實踐，請參閱基線高可用性區域冗餘 Web 應用程式體系結構", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "544451e1-92d3-4442-a3c7-628637a551c5", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "VM", - "text": "合理調整所有 VM 的大小", - "waf": "成本" + "checklist": "Azure App Service Review", + "guid": "e4b31c6a-2e3f-4df1-8e8b-9c3aa5a27820", + "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", + "service": "App Services", + "severity": "中等", + "text": "使用高級層和標準層。這些層支援暫存槽和自動備份。", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "VM", - "text": "將 VM 大小與規範化大小和最新大小交換", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "成本" + "checklist": "Azure App Service Review", + "guid": "a7e2e6c2-491f-4fa4-a82b-521d0bc3b202", + "link": "https://learn.microsoft.com/en-us/azure/reliability/migrate-app-service", + "service": "App Services", + "severity": "高", + "text": "利用區域適用的可用性區域（需要高級 v2 或 v3 層）", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "調整 VM 大小 - 從低於 5% 的監視使用率開始，然後工作到 40%", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "成本" + "checklist": "Azure App Service Review", + "guid": "1275e4a9-7b6a-43c3-a9cd-5ee18d8995ad", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", + "severity": "中等", + "text": "實施健康檢查", + "waf": "可靠性" }, { - "checklist": "Cost Optimization Checklist", - "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "VM", - "text": "容器化應用程式可以提高 VM 密度並節省擴展成本", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "成本" + "checklist": "Azure App Service Review", + "guid": "35a91c5d-4ad6-4d9b-8e0f-c47db9e6d1e7", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", + "service": "App Services", + "severity": "高", + "text": "請參閱 Azure 應用服務的備份和還原最佳做法", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", - "service": "AVS", + "checklist": "Azure App Service Review", + "guid": "e68cd0ec-afc6-4bd8-a27f-7860ad9a0db2", + "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", + "service": "App Services", "severity": "高", - "text": "確保在本機 Azure 的標識訂閱中部署了 ADDS 域控制器", - "waf": "安全" + "text": "實現 Azure 應用服務可靠性最佳做法", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "75089c20-990d-4927-b105-885576f76fc2", - "service": "AVS", - "severity": "中等", - "text": "確保將 ADDS 網站和服務配置為將來自基於 Azure 的資源（包括 Azure VMware 解決方案）的身份驗證請求保留到 Azure 本地", - "waf": "安全" + "checklist": "Azure App Service Review", + "guid": "bd2a865c-0835-4418-bb58-4df91a5a9b3f", + "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", + "service": "App Services", + "severity": "低", + "text": "熟悉如何在災難期間將應用服務應用移動到另一個區域", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", - "service": "AVS", + "checklist": "Azure App Service Review", + "guid": "f3d2f1e4-e6d4-4b7a-a5a5-e2a9b2c6f293", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", + "service": "App Services", "severity": "高", - "text": "確保 vCenter 已連接到 ADDS，以啟用基於「指定用戶帳戶」的身份驗證", - "waf": "安全" + "text": "熟悉 Azure 應用服務中的可靠性支援", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", - "service": "AVS", + "checklist": "Azure App Service Review", + "guid": "c7b5f3d1-0569-4fd2-9f32-c0b64e9c0c5e", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "App Services", "severity": "中等", - "text": "確保從 vCenter 到 ADDS 的連接使用安全協定 （LDAPS）", - "waf": "安全" + "text": "確保為在應用服務計劃上運行的函數應用啟用“Always On”", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", - "service": "AVS", + "checklist": "Azure App Service Review", + "guid": "a3b4d5f6-758c-4f9d-9e1a-d7c6b7e8f9ab", + "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", + "service": "App Services", "severity": "中等", - "text": "vCenter IdP 中的 CloudAdmin 帳戶僅用作緊急帳戶 （break-glass）", - "waf": "安全" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", - "service": "AVS", - "severity": "高", - "text": "確保 NSX-Manager 與外部身份提供程式 （LDAPS） 集成", - "waf": "安全" + "text": "使用運行狀況檢查監視應用服務實例", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", - "service": "AVS", + "checklist": "Azure App Service Review", + "guid": "c7d3e5f9-a19c-4833-8ca6-1dcb0128e129", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", + "service": "App Services", "severity": "中等", - "text": "是否已創建 RBAC 模型以在 VMware vSphere 中使用", - "waf": "安全" + "text": "使用 Application Insights 可用性測試監視 Web 應用或網站的可用性和回應能力", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", - "service": "AVS", - "severity": "中等", - "text": "RBAC 許可權應授予 ADDS 組，而不是特定使用者", - "waf": "安全" + "checklist": "Azure App Service Review", + "guid": "b4e3f2d5-a5c6-4d7e-8b2f-c5d9e7a8f0ea", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", + "service": "App Services", + "severity": "低", + "text": "使用 Application Insights 標準測試監視 Web 應用或網站的可用性和回應能力", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "使用 Azure Key Vault 儲存應用程式所需的任何機密。 Key Vault 為儲存機密提供安全且經過審核的環境，並通過 Key Vault SDK 或應用服務 Key Vault 引用與應用服務很好地集成。", + "guid": "834ac932-223e-4ce8-8b12-3071a5416415", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "severity": "高", - "text": "Azure 中 Azure VMware 解決方案資源的 RBAC 許可權僅「鎖定」為一組有限的擁有者", + "text": "使用 Key Vault 儲存機密", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "使用託管標識通過 Key Vault SDK 或透過應用服務 Key Vault 引用連接到 Key Vault。", + "guid": "833ea3ad-2c2d-4e73-8165-c3acbef4abe1", + "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", + "service": "App Services", "severity": "高", - "text": "確保所有自定義角色的範圍都具有 CloudAdmin 允許的授權", + "text": "使用託管標識連接到 Key VaultUse Managed Identity to connect to Key Vault", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", - "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "將應用服務 TLS 證書存儲在 Key Vault 中。", + "guid": "f8d39fda-4776-4831-9c11-5775c2ea55b4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", + "service": "App Services", "severity": "高", - "text": "是否為手頭的客戶用例選擇了正確的 Azure VMware 解決方案連接模型", - "waf": "性能" + "text": "使用 Key Vault 儲存 TLS 證書。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", - "service": "AVS", - "severity": "高", - "text": "確保使用「連接監視器」監視從本地到 Azure 的 ExpressRoute 或 VPN 連接", - "waf": "操作" + "checklist": "Azure App Service Review", + "description": "處理敏感信息的系統應隔離。 為此，請使用單獨的應用服務計劃或應用服務環境，並考慮使用不同的訂閱或管理組。", + "guid": "6ad48408-ee72-4734-a475-ba18fdbf590c", + "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", + "service": "App Services", + "severity": "中等", + "text": "隔離處理敏感信息的系統", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "應用服務上的本地磁碟未加密，敏感數據不應存儲在這些磁碟上。 （例如：D：\\\\Local 和 %TMP%）。", + "guid": "e65de8e0-3f9b-4cbd-9682-66abca264f9a", + "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", + "service": "App Services", "severity": "中等", - "text": "確保創建從 Azure 本機資源到 Azure VMware 解決方案虛擬機的連接監視器，以監視 Azure VMware 解決方案後端 ExpressRoute 連接", - "waf": "操作" + "text": "不要將敏感數據存儲在本地磁碟上", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "對於經過身份驗證的 Web 應用程式，請使用成熟的標識提供者，例如 Azure AD 或 Azure AD B2C。 利用所選的應用程式框架與此提供程式整合，或使用應用服務身份驗證/授權功能。", + "guid": "919ca0b2-c121-459e-814b-933df574eccc", + "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", + "service": "App Services", "severity": "中等", - "text": "確保創建從本地資源到 Azure VMware 解決方案虛擬機的連接監視器，以監視端到端連接", - "waf": "操作" + "text": "使用已建立的身份提供程式進行身份驗證", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "將代碼從受控且受信任的環境（例如管理良好且安全的 DevOps 部署管道）部署到應用服務。這樣可以避免未經版本控制和驗證從惡意主機部署的代碼。", + "guid": "3f9bcbd4-6826-46ab-aa26-4f9a19aed9c5", + "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", + "service": "App Services", "severity": "高", - "text": "使用路由伺服器時，請確保從路由伺服器到 ExR 閘道再到本地的路由不超過 1000 個（ARS 限制）。", - "waf": "操作" + "text": "從受信任的環境部署", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "禁用 FTP/FTPS 和 WebDeploy/SCM 的基本身份驗證。 這將禁止訪問這些服務，並強制使用 Azure AD 安全終結點進行部署。 請注意，還可以使用 Azure AD 憑據打開 SCM 網站。", + "guid": "5d04c2c3-919c-4a0b-8c12-159e114b933d", + "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", + "service": "App Services", "severity": "高", - "text": "是否為在 Azure 門戶中管理 Azure VMware 解決方案資源的角色實現了 Privileged Identity Management（不允許長期許可權）", + "text": "禁用基本身份驗證", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "如果可能，請使用託管標識連接到 Azure AD 受保護的資源。 如果無法做到這一點，請將機密存儲在 Key Vault 中，並改用託管標識連接到 Key Vault。", + "guid": "f574eccc-d9bd-43ba-bcda-3b54eb2eb03d", + "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", + "service": "App Services", "severity": "高", - "text": "應為 Azure VMware 解決方案 PIM 角色實現 Privileged Identity Management 審核報告", + "text": "使用託管標識連接到資源", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", - "service": "AVS", - "severity": "中等", - "text": "如果使用 Privileged Identity Management，請確保使用有效的 SMTP 記錄創建啟用了 Entra ID 的有效帳戶，以便 Azure VMware 解決方案自動主機更換通知。（需要長期許可）", + "checklist": "Azure App Service Review", + "description": "如果使用 Azure 容器註冊表中儲存的映像，請使用託管標識拉取這些映像。", + "guid": "d9a25827-18d2-4ddb-8072-5769ee6691a4", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", + "service": "App Services", + "severity": "高", + "text": "使用託管標識拉取容器", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", - "service": "AVS", - "severity": "高", - "text": "將 CloudAdmin 帳戶的使用限制為僅緊急訪問", + "checklist": "Azure App Service Review", + "description": "通過配置應用服務的診斷設置，可以將所有遙測數據發送到Log Analytics，作為日誌記錄和監視的中心目標。這允許你監視應用服務的運行時活動，例如 HTTP 日誌、應用程式日誌、平臺日誌等。", + "guid": "47768314-c115-4775-a2ea-55b46ad48408", + "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", + "service": "App Services", + "severity": "中等", + "text": "將應用服務運行時日誌發送到Log Analytics", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "設置診斷設置，將活動日誌發送到Log Analytics，作為日誌記錄和監視的中心目標。這樣，你就可以監視應用服務資源本身上的控制平面活動。", + "guid": "ee72734b-475b-4a18-bdbf-590ce65de8e0", + "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", + "service": "App Services", "severity": "中等", - "text": "在 vCenter 中創建自定義 RBAC 角色，以在 vCenter 中實施最小特權模型", + "text": "將應用服務活動日誌發送到Log Analytics", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "使用區域 VNet 集成、網路安全組和 UDR 的組合來控制出站網路訪問。 流量應路由到 NVA，例如 Azure 防火牆。 確保監控防火牆的日誌。", + "guid": "c12159e1-14b9-433d-b574-ecccd9bd3baf", + "link": "https://learn.microsoft.com/azure/app-service/overview-vnet-integration", + "service": "App Services", "severity": "中等", - "text": "是定義為定期輪換 cloudadmin （vCenter） 和管理員 （NSX） 憑據的過程", + "text": "應控制出站網路訪問", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", - "service": "AVS", - "severity": "高", - "text": "使用集中式識別提供者用於在 Azure VMware 解決方案上運行的工作負載 （VM）", + "checklist": "Azure App Service Review", + "description": "可以使用 VNet 集成並使用 VNet NAT 閘道或 NVA（如 Azure 防火牆）來提供穩定的出站 IP。 這允許接收方根據需要根據IP列出允許清單。 請注意，對於與 Azure 服務的通信，通常不需要依賴於 IP 位址，應改用服務終結點等機制。 （此外，在接收端使用專用終結點可避免發生 SNAT，並提供穩定的出站 IP 範圍。", + "guid": "cda3b54e-b2eb-403d-b9a2-582718d2ddb1", + "link": "https://learn.microsoft.com/azure/app-service/networking/nat-gateway-integration", + "service": "App Services", + "severity": "低", + "text": "確保與互聯網位址的出站通信具有穩定的IP", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", - "service": "AVS", - "severity": "中等", - "text": "是否在 NSX-T 中實施了東西向流量篩選", + "checklist": "Azure App Service Review", + "description": "使用應用服務訪問限制、服務終結點或專用終結點的組合來控制入站網路訪問。對於 Web 應用本身和 SCM 網站，可能需要和配置不同的訪問限制。", + "guid": "0725769e-e669-41a4-a34a-c932223ece80", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", + "severity": "高", + "text": "應控制入站網路訪問", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "使用 Web 應用程式防火牆（如應用程式閘道或 Azure Front Door）防範惡意入站流量。 請務必監控 WAF 的日誌。", + "guid": "b123071a-5416-4415-a33e-a3ad2c2de732", + "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", + "service": "App Services", "severity": "高", - "text": "Azure VMware 解決方案上的工作負載不會直接向 Internet 公開。流量由 Azure 應用程式閘道、Azure 防火牆或第三方解決方案進行篩選和檢查", + "text": "在應用服務前面使用 WAF", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "確保僅鎖定對 WAF 的訪問，從而無法繞過 WAF。 結合使用訪問限制、服務終結點和專用終結點。", + "guid": "165c3acb-ef4a-4be1-b8d3-9fda47768314", + "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", + "service": "App Services", "severity": "高", - "text": "對 Azure VMware 解決方案和基於 Azure VMware 解決方案的工作負載的入站 Internet 請求實施審核和日誌記錄", + "text": "避免繞過 WAF", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "在應用服務配置中將最低 TLS 策略設置為 1.2。", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.MinTlsVersion>=1.2) | distinct id,compliant", + "guid": "c115775c-2ea5-45b4-9ad4-8408ee72734b", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", + "service": "App Services", "severity": "中等", - "text": "對來自 Azure VMware 解決方案或基於 Azure VMware 解決方案的工作負載的出站 Internet 連接實施會話監視，以識別可疑/惡意活動", + "text": "將最低 TLS 策略設置為 1.2", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "334fdf91-c234-4182-a652-75269440b4be", - "service": "AVS", - "severity": "中等", - "text": "是否在 Azure 的 ExR/VPN 閘道子網上啟用了 DDoS 標準防護", + "checklist": "Azure App Service Review", + "description": "將應用服務配置為僅使用 HTTPS。 這會導致應用服務從 HTTP 重定向到 HTTPS。 強烈建議在代碼或 WAF 中使用 HTTP 嚴格傳輸安全性 （HSTS），這會通知瀏覽器只能使用 HTTPS 訪問網站。", + "graph": "where (type=='microsoft.web/sites' and (kind == 'app' or kind == 'app,linux' )) | extend compliant = (properties.httpsOnly==true) | distinct id,compliant", + "guid": "475ba18f-dbf5-490c-b65d-e8e03f9bcbd4", + "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", + "service": "App Services", + "severity": "高", + "text": "僅使用 HTTPS", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", - "service": "AVS", - "severity": "中等", - "text": "使用專用特權訪問工作站 （PAW） 管理 Azure VMware 解決方案、vCenter、NSX Manager 和 HCX Manager", + "checklist": "Azure App Service Review", + "description": "不要在 CORS 配置中使用通配符，因為這允許所有源訪問服務（從而破壞 CORS 的目的）。具體而言，僅允許您希望能夠訪問服務的源。", + "guid": "68266abc-a264-4f9a-89ae-d9c55d04c2c3", + "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", + "service": "App Services", + "severity": "高", + "text": "不得將通配符用於 CORS", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "不得在生產環境中啟用遠端調試，因為這會在服務上打開其他埠，從而增加攻擊面。請注意，該服務會在 48 小時後自動轉為遠端調試。", + "graph": "appserviceresources | where type =~ 'microsoft.web/sites/config' | extend compliant = (properties.RemoteDebuggingEnabled == false) | distinct id,compliant", + "guid": "d9bd3baf-cda3-4b54-bb2e-b03dd9a25827", + "link": "https://learn.microsoft.com/azure/app-service/configure-common#configure-general-settings", + "service": "App Services", + "severity": "高", + "text": "關閉遠端調試", + "waf": "安全" + }, + { + "checklist": "Azure App Service Review", + "description": "啟用 Defender for App Service。 這（除其他威脅外）檢測與已知惡意IP位址的通信。 在操作過程中查看 Defender for App Service 中的建議。", + "guid": "18d2ddb1-0725-4769-be66-91a4834ac932", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", + "service": "App Services", "severity": "中等", - "text": "為 Azure VMware 解決方案上運行的工作負載啟用高級威脅檢測（Microsoft Defender for Cloud，又名 ASC）", + "text": "啟用 Defender for Cloud - Defender for App Service", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "Azure 在其網路上提供 DDoS 基本保護，可以通過智慧 DDoS 標準功能進行改進，該功能可以瞭解正常的流量模式並檢測異常行為。DDoS 標準適用於虛擬網路，因此必須為應用前面的網路資源（例如應用程式閘道或 NVA）配置它。", + "guid": "223ece80-b123-4071-a541-6415833ea3ad", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "App Services", "severity": "中等", - "text": "使用適用於伺服器的 Azure ARC 使用 Azure 本機技術正確管理在 Azure VMware 解決方案上運行的工作負載（適用於 Azure VMware 解決方案的 Azure ARC 尚不可用）", + "text": "在 WAF VNet 上啟用 DDOS 保護標準", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", - "service": "AVS", - "severity": "低", - "text": "確保 Azure VMware 解決方案上的工作負載在運行時使用足夠的數據加密（如來賓內磁碟加密和 SQL TDE）。（vSAN 靜態加密為預設加密）", + "checklist": "Azure App Service Review", + "description": "如果使用 Azure 容器註冊表中儲存的映像，請使用其專用終結點和應用設置“WEBSITE_PULL_IMAGE_OVER_VNET”通過虛擬網络從 Azure 容器註冊表拉取這些映射。", + "guid": "2c2de732-165c-43ac-aef4-abe1f8d39fda", + "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", + "service": "App Services", + "severity": "中等", + "text": "通過虛擬網路拉取容器", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a3592718-e6e2-4051-9267-6ae46691e883", - "service": "AVS", - "severity": "低", - "text": "使用來賓內加密時，請盡可能將加密密鑰存儲在 Azure Key Vault 中", + "checklist": "Azure App Service Review", + "description": "按照參與的滲透測試規則對 Web 應用程式進行滲透測試。", + "guid": "eb2eb03d-d9a2-4582-918d-2ddb10725769", + "link": "https://learn.microsoft.com/azure/security/fundamentals/pen-testing", + "service": "App Services", + "severity": "中等", + "text": "進行滲透測試", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5ac94222-3e13-4810-9230-81a941741583", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "部署根據 DevSecOps 實踐驗證和掃描漏洞的受信任代碼。", + "guid": "19aed9c5-5d04-4c2c-9919-ca0b2c12159e", + "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/devsecops-in-azure", + "service": "App Services", "severity": "中等", - "text": "請考慮對 Azure VMware 解決方案上運行的工作負載使用擴展的安全更新支援（Azure VMware 解決方案符合 ESU 條件）", + "text": "部署經過驗證的代碼", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", - "service": "AVS", + "checklist": "Azure App Service Review", + "description": "使用最新版本的受支援平臺、程式設計語言、協定和框架。", + "guid": "114b933d-f574-4ecc-ad9b-d3bafcda3b54", + "link": "https://learn.microsoft.com/azure/app-service/overview-patch-os-runtime", + "service": "App Services", "severity": "高", - "text": "確保使用適當的 vSAN 資料冗餘方法（RAID 規範）", - "waf": "可靠性" + "text": "使用最新的平臺、語言、協定和框架", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d88408f3-7273-44c8-96ba-280214590146", - "service": "AVS", - "severity": "高", - "text": "確保允許失敗策略已到位，以滿足您的 vSAN 儲存需求", + "checklist": "MySQL Review Checklist", + "guid": "388c3e25-e800-4ad2-9df3-f3d6ae1050b7", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview", + "service": "Azure MySQL", + "severity": "中等", + "text": "利用靈活伺服器", "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", - "service": "AVS", + "checklist": "MySQL Review Checklist", + "guid": "de3aad1e-8c38-4ec9-9666-7313c005674b", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#high-availability-within-and-across-availability-zones", + "service": "Azure MySQL", "severity": "高", - "text": "確保已請求足夠的配額，確保已考慮增長和災難恢復要求", + "text": "利用區域適用的可用區", "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", - "service": "AVS", + "checklist": "MySQL Review Checklist", + "guid": "1e944a45-9c37-43e7-bd61-623b365a917e", + "link": "https://learn.microsoft.com/azure/mysql/flexible-server/overview#setup-hybrid-or-multi-cloud-data-synchronization-with-data-in-replication", + "service": "Azure MySQL", "severity": "中等", - "text": "確保瞭解對 ESXi 的訪問限制，其中存在可能影響第三方解決方案的訪問限制。", - "waf": "操作" + "text": "將數據傳入複製用於跨區域災難恢復方案", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "70c15989-c726-42c7-b0d3-24b7375b9201", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", + "service": "Entra", "severity": "中等", - "text": "確保您制定了有關ESXi主機密度和效率的策略，並牢記請求新節點的提前期", + "text": "使用一個 Entra 租戶來管理 Azure 資源，除非你對多租戶有明確的法規或業務要求。", "waf": "操作" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", - "service": "AVS", - "severity": "中等", - "text": "確保 Azure VMware 解決方案的良好成本管理流程已到位 - 可以使用 Azure 成本管理", - "waf": "成本" + "checklist": "Azure Landing Zone Review", + "guid": "6309957b-821a-43d1-b9d9-7fcf1802b747", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Entra", + "severity": "低", + "text": "確保採用多租戶自動化方法來管理 Microsoft Entra ID 租戶", + "waf": "操作" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "78e11934-499a-45ed-8ef7-aae5578f0ecf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "Entra", "severity": "低", - "text": "Azure 預留實例是否用於優化使用 Azure VMware 解決方案的成本", - "waf": "成本" + "text": "利用 Azure Lighthouse 進行多租戶管理", + "waf": "操作" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6691e883-5ac9-4422-83e1-3810523081a9", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "5d82e6df-6f61-42f2-82e2-3132d293be3d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Entra", "severity": "中等", - "text": "使用其他 Azure 本機服務時，請考慮使用 Azure 專用連結", - "waf": "安全" + "text": "確保合作夥伴使用 Azure Lighthouse 管理租戶", + "waf": "成本" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "348ef254-c27d-442e-abba-c7571559ab91", + "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", + "service": "Entra", "severity": "高", - "text": "確保所有必需的資源都駐留在同一個 Azure 可用性區域中", - "waf": "性能" + "text": "強制實施與雲運營模型一致的 RBAC 模型。跨管理組和訂閱的範圍和分配。", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", - "service": "AVS", - "severity": "中等", - "text": "為 Azure VMware 解決方案來賓 VM 工作負載啟用 Microsoft Defender for Cloud", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "12e7f983-f630-4472-8dd6-9c5b5c2622f5", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-planning#identify-microsoft-accounts-in-administrative-roles-that-need-to-be-switched-to-work-or-school-accounts", + "service": "Entra", + "severity": "高", + "text": "僅對所有帳戶類型使用身份驗證類型「工作或學校帳戶」。避免使用 Microsoft 帳戶", + "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "4b69bad3-3aad-45e8-a68e-1d76667313b4", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "Entra", "severity": "中等", - "text": "使用已啟用 Azure Arc 的伺服器管理 Azure VMware 解決方案來賓 VM 工作負載", + "text": "僅使用組來分配許可權。如果組管理系統已到位，則將本地組添加到僅 Entra ID 組。", + "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", - "service": "AVS", - "severity": "高", - "text": "在 Azure VMware 解決方案上啟用診斷和指標日誌記錄", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "53e8908a-e28c-484c-93b6-b7808b9fe5c4", + "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", + "service": "Entra", + "severity": "低", + "text": "對任何有權訪問 Azure 環境的用戶強制實施 Microsoft Entra ID 條件訪問策略", + "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", - "service": "AVS", - "severity": "中等", - "text": "將Log Analytics代理部署到 Azure VMware 解決方案來賓 VM 工作負載", - "waf": "操作" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "1049d403-a923-4c34-94d0-0018ac6a9e01", + "link": "https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks", + "service": "Entra", + "severity": "高", + "text": "對有權訪問 Azure 環境的任何使用者強制實施多重身份驗證", + "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "589d457a-927c-4397-9d11-02cad6aae11e", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "14658d35-58fd-4772-99b8-21112df27ee4", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "Entra", "severity": "中等", - "text": "確保已針對 Azure VMware 解決方案 VM 工作負載記錄並實施了備份策略和解決方案", - "waf": "操作" + "text": "強制實施 Microsoft Entra ID 特權身份管理 （PIM） 以建立零長期訪問許可權和最低許可權", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ee29711b-d352-4caa-ab79-b198dab81932", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "8b9fe5c4-1049-4d40-9a92-3c3474d00018", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "Entra", "severity": "中等", - "text": "使用 Microsoft Defender for Cloud 對 Azure VMware 解決方案上運行的工作負載進行合規性監視", + "text": "如果計劃從 Active Directory 域服務切換到 Entra 域服務，請評估所有工作負載的相容性", + "training": "https://learn.microsoft.com/learn/modules/implement-hybrid-identity-windows-server/", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "1cf0b8da-70bd-44d0-94af-8d99cfc89ae1", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", + "service": "Entra", "severity": "中等", - "text": "是否將適用的合規性基線添加到 Microsoft Defender for Cloud", + "text": "將 Microsoft Entra ID 日誌與平臺中心 Azure Monitor 集成。Azure Monitor 允許圍繞 Azure 中的日誌和監視數據提供單一事實源，從而為組織提供雲原生選項，以滿足有關日誌收集和保留的要求。", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "984a859c-773e-47d2-9162-3a765a917e1f", + "link": "https://learn.microsoft.com/azure/active-directory/roles/security-emergency-access", + "service": "Entra", "severity": "高", - "text": "在選擇要用於 Azure VMware 解決方案部署的 Azure 區域時是否評估了數據駐留", + "text": "實施緊急訪問或打破玻璃帳戶，以防止租戶範圍的帳戶鎖定", + "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", - "service": "AVS", - "severity": "高", - "text": "數據處理影響（服務提供者/服務消費者模型）是否清晰且有據可查", + "checklist": "Azure Landing Zone Review", + "guid": "35037e68-9349-4c15-b371-228514f4cdff", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "Entra", + "severity": "中等", + "text": "避免將本地同步帳戶用於 Microsoft Entra ID 角色分配。", + "training": "https://learn.microsoft.com/learn/modules/design-identity-security-strategy/", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "547c1747-dc56-4068-a714-435cd19dd244", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "d5d1e4e6-1465-48d3-958f-d77249b82111", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Entra", "severity": "中等", - "text": "僅當出於合規性原因需要時，才考慮將CMK（客戶管理的密鑰）用於 vSAN。", + "text": "如果需要，請使用 Microsoft Entra ID 應用程式代理為遠端使用者提供對內部應用程式（託管在雲中或本地）的安全和經過身份驗證的訪問。", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", - "service": "AVS", - "severity": "高", - "text": "創建儀錶板以啟用核心 Azure VMware 解決方案監視見解", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "e8bbac75-7155-49ab-a153-e8908ae28c84", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", + "service": "VNet", + "severity": "中等", + "text": "利用基於傳統中心輻射型網路拓撲的網路設計，滿足需要最大靈活性的網路方案。", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "7dd61623-a364-4a90-9eca-e48ebd54cd7d", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/expressroute", + "service": "VNet", "severity": "高", - "text": "針對 Azure VMware 解決方案性能（CPU >80%、平均記憶體 >80%、vSAN >70%）自動警報的關鍵閾值創建警告警報", - "waf": "操作" + "text": "確保共用網路服務（包括 ExpressRoute 閘道、VPN 閘道和 Azure 防火牆或合作夥伴 NVA）位於中心虛擬網路中。如有必要，還可以部署 DNS 伺服器。", + "waf": "成本" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9659e396-80e7-4828-ac93-5657d02bff45", - "service": "AVS", - "severity": "高", - "text": "確保創建嚴重警示以監控 vSAN 消耗量是否低於 75%，因為這是 VMware 的支援閾值", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "143b16c3-1d7a-4a9b-9470-4489a8042d88", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", + "service": "VNet", + "severity": "中等", + "text": "對應用程式登陸區域中的所有公共IP位址使用 DDoS 網路或IP防護計畫。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", - "service": "AVS", - "severity": "高", - "text": "確保為 Azure 服務運行狀況警報和通知配置警報", - "waf": "操作" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "e2e8abac-3571-4559-ab91-53e89f89dc7b", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", + "service": "NVA", "severity": "中等", - "text": "將 Azure VMware 解決方案記錄設定為發送到 Azure 儲存帳戶或 Azure EventHub 進行處理", - "waf": "操作" + "text": "部署合作夥伴網路技術或 NVA 時，請遵循合作夥伴供應商的指導", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "ce463dbb-bc8a-4c2a-aebc-92a43da1dae2", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", + "service": "ExpressRoute", "severity": "低", - "text": "如果需要深入瞭解 VMware vSphere：解決方案中是否使用了 vRealize Operations 和/或 vRealize Network Insights？", - "waf": "操作" + "text": "如果需要在中心輻射型方案中的 ExpressRoute 和 VPN 閘道之間傳輸，請使用 Azure 路由伺服器。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", - "service": "AVS", - "severity": "高", - "text": "確保虛擬機的 vSAN 儲存策略不是預設存儲策略，因為此策略應用厚置備", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "91b9d7d5-91e1-4dcb-8f1f-fa7e465646cc", + "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", + "service": "ARS", + "severity": "低", + "text": "如果使用 Route Server，請對 Route Server 子網使用 /27 前置綴。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "cc881471-607c-41cc-a0e6-14658dd558f9", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", + "service": "VNet", "severity": "中等", - "text": "確保未將 vSphere 內容庫放置在 vSAN 上，因為 vSAN 是有限的資源", - "waf": "操作" + "text": "對於跨 Azure 區域具有多個中心輻射型拓撲的網路體系結構，請使用中心 VNet 之間的全域虛擬網路對等互連將區域相互連接。", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-virtual-networks/", + "waf": "性能" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "4722d929-c1b1-4cd6-81f5-4b29bade39ad", + "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", + "service": "VNet", "severity": "中等", - "text": "確保備份解決方案的數據存儲庫存儲在 vSAN 儲存之外。在 Azure 本機或磁碟池支持的數據存儲中", + "text": "使用用於網路的 Azure Monitor 監視 Azure 上網路的端到端狀態。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", "waf": "操作" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant", + "guid": "0e7c28ec-9366-4572-83b0-f4664b1d944a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "severity": "中等", - "text": "確保使用 Azure Arc for Servers 進行混合管理，確保在 Azure VMware 解決方案上運行的工作負載（Arc for Azure VMware 解決方案處於預覽狀態）", - "waf": "操作" + "text": "將分支虛擬網路連接到中央中心虛擬網路時，請考慮 VNet 對等互連限制 （500），即可通過 ExpressRoute 播發的最大前綴數 （1000）", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant", + "guid": "3d457936-e9b7-41eb-bdff-314b26450b12", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", + "service": "VNet", "severity": "中等", - "text": "確保使用 Azure Log Analytics 和 Azure Monitor 監視在 Azure VMware 解決方案上運行的工作負載", - "waf": "操作" + "text": "考慮每個路由表的路由限制 （400）。", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", - "service": "AVS", - "severity": "中等", - "text": "在現有更新管理工具或 Azure 更新管理中包括在 Azure VMware 解決方案上運行的工作負載", - "waf": "操作" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)", + "guid": "c76cb5a2-abe2-11ed-afa1-0242ac120002", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", + "service": "VNet", + "severity": "高", + "text": "配置 VNet 對等互連時，使用「允許流量流向遠端虛擬網路」設置", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "de0d5973-cd4c-4d21-a088-137f5e6c4cfd", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", + "service": "ExpressRoute", "severity": "中等", - "text": "使用 Azure Policy 在 Azure 管理、監視和安全解決方案中加入 Azure VMware 解決方案工作負載", - "waf": "操作" + "text": "使用 ExpressRoute Direct 時，請配置 MACsec，以便加密組織路由器和 MSEE 之間的第二層級別的流量。該圖顯示了流中的此加密。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", - "service": "AVS", - "severity": "中等", - "text": "確保在 Azure VMware 解決方案上運行的工作負載已載入 Microsoft Defender for Cloud", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "ed301d6e-872e-452e-9611-cc58b5a4b151", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", + "severity": "低", + "text": "對於無法使用MACsec的方案（例如，不使用ExpressRoute Direct），請使用 VPN 閘道通過 ExpressRoute 專用對等互連建立 IPsec 隧道。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", - "service": "AVS", - "severity": "中等", - "text": "確保備份不存儲在 vSAN 上，因為 vSAN 是有限的資源", - "waf": "可靠性" + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "558fd772-49b8-4211-82df-27ee412e7f98", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "ExpressRoute", + "severity": "高", + "text": "確保在 Azure 區域和本地位置之間不使用重疊的 IP 位址空間", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", - "service": "AVS", - "severity": "中等", - "text": "是否考慮了所有災難恢復解決方案，並決定了最適合您業務的解決方案？[SRM/JetStream/Zerto/Veeam/...]", - "waf": "可靠性" + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr", + "guid": "3f630472-2dd6-49c5-a5c2-622f54b69bad", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", + "severity": "低", + "text": "使用專用 Internet 位址分配範圍 （RFC 1918） 中的 IP 位址。", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", - "service": "AVS", - "severity": "中等", - "text": "當災難恢復技術是本機 Azure IaaS 時，請使用 Azure Site Recovery", - "waf": "可靠性" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant", + "guid": "33aad5e8-c68e-41d7-9667-313b4f5664b5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", + "service": "VNet", + "severity": "高", + "text": "確保IP位址空間不被浪費，不要創建不必要的大型虛擬網路（例如 /16）Ensure that that IP address space is not disdised， don't create un不必要的大型虛擬網路（例如 /16）Ensure that that IP address space is not waste， don't create un不必要的大型虛擬網络（例如 /16）Ensure that that IP address space is", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "性能" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", - "service": "AVS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "f348ef25-4c27-4d42-b8bb-ac7571559ab9", + "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", + "service": "VNet", "severity": "高", - "text": "將自動恢復計劃與任一災難解決方案結合使用，盡可能避免手動任務", + "text": "避免對生產網站和DR網站使用重疊的IP位址範圍。", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "8255461e-2aee-4345-9aec-8339248b262d", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "153e8908-ae28-4c84-a33b-6b7808b9fe5c", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", "severity": "中等", - "text": "使用地緣政治區域對作為輔助災難恢復環境", - "waf": "可靠性" + "text": "對於只需要在 Azure 中進行名稱解析的環境，請使用 Azure 專用 DNS 進行解析，並使用委派區域進行名稱解析（例如“azure.contoso.com”）。", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "操作" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", - "service": "AVS", - "severity": "高", - "text": "在區域之間使用 2 個不同的地址空間，例如：10.0.0.0/16 和 192.168.0.0/16 用於不同的區域", - "waf": "可靠性" + "checklist": "Azure Landing Zone Review", + "guid": "41049d40-3a92-43c3-974d-00018ac6a9e0", + "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", + "service": "DNS", + "severity": "中等", + "text": "對於需要跨 Azure 和本地進行名稱解析的環境，請考慮使用 Azure DNS 專用解析程式。", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-dns-private-resolver/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", - "service": "AVS", - "severity": "中等", - "text": "ExpressRoute Global Reach 是用於主 Azure VMware 解決方案私有雲和輔助 Azure VMware 解決方案私有雲之間的連接，還是通過網路虛擬設備完成路由？", - "waf": "可靠性" + "checklist": "Azure Landing Zone Review", + "guid": "1e6a83de-5de3-42c1-a924-81607d5d1e4e", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", + "service": "DNS", + "severity": "低", + "text": "需要並部署自己的 DNS（例如 Red Hat OpenShift）的特殊工作負載應使用其首選的 DNS 解決方案。", + "waf": "操作" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", - "service": "AVS", - "severity": "中等", - "text": "是否考慮了所有備份解決方案，並決定了最適合您業務的解決方案？[ MABS/CommVault/Metallic.io/Veeam/ .", - "waf": "可靠性" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "614658d3-558f-4d77-849b-821112df27ee", + "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", + "service": "DNS", + "severity": "高", + "text": "啟用 Azure DNS 的自動註冊，以自動管理虛擬網路中部署的虛擬機的 DNS 記錄的生命週期。", + "training": "https://learn.microsoft.com/learn/paths/az-104-manage-virtual-networks/", + "waf": "操作" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "ee1ac551-c4d5-46cf-b035-d0a3c50d87ad", + "link": "https://learn.microsoft.com/azure/bastion/bastion-overview", + "service": "Bastion", "severity": "中等", - "text": "將備份解決方案部署在與 Azure VMware 解決方案私有雲相同的區域中", - "waf": "可靠性" + "text": "請考慮使用 Azure Bastion 安全地連接到網路。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant", + "guid": "6eab9eb6-762b-485e-8ea8-15aa5dba0bd0", + "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", + "service": "Bastion", "severity": "中等", - "text": "在 vSan 外部的 Azure 本機組件上部署備份解決方案", - "waf": "可靠性" + "text": "在子網 /26 或更大範圍內使用 Azure Bastion。", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", - "service": "AVS", - "severity": "低", - "text": "是否已制定請求還原由 Azure 平臺管理的 VMware 元件的流程？", - "waf": "可靠性" + "checklist": "Azure Landing Zone Review", + "guid": "1d7aa9b6-4704-4489-a804-2d88e79d17b7", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", + "service": "WAF", + "severity": "中等", + "text": "使用 Azure Front Door 和 WAF 策略跨 Azure 區域為與登陸區域的入站 HTTP/S 連接提供全域保護。", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", - "service": "AVS", + "checklist": "Azure Landing Zone Review", + "guid": "3b22a5a6-7e7a-48ed-9b30-e38c3f29812b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", "severity": "低", - "text": "對於手動部署，必須記錄所有配置和部署", - "waf": "操作" + "text": "使用 Azure Front Door 和 Azure 應用程式閘道幫助保護 HTTP/S 應用時，請使用 Azure Front Door 中的 WAF 策略。鎖定 Azure 應用程式閘道，以便僅接收來自 Azure Front Door 的流量。", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", - "service": "AVS", - "severity": "低", - "text": "對於手動部署，請考慮實施資源鎖，以防止對 Azure VMware 解決方案私有雲執行意外操作", - "waf": "操作" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "2363cefe-179b-4599-be0d-5973cd4cd21b", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "WAF", + "severity": "高", + "text": "部署 WAF 和其他反向代理是入站 HTTP/S 連接所必需的，將它們部署在登陸區域虛擬網路中，並與它們保護並公開給 Internet 的應用一起部署。", + "training": "https://learn.microsoft.com/learn/paths/architect-network-infrastructure/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", - "service": "AVS", - "severity": "低", - "text": "對於自動化部署，請部署最小的私有雲並根據需要進行擴展", - "waf": "操作" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "088137f5-e6c4-4cfd-9e50-4547c2447ec6", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", + "severity": "高", + "text": "使用 Azure DDoS 網路或 IP 保護計劃來幫助保護虛擬網路中的公共 IP 位址終結點。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", - "service": "AVS", - "severity": "低", - "text": "對於自動部署，請在開始部署之前請求或預留配額", - "waf": "操作" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b034c01e-110b-463a-b36e-e3346e57f225", + "link": "https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access", + "service": "VNet", + "severity": "高", + "text": "在即將到來的重大更改之前，評估和審查網路出站流量配置和策略。2025 年 9 月 30 日，新部署的預設出站訪問將停用，僅允許顯式訪問配置", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", - "service": "AVS", - "severity": "低", - "text": "對於自動部署，請確保通過自動化或 Azure Policy 創建相關資源鎖，以便進行適當的治理", - "waf": "操作" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b1c82a3f-2320-4dfa-8972-7ae4823c8930", + "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-reference-architectures", + "service": "VNet", + "severity": "高", + "text": "添加診斷設置以保存所有受保護的公共IP位址（DDoS IP或網路保護）的 DDoS 相關日誌。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", - "service": "AVS", - "severity": "低", - "text": "為 ExR 授權金鑰實現人類可理解的名稱，以便輕鬆識別密鑰的目的/用途", - "waf": "操作" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "359c373e-7dd6-4162-9a36-4a907ecae48e", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli", + "service": "ExpressRoute", + "severity": "中等", + "text": "確保已調查使用 ExpressRoute 作為與 Azure 的主要連接的可能性。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "性能" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "255461e2-aee3-4553-afc8-339248b262d6", - "service": "AVS", - "severity": "低", - "text": "當使用單獨的服務原則部署 Azure VMware 解決方案和 ExpressRoute 時，請使用 Key Vault 儲存機密和授權密鑰", - "waf": "操作" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "description": "可以使用 AS 路徑前置和連接權重來影響從 Azure 到本地的流量，並使用自己的路由器中的全部 BGP 屬性來影響從本地到 Azure 的流量。", + "guid": "f29812b2-363c-4efe-879b-599de0d5973c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", + "severity": "中等", + "text": "使用多條 ExpressRoute 線路或多個本地位置時，請確保使用 BGP 屬性優化路由（如果首選某些路徑）。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", - "service": "AVS", - "severity": "低", - "text": "當需要在 Azure VMware 解決方案中/上部署許多資源時，定義用於在 IaC 中序列化操作的資源依賴項，因為 Azure VMware 解決方案僅支援有限數量的並行操作。", - "waf": "操作" + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant", + "guid": "d4cd21b0-8813-47f5-b6c4-cfd3e504547c", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", + "service": "ExpressRoute", + "severity": "中等", + "text": "確保根據頻寬和性能要求為 ExpressRoute/VPN 閘道使用正確的 SKU。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "性能" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", - "service": "AVS", - "severity": "低", - "text": "使用單個 Tier-1 閘道執行 NSX-T 分段的自動配置時，請使用 Azure 門戶 API 而不是 NSX-Manager API", - "waf": "操作" + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant", + "guid": "7025b442-f6e9-4af6-b11f-c9574916016f", + "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", + "service": "ExpressRoute", + "severity": "高", + "text": "確保僅當達到證明其成本合理的頻寬時，才使用無限數據的ExpressRoute線路。", + "waf": "成本" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", - "service": "AVS", - "severity": "中等", - "text": "打算使用自動橫向擴展時，請務必為運行 Azure VMware 解決方案的訂閱申請足夠的 Azure VMware 解決方案配額", - "waf": "性能" + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id", + "guid": "f4e7926a-ec35-476e-a412-5dd17136bd62", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", + "service": "ExpressRoute", + "severity": "高", + "text": "如果線路的對等互連位置支援本地 SKU 的 Azure 區域，則利用 ExpressRoute 的本地 SKU 來降低線路的成本。", + "waf": "成本" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant", + "guid": "2447ec66-138a-4720-8f1c-e16ed301d6e8", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", + "service": "ExpressRoute", "severity": "中等", - "text": "打算使用自動縮減時，請務必在執行此操作之前考慮存儲策略要求", - "waf": "性能" + "text": "在受支援的 Azure 區域中部署區域冗餘 ExpressRoute 閘道。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "72e52e36-11cc-458b-9a4b-1511e43a58a9", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", + "service": "ExpressRoute", "severity": "中等", - "text": "擴展操作始終需要在單個 SDDC 中序列化，因為一次只能執行一個擴展操作（即使使用多個集群也是如此）", + "text": "對於需要高於 10 Gbps 的頻寬或專用 10/100 Gbps 埠的方案，請使用 ExpressRoute Direct。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "性能" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "c2299c4d-7b57-4d0c-9555-62f2b3e4563a", + "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", + "service": "ExpressRoute", "severity": "中等", - "text": "考慮並驗證體系結構中使用的第三方解決方案的縮放操作（支援與否）", + "text": "如果需要低延遲，或者從本地到 Azure 的輸送量必須大於 10 Gbps，請啟用 FastPath 以繞過數據路徑的 ExpressRoute 閘道。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "性能" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", - "service": "AVS", + "arm-service": "microsoft.network/vpnGateways", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant", + "guid": "4d873974-8b66-42d6-b15f-512a65498f6d", + "link": "https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway", + "service": "VPN", "severity": "中等", - "text": "在自動化中為環境定義和強制實施橫向擴展/橫向擴展最大限制", - "waf": "性能" + "text": "使用區域冗餘 VPN 閘道將分支或遠端位置連接到 Azure（如果可用）。", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", - "service": "AVS", + "arm-service": "microsoft.network/vpnGateways", + "checklist": "Azure Landing Zone Review", + "guid": "45866df8-cf85-4ca9-bbe2-65ec1478919e", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", + "service": "VPN", "severity": "中等", - "text": "實施監控規則以監控自動擴展操作，並監控成功和失敗，以啟用適當的（自動化）回應", - "waf": "操作" + "text": "在本地使用冗餘 VPN 設備（主動/主動或主動/被動）。", + "training": "https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/", + "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "718cb437-b060-2589-8856-2e93a5c6633b", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", + "service": "ExpressRoute", "severity": "高", - "text": "使用 MON 時，請注意同時配置的 VM 的限制（HCX 的 MON 限制 [400 - 標準，1000 - 大型設備]）", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "可靠性" + "text": "如果使用 ExpressRoute Direct，請考慮使用本地 Azure 區域的 ExpressRoute 本地線路來節省成本", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "成本" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "AVS", - "severity": "高", - "text": "使用 MON 時，不能在超過 100 個網路分機上啟用 MON", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "可靠性" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", - "service": "AVS", - "severity": "中等", - "text": "如果使用 VPN 連接進行遷移，請相應地調整 MTU 大小。", - "waf": "性能" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "e614658d-d457-4e92-9139-b821102cad6e", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "8042d88e-79d1-47b7-9b22-a5a67e7a8ed4", + "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", + "service": "ExpressRoute", "severity": "中等", - "text": "對於連接到 Azure（500Mbps 或更低）的低連接區域，請考慮部署 HCX WAN 優化設備", - "waf": "性能" + "text": "當需要流量隔離或專用頻寬時（例如，用於分離生產環境和非生產環境），請使用不同的 ExpressRoute 線路。它將幫助您確保隔離的路由域並減輕干擾鄰居風險。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "安全" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b30e38c3-f298-412b-8363-cefe179b599d", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", + "service": "ExpressRoute", "severity": "中等", - "text": "確保從本地裝置啟動遷移，而不是從雲端裝置啟動遷移（不要執行反向遷移）", - "waf": "可靠性" + "text": "使用內置的 Express Route Insights 監視 ExpressRoute 的可用性和利用率。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "操作" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "5bf68dc9-325e-4873-bf88-f8214ef2e5d2", + "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", + "service": "ExpressRoute", "severity": "中等", - "text": "使用 Azure Netapp Files 擴展 Azure VMware 解決方案的儲存時，請考慮將其用作 VMware 資料儲存庫，而不是直接附加到 VM 。", - "waf": "可靠性" + "text": "使用連接監視器進行跨網路的連接監視，尤其是在本地和 Azure 之間。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "操作" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)", + "guid": "e0d5973c-d4cd-421b-8881-37f5e6c4cfd3", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#challenges-of-using-multiple-expressroute-circuits", + "service": "ExpressRoute", "severity": "中等", - "text": "確保將專用 ExpressRoute 閘道用於外部資料儲存解決方案", + "text": "使用來自不同對等互連位置的 ExpressRoute 線路實現冗餘。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "AVS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "cf3fe65c-fec0-495a-8edc-9675200f2add", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", + "service": "ExpressRoute", "severity": "中等", - "text": "確保在用於外部數據存儲解決方案的 ExpressRoute 閘道上啟用了 FastPath", - "waf": "可靠性" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "AVS", - "severity": "高", - "text": "如果使用延伸群集，請確保供應商支援所選的災難恢復解決方案", - "waf": "可靠性" - }, - { - "checklist": "Azure VMware Solution Design Review", - "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "AVS", - "severity": "高", - "text": "如果使用延伸群集，請確保提供的 SLA 符合您的要求", + "text": "使用網站到網站 VPN 作為 ExpressRoute 的故障轉移，尤其是在僅使用單個 ExpressRoute 線路時。", "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "AVS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))", + "guid": "72105cc8-aaea-4ee1-8c7a-ad25977afcaf", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", + "service": "ExpressRoute", "severity": "高", - "text": "如果使用延伸群集，請確保兩條 ExpressRoute 線路都連接到連接中心。", + "text": "如果在 GatewaySubnet 中使用路由表，請確保傳播閘道路由。", "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", - "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "AVS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "d581a947-69a2-4783-942e-9df3664324c8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", + "service": "ExpressRoute", "severity": "高", - "text": "如果使用延伸群集，請確保兩條 ExpressRoute 線路都啟用了 GlobalReach。", + "text": "如果使用 ExpressRoute，則本地路由應是動態的：如果連接失敗，它應收斂到線路的剩餘連接。理想情況下，負載應在兩個連接之間共用為主動/主動，但也支持主動/被動。", "waf": "可靠性" }, { - "checklist": "Azure VMware Solution Design Review", - "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "AVS", - "severity": "高", - "text": "是否正確考慮了網站容災設置，並在需要時為您的業務進行了更改。", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b258f058-b9f6-46cd-b28d-990106f0c3f8", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", + "service": "ExpressRoute", + "severity": "中等", + "text": "確保 ExpressRoute 線路的兩個物理連結連接到網路中的兩個不同的邊緣設備。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "可靠性" }, { - "checklist": "Azure Spring Apps Review", - "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", - "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", - "service": "Spring Apps", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "fe2a1b53-6fbd-4c67-b58a-85d7c7a0afcb", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-bfd", + "service": "ExpressRoute", "severity": "中等", - "text": "Azure Spring Apps 允許對每個應用進行兩次部署，其中只有一個部署接收生產流量。您可以使用藍綠部署策略實現零停機時間。藍綠部署僅在標準層和企業層中可用。可以使用 CI/CD 和 ADO/GitHub 操作自動執行部署", + "text": "確保在客戶或供應商邊緣路由設備上啟用並配置雙向轉發檢測 （BFD）。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "可靠性" }, { - "checklist": "Azure Spring Apps Review", - "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", - "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", - "service": "Spring Apps", - "severity": "中等", - "text": "可以在多個區域中為應用程式創建 Azure Spring Apps 實例，並且流量管理器/Front Door 可以路由流量。", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "669b215a-ce43-4371-8f6f-11047f6490f1", + "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", + "service": "ExpressRoute", + "severity": "高", + "text": "將 ExpressRoute 閘道連接到來自不同對等互連位置的兩條或多條線路，以提高復原能力。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "可靠性" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", - "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", - "service": "Spring Apps", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "3f79ed00-203b-4c95-9efd-691505f5a1f9", + "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", + "service": "ExpressRoute", "severity": "中等", - "text": "在支持的區域中，Azure Spring Apps 可以部署為區域冗餘，這意味著實例會自動分佈在可用性區域之間。此功能僅在標準層和企業層中可用。", - "waf": "可靠性" + "text": "為 ExpressRoute 虛擬網路閘道配置診斷日誌和警報。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "操作" }, { - "checklist": "Azure Spring Apps Review", - "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", - "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", - "service": "Spring Apps", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "5234c93f-b651-41dd-80c1-234177b91ced", + "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", + "service": "ExpressRoute", "severity": "中等", - "text": "對應用使用1個以上的應用實例", - "waf": "可靠性" + "text": "避免使用 ExpressRoute 線路進行 VNet 到 VNet 通信。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", + "waf": "性能" }, { - "checklist": "Azure Spring Apps Review", - "guid": "7504c230-6035-4183-95a5-85762acc6075", - "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", - "service": "Spring Apps", - "severity": "中等", - "text": "使用日誌、指標和跟蹤監視 Azure Spring Apps。將 ASA 與應用程式見解集成，並跟蹤故障並創建工作簿。", - "waf": "可靠性" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "e6c4cfd3-e504-4547-a244-7ec66138a720", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", + "severity": "高", + "text": "使用 Azure 防火牆管理發往 Internet 的 Azure 出站流量、非 HTTP/S 入站連接和東西向流量篩選（如果組織需要）", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "安全" }, { - "checklist": "Azure Spring Apps Review", - "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "5a4b1511-e43a-458a-ac22-99c4d7b57d0c", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", "severity": "中等", - "text": "在 Spring Cloud Gateway 中設置自動縮放", - "waf": "可靠性" + "text": "創建全域 Azure 防火牆策略以管理全球網路環境中的安全狀況，並將其分配給所有 Azure 防火牆實例。通過 Azure 基於角色的訪問控制將增量防火牆策略委託給本地安全團隊，允許精細策略滿足特定區域的要求。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "安全" }, { - "checklist": "Azure Spring Apps Review", - "guid": "97411607-b6fd-4335-99d1-9885faf4e392", - "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", - "service": "Spring Apps", + "checklist": "Azure Landing Zone Review", + "guid": "655562f2-b3e4-4563-a4d8-739748b662d6", + "link": "https://learn.microsoft.com/azure/firewall-manager/deploy-trusted-security-partner", + "service": "Firewall", "severity": "低", - "text": "為具有標準使用量和專用計劃的應用啟用自動縮放。", - "waf": "可靠性" - }, - { - "checklist": "Azure Spring Apps Review", - "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", - "link": "https://learn.microsoft.com/azure/spring-apps/overview", - "service": "Spring Apps", - "severity": "中等", - "text": "使用企業計劃為關鍵任務應用提供 Spring Boot 的商業支援。使用其他層，您可以獲得 OSS 支援。", - "waf": "可靠性" + "text": "如果組織希望使用此類解決方案來幫助保護出站連接，請在 Firewall Manager 中配置受支援的合作夥伴 SaaS 安全提供者。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "安全" }, { - "checklist": "Device Provisioning Service Review", - "guid": "cb26b2ba-a9db-45d1-8260-d9c6ec1447d9", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/single-tenant-overview-compare", - "service": "IoT Hub DPS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant", + "guid": "14d99880-2f88-47e8-a134-62a7d85c94af", + "link": "https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules", + "service": "Firewall", "severity": "高", - "text": "根據業務和 SLO 要求選擇正確的邏輯應用託管計劃", - "waf": "可靠性" + "text": "使用基於 FQDN 的網路規則和具有 DNS 代理的 Azure 防火牆，通過應用程式規則不支援的協定篩選到 Internet 的出口流量。", + "waf": "安全" }, { - "checklist": "Device Provisioning Service Review", - "guid": "f6dd7977-1123-4f39-b488-f91415a8430a", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "IoT Hub DPS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant", + "guid": "c10d51ef-f999-455d-bba0-5c90ece07447", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", "severity": "高", - "text": "使用區域冗餘和可用性區域保護邏輯應用免受區域故障的影響", - "waf": "可靠性" + "text": "使用 Azure 防火牆高級版提供額外的安全性和保護。", + "waf": "安全" }, { - "checklist": "Device Provisioning Service Review", - "guid": "8aed4fbf-0830-4883-899d-222a154af478", - "link": "https://learn.microsoft.com/en-us/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "IoT Hub DPS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant", + "guid": "e9c8f584-6d5e-473b-8dc5-acc9fbaab4e3", + "link": "https://learn.microsoft.com/azure/firewall/premium-features", + "service": "Firewall", "severity": "高", - "text": "考慮為關鍵工作負載制定跨區域災難恢復策略", - "waf": "可靠性" + "text": "將 Azure 防火牆威脅情報模式配置為「警報」和「拒絕」，以獲得額外保護。", + "waf": "安全" }, { - "checklist": "Device Provisioning Service Review", - "guid": "da0f033e-d180-4f36-9aa4-c468dba14203", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "IoT Hub DPS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant", + "guid": "b9d0dff5-bdd4-4cd8-88ed-5811610b2b2c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#idps", + "service": "Firewall", "severity": "高", - "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3", - "waf": "可靠性" - }, - { - "checklist": "Device Provisioning Service Review", - "guid": "62711604-c9d1-4b0a-bdb7-5fda54a4f6c1", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "IoT Hub DPS", - "severity": "中等", - "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護邏輯應用代碼", - "waf": "操作" + "text": "將 Azure 防火牆 IDPS 模式配置為「拒絕」 ，以獲得額外的保護。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ab5351f6-383a-45ed-9c5e-b143b16db40a", - "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", - "service": "AKS", - "severity": "低", - "text": "如果 AKS Windows 工作負載需要，可以使用 HostProcess 容器", - "waf": "可靠性" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant", + "guid": "a3784907-9836-4271-aafc-93535f8ec08b", + "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview", + "service": "Firewall", + "severity": "高", + "text": "對於未連接到虛擬 WAN 的 VNet 中的子網，請附加路由表，以便將 Internet 流量重定向到 Azure 防火牆或網路虛擬設備", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a280dcf5-90ce-465d-b8e1-3f9ccbd46926", - "link": "https://learn.microsoft.com/azure/azure-functions/functions-kubernetes-keda", - "service": "AKS", - "severity": "低", - "text": "如果運行事件驅動的工作負載，請使用KEDA", - "waf": "性能" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "715d833d-4708-4527-90ac-1b142c7045ba", + "link": "https://learn.microsoft.com/azure/firewall/firewall-structured-logs", + "service": "Firewall", + "severity": "中等", + "text": "添加診斷設置，以使用「特定於資源」的目標表保存所有 Azure 防火牆部署的日誌。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "26886d20-b66c-457b-a591-19bf8e8f5c58", - "link": "https://dapr.io/", - "service": "AKS", - "severity": "低", - "text": "使用 Dapr 簡化微服務開發", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "e960fc6b-4ab2-4db6-9609-3745135f9ffa", + "link": "https://learn.microsoft.com/azure/firewall-manager/migrate-to-policy", + "service": "Firewall", + "severity": "重要", + "text": "從 Azure 防火牆經典規則（如果存在）遷移到防火牆策略。", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (sku.tier=='Paid') | distinct id,compliant", - "guid": "71d41e36-10cc-457b-9a4b-1410d4395898", - "link": "https://learn.microsoft.com/azure/aks/uptime-sla", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant", + "guid": "22d6419e-b627-4d95-9e7d-019fa759387f", + "link": "https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size", + "service": "Firewall", "severity": "高", - "text": "使用 SLA 支援的 AKS 產品/服務", - "waf": "可靠性" + "text": "對 Azure 防火牆子網使用 /26 前置綴。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1288b3c-6a57-4cfc-9444-51e1a3d3453a", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", - "severity": "低", - "text": "在容器和部署定義中使用中斷預算", - "waf": "可靠性" + "checklist": "Azure Landing Zone Review", + "guid": "828cec2e-af6c-40c2-8fa2-1b681ee63eb7", + "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", + "service": "Firewall", + "severity": "中等", + "text": "將防火牆策略中的規則排列到規則集合組和規則集合中，並根據它們的使用頻率", + "waf": "性能" }, { - "checklist": "Azure AKS Review", - "guid": "3c763963-7a55-42d5-a15e-401955387e5c", - "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", - "service": "ACR", - "severity": "高", - "text": "如果使用專用註冊表，請配置區域複製以將映像存儲在多個區域中", - "waf": "可靠性" + "checklist": "Azure Landing Zone Review", + "guid": "0da83bb1-2f39-49af-b5c9-835fc455e3d1", + "link": "https://learn.microsoft.com/azure/firewall/ip-groups", + "service": "Firewall", + "severity": "中等", + "text": "使用IP組或IP前置綴來減少IP表規則的數量", + "waf": "性能" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f82cb8eb-8c0a-4a63-a25a-4956eaa8dc4a", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", - "service": "AKS", - "severity": "低", - "text": "使用外部應用（如 kubecost）將成本分配給不同的使用者", - "waf": "成本" + "checklist": "Azure Landing Zone Review", + "guid": "c44c6f0e-1642-4a61-a17b-0922f835c93a", + "link": "https://learn.microsoft.com/azure/firewall/tutorial-firewall-dnat", + "service": "Firewall", + "severity": "中等", + "text": "避免將通配符作為DNATS的源IP，例如*或任何通配符，您應該為傳入的DNAT指定源IP", + "waf": "性能" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4d3dfbab-9924-4831-a68d-fdf0d72f462c", - "link": "https://learn.microsoft.com/azure/aks/scale-down-mode", - "service": "AKS", - "severity": "低", - "text": "使用縮減模式刪除/取消分配節點", - "waf": "成本" + "checklist": "Azure Landing Zone Review", + "guid": "7371dc21-251a-47a3-af14-6e01b9da4757", + "link": "https://learn.microsoft.com/azure/nat-gateway/tutorial-hub-spoke-nat-firewall", + "service": "Firewall", + "severity": "中等", + "text": "通過監控 SNAT 埠使用方式、評估 NAT 閘道設置和確保無縫故障轉移來防止 SNAT 埠耗盡。如果埠計數接近限制，則表明 SNAT 耗盡可能迫在眉睫。", + "waf": "性能" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "87e651ea-bc4a-4a87-a6df-c06a4b570ebc", - "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", - "service": "AKS", - "severity": "中等", - "text": "需要時，請在 AKS 群集上使用多實例分組 GPU", - "waf": "成本" + "checklist": "Azure Landing Zone Review", + "guid": "346840b8-1064-496e-8396-4b1340172d52", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#tls-inspection", + "service": "Firewall", + "severity": "高", + "text": "啟用 TLS 檢查", + "waf": "性能" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "2b72a08b-0410-4cd6-9093-e068a5cf27e8", - "link": "https://learn.microsoft.com/azure/aks/start-stop-nodepools", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "39990a13-915c-45f9-a2d3-562d7d6c4b7c", + "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", + "service": "Firewall", "severity": "低", - "text": "如果運行開發/測試群集，請使用 NodePool Start/Stop", - "waf": "成本" + "text": "使用 Web 類別允許或拒絕對特定主題的出站訪問。", + "waf": "性能" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.azurepolicy) and properties.addonProfiles.azurepolicy.enabled==true) | distinct id,compliant", - "guid": "9ca48e4a-85e2-4223-bce8-bb12307ca5f1", - "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "6eff7e6c-6c4a-43d7-be3f-6641c2cb3d4a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/gateway/application-gateway-before-azure-firewall", + "service": "Firewall", "severity": "中等", - "text": "使用適用於 Kubernetes 的 Azure Policy 確保群集符合性", - "waf": "安全" + "text": "作為 TLS 檢查的一部分，請計劃從 Azure 應用閘道接收流量以進行檢查。", + "waf": "性能" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | project id,name,resourceGroup,poolcount=array_length(pools) | extend compliant = (poolcount > 1)", - "guid": "6f158e3e-a3a9-42c2-be7e-2165c3a87af4", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "94f3eede-9aa3-4088-92a3-bb9a56509fad", + "link": "https://learn.microsoft.com/azure/firewall/dns-details", + "service": "Firewall", "severity": "中等", - "text": "使用使用者/系統節點池將應用程式與控制平面分開", + "text": "啟用 Azure 防火牆 DNS 代理配置", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a7a1f893-9bda-4477-98f2-4c116775c2ea", - "link": "https://learn.microsoft.com/azure/aks/use-system-pools", - "service": "AKS", - "severity": "低", - "text": "向系統節點池添加污點以使其專用", + "checklist": "Azure Landing Zone Review", + "guid": "3c5a808d-c695-4c14-a63c-c7ab7a510e41", + "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", + "service": "Firewall", + "severity": "中等", + "text": "確保有策略分配來拒絕直接綁定到虛擬機的公共IP位址", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "55b46a94-8008-4ae7-b7e4-b475b6c8bdbf", - "link": "https://learn.microsoft.com/azure/container-registry/", - "service": "AKS", - "severity": "中等", - "text": "對映像使用專用註冊表，例如 ACR", - "waf": "安全" + "checklist": "Azure Landing Zone Review", + "guid": "1dc04554-dece-4ffb-a49e-5c683e09f8da", + "link": "https://learn.microsoft.com/azure/firewall/firewall-diagnostics", + "service": "Firewall", + "severity": "低", + "text": "將 Azure 防火牆與 Azure Monitor 集成，並啟用診斷日誌記錄來存儲和分析防火牆日誌。", + "waf": "操作" }, { - "checklist": "Azure AKS Review", - "guid": "59bce65d-e8a0-43f9-9879-468d66a786d6", - "link": "https://learn.microsoft.com/azure/security-center/container-security", - "service": "ACR", - "severity": "中等", - "text": "掃描映像以查找漏洞", - "waf": "安全" + "checklist": "Azure Landing Zone Review", + "guid": "64e7000e-3c06-485e-b455-ced7f454cba3", + "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", + "service": "Firewall", + "severity": "低", + "text": "為防火牆規則實施備份", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d167dd18-2b0a-4c24-8b99-9a646f8389a7", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-cluster-isolation", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "d301d6e8-72e5-42e3-911c-c58b5a4b1511", + "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", + "service": "App Gateway", "severity": "高", - "text": "定義應用分離要求（命名空間/節點池/集群）", + "text": "確保注入虛擬網路的 Azure PaaS 服務的控制平面通信不會中斷，例如，使用 0.0.0.0/0 路由或阻止控制平面流量的 NSG 規則。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "5e3df584-eccc-4d97-a3b6-bcda3b50eb2e", - "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", - "service": "AKS", + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "guid": "b3e4563a-4d87-4397-98b6-62d6d15f512a", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "ExpressRoute", "severity": "中等", - "text": "使用 CSI 機密存儲驅動程式將機密存儲在 Azure Key Vault 中", - "waf": "安全" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b03dda6d-58d7-4c89-8ddb-107d5769ae66", - "link": "https://learn.microsoft.com/azure/aks/update-credentials", - "service": "AKS", - "severity": "高", - "text": "如果將服務主體用於群集，請定期刷新憑據（如每季度）", + "text": "通過專用終結點和 ExpressRoute 專用對等互連從本地訪問 Azure PaaS 服務。此方法可避免通過公共 Internet 進行傳輸。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e7ba73a3-0508-4f80-806f-527db30cee96", - "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc", + "guid": "4704489a-8042-4d88-b79d-17b73b22a5a6", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "VNet", "severity": "中等", - "text": "如果需要，請添加金鑰管理服務 etcd 加密", - "waf": "安全" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ec8e4e42-0344-41b0-b865-9123e8956d31", - "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", - "service": "AKS", - "severity": "低", - "text": "如果需要，請考慮使用適用於 AKS 的機密計算", + "text": "默認情況下，不要在所有子網上啟用虛擬網路服務終結點。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c9e95ffe-6dd1-4a17-8c5f-110389ca9b21", - "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "7e7a8ed4-b30e-438c-9f29-812b2363cefe", + "link": "https://learn.microsoft.com/azure/app-service/networking-features", + "service": "Firewall", "severity": "中等", - "text": "考慮使用 Defender for Containers", + "text": "使用 FQDN 而不是 Azure 防火牆或 NVA 中的 IP 位址篩選到 Azure PaaS 服務的出口流量，以防止數據外洩。如果使用專用連結，則可以阻止所有 FQDN，否則僅允許所需的 PaaS 服務。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.servicePrincipalProfile.clientId=='msi') | distinct id,compliant", - "guid": "ed127dd1-42b0-46b2-8c69-99a646f3389a", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", - "service": "AKS", + "ammp": true, + "arm-service": "microsoft.network/expressRouteCircuits", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant", + "guid": "f2aad7e3-bb03-4adc-8606-4123d342a917", + "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", + "service": "ExpressRoute", "severity": "高", - "text": "使用託管標識而不是服務主體", + "text": "至少對閘道子網使用 /27 前置綴", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.aadProfile) | distinct id,compliant", - "guid": "7e42c78e-78c0-46a6-8a21-94956e698dc4", - "link": "https://learn.microsoft.com/azure/aks/managed-aad", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)", + "guid": "11deb39d-8299-4e47-bbe0-0fb5a36318a8", + "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", + "service": "NSG", "severity": "中等", - "text": "將身份驗證與 AAD（使用託管集成）集成", + "text": "不要依賴使用 VirtualNetwork 服務標記的 NSG 入站預設規則來限制連接。", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a2fe27b2-e287-401a-8352-beedf79b488d", - "link": "https://learn.microsoft.com/azure/aks/control-kubeconfig-access", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "872e52e3-611c-4c58-a5a4-b1511e43a58a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", + "service": "NSG", "severity": "中等", - "text": "限制對管理員 kubeconfig （get-credentials --admin） 的訪問", + "text": "使用 NSG 説明保護跨子網的流量，以及跨平台的東/西流量（登陸區域之間的流量）。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "eec4962c-c3bd-421b-b77f-26e5e6b3bec3", - "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "graph": "Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetName=subnets.name,subnetNsg=subnets.properties.networkSecurityGroup | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend compliant = isnotnull(subnetNsg)", + "guid": "9c2299c4-d7b5-47d0-a655-562f2b3e4563", + "service": "NSG", "severity": "中等", - "text": "將授權與 AAD RBAC 集成", + "text": "應用程式團隊應使用子網級別 NSG 的應用程式安全組來幫助保護登陸區域內的多層 VM。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d4f3537c-1346-4dc5-9027-a71ffe1bd05d", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", - "service": "AKS", - "severity": "高", - "text": "在 Kubernetes 中使用命名空間限制 RBAC 許可權", + "checklist": "Azure Landing Zone Review", + "guid": "a4d87397-48b6-462d-9d15-f512a65498f6", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", + "severity": "中等", + "text": "使用 NSG 和應用程式安全組對登陸區域內的流量進行微分段，並避免使用中央 NVA 篩選流量。", + "training": "https://learn.microsoft.com/learn/paths/implement-network-security/", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d2e0d5d7-71d4-41e3-910c-c57b4a4b1410", - "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "dfe237de-143b-416c-91d7-aa9b64704489", + "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "service": "NSG", "severity": "中等", - "text": "對於 Pod Identity Access Management，請使用 Azure AD 工作負載標識（預覽版）", + "text": "啟用 VNet 流日誌並將其饋送到流量分析中，以深入了解內部和外部流量流。", + "training": "https://learn.microsoft.com/learn/modules/design-implement-network-monitoring/", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f4dcf690-1b30-407d-abab-6f8aa780d3a3", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)", + "guid": "0390417d-53dc-44d9-b3f4-c8832f359b41", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "NSG", "severity": "中等", - "text": "對於 AKS 非互動式登錄名，請使用 kubelogin（預覽版）", - "waf": "安全" + "text": "考慮每個 NSG 的 NSG 規則限制 （1000）。", + "training": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", + "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.disableLocalAccounts==true) | distinct id,compliant", - "guid": "b085b1f2-3119-4771-8c9a-bbf4411810ec", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "412e7f98-3f63-4047-82dd-69c5b5c2622f", + "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", + "service": "VWAN", "severity": "中等", - "text": "禁用 AKS 本地帳戶", - "waf": "安全" + "text": "請考慮使用虛擬 WAN 簡化 Azure 網路管理，並確保在虛擬 WAN 路由設計清單中明確描述你的方案", + "training": "https://learn.microsoft.com/learn/modules/introduction-azure-virtual-wan/", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "36abb0db-c118-4f4c-9880-3f30f9a2deb6", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#configure-just-in-time-cluster-access-with-azure-ad-and-aks", - "service": "AKS", - "severity": "低", - "text": "如果需要，請配置 Just-in-time 群集訪問", - "waf": "安全" + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "54b69bad-33aa-4d5e-ac68-e1d76667313b", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "中等", + "text": "使用每個 Azure 區域的虛擬 WAN 中心，通過通用的全域 Azure 虛擬 WAN 跨 Azure 區域將多個登陸區域連接在一起。", + "waf": "性能" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4d7f4c6-79bf-45d0-aa05-ce8fc717e150", - "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "8ac6a9e0-1e6a-483d-b5de-32c199248160", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", "severity": "低", - "text": "如果需要，為 AKS 配置 AAD 條件訪問", - "waf": "安全" + "text": "遵循“Azure 中的流量保留在 Azure 中”原則，以便通過 Microsoft 主幹網络在 Azure 中跨資源進行通信", + "waf": "性能" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e1123a7c-a333-4eb4-a120-4ee3f293c9f3", - "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", - "service": "AKS", - "severity": "低", - "text": "如果 Windows AKS 工作負載需要，請配置 gMSA", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "graph": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant", + "guid": "7d5d1e4e-6146-458d-9558-fd77249b8211", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", + "service": "VWAN", + "severity": "中等", + "text": "對於出站 Internet 流量保護和篩選，請在安全中心部署 Azure 防火牆", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1f711a74-3672-470b-b8b8-a2148d640d79", - "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "6667313b-4f56-464b-9e98-4a859c773e7d", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", + "service": "VWAN", "severity": "中等", - "text": "為了獲得更精細的控制，請考慮使用託管的 Kubelet 身份", - "waf": "安全" + "text": "確保網路體系結構在 Azure 虛擬 WAN 限制範圍內。", + "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "cbd8ac2a-aebc-4a2a-94da-1dbf3dc99248", - "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "261623a7-65a9-417e-8f34-8ef254c27d42", + "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", + "service": "VWAN", "severity": "中等", - "text": "如果使用 AGIC，請勿跨集群共用 AppGW", - "waf": "可靠性" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnull(properties.addonProfiles.httpApplicationRouting) or properties.addonProfiles.httpApplicationRouting.enabled==false) | distinct id,compliant", - "guid": "8008ae7d-7e4b-4475-a6c8-bdbf59bce65d", - "link": "https://learn.microsoft.com/azure/aks/http-application-routing", - "service": "AKS", - "severity": "高", - "text": "不要使用 AKS HTTP 路由載入項，而是將託管 NGINX 入口與應用程式路由載入項一起使用。", - "waf": "可靠性" + "text": "使用適用於虛擬 WAN 的 Azure Monitor 見解監視虛擬 WAN 的端到端拓撲、狀態和關鍵指標。", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7bacd7b9-c025-4a9d-a5d2-25d6bc5439d9", - "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "727c77e1-b9aa-4a37-a024-129d042422c1", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", + "service": "VWAN", "severity": "中等", - "text": "對於 Windows 工作負載，請使用加速網路", - "waf": "性能" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (tolower(properties.networkProfile.loadBalancerSku)=='standard') | distinct id,compliant", - "guid": "ba7da7be-9952-4914-a384-5d997cb39132", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", - "severity": "高", - "text": "使用標準 ALB（而不是基本 ALB）", + "text": "請確保 IaC 部署不會在虛擬 WAN 中禁用分支到分支通信，除非應顯式阻止這些流。", "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22fbe8d6-9b40-47ef-9011-25bb1a555a6b", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "d49ac006-6670-4bc9-9948-d3e0a3a94f4d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", + "service": "VWAN", "severity": "中等", - "text": "如果使用 Azure CNI，請考慮對 NodePool 使用不同的子網", - "waf": "安全" + "text": "使用 AS-Path 作為中心路由首選項，因為它比 ExpressRoute 或 VPN 更靈活。", + "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c3c39c98-6bb2-4c12-859a-114b5e3df584", - "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", - "service": "AKS", + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "2586b854-237e-47f1-84a1-d45d4cd2310d", + "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", + "service": "VWAN", "severity": "中等", - "text": "使用專用終結點（首選）或虛擬網路服務終結點從群集訪問 PaaS 服務", - "waf": "安全" + "text": "請確保 IaC 部署在虛擬 WAN 中配置基於標籤的傳播，否則虛擬中心之間的連接將受到損害。", + "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.networkPlugin=='azure') | distinct id,compliant", - "guid": "a0f61565-9de5-458f-a372-49c831112dbd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", + "ammp": true, + "arm-service": "microsoft.network/virtualWans", + "checklist": "Azure Landing Zone Review", + "guid": "9c75dfef-573c-461c-a698-68598595581a", + "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#what-is-the-recommended-hub-address-space-during-hub-creation", + "service": "VWAN", "severity": "高", - "text": "選擇最適合你要求的 CNI 網路外掛程式（建議使用 Azure CNI）", + "text": "為虛擬中心分配足夠的IP空間，最好是 /23前置綴。", "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "7faf12e7-0943-4f63-8472-2da29c2b1cd6", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "5c986cb2-9131-456a-8247-6e49f541acdc", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", "severity": "高", - "text": "如果使用 Azure CNI，請根據每個節點的最大 Pod 數相應地調整子網的大小", - "waf": "性能" + "text": "戰略性地利用 Azure Policy，為環境定義控制，使用策略計劃對相關策略進行分組。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "22f54b29-bade-43aa-b1e8-c38ec9366673", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "高", - "text": "如果使用 Azure CNI，請檢查每個節點的最大 Pod 數（預設為 30）", - "waf": "性能" + "checklist": "Azure Landing Zone Review", + "guid": "d8a2adb1-17d6-4326-af62-5ca44e5695f2", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "中等", + "text": "將法規和合規性要求映射到 Azure Policy 定義和 Azure 角色分配。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "對於內部應用，組織通常會在其防火牆中打開整個AKS子網。這也會打開對節點的網路訪問，並可能打開對 Pod 的訪問（如果使用 Azure CNI）。如果 LoadBalancer IP 位於不同的子網中，則只有此子網可供應用用戶端使用。另一個原因是，如果 AKS 子網中的 IP 位址是稀缺資源，則將其 IP 位址用於服務會降低群集的最大可伸縮性。", - "guid": "13c00567-4b1e-4945-a459-c373e7ed6162", - "link": "https://learn.microsoft.com/azure/aks/internal-lb", - "service": "AKS", - "severity": "低", - "text": "如果使用專用IP LoadBalancer服務，請使用專用子網（而不是 AKS 子網）", + "checklist": "Azure Landing Zone Review", + "guid": "223ace8c-b123-408c-a501-7f154e3ab369", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "中等", + "text": "在中間根管理組建立 Azure Policy 定義，以便可以在繼承的範圍內分配這些定義", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "43f63047-22d9-429c-8b1c-d622f54b29ba", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", - "severity": "高", - "text": "相應調整服務 IP 位址範圍的大小（這將限制群集的可伸縮性）", - "waf": "可靠性" + "checklist": "Azure Landing Zone Review", + "guid": "3829e7e3-1618-4368-9a04-77a209945bda", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "中等", + "text": "如果需要，在最高適當級別管理策略分配，在最低級別管理排除項。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "57bf217f-6dc8-481c-81e2-785773e9c00f", - "link": "https://learn.microsoft.com/azure/aks/use-byo-cni", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "43334f24-9116-4341-a2ba-527526944008", + "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", + "service": "Policy", "severity": "低", - "text": "如果需要，請添加您自己的 CNI 外掛程式", + "text": "使用 Azure Policy 控制使用者可以在訂閱/管理組級別預配哪些服務", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4b3bb365-9458-44d9-9ed1-5c8f52890364", - "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", - "service": "AKS", - "severity": "低", - "text": "如果需要，請在 AKS 中配置每個節點的公共 IP", - "waf": "性能" + "checklist": "Azure Landing Zone Review", + "guid": "be7d7e48-4327-46d8-adc0-55bcf619e8a1", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "中等", + "text": "盡可能使用內置策略，以最大程度地減少操作開銷。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b3808b9f-a1cf-4204-ad01-3a923ce474db", - "link": "https://learn.microsoft.com/azure/aks/concepts-network", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "description": "通過將「資源策略參與者」角色分配給特定範圍，可以將策略管理委派給相關團隊。例如，中央IT團隊可以監督管理組級別的策略，而應用程式團隊則處理其訂閱的策略，從而在遵守組織標準的情況下實現分散式治理。", + "guid": "3f988795-25d6-4268-a6d7-0ba6c97be995", + "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", + "service": "Policy", "severity": "中等", - "text": "使用入口控制器公開基於 Web 的應用，而不是使用 LoadBalancer 類型的服務公開它們", - "waf": "可靠性" + "text": "在特定範圍內分配內置的「資源策略參與者」角色，以啟用應用程式級治理。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ccb534e7-416e-4a1d-8e93-533b53199085", - "link": "https://learn.microsoft.com/azure/aks/nat-gateway", - "service": "AKS", - "severity": "低", - "text": "使用 Azure NAT 閘道作為 outboundType 來縮放出口流量", - "waf": "可靠性" + "checklist": "Azure Landing Zone Review", + "guid": "19048384-5c98-46cb-8913-156a12476e49", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Policy", + "severity": "中等", + "text": "限制在根管理組範圍內進行的 Azure Policy 分配數，以避免在繼承範圍內通過排除項進行管理。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "8ee9a69a-1b58-4b1e-9c61-476e110a160b", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni#dynamic-allocation-of-ips-and-enhanced-subnet-support", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "5a917e1f-348e-4f25-9c27-d42e8bbac757", + "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", + "service": "Policy", "severity": "中等", - "text": "使用IP的動態分配來避免 Azure CNI IP 耗盡", - "waf": "可靠性" + "text": "如果存在任何數據主權要求，可以部署 Azure 策略來強制實施這些要求", + "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.networkProfile.outboundType=='userDefinedRouting') | distinct id,compliant", - "guid": "3b365a91-7ecb-4e48-bbe5-4cd7df2e8bba", - "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", - "service": "AKS", - "severity": "高", - "text": "如果安全要求要求，請使用 AzFW/NVA 篩選出口流量", + "checklist": "Azure Landing Zone Review", + "guid": "78b22132-b41c-460b-a4d3-df8f73a67dc2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", + "service": "Policy", + "severity": "中等", + "text": "對於主權登陸區，主權政策基線的政策計劃將在正確的 MG 級別部署和分配。", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = ((isnull(properties.apiServerAccessProfile.enablePrivateCluster) or properties.apiServerAccessProfile.enablePrivateCluster==false) and isnotnull(properties.apiServerAccessProfile.authorizedIPRanges)) | distinct id,compliant", - "guid": "c4581559-bb91-463e-a908-aed8c44ce3b2", - "link": "https://learn.microsoft.com/azure/aks/api-server-authorized-ip-ranges", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "caeea0e9-1024-41df-a52e-d99c3f22a6f4", + "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", + "service": "Policy", "severity": "中等", - "text": "如果使用公共 API 終端節點，請限制可以存取它的 IP 位址", + "text": "對於主權登陸區，記錄了“主權控制目標”到策略映射“。", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ecccd979-3b6b-4cda-9b50-eb2eb03dda6d", - "link": "https://learn.microsoft.com/azure/aks/private-clusters", - "service": "AKS", - "severity": "高", - "text": "如果要求要求，請使用私有集群", + "checklist": "Azure Landing Zone Review", + "guid": "9b461617-db7b-4399-8ac6-d4eb7153893a", + "service": "Policy", + "severity": "中等", + "text": "對於主權登陸區，CRUD的“主權控制目標到政策映射”的流程已經到位。", "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | where isnotnull(properties.apiServerAccessProfile.enablePrivateCluster) | extend compliant = (properties.apiServerAccessProfile.enablePrivateCluster==true) | distinct id, compliant", - "guid": "ce7f2a7c-297c-47c6-adea-a6ff838db665", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "67e7a8ed-4b30-4e38-a3f2-9812b2363cef", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", "severity": "中等", - "text": "對於 Windows 2019 和 2022 AKS 節點，可以使用 Calico 網路策略", - "waf": "安全" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = isnotnull(properties.networkProfile.networkPolicy) | distinct id,compliant", - "guid": "58d7c892-ddb1-407d-9769-ae669ca48e4a", - "link": "https://learn.microsoft.com/azure/aks/use-network-policies", - "service": "AKS", - "severity": "高", - "text": "啟用 Kubernetes 網路策略選項 （Calico/Azure）", - "waf": "安全" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "85e2223e-ce8b-4b12-907c-a5f16f158e3e", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", - "severity": "高", - "text": "使用 Kubernetes 網路策略提高集群內安全性", - "waf": "安全" + "text": "使用單個監視器日誌工作區集中管理平臺，但 Azure 基於角色的訪問控制 （Azure RBAC）、數據主權要求或數據保留策略要求使用單獨的工作區的情況除外。", + "training": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "a3a92c2d-e7e2-4165-a3a8-7af4a7a1f893", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", - "service": "AKS", - "severity": "高", - "text": "將 WAF 用於 Web 工作負載（UI 或 API）", - "waf": "安全" + "checklist": "Azure Landing Zone Review", + "guid": "5e6c4cfd-3e50-4454-9c24-47ec66138a72", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Monitor", + "severity": "中等", + "text": "如果日誌保留要求超過 12 年，請將日誌匯出到 Azure 存儲。將不可變存儲與一次寫入、多次讀取策略結合使用，使數據在使用者指定的時間間隔內不可擦除和不可修改。", + "training": "https://learn.microsoft.com/learn/paths/architect-infrastructure-operations/", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "9bda4776-8f24-4c11-9775-c2ea55b46a94", - "link": "https://learn.microsoft.com/azure/virtual-network/ddos-protection-overview", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "e7d7e484-3276-4d8b-bc05-5bcf619e8a13", + "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", + "service": "VM", "severity": "中等", - "text": "在 AKS 虛擬網路中使用 DDoS 標準", - "waf": "安全" + "text": "使用 Azure Policy 監視 OS 等級的虛擬機 （VM） 配置偏移。通過策略啟用 Azure Automanage 計算機配置審核功能可幫助應用程式團隊工作負載輕鬆立即使用功能。", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "Resources | where type=~'microsoft.containerservice/managedclusters' | project resourceGroup,name,pools=properties.agentPoolProfiles | mv-expand pools | project subnetId=tostring(pools.vnetSubnetID) | where isnotempty(subnetId) | join (Resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,enableDdosProtection=tostring(properties.enableDdosProtection),subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,enableDdosProtection,subnetId=tostring(subnets.id)) on subnetId | distinct id,resourceGroup,name,enableDdosProtection | extend compliant = (enableDdosProtection == 'true')", - "guid": "6c46b91a-1107-4485-ad66-3183e2a8c266", - "link": "https://learn.microsoft.com/azure/aks/http-proxy", - "service": "AKS", - "severity": "低", - "text": "如果需要，請添加公司 HTTP 代理", - "waf": "安全" + "checklist": "Azure Landing Zone Review", + "guid": "f9887952-5d62-4688-9d70-ba6c97be9951", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", + "severity": "中等", + "text": "使用 Azure 更新管理員作為 Azure 中 Windows 和 Linux VM 的修補機制。", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e9855d04-c3c3-49c9-a6bb-2c12159a114b", - "link": "https://learn.microsoft.com/azure/aks/servicemesh-about", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "c806c048-26b7-4ddf-b4c2-b4f0c476925d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", + "service": "VM", "severity": "中等", - "text": "考慮使用服務網格進行高級微服務通信管理", - "waf": "安全" + "text": "使用 Azure Arc 將 Azure Update Manager 用作 Azure 外部 Windows 和 Linux VM 的修補機制。", + "training": "https://learn.microsoft.com/azure/update-manager/overview?tabs=azure-vms", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67f7a9ed-5b31-4f38-a3f3-9812b2463cff", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", - "service": "AKS", - "severity": "高", - "text": "設定有關最關鍵指標的警報（請參閱容器見解以獲取建議）", + "checklist": "Azure Landing Zone Review", + "guid": "90483845-c986-4cb2-a131-56a12476e49f", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Network Watcher", + "severity": "中等", + "text": "使用網路觀察程序主動監視流量", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "337453a3-cc63-4963-9a65-22ac19e80696", - "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", - "service": "AKS", - "severity": "低", - "text": "定期查看 Azure 顧問，瞭解有關群集的建議", + "checklist": "Azure Landing Zone Review", + "guid": "6944008b-e7d7-4e48-9327-6d8bdc055bcf", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Monitor", + "severity": "中等", + "text": "使用 Azure Monitor 紀錄獲取見解和報告。", "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "3aa70560-e7e7-4968-be3d-628af35b2ced", - "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", - "service": "AKS", - "severity": "低", - "text": "啟用 AKS 自動證書輪換", + "checklist": "Azure Landing Zone Review", + "guid": "97be9951-9048-4384-9c98-6cb2913156a1", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", + "service": "Monitor", + "severity": "中等", + "text": "使用 Azure Monitor 警報生成操作警報。", "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "e189c599-df0d-45a7-9dd4-ce32c1881370", - "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", - "service": "AKS", - "severity": "高", - "text": "定期（例如，每季度）升級 kubernetes 版本，或使用 AKS 自動升級功能", + "checklist": "Azure Landing Zone Review", + "guid": "fed3c55f-a67e-4875-aadd-3aba3f9fde31", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "Monitor", + "severity": "中等", + "text": "通過 Azure 自動化帳戶使用更改和清單跟蹤時，請確保已選擇支援的區域來將 Log Analytics 工作區和自動化帳戶連結在一起。", "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f7c4c0d-4e51-4464-ad24-57ed67138b82", - "link": "https://learn.microsoft.com/azure/aks/node-updates-kured", - "service": "AKS", - "severity": "高", - "text": "如果您不使用 node-image 升級，請使用 kured 進行 Linux 節點升級", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "eba8cf22-45c6-4dc1-9b57-2cceb3b97ce5", + "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", + "service": "Backup", + "severity": "中等", + "text": "使用 Azure 備份時，請考慮不同的備份類型（GRS、ZRS 和 LRS），因為預設設置為 GRS", + "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "139c9580-ade3-426a-ba09-cf157d9f6477", - "link": "https://learn.microsoft.com/azure/aks/node-image-upgrade", - "service": "AKS", - "severity": "高", - "text": "定期（例如，每周）升級群集節點映像的常規過程", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "f541acdc-e979-4377-acdb-3751ab2ab13a", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "VM", + "severity": "中等", + "text": "使用 Azure 策略通過 VM 擴展自動部署軟體配置，並強制實施符合標準的基線 VM 配置。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "0102ce16-ee30-41e6-b882-e52e4621dd68", - "link": "https://learn.microsoft.com/azure/architecture/example-scenario/bedrock/bedrock-automated-deployments", - "service": "AKS", - "severity": "低", - "text": "考慮使用 gitops 將應用程式或集群配置部署到多個集群", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "description": "Azure Policy 的來賓配置功能可以審核和修正計算機設置（例如，操作系統、應用程式、環境），以確保資源與預期配置一致，更新管理可以對 VM 強制實施修補程式管理。", + "guid": "da6e55d7-d8a2-4adb-817d-6326af625ca4", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "VM", + "severity": "中等", + "text": "通過 Azure Policy 監視 VM 安全配置偏移。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "d7672c26-7602-4482-85a4-14527fbe855c", - "link": "https://learn.microsoft.com/azure/aks/command-invoke", - "service": "AKS", - "severity": "低", - "text": "請考慮在專用群集上使用 AKS 命令調用", + "checklist": "Azure Landing Zone Review", + "guid": "2476e49f-541a-4cdc-b979-377bcdb3751a", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "VM", + "severity": "中等", + "text": "將 Azure Site Recovery 用於 Azure 到 Azure 虛擬機的災難恢復方案。這使您能夠跨區域複製工作負載。", "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "31d7aaab-7571-4449-ab80-53d89e89d17b", - "link": "https://learn.microsoft.com/azure/aks/node-auto-repair#node-autodrain", - "service": "AKS", - "severity": "低", - "text": "對於計劃的事件，請考慮使用 Node Auto Drain", + "checklist": "Azure Landing Zone Review", + "guid": "f625ca44-e569-45f2-823a-ce8cb12308ca", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "Backup", + "severity": "中等", + "text": "使用 Azure 本機備份功能或與 Azure 相容的第三方備份解決方案。", "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "ed0fda7f-211b-47c7-8b6e-c18873fb473c", - "link": "https://learn.microsoft.com/azure/aks/faq", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "826c5c45-bb79-4951-a812-e3bfbfd7326b", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "VM", "severity": "高", - "text": "開發自己的治理實踐，以確保節點 RG（又名“基礎設施 RG”）中的操作員不會執行任何更改", - "waf": "操作" + "text": "在支援可用性區域的區域中對 VM 利用可用性區域。", + "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (properties.nodeResourceGroup !startswith 'MC_') | distinct id,compliant", - "guid": "73b32a5a-67f7-4a9e-b5b3-1f38c3f39812", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", - "severity": "低", - "text": "使用自定義節點 RG（又名“Infra RG”）名稱", - "waf": "操作" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "7ccb7c06-5511-42df-8177-d97f08d0337d", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "VM", + "severity": "高", + "text": "避免在單個 VM 上運行生產工作負載。", + "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b2463cff-e189-4c59-adf0-d5a73dd4ce32", - "link": "https://kubernetes.io/docs/setup/release/notes/", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "84101f59-1941-4195-a270-e28034290e3a", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", "severity": "中等", - "text": "請勿在 YAML 清單中使用已棄用的 Kubernetes API", - "waf": "操作" + "text": "Azure 負載均衡器和應用程式閘道在多個資源之間分配傳入的網路流量。", + "waf": "可靠性" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c1881370-6f7c-44c0-b4e5-14648d2457ed", - "link": "https://learn.microsoft.com/azure-stack/aks-hci/adapt-apps-mixed-os-clusters", - "service": "AKS", - "severity": "低", - "text": "污染 Windows 節點", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "89cc5e11-aa4d-4c3b-893d-feb99215266a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", + "service": "WAF", + "severity": "高", + "text": "添加診斷設置以保存來自 Azure Front Door 和 Azure 應用程式閘道等應用程式交付服務的 WAF 紀錄。定期查看日誌，以檢查攻擊和誤報檢測。", "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "67138b82-0102-4ce1-9ee3-01e6e882e52e", - "link": "https://learn.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-20H2%2Cwindows-10-20H2", - "service": "AKS", - "severity": "低", - "text": "使 Windows 容器修補程式級別與主機修補程式級別保持同步", + "checklist": "Azure Landing Zone Review", + "guid": "7f408960-c626-44cb-a018-347c8d790cdf", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "WAF", + "severity": "中等", + "text": "將 WAF 日誌從應用程式交付服務（如 Azure Front Door 和 Azure 應用程式閘道）發送到 Microsoft Sentinel。檢測攻擊並將 WAF 遙測集成到整個 Azure 環境中。", "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "通過群集級別的診斷設置", - "guid": "5b56ad48-408f-4e72-934c-476ba280dcf5", - "link": "https://learn.microsoft.com/azure/aks/monitor-aks", - "service": "AKS", - "severity": "低", - "text": "將主日誌（又名 API 紀錄）發送到 Azure Monitor 或首選日誌管理解決方案", - "waf": "操作" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "5017f154-e3ab-4369-9829-e7e316183687", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview", + "service": "Key Vault", + "severity": "高", + "text": "使用 Azure Key Vault 儲存機密和憑據", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "64d1a846-e28a-4b6b-9a33-22a635c15a21", - "link": "https://learn.microsoft.com/azure/aks/node-pool-snapshot", - "service": "AKS", - "severity": "低", - "text": "如果需要，請使用 nodePool 快照", - "waf": "成本" + "checklist": "Azure Landing Zone Review", + "graph": "ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)", + "guid": "a0477a20-9945-4bda-9333-4f2491163418", + "link": "https://learn.microsoft.com/azure/key-vault/general/overview-throttling", + "service": "Key Vault", + "severity": "中等", + "text": "對不同的應用程式和區域使用不同的 Azure Key Vault，以避免事務規模限制並限制對機密的訪問。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5a5b252-1e44-4a59-a9d2-399c4d7b68d0", - "link": "https://learn.microsoft.com/azure/aks/spot-node-pool", - "service": "AKS", - "severity": "低", - "text": "考慮將現成節點池用於對時間敏感的工作負載", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "2ba52752-6944-4008-ae7d-7e4843276d8b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "中等", + "text": "預配啟用軟刪除和清除策略的 Azure Key Vault，以允許對已刪除物件進行保留保護。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.aciConnectorLinux) and properties.addonProfiles.aciConnectorLinux.enabled==true) | distinct id,compliant", - "guid": "c755562f-2b4e-4456-9b4d-874a748b662e", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", - "severity": "低", - "text": "考慮用於快速突發的 AKS 虛擬節點", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "dc055bcf-619e-48a1-9f98-879525d62688", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "中等", + "text": "通過將永久刪除密鑰、機密和證書的授權限制為專用的自定義 Microsoft Entra ID 角色，遵循最低特權模型。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "6f8389a7-f82c-4b8e-a8c0-aa63a25a4956", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", - "severity": "高", - "text": "使用 Container Insights（或 Prometheus 等其他工具）監控集群指標", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "6d70ba6c-97be-4995-8904-83845c986cb2", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "中等", + "text": "使用公共證書頒發機構自動執行證書管理和續訂過程，以簡化管理。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.addonProfiles.omsagent) and properties.addonProfiles.omsagent.enabled==true) | distinct id,compliant", - "guid": "eaa8dc4a-2436-47b3-9697-15b1752beee0", - "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", - "service": "AKS", - "severity": "高", - "text": "使用 Container Insights（或 Telegraf/ElasticSearch 等其他工具）存儲和分析集群日誌", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "913156a1-2476-4e49-b541-acdce979377b", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", + "severity": "中等", + "text": "建立金鑰和證書輪換的自動化流程。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "4621dd68-c5a5-4be2-bdb1-1726769ef669", - "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "cdb3751a-b2ab-413a-ba6e-55d7d8a2adb1", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "中等", - "text": "監控節點的 CPU 和記憶體利用率", - "waf": "操作" + "text": "在保管庫上啟用防火牆和虛擬網路服務終結點或專用終結點，以控制對密鑰保管庫的訪問。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "1a4835ac-9422-423e-ae80-b123081a5417", - "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "17d6326a-f625-4ca4-9e56-95f2223ace8c", + "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", + "service": "Key Vault", "severity": "中等", - "text": "如果使用 Azure CNI，請監視每個節點消耗的 Pod IP 的百分比", - "waf": "操作" + "text": "使用平臺中心 Azure Monitor Log Analytics 工作區審核每個 Key Vault 實例中的金鑰、證書和機密使用方式。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "OS 磁碟上的 I/O 是關鍵資源。如果節點中的操作系統在 I/O 上受到限制，這可能會導致不可預知的行為，通常最終導致節點被聲明為 NotReady", - "guid": "415833ea-3ad3-4c2d-b733-165c3acbe04b", - "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "b12308ca-5017-4f15-9e3a-b3693829e7e3", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "中等", - "text": "監視節點中的OS磁碟佇列深度", - "waf": "操作" + "text": "委託 Key Vault 實例化和特權訪問，並使用 Azure Policy 強制實施一致的合規配置。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "be209d39-fda4-4777-a424-d116785c2fa5", - "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "91163418-2ba5-4275-8694-4008be7d7e48", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "中等", - "text": "如果不對 AzFW/NVA 使用出口篩選，請監視標準 ALB 分配的 SNAT 連接埠", - "waf": "操作" + "text": "對每個應用程式、每個環境、每個區域使用 Azure Key Vault。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "74c2ee76-569b-4a79-a57e-dedf91b022c9", - "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "25d62688-6d70-4ba6-a97b-e99519048384", + "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", + "service": "Key Vault", "severity": "中等", - "text": "訂閱 AKS 群集的資源運行狀況通知", - "waf": "操作" + "text": "如果要自帶密鑰，則並非所有考慮的服務都支援此功能。實施相關的緩解措施，以免不一致阻礙預期結果。選擇適當的區域對和災難恢復區域，以最大程度地減少延遲。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "b54eb2eb-03dd-4aa3-9927-18e2edb11726", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", - "severity": "高", - "text": "在 Pod 規範中配置請求和限制", - "waf": "操作" + "checklist": "Azure Landing Zone Review", + "guid": "4ac6b67c-b3a4-4ff9-8e87-b07a7ce7bbdb", + "link": "https://learn.microsoft.com/industry/sovereignty/key-management", + "service": "Key Vault", + "severity": "中等", + "text": "對於主權登陸區域，請使用 Azure Key Vault 託管的 HSM 來儲存機密和憑據。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "769ef669-1a48-435a-a942-223ece80b123", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", - "service": "AKS", + "checklist": "Azure Landing Zone Review", + "guid": "4e5695f2-223a-4ce8-ab12-308ca5017f15", + "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", + "service": "Entra", "severity": "中等", - "text": "強制實施命名空間的資源配額", - "waf": "操作" + "text": "使用 Microsoft Entra ID 報告功能生成訪問控制審核報告。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "081a5417-4158-433e-a3ad-3c2de733165c", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "09945bda-4333-44f2-9911-634182ba5275", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", + "service": "Defender", "severity": "高", - "text": "確保訂閱具有足夠的配額來橫向擴展節點池", - "waf": "操作" + "text": "為所有訂閱啟用Defender雲安全態勢管理。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.autoScalerProfile)) | distinct id,compliant", - "guid": "90ce65de-8e13-4f9c-abd4-69266abca264", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", - "severity": "中等", - "text": "使用群集自動縮放程式", - "waf": "性能" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "36a72a48-fffe-4c40-9747-0ab5064355ba", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", + "service": "Defender", + "severity": "高", + "text": "在所有訂閱上為伺服器啟用Defender雲工作負載保護計劃。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | extend compliant = (isnotnull(properties.austoscalerProfile)) | distinct id,compliant", - "guid": "831c2872-c693-4b39-a887-a561bada49bc", - "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", - "service": "AKS", - "severity": "低", - "text": "自定義 AKS 節點池的節點配置", - "waf": "性能" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "faa19bfe-9d55-4d04-a3c4-919ca1b2d121", - "link": "https://learn.microsoft.com/azure/aks/concepts-scale", - "service": "AKS", - "severity": "中等", - "text": "需要時使用 Horizontal Pod Autoscaler", - "waf": "性能" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "77425f48-ecba-43a0-aeac-a3ac733ccc6a", + "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", + "service": "Defender", + "severity": "高", + "text": "在所有訂閱上為 Azure 資源啟用 Defender 雲工作負載保護計劃。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "description": "更大的節點將帶來更高的性能和功能，例如臨時磁碟和加速網路，但它們會增加爆炸半徑並降低擴展粒度", - "guid": "5ae124ba-34df-4585-bcdc-e9bd3bb0cdb3", - "link": "https://blog.cloudtrooper.net/2020/10/23/which-vm-size-should-i-choose-as-aks-node/", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "24d96b30-61ee-4436-a1cc-d6ef08bc574b", + "link": "https://learn.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection", + "service": "VM", "severity": "高", - "text": "考慮適當的節點大小，不要太大或太小", - "waf": "性能" + "text": "在 IaaS 伺服器上啟用 Endpoint Protection。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "38800e6a-ae01-40a2-9fbc-ae5a06e5462d", - "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", - "service": "AKS", - "severity": "低", - "text": "如果可伸縮性需要超過 5000 個節點，請考慮使用其他 AKS 群集", - "waf": "性能" + "checklist": "Azure Landing Zone Review", + "guid": "15833ee7-ad6c-46d3-9331-65c7acbe44ab", + "link": "https://learn.microsoft.com/azure/security-center/", + "service": "VM", + "severity": "中等", + "text": "通過 Azure Monitor 紀錄和 Defender for Cloud 監視基本作業系統修補偏移。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9583c0f6-6083-43f6-aa6b-df7102c901bb", - "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", - "service": "AKS", - "severity": "低", - "text": "考慮訂閱 EventGrid Events for AKS 自動化", - "waf": "性能" + "checklist": "Azure Landing Zone Review", + "guid": "e5f8d79f-2e87-4768-924c-516775c6ea95", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Monitor", + "severity": "中等", + "text": "將預設資源配置連接到集中式 Azure Monitor Log Analytics 工作區。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c5016d8c-c6c9-4165-89ae-673ef0fff19d", - "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", - "service": "AKS", - "severity": "低", - "text": "若要在 AKS 群集上長時間運行操作，請考慮事件終止", - "waf": "性能" + "checklist": "Azure Landing Zone Review", + "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", + "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", + "service": "Entra", + "severity": "中等", + "text": "對於主權登陸區域，在 Entra ID 租戶上啟用透明日誌。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "c4e37133-f186-4ce1-aed9-9f1b32f6e021", - "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", - "service": "AKS", - "severity": "低", - "text": "如果需要，請考慮將 Azure 專用主機用於 AKS 節點", - "waf": "性能" + "checklist": "Azure Landing Zone Review", + "guid": "d21a922d-5ca7-427a-82a6-35f7b21f1bfc", + "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", + "service": "Entra", + "severity": "中等", + "text": "對於 Sovereign Landing Zone，在 Entra ID 租戶上啟用了客戶密碼箱。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "graph": "where type=='microsoft.containerservice/managedclusters' | project id,resourceGroup,name,pools=properties.agentPoolProfiles | mvexpand pools | extend compliant = (pools.osDiskType=='Ephemeral') | project id,name=strcat(name,'-',pools.name), resourceGroup, compliant", - "guid": "24367b33-6971-45b1-952b-eee0b9b588de", - "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "b03ed428-4617-4067-a787-85468b9ccf3f", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Storage", "severity": "高", - "text": "使用臨時OS磁碟", - "waf": "性能" + "text": "應啟用安全傳輸到存儲帳戶", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "f0ce315f-1120-4166-8206-94f2cf3a4d07", - "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", - "service": "AKS", + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "159aac9f-863f-4f48-82cf-00c28fa97a0e", + "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", + "service": "Storage", "severity": "高", - "text": "對於非臨時磁碟，在運行多個 Pod/節點時，請為節點使用高 IOPS 和更大的 OS 磁碟，因為它需要高性能才能運行多個 Pod，並且會生成具有預設 AKS 日誌輪換閾值的大量日誌", - "waf": "性能" - }, - { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "39c486ce-d5af-4062-89d5-18bb5fd795db", - "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", - "service": "AKS", - "severity": "低", - "text": "對於超高性能存儲選項，請在 AKS 上使用超級磁碟For hyper performance storage option use Ultra Disks on AKS", - "waf": "性能" + "text": "為存儲帳戶啟用容器軟刪除，以恢復已刪除的容器及其內容。", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "9f7547c1-747d-4c56-868a-714435bd19dd", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", - "service": "AKS", - "severity": "中等", - "text": "避免將狀態保留在群集中，並將數據存儲在外部（AzStorage、AzSQL、Cosmos 等）", - "waf": "性能" + "ammp": true, + "checklist": "Azure Landing Zone Review", + "guid": "108d5099-a11d-4445-bd8b-e12a5e95412e", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", + "service": "Key Vault", + "severity": "高", + "text": "使用 Key Vault 機密可避免對敏感資訊（如憑據（虛擬機器用戶密碼）、證書或密鑰）進行硬編碼。", + "waf": "操作" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "24429eb7-2281-4376-85cc-57b4a4b18142", - "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", - "service": "AKS", - "severity": "中等", - "text": "如果使用 AzFiles Standard，出於性能原因，請考慮使用 AzFiles Premium 和/或 ANF", - "waf": "性能" + "checklist": "Azure VMware Solution Design Review", + "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", + "service": "AVS", + "severity": "高", + "text": "確保在本機 Azure 的標識訂閱中部署了 ADDS 域控制器", + "waf": "安全" }, { - "arm-service": "microsoft.containerservice/managedClusters", - "checklist": "Azure AKS Review", - "guid": "83958a8c-2689-4b32-ab57-cfc64546135a", - "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", - "service": "AKS", + "checklist": "Azure VMware Solution Design Review", + "guid": "75089c20-990d-4927-b105-885576f76fc2", + "service": "AVS", "severity": "中等", - "text": "如果使用 Azure 磁碟和可用區，請考慮在區域內為 LRS 磁碟設置節點池，並使用 VolumeBindingMode：WaitForFirstConsumer 在正確的區域中預配存儲，或將 ZRS 磁碟用於跨多個區域的節點池", - "waf": "性能" + "text": "確保將 ADDS 網站和服務配置為將來自基於 Azure 的資源（包括 Azure VMware 解決方案）的身份驗證請求保留到 Azure 本地", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "bb235c70-5e17-496f-bedf-a8a4c8cdec4c", - "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", - "service": "Entra", - "severity": "中等", - "text": "使用長期可撤銷令牌，緩存令牌並使用 Microsoft 標識庫以靜默方式獲取令牌", - "waf": "可靠性" + "checklist": "Azure VMware Solution Design Review", + "guid": "de3aad1e-7c28-4ec9-9666-b7570449aa80", + "service": "AVS", + "severity": "高", + "text": "確保 vCenter 已連接到 ADDS，以啟用基於「指定用戶帳戶」的身份驗證", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "503547c1-447e-4c66-828a-71f0f1ce16dd", - "link": "https://learn.microsoft.com/azure/active-directory-b2c/deploy-custom-policies-devops", - "service": "AAD B2C", + "checklist": "Azure VMware Solution Design Review", + "guid": "cd289ced-6b17-4db8-8554-61e2aee3553a", + "service": "AVS", "severity": "中等", - "text": "請確保登錄使用者流已備份並具有復原能力。請確保用於登錄使用者的代碼已備份且可恢復。與外部進程的彈性介面", - "waf": "可靠性" + "text": "確保從 vCenter 到 ADDS 的連接使用安全協定 （LDAPS）", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "3e3553a4-c873-4964-ab66-2d6c15f51296", - "link": "https://learn.microsoft.com/entra/architecture/resilient-end-user-experience#use-a-content-delivery-network", - "service": "AAD B2C", + "checklist": "Azure VMware Solution Design Review", + "guid": "b9d37dac-43bc-46cd-8d79-a9b24604489a", + "service": "AVS", "severity": "中等", - "text": "自訂品牌資產應託管在CDN上", - "waf": "性能" + "text": "vCenter IdP 中的 CloudAdmin 帳戶僅用作緊急帳戶 （break-glass）", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "5398e6df-d237-4de1-93b1-6c21d79a9b64", - "link": "https://learn.microsoft.com/entra/identity/monitoring-health/reference-sla-performance", - "service": "AAD B2C", - "severity": "低", - "text": "擁有多個標識提供者（即使用您的 Microsoft、Google、Facebook 帳戶登錄）", - "waf": "可靠性" + "checklist": "Azure VMware Solution Design Review", + "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", + "service": "AVS", + "severity": "高", + "text": "確保 NSX-Manager 與外部身份提供程式 （LDAPS） 集成", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "604489a8-f42d-478e-98c0-7a73b22a4a57", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", + "service": "AVS", "severity": "中等", - "text": "遵循 VM 規則，實現 VM 級別的高可用性（高級磁碟，一個區域中的兩個或更多磁碟，位於不同的可用性區域）", - "waf": "可靠性" + "text": "是否已創建 RBAC 模型以在 VMware vSphere 中使用", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "e7a8dd4a-30e3-47c3-b297-11b2362ceee0", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", + "checklist": "Azure VMware Solution Design Review", + "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", + "service": "AVS", "severity": "中等", - "text": "不要複製！複製可能會產生目錄同步問題", - "waf": "可靠性" + "text": "RBAC 許可權應授予 ADDS 組，而不是特定使用者", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "79b598de-fc59-472c-b4cd-21b078036f5e", - "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", - "service": "Windows AD", - "severity": "中等", - "text": "對多區域具有主動-主動", - "waf": "可靠性" - }, - { - "checklist": "Identity Review Checklist", - "guid": "6b4bfd3d-5035-447c-8447-ec66128a71f0", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", - "severity": "中等", - "text": "將 Azure AD 域服務標記添加到其他區域和位置", - "waf": "可靠性" + "checklist": "Azure VMware Solution Design Review", + "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", + "service": "AVS", + "severity": "高", + "text": "Azure 中 Azure VMware 解決方案資源的 RBAC 許可權僅「鎖定」為一組有限的擁有者", + "waf": "安全" }, { - "checklist": "Identity Review Checklist", - "guid": "f1ce16dd-3f1d-45e8-92e4-2e3611cc58b4", - "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", - "service": "Entra", - "severity": "中等", - "text": "將副本集用於DR", - "waf": "可靠性" + "checklist": "Azure VMware Solution Design Review", + "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", + "service": "AVS", + "severity": "高", + "text": "確保所有自定義角色的範圍都具有 CloudAdmin 允許的授權", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4", - "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", - "service": "APIM", - "severity": "中等", - "text": "在全域級別實施錯誤處理策略", - "waf": "操作" + "checklist": "Azure VMware Solution Design Review", + "guid": "9ef1d5e8-32e4-42e3-911c-818b0a0bc510", + "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", + "service": "AVS", + "severity": "高", + "text": "是否為手頭的客戶用例選擇了正確的 Azure VMware 解決方案連接模型", + "waf": "性能" }, { - "checklist": "Azure API Management Review", - "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08", - "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", - "service": "APIM", - "severity": "中等", - "text": "確保所有 API 策略都包含一個元素。", + "checklist": "Azure VMware Solution Design Review", + "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", + "service": "AVS", + "severity": "高", + "text": "確保使用「連接監視器」監視從本地到 Azure 的 ExpressRoute 或 VPN 連接", "waf": "操作" }, { - "checklist": "Azure API Management Review", - "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902", - "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "976e24f2-a7f8-426c-9253-2a92a2a7ed99", + "service": "AVS", "severity": "中等", - "text": "使用策略片段可避免在多個 API 中重複相同的策略定義", + "text": "確保創建從 Azure 本機資源到 Azure VMware 解決方案虛擬機的連接監視器，以監視 Azure VMware 解決方案後端 ExpressRoute 連接", "waf": "操作" }, { - "checklist": "Azure API Management Review", - "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a", - "link": "https://learn.microsoft.com/azure/api-management/monetization-support", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", + "service": "AVS", "severity": "中等", - "text": "如果您計劃通過 API 獲利，請查看“獲利支援”一文，瞭解最佳做法", + "text": "確保創建從本地資源到 Azure VMware 解決方案虛擬機的連接監視器，以監視端到端連接", "waf": "操作" }, { - "checklist": "Azure API Management Review", - "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", + "service": "AVS", "severity": "高", - "text": "啟用診斷設置以將日誌導出到 Azure Monitor", + "text": "使用路由伺服器時，請確保從路由伺服器到 ExR 閘道再到本地的路由不超過 1000 個（ARS 限制）。", "waf": "操作" }, { - "checklist": "Azure API Management Review", - "guid": "8691fa38-45ed-4299-a247-fecd98d35deb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", - "service": "APIM", - "severity": "中等", - "text": "啟用 Application Insights 以獲取更詳細的遙測數據", - "waf": "操作" + "checklist": "Azure VMware Solution Design Review", + "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", + "service": "AVS", + "severity": "高", + "text": "是否為在 Azure 門戶中管理 Azure VMware 解決方案資源的角色實現了 Privileged Identity Management（不允許長期許可權）", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", + "service": "AVS", "severity": "高", - "text": "針對最關鍵的指標配置警報", - "waf": "操作" + "text": "應為 Azure VMware 解決方案 PIM 角色實現 Privileged Identity Management 審核報告", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", - "service": "APIM", - "severity": "高", - "text": "確保自定義 SSL 證書儲存在 Azure Key Vault 中，以便可以安全地訪問和更新它們", + "checklist": "Azure VMware Solution Design Review", + "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", + "service": "AVS", + "severity": "中等", + "text": "如果使用 Privileged Identity Management，請確保使用有效的 SMTP 記錄創建啟用了 Entra ID 的有效帳戶，以便 Azure VMware 解決方案自動主機更換通知。（需要長期許可）", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "8defc4d7-21d3-41d2-90fb-707ae9eab40e", + "service": "AVS", "severity": "高", - "text": "使用 Azure AD 保護對 API（數據平面）的傳入請求", + "text": "將 CloudAdmin 帳戶的使用限制為僅緊急訪問", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", + "service": "AVS", "severity": "中等", - "text": "使用 Microsoft Entra ID 在開發人員門戶中對用戶進行身份驗證", + "text": "在 vCenter 中創建自定義 RBAC 角色，以在 vCenter 中實施最小特權模型", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "9dd24429-eb72-4281-97a1-51c5bb4e4f18", + "service": "AVS", "severity": "中等", - "text": "創建適當的組來控制產品的可見性", + "text": "是定義為定期輪換 cloudadmin （vCenter） 和管理員 （NSX） 憑據的過程", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "06862505-2d9a-4874-9491-2837b00a3475", - "link": "https://learn.microsoft.com/azure/api-management/backends", - "service": "APIM", - "severity": "中等", - "text": "使用後端功能消除冗餘 API 後端配置", - "waf": "操作" + "checklist": "Azure VMware Solution Design Review", + "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", + "service": "AVS", + "severity": "高", + "text": "使用集中式識別提供者用於在 Azure VMware 解決方案上運行的工作負載 （VM）", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "79377bcd-b375-41ab-8ab0-ead66e15d3d4", + "service": "AVS", "severity": "中等", - "text": "使用命名值存儲可在策略中使用的通用值", - "waf": "操作" + "text": "是否在 NSX-T 中實施了東西向流量篩選", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", - "service": "APIM", - "severity": "中等", - "text": "對於DR，利用高級層，跨兩個或多個區域擴展部署，實現99.99%的SLA", - "waf": "可靠性" + "checklist": "Azure VMware Solution Design Review", + "guid": "a2adb1c3-d232-46af-825c-a44e1695fddd", + "service": "AVS", + "severity": "高", + "text": "Azure VMware 解決方案上的工作負載不會直接向 Internet 公開。流量由 Azure 應用程式閘道、Azure 防火牆或第三方解決方案進行篩選和檢查", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044", - "link": "https://learn.microsoft.com/azure/api-management/high-availability", - "service": "APIM", - "severity": "中等", - "text": "在兩個或多個可用區中部署至少一台設備，SLA 提高 99.99%", - "waf": "可靠性" + "checklist": "Azure VMware Solution Design Review", + "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", + "service": "AVS", + "severity": "高", + "text": "對 Azure VMware 解決方案和基於 Azure VMware 解決方案的工作負載的入站 Internet 請求實施審核和日誌記錄", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", - "service": "APIM", - "severity": "高", - "text": "確保有一個自動備份例程", - "waf": "可靠性" + "checklist": "Azure VMware Solution Design Review", + "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", + "service": "AVS", + "severity": "中等", + "text": "對來自 Azure VMware 解決方案或基於 Azure VMware 解決方案的工作負載的出站 Internet 連接實施會話監視，以識別可疑/惡意活動", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485", - "link": "https://learn.microsoft.com/azure/api-management/retry-policy", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "334fdf91-c234-4182-a652-75269440b4be", + "service": "AVS", "severity": "中等", - "text": "使用策略添加故障轉移後端 URL 和緩存，以減少失敗的調用。", - "waf": "可靠性" + "text": "是否在 Azure 的 ExR/VPN 閘道子網上啟用了 DDoS 標準防護", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs", - "service": "APIM", - "severity": "低", - "text": "如果需要以高性能級別進行日誌記錄，請考慮事件中心策略", - "waf": "操作" + "checklist": "Azure VMware Solution Design Review", + "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", + "service": "AVS", + "severity": "中等", + "text": "使用專用特權訪問工作站 （PAW） 管理 Azure VMware 解決方案、vCenter、NSX Manager 和 HCX Manager", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed", - "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", + "service": "AVS", "severity": "中等", - "text": "應用限制策略來控制每秒的請求數", - "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/", - "waf": "性能" + "text": "為 Azure VMware 解決方案上運行的工作負載啟用高級威脅檢測（Microsoft Defender for Cloud，又名 ASC）", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", + "service": "AVS", "severity": "中等", - "text": "配置自動縮放以在負載增加時橫向擴展實例數", - "waf": "性能" + "text": "使用適用於伺服器的 Azure ARC 使用 Azure 本機技術正確管理在 Azure VMware 解決方案上運行的工作負載（適用於 Azure VMware 解決方案的 Azure ARC 尚不可用）", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "84b94abb-59b6-4b9d-8587-3413669468e8", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway", - "service": "APIM", - "severity": "中等", - "text": "在 Azure 沒有靠近後端 API 的區域的地方部署自承載閘道。", - "waf": "性能" + "checklist": "Azure VMware Solution Design Review", + "guid": "85e12139-bd7b-4b01-8f7b-95ef6e043e2a", + "service": "AVS", + "severity": "低", + "text": "確保 Azure VMware 解決方案上的工作負載在運行時使用足夠的數據加密（如來賓內磁碟加密和 SQL TDE）。（vSAN 靜態加密為預設加密）", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0", - "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale", - "service": "APIM", - "severity": "中等", - "text": "將高級層用於生產工作負載。", - "waf": "可靠性" + "checklist": "Azure VMware Solution Design Review", + "guid": "a3592718-e6e2-4051-9267-6ae46691e883", + "service": "AVS", + "severity": "低", + "text": "使用來賓內加密時，請盡可能將加密密鑰存儲在 Azure Key Vault 中", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "5ac94222-3e13-4810-9230-81a941741583", + "service": "AVS", "severity": "中等", - "text": "在多區域模型中，使用策略根據可用性或延遲將請求路由到區域後端。", + "text": "請考慮對 Azure VMware 解決方案上運行的工作負載使用擴展的安全更新支援（Azure VMware 解決方案符合 ESU 條件）", + "waf": "安全" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "3ef7ad7c-6d37-4331-95c7-acbe44bbe609", + "service": "AVS", + "severity": "高", + "text": "確保使用適當的 vSAN 資料冗餘方法（RAID 規範）", "waf": "可靠性" }, { - "checklist": "Azure API Management Review", - "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd", - "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "d88408f3-7273-44c8-96ba-280214590146", + "service": "AVS", "severity": "高", - "text": "注意APIM的局限性", + "text": "確保允許失敗策略已到位，以滿足您的 vSAN 儲存需求", "waf": "可靠性" }, { - "checklist": "Azure API Management Review", - "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600", - "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", + "service": "AVS", "severity": "高", - "text": "確保自承載閘道部署具有復原能力。", + "text": "確保已請求足夠的配額，確保已考慮增長和災難恢復要求", "waf": "可靠性" }, { - "checklist": "Azure API Management Review", - "guid": "7519e385-a88b-4d34-966b-6269d686e890", - "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "5d38e53f-9ccb-4d86-a266-acca274faa19", + "service": "AVS", "severity": "中等", - "text": "在APIM前面使用 Azure Front Door 進行多區域部署", - "waf": "性能" + "text": "確保瞭解對 ESXi 的訪問限制，其中存在可能影響第三方解決方案的訪問限制。", + "waf": "操作" }, { - "checklist": "Azure API Management Review", - "guid": "cd45c90e-7690-4753-930b-bf290c69c074", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", + "service": "AVS", "severity": "中等", - "text": "在虛擬網络 （VNet） 中部署服務Deploy the service within a Virtual Network （VNet）", - "waf": "安全" + "text": "確保您制定了有關ESXi主機密度和效率的策略，並牢記請求新節點的提前期", + "waf": "操作" }, { - "checklist": "Azure API Management Review", - "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", + "service": "AVS", "severity": "中等", - "text": "將網路安全組 （NSG） 部署到子網，以限制或監視進出APIM的流量。", - "waf": "安全" + "text": "確保 Azure VMware 解決方案的良好成本管理流程已到位 - 可以使用 Azure 成本管理", + "waf": "成本" }, { - "checklist": "Azure API Management Review", - "guid": "67437a28-2721-4a2c-becd-caa54c8237a5", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", + "service": "AVS", + "severity": "低", + "text": "Azure 預留實例是否用於優化使用 Azure VMware 解決方案的成本", + "waf": "成本" + }, + { + "checklist": "Azure VMware Solution Design Review", + "guid": "6691e883-5ac9-4422-83e1-3810523081a9", + "service": "AVS", "severity": "中等", - "text": "部署專用終結點以在未將APIM部署到 VNet 時篩選傳入流量。", + "text": "使用其他 Azure 本機服務時，請考慮使用 Azure 專用連結", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "d698adbd-3288-44cb-b10a-9b572da395ae", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "db611712-6904-40b4-aa3d-3e0803276d4b", + "service": "AVS", "severity": "高", - "text": "禁用公網訪問", - "waf": "安全" + "text": "確保所有必需的資源都駐留在同一個 Azure 可用性區域中", + "waf": "性能" }, { - "checklist": "Azure API Management Review", - "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd", - "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "48b262d6-cc5f-4512-a253-98e6db9d37da", + "service": "AVS", "severity": "中等", - "text": "使用 PowerShell 自動化腳本簡化管理", - "waf": "操作" + "text": "為 Azure VMware 解決方案來賓 VM 工作負載啟用 Microsoft Defender for Cloud", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345", - "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", + "service": "AVS", "severity": "中等", - "text": "通過基礎架構即代碼配置APIM。查看 Cloud Adaption Framework 中的 DevOps 最佳實踐 APIM 登陸區域加速器", - "waf": "操作" + "text": "使用已啟用 Azure Arc 的伺服器管理 Azure VMware 解決方案來賓 VM 工作負載", + "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6", - "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", - "service": "APIM", - "severity": "中等", - "text": "促進 Visual Studio Code APIM 擴展的使用，以加快 API 開發速度", + "checklist": "Azure VMware Solution Design Review", + "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", + "service": "AVS", + "severity": "高", + "text": "在 Azure VMware 解決方案上啟用診斷和指標日誌記錄", "waf": "操作" }, { - "checklist": "Azure API Management Review", - "guid": "354f1c03-8112-4965-85ad-c0074bddf231", - "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", + "service": "AVS", "severity": "中等", - "text": "在工作流中實施DevOps和 CI/CD", + "text": "將Log Analytics代理部署到 Azure VMware 解決方案來賓 VM 工作負載", "waf": "操作" }, { - "checklist": "Azure API Management Review", - "guid": "b6439493-426a-45f3-9697-cf65baee208d", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients", - "service": "APIM", - "severity": "中等", - "text": "使用用戶端證書身份驗證保護 API", - "waf": "安全" - }, - { - "checklist": "Azure API Management Review", - "guid": "2a67d143-1033-4c0a-8732-680896478f08", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "589d457a-927c-4397-9d11-02cad6aae11e", + "service": "AVS", "severity": "中等", - "text": "使用用戶端證書身份驗證保護後端服務", - "waf": "安全" + "text": "確保已針對 Azure VMware 解決方案 VM 工作負載記錄並實施了備份策略和解決方案", + "waf": "操作" }, { - "checklist": "Azure API Management Review", - "guid": "074435f5-4a46-41ac-b521-d6114cb5d845", - "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "ee29711b-d352-4caa-ab79-b198dab81932", + "service": "AVS", "severity": "中等", - "text": "查看“緩解 OWASP API 安全前 10 大威脅的建議”一文，並查看適用於您的 API 的內容", + "text": "使用 Microsoft Defender for Cloud 對 Azure VMware 解決方案上運行的工作負載進行合規性監視", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9", - "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", + "service": "AVS", "severity": "中等", - "text": "使用授權功能簡化後端 API 的 OAuth 2.0 令牌管理", + "text": "是否將適用的合規性基線添加到 Microsoft Defender for Cloud", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091", - "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", + "service": "AVS", "severity": "高", - "text": "加密傳輸中的資訊時，請使用最新的 TLS 版本。盡可能禁用過時和不必要的協議和密碼。", + "text": "在選擇要用於 Azure VMware 解決方案部署的 Azure 區域時是否評估了數據駐留", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "f8af3d94-1d2b-4070-846f-849197524258", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "832e42e3-611c-4818-a0a0-bc510e43a18a", + "service": "AVS", "severity": "高", - "text": "確保機密（命名值）存儲在 Azure Key Vault 中，以便可以安全地訪問和更新它們", + "text": "數據處理影響（服務提供者/服務消費者模型）是否清晰且有據可查", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "791abd8b-7706-4e31-9569-afefde724be3", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "547c1747-dc56-4068-a714-435cd19dd244", + "service": "AVS", "severity": "中等", - "text": "盡可能使用託管標識向其他 Azure 資源進行身份驗證", + "text": "僅當出於合規性原因需要時，才考慮將CMK（客戶管理的密鑰）用於 vSAN。", "waf": "安全" }, { - "checklist": "Azure API Management Review", - "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", - "service": "APIM", + "checklist": "Azure VMware Solution Design Review", + "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", + "service": "AVS", "severity": "高", - "text": "使用 APIM 前面部署應用程式閘道來使用 Web 應用程式防火牆 （WAF）", - "waf": "安全" + "text": "創建儀錶板以啟用核心 Azure VMware 解決方案監視見解", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "應用與存儲相關的 Microsoft 雲安全基準中的指導", - "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", - "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", - "service": "Azure Storage", - "severity": "中等", - "text": "請考慮「存儲的 Azure 安全基線”", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", + "service": "AVS", + "severity": "高", + "text": "針對 Azure VMware 解決方案性能（CPU >80%、平均記憶體 >80%、vSAN >70%）自動警報的關鍵閾值創建警告警報", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "默認情況下，Azure 儲存具有公共IP位址，並且可通過Internet訪問。專用終結點允許僅向需要訪問的 Azure 計算資源安全地公開 Azure 存儲，從而消除對公共 Internet 的暴露", - "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", - "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "9659e396-80e7-4828-ac93-5657d02bff45", + "service": "AVS", "severity": "高", - "text": "考慮將專用終結點用於 Azure 存儲", - "waf": "安全" - }, - { - "checklist": "Azure Blob Storage Review", - "description": "新創建的存儲帳戶是使用ARM部署模型創建的，因此 RBAC、審核等都已啟用。確保訂閱中沒有具有經典部署模型的舊存儲帳戶", - "guid": "30e37c3e-2971-41b2-963c-eee079b598de", - "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", - "service": "Azure Storage", - "severity": "中等", - "text": "確保較舊的存儲帳戶未使用“經典部署模型”", - "waf": "安全" + "text": "確保創建嚴重警示以監控 vSAN 消耗量是否低於 75%，因為這是 VMware 的支援閾值", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "利用 Microsoft Defender 瞭解可疑活動和錯誤配置。", - "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", - "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", + "service": "AVS", "severity": "高", - "text": "為所有存儲帳戶啟用 Microsoft DefenderEnable Defender for all of your storage accounts", - "waf": "安全" + "text": "確保為 Azure 服務運行狀況警報和通知配置警報", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "軟刪除機制允許恢復意外刪除的 Blob。", - "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", + "service": "AVS", "severity": "中等", - "text": "為 blob 啟用“軟刪除”", - "waf": "安全" + "text": "將 Azure VMware 解決方案記錄設定為發送到 Azure 儲存帳戶或 Azure EventHub 進行處理", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "請考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。", - "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", - "service": "Azure Storage", - "severity": "中等", - "text": "禁用 blob 的“軟刪除”", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", + "service": "AVS", + "severity": "低", + "text": "如果需要深入瞭解 VMware vSphere：解決方案中是否使用了 vRealize Operations 和/或 vRealize Network Insights？", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "容器的軟刪除使你能夠在刪除容器后恢復容器，例如從意外刪除操作中恢復。", - "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", + "service": "AVS", "severity": "高", - "text": "為容器啟用“軟刪除”", - "waf": "安全" + "text": "確保虛擬機的 vSAN 儲存策略不是預設存儲策略，因為此策略應用厚置備", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "請考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。", - "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", - "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "d9ef1d5e-832d-442e-9611-c818b0afbc51", + "service": "AVS", "severity": "中等", - "text": "禁用容器的“軟刪除”", - "waf": "安全" + "text": "確保未將 vSphere 內容庫放置在 vSAN 上，因為 vSAN 是有限的資源", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "通過強制使用者在刪除之前先刪除刪除鎖，防止意外刪除存儲帳戶", - "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", - "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", - "service": "Azure Storage", - "severity": "高", - "text": "在存儲帳戶上啟用資源鎖", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", + "service": "AVS", + "severity": "中等", + "text": "確保備份解決方案的數據存儲庫存儲在 vSAN 儲存之外。在 Azure 本機或磁碟池支持的數據存儲中", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "請考慮對 blob 使用“合法保留”或“基于時間的保留”策略，這樣就無法刪除 blob、容器或存儲帳戶。請注意，「不可能」實際上意味著「不可能」;存儲帳戶包含不可變 blob 後，「擺脫」該存儲帳戶的唯一方法是取消 Azure 訂閱。", - "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", - "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", - "service": "Azure Storage", - "severity": "高", - "text": "考慮不可變的 blob", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", + "service": "AVS", + "severity": "中等", + "text": "確保使用 Azure Arc for Servers 進行混合管理，確保在 Azure VMware 解決方案上運行的工作負載（Arc for Azure VMware 解決方案處於預覽狀態）", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "請考慮禁用對存儲帳戶的未受保護的 HTTP/80 訪問，以便對所有數據傳輸進行加密、完整性保護，並對伺服器進行身份驗證。", - "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", - "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", - "service": "Azure Storage", - "severity": "高", - "text": "需要 HTTPS，即在儲存帳戶上禁用埠 80", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", + "service": "AVS", + "severity": "中等", + "text": "確保使用 Azure Log Analytics 和 Azure Monitor 監視在 Azure VMware 解決方案上運行的工作負載", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "在儲存帳戶上配置自定義域（主機名）時，請檢查是否需要 TLS/HTTPS;如果是這樣，可能需要將 Azure CDN 放在存儲帳戶的前面。", - "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", - "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", - "service": "Azure Storage", - "severity": "高", - "text": "強制實施 HTTPS（禁用 HTTP）時，請檢查是否未對儲存帳戶使用自定義域 （CNAME）。", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", + "service": "AVS", + "severity": "中等", + "text": "在現有更新管理工具或 Azure 更新管理中包括在 Azure VMware 解決方案上運行的工作負載", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "當用戶端使用SAS令牌訪問 blob 資料時，要求使用 HTTPS 有助於將憑據丟失的風險降至最低。", - "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", + "service": "AVS", "severity": "中等", - "text": "將共享訪問簽名 （SAS） 令牌限製為僅 HTTPS 連接", - "waf": "安全" + "text": "使用 Azure Policy 在 Azure 管理、監視和安全解決方案中加入 Azure VMware 解決方案工作負載", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "在可能的情況下，AAD 令牌應優先於共用訪問簽名", - "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", - "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", - "service": "Azure Storage", - "severity": "高", - "text": "使用 Azure Active Directory （Azure AD） 令牌進行 blob 訪問", + "checklist": "Azure VMware Solution Design Review", + "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", + "service": "AVS", + "severity": "中等", + "text": "確保在 Azure VMware 解決方案上運行的工作負載已載入 Microsoft Defender for Cloud", "waf": "安全" }, { - "checklist": "Azure Blob Storage Review", - "description": "將角色分配給使用者、組或應用程式時，請僅向該安全主體授予他們執行任務所需的許可權。限制對資源的訪問有助於防止無意和惡意濫用數據。", - "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", + "service": "AVS", "severity": "中等", - "text": "IaM 許可權中的最低特權", - "waf": "安全" + "text": "確保備份不存儲在 vSAN 上，因為 vSAN 是有限的資源", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "使用者委派 SAS 使用 Azure Active Directory （Azure AD） 憑據以及為 SAS 指定的許可權進行保護。使用者委派 SAS 在範圍和功能方面類似於服務 SAS，但比服務 SAS 具有安全優勢。", - "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", - "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", - "service": "Azure Storage", - "severity": "高", - "text": "使用 SAS 時，首選「使用者委派 SAS」，而不是基於存儲帳戶密鑰的 SAS。", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "5e6bfbb9-ed50-4354-9cc4-47e826028a71", + "service": "AVS", + "severity": "中等", + "text": "是否考慮了所有災難恢復解決方案，並決定了最適合您業務的解決方案？[SRM/JetStream/Zerto/Veeam/...]", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "存儲帳戶金鑰（“共用金鑰”）幾乎沒有審核功能。雖然可以監控誰/何時獲取密鑰副本，但一旦密鑰掌握在多個人手中，就不可能將使用方式歸因於特定使用者。僅依靠 AAD 身份驗證可以更輕鬆地將存儲存取許可權綁定到使用者。", - "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", - "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", - "service": "Azure Storage", - "severity": "高", - "text": "請考慮禁用存儲帳戶密鑰，以便僅支援 AAD 訪問（和使用者委派 SAS）。", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", + "service": "AVS", + "severity": "中等", + "text": "當災難恢復技術是本機 Azure IaaS 時，請使用 Azure Site Recovery", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "使用活動日誌數據來標識查看或更改存儲帳戶安全性的“時間”、“人員”、“內容”和“方式”（即存儲帳戶密鑰、訪問策略等）。", - "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", - "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "b0afbc51-0e43-4a18-a9cd-289bed6b17db", + "service": "AVS", "severity": "高", - "text": "請考慮使用 Azure Monitor 審核存儲帳戶上的控制平面操作", - "waf": "安全" + "text": "將自動恢復計劃與任一災難解決方案結合使用，盡可能避免手動任務", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "通過金鑰過期策略，您可以設置帳戶訪問金鑰輪換的提醒。如果指定的時間間隔已過且鍵尚未旋轉，則會顯示提醒。", - "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", - "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "8255461e-2aee-4345-9aec-8339248b262d", + "service": "AVS", "severity": "中等", - "text": "使用存儲帳戶密鑰時，請考慮啟用“金鑰過期策略”", - "waf": "安全" + "text": "使用地緣政治區域對作為輔助災難恢復環境", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "SAS 過期策略指定 SAS 有效的建議時間間隔。SAS 過期策略適用於服務 SAS 或帳戶 SAS。當使用者生成的服務 SAS 或帳戶 SAS 的有效期間隔大於建議的時間間隔時，他們會看到警告。", - "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", - "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", - "service": "Azure Storage", - "severity": "中等", - "text": "考慮配置 SAS 過期策略", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "6cc5f512-9253-498e-9da9-d37dac43bc6c", + "service": "AVS", + "severity": "高", + "text": "在區域之間使用 2 個不同的地址空間，例如：10.0.0.0/16 和 192.168.0.0/16 用於不同的區域", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "存儲存取策略提供了撤銷服務 SAS 許可權的選項，而無需重新生成儲存帳戶密鑰。", - "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", - "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", + "service": "AVS", "severity": "中等", - "text": "考慮將 SAS 連結到儲存存取策略", - "waf": "安全" + "text": "ExpressRoute Global Reach 是用於主 Azure VMware 解決方案私有雲和輔助 Azure VMware 解決方案私有雲之間的連接，還是通過網路虛擬設備完成路由？", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", - "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", - "service": "Azure Storage", - "severity": "中等", - "text": "請考慮配置應用程式的原始程式碼儲存庫，以檢測簽入的連接字串和存儲帳戶密鑰。", - "waf": "安全" - }, - { - "checklist": "Azure Blob Storage Review", - "description": "理想情況下，應用程式應使用託管標識向 Azure 儲存進行身份驗證。如果無法做到這一點，請考慮在 Azure KeyVault 或等效服務中使用存儲憑據（連接字串、存儲帳戶密鑰、SAS、服務主體憑據）。", - "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", - "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", - "service": "Azure Storage", - "severity": "高", - "text": "請考慮將連接字串儲存在 Azure KeyVault 中（在無法實現託管標識的情況下）", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", + "service": "AVS", + "severity": "中等", + "text": "是否考慮了所有備份解決方案，並決定了最適合您業務的解決方案？[ MABS/CommVault/Metallic.io/Veeam/ .", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "在臨時 SAS 服務 SAS 或帳戶 SAS 上使用近期過期時間。這樣，即使 SAS 遭到入侵，它也只能在很短的時間內有效。如果無法引用存儲訪問策略，則此做法尤為重要。近期過期時間還通過限制可上傳到 blob 的時間來限制可寫入 blob 的數據量。", - "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", - "severity": "高", - "text": "爭取縮短臨時 SAS 的有效期", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", + "service": "AVS", + "severity": "中等", + "text": "將備份解決方案部署在與 Azure VMware 解決方案私有雲相同的區域中", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "創建 SAS 時，請盡可能具體和嚴格。首選單個資源和操作的 SAS，而不是提供更廣泛訪問許可權的 SAS。", - "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", - "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", + "service": "AVS", "severity": "中等", - "text": "將窄範圍應用於SAS", - "waf": "安全" + "text": "在 vSan 外部的 Azure 本機組件上部署備份解決方案", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "SAS 可以包含用戶端 IP 位址或位址範圍有權使用 SAS 請求資源的參數。", - "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", - "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", - "service": "Azure Storage", - "severity": "中等", - "text": "盡可能考慮將SAS的範圍限定為特定的用戶端IP位址", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", + "service": "AVS", + "severity": "低", + "text": "是否已制定請求還原由 Azure 平臺管理的 VMware 元件的流程？", + "waf": "可靠性" }, { - "checklist": "Azure Blob Storage Review", - "description": "SAS 無法限制用戶端上傳的數據量;考慮到存儲量隨時間變化的定價模型，驗證用戶端是否惡意上傳了大量內容可能是有意義的。", - "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", - "service": "Azure Storage", + "checklist": "Azure VMware Solution Design Review", + "guid": "4604489a-8f42-4d78-b78c-b7a33bd2a0a1", + "service": "AVS", "severity": "低", - "text": "請考慮在用戶端使用SAS上傳檔后檢查上傳的數據。", - "waf": "安全" + "text": "對於手動部署，必須記錄所有配置和部署", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "使用「本地使用者帳戶」通過 SFTP 訪問 Blob 儲存時，“通常”RBAC 控制不適用。通過 NFS 或 REST 進行的 Blob 訪問可能比 SFTP 訪問更嚴格。遺憾的是，截至 2023 年初，本地使用者是 SFTP 端點當前支援的唯一身份管理形式", - "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", - "service": "Azure Storage", - "severity": "高", - "text": "SFTP：限制 SFTP 訪問的「本地使用者」數量，並審核一段時間內是否需要訪問。", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", + "service": "AVS", + "severity": "低", + "text": "對於手動部署，請考慮實施資源鎖，以防止對 Azure VMware 解決方案私有雲執行意外操作", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", - "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", - "service": "Azure Storage", - "severity": "中等", - "text": "SFTP：SFTP 端點不支持類似 POSIX 的 ACL。", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "b79b198d-ab81-4932-a9fc-9d1bb78036f5", + "service": "AVS", + "severity": "低", + "text": "對於自動化部署，請部署最小的私有雲並根據需要進行擴展", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "存儲支援 CORS（跨域資源分享），即一種 HTTP 功能，使來自不同域的 Web 應用程式能夠放寬同源策略。啟用 CORS 時，請將 CorsRules 保留為最低許可權。", - "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", - "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", - "service": "Azure Storage", - "severity": "高", - "text": "避免過於寬泛的 CORS 策略", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "e6bfbb9e-d503-4547-ac44-7e826128a71f", + "service": "AVS", + "severity": "低", + "text": "對於自動部署，請在開始部署之前請求或預留配額", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "靜態數據始終在伺服器端加密，此外也可能在用戶端加密。伺服器端加密可能使用平臺管理的金鑰（預設）或客戶管理的金鑰進行。用戶端加密可以通過讓用戶端按 blob 向 Azure 儲存提供加密/解密金鑰，或者完全在用戶端處理加密來實現。因此，完全不依賴 Azure 存儲來保證機密性。", - "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", - "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", - "service": "Azure Storage", - "severity": "高", - "text": "確定應如何加密靜態數據。了解數據的線程模型。", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", + "service": "AVS", + "severity": "低", + "text": "對於自動部署，請確保通過自動化或 Azure Policy 創建相關資源鎖，以便進行適當的治理", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", - "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", - "service": "Azure Storage", - "severity": "中等", - "text": "確定應使用哪種/是否應使用平臺加密。", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", + "service": "AVS", + "severity": "低", + "text": "為 ExR 授權金鑰實現人類可理解的名稱，以便輕鬆識別密鑰的目的/用途", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", - "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", - "service": "Azure Storage", - "severity": "中等", - "text": "確定應使用哪種/是否應使用用戶端加密。", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "255461e2-aee3-4553-afc8-339248b262d6", + "service": "AVS", + "severity": "低", + "text": "當使用單獨的服務原則部署 Azure VMware 解決方案和 ExpressRoute 時，請使用 Key Vault 儲存機密和授權密鑰", + "waf": "操作" }, { - "checklist": "Azure Blob Storage Review", - "description": "利用 Resource Graph 資源管理器（資源 | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true）查找允許匿名 blob 訪問的存儲帳戶。", - "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", - "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", - "service": "Azure Storage", - "severity": "高", - "text": "考慮是否需要公共 blob 訪問，或者是否可以對某些存儲帳戶禁用公共 blob 訪問。", - "waf": "安全" + "checklist": "Azure VMware Solution Design Review", + "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", + "service": "AVS", + "severity": "低", + "text": "當需要在 Azure VMware 解決方案中/上部署許多資源時，定義用於在 IaC 中序列化操作的資源依賴項，因為 Azure VMware 解決方案僅支援有限數量的並行操作。", + "waf": "操作" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f00a69de-7076-4734-a734-6e4552cad9e1", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", - "service": "Front Door", - "severity": "中等", - "text": "如果將客戶管理的 TLS 證書用於 Azure Front Door，請使用“最新”證書版本。降低手動續訂證書導致的中斷風險", + "checklist": "Azure VMware Solution Design Review", + "guid": "1d79a9b2-4604-4489-a8f4-2d78e78cb7a3", + "service": "AVS", + "severity": "低", + "text": "使用單個 Tier-1 閘道執行 NSX-T 分段的自動配置時，請使用 Azure 門戶 API 而不是 NSX-Manager API", "waf": "操作" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant", - "guid": "553585a6-abe0-11ed-afa1-0242ac120002", - "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", + "service": "AVS", "severity": "中等", - "text": "確保使用應用程式閘道 v2 SKU", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "安全" + "text": "打算使用自動橫向擴展時，請務必為運行 Azure VMware 解決方案的訂閱申請足夠的 Azure VMware 解決方案配額", + "waf": "性能" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')", - "guid": "4e35fbf5-0ae2-48b2-97ce-753353edbd1a", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "Load Balancer", + "checklist": "Azure VMware Solution Design Review", + "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", + "service": "AVS", "severity": "中等", - "text": "確保將標準 SKU 用於 Azure 負載均衡器", - "waf": "安全" + "text": "打算使用自動縮減時，請務必在執行此操作之前考慮存儲策略要求", + "waf": "性能" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "9432621a-8397-4654-a882-5bc856b7ef83", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", - "service": "Load Balancer", + "checklist": "Azure VMware Solution Design Review", + "guid": "b78036f5-e6bf-4bb9-bd50-3547cc447e82", + "service": "AVS", "severity": "中等", - "text": "確保負載均衡器前端IP位址是區域冗餘的（除非需要區域性前端）。", - "waf": "安全" + "text": "擴展操作始終需要在單個 SDDC 中序列化，因為一次只能執行一個擴展操作（即使使用多個集群也是如此）", + "waf": "性能" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant", - "guid": "dfc50f87-3800-424c-937b-ed5f186e7c15", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "bf15bce2-19e4-4a0e-a588-79424d226786", + "service": "AVS", "severity": "中等", - "text": "應用程式閘道 v2 應部署在IP前綴等於或大於 /24 的子網中", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "安全" + "text": "考慮並驗證體系結構中使用的第三方解決方案的縮放操作（支援與否）", + "waf": "性能" }, { - "checklist": "Azure Application Delivery Networking", - "description": "一般而言，反向代理的管理，特別是 WAF 的管理更接近應用程式而不是網路，因此它們與應用程式屬於同一訂閱。如果應用程式閘道和 WAF 由單個團隊管理，則在連接訂閱中集中應用程式閘道和 WAF 可能是可以的。", - "guid": "48b662d6-d15f-4512-a654-98f6dfe237de", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "d20b56c5-7be5-4851-a0f8-3835c586cb29", + "service": "AVS", "severity": "中等", - "text": "部署 Azure 應用程式閘道 v2 或合作夥伴 NVA，用於在登陸區域虛擬網路中代理入站 HTTP（S） 連接，並使用它們所保護的應用。", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", - "waf": "安全" + "text": "在自動化中為環境定義和強制實施橫向擴展/橫向擴展最大限制", + "waf": "性能" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f109e1f3-c79b-4f14-82de-6b5c22314d08", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "App Gateway", + "checklist": "Azure VMware Solution Design Review", + "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", + "service": "AVS", "severity": "中等", - "text": "對應用程式登陸區域中的所有公共IP位址使用 DDoS 網路或IP保護計畫。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" + "text": "實施監控規則以監控自動擴展操作，並監控成功和失敗，以啟用適當的（自動化）回應", + "waf": "操作" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant", - "guid": "135bf4ac-f9db-461f-b76b-2ee9e30b12c0", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant", - "service": "App Gateway", - "severity": "中等", - "text": "使用至少兩個實例數配置自動縮放。", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "checklist": "Azure VMware Solution Design Review", + "guid": "c5972cd4-cd21-4b07-9036-f5e6b4bfd3d5", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", + "severity": "高", + "text": "使用 MON 時，請注意同時配置的 VM 的限制（HCX 的 MON 限制 [400 - 標準，1000 - 大型設備]）", + "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant", - "guid": "060c6964-52b5-48db-af8b-83e4b2d85349", - "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", - "service": "App Gateway", - "severity": "中等", - "text": "跨可用性區域部署應用程式閘道", - "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "checklist": "Azure VMware Solution Design Review", + "guid": "be1f38cf-03a8-422b-b463-cbbbc8ac299e", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", + "service": "AVS", + "severity": "高", + "text": "使用 MON 時，不能在超過 100 個網路分機上啟用 MON", + "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "e79d17b7-3b22-4a5a-97e7-a8ed4b30e38c", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", + "service": "AVS", "severity": "中等", - "text": "將 Azure Front Door 與 WAF 策略配合使用，以交付和幫助保護跨多個 Azure 區域的全域 HTTP/S 應用。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" + "text": "如果使用 VPN 連接進行遷移，請相應地調整 MTU 大小。", + "waf": "性能" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3f29812b-2363-4cef-b179-b599de0d5973", - "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", - "service": "Front Door", + "checklist": "Azure VMware Solution Design Review", + "guid": "e614658d-d457-4e92-9139-b821102cad6e", + "service": "AVS", "severity": "中等", - "text": "使用 Front Door 和應用程式閘道幫助保護 HTTP/S 應用時，請在 Front Door 中使用 WAF 策略。鎖定應用程式閘道以僅接收來自 Front Door 的流量。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "安全" - }, - { - "ammp": true, - "arm-service": "microsoft.network/trafficManagerProfiles", - "checklist": "Azure Application Delivery Networking", - "guid": "cd4cd21b-0881-437f-9e6c-4cfd3e504547", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", - "service": "Traffic Manager", - "severity": "高", - "text": "使用流量管理器提供跨 HTTP/S 以外的協定的全域應用。", - "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", - "waf": "可靠性" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "3b4b3e88-a459-4ed5-a22f-644dfbc58204", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", - "severity": "低", - "text": "如果使用者只需要訪問內部應用程式，是否考慮將 Microsoft Entra ID 應用程式代理作為 Azure 虛擬桌面 （AVD） 的替代方法？", - "training": "https://learn.microsoft.com/learn/modules/configure-azure-ad-application-proxy/", - "waf": "安全" + "text": "對於連接到 Azure（500Mbps 或更低）的低連接區域，請考慮部署 HCX WAN 優化設備", + "waf": "性能" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "01ca7cf1-5754-442d-babb-8ba6772e5c30", - "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", - "service": "Entra", + "checklist": "Azure VMware Solution Design Review", + "guid": "ae01e6e8-43e5-42f4-922d-928c1b1cd521", + "service": "AVS", "severity": "中等", - "text": "若要減少為網路中的傳入連接打開的防火牆埠數，請考慮使用 Microsoft Entra ID 應用程式代理為遠端使用者提供對內部應用程式的安全且經過身份驗證的訪問。", - "training": "https://learn.microsoft.com/learn/paths/implement-applications-external-access-azure-ad/", - "waf": "安全" + "text": "確保從本地裝置啟動遷移，而不是從雲端裝置啟動遷移（不要執行反向遷移）", + "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "ae248989-b306-4591-9186-de482e3f0f0e", + "checklist": "Azure VMware Solution Design Review", + "guid": "e54a29a9-de39-4ac0-b7c2-8dc935657202", "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "Front Door", - "severity": "高", - "text": "在「預防」模式下部署 Front Door 的 WAF 策略。", - "waf": "安全" + "service": "AVS", + "severity": "中等", + "text": "使用 Azure Netapp Files 擴展 Azure VMware 解決方案的儲存時，請考慮將其用作 VMware 資料儲存庫，而不是直接附加到 VM 。", + "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "062d5839-4d36-402f-bfa4-02811eb936e9", + "checklist": "Azure VMware Solution Design Review", + "guid": "bff4564b-0d93-44a3-98b2-63e7dd60513a", "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", - "service": "Front Door", - "severity": "高", - "text": "避免將 Azure 流量管理器和 Azure Front Door 結合使用。", - "waf": "安全" + "service": "AVS", + "severity": "中等", + "text": "確保將專用 ExpressRoute 閘道用於外部資料儲存解決方案", + "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "5efeb96a-003f-4b18-8fcd-b4d84459c2b2", + "checklist": "Azure VMware Solution Design Review", + "guid": "3649906e-bad3-48ea-b53c-c7de1d8aaab3", "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", - "service": "Front Door", - "severity": "高", - "text": "在 Azure Front Door 和源上使用相同的功能變數名稱。主機名不匹配可能會導致細微的錯誤。", - "waf": "安全" + "service": "AVS", + "severity": "中等", + "text": "確保在用於外部數據存儲解決方案的 ExpressRoute 閘道上啟用了 FastPath", + "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant", - "guid": "0b5a380c-4bfb-47bc-b1d7-dcfef363a61b", + "checklist": "Azure VMware Solution Design Review", + "guid": "571549ab-8153-4d89-b89d-c7b33be2b1a2", "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", - "service": "Front Door", - "severity": "低", - "text": "當 Azure Front Door 源組中只有一個源時，禁用運行狀況探測。", - "waf": "性能" + "service": "AVS", + "severity": "高", + "text": "如果使用延伸群集，請確保供應商支援所選的災難恢復解決方案", + "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5567048e-e5d7-4206-9c55-b5ed45d2cc0c", + "checklist": "Azure VMware Solution Design Review", + "guid": "4c486b6d-8bdc-4059-acf7-5ee8a1309888", "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", - "service": "Front Door", - "severity": "中等", - "text": "為 Azure Front Door 選擇良好的運行狀況探測終結點。請考慮構建運行狀況終結點，以檢查應用程式的所有依賴項。", + "service": "AVS", + "severity": "高", + "text": "如果使用延伸群集，請確保提供的 SLA 符合您的要求", "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId", - "guid": "a13f72f3-8f5c-4864-95e5-75bf37fbbeb1", + "checklist": "Azure VMware Solution Design Review", + "guid": "9579d66b-896d-471f-a6ca-7be9955d04c3", "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", - "service": "Front Door", - "severity": "低", - "text": "將 HEAD 運行狀況探測與 Azure Front Door 配合使用，以減少 Front Door 發送到應用程式的流量。", - "waf": "性能" + "service": "AVS", + "severity": "高", + "text": "如果使用延伸群集，請確保兩條 ExpressRoute 線路都連接到連接中心。", + "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant", - "guid": "97a2fd46-64b0-1dfa-b72d-9c8869496d75", + "checklist": "Azure VMware Solution Design Review", + "guid": "c49d987c-b3d1-4325-aa12-4b6e4d0685ed", "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", - "service": "Load Balancer", + "service": "AVS", "severity": "高", - "text": "使用 Azure NAT 閘道而不是負載均衡器出站規則，以獲得更好的 SNAT 可伸縮性", + "text": "如果使用延伸群集，請確保兩條 ExpressRoute 線路都啟用了 GlobalReach。", "waf": "可靠性" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId", - "guid": "af95c92d-d723-4f4a-98d7-8722324efd4d", + "checklist": "Azure VMware Solution Design Review", + "guid": "dce9793b-7bcd-4b3b-91eb-2ec14eea6e59", "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", - "service": "Front Door", + "service": "AVS", "severity": "高", - "text": "將託管 TLS 證書與 Azure Front Door 配合使用。降低運營成本和因證書續訂而導致的中斷風險。", - "waf": "操作" + "text": "是否正確考慮了網站容災設置，並在需要時為您的業務進行了更改。", + "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "189ea962-3969-4863-8f5a-5ad808c2cf4b", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", - "service": "Front Door", + "checklist": "Azure Blob Storage Review", + "description": "應用與存儲相關的 Microsoft 雲安全基準中的指導", + "guid": "d237de14-3b16-4c21-b7aa-9b64604489a8", + "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", + "service": "Azure Storage", "severity": "中等", - "text": "將 Azure Front Door WAF 配置定義為代碼。通過使用代碼，您可以更輕鬆地採用新的規則集版本並獲得額外的保護。", - "waf": "操作" + "text": "請考慮「存儲的 Azure 安全基線”", + "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2e30abab-5478-417c-81bf-bf1ad4ed1ed4", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", - "service": "Front Door", + "checklist": "Azure Blob Storage Review", + "description": "默認情況下，Azure 儲存具有公共IP位址，並且可通過Internet訪問。專用終結點允許僅向需要訪問的 Azure 計算資源安全地公開 Azure 存儲，從而消除對公共 Internet 的暴露", + "guid": "f42d78e7-9d17-4a73-a22a-5a67e7a8ed4b", + "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", + "service": "Azure Storage", "severity": "高", - "text": "將端到端 TLS 與 Azure Front Door 配合使用。使用 TLS 進行從用戶端到 Front Door 的連接，以及從 Front Door 到源的連接。", + "text": "考慮將專用終結點用於 Azure 存儲", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "10aa45af-166f-44c4-9f36-b6d592dac2ca", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", - "service": "Front Door", + "checklist": "Azure Blob Storage Review", + "description": "新創建的存儲帳戶是使用ARM部署模型創建的，因此 RBAC、審核等都已啟用。確保訂閱中沒有具有經典部署模型的舊存儲帳戶", + "guid": "30e37c3e-2971-41b2-963c-eee079b598de", + "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", + "service": "Azure Storage", "severity": "中等", - "text": "將 HTTP 到 HTTPS 重定向與 Azure Front Door 配合使用。通過自動將較舊的用戶端重定向到 HTTPS 請求來支援它們。", + "text": "確保較舊的存儲帳戶未使用“經典部署模型”", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "28b9ee82-b2c7-45aa-bc98-6de6f59a095d", - "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", - "service": "Front Door", + "checklist": "Azure Blob Storage Review", + "description": "利用 Microsoft Defender 瞭解可疑活動和錯誤配置。", + "guid": "fc5972cd-4cd2-41b0-a803-7f5e6b4bfd3d", + "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", + "service": "Azure Storage", "severity": "高", - "text": "啟用 Azure Front Door WAF。保護您的應用程式免受一系列攻擊。", + "text": "為所有存儲帳戶啟用 Microsoft DefenderEnable Defender for all of your storage accounts", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "2902d8cc-1b0c-4495-afad-624ab70f7bd6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", - "service": "Front Door", - "severity": "高", - "text": "針對工作負載優化 Azure Front Door WAF。減少誤報檢測。", + "checklist": "Azure Blob Storage Review", + "description": "軟刪除機制允許恢復意外刪除的 Blob。", + "guid": "503547c1-447e-4c66-828a-7100f1ce16dd", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", + "service": "Azure Storage", + "severity": "中等", + "text": "為 blob 啟用“軟刪除”", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "17ba124b-127d-42b6-9322-388d5b2bbcfc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "Front Door", - "severity": "高", - "text": "啟用在 Azure Front Door WAF 策略中啟用的請求正文檢查功能。", + "checklist": "Azure Blob Storage Review", + "description": "請考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。", + "guid": "3f1d5e87-2e52-4e36-81cc-58b4a4b1510e", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", + "service": "Azure Storage", + "severity": "中等", + "text": "禁用 blob 的“軟刪除”", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "49a98f2b-ec22-4a87-9415-6a10b00d6555", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", - "service": "Front Door", + "checklist": "Azure Blob Storage Review", + "description": "容器的軟刪除使你能夠在刪除容器后恢復容器，例如從意外刪除操作中恢復。", + "guid": "43a58a9c-2289-4c3d-9b57-d0c655462f2a", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-overview", + "service": "Azure Storage", "severity": "高", - "text": "啟用 Azure Front Door WAF 預設規則集。默認規則集檢測並阻止常見攻擊。", + "text": "為容器啟用“軟刪除”", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "147a13d4-2a2f-4824-a524-f5855b52b946", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", - "service": "Front Door", - "severity": "高", - "text": "啟用 Azure Front Door WAF 機器人保護規則集。機器人規則檢測好的和壞的機器人。", + "checklist": "Azure Blob Storage Review", + "description": "請考慮有選擇地禁用某些 blob 容器的「軟刪除」 例如，如果應用程式必須確保立即刪除已刪除的資訊，例如出於機密性、隱私或合規性原因。", + "guid": "3e3453a3-c863-4964-ab65-2d6c15f51296", + "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", + "service": "Azure Storage", + "severity": "中等", + "text": "禁用容器的“軟刪除”", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d7dcdcb9-0d99-44b9-baab-ac7570ede79a", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", - "service": "Front Door", - "severity": "中等", - "text": "使用最新的 Azure Front Door WAF 規則集版本。規則集更新會定期更新，以考慮當前的威脅形勢。", + "checklist": "Azure Blob Storage Review", + "description": "通過強制使用者在刪除之前先刪除刪除鎖，防止意外刪除存儲帳戶", + "guid": "5398e6de-d227-4dd1-92b0-6c21d7999a64", + "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", + "service": "Azure Storage", + "severity": "高", + "text": "在存儲帳戶上啟用資源鎖", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "b9620385-1cde-418f-914b-a84a06982ffc", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", - "service": "Front Door", - "severity": "中等", - "text": "向 Azure Front Door WAF 添加速率限制。速率限制會阻止客戶端在短時間內意外或有意發送大量流量。", + "checklist": "Azure Blob Storage Review", + "description": "請考慮對 blob 使用“合法保留”或“基于時間的保留”策略，這樣就無法刪除 blob、容器或存儲帳戶。請注意，「不可能」實際上意味著「不可能」;存儲帳戶包含不可變 blob 後，「擺脫」該存儲帳戶的唯一方法是取消 Azure 訂閱。", + "guid": "6f4389a8-f42c-478e-98c0-6a73a22a4956", + "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", + "service": "Azure Storage", + "severity": "高", + "text": "考慮不可變的 blob", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6dc36c52-0124-4ffe-9eaf-23ec1282dedb", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", - "service": "Front Door", - "severity": "中等", - "text": "對 Azure Front Door WAF 速率限制使用高閾值。高速率限制閾值可避免阻止合法流量，同時仍可針對可能使基礎結構不堪重負的大量請求提供保護。", + "checklist": "Azure Blob Storage Review", + "description": "請考慮禁用對存儲帳戶的未受保護的 HTTP/80 訪問，以便對所有數據傳輸進行加密、完整性保護，並對伺服器進行身份驗證。", + "guid": "e7a8dc4a-20e2-47c3-b297-11b1352beee0", + "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", + "service": "Azure Storage", + "severity": "高", + "text": "需要 HTTPS，即在儲存帳戶上禁用埠 80", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "388a3d0e-0a43-4367-90b2-3dd2aeece5ee", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#geo-filter-traffic", - "service": "Front Door", - "severity": "低", - "text": "如果您不希望收到來自所有地理區域的流量，請使用地理篩選器來阻止來自非預期國家/地區的流量。", + "checklist": "Azure Blob Storage Review", + "description": "在儲存帳戶上配置自定義域（主機名）時，請檢查是否需要 TLS/HTTPS;如果是這樣，可能需要將 Azure CDN 放在存儲帳戶的前面。", + "guid": "79b588de-fc49-472c-b3cd-21bf77036e5e", + "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", + "service": "Azure Storage", + "severity": "高", + "text": "強制實施 HTTPS（禁用 HTTP）時，請檢查是否未對儲存帳戶使用自定義域 （CNAME）。", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "00acd8a9-6975-414f-8491-2be6309893b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", - "service": "Front Door", + "checklist": "Azure Blob Storage Review", + "description": "當用戶端使用SAS令牌訪問 blob 資料時，要求使用 HTTPS 有助於將憑據丟失的風險降至最低。", + "guid": "6b4bed3d-5035-447c-8347-dc56028a71ff", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", + "service": "Azure Storage", "severity": "中等", - "text": "使用 Azure Front Door WAF 對流量進行地理篩選時，請指定未知 （ZZ） 位置。避免在IP位址無法進行地理匹配時意外阻止合法請求。", + "text": "將共享訪問簽名 （SAS） 令牌限製為僅 HTTPS 連接", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id", - "guid": "2f8e81eb-8e68-4026-8b1f-70f9b05f7cf9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "description": "在可能的情況下，AAD 令牌應優先於共用訪問簽名", + "guid": "e1ce15dd-3f0d-45e7-92d4-1e3611cc57b4", + "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", + "service": "Azure Storage", "severity": "高", - "text": "啟用 Azure 應用程式閘道 WAF 機器人保護規則集 機器人規則可檢測好機器人和壞機器人。", + "text": "使用 Azure Active Directory （Azure AD） 令牌進行 blob 訪問", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "8ea8e0d4-84e8-4b33-aeab-493f6391b4d6", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", - "service": "App Gateway", - "severity": "高", - "text": "啟用 Azure 應用程式閘道 WAF 策略中啟用的請求正文檢查功能。", + "checklist": "Azure Blob Storage Review", + "description": "將角色分配給使用者、組或應用程式時，請僅向該安全主體授予他們執行任務所需的許可權。限制對資源的訪問有助於防止無意和惡意濫用數據。", + "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", + "service": "Azure Storage", + "severity": "中等", + "text": "IaM 許可權中的最低特權", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "guid": "a4dd86d3-5ffa-408c-b660-cce073d085b8", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "description": "使用者委派 SAS 使用 Azure Active Directory （Azure AD） 憑據以及為 SAS 指定的許可權進行保護。使用者委派 SAS 在範圍和功能方面類似於服務 SAS，但比服務 SAS 具有安全優勢。", + "guid": "55461e1a-3e34-453a-9c86-39648b652d6c", + "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", + "service": "Azure Storage", "severity": "高", - "text": "針對工作負載優化 Azure 應用程式閘道 WAF。減少誤報檢測。", + "text": "使用 SAS 時，首選「使用者委派 SAS」，而不是基於存儲帳戶密鑰的 SAS。", "waf": "安全" }, { - "ammp": true, - "checklist": "Azure Application Delivery Networking", - "graph": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode", - "guid": "baf8e317-2397-4d49-b3d1-0dcc16d8778d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "description": "存儲帳戶金鑰（“共用金鑰”）幾乎沒有審核功能。雖然可以監控誰/何時獲取密鑰副本，但一旦密鑰掌握在多個人手中，就不可能將使用方式歸因於特定使用者。僅依靠 AAD 身份驗證可以更輕鬆地將存儲存取許可權綁定到使用者。", + "guid": "15f51296-5398-4e6d-bd22-7dd142b06c21", + "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", + "service": "Azure Storage", "severity": "高", - "text": "在「防護」模式下部署應用程式閘道的 WAF 策略。", + "text": "請考慮禁用存儲帳戶密鑰，以便僅支援 AAD 訪問（和使用者委派 SAS）。", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "43fae595-8a32-4299-a69e-0f32c454dcc9", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", - "service": "App Gateway", - "severity": "中等", - "text": "向 Azure 應用程式閘道 WAF 添加速率限制。速率限制會阻止客戶端在短時間內意外或有意發送大量流量。", + "checklist": "Azure Blob Storage Review", + "description": "使用活動日誌數據來標識查看或更改存儲帳戶安全性的“時間”、“人員”、“內容”和“方式”（即存儲帳戶密鑰、訪問策略等）。", + "guid": "d7999a64-6f43-489a-af42-c78e78c06a73", + "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", + "service": "Azure Storage", + "severity": "高", + "text": "請考慮使用 Azure Monitor 審核存儲帳戶上的控制平面操作", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "041e0ad8-7b12-4694-a0b7-a0e25ee2470f", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "description": "通過金鑰過期策略，您可以設置帳戶訪問金鑰輪換的提醒。如果指定的時間間隔已過且鍵尚未旋轉，則會顯示提醒。", + "guid": "a22a4956-e7a8-4dc4-a20e-27c3e29711b1", + "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", + "service": "Azure Storage", "severity": "中等", - "text": "對 Azure 應用程式閘道 WAF 速率限制使用高閾值。高速率限制閾值可避免阻止合法流量，同時仍可針對可能使基礎結構不堪重負的大量請求提供保護。", + "text": "使用存儲帳戶密鑰時，請考慮啟用“金鑰過期策略”", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "99937189-ff78-492a-b9ca-18d828d82b37", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#geo-filtering-best-practices", - "service": "App Gateway", - "severity": "低", - "text": "如果您不希望收到來自所有地理區域的流量，請使用地理篩選器來阻止來自非預期國家/地區的流量。", + "checklist": "Azure Blob Storage Review", + "description": "SAS 過期策略指定 SAS 有效的建議時間間隔。SAS 過期策略適用於服務 SAS 或帳戶 SAS。當使用者生成的服務 SAS 或帳戶 SAS 的有效期間隔大於建議的時間間隔時，他們會看到警告。", + "guid": "352beee0-79b5-488d-bfc4-972cd3cd21bf", + "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", + "service": "Azure Storage", + "severity": "中等", + "text": "考慮配置 SAS 過期策略", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "349a15c1-52f4-4319-9078-3895d95ecafd", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "description": "存儲存取策略提供了撤銷服務 SAS 許可權的選項，而無需重新生成儲存帳戶密鑰。", + "guid": "77036e5e-6b4b-4ed3-b503-547c1347dc56", + "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", + "service": "Azure Storage", "severity": "中等", - "text": "使用 Azure 應用程式閘道 WAF 對流量進行地理篩選時，請指定未知 （ZZ） 位置。避免在IP位址無法進行地理匹配時意外阻止合法請求。", + "text": "考慮將 SAS 連結到儲存存取策略", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "6c19dfd5-a61c-436c-9001-491b9b3d0228", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "guid": "028a71ff-e1ce-415d-b3f0-d5e772d41e36", + "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", + "service": "Azure Storage", "severity": "中等", - "text": "使用最新的 Azure 應用程式閘道 WAF 規則集版本。規則集更新會定期更新，以考慮當前的威脅形勢。", + "text": "請考慮配置應用程式的原始程式碼儲存庫，以檢測簽入的連接字串和存儲帳戶密鑰。", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "f84106a2-2e9e-42ac-add6-d3416ecfed53", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "App Gateway", - "severity": "中等", - "text": "添加診斷設置以保存 Azure 應用程式閘道 WAF 紀錄。", - "waf": "操作" + "checklist": "Azure Blob Storage Review", + "description": "理想情況下，應用程式應使用託管標識向 Azure 儲存進行身份驗證。如果無法做到這一點，請考慮在 Azure KeyVault 或等效服務中使用存儲憑據（連接字串、存儲帳戶密鑰、SAS、服務主體憑據）。", + "guid": "11cc57b4-a4b1-4410-b439-58a8c2289b3d", + "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", + "service": "Azure Storage", + "severity": "高", + "text": "請考慮將連接字串儲存在 Azure KeyVault 中（在無法實現託管標識的情況下）", + "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "4cea4050-7946-4a7c-89e6-b021b73c352d", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", - "service": "Front Door", - "severity": "中等", - "text": "添加診斷設置以保存 Azure Front Door WAF 紀錄。", - "waf": "操作" + "checklist": "Azure Blob Storage Review", + "description": "在臨時 SAS 服務 SAS 或帳戶 SAS 上使用近期過期時間。這樣，即使 SAS 遭到入侵，它也只能在很短的時間內有效。如果無法引用存儲訪問策略，則此做法尤為重要。近期過期時間還通過限制可上傳到 blob 的時間來限制可寫入 blob 的數據量。", + "guid": "27138b82-1102-4cac-9eae-01e6e842e52f", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", + "severity": "高", + "text": "爭取縮短臨時 SAS 的有效期", + "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "92664c60-47e3-4591-8b1b-8d557656e686", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "description": "創建 SAS 時，請盡可能具體和嚴格。首選單個資源和操作的 SAS，而不是提供更廣泛訪問許可權的 SAS。", + "guid": "4721d928-c1b1-4cd5-81e5-4a29a9de399c", + "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", + "service": "Azure Storage", "severity": "中等", - "text": "將 Azure 應用程式閘道 WAF 紀錄發送到 Microsoft Sentinel。", - "waf": "操作" + "text": "將窄範圍應用於SAS", + "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "845f5f91-9c21-4674-a725-5ce890850e20", - "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", - "service": "Front Door", + "checklist": "Azure Blob Storage Review", + "description": "SAS 可以包含用戶端 IP 位址或位址範圍有權使用 SAS 請求資源的參數。", + "guid": "fd7b28dc-9355-4562-82bf-e4564b0d834a", + "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", + "service": "Azure Storage", "severity": "中等", - "text": "將 Azure Front Door WAF 日誌發送到 Microsoft Sentinel。", - "waf": "操作" + "text": "盡可能考慮將SAS的範圍限定為特定的用戶端IP位址", + "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ba0e9b26-6e0d-4ec8-8541-023c00afd5b7", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", - "service": "App Gateway", - "severity": "中等", - "text": "將 Azure 應用程式閘道 WAF 設定定義為代碼。通過使用代碼，您可以更輕鬆地採用新的規則集版本並獲得額外的保護。", - "waf": "操作" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "f17ec301-8470-4afd-aabc-c1fdfe47dcc0", - "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", - "service": "App Gateway", - "severity": "中等", - "text": "使用 WAF 策略而不是舊版 WAF 配置。", - "waf": "操作" + "checklist": "Azure Blob Storage Review", + "description": "SAS 無法限制用戶端上傳的數據量;考慮到存儲量隨時間變化的定價模型，驗證用戶端是否惡意上傳了大量內容可能是有意義的。", + "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", + "service": "Azure Storage", + "severity": "低", + "text": "請考慮在用戶端使用SAS上傳檔后檢查上傳的數據。", + "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "d4eb8667-f8cb-4cdd-94e6-2f967ba98f88", - "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", - "service": "App Gateway", - "severity": "中等", - "text": "篩選後端中的入站流量，以便它們僅接受來自應用程式閘道子網的連接，例如使用NSG。", + "checklist": "Azure Blob Storage Review", + "description": "使用「本地使用者帳戶」通過 SFTP 訪問 Blob 儲存時，“通常”RBAC 控制不適用。通過 NFS 或 REST 進行的 Blob 訪問可能比 SFTP 訪問更嚴格。遺憾的是，截至 2023 年初，本地使用者是 SFTP 端點當前支援的唯一身份管理形式", + "guid": "ad53cc7c-e1d7-4aaa-a357-1449ab8053d8", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", + "service": "Azure Storage", + "severity": "高", + "text": "SFTP：限制 SFTP 訪問的「本地使用者」數量，並審核一段時間內是否需要訪問。", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "7d3df025-59a3-447d-ac25-3f5750d35de1", - "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", - "service": "Front Door", + "checklist": "Azure Blob Storage Review", + "guid": "9f89dc7b-33be-42a1-a27f-7b9e91be1f38", + "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", + "service": "Azure Storage", "severity": "中等", - "text": "確保源僅從 Azure Front Door 實例獲取流量。", + "text": "SFTP：SFTP 端點不支持類似 POSIX 的 ACL。", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "a66f0fd8-2ca4-422e-8df3-235148127ca2", - "link": "https://learn.microsoft.com/azure/application-gateway/ssl-overview", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "description": "存儲支援 CORS（跨域資源分享），即一種 HTTP 功能，使來自不同域的 Web 應用程式能夠放寬同源策略。啟用 CORS 時，請將 CorsRules 保留為最低許可權。", + "guid": "cef39812-bd46-43cb-aac8-ac199ebb91a3", + "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", + "service": "Azure Storage", "severity": "高", - "text": "您應該對發往後端伺服器的流量進行加密。", + "text": "避免過於寬泛的 CORS 策略", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "3dba65cb-834d-44d8-a3ca-a6aa2f1587be", - "link": "https://learn.microsoft.com/azure/web-application-firewall/overview", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "description": "靜態數據始終在伺服器端加密，此外也可能在用戶端加密。伺服器端加密可能使用平臺管理的金鑰（預設）或客戶管理的金鑰進行。用戶端加密可以通過讓用戶端按 blob 向 Azure 儲存提供加密/解密金鑰，或者完全在用戶端處理加密來實現。因此，完全不依賴 Azure 存儲來保證機密性。", + "guid": "3d90cae2-cc88-4137-86f7-c0cbafe61464", + "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", + "service": "Azure Storage", "severity": "高", - "text": "您應該使用 Web 應用程式防火牆。", + "text": "確定應如何加密靜態數據。了解數據的線程模型。", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "0158fcb6-0bc1-4687-832f-cc7c359c22d2", - "link": "https://learn.microsoft.com/azure/application-gateway/redirect-overview", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "guid": "8dd457e9-2713-48b8-8110-2cac6eae01e6", + "link": "https://learn.microsoft.com/azure/storage/common/customer-managed-keys-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json", + "service": "Azure Storage", "severity": "中等", - "text": "將 HTTP 重定向到 HTTPS", + "text": "確定應使用哪種/是否應使用平臺加密。", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "bb697864-1b4c-43af-8667-90cc69aaed5f", - "link": "https://learn.microsoft.com/azure/application-gateway/how-application-gateway-works#modifications-to-the-request", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "guid": "e842e52f-4721-4d92-ac1b-1cd521e54a29", + "link": "https://learn.microsoft.com/azure/storage/blobs/encryption-customer-provided-keys", + "service": "Azure Storage", "severity": "中等", - "text": "使用閘道管理的 Cookie 將流量從使用者工作階段定向到同一伺服器進行處理", - "waf": "操作" + "text": "確定應使用哪種/是否應使用用戶端加密。", + "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "ff353ad8-15fb-4ae8-9fc5-a85a36d36a35", - "link": "https://learn.microsoft.com/azure/application-gateway/configuration-http-settings", - "service": "App Gateway", + "checklist": "Azure Blob Storage Review", + "description": "利用 Resource Graph 資源管理器（資源 | where type == 'microsoft.storage/storageaccounts' | where properties['allowBlobPublicAccess'] == true）查找允許匿名 blob 訪問的存儲帳戶。", + "guid": "659ae558-b937-4d49-a5e1-112dbd7ba012", + "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", + "service": "Azure Storage", "severity": "高", - "text": "在計劃的服務更新期間啟用連接耗盡，以防止與後端池的現有 membr 的連接丟失", + "text": "考慮是否需要公共 blob 訪問，或者是否可以對某些存儲帳戶禁用公共 blob 訪問。", "waf": "安全" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "c8741f03-45a4-4183-a6b8-139e0773b8b5", - "link": "https://learn.microsoft.com/azure/application-gateway/custom-error", - "service": "App Gateway", - "severity": "低", - "text": "創建自訂錯誤頁面以顯示個人化的用戶體驗", - "waf": "操作" - }, - { - "checklist": "Azure Application Delivery Networking", - "guid": "f850d46f-f5d7-4b17-b48c-a780741402e1", - "link": "https://learn.microsoft.com/azure/application-gateway/rewrite-http-headers-url", - "service": "App Gateway", + "checklist": "Azure Data Factory Review Checklist", + "guid": "ab91932c-9fc9-4d1b-a881-37f5e6c0cb9e", + "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-ADF_v1.docx", + "service": "Azure Data Factory", "severity": "中等", - "text": "編輯 HTTP 請求和回應標頭，以便更輕鬆地在用戶端和伺服器之間進行路由和資訊交換", - "waf": "安全" + "text": "利用 Azure 數據工廠的 FTA 復原能力手冊", + "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "eadc3164-4a0f-461c-85f1-1a372c04dfd1", - "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", - "service": "App Gateway", - "severity": "中等", - "text": "配置 Front Door，通過快速全域故障轉移優化全球 Web 流量路由和頂級最終使用者性能和可靠性", - "waf": "性能" + "checklist": "Azure Data Factory Review Checklist", + "guid": "e503547c-d447-4e82-9138-a7200f1cac6d", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", + "severity": "高", + "text": "在支援可用區的區域中使用區域冗餘管道", + "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "29dcc19f-a8fa-4c35-8281-290577538793", - "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", - "service": "App Gateway", + "checklist": "Azure Data Factory Review Checklist", + "guid": "9ef1d6e8-32e5-42e3-911c-818b1a0bc511", + "link": "https://learn.microsoft.com/azure/data-factory/source-control", + "service": "Azure Data Factory", "severity": "中等", - "text": "使用傳輸層負載平衡", - "waf": "性能" + "text": "使用 DevOps 透過 Github/Azure DevOps 集成備份 ARM 範本", + "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "276898c1-af5e-4819-9e8e-049c7801ab9d", - "link": "https://learn.microsoft.com/azure/application-gateway/multiple-site-overview", - "service": "App Gateway", + "checklist": "Azure Data Factory Review Checklist", + "guid": "e43a18a9-cd29-49cf-b7b1-7db8255562f2", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "中等", - "text": "根據主機名或域名為單個閘道上的多個 Web 應用程式配置路由", - "waf": "安全" + "text": "請確保在另一個區域中複製自承載集成運行時 VM", + "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "5fe365b6-58e8-47ed-a8cf-5163850380a2", - "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", - "service": "App Gateway", + "checklist": "Azure Data Factory Review Checklist", + "guid": "aee4563a-fd83-4393-98b2-62d6dc5f512a", + "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", + "service": "Azure Data Factory", "severity": "中等", - "text": "集中管理 SSL 證書，以減少後端伺服器場的加密和解密開銷", - "waf": "安全" + "text": "請確保在姊妹區域中複製或複製您的網路。必須在另一個區域創建 Vnet 的副本", + "waf": "可靠性" }, { - "checklist": "Azure Application Delivery Networking", - "guid": "fa64b4dd-35c2-4047-ac5c-45dfbf8b0db9", - "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", - "service": "App Gateway", + "checklist": "Azure Data Factory Review Checklist", + "description": "如果ADF管道使用Key Vault，則無需執行任何操作即可複製Key Vault。Key Vault 是一項託管服務，Microsoft 會為你處理它", + "guid": "25498f6d-bad3-47da-a43b-c6ce1d7aa9b2", + "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", + "service": "Azure Data Factory", "severity": "低", - "text": "使用應用程式閘道對 WebSocket 和 HTTP/2 協定提供本機支援", - "waf": "安全" - }, - { - "checklist": "Azure Function Review", - "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", - "severity": "高", - "text": "根據您的業務和 SLO 要求選擇正確的功能託管計劃", + "text": "如果使用 Keyvault 集成，請使用 Keyvault 的 SLA 來瞭解可用性", "waf": "可靠性" }, { - "checklist": "Azure Function Review", - "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", - "service": "Azure Functions", - "severity": "高", - "text": "利用區域適用的可用區（不適用於消耗層）", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "a95b86ad-8840-48e3-9273-4b875ba18f20", + "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", + "service": "Azure Monitor", + "text": "Azure Monitor 中的數據收集規則 -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "成本" }, { - "checklist": "Azure Function Review", - "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", - "service": "Azure Functions", - "severity": "中等", - "text": "考慮為關鍵工作負載制定跨區域災難恢復策略", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "45901365-d38e-443f-abcb-d868266abca2", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", + "service": "Azure Backup", + "text": "檢查未找到底層數據源的備份實例", + "waf": "成本" }, { - "checklist": "Azure Function Review", - "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", - "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", - "service": "Azure Functions", - "severity": "高", - "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "64f9a19a-f29c-495d-94c6-c7919ca0f6c5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/lighthouse", + "service": "VM", + "text": "刪除或存檔未關聯的服務（磁碟、網卡、IP 位址等）", + "waf": "成本" }, { - "checklist": "Azure Function Review", - "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", - "service": "Azure Functions", - "severity": "高", - "text": "確保為應用服務計劃上運行的所有函數應用啟用“始終開啟”", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "69bad37a-ad53-4cc7-ae1d-76667357c449", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", + "service": "Azure Backup", + "text": "考慮在網站恢復存儲和非任務關鍵型應用程式的備份之間取得良好的平衡", + "waf": "成本" }, { - "checklist": "Azure Function Review", - "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", - "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", - "service": "Azure Functions", - "severity": "中等", - "text": "將函數應用與其自己的存儲帳戶配對。盡量不要重用函數應用的存儲帳戶，除非它們緊密耦合", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "674b5ed8-5a85-49c7-933b-e2a1a27b765a", + "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", + "service": "Azure Monitor", + "text": "檢查 40 個不同 Log Analytics 工作區之間的支出和節省機會 - 對非生產工作區使用不同的保留和數據收集 - 創建每日上限以實現意識和層大小調整 - 如果確實設置了每日上限，除了在達到上限時創建警報外，請確保還創建警報規則，以便在達到某個百分比（例如 90%）時收到通知。- 如果可能，考慮工作空間改造 - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/understand-work-scopes", + "waf": "成本" }, { - "checklist": "Azure Function Review", - "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", - "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", - "service": "Azure Functions", - "severity": "中等", - "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護函數應用代碼", - "waf": "操作" + "checklist": "Cost Optimization Checklist", + "guid": "91be1f38-8ef3-494c-8bd4-63cbbac75819", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Azure Monitor", + "text": "強制執行清除日誌策略和自動化（如果需要，可以將記錄移至冷存儲）", + "training": "https://www.youtube.com/watch?v=nHQYcYGKuyw", + "waf": "成本" }, { - "checklist": "Azure Bot Service", - "guid": "6ad48408-ee72-4734-a476-ba28fdcf590c", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot", - "service": "Bot service", - "severity": "中等", - "text": "遵循 Azure 機器人服務中的可靠性支持建議", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "6aae01e6-a84d-4e5d-b36d-1d92881a1bd5", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "VM", + "text": "檢查磁碟是否確實需要，如果不是：刪除。如果需要，請尋找較低的儲存層或使用備份 -", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/manage-automation", + "waf": "成本" }, { - "checklist": "Azure Bot Service", - "guid": "e65de8e1-3f9c-4cbd-9682-66abca264f9a", - "link": "https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-concept-regionalization", - "service": "Bot service", - "severity": "中等", - "text": "部署具有本地數據駐留和區域合規性的機器人", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "d1e44a19-659d-4395-afd7-7289b835556d", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", + "service": "Storage", + "text": "考慮使用自定義規則將未使用的存儲移動到較低層 - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure", + "training": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", + "waf": "成本" }, { - "checklist": "Azure Bot Service", - "guid": "19bfe9d5-5d04-4c3c-9919-ca1b2d1215ae", - "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-bot#cross-region-disaster-recovery-in-multi-region-geography", - "service": "Bot service", - "severity": "中等", - "text": "Azure 機器人服務在全域和區域服務的主動-主動模式下運行。發生中斷時，無需檢測錯誤或管理服務。Azure 機器人服務在多區域地理體系結構中自動執行自動故障轉移和自動恢復。對於歐盟機器人區域服務，Azure 機器人服務在歐洲境內提供兩個完整區域，並提供主動/主動複製，以確保冗餘。對於全球機器人服務，所有可用的區域/地理位置都可以作為全球足跡。", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "d0102cac-6aae-401e-9a84-de5de36d1d92", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "VM", + "text": "確保 advisor 配置為適合 VM 大小調整", + "waf": "成本" }, { - "checklist": "IoT Hub Review", - "guid": "ac1d6380-f866-4bbd-a9b4-b1ee5d7908b8", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#availability-zones", - "service": "IoT", - "severity": "高", - "text": "利用可用區（如果區域適用）（這是自動啟用的）", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "description": "通過在成本分析系統中搜索計量類別許可證進行檢查", + "guid": "59ae568b-a38d-4498-9e22-13dbd7bb012f", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", + "service": "VM", + "text": "在所有 Windows VM 上運行腳本 https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server - 如果頻繁創建 Windows VM，請考慮實施策略", + "waf": "成本" }, { - "checklist": "IoT Hub Review", - "guid": "35f651e8-0124-4ef7-8c57-658e38609e6e", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "severity": "中等", - "text": "請注意 Microsoft 發起的故障轉移。Microsoft 在極少數情況下會執行這些操作，以將所有IoT中心從受影響的區域故障轉移到相應的異地配對區域。", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "7b95e06e-158e-42ea-9992-c2de6e2065b3", + "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", + "service": "VM", + "text": "如果您已經擁有許可證，也可以將其置於 AHUB https://learn.microsoft.com/azure/virtual-machines/linux/azure-hybrid-benefit-linux?tabs=rhelpayg%2Crhelbyos%2CrhelEnablebyos%2Crhelcompliance", + "waf": "成本" }, { - "checklist": "IoT Hub Review", - "guid": "4ed3e490-dc06-4a1e-b467-5d0239d85540", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#cross-region-dr", - "service": "IoT", - "severity": "高", - "text": "考慮為關鍵工作負載制定跨區域災難恢復策略", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "75c1e945-b459-4837-bf7a-e7c6d3b475a5", + "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", + "service": "VM", + "text": "使用靈活性選項（不超過 4-5 個系列）整合保留的 VM 系列", + "training": "https://learn.microsoft.com/azure/automation/automation-solution-vm-management", + "waf": "成本" }, { - "checklist": "IoT Hub Review", - "guid": "a11ecab0-db47-46f7-9aa7-17764e7e45a1", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#microsoft-initiated-failover", - "service": "IoT", - "severity": "高", - "text": "瞭解如何觸發手動故障轉移。", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "c7acbe49-bbe6-44dd-a9f2-e87778468d55", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", + "service": "VM", + "text": "利用 Azure 預留實例：此功能允許將 VM 預留 1 年或 3 年，與 PAYG 價格相比，可顯著節省成本。", + "waf": "成本" }, { - "checklist": "IoT Hub Review", - "guid": "f9db8dfb-1194-460b-aedd-34dd6a69db22", - "link": "https://learn.microsoft.com/azure/iot-hub/iot-hub-ha-dr#failback", - "service": "IoT", - "severity": "高", - "text": "瞭解如何在故障轉移後進行故障回復。", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "a6bcca2b-4fea-41db-b3dd-95d48c7c891d", + "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", + "service": "VM", + "text": "只能保留較大的磁碟 => 1 TiB -", + "waf": "成本" }, { - "checklist": "Logic Apps checklist", - "guid": "3b7a56de-5020-4642-b3cb-c976e80b6d6d", - "link": "https://learn.microsoft.com/azure/logic-apps/single-tenant-overview-compare", - "service": "Logic Apps", - "severity": "高", - "text": "根據業務和 SLO 要求選擇正確的邏輯應用託管計劃", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "cb1f7d57-59ae-4568-aa38-d4985e2213db", + "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", + "service": "VM", + "text": "調整大小優化后", + "waf": "成本" }, { - "checklist": "Logic Apps checklist", - "guid": "3d7008bd-6bc1-4b03-8aa8-ec2a3b55786a", - "link": "https://learn.microsoft.com/azure/logic-apps/set-up-zone-redundancy-availability-zones?tabs=standard#next-steps", - "service": "Logic Apps", - "severity": "高", - "text": "使用區域冗餘和可用性區域保護邏輯應用免受區域故障的影響", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "d7bb012f-7b95-4e06-b158-e2ea3992c2de", + "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", + "service": "Azure SQL", + "text": "檢查是否適用並強制執行策略/更改 https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", + "waf": "成本" }, { - "checklist": "Logic Apps checklist", - "guid": "1cda768f-a206-445d-8234-56f6a6e7286e", - "link": "https://learn.microsoft.com/azure/logic-apps/business-continuity-disaster-recovery-guidance?toc=%2Fazure%2Freliability%2Ftoc.json&bc=%2Fazure%2Freliability%2Fbreadcrumb%2Ftoc.json", - "service": "Logic Apps", - "severity": "高", - "text": "考慮為關鍵工作負載制定跨區域災難恢復策略", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "6e2065b3-a76a-4f4a-991e-8839ada46667", + "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", + "service": "VM", + "text": "虛擬機 + 許可證部分折扣 （ahub + 3YRI） 約為 70% 的折扣", + "waf": "成本" }, { - "checklist": "Logic Apps checklist", - "guid": "82118ec5-ed6f-4c68-9471-eb0da98a1b34", - "link": "https://learn.microsoft.com/azure/app-service/environment/intro", - "service": "Logic Apps", - "severity": "高", - "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "ccbd9792-a6bc-4ca2-a4fe-a1dbf3dd95d4", + "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", + "service": "VM", + "text": "考慮使用 VMSS 來滿足需求，而不是按比例調整", + "waf": "成本" }, { - "checklist": "Logic Apps checklist", - "guid": "74275fa5-9e08-4c7e-b096-13b538fe1501", - "link": "https://learn.microsoft.com/training/modules/deploy-azure-functions/", - "service": "Logic Apps", - "severity": "中等", - "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護邏輯應用代碼", - "waf": "操作" + "arm-service": "microsoft.containerservice/managedClusters", + "checklist": "Cost Optimization Checklist", + "guid": "c1b1cd52-1e54-4a29-a9de-39ac0e7c28dc", + "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", + "service": "AKS", + "text": "使用 AKS 自動縮放程式符合群集使用方式（確保 Pod 要求與縮放程式符合）", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure 事件中心提供靜態數據加密。如果使用自己的金鑰，則仍使用 Microsoft 管理的金鑰對數據進行加密，但此外，Microsoft 管理的金鑰將使用客戶管理的密鑰進行加密。", - "guid": "7aaf12e7-b94e-4f6e-847d-2d92981b1cd6", - "link": "https://learn.microsoft.com/azure/event-hubs/configure-customer-managed-key", - "service": "Event Hubs", - "severity": "低", - "text": "需要時，在靜態數據加密中使用客戶管理的金鑰選項", - "training": "https://learn.microsoft.com/learn/modules/plan-implement-administer-conditional-access/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "44be3b1a-27f8-4b9e-a1be-1f38df03a822", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", + "service": "Azure Backup", + "text": "將恢復點移至保管庫存檔（如果適用）（驗證）", + "training": "https://azure.microsoft.com/pricing/reservations/", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure 事件中心命名空間允許用戶端使用 TLS 1.0 及更高版本發送和接收數據。若要強制實施更嚴格的安全措施，可以將事件中心命名空間配置為要求用戶端使用較新版本的 TLS 發送和接收數據。如果事件中心命名空間需要最低版本的 TLS，則使用舊版本發出的任何請求都將失敗。", - "guid": "d2f54b29-769e-43a6-a0e7-828ac936657e", - "link": "https://learn.microsoft.com/azure/event-hubs/transport-layer-security-configure-minimum-version", - "service": "Event Hubs", - "severity": "中等", - "text": "對請求強制實施傳輸層安全性 （TLS） 的最低要求版本", - "training": "https://learn.microsoft.com/learn/modules/secure-aad-users-with-mfa/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "cd463cbb-bc8a-4c29-aebc-91a43da1dae2", + "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", + "service": "Databricks", + "text": "請考慮盡可能使用帶回退功能的現成 VM。考慮群集的自動終止。", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "創建事件中心命名空間時，會自動為命名空間創建名為 RootManageSharedAccessKey 的策略規則。此策略具有整個命名空間的管理許可權。建議您將此規則視為管理根帳戶，不要在應用程式中使用它。建議將 AAD 用作 RBAC 的身份驗證提供程式。", - "guid": "13b0f566-4b1e-4944-a459-837ee79d6c6d", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", - "service": "Event Hubs", - "severity": "中等", - "text": "避免在不必要的情況下使用root帳戶", - "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-identities-governance/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "cc881470-607c-41cc-a0e6-14658dd458e9", + "link": "https://learn.microsoft.com/azure/governance/policy/how-to/guest-configuration-create", + "service": "Azure Functions", + "text": "功能 - 重用連接", + "training": "https://learn.microsoft.com/azure/cost-management-billing/reservations/reservation-apis?toc=%2Fazure%2Fcost-management-billing%2Ftoc.json", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure 資源的託管標識可以使用 Azure AD 憑據從 Azure 虛擬機 （VM）、函數應用、虛擬機規模集和其他服務中運行的應用程式授權訪問事件中心資源。通過將 Azure 資源的託管標識與 Azure AD 身份驗證結合使用，可以避免將憑據存儲在雲中運行的應用程式中。", - "guid": "3a365a5c-7acb-4e48-abd5-4cd79f2e8776", - "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", - "service": "Event Hubs", - "severity": "中等", - "text": "如果可能，應用程式應使用託管標識向 Azure 事件中心進行身份驗證。如果沒有，請考慮在 Azure Key Vault 或等效服務中擁有存儲憑據（SAS、服務主體憑據）", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "27139b82-1102-4dbd-9eaf-11e6f843e52f", + "link": "https://learn.microsoft.com/azure/automation/update-management/overview", + "service": "Azure Functions", + "text": "函數 - 本地快取資料", + "training": "https://learn.microsoft.com/learn/paths/azure-administrator-manage-compute-resources/", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "創建許可權時，請對用戶端對 Azure 事件中心的訪問提供精細控制。Azure 事件中心中的許可權可以而且應該限定為單個資源級別，例如消費者組、事件中心實體、事件中心命名空間等。", - "guid": "8357c559-675c-45ee-a5b8-6ad8844ce3b2", - "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-azure-active-directory#azure-built-in-roles-for-azure-event-hubs", - "service": "Event Hubs", - "severity": "高", - "text": "使用最低特權數據平面 RBAC", - "training": "https://learn.microsoft.com/learn/modules/explore-basic-services-identity-types/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "4722d928-c1b1-4cd5-81e5-4a29b9de39ac", + "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", + "service": "Azure Functions", + "text": "函數 - 冷啟動 - 使用“從包運行”功能。這樣，代碼將下載為單個 zip 檔。例如，這可以顯著改進具有大量節點模組的 Javascript 函數。使用特定於語言的工具來減小包大小，例如，搖樹 Javascript 應用程式。", + "training": "https://learn.microsoft.com/learn/modules/configure-network-watcher/", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "Azure 事件中心資源日誌包括操作日誌、虛擬網路和 Kafka 日誌。運行時審核日誌捕獲事件中心中所有數據平面訪問操作（例如發送或接收事件）的聚合診斷資訊。", - "guid": "b38b875b-a1cf-4104-a900-3a4d3ce474db", - "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", - "service": "Event Hubs", - "severity": "中等", - "text": "啟用記錄以進行安全調查。使用 Azure Monitor 捕獲指標和日誌，例如資源日誌、運行時審核日誌和 Kafka 紀錄", - "training": "https://learn.microsoft.com/learn/paths/manage-identity-and-access/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "0e7c28dc-9366-4572-82bf-f4564b0d934a", + "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", + "service": "Azure Functions", + "text": "功能 - 保持功能溫暖", + "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "359c363e-7dd6-4162-9a36-4a907ebae38e", + "link": "https://learn.microsoft.com/azure/governance/policy/overview", + "service": "Azure Functions", + "text": "使用具有不同功能的自動縮放時，可能會有一個資源驅動所有資源的所有自動縮放 - 請考慮將其移動到單獨的消耗計劃（並考慮更高的 CPU 計劃）", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "ad53cc7d-e2e8-4aaa-a357-1549ab9153d8", + "link": "https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications-portal", + "service": "Azure Functions", + "text": "給定計劃中的函數應用都縮放在一起，因此縮放的任何問題都可能影響計劃中的所有應用。", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "9f89dc7b-44be-43b1-a27f-8b9e91be1f38", + "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups", + "service": "Azure Functions", + "text": "我需要為「等待時間」付費嗎？這個問題通常是在執行異步操作並等待結果的 C# 函數的上下文中提出的，例如 await Task.Delay（1000） 或 await client。GetAsync（'http：//google.com'）。答案是肯定的 - GB 秒計算基於函數的開始和結束時間以及該時間段內的記憶體使用方式。在這段時間內實際發生的CPU活動未計入計算。此規則的一個例外是，如果使用的是持久函數。您無需為在業務流程協調程式函數中等待所花費的時間付費。在可能的情況下應用需求塑造技術（開發環境？）https://github.com/Azure-Samples/functions-csharp-premium-scaler", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "3da1dae2-cc88-4147-8607-c1cca0e61465", + "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", + "service": "Front Door", + "text": "Frontdoor - 關閉預設主頁在應用的應用程式設置中，將 AzureWebJobsDisableHomepage 設置為 true。這將向PoP返回204（無內容），因此僅返回標頭數據。", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "8dd458e9-2713-49b8-8110-2dbd6eaf11e6", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", + "service": "Front Door", + "text": "Frontdoor - 路由到不返回任何內容的內容。設置函數、函數代理，或在 WebApp 中添加返回 200 （OK） 且不發送內容或發送最少內容的路由。這樣做的好處是您可以在調用時註銷。", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "7e31c67d-68cf-46a6-8a11-94956d697dc3", + "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", + "service": "Storage", + "text": "考慮為使用較少的數據存檔層", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "a2ed27b2-d186-4f1a-8252-bddde68a487c", + "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", + "service": "VM", + "text": "檢查大小與層不匹配的磁碟大小（即 513 GiB 磁碟將支付 P30 （1TiB） 並考慮調整大小", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "dec4861b-c3bc-410a-b77e-26e4d5a3bec2", + "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", + "service": "Storage", + "text": "盡可能考慮使用標準 SSD，而不是 Premium 或 Ultra", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "c4e2436b-1336-4db5-9f17-960eee0bdf5c", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", + "service": "Storage", + "text": "對於存儲帳戶，請確保所選層不會增加事務費用（移動到下一層可能會更便宜）", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "c2efc5d7-61d4-41d2-900b-b47a393a040f", + "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", + "service": "Site Recovery", + "text": "對於 ASR，如果 RPO/RTO 和複製輸送量允許，請考慮使用標準 SSD 磁碟", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "d3294798-b118-48b2-a5a4-6ceb544451e1", + "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", + "service": "Storage", + "text": "存儲帳戶：檢查熱層和/或 GRS 必填", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "92d34429-3c76-4286-97a5-51c5b04e4f18", + "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", + "service": "VM", + "text": "磁碟 - 驗證高級 SSD 磁碟在任何地方的使用方式：例如，非生產磁碟可以交換到標準 SSD 或按需高級 SSD", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "54387e5c-ed12-46cd-832a-f5b2fc6998a5", + "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", + "service": "Synapse", + "text": "創建預算以管理成本並創建警報，自動通知利益相關者支出異常和超支風險。", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "35e33789-7e31-4c67-b68c-f6a62a119495", + "link": "https://learn.microsoft.com/azure/virtual-machines/availability", + "service": "Synapse", + "text": "將成本數據匯出到存儲帳戶以進行其他數據分析。", + "waf": "成本" + }, + { + "checklist": "Cost Optimization Checklist", + "guid": "6d697dc3-a2ed-427b-8d18-6f1a1252bddd", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "Synapse", + "text": "通過在不使用資源時暫停資源來控制專用 SQL 池的成本。", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "默認情況下，Azure 事件中心具有公共IP位址，並且可通過Internet訪問。專用終結點允許虛擬網路和 Azure 事件中心之間的流量遍歷 Microsoft 主幹網路。除此之外，如果未使用公共終結點，則應禁用這些終結點。", - "guid": "5abca2a4-eda1-4dae-8cc9-5d48c6b791dc", - "link": "https://learn.microsoft.com/azure/event-hubs/private-link-service", - "service": "Event Hubs", - "severity": "中等", - "text": "請考慮使用專用終結點訪問 Azure 事件中心，並在適用時禁用公用網路訪問。", - "training": "https://learn.microsoft.com/learn/modules/azure-ad-privileged-identity-management/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "e68a487c-dec4-4861-ac3b-c10ae77e26e4", + "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/overview", + "service": "Synapse", + "text": "啟用無伺服器 Apache Spark 自動暫停功能，並相應地設置超時值。", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "使用IP防火牆，可以將公共終結點進一步限製為僅一組IPv4位址或 CIDR（無類別域間路由）表示法的IPv4位址範圍。", - "guid": "a0e6c465-89e5-458b-a37d-3974d1112dbd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-ip-filtering", - "service": "Event Hubs", - "severity": "中等", - "text": "請考慮僅允許從特定IP位址或範圍訪問 Azure 事件中心命名空間", - "training": "https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/", - "waf": "安全" + "checklist": "Cost Optimization Checklist", + "guid": "d5a3bec2-c4e2-4436-a133-6db55f17960e", + "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", + "service": "Synapse", + "text": "創建多個不同大小的 Apache Spark 池定義。", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "guid": "31d41e36-11c8-417b-8afb-c410d4391898", - "link": "https://github.com/Azure/fta-resiliencyplaybooks/blob/main/paas-foundations-playbooks-AEH_v1.docx", - "service": "Event Hubs", - "severity": "中等", - "text": "利用 FTA 彈性手冊", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "ee0bdf5c-c2ef-4c5d-961d-41d2500bb47a", + "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", + "service": "Synapse", + "text": "使用預購計劃購買為期一年的 Azure Synapse 提交單元 （SCU），以節省 Azure Synapse Analytics 成本。", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "對於從門戶創建的新 EH 命名空間，在啟用區域的區域中具有高級、專用或標準 SKU，將自動啟用此功能。EH 元數據和事件數據本身都是跨區域複製的", - "guid": "f15bce21-9e4a-40eb-9787-9424d226786d", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-premium-overview#high-availability-with-availability-zones", - "service": "Event Hubs", - "severity": "高", - "text": "利用可用區（如果區域適用）", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "393a040f-d329-4479-ab11-88b2c5a46ceb", + "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", + "service": "VM", + "text": "將現成 VM 用於可中斷作業：這些 VM 可以以折扣價競標和購買，為非關鍵工作負載提供經濟高效的解決方案。", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "guid": "20b56c56-ad58-4519-8f82-735c586bb281", - "link": "https://learn.microsoft.com/azure/event-hubs/compare-tiers", - "service": "Event Hubs", - "severity": "中等", - "text": "使用高級或專用 SKU 實現可預測的性能", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "544451e1-92d3-4442-a3c7-628637a551c5", + "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", + "service": "VM", + "text": "合理調整所有 VM 的大小", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "啟用內置異地災難恢復功能后，可確保命名空間的整個配置（事件中心、消費者組和設置）從主命名空間持續複製到輔助命名空間，並允許隨時從主命名空間向輔助命名空間進行一次故障轉移。主動/被動功能旨在更輕鬆地從失敗的 Azure 區域中恢復和放棄，而無需更改應用程式配置", - "guid": "dc15a1c0-75ee-49f1-90ac-ccd579376bcd", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-geo-dr?tabs=portal", - "service": "Event Hubs", - "severity": "高", - "text": "使用主動被動配置規劃異地災難恢復", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "b04e4f18-5438-47e5-aed1-26cd032af5b2", + "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", + "service": "VM", + "text": "將 VM 大小與規範化大小和最新大小交換", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "description": "應用於無法容忍關閉區域中事件數據中斷或丟失的DR配置。對於這些情況，請遵循複製指南，不要使用內置的異地災難恢復功能（主動/被動）。使用「主動/主動」時，在不同區域和命名空間中維護多個事件中心，事件將在中心之間複製", - "guid": "6e31b67d-67ba-4591-89c0-9e805d597c7e", - "link": "https://learn.microsoft.com/azure/event-hubs/event-hubs-federation-overview", - "service": "Event Hubs", - "severity": "中等", - "text": "對於業務關鍵型應用程式，請使用 Active Active 配置", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "fc6998a5-35e3-4378-a7e3-1c67d68cf6a6", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "調整 VM 大小 - 從低於 5% 的監視使用率開始，然後工作到 40%", + "training": "https://learn.microsoft.com/learn/paths/secure-application-delivery/", + "waf": "成本" }, { - "checklist": "Azure Event Hub Review", - "guid": "9ced16ad-d186-4f0a-a241-a999a68af77c", - "link": "https://learn.microsoft.com/azure/architecture/serverless/event-hubs-functions/resilient-design", - "service": "Event Hubs", - "severity": "中等", - "text": "設計可復原的事件中心", - "waf": "可靠性" + "checklist": "Cost Optimization Checklist", + "guid": "2a119495-6d69-47dc-9a2e-d27b2d186f1a", + "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", + "service": "VM", + "text": "容器化應用程式可以提高 VM 密度並節省擴展成本", + "training": "https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/", + "waf": "成本" }, { "checklist": "SAP Checklist", @@ -7816,11 +7681,146 @@ "text": "若要在用於 SAP 解決方案的 Azure Monitor 中啟用安全通信，可以選擇使用根證書或伺服器證書。我們強烈建議您使用根證書。", "training": "https://learn.microsoft.com/training/modules/implement-azure-monitoring-sap-workloads-azure-virtual-machines/?source=recommendations", "waf": "安全" + }, + { + "checklist": "Azure Function Review", + "guid": "4238f409-2ea0-43be-a06b-2a993c98aa7b", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "severity": "高", + "text": "根據您的業務和 SLO 要求選擇正確的功能託管計劃", + "waf": "可靠性" + }, + { + "checklist": "Azure Function Review", + "guid": "a9808100-d640-4f77-ac56-1ec0600f6752", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#overview-of-plans", + "service": "Azure Functions", + "severity": "高", + "text": "利用區域適用的可用區（不適用於消耗層）", + "waf": "可靠性" + }, + { + "checklist": "Azure Function Review", + "guid": "5969d03e-eacf-4042-b127-73c55e3575fa", + "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-functions?tabs=azure-portal#cross-region-disaster-recovery-and-business-continuity", + "service": "Azure Functions", + "severity": "中等", + "text": "考慮為關鍵工作負載制定跨區域災難恢復策略", + "waf": "可靠性" + }, + { + "checklist": "Azure Function Review", + "guid": "47a0aae0-d8a0-43b1-9791-e934dee3754c", + "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", + "service": "Azure Functions", + "severity": "高", + "text": "如果部署到獨立環境，請使用或遷移到應用服務環境 （ASE） v3", + "waf": "可靠性" + }, + { + "checklist": "Azure Function Review", + "guid": "17232891-f89f-4eaa-90f1-3b34bf798ed5", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", + "service": "Azure Functions", + "severity": "高", + "text": "確保為應用服務計劃上運行的所有函數應用啟用“始終開啟”", + "waf": "可靠性" + }, + { + "checklist": "Azure Function Review", + "guid": "40a325c2-7c0e-49e6-86d8-c273b4dc21ba", + "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", + "service": "Azure Functions", + "severity": "中等", + "text": "將函數應用與其自己的存儲帳戶配對。盡量不要重用函數應用的存儲帳戶，除非它們緊密耦合", + "waf": "可靠性" + }, + { + "checklist": "Azure Function Review", + "guid": "bb42650c-257d-4cb0-822a-131138b8e6f0", + "link": "https://learn.microsoft.com/en-us/training/modules/deploy-azure-functions/", + "service": "Azure Functions", + "severity": "中等", + "text": "利用 Azure DevOps 或 GitHub 簡化 CI/CD 並保護函數應用代碼", + "waf": "操作" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "6d8e32a8-3892-479d-a40b-10f6b4f6f298", + "link": "https://learn.microsoft.com/azure/spring-apps/concepts-blue-green-deployment-strategies", + "service": "Spring Apps", + "severity": "中等", + "text": "Azure Spring Apps 允許對每個應用進行兩次部署，其中只有一個部署接收生產流量。您可以使用藍綠部署策略實現零停機時間。藍綠部署僅在標準層和企業層中可用。可以使用 CI/CD 和 ADO/GitHub 操作自動執行部署", + "waf": "可靠性" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "fbcb40ac-9480-4a6d-bcf4-8081252a6716", + "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", + "service": "Spring Apps", + "severity": "中等", + "text": "可以在多個區域中為應用程式創建 Azure Spring Apps 實例，並且流量管理器/Front Door 可以路由流量。", + "waf": "可靠性" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "ff1ae6a7-9301-4feb-9d11-56cd72f1d4ef", + "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", + "service": "Spring Apps", + "severity": "中等", + "text": "在支持的區域中，Azure Spring Apps 可以部署為區域冗餘，這意味著實例會自動分佈在可用性區域之間。此功能僅在標準層和企業層中可用。", + "waf": "可靠性" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "ffc735ad-fbb1-4802-b43f-ad6387c4c066", + "link": "https://learn.microsoft.com/azure/spring-apps/concept-understand-app-and-deployment", + "service": "Spring Apps", + "severity": "中等", + "text": "對應用使用1個以上的應用實例", + "waf": "可靠性" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "7504c230-6035-4183-95a5-85762acc6075", + "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", + "service": "Spring Apps", + "severity": "中等", + "text": "使用日誌、指標和跟蹤監視 Azure Spring Apps。將 ASA 與應用程式見解集成，並跟蹤故障並創建工作簿。", + "waf": "可靠性" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "1eb48d58-3eec-4ef5-80b0-d2b0dde3f0c6", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-configure-enterprise-spring-cloud-gateway", + "service": "Spring Apps", + "severity": "中等", + "text": "在 Spring Cloud Gateway 中設置自動縮放", + "waf": "可靠性" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "97411607-b6fd-4335-99d1-9885faf4e392", + "link": "https://learn.microsoft.com/azure/spring-apps/how-to-setup-autoscale", + "service": "Spring Apps", + "severity": "低", + "text": "為具有標準使用量和專用計劃的應用啟用自動縮放。", + "waf": "可靠性" + }, + { + "checklist": "Azure Spring Apps Review", + "guid": "dfcaffd1-d27c-4ef2-998d-64c1df3a7ac3", + "link": "https://learn.microsoft.com/azure/spring-apps/overview", + "service": "Spring Apps", + "severity": "中等", + "text": "使用企業計劃為關鍵任務應用提供 Spring Boot 的商業支援。使用其他層，您可以獲得 OSS 支援。", + "waf": "可靠性" } ], "metadata": { "name": "WAF checklist", - "timestamp": "June 17, 2024" + "timestamp": "June 24, 2024" }, "severities": [ { diff --git a/spreadsheet/macrofree/checklist.en.master.xlsx b/spreadsheet/macrofree/checklist.en.master.xlsx index 7e84917a906859611cdf3edc84d0870919c17fe4..b3e1903130c5f63f107ceb4bd50bcf52760972aa 100644 GIT binary patch literal 499920 zcmY&<1yCH?(sTmB2?Td{cXxMR+@0X=f#49_-QC^YU4py2yUV}#zW*iPtJ;NvT54x{ zdZzo#9^|D!zaW45^a=8loYA6Mk8giYEbymc;PV^sX=Gz4Z*ODkK&NkOOY3T7DHAaY z4Z;8`;+;RXZsNHqc>J?S>UaE0bu4E<1BI3U^Mmsjyw+3?c8OUMg}y%2TJrUPHY?Hn zrq4s}!W*XQc13;i*E|ahYd&GsnDBXcxS+i`RtrA^7+~4Qwq5jRinYTgjx%Ti&W)UM zqyzh_%^VHncvb8j$obPw;vcDHyE_@5RHfZUq&N~w+1{C9dv8 zxr!CrO~VO}2N$`f`YLI3h{_2y+iZx;)441jBuGN%J2_# zXX;WmSZv=q&QOLv^5U z=YUVvw!+d|kZA@5Gc~-=wcj z=xa?}QAHrDUpDCKOU&%Hacu7h>yBjJ+@RfnD6BXmt^i{0;?9GpZ^);5v>ag?x4GT2 zzi*kt8juP2RYsKKNjH-H>$XPAWzz_a0hM5H03pW-Y5$^T=Z7buj2|I^ewOv}(_kHI zrG^6m<-!o^F6WaeB^$~i+^SZ@1N^>k2j1h}fL15h@6KNqs>^%MZWVM8S>(RTT$t%7 zY`2ArAZGTZzt>9YxW&5BZat_TMWcS8v^93UP(8|$X)RWLN?8S`ddyO{XaKx*gXrpX ztDcIER+2wrBP+$gsZ2S`-}fw;A4K8ivejK`Y`RdMBX{tt2Z*N*6<$-@C1wc?aDAG< z2`85L%7MF$`-`7cI1by^z%tqkR)AfY0%^*s)p_uKlkMgCN&8&8&PPGOeHtYsz9KA@ zfKWED#(Ev3+~o81b${s0;G`Vhhu8D&@X?NLp+n`!8vplB@`vX_oA;+Jshx`rFVDAI zO&%TOt4gn@<2gL<4vBVv*^h_Qxf@fu&X4EH%uMsmuMu#+E`P-6>92MV4rnKIfv_NL zf_m|WyrCnAfb{>I{j|cU^3!D?_}EsaEaj3ns4N>)2M>o*>%o9GMi{gWhYZ>_m0{UP zt2J$9NvnS^Y`VkCo|kg_oX{~Zl}pRs)`Qvql8iH6KMW67%8Df>}f1$Fqo6Q)RaYFo+Bmg;v{L6u?aeO3OW~z^dd^vUoNON`;t)O@Fy^O1XfYjr!h8Q7Dto#f(W_9Cv9s zb1ZQh{3TuD#5ydlYGhduuhK9h!zI#ZY>R7X(_xg~fUnl-9-;sF=aQJb-r+P&aM&&3 zlJiKvs77-}%Xc*Es)XZo|2!KSuY{3|&7C+Nyt2*aM@3U@Np)J=`K@<9V;Pw6X>C}t zVPjJhZk$3C)!n6#rSxk&jIvO#229@eb~mCVic{++}HI@X)ghzHndy<>7!ky+kSwPF1iqDRv6>L@x*AALd|$f ztj=IE&*_)X#At8wf#c8FX0fsB_QqELn+jf=JCSJqC@LPVkRBsSC^?~=?euVeLtW(1 zlt7U=Hzb(SO%(Pb*f<_O_*W<*NFK-w>;1xz*RfW#^CPDLK;oHsg6a+3*bH=tU{f(M zv_5*TK+Wop?v9GN+Y0A;X39DEEei`4wkd!W#$eS!+oxG!Gc`7kO9*J|Sb{?&^?AX% z%=vL~*{^T3$;LwgmIMfLdQVeEZ&1-mSaHPPPDI$I9J|NusO}4;DoniH6KWIE!#sGf zhgo<+NyB8~%)~a3(pVND#V`8T40nD;JZgUlgr<}=>7qrjw;re63fR<9v!l?KY0SAs zG^rLrz!@-e&q0oT`jW9Rd4xP4&7`dppU<=<(CL6sc)k*l5VM~GnpeXb`lCsxqibZQ z7P_vvLZyDgQ?l*DM?OnsPU+@$c0L^kP3;?U0aaynYU_OJg&QWdSh;c$!_E9is*STP zWb}sbh?8)B5;r-Qk0N(kdtsW9Z<|Ykwrn25cAhnFonIhci-1~9sX*(lM~8L^_}9u= zNRY|z5D{zUEs~@^-oG!JOg(r5?YQm8h$$Tr?gb`xf z;xCd7l)V;ra@IMQ<>hahb0$=-1uaz?=1NpLWt}ghnR7N5jVc-@+om0ebe)=AbPfI^ zZ`SH%0bfer%=;T7H$sh{p7vbsUB=;Ww%_#&yY_*=l@V4?>r(b>Gua zu0bf5EG($56F1sxKALO^2bIES1v*i;9p;`}m3iVaH!MR>$=uxCe#Bms;mDyHP)w%} z%|3b2jm{D7NiA)dO+Oz@+WwY$BU-)7qvrD+Zp286K9Cp9qSJc6l4wJfa=R^+*O~S{ zS`XO3@qnjU@wVY~E3__eoA6iNc4~etA99Aj&f8E=9(wX>=6XlP^GZ$3^hUn>3X>sr z%>2E%Z1$sk^4V7NJ>$GoySZegcYK|v$BA=8z0{!GOZ|#&T-&BG{C9)%+I;Z}XQ36& zLGuYG(t@++bg(AY)kN47&gDtN`}dVakMkFuZvl@_saW4;S$&nTDjrrd`p!Qg>01$U zw+3~~BPm!Baxx+Cz=PNz-mVT0h-$3_%USt9hrk)2ca!~;yZ*a#QrVxos-0(Cjwh;!*d#jfPKC z(~Ks(S9jePXK6l`Z`b=Np6(&%8E=Ej+bjBGZ!)tkSu|2*R3^kLiB_KtRu?s?_!IQP8HVzqr5V-vmM&F|GIi_z#@^S7+d-c-g z$mBUQPLIREbD?=)@+Bx00iO-@=?(Si4Py79^;0v((8b5E#bm9HF@G*M5 zh|e&fQ_ZRRZ*P~G@HngYTc3+00xhu!a$7Huu6cgns{s1j(`JU$GeVGq=R<$^vb2+= zyx$*BEF+JSY+z!3@TaR<@(oj18=JX{F{g*tX$^ljE-2^)2emomO0W+7I{hqGbCB8B zu*id%(vhEX{%CE}vg@6{4)4@m&}b-G=cy_QpRab1pM54Lta)^Zd}8p!#_YMm8k0z7 z!}4jrJLRl@-Z9gwK;z@?tUP;(t|ggEAXA$1jX|jQLAZAz-)?uj=%%~GFMBP`T(yjK zAP^>JE3&dBobwfVZe8rMZLmF@nPH2rD9<n7m^oMxHxRfoo(ix%Glre%KGIhsret`J!f3zE9zLKIvRj~G~bf0 zIVZc$YiD!3g0(&CUcPmjZQZa}NQe}F_vvlx?43J&=b%Mu61o4?G#OChaAXf3J3R8N zb&3mp#HpcaM~8PDUhnZuh17Xk+&I4Z?kQUwuZyS7sB_`k$7*jUFw}SFi<)9(!6I+t z`o0Qn>M-v}Lh&mc+rZY8B$o$Ug6EH0j^p&NceLu>kBMCm+7EI=Bf9gjG&eNhA6fL$(*ucNQN(BElK|eY|k6j;E2!iVXPn!6he>AcT5u z82ZF=X+g@Z%gu~!C!+7D!6xZ>w|_xg?rWno*roMz5mTr@taGM%PD@kdFx?F;1r6F z{rsA205%@vSxinsRqoVmku<;U@su-E7_0G+W5n;iN2b?>H#*rx!p48EGNPY&l^xYt z)Y}jgq(>4NlfXK9jX*AisU@X!Ep3XU>_`LUSg(5y&7oVQn(DMraxf1+&5Lc6zvoV) zIBXh|lt{8jIiLC_d)K~tu~~UXB9*ePE|Py<)&`IDy|9Q6_1dd65_!Wip@#2QVt#wx zD$h_5KF#-3`-$;A-4nU4a|gFJ<>OCpK1(AQ&zv+ynMlWTCa? z;XoW)&N6Do8(A15Y_Vz&!dCDP;#Nc^R&> zkb2E;u)x&ZjyFwHVLZZ_*`*ekfO1>?U(iq(M@x=u1RmE~w z55k1fqB6b_`?~zG@<+8Y+a9Yu)28SpDEnTE$gx>-0IkmOMhy6iUl78m}Lr9!! z>L7)YRrLA$dJg#Zmvj;;wSwmk^#ab$#(~eLS)fVm4wIjp2jKL|m}W3BIDXSUrp zLPyCC$=ed>rCv=W3A&#Giqz#jR(kfB< zPxJBL!^4a|!5jbch}8S!-GdZFX1P6papM|Qy*MeDAX?p9+n3=F3F=A?sy75HvQJ(^ zPoNEc3BmC5!wUT;Jy+UiNFg3r{<=JLz0;73!1~$D^96X%hy6DQ^bPw}z;gmRM0F&b z!L}n0p1t=e{QxIZd31E|qF4~{w}zeG=&ccxH~j9K6c60{P;`2$XmAeLiG_rch%0vC z|GbJJa7^APf)EC28fTz8OCQ@aRbM&@hc^sLsBwFS4r?aVTdF=UkYT!w#ihV{Z3V5; zW=>0e!?Sc5GCHLr)TX6?(=U!)ViN!B0G#4~C?F2%7zKWa|MeN-h*-KgbA@2k3J<(^ z6vM?Yi6a^*RKCesPi#N{Gs_S84-es{ZKv?Rc8=qdjKSgM`DZUZD@SI!NwE})QUc#t zF$AeCmbSLPJo4oFM$za&P~=wKgM{RpF6*B2;4hR{ee6~OPUn!BcYqfw+^X$qSHC+W z5Cc#)VF>GBxYa7}%@zUV>yX!iz}1Olw0_#q*f6F^CmcGLwxI^lovyFHeL@MCkdt$V zdi)(B&hex3We%@yrBBH!*fieTwL;xDF@sL<4L8t6jfs5RRP$D9C~wm5dfglM=2tXN z{M2sh?S>Cnj6X`t))eO>b`7v+ge~SkbKzx}UrVtUZBy?^P5~ctZ0=yN5Nxt%PApuf zcg|1Y^}2NW%U`*k;kBwoT97?qRu*4KHsZ6Wmo+4qcx=uhzn@e&P2L`bX|CC{;9N{W z-f7vQ>6KL=osG?Q2rn%qvCu=6oShN|9^Dhyzp?*P$1IV#WHuTmc1YeK$;Nt?IF+^} zip@Hf{WFF}iT#K(?(r2i=R}h&wTd)01I*vu#j_!+u5QKFZ zV87`15DtQW5Z0*=& zA&Cd?{;NIjX>0IzJlRE7vz<2fgx+;Dj8I`*#)*K7AO&88@79?2a3$eF(HOtR6pZu* zTY9~sSSJXKy`nStI2>2=hknntS!5C+h7Br#O`1-aoG*yZOu#z zCP*aNA(VSKiV!CV;%vQ8IS7aBQFnc43L%<_a6WI*FF2=zGe$a>5g8YLxbg4!?#>t6& zW25#QpNDF~NF*j4R_q+Cbx>{PKjZxRGYB61zBs}W3_Q2k@eM74?PMsv{OE5Y3-B9i zB3mvVZK{sicLCf4ES|BI)VGb(zo%m5UxPQyu^prLT!@jl0@&PnpA1P{{{;e(8zO#_ zqv*>d0kLZZ(o2NnOER87QzNAP0MmIbdt3%TdcXBP78pAmW%u7Q33*3-naqwe(Pg>) zr%Z=P_xWF|*DPU*rHq@=k6}DQ+V9R zywz_QkGD_yo8F7|;&o+wL;Kls=)U3o(m$~}rzybj!30tgUg~ils5*XIyzkv-REBP# zFmV^-BlPjE71#SI;^EJ)*f#?-gWv-eudSXh)yVXI>TN?*ubRo__|Dkv84^E##&AK! z0elwMMq>3wr}_}`V05C5{@^HjofO#fh9mf>O=phf6`t7UXUG4jO-@s68nZjYPU<^w zHs3`Ay#I~A*(mCDl3>?ZcaX#{OuLK3|E*g~a8Y5Y_gnSvpS-uS_(S{LK6-AD4V^#o z3%=stt*yh1lUI5jz0ddUzh6qOcL%c8WmapApy}(fENRaw8fsWK60Ql{$D;%z*NK*u zEs&*7oQy4Ne_%5|DKRemooYVN2%l}pPVB!gsj9n9Kcqce0CY;CXi7R z9ONtFgVd_ zOL1s2LZe^<5GC%AZrBGT34dn*10;@yqYQDBm&g+mCwya$bfCLVMiQ;EN^YW#z>W;? zLM2m(A@NE=mjHaE=B)9XAtq*bhM8q6jP%8uyJ7 z+i21yn5j<23Uy60_KO1Yt{X8_H`^quJOa_*Hhu9E4x3;R3F{5hroV>>MTdy^(Syr* zKYW@&G8AS_ZGJ3ZTvrz1a`M(N7HZ6M;M)2QK&3F!lY&3*wwn_y1UIK`#D#3+3~g9EII-(eF)R3D4hktrP@IvE@*hst4ZWXf&%Eie~O&L|Yk@rznoyit4z-znEa#%YJ%a3{pC=A*t(V5v9Q&s^*h z%nhTQqW>!9c6^1o7@LWsd$IdVZXBSh-PPdtnNliI(K;cv52;!qI|vY!c46qHB%Xs{ zaE^muT6-@+0_~8gaWd*_MUHAn?o^U>V!eh$66zkO%)+S9CRGC$C zoEn&jG~8&?9p>Ia(6sv|%9sQ{>zrkLo5$O+V~auFR{*yJFNEV7BF+Y}L)Ny$1L9R) z=r1yD0QV8%wgjyppFc^+VstD5ojrSK46}*gF5%EyA6hX3gfH+_3V(*Z11zFk%L1~T z;=pJEGs&D~(;sKTzdS0q1i zHeL@SYPEVh2bcE|~ zf=pjyTv`_5ToeaH>5=kko5JqNw4WtM?OX;(LRQC^fjC(fA6*R;{mX9(pN%<>4hS(i;ApN#-nWhTjT zzQX|re-c28GEoEKJT-c@6Z)*IH>m1UOau?B*8UUVIb`d3kOQKc_^ru3<}HT1CYhKk z(XHdGiu?ftRStwp=8SzLT=~_@PQi!jPd}1$3V^6Sq=2Z7EJ9vmnf(^G5nj=8$09Ul znZ}COa-bpmUX_(wU`7^qNB&l_F>)q0WUr79Z`{m%3QrNJiTm+&P*T$4u9&)pGXzeJ z+Y9#D#JuP>{+LHn*f5~dOts*gq(`-c;mlS-*QGOVm$1V!;aZw{OF6n`UvqluH<8k0 z_o+)ZqGn>$;&KG!4ZFQMZWGdxO8}hzocOWCo+Z5#$l!1|q9$7W;@<&wj6q!OR7p{t z9~PdK;e#4JD^z!upFv=tL3Agt&VzN_yim(DRe1!3O+E+xq^f+luT0ubtww`-&35F5 z6AA9i;VMj`HbePBXajW)@6dIu;BH9;Il4Dm?zo2A?X*noMme^QK$(?aQEK{RRu+f~ zbg%8gLQ*WaobahCbd<8BFtECXL1{3P4?!?!=Nfbp6kQH}G*gGgyPTU*xpR!r zN6JXK4Z4*0D!+MYVzI+ZL&gi$srVO!;%R8Qmd)91lg(%TvMN?>4iEE#wkoDIe9g*?_rZcXyPe#;c5S6-d&4xFoX;Rm?dAI+H7A+^i`*Zk>+H8JVuq&(9g3F zG}HAyV{T`y{rrkS1G?0z;l2o0%uBT-B($a?Sagy99`R#F@G+`9WH9KBEx#1Q)|nBb z3v()E-oKlBwh!nu2{>pDU;EHw%_3>qz*`>BL7Ah}I=%H+)q|HG$ zRp%?&*voBEfQr+vP`Nl7Rbs{xIGZgpQ4|F0o1MEGYZx#O2I~Bp6muV7C%cxWeSP(j zTXRTgw1tUYExsej_>kpGeQGmwJdF#2Uk&+YbShM)agP(R>Jq~j3BfZWa{HL29;AUL zQnYxQ-2WaGv@0-)HJvLdGz-GQH%ox*)Dj5^eQ7ecG*NCL;5>8hq~S%0Debd+scLWj zxP4o3nfzHJT<<5DKj(MXy6CIb?8SZu_ViV67)?`Z=liRLvJ~C_8&KSXEgT>x;*;`ol^bd2r&S(cVf0t^PjoC(XNp#SI;60vh=c?4 z($2{#!1QJ*Ot*eZB`<4EaDYA`1cxpKlY&K!OG1+)90)+FW{#QRV}sJ;85Y*ZrJVYc zP75-tc-EP=QkDz`mViF6vnawS6*hK6qZ{{5j1%G{zA+xPYO5A-4prW5vy2^FBO;1- z#XgebT1a!MV5P@Rj^s-?ckc0X*URNUNhVG{9&LQM!h$VHq*9f>wt<^yh2r?T)-~){ zM>zCeN0n&4FSd*nFaTF{4?(a&|1Gh`l{D?SbaOuS?3a zdwXbSEYy?Z305dEgx&#!%T@~)lPnXLQdaE0C2T3<5KlYTR!Te9C){3`{oauxXG0O% zp2p6~L+6Ik{7XiYN+BiMLaJtJD*bKP^7rwXr$oH%%-nN&>wjXQ@47`JK4j?RYPGy>j1Qf56; zMV`EYMFAGT?i}IQjfqfXHwe!SqfL(iF4vfhHr;IvRM{lf5x8>N-@a(U$YXz~C}uAV z3%8vH*I-7R21~Iou{z6ar&vSYJpd8!%X}&H~Ls#sGRxg z_K?YmphhEE#UI{`oS-uVVZUtkFip9U;Gu>{*0VXPd^N3af!z3t8^J=!E*ZVk(&*RICI&o3RX+q20{tVOS)X-crqj&7qR}pHvlW z#xjB~-HKFJiR!kUQ{-aEcc{~dzmdmEEML1$?boT z2+bIhYe$=)F=QMwvBZ2_n1I!TLd$rYao&bmSqHOqUw}fC7ErEl`QVD3c`oMl!l~`3$F-lj5 zQ=|^HF8^Y+2nq&7o&f3?t4o(d50J`cW{LJWAWKFH+!vTG2cc{KeP{nAz|NMnIO(P} zE>EOMbS6c1Op}=NZ+Vsmv7%~i@9jXsV71d85E=6qYCEA+4%yumo%4KkYiE9W7S_MI zmndLvd68mn3DiCJX8v%Q`m_ARYIDnyY)3W#iEDje^ilc`P@gvQGwJq?1YKPH8VC4M zf|!tz^dhEe3zTYFI6Hu&g>MNG7D`lx+j!#Hc*ThOv%Csde$#B|80W`u!?@GrSYCj6 zTQSuIL3uT$O&ycc1!6qg+~Y}XQr!g)lI|^1ajv);Q#T_LddcfOigU@WBo%{J4BzHVR5~pYpg#?iMWWr*XSa%#|BhN9|Tly^P{xzy&?+Gc52bOw>#77 zlT=QG@yMkN_=o(Zh{`^m)o9M;4}Hz^i#r2{^sQ*k%wK2Lbl;B-TEJF+hetW&`xoM+ zHpK@0xNf6eEhIHvD~i{kU0?6F867Au%o3EtLm(7#+L|?f__m~`&Ayym>=HtoX3mW- zHO%^h+*xpM{|7;btsb*VzQK5-$WxBpfX*fLOk2Z5()t9mJw^%a1!3S^7V`rSmt@iz z7ZS$;4AO9-`cRHIv22`J1=U!qaSd+`oy8PICI!uJR}Rl%XK=9#-UT^m2V4Fem|! zxEmFSm@P^z*#7+-e~}myaPr<8D_^>B3CKe6?_gd^jB+EUq$;ea3K||58Tpr4MtcCm zlwm!|2>`ajj*GzA=O+srmHd5s*fP`HLn7K_8%#N_9Kf6N~p%sdDJ8Pc*Y7=3WK5MkE%C$S3nc+mEefG(LJ;* zo%sPt7Zsxj1hb`P7H4h-nW^28Yo-9LB$d7W(GX=FxSo0^fxZ|xeR_8EOGDyEV;Juw z?GT^#53n;}nuOv(EkqjTl}!>2+0;SC3blPKg8e^K>B7fo@Rq?~HMU%DtM9BsCK|Al zLw`=LOp#vU@`Bgo80hx)fy1)!aQ);Gch|@zPVq%kjEaMkDZ1Nip7VJA@B?>xt8+t8 z+NX`~&WQ$}Kip>gng6)0Qi`Q=xgnzG3L-QUqN(_!g9SRVE}V#C4|E(A%nA zGg9AxXBcmZ@L#3xV-OEH)l~|S#=w%rjvGsYOlTtcdTTcjK-QTH%bZ=M*O)u+#YHwbue#}2H1HUxIz2jUyU++*n; zOSuzj!Uc(2>0WI<$6%CPa46P+tg>qCV#Bk|N$s+$drf+)k-}6-giV0_q<-HY=%kIHRsCtYi#=%&0-<= zd4Y`%>L$+{9p3s!=TW>5LyFy?ovowpQ>GL6(X~t+jg0lft_UCI{(Gk0x98**T^T(( zKhLzdbkSl;OA@XDCRO8q0@G9q?<8QzMzqL` zQe#snhrOL0g9#W%TnJ4n@dpWz=N`Pxe(Dz^ng7#)iAmrRWp5UeWfX?JAt58FGKe!^ zA&tcijeK+yu17(1SR6`4`+Htw)@8ch9(T3T8AEaFUwMoPOY0?z=T*@%^^7}_3Uo_j zbsFL6t5JfJ0X>L!R6<=riY#vHjJjuY3YP@MQ!e>y->k9n01uVLfWok^2dt7tvi2)rlup-_ zfqO1FW6ZFHl%^%-63u1?0Q?=N6{=+E%>!C%MNcgh7DsRz4+IOHZ^fYglij0 z8aksrnX^T4k|LA85}`PZKi=dmGY*sp_IP0Ps{;G2uu>L)liCJtaP>0aPV>W-Xa;udVZ2+}W_O9|y_&=wFpRqgd&V^O z8{aBA2PXaEcijF}L1}56aP8!|GA-fTq`Ug-5MzD3I~IHasl_m@p05qwIILeuQ}KyN zJ@8WQD$pptlVF|?l=C^dO8=a#!nadYF4f#*vVoiK0+zA^|FC5^%R=*3XT~p!LQmbrx+Z09uih?*|ew+ zioVr~R&`7>n~25EhWBYAn7e5rEx{5Wxh%Y}<`ayQcJ`Y0qC~h71DlEU)BLTl|x|oOWIXu3=1fl z@%G!TCWF*_12UESJ+O76P{V%W{BIiIh{XF#);-&+i68#l3r@Z)MCI9n_J3Mf%EHfo zx0@wk7udpe&c#t_%u`|(aZ?(mMmSZh((2|`hd0Lr6i=+J3RH{|>RxR=afDPIfoqTV zT4k~%tq|ax@`);OSnA*?aZ2q%>Lz7r*k>cmO~SIWEVx>as3M#J!V_`ssCmmcz_47t1kE|WKBOHc>-TIZ3{NV=e8?2%- z!~#HBX&`WBGQY%pnji1Yb9~q%t*CqXI8aNkA+Ie@Sr>4b`YB#gsZbcoxJ(}N-yq0k zSa2oDox-?FSq0lWWjMqoh{Y`>e?sSj3X-oK+M-*U3B^PPizpy6#glbb7+UPY0LcH= z`pFBA2V=nu#>JA|_Kgd$Flk$z4PTBq! z8CH)!+*syA4GR}_${Rfo8S~_>d^D?*l1D{qvI&UIy&gkZHlnM?3Qe*I|8z z_bYeXmmy`{;r^OLxvGse#u7tFIsMn24dNr3*ydt@QIu*(q_ zX(&MVstnoV555esu_uPTDwf}4n)Aa2!6@|vs@hjt1zw=4@iG_*9mD4R3`%P-fg>QE z7`*UPa8m=E*f*}zCCYu=f5E+v?c|GvkQ{vCBe4-Mhp;2!Q(WV8v)Sv!sZ`{c553_#?Qmeuo7ri+Pn<_ zDY<0{vQo17RyGrO7!*e()j6RkL$EcV-gJ}ro_|7dgup>?7z8EU9T!NE{o;bX&mqyn zJ(=*HaPmZ*;>w+TDS`cEpeO7zrOjU`9T~*ev9*-e|1o-KdD$LutoY&aWqJOF@TfEOHi-%g3NJ z%8#IkT&(K0B>CK|tq#B3&PCih_fjE($*ZhGxf5^e&+kj8PvddAZheGC$T)gRwWD$G zBq#+$TOpxN8EEFvT9>==?#x@~c~~7}N&(J$3%J)O8Ud2rBKpgnhsj*NPVXXUcmx$m+%&xtgJb4%0Yd zUpKeiTG#Cr>P_c9qQU9_8yy>={`J2~q6QJt?q~6<{U7@h&+LyxwN#g>R{T;;Z!(&n zf>SeKXYtRCvx4MOq1?tC9Z~T5STCI#0p(ZPwOZq3*8CP96-Tv@c@ICc)^*}Unb3M( zpEN<7MT8zX#LM$zPp~5)sHIC{JBfR$Ea4fSV`S5_g*AJ~m_e$`eZc(HoWn^a`1Tiph|xW#Z79lW^T!P@pX65a?0H>{7T-`2dqZV zb?*BwWjrUzyY!#um*u>W)`yDg%ctZXJm{Y}Hw5aPZUDF_tx9wPk%gQpr@-|K5F+P7 zOmD+!QLsDh-8Nn4G<&v4gZ%*lMwrt_KG8k@hTxIl2s&u9n^!uogU zkC`*6AbwF(V)%iQrGMLg_7vFm()dLN9iiyRH%=yKm(T1s)AH^=8t6U-k)8^v@QHk* z`Q`h$|11v(qHLoKc-smLG8pG)>7V4SM~vMnJ3G(HNJtq8Jero6*F&q@Q0Cs%th$8B z0Vl0i&FgCkSqQN>Za1mJBzcyrzB#3J?Ud?wldpd5x<0ju*kE~{bZUyr25=H7~ z)Ds#9`$nHhF&A!IT(V>wXWP3&XtAl9#DL?54q=teWOCsasKWj&!TPF9z<)xpw=aNp zb;kf)?XDVTU;5$0lSap)FWd?OY$N~pdI__rO<+l2b({r5Eo5pmlv4^Brkmh8Ppq%WF(k>%IE1kVu_W;?Im(#D>F{)v=z!!H zlmx(2EF6LyanIkg&*YSKF4S0Dnn%#e^28roqL?R(G<&ck9~p7TefENWiJ5dPn@pr7 zE?1dXYUlf2VTqPw?^bfa1IwgB9|2oH^ z?MP}FvqEv>k5fhLKsGi3f)D__MywCu@h`%}{j=bR8O3Mubd_P@HnzlWmPfRi-Xnm; z=ZfW%Khv0Fx1o;rtxa{fk!``qe6n{le0zRBz&bh5)x}6BQe^gyi&KHePVm)OqKVvI zFi59;I3{q4FR>|l5{j6$ntn7kh;LYmUsu@aidlv;J*&=rhohaR+6-1cj1fQX4 zb7Pp|kJUaI6LJfYHBq|yXZqjVrf)wKxZo4sp!b!!$Ls_BI_sN%Q}p?EpmE;lF4n9)LXY%-!ENXrUJenn4Im ztoqIeQFh|jdBbxVZ_c4{);_jO*yB^|yzxeF=(GEqVnjvA*ZC+viX?rCuTjD|zw#cC z{HHN{rSgD{S$XRnq5D&Si5f7Di)ik=;(){@u6=apk9|n0UyUZ4bRfbINtzKWGSGkU zO}X~(@ddbjHi54!HUVy*bFq5J&%Q)szO27dU*~)~2sFE2>D7;fKDXTQs>8+}=7P6q zk^>vcs57;n0nC9uk6XxEcaCnW(&%7p|n4VIzr4T0B{5#Ykz$LnREhM`r40l|A z(o5cSf!W)Zl&9>srDRI`hqdvm#mxK~w6DD8>Z!SCp>$Ruyhx04{GGhsRo_6yy7_~< z?xNf7=|S|2Y!1p&c_$zxBk2bs;8n)yt#JC5we9O5Whd~4NUv1f20_UyoWh=qIC-bi z7MOJcF|`EIVu>^R4xxnlsqN%=Q@WkL^f_wIh|M2&I*RBQx3R?%zY$k$M=e0%B$3dB zKg=?xLYFF@LXQagTMf}~UDi5MkEf>jt_MoMCkah=_6t~>-@X1fN)jHJ8&@&qNkC-P z6|c%|*u4?3Pu#7?FbB8@xU2_@ag^>mJ(naGbzdy#j`y;kGv{Jex-_EK4p(&BElGAO zy<-N;c^R&Zb9F{~ZOR+&Doc>ZM)#u*IH6@fPTIXL#j2cA-0d~+>>(R1*j^=!AA|Po zk6S#J1Fg%*=rXupQr{kWznZ!1=idpp8$IJ_lJACap7TpgzdnHRHSVoh{;oRVZfvGv1B21r)C?Qxxq+7THNj z!=|OB(OtdAFpP)|bKGPGD#H=&ORlsn65DBlN*(t`{f=8()pc#Adp#pSeE@4i7&7}# z^b^DGwe<)fv*L5z7+)eFyx}WyOF(t!gIu#Utl+k-GI$S{0s*K_{I_lsfw02!$NYuLCP6g2QlKaEt?wh%$*Dljl37QF+FHtd#WE4pq8MUPvMm*#dhNLUVW%$cUvi%x$Tlfo8f zrd~}-eOQ*?WBG$`cB)y_HD^n~HPH0`vL??ZUXuq8?zbs%6NBWZ`Jpf{8{?{U{l)n) ze#UVdQrYQHvzEgKgZ02BLZEA^d%&dzKTPIXQtoYdcS%OOPC|-c;YFD+GSI)*{1>75 zun|&u;t$^^WO7D=C0kRR^J1RpeQD~2_I1`#1s4$0X0x(gOkfkY2-~kE@nmYT4K2u2 z$Q^IpNmr_79;-W8G-%?fz}G*7kG^i$FSlr1(HIp}Yy{M;mWC8R-yAU&-6|Umt=7+c zF)2?tkdrknZ;w?u){z!Y;*1toKNZ|^;&W8nB}Gc`5ZEMfM)kmDyR!2C=U(UkztBy) z0f(3@wt$?hG%#>=mQUy~@~OWuPE_0Le9y6Ws6u!~XqM?R!$2^rmBv<$M66%sV{WesZwIik_n97++LN%r#DL7VsLRzFJhI%sDLdujON;r9OAUzUNIp^=(JjTou zj;tsa{%3B|Qg*XTXdCf9c^wm`7!oi7T07^nZJiKgPKK#yelA{f(@rEl*@IV6qF|9qz7)#3lb$W8nm9i(?38JA*|Qt02ld{N2Lx3*H^5A5YLc z_=tDX$~+d4_D8to>^i+q6xb zoKp*-(7>p`U0mm~Ry{PBWlrI_f9b@ms-wkJ+=k843C9B4NXAmcA*gGOXI~Ba%+3r)98qApRzWW`~%KCiTOqM z7){Y@MvJ-dGh+DMdM;10XrkFg@qlh7Sj&?8;rIu3cF9Yy{95Q(I)4&@AG^^0)3vvq z-pc=D>MMil>Y8Q~++7mfJvhM~g1fuByF+kycMIOn& zoGNC|^mO+OYcJ?zUc?{ebPb=H-=^&%r3&ffWBvC@<;|ZD6#{tq; z$}74vP=MALO6}AL`V{X5{|>LH&3GlF9Fk=Om$^~4M1%$!qJ{l9h>N(0^Lo-*>9`-{EW(LXIVL?ssUY-leG5 zgARXxrp{0ln8{n+#(MEfySF07!*$_T-V6DPYti=t&jsDYW9OacyFl;zP8hLk=G^2B zj;hIcte>j4=%{3FSSR!OwB1sKJBTTS`j-QbJvq-Ca;GD2&$&}?D@gbcLrPC}?<3z{ zHzqeIE<&GL!e8#p;9}l42a3PG{Y*4l7%|-5;%OHiY~tDe+2OG%%kyyfRde;~DgH6) zsjMG#jLL@rR)E;(**UL{;I9q2n`5F{AZ<6Tgf_8WEeVWBJ9uzLk%6^g0^q%PqMR;& zWRQKC_2hc_n7}rM%}KkZcc}VZ4cxSs3sbbtyD>#x^+}t3F2`4k;pBUzhG3y!X?G#g z@sd4CBkkNlf;|c-Lod})5gZS1Z*E0iS8kn;?qOnwc%DvCVocr~%M)+*Jx_@y&_-}# zE>lZ{F+#lZi@QA6qCfKbIImCWj2%#d#z60AIDvf!BRkoHM`_dUo?0`P-45NRgFBH zSRz4I*UPcH1i+UZs=9!V>3f4$Z#&itBYX*4&l>P0RlX(9Y|P!-8TL1^NI1g+?zPZ9 z;Hb`uPI3dtPR-)-RqNGvn9kZ^;S(4$L?jS)=b|A(LX!VRj}I0J9i04Q5rH;8Dw>3G z)EwDgLFNfdr>r@24L_-$3Lc!ZvZ3Fpy+NsQWY$~KrJrY?^YH8YNLSU273I6;J-fWIK@2U>$sN^Sju)PLv+R!w z&2fvhx;z*UXCK23ZpSLiP!+9J#xs_Le6^E3n@u@cNb|RF=aY$6zFaOXAvRLZ-6t$X z51zE8R0|^D3I5<%BKdvt3+m>3`u?}iiN;%X!$=ecduH-TtHY?~QQ&_exf>?PgmlSf zghyor z%SUjHlH5)O!gk(~Z#g$F`nS3xU(ibb9?iuss{F}Fd5sYL$d}kU=dpW2k>NTW`x~be zMfFrYteX;53VsF~3{&~pzc~@yC$62pySP1<`Lk^v`WG+gN62O0@+w#H$B?J5QTJ<1 z)mh-#LsOnx5OE2b)QE9K$jVxB*==UVvB`@db3B+je2m)=5-)SG`sQXTLDTTf^X^E^ z&f0Qh^H@_2chLqk%6z$FU; z7pV>nM}Dj`Lzrydax?8rA4zk&()pN4Jm0!{Pggt36{ErRaDTfzU78xZ#B#%DecV|I zNj)i~3AtH*t1Gc)IM6$)AN7UQD-#_VWM1yK`k$~Pg^!B39LUZw7?~1zaMlHMRFOww z5$y%IS)v(W?elQ_Djsc^a8^*z>k#GZf`$@GI^`#M^7UZ@BghdXQ^FW0PZ(jNd4dN& z|7}^F92|@l6g`$^e-Po6lrDwv<+KyE`dhB-m7zy~Hls2cDwq4GBU`WrhlDZ%wd6l} z!gh1e<52vtHrj zI18@fS>JeDPeU#zf}k}G3AoRU$Jg{AE}p*+2ioUKl}HO@7mFLy$*#hp+a|TQp^G&e zRZgK5T6+IeUDv?*`%5;!JxFzp#mX+9hR*^D;FYy_(FZ#j3NEYGGZU+hVdRGkKWRW% zatlRyJcyECtNJFVAfUtmWUM;uT(q5Pcs~^@%a@e(Z2joC(k*qO-Aam}3_NPLWKnoM zMosW#r6){USJ`!EFERvj8JMDLnwoxAzLQ%caTfHeJR=1CJ)&FWPLA!hxc!YobYE`UJjS#5J_4M()$|2Y@1ObiyGFBrWX866*?B^ z{CcM&8hIofTJGQ0g&{usw{`h6zL$Z3Cjv7?sqk$UifI`42ayv>WH5ic^-gdZ&?8?Q zoD@30&*^U-#{>g|_Al9j_d$8Y6M>z2;s`UB5~GTmmUXETaUvag!AAOO1 zlA36&98nlVzNC>vCf>1;6w$S9+BE2i2Z9lZ)?;cXk4qC0ZSJ<+j4f-1O~{shTR+cyTa z69_sf#+^kUUErzcfC1a;j+{Y?4LB#*gbXfpc8esh*<5SRYl6^e`YfMDO9gTOkH|~Ic2yen^rhvyq zx6>Di#~y9C*owdO;WHx|(uBQvj4(W@bDw13FW^xvZT)PEd|aZcpSN^#@Zn82c_tbx z@$jv3hUl^YEgJ*|jPE;HnuXjTV_JN{67$l^av^R90qt7X^-nn3g2nlm8+^@JMVsQC zs&f)k?L4epyFHd%3E}cv?%>fTBn3B+n3>KTk<+n4MZ=;8Fo4orfskN(e%ZBYOgd!? zi<9pLOm4dy?mY46tVHC6w+&3z-$<2OzJqXm(jGI^Qo(_{eH}erzp0Je@(frPKz`!irJA&qjpkW=KOw2 z_LIBc+n08wj=H-{X`BT=Gvn>mRN;%ZelxP)iq;)ZmCimd+AqCg`KsOHpxiu??n&Vl;fU7s(4x`J1106@)eSkEPyG#lK#fA#E3ET+ho{}FLGAY` z9`)^5{qT)gAcb2C(}#8@>m4iQs@VTMemB9lrQeTV(-Ul(+qgWmD55m$L$-`836Rm` zyd;hd22&opfLL;^SzKp)`MmK z1Ntv8ubMt!+~y;7Y%gwWLHNe0K6PV>%q^OjcuM&a;Wmp+MF*#~6;9}HguiHFB4Kw^q6FxKG3D!5BU98x=!V)&>xtl%3FCr3-*d9Eg3T4~#)1>-A!> z$*UuTWlh<6r$e0f?WM?^-~*Og9jyVh)e}Y->wbmd!@aa0YEV{e7{dCyfxT1USNj_U z#vU!chjPWho!}7kAvvBY0}mp@y-ObbaGQO)=$GlpQ+-3|wseRY7zDhGt!cbatS<*a z5YWK}rTx|70UIPJfgk_}h$v-2lrbZNOT;l=qlZ0bEIsCK+Ne&}WmUSF%Y{cY_>{+j z;{*!NpS-lbQ_On4+EGtvAA!_6WzTe^JygPXC#aY?gzQT)XN7vnk}t-?js8OdM(MLd z=?P&`_i)A57N2v~p*C*AGJO^kT?k7!pf-1T>Cr;PZC82K~{3?q43*ZT<`{Ys?koE97CJeL?zKzH|O3Q z8Re!;LiKxo@h)wI2A-@)!6#Z9vm;CT7@hocP&i{Z*h7Wd-OkL77{hP6Tow%30vW2h z;`_TJ6@GrqhHVhC0`wUuvBfFHP~)zo^coxKwNx!i6eoGqtY&mq^B+Ff^WoqJ{jbj! z2r-DiA$5=(`$c{rp0y-A)>Ewyw3ch&Gsx3|ZAjcZZ@s@HBE(Hv_Sv)=%Tc#Wkb&&y zO03MH!3^c~Fp#5=es3vc?^L}#&Bh!r2aYo=tShilVqndPyq;?T9{s|qjW^}=Q1U+d zh|?cI>f`UbS0pX#=aM{plWNnvU>kf^uyV#;!f>71*h8Y{gP?9V|A(FoD9F3t=#kkV z=?n#-M@B>`AtUUTl?@dtNz;fr_hYHr;-L}yP@SeuT+PEvziCfDIpl&QpKe_9Mn!?J z4q8WD(4@ZmP{o>8ob0ga2rxtq@KblY_l9?VP^n^ss8xUi5fOo;rZaYK5DI$hCH?cX zx@-pr-+`m7aAA;a-t~G>4Ej)6Y8~TcKHmVDN!|GqoxLNaL-0N{J-ZVQ4rP!q3tk3r zx(_DXemPH{*kuWm^HeJcK3?^S$>XW13 z$stq@!&Ru$_tl&3zFW%OtVa5651@TOPy!YTavP^UahO|gBK=9Ec$E?o*h z4$gp(1jgKXy|G_=r7^{eEAbVRV&x^%Fl6Lc!$MZ-n{V@t=!8i)?Oi>UGjQ5SfrPR# zC$V=u_4lnH?wei?Nzj8)vC#&kZ3XY;Iar7CgHewXDtPIjM!PK$FidRl+7wm2hLbHN z<7oi|q-y2(aaO5nDp1(=+7&T!_euTPs0_ad1!`}QH!nu`QPECwdV~v<7d^%23GnBG zZq1ejNF|aiUt}a2+h_ve7lRS#fMSAiyQosvFh^0BY2@Md>YI`Cw|!L2MouXH(L=2H z(+L0T4LTOO;*oAkX>=1CvazUGi-L>-?i1yHf9{i{^cIg#w9It2*(&RYc!lhJ$PtBH zz0nC-S=QO?GnutacB3b6d*4!ZWDCxCo2_hPk!*$j5M0!+DP&vA>WLpxBKAt=ViwzN z#8MQ!L7cuA4OCa)dtpnvzBmxoR^tJ4A3k595v&FY{U^G*I9RL3dTg!X^`8?`2cg*& zWW0bqWrI7KA58?RlG!fVL{;dU_(~eY{j{gf>AtbCc?r}gg(HS$pDUy+k?2DPaagGJBwt9b$9KZS(EjChhl4I*xZ9Ep6_i)bm{_ucjN3(OlFT03#Q`L= zo>?Bw@mUG)HeJ!V_XqYBWT>AaH`szL#pr)xkKxlU$Oucdc++3>M$GAJ-mpt)5kRHm{bO*i*Wf&(NOk{q20ggk@e1Jv$tH;RxAtth^|$CT0~1aHLk z1v8_wS);HjdXG6*#RBZ#snezGt`jMe`b&r@Zjpd0Ys zxa7XE=qA)lCFv;L;VIR#CL@Xn0jxKDe`&TMh9px^Q+Ie2-eGeO8H?b1fYAT3l6P$g zWbKj~qJDm5^s|06vVML>0wG<&ORY6=66U?7%7EIk^2%+2RaqTN8E`W+dsEn z`y2Y+0H0a>up$<8{<$7rXZ~{6KW)R2igMK*qKx)?s#7;(NF~`Q>-1WfYr8}udGCAl<0$)lwa3VBez$Dw zR2$*`Y?e0I&&RJvA$RERrUUua?s)d1Fe!7TdASRSzmL%ZhV43(nvCXx3GnREzQub% zxHKI(!1mfMvG~D(o#i34L?Aok?a9)Hoa35T7 z2w#NQ$a`exPyK@pmov#LKMZ_fcgdJoc(iSB)8$QiGJ)En|5=DvBl%mP(Q(w)5FBKEpV}FitR%%ThDU)CdoaA zkvkADGKjOJa3~CJyBo>{cqg=T_Q|=E!NUD-@|)kKG*c%FcLIo`jV^Qe7F6C|paYV& zDJx&L6jtL)NqI#=2+>?o_nZoD;iOM(A0h5m_9*gr@%~ox1Mh zerP)DqUkm{$v7Fz_K!NBNyV+UaVOzSQI9y`5kZD=aE6?n=JeDHMs$q7<~=neIGsZc zkp)B^J4KfU6v|3MJ>qPOF1w+}Wz=3ZxcsF$!SaBQ^IN!J3H^H|0mpNimp2q}eS+>h z(0~rUb8}}N=s&_`lJDos6B;<=#38~Hni*O*Oo6^9y(;13E+-2x-5=`LpUYKR^%wGaLR@_b0WO9D`yg)E@Trs z8TXBVYZmO3? zr=A@xit!2@?7UAQ&ALf(1HVactPdiLcby5!G*|mKXkOf$X(*^Ab^G6I+yX<9&-Lhb zVjq_la?+}6@4#zZ8GO+JXX?~7>Sw=xom%AIt&X1Z>ao{ZxS-gXU~*iHWXF$i8IQ4b;@9V?Y(I4?|UcgSPwfHQbix#jc%N9Rcb^`1{zyk zdgu~`2@=4kZ00#Noz(zp@7OX8L>dEUEYT;vRVR}Q$U)IwpbA(LP556XI$<7LmN0{dx+#V9-O0dRdij%! zTlT6f*%P`h7@_tH7@^8<*i9LD6#Ixt$iX)5h=rK~F$NG4Fj&q^P?dguCjMER2x)rT zM@s&$$!~G6sJFD)6azp_-c>3D-*qB7!1b#hd*=RjA99x*4ND)&o4wpdTQ}96f}HUuhnj?vtnq}6g$83ONb~n<$)F2vcd|Sdx1|rK$~tpg zIt#ft`*hsDLb?>)SGqZWgZ!rkfwy#cR*SNn z1H3M-ioCD9E?sun%B1SL=wb@Z`|!krH-kwGS6z9rIC#cM_@jA6lFv8Gz5lTWY-rh4 zc18IWHOS<})h+1|YUhp2A-_f!u?P{pbGuHs_;+ORKAne5wMhF-oWA<19GHHX5`k9ZJ|?) zSdb_(!SXV&Dq&PtiT$MxD$BIy^|tcn98gXRU@BfPL|M;DN-ux6EMZ9orO3_J`-O+3 z!X|C3JHu=^D-~0k(S6J?)_I!_%;O;?deTGq)G4K|fkUfCcY@Q2M*qQCwWztpn{xiB zyqav!`lH_NKxjBRsHsaU>Zn#2)Dnd=vDvCoq8sG{3c69n+)LKz>!9l&AeJLQqVM?| zRy)QXQsPF3TJna{!l1$jlcv;pB`0}% zTdBy6r8Q+=nCj_fcKYZd7^l!RNvcqp?9f#T2-kaV!s;(iyjqJ9=DL+7NhqIh`+{_A zJS1`+XDSEDXrV=!1q<<$jG8xVUquOTXgr~HJGWgsi(HKM_0L1lNiB0op*cRisU#*g zBBY^3mtwd$H>17OJcOny2PE_Z`r%(1lfOaKpJp3Vx7Fp8vNw1z#q!g(?Fm`$YS}xU z+;s-niM$*)m<=J1gV*d4?hF-`?v$yN#}?0-0mkO@Crm0Cx{c zZq3#BP7=Ac#eC#q&!aArE&Xg=LT!%>_xBkTE39_7O*mAsGp)?1gQU=YhAOUwf;K|R zcX^YFOCFY|zMuKoc|*n^)e3FSYUe9w$37r-(Oo^4c?SQmZ19?=#sl~apO{r0^K(`{ zyl8ZgPHf~Eyo@$In%+juJ22=8F}TcT?76?J{H*Zi!QH|}{WY-0c(pAtygeM8;GI9g zF{Omn(S5uhFHQ-%xkY= zgPX6koIMoDrJ6|ppm^c3KSV#VYgCi9pj!I7{4}@UD0TbHT#wU74GPc&s0t%}aUMhj zaw0lnv8-eG_;P>ddn2E$NMJZUDtoItRlHOXT5xl&XmutNLzc++HNJ!@dJZ#p9WNy! zWlnCI6my3=73%+aE@vTyexdNyiV!q~g)fR222HsI^t4DU2d@Zd{fa5;n0H$8{pB!6 z=$al~5HFURRs;gk4Bf+1*DRa0K;OJ0NFi=_WmG^-3vHZ08vnhW%5nU7AT(ARHYAop zRS(nkCX*;VsuJ0@enN?0A5RX)_*lZ%5k14bkQ_UyJE}>iAdibQl7AfK5i)?$rWQ?I z0O|n(X1W92vUY#|@e?NrZB&4I4fajq3;_s-RK%BEyAJFJ2PY-W*q}+=m_O_S%yZyreYwazz)GZ(<7*n zSw7bRvqF7OzT|7H>~3!<{1Z5QWcXOe8qncmkiZS428k&|mz7=#vWq|Io6;07+qHNj zN^~T}s##qa@GT>L@C>S*oXr?3+(Fc$Kjty8{HQi&AV>64xGzL3IS4cmnIHHyp&}NFn*V1nW_agdIAr9lO)^O7SfKnZMxO^+aZg4uRFu3&;3&W`so!4Y!I! zjgtZ6Gs!+XIkKDTjyt8?Ta1%%#!K;TVB4BbM(%DiG5<}|$N?c1DNvW~OGy1^$6tDA zq@Xaw_-9`)7|#y8O0Ooo=~FaDTQrK8)3k0BoA9O>ojP6~0HFhQrH^lAx0{QxG-h6j zBs!rq`~+G@JZ!TT^lCJBrH%fKU<5yfZn|PozYI0!{mIdn??zgyC}t2Os$@5vtizN6 zKmGR^W1&9-UDIkMPB_}W1+%)w@8a{QLj0YN41x^mNX}G@L_zb>$E^f))N-Z~7?CF~ znVg@5d6QiLOl&MiI<51uQ`yNv!h2l{9R0u!l_@oRFxpN>oV?rRAC%pz$BmHh*kJiH zZCJADz6gLBsay+Q0MH7KGSJMXs#>_D)qg5uz7RRuYF+&jJWxg)GgLXTtu(v~^$W-2 zeoowG8lD7Q0Z}eobymFz2i!~-bcSh!njxqUftFjX`RL>e0o)tzF zKaF@w=kl#%dnL<**lo9Q;8vZ8!WGSI72e0VK0qw|9|U$-=_G%2Sth~!-aqM}kqfa= zjKErKxT+1)z*`1fZj}VzxFX6z*NeaI{ZMo}h>6~|7ZY>%Z{YNg6mwvWv)DwdL#@UZ zStkomrmie7qXg}Vnjj&DjqeImC&V}Wcnwo zWQI-~wW2Y0nb#Q-qWoH4g0FiaDcSVoZz+an4MC)v7J$M!5Q4%A1G@Lwqz*LaGEYqz z4Q7v<_-+~-V13g?%K#$s@T|Z4S7?8OOQ>}fAR?&H8k-63;GjZ-i9apuXLg1rkD@zM zg+gpxZeQT{)Pe2{SA~bxiih*S72sLiiRPhE*R}aPfl#1fYA#Jg_EqeiJnxwUuxp0t z-G5Us^u>pFQ-dB~M+X_McrXM`|yBd%T+lrW%_5g?4W8>93pGHV`^KKCgpW1 zOy^mZD|HC;NaB$4bwhi(c&UskB6 z7KT8Kgn>KQsKU}r8uJk`X0~}{(px}je_B~^A%~-V zVmVWZ-YY6Zjku2Y!1&w-o;{6mVK)k}Cvuaow6Y53{=!mtni}~8N>NH#Q0yvMid{0s z5mxm}O3|=Y+<;E%RhAQ0lr90hI@R`-tJ}jKfLwVEP7?o2)x~w*EiSj1?_3-d4iav& z_sfgkrzVV`8zL_R?P^Ix0$%g9N>x#47SMl<8T<|?7yQZsMI7NA>5Ua+@Exx0)JRan zGzz**-++L;JFZ$(kq8$-8zWo@9#3<7dKB*FgHaY0b88t@!jTP$kv3_>HyouXLDskQ z{oE-pZW$CA{xnN^*$X{f<>upi-$5#cEWbhV0LABa45jjUH z5N-dorbx@3BEcfd*H35lNQoq&4`du>v7Kth*lZWY(A=Cx3sqGuHQNR{NA}9NL@L{% z%VZ@GICj@(-m!U%lntWz8nW9I7&Pc@QYsC7?R6+PSQt`-swsI(oK*H@Oa{E^?Bgj& zn!kR_(<{2pG7eocs{`b>Z{tGq&G13FnKA(0x-tOivPl(N&&{4SRHCsUy1bf_$%hm} zuI1Ynd4|(wl8}M*jQuFRAXQM9j%!YHyh>&BP^7E&GQgDB{tNInz1_HY1WXb1wqBnc zvf4{3PSyB5pB$;GQa*NLkeVehlZK^i zo#G0YyjtYpG-G^sM+q5#-6r$UwCvkFw;I;D>q3a+?5GCKcgfJHsaFq!N63lc*n)!J z$J`2+h%+-CKV*za!IjhIUwnly^9T)e*E(F;-80b{Nqw|M-a@pGHWM)C$TQ=Hoo4O4Z`R}5b@2nRY*$B(#IJ=x*-IHtqU$O|? zf{kl+R7!>5R*Z_03d&sr6n&1ab(B0&@)@-&B)X1Jf@Kyg3xK~<8jM=?25*^_;nooU zF&{Sgh~5C=rYwTY)IV2fxtPvSe!a-PpV^srrxJQGs9+i_G=-zFUWk_&w*(f^wj8#| zGgI6&sS=&M!Kyw)Df%*+Xy(GV#mAKyy7NUxTgKp1f+E|Eq_1u+QC#x4>hBU646wEkAC|@wV&6 z-M8`ZogZmWH&G6xV1i@HIFWmqINIS-F{Bfa?v`Z=NZgY83}>It1oz3_JY1NTc3ua* z&w&|uQOs;q-eO_(9zffUC65Tb2v%N)hWT>4pBbYhwfaHP=QSYtyq>d@E0%B`p1ZuD zIsn_{yAvtLSF*Yk?E$S1?9LrEg(Yyl+cEc0fc{_PVG%a7$mVt@D$XYKD;1=|O^jvx z8=TzJBHmR*BQYuBc7mHkYdh_})=Z}T8`(LNTwf+uzjI;9rhF;{-bpi$=Jvj3#&UIX+oJ zg?nIhad^9I@Bnm)p?t0>UXb&pbIvE1d~F*S#w^aZ>BBDipT%z{WXpE4yt3MdE6Szb zN({KB7?-FH13YXe#Dos@h6MOiAd*YRRT~ctqI-o-TakBt;r5jGNUqg{-&2yhnc%C6 zc)xLvi+S~{T_-(nt-OEoh*7U8Au|f!+f=#3=fwbU_3DlTC{6zPEaRmjpIwRcP%8VY zkkV>`%{)hFL`Z6`|7M? zyT|*fE%z(^ha2Q132xo;X7bCo$77JY}{>ao0qNkI=It z(bx?Zs-MeP%>p*_+-9@CbJq%$i=aJ_ptpgE!&N< zf~114N5mQoJt1$$Dx#DKG@ZU2M`TSd4qIU72yRBlAV@+-6Xb-Y(hwZN@sD8}?hm?* zgO--iu#(8g&b!FN`>T0k^1uMczD%fH`7RkUssgo)ykVpemrdTbP1(nv_ixG!9SI%c`cI67?VK?Cl-*B| zZ)}C7**Kq}@uxcdbFxgIE%V+yaYzaRQ{FZh1j@?=U6BTkdk6`wgGG-oKSnA7AN*>% z&7YDw^^BCe-_=u7bT?w`3=@5!7l^|9F%Wf0g^)f=y2#A`1m+*=od199+y!Z7t)d7K2T?djWd>8B^p0BFl# zkvuHuHKx)SaCv;_c(vL_d*R}sA%zd$BrF!Qg5C45{*sYVm4mt@3C^ig6LC%yE*&h*@mmIXfR9kh zs#Le0_)ATeH;dhe#6CK4;R#(ON}69*y{0n#3WD}hU|uta8t4Hy{q4+)HlCyO0AKYW|e3tOPQVi{`ucL@)qM@-(s$_oZ6xocMAg$}Dh=Y*d}>0eDN}gQy6caA%zs&&q!+2h#3H<0 z#v=6B9cgAWeB8hA+<~;IaS*F4@&fZoNgUls@`0D^+!&WL^T)-e`xTi5DHvZr&H$c5 z8GfGZn`SCrUWbBAA^ewMF*xbd=sGPJKLS=nBEI#tAAPOtS${S)6EEP6=MMAkd}-^6 zL&OcR?)nc6Cq^!^YQO$2x>&HOYuRrt+rh@wL79A*bRjZr(fS zOZi9{OPA7a7Jo9a>|^bRaOn32;(Ii$YuY8?n>6PMCnpA7V>|u7C^ci7x#QQ^5A3mS z9Ko|NWn!fMluBfh8DERF1gaiI65I1}oN>5-6$p9lgG79rug?>UMzJ%<6j89`_A)L> zg-Y-#=r7H}m}oc3JI|RDgBmYLXy8~r$k7A<ejZZVy^2i=EF+cDhW*Mz0>s4ah2@_#+Kgo zUw!_P*dIIH`*1{qe_xiWlq32;tgPX?qSQkxROClzjs)|13J(VE9vEX2cW7 zqAR{9uPG_rY^V94d|eC&B@0W6@w&!^O&F#5E~acH1bMdfk>xvrEqn)0a4erb8{lhHAsc_UGNT3W_}cH=z1Qp>K$>V{RycgbGFSRTdRyCg&G< z>3-o4!I8O4De7I>(#$gCXPd6vfU$}~rIR38KRso!BEwN6?@WF$n*%>bO))2%#@NdzWKT^)e*wV}wgGL34B;^be^a5T9iur5e zaAo#v)=36Zj1@c86ZBA$k76!c#`HDB=}D{mc22{L$|G+M<>=O0pY_RhHN7jCbvTSx zCP)!q$0<+1U>9|jNb$ELMwYGqAa6GUW*<(Q03Y@0fJEGbFH=Mcg-lI`26!*a0s}_zEzWMAiJW?E#9mdNoPQ0@d!5l zX7WgZ#eZ=nf7r*=9>+s9G-Z%3po0b9dvIhx|4{^5a(7h1^pOn1Pq~@F)NC4>{-wGh zTHufI8JU4`kU8=Qo<&pYbSz3q_vRa=o!==3>y24Dn?#O{D^ycK4^@h7{<*=aLVT}j z%S%*Oq(|8-Voj*_St(EuUHwa<%fx{>2z#AZW4>c0q=GA(pNO$kqt$V< z+Opp@FEw=)IzXxrhS>?bpLm8;_0*gY3p; z()~gJ??eDW5;cob=7kM3RQ+2^F<9V_%1fDnN@Y6?a_zb29BV#lSY@NbuKiHU8f!-g zc9gX)?i}~#>X=w?*BTWpnoUnqM07M(0@vAP`uBWIh5A8NSHKOI8zf=$S+6+1n&#M9 zf!<_}y$)VQGoHbl^7%1@nL*|C?EYyNieC6 zm1_F|CfCf@I5soJVT9(dAuEh_NC4ayC#aOOM|`ff@Rj>aSRBoS&h!I4Xw1=1%+g=>Hpi$ zpbuKG05dH?`xz?P*5U`=pWbQcrGxwjk|=9Btm;kZ`QV3}C%q4k>btS05r*6L$^-#q zkqiI@*yT)-kcm89-b+Rdqa|vvMQcUyp+4>HkpLNIMvy-3LTlH41O`l`p;$w8pFzh#7W)nnE^Hxh{|D0A3sv-Ra`B`1{fi|r?36?g>45#8cY4p z&ZWE;2sZWsTYWI-J2SciYUDfb_Y9_j%4AX44^hDeDXH<95kV_#3QY91B7cP&ieFa$ zqzgz7IHSaXMYc^ArIW;&aa}J zcl`}+n@&}^d&zuUu~(tpSlB}JO=#U*&fW|^{WFY{O^djW7O_OF0&WIluwylUK%F;m z^IX{6F!XO-kU;WdEP!wKByJ3#D9NeT47Pf*bxU^P0FMA4)M^HUJOK=IWZ`ph9>iH- zUXI6ug(Rj8QDPoAW+XDg+)BVBm4DTm2hLYq$^a@r)l$;?({SVS%0NOgvw{vil}T<) zDYtdw?RTh**;U$4-_82r4P32;IcxJRvK7>~G8B;|lV^Dmj&k8he?-%2m9^k*$B&Gv z{s&}K?VmWn(S}2CwBfsGvKD(maMiJt)9uEPJiva)zuE)~xf=86D}Jm) z49V#3GK>9QZd+k#{Km(QLkBI5UO1X^On&CiR0~l(xwbN*@~)gPrN(VPpjXXgN*)FH zxR5s85+Z-8)=GXIC{mmEODJW}(M$s(N4!32-@%*#1`qi7kDrFFW3& zxaog`TPN(c7GLwD>Y?<3PN>aM7bXlaKhkUuS*6f4ur(vZLb(e3{%rx^+|4cUQGOrj zheRiiUu$m|X}l9{D$p2om%p#1N@TwE zz`*7tu>gJOU&bf~!wrC$5eA@)Wwgp7NU;$Xhtm$!DnBW(=1HIG}_GK0R)?@{$Go=lf^|Pwo|Ytw}Ui<%>F+OfsM)tdykg4j2!>{wKfp! zLVwjBy(#4D2aX%>j^`m>JQp6Vmk&})9{JpTNDT6Ugqy*}_3N0wr+YflEBON>aE+*L zc#S^&dLlZ^DVUUXxifuefvYwz9P3qiAN& zf`{{`#BLvzd}7N)sw$D!3%OdDez2Hh7JAMb7W9Lp3f#f9ba-K+EF<9M@3)LudmzOQ7HE(H1QZec?Co&mZ2j2yfs$%qZ$;|53ux- zGWH6VLg9*Y^%sTW?N77A>L{Kcr5Z>~Ej}1K@MP{P81oZ~+bjH&4VE{Dg87}|0_F0S z*oniAwdb-u8Cc4WGW3b?aXsbh$!MoBNOS28+g~CzTr=E1nyN$-Ppl9jhm^yy(NQ|e zK$knCo)@;+>iC7?!qxEuG?S&KrSQF`oOWeDIIK9mymt@BcI!9GcZ=&1_Sq(qy+XF9 zUD5twyV?AUEUR$I31+7w3d@LG8%xUf6ugpE11s{+N}|$P^hj05NnEX=)DOO9vqir= zqnE!yY60?i#yr5v4qeC#cYtIsoJu|JA>lD7myy1OlTPNp#c6QYuqfyw|J>nC^xQfH zJ78V0OJQD&jj}Y>Tvmaws5?0}r7*RzMf(NjPGLl$=hQ7U(X@jiqsA8t<}^8#at7=D z4ZW44O5A0Ix?enBK5HpZ3L2(q*?N+)sGW16%i<;U8k64cr>ul3QUJC!xSG(@7x2oX zSE|XCvu5eZblCzZ+YiqM4YXv1rTo1)QM3+>6)J4y2-6aH-S#^opLs{1cOV z{u^ZcMULy(g=7*|br&ob!Wd$2kMkiGu_=SPIWQCmc1(J`Q6-TO`rcKCf?@p-^7O6F zy;$-+%iMf4{70Goz+VF+GB*Pt4uFo4>WXmObP3lh+w=3aKD``9&vU5Re(o*@kCpCA zL`>!P;2fKJd%iCiDfx!!5X`!(lns{u$=&0ylVzLzWuM*b!Nkh%(r9gMMON-vTbYt_ z-z)nD@|ly=t*q=qq4I8s(vxR*r^>BU-uaV+s+hVYq4NJ@>Kmi$e7?3D+iGm9v2ELG zY};#W;w(Z7F)125gp7U$pfBSyPnw)i?HD_jHu6^yj=Z?AY*pyU9*EMZ8yQyl? zc)OOGEv6!O%trPb2%X*WLA(H%Fb z^fQVS6J2Vk&IhwD1%0hKk+gbH{C}41wZkbNm9?%KC3h?ZXA?FHS89O zOrHGnt{@9F!Ynne(*I;(v5sFWST%{Lk{=|Ij}tdu;L6r@oeJrs#!4q32pg}#pyKo~ z<9dHshK(e|>;kWG$DLJ>B~h*Gk2F|Bt-UC{)PI7{MUDQ#z(emjfA*LB`Sj4n(AH9m z)gkAA?}n zu-7p9m{qrRLQIEtS~?NNPo^lTSiNTmoAv5B!te|Ub#Z0=+`&#*v~Z(;Tf&J*!&}Zc zf6Egm@%*qSbJUeq+$Y8{qeB2X`FIeXi{LID(l*ttu=m?IxCY_BSnUqGgkRpSoWIzs zU^&c6-sVHZ9y%b}`zcGs{PG2EM3{)uK-54`gaX@QBetzw;H0H(G*zd(_(CG9#-M1Y zSp~M5mExymfHDQ`*FRoZxmq13<7mdrd?QKR*x#^pSIH5&eOu9-yw zz|K7RUm3zzE1n6bBwA%zseEUZ_r)A=9P)^Nq(jup_T+W;jp3we5yt*YSu>4uhB`T^ zgfcJS4$`SQ2Wf@xq1Pi%`m5#%xF^Z;WYHa!PDb-;t0_afsRj$2(;>0VkBTr8)Dwo=>$y!-L^UxIx$uhsr4TwRu zb`|7k1a(wG$Q^yz*s3%sa!l%4aDJz7sZp^sa7Ts=LR!)#NZ_MdKF9H@+BGnzlE?AS z-;+oZlskp3KEh#X{1vL+oAhu*#au>YMcF3w8%YMzHP%ArR!zJ@a{|V~T|c`)4xC{o zu4(_*k{hZAoU3Qwnb8liGSV-!J#^g>GAq=C>t*P)T7M z;z*#o3TB!3=Z%ODtG|T|y9=u8 z@NMt0mK7IB$AW)ExXBE!35x0&jUf1(H%j908?KrX^Kv*v9@nb~=jfG)-ed1bLWv*=NJveX2TI4=m=o*feEqi`i%fo=&NBWC;Ck|oZ&rZo3H@(9!UZbCxJuhKxx);u zUIKcl`u0wr`$-ItnQV2}Wn=t$8YrVOew+G2!)3z|H3N@4%!*@HE2lA0ZQ@!SksCErn-zzxu3Plq8D+gQPdGcvPQC$=&MB}KRn>W{p{#O*;>PI5P=x$jkf}E< z5o$DHmk2)F%sS`-2r4g-D&fQgX|yX!%&9(R+%mX;_&|JcUR3(f@8+H~-c8z-wX+Dm z4t}A3)P)?>v(UN2@ktOlaiQ~%Z$|dO*+Ea;EDpI@9I?hO1?;Tme4z_u&CpLGQ$nf0 z%Wwrj1xOa zZ-2Pp2IJ_(`Dwn^6|O=a<7&f;{wA-O`zJVm00EDX%u~AhAc`SWVhce^W(-L6x5}_T zfV{fLdAGPln~i+F9LRI}aR-ZHFqo90Vvn0uzbt8TLs^d0lZaO{IyC+RdVokrtA(3l ztN-``+G>>wVoKp;YA&35Bj~+aA4RMHec$Uv8}=|q5sm& zUOv&2Z-*k@NCDeU+2Yo6VuvahCqyNx!saa+MTW47U5KZT&A174;wc2WkFDoXpn7a+#!`72Z5Oz|{ zq9B>G&rfte%mQC|gxKfh@vE{X=Wd{V2&2FwWote(qgP z$#C1>t{Yn(*jC(SP8ze!9S-TZlEHXcw7CBuQC=2h?g}GUeSX!FVduNLRadn2Pl>Q; zhxFtlmI~Y7`MS1`{a3{5_d;#R#KXi<{CBaZyM=)R+ z(*H&%US#a@tQniCtTI3x^Ks^dzzrh@u|089Z8FKU&F>WuP&F95QQB-gU7In@h6dK6TYUJU0#iD;ZPtMmlxc zVq=~!HpYd@XPzf8LFr$L_pX#|aVcpj>>l_EhuKJSe}Wf2rs(*$athm6((H*}Il79>;WS|T)vhp_pVfw0 z>#aH}?av72CZIO@XI8gZ8ZF!rv-^;Qg&hjRE%EOk@FL*xU=Af(X1^-xhisfFk^h^u z{#i*{9XRXitD3YraMt#2=~-!ZLhe%h3JcT5#wE&H+Y0qiIS*f{{?8Ru0yOwRJi`L$ z@Y_z^8D?@@-C59zS+uWW2*|yvS+xBBRiUARlsnrJ;i4#d>K~I4!W&(Xqa+c?@aEL( zl6mfV@rP`!MSNIj-Ts@GA^BM3tVY;QjG|lQOrG(c&p`gRTvdc$5Jn|RxZ^rm2w!7T zZva7dazIh;ByQqu83V>_xzVV2x@Hxn6?2VrT1(!5`DDAcsbC zP~yK-cYy>%1<;FlNq;{Q^ZW)yJkHE12$9C4pc@M#KwDoIzI$ZfS-^&`^OXRja{K?) z8QwUK*V&gzlY1A?Wmxc!)kW}2j#I1}r^rnLQuWk0!>--nuAyts+P5n)4$J^&0XXxj zD$m!XM%|@|NqC@k-70Fi55E&0-KDS%fi`zCrGfz7>1`j(+D|Tem>yy2>aLon} zdd7A4eDA+f<+XkibeVqUV%DR6nRfp|CYVg^eq17woTYG4pBlsCL+A?nlS0AC*Qq&v zuJGzJ>pcuKcCL}!QwH9}uaZc%%iruBB5Ee0BA+Qz9o>E)kMsB^Q#%|4psT(`jF+5oZr^w1AV zBg?<@(KHUKl!H3b&BW8$7h2jT95;UBSUQlVUB8_*+4G&Eptio6KjRsUO%O_ad5pvA zR|*g$`*7Ag8X~AE{yLr~zHqhedr{iSah>U&ixBBEJwSNt+&Lx<=Zi_^wx<%MckF+F zO!i1%3E?4Bfyn;7=VR=pJ@tV$HX_ixiLBEi#IJ}`!9ftMz)r7QIQ2+6IX;dXl9K~u z43EG1r`P0Yj@9I7U%p-FMY{Y24}Oqc6$*SU+T-oH`z(|HurinPK)tf6L*%wK$VOey zNl5~n!~A1zd@O~p2g_dSROb)#YI=R9$7a^!EN~NT{?Xy_?(>@i*(T-JhLohfDees^ zU?1jVVs9s&dz~Ble~1jtbJ)e^7e1JlM+ux3JD=$%nOTdWtC1*83eG>s zIolDVB&vc_Pk1nm9ECA~>~p=S;2}7pnPnU~9U{vaMG*&F-@M&)OC;LgaCD`9sct_* znyqZ}%V`?U7_@hncy0un-5SfxJCw>q|F5a;0mEVWuaXzoTLtW(F}AN9ueTNfh&H!qCv1Pbd%Ma65MaQvETS zpge(e`}*iaa4ZaB|B@14PMYB#i@ik3n+-)MaJtv_!p@&5ASTQ&H})2P8nA@B-}p?t zH$1-=}4X%MGK-Q3}bP1!XoJ~4k{q6mF_`}R(r8AB1hC+wE=vB=r0DT-_A81O|0CDoeq&9Gru?jLAlth>UP6=Tt&-Td6nq{pBC1qvMr0r~dO@BqXIxmlyxxPP61_ z>5*`8q1cLftM63A&#LN$O^nEzry8wL-`c`9rxH!{H<_*8;~K<345_==%wk`}GD7ag z$^CA*^YQ2X_U*BGYNYj~+*AdCi)SxP`qd(K`VGyBdgN!|%bV)=k$Q%=qqKUf*XOY3 z_mIrEn6rLIb zo+>68>nBiwL5-vC1g9V`8KnU1pIb{p5+K>w5Om@qSi}!8%uc`&qp{>s$|KX0&Th@xDwn!1}TJ ziOF9l=k3%Usl?xT9V;bg+kWSKvQWz05+{Ui1a?aKXR3G4ES&Pv*Owl-6Bz^s{(rbs zMs8W#%C7tq&_497!iNe{(+`6^B&LU76u22;k9N?=5R@ZgpZN>(iI!2yjrG+6>Ze#- z_<0-hgItlN^A-s>-{Qx|VR&U%cDqIsbFn@xNc=is{{GRXwzsi#z8#*PJ+ZO$cM#XM zyrr#*wUpl$g1Ip6aWI%SOoYM{ta=g+ z%~bh($EQUDgPm!wXSZ^G4UuWsM2PmckugItShzY0RmebV%eg{AVy|k&Iiwburhg}s z7h$9$k^Et2j;Q?5xKyKk`Ph$bxSu@1^ON+g4{Qp_iXA>ddD@BBEij>By*Jh5q z0Ie7Xk2o)&jhFL>15;@?WZaWh;#><-5@cYb-542GaCNPLnM4c>;YIp};UE+;Mt|5j z5C^HsC>bL?VN~le#!r&#Q$gs`EQR#}r zz>vR6u=LyrbrkG_8Go?4kQ-7-mJ^v1n)%4>@t!ky|JKH+aXlBu1xQf0;uYEB)tdbi zUhGB7Xaj+Px$vx&G~Fj?#V}=A>hZpwP+kEplh?opm-hd@@pne^DSD|2;Ec2jYu~xh zzDi_V17{?~eSgg0EaU6Rx|Z^~nBDQKYRWmql<$g_X4O@P((GG0D(af2rj2&l056F8 zT_g|vl_G$sd{kq2+B}kll*t zri6kXBKV^lW=j_^feurAv@C-COj2Jg$bqj@2C|fs{|B|mAn42ZA8n}mOW(3fBB%mt z=N$%#Hotxh;U;e(dk|LlD<^Deu}Td$=bHE1JuYedScQSCDla72MQ;A9`V{v-1k~4P zD>D`uT1UeLjYv0;xeD1B>~JoFMTSSisA z{<*@s&&YdIL77l=7={C?jhMM^f`7Sh-I>{FFOG$1^Ez;%;};9KKS!-pklrHWSO2P2)lS!#!x0R*0fsU z#tY5&HU_dYR-(4> zJJ59Dt-}ed2%6t8crSbj=b_yYdrT|-u{&Veb!z9ub!xzq3$Z2M<~H)TA_D?Y>eSv; zUB6>(gtI-|tE+x{a<6g|fyY^@Q6|Mn=I{El;o42BN^*THE5 zyg!Rr2$Fn5>~lBx&3_G3{|oI{4pM>^+RK8Hk8GE7?F&D58X=z_JX$zy<`>J|TnMSL zI(G#TGNeA7{FoP7_uW`j4nW(f*${MMGN-krvL>%!PGj6knn@xLWR7yJT#?yFop*}! zj%2*}7)QcuF~oUx^klJSW}NFHJ!toQvcs#cQ|hD~UO;2iz>~9+4Z`jF+_Hwx6Ue|e zUFs#_MR>(JYDU_jwrf#g+X%w9o!&1JzrIUQU0g)r7M@2@Vfkk}^BmZ!u(sgEpb5XC z2lm>M!!Z*uWe;JiBp2uXXviUAfMW3Z2Ls?2Q2D($F!+ITWtsmP5~~5fjn7B;krCz8 z4_L~8v0N44^K$ywVU5qE>w{9C_V9cJXbHy|*m4vjW!okW&Z)HcbHoM@V|*p3wzz>7 zGw!*jirUUJNvo61VYtf&?rEh58N!eqqX6iZMK}m;q1kE zDx~25Da`N$)QKRa;(LXhd^LBa2P4w@8^ajX$&bc%#)};v!R_ z9Uz4w(Y%eBDecn7i~={@7&YJWgVW2t&Itv764+>QimSnZGh+5L#K{p-=qvK<$I`eV zK`$uFqc&N5xkVItx96ecsJ}Kh-K8@oc3wOt2DG{7E{epxSGH+C363|EXMz&V9bdTj z@tx(aBu6*?v<`Jz#|O~fHHRLi*;z+w5;o!WSxPvRKe%w#kvKolCPf|^YV-G+fm_I7Oa~g6=iayt@GR zJ)lU%cSXZ#Vk))@+)ZvTknq#PnFTkb0s=alhkso<@_(yDL)dh&Ve$aeg71Rk^EJbR z($|y@#`1(b=E-4V@R(|uzFxk+=9OUn`P7n*{1=~N`^d;0{8W{byk)n!FosJah4lX# zj%>X?am;A)-iY7Lk_SrPpZxy#;r8t47Q0qfcSeE_r+H%3i{FJ6Sg6z}t2@09@Z!(; zaqTG-FP}ztxX7EIVdI+mQ2*OQ7cvt-EUBJ|#z&Hf?0(sh;F=drs0a8u z!6NT}VqVvo<$Eul^*3V@emcn>H0&O3yi_}0}S{Z{c)e2u%umbz)mBwrFb;(qT@-WFb9-qNrPYlqII zfD`dr@?zevcn>hf|IZ(s)0^h_tC$i3{Xr-2%IK#*{s6FapgK<68$I@^bziZgqRXm+ zp|$7ew!r<8BU!|7_E4Lq z1nKNLHQp(x=3Mv6B;LNMPb+W39yiiU;C_PC@Y1JzCzdp17z9RCc zt8zM9hneHOn3)48c<*8pI|Cw*fu|jyOMHp3t5h>`vnIIyoX2;nTs_hVi7#r-tHD(r zJ9X*ku8)N*pu#xoHa>W3HcxaBd^u{x^4kd5^mJ|a09GtHiW#OX2IzsQk`mjmgC2q8j#;;4w!FDC4bK6x7=@dCBgFYdx_R!V_+^257D_biO1$n z2l9E^zzt7rchD#e)9*ZDgXUcApb>&e?J~p7O&YcPT;+|5Wq#f|J@DOe zv%FGi8GGx=-n&0Ug8D#p$-n%y1-hmpR5-hG)c}n+pRi9BA)}t7^&us-( znoUyM%C5t{G}7V<7QOKsLCrRy+Y<&4)e!Bn@6JbbDEp^4#=$A` zbS-7`K*fQ@Mb>+R#?>t_^$ugVuLohvNUl2(PC~Wd%D# z`O7JKaxDiHa$u7Xx-&)F3yO1>c==t74Wj9OC8hZe9@0lo9?~5Rv_*);Dzf4@UinHH zH{Mk8`NGNyIU)U4?&pdPtx}e$PM6J*U4tGFJhCDlJ_5IWD7`1tI^k1kl^8^QIgDHp zP6(_zrSll4F%t}2?r%Wtc7m-of^)#o5iDKypviZ@oYo`|zT{e_CDX#LU3Yz@q5?g0 zH0h76SXTU-Q7CCpwds{pvr)BI;S4>vlHlCMNn8I^1}j31U< z>I}}icnBYK4tI0P6ZTzK+4I~#e%^g|TwE!1FWMwNV3%9qeids>_(5WR15)i#ARc>; zLUFwDM|K|^I&}h$H$a8Y_r&u?gyZYzF2D{|$uf)j;J)Ef#-F!J?X=z{F@RLN|MNTG zKW5t@I2PKKI^~EzdJP`22VdWwc7L-Wt@W%wUTfiB5$Q?k412c9zMiO|@_hZ5v-i zcFH;X?6!!c03Jy?aoZ2u)jECJsVxJgU|3s9jA74^i4Y!tO84nckoUmZ(exB}WeDSmrV0q-CH2J; zAxal7O)VP%Ykk6G_&xp72ptFnKYXw54)*VL|G^XWg9pZ$$dQZNf-*inrIh>o94NzL z0pwQ#;5`9HdBOiRwbO2C^MS2s2L3p@{DD@_E2oKPN)7h_|3IvumE?&%Ejw-zrZ63A7wBv5&}#;KQa+`*d0U>xtoX2eptHu z=iV`)bymABidXr|n_=h#UAeL$O0%Icd(xXV1HAee+i$h~pw>r;67)<bIWC& zLfJVGT3=YF-K4iNBIe4}cj27RzrWeJK=~@iR~qs}deCC;n!et0@tpRvwxf)GjNPAj z6hrKt!rMqa{seWq`Ry55KILQne_Kl8_$`Khz>o;e(S;b!aX=p#Q>@1$%>i@5XDWd% zN-JT?DRtO$RAtTkKU9DM_4hO+jY%2!)KNAN2XtzVapXo4Xv1s~XPbGGYXd@ZX2g?f zS3_?d`W#;U?5@0#x0{c216`9KW5FYYk9R_NSzkE?Jp>!o#Oeb4z@2=Mx1B_-GQlWg zf0=Oo;jCA=86@Bxxr`)7Q1pQPoSoPv5lC8bk3ptlhqYAl{mhIn9U~`D(8LT9e}e(9 zrp*M>FC59Fz$-m!UA1F47Z+<(NR1}fn&it+Vkxt$DgdO*?Onu*YeCma3ke_@DHQ7i z;GFM{)mPK5QMD-<3GgefAuajw=`qC8X_c0L z!eHrMwy(t1mhdog1z3Y9SVG{BSDcwruvAIZ&BS6#Bj@sVyv$4T)Gfs*f5QzWX_>i? zo2qlba3fUNLe5x(y26XRiDk?+QoPbLLx~C{53fA(wG-!NgpX$`(!3#0j`8V8ffq`E=jd!)`!U~FlJObzP2|kGJUklUs zyp@%qGZ1Cu7afr-y}F6|N|CX2l&?bw96}NoQvP@X)|OS~frS*}yr!Eg5``#MQ?ZnN zx-F;Sgdx)rQQZeal8ui9&u;m>3n_p7R;-1#)%ZoRl?>2tiL&tF|KwZwMuJu7nW0R85xG*z2WgS@@I>TssmD#9AA!3bt+v_ z$nB^8@kZCSxt-B<=8PCaEPR}-46A?TbDccuZ(z6bVM*#si##)#OM++i!1}aPN?0wF z%~tI^8ib5f_9b29x`o-a80t2+)Zepm7?M8AMA8C~QoMLI2L9{F`mH%u*lT>Yq^Z8o zLd>Y5Cov0t+FHB7VA4a zM9UhA20fE2#psr`T7bg$;MFB8LP30UJA6l8wFE6wgSBglL>@FL3VVT9k%S2$KRtgy z#%s6G>B;oe;j{kyV4a-Bo_e@2e$c!f3~&C<0#27RkN+04j1_^y+c&y;(cg~dt;aNl zn4umXCe1W^5JKT9!I1#Ozl9hOxZWfRp#UJcZ^c^v{lq^Ld6`Mj`Vw+uN8%ri$(ryY z6cf9JRL9p#m;~?I*x{V?1bcEmCyzL^IKyZn@oph)aV#I8iIdERrz06WUBr=(NO1%8 z{sKHLkR(&`VSObD9<-&><3;K+_!)W%A;U7>OdiR9L)>(JhHiMrM^niW#sbdkofu-X z`nYzwaN$_T(T>U;7^DO;M)3SpXvatLzy5^fHRXkwtk4-v&cESDJgcvhPsm~7Da;%t zTdJD~rC0%t=<#PW_nJtnUfZ%w!^2Y8`tWhN5&z6V_9dD2hKJOtcl{jot6N9PNkO<~ zomE=;Z0@5Fi$N{+jSG57rdZ0_rN}5NQZ9guHF8|XygW|JO@h}y)c88@PHKG{Hidip5bodUk5CkjXv!(&H*4}ZB&@ldCfCrwb z$0U#ZPrl&;Lj!BvR}knt)2-n&+-DTpI^=D3B4Fm~Y2rS(@>`ME*<&~$0FM4IsYL+R z5CSyZij0vD1#Dl*z!bU1ncxMxNP9mt3?z7oPJWoa!JrCGeocV9)rta}fE3g#Nv9Vs zsA$4vt4=Tc!e%m`=$iNkyv(=Q%?h#?P`D)8X`93!lTX|VqB6lT4+Vd#C%S#4OM}oq zDRL_qa!vf}1eQt*QtX&X$n58$(~n#`l;!}mQxHjWwdpJyUdx$fcOok>WljEkk@N%d zhmroTo{MvI8dt*`XQlU$X_zvHH^W=o_6t!AAp z$v3kLh|C|Ami;aMLXx@K&`5ZbynF_eOU7;1(e+P;QhV)mTf8Qg49u9qg{jA3>(?hd z(a;)3|F}0AD{3ZE?E~m9m$AMe?Yn{Fa^(d%jfD@JZu)mAHV9!xQyGj-1u-ncd@FFH zyba61eI`w{KvLg;C(J5WU8Na;X@0XCSlDvo)mUVFH%v=rrp8fv^ZjF=bqU2@q-HJ!uj3OG?`tI`+< za5C4xb=sc;#5F`8X`eS?tIM0FK(>rsxeZ`rgppzx^1tg>EWEzWN&DS-B-jP+z*SkV za(B?(CI_1#m0(KlvuANLub&a}u@cxUTFGw1n`fIUgcrm-;XFUDD6gHoUZFaHWPFJ?heBbH#A7jabIziZ z{NpyA2O%PWA4Wq9rqtI-43J49Fl344nm503*$OBVN83Y_Jhvj z!kNpaSnGXtL$s2gDt{xFf`|KK>GjLx(FWXplpN@D7e{t=mO?U)cw*6)-zTiqe#`u) zzM?NE#B39h^S42t%!@AgFvD35@ld;lEPH~ruuX~tGd*>!!vBWkCmrN$(c(oWFZEN; z&WtfR3hl4CooM)P@F>E$)yZ(nWvkhSOXbkH+)fzqCR1Z4KER4Zw~W_E6QuO~)dV_0 zIgHXT++`Y8C^I?tZdOEza$|?f0hJ#z9WHHae6J~!_AC8-ugMU`D}?>kB+UKQ9kp|< zDxGVWp>DGMdIioidgPEfp-YxWH^4H9&c>8mNlY7)bt0v+Xao;1lQgTStq_#0!UXU_ zxI26fUm$ij5zEICcRCYchqfpmxgL2OW^YWNy16@E(~HG3UnwmKu48v=yb9)R>F(9b zyE0#P159CdWjBT@n^l74;EeMJlQ=U5p4`XBrX>dStlb_;lOt6jBRjH00v( zilz?+>l(tExd<1SDii#78m&u0OP|5Qr*?e^b~(K1x_OX}^(b=QsQjTS=cM*6mah=r zvtGV9M&?vPesy58a7o5t?OVu2sfPRt&1Ug&*D$l!v*Nf|mf5SXt`J^}fI^7?%Tj*_ zdJtfx_!mM*T+*{yu+kjv#VYd7{7ObwxZ#())PNNkEmKCXVYGyHD)Hh5#o#(0JUeV~ zf!8v>Nu79h&#hEIelVl7-wvGKEOlTle&0{4U%^O-IabuJuJ>Kio}2XaEx)tQ({idY zIwfPn#E9#l;9Ry6CaMAZ)peCPx#faHWTX}*t+4tb>xgd06_ZF3kt}O#FYU>ZrXTrd zsS6-X<}1?(ze@?HW*rH-5vYC`jf5i9!!vs-+drG_4#rU3legkYS3x!UxjP?EXkCgPZ2NDPIl68MGV zvSY>k!6%z<8^Sxuh+i1ojwVk5^F~{#F^}o|j;)Hl_w(;xTml-KR@92_^lxj#pI*nY zJ_T%~U>Je*EB}!l50XE0=t=$Hbbskww_u7_}u2Y-ZDTR&iFazE2K&(=yr1 z85#Q7f6bkj{c=RL@BOM%dcx)YCNIyFB1D^B2_NfV>fw^i%-fgz3#A%97TUCh2jJKX zh>l?Ws)-DfS`=DiH1CPC-)hiuH*y25@#XJg`I>B~`$>fnUjQ~zE*|7MsGUf4yUC!A zPUYx2UHJL3`A}*L^-59rWb{?EGb$0TrFFY6D^iK5m0(=DUKLqN8;66~zU6|RZ+kgo z7^m4PFs_`h+eOz<1517t?6XjIoe+3V!TDlOH}-F30LKiuK7}pfX2|>`R|hdYThYX$ z{cUT)`!SYIR?P({feWnBj5ZgN^)E}5RI`S@*VCy}0_h-?H^pGQciJE&QZ1Vo=r04# zRBn|b&P52NzN3p={7v^rv)=mt8qHU?cl*Z$J4POSpZyOyJl|v_m{Qz&W4GM;ONjcz zUxcmApCVFi@!TQs$^nR7IddAs3{@JFH>K2p`$*5rH^SMT`rqnH;d6^slD;?4!M5rJhxgM>!JXtI z$Kw9W@gIxO+7aO-=RQg-Lgn|*y8v-2mtDS`=6(0sM504em3VT1`B>nZ zR4D&RbvjacH5wX<{qELqzPV!9S{-W8`)NyiW-l~Et&kKM^CjcQFxoKBa5!opVl(J$ zp~GRum^~L3JvU!=p?CWiJesMns+W9ErRK_|uBXGQerHVtfrx&kg`v(90_3Z70%8=o zn79M}1{nhlG0AT+wl|>?k}kwibX>9P%=a=W?SckD5_D0@y$K|{UC6Eb6nBO3CfkqoxR%bMM;_VZ&3b|iLV1@&xu*m{E(UtQQGkD59+ z6Ta!hJ|zef-kmg=-a7Cf@QQRifJ%RU9+O;|=o$N{fVh0f-%!syqycdPkhWOMNi0bKvGYMXt_kxLO0rt9Q~D;Kp8Db{1}?J_Q8`~Y*(v22 zkID1yoHOt1An54CU+30>bW^aeAyb2M&YV4t>9wcZ=SmJJzFeW^l|k^OS|9r~hZ#HX zCw5^?%F2dGU%M#L8v?3h*39Du+ZOLWLd0*<^YJwc>=}(CEu49{J3`z+ah0?&CR-C? z-iyn-KD9X$%(KusXjV2qx?Pp@{fHxd_izf(h=%eQ)PV39^!PIr4bV{XFj5bJh%#1- zn8uK;dyn4DC583q+2~>T7op-S>fnCC|Wdc=K137DZe>Sl(F&aBDP zQO>Wuwyl3VY}s%1c>Q^ofZ0R*V!szql8Ucmo@_%|$e>+ww!HMg=)?)(2WqCaU>Q;Y zPpsO}w~dt1U$*51V;U-0PyntI_Om3_%LqJYT6yGz+4HKbU={8%oeLM@&uTEF8RH5L z^%;qITNkp!m;P0*3h~qu6jn!cl*i~7^m!UP&xssk`jKQtadsS*uVx-qT z%2zg≷XR0z7qjF@^Q|h&(LHITwVxjC$3q34mQ^Lx8t1$;q3%pR0)9i!M3^!;wg4hsWUG+$%N=4&jGEE`=*#>7GBR0YSB=$f0;g!2&DP z7ib<85Z9$zmKmOG6F|0&4C-}@Ic^S~v4vG18@BaI7&n9k_8a+EbK9+)227>Nt@Ahq z%~DS_9QK`wNDuyHI?jfpndI%Xz3=&y{yRT~#zCzm6Bof^FdLLr{4-|z86uBVDUn)& z(a0|4-h3;Z5Ulo_tHC@=pp|?8io3f`L?rKba2>=06r=85jb2GH-?_;Fw@T>q`ij)4 zw@Kf67XcyDJxn9T6i?!Dt<^}DG3^KgBAHv-{i78kew*|06Ao;Oa}Ep}4v#cRvDn_`qz+i8nOf{v;1-WJ(ZN@Zq^hlHe(sOpd8CWf-oTeLplx z=%Ffsu3hg|4z5GKz^AOfvkE>|@;R^7tJbk85PV}=*vmB>Z6%7~gCUP-J0G=ZyXZed z*@1%;&$uD|Y!(5=!eK%)a=;~>S-d2~bdW517hje?@Ug#PUMEHoMgi_mZt>Kki!qE) zAZ8P5Wfphesi%(3Nq3Oz_@a)(V7YtVp4saX)OwU5<17jyn!CHV-|y$%V18UIPO7K> zNaCJae{eU4JG3xux50i7b69uM^C4+p|{-aU-yRXGdYv+u60vl?L1nLSAp^|ymflp1HbO+2o(ujO57mh|>jN_R7!3Luo9^?{b!E^Ie>nkU*IazE1yx|nsCRqz|GK$A$M`J~A zA9ybhH4aB>W-&1-39Fi=9psGbh8r<&rfkP|mu5$l81E6LZ}t2xww=-v#`&_x%vb#K z<)q-oZxnLn9wgRiTRq4;?X{W*C9qO{SVHH837+497>}nh|2&cEE`CC_Ua7&PtxRGl zxTRfX>jg;fz}@ReJLZYBBu~1tc)mH+hCj_7Uh$OrL)!in5yRns6ulNv!hb3EL&Q0I zqc}_QP3zS|AIXhXOp{r2^L~Vkb&Zxf#@o6A_&%vz?J69)KP<*Z@|)`=L^~ElcL4 za6^q$(tAWL1J9ZeP}D-8dWY9vbd$bNxORC61Mex zl=4HMb#(EOSLEe!Q*|M>|k-O%9_ z0mX_z)#$btd~CTPNO?Uu*=I4&TtqY?EEDfCi=`j9y8UO|w9!wcY?ubqvd)Ah>Ye6a z{jOG2*v#-f=beWu-9z0rvkA}$6k=dvFTY(plz+SU82fwpEga@PD)&Z2z^wHcO4iAJ zYSv<}_SLzOrAH~Amm`aGN_Jfnv*hcyN>hdurbO(r~1 z!pRV|fR}0@uJ;)8%8RIbX_1Z1B8`#N)-w?}|LYH5ZozOS_{qJOd2}JoPT@sp0-!aX zlHhOm4`oLWkw+@qm3Bwm@tZH8AYkn)INQwWcsxzTno`dZS;X>QsP*k42G-$%6fHH$ zujLWsb_}LBS#h-B?S?HG?aOO^l^y|M!Vnjq;U}+PL(WQ?tSXS%e_Y$W8VtX%x&3KF zEAP{7F1>MC&bQj6G3A1Xv<5fowHB5-wRR1HxGlH=f;LO$$l7dgyW~?bro(|@V)g1m zD>+2)>|dhiP}HJ`BKHKA3QaNk{Jt8TGgkxBH@wMBUkmr$R+{t;7aJYV3yVA8ebr|7V2t#2-#qoV z>w02IQ$jqa8ZNk;(Xh%g@c}a@f9YTQT}!e0;pP~#67B&o_MZv1Yk7p>b)GJde9zm$ zlaNh8ij7a{6HRfzyR{40(%#b1Nf+E?uPB`gvutFaRE3^a%E5=ce3kb34ye^;NNQr- zJyo6b_EG}q zGZJ&KUkv3N?SL{XSTFnO3|XAI^^K+oK@rYcrPxo2h zr~aqL=Q;_roDY5UXc<0BPs{y=?wb`KViD0Q+$~Ux7db3kFC0|ZzgMg3&lCSzO;s^& zKtp?MYtc!TjUhkdZxE3iRjVB+Hil!v9ubz)8*!rF6H`jr&-_28o-w-8W!c!aJ@Lf0 zZCexDwr$(CZQC{{$%Hep-oEdib>{xs)oa!MR#kO%cd4sA92A7^_|xvH|7dDSgu(>! z%%XbXFM=VG|Lx1MybMDwXNxZ*W>}*oaz=@B=o*+0oTDRy$BMH<(QRL`P zB^0IDFZt+xY*#2q#hT;s+PUTlG0lwR*H)pT)r>Z#OHYefB zK@-P$4Dr6*7V?B^EHMPnFk@1Y8Y+(^YX`L@>%f0O;zG3@mNQ#yblN{V3XaiGnkdHE zFM`Oyl9W7%k}4VdivLsO{X;R^p#Kn$H-t3bgd)U9n4PYs zsZab}C>BW@q{KrO;!Mv|=Y#}TUxJrmtqi{jza=m7Lv&=+0Pqcpq#+Jeo@nL{>S*SH z|ANGW9KzRkB)=U`Vdu;OFiqg@DI2pP1MG`fsF6z)0>d2swJ~@*Ekhj0+YpY5x$uf< z3a_9#Nj&pit(L6~z(mzjg8xW#R?3$O`I5;GXntr!lDzsQl9Xsy7}+&8-`Z6D5;7x_ z5^oC8Kpz-xyC^3K$|NNmPio|rD1%1gh+~o*ePC3)f;&H^_Y0pPxS(Xo;{8Bf%#U><2^2vVj=|Px#-gbb~TYIAezk66wkT5jV1pcs=R@=!hJEhhHL?e%4LmaXk0p z34YfcSUEiWX_EpM8k#Hp3#;4LOS6{4?Vs~h2?97!1*>^&Qt#V7?XkucV`_xh*d@|$ z)s+OY4|QCzpa@ASbmh7qfn3rxj+>75XBWe(uGE~W%cp3at>L``i;fZX*p@aH`GcDW6>?S%;oi1e8Sz-d)PX1i?&y91PY2Y!J zo4H&GjQ%pi2g*z?^1YT!t#1*jStCcbQO2s@$@&B>tPf{gX4!eg|IiY_v9*BwVB(}E z8z>S=tSS^j;rV|Mg@jrJ%`kViI~_e_N^>8w_fM(gtPs7^((-R__K08aA>tu_d*gmu ziiVK2#ljSD;T_Wh6y}q}^O+1`5p`Wa41?QGu>l9r3X|KOT(sF&9TIjqb4zPPOP;QZ zBJHD>Uv-qq(C?S46}JUE|5Pp7=aC{l$ki&`;VuE^u)riV>zQgAzD7xknf>MC&h~VR zE^$o)h}eOB^J6suv-gFgx$hc73VRl~XVc4Z*|Id+)BD^TB7OFd?e|>WWz`Wn{>Nce z{RicA&xWC@p!HvJg`b3Km{_KzqgPeJ4#xVCkq_NM5J#5h5eHTQ8;o7cx|dlTT(~*c z&xPX(fGb9D>&m?w9;weM`B|$If_Tsb!wEX*!wLKU1(5{tBGO>`k_igW$oXIk$pD>b zM`=%YzlOHDuG?eCE(_~~4E#-S%W0$B93gOFuc_O{%rL&ObJvAjU0QE|K9TiLg{a& z%rg5e*devThF{xxiN1UWIqNIWLlBTh@~!VRt<&~vo6>Jb=%?jPa zoM(40PQKAt5-yrR?PJOJL_}g0-2?;XnvT^?DZ$N5h}kDOtP57>+&z#K(QSmPU3IR_ zg7ZM(&q<*kLLz2_rhqwX()1kJ^KpAAaaZIL(jh8*Y`ODsD5)^0DuwCBa8bd``tnE^ zwPfbJ5m8M@UpkUlm6~aLssE9YHGu+Gqm?ojKt>H202#5N;z*#Tb0NSbML0l_e~~{c zdtneM4`&eQxbXk7SgLScwlRuqZH*s_8>q1*^|}168b;aE)=L)A8-mCbp_W6agyIaBYn;;6BQ@sw+ZLAE~PmmIO6gIK&ynF}28pps5269JNRr zlv=^8Mkbk291{L}U6-GCND{2vJT?lW-TWL)w%%5NWV}|EBp;1nq%%qqEE!@^*MmID zA1}wW{u|B`o%>Uur!#J4ozLKOeD4;_Kv!UzwO7r+!|bo~FLW>mRDq zVq46D*;o1C+6$rYGHO1_Yh5z-YxalWux+@qSi-Hf)F6O26g?410B;iE$|(QgZHWmk ziHlYP18iQH5|x&QChwc1){8Gs)kSz$0#X@Sejz8F)_!4$GK<)tw}9k$ovb8)H(?>m z>Zp|?FcB$alXu0VuB?vp;;?OR}fze65A|_ulH08x`G!Q#I0(zgrqR`SQ10 ziyyP?;fLG^Y;}6f_YdhJr?rz^BjZlflHPlOw0$q6S%AO?TA_2r{`bPrkfEnA=AZ?^3wi#8_B#H4ogdP+BfiJ5x zs^VD-YKBvGLO|qcyLmuVs@wut24r;f`(`wp)PbULDbu68m}#XIPRO(w3Uj$bsqvr_ zzYpdBR`F~<+fKVQtK}AvCJX!SQ-E|+sx;8e4}IFZVDJp2Oz5GZ5Z(6{+_F1~gab8HL=(xCdcfQ1k~ziqWh9>dN3Ge9+WqO7QjBpLaC#C z^dNe#tZrqTXB;%3=raxrAei5C3ZZA=G_YSt|Wvp3&H6;Kq$Ab zV0J2r?MOHInMg?l#S}ZX)qLjWcH*F)6QbED<`I^_?og&&x~MOxv(Ko?I*EndkCm;` z;HWY>=%~O7oya_CvRy(DCHp<-4W$)x6FzOllW)7-uq*P}X1e^oHM$_|1-vbP-1GU+ zmX~HHR%X}OQIZ%sj4s%Mb(#6gNzCz z*E2{&azPy?lEz>;Ws?T}oh2SfyoC2nJY>Ku-4<_R=fLG2lW3_k9P;|$VM*mSI(pTq zV4>L304@cjA)mG#6}CV4jJveM;8yuh0RlGLNosH@KPZS#Jj_Tp z*)$fsUiu}WpA6n$7zkumu3;eHt4!GU*o~t0=Q7aZ->qRJVwDB%qbP|u<$xy~U?k)e z1R|+r0u!A^qgc!o56%`HkHDwidEh3y>3+ii6J~?_57FKbfG=#KA^nHw0+cU#h`gzE zqT>PsB$4Q@HNi@ViIVuX~`e`B;98XzoO8Z$3kse%V9j@qkip=$N>OhR) zM1^LKtipsNw3v62NU>OD7RT(u1XQ$`!tqAU^i^66$$`So_$MC45o-(~-gl-*CBQTD z8AoXFDlB87usY4ok>uu#`R2!KrREASafRS3-Ur6b?eP_YxiAoz$K8{8%jWeUgXNt% z&ftDK5`s_2maUc{CxG>$n2NX7so!FnhZ{&Dw< zCQr3DT51pIk`S<}4{8ietZ+(uv$PYA0g%6%{|X0%@zMf~0nq%P!mO=WXoIdrvmx&= zmhXyji<-Y85sgp<3StSVX+>lou)7y)Y^uS2PhjVVjFfk3VcI#(L>+qzt}A}`c)H(q zKoMa686Z(|pK5`bD+lit=#^RSX^SlaxdY|w3mWlmeJvR4gm@p-4#_#oJMM5TC})o- zk{oP^Bu@LMDP5HLx@i#6w7UF|?ASLW0`Jc0XdCpeXrWm4369rJ2>_xcK}va*CqXLk z7a_V}VfaJL&P(lgcfK^}RTB;Vta@kI_>TLW!yleAV+=_l%^c|_XvX{^+iG+vMqxz7 z@U%KzwzDp82~RE5%1D=bAUG75Y^RmR;+N=(c6<(UyxdvdE=d-WW8vB}OrzWIb~M}E zXVt2&y;Fq&)5%-+GG(mAshRiq*6XPdx*Ap*&>8I(=O}xqRx9Q1$gTe^_oMe&v}PY# zAs>aiSL;W+tLdVzuj`_3EXCCs=C`Xe_y2+-i+pt=nqc=z>M08{fm-;?diVY_rZ3g0 z?&{AaUDiJU=tch?Fu*N>fR9`i`$!$k&Fs!Y?6ixWyic_`LErqMx9Z&(*N?^BmN*4E z^&^KMXsMEu+lHh(x4||kFi#qRS6)_UDQAN3K_c?-wegGt0T=KI+M8xKXP6*k5u^YP zk#_WaVxQS^$iG^}l`}&rB+5dUslJKXlzDTL@8#7>v8u#1X5W{%|5Oyp2F;A1thM&rt6)49C^iPLb8bL)UpWj?hu5jUhebCrCe3ev5 z@78rFu`JoxEo|X;E6Rkf-bOXh=X=3dpl#j=`Ko;Sy|FQx82?f?%u1l53&p*dvnh|y zo6*CP=L~&~T8C9@fW2^d9Mo{;FeAICo%~_(8Ct^P=Yh{KdxYni5CXU>$gqDM3d1?8 zCm`yi)7&pAU1kpUa8PYV-|wf7ejyn$R*;M5i?W=g6)P@qF6>bB4(+w~7<#b&+0*b| zDwt!KGgtzxe@{whP&NnqEU&$k4D0-~zhScc)U5>c9bRl`LLEZq(O%uoO}6MtZs&fa zo$gKV_8mKweh;5~y^_zA>jDJkL%-iiRdQdK{YJ_QlUmW~1)*NzJebOHZ2X&U3^!~E zIWvOdWaO-Hh1?ynluMy-a%MPQ!WsijBMTkY(^RJD0Id;E-V5z<%ow6?Spq2cUHe#q9%JD@wN@yi`vIAF_5JSmoeH49umc?`*Z%2Lm z36}zUN87#5)l_5PG|Ww*T|44CmO7f*_sa62%3$B` zvmyvp>(CVDgM9y3h5<lElp_Ch7?c@PxA7$|Z8#l3E$zypGzijS{tswFbH zOqjw=aFmveGC2wfP#>Jzf~OiT?u)UNmO@19_h-sD6x;enU2>eF(?3<}z0HO@W!4rf z1WjnO1aE2A^8{$!b5UD48DM&zXg>hPixP{aBCZt>Y$wuWw|1}g9^uDoOd{ddvJTOv zwe?*!Q*}4fju1j@ssHL{Xl)bo>B>Cw0_;qBTcOi`er`nQ{*W-8Mlrx2r+f$0--Xad zE+yZ^pUFHo0SX~0YeCJRIjYtp^vp+j{^3!u&fZ^7eKsAy<4@6(&b&~);M5<^q@E0l zkg+QJhZ%_e)r`p|qSe5;`DWDOt-F_RZiFmurV7l}m+2MH7ecDkN-1>P9O6zOua*P4 zvsIma0pP_L;7#Y?0+Cr4Z#D$cf?EnVpv@D^(gdzum!JgegLXY{Vs0+;1Z9acO)`T1emc7kGjgCQQDx_E%#iI=ak z#SXy=zZG!75iXgo|4F0_rgrAj{p4yiwDaP5eBrzXgl0QV9f)i!_sAQnhDRw3%Db)Vbm4m+r|V>(rGd&2upT zvVYXSR{F~!@V#!vu>f^(eB7Z#cBpq+0^U#Mf%#Z0@gm)=q7mTncH(HQ3kCLIWmP-l z@-oiCD&#E~iIUy6|HnDWU!hM`PL*>o`FD05(#s$_;R0UOagGKjB z(j-eNcMua!%{fbh&2th6yRtxy&8ipvzjSx*_$i5S;+ zm#eD`-F0}f+VZHoBod>3u9Mn;3d3#a3)H0(xTr=!e9m@Un(vRG7p}bJhZ|S|Av-(t zWGHqAMlmDevsO$6qdCwulnX;D*4(>*B&9%FR+7j!$%ofD#Gpo{1jMPv+S_ z%_hE)Up^zo#>eJcpQY`wrka3sJ@HYU`zU{VUrzj@5N3|nYL{iHznPp!Hw7j$h`e|F zuoN%$HX36v-0A?i+tD05k^BRyD|mH*%2g0c>M}hXPlt8yDX6ksL+chh>Rq6|J06Mr zLS(wI83s(eS~z(%;IAeQHUbChW~>TQ7Zd%$X+}_jwZKO?I_H2EMGVj%iMlqWtf6bd zxN5!dDvO+HTWQ@esMfSh{lV%^?125Nr}rwL*4kE19i471D#LZa;g8wFF1%&vr6Sjz ztlaB*b=B%0)*v67VFaLev5x&m?gjNr)%j}NaCpnrPU)3I$mpPz4(})c_4S>>b^z)F z&?nmf)bq9RP`)=xX`nCP^Wh4@H?vG+KzSs-31#YJGzGV-{sN;(whQe_)eqL%o_RS#bDafhN$MpCCiI_aYGsmy*ltlB zcgHR9ZAKanuFICE#j^{?o%2)`n2pPwSf5++kaWRgk)-YI?j zQK+fnA#)-GBRrA6X=QR$1*?rHobzAa{&BytxZVXnd;PB7eWZwi@t1Fx@`DzI1R+^J z*HvS1VB3lhR-|!&<1@KvDgV^cp2V0`3HkO}cJ=oxAs$=%O>(DPxRTgporwvlHeg7M z#Mydw(Sh?_x45_L&y%m*woLaqV@yC*UZ`69=}}#iW-#TWx9KQs6{f@W5B~HE-PmiZ z8o<%-FpTCxfg62qLVX`&jy0I>qa4_ycI{6`=QOaUbv)J|e-Y zrg<=Cp$6uAZEIzT-emyy*C33BM|uCSqId=vgjhw5D{C|(7|W_dzT!%4*OI(s@i`fX z^07-kC0w=nHc!oJsS{!+&+Hc$#g%-*Ifyx#bsHJBW_&)U+R`?jY(ML;#UWdwUoSp7 z6I*HuKZd`Q5Q+@dZc4Z9QuMWTXEO2ivv!;vmSzcX^?t6>vp+i3ckS}px>BBbp64SK zZD*3J=1ALaN-xLQnYlp&cHdx*Z0CJ_5w2T@#eldZ1n)p+1+SMseN)zs> zFSIgdk~yhOjrMM&4UsuWVMz!I|AZli;UyqHTO=WqgRfHvv20~^I@H<+T3rN_I)2QuuM{b zRj5)@egkR7d6G#$^uZ6tGTaeIDRC%U)W1PDX$rtl%-QW#0!(!APn5{-%c^CjSe|Iyek}uV|3(=NeEVl_>t<&2(UchE8<^!nJcJOTf1k0k5shUq z4NTrsujuXjcDA)wbbr0hQHFg6mux(`Z@-O}*iaCIThHm)UG~(zAPD7G!Lt-o@1~y? zO(sLIZS;pGkKQ26N+B=-x)pcJcfWThpVGh2b;-8asI6pa|JL}q4%*gp_h)KCrnW$C zx9UWAC1JsukXKb?&J!LfnXB$n@MoT^?X81jkRNi#z}N&lp!xqTv?J)#WpQLu`bkH) zCYl-ek)f90&Eoo~><&^$60X7m9_DxZg+;1Nfo1>gef_L$0jgr6ND}sJ7{y=$l)_mn zZ-LmLV+6XZ6z=|DI)0%{WWe*(JCsh&Hq9sQ9u?2vs|d`c@wkKKyRehi0kCZr!^Ne| z83tFfVJW4ri?>p>b`$paYRxp)HpLH6NWaPQVtrTGcZ;;%|Gd^RY2-)hfyVajMp;Pc z%NslnY`_H$qC7u(X4GxZ9lm{5%Rsm^`GBKsw#cbtV^Ym?P0zjxX@01FuD(fjv)qHd zyOS$!;Qg5ycmgp~Fo&tz;0LK3ZVP~L_-Kki<&(?4r6-Yl=5QDs1B?W-{nu?&z&NFo zbm}ROp`CGOu)yqWl1F1IIUN2cOi_stj{4aWfeKg|s#J%=73EStIi;q*A%X{~SZ4S3 z)7%tPgmTt4sAa*Hyh78Q0v$FLhZ75z#9LT($6R9S*0dw}M7>Nd%6k=34I8hrXWkMy zJKku|{P3sq?~z=W9cVMkKH+(l5pNR}638@L#SH`vcLH6>=!X8X-VKiXP5vI`j>JIE`pjqO9A5JTa$}V@%4gEK0!NIyO`@D84s{lil zO%m#dgxhdJN4U+)ncDnZ-qgPzfyFMtxRKsJF%M-irdQo7QPe849X*X$R;{M2JRq>d z{IJ`Wb>JP=tO5mcPRt(UX+N}>JPE2^8$gv$-Dl@I>8dL2cRV*YB;>fSEsPYl4r+^& zGedFfz!%_$oYz100>(E>aSP2Sh!)OKUX%>(o6K?KIyuxyHkBgfy~GJh1QI&fgN z_l4@DF^R&k1`SZ!?J^QcJIxa^4+;07tyqDpHXbEg$;(7O4+L2dwLjmV9ccp2xr=MJ zoqwp|UYhQ0%(7x|^wEHP0!{WCDB+H{|5_f6eL0vT2YTiJ?(Yi++CKsVBBTI%1_RFD zS4|hfyyT#j#waN<&`fb0^*|o2AQa_vON;*F00Q(kT{Ml21oUo&3Irhj6hOSuY>36z z@^g|zK{ASNzart~*A6@PE@o70z(a)(xi-Bk7J>Ba=mw6(FQq1jTsjy+31dY zVclV?(#*QcG$M+NtQ##vp83p}VE{@2+im$cv1eRgB!04zQq6`SY%m@Y7>QcsZsV-n zIpG{fXkL`kYmE`+`##mjkA;Km4O)aM+O+&6bs&Dx@p~b#=rH&=|-$ei1t zvOh)ti2WJ6_|My#+<6(AZ*W@)F3|PQ6`6aeZAuYJV#RQ*y`uPciyimYbR-CIG;zT$ zq378ku$7!j47Qz8H~Kmn6sPNB6H{2;AFT>?SGB4mbJOf(YfR3vm$>n=v7}5Q<;s0e z$HpHzn@>yJ&U$ee^!%%Dfx91h?3rW=SJDd*E+{UVk%GU;y{5;wvAr1boMRc&lkjVd(8Z5TApS@Qdfyk2R3YPi-B;R=$OV~VnS&#s@c;6al$bAu+2pn?(tJ(;X zNHYO6ew0M~UR`zA0l$n^-hUJ+6!}Osr>PNcaD1+kH&7Yl-=q+5F>nlVJ6lYE zk~>~}`ARmJL@)|WeE0zx5%Q31U~Jv;vw-*^?!R{2;MBV_Zgom37{ zr4~_Fz~yu2cE1Y+JP#$pyHTS@3-%+R6_~OQ_V-oUmj|035E{u(Ji?PYpEBHzRZ}M} zZLIpqezaf4c(VOO=iZxw_H0)~{T7e|qRl}-W%ytmS42eSkQIbvceK=43f1{CTI0{O zSq%&lK|E4U1{xj2&}I04sShXyz9MR8yYdH6pZFi@B>~hY0;nfb?1s)lm{$e941Dw1 zI5(pAJDR7=r)eVf+r5wceeTzt;~og6*p`;d^N!PVO#SXpL#|U*{~i$3@-?3rCgT$Q z+X6fcUvj71#TUcJ-W9{g-)sRA(_{hC{lB0Hh7S@L^qk1}A$FX`@Kn5sXbJ=IyF13% z0qx_CaRty^q4>X1tw60H+SmO}%|FS5N9Ce5r)0~W#RI^s>jtZgU%VxSU0V}*k5VH` z&iBb3pXO{GlO8x|9^muOZlr#T^AjRlMT+6J&SLw>4_UY>D!q4VA%IPtUn6P_oj#CLO6v22KIN?K~=;1 zkd`CYm-}6IGnI=|iZbp!1X<+N-I{yHUoCt%6u*y zck1?b_A1gxsXid;FOOcXfC8JEHbHr+c-twfc>Dhg5;blHQQwQEKTp$3Q?}@eL<{>A zjOVG|Ghv(YI4xlVu<`$0me9@c0BkF>7G;AJ3!RyvGH#f*4i~=k zU*eZY;{dj-F?O|RKt9~OV(mgZXJ^)@ccb<@48N$i% z?oW+xsub6vGr}@dms?;}SE>1MGP#^~gUQlD%<_Gq3Br3Uz~SKtDaTbV8%d2nUzS7< z5+70lnMaJFGw4p>=dFO{#(xW`Sl#$ezgj86^f_eB7KRA@THJEM-`c-D#8g>9NR_FG zpDlX`Wsf3mj~qeTFNp^%cL)WAB93J2fvg5ibJ%RGs7p>8R}}m*cvb*a#BqE*?&hDw z@z>DoPK6|k-QOfbkUF?qV*<>k-V~;5Z~mxq8iFNa?!kqZG{auoY>7P3<{|<1Lo(enOA!+SA@N1CWBk2a+3P-w=&JA_a zprVu;kTHCtk}4-)1>5{Qqdd7|2Ix+&P~4f>lQ1x|-@+i-geW@0h|u=F68?ZuAR)?| zuikQofhN8gZ6s;ApUz1&T1g(639B@y+s6^mS=irgORx!;pRApYKNzrW%}@^ZQ}G{q zDb3tjL9n`e&h#t9Tx2g0kI%=eLo~ml=Pl>o>Kkc8y)f?k@eU5)oJk%zbG-AenHrMPJXW$m8$nEw=>Kt=)4% z+D02qt(#|_k2BjMRN(W!2AcM(do)M$R!JoSKg|+wytQ!-7)qI)ovt1mx+6QgkRF$5 zDmSSKm0f=;H0=A;q=!t)m&b{kJ(CS>e=1{->_pz5!3;c`4Gnb~EwR*GYcw#~9txud zz0WkKsSEL0JbRa0>U={$U|tFblL|HlqY=Ea}I+&Mu)l53uIo!Mc*sgeFz= zPomnk>T{))Ffdcg$VWC-+(U~Oi7p z$uvIeXz!3(o4Z(8%Mmh_?WrE+w9Zr=8Wo!%J7YMia9hUFPfg0FFU#vLeLJOjAQU{} z(j7`?VcJz@%3h<&v3GYQmT{`T2F0^CnK3vMd88GG710{k5sffT1pDtP12HT_6Tmd_ zO7SMj2P=60x^lM;0$0$rvR4IY1Y_cfDZ&S&qEnofWhg;Zzms*k9lhfwyD9hd&n~%b z#d05HvALYM^S8`hjg%2>8Z9-Hq}SZBa0539VQNpcZ=z}w`OPm3O|dlwYari}NZ)={ z7$zpqh+yG|%31n9Cg>8j7L3&|Ih9546+hIQ{xWc@^MmmP34f<*_bO@} z%@3AsGo?&ty;2!mvsr2biZ?siEYO)dvVGeA{J7HgAlaI^N($N6wutLHxee)NwF5TI z)ay+l_pw{}dWyxo`cirrS@pXtHFyj#*wKM9Qtr`K80O2OU;*UD)-msbtBo*?j(7?h ze%jBHP>Uv;@<|_Ym>@q{rOuG~hZ**VQw0B;ug7W_0+y%jW|I$Baz|^Z z7$7rJhKVI%V@(&ZzNd6Cq@$#Os1biPSZJmS=dR0Ds+&x0Wrt!t6=#|72hdh(_6t52fWL-HsthUQq(OM#l*KiNxO+3W_yN!Nf zLmX%T`e!2*VcU%91EK%EFQzAGY|kYELwy78!^Qy4WW<@c??vs+J43p~akTrL%0isb z=9!T7bjAR?7sm@CEfVJ~?jh8&>KQlt$bc?;Da4A64tr0h;Li?Kf|AeT~wy0+3zVPOq}E~RV~&YL$vzb&pk<7N4ia5r+EEF-pD=Rb6?^o8k~Be8B7 z=$yMI|1rH?^qv#um{ZMkcKHT1#-qfkzcM11={>aWmUY+2hN(>dD%!3IXr!jQO(b^7 z?Q>W3v61BeH&NdjK@*dovnuJ zHNu_ivN56#B+%+nVaNUZXU+9eh#;)I;Xy!Q2GY}5LDlK}QOyPXFK6k-0Nfrc@YOSa zIQ=J|OVuQp;9Yy$k_Q95aen#}ugTV-+uoYwF6rG0B6%ZKX_;LZy&iYAZ{v<~k2S%z zlsj8yDH?tJK$pW$c9XzUZJQXY(|#0Gz*K z5%3h~gsqe9EJ7oIv@l|TUknaB!i-(|={itz3{EDiyEmw}n@oYpgNppQg(aMxKP1+P|_l?NYhu zmeWvjXQp8tO!eH6ndyf!JcwtfVWCZP_dQVT`BODg#c8FeXWg|@X{Uo2BoaxWjNF_V z09b$N%(v;EhOL{K2GAMC*2oP9Zc_|0_{kHK9!7%8_)d}2ZpnjYzPri|{rzdNocVMD zeo?~n_P3ilR%xn}8P`m+kuLMjRPSKH?LL3#?YBz<>y z5auCXH`3XD2pA-N1?e?K!(3!#r3TqCe1^E@F|NbL=v9)p0f@ymzpxn}*H<2aLW)3P2wp1VJAMF-5aORvzG~Ed8ltnw ztmMb|4NKswe7XjkdIq@s4&=z|g&!2Qaq{mDO-#UdQ!st5&^suTol%21u|8&#ekXd|8ZGhtUJKB%=o5%n-uaj94hq101pU9N{n+ z;-vCZoqaY|K5loxYL5ye6+df% zfzP8Q5#%}-(Q0(GNgNl7H;;J)HxIX`^Q-&oCLZpXYrC6Jtv~8Ch;285TT=7FR|kHH zS>kt>)|RT_%2k6=<*LMTH82jAsuBuS#R(WI3e9u$LGhvqc@5PPMi|Bp@yCiRG$h0E z!xgH3weZ$Tpa!N+wx$s6lgL+b6Y8BLRQcIuQ!my4b7YZ8HoL}Sm2+EM;nCSTiEtd? zxGk!cHCXW8!S`>B^SX|c{Y;Qv(#Sy^ZLcA|$l`V$6EuvBfpN#?f5}3$h&eAT@rg`_`r`DJW zMebfG=2t(t#gEN6pq%;7zWLeF%#)|UZozWG=>(wpjp$Y+ zv*r*?#!aE@1&qV!)_8;FZ^U^fA-9@LS)#PmB)5sD;8jCJ(^j(~H(f6s#IxqY|GH!M zDA){}gI3I&lp*}jCP^a-$DL^D>2x1qfPaMff5`=u0hDOHdtr)!$!m zX6uG1hl$8dgMm6!OQLso@rmo6_B5fJHjhaRCV1U=Gp+Y=Ht|?@-IfH@TQWmLXgeZS zTt(g%LmR1uZ8!%MzMHe_f*3oe#1(E%r2&IApfSQ<*!4Fp4i>53s(n-O&L!I2;32O%>qi-WHsj_hE^IV}}$Me$WDJ$mQ9*FEQI32Tq^g;hvvC;_sV+O>?4@xO- z&J}jfv@3*T>w9`;8-Lq)Q%-0Xiayn{a#0O2D*ZU?}fvVOj#9?PlKcia#iP%J=X!Q z9&_OYVA1p+I(IaTpCHzv@|S~Gf%2Ow@>XHZ9f=&)NK{eFM>g6g(F{O+lr<|x$Ah_eol(%_ zCa|`Krg8;oOs=OT^VGyk+wREbjgtIV5z+cOh(iEk53Q=_?( zyFh)#PEwxD)1h_WohqcDgr&=nqV7QCbnHbktzpakUaxpJ$Wo`PNtey}U4@Z=EymO4 zLj7mLu*PABz#f>{((Nd7>>e2A!fmzDS{6{*L5wJZGWVHeD%5Nx&jYdO5Ar=Qo*#T^ zUm0R11S#QW_+YU% z_oH54fEvX%SZIpD%{@Qwmxo|91j|<7lT7s)=J|L60+FuE#0K9Z#H;+lwc|_2Ua)Y^ zg!}Q?vH_5Jm_Q&JhB9u*VAtwq8|B*PS&}B|X7?Y=q`#63q{SyE$YO>0u+eH9d6_huin($D(##VEl~@T^-(ldhi(u*KV*GcDE^eO z?DeguL`D|CMoCTAEMu)<_j`3xeSR-dxc;mPwva#$SW2CQSOY4@+okWobIp-U`D2eqI2ru{75)@-N*b^Cp}xplJJ$Zl6@iyI6xwda>*_9AeqmkNe5qS z|DFJPIH0}S&NjXOS-bi;$!v!u4w`PPmd`A8H|<5Ci{#(ORh6-iy6~FceARulTTu8r z_1g=u(!)#Ma_kqMELo?Nb@~MA?D4blOkL7H4?yUcx@tPfS&;mGbrVEV^XTGWjnBMh zO-6Yw4(nTd@=5l;p;l|;Jg{Rs7fE~G%HAXrg89C=N!G*`!UhPmn9sy@+~K_WOq!{_ ztHMN_FT(W&v+&bz=dYTZuaD?^ zzMQvUmrEm4R(41a&JQqE<<_<71BOr58@G>#hq>xkr7xY&UX{82;_2i4H|*C8s%#W%0r3!f&wshQ)Z}#@iqhsb zTMtf1?=89eHuRm@N*D&ILKZ}m2cgQ)#5hVANGL;^DB%MmA!T|ekGJ5t%uWOqnmDKf zyZ2L|I=bGSf|X$u|IPh%??5CE{@hF!0_=vpJCruVTUSD%2N7AE_nxGZK0fFk2j69L zB~E(0fCS!lx-l&W0wNB5vyhqJ#V)UY)RpGFeQLgF_p(pU6~Tm3`?ZMeIru&GDu$bG z^YF6c<~X)5QJwD%ixo6AZ;sTQSu>Zv!S-^PDc9b7{2ofJ^7K2p6*?30OWr5vH)GPy zMN~GkT@co2DRm2fAgKT}krPX(ff_kkvFXzc;^Lr4!mHH#L;kb!ZOFa^rBkpf8h49jHQV)TMN@*MaqKc@+4H5nixk56G?f>39aOB z2Kw~y0mP(ZY?^ze`ucK5{wSe@&}-9bWVsrVe~pd6IZ(hSY%IS4R@>bRljS$o>`tHT z*0iH&0x8M0yIWlSx@LAEt!zjAtu%ICgwBQxg^#&iP`CtH|EUKpWq4u*=x?jmm&&^J zGI}@&OWH(#+BUNjLB7gv3BD~#BzY`yPBx4PT1Gg!Y+*<~))r#G@mWRKJy>pO4XY?B z#3W88s_yj<{1jBCq*epIs2>0c<8~T4dC^5JYT}GXo(+hm zI}{M(fMgm3j0OU#y%SOl$u%;DMjC zv|<3{_4UzKmltyeE>s2m2NY7SY-zMTlZi8O2Gig~GO}E0G!)afxWjI^rT7RH6%?qC zU=u^+MzYh6yvRnRgf1})#S7GK3UZ=gic>G@=7i+RLWj?OZ7OP zDu0mDs!+leGYLFyPbQ(2)xpU?Wfz zlwz33Xr$TsSO;Ju;Y5^?Lc@xhCDoOn1BKO;SoA~bCcb!Qq6u#fKOLie04c-%XjC-C ze`-Y-5TPO$TA(A72MNJWlUh0gUW5V6(%G}T0RvWQnxRf%Ar@?l5*Hkjf2_xL2T>;Dr~ zJM*Uq;6NScRL{VB4BMmJ`v%{J4H6U#_v^JBBH~(rO;(wxzt*rJ88a)tk?C;m5Yayb zO-idmZe}#1fcaVwbi2iqwFYHc>PA-K%Ei^)i!UaWd|Q{Rhf!nGi=kd%^Tl}9vbN#7 zMjbZ6(FH`Fws4=y6%rU#Cu>>h)?Y=9JiF9G>pEhygm4JJ>RMZLy4YN5ekgmX$6&*G z09}q|dk~wk`LMA;mb|vxXdU#VVVs*ctN(8CA*8gf!@cda1o@ET8SjCSP&p@f#l0~D zR#k?Z5T{tKsIzCR@3HHC+Oh%ln01Rcc;2pF#vP71TqgAzcIM4e;K+53KEgzX0pyNj zkAesP69Sx;U&5|~RTEP%kP{(3@=dMhs0yT&6HO`Z#T|1HBL3?;;}Igk6j`Cd0DR~0 zBMK|0BaRJ}xPFJqoII1Hc{bV+1r}snc#}*>8*V%|I9Q)A)x3q+g~ZD#X0QObEp6PS zEz>sbF8LGC77TV{;SK5Gi)H0N!)@kAqU92J1q(l|zH-pkniktucNS7v3ik~8Ue%tw ztG;zPp*C;a);QUs`>y0)Z~W zcvn#1w!s})EQ-u06Fq(~y=*NWE;kI|33A3o7<|>2N7=*32W+Fn-d1t1!aBbxtyfsj znj9}z5tHn2Oq>Jx)kE^|aujC>^byBx*>l|wX;dYRUMyZt#a_^o6B{rGP?fYhnEyDn zxXT7UQwP6v%Ni}#>OCNfwrlvIj-%&!6WJ$6&y_~SP~aCBdn4;k1FF%B(K!_yX}PkO z=9u_p%%H25n2Z($sx|10^bbwQW`-m(!sL>p9Xhf8PE<19{K%oz(gN}-x^;?V3ttZA!hK|_sH0_Fr zJnpvhJiT!28h+J&_7}KB-J2Ha7qA=xQfKecjnri=DB~2=Z;AmmxvHERbN|mC_e(D&<|0ot^r;g{jx5RU+!Bqj){E)9Z11 zekXC=e96vxww{%bcJe)p;^1eTeTi_Gm6x&iouq~SO$O+#b|?U%rPN4^!I%Z^ffA-k zemIHm7wa&K_;+RmaP55$t(<%TbtCz@|35367Q^l)Wd#yqIVG(|&VF|VHA~8?FRlhH zl!JR%f!ma>-g<55Y?b_K{N zwlwfGmo?=jjW;^Jo?ZG`9~-f#?7MOTn@goeU7>=72xLaKlbF-Tg-{yeNEg=5>=CN8Vci=#wrke$+xqbvq_W{MGR9O7h;sz5C3x)t^lGs z?Rm2rQ;Il5Aq}pNB8>3rKni}f?kjJ`F1AxR5%-+VT;btoO>pdvt12}_`?}O`@W`L& zGX&Y<+InkMjZV!}rmuco1CiTb;YM{G-&za*w0F0Do?h7w9D>{?wnM1x|0H)?(u{g^ zcX{9R`nbFw!Ud{qQ!sVedVeU)b_0X=+Nn9(~6t1&QW=IKD#9pfZ%*>@s1>k|giseODtpMTpV_ z(4j~Dtxv0xEE6bdL88|wzc4jU-jNWSPg9ZPFgKp%E+_wh3yM4m<0x4EDe_29V*YhP zJNF4?Z4z}st+Zi9keIR*c+q0htPhHQlT97Jz{Y>JiY}R?Jbcaki0t;!A`#W$LgEi- zE&nV?={J94wM?&XPyUYh>B$^o5kWr${CY__s z>d>SzbF5K;Fun3w%R&F@(mc@pInS&8guoM${XZw9B{rh>sUS3Ws($;<3Gp)X9@nj* z0R$9Jj_GvbkG1&Ux&F=d3B3Cjho_4!4#BJPPy+=ts4!GyF#{`To|(a8cO?(JPrC=h zTQHr(i8-y=YNPU{lwA9_#df7rpBxz<_9^l~&mT8pys0=xZT*~6&(8|xG>mQfF3fXc@1h8LYJzZk++anzIKDG0pHNw z&idwWvbKyk-H#okh7~zgvfs~1PT3uvfWDWMg;ToU4?#|eBrI^}`GaB0itLLr6($vmF*xo@HU&+Q)k z7d(f~gIjEcu=Y1Eq^CH~r;t$o|(-=8xsX+A6Lrz2SWMH z)o;(YJvn$6QXr@KpOyAb2U?i@qej6?j{kmC^N3K>qo1VYM zIyJpoGx}!UTUpcb{n_AvGI;dbO?)#d)nc>R+=#JLXQih&_Q%BWHm8e1nveuoht`W* zxm_YdUFCtFTc8F<(B0e>tDb*N=A`XnH_pT9cmy?cU{jmx%~w|^>>q48q6&*LdSdRv z4+)>%%NFn({2lpFKsx^(^-yhCR2si}{n_4pJ?_2WvVgq}ByG9}9*5p{9(xAE0 zVHV@ntm!2(=zDS7nAR+kd?CQy<}oQF_g5cfHBGFlbcy+^=5GvofsdkO*K~zbn%Y(O zK4jUQx_sT{%@)ijKmE^H-m1@b+&2?s_4n7YHx4L|#-iT$q^lAJAF~bejdIyd)>=D;zV539ycSn!-)f1hv5^(i!keP+F7iJ}@w5hz zT$)Ltxqpj={fuOmtmGWix-3OY3@S3#QiHClNnD{zTiA*27!ik+XBYlgE0_dtP;$0w zKrN0FJ{lVqpLZPPFCHY4GcJZwVAKp;-TjPe@v&|0U|7_v@OEs}(Ppir{)% zC$n+zV0S)yZ-`)e?KHjV@%&4N(DAKjT&4HC@4BUSHw1IGrdC69gX(mKGxW{^P>Yu3 zo2=X4E$#TI76=>#`l>+ySQEa6D$=L4R4MsseI~UCuW2UwXliZTxsD(#4F1*ndS5`_ zXxiA{B9%S*k-7^tSWZY!2Vd_ru5T($ zU$M5U#l9bW2A>R;12_T_gKW2R!^qq>_($5ajPeyN+CqFFRQem&!DK5f^PMwP&-h0w zwVTYIgqaYfH@}*!7uIBIiUYX|jWGB*QybEghxX*0?zC;;9m(74)euMa-yPk%b(`UA0vZ{wy1sX z%ik56AdeMjZyx?Z`lM&ubc1Hn6=o9U!OWlfL&7lR5yc*4EhJg7$yaSNE0Ol0kOlEOvUZm(!mrpKG90rou_#mEK`u>{FhauE} zqDl3k;3BREwG8otN3qmH&TvqIR>lotsc|=kQmd|-z4%>*D)MMm1~=yoXGCXbXo3wF zbD`gLi%cXAITzJ(t^tGvb9M-bvaS(VKi)&~AYvR$uwfYl;;=w-NH?=!u8(SW__&^n8fKEvRM=lRtRBJkt6%(7 z_#cnoglxf*Jp}u>nPyC(?2|LE9un|T>^;T!b+>Bg~X1st+#IE+61*>pX&%=yW{|G?ScCT!k?+7 zUn)zZYxeya)d$%`ueas2pg?*t8l~)%;`6)qO*RoiuCRxIlq<(Z;oDlO!seO7t^Wfp zI1V|ob)he=1O(>P)m>7S9JGuhw(qM@%(^EWaLT`zO|WQi;CJn~af+`w8PS3iAO~e6jpnxtJtU*Ew|5wzs`F?S zZBXF9)!1~Xw!{dq26xD`pOL@+(hV|kj_PBig$Te{s|u1-%g;kT#X(VH;)c(Oqb=r5 zxX*Ct66n={?UJR@yE9vTEmXKWmC&-N_E8cf@a-lHD1b2a^l+nxX;(tV@~RZb6i(U3 zXxJx((+X4>M#~aTLBU`ah^}ND`-z2_KUGi$r=?`hmI%MabAN0 zesvXtS$fCGworR1E8H#>Wn>t=*D+?-S&O;+RjNXNpW8+G_9&bBz7Y_Q##pZ!AR-)% zUm`4iUFRUDBaK<|BiLRtKlJ;jqOsC#`+MghLwiQ4v)HO`RgF+dWE~ZInxbAHk%k&1 z;y%0i$At;F9Ni~mG}y~fDdzh2!z6JBd`j6}8OU3aaiw&K$vwdfM{ln7bTwXxV4}G` zYl#8Dx@I!GX6mytesH`O#KfejF1ZCu4O*5H(CxQMI}WM^0!M*P1BIP5AB<*JP_V^D zWW988?phHheoAj@oV0OCHR0ygoLnQ)9Y0E+T@Ft5|I?7S{lIP_SpmMSWcl4V-{pUlTJvXPxnGBa6oTo8(|of3f$)N#A(MgOU{HDU;9 zL9(O_i1in6!)s!h29i5v6&sP##5-~Tr;z=N41(O-6u`(p0gMdb)C=f`9^d!i5B(H! zA)xa5IbC}JO2~o?hI`BXgYHvPv-p9A15#podxy@+w`UENpz+bQG zPBQKF{|J6IhMstdm)phX%ajRf7rJRVyXxc3HU4ZUTl?kb@$-Dg6;g>5cHFw!Mup0; zXoV_t-q&)~$|vKH)fU>Mt)XPWO07c8sfP(dZpy(vDQn{AHwA9-xhM~LpuU8hQ_kG~ z)0YTrm9_{B@g$yMt@sX9_L`_Ds-k&e$SKXo15QEzzdM=HR7%B~XEfwHONB z(yMp^5F_9=5=Sp1!xGnFVq=0!pxz;(=U_ z0PT2i!68y;%#o=|nrKq2{Q^U!ZxGSYw;59(%M5!3;iCJKBeG63X#cl9bPxi?_*om3 z`2YCxq+KZ#5UGK^Y{Ld zgo;Vz+H9E`JXfH91Y7typs1=04MXKG6d+w0{lIH~P5y)lk>A%Kofx~Ci^zG_z$Ebe zmcq!Ubjl=%bSin_4zfT?7bkpyg;-Q%F=wfqC7!4+S}5i8O)e5R3KZ|NFjET_8z%)e zei2}y5Q<`f$%iP}mI?vp= zKDKEY?EA&DC|zgzTgm&F#?7v8kg3exQDb^I8d@eFM8eY{Kh2ZN*$1rqa{K`Y*)0NG zOj^)$vw_IY@4tCEOQbbZEb~jo%SjDcFNxDjjtgfWV;e(wZ3WfKyk)1}b%o+=gqly3 ztMlKcOF`|L5caNgFB+e~VMLm*5=Qp5QqXGjv(<{HsshTT<^6T|esTT4p$oP0r?nB{ z3OqRi{F()<2vSc%Ni!IO7jxoK4FE^IP`4}sZ~)c1)?i^jvpB{aY!Y}6RBSap3eQWV z-=&;*F#oRG70AniCrvAY|6!KM*XzKj_5?$UBKk2fxV{Guo;4CeCM-k>*pfZhNKZhn zYM@~(PV|9eDUjZieq`8EbTJ!Y!1PZ z%EU!(Y&9GBzdWBzRKG{zPdF=g#w4 zzn-gzvlA;9FTR~rN*Smw*HOzEBMo>l81#*FF;Rkr@!nz)i|?mbW!&4U%S8gLXQMRP zs3$9=oYdu{>#X4>J>v(d?*Nk8ah=1ODPfqjckSb}Jygm?ZBD?+|0)N>j{$0l`k87X z)V#6F7(u@T&t;Zb=eN;oK1?% z;o2dV`qf#9oU58$sl}Q1oCF=axv2=i0)(e1`-?2ljg_-dfc76QW{2^O&}H$Ts7cY?X}L-aP?z)(n)2<1`* zx0fv)Hc{GBRZe3bn)C)1{vH8#-^eLx?ZMx-BPsqKH%awftCl(|h9#3IkT;dpH$t0U zSFgKSeY4kloHKXL)MCXi34M72i=6k1JU)WGaSI0(J>Ga!)T`J=d}TxrtM4C#)LT-Y zys?J&EB!ebl#fN&sNTw1%Za=FIZ4Ei`+mygp4#=Y*O6icaGLt6$*dxYt4C%i&|;T^ zmj8eC(L!K-^!`8f(H*B~3aBrldOOyGshEjW6tCgLKY}lf6p8^Lh8bNR9~7$WUTt2@ z?jkT;#K~d;ad(oHj(J*Yi};-1?c3#L1Xh!u_a*}qS=HTlwJb&}v;V~PVr9(0ZL8qz z?`|C>lNySiKj7eG%Z*Dp8OwX2GEojha8b*TOTik;qdb4om6_A!-e}`Rizyb-RsPiu z_M{{XL(Bn-z^zaa zWZy?v+KZjU4EUNS_=B_v$l3(yg{3x$pUa34&5;4wAvIK@xXSUw4Xu)lWX&{#tPROr zN!<;`_?IccFcTLQEm0KxN3v~LDvB$R7`u6t%jp75=n|`04FZlL_y>Ayh(2OPH_3d` zM)*Tq7rZY@f8zUs&}|(fJpr*BP@O}EdFLfT1~xS zLGo|f8^m{OiqtxX^*$oP=D+(nK$5O~d5>S`oMrhfe7+V^QY)(ChKkr&3c1G8#ZuJ4 zZA^7SNt|9x5>G90T|Ld?pvv_PpfuytvDKjYL)6{CZ%7$?%C;{tM@|8EigR!=>X;gs zM(H?tjs7Q%$}(4qPs$nq8(qUNn`j`7)l45!%7V`cg>_cxKcW7=C-9hhHoR$-2Aeq* zpoP{wG!DGexZRGrLKsuCsRBmPTLSiIiUn7d`{bfCXO~d|*sH6CRnGwtqXaslFO%&* zbkTI;p7+93u!>uUVj7kSW$gx)7;4`_o;tU{E~*!L&agXvpELxBm*IGC4R~FM<5}}b zM7N#Wat{G>qis{{87^RMw5=Hr?l?#aO@!oJ0AMr{F5-%+C^GfLbjG4U{T-Ert=n1~ zge!maPgx9%6P#PZ&5j!y$jjZ%YQ*{G2*XCUoz)!jJwSwt6O5C_)-oaSYSXipq_uVR zJb&!0qxbh~jP;IPU+U`hFPA7xP5ojU9im~ik&}!X7&;=hGHXQoC0&$`)yiVs6SoCH zXJ#@uowwiK3KPu+Q}Qj?ELt1Q=?GNc9yZl3{z4B0ZqL7DD>VTAM>h9Ifr}~U|A^>{ zoxmjYPu)hFN&VGQHBauRHqe$Z(=(3%N;z&L{WRw+{x9)Qc|FO&Kg^0 zk#;1ZaJtg8iE#9a%tR{AHNo+QYAp(K!$i<)+=3PDnxms|J)3S_TH_D=48ncDw2dpi zA20=Bb1$IuIhNDT3G1pv@`$mjvAa5e%lx1Eveu;aM$W&eJmz;bY5F*iG5NZ>D2 zf@X5{%)+q4eP=eofma0}E)H=%%5Dw%ZYa%eSua&hq4s#7b?|!`?4yG4s|>m_gtGmZ zm8peC>N3hK-)gP)qoZYA>d)@l=-bi9hul}~!L7bp_=_=q^zBy5=G&3PP0_2022ESP zy6MF#)VfDct-H>o3sI0%OLt$x413FMz8zO zL5HPFxa27QgBbyUe2T)}l+)>ZM|f-ePJavnrM)SH(|1{)o^hWDHx_169|a{K|acLVZ;k5@8>;&>OZ7 zG=|XuzQss4Q~I1eX-M<-Kt&b9Ko<~oe|OEF9DUn#=gSx#q5heJ zpchEP2~@+SKst>VP{C@VI`)cU43VT_Uo*N$kTYj-{MT9;p*thaS36;WYyCqum;;jr zTq~o(S}$r{5e`ladyy(c3oSiJ@dYB3TWq7XS|!h>e8)^T>%=!u$%?m#ciirK>2q>S z;Z~H$I2f>!bn0G?YPai0ygaD&kdEf33Gw4bi>8Rj#W!EcK}Asne$6gK8F$(GUTJm5 zAT}fjiGo^o-i}sy&4lleeJ(o>V=*JD>f|;AVbC9qs*o_P<(2Kwe@>{l@Pn7_^JO9r z&5vVF3aU45zn+gi*1mpqWsG0@LER4<4(SPM5~*thxbZZ{vAx#r3*_!NWNy4df?8Kt zAj8dDBnmNSAtdODLX9{wONIhRfe2{xozj5?#y7TD^;AeQ6j$QFb}uwCVDXDg5}iey zxDfx6c}3)5;+3WmVxV~o%0=^`mch~&CEhm@-~<19Ph@PTTfET=cvHN_!1jXUg2_tV zQaD~oIRh#fok@q1i8*b3&fmE`bVgZ5HaPoh z<%Ge`xI7=)k)=dck2E^aFa)+uo|T{efYjy_G+mUv5%T4xO3Gn3`^fA^12;J}!)D6Q zrBkVlsf~_Wy$^}>8a?U6Y54>_0QlC$XL+2zrL_z{uSenfX+L>L%UlDW2$+Ee0*pT7 zhkNVk$S;`JoV6Zup3KAe9oFCHq!|*SbG*!1hw-SazsWKqSmB8Yn31)T$e6||(;Jh| zxFZwG($u)nWQME=|1a9eO}h);0R_45fTGo61{IK_R>v}yBoq5{Zh~gw%GTTM@GY;D zo;BdX9ZZU5aVzcEF1+H~FL6QF(IGs~ADPS$LkV7Gl-oLh!0B=OHPtue)Tm=iTg7&B zm2R9fEa_Y+1pCosIOP*Ey>a6TUE0>pQeuLRt9#B|m>=18(B= zGH-;adEsRGHSaQAf>4=KSRob6z3H$e>cXdue_T3hy(0+7=EFf8^V(cJ9KGdUZ3cYg z{dlSn{yRMZ-SgppRZJ50p2M#=*Ac|q!xssAQRraJ{jsZ|x7mEt{CK881#ux$f(LlB z&OO-iev3K9%(LtPkvfDdj0U!W`a~zI>Kl>`O}tol@3HpmQ2D@C{ho|{^`PMX6vd&} zfcj^b#NxnF(+2D~M3ZC7;dhgL%^Dl;PlpNb0M{$f#WG){PeuFDBLXy8(j0hvovFjW z(WUq%XJWcImCGU3oY>|-d=a3cuo12z3sUP4P+$zAX{x&Hw%`$~6Fp-e@Zzs#Z%JS3r8jjh@Gz3X zrOKFho@;B&-4v*(PoPnr^=x{)vX`^O67LO;tbGaAT+M|Cb7STS-aE*@t120%e-Tn+(eden{)_I$e!TD1y+&jqHrjI=})iY;E3ja9a0}RtcB8O zpdbuZvFE@o=?|^6;9k1eNHT`?i(=+1r+?TLoZef|J+dD5Js^D>p|`Al2qpR(Jclf$ zS9Yr*eis#F&@KcVUbF8WhmxGHj>=LB`tLH_9(>04cE_l)d{egZ3JYs%hAiJ_Da_7U z&_i$>=7sXSyou8`1*>^-Y_%XT`(-~KEBBGFC(PI16~dp@o$6Ygsj1lytSMH2|fU+-z*si2y56QW5`nU>Qe{0@JZzI*t|NNkJHe3Q`bw}gauu}!n z89Hhc1yog#9#sS?i%2MpDcue@Jt6=3A2-Bd+LxvgTA=?~7K`SK)Wc?0m)C7E zBB|W{q)LmIQ8F|KVyvUBcPzftI*%nK*hX%x*b8dScg0zZN4;aT5>Fxd=*9NX=N&gM zV=>&hwf&284zFDBylClJC1o&tZOF2(fynDz>Nn%p`3JTlRZM!z^wJf2a@FC~C10Cv zt9HYeWkEYAh^5I3gM?f;w-KiX89&q&@}ZF*T=H%sunjVp;@beA#{FEh*xyuktpqYU z#E-gYbEgFHONaq{%8q{w``#wd74jbTl@K7`cqzPI!U>2+AB#BS4>X^bq6zcS7*JTH zzRjpiU<;+j4f2At2l;N^25cS_F((4?SJ$OwQ*cK$Li!tSv7w0Psgq3dg}y;xJ{12U z6n?ODb(@=savk}jT8w2rZ4$kYAW;_6N4uf4MaHIwx0-UYgMO!TQ}XcgC9y|gB92~# z{VPM2ibb_WHnm?`%n8)ePc4R*m8w*Hi>`g_dVS}thlIVV)GWiUe$uI3(kLzc5^5lj zyn$5GCk4VNzJzJ&W1awM#A)%rpeBw4b^5n90DWL5h2CTwZwy_A{r0TZ%RR2GBs42c zEfpupNgVd>d5*r)LmiEEG2fz74{shly8GV>oASI;tvk04qqv7|i>NZr5|W`&Ya&9B zhS_C2G%eYu4-KK^X$tQH-YC;0R?rVts`_MQs^P4UrC z%Wb~zIqvi<{)Xhorq%{9BVk^`^~~HaD+syx7SH?GOg_$8JBfP;xmkwK7(xfoe&gxa zAK_w<$XfafOk>7M>SoE?8!r9D7I@tmeHTG`Rl!(5AYSb>;4= z?ys>L8H%uX3e8j`@^TxomO!CsIQ^fuKRc5wy0((I^`uDO<&Youo|GcEtjY<+Ji@63 zGWnDC?(^SCUln8L!kn}ClhE(;wNR&|b7XkdYQeCIjYcBNMzu)kZ;aKC{1i#BIOK`` z3z9Gh{;KGQ=4;9Ib?`|!HJHw)#-*ml`u1k9ELg*7u^Rv|jOBSL9Xeqgtd~n=h_m<|#0Q{Fe zf3d*re4ch;D$-^R!v|jHCT~^ogkUwnK7{LW#|RYHqQ{1~Lm$8~L5lGNJ*`~np?^m} zOboE~;~dqw^5^h2yE-L=`7Jj`1HW;MW1COAYb9bMBBr>bjCV}#a1f=l%o5VW$?vcQ zsh7DLt85BkKG|%W!_>*&Q!MMp9z`{zCHf*pSAcJUdcYY)MX4z&l`$_x_-2bmF|91V zPnT(SD~%S)I}*fv6p<;Gv`0t!ui5}?6ODR6Ssy+*U?a>GyEHHOz}aE+n&8H~Z)hW> z(xu`A;0DY60T{eo0x zT6HE@-?rlKgh$sY!NNDqO%LP(quJwBaW*1Gx+qtbwAsHDtYzGGR+XvVQ@Z49yXo&= zWD2)9_t|ngz_tepeyAaoL)5%n@;f82aKB-U1;8B~QL)IQBH=!1@3qiMTv1hBu|k{h zULE273%`1dr|5B;NX2_3Oq7ow#&5lidfZW@0}s5T9)HJ3A3fY70yHU%JFFUQ{Ay}! zj>fM&tZbqQf|7y(K{kAEGfLo|`uh4KfeRF6w-;|tSF)m{HmKTji4!zmK8-9x^7+}J z8L}}dyXlrScvL~_Ih3D~iv&0>=GVuK2Z$;N4}z_p3LLN5S#kZ z1V-LG+5&F}tqK2>ADNdTjyB1`JeO2hED!Z@`mg=)DaM9AHf;}}ReSYSx{x6ln-$9t zUHfL@8rMV~|BBhFjM<$YQ(;UV$6#|~58Zk7a9X*+bH1u``M6NQG{EOd1JOSM)tv-bIAcBPlOz8KHC(^HTZp8Z1t!*-K_rJiTU z?Pb~T?HOOj`E6Vy4x(~?u~oy)tNKow`W( zt`F2+ux`KWs%G~g_MRJ|SJea|u>4iXru$-_mU-C8uigJ3bIAXS&%hf{`6F3%RAw6# zgs|;b3eIq8btGPep=C?0JVh)+X&0E7%Kg34Nu*(FdEy}`F2ZFU(h(Kd0~PI@(-=z} zV82l_b@7+c-fD*6g_)qi`oke;xBeU*+5oJ*zv(0K^Bf#iOQi1%nSBH3oQ^L` z3-gO2F=16Iyc3bWR!UpJ}vnEe!JLB-wfJZ)>$TWR;` zx$hmZ2v!_y)Kxv-+weEh7fUhCmZ8f)W+_y2f(|SUUDQQ3uH~Wlqal6$I%3%UKr}Pd zF;8t4eQ!15ucQ)OH1J+bqcW@5OsrO`6INHOq+uS~zuQw9I*O7+wjTDX{JJ-s!|^z2*Qu=PnSKrW-!HgN~27wXsyqf*JcUk0vcU#CxhZmXH=T^55rd)HhOGBAgETa6D+ z!h#T1yymKgAtfUG+^2N9<1dnYP0Yv1)=qbNo>e9TA{BT!a&^n~4JnA8(A<}HH}|jm zbOpj6_If{jv&KrExPRohawXl>_s>h$LKOWCEaS%D+sYCoRpC+h{3(p;yj6Q?ec)bm zyM{v%sx`by3Dp0>@}`VU++q#ftJt8zzj|06bh7ytwimOP%DI`Qzw0q|-!R2H{?Q)E zcNkV5U>X1>{aI3V?}@UgrJmBwLXhlw{>N$k|Bfo>WsBoGsq4BXekq#{2(mXvsLFSM zcVR6uN?(?*)uW)jXz9E|P`Es+AM(}vkP6Av;bZzVC&x)uA;e;I9qwlxAhX4wr?Vg` ze;S>*<@Cdz7}vccwd9?1iL=1DbJZYZbFKm_>~63VNW8_3JJe}I)DsbezI@G*1?9#Q zkAFr87x(}%{K|_;a;<;p#JQJawW`r2(5LgQiy$`+W{D~!!1%l-BqKqvqz98RVjQv zz%nytSQl`oHKQ&_f9YYnI?Tedr&})=qK*?%f2bfz1hUh707~lfVx+&mCBiqto*0nr z=1KQu45+0wPz_tF2lE<|j@+r58fBGE1~V_#qcG11r@k!|#z*RbtOkqxee36o8QK)hGJ)kHS3-(9L&D<5Vh%$e8keq z;nMrVUCc}1>&`+%>8){ryXOZq5E;wEU$%Y-%?6e%Yur@5AEAymi94iW-P{M{0+|J{+G z`#Q)IY*?frVQwu4YnWLETOZgW7304`lBK7N7tNJ>_Wr18Dh0!Q^Gwr_h~uhP13OAT zFu9fTBRU-jUA4tIt;YQGZ*bk>9FrW{_#7TL8Qhj=L)w$!KqYNkye%L~0} zipZlPMVYX9b^Yk5;}k1g;&kgJt(ZAW*MHQyWrRDeFjqtQi6sVlEYg{_V20_9#@t4k z6){w0LP=Nfjc>j2kDN?tIdqf~JQl<3aZHF<1I7Xh9a>C}>*etlVO|4M|BsD7lCU>W zzv9tkKOh(rq=mf&BKS7X57%^t)5=80!`StTGPSXO_2xdedy|FV!MH3h!?4}c=OgOy zRwGrGYMu}xY|n|P-<48YvS>xmhWyYNK-S{8O3nRk%teHAk`7xVzs zjk!s0vxR>Z!-*^PNYCXSQla(})a$gGyvx@By1bfz0NXAap^<#$>YLjRBn?|bv~d)} zUdzFkRv#j{w3tyZ(%2(Ob68RksR8KWBEc39{>Q`opyb7|*9@eqGQltbo5tLrR&D5_;2))gL-%J5b!C@g- zIpqW;VAFaZKY{QXou9KUZ`vJE)f;W!M|u%M_;nnkNT_|(NoK|b{}_P;{91K8E+|7v z{VVDBC$TMX;v$djo&SJ$HJuw8O&&TiVreoz(1joav+vVRH_z!*9LP~@2L9)gk&*kr z|2(09v~6%-SXr1%!`w{w&F_y7syAK5T+)FMTK)Lc9w|*_|IsAA9nf&4l;ZLK_n3;z z7KIdPV2s31ZgHfZ+tU>fmLx)VwveiGgvz5#%)~J5ldbwz;0a^Qr&#|O@9}vpVwkY; zbjxjmMYA4*`L>KTvhAjx6$^0BsB_Gbkt1QugHv709)0vkI$G?K_g*ulRo1v#sEH?e zvQRZxsia1`uC@8xuhD*++e)5e$=c>xcW!c>JdM05qNv#aZDIHmv1LMC(=J_CM0!Re z>`LPxi1ehX{kb+#l$wB{)ikZMf|xHsabFmA>;g7bWSd>>)u;v4{CSXOh!`4jg!YqH z`yyykO3kYF|uMD?#`;sa_8Zw~^I zdS0QffOILPB9ufT2f*Cz(}nCOTrz}j^Ulz%P;pR&jm=mm1HoOing^~Ir(`PP`9poU+G)q*RZ_jeFNOllc^T^W* zqw+$vcm~z3El(oWP?Pbtz8Y!sm@VfwBO6yNQR%v;%hJLonk~C$Uy2>R!l&A&n1k86 zImT3BOIVFH(ePAN|8%zDEwjm(%WcC&bf6%bOr?Ip`&ya)?MBET-A&SqHW^B-9>I10 zty8*^T7sG%lD{BzAZI}M9)?qcawCt2D%;fHYeB#)#s(n_u6P4J z{#QBYzgSIpLej?CH?4D;Z5Fj-KUC%8z1d^+6eC9YyeXhnDg64!B*BWPtUYl8bjb;y zNaC9`D8%S^ryjC;bcW>1L=STQfBuN(4og*E=~9ZjG%vyOb54;A^p9!`9+EWEpXOZ85A%A3ZrF zqJ^f9J;oK(D2%`Qd+-5FBa}MbyIDcp{AVK)OR)5N`N#qP7&`-0wkS4)Z zQB7;@Juih{J(qB@SI9G=L0j>SrS56&v~w5ga;ErEbuNB729CDciq56*@95xupuMmr zZg@rbyQsb68K<$5c1pBG+te;I{AeDM4=U%Fn%0o~v3N-G|85L+`$tOMY)?sDg0s9J z$AWH819|BH{!|MBCf_*0u&25r0}y0{m1kYMdtY^t*k}NsK^FGt?e*6q*2CN=6Fb$ z{+HH66t)ScIWP|T>=MHMCf2Y|Hny;&JB3sAQCQlmANVV4${~-Jwil=zopLjH$}wAG zAB003C8~GkK_)pzNb@Afj11yrw!^J*S`@HINF||oFX7!^o9831b5tBX=A5-zd#Kmb zHkc~9=?wKvhzo6L7?|yAi_%j&+dsbM_Zz0))O1XL6HQXT$0OoCn1bUm`!_C64h^_{ zlGSJbj=J#CwLL;N?qFtUAdMe77R<>KBGIcSz2#Mp$dVxWUD)YtQ1#NfjP!2}+D-j# zpKJqeNq0t#?Utsg`3o5J1PjY~YJDQ&Mo|@UrFRHFy&3IxmOlL4z2=vMhlqIkF1F3u zczQh%wnbnY@HOaZM!prvsi=Z*6rt|Ddee4v5R4hQ1ytZ(8xs-xv}&EKdR6~q*;c3z zLKT3y1L+{DSj^tw1ufMqj!^lksge_9-XqWbwDw&9-|zfUEz$aXz`V-!BES}WL@77QS5^8a z!VGJ&`+Vr-qoZ9z`&MK{L`J%AZvXrmQ1@M0^=N)1vd`ue`Q$8dMceU3hRftS|Hiv= zwQ^V1Yp7!-t9il%ti-LtFKr#OTB3!o*}vGrHw*8m?8*e>NF08}M|b#80j=SsHEv=k z#Fn4LwDL60yA5R=9=XEq2|rflBF-gG%W9bskb#$_4sQr|i!xDeyv`_=CMc2m)&7|Mg< zn!Qejw1`XN{wMguw=%rzv|G=@fipK_jng`~#}OIw`mJ%dr0>I?{(iUjUX;mO%nSrz zUDNDrjFXubU%UW&d|d`%CNm zL@t@@ol|+{Z9>_#E_( zbF)^bz0NYHhXyLA;#@?bW)Ds= z`kR^K5F38;Das%rL}fA1OCZR#76wp5?WkymwABL#0HQ$urPbD$k)E~JD(+H_<26$y zkm8zP&Ebr;+z|o%V)$?)FmGp`J%MLHtZT+!ihw8tPRR|YR9-C+jy z7DkPfmwY$ESsHmsbaCddNxXB)&QdtuZ=f5VrP-yUjf@tP+Go-)PG6^6swWy$I`EXl z09hLOcRqr4QsgIlO5|gmKP$^FQM;HH8do?rt1m+U!?y${CODA{)wE%OOgq~?1a~#` zE3-eHDaKeehLXLeMSfP!jw;%BWA&xh7pFYLjv=o1FK;Kj|02qmZ#g{d(!3hIN(q}s zu&tKxQUB&r<+V&R_gBAczE?*iRzr#igMG}d#;L#sCk$J!(T0keJ&xvYk@#H@(Il*c z{uKYQz$tfjmrxnp_qal%VzE&150GMsW`#K6-Rar=ax4A}&*_HF5|u=-uQ0_sge8+( z!2697?1DbBPbKa1t7xL4X62NqnN3$!tQ>h+(8%Uo61`Q!@JgwjMhM$&+o!_-(!jl6 zipib;ftv6^?RDG%IGsevN$LkuH4PTGOSkf=EiK9X+1}|hpl4RcH|doGTO?V{ z)1P}noO#Ts zG1l=9<|wg~6!*8*!+(BvvteO&{bgx>U1>5bg}&fKY-|yuiD0EwX{{H*ccoh6;O@^i zagR4u_bnyw8)(5&Vg$WG`>DWc3L9jQ`NHM1KvIhQbnlmf{(vusmyAxI5w^Uvbb}~< zL7!Dyd2LFouN5?xuT1Rf+M``K38X-d?|qA-tbEwgwN7g^YlUNOLX+e#vNQlf%h`pi zH(3?-5bHYD_xUSpOD0@;hdU?FOaZCQ!@XN}qSTg`;LeyOu!^Bjy5F>IY1hmaj!b|4 z*4+X~5k#{)06$(@JO6poP2<^wmY1cZ7T~h5&bU0O-*j^MYyPlL|tdg zgDxmkdMGGzNS46JB{n!l()P6r_-|~*dY|X~TOC)|a3gJt%Ffn*z|Fpb&$4qsRjS(a z!aNhfZ0QiupRclWn?s6ZFMwgJRX6?Rf<*}r98)3KG*4FAyD>GfHFs6CaS5T1;a*)#I$Wg{k_5b$LpHw&=31*L%RH#A=vNSg*Q*&L znk^yE*}`n+aw{NX22I>A@AgupRxrwF7S^Zm4P(NntFxU@^hVf6y;qIHkz-#isGocw zJ1*(NdheRhcYl|2lhXFG=-X)WTd~D+)X8G*!}~ zsFDl{Oinkz(n9N33eeTre&zpH)U^?l**Y>%*^=NQ(xx3`@A{sJ#DK8}$C7YC7EC2H ze(5(wL_YmDinjNVoc|0#x%eGmJn1?si5u6lHs9BG*;pg{*Hk5Ly30dRc;qg_%$H*< z0E&3A3MzYD-VL-4#(Oew$x~A-HB@&xZ0{xICH{)-V=%>13146v`7c}Bt0brfa)AAW zh286$FL)wI?~fwZDH9tjs}VO^i>1dE)nC6>S>CWmD7O=i7x%3$ut?nxI$G^uBnZyz z1dzo|gcv~amqA;93kHJ-8xS@POV=-?a-DpN5WfL>ZRIRI+uN0jN zyEyHUXIE}6ZQ__Y}>Z&q-oIDw$&s%wr$&XW7}$c_Iu8E-hBV|kGZZj z&%Fotnl)=ydqc?#VtB5X3`Qs`r@f6NamJ()28jdMTES*T9(R)T`?QqsN521bX>$mG z(<^b4(tBr-lAo|3YTbs5wJ;Tr!mlhDCYRaXG(Y- z+P)s6N3h4W67AjnVToLRrbVqO3_J@C##cD6rkxR6@aGRa5eOJ+FUgYLm2k-t*m?nb zx=#O}1od3n5>;jnUmHj$pm6d3T$w9F;B_J{vrJ_gOiW`zJ(ShPUwOCARnETRoirj9 zQ1VaA=FwdHZ{7f0*YY`-Mk!@wxylCO_RZVZn7)2*g12iiWstPR-f|fGlA;Y6xW;r- zD-h^C(A%6mh7{wFJfJsPIxQbiJ1!gpoOlS8qMiFMDbn`Vav0l6bC4c=+PV=&u(5ke z&8;HEUELo-X8xhoq^7DRn!?V-_n0eU#X+x~_(gpF0QCmY6ZWbYkRsK!cBYSHR1t>> znjMnVEB6KQF_)F6ekCjYz6+ngjq3fdYdLr8gQ+>bgfVSZNTW4cD1)p&OF;nhSIoMo zlw8)U?)Zk(T-{pCn3F-%M28Z^vGgWP`Zdi^X(Jc0scmO_;S?9j;5!+bb8@R^g|<5HZ(S!?o+3fnkDAP8-dPI+eU8&En1u{ zqZxyE4VLbKTo5`;1n3$IJyJ!*K>`|7q}e|~j5H^Sb%Zo|{LV!r!(~^`Uk`8MZ(w^3Or8sBbG}5RgauDo|C8NSnYV5?$|~3% zHG6UI`*m_jEY>pUbmG{sLOlCq6K_Gaj5GIW$|WMmN$%^pRh5jo#{v|gSKHEgkL~3u zj3`FIbqJm8M)B~T23wnyV00_qIR>t;chD$AHP^4UY9?w#H;I>1HS2=ykV?LWCY;i$ zy~3uAoU!$Dw;JK2mw9#Odh>7JZ4vD3tr;ZOaJF_9zhE^%1~xa)l`%+lM4D3Rh=;eD z0G41PlnDx)(nuBe3M;{zn=wA!maeJ4qK9>$BJoyGr!fC_)`pLF-RoP0w3xei69M>v zbQx2wA+ZwLOC7gEju3Jhuf@YoA-EB@?4cnW3(dD-`!^#FYCH9!XIq$K!@$O=Tl#Hf zIC4YDY0BFt0M$OESibTwdzANP3X;&dOwNk7@HI05=0oNdB*E^&sisFQp&i(*p%iUt z@ypm%5CH@FH)a@w}FxsS6lT~yZb|7+-n-`8#IWY=l;J&`A=)=wA!@^RxzQEhQZ z?AZxPtZi3$Oua76RL^fvlvIA02vrR9{dxl$=~u^IePV*3_*im%XD+yO865$v#z;rc z7Yk>Ue+Op~q!Un(>Exsf0B3QQwtGJOSZ(Vrtjh?SndmW!K6_WAqKzx%D< zwWQW3#zU18SA@9HjC%aseF#{evNG{mzQM&DakrEL)<))?t)A5e=WH8<6ZBLSiB$wN z_-mHcV%jil@RFW)7(BF&@BXHV4~;>Q@!G&v{5I2m>x<*(e{thId3+{o%epEPDSnIL#6xpjaH3f7bV7a`oZSYCo$kjD zfZrW)hPhOJIrX{UdGxL4PFTYr8n`l$TWz2YT;19HZ52}3jmcoXVUe6$ICI-4r=HKl z?Dk6)!$Y~5s}c6`A;exG9FTmOIy$mS`V-uz(e7tROw|-<=@rjtG^ux$#lF8my%=*h zYg!L!l$ozJ3z$wGHZsmcwoEC59LMb(eC@&@#IB+OQwx)+rK*`}vn{O*R z^BMMk>>%`~=6j0_8!wNhdz>mE1bixGsKxenkette+sh6i8_MKWT?oS%m(!$5!v_EQ z7>CyRZOBmk*zM*8BG8D$9gIBFNHr2?kF(qzQr29jGa*r(sAblUGv??yVp`F0SVYB8 zLU|3f0gzom3{gwP=aQ@zMHF?C|1!FPWE{rkLYz1Uxg6pdfY<<4t4OVVN}`_-k*2-k z0Lg}sDdo#(ld>8;{H6ewLyZVyOPlUVMcw!BWFG}u_$&o$y1)O}Dz8IJ!eSELCYH4R zaH+z1OgpEKot!uB*8g+ljHuQG;Z4t%!>rX{hVc+YE?BwGNMp%?N0!Dc%}fVv;Mv5| zDb`Rdv3OX&_ah##F{gc#F*yP31gWUjb2=Iq@!)rmEbmk39&;!MK74r!LESl z-~U(F6G2<5?SafV}FK>AM| z5_7}SzMlP`D5JIY?xC+4%?@XDuRq?@-R zBIvW9`;0;Ft)KB+_Y6JVF5k6`;Rpgk@@OUa)(UBKv~2-l-ZVGqjv}XIr!^FP-PFP9juSxvNy^pQY%Guja+ZCX{S`)<)dLbgVC$f))BNx+eZmDABdu}~Jl(n?>=1oA6Z~uA?Z{UxS*Iw(LUtr0~12r@pc^X@lB0w}1||d2v9mPKVY_aDmpNX4E(%;lQC)jI|@wVHdAJ-yh^oL^lry zlcP7>F+LV(;9mp~rJ~nRO!D9N8$v_mUK)2Hp`n`>{+CmPlz-3BbCt~@*arxyBBDY3CvM9AZ{ z;o-7AXPPy?@fQAwLi~$eJ18Aqg)f{vgbs%!2-Xg4GqQSjP#~z>1%Ag@bUR`i5=>D) zo=%TkGw*X%vPXZy()AQeqDtS-4}tRg4x!^J3xT%}@E0gO*o8pm5QPzET?Afnl}9eZ z$8>OHMJFpb(9BCi(?|U7dmMznnr+wV#2*5lKF?8@Yy*dZzSpc6i*qX7#9mq_kI-3x z7)w>@g?f38$%-Pggl2iMb%)k&n^zodPvFvazpb;gRw(QL3n~12nMCOu!Jn)@5gxL2 zzS1n*2r>+4G^o7=Dt!6{`r*F#XqmY*ITKs96Eq_vq78H3yRV^1vl3T_(zztS09Q~4;B{H=zMr0Y*9B8fqz4ymaNuX`Ez44n4 z(ldN1;(KM(F<0fB$^~Du8@N<8OcZ_KwSn76IDM{0Z*a9aCU$~BeMRf?8FfXrCVu4A zf#+dKzfij;1I#=3`CgW))ZzjfWLdw-j$q^rY7cS>bZ`QxKM@@YynUE~gar8R^3*IP ztY-WGNW@95k((ZQIeHG(pqtjs{C9Um`!K>!4_5dg3EpQd1x|H{UaUmSi=$Fx0X{NF z+T=&q;0lx2xSObTMyPL0>BI8Ux&F31n%6=VtB3tZI34UPcmgi`JK|N+cN)ZLlwKq& z4&Wm_q&Pt`O0Z#yMdxlYHf-K8r6RdPU65_Qg$+znLjjd?z(GJ-ZB{LBszU+Eax;MA z@kZ>PmTNMQz8Qx)1#UN=*fE5U2%F zeBx~_9oyi4vkKC&mP6fDngjDFXV5Q^Tew);@Qp|t8Df00!&dO)Uj>8{wOXgE03u{1 zqDXD0@P>Ml1ZjsN)30{lP2VAMQ?BgUaZm$3@*0M?HZeJ$lREA|X=8Jhj^?feC9@C~ zc`t}^gkg5-pq2snldm92a6$`^XNgHnNg#qD6>9?iTkj+fTi?V8|jlWQxySJ)MT9@eePai7Dh)nyzlF%VnNiq^~Yk7U9Ad6*mtLeuYOpmjPvQiYRAKn!vAj!z3;E?X^jUmvOq%4FMU5u*N8BMVsXk z;!Fk522OSRW)Oqwnmzs2XIo@Fb{v5g6&g+So7e$@dEhW7TfU%aivF@;segbwOlp@p;Pl7|NuoRyWmImdoMLHAhny5;R@OfhGPB4@w$LxElU zoTzE)4K;Ru11GbmaE&uXd?A1z398l)Un{&OdQN+3$<~uVkFS^x?A|1QV10ZXJ%&9-ryD11o|#c9J_%~TAH&{oSR(scJ{5!NNv><_97_YD^5QO!DH;v zqkTp6g>}z%`HwEzX5chW*Ajv@at%Qa6(}{A11l*nJuio{?wQg=ZW6wmJ{OppY8ca) zL;e01_p(u>QWmUM_R!?t_fkW4ZKy2x3XuJ4rFq?)N!8!m*X`Hy`^z8NhSWHkNy2Ua zYSvXL3@^Ah)FK22 z43(|q&R8`LYKs)F>}d519xRnVoaijg9Y|tUmv1#>VW?t0U*tLg zg+5bt$kcaMpbN0#?!O9o7Pc$=G(#rpl)fp%_HSXJOKUkr_quFNLdW}?!M5eoep6qWn)A9a z)f5y$fKVUL<`)~MWZZ~VOh?t%1zJW2>sK|!MpCYy^65hFF*fdjvn~Q_)A#~i6}GHn zV1%kyuza@N$hEvo9*2v4ixNmT(*^{)xEFDRXcl z>;a=B4s*YyOK~zgt;aViisDK~Z;qmgGyErExYMg1lfJjXb%yl2UZC|gu}%aQidK7l zXaq-aJr7ke;I`X1Xjqv%oJC@kP|j7SbqPWzBIMsJ@l)5r@;W!7-gT4j!S7?89Sa@9Jb>RbGtu=X+0T%g>IBm466;`Np^P^3$eu84QNeYLnoEvw(tusmbW5L>!pC#m!?6=? zk8*rEpzplWpePpAZXpQj3!$o;wQJOU34HW z=&7Y4kha4){i3q2bMA9ippRqxdL`&lYSg05N>pk2D&ckoN`W*<#6l%1DcDuY7j;Ys z#N_@QW(8TQwA60MSNVvue=;1&dXuF7ZKuE2drwxPYL!W5I^L&f?bi1$-7cW#-wyG7 zD&f?kqgzf!mb>WRb$>kbe9{G#k3hS)EGmJo+sKHGaI>-vg2ltRpqP8yyWxL^`6(+H z6tE^6+R@6Ka@k`2z!%Sp05WFLAQxEXlq+eK0j+*2(yT>6JkJ#bO{lLt(MvsyE$=w# zc>#k--k=X|h(f-W5y{fK!1bw{Z$ZIg7@g9o3>aoE9G*sTa0)1#rfS3&OsnY5@9P>u z$>3l?g!GF7af;Qs5119k;N2rP7Z>2`W?Cy7sty^;s@-t{0|1E zB6PHfO3t}x6xWisdrxMtkoA`9GePG|D ziV<#e5VX^RvG+!t1unGqu`PyWq#=C7q*XR^ULQf1P>-`%1E*_OA-1%~u{N)GloB^| zLmJz?V-8Zb!(ga~J+FtIM2rR9x}}BiX=_KbvsNNlmaK(2a5E6mbcww^wv||a51ym% zgpA-=g%2!tA;0D_g0r6O3BAtqg>AoHG!#p(|H4=6miCqB>Ox~*j3vutiy0l+se^2c zxqP3CLJZ6!`t|iY=aKUt(Gbaau+!xr#OA$hYlm#%-v=lvQqUdC<`{HMcB z#uZg|lgoK4gq8Cu&)NZ*A)#LGjoR2ylfuD;=$hnlUy-~#ygFRDiuP?S>>H!pocQOC z^4s?`Z%-6i9~^IF-L1cZEbYkr60FcA#c7wug?JS1HZH5CnU}jI0rvgf^qo z0z__yA9VTFT0sJE>Wx4~g`tbNF~Cs$DRBn^_*qWe*cBqH@K9sStcEz0xikCcqwNcw zBbghF{Y$}z&YmdB9ykg> ztpxtjiV~WhR6&861sYvs*G1MF3bBR8c{ThpOJ7f~o<^(L&ktu0cu0%~ktRwd@OQhp z)t;o!HQJ6RjRbEOZ`&1BoMVu)mvIs$8Ya409a0o0?DxKDYz@mT^?|z6@M|_K4T}Aw zGW-8ZeR^bU&Hzd@{SLIeFeK0;u|tEgh{3jlL?Eq#A>;h4%71qq25#5QIp6D3V8p1D z%iRUN3A6^UOHLc1ul_O)5l7r<5yJC0sv6DfjSLx?1d8J2IN zicKy9o++WEhfe%Uy59(375;BRLDJJwnfv>!qFf4xrw7!wcT8lFic=V&Aus*ywdv>2 z^-$rzU>bj`H!u`J)CD6U{M!b);a>gjRwe7!kGn~W6*b2as~a;W%MpZQUKSwP#I)*7 znp~V?R7Urb&BhB<<1D^+!V2A6e&j5w{mC$gLuo z6?Y|N=D(Wf4sxKelK(CiMPCplmQtH9m=el_QN!Tz1vRid-*3@}u(k383M>BGCbg{^ z5r(6m6(;3$ZQHE1z&+cOF`4XHw?2{i?)rkuP+<1$LzV92qw|+!%Y{UU{$yC(IwP+2IBs?5B0g>0OYWl&T^h?fe5R}qg>0`UySt+B8g-ZM8W%-*qfiBT#l7a!JWh0) zrPsTaYLtE7m}{jqPueNYuFjGx>JsZW`Cf z4^g}&QGzzU5eFLR*f5};i`?=>|Bu)<%4-JWsGtfQ4}a@ z#(-*^-N1$4gyoB2;9&eP8a>97xr9|3@nZf9?FW2SyIl9N8t`%&pGQt1h~ImyJiU6U z7a)M~3JeFI@_;f3k;V8P^;dRt{tf(%u__htUFmhrC%#y@cUzH;^o0&tdJwn8tu`gr zm|si<3t|Go0)bL^f|>0QRGH^Kge~jh4&cH9jA?Z^yMP5(RCCrr&N9YH%_x{jD@_mY z)L@9)07_E=m3bMGDwAF;p5ch_5a|CE`t%~-+yTv~swvHa)@(oj9q)JnK@LJcfAR`F zQ1m`MGauWvAoc)YZ@fWz9L7?Qs&(rV@k@Ud5iNVKihRt)n z3G;4**D+yupe+KhUbQ=9Li zvn|f=Mvw?>VIvVs;KHBYk~jT_Us2Atd`II`5wOwypQScsW?8&`9!ZyTdQ2{_QybuM zvbab6kfl{1HWFfvGC(YTQo`wCxR?TRH>+TUBjNvG3dLziI`2u^_SHXd=57YOD26=YC=W*N zo2=clh0wHk8Rcy}$7pKG3lW@XnzYU^&)`@#tTH`{PM@ae3}nAsTE+kLnv2xC zCXd{^B?JEr5oE;ouDJu0((|K^KK&;Un6k~dOo{ep+D8gDUwsKExSAEg+D$_Mx!;F}ov-wpx32qPr1o&qr~t{Z z&(tTNB{RDBEF)D4ha&(D#ScP=MwO)UvN&RlEOvx#`K$7S%OopK=A9U{#&$@4UUc-6{~*U+K?OjEaLfdzU^ zawqbeSSZ?X*er}7{Tjl6H*pNCoVDaDT4#!NNxNjS&;NDLqJ}o%w2l_|zwQy@y@ET) zmSLGY$2?_1ppdcdH~*gAAwu5&pph=7gEOac~NA@`T}37`aIqI|nnNSY|ka zAUzE88v(SDHwnxXTA3|*hprvBpy3E6=Uq6tNs)gkRtWuf2QvpR2XdgJ(+39p)Ys9f z;I73FBmdO}_8K;p*;;j^(1c^#Oo;dXw$@p3YVjH%p|5_zTLirhXq1gB#&t7ugWzg6 zZYyk(4tR{i8$;HJBsX#9KKCCW6)JQ(1BC;`t^jX3W4I*`xT)3o9IR7a!DsaA;|qN0q~{x5ZG9E5yFr&uKx1@ zIE$(U1S*GM3~|v1KY*)ri*SWCS>kgW0M8p4W`OlNWmmVe7s-kCTxv~~e&lTlFSR|P z&J0z+d=2-$e)uihXVmWziD&|@)C63q4}AN}tooOg?kEg2nDjkx1ha}}i=*!SPE{M2 zffKbo>-afYxA%!whuY>JYIF%tV0^3Z6eeu^@g0ac{T5Q@;mTZdl8KY(MZXF;3Yf_# zGZa+xs(C3|K%!VT8Wc)&xvwCS0RIj>Z4?g z8J@0RU5_S) zTHKn#71uR$7?On5G*I~SgugEsvx&Kb4_GVpAB61fVPHd!I&TQX{aUtwA$CLg(xpR@ivFuhsBS100wYO3ThsX#-R-8PDKTmLxJR> zPDl(=J+7HWA~{I$?%v4`k1wTlMImVe1$2MHaXIl5g=6j%jiZE)uVl>YtfFYJ$QFM6 zl1FvV>nekSrhH8JRlwIzCI`k-x-)YnBx@aj=x}}jyo&N825O1>dE0+PK~(Bjvq6)O zTEmLdjPvS5UMJRi+0D4orJSbtJ#!#LUTPZE z9QdRUk4bL$eqr`FTwI_jMvCp5c{nrcr_mS+Mw9@JrbN<-F%n|_FJ!f^1y>}5h%qc& zv3cdh{r+m3X2a^$!h4%!A_=nSWIORTaYXI7II463M+xe`#9?D~lUTKI zi9%IL7ryHah||V9+(^VlQ z(NvQzGWMOuQdjs1#kBuSBSSncpQFVXuPTj%5Je774Sgg1rTkk7a2fhE}xyqDh;0kDd~I>?W?!k{eN z|A{Q3k%l`NFv{>~+)ydiS+%#hhq6bBL<>cEloS5T6Kjf@&EwGhw z0@9>uj?PoYNC4PK^0ym17T8F#MmS0s;nvfxKrEgF&KWS_&m;C1gFc|ToY-X`3f)}b z)4Kv%jK1=P4)$F!b^O%UW>XQdeH4#b_u5N~CZ@wt!hSh^&M(|nOA8MB~>excg7^n@j%nl1s8{}@zDBXmBV1+A& z7}xGzCiv7#QL-_SuQk~_81$}s$yBH&{hU$%ZU>wM39apM>P{VTO6VX3eXV$)LD6u! zC~)<`K@-s+K+|=}(07+bkN{Qu`y=^LihpNroDjcBg|0vka~3hn`j^6iql@i2`Dm$z z)1He#l|F*}8WvN=29n-sqI3~c;C;FyAnE;el!m7b9tO1*5+yk7h$-gQKf9b_fKs4} zp<)@Ya&bBgU&QnYk8lWP5@Q=*QXCK-{9=}ffFp)~@VPcU5}4u0>EBqD>a02G$jm@| z-H_FNg^@pytBXR(Dy0|jR&xS%S-odQXFgm_eMNkHG}7i{|6vOo#)nT4F#@j)YwgfYwj?iowlP4qYWcNkU=6e|goYPn+r=HtzPZ81XDlUi?R zyi~;*mhYOT67Os6YC8T9B%rr~>Ix4yPQ3!n!g1wT-b<0oR+ahs3&q!~YiOm4K0!&& zBtm>+NyS}Uq4b&8VfaIFvxL8K*po5icHSmpS0udhuAV1n3kqX3f`>^{KtT^KtZp+2$i-E&AjaU^x(DTS4?3 zQN2P5d>HGk^5w3JrYuim;w5!vODT#99>L(Pf6H4Rd=Bn7bQ+KguX$xuuM2~xbEz< zb`I4YaCLiXMUo>(Adqbqyju+l^X*R&3bbao_~8->#gy1O1;j3etym2aDN!efu(B< zE#f(NUs4RAw3lT&v54sI>%`2sT{KX|ywq*H3HU<`GjMTc45x{XS>u*0NEs7iBg3LiwvJ;iEp|ZTTEH>bIS1 z{GsR^6OsSs<(JQKuxF)>b|pHgxFVm8%jxmLiYG`6(u`WYM4A1r;AdDwEe6VQJw)Wijq)CtP6)9f)0uy0TE%~a2mf}rDl%`c=t zfFhsUSSX3_e=MB6{!lJJKuCxCWIFGX0jik-EIk;`monqWh-jP0OGJ>Tx^WQ=frvCgQe&o0m+Y8%?5vwBA(p3eD!@=YV}L3Sti|MjOe&tI>6j;FN1{$@j=Tv0Po(^OQ#j#Xt4pP0pd`=2W!`M@ zxo5r{7U%w7ORFx+ur}Vp>ocBeDI6$5@c}rFjMaN)<~Jvir&V?eQiUj=U0jX({TDdv zcCC4$vu^nzD20^fIDdyfp6qoY2_lgzmNZS+;qN&dB~q)ot%}&KCh9lnH}Y@1LRr25RuxPf{qT0 z{XTMYtefJH^iK#N18QOpNrURrUG(4iUY1^VyUaH}V&&g|@xRcr#V!^-HBlfR^lU0! z`ZVWN?DZoWOjx+vM9&%DO5QEw6%8G5@Ul@H)eu9wD(rKv;R??T)SKvyS|_V0YGQa} zh{mN?C-2^Ad~U!r=5mJ)mWqaybQLs&qwKy|hZdqQ>abmbl(&=*x(5)QR4iRmi*U%L zi`R4E?6*{H>DQhiLeANDDI?Uf`z4oEgGb z<`$>omKYx1M*q_R@bO;-YdNjgrPt?I^-?%kxndN=ZkU-w|Aa9}zAqHN%v2H%%A7u| zYW*hoU^|ncNa~#Y7>1l(_>u`j$Vz)VDl#6L55#?uPTvpoYz*o4B*G6@4pmz=@tyBc z{KBsTmpoavS%+Y%o=AJGqtWyn0as~gf$CkfxAoADn299@f{ERQBnX;m`=;N+wf1Vb zc@=9-ZZmJgf|M>BK;K&Q(S z_a1PdunmP(a|#CD-;heQ=bI4I61RYDb4Dcen-iCwO1-m&^RoZ1$fu7Y7l;N2}o6|?;kN5 z!pSzj;G>cG;#0qb?&Yd39y? z7`hIkPY3_Q;rF?>4L923AJ)d0J9b82**wl_&Pl%s3VQ=b09g7i-ZEgTyU z_x5xDeHFMyzRL0aCb+$oekH(7T?v#hq5RQ!TCrP5*=5C>)$NIv`1%DEP0I(Vt z^1j}zsz@*stUe9_wk~)m33lN7NXNpdB^pmFO)SZAa3wl`m3c3y0WQz3?ed*yn3ZNDoWl_aW(#%J*VcU%yX*ehnFPR5&*vtSRjYLqS%-r6!_ z*t?WGqQKw_|8}{(#+jVBTd?9nF|JHb0FlbK3+AZf>^YY<|NEBW`t)zod@K6<-8sp+ z*2)f(vX`KlU5WJmY(Dn8;}!>HR$Qp&3I}DZQ3KeCPk(;va0oN#2gHvBNM6*H!lETZ z3QmTTj{H9KFjPu5)licIhS{@zpk(;}%^bY9Be&QdUr4Po!9t%zo`AA9L%qMBjZ5d1 zdMR)b9yPr%yZ3J56sMDkjuTs4jkapv3v5;lI{JHB33IgbgyWarOISV&(uCQ*_RBH% z%s>r5gz8QVS#3u9y>ZDB%ervd2zQ9CT+p(HcW#XDmgmZWA69c`!T-tayoLitI2pq} z{#h^$b1ijkhRfLqK`LV4KSL)q&>E``PU~M#hi96H3lPl^+Up;Y z6Q+ZXnuF+2`IhaWC>>sm;7DSu0zBECL7)_jX@&n;oVAd_1i1LT0Cp{J!Y*lI1c&r& z{D36}QwvRrrtV(|IO~`q?|6}1=hBD@V+yNmc+LM@<_f`4gk!Coj3sN!RxtL2T;i@} zguqQf@cP0wXj1P5mzw)ygUCY>>@ESb1mi+kZB>YIQ!RGUo+f%YC&V?l%A@7JTBdQ) z?ND^fG=fZ-S|#;6sGiuIsp?$ZmH(_MaOh2Y_OBJ-&>Jj&I^1in@4H;4#F#f{B&BKB z<>i`3;-Uvdh5!nQY>0xfoqw;C2Bb7Y(5n}X#p^0uG4V~D;;;PnPsz$2Yuz^0`J=6> zlPh~C5F0QmwAx4FW^xRo#7&&XCU$X&YdUuy3(-B2&*hqlFBdYT+VUp@@h6*S#Ya99 zJ#R}_Ma_GXtQ*p1Lp!V{HnsK5cpcvR-QDXsE?wZTkDiLH=d!+#p6v`rLFbiJl^#oo2$WPUvS6YpoLCz> z5P=GM?JIu8Fhr^23S~YpRU99smeoj7b0R+B7~|cW4p7qn)PqRqk5FKlvOZ7`5yG_7 znidp8)XV!>KQ#8Cz=R9c^Hq-|NZBHhxq;sG&2C;iMM}$!5b19@xag_t(0Y8nw+qgM zja+GWrD@UN@QHU;vc@1_WF2heSO&=XORZP!#3P(zLW;FY`5+OwBGviuLKjKxR}SW& z9;eGNUn!3<{xkgpL~Ic>vMfPwgigi|9Rfa=(~g1l6gX1&C7KXQ@}-|fZ(2F<2jO6~ zw$JK$4AReJZi&9el#dGO%Mt!{eu<;sZ$Pxa#kweV?rnFb@!oW_jSfLMEW70Dl+4Ay zPT5Zh%5sz~wSBYw^;K3*RaQI~OiHeyu;$1&UKu#o5Fgrs`mv9Ln#ryFin%A8D;XKZ z17fUHDwB;^ey@ai%-88m1S%2m|Gqy>^fRY#VWb4;`&`Hq^g>X*LkwJz(koJp9#i|l zTS&_oYo1DiP{Z+N#J?wdG4qEGfwPFQC2lDwh#txH9&Gsxq?&8N)4N!2gASxkj9xO@Kkm% zVCHB?n&Wd5f$ul${AXtXeXZTD_VL`V2HY746(6JsK<@`|q{SxGYiMz9G&RX_19z4ntW)z(0qmRN>U%f4=UTYSd5; z3nvfhk;RajCW$JJ?{>>l-rDa_e-a0P1&aFHDVjPk*8vFA^aIi6pv(72u>p3%{a?+j z4q2T8AQ%hz3HE{wH=XOaD5E~kWh|m!F+&NeKYZmOGmH4W6xvlNn+Gmc=~$d5X6;Fv zaDA-}-g{(!0GK)V#3qCLQzuUTp0K_uWD`C;aJ+zYSj3+muK%=!#+kCb7kAY10?eJr z@6#tS4yM~wWrx~5>qAUBL4$Kcx74pe3-ou1b z#k9|txeoM7&C}l2g@?7vX%giQmwC$PC%tU+1EoGGuihKxz)(Z<1IS6Tt}~a_-F3Mzlg^H$s;%AK5dO7LyX}B+E4|W}g`uH)g-q2^qGZ2fD3l2z zv8Z(*R@sl3!uk0l+Kd}{N z3O{tW?4o zJG#-=7LiI{o!En@LS^SAgc9EzsaA9HK!rA7q2u?z~k0!f6 z9rh3rHqOtM@T=ZOmlP%qf0A~`;y+*5F0CKK+c*qPtMlWlU@_}5z&((@tj~n*IkN(^ z7wyE$nnbfY$6Zx>vIn;Lk<(~cLD;ju^Ih6)S#nK5-7?TjqFrM*lMdZ1oS6}^wNYIE zBtK3gZj?~*n7d);2EZ;4R5bq0SP*vz6fR~>Yd+cSSM@=)Uli{eArE{4URsee-29JPpMpz$>WjV}jt#`9~#AiKBx6hfmW z@gG4dd%m(gIMvdMkzMcmdaVeLVH*8Xo@$0~P|Pjt`Wx?lBF3TK0*yrut*s@tO?5>s z0_B@!c9Bmp11ZLx*QF0~+w3b_v1YG9 zfJMl)!Wv5qQa-;g5q`*m5dU#J?~koE<7A&&oV3Ci6C_~rA`fY|^%u7FO3;}+a$_rh5%1I~w{vf$e zO$+bPqV*rHr(C_8apxhMK4}HiE?2dutK?V5gJ8W#?Oj%cMvzz=eS&(tjIKMDQE6@V5q%?qV6@ zW+3TS=z*!!1+q5a>n*Pwu$mCCtxQs0nBqK!mMA8QdZe6UK9BbP|Fs2Futd=T20|TR zAXFeqOUPylT9cBCfxuu-d~H(Jp^Etkp{ks}3KlS78ThA}Muc2Z2iQy#x`n<}Ibts$ z>4r~HGUQ1)tiEqQ5FZXjTNdA6b|Umwa{GUny2_|Hmt~8)LvVL@8QdKPclSUDPH=a3 zodJTo6M_eVyK6{r2o52*y*cl_d$>P)R)1^N?Al%3CEbO94c>l>A`r-g;t%q*i48)c zE?!?$avd_F1j2Zmy#5Az9vW#(X3}|;G4;>{_zPwYcuJuz_UI8H3il*CZ9+?Y6aT^I z4pZu+&92KZq)xv0jME!3w&!$9+m+J<`**}T>1#6lgZU<+Q)9v6r#%<$h|a`l{EKhE zP8vOmh!TgW8xdYbYYqY!tt6gc#lH7KAHU9H(8H(wZdq!CO{*CVQTzw2`LQ^+>9`!m z@7b~X;qZ%PR>&Cp|Q^TETgDz0FF)}c4c9A_(RfVL<= zYjr!7I;ceeUbXskZ^Q$6K2xS_u@zQD{>9{FP`jNoLuRtkzIb4KZmW(dNF$o~mzvf& zsjnb-3^4-?*I#gHyk^du#oycB(nrhwG1%Q67OYHyWxU249XeMJSM8nML|H4nuctG( zP0POb%EG<%)c23~c8Pc}_aE==$==mI?AYDDl06V7r~=w7R6HCLCrB>UvGNnKJ;t8| zjd$!- z2(jCw`OHyKB22(V$1}ZFCu5G}lD0LMs9CT!sal@#<%<~EuAu6?i-gstSh+?LU$|ni zVh=R%4?2B{KP-5cWRrFynDRbSk}#H$fE8J(&#kwFHRE?Wd?CZ!0!Qk)!R9!`f4~9$ zk^O)FA$x)P9$}f`Uen}>mRv#7ux*Bi-t{>^ul24k_xqBudAoF13Jm zQ(K+p;sU2|H_My;X)W~7Fcq$o3*d1XaNhuPg#JY7gi$U}xee`91>l8Y-f92V_x{W| z*gYsraeV{o-~|D2D?r)yO_5$rQzx|naIJ~|;L}H&sm+S{)Us_rKG1ITm2h+2>@EEE zd2ag!Vfoq^nT3>XnEnqGnNFy%5&}&F{NeQ+54{F?@+*?_l2`Q1A-i zwEHT6Wzh7@^y^Gg)+yhMVZ`vcW$nDR<0K0jU$lKB>neqG3@bX`_7VXQCy+g`jqZZ) z9Ng>;8#-tdDQU3lIwF(lU4zjTz2`b+kh8C|jcA%odq#^4J+=MjJR?%G;XAto;Bzbv zs)Zu)Z7NHIUr2_IERZ&bhiz$!CMHCX7_+PL{g^WB6tDIC%@7 zhmMr$WT>q;VbwPWHYTE>B)HDHSI>bnVyjzU$WV6$=^53L9rx|IP4@Baw`oM#jnME{?RsD z&eqoL_vJls&p8_&Dddj{ZCjQisset;8X>ow1L?521Bq@ zp|t4wV{z&4uy0YZBf7Scj5m2r-qh(bTLkGoRDSr6I*nDRo`0oGDz*_SuFyUHJkQ5N zM)>v9Io3e<@#gr)#`?DX7^p+b!Q>V!KwVndKUFKH*zAkBZMs2HX{@eVa(k?FlH+WX z^cBSi?Id`}Rn+fs4|ko9EHPAX>4zN+1{8?IVMr?^Y*u>{svHI}t)dqi2#?{y>>{Ba zqGh(=d8WgY#^8W*6bcwWL|GIkY{ zoWsux7FqzDJgAIW2Yd(P7KyFSQnbPgQCH7JRenj<$ohEnP*NyR6l|{9>WGb4MY-Kr zeKBR}F`>%UUOih55K)8xICuJKE#N0ZiU;J@{c&QNMC>RuqV8uyex zrs?g(?Ou>Kxr|ewNpPCSn@HVfY^hEz0jcbZgBQm@zMf4_2IJ)VM>-jk)CQ@>5BDk3 z6;LRP>C$Ci)G=<+sn=FLzR zCSH=HRRvTfgp&gh;bdbKRg59E{CEJ|uOEC@%cH}_)Se)<;W>m^VvJ!1Ns-SD;G_H|xj}i)jS%xQseGV+mzB(kda=Y4S-*$4!0*&T2kCyn>Iz zmj&^Y&$Js`+K#&NQ0NSXGt*T+jrhOqk5`Sa88q%sv076o*2At~CE5-^QV-_RfEer# zkjsF5xuh#Ie1hA!k{Y8|Qs0Y4>WQYClS{z|6LHndihr0@MFjZ60W|n;i-5m{uyN~} zs8O4se?@|?2Z{uVfReqJXsrVctXZ)N*QvejC&vIcY1E@T6`ziu zq`--9Tk!dw^Q=by@w~=A)ewPIm++8VHKG3ZOmzn~p`^ZqWtM=h<|FDNe)#Imb*K|n zG^7e9P1gZ|kKGfXfN#zHp#MbfFTXru|8tebV&J{+`{;S;e#O5tSmjZX08w7r--SM! zWs3Rbtbe_~$5LZv6Ue-)E*8Q(ZcEfcqjB+NeDlBJ-_J@zgpq~_!xie_4=snqt`PrO zA&-=P||az^WK(CYl<+Ao@IEF zwSaU5XYK~k_S2LL&NrTc`#h?tb2Q{YJMdl((sAw}HIqJ7_;jjJoB`H?6kLp1?7-wX znrq;H)pu&YzZC92z7mGWq7ed-g;{;nf=Qcjbid@0ullxID7V0fjXjxWQlU2L5^qHS&8 zo|_aDGZ$Dh0Hz|<(&;^n+_>4p_B!7mo zvn?v4b28j2`!dU`|3YS4_PCRiqfM|gUf>{NagWPBvZtns-TD;sN#L}>=8pZ(wwmQ7 z?wM12hieTLohZ_vC~ve&K63)1zg9-(lZs>y{f4^sq`HHcz~>ku_I-EypQ~U+ zf&-Nf0#|wyFwfyOSTSo;h5e80KC5Qb{d%IoZ#Wm|E!Gw4L=k8@`t1p0si8r^vDriOB9MwL51NA$;*2c z)`xtL=QY=w`MSG$+}(f;t`&C2yFg4MyyKlL#QM>Jnn(VfK7Y*;VG!Qoc8S6*wPs0N z8np=+?+~YCgj3B8Q9pS-Lw$2Na72?~mlcV?Y4?$8Iz?uf9T+R4s=VIvUG+n;eJ~=K zX367@VhRK(Z;4c7dl5?GWN(QU=jIlWh6QnqdoW5sRS^*`(lF+nI~%boxp2<+Tr|-L zAk_^FRIw2G09W_$?r&{9s})Yr;O}i#xm#-d;<#o)6Y$_~9M&OO;s_tK4A%f*>qIuU z%+8)^w_($ZiDnZHp8uT^otxQa9|2mDn};G1f_yvNOjyZ2)VSq_PjeW$sgMRS=P*B~ z3}2r>*G0CJW5ZaTDq<0Wr<8kV4?V0Q(@&G=bqhh?dSCAoUxxL@eG6Y-DVFpUB0@g* z`nweigVtBhTasW1QbG66;69UqePsKVm?PA2(Dq2^T5K`0+GKAKR1iUR-Mt(XYDVxpRjK(aZ-qazm^ z;g8=OowaI^1eb9<&y_RiyA(>&f&23Bon-Q2S(;5t z5?qc?uP0Ha*m~m75$LW~lg=D(tiH{Qr5g_fI+B7u!`X@7sH#1BoQ`-F%MO4kw^)HD zAfHdk%@eoYc<#az0rT#GPNXD-kad}(PGevI ztqB$vf}rg2yFesKUViuD`gZ?PfLLzj^n&*hclxkjp!S{1G(|WHz6|^_v1K{ZEOW+1 z##5F*&u6*EDf;YW=kBx(LUjkFnsz2;3^djcbee$O6B`&l*fD>hQUMU~aLYsKoLZ3;81Oc7ryntGu3^de_KgL zyB}hMm4%adI7a<#{dyZ+s2Qz6^eVK8Y#+JBu*;IJ-FH@yXaNT}eE*N7VwC&gv-cDo z1j}UOsrC}%WC?B_XolITuFUBeu0nHY?O1IC@9|U9mr}%-0hR&A&Pyc|CmhS#SPh~G3_RHz?`Kt^fhkabZ?o}BeCWD(V z0k)thc;s+P2AD+Y2J=WA@)yi3u9^=IF0FeiKakbHkC>(2*(dcQ2kyQZ7bre5>hjy2 z7_c@0&6mu&(V?%Me=pkPyt>u=3-L-AdA3rhmaa|;p*v9^B_dBG zQ}b#e`4q-AyJeIwKzN}aGU~%XC$P`AHW=d;xYBo&$42evwfr=O%kGwfn4fdDw{@bv z&@!OPvfjdTqM9qdIooF+huXC9cnrl7H64~l%2YGB@FtGo*udNsO%3)@} zLB8Z1c$$;sGU5lBrn! z6=Wy8f4l9|aV2@D+c-J)2;8`oF}>NS--n#4-4xTjr5%J(}?v|tOf1x~Y(F{R(@*k81wb>rU z3;Bs@XO|Q$Cq{UJ;J*Gvvxwr`Ii2vU5OTpj)mo%!2Kt#imH;EHhNzjdju6`D3zqHb z{Q_0a-yL)-J{w4nY5id#mh2NBC~FH#NN4}m{W2NPc_rBR%Mn-;2WTXpin(?H z*2ue9c8e&1;Rm=ezHR}T>_qhJ_}5jzl*;$i+%#xYF|u!aA}1NJ=5|LAa#GzvlIDGB z^GoLPa~;0ywGF)e`uA^z=sV-#lX&JEuXIGT_uAJ`qW1}Y3gcd4?j}K9&*4z$T((HQ zZ4R%#&-asK@d#J#5Mi7gAqJkwT$)Zpx^vylL!s2y5!QBg9q#4F0b~r^jbf;Cgbu+20W?Tzcq4Ky)*nNj^ zuHhN@*z1ao+v@5Fg8@eVAwY!WoS(*;Dm$Sm-kP%`HDoSs$jN}~bR^rOfMuT$#bfcW z89#!J+OYWkAfAt`?8${fO2FIGUUJDM%A-V%lPBD=6M)CkQ) zoCeMGP*xs5Z=WexN5Caugp`S(`29rogmbE!x7i2FIz*7AB1y~YU$KZOWuu6XU%eez z7b8A74IvjDc5YMlTulyntb0qhk|W0Ev`dt${yv^sqN=C(9*>;1KAKVc>h1dYaGS*! z+*e)Tr6R}iqX=hF*>et+BXFH;&_b^|_D8F&cJ{RMwcV9b0C?lbY{2>2HLyAfG78-w zX8pbZ^qJts(5F1fzQ@7JR&d0QfL6n`sI%GKdHOHPSIlgEh2XUTp?oBYj26th3Xy{1 z3eL1eA)k@Vr=%x|g;~n_#QGq;`)*89b`!~CO>3CKt#1s%_l8Tq#EoB_$z&=xC1E70 z1Y7E>hfN%YLhk=+2l0z84j)#&$o|!)C@+5ih%T1@t~9_KN-Svd*rH{f;OT2SxMRg@ zoNgXLZ429k0;>HNzhTLIt6p~wE42x%01~`(DA^j5OqR@of`s^3rwd2xHuZFHHF^aT zEO{=jG@3dv=oqNHIxQMMzw@1<9=2+innFJYynjgVyZ2LA&gGI1dk^QIE6?P|7y*Jks znZM%Ma%V%Pys0x-Hp=|y)jO1Fagb0SOO>gijZ>ZxBB4IkY29(Pf)25gAv{vZ58sS+>;3)d@osZGqetVaD!E5tzrM>}2W zuhga$Nmo(0Ty?1xOf!P#u#gUC+;x~I>X`7DlyS{^gG z*6n-Txp(uvmpUHc zTT(g()G&l16VMgv6oK#8WLrE+rXnTMvLx2sVXb#Td!@>A@#jg&`K9XZ@m$>1V;a=L zeE$K1E(%DDn4fwvCif+kOF+0<8&E}gzp}=#ruiYraCu;j zfx@Kz8MF;0$Sxk}bPlt3R_-7Cvxh%m>yJqe)OHFHfc9QI@+-GVo8j;mSbn0Xsn0+2AGG#39gp8%qo0Iq! zw%{!6_dp92nTOo*K*Oz2$+pUtXes5iFkGhbgB}ZcxqrPm+_z)l$lV3v76l8^4u9x@ zohF8{_J&lBx(1^N;%BRwpxJ5>z=Asnjb%*GT#hV*A*0X^Mz<20?osFA#z zsQYvx=&*iN;9eD943{J7w}UR@Z*_t&3N;gmGad%R9I{7+>gKa2Q8P7ONTS|5EVJHj!SI*x1 zs6N@Jey9Tq1i&jNzX@D&dY7?dUI2u2+9_}C2e znbkgSK&m{RZVt;)QWswy?yG&xY){Bg2*}U(e&hyyhp$ktFAdUv3|pUv@x$PVUXgl_W-(_{v;10?`$;AMA>6(OTCY4IMuuJ{V~T=v~YYvhZ|<5+4!1Ozc}A05Eyl zqN9j5MJAvQED+!@=h59$Is*r!@&_i|eJ1>;6?1mr3P~P&n)N9)u%`OofDaZYBe%WS z@yUh&e<#gND1ULlJ-0VdS1uwS? z-!n9(7VArXHG$Y^_{hW&n**a&8yBc_6%rvLA!y`DUwE$(@x820aLqE4K$<7|KLbnhG0mTngk2I#m`?QmA4`Tq_BS2hHk0R*XfM^(NmM~n%{mcK4s~ky7 ztx!Skdqn3t-#qeP_9}_sZFjm}YEAtzJ(lV%A)1Hn-@ii4dWSL34IXF#cWfft z4TLfnsu^E|6S(zhP4~`=10PvFIBwyxZ!W*0VvVU8nPgSZx{#r|R+x_d>`6XXe|(gU$&Nhuq~3zhH_`%pfChea*h~wSbuvDH}1mUheI|!onU{KI*go21#Cb=4lTXF zSqAQLbkeMYeGHtM6=Wbi4zk7zd>G3LT1$T0 zE=Ns15I6z}u;#u{?^*_5bUtD&y_!hn|30r;zmQz7^mhRbJ5?PLd>m>+U?eB42)W#3 zHs&l1^%Eyl393}fet#uZFj*!ef8}nK+d1RPZxh|jBps?cD!mm=>6y(CG;AX?EjmQQ zV9{e`7f0)fYi9veq1bl(uR{cCcYhfgLnBi;`(I_G_+{%WwY@q(RhsJ+&Nt40-GQ^= zpe1CA)4pg=j=Ozt=TaBmP?;^l+6!3Gg%q>BRbF`y5pjXC_PBTDf{}npF535rt+)^0 zceqe-@8?h2E5`wxB>q$u`|0F&7N^1sjWbcVEFk$1Q6D$+zw$kNOWZ~6nRB_Y{QJD5zOF8=s!hlP?{^%R zj@#5ixe(T@4<_IeNQ2u5aRy|U4;u3xh_1ZxN0LcmCt_r$G&v?x_2F_7O1v>$x8HV# zu)&{H>=5$DX%Pr)#Ur)HEa6H!ac@vHHdG=L8O&&-4BXh=9oCRf_2+u%Mq)pSspQIC zap$WF{6FULt{oQ9^XSr{PK=?9llas&B5Hfwz^3TYQ@5$_jQSU>`*Ez2Fb-g+w@|e? zk=O6YE!vK)1sfFrO(xf@?>0AmSMqpvZgPr^3U9#h*Cw+-#uuDi8rb&uEjN;MY5!%A zO}neE@m3x%yYB14l4@QBQON}90Ng%b;_LyWy{gP~zn%O2OyARb_CC8Sc${F{xF>n@ z4_!`waj)7cwOhcx&!>UZfuzlB*4FkXA~j?8{UWS`KZS4kj%_k_GeFF^fM?7<+yp|n zIe^Tui&IW-Z5@NFTEKdFHtp_yVRBM7v`&b5+Fz2xTfe(n1MuMeNBb;9c7qWB7Is>F z*LIL#JDUi7{|B`f{V4G0^|AC#A;5Kx(#!Hn=Tmg^w)%g}4sp#c1`9iQAQse-3R$a4 z^pLeW3R$akTDaUzspYPVFQ=3H!a+4P(|?+orfhI5HlEH}=4Fj+IJ*B-89)0jMb+(L+x-=O z*ng09Jwrk;|F#PZT|7u&np+c1+ky*s?%TO0O@;tFHC#EFTz!BYr)`@+@`jlt&Gz`6 z_`&b{tf=#p$g=6f>&Ccz14MTJ9*nNDTo)|BveTo0Vlei2wgZsWs!H%nJi{mPj(CQL z_W)a=rMl^^TQ}2K#70~l_|b14T8WH>$Hl2OEV?H)JQ&|o*rav(eJ=4JBbT*d#rqS; z*+UMMEIkZOnL8;VJ^YVRK!!@Nf`#IxhlTp9TDEaH@h*^@$7vV`ih9{bV+_{T&K`!< z!$Nr9I0$=6;tdTbC^7`YzhE@pF(P;6Z8SQu40Q*iT z=7~6pgCdRop{cc^RT*9n&i|zY1w)Z60Go|E`h5(;`ueDUJ4e*cUsgO;m}kW!yGA6R zbdK=$K#6eN+5ck069zV$FOZse&#`3gf^YRMl0tCgTawW07oSTr&7*8^Y{9pLdfy_^ znumYFysD$xd)rF{>lq4|Fps7Ao0>sV2*dujD*$JYHnwd>vNe|Kc@-ujo)Hdf9T5V) zZa$Xa^))tW1VrSFp^YWsuCEoeCyx9zD`XK$6zPjO5yED9JI{q8KYv!wg8fW4o*dEn z`Rs~|5Rg_jviDjS&`+A=sT zj#2G#Gy6Sui20`=NmPc#w*>}Oi&4q$3)Cdrb0lr4=orwF`0xVd^iM>4Cq#Lrs3Fb; zR-%}>cFg9PD-H1Z6X8cP&%0)mW?Nd&40OSI1RaX!c*U(0q_cX1Eq#qTUA2aOj_PZi z%Y&H*_A|%#!ys(nYaG%;!TJr-*`Ij9$}}#ua5n;LL@{NPe0u6zZ|VslFjD#Jn>@i8 z7|$HOzy}J5Ji5_CY34Q%aSkg#UxdF;8jvyzGBBzHknS<3gv4@I+m9e>)j{EPP%QTH zt=qT4N^qL9D|6;f;>5dTntNa?bAC4n#h${6N6IuOw{Zg7fqg6pdljQ6w-;J-C?W%o zkj@@s?1rGgbZ<5g3RZ}<@3){qXnM0N8YQvX_uzZjwo;OURAx~;KhJcYLxqJTINZN?v1QZ7@ia5mQ)5w#s{qg`cOz$SY>JAPy5L(Go1i2BtfU=n~OPYd? zX-JP5|GIkyRLP^wUDK9&PUSZcqyv4yUsI-tG!Po&^ewX<6zK+7i&gih54@StyLXj8 zm-EmZCYbv%cXyKVeooQL$N{LhJEF0Ow!%k{7-Zz&sJJ(C2z=tAk+FqvT8)!jIsO`a zKV_UwT~8t?tG_rHYQ%1Ik)n0@zvQt*4F(mrFHnjWf^B2P-*7Fg|I@V@rbw3ft8bPh z>DJs{u1@OW15$ZkG8(zY_HbGF-x~FAgYnw5)s6ObV_nzYnV!CS?LLAcXIt6uST>xY z#66n#=%YHP^<;rR|3Nsi!!6vQa7W`l;2ujXj2T(JaMk-Ssg7%u)03epZC=lpA% z&?(ELN8q6mvz{am0nb_FUQBEGSE4NJFk^-n(at*0h{nzOLesYEKYQu64k zXw>*+JvT&&?~5=UF^^<23#=Kb%+%zIXkwAqykHN$K5H`woopRtXA#bo-4zRF2fAD3 z(HRLW866mItFerd=PMr|_PpB|@29}Rsr+ky7+~-_-Qje!Nlbr9(FR059!C7rW%;&D zfMe;ywUiIzOI0T>>7Q0ga{=)*D_&4D@fLXTH{@-`#ufW`i5ad%q!D&j~Ij?>z8K(pI@J90|YW6%ir0_E5tOze&x3L@#=$K20!6oKwW!W57# zZ5pEOVxCjHT!F{%ENa)3lRWPU^kIAbs@sfI|H6)g?o+?KT(CKVGQ%+6LyLCk6ZyA| zxld>EetB3E2BTL~!!xOLt+!TEsB!$p2AaWO<_FP*wH^++P`jJWZ6-CV6i}t75-%~s zuQ3hifMK;GoRPS-wcClsNVAU;)wEi(8<-Wq*cqL%4sltCrj*V=`8S7ls2rY}S%b0Z zj8@$EquKGR+_cR$G6>K)L}MCSWqIc3oGI7&XlD0n=)3>m5HS zoH#wL8Q;#ZBh06G+=iVvq!lh;Z=x&ACl#!Q=4|1>-SCM-?kFF~!(L$7-<;xTmQ$?^=BY_wz&?B@m$ z_&4qHfv!I25AZZ~m&eHYlm8W?m#IRwG@V&QbGeD>`k@MAmAYZy`6nAX6RD4d#r_7! z0HK|>&}Qc^u2tsYq)@UFa&*X?YLTTZHKPHU!7-~NqB$Pj!soaGdD9<%1UgN&FW71Y z)@yr_wJY+VCubi*2Xa63H&X}Pm%d`Wl^J51m@Xa!~=-!Z<--i(D^ zW%lTnq0ZuX?WdC0$=pR-(M31;j%EhXBYl&`-?MESBF!K~nhROp7ah{Yh==Gjkg}YM zGXD#Gl#5L_3&wV*aViTgGphe@*m=G}0erdkPh;=SI8rm$quH9S4)T@Fs5A)56jPBoG8 zVIcWR*NK>1mV7c^=)Ea_soeNzMYGn1gxAUQ(fG@}{L)zzC~0;2^3- z6X2eFXL-q*R;V12H;&u=D&KuoQ>k-c(egZgNt?uXgN_Y^Hh_&AyE_KeFZl_wZQRo| zv^YQ=a}EgoUPS)^^%aBq9k)o@)Xmf9bJ+9@$wq0NX60E!@xXS6UQH8m`i_}0>eB)a zI`?-^MCCwC>z~GvnfDqME*F%6p~rB0=t9#2_VO+szDyx1@qlOk{88 z)h>FyytXqcqel_{u!PcuM%#@eSsKe>nbFcjyAnypLq<|^$+pHO2Aplp=D%P95iHL* z0if{WQC8)N?P0d!f1){P@uFs)KshP8UjU%q@uXv$ept;OJO>P@lEFB_It}|SuYX=U z#{qOGw&rp+V?aW5Ko3Lt5{Cs&Y;M5gz-usSQaQ-sK6>Zzu$`!WXZ0wAP!Dr}pc2v2 zSQKmLC?s1QleV?EX@*ll8n*p709mTeJXsHBPAPhZFRMJ-^&0BmO$HY0r~+~OKpPW+ zu4MFk5%h5O6g2e&KZ|s!l1Ba5T>TYPdxV;B^2uB^@>}Dxu$0XhmlcCs-$v;HO%`U7 z;ReiK>4y}-0E7F0<*nt+&Pl6z&7x?zL5mVTwvN#31AA|qA#gkR)tmp|+lCE=JNx#N zK%#1PnET5kBz3(OQm?tdIik_uC9}dB!<{8b9=D&n7%vDopm?((`yPN-hz)sx*pO^# z-uy_xEUagS$-ykmmmBfKesn=3qAZ=vA>|}7w)83*QI+XP(o@b z4jjtc$$w`B4nh0-*>g{(V2i)S@oOc^D>=pO_lM!v56>-ZbJ7MG z_m>&#EKXoqu zAK$zZ(Wq~G;ymhG0eY)~omGP@e?E*+R{UnBql%2YwI7mraLpH8*BImi1%lhmt|dr*iT;KQ<;(!9~il*LaB&r65c?YZZK{Y7QW!Ccs;POb65Fpb)4aB(MC8H;FS4wPwt?7Tevxa%tEWG2O|kYFbwKBm7A z$4W#;5KHnqtw3iMSTjeS8Dm&D6EhwUzGgP4i@_Y@On4 zO=(7ij2;Vfr(|@sA7``osadL?->cGF)3s1QUWkVN7~vB)W2-J6BMDtvMjT6IpmB=$ zrb6p$;gN^3%oxVR&)Nf@p5(b^~a+4 zw`bqSYX-O~+bltKRXeG7Rch~5+zU|_8CvLZwXq+5iea|(WMA~i;&t2A<@&(w7hF^gPCGc+*ntnK0gSQ+L)S)9O zYxK|tkmMeAP5aZ!g6;zs%@BMl6vR)(3VUyOuoAclqSnfQ4GyqCh_lbnC0&2^Shag) zzUH5CJr49|=G>$li}sB~#l(CsXdl?I(v+#BIax4+Wk zW~ysH332d+wKSmN^mFGAB5MgaeHmDbr(=9a@djSz02ync!mn|&8a3H877H|adH@U{ zbWUJ0^5q8uPZd^OPe9Yspc(x_57m!AY(yPiSG%sJj=Y)M3_6NIG+LP-AF$-gA9Pb`&XXhD&P?@xA7g{yD#uYHZeiC$Py%`bBs4$==kU(%&p_4UMSrh}xt`@2YJH z2;~(^L2f2Veo_`z`%+Z-_kHGF^Ne4)sYzN(zVt5;heA!G#{6s^$@SBI3O}=x&h{T2 z0Rn+6tH-*0_#=Yfc6BBpg*!lBdt6_}$FLQfVk9UIcB?f0u+7h5c!wZ*SS}8?BU2 zvBfb8%I(C`hE;44Egl_*nYw%F9pp~;~bs&9svLlmmx zm~iTZcvdM1LW>uIdw!{rW9j9j(}JA^cc&J=;WAqR34E(=ygO_-dvCOs^Odb@esX8l zFa=0E<|q$m;P8%!d%z<3)_;4lt>myt<3+kjH(%+Uq1`U;&0ZV~GBXjV2m)CzhD|fa zD7vK9zjAP3WCUh@WO~gO>ZTYuBwPKx)|`Rz4D?I3H!IP8Pf9}B%tb`m?92_0WfSo< zoZ4&y`>5}UL^2)9a81 zhfY*3ylR}303JR*Y1?~okFDBl#GQE8LqYMEcK&T7*hjlWc6czAEJN9EcTi zX%!2si+fLYj=6Vu78oSN?Zrndn-7evhnf;p!oX4iy;My1(kfPr=G>F2_ zuG@gz2=m+Ec>t5Jgv*Y6!B*`vzc7+vH>dg>3(wTHCH$M43iyG|vVzwc#61Oc;eBVv zq-O9fg2 zNOx2`n96Z+<23ZNq2`?q8$nq$r?U9KUKSW{#tJci`Y1*H(i^Ah{*E?`zT34XjD)96 zqge~nvb#rv!3%W$)F^Zw6=E><1C1_hrhaAgvTA2^jv3cHVzd`8yQzBxIM})8#fVj3 z{7bK!Arh;u^BEYfME&`)R`Od%&&K_>Tn3d6?yiAZ+*eQafMAnb)Z@7NpI0URSR5eL z7c0c1ZB4j0rADu&P_N*51#w&cqf{=4Qlk}H=&;=lH}sai z#GA{xq`Ay*(x*pjG*ni7{T=_ye|o;GYRlF82+6CPA(?k{`P;_0`V0=Hzxxs6s_@8o z4acmMRSc0tjE2-6F`3gZcfukecUJzSrCVuNyc5%lsNuRHe0_6gI>#r|MMnkGOW4$sb z=YzTu_bf=0rq-$eVq*ZwSWl|Tjkfd>ZNg#;rX-sN%!`$ zyJpL?L1LuPX;U~INI_8Y>pC3g|(?zw?4D-I0vwi*+swR=~ z;Z(f+i8Sz|ZM!)2^;7ahTDj`pZ(pMt%!h}T0bjEk45_`au&^!Ipi^OzAFETW)1Qf_ z;NBY_TbPwxH@MbDC43Ndlsay_2%Ay%@7qQiYn2ORg%@YpGD8wa(ONB?!<_r#iDGPSvy6yoTjuc$fM+=Eh;=t@_G&zh-jdj}|JlFp*g6GW>m7gn zvd4SNm1MF|zd_Te)r|;U(7uh;0*@}%1{i>3iRJ+OA(-qKhyP?Du2wKYf)0GS>HoSd z+qoWvvtE&6(;=%B_v-)Yadm{FFeVMn{l6QTz2!6*jRnf2+=H{)7Z9C>Oh;@d#{?un zVQy`b{S90gZ${V5P2UT#dwyC{`s^R~Yr7kYTaHaq{L~r@UEiaf0#7@3I$-SwsM0Fb z4~Y9wrddrx2N+DV5*PVSl@}OC^sOu?nHkifl;EvxWSuc7jjjZ*qHekmg-KVS_&rIe z;P@9uMdPRS#dLt@rTO#2_0KhK(Qe;6r@u(gAxg#h(e9;Ed?2Ky$qc*CD-u>@?9&Y# zsdl`Hs`^pmJP-8!KA`g}+L({{ZPfom)jLPW*>3;CjT$sfW81df*iK`!v2ELFY}=UF zwr$(SJJ0WY&(rh%lQmiEo;Ca0*T!e_4np3wBco0aDTqyKu|g!y0if&bE`>NYbA$b7 zX6(cuV>Z@=eUfA{dB>D+LB5i=4WNeM8)epvn3h|pj}H9AhpH)WIr+Bp!&-Z@Jo6?5 zMObQpmUFdnAs}?Dt-XNr)g|DnaCF+#psY^j?7RW{tCG~h>*I|TrMIghOUXE=8w*p1oIftdw6k#;#!JQn`~W~~e2SeFU&??HUuyHNev&-Ye!B?Q z9yL=ad8|%t%pe$0avG>@y!verTbiRe736QGtjA#vcEY{{qmVr{j9$sg4OuTFh`0y- zTofTFPQEyN*zH?BD;wj;@$@7mz+!${M&q){{Jm@~g~_Uoto4`MveenAsIsf@SD1yg zO7pI;LRPLmhhF)Tkv>_-yjuEFH{T+yM`}EW52%4L8qTe;gKIAK=uJS#;N=##7v$kJ z7kG455y+vw9+R#o!{jJ@90__*!o2fjdHZJCbJS9AU#l5e6Pe)Nqn;sUB{UC_uUN zc9fUqQc&bBG;`+u3cipqou4P|ma8x>hoMrscoK|F|ALsB9?Zo~;%0k$T17XX=qCg- zO&X9$SIp4Ur=bks_?$II8ewWWcGyoY|?JVt(aj?yaa;#oEar_PVMvoegY-~Qd)|?FvlkaN8I;T zGtLjl6MfSDIT40wBKf_1}yp>Wa;K3LE6Zd+RvFhbr7^aKFQ% zN{4W8@8+CcZJdAczb%luCx&auSUA!~Zsd#CHe%bET{8bPXI+urntI%2TauRuSzwF* z^84o7m;TQ^(WeSrIz-QB$p4M!_$1LZ0pIAO%^Y_LHXrJ4>&tKpKf3x)7y zbv&Y@nfreP`^9MwdcuAf=^w%FK=#KL*2yIZ?YLt~_DwQ%rVUup?f1?Y>HTfalQ5X- z2nv#DUUE;f`OBCwf!h)(xg2`~LRryjWL?%Sk6Ql4sz^r>K&f(XY3K-29Cwd3ao6a! zCtUDw_1kr-UoEW`>^vKbx%?!1%ERZ$_oG^VE`mAVvSkPI7oio;#(o3Z5;UMKp*(@Fw3#Eoj4Ng;iRju~ zBAX5UaAt`{{c}dI)w$8)zpC(9eTcAzLk~Sw^Feb^8Vu zcOMocE6?ROiP1RS+DavPG2%=UocmKs_*dBjcCF1ts@5AsjHuMi;lV27*sQ~RMDfgF z@E?hyB!|L-jy0c=Y{gp%qN0wisU*r$)bZy-T}ZWX-v$$$@QR2iz6%G=w%Y(ROVK8> zBaz^;j3`WO+-Etqz%x6Q#RbAVt%eG3fr{y2#VyT6ze{=dQa^s~hFZChESfAEo96)g zSdX6WeIz*AEE}k2Awg|p{%nKHq$lc7qUWrk=vjIPUp|u{7foK@zm?-1t{dn>z#ft! zwshdraOD`kcaERmS*CuK9Gsb*wIpDPO2!tjUe?~u`^t4^heVJ>9e-GIphxAmt7eojF=1C@Yz?D><#HOY2g)d(M_P`(opRS-y(SdSC!8S-xQ>&ESi87$Pt8E?H*@y_#4@+HZeSskOxOds^Yoq=b$1x( zkXa=)>GTPmJ?R_;@OM(=VUtY$7N+=XqPTlqX z@kQ8+e@b2AMXT$`pM@E8v-Rs7QrqEh_+j*hSZ$QT+~bG0&vZDH#)?E&?WVP;cxu6R zm(A>tHt}ZG5tR*K#Xi=tmh8$ybNrC|Z~*hP3>e|b74i7<=iYtpnWOccGYr+LE*MnRL_kAqGJI+G#wIr@cFW&VZ^!;;H0JTJX`Aospn=_jb>g^rx3Clej+BOI=8v0Vr}2X?8s7nT23W8U!cTjKKcwJ6BO^3Q8H&{S-!ax?_{sNC1_$!^uqH{b3kY*1RPCbX=cp@jwYEPa%5gYP$03QA)0GK zGgZD(MPj451m^6fmCX=2gmrpI&i?>9wZLWUlKC_%f1KxR`vysMb067Z(>2> zuJw!{%02d1uB`=s`hX#SddG0r$hX`%SwpGazNkrVwg>bd`m}jiWD&b__Hlh4f~Py` z(0^@S$n3O4^JGEdKQ?bi%E?G1{aZMn91wv7n`+>>QT#sEzCPU>nXC58hPQ32={v>*;rdr>*q2fyNO^SXMiF<^6_Dr>ngKhg)E4-Hj?e{jdVe5G zJnkq40XA+~W??>XERdg!*@Cdht3-f0M{wFoA{)9Hgy!a`u72QuIYdyJNhWYQ)k|>f zw|@L0)bbN*jqoz)(A#~L&vJ{vNB&ANeNi5fO_ro6Jy43rQh-v-f%c0mdnH;QZn|+4 z8X~`Bb_x#t^h7~Y50(_4EbCh5tKz}T?)vhb3tG`&E86s~RyywG&YeqA_TZ}c$%{-6 z#-aESH(x!*;~pz{C~8ewL5-NfZFhM1?C#%Gmybj+?jc=l7Fr)>X_#qO^B6HiORnIy-L? zc9g6s2QV2ArFLzaSA#9tOzc8mLMd&o=)lD6Q*JLT4%)(*4%fqzZ)qpeoox@=BQWm1rB6kZ_$`0!sc z@Fjz*&w0`G+<{~a2{ij*{#-E8Qq+hXg{4PoOU~K9%x}Z1QV{}_;^j8odBhvt7*pn~-9d{7< zH58sjP9uAYT)(@(v$@A9KH!}}-1gfjn-bQJ{31-Nh%ux9#%STJ_f83C)Utw~ZzzVo zLiv;)VFoNg`4f(4wHQM|N=&&_TzqW*bH%P3-+g-UNJY9u83#eZ2$VO5DI}9%ywJUs zeSNh(ED$T-33Hhm7A@V?HLjLj%h2Z1SkxEINXD>| zWoL)k{;!TNt>&b(P6{(+0d@QVv658(5}eNXEMv+B+$waTlm7rOCgX_W=_(mJtUQg@ zYxHx@r939eTIP^**KSAYJ3Bky;uqqTvnk4XKa7}Ag!`{Ijksc+OI1%y^BCN7^y;8) zTtS>_9e##GfXV2VsB6VgxST0hqxWD8#1gfBd|OtPm43j?g|Oytv_pwjc9j*9=9!!! zzbQDPuh_(2sfh;y$5Y@d4_h_AKn%l5v#VhKYb`;T9h+w^>}?B*fFZba0M+~wtZ347 ze#t?eyL4Q$hYERjVAx%%)|TkR;yuO^O}^cN__gF|y`m<_#&EOTVeM}@SgsAipzDUt z_p>{?l@FcrPjjO0%3QfgHuOc+19udx!`2=11P4W4A<(h8Yn;~G0W!fT8i@#qE-M&H zKZ24KJX@o%bF97a@ysn|Inx5xfs<7-XtC8L3kD!*Zs+%n0seCm!PXHb7T)Bzh9PUA z%ec#~jXG)m%;{I_Y&oT8`J- zoTo`^yeaaQR)ikTtjn#yHji0aLU&-B2LhVR!$le_yW%VrMs;yA+6!+u7=}AU=%I+$ z7HH^51QYx6-_AAO2^XB&rbkV~OQ0*;f!&80#IS=WQ%wlKbZpMBE1F;uF_5?#vsc7{Ryx%lkj{c+NW$JVo)Kh6kx>1NWR`tDwBRoYE} z&=oMo#`aZQwcC3JNZoM*44)cnMhju{19GrZv|GmDI`YPSFJ`DV_7M*H_K2>d?R1B~ z7uU74o$o%`FP^n$YD20YBpep#34e%?vK@QHAE2jny9)W7_zEmUBRCL$gRVaoYkK43 z5`XpGOdR?mc2|W3Vn`~r;a+Q?HHV;IP`U!$p}|<^xW9kibN# z2kRpKPc<1IEP_*_OvxDCYYGkZu*k*exQ7Hn$w+|$X-+yI6d6WJyQg#eLkBk$kdE}tQ|>kW6>op)lFjSS=pa^fn%@G z(fVISYCnAa{1Yx+VL-BbNIhYyj1TiL?v16&Vdp5nP-oANKvZE^v?# zcGF-k!Ts&_$uJmIVBwsXSr4I-wD2Zn7aMw zFIb3~EhWFkoi|}AQxIO8? zK@MTS+m=B=exO0Qph1HdFDN#(kKYTrM=Ii;Xav*R@4>+-D(OLiquNUQiJBtj5;ydc z538QsLfiu94wfFc4_+Fpcd6}pek_08P5qzpLG{u!vCCwEc=DbpBDF$-D<&!(5{Z-x zA`_(o1Q@^7mr#R=Tj=LUN5uBVo=~^J7nhN++S`E*#|qw(*|c#3d9qB((i6iksrLPA zv$XSE_%2Nj%$6F`+_Pz=3XmRL3$?18*~?!}!%vJd(93A$=m$_i#tud*S^$AmvDlTO z7yZVYwJIkRN4)j41?4iRE5GAG3YYdc+1Hgw67ou9sZIl`2+N$e4!zlwHOH#CRYux>$nun`Xu6=T$o4TwTo9{UcUd0cZE*&)78zOv)01{bxeN2ZGUF=Z7SktsAv57Cp7)6;DWpOCUTHZCK(Pu@cS! z88=QiE8VHhW|jUz3sLy#Z{0)*RIWICEGwrux}-w15@=5U3-1x{ivWiCA;_C++bd({6rxk-@jp1pnRd2yEc- z0l%3L82CRjTk5^oyOdMH3xLG4-ZAf@F>qsd8dGs_YYuN~2Fa@YuvnJSIzijBZhq+-t%tFeM3a%EA z2OZ<6ruL=udA#a0mde!Z4r?Rf9345_tjhKtVpvAlX&yjvIzwamWy(v$iz+Os`4NE&N(xWr>76yifc*p z@;t*G3oyMIldb#XRlgi{GFff#z+swyy#)2y+beFk*BN2s((Yc-#@WhM6b;&!ymfQH z6cz+W{;5bn^)#{pp=pAutF{SuiJDpGvV(t#HinQtKkp(0xi+9tvMRHbMuN5)~C zLcjk$)*TCy#~F6^9Kg;{5uRqY=lLaKc0VN>Ki#j~c##L22vqhq5qraeL=+h7^8e=^ zzAv4G8$K22N*E4pEkgVx)@+<+!+1zy_;EW_qlOq7;3`jv5E@K?6h+rIcIanMtlDdY z^;c2gONds1iqiOxq6iUUuh&cIF=1;Ju4Shp*)U7DUV}$rvd7q}JC58EDl6|!CQ=au z%nEa`4mEt8zFu@s3~OcoPy#_|rR2BFsl?G`%z_oO&q&iNAulg0IQcL z{0YelsTryGN@n}q>fl`ao2Der{QwQy$9TQIkKrq5t%Y0A3D(NfQJ{{Vy>lt($q}R> zb40PR&WUy$SrrG(o@{>G_Ks8=7V8q7qr84P`5HOupXXdjdXx}MLA!Cu9mmH$wR1>O zhhM41HC03s)rJW9n$*xCzY+8ih9d2SK_vD4n*f>{wCN-Yz0Q(EWE!4EhAqOLmM1y( zZ3ez6nOp>%>~*~ur}SX8Em#6LP~DLZ_gXuFb%ojmTYdF{-z~V~=SaP^B$NB2$2Fbl z^iwNc)L`?wV{xVC53eSu?z*gB}H!shBdPEm^Be0qN~9IfxgNJc_epVGT@S{Sclz6B*>9I2l2( zGnvE!ES^McBUoTd9{eUDI~ckiUBs_vsdcT>(^nj3tlCDzzr=wQ=Wu=G9 z@37gg$eIy5+qe>mt|u8}Jl<6=p_=%fLj#-w*sB2crwC)x7UIX>5+3&@xy#$3!j+UA zGxQ|guPZs+5TtNuS^c2f-=Mhs4W}>q#~=@bY%ppo=*?No=9@j6iH-q=kDu|@kDuQZ z0#GOi9rQTsU1g*8J*HN^rk;RjwwSrhnFI@ ze`7&tlGvg1U`xJT+FqdG=q5~WXWaeWyYXpou%GWkcn1%7u;8JIGiBIXa-4}=kp*}L z1dBe1pS%Q6H%x=jx#YSjtzy}Iq9Z%>2xHNnT-tlFSgr>KU+~bt|ISHv4MgD&dDH%! z0s@)pYyF?_`@TH`DQ@_7Tk9@&+(lV^*BuG+r;#hxyv=nhPUViq!0)vPTl*oNjll3?o=djTY>3*j757S4YJ z?il~UJdZo@5rjC0+CnhE02JJqjCy)#UhL`+KLQ1ObLF)7tu4p;MuWcK1HoApHiXK< zLts1pMLvd9X3PSFLAT5D4|R`EDEEZr**6h-&*;qm+icw3IEOXgC6w zKdt>JY7gS|B-?m`FbuHZESO>@&OH1QVEKcQkPEdn-op$0om@*6ZkR}~w~~IZh8G>; z!dO0|PH)tg#4c++W=dHX*n?(s2x+;!#}w#JgKjrkUB0Oanf~&Av%Jq+wN?@#vLO0p zHnZC9bCacpKCdeU3TbtodeCA=3@`Ovz8Kt%Zq$u z@fG!<$9#*4X8ni*?r)%auPG*#MEkp# z1b;(}kd0}m=g9(uR3PfhMT&w#1f5TZ(J(pjFLq*i=O;+fzxgRu>c@!^K&fp^Lm8~t zX`o_JdC`XgHQdxu%X>M;1JCc6;iQqvM(oCH%;PQ#cP?!LWn{$(R$-m7_k?! zsPfZDQ`?q1n5ulfRv#J}U;QDLA@0H%0mye#?(dWjJMR?+Q?;sub3z?Gj*+_*gbgk$V0&!b( zm96IxhnWS%&D&2AoK0^rgRRY=%477%jb8b@LB6-XPo|DsO`g&{@Ky1B+>T?0!W@O$GZtmpIkw{qiyweE_Rn~9L8r{fil8f4d2l`55cBRtqb z4RrV2`jl{@0OPI7hc<+B;|kMTYme8tc?DwZE*0%t_Nhd1KgObj~P#Q(9EZD++EKzsT8kG-U$m>+uD-ZO&1D}C0; z{IFe#<|i$=E=lsRQjYF=yNI*+nkxd}pib*wtGwf6ri}kodhXF7cb3?1-!DCg=$o-j zBr)lvt17?DjW-1qV?EAUD!a1#cIGTSzrqUe_DB_y@K4apj0|Z1T5_N-Vg$F+tJk&xUS^Ic?R=)$GY1(M zukzq-2b9!#`J!z?t^LwjG^+g)P)!S{#0B%`-FnIUNX1(zm_O1@qAKeq%F+p@%!z!o znmPiA`qUF`!940}B$K5_fOsK7x6M$$?yf&a!TCD9>2MV*nklP*l- z@+d;YI50(pN?CkEkTQEhLX=vox;W2jgWMdX0MvY*a|jAZV3@vptZ1?Im|qu($quqo!7FuhQvHh2XQ*BQiS_v?rbBlVKm%MS z`~biI7z06NVTA(2tZ|QrQjMbJJ7qcw~UH?%WoY3o;}2r%qy|<;r60F>cX1;W>^MP@MD%XB1@8#mv%$HksSMz#mnFi*fPpTSJk`YOvB+G>^3pT$36n9+-?aXvtT zgB_KBRrvn)@2$s*Y=r1DOE+)v%2?zb>x7=m=eH? z*q|NE!Aq)~lI^D4L~MC|R?#Als+QOG_38QPc~pJ({2fGr?OgWYu3br%U1@A#8N7Ld zv{}pqcs-iGigL{Ayu6TpHA1o*XGr^;T7U|e^a4%?Wsa)F!2Mh&dQ9Yxz^P%IuYlvx z!iF;6(Y83T{yHL`x#?x_$%49n91*^}St7KLP^3}$7VEsKWnD+Y&EV(th#PP|gDSjb zwUFBkGsaPC@Y^{CmRvx>hg=bewZh&Azu~8<&U2=rrh?9MDnl5e%TaA_D-`Q) z7{*^VEUn3p0ojoJ4;xq&S!_vlZ;eV*fZ4|ZU9-K&C5>AJ{#i%lQrs*O+^MzhgvF{y zPZf2L4P$gOf5Gf}a_MZpT>GdIyQGA-sS2~%LNCQMO^~MkY|e@LuOiAwWj?7&B@w94 zYA`NzX?k4pI}`&}2FB(Fpqf}nn)#8yxbuAvWjwv^eEnf*1b_hE3&99N5M!$q8_fMp z4b!lC-BAk_!fQkzleFhHP6+$}hXoF*xJjn(PTA%K>k=J3l#p`}r(O%LKyElO7M7^N+lg7p>p zw8rClJCDQ$^=Gy{?5IHN^w4Uzz`ri%C0q)0kKaQ2Qe z!5T^h!TtN|qD-q2-ukd>?35W@xo9W^x-Q~mM36__Jp)K(G&JqZpj<^(&WNQ}R%M_( z^+WGII|#vGXdU?k4nhq*EYX2$)F9&KpVylqV3v09CnBWrUf(|ZUzZnCM>GhXDH#O} zv5EKcDd(j4WqSG>9Q1<5pudaa$CaA&e)@24{qS%G_lc2@4~qOj$y9d#>r6-+o6E6N z1=MBc-s`zlMx(F_4AK5;|KlFIdNQ-4r-<+nDfzB^sE%DN)yJ2_?y7RjlwoNrd9XYf zcEAXCigjNW<+nB&#?^5Zf;<7O0qnyB??TEY$`{F=JTET~*kd`_x_0?t5*+CT z&wI-DWsCwl*laeb4*EjHEH!3g+Smj3sc)1U%?98BQJu75-ZK5WNN}`00!%{8DLpTb<4zx*duA*7A6t3 zE~LK(soJNA!dZas5Su`HCl2|q#tkjS=7WP5XhXt=Dd>B$ljJRl4RhFVw~%5{8C|;C zrh?f1zlA|GWdpE5LZ_RQ)7p5|2QxcB+i}XP%T&UGDcZnxq3uq-ui?3^TUjjTVD%1I ze{(0%6MNg;+>-ktlM1*(S z_S2f6o(n>Sk(s;nZqKm-`>i6CA|5Kwe)g{8<#Wk>k+dn6SmUb7=5j?w+!zD#`m1qy zxpblu#jS!e3F7>``{8KA7xU`u8UeZk9cU<_;RpE?0NLr>$oXjV^`jfq9rHD$T--YG^Sa;3y9aO{97n%QUeUoU6-q%Uu9Z)EY~qstWTV`7lwxlncraHW=6r)W96K(}*__xH<%O-Qcx=CvI@Y|UXy3@kM0=J0-51;{Lf28cLNu!& z?*y}JG)|GnYPZ*p!G_=zsLhc!Z`ns%xGd&gdHZylHDARFJA#uSwDAEa|~ie zf;i^rhV6PMrK2v6?I{XJ(89h70yf37?ptpxUg{bXR$Q0`Q5)=hM)#=O~CaP8?)C8mVB zUQ9`(e%;fOKt9WYs|eHCR(ygyT3V*=1g?Zaa#k?SAklMesTSG~5ls9Dv&HGJf%+yp z38#h*gCUY4<}Xx2T(-mL6n=|@Jqn(K5p;k)k|Ag9bkxU4A|*7?GzO>1JlntQ8~%Vn z&js6b$g{Zw11$ICa1q4tJ~U;m#e>XNTn{xyU5_s|csoU(_Qu6EG$4tPWmJ3qL@u(w z5jaUOxp*Q;WvR+ku#yQ3!y9ihczv-Y)KfME_>7RGPoh8A%}NtRZR?!{CGVk zs*>#iO9iG1L2@1H+c2jwU+OexmMniD*~;qjW$?ykGrhZk=SyP4Y& zv2^0TYjei0ANQ_PiJvdZPA&zFXF`}Z9OuZ$erhO!Nq@3Rf3IIZnz!bY|5btaql~rQ ztZuq9c4JTkP*Rs();@5Awvo_hzPWfYe&nM3a#u^XQH7Uq+#|(37|fBC$*EFq{9RzP zO`Lei)o}LXw5wi((34&?;2=4?QhLg8;O&4;+StFh0}=ZnQ4{5%zv1JcWh!wh;H6EK z^1UGwrZ_!+RTs6Fz!(}yA9V;n%8;rSDF;T8Ae<6WPmM%GA&&S$u>w3e`Cl*xIE zVd^`YI&`#TM_W__%pWQJL94f!mTM^uoU2%mWBm@o&d@K9?M%}pk+eK&gv>;_fk7hfv7!y>|Y((7Ee+pB@GnqV@le2-bNGSTRk-Gip7_tE1i z=}$+UmMSd(+gGC9xb9e6=%@(E%CLxC_0F}lQa)Bm9_0N;orIo=bh6+U?+ttuZNI!- zL{d)L@45LAcc}O>^@87t3UJ(%@(Ee(604PdZnt_;L`C^e!3x^L?#mP(N^(ux4om8H zYadAl59Y7eMtYmsshL)7J)|x6_1Z>qdEGW;QIu(!N37a+P$OFbyjy{gFzJUf0B7iQ=P(tF26l zfsLHBmEF8on$2E$FDYv=A#0Ku_+dr2F;B{lN~@>89fnUcLrfWPH=-V}!H&#`6)lY4 zOG&Pr9FWMxVD4wIjnCXWg)Im`I&s|r=5l%xQD45wjs?bO-StWBW?>x&$Z~s}JzDHm zabJ_Qzs%uo@9OVM4Brr~ZZia`)@^PuuOBz4H>lCAoK7wT-febraA==Jux(<)v}^Ek zG!zDM%p4ldMg-C!O(0JWO2|vc*qTqhlPT0&MDC?fB3+0)lB%o5YD)i!9-w|j%9MtDsK#}xl)PerK`0T8CWTB8%cxfSAXg>La#N< z{4B-I*S45PvphV$N)(F74?A|RllNRoWzs}KmXLyEfEWlFHLIssSt`kE2%Mg`&RlTDVlxjhX51oI70$gPNw@A_#26o z*nCs-Aeu@?i^rDR=))ZtMGl{(5ugZ+w5ijuWh=J;@DMS&2Rd&7H5T33kyqW(Zzry1 zDeCOD{m|=nK4Ivx@%xag(_pZ55AW;Xz)$x=RLm1R8wT=kfT2;LDhO>9H_DK}!^Dz} z4AMX`BdrhxYo#*!p*CiF6Eks}JInxM^i%_KX91oYr`$zE(w9Sxp;3qX?|VjWFU~8* zW6F;7-IrE3j9S%uMk~&VpiTB{{yLa_50z;F@tNaiK8+{c*wxc<+s%s(buTyk7l~4N z%e6m$y!JZHC#Z8SdZfg&#jQncY&xQ9iBcrfoa#vo(xtf{$SUn#UO6zOE~WdDHaK)7 zC8W1t?$36n8bvY(MhBWnLbFc38sGJ{jFaYxdMLQNmec9a85{&J3HhHno2jMI?9@bv z7bHcv6>g?vYI)s9z5lvuAKlVzx+R!wUsLY3YBWen>Wwu$oLV$k&{j$qc?4H}hu>C3 zA(WgEGR(pI)ls!dnV0e#919 zSs;i(Vs8l;_!bf2KP^*YwuZG1t0UI@lEb$53>rkm=BNk4#Qp%Y!qhM&XSPephiWIE z1|4`aD2$vWPi=^D3?a2=L|CDyL;O=HbUnOBb{#m@3>WD4f0pqmedRY9GUfYVpn$Db zd-{r|EZ$tITBi+<&Dg<;^CBI<{k_N0R*G9xmPzd_RX@RAd1m{HfkNze{c_fxRTKR( zUurRag6kF-7bQs{6U66Ewa7+l@)ys)YsfH@6({YV%D|*h(ftC=v_et}%vf_ug z4&h?2YxfE%635mee5@eit%Xq4UbSxPYf-$JtO;{Z+ttNVK^>&|LmQ&0lMG1H49_FC zM~N2Pmxb4DRhtoG$^xg+X`g^;z8+SPg;_m-j>R97nzn>Ny`RgvM|9)yEcS9L)?%Ml z;BtcP5EPzINxD-z4sKpZ$?dWX?9K z%`VWC$6E6I8z=Xp_X^`2_e zLWSmj!~j=8_cr*|Ap=lHA0U(8Rrj(O3BA<}wNal6hE5of^!8B%3XfI6#c@iSi$@8; z6j@Q91^*kP74ocJM z1ZU-aRjY?-#8nWnAPKWV=b?RudVbRBVilDm!%#9_=UK+!T+Wbu=zo8F6-*B#Co?$t zP*ot45%Go+6H-1oAs41sD1h=__~5xDCX@|#QJX^E#XF2-?_c?L*@%rPiWs0p z*MOB?vZcFCpKZs=R7~L6V`Jl{$^6~>iuLXx-TfFOVA)lt+!v{RyvdFe==Gq}it*v6 zPySy0q_W~*e`Fp-O`i5g{8iR58&`^+V;|X~R(&{;V`a%)=Zeg-C+kz6=5@5jVPyK( z`nhQxH}}!{N0~_P>+9iSq4#Tjmb#X|ynJuF`dQW2@Vf0EZe}?- zACx^GFy9IlMd-C4^!7}CQpB-OoyM_?1w;_aCdhNZDYHM+lH0vfQ6~rei!7@+{f-l+ zQ#-nJ2)2)Cf=JJrlipE^ZVrHdVyzg%Q|q{TJ6ZFzmg%yJw1QV<+r>gI@LvGMMdLOt zty}Ce!$}buOeIt+VhK*RK`$0jva7bkqSLs8g_$&G4Z2v%tK&s0EB}WFK(&ud=9XM5qzI#t9e*5mI!r-K$+Lg`-dSELbnOAxj zSW2-fl-NgDAt0;d#f+O|l#Hx*@XsT#|J9O7El2P%3L;NW-&O(6h5uY?E0v6+^u-DF zDvpDOl&tsp9~54a@*K(a!p0VkRJq#R+3+@Ly1U^*G*Ge>I`r9C;z42>8fnb*)#svK zyXS{ly~RR9bAREn?~d_wJJidOX;%>#E{=?Vq3Mq^ff}c09+bNXaC5j6%TyErc>!%9`g!;tP9IMk zr_d>;|F(=~PBL$~IxpbMX9|<~zGC&(p0+xs+sV7)yWtrB1y_+R4!xkJ=;UjcQ(RMh z5}=~CNW3^3)fnRT^u@U$w^h%LAVH+h)GyM+Md5YOv7v5baf;AfZ;Qwr5nqrp<4@`(H)D77)crXB?SE zV+SV&Yww>5zsW1cen#|X60M(8ITEql9KQv528G15Wvc(*lT#gbkkdJnkTG9x+C4RO* z)#SfIFa?Mo;^f?oh$Xy{*=Y-AA_K{R=DH9jy9Uk6p!GF(CSEsdck@!mbISV;2>KT8 zm-IkB>E_W&z}aJUxnxCmwp7=RDF0+BO~V`$(P#jPL9>Uy%W-#~ObInZEt!y6F3Dp+ zrc7w4HYhOAao0vYMrcD2rx!~8FAijMBF@Dil6MEeh}}3t6-07c8#UYmPaik@&N0l~ z1iMl??k1|%pDCQSeZ_u!Qox`~mL$AcUh4kpXI9~)^d1GbE7m$SR%aZooBxe8=fyVD zGcTjx-rRruSvBQ|$DqMVZ$AryWWl2lev&Tww9(1*_Dgi>ao0IavWZWf9jj_RlsCmc z+5@gypR6~nKM;y~Khp-APj?a)W{ui`_&YTskc@}#=37DO3J;YD@bQ0@2f;xo93v?- z%^6&**D3rTt{I75DadcD;Zh@+dUW$ttM`uEy<0@Tt%fALKU5QG*%Y-@uJW~&-&R!; zYw%^GEe5)2PN~0@Tg5R2>Bjv)<>=ArzJu}3LywLWDWHxj#TK4RQn@= z@n+Nel{31yIKi5E=AY^mpAV!W_ocFJ23OpE+w!T-LwPd-`Ia$TQ_9d=IuIex^3@L8 z%@GBPkElWM5315WC5o`z0ArY>ve1R!3dS!Mf&V(TTPPf51E+?6z9s_oj~{UlNZRM% z#U0kl9Mvgg=QbK$UvBHQnyCBHh=;@K_Vprv({fim+6c6h%aUsB#_&l%m15$OcU55+3-sy)#Q*X-)BaeDqOJ`1g+B@crae*a%K-Yw&XE*z&C&6rK~~9} z)!{1&hwqc9W%{0~$~q+7mJ098;m^?*-0gVUS4)wa**t>PY~G|MRZNdo?&D3~Yn4BK zMDwu7D^_iP#6N)Ii6VRFNRePGGGCx*VSc20qvN0~KAg7|@~N#)J3AHJmtb^^mn{Ez z#)o{o%AU^fdYfsOZ8pGrjx)e0cMa%lD+vtZL@jq6t3F^bV2>lZiqml z2$MSggc)?B*)`b(Csr7(KKNIJG7XMRaqG%hqA?b@|8uMw`p8$>{&TTpnJ;;?TBvQ+ zqD|qdb3-QbAg)AswTYYam=0{-h!MGv9~>08wilJ$h~1O9QR!(+@JL3Mp-#kYGf zgD88movffcyY(9+D@TdaP=$Pla6?y<}tEn?XDNf8Ah54iV&71~yO} zqq4gchkVvO){Bwgi65&8CHpg0COI<}^_KtU>m3xp3ZaH`Qh;`X@uZDDf_q7Jp}v=g=G zrmkK~A@Az&kw@7cvf_@;Y5}di>6R{mcNnky-w%A@clMlp_Fnm{XYHM+z$=vfS=^#j)a0M>cQ3<_ zl#Ib2TJqRG`T<1^$Lo>#trn1w(NyO{*~ZiySGEzs+Fk*yyPrC1S%~K&$hf*6Ma;BZ zY}MAyx0!s%8r{uzuUw+S=;4>KlUHv%|FC6gd6B)9m!isRJ(B z%cDaO=dUoU6pS2f++l628PSWGN{GF(;B;UM`FPr!UfXfxc+0ZB6( z9y9Kxo@LV={PUTf5oC$xB#w2d_VNNLT?Owtt%{2}iehm0YG>%Llloe$T^!saYe~BV z7WM)QZ$Q<*xOmjZKbFEG5c-SEy?vC1`kvmUIHp{sw+z0&Aq>8DJ&Fe+vm}3z_DFA$ zVDIVvB{1xQY|Q?p87J)n_I>}T^~2y7f<8aznrtUuvY(wtoV$awr_o1A?}z+}_b11@ zO9WDxwlS|;F}ifUJSIq&B;#`i}=4eWf%u%OoxuZ=5zuZ4x5u7 z$G-o~HUckeotw)ET@l{fAiOZe-6Y$&5l*cEorTgtqG8|Qz*@rJj>6nQnR9?d`&tKH zu~DWbm^H%|3ubJn5Q6y|b9!}WG717QBAP_hr`x$4RN4o%_UN zdgm|-yH}^E;+A#sTE$PZ$N9ChdKvGqYnG|beO{{npgynLXw%o#j12_0V4Ga{d~#VP zWMT7hBPxxHR_+YIb&E%$MCTA{$O~dMX$>vrD54tnSgM$bNSg@KVfcf?k-M#8xRp=J zo`L!DVWTTot0vZu%k_IPdU#sObyddHh5UJllz;kB_wUzzk=9ks3evzK^XUP5Z5(_(7Oz2FqnY~HkU z>ists9#y<`r_Y3EfrHu2?)*(EGAm!=u)Q5I8c*vFT#Po7ztNOh^Ns|)4N3_5*!Z$w z1SrZv&`w`dA}uyz&n)q;97RXwOLINOa#?EqsYZPibt~h)-rR*krYA_Rcx317-GOMP zD1k(Of=M+8D57XojsmivaWb;nnib2M3Q*G(C@{YV!dXj4Z!z~#yCw5U91QDsu7<1e)WWIB49p zt*!WtQ!IbhZ1`!o<1<6u#rnc8p0Z-*4y6kD%lnE$JyU6ZoQ>RWXpv<(S6ksr#@14K zLh@=THy=Nz>Szo?-Jtr8DV_M1M9v<=#m7!f2Fav9_Isy>c(YrDSQ3gjpW($))66@# z#LYpcF?lVSm6SYVT7-D$Sf*~G)Vucspo71bez5rPC#)OuUNKRyRbPrM5>k#HjKj>v(%J;p%b4H>>#qhbg69_YLJu&##AR>BUtFN)mMHtQSXhgeL-#+uBmy1ux-E2x^BTry`jQXierCPT1nGH`X ze6SuSlMwcF9irFd&8a_I2%+u8u(m>-mlo1ujb{>RL;n5EgRl`MKzBwWSswAPM?2n& zW1?XTNk(nu=59a|KUKc6y_+zmFe8-1G7Bh)1^&WbCK7WLa6d*y!>0Iy8vNcy!EP=_ z3?av-eu!WPj)R%fd?-jG?d9G2<#ZvWIV ziH2(@iX~d*hVRNcw5_JrEf%~sT5M6v1zr_!sE8=pA00z5Eg5mR zk;z?o-2jOPb0MUW6x53>`z^+U=>8lRNW@zf73X73vfkUq`?x2;&4i(w2dF79ZKo`bYjQ|&6Mv_E>kBoaQgB+Kp|fC`J=wUq z;Riphix6IrC8|IgOc+_)fohn$@Q)n^jUkhVJ(^A3S0{8FX;MMf&r!(X8@iq%OUxvzJdm&H)nbiHCAvU{n z*-@jnl|Pxu)+5}NYM$AV8j=h*tDo!o#+>RO5Le=8Yt!Rk+o*OHF-t)DCznXm-7(BP za&`LlP3*;0rk)nth;RhP5*!G{kX7yJaqSq!@Qj1hRgmNv<*KtXq778ZgIV$3^?uTO z*#D@?l9?u1%{^o7%3$*@aw;Z8TkXkyC2>`TWe(tZQkq$^>&DlmdqTnv-!PS|2ePj}G?gDYzZ0H3{*IR}PpK+h>#6WIYgHW~ zfV9*C))N#Qn{&9^CO8p1G4%KH6^pcf({d*|V=^iDHJTloG3~Dgb*H~Mr!8ph<<{EN zJzI?6X&&0#D^nSWeLoOdx6{2?e9qhqED0l6>}T!97>jYpsEN(tog?jq>beS4r%gJ`*XGIx+ohcC!nE-m=BME`R5k8Nm5m zv%y=da6zcV`J$qK(Nz7wnARLP}a zO%~te0qtMxVDxy9?Ahcs8jbGc_ej4x9M`))TJmrP^v&4EdJmNLEz2aj4>n&mI*0HG z|LWc$FZp0y!*VCaisj*(@3f)PC|dMloxM`0C_PA^y5FbPcCj?8;b+Ztjl(b>@d?U4 zU4$sgF)TO1u77rVwnSo;Dfg|&?T~R2IDPHZy1aLHwy%4OP+QEaq`7{drzgzq@7)v) zmibjHGsL*%7UJCSMm_GEWQ$wa)%cOIUdzYm4k->2x_&iEl)mW+KkBVdYU%;yHRI8_ z26c_TFA_Q)%Md5rWc*(}prlJ3&YpjCw*#iTtny7ESvqFCVDh_?gk6P>ldf@#*@e40 zhVD;+uCA6QdWzR%$H08Krzaf*IZHJfvELDbeL5tQVaHJ3NjdIgh{5!t*P(>#qD(c# zrPRw^xU@LXAiO1>%Vmah-lDZ->CIC=Q>><*PczN*{q*{fPYCg$Y$W-jjKX*l#0etG zof0v?lhoOWwBOy7?kMo`HhHT6rTd``){PhD=EHv-^b(f8E;{&e?)xccU%%btUB5Pl zUdGnG1|y$#?P=JZ5|ZhX;me_N@u!A+ac`~bEXV(R zzM$Iv!e>{S@_(%{Aj&&uU-9djFD!vpI~y*XMUy`}3$_B$dXP=?#Px62EkE_@VE0 z1>$MX+!idmr`IrphW0Cau10Zi2bo6qO%V7IeUJgEbQ8X#4}y+9g2r3RqmtfQw%I~C z6JH-7Q^L0 z3L?;w;6w8E0#pY*7KQ)yld{+~WUdxETnU3wA}Ut>fQzbp&o2?0(iT?dR3!7ZZ~6p) z1M}pXOu#w~^{4Xcy3O^vX((G}1U^3n+|4>!{3{&riD5PAx9+nMWP4Rnf%==UKR;j@ z>@E%Mp4_G8Zk1eu+I}37w0LusAg7HciM=;dgO5>ysg@M)u3>5FS)~I$EJ|1~Jf$t? z$90ai&9qCfwH!<93vW>1k&+zbC{~CYaj;e?HTeD2WA9s(ZXh>wBng(QI-}Xz_?8r& z5h;|u%D2|LGF9nxDzq%idC4(GBE!nGqn_)gE_slf9mx%ST>SdU(TQs<__&~lwbunY z@3XRyHFWbBy4@Y6(VJa08HkMSj4u2RU`)BxKAc%GLQ?Xt2*uTTD88E*;}s4|OQd=) z-=0YN-rssGmVVK9<0ap-PrdFUuk_`;_Ltm=Z04Xl0*}{cF8;pA)@oYDbUa6cPNwQMs$vWqlZuq3<4 zRG;YsoMIQbL#AKs4=tPQY1D-4W)bH;Yrg1;PU`F_F4uL(7qGH7&WNL;JI`+3Q0MlC zU=~M$V#JgS;U8K~J;YBfXWFn8t-eo)ijh4@cy|qI-{!;~8ao-UL6OB8pvN-SPNYQZ zP)-WPeS(+sjsQ|kCSV;*^ZDf;{>Gde_2;`uY{ge{d~n}n-BZ&_Pq#_@sybOl6(vR0 zZoc;IgiO1!SW~3R$Y5>(mIb|Tkqpim;gXXK2xEDI%odQIfsA&Q$qkDrb7}C8uRy(< zoT4q6@;_fgo{AtE6?E!S=MZe~=N7VwAktELFh75VcJ;_x8m*#QJ1K{cLWV)_EQ7GS zI9f7S5Jfpk=TpM_H=gby8O)+=En^08^mD7eXHK-m;j?%CH<{WWO^1B^nYCG+1NKk7 zjL!k@Y)AnC@4Fw$%z+?;b<^i@!_t{M6RZ$*JWA%Cm@1rSqSw)P{@S=q4C6)UZ4;kp zlph6$ZzlTfm6lwl59}9Uf`t2r z(Ma!}2#i8*knFSY2W$uW4nh7Elb?^|5ss#a27#*M5l03>FoIGqU#YnMTR(1oD>weh(s>-9?_hDW3+>$VKJ4NtW-wW z=b9<^S0+`){Q1jv1%ANF3VLHy!`v&tQ2@NM?#7p#6Y0kHCc9&_xEpl1n?ry4J(sQ~ zj>AVCO5an74xuM1MySBpefPNVm1Wr-N99v1pD*4G0ZTeoy1Pn9=)bMZEoL0tQg3@M z-^r?AXj+Or`>j1}mNB)vPQPq>&^&mt8=h(g0(KBR*@U(=62pa#D8b~Tap3^}T75Y^ zwqeA$XqcEIpuH+of@cWfOScnacGWo!A_jZq1ma(`oxB66N^oye2#K7){!_;p6DsnMA@C3C#Q!Un-^W!&&SVY6oQmiR0i1_)F^&EX^jz>N|19|Fe*i>v4oX; z(K~er&~9T{c<`Gh!L2|*V)-0fcFWos0N}jX# z+3m&6zKHLt+w&9DD%FpLW8^c3PeLX4Ue_`7pA%&6A z(`QIQs5jkj{9*dOE%cSu@Pz17-?06e6;r@z#t+jP$INfuubOK|@-^3`4!n z95CWBw1DMYVt3l;CTbH_ILJtf6}YX{&gCMlDRvWf@##pNZ^(^8)P)9}dglMqsY; z$ODM!{6g*v!Yh|>xdH+_V?ecX&Z-lmXd$)=H6yM>lDLFko`lAPLz(dk)?-1S%Owe19cMAaL9TltmEk1iM#JeyrYk_vh0Rz+XaEK~Hf+6@9&q zHZJTp;7jVo&BjSO?I2ntSS?JppE78ZP0Hc%MqzA5tHy&JFLZhCY<1o}du`6o=iA|r z2ySGXkMG-3D69ry=KOgux7d>@bi^==f-$*{qGQz+f*dV+U!h#QWQ(-0j(WvFuGj-E zRM;brRADMTDNbCyQXVv+pt%i^;RMoNbX zIh;8oygzbI3i}6I17CN6ZNI#^iaryTRy>{PHVq|nwvOi#pLDgVMGz+6$4TzL?kmj& zuvcK)UOdUYDfHP1{Xx(mq^rcOhWmBcIAOMmyzff=vP-Q@QI%t)(@=FvYjrT4x zn{ikv%<&gm(S`oyoJePKZ%W71zZkk{7?hnr!oSuTjFFWc_`H0o?E?t;DZGM@+{U#* z`b?M2rJS6YXvz3~ChjY6^4j~tfdf4GebDvX<&@f<>X!ea5W|PaqeO&&cJo~YAJW`I zAm|^^#ZHm^?^Vw=T3x%AW@-7Q7M})J~{3PM<1E>Xu5qVUidw(^~-30 zhK5@Vo^eWJ`U$~&Wvo4@<>?=Q##C3T1;>DS`FW)eGFk%#+RaA}GYlA)8c@HOY>%Nx))Y-EVCJE&Fw6}O3YKiI$hUc~wxy86?VMLIw-CkD>4(pGbR~iG(y}Xv z#(?&s9Ik3VO0%Dn(Bn`W(tz0)w%|v~E++4~bc1%YO9Ow5&f z>Ae{Z!;1@KpV1WJ#^tG+ErFCis;GY80MJY2rotY2+~&w2GIJ%^(du-a{p4`FQXR#_ z;_kF$N_;<)005P0wX0j&L6TUfF(H#fzaq~)H!?^UE9`=+e_}5pp?SbfOD+li!3R)1 z4o7>M&ajKy=kOq{XQs`$a*PxV+RA$QsoI=028kEw3ldqgiF58 zmgAXII2|Od&|4ucTTfR`cLleEvQjjdWE(pdiOKcPi*Pl!K7^rf3Li$~+O(8Jo(eU? z$~qLCyx8p;-kTBPXhkB@0BMq5$gud9~jWQS@JRq+ORf z_)jXMK9O8-oOop~=2*_9G19UEZL;nQ{e!{%czJr|3bA9K%Nu>4Xkt1cy*^Xs0|~)n z-5M0K3UpXg#tc`!9i)+^jSrz_vcZy^1WEHph!>7E%6}F2!kQ5bnV&ySd13k7|BvxfopE-j9%osYxCA`)FVePqk;`9Tt)=Fb#)mnf|Ib2bTi{0jr1-ckJY> zR<$tmygKu{&4mR=yDZtGHT%6w@0L{@55&^k`J-C?(+qC)8?IonquzN_o04=%eeyGY zSHnv6o7LIERA*3jN3yeVE76Ootv~7vEEx?E{0@|Sx;h!M*+-2l^7#@>#mgcdjb9km zLXf9H8c|H`QjKA2^r%s=bRZz4Z0egh=;?z-v1n<2uyu5q+3MP`I9YLYIA`}I6{A}A zt#556(%2o9z0dTBR4>slONlrWb!p1WDo^AP?6`n&ir$5|2X?W+BegLMh%qJLV+bL; zytaBFz?UJ1Q5H+~_P(kjroA{6SRmV9doUzSV$6>IDByE$oou6%CP^p|;|J?${*a7* zT{0t9B7UDNAkv)j_2z6^Df{Z$h-GV8BmUCd&Gc=t*U}pQ9h-8Gu zGpSm8EmaSwL9-Jl9-0l`?h4e83#9lIUWiw!{7h@Y#d&`TfD))psM1_|8hE^?$G$@_vwyBA-}Fi#b#YvBny&`>qYBE5+=cy1OSrLvADT=X+5to?QIHw03&;Kz54mQay~ zmf>SafcTz0Y*rJt5t@D94sru^iUA7#I=GU?wXj8&rfza;vFDX!`IXt|6%RhYEaf%VDDjI$elilRK+aN z8u|O8!&a!|Hl~%mDBQb7lr~--m8J?X)^z?IEeL%~SzIH5#vIGc;73y$(iHz=FzP}~ zmZs(k9b#w)(!tGSMm&4C|G3L0qSDcrpk(;xU+0@QsdvV+g*8Tg^qO&kVHg$mh(r}` zJy~=^S#mh%Mx!|JShVFSB%Klf4ka9oJ)91bEi{tHijYVu&@nR|9>;N4@#F}lBqDG) zFdoHu6r}?*SxI4PBN8%sNbsrGRYJ{uest@$Xs(2S)_TLD znCq&xh{L;X8Grs(gk|6PiZI&G<}EA`Cp(~HI8hO}cZEoBsYRtiL0VnO{vpsnHx0O$ zSK;p#Wj(7-zyidJ5Sf`Lgx1r`gWU~tRA_@XgMtQ;w=9_P0gp>!YA;oRtIrGq9mqmEnrc}J@>0@SrS?(nYqZIwU--z+`la8V^R@1@?gq``m^&7J zt0Iw0;k)@&EPi{h5j zq^wH`=3G@0;;nypr5ob?c!^$I@hDCW;Ss1zjXFVi6vo4FUhWRanqjpX)I@iH_vvQ_nI&l7B&&P^;i zK;?)JLRG-o24+TUuyBmyBoffG=Ws1qd7OQ!EkUdJ6 zquw1E1>o1fV&{MlFn|lik^*^Uh+?yw7ZptyC#WP25X%pbjGmR z!ecyrZydSpxuz?U%r&%A6WV?l-o%@lwqz^ZtC6ZKdS5(c+Z}B{RrdXzA^G&cK_>1+ z*?r6F(OFI3=z(=uW9f8H*AUk%881pcfPDhZ3+KA$IG98TaQ zhGMQ@N{RKg@zOSLY2pHSm(pW*Qo3$gxL=5&Z#(-M600GBiV(|Mei2XTy=JA=Z!Z&H znlcwO$gsK+LT>ftLdw#21b@fV`N;fBhF@`!SmBUf)xo=2hbPuF6a4dp4dSRCd*%NW zny$71g?fh`sELLp4R+x(t;U|}Jq7>bCIXkBc`+%M;FR)Cl98zS$>Yj1g1Iqu) zI8z?Ja(4wEO#+(#>^X+E|C=TK6&0jz9!6R8Cea=JCP z=Xt$5I!4{J!%-?G`U70~F|r!3{38<6B^-OCq1OD>1!^PUL~UUk5r}X~LRl^^_-3OS zs(#2XjyLb7x}pdmGDUp#Xdy)1aea;^QCkR^F5wp9D={%BJi>OGRmW)P$&{hyMp6a8 zqH8SbzKWCr@=_EF^L?UoRI>6LjSP$~XO*!MOUyy}F2Ktj zl#JU5GV)`)iVbw)hjb*}cu+fx+mbz-AC{BSBLF8cs0OQ*m5h>$1hL|+$*!zLP5@LG%f-V>aO!o_Q z%t^-#8fBopJGst>TSe?m8I}Ahj#0k7pP3^BcBs)K)FUQpcRH_@BsBxp_74f zBWy3GP1EZ$mT!UAuP=5WK6zBRXU2vln8iCc@&<(8x*z z6nQ8#Fi8JTc>n{g$po+$N@T31jj!^uNc@9ANkM`%jcPn1B`U%TPi-DWD&EbCivP`G z6WCsMX=AJv7NifK#b**wNQAA_=TyP+wO9koej4-Ys^H!YS4~#l>G`5$s`bsYEMVH^ zSe5$i5j~~=C>5h6Qedh~PHo932p{g0PCHOb37Kk4B)`Nn#`h&rYa=qtZYOavnJRsd zDG_u8G<%}w36}gnBhwlo3Ntca++Z>EZG|X=iwl~@n6nHe#A<%Sb<<{v|#c8ygf0z5oY)RgXla>s>pLzhh--9yDzuY_f zYI=}m2LrbvQdLhiNLnt#b(jy@5a!1EzvF~3qG1)W;Yo-Tl~&0X&1qQ&D4JDjKCVpq z(`_s0&tj+!JNDUv37q>J@Jq7Ew?~df$GOHjB6P{O@l~Owfv=0a-`!bre#1-VGxz%D zb%~az1C@O9EDApY5w+o-5R3`vtr`*T^R9oN%ZnB>RBRusGY^iXooLWlS>{>v!{fX? z&g+S?Zd~@zB6Iez*wrrBxf}oNu1mCkx6J_D-A zZ!XDfpX%*U2X@(wq!b1r0h#72JG8a8gxj>a6&bANtgdM@)@9cO8uuLPJ#zZ1 zN~)-FM6d{IG-D{4vMQB>%0r!$H8|Xv7H~>-{?4Ib(*ao2vSy=U_+G;oj$gX-%A2~Z zSVU00DLtFpBsy$MN?+iA*;M%YcV%L-*XXMozf_xy(|2{Mm|x!@)e{L6pfi=0pi0Po z>rcbSYN-}DuVe+3#I((^!gGILyeU7Luy4DqzLUdy0*o4}H*u6>!>9g1GDK+F3=C#^ z)7DX%5~NK^Ryct7|C>}Xkg|Tw221a~#5?$;&NcM%8WV3A^YSk?@^d|W^5--*?>4<^ zmXg##<-~`lQ|P->O>NUoJ#zsB@_}a#4{P)hNKxV;N2oF{{3VGA(SPo;FARzI73BQ+faqzA)hxSk$T2E zxy}fjRjSdWLK^75FKXU8Rl*=cuXH-=n9FBle)QDm8|y{{6y+woE#(ay5x7N~I;8=P zC$goqaH+N&B8MIq5V)4ELhR(V)3fIw5BT;E)y!KH0r#qxw%4!!P=x?{R@X7b+`iAJ zPDS8|M9@=M>2^PCBH02_@d?8a)gyeT81R}W#smx*?c zmS+Q(*pl6JGB4DxWuPyg-{z}RS7De_HUkG2o_IY^IC}ilY)z@|L_OwJxr#7M zIM^~_Laanm2Junn{IYsl>oJNmefOy zI{$0H#H&==Yi0khP~OY zJ6Ez~-8`*xtlQYw<(+lEuuy6C6M`|IZbFv2*Mgq@i-Wf*)q3xDN=BCKvzbEgZ{ZKs zR_SAtF^Qh?lfDWUY@U^&RJoRwRKe=zaFJ`o0TBMJP#5qLxIWA7n|wd|3{CQ(?AR<|BRn%QS0L=Oi>m&kWTa3oK!mY42Yn{V$i zn}tq_!w1+{I3mZU!*Q@a78+b>IROw@U&OJFk3}vvIAQ}d{@3icFQB@e_=KDYmm zf}B5f>(^_V_miO}!M@9JkF>~UE*{1WRSPFRsAZ!m7bvlF`;>300=`)I_pJZ3Zz9jr zz_Wh%_9?~p^VY0zlfaJ<*?d2OLa73k@X<>%3o!mzv%!1! zJ}w7dl5?){(O%b+mMya?lX+IBff<~;z>+bqoaQmP*%cv+?x((3u{=b1FZd+;$Qob5ZA{S+T%JM`?5||r63c#GNT{(3ANSr%_eKD zDM8)eJY&bHm}*?UJi$5-l=u80hwdp&MB%2WOX~JG=G4!xttL)$o~ii|JlLVBY5(Tu zvJxfoE!FaJeZQ=N;`}>C-%&QvhqG?`N5^t;699@L@bX%GW zFshpx0TbV>l&IX8YlR;UJXOxXA2TE{KXNHn9i(cL448H0EA8Nn%ZR3@Y8OuXTPEihfu*nRohpI9N2%Ft8q7rp zmoh{Fm(T|?8|8ugZh)&KyQW37)lSk2Iub@JNEfzu^2o(jsSltZ%pw1T{(AEfwZ;da_s_!$aI# zP^f4Gr^=K;oVqqyu*}a5DtyHMeXyw%F6@I*O^SAMMF`O ze9L#<4PM^r5-l_Wh$?kuNvjza^lBOJd28S`6_4bD-afVjMt&rFVho1<%hrV;`ryR) zi8%&Y9T}6mo9D&nE=Jo5LVOH;4eraf%xYf6?9q};VLD5`t$KlvDGFBr9ss#Kl{}B+ z7Y!PxpNW2e7|*@&G$D=5*e}1@dzA`u%y1i=8y|dE%nPQP|9qF(E`7~dF`f>CrqzS* z8i=;fl!VwyvDc*L>Xn|pQTFAb_}%PWs-EO_dXPz1*QfdZ*%%B-0zG}*gCtj*$qpl5 ztP>{K<+5)OW<#ETWsFwErwqZK+YCyMg55AHDH3nNILOHAwA_~uBKRMSZAzvu4~DYP zb~O^hzcb>6diT41+7!^hS+|*qKgd6?imf;X+ospqQ8s3zU1f*C-h(Y4aJ`sB&Ac&U zK2F^{bqb(&h$A;@7D|v{Pi?;n9%Z^}BK6JpZ_q8g-&VKs{pNTO;rs0CEeRkk04{ua zAYiP?wtT;gWs#G9Uk-lDCLV52+NYXN@tGYX)CCZ>=ik&n<#IkIGgfoaLpfS**LRjDL(j;jmWu3^2?3OXO?4gsF6K`VZD ziQXeJ{60ny*@yZcn2piXl4t=SFm)ZotpX1f9j(Muiyg^uYl^&JD1Z5;yPr^uJEyoi-;<(a{BB&3oDF~ zA{fnpx8+|1$}Lp#AaH;^@ZvEWA9CyDnw>OBL5Enw;Q+oKF3S#tG-LX=o;qh ztGQ4!E(jfsyR5%W>t%^zVZ(x6hbr;V%U)=k>K}$q!^d1MqJ%NCu(-T1Gxf`8RzbXv zlyR<^F&Zr>RVC=fIiJS+OOJ*s;*cK0foY&>%AO5_0&L`iM|Re0l9cV>euEt$&Sf7H z_R*u0PpCP*H8Qj#L9yr60%->-v4dT2WgF_B7xI6^gYA3l74ouueYJ_!B-p&V{A={O zsDCMw#t!p`=mTB}5rexco_v}0Aur!6zYpGI=GYP{d(-W#qBQMnp%R)O;-zDiX^nL{ z+2;;SCSN{^N$Z%(3v;dFj~pe$4^*wh6DD~Vzowfij3JY_NEyWMD=}1s-%oHKqP_sK{c7L)>JlwXFaQQdg zG-24k$VE0KyTI}1YPn4zd2N;7jUU7I9=(>c?i&OL6Jsn(-i-|-V=TCDTjt3j^_1ygz8hnBV5#N)>UfQBton=+QZ4SOvO*JWNT2)d%~QGjM`iWO zh;U_W(gDISg@%i^F$M>{p&PcrtFvzdK*B}8>*A|Lp~C#Lb1&B!)&z)fDt)q>uR6J9}mh^Z$2v4piwS>y@!tfeeqz?Cm2*oNrRA8V9nw;%U8oy>gzS7$0u z)P#ayiIT~yb%Z0N-B>u5L_zptm48O(R}#re4iW&pxNYutBfs}<0zK$(j>M~MI(N+%gXBi}TJ1DgHeOC9(IVxi%VH`M);8Ha_7^2~1>`H--`S}; zR!K_y?!Tc*{Gx_8apY@B-<#=QAkav>E`Iw#oiAJZ{aa5bb)+i5#7tVnxclBO2ExCm zn)!rIA2Cc9L1FEfH@F2;COzvus9L9^iW|cB=LZ(2PRzxx)?$A8{Q5m~UdZ6n-;m|8 z8b>DTIDa}6b!Sw2a(MUq$kA~y%Khi^ERf{z%^lkqmp*Uf`tMDT)}6C&Q@)nrh6`l( zYXqJ^^_8Fp$)H#I(hlpb^X#YpddleiSwn<&NA@Eal1eT5(T|=H#_i%_yww3}yskB+ zgFT7%=eWKewbqVtTfB$vIxkc_0~my_WT?7{g&m{jv7P%q-3CqKBstftszb+P63YDd){PeTr?w0V6P4Z=&=Kj=Rigu#gM67;&*0CV$u;58F0g7oT82iY~L(b{60 zs*%nglmoxTJqwRvAc$+#S{~tqnepH5$!yTfmlL8R9F=Z#kfK6#$0DKn+jNCu5K98Kzc7KPzc-j zr3^*&2!Xm^jrw*HM&!c6dt$(2@8UuzaG_B%@SzV@S2+;Y2kQi3%AYB@m0v$t45FbP zAH0e0J2u)V(a#?k&E81WDTSRx@Z!cQq=9K&HGC@A_rwcm!mcC3i}OVu!i_rYB<7|w z^8oxDzuc*T%_2C=qK|w873ef7nA0);R+EzcR+dKOEi#J(x#%GF$G_*kk$01k8x(89 z+C_)N3bbK@=*b5d$C^K=3Hx1tS)%EhAUYro%+O2nx3Aq5<#tKeW0{}u$9?~F3kgxC zgdxd63{eLD*0C3;F|fBfguO1r*tL=8@50s=rwp@I!gT@!^)u2`^P!rf56NY|elGUk z@pt5lF&K+wc+?MVw*eIhaIjN2vxH5K4t+fpEj=ImWb6;|v5b+@e5L3G6 z$nExiVWhNsVAVWF)DV~2YE_rWY0X>kQ7Dz%I^zuqn6d2b&JE3$4N>R5=`?QZ1!m{(zOJhoP8R*50YbHsq#Kxs^f%IO496QEL zTIyCE`h-^zzMy*B3#8)cACY#jYT%nrm;t50cfO2zh=8dI1%&}QDD6e~#&MEa^u?-& za}Y-QP$zA?gAN*&&gie^5mcN6z2myp1OQJmu5vRRP zI^Z?qZ8)z1u$gq8$lt@2M@%#T-IzVE(7{@sI!A)6oq!{D_2gs-aZkntrL=aRtlshg>JYU;bv`w<)p5c*PlhlERPq5AEvTKOQ+W?|%2?8$xOc z6__HHZfc96f%AS~-3@Z&2>`D!vqE%@C{K~sHmu>Pc6q8A$p(&Ki67II#DTHYm~sh^ zn>|`arF~om8v&|<^C{#6mK=CjliXbmyn(6KRD=J-R_uHtL3~w!u1O~Hz+9B2DFGf6 zT94u-a;5HH3#+^IRPAfl*Hfr$gg5Zrw0LWXC6m&NaeqQy#MmzoZeDg z)yfgaQk|TMQ7~GJQ`0W1(==uK)r2#fo~!5=fKmi3Q|ey`pn;tE7;H;)@*8? zZJ$-?n3Z0b= zn(5rDKFb*0wdzQRW2cyk;av&tYyH9(gON=_gYWIZA?}M{(~Z6~87Zy4=A13Wxynd` z=9`nXf9@ub7Q!5+oAROQKPOvUX%jjQcO#&u?>C;-u55>J8!c%Nv&~mR(i!sTvP=4R zs8M6baAcCy)!F5S!<`rLX7D0lENQ>RXIr^F-R-qjd z5BkIO-Yhv4kOkb^&`iO+Ldl1RRLqoSI^CRRT7*?>eyzY6d~w)>!Oj4Uxf@|`8Q!Bi z`^qTgU#2yfe!BW~@WQM%rL{CMnC`5jo!aPHhWBQ=wXe&76;=eb^SGI(U7W8qK6AhI zsvL*>wCHw7=xaP=rt!DGHgp_(f3>{-Qh^4^cEEwkd*0Y)&Hcr%rbbi4NyO*RNieOv5U_I3>fULO=s&F25qQnn0ZSfHLT@H+Fw)6MWK>ff-M9s&I*AtU6 zS~p~_IIjGL`k+9xsL{4}e!0Af1iul+KV!^jS!Hs;_kSB-c1QO z_`<^OS%HBz_u!O~Ovw@=-9WJB9og<&0`ruw=0AHVPY1+tR~cXWfv82W@sfqz4I{2V z!H9o(#*uAgWC{LIjDa2?0FK-taSrk$RS(*ewwnJ``l#2+qvz)lr_Zfwr~M{Ie)sdz z|55eUaZ!F>*RYC$AR*l#NOyNgOE*I!-61Khbc%GhbT>nHcXxLTIrP8-c>nmm@4v(F zx%RovIeV|Q_BvYNlta=fvuo9YO=k5X4lLt% zZQT!$^;nltE$57$d?^wKHP_u4`g4rgLCM0&|LQ~kZYz5cVku^+o#OB)i3V(8bf-pJ!&X|NAfM6_@Iy4*$8 zdfJ~%hSCy|oq1uc*EQ;P9YgcgPx|$k!}*Z~JC?Y2x6Bn|s`KsNRDQM={(N1rM)g5S zp-8w~!j1P*^PNkj;;;7*hFmWm8l{~j5CTKoyDZKa3{`cmtdzs5mckXYN4WP5BP!dX zUQ#)wMWmd+%y+p_XW>Wi(NbgcNeZ@7P{C-Ib!4{skuD%l+A_zsqG_JMWN&r@>d}JR zPd^@m=zdyNLjz9TbI)rRz&s|AmO?7}HO9;!+vqg8%c3fxM-}3V5y0{`Gml{=F+RF$ zj#2UE{)ZdS-6gxVNobS%qER!!UUQ>!RQGLrBDj6MtHDTj`etnvv`T?EID8PA2@c!t zwgtlZ<->jErGoiR()UxwFXIcW8k$0h`uarJx+VsvYPMcJoP-?>ZE2;w1TSDTBj2ka zFaMRIvRp#>A!2<{cx!R3?L*}vPdu*{j@xD+XbV4aq{C16{JvrSVJ{xn?J{aaJ!TU$ zVSyrlOntk2KHF|y!go>RRG!z>-&S>?0FPiud`W>-d1ArSx&5m z-W-0E-6Q$3G<90pZq%YP2!jK^IXcAleZK-o1*4D%6$N@GU;&e>|Q^3 z_sW#dDk6U5vU6GJQTT-o)m2(cj+<~BMppLC(?|tppDu1}IGK6k=w=P?d_YR>zz6E| zBi0!l)&MnCL_^wJlJqEa+C65XNGaH6iAWN0@J)tI_W>Nk)_*I>-$Yltbutc6<5%q8 z5{EerD)s*c$4<~zILLpcRJ=_L+)O7x0U7fEtXAS;l&3r`{VE)86j|5=&l z3=T->BcxJ7+}hdepb{m7mkF_-jH}T)5l+#m*8K1nCYw?vo zdeM^k$0#PnowDqPOO@M2@5^GIVt&+xIzX1dNOnC;9^h8eQa-h6Ht|ZhD_p7Sn^UzF z4_M7g#y+rP;nOVdPS#;vAbGV$eDc?zhniV&8wZr80ga1aes>)v>IfIcMpCD#=S2At_=JR9>0ypJr2AH!2*12l)pg>!RI^HLsv z1EcNm@$WD%gUB>V|GqkDq8TvC@w}bzJI`7;=(ssGhW!ua7vo*WeqVQNPO+#pUC@ZV z0gL4AKqVUWj@Yj{T=GjRjMERQKxyqZ%~O>0YGfsMeJ=r!rz{-FuuRV^#&e2A;!To} zXG@yS!Nzl0H`G@N968-`1GOHq#Fr=%y%pdV&S$l$SUnB|^7L^Fcq=uioDxGFe?i}j zd(IVnR-3ZgUpnzwKBB!f^LLvz$v}D@c+&?|cOtSILBE}|{>i^RRFq@l0%CD4oDpKS zq~%n@{mSCuX$$5NA5q=q67)@fWo0Su0V6R+F}0=7edBh#$D%BqW|BiTu4`=x4>&}S zrzl7|lILP%9f<^@Znb-LIu}L9>N5EJSjcW_Ytp9!IL9*8vxc_g6Sc1QK^uIr4M915 zPRxEpM)2t@-D7VgC37Y!?lAPRvL;uw9NLpoK{9+4t38-uNTO=qk5f!8Eek|3oz zE1%BK`qOgBHui0D3f{zal2I+R5F<1a@E!r7GqY7_CiSse;P5NnTzBbEy5wNG*5pQT z;F%6N!Ng^KTn{DkX7@WGky4HbWc6n3=^_jgJAXpE5c}4N=AFSa^ zx^RU;*ae^Vy~PDh2uH(c3vUH%tPvF7)JZCy9|UyrT_5Qa-=R}8@92o9ScStOk)z9~ zZgoeaOIU*pjSXj2Ev z`78(-4Lv60U;E4oWJU9YE46of)toN~+dyWE|T zPHVvJyR90Q6V`)WWHvZ)(HjI7J*FYqr2iskDb6M}&mp?pgxuuzWtud-Nl#pmmIa!IB^$C_T0JjozvJvrMfN;m)WT*RXsqc>@x=k4Th)piy#uXZZWBc$)f z^G298ZUPFaPT%y+d^c~~x5QCu6P|vZ9XR^6xL>HkXVjkLVED24gr1pkm8X!h1Wa@? z@>|FJbnYqM$RKKKlkNL6VXFj?D;|glQIC zX&&(erdfqmL>N%(m7;c778JoxSCb$nt*~5!3P(4q!B>@pwaa6Ize;zscJiqwI zg42x^w<_jT>LJ12PEP88PfD{$S0an$?)XfQQMZ5LNfW{>Rz&pEVSCBHql$F7r)!(> z2@kUqaKiIljRmM_N9S=XSO&m~QVf<=wv3HYIvg^YA%~1kzSXbs`>pl7Avx&mdnulB!yTsf+3{6@M&?rw+oT?i zTjH_H^z%d7FPa8ZWuf4_Fu7 z=h23qzS$W4&T{2HcoJsa_$iBqE1GQ=TTp!rd^*lit;a_58nZz=TU z8X24++-0)JIsuB|U(WR~7=r@uiueeUy|v~_BA48- zGvyPO)&DKszvw90B`K(w34A3Oj_7m~X2Ru@CkCR0FVxQ%o%sB`aAxrj-8)h`wpYwJ>!qV5Zg$54_xx5W3E(6uimXbi>6+|B*LKwbXuaW_ypF48x;2XYlFqMT z$fOVT8DeO|_{WA|^^7%Qu@s~k)56d{{`f>e#g_h{>S^x~%|m{y8WNIi^L=nRe<047 z=YG6rlbgti;52%l+8mu=0S$c+IYb$wqDN1=OE}B$4<(#wI0@&^zC`5A3HLrvz_u{56+8ShbnTrVKKa?yprk)2 z>-zT`sN-%I!p;$?@_JpOZ9_u~7SpC;3?x*KoPJ6?NlmF7kfB~AytCh{l)(#F^-i`J zi2E-r3H6Z2u=H_syZ(h0t?3(YoAm&Mt#g(WV>Wj=Ddsy~?4LB#8neh-9e0iVi|MeY z$E&DbbR=WsF_A(8ENO19vG2b?%}^gTF+#gAdPJ_p(8h?rvCPhnxKd4zjM zqC9`ybsXfg^)l-f%IqK-bXs_~YqI!X!mtgo_W(v0h_xkUJ-~(M_=uIJ8vexFs zEx46UWG4yKDuMedE?hSy+V!&# zbNQ$+_49^ZBq3A(ELABAKdPQ5j=pV5(MLrkqV%rmPb3YhM_jR9bd)^sP2!h06W^Bv z15+6=wPTi1r6Dv8^DQIV+-U}e!54w^OiHXp3ET(^Z$)1@(VkreZolvahA)$-dy3b0 z?6Hf_N3bucJY1x2|1gw2(}$RVgRmPs5OoPis_XD(l` zYd^am{Ymqjjx8ZhZw#83WC?~izY+Fqe#K%@QC{sRK_M+?ks}TQKWqdZ1($~~^Y#Y7 zJqlkH!3;PbUVzwV)AX{@NfQenhQ5DAfg2_J_*k43mwsX)XciQ5ZMBgpj^^3AM44y- zi}-i&&vMgx^X%+=?UWBf7R_w@p`-{fOB%dLg(=kvfa6p1!eO_qNr1@kmroki z{V@6M1s7d1IiGbNAOmP~gUK!he$_t?tZ%lG(q~C}nOfF31*TvGAybpum#A_<$y$VG zqcF}BL*8TT%X!NU54W8Uw_~YyB@f`65)Ygm&xZ2{QsnFAd)BL1SjgwQ*uaO9l8~gx z1M>L$WdOalb0dD99k+vj60YDvETO`0tiF$^a(;0X^!h~WOdrX_r6S4NcKh_<4TN6O zO`paWM>p0#_@8qxd1D?+7oKBJG~rU$mPCy;`=znCcOCAUNXv_~^R664!D5l~&twRE0T6R+?3)ksYJYe*I;;=% zjPlnR-ubbe`RFQNSRI=0e6Vr4%iJa(3jfRh?Yt|}Dj1$~$UT#Y^dudPk2LEz@Q!M- z|Cj`wEO?lTth_ZDMBTN)@v^h&8bp3~10vTM$-19*_NEMR>Zo=c&Jy=*?u8c3ItEYwF4?NmA25GfO#R1mn%_~Apy${X<1V)6ckL6x zVreKQzo@s44akyk-1rwr+@jcFHsTsfB zC(VyGSC#g{2pTZAhP>GP4&@WyVRwG0OzZx{aft#ww6!++iQ_qE;P*{_xoWR34+XDAWF(00_Pjjj%Sc+p$G1*2UW?z+hue{$EQ!X~7CX!_zBfa(_Yg;(c zF1lO-^-sm!I;)h9*!gQ{3G#P1IyYmU!>%_*_TU%OZryXNwCjxp=*;gmq}yd^6F z8vpWtoyllE6aPqq>tI6Ex*4n0pv5kfi7QGKh>MjdGSbc|t8_@1_~ZXd^Jvx#>fvF( zM3!i|+H*3=VH@(@;E6VJCc0yUTF_j^hCxmBE1l&O0c$_Wx>%&GJK9CgkR3II3`U`8 zdTt0P#2pN7<@N3?Y6hw1o#rhh(Yq@AYNT?y-LpaL*S&NhG;l7dw=r?^Vlz<}lk2E2 z(NnGq#f=Cb5V=yv08Z&XrIM7jY&kR~h54 zxoy#8cv<(L%+7b+0J~PkEwAT_rj2o&+;q|u2~%!gGym=L2^ZOkv@aP#T3|^oq=OTu zDmiHf3@mugd0LdA|b z`P-*p|2{ZS^MA<{Tv#Hq(FH&SF5=Wp`3GtiFY4~E2WYy!>7V(eI7rIm&C0_ZGF9f+ zz%C#-N;)V`tuCQY9AoapnxKhn^>kGY0rYi=o%FO9Gc@#=Ip z4~!5g4if$=E*C%%9NiN&;6o^h4e(7uL!WVJ`O5e*_LNdzv~IxXPR2KK%l{-v*!Z^P zBd7Uwd$AMK0hz38TK752sm<}02*14ZHB4zR!K8IH(GEJV!lwBo$=e0@Y?7bSxdkdA zR^+}?lJVeb1~p!5&-?4~#7#~(QPgz_M?D9qoZxf=P^(`O$b<&_83W2(I<-Y4$}JWJ z>|`h;R(Vj^pttgcn?rYg>_tn`*qXBz&eLXN7H;R{&MJL@VcL907LE z`H!jV4Rw&_@TEmF$DY+-dp^zG=J>NR*$o>$t=`w)&;>r}=aJI}DZDkvM{!1$@qw#g z(tPK<1p|`XfHg9CiQ0~j){hOCkS_gE`XfTFKy8vvXF536yti6=+1!iDD^Q-^zhqxl>7De4E2&~=K2&(OXQq5$9oOa{LEN>^ z;Gj7r{Ch(<^`m{R;h1dbPHpkX?c4_PsJp65SqLX` zWR8a^87qQq^^%+k*5YJl{KrYRcW|ED6lM zjZX}L8EzHhhZp0BPwSUpaja-m9a*Bgz!X7}^v4_8C>jl5Gle^MsopO*iK2x3`i}-s zs$-ehvO*_(gMXp{i>s7x6@PFP5CPPYZpenl9Gy7K{6~aKna6#+?-ryeFU<5Qjt4=Y zh{ch=%mw7g>Mr&hTyCat`}|s7K{Z>SeU+HdCPYRri9CXOp5uNgibhPno*lFL^+PZwdM1-Viw)nF@~Xj288IZ(r&N# zVTI}1J4ghl`e9E$STWGFYEr(WEQ0jTXfl9Z7VMV9Q@S>cMZ-hB;R$Qubw_0$Q@!Ry zlJ8#V2RHE)h56&++zu0(fOvz*Ib53PoT+W2|l*ci4aAF%lWH{=J!w zV(TolM%y`Sj&RduKb~>KA~%J|c10pi?8ftaTrT6a9k&%_u6F*Z{G?dZ*b1U?4OnD1 zUNjk5eExjvZ>2w9NuK&P>-pE%0w#wPC)=2U$Q1tg`C6Yz$J8*yKk(9GIU;OyWLCNE z=*B&XOXVfsdJKR2nXFp7KN2>&GqZpTm)JnHIUilqMAXzTBWy(hCYfxRp>rI=mOIjy z==E_d(h_N&iF(s3*Q$wv$LoGOfyR(vOi@}BJPsxribeErmiuG9je0Xl*0$QW)U2Ea| zK)jIw%Xl`O_hi~L5wskoqaJJy5W=I*?e4=5C5ZPccL7$#kVMz-WRUZc@>SG%pY@U) zXvK-sVe_g7^{I#Q=99fXfdZL?5tS>?-Lm7&;G+#)t)|)&ZJMwf0Nv$eFyQlA9=wqM z0_Fr>y!2bk)ZhTNkq>iU=mE;PYk{-8PTUqDI{(4xQjIGITUL+9TWR-889fH8Zauaw zK(ZFCB}wO@Fnc#CB_Du$<5L@f^3k~)@^$2m;Cpc0kYE#gFJo`2PEu9g#j>o+>qe&9 z3?Q`HUeg=dP&F$M=W)!8Nd)dQW%j^{Tu`~e{|c(EsMf*qN(kfT(wJ!`(W#C=+8-P* zn4_fTr3Row-h>EQdj59PhES?+T4=jzNMM5m#>GEk%A*A+XV^BjX_ICgL!v3pI6`gt z3d(-3Z@D;kp;P03Ke=ZZcVA={h_hwQQZZtdi zLC}t$Bu;4@p_~@vvGmbB3dX z?uwkIzo^`v_lMqhhnv^U2~m1h+k{-qbo)+v^r~c@B?!wi>3dlCjed5$H+DDmU@ZD-> z{lm3hM_n?`iptRfVBE$s@VH&dtQ&X7;jWL~_Y^fTts^<)Q|CGF|6+3aT_dub0~o)g z^vZsQLH(9BwwtNDKjPKvdPBGvgXs#6U3nK-fI6E~XXHyro$J473dVkyv24%XZ-ny4 zzyBO(dNMe@J?D_{c_o>VWSF<*j}t*???1TDtrOa-bCk?Ty&R2azW1f`7hILoaleA_ zca;E5QQu?zWq|yn1-1?vC5kv~U6rJjib4>*Q+!8;Bvo&W;05W|j1eD>7l_}YMP58{kn#fF>;}$t-z6VP zscCDM{rVx@qG~r>io6-~VKH%SsY=60GCS_- zzu6tp=gaN2K=oIzRC89}jh|Dubyg6Z7f)R`{c zZ!$#i%nR;!35REM;wogZhxihO$r=*VuB?b9f|WKzKE8+R6b_GLQWmj#@ZofQ8OWVt zaD{Bi)`8-{?6Zd8)36=nxnMah7Ib|f1pqhfxj22?$B({=Ab#wzze@z`n9-}q8V8NL z*rDwg(e6x=^6zjWEndAIdKGzY!4H$vY7+4;l%W+u*|8i-M`-wVEgw`=E9sF#T;yv3 zqH+ec?rrU;(TQfHP_NF^wQp!6U zGHcN5xLJ0eQWVX`w4_6KqJ}A;h|)jmPBwfj_hD;E2cJ4dg>kTYF*FC!K_LmD^DC!^ zyo=1l(mT%Xh__8|Di#hju#eF*O|72$(l>CAo$+>n!3=;Q$w9L)qL9iC8M+KbKE^LY z)i7Sw@E2j8a@ty7=w4P_h2Kk70aSAApPLPFi7*^K_v2;<2dz7c7Kc``e`PJkat@Ro z7;cUlXCq0223))=-QF05<(U*43mNez1p7Vbh*=$c>>HPg2c%w|*k{-Yn+ zD6XA;mh!)Pf7{&!p9JB`g={zb#7rH_^!zD@1N#21sa>Ob9co>I4d>N!>e;B(qjp@VDT~lgc=UOM z3{h$3kiV^Qds&H6)$gE<0p6|HZNmR*NCFM! zlm>n8M)I21rtPF#uJz_)^G;h0M(yOc-?TZME{nHy@@Y2eUq3m$4+rsHYNf%6c9D&A~o#jcMPM-0HE2dtmdA z)93SA+iqCbxs}E@bB;4Oc>Jb6pgEcbSG&~97i7YsY&2?eEPtx~rH8}Td_8nqf8NcL z;=C}_J_4^YJh;=`RPW02c_L@4Mz*45DsxpfzE`_`3WR$kHEKh9{%yH`u=Nkwe)~n` zEWF!Iw5v=vglfDcwZkwTmNFVGT%oC_PYF)#ol9|SpEBj*WfAj$-wS?Y|57<~d|<}L z({91>RLKrrwMMbK`VJ?JGb(e!1|*Wv0L)8Q)xLc73G z%%8NISeg7L4Xe(@sOoM~jENtiooJD*SB>*HuphQz_zm69ce@0LHm8TvDWtf2k@u{h| zuM>AVY)`96%T^k4-%QVabaKD@MXiPx0@Oj;PD3bumlki#25osTs${c7E+2hC5S;;u zk%Vt;4QV*mS}K=itaQXf`121e*q6NO@yy}vrRkva3T`Lpm^DK&&gcQa8r~NPBO65b zoCWfWt3)zszQ+8;Y5ubIG=+mJhKjcenFrLKvtZr(re&*~mMHV2HmCi*FEK8)Qv|EG zi}%3`iN~3WhIX|Lcc9x{YMi+JTf^v3DKn$5(4z(?W9^2fctLjqTVT`HgRn z;jp^52=sfXL%PcT)jRa!-z^@EfEGE&t}nCH=wF)ygu)AhB!mqkf{2Iy_N-A&euxUx zj<4nd|30yZ|i;LuJLoW(LJ{P$rF7 z2qQnCin;H@pCN8PXZ{aXrit(y1ICB3vs0fH^*0(eo942|QZOwOV9=SB7O>b@EBo!- zO`Zr>MYbmj`iadPo7$gWgZe%3`y+n_!~Bw--?{nO!;c=$_CI!AUxvPaG!sGsWPH`r z5%y3Hv{1Mae3+FTC%%;2zP%&YC>!5m+<^br^)x=C?cuD)u?0uS z=4iUE;KHMi7n@4dZw&eYEFLCte6*TX0Vos9bzrRB?UU;uKXqIwob(#%*+FB zS|bkX%Mozgh*w+7uqe+&i|nf#HxhG>P>36+*Ky@HOi#JEawL31EopR$+MgWI23^>? z&h@x2Mmpff?mxQZ$WLICbFgN9C&e_nX!AHn&*j$NK<~L|Oc74;YB~^<lDb>MwW8HI#+G z1>KQToD+&bMG3|Te3GJ}huc(^UWn&ok~(?Og7$AuF**}cZdYQ}cur7C9u>#_V{(d))U;2Yf}+Y~Qn@riQRqs6yunp-Jgib<%;`ij&}vB| z*WCoeECne3Wk?SIVuNY4;I2-JNg0j%qdB;UHO^r}fF-n*f=1VHI*P^gEbceLbp0th z=l<5?SZ87!Od+U~7`R9fBkc#C2E*QypK<@VRq;F{2U`NYYQ;_-?@+I>AbwK^#L1#U z9YgvY{+6kzymsJoOYv5m)_?LMdezM2otYzR_W{*Yg=#MjIAYoMjl;py5J(M>=jDy- zj3~@^fQnAaVIk8o;JyB-(RA#)P|n-7q{lJ~`<$ArfAtO}wX#1{FSTXsFueCX^Yzf@ zV+6gH@Koq*QV*>r+CTZybX2VysZy`dwQS4Dh2&hMjRXQ_tHJ2Emc!)7RmH={`KTfv)`|kpUr>n@0U%7{25rk5T5GZm^wS+ zWNN<4mI2D>0vHoG|7oBF0i^}sehxPm6{Oj;<#^w_4CS8e`|`OuLs< zkkWUPQP^DzFl-v`U;e#w=&+%pY;e&E?yO{CU5}kL!Si4Ai9uzFdMo1(xzn{8=(WWL ziGSGc8bLSB82rtf#kQ%bDIO#A8q+{&(OZ!FBRcZEHk>2e+8lJ-gwM481D7wCR%-E2PMQ5*l zdn@=?*>Ao{shibPw0)@Sgqm3Rg*mFQqSyP&3+ODp@H%(%!GH&*>uD|or(~1O3ef0x zCr>Jz`$c$@*yWHj@=1cDJ;X&8=MT;IL{)WN_t|)YnK+}L^Y*rrospuvszCy% zleuR_Rkx-O7OqlZlKSrTb!U#5z<{H|okN!@7gG((=N1UbnZCbkj3no0}tteqNF!sa-&Ug^eHHwi|0QWD>Ua(+gCG};GlV|@}n z9kt+n?&*?a11i7({1d%GKI77xiLe41cxvRVNGaj(X^ox2F>UmB6cpp)Xqcc5E6%RH zm&JC5Ok2p;j8ibosDkta>9#*}pxg_#^7hLA9U*fLK^lfd#ma2ji zJpd&=ftrYhQh=X}`b{bO)BZ4A?;Vkx38i+!v%`>Y@2EObs3GiZ?o!j+@LDCO2IW+d zg2LtRg_Y0)M?8B);zY|z$lqU^y^|sw2fqNNc#q)X;ganA$F`RAnbz4;cBb6Jahxc@P1=woJ!pAIxoF!&+?>v>}>(_bF*$ZZ?|4tWLpC?Q{0MOnH zRSCVCdTgyNy9k_yUK0Y3Xx`_OoZ68Fk)+*KZ#n9!2L`5=7~pK{#=L2GtAq0MgHvmp@nwb?SKMrg7I&9Rm{+tB zETOudgh$42)o!j8?S>5&?^wdGk9*bAQ#y7Ya&uU~w3vN5a#Yrj4!6BOljKn~0!JET(|mmDGE=j;_=z@x)|vO;$IC>`J=~fXRl1`Jtk*o%tn(E> z1>UfYyR5GMb1f!}jF8>M;eJVvjt3(d(i&N^ncUDrwZ~f`>Y@s*kN2GyK&?J7;|{M- zeH+;4FNsj`CEeDad(y&0C+;ztWPKke4AG){%`$vag%|Jr;5C9l>r7axlC6a{6K+;Z!%SwfkMW=inQDNalAEd&{Xbq->!g5T9JRARKIi z#|WYzf3%&>8&9p8yM2OVM15H6g(q*m3(VIasid(^-)44Mq#*h5=dTEE6@>HP!BTT! z!Wm>9;Q%HH{q4J1m4kD{KgnJH4hNhe>h^PM_RCzF?YO}7$W$DbFa0{InWrorbs5CF z+9r&RdUIZ;U0P=eTRvp**(7Wj4bN2kk3;pCs-#!pnVPK{iqJ=Y`3R9nV$^$*z;h)I zc^8Z%a$>4GhJ-6qxy~UA*T)l8qyk=8|L0?k$cQ1;lKlAiICT_~fLTX1Nj+GD$g%zU zaoumZhI?t9JDAEpq8RUFkn+GNN(n27Wbs!QyS7Aif%#vIPcAAUwXT}6phm|#Gpkvv zU;Crk3tyRi@XDgQ5{Nbeh9mmnv8mVx&fJJ0avL6+K@{4Xg3!toYb3dk_m*Z7J177j zqrn!W!u-Ez;MZfYwIw$%%ytrp{@Ol9!@O~O$i|z!Q11=<-3F0G_VfG=Px<1HFkGM| zih7J0WcDLH+s^pr#O>mGX7a{dR&LQ7RniTkSpuX%mhOm(+9yvctJK$_6w+8-TV$m!N6I)(yq}>YYs`h!9syOs)S_Of zd&pvS`yKj9{)va{%;T;5nKYC04}#%u0v{msj#P8pPE9^2r2;GF?*}b?Kho-_TJ*qm zXBa*|zN+o52GK^7%hL5OcdXIZ`Fq<6d@%s6m7&3DzgSpKalZ&fAG7Ftm;!5_fG=^QU1(9yo89 z7y$4m!_kfwTS2|aZ6~}hNR_%*)%h~Z-b8(=5(l=O+Cb%*Dk_X!CX zC=(e(Q6tBSV^Hzd8llIn3nsmPyu;()ImXCA4Ki0+nTdjQ^YV}6dh?r7F_iboG@iV? zi0}nc*GOyx)quDJM9lnC3w@}G*FGLIe(9m1q#ia;yuw`n&lRU69j<;rDv83b0h2s2 z4S8TdxoV)`d=iCnba4g;)rZ}XiEq@7b66xErT?t?mIKzv{P&X`vX9N7P=P0hA&2)S z98z|zkz{I4(W!~|DBRq%{363c*WRA|i6Z`?t#u^Ky{o(7+)uaDf{9Q2Hwlhq%aHtP zun0LgktDNNOnp~cJMrPtXiRg04XXHZ{1iri+F>|ou=oy)M>}1>J#)Yc6a!pYE|izN zB`CYfH2wUfxrrw50d9b?pXp3t66j@SR&=cI#iSz|SP7jL!#Vhq+k5S^N^SwZsLc{e zWMf};flg^A{Ik<`M;z1^Hd;B6Cydi?UqE!E>38Y-NzKSGAlWmBPKJjOIh;-f8(epT zFQ$!+2y_eF0I8F;NkOx`R@*Y!ALqgxFwdnLTo#Hb)r))CM~2k&_{TKoJq{smC6Hln zuBD^%iKHtkR2Dl|RouI_j$RfDkw$`=c*LJ#tv}E%bD;_>JXr|-9m`E^i@KlRX5r*d z?9XJtdbCu8q6T$o8RiAFB^4WE2BxXjMH80j@!QZNxP|Bn{BL`1%d2C>c(VF!>cf9{ z@+9bnwV@eh(@O2`THUUhU~WP<#n#2tQ`&q^bb80PzScn3a;sh?FO=isGJ!`6QJ;~R zbTTF6GM+CaC~>zD!aod8d0NQ9xTN8v8n$Zwt!Q4$UMyduF;L+z|EMNhfoGH_*8^EH zX8TQQ-R{zqI-$CNI`oGorn4Q0HXmfZOLN~vJH5ub5mpN_cSwnBb24G3O`y4b&Hs3J zY?Mp}MSoTgSx2Xe8d(raiBBqqsp{KbAz92lz@nMmKaAJV|K|h$qp^|b$$Gt|e~R!t zD*pkr`x~AypZ&TMbvyo=5+ka6f_Jn|(vZCtY&25Hw+JAG8Y{chkQgZ%MlW)*xnyIO z86hr5O@vq;W+EDM<5DZrj>Y1aGbsYzsPt_~t))Vy!JTh&%_olb31^1VmoDZ@CX!;z zE^RX#p?P)5Fy63!kXm+jmbj2E$n(ip?l^|52R?6D=nwADG*Ze`%*rAe@5v>G@hTKH z3O-@R6QVuabbwchp5^G=_~_6d(x3MU7*F{F&3Vb=zrkbtv*qN*wKcol^mbvnZAqMC z2c+}3+=w}FB;eld0@$yHqda&6>Jae9eKe7dW5!LAK0ZsIM!&xcrs_gJoNe(r*)`)H z99=tIJd|?YpA=#KU3Rogg|w;sic-#huMzJ<9HC5E?jr+r_o=Xr;t%ksscJ>P2lb@~ z7(3&|11TVqB@{||_D0qVXERj98A(hB?>3G_Cf>+2&brr7@*TDToBBLqEiNR}nN62cGsW;p0|a5Zsc!MXTn6PfQQ%^Cifyu89z)NJ7)<+KII9#mk; zU&XL|FpVs?i|c9pWwGXvBI-~9f7*o2UYe4(acR^zMHy6fT}sKxi1H)LDJ6dDz;{X8M3?n28T(?;LfTH@7$3 z#2O1VT@YJzbYh90HgAzUKMlF)^sK-8rLDD%w54VLAn2aeJae3}t(uiwbG&zFet0(v zZ%1ghJcc_ttUoy)8=G_0zIYO5B)L|ZHTJ3Hpaxq=tGI&OYhZ11z6Q0M;m(ni9p+u# zQJ?-Ds`+Ms7x{84CEV8?rcLXWf)t%FIf8wkv3(aIf49=QT9n7 z2bDUl{5a*hZ0&x%-7;}pQN8ZyCn`Z~>Fp|KJ5%jAG~zfdJivv+E_aJiCZ9Ulb!b9x z9^yeO)l{m(=lI6H3jduADi-^8ie-;11u6sD}+nWg| zHkpKGLXaj9G2vdVf(dfnoyB8v^!I$6U(p-_3D{CR<-!4uHTWQxbHPhHA#az*mwDph zr{q-1v}&>A2PZITnvoH-o0V32;5+4`s;?zVk0Th2IAML;k9=6>Etu4`_5=7Mr#5h(omc?yW3t#h~sU}!r=u!e&K}~ z0z;xv)6NXOOki zwcO~EE54VCyYC@}8T5O9j3a_O55LRBH7!8e|Hh8BA~)F^`1f4njBxk_;mYjo$8!Kq1X zsbP5Ousfg%>|==9fN4Xl5b)VwKdl16U1#00rBAZ0(S&?Hs}jx2ruD@*pMZS4vqeMG zpAb`0q!S-pc4f&>OMgKT-p5#av}AjaP7^#QO4D)8U7|!b_;M}oz$NVy=LSrp8#0iS zPR9+!z)hd&+y!zoy0-n6kT>qs;rjl~_VGph{4@nBdGhCJ*3r?j*!|@wyUljqWs(8% z@KhCI!~z9j`RHI`O_7X&at2l3@7h26$6q(KynZR#o@QDr?~9vSkUz0JJe&9jq@{|l zI0o<136XIEbMiOwt-8z0i*YtTvOesrGYYkWK+}Nn?aea)Sc&78@Ro znUZ>Y?COF=lo!7UjQSyU3{HJG);}1AN*7tQ2-3**7-tbSTAUtrSJl=LG^f zcB(HE$a4obCq&k5Rr`UXbT+1V>&wD6;}-2nVQ>#%sI)fY-veMp!~+$=-#xY<8bX3= z;UhlTWc!w)b2q{?6~6wzqQ|Qq%j#7?Z~peG{Mjd~`H``>f%90;?Y*K%@~0fj&d1Zb zQWj>zWdJ9mc2{FyxJzOJD9G`5$vHU)Egg8VQ=rw*L_;wjRCBrg4 zVsN{zT>k&NZGy8#?qS7jg1_bQlP8l4C-WxEa0&3yfeepmEt3S!uX#KvzLq30zjp2a z+4rvE;d(8}t=_ewp=`BZ_*&BguorJ(IsE^q`pU36o1R-*ytunN#ogVDdvP!BuEmNw z6nA%bDHMm|?(Xiz&j#Lye&_GK_grJi%1S1anVb~mv`mzR2R({ov4g3n);~^j<3YYB zK!;iC9Dd1rjkF0}0?I!9;QRaAyt!c+>2H-FmQAV>Ap{i(KmNTP7kEQY1{*8}k+pXO zW86gjgr^bq8ywv~01zo~vbH>jxdX@SO~W_QB}zVQ^+L>6yH|p`6EshD{$M)> z3B&DO+OVu{W~9JUuNUWGd0J@Q6Ki>G z-$}xuiCLARiNf@9hYtA9uhfceb}NgODkyY@l0U0tSak-n`{iGkEr|iv06S+k7UL5= zj6C-;r8Y9V#jk!k6k9~0-*D%qh@f&ADkqi-J;;Rbhk<#ES@6Ea6kV1unlImHXv_w% z1I3(X)1BN>iwB^4znqEVO391O%hw0!+lOeDAJ&m*T4)`3IUf*7#o_JtHqIBUObg@a z+AM@+i)8;Ls}T-Q6e!CVWZ_7nc;ic9MzbRH*MOu2E}7UtTLy8zG-eqg#n{Ha3vwi- z0#b%pmzv;qa}0g2cbhV240R7x*7NkS%d@rjB_dWU7yf{SYsoHljL})TSZqfLTQw6# zH7PPVH)KL2yga48`Pgxd7@z0SapyiW*dv$?gC#-UTv*M?Bk}1ga0%wb_d{P;)hlC6 z_*WQH4$~)5?>C%+&PD6`DsNyz>?1ppo^8JsLKWRskkt@8Knd{(Sz#)<_wIR^P3eY= zLzU-UHZj|mV7}x=4Hp5fA?0)1Z7nA<;krULb1p3@a8btC2PijK*fpO`$3sSlFGC04|q#pXvP`E5UsUh7wT^1Fm4ReP*XB``l=`m}65b{}~})mm;f+)?e~m zlK5-N!82ZO;z=7EhTbvsI}Hdiv-!3*wfHr#k@58uPNtyY_sBqLr_y=$IIpJ5xBArm z{T5(<2L-2t=)*AS9Az`4y2UOCt1U=bb&Jeqi?B@QwUvELz*8o@wYYk`GvXvLR^m3Y z#Gp*9dv4R@MOg0X^@kHW8#q!wJ6==soo$LP;q|o%d_4g9c7P`Z0~g^u5W0hqzryDd z%E`3_6KVg9<8(3ztfYNMfY5q>4}TRvo1V4|Kq52_i&oz0db86>dLnK}@qRY(U=ydw z!u(PCpW!m@=g%W&$Om7~NEi$(a(gOfj20GR&5X-awVJeS%?KE~`Op^hxyoTgfi>T* zmMB8o`=jrE!pJBdFu*VVjpnIFLiov7s80zoupw41XPr1g<#=cf9$52TlrT)8c0ZMa zH3>l5zxwUw1sb~CS5!9#qWZ)mwW>6!w`=53kBG~s&3os-3EF7MAAq6XnHj@W`EH4KhaO3 zFvzOF`?+>U$7P)Y$3)A^ByI%JUYat8E0TxM*=UnM(NF#>5JX>}QFdxt@VQGC?e&PS z=MS=H+LdiVY-M}7oorgzwbqCLMR25hPHJ9jMDt{fm@ZuS90p~b3K zLgn5UL#h_iOA8M=&m|nl{&+6ATtr{L*Rr#l3VFr`L@FSgpZxWLmKrr!rU0~nKQsi2 zzb<;IPauQpm;w8_KlCSxb^I`2;)tyNE}VASE_~#7L{eV(nEAVyzX0A>_SKUBR2lf| zVsr-$QN&itDq6XmRv(NRd2N#)pl(+sQK?;b03JNpSbg|&F`-N0Mk1>N30O)4@C@C^ z7~h-6KLigfMF5s00A@_7sFq8aWy2^Y9IKcZsl<+8qY+!&HKIhige(;3P5Lgve=0zk z{8e6Cy@{|Oi*8fUZ^aY(D-n6S@=U{gOC&=~V`+0^HZJv|ured?nH#36vJfPM;Hz*% zLm+2BF|sBui_JEz@Mr?o#ymg(Kk2WllfjVse9y=2hZ4*Af_ZarilxhJ${7&dDYGpO z_Wq6>dU}j)*8O3Fj$$+8uqU-8vnxjadt~L))A{Usyx4ETm|~lVX8WBZ4yzsDw+4$- z{DtMpS3^)0%Ycj!vgC4KG~5=q#!{C3by5{(xTa;NZHlIk7tuqtmXCrg5v4`bP?qvP zly8_P1xBhDR{D?bXs4^keHCrB+3SI==1%nbyu$PPGQ5WX#KcQ4n5ql;YoDya8s$h8 zQ-m=5M4EO68XiNTJUxYh{I*HvIhW(TjAYb1KJM_UBY$;f7M=!V!}HP$_tbJ8@&cp> z6;CpiH>rVf`)BuFrmS05HD^fFwa9PZl2}cv@0z>^TnEmMBIP(s%PCn-tQdE0-`i95 zoJAv z!0Y>d-qWQ102qoFD&hR@D@E>{9s(#8J7b)?s*CNtBAEc^D0xxM8E$%0uf;y=qnhQs zk+h(FwW#)lDRN@C5ufW~p4^RAW9TmULz(4V8f@aWaUk@o-NZ7`utA(W`m+@K$rn&mBUxM`e@MgBNQBzSh zrScujc4uF6sC`*RP&|JQ*~N|ed74-(-B$)BpYuAY>$R)%WPHVeHH)h%edrd(v2gEO-XO(TytyF9^ z_WOeIPdoXL5kQ}0Nc|(_P=Zb4O2=hMO_Z7n+HJ zq;HPUGfN1j|2bFQHp_Nxg1We`Tv?#U8&N4OevJ~spelGVFNmJyUF9UJ{VRo4UR%AX zoD_}yT(x9Op+O%L-VLXOhX|=?{s*j&ohA_nkL&6AHGZCz4=f9y)4^X^$}R+_Ig$(k zb-q$bM3-U6J-EKmC>Ze7wge*bo?WHXi9sRwyU>vTh)P>8BD~t51KcSJa`EG5{?~aW zXpyjruPFl9)Jx}vKJeDvoC{Az>Cf0dzb~Bb6qRj2A+EN{?KA*meX6j`+MmD2goDAH z*c{-PNdH5Y%4YTJm zj8_KrLH0T9z8vD1=N|R!M_=t_>iggy*d4~Ou&+Yad5wb6eLy$j05P#$fBM4{iY1uy zvAIE`$F8iA2zo&n+B}|Vu1i?a4+)`=4oQ9lQfPUA^w?1hz3yGcMhI$kns-fSX?|DW zyqJ{~!F5&c$HCDjzUK7q^TdT+jW{nrZN7Tm>9QTkYStrou5V?z#l)3B0aCN;agZz z-n~%@aLPd8eq7U4F}Yyz%5n)|GLAAH#*o6_&Yt)BY3v_i!h0+QbDKR@gZC;Wk7Fmu zV@KFcMQHs}DFjizZb)>$C3U;#{3|5}3N(}m6)PRZCDX()DIUt#H9TIyU;j?(&8ReK?qB7z&p z92+^8l*>K!GIELnzQUc!0!h{uRSYa483^cA?oCaP1v?r4a0NB4sR0&LMQ<^yHesn zpg!%BvJ^>J{5Q;H^-Uvt=0*%%TclTRyxb^eFL*s1`-pSo;lv>?p9GaVnO4@a5Z?~B zN^YmI67bM&%=5;@Jy(N~duQ%HNaBk?djpQ5a#Dm6A)*PVHau$)g%!skcTMF*OrpUn zIg_OQAcfvl_JJ>iFSLvl9*~gm2t*3s=*Z67j^N;!c)s|Mpy5wiYKgSkSlF8qap*Lj z@^iQUnLWdtvp08Pl%BGWXZCw$gb3)HKer30pSa^yW!7%j;BuDxgxbD|>l>)qZ=DQu(gBa|++qI#K7L$^o+Tfuq zU#(QGrhGYUnP3jxgctH$LBKaydZ6Y+(dl-^oC#jVe+Z+u08k)m75!61qqi!AnsP{> zrP!9eAm!M>z65QtiP8}Zo8*W0Bs?=~n~;y8<#|AWDMQ1)EOXCl!+J@F4T`&kwQcrw z??pG(iL^yB?)YM(2Xp09#sbh9R^t{PB$f_W(&k$c#1HeqIAF#k0UsPmdIM*ubU|S} z2niv0$sp1Rb>;A>FmF@9(DkF?-u(?=^C-ZRyu{j}k>#(~!)(F&IxI>)*p7IV*A3}i zwrX`RPmx*R)um5O`~A9eq5Tp=5NDfQTR#>i-u8KLsb3b@bRh`;U}iv5aUuKqZra2}gs-@7hO;K_#{J@#fi%Uq4?n=%M2(1p+8XB=ywY#08wU;xk` zD7F4AAapJ3+@gxmjkrii;h>>$Rk5#1gt7k6Dz`=Q1lB+aX#eE#LydFCUsEl*o)-KU z{L_e4Eqid9=aGp3hW+k#90FW0w4kh7H_@VU5EnF}^^J*(I|*3>{A3GGi11;gd;H$l z-T5K=W<&2b*s)gY1Z9>Kl4anhBE~9cFA6iULIXPht4Qc zK&h`p1JpZkJz6?lg4-I+hSH}>QCM};q;T;@M?Vz#eKWt6Qs>aMVN!(B%R{_aTKuI! zl)Tp6Z>iCCD4Iq?-|U05ngWL=UD_MDPFJ*N9ZOw7g$ z<3r)$|E4EB|403IP@~Yar8c`0`re8qrU9o)@lQVH~7n(~TcAXyMmfH2Rxz z>LCR~3%k4&ly&HkY}OEW_tPS*ck*7FB`|NxHc3uP26FPCd4_eFch7|%DyGq-x6V^( zWsG~WaMZ$9rZH0;TuSU$uj|sNgPKE9?eN!>#@{j?)mnoo1GOhN$wF3m{IM|C_voi0 z*_ph5?NR~Pmsx)kJn4mQbVG-$^b2*{#C`fy`I)c~M{YYmPV6^+CVVrp?#xjbUHHH9 zmaL|0&VVWpTA?;vFLt4E2q^Dw^OnFpfkZry{r=FDZK4L%jOeEeg>l{e7<%Fhr-908 z05>1C2agFovYs^i(Ms(=KBas-)7)uxvg6hYQs9e}DhPC>bVR5KmC2d^m6a2;y;hev z+^vlu88@u!jj86@0JWoEn9_F^&*^{WXM{l*)5y+f{E=pg47mPHifNhL)AC;P)Rkpv zeQLefr54cO#mTW{8AARRe=}k@-Bs5{xl*#SfM3*jL4-vpHCm$WrKr9ahIag!pP(nr zyt32M4m06K-!klACsHYVd-~1yjAO&q2`#Kj$R615U_wML*P`84@$U1H{q)ISDyo9) zD`W|xg5kSY{M9goGNe3jKuZqoFQvoWM)*W($y%G>jAOka=yo#4xIY;Ngy zlcC=;q4!#r0e1{+q%X6h+xo(lgz5X5OpUT$U`ub*r1xWQz$YhkkQ`N*zu1ZcEG7{T z0tK~LPbt@RUcI3dp7EbQ{#7?*FSy*O2@pql`L5Aig2J!`UK&YpKMdl!kX}cckxOh{ z%n@faW|p6Yo60(;-t@~Ir0&NUbs5y`w1}_zTm8*i=mkuX;wC_9MV{f;oGoGmo5Op; zPemxD)K~J1GAc18Nq)Nf+hqEo%Kyl%8FdY18)j)RLg~e88rbx71D#b(*@K*Vx09_P zf;6?n?eW=J0BET;ljfDL7N%#EOeuNs9a+&gKv6)L8>gPn$qpNx zCUzRUmTKx>+O6qxy06@gt2i*neO~V)?dgdPO3+Lg;+ImLlRZ%m`=^V}+dp!lGKi50 zfX)$z`nYF}k~06OdDlSZr5sQb5*0zUB}|SyC;%kTRQqiPd;MCmh?rOkuU9S0b5hEs zmRq)P3LpY?sB>#W-b-|bbLHQryfyvhw!0WzQgc&y<7+MvICQ7dJYvAHD+j0kbpl&! zwYHwlW$qd)_$$BjFLvX)_?aOUg_TddxL3BdJi}SfTKz*EAkEszB-XjRB8FDe|2G;h;N70}9DE!(NS zc{yqGfjy6D!Li-k*0M6!Eu8@&Bd!no6=#OyplHJI98-AalyzQ)*A;CUP1Hx-b^zDFC!uLR z4uwdcXTeSU8qXsGy*VVVzm;`}!G0vhi@lj%*!Oyvy1!X+J$P(dR<>d_by!T@EqTs8 zy3btFKRHq_pW4x$n)r4{(MJDlb~j(sI(;O!#oDUXl65q5oIZc#rsA|}?dlxqHsI{& za!Y1`W5sRPy}I?e+}Tw+9h?zWKA^4#E+uG_r1mLsL7!-kY)lSM1XFE9cV`2~a# zW^J}V^><$njGkWd0N|W@d0n4A_sX1+UEh$BMfHzSkc;OB21^8UK??>q;>jtu)15C- z03rQBe>b?So2ET<9iarTkv89ty}M%>r&M*3#d{O%7e-!MMk)UN-Qs2x0|O2v zCreyu*G|+u4Mt9qKVV||ig5_-f0~?wag8GsNPo8eZGQ(f4Q*r6;1{}h@K;|O zl+mA4*DqklSyF1{By>ug`?9}NZej86!ZrJt+^2$t4YTwQ@leXQwD6l|j~I*Lu3XuB zz>Bxjre$F0P%}j9Ydyn@rge3S_e5I2Ag-Xl?YZSd-+*V(j9ScYsPK1{1PLeEXGw6U~nl{eJwhb*Ra-XtU3pDFHoH!76S z-|O2Ei8Vt$)(11(@1rcV`{Vpwwgk{&hKaG&w_yw+`?^7b0ZL&lekq#VOhLA{(GqgO z4WUXG`t28%SwL^N7OtACWBreuGFo`M^-ry8`E+o$Ac+X8KU(b^i&u`i=d2c9XVRn;@%~-h|GCDyaU{tCuOq5C-VqW^QzFn zJkoxHnQfx>K>EjC?!HKbi0$V$tKOCH4Db*FF`h=2nGx)Zm4rOWDg25M?N>s}lKYFS zdlSXzp8t&wq5ki$P17e@e*D?DyDwo06pJOgwDFqY)PFJfr~7Km)v$CK8@*6mhA`lJ z7VYyx3g(%t<~J-_{Yq!5m-lq+q)X~uaW$6H?Rpik3on+@DojJcY~ff9rn1NQUSU>^ zSp>Lrv&s|<=5k^{0~WRG@siVolyr2&w0o!4qX8i)fwHV{z@ zIXHD;o(U`sB~9P;Z;?Rj@!Kv<18KYA@m_HN^$&r&;0B$_EOF-j9n-FygAMoH z2`b{Zr{-I zMSUdWlD*WmD)u@OK6uJ+y%hMYi&YV}PR(L)WOm{!<)3Zgn9ZZWXfI^1vT&`dB5Iz) z$vnhoChc0hblp8Rq3|vES;PeJSmV-OL9b5H<>RBJ=&MrDvfs}zBpBz`m~)}AA6p7N)Bb5h?HBlIMw;&T&k>zrGgjnEvD(B(?XIz z!DeN3Dv-hkDA)|m)s7@Bj5o7%&VF3u%lco1&qn=U1wy9^Xu|IzBDQ&soMJSc88qhqxYuEnhZ^UQIB@{JE9&U!Tv-cqd^~ep`q@DPtXI>WKBZ8V9;zSo9GQATq4u{NYlf1706{)r?rsYUgNcr z4*yXV9-qKGBDgyGSTP=X!;iud_B+k=RAhY%DlAX;(<3(9M>)`;GUER;IqL0<{> zGKIC|Ki_B#v|yni*sc9VRAII(n>$6EPm&@VVn&0db%-9)fNt3YRl-DRBO+AU`#^U} zM6gtatdwI)MlnDK8%d3gttF64O=H*)tDYOwC~_*_g02-zuekLge%idXrZFKP;6vol z&u)~dO7Tdz>@Olte``3rxV0xQA`x6MbDl{Pi4V)J^~plRj2?s@f_%ly6@sW!=kO8d z(*Q$oAcrLc3?UOc5Sg^CT#?EEC5|wV5|5^F|4LuAr;17uUaTvVEznOwU1PwSqF$mN zR!Rh4z6xEaiF&Okv!KT4fCOiNo2wg&-pzK43mXo+L4G+mZJ%bqE9PMv!dOlaC#l)O zDJsA*Bpe&tpH3?yWW8A@C+?XWD4Prhgyh`7i zA+?;fY%p7vzkBTO7lu;Rpt)S)syfOpVN2!`Sa{iC<*xp05V8owA6&Nj+))m`s*`dB zJJoS9!CBcC- ze!(ai>>+V$CNkYoY*xu!sw+bJpa(S&>x?L8Lu%~&%V@Q{O8eNQbhael|HKQ)D||G? zfIcZ^)fo0=dlM7J7dJ?|>4mFpL4oL4D~fQU=6iG9qw^(VMHvmb1*i3pMsYlGWJajR zJ*m_2L2n^+G+Xy+0(qT+K9zqvT10c<@nTOax;S91kBUfghE0gE$qKl)ZixAY#BFTG zlFBsG&o&mbDkSq8p1UkYF*7DlpvjWN2WXs1Nt__|pkFpuchxlz&YU;_S)O{I8;|HsBarm#bedl&pg< z0$k%|2aY$BEp7-eG~9YI5qH`S4P#Cf)X#36WziaZ%xQRiT9-p7f<0#Tm#W4W8=j=& zZRg_djp_?zNug;s#mQ0hq*GSclB5#tSUTQTWhe-VE7gFJOzYL_ zIEq+_LUBDu7+$GL0B9P7%=y1%*_%$;3tSaPL*l9@Sxi8R1Hf`9dt>ic=YY={odfp| zK08W05_APmK+jkGPnLl=#TTP0XMHT7OZnp8^x0pQwaLR?DRJU5r(_7sY;@Y3!=!A&x`MR3BPsTS z+3$+7mIiVm?0$I=1_xoeyUNk*M2YAMSvg%9|M+zsn0F9PVfkn_-mN1Q?92RWdEo9E z1Nw=Cj@KMdCj1gjV}5Sl%G8s&SD-RQSy8G(a3P_7@lrB{$+EzZ`1V{I)~}mZs5}$@ zDXV=!DtLlT`(0A;Kinl-$T+3-gsQtJ9j#85G#Cj;MD+kveSrHXF@e_}o%t zS1n}BTSvhDmU8Zz zF>AyHPe>5!Vh8118z}Wk=SXzfv+4bV$%!!dWP5tOnDs!IS1UNN6fXtMyoBQ%MuHm` zR9F_!(wW<@@zEJN1tqC*4|8~Pt!iU`*x3CM)X%EX~vrpB5p%N zYS@qqce`Xh+c*wBPa2@zUC zmRg*3JJ%nk+k9gU7z4^y>wjYafZ6L9Y!xMAg|v44eizFZ2DGrjn?yFv2YYI;g_ zH>kh%_CG>>wj3BNj;25l(0Et4e7y!&_7fY$KiquKDiG)h^8G5sE1OUAdGXAZ0axcI zx6Y~_mcK0OERw?FKOffael_mxowW$upw&nw#~SX@9=(212pF4(+!%8fgHyC#S`FF~ z0XZR)Of*kV%HW3S;$InJSrTA{CksJ`$i3SC0gs7ZC&E)SO^>#GXtZ-XfZ|%^fv1wr z(lXo{q_Ns#?(=TzHe5GPj{xghl(90~eYq;Zsc1U9+#f!yP~124dYE4|-H|^IKn9Md z1ym@bne{&p@cqr?k(}rCb&I#PdI1Ssr-4-AIt8Zv4XfSOfh5W14*P-V{G%yh32yC_ zOx*6Yh=bLh5xN`@RXpLrgbnJ+VB6nyB#c|L7Xt$QqMN~2Is~0Fc68c(Dpd5uw0S7~ z!Pjhqs{w8-$B7sB63BU0^AF3PKDYDg#iIq%vL_e61xZrevk#8)GLh$v9~pn2S61c? z{p|YUx|tk|Rqf*VlQD?Y!qp;;H6ZI3^G=4x!EoWVMXhVMY9pZjK^ zvYWmf>IDc$xRi4UiJY7PrdFav69Rh*xKc zC@cffuKMaDv59uhS%hL(0OQCfw*`zNoncgJwYZOBoUcpR#0TC@V4w)Kh$bZ?*d2p- zIxMZtpjk%l@W&{Fz~IsRWd74^{+GFA69lC6tVQ%Ed9Cr#x;JH0dCM>h8aEJJh*j~ zBUd2xPJY%;8-kByVM0-N{*l7yah7r%{#S8Ny`U(m|n=H?&s!0$mf>x%e!&h=V!t$WsRYR1JX(|PpSP@zGC_s+jL1LOPP?s>3k|dh^XOL$LIi)#a zn7n{r9Z5~-sBJR~^EW1z9eHIy|6M8M)Lkk=$#%F5UA(iF5b0BGs4~5b=F}e1Xjj6X z%*UJ#g__0L9Le@W=Zsxf#*FmwZenBZ^u%tzu)#`D)eo|W5mw~Kv+TYSW{D?jC0ocL zlVLIy3u9!ELtYA~p!!27K#7upJqndOk7wMXj!L*_g6Jj!% zFslv=s1ouuV#Wo)cCADaA%wp@zTfAHYHrTx9?E2_jK|0ptxl{I+s7v) z2YC!iC!Xhh8Ykh4Z(TE3+9C*;b}xD4|E9gaVSl)ht2hprc7z;FPlSc&xY^n;Ed)}%n(JB!fO2&ohnosj&BfNGxXzC{EOv)`14myvEQ4vzvS2x6N`|pw z9xT|I)J0@ZD@f%);YaBu4CAI4rz;}bn$+6FuU3g~50tg|^1lu4q!-zw=?&EQNF-3p ztj*k9-HBq&xc}(PflG5hgn;cw3;#1_C@q}A0<`=yj*3_Fk{*YY`8GCM7xMa zOhIBHCmyRn@{6$Jl2{YPw})wfu?7pWDtTt9B#6r!N8EXfWf#Clq2;;`U=|X0b4jd< z6#OUcSG(w}w(%PxG~QU5^GW4NO(p%jj|(IF0&`I=Elb}mzy>CEGz+1L%3&x}e$`@t z+QU?IRJ(#Yw2C~4>Ii9Ii9HVi=Ko?s>YgD&`$*^r<2wQY>GwlNyKE9T2wen1<_@3Q z*A((Y$H#*Z7DoVoP+UM%6ESYoOun-UMQ9wPCwyHGz;geMaA`VQfv?huT}KgN=!%of zEd2~udNynU)qFo$?m7JYgvsJ4sW@{{%T{2Sy#p;*O9LaeV&FOjQ+%LVxOH-ces8Yk zFJ%YW9%#m3vVI$iFrNd!Q5O0R^hOZ851eSQ>$n;x!=yroy=Ij&(+5UPCz9}7T?QaKol2sIphNlYucBGk z4KdJ5LXH=o>0U%GWdORz-$IPQFS}1sb|4mos(Yw3E+c5t8o3m2UXRXyoAI_gYUYx+ z4TBVT@fq%~%CL6s#DqhSffi(p+pv3d8R*->L&n zxC`aHxxf!=bAfEr zJ7?i4AgMYaGv|N)j{_{}O9KQ2atW2*hP4CIMydMPDDBt8k|YIQ?dJ&61`MBu;O z3fgO-huowl^R^6WV8$sby)D{HP36S2tY6feV!tp^^)w0NC_8d zpAt51pQnF9a@BJgQJ?a3266W)B%xQ^hD%M=^J@aigD6zB1Rwrd!w_1q;hploq9Y42 z5MBh3I~UmLnE|qjy(Ct`HJ-7Lv}`SqyFXy0u7_c0Bpj;_kDhYiiAv6A~Hkup#2 zwh|5Sbz*WCcDQ~WsXzi}?_%2T(*i;jq~*9N>Go6~f3_z&dq+Hw5j=9@!N1}66A2JO z1dtyW82tFfWINn}EC|DQXPqi!;oZipU=3FCkP3;4QXIfP-tEW!3O)WNHMk$wNBCF! zv7rqZpI0I{3`MbM&qkrts5{c)qdB`GKnS&0gW_(KvHli_YF9Vwr?9u-hOxzFcs0~T z!=}nSXGqOo&YK4yUPg$H^5P0U`(+}<^G88o%mg_aqkIrJ*#AXhnABCa5j$N{<8T{Ge7mP<|}N0H(7fS;2?f@zDhuYEwyqB7qXE5V#UnLM8`3sY#L&Z#|HL zOxQ7$%LnvbS__kVsUquBK+hpiAzrX0G&wQ9uqEkXVq-!7n^GE3iO1BYy>T>a%aeAB zN{q8Zg!={L$}o878LiyhdnRU^-a#~uiXK=k~PM=R6a>Dig z26^3A$2o0%kDgZ&@lUQw_A@oQcMq1Ac3xJrHZrtfgq|dkgk^DE#vFL$0$49}!;<7X zVFXYx7Z~|DS3a}^MiBW&4c72aa?Zl!m*kWiLc$JFstN-)BnwLtK*9w-5!5Va@+@(H zg_mtJcIyIz)FCqhi<81KtVI_P?5db&T+t_iNrWIjj`>ymU^hpi5~EciAPYgS`XpUS zC9^dFo7MCi9!g!d{uF;*@gvoGQs|HR>um*LW49OgtpG#`0F~JcigIgi196C!sf}$A z`11nMlM>E06s^P#2ko6di$Rq9O#gFTv%?Dst=N?|b=wDkGXaR@l5I=x-JnRV@qtu9 z2rCWlXZ)@3GlfiC(3F#B^WBwrhct?NC5N`QRybL!bZegsT~*pm@0aR&rlDgW&IZDS5*AE^uRoov8xkp6tw>WY?u|MEgMwqZEX z)Yfsa;g`rrZsPN|Vel1{E{S-~QRD>i_q{o>McT!l7|{F4bcoZxN4bNE*tW7MdP@px z03q$hw?&$K4U(l`EsSP@A^8n*2NL=|XN7<;U1Bfx&`l&d#22&S59^7{kbfXEd2i?b8lNyakbXWs}Q4+!rvg7(gG$(;cqP zYwo`xg;-tXtPt=ui}rcgHdN+nQ6wP^3)c*RFc2=>8rl(Kj0`SWk}^zKargYB7j&D1`|r^@RB*?;)+1w^^@%){T~`h z&9UwK0HBdFZ!~h7dZ0eFl3byk6%_|AVhQ%(*!m_V4&SpO58ijneI49l6c7X8jKcSH z_xXFqzTR8jGOy%4Ix)cq_p=gt-YZi!jU`h>q&A*V$Xf=U_ua8@SWozS7LUZs!~c-+ z;#fElt~mAtQ861hw>}>&EpI~K3)g!&X%zySrzsmP{oS}4C8ijkN>Rx__)sO2G)ZQ3 zd6>1_c1U7-0qwyLK;XWiwA(JYH|9*n|L_;&Y=f~&21C&3*8mEvH4ne$2k`^9Ec;+` zS(Ck30>tw{vOv851Avkbe+Pr`((yfC0q{Nss%WCSYAeiDTb#9ehG4?Tj`{K|JXPi6 zj&3qvq7BdJD=VoU5(DDq`EdCcdX(squ;4cbqD?~Ve5eVD{Fa1Vx1nMeWud}Xd?VuT zxbHnB*+5_Z9rR9HAS8YHUS_%+D)~X5k&v{d+;5>o`>5>z${_o>1a{vYEUQe|b+tt9 z`KpDH-#?Fh+3m3}pKKMp2lTfg`kywCjZT)dsuTA=;IG6KaPz{QW5`q+?1ExrKt(t8 z(_Y?u8{kz>kW;RDN~qo|#4Xo89LDr^09XIdvs|Iy-k|MucMk=9BZ5}i;T~&8Zs0rm zwJSgm?b9W5pVf5iyP80*JDIUpsFOw>0MSVR2UtP;Ba{EtV~~zlIOAcySfG``A7+VC znUJDIEmk+KNR_lUn|NK_=k}e31zGvhUm#I^^8~QJE9w_DHrY>gYigDfk@0MlZ*S;C zp>JrlkY-hm$J=`XbAPGJuY48PIC;IN&$`22~pyS@Gz zqXKqqE9DsB4*VowJf()Vq>=G2d+Pz`4Q1sQnN;JlSa#*=xE zr4bzV8J-%Ijb&DqjWz*oIo!3Z#yu9-8G_U?9Ok~}1J%M*_A*mc`qr zymJYY5jv3ypDhSwK+9Jj&=qWZkFyyh57|KEBLS62)LbMMpgtv&p?7)jb!sfkj=l#J z9o7g~ozHDM>YYq805Modzn6Xos{05wTNE=Ob086nA5Jt2Z!N6WR0grZM#W9iS;2SS z0}4{%|86R=BD_m=*eg)r+fiS37X!;qMmvOb3>3t%sdp5+#eqivJ!$Ip;5I95L<$6o zyE32v$+Zf0%;+-93p)VpjAiDyc~CnwJ$%LkRF2M3YJ;+M|L;{pk-e3jd$y>T>W5Y_ zRk}rcWIVvLGHEnWp6JsA7UbBoJq6$KJ>>IB^jnJ@YZK8m@F|v0U8Oi$2qXbp40m9Q zD%A98d&6Xxb{zmvP8=X6$oLHqy-XwjU5m1;Sj#&0``d%{Lk+)p`|C?^x1lC_9hOH zEMU{*aHLc0bXy5h-klPuv{j=gt0pasrZtJ{uagWaGu;%>BU?j$**yD$a z3>Nbzo+sDJE2S!(OEFjbR?EJ}EO&z`6Qxs4GM+hPM5KpCxAsiU>Agz7*yj(!w9*`R zEH|z|95hB&XcCu~S`wyi>d*L^tus{dx?AY0B9ca6vwqdT%t;jCP=~L=_d_Rao~4>Z z{;ANOK+g!B5}}Q+Ku(+XlrDBbRhJP12xs7b!ZyKU`Ue(laIWLK4!GP)5bjd$O9y}1 zcNWHSaeY#i_=zhn_9MQg%==(}5L2DI%EX1D%cd<`j^mr7&~EvQDhBtZwwR{!e5JQi*4aLJ2j5@j3!Yqw`&3|)ZlFO_*ZT^ngdSEK2nOHh2V2e@g2tbcw!sGr_rf$Xhkp^`K>4OrqqoPj$Hw@ z;gZkIlc1de6TJRcT-6&5pnxYPFY9dp&XXJN$9rgqLq?s7kqTR%@y{Mnn3j?HF*ZepYFc_s)PvppYe zWDqVP+;~bsB-7Xy?cpYT`nAV#hq~Lg?y*!7;W(6&`}t;wn$^zEXYvTr%WZbip6utu z|D)5= z)!ik#c2%2ojwh7;kPW&Y6e;{bBqr)J35>K_lt}buWNVyh;UfX`u_6hW2{6Bf!gI>< z&LWuPg9_oGkCkDtF=p!n|D+b_L)c;n-+PKcp=kJ!Ut^Aa<)p$E*=>?sE{uZMnE9tw zIpN8MCuZA*W~iPRZ66*?uECKgbgO!!A6MA(}6f{f|F}dMe|Uj{ANJTyTJRUIco^da;4Bg0~0(IUPV&g(kk(LFw$4=*ZnbRW0ef@CZ3 z^`LLnyOmzndHS0Z`8-|cx@p*0*TPffL`qZV73P7^6>#^}-)fL_b^JR6-S;iUd_Ue^h4Qdu1~?V!TZVKC@eHrV}J@yKO#VHEKtmw}m#4$#OnJ9z%dp0=McJVS@)lDX(n3y0^s9lnM)tLm0I4SdUjV~Hdlby}NSA*h zArX*PnE_i*Ix)rHcZcc3{JTZ8$FYAPB!btIfG*^`?GX2*LZ3$sZ2;o#06Rrr5!u6i zgNp=oFZ$!~wIY5cpa$BBS-khy`cU8}!j}&cr#&-g6V1OvXJ*PnhqfFhov7XYryvP+ zx}Z;EibuoT)H<6!AueS(6dc~)I^7T)&DKg!?m6sbHnECJx|0^Hsqr71%~`E{njLpu ztPjqBd&oV3Zs$&I$2knZB#%Pao$lH@-3EHITR{i{d{jro17PJVfVwC!g4DaD+u7+kJhIsJ%FG& z{?UZ0^z<@WG4mP9#8i9@WF>3UV#z}0v4Ap4XDJ)!eAlJprr6IH(!4nXWr*d#rC*6+ z&rY^P*{pGIUaA!pD`^n+@hy0C{kgalnbYt0Rg_*=E zK`Fsu#0RAx-yRU1n`O-8-STzxN*2b(uRKiGoLF|1w!iUoicESog2tXiuLft_xwGS$ zjI!UFUmvWrOUf;zueGsu2TrYCw-X_N8jB}dHL=SrI{;2D*PvOs#ELSqgnOUGBfu(_W3Q%J z0CRMx&aYG~50pJBEgkk_+PGbAN8+oX&?xvW61K}EJ$BqxU+V85kIo}HgB-EFi6NKY zhgfXqOZ^C<>$3aru5ei1u#e^@=d}K_D<*jLWgmkqreF5V$bU&|5iQy1!{Rqpr@mV| zGq;{%vX7H(GT_gMj%Bx|;FnCQkL>KJ_|jZEJX-PTA;kHKlTwyr*y4-#_trSxajVr{ zIGvyjJg?Y}p6A~Ur3z0t$w7NZFy$MbL%2`nKs51)Ffgl3*uNSPXQ80hBC6(I<`lq}xm zho|Y8@DnL+cjMgyDG34Bl#H#u3Um!SV$eq+kKxkyICIgDhWFf#XtU?T`XU^JNRO2( z-vAFXy6ovo%N&`08vPAuxOurr2ofQepk`NzUx4n98xAZM5mtc92*iv7PUbf(C@8gv zJhd9Sn*S5!s7|>sS9pn;!jI;gTo&n7^8d^|Z$ z^6B?Q?fXo?9l@?jwolBMuhR_&`-oMP^T1E(EVxc{|SEvSJv49o+G{|t>NN>BnweRj)HuwyC&X!PFz z$l5{LH)I(03|ZKd255AWUKHH0R!05xyVzI%RnsUXoY!8(Sv z6yfJ|LDUk9Z>&X!TI=QqIMEv}iBRADX;gi*Rw*Y!jA%s@l;mPg- zcUS28;y>d88|`*u`f;2Pg@^mixX8x3xtAB>h8$ERS!gK$%X1~~tCFpcW9H2%tUG>Y z^p6&sDVsKAcu{0t1C(#`Wl*PvznwfW?9Mm8_}8>vHZaW`+=5#UB87N>Zx~g)m>gWn zdhH94Kh;*Wdo9p?u7VP@K>$%B@`C-n$P;?~^_{?tDc@l9Godvw_2-xLJwgGk7Ka~P zwG#sq072 zVA=f5EG*xesMI*vdHl>VF$U~z^2z%aR)9=NeQjB>omIpBN^kZ1548&jrS?tNAdOAQ zTUB1qvm7d?p&}-#2^BW&l>_(2jLL^yxNCC$Q{VTE<^5VWO2BKhu9r?6{fM5M0*+!H z0$9II2`z#YA`ao6>_tvQu%oY}g4Q?WA|YT!IEB1RdNAcviur5=w8SmK{>3pc1$+ic z4~TB40&Jn3VcMX{tPpuqd;SMxD`&%~a_`$O$ zZY+@MhyJ)EH>Q7GB|OGMGA4a4fGVly0Ob{j zxWZ?iaKM^S>D-9--J*#ru%?x6-M=wlFt7o07yBP(QQS5#;ZTe39u2dH^HzOp1J(;~ zOb8+3_Z~X8v-~Z3tngDN=Wdfbh{TS(!70l=x<$J-(+(tFV4BNK zVGhk>YP07Wj13_zDTQjg^OP|%MAlyOBO@-_fm3#v?~#E3;_eL}_msXK<4K&&`whT- z=LbO6XqJ~@OD4>5PnHJ#Pp03_amVnX+m=jo&&&7S!3YQb+uxnneMqF)b$&}G3qq((AdrvM0- z9#j$Pj_0nhOo{|y`}(W32sd@83h!O4@p*ze><&C(z`3oM^c)xvkv;dVUXZ;={?xej z48^pXGMOktq=Z?Nt>H@QlG&P&oSJgD5&;y8#JX2ayx*25mn^~>u6x!EOBX?Hr1`5Z z0-k=E-0eoQKoT#cz*j~J{s;#?Gb3JcW7~G2T74!FdSHeb!8^NlydK;yhc6{N67~iw ze6GVT(7eTviUjq2*VVV~jcFai(xGid;_ZFC#9Tx(B6zhptfi2!a5d9qz}|b1_qszv zDx?f;5Ic3n61mipNRi6g$lx=_P%5-6|+F{cg25Tzt=2R`QRE@uU&1=M}%J*5eH3i5UoEgL#AHbQU zw1OHn;Z}ZRGG$*{G5`K(mQX0prxI3VYlxyON_v%q6*{Prp*(~nO!N^c9QFk1Z(>l7 z=iqa0f5J%F$p2=T>bLNs7oy!JkiAYzc2~0T%Jo1Ol8?QvtC&;F84Z8dNY>qz$!5-E z{|4}1mT=PCx7^hx?y{Kh9BuPll#@qsWX1@mzG~wf=8m3ny&=hOExh((OR5{kGW#WT zNQzt~4K5i|2YDZbvFmG6Kg93g|Jfa-t*DI#*N?w3(a!MRAlt1fU)=QS2p@0k8z7M? z)zpD9;P62@gI*P?{}J4ksjd0&+wfH}@4g_C2Y-y`yYpld9-=;Al^6K%OPDcQO3u=x zjWVGQDb$3#9D75UoFgpKb0caa^iuVL61aE2+U2BeRsYp~R+DPN6CG5UgKK%-fEYW% zOUIiA7bF|is{#bIenXZFL50#?!+elpWoQY=FP3Tz_x4@h?#h-fpZRtf1!PEMdsYX? z)^P3PQ{~9BWdJ}LtObNMu)bT#+!&`EeX*qoyPfauzTX@~{d)o}KfXG2x?2V<&@2*m z8RqX|=-_RMo!c){Q`(ZfEryO^hIMQ3(oyt)8souLD>uh(u&{_EZzlo6=vbJ>TokEK zPr}EiV+RlJIm=?=-Ne0Aw_kYT&DMNmf$U~LYVbS?h`cn205dqqPf|N2qDJ3l>FXTX z7TNwVvfo9BD#|mWekfqfpdkOseolrU)H;YDeGnjjNMueU(=JiAF7bATZ45Xe$4Bc> z_cq>OzfOtUlW(X4IUXyTlz*)8o_5xMF}8*@?TY1uDc`d*_DWrp-euF-=+90|EOFEBrd+&V4mJDGtP>ksZw>4QV6`0hncKjnGpj zr6lQ@8w3|isvN6kOF?w9ft}&DP+$HFl|E-K2%rh&YF@7<(j!1g_ zys^Y*|FoXWdAl)*UuV7B3+iVIptP&Q>$h9len}Ja4U*er=2>9l1K*vA7M7OKEJoBA zie}l4EAm6(m1koUF}Jh>uvyP5sp(WqJhnU-|5xtmZJZ64{>eSvA9aa;_RrsEEp@>8 zE{0KcD8Y|utk6tq+bvJ7f&rKO5GNf@%3xucN1=}US6y5#BU8P@8Y$Sh41{kP23Mln zDts;GNIN(%;onjL1x26H}B^t5z@SPP8kaMhA$-Nc@f%d ze2QYXPr>}pm#=7r(c&t6_1qh81x`dp3*CWCFQ`!f4ze<^)W;1Td@y-wxeZxYIA8CS z6LMaJUX1n7{jHda7pIg~bYdYX%l)tNrf|p&OQ_X#?qI^mfUV3!m;r?GN-TBw?g7NvLeUgowPK5NG=>9D8+l3A8~3-D(pUBaBp;(v zIV)wHZwiKI&+k{xOo$%pjvp4*!Wte1eHc7HXN>Gdy&bayHGd8%m{n?h*IcHHh%8z| z6p2QT@91$7Ub^8!39<)bAHu57d=go0 z=CLMBv1X}M4&cqJFoP_C>M`G*BXhO?j2he?gRBd+8YrYc&D%*4C8R1%Y}=sKNT-T8w^Mq@cT^fGG;g zFQuQ8cx!I>a5qi-_5Ud^bpT$eI!#}S31-Ldt#>4Kae45zB{>3BR8vEzbVc+L^~5~j z6bj7H+b(}f;oeI3-$z)3pE2i%>9}=m^+UC zz_FZBN3^kPy)zDl@LlFdLW0@&!BcZvkSfB&^ACAzy^R~c-#wK?GLB11Th=W#YfgS0 zYB2*f`;<4;mbgxwI?~qul&!}H2~NLG>~{==IsCrZF~(?djStlP+20(h?rw2{<;l@sP%zh?T6nCA?N3yc3<&!irydGMCE_{WF1T`Ey+YlpkV1&so8u& ztDs%gc9`WMv|=SJQfGr=MT&?{!NGw*fzrQc$-JETa{`@sDJod`8~wzv+}IT3_AUSi zmb+|-ICgZ($+1o*wJh@4ZS=GVI)xUsOt{n_a(&pRHXQ^oe#iG%cEq5c|G6hW!wFgq#LpBE zra^Cx!Oyb?<@DS)A<#;j#e6@*#l^InDs86lP$%O?w+@4`Kb`4JlI5(;9N`9F`*M5> zj3bsTlBQF_s+SETWc^DwQ>2=0_%wpvoaHUbg0hgF5^RW!N&*&y4y`iEVR3%qp79qt zZIotXb#y;Ca}L2}aXqDfLBkq0@ID^&j-p2-NKzS7=KxNnISwXIGmJbszGxbNprxUj->vEif%bPNC}~C~7a4s- zOVAtnLl48z9E)P?8lBhvG}M+(hYG`=lz@!;KIi@Ob>U%08DS%!SUu*3AjwnHEZ zX}u2xlFxyzvQ3m&EZyW9GXT43>?)a-L1{;#aI=iEj<&=5^xAMdg#?f-$O$*I13WBjz)dN1{*q_hE zA82~pE5@uGV(;l6kS+#0z&){Lc3H%MB&PtA8myi0rES6 zaaSd3tAf;-7)=izjYdfpot8o|Sk8=iwuDp%W0p{L8@eGBrijfk3NH|;PEg$Cev95{h$PL^JmT#>XMja9p z?c-%@wy>^reeTE}39S#D7Rkov!OGTxvINp3fIS{95>#UYQEw*gKm?5AfVC722WYlWKqxuo4)+F#lvY6n?nlN;z9F&Egp8Hm#i#YW2lU5^}l81E(*nSCE z6}8~gzj!pq@PJBN_9+kI`cFKXV<}ckNyEcUW-?^PqS;Z(Crlk_eqAd0rQ>s{b)e_9 zzFI~!kjK&_BVyy5o$y<`Vs#s-l1iNYa?E_9;eOBuajN)|g!GRQOz;g=1S6Hg38khV z&XLMdc2yw1o~oOf25=Sy#an-#@&24oQa>spAo9=b9AJ}5B?^nsfTFxLz}V4VUbQIw zOu33~{c_xHeWO?QJ+;)#gap=Q9vuWBlNkD9L$2{hpPvmwwZ#%YLGPA+AjlY(Y> z8GoChtT*qz#|J<5#V-3LdLU})_5d)FDXl1^bUGK*avnFoHt%>Oh>q>0T5!-&X}LVz zA_{@6wZ1x-zecKDtI+WpTYK^(>#@FGlz&Pn*>>{jij-NGTmJI0e+OxI?Rf)hH4Y3o zDkv8UO&pP?G9#5mBfhRTBr`ttoe8LLvl%W!k{ zEN1ge!4A$I48CGEXav0cI;cy<(lqG?Y7T;rjp8}>g_~Um^$7iTaWL%6(;4m!G0C7< zD3+~p|E^ysq*36v>(;Ht0AXiGaICS0683(&GYXtTg!j{rzaGx{P-7maO6jamXk0eD z@tm##Sm0uLdVC+TLRfRmYt_K@-ODz`MW(&8`KA^;F~w{j*QA+BMH?w0@EtHLx^OIe zsFkm*b~&B*iuJCkv%DpI_9nbn&2bHMv(LCZd(90ud9;9-1?H{{>#+5Y5<`u?{7_nc zOuy5^$q#hEyV!*w1r>@0t3nL-rRqN-&Hs-!G3GEZrWyG`COnA~Nj!O>#BJA(E|LQ)Or@P$cV-lpZ?V^{45P3N%IjQWgl;Sf(TC?oCoKo7Vx-s)g zTT2ep6|;gg5bE7)OJr-Z-ElR36s>}<;R!1AclXf)2`KfFujIC00a#U7hgHBPr#P`7 zbe&CCYvh7xJdsc`J3ZLHaz$VDM{B{;y~+jrF;Fh?50I_HEJMCNq-3ei(+83%Ou4}X zGh69g_?4L%sxNN5I!1W8pao@5a^H{P)nE3go(^PI>&@#{)3nvPN2Gajuqf{0 zt#k9&cF(MrS+!`3%nwI64#JoL^S8*5FG)2 zv+;jTeQaNt*mn)?OcjAGtel>`s-r32dSXseyQ-PL(Sa8oQI=mA!RQ*!QNge)?=z!2 z2kRv%AK$~xytF7X2BYzrrkW#A_IOZS>#lqD1(I1p8Q*0GJXCYxzb6Nd`cfpij}gXo zW)BbKcs2h$o79Sx8VJK#5(K>dpDt;nYCCsR0fJ z^yd;2=#(s|*ExbKCZ*t^ax`QN-ylY-B9w*P_zT6jpD(ya6lY1IpdD@~BWtp``MSyV zpo}vk-F!)8nzqcn1eX2fTE;JOdS4q15ilpPk6}uOZ-C5NCcbrW7YZ( zO9u)tu+fXC$(9&@o>5O$U`U8>EO_ich&Z`*txNn{2M-m}((U{BO6S6dN|Q|2>+vnY zHZDWx7|#5j`j`dD^r-!HgjZ0`fwN%RLUo)uNmfOq0ksvwZMVb_UCPp?5+yt%lM2YQi*9=2TMs6zU$Nb%X2FVnbfi>D5&Hm z5UDMMK}E0rec|4a6YMs-#9WRB(d7r^*9^24si`pJ6J;J`lYtnPjI6QG#|IuQb~8q^ zl&vRYK9Scp4(Xwg6HjCy?;40z@QJ))6_*?3Cg=JQO|Zbr(uhmd2a7I5j~=bjzcYh; zbS7$s2o3m)yAnkU;=6nd-9jZse8pXxdfuJ5p=udtS`Tzyzmd3NVL`{pGG@2)UI3yv z4@wQR=ZWWo9MGB0&6oSQzNy@a=~{wRcDOC^6wZFZ{N<7+}&aYHdFzdfp9mlhE>CiO5S8@7CMV!g0vZYLHtWka0$RT4((mHL~qv7uqFmu`>8gzd>Nk z`zvu?wwm_Jvfp-b859K3P1O~mrD3|LH^MHZR8<@T<=n8(3A=`EN6FeaG86x3`xZv0 zpTZR7J(N@ypI1PvP9h;=dQLR1TeiTWkrcmlH;RES94zD61z@9`^D#`0o>%JdEFG8gmDvV-;SH-=*=lcwu@n&-I6+ottEuuc}JbcA;W$z9M;b9JE6= ze7rKaoXK1DXrsNAVvnN?0bV38=wGstBJFC+rxfs(bS;k~OC+?cDRbe4adpBc?Bui?``jtQmdA7#sw{6w4l{y>7nzdmKpsFt)! zJ7$=zH)!pM^8G;Ca+6YzXs?<5r0T_QW&G{ppMn$kXBLU+v5mtVVW_p){Jh#f5R|}5 zHvnSr-j~^b&V5RZuQ@QZ<%23Q8)#6D$B-77RtzJh)k0Ad-3-!4Zh~71Bgy)=2ub63 z!fdPdMLYGOnwM{>3k%Wh@ARFmaI?|Ea%1O@+dAnCyC%NV!ZjJ+Pt+2r+DtvUPD*zk zFG|Fv%*I|eLVlVmGlH{~4lKmHv_B-uCHj0y>)2EEd9HoP%7`hf?71D0f2Z3wri(0( z;k6a>TfDFBXcXGvZO7~wzg5Q=*UT|FTP48qyQO9XwZb|}730XmbQGG6F;pwyz{6Y@ z$vW}>q66-3@H?)$P%p{T6*hrQWCM*jFrriu6VTiDvZVi&K=v*Q2 zUL2FPa%AoczSYTYVG0Jwk_cn;-E*>ROJQ32i{r`HBRklS|6C~uc&{bUrsC{B-c1oTYS5EDnm3`j$c7Ya=3khI3>XOT-nf5OtX|x zUb-;_IvY}q44c?^60o7rf0H;$0%4w2`_KV0;y)`zxlNp9O>DJz#oei1G02yb(2P(H z=&ocUf4D~5RyKf7HyLy5jb!+v9#81FsmK)}$3z+OxP z{?j?k)t})6hW7N9#G z*ESuYGYd^15Gk(5r}h3P&avmjTc}YsM9`wJE9$o!(18BL$(msRCD-oB@4WBn+$u}~< zm~$ADGEfSToLt5+WW>Pzfxr47Xn&y;#SUZ%5g?LJRbPn2<^@rg6d|ANHKN-w`@#K# zmir8q2Q{PNUZ)}eKL<`lU@*zpWznt{_521CGuj8P%i~2a+fsrcE58z$8Ndm(6_{Mv zY?DRfNj&sR(rdMtap9a=5Z5jaA*2c0(bND_a9dB#GiFjwcFikA@+{@ix7P2WI8r2a(eec2{P%pDfllD_IWJ(>-=2R( zfOWDj3IA!i_*PKd$9{9k-R*?e@~V#a0)dkLW2P{$Q5qO?Qothqq~avc+=$hq#|>^r zcS^oPE)r>Brr}}!9AO|#(?#-cTYWV|1U5*M++)XH2$%xLvaov)s)4kijbKawsuoWP z#`K!oRu{i8?P!F49JTfA5^0v)2Tw(Q3S#N7K&6&9K4B< zlNbFP*EuaG(Ox7fiSh|zytz~t{59uZvyp%pN~wA8j?Z6u;O$kYov;hD1H%gN$F!w& z7{GfPB!#7=7r~r;h*y9EY!tT<#rhA2&(CyKU%q5`-92}dL{xnKxqJH3!lfO(_ENBZ zYO~h<)PdZ9YKd~&B+)Q75b+1uRRv?bfNdT8a+V`63fW7Jf*cRQ5C9cRFUQD5q9gRn zH7qg?O)0Z8;&0S{FvqO(i*X>r6O8e#PH?Kq(2ta?{oTV|U1f)9^Lk%TCLUFt#XFVe zCTFOy$Ij=s(FeW;@hlmf)BF)2vX+NDFE-_UsX_7<`T&u&AWwgc3mnxVXLGEaSQug~ zk#*H~?SU-w= zc4<4xCuAY%8cw*|Iwh{W?(zYV<%HjQ9f9ckl~H4k9XQCvm8NQ2f{0vcSZ=ppqOgWQg7v2!Vf{ z>w>J|Ax!G<#n^?@<}`h_T@|;NB7ZkzQD?JntUl+9<#?ghux~ z#)yh4jd^e(T6a0guDFU7zH}6q(;5PzWZ67hP z^h$V=i!8k5SqALK2BNVyY%fIwr4bKSX+y)dw6_S-$P+h zQj`;1;u*FAsq6tI)$tCV?yJhwm2LTgEiTi0mr^sUy7G1V}(1{86u^jifsqFTuo zXutK-c46Ucc3V(^_~yHjsL?*mZ{?Ux?!nJJJQtOI_}_MGg#M&lyj^fkDYIAb?`Mt| z-~>=bkRfa}Sc?(9#TIdbl7cb=|NZyW_g-}+VZeQ_5d!A$DTJ>%eA#{z*uoZCg|D~L ztxZGc@0akXmDvy%pWzN4PCot@sD|10mn??n9qoJPd8@PM;TOW7?9-Q}C5-Cvi1s7# z=UhcG#2qrxH%VANycN3QZ0c+@m-U6gup!%i$k4)c6kl=8M+~#ex2_C=`l0_7W@gYZ zk6Jw%9TGzEPb>f6?Ju;gm675*%uEW%2nA>PdKE}vcK$2&!*k2~w+T=@#WCLYi#B1&6+UVZy(V1hLQwgN$V4Jnvv;KLImH31Js315b zJc2U1-H`wT6z2`Ppfp2DLbtRfHu|MzCjhPc$~vfz-|5`T>As`G6gZV&GO z&lBN#2K(pOrZvdhAASu1OjJxVY&3Wv@CUNm01}%sO`oQ+J1zrr{*!G;0~^xPPge=N z7gl26sSuYRN!~zv_qg>yU{)m>jb^?N2Kpr{HXS&^D1la=!M5k=xKr5L4GMzl-$7=K z{+O-zkqR9-4f*vTe;j;@E+AttBK)mT3Aw~FOp*=@#P~!_urlP>wdjmAvAvD1J!c8& z(Nq0Ez35{+4{bX}sl0%rK!FB?!~Y5vW{OHrBJ)Nz3|*4Im9%IR!X7Q*A?8FjthXQy zV*lUy?TC`h)cd%PhMb4=`dEz)yDTK$D`q*vg2Nk|V55{D$$+@Z(x`}+41(3dTRwgGyJim^?Vw4HiA=u;q2QpZ6O}ekoV*|v-$1JQ4Qe+ zBWe6+ZUdz)lH!{o$U#mFag1hW2(YG7N&euDj;%Ma@J{03&QEibd`F9!r}JOpi^ zfDlO_6ug4#De(r}zHrf{m)kGKr(UUe193bXmEDa|8ftww>@P3LVbQP+D=R98B`4L& zD=jrxw_p$gshVGl$SBmBw(if6P>E@z`XG$#Z**27k{RA7fJhiqq9*ejDXt_6CN8ox z>r0J(6r6YP$%>-Q0KG-SwdK!-yqzYUfb^?RB9H8bI6w&$A(`NH5~D-z zV_El>2L$-lGfjNos#WU4+w|_fZ_L~xkwqW(eXNqPQsH^`;&z*Am89O%3+4RV@z{7F}<$;B@9eE!a4-(Pqv@q5uO9Q{cBN|44KRF}UlTGsWG}aDJF93ZJa0AHmf21( zfR|a){9Eb$FRb&N=G3<=dTsk*0Sj_@u4;Rk5Hl<=(r+CtW2uy@a-`3%{ z2zml4cAo|CROG>f3v;7ri^}hl#?>*;WAos@5=!pGr70w$Ge>MvkBXq{OCo^>L+A5i zo4y0L`Y6k-Fku?H5w>IK8Xdx^Dj)CsB@+N7Ts#}rW-!ng%xEn6f;6;YF^<*H!j^lg zOSrKLon%?9eM6D4!c(&`L!cU~FdiywUjCs70BM81_2qB#BcgTnQo9h4{owh-&Pz=9 zk^508=K)_P4+3ug zQKJ{3kXz2Ze8wOM@b;xwEk1Z6euY-kdGB8sn~DEhx7bvkScF!;WpYT#9JUQxSs{~M zMAJI$_DZ$%$8x@|yE6fm`BJ56y2>$b#rbCn1R;4VkEK=P*e}`%hp5Zvqu%L<7M6Nk zs_(1pOP&!(WjrS{chjFBH{AINSOVX4I_m*$Lj6H6nDm`V(R($atZp#aZ2wFic83q0 zYh<^Eq~Inn|Fk*#NMb^r5`z;CpG5Me%aYrhd@@=aLx?)777yC;lbD|a`-;T|9Sko4 zp5H0g6{w_Vc@+-?C}j2{eHcV#cy<-4z4I^1+KJ-POG$DaF86sC!cC~CPsOIUyUj&~ z<7YwGt9fxN%BJJQ_S{d9Y88yxh@(isr>Lumqnf3tAf_sQ$&XYHj8d@*#LxP&3Yj56 z0lEb=qo-vPoI+W{cgUhh;lu4MvQ`!gpB+tuBTP%nK>>U=>e|*zrE}k9mTpJ|0zR2S zcP&|e$?|~aRn@>FeOmuC3ndfOLhEE9I#8J6MS|2zfnPJgp-T{da?-@sQ+K;PAodX@ zfgR+#<+yn_lGrr!r@gPQvX!&zedhucscJHPB9QeLa8|YMns~&LdJ4;eo+PWP81&Wn zk9>9Rp&H>khTnk-h0O?^F5I%Mz`nD@ z#w{rV3~@K$xI^KZAW6^z;f!ht4X4h93k*(s>dBA2qzwu}*+@V@6ca)jI+Zx~fFe6F zpS;jb3M$D%+5-WGI{rp4iyppqoAX%NBLt?%ln;#d196r-Al=Knr(` z;^#2YXiMR>p1Wn^V*8!QcTLM0G2`;$ ziaWW&gEbkV3O!ZhA0#5^{g#O88U%^{kCNEjV4}l!0&+>gIpO{&=|b5tKI*)_=e-cf zy+%nXE$fS> z@SUDQQgF{d!j%3}{v97x6(tcM6dt7oepoLKLw4#img4<>{;>`bh9jhOJwQmZP3*=N zfo{$SM1FD3Y^Hr5o7PeC78+1=gTtg82P%xA!KA$Ga!GB1B59BEGr;T@$^j+~>=dzq z0&Wfddj|sGx2TW11T?WthwT8xHwetilb-Oi=g3rmFP-v>1@-;G^uN6ZV6@)Rli~Yf z9||jlxFdyW?61~mrsK=VX&V%Gtzd1FD6M=A7>D~@0jMcmpjL-o0W*+l9=1RAnvS{0 zoRZS~__eck-Z!(lo#fk%Y>0gJr)K^MvATJX>;uzWfQ6sDTbdinHMZS1iCB3fNJ-%s z)PC%kuXGZd_%!9{IK=;-fQTeO0bx`EyUeT+YPlb0<}8ZqK>@3)p*sLV{OI83rNx0Y zZ!g&|mQ`4&Y)cU38UN`%Y zt9R13EJc?qqm=JXz(V5S$|>%dW9JwbM5TVW`%|{)G>Xce|A_}KKy-%;VoGX1Cldat zYwWpp$ttx&N4FB9oI~xfLUaJ5bnc<%(5bI$UFWvrUA9lj%dSY98G;$vl(V--6QM@$ zK+k0q0P$UOgs8?Q3n6O1mmFcxN}$n&r8HdQCgBbw5~sZt$%m|#e?}W^2?c3V``puU z{v3Ir9{g>e0-{;w_^dg~BB`8(xn_|={C6;q*%598G6Lokg5_)k9@BM~0H&KuvV%3O z2j;nq+v#3rjRynMU23l{0Z^W8s9I9-`Q#!u>f{q1SQ7cRf8e60#v1-cRt zz36KQ7+lnJ6^*U-Zv>T*+<=<*zbaK3VesF1ahx7Su-qS?JBna7=K-UI5gTzcBA^Lut5LBtNEYw$9VSRr z+Pm$Ck=eM=+w2$Z=J~GlYe&&iz$m*G8r(`hi+;eY(49lX2q=<96=+=0t4K@N*0kiq z{V)v)>vP=-+SBz#wlCQ;5(z`Ioe>;yhu$L%CDz4`sHqJh!?z{gW=Kg;nM9tqJ{@r_ zx6V{g_n5&e9*3ddac$M>cbU!i9jX6_ru+#(zH9-cFPvVU4#h(sKR@k^Now8k_}j?4 z4_^!0cboWfdHS8j!O`FS$FEJ1puf*R>I-KM94+^I4H8aBmgb{P_ub0ZW=6Yu*o(ea z8~_-WRflIs&EVz0z;h_ zDeXx}5eC#(w~9Nr2q1xBRf2VGWvd6RN&`N?D{h)#7AqSH#N14a4?N)0?D5)0`JMU>E7jV zN_k>|I`u-iVoG^1O<+O+?9-e}?u1=cd5AJF@YXe`kH`4xw9l=mOJ&c;j~MmvY#P0k z_K6)}ieS8_>;=|LCKCDu6&~M*YR`z8IolA^m5)wh-Ho;DLrtqG$MxJ*P*i%_nb@-uymkUv?AjRq!cmlv@{WY1-h=LmDp7N@eAja9R z2FdxU4*tyisVtujOJ!SJCt|i6+pu zdjO2m*|VArz)RlOXEpnCj(p(2Brlv8`G^t!OQ93yQ{$Pd6wPRyg>)6@Y|s=Td~J|l zJ$_;O!4>i>#<;jsACxkdR7;JV)%?E3)0yS6mr>K=tO3;;=xNsQfU%phKoiRQeUjly z&o!2t3BxQqM9$&*z>AuzwNhLKZSd9MdRJjob1uL;?Flcr)Urk>0d-4|z&=a?^>|l> zq~d6>iSmd-E>wiJ9%MSX^LH9zge;`gvx$r>nNERkf>1mY`oM6mM3ktboWqHaLJ7O`0z^*n>{^ za>Ro5rLOm$Jhp=FKbGGh5~adSOrDI(sPxzJO)jh?k`@QbxHZ@hnpU4+9B;W-V_vFMT^|LXr>mwT7+YU#tTmFSQy zf3eHinTmCCv_tu>WXDG5qJQ@7t#9FvD0$UF1=S5Koz~Lm7*b-|{a)bxgWZk6>joaI z#@%~YV=XW*YvEeypB!a;z$#dQ4p~G~FIXWgAQ?F~UBs@WZd=k$vY32XC*MeCpebz; zr~;HkjHCGv@Z<`Mt1#v-qG1xO_zOH8+EeC6n?@&l(wbLTSp+=*N|)!$TNT(YmeSiEse$k1!-y|4~(u2nonSB$ILdK~UyT zkdi8OU2O!N4PeaK>axUYoWH@f{dp%(+HF@cHTkPcd*VyGlf+@fw$~Lx23X=(eX^4St-JIv{_t z{^8MO(Z-9*M&JCsR0tH&I3{zybI*Qt7}iIuJN#t18E|cRq%b;qaI+B9c3ddVLMS%AO|0jN(qV^?C!7@_9fMNWNU#hR`pF2E> zj81mNal&40oS24a`%?g4EMITSvQ8EBRDb)JN0H2yh5O>~NVY)Z-#KyP{@>ekVHlN+ zz{n}F854M?pnYku8YEfTQ{knhV7d!~c;Rlz#+3qeUE~oBDE?zB0$~P4#{9USnEd1a z+KR6h%rSUqo0(OmqnONX z#g4?(M?jETYkIg8{%sPY0N^H$WqXo|c+Fq+KPtQT3|9sDR5EBJVIK7OID2!o`x2gv zMAO=UI~-Lx0gv16Gl!4BL#pGWZSL8!Xmg&GfwS$l{`U71s@5jdST8N753hU;Fjc!_ z?;3Yl-Ho-2W%&!>f5;>#;UKYr{UMW~T3|9BL@y5e%)1hRkED~j2`~JVdOIFM8Kq?O zI-(*-{*?a_m`Ip^u`$2Fr~WJ2R+vAu?sdjWpQoSzdnA{3DZ7@RE)Vi*VpgL$?=wTEQuoAP?zw^if~X0Q}6>4Nhnxl zjS`dvK6BC*ObySJ!R({`>qZ3;C#W7tGZI7}P#mfv{&6H#j9HD>HmY^ppD!dzdM?#I zYFKBN1B(#CJp>O0u4D87^47uTdUL23dQjLkRvLEZF8KTYif>zUUn^GUM^vuU*d6uR zV%j7_c>S>Pg1*Ej(#iRtkFuIA#txE+Y%VYQQ~yUNst)1Q(nsXqlpqV>{sH2ZyDFmb z(bt_e$bo{Ekijj4vw_FIIjv42D{hMie)G}9ZP$CUXY{r^E~>h9I8?kN^X`7D_t`ow zuJ~)5NTtzSg26R>-dgt@ooqZsny> z$*Z%Yy|9C%tOr_@Vci3B>FbwPc^U^+x_sY*x6KFQmlHSl-Jdx(j>ei77myz7zi3wK z^{ZcKxQizYxdbl26PH|>m22-id^($tWvWhqO*F3R2tBFv5v;*s_f2+0%Zm)q5FTOP z&O9eBzwI5xY~*2gz;HEK2rJ4ewp!>pc%U9aChmDUo$;nmop*3Rz&wY2tqR{?za0E2 zS<7EvF9nBe4-Fi*nY9v}T=UQ*Sdrne{m2VVY~sEMW(VhAOA_U(vFG_5O7{ z&20F$1}4k1y3Gnt4I1>1(@7OR2qQut=bghST(C6OK6Y&B5v@0Y)6?oH@BaZcJC(c;Bd$(k`pDe z?TTgJSIyGD^*@A!${fy4=4fz339<|6AM42^nFPyiu4wI+VaU!svuy0FjDmi!`RZ$z zohOHyRh6OUQ{32RnUDT@khi9MG zb<5ayU>$3&@_ORW^$(RXv)`7z@1LK`*bY9rv3uj=2k>|Co39PgFW9~yhW-x>5XiSP_1nugcsA3 z8-pveW-dZr*VJm125jerrVv?A8Sv+!y+Yj7pY8Nc#aEc{G91~Dd4tuAZFlJWBHazb zS~wcBP#lo;*f7Sq7e08^!_LOUf2FF08|PCFzLu&L=Ogw*5p5yZIN&V44wY-X?I@nw zl=m7THVop^uT1!Y`m-a@7h*`mfPbhJ}Mnu`LdBYY+_&Z*$~7}&tx{=?cXh#=m8&tSca zU{`4STdR=dmeMGG@YfiuiqwvBBe@QcLuU*?lMbN1mzulLTW6e5@uou{csU4rRz4 zCw|a z>1yaty1G}Y^NF^sOWyF*9A+2xLn3%sMDWqGS!XN1p@d&Xw%pK@ZpT#zO%>lEQ6;{{k_~7gYGP z=`aXW7;2J#fY`hK5=WH@Tt5Z4l5RWB4)oY*5Y_C4VipzbP-DQ-&-z)qME;%eZ0a*D_TnpA{^ zGoXS8inGHYNP@blGVx%yf)A5zt$(!Gi!LA6U^*_uUH>Jr;oAC*0ZkndbVr2To4r`6( zPZOg)URIuTjyE$sm_bg=AFRTphe2$_8XQrhbIQMY(prND+av-dSr_lIAEGU|#8xnY z4Bg?+fM%TIR64j-*uUnc9eU#96mVu-Z?CB$$b4)$^f{ z9-8I~N7>fTUwuOf6dZXAMxB-+PT5nZwTMmekL>FKRd70~n-*|6FZ?S`U)Omdky5`% z4CeP<|Di~;FswSJf`ca5tUCKJifN4P>0uFZ(jP`C?v%3*RHr+2)jm5HWR|0u15IRGz#9>$8E;-cr z5s(U!7b-<2-4F~4zAK)z4hoaR0{r0Gw95(Lfo%SFlLeFB5AJ#QJ!>Ca9FC`;%2c{b zbVV8+yHh$CVn4&mIG%)8j#jeUk?TU&u~LRu1B+u|>v1HGoICh;Z#EbFX@8I`o59dA zW+EeqQr>_Zy@ek}!@$%Z+7w&EK*60C-9p$KP0CIf3i#q46;C}af`6#D-@fWG0EQs? z?~GOTEGjn0%b`tSH2!*dJ^w=px%jA74N5&1>}LtY*b5J2$egGZaV%#Tmt%Rtp1nB; zPuV1H)XX!2z-mq0jI0>d1FJ=sp&81PlA4YI*))0Pb}a+;53=DC<9}=c1JPh$3XE!s z&R~EsPf?mh+*@FJhluH;CJ|+DCtXYd;{yWmr`b5XzTp4J{R?g&pz-;i2Sxv+@6YUp zuH}LoaBUJs&B%xGzjL)683kGLlGmKgDQQwb1BDF$WJ>`eM(ynH*2r z&Sm*tCZs(R$v4myI)vjwLKb2Co6Oi?L?q4FiGk^c$35DRf5r(wgIaAoU+ojZRl~#N zlQ*;VWkUy;J%93!eevp579Yf9=W=U`Om|06>r5Q`9SMcJadkW^PQ182?yzTKnp`;;$Drc^B6Pd(~+LE008rhn6u9w*F! zfn>BneO|-I&QtO=vngF+;M94{R>{95tBbpvIz;YS8cX;9;;P04U{^4=kQ+lqtgu<1|AFHdB;JH4JwkLG@Vc>E#9hc`r(-8g~F z1u*LxCLGpt<~LSD-84yK??eoquP$lOl zJhmwi?s?8K%VF2cBc8$*HPW0Hb}5?I7If!lx&NCyM7s$SH)r2`Fb>Bc4<59sR@RQ1 zYq!_lgwqs%QmB#fC~+@vL2+`+xN#_?W$)JfPPZ*B_D04&(LBd4trZkKCq}rW3C%>e z{4IM&=L6lgx~lZ5VWkpIT<{B4OqRZUt>@gyLHS(cjbYA^W#w`+J;x2#FHD=)gF}Qg zI4WYPuy5JPyorX(hTMm$*K*A$oQKVYUt0cLN~70dwH3!f14AgB5h@M{C&h8Ba2Nxc zn4P}T7`3>yIDdLVY(GW&|9j#C7y4kxes~Y+$*ccYJy1{12iwzDa@m2~9O-~b!QRIe zV_RpuGae6mBgZ?Oqc5+|x^~nZ{<4*I;U0BZHC^pzBUU*b@QKhqHGK-@h^$6U88TZy zydL1N5$aMdyo+j0XWRJE4JO?H0n*hP7C-YFmpRdmrv4>l+id8sd?Oj^y{7{?L%J(hX z(PJy*_Pkycaaz>W@0p5Qy5*ZkIr1uBs1?<@Ib~Fpj({FjmG5f9MzG^wpVDkyZJruC zkrCOTG}@CpJA0-}Yi^L#R!4YtW}?6lgw9eg&70KB5VmB&e$gM4Ha!D%xF$X*$(#*- z3VZcm-&#F=OD^mnKj%QDS42B$ks8RT(R%9E3Ac>dAX4l5+V35ALajT@vxNDBdMoE4 z`}4Cw9;j|b{2~fE5J9kY4iW>y7}zgq0sr`}lyCqZdrNHytu$6j;ITQggR1lYyUl}v zbTMTOcR7yw(G@0aN2|1DHQkA{O$~PN0j7`n_|*w`6t-DSO@dS8*d5p5v51N$)n(r5 z$H!)Y@_RpW?f}5)4U6C^8*urZlRVNNwXEms)CR<(+RtNqqWRQ}13y~Htun7c$j&8e zXl1Pp3CEoPLT5acjGR+6x)|mnn_AQ_$wyS+NXkWMfiX}>K{XVN9`mlmUCuXrP%0`E z?i!Xtm=$~{PTFurj5PS?+3UsH4sy+goXf3+UtCM=tL#87<%C_uVDQNMLlNQ_AL0o= zp`MjW2s_MzNCK=zXo@iAe)!*fJ*~sb>eN`@^HC%#jf?QiDtq1N(0cQu>E+=s6q7Uh z?3S93Mt5|BF-5L&jh(;>q?`4Lg@8oGvz#t)RU#$?yJU~kiNLQTb6p({U)u;Zb8im| z_#*rDaqL{4)Y!N+lRL9%mPaPD2ana%OKDur%Fy!yJ8M{j<%_Abqx|gzSnz>G%lVE=t;(G}}52!EX z;rLw4%!ouTqJxoygLjjQW#k7w9OCzEaJ~Tw(&a_wCn;!x3wIZnRH3sbw2C4?ty+cX z)=rJ^ZHH)&$tN0}<*lAy3Vbb}9w+8^4t9sz!OmPA0Kcp6{Ejb$Jxp=rmsTQ|k1V&C zD7K691R!$m+cEX~?U#`^Klmj5_Acy$-|LjJ3g-q}Dy9*<#^%Y?B3d$trV=T30Ca<( zKs6e2@}))L@)$(&C2Aa0oG=u;DVkO=zo9}ul?gpq2&z>u=+^&bKV_>ViO;H%IueQt4RGvTv9?=^Tg0?j^heH?G}P_) zqGDVf(&#v3gqcqm#r2IuK}n(?j>=a$3>Ig8N}E-P6}=hRBNpB*>{ zgx#xrVK_gAOlUeIz}_K$DSBf+po1v-Ayy-~#iMM6>!!WEmb;Bhmx;JKGJFTZpX^ec z2A!qR859Txor9F<{y6b*jd2RwSVLhGYzl27lT5GxSnIw2fUi#k8AWUU7m1{DvgpXG zEpj$YQrMS`{%gyMp7O_Vt%Z={+juZT6RX(V{2H~-(aiJ}Z?#S6kUV*0(j7}G1nUq8 zWS=N|@joa>7h8t-;(QNe?Jwa_q+u;)L41*Yqh{aPiWr$%d{~^b0&}a>w+f@wpMOyt z?k{^l8zqtzYSpJ#o8!P0+}5{1;zFJZ|57Vd;oKDk&!H9fJF%m2(_|$~YzIwJ9 z(E95G)fe=hCe6TQlH}hnL-iU=oz+#>i!Q5c9Um^_qsngv z64-F(NJ*y&Ik6qJ;MUpI_&h-^dMj;|_1&C_l-DIeRf;E|nQ7(EQXF?_lqcq2Q})x? z1MRGtqM-a`DKL3SJoaHklivXYQ1-HWDMKv&RsSL>Wf^8DO|M&_4>%G^ z(MqH;lYc3B?wA zzX|ozYuWl!@@>y?Ec&1-a-dK)E#vAN?9~Csc6a3@lZaD!K1Oz>1DNE8P*0wlnEL>@ zxz!t7$gvVvu>Iq}9#LNOs0Ix>V7FNL5Sa~`N+MY`7D@PmuV zccV)eBU@qwHgn^5%RK5Ra4fB#D_hwxXH6>1niZIkT*e8|NAHpA!i%NH1uyYgwE~id zezZKEc`myI~4AIbMRQ;@jKymH5XC@z9gS8;ZA0Y|0TJbRbFU{b=h zZ~~L^KcbbNn(J2kv2DI!=Qvj^BJ|wE-||8ghM$rK{)->$tf}~9QBe~b{zu&w=UMlg znVyWra#E3TXt^4bF9H zULG2oz>Jy$w0c`scR=t%=Tcvd+M|t)<=BGNELNAq3C8bo9<3!HMq)+L?oqWT;fplx z4rpIf7WjA3{R5D_kl(FNLCZS|8~{CG<1z24AEZu?ZoEJK#yg~!4~okO@r9GRW0YLv z5{|vr3MMjX{JuP-@j01v(Wz_z)v__w5vpd;L>s7#UfLl%Y=I zL=~)ym~(hcIiFXPcN|m_V{y2$4*f zc>lxQu)Y7Pl)C*w*@f)0Lq(^DS9_P=;w9f*E7QJfSpz5hZ^-Tb7Uc7Y`korjFtHF{ zwmKNYj8_K|$te$6VU8O~X~^eVy3a;A%0xv2RgfZ_>0#gwGxOk4D+Q3$8&V|wj*0-{ zqodi}Ulp}yS?<#~mGD~O!Z3C7Y_vZ*eGnKzy3{4>zZcLToZD0Rot$1rM`xn;D^-RIIjOy|_lFLs_>S$qu^pi2w0>6NCm;}hH3M>E`|Q3rY1xM^;EFWKM}jIO+W@;_L)0gX=Aoj zpcm6N|La%X)E)WW&)dIYHIspx+nc_E)%QhDPok)Ef2@OSbxJedG>ei85U3M3S4x!c zs}x5uD|&b^KnoEWjyTU`UiC(Z*6;qAEU=-Q89yZ2=~gFsomu8<0dm01gxx&&ll#*@ff zNUTZktO7>TN);7n=DoRp!}tDnr_TZ^-&j!DHvW}Z0q(W$weB^7}GjSwIoe| zzMSXNt9%FgvR1e=@apL5`X@3@Y0cFH5<6`Lx{Sw?WBI>HH#1M(k_R7~$!mL1_{Y`j zwRE{A2T8WnQO@O+&ODDlL%aV*=EVdSTY+J|mRzvCs*xV3V$pJa-yu++xiB!Yj(HnK zD|Y+f3TX$ z1RdtglHoI=-b%8qQe`19Y(rY&!fu1xpB!r`dz3Gv^Fi1^o1O-;jZ#SSJY^^sobq{z z(W#FmRq+SL2rwyFFD{Oi9(_P3WkGmI&s}TsX)yuu8i&87%ZUy!VpUHO`Uwp((18#! z99~B^RjigzM3KN$Ska!HJ7SzvBz-0>7B4SYABm+jD@>7$8A219On&c^6yGc*e<2;V zil9OGjyiPqXBt zv))%Cj=M}m&pF{Fl6KhfhM?c$g~UBRlNn8u>@@_|Y3(NI4i#S{@Ry;vg!hz1*S_xl zaJAQVO(kX{<+73V4`G`Bc=1~C(DRFdZHu2vz-ObTNMms(Q{+DNcWp@Sxn9e_^AFe~ zqpf?RZp#&itzWI$Gh(xi)uf%!3dz4+@;kVNpAHi}5jakt8GdmfwpTvxR$p3Q@g-GR z+`@MZ^KGeQrm|uB;C6}0?&;-ji)qfxwR$}3Iv;XQl!X^0?Q4Qvzz#&sNxBc+dgt6y zl-3+&-rJ;Y-<$2bDSi*pNPY?BDRDG6U9EA%wPG0bIaxC64U?cYRJ~svLUshVnI~VO zl=x`#h1S?B+)PdVC(y^wl6N{KRVn0F!I8;Y=K^P1+C2(3$h4-{vLG!pip zMoG`7eWZ_nq5ueEmpI71FS1R}F-9KEj_u}mx#BTTeH%j^VS?kmw>j^{0nis&wc0Mm3$em@vHQb3OQra>&- zN-}Wsk_0>97+N+ZYx~4oav2LLb>QagxUAnftp|*}0tt8mZ~s#S>VQ0~11l9s8O> zX#~NxDNnrjQ??R}Q8tB>JQBu?dYxlk++ER*cV=0c`POe{&1e-4TDj(`;$qw%SGv_V z#&OB$SA*MpgfwSRQ#=A}lNb=WBH;x-E+XxZr*#JKl1Hj^kke6n9|Gev&nFq@K1{(m z7k0TC_H)|V;)E(QO*}L<5X5$rIDLM~SwPCeE~>5YdjG`gt&gF)rG5Kje{;8*=+$dm zM#u_ot-QkD-(gKhu%^dT&0`vg#IKTVvBP26=uyR?Pq|sCbnYSgFie-v!r`gaYfv+UYP>NQQ&OIo~-+BFAN z(8JsnijSY%in*|wt_~NxraQJc0k zSad;c&XNseDM#-*>#B1wpF0oO^Bza&If z)3-UqbL7x~V*_y#{DWqMNH)}WaufZ$Xh{0ctEd^u#Z=hBTSdV(4L0EFe74fiUu|2L z9t|dIk{py)1PI_Y@N|2G;MM6z6I`V-dBY+LHqE=@D;DbVHx8vHgw$2wYvL!j9=GwI zq1(^{0J~>}8`P6{Mw|>Cpa$&^IK5L)Dh}+&NPmqj5{9CfCZo9#t_#ojxe7IS?8->q z5q+~he6=)hlT;``_V)HX;_-2KZ?xj2prt*33Xh}l6RB0w31WX5PJ_7F10QzVW~`** zJ^&DzmcWaFDQyXd{bUhe6rsr&N_u7>KK7?~Fe4TmGNy7z#0npFm36CIk3st?3Pv+$ zlfvFYEFMouO$0K|DD4h&u@*%i)GJ^Hx_hKZXpV$Tk~b0}LN4}4fw4_kr9w8j{s103 zezg{WXu+(bX$2mA=J0|e?^APBXKxCqS`n_3R_*q?-MiS@wb9=y{LIK_j&ZZ0W^Mc3 zjU5`Tctu@D9OMi|9{IM;hZK$$mkU{KLL-KyKPV#Ig*7ssla6vSSD`F$PmxW7J3y)? zG0bueGCEv@Ie3V;^nJd=8xs2^9?c{g5pBlGuu!<(-&F>3)*Xqa@B{Y2GG6)+vMBJ$ zJ&bJ>Y7C1U8NEW4;K4FiPV$QA8?E92*0VO&Ji^wWwRS&Q8@{xv*|rGRF;V)N;SN(k zQYY%d40sq?I-7DBveI+~W9mUMqxLnoagzI%AtaNAbv*7;vL!2!||$buAFl zPq7q41V}VzJ^_OIP!I%U`DO{F0b%{e_Tr2nB}EQZ2CPtreR5L7_6f(Y$vpmMVqU83 z48NHw2ohVYhl7E$saCKaVF`c4SGXKFqQuQfvV<^FnN3ctnqop}&M3$*mfb$;T3uem zMzUSQio9ZGtd0k3Aq>56J&a%(Gg$cND!noOkB*Y8k^*_2K>A0P+59nN= z$sN*!D3%cbUpQHzZW=is-KCu(y%9mTL`l+tlpm{(6Clh*5?#y;A*v03BuC`ch8ce< z7IIPk=3C8BnG#gyliI7K3qgy-uD%3WbMNPT&vxIBt<^rz!bY9;)W#qLtcxr=wnR!` z=ZhkkLD(x`VF7Jp%$SSGo0>w6=uMWbb}~UhmNIIJ<|wnwN*L-eh-at+$|V-KM;24R zkF?+?byd>`ejghc6fJ@wM}al4B*2u>9{03Z0WOA3TPpAc39URti%#z6HIfbxEi!PT z#mpWe106F){O7JD)1bjYhX`Y&h5!pf$R>DizZBTxMkAStegzpCYd1H3q@y6JD`^J$ zWm-MX(ZaW$eNdTAy#J>Fb&#XsrQx`XnIS{A$zW66z)c-|KPZ*e!i&D9dgONS9H1NOU7d>%?5_pN;Em zY@pKsE@Qs8wXvPO9x)ZsZ{;;3z71}nQc)?Uo}%noIPqd;t{&LItZ;xN+(Zeh__(Z5 z`iL%nm>sUpdM@Y>$m9(_qQXJy#6fG4jY9hp)Np@zNDhafY3}#D4GtZyk|GoaByS>W z9YA9b8);>Dc`)4$wt+o3r}irW5`=wo6VoQB^`y`DfWr*-PMDeBTX5}Fz7|r=?ZVKx zD15B(jztM#B2rh4frc!BidQUQf%4Ep#mm-A?Jvv{^!SWUr4y%;a}8JQflArYk)jw^ zXo$*{fhH>MQ5_iNm;sGv(wS&wor(8YP+$!1I^iG%nrgN^8ELQ1a9KiJ2eSmcYWak@ zshm{bKLQ2lgO97INJZ1ng>k1NjS5*xiIVIl;US>Aick+x8!-9D`KWh_&)m{O>~V)< zOhxNKibn0>{ub@H$uDF>tNT`=DDG1H?GY8a7ft6#G&B3=Ty>gss3(VQkfkYPl|v$^ zX1|Ko+_%P|Re&#Y+7{(v&9;-_LPhNKW}~ozFV19=#BVrH_ifc_XQWzw$z z+w+}XbL-~=HK;aVeCqX{jJ~4w3?&|YrylZ+pUXRhJ`_EdAm6XVr31?l)s4R5zNW@6 zvn`^x4WEyvSY<`W_=IkF$M?DN$0YTN01+%d+5>Vw`Wo_o6dkmdVI|)PyjiyiY95*f z8*n&r#)f3VUNxw$Z<|l$l3qssc42+|#UBH$bjzJ)0$d_Q+)(Ra%tzu$q+Q^1wJry+ zMaoG)bhb?TX(FH92S=EOE#e+YG!$BxWKLj;Hzy|(bnseHy;e1*1E>53pcqYoNI$tQ zsKU?30^pQMddG&hWbUa%lM$cvVqoUCe$g_mUt6mlxSUxjazdh3eQ&k`Bna%tSrJ|# zB2&PLi@!vMKAE7ypgsZWkWWPEDa9RmrZC023-w7I<3!kcixy^eIw-ocHd@~eE^4rn zvxVNQC*$ok4b&;j$ZM@<%U2Y}t2)hVqu0gyb0B!7Dxv9`HGmfNDrL(TrG(qvY?V#7 z)oLx>GX(zBb(LjIQc@{fUVYF>pgqsTaD(Pe2E^&th*jD>PuA(mtjGy}m{s9zs;=w8 zaQ5MDUWeHril}pOmBE|QM7YW~EWCt7zeqICY%JN{|K3UDEnln4-}dIuf$z|p(s`mh zsbGsacw%gGP%Ev?^v=q98V%8JygZCuBHElA=be|dIUKV|wBZxC#Teh*d0FfiS zavA#>YsF0IWR)#PCEIYz_9dF_{7${zX!4RFeoZpASCc%kJg)$+8^g{mUq21=$7}J- zFump%zL)w?a=V{U{usUbXYAJudF5=w195iPy&M((^p~7vLq1{L>jDh3rQAzZiH zsT{L~!OJ@Z6X?4hosV71qNq;;nZGZcR^Bt)0ir2mkp!Ho={KGy_KA2=&rI{U;MX#rd6nwIcjkQBgaY}8${D%Erne$L!VSE6M~rS4GWe%(`Ngd*@8~ zU2-^3IL}xL`rC5Q-x_+jFn>6hOKxAB(Qo|N_kO|AWI>|_tQqR9z_|)dolZRjt|iI- z@@xNa*Nef!zMS!#ZKzgQCp%jsaoccqJmsKayf{hy=}p#iL32n7yCJO(3f@bxH9Y;f zN11i1MuMf`jJj4x<6Ku~=QL|;W=FX-Ij{UyW1QSjPJO~~YWT7;E=Ip_^0H~=_yuB& z;QJaCr=zWk08DawJnWVd^jIjkG2I>~<;5S+YIqC$4tgU@#Lr;#V_Grc5p>~@(F2dq zF^MG78n_wpM%RoNA7&-J3cK2Z^XXh;5x zR0dWy*Fe~9uG&l$97DHT@;ZUQP}NUSnN?JkmCyUx)}Wfsfz&sYQS&oc2M=LS zaQpBWB%fs1JpM=O6*U=`Ck$+P!ebJYdOSTT7K9&pIrleZiSS8_$07nZx1beOxt%RC za9gK>XvqR}y_lJWI#HJ*TlCdtFx$#l$_g9Z=x%%l%GFExv4Ch@kAfQtSnf^apIzgd zy=AZ%+bX)Dt?D;IFQJd`8(^zHOB5v}vfn?w=vCjm{uX6;anCu_f5FO9fHTuD)Y9=p zqJlDM$c%G`G5-;iz4gm6UB%e(_)KEo!56xR!~46=&)2{jC_O4go08G0pS7W_s2>f9 z067WaCGne##axqtBp(M#!ScrvIhj)n!o$G6xx@HF9I&OaG@(Ly+K{zscJu8 z^!P$G!weSjgfv&vxr9ns&JdJy>!LtESC=5<)g0JPxHM<0ZmWVh49-F~ zKN*<)qz(dvLnY2SZsJui9dT0l ziKLu}5;zUo?^F}0n++cJNFB*?0zgm#$tdz6iK{aZg}-v$eW|3N0mB|!A)l|EL6E31 zQ2}+?@=-mkQh6Bb-2Ud3;k0tgO@$yz^&YEbU>PUaM=_Zq$fnH&9zZs!jD8IwiVeKv zXutbs_*b-A@q&W-1u2NUz?qh8V&T4s$O)6mvwNUA6>u+>65Tt>P=>jO!-kvffGg+) z4QU5}nc<&WMB5bs)GpdNDq!6hCRJ%SNfuMN*9*S3R^W6wcF#BjbUd)k0ZQ8Sl0ys_ ztSLha^4t&|$1V(sW|FFSCY(cOrY1W!R*z1jdPHT4f@CJ96TQ)~a78d-y%07r3?;jx zhR~7(0S)1EfgeE|$k53LQGYYCRm(EGs%hUoErxmCCB|`8*8DR@oDXMAuAHY+1 z3+MjB3^CKR#Avg9V@187F#|dh=2BC&fSM7Qmo-L(ZoAH-hK|jOiej*;Cz@{PHtp-t z(L=<-XPsq#gp`ii9Izd?tph^9q~)T8TyO|*6`4~-O~$44zp0m;@*Z2beG z7dpMwg-voUi>CtyVT9$zqL>ZXU9A>D$c%c(B1ifm#%If+v3jbMTnU0Ifp zd+*XiQ2;dw{IxP46gg4MoB4C>#kWleUi>Vqklao-W9RN>+mpWvsNF~23Uz~L9|LW| z^KnpzBr5=HieB z9&KhU2I$EVI<~dvR>KAGTu4Hp2SmC*scq z>cxfIs_U+^5fJyz5gUkxz9t*9cn(aUoAe&=rZ@W0>0o>!h>n7hcO3;qJz<4v88v*K zxPxJXZ=v5_BU~k#9@MKi$F?bCw~#k1y?&28Q?QZUv!)URK}Q-0>twk5Vg(O8eM=TJc*H53oQIPyk2@4<6A>m z**j*WC72zXDCmL#h|4Go6Zfb^Mc1IQ_xXg95o!kmtQAiIyZztYAFn-1DW;|5I^u46kp; z^C$x{7{^@8?lB~u>Q~QS9671K#mr0rChc%62}fip-yx2IO+(~GGbp6+M?S^U8F5Yh z9$~rZ1?3Ss{jCMS!IMp+r-NEkC_Do<%xVX8cgQ=q?Uqdai_Wib@vD*|YY+hmHqx8G z&Q2E=;5gPmlkO(ZA9YHA)ln5jQckI3y`4hyH%@E#VhXxdPlsA|AsPXC!l5ujWZ+pS z`#{PoCG5gk_g4foUniRY<(`&&P? zLbKpr$ebHkv3UJw^^WhqzGUOvxq(v%sxOd-(-256y6hvT(VAI&1q2G7G>szJv-+*L zcMyX;HKgR)V?;swxQVN#<>bp8>hghx?qg=4V#p|x!q5^X2jS3e=+MUs;j%=hDi~$+ zC|S_WL4w0##NGoy9RzAK-t=7ybT-zJe<=N6or!<`E0q7jNeby#z58!$qe7LSM~p{? z_f%BF^aKdd>;h;A(@k+cy_5V?z7!qD99i&Q#Yf2u7`y{ksN+OUjnMW|WARJC0UI2` zh!HlncLBS2*-u90Ph6A5JyqRb<&kl$Tx23EQshsKwW`c|o|6;`wBFDBaqqoq=}}0JlG41sl98f1x@E{oF&02S2GXq)<9HV# zA~(yeW9;?VM+LuFL1=!DguTFH2rC8s=*-G-szE|oW^&k|8~osL#t&o?=50jqiH~VI zE*D?6et3rx)D#5;p3!PSwq8sVtBfu(GNmUF34%nE=#koFeg3ft+T?t{62j%_iuAefAV&5334 zi@(M5d0esj40r_nbYWAV)v++F&{oAU5;=N>u)0yw<_VX-G3Z3g?DT7e{3XemJb6Y) z$dCIy=^m_zZJR9Rb>WMQuyIpk;CWpz@t!W#ib;D%@1ZBid_$UWeaZEfjq_!O=cw$I zaj~Gt0C5ZP%>Hl^wn?7I{uDH4v-akrUQhgM_jgrj+;1_Mc+BVF%HNiZlK3yXxH8HN zvO4IUfTUWZC(2COv2k~fJXZ1PoQ#Huv~z0i)nMP;etdz>O79mA z#o1&WHJ0uGF)Wc{vmzP()ir%Z(AqZmgy_}sN^1BW220tXdNX7U>fXyzC}ck%N~2h-Q!8Xf`PcvwatrkO#-Ur54m<$SzS*O`RxNb2DdoLLMXXr*h7w9A1yE z^oHZ2+J(zQV4YaHYm(?iO;&c1Qx4oPZO1S10peK@ zgWjfIdwCb?xLK9`h@6$OF^P(EM+;r4QZqcf-P~CD?X7vq$&F#7#hluvM=}MpsK>wh zsbo{_bn};t9ml;1pI*5yM8bi|AZU@9>dObyh48v%HED(yAewrtdW_z<8Q1($w#Ixa zN6uMC2X9&d*y(tUkJ(IoQg@$g2A+DS=3r-I`O79zW zb&XDIQ;qX*UY^}+xPoXDkE$0Em>kw;IseL5U^2}GaXoEH8@82y<5^T#1x^)_-r#0U zmS30vHDug1{Lc7Bb=>!vA6}N$?%5F1mE%%HHY?L}VAwP(#nQWDC@Q2Qjtk8V+;qQA zIodx)*vVRVBD})0R9|`~e?f_>>0HkB)~~ep>>bw?S}^dDQJP^xg>Po3cCS;$BEPqz zTG3ikYS}2fG{EJQ?{Z!f_V~U^v)>D5aQ}Pl(Z=8fQ^pI17v zc{W+TNP)z-e1>`2MS#H2G1OD0rCCD;Qq&m&z@(>~5D&uQBUXCM=-FJfd6a?)7;syO zjQ*CDpvni8d#JhAu;~%2v?y6K3UUxcyB^R`;d^&`?c%CsAmolQI-Em~;mmzx8`_F2 z1eVJ$X}xI2?shL<8wOm7pMy>hlF(MWGVSbE31LcldhZCV>gipWX2%Y3ZYiB6c4kY>5MEW%4?8fjOAE# zFF}Bo&kPY^;~=dFFLVdPN|i;~wYR8LU2c#PwJ*SjSI$qR!exN4?zd9%I+yXX{};5N z`u1|EwouNYg0C7|T5=`pQo7}8k4N`i*Lm~X{aan;MitrJ=msrNS{F*`YPoJV+T(sh zu}hi)^tX$73DR^{Hq%=8Yby-q$mXR$no#3?IC7}J=f)bmIdW>L)JEU~qFO^2D%bVjBWDkm7s_ zr2X#us<&QqoB3W&_Ll(%0NOKEJNzXz=mL=QTLQAVa` zld^f)By?sT_*s}_Dak!AC1EN(BO1|=#7yK-7>1FpD>Y$-qqrV;_Og7bqsEV{w;sBHLm2P1>JF;H#`%np0 zM~8=FBZZgH$2Q8|^o&zBFXM#HocTNmLq8({OXNNWeQ>gbMkMlBl)Isj-nltwn+-Eg z*^G=6%4?84v_ah=XxrCWhG9$w3!PpU2+sHXQS90#kpQ1lm;c+2)NKu6C?MQu2kf|) zovI`Z^}VH+_EfF7D(P4Zt2N6ntI``V9Hd`*QVp_=#GlYL8-;Ls<{+DwIY4KQ!XQmV z#E9UYPr{gSk_J8{MU?vmi?b}Xl(xu*nS*Rb<^bh22qDJOZ<032LsJjmRNpdHWI{#Z zH7etH1J$UGwjMTJwG9$gp{f#ZD8$kD5V=J+Jq8(QyIyK)O{f`<~MtPdAOxhXZWR=Po5S9=v=$An}` z>>Fh|LrCVuzR{VxkR^ct6ZBS!3H5@2#5|9p!b>2&WEPTP>^qwg`$l;ULSkYuc{mu~ zC%Nf7L1$%My=(chp<8twZM`m`jv^p>-Yjo_f2(#fK(|6UE{zz3evN``yAc%P5c1J* zU7>1o$H&9o^zBX5?ubd+l)yR4bcUqOyC-C0KNrxgfZKu$U?P%b+Dx>~R(Sid;8`*q2$xhavlHM#vuJHOM%|az>Fllou|_^!Ic@lvU5)dcWN% ztl586xvEnq>_` zG=x~6Nhbn#kWYX=rs@RFi|Pc1%HE$TSLI37SL!*`-F&aObGwuOlJtktkykN_Ww4cgg&z+V)*jS#*V|&jqA0 zqrY^B`;FR6Rf@fGLiaC->`q7@;7n)8?yOclR`&l!*~Ol@iwhG70+KLDQbH5?FNIqJ z*jh}Dn8m;ihO#?7ae?z1WOqu1G}Af zM`?B8(kt}^QJ6S@#1)?LcoewdP;#edJ8<5GR7$FAzas){m=zITG)*F)VdbGnuJfUK zEEyowou^9m713w={sxpf+2;_vhWMnaV(KhE{B~5k4G~~$4e#W{i1<#=0yi4U&-APZ&TE&S*OqI;IX>0Z4g_eW z#712hRTVaB@u<$av|K^GTfKe%2{9z7OR?c}({+@5mS1UCtG<9q54Hk>^i0lnDAqaB zgUwvToF`e55YO}FzF7nr$-^`yMdpQGMAI;EE!HO%)r-oT!Xvkf`8PTBERtnGqlvxYIdc6@X>gh6@Q?&9MyGEF!9uB+NObjv?mjK$ciWy! z+ClFty+G?TKpzfj3MQcr#K3D6d^sUt13g=lEy)=jcQRA(@^s@Mhf@ zz-JC+qm`{(FN z4AL|`i0{q11Axz*^UU+Zh>=1BJ_$vZ66&TANiykMxkZ>4=KCjsHw>kFGeYSo@3Ji` zh=|e|_W*FygE0eWLwBbaUCCVTd=Y&&Ou6-Gur(wro1K&}R=;SHg3-3|$gv;u7kt|B zTQK^ppdQD8LxM(m$enaBsoc$n>$!5?>)J{n?CQu+ecizNb!pkItV^?lYw7JU@&ON^ z;Dc*0c=$^v->Y4}gPh}E?aOP74LMNpT(~}O~yrhGT{rnoQ5cDR8 zGMilmXZgyYK3EI)CzQbzIV1&vzJ`R-!t;gPHL_58#YHSg8YY}TE!ZqoeL&2~GjEuJ z@MfeSP+p71pHZ#}*LZ|^T=jlxTd`4HTxP%S6&oa}X*KUN+^1I8H9pW6>8^Ckciw#d zu+;EH)vz2;`G`Sy)v8VmLgQ@cTBvU|P~2_ZSE5t?IF!g~@8U86P%x$aDk3hI=Xh7H zj)dpZXO~WY)%Ty1K32(gs(w%VJZnMWnz?+xU|S%!*cT(#R%UEXx*D{4Yb~&?U7KNH z)Y%BAk2ieDAC}6h$w^0NX{Trgztu7KrOwbp@yY(zSX16sSe3)7yIDPxGGK6)K`qmS zi!?aX8OCWwO6h~0{e0upCGzDFMQ$&3L*NCHbwM#pggrC&izv+fj3jXeMdN4;9Ssta z`YB~l3ph%Qc<8_zCbPU5$t;xDVu>)epEmM*atVf^C`$HGZFBXdv-t7m_R={vQ%B7t z5u1fgbMsu4-Nss1P~)M!7j|-$$8?wa7kvD2>!Yd^EB$Y8K8`EoC4jWmL+N^tK;X_o zu2R2_3kbdm+C|^L@wn1HzC;Hr-FuHrP(uSxZ>B@PtyjfnV%WZJX-`3@Zm0PG5 z*nj0MXsezE4ALK}GACT3+&JJ{Jkyl|rRot7ONzXcaZCE~__5&%IG8QHghP>b)|!Z_ zhO%SY>4!Hmu)2pY>sP9WkOt=PbY0+e&{;#8x6MX@zPjiBqpYDEu=9~ZXy zO$*H&KCg?#wFSoEse<5qRT6-Aus468aLum8c$e!idA*;TTIt^z9|f4I(| zz6?5BVdfNj0|5=O&)>!#c3Qc!#k-FtIfmbIVwOQQQtHH33!!&A# z@`p-kf)I8Pz+$uK+TK0ros}?gp#w4K6x!e6_ckv*#qSSe4a~qocPk%0L*8f$w*fc0 z>=z%P5L(|M(bkE$H8(W8J@0vKugIMZrD^M7_gyI$RXMf0JiHw(2q9fHPB!r}RtuPx z%z+l}uAse2KfBc#Pr*7G&U$(9eh;^4nqPK~Fatq1Xcvz96c^M~<3cm`lc<{Np!k27 zPl3IGf^oqzMv0OvB~&s+Y9Sg@NLq`MS4}!SzCO=Qa;v`UJ3M&xkjI7u z)I(KUwEL~?kL_laFw=ghYxQNm(c}B{f8uT$&igkX-hNp;eY0YHZ~7dWjflMM?z9VJ zrd#N@^bC~P*<`1c7=7(iN{kAHl{kx<{umVhW2Zmj4-SJ>1T70vH!ys(sI`%hSCZt7 zHVV=-g+Ub4y6cnPvIx=}DjVc8O|6RPEG97$e1HD!)#8ilVdfQ7E4|l;+v~3TieT}Q zdU#Z51{UMUZRpB*Dru_nlBB7C2|Un`jkTNzZ8A!lH)-8W7oTK4xh;zzx1q9OFkq5? zc>T>pGj99}m$1K)UHYs>yxtfot`>F{l<7)yl(DlN2iNNR;-~lCQ8Fg-;7BpU9J}of z*qX5QyLP)*i?>6gLNg5L(4Y5De|Ezqp*oK^%KAVCUcByhcJzi`QTxWsb-=Xq?`&Mi zlAU(FTD8VD8(NY>!wJ~q`l-4<^qas#MX1OOt%@W0p)0p(!G+3F(kRLZO%x|hRac~; z8I@U9R&^kQmH8yUEP~{R%7(S-+zFGo#4wTFo2~Ko&?XZAw=h`N_?NDNVxzVu?yx?Y z`FTIF*yIL$IaMu-YR8MOoF%*{MNw)Sz0ezQkv61m>x@)+A&R=>JgcYqpqbAO%Ocoe zsB9Q2nB*`5!OL_a(7~?od6;wjPIU_yx(B2@eM}2*E{81FE8BAGvogSdM?^!YTy2%nkpXq~>|df)B))xE!~+B_pfF7BAVzat_Tb0bcVeqob_OE(q* zLI$1IGh&SUp&rE!A~_r(?&2~s1NL-HsbY&^hf~6uMl_|SwT7B*$Ob{VtQ8js0auGOfd|Fo)LF+!E|io1t{&m6xBkH41JQaevI&L{Ji&N4Ri=D((Ls1Jccv0vhDrj!WDw zR$v_I9m2PxY{Fc2-`9uAE$ywF@w}knD+s(p;Ol2gzycmU>meW4b~ccAdoaO3_-4O^ zb_~iz)zV~^^H~aXU`WVu;4ZT`^VMdllJeSSHL z^;=l)+>_Z&&rd3vxyvSTFj~Xj&Nl=n;ofggA1?1FzNbl3;c}W*7S~MzUAa_w%FUp_ zifgN~Xj1LMYqf7wofNWYDiNS>Wzbdt*`Vp1}(B}`*iq;wK#-j%$px;7-{^h2K(}mzxXf^ z<~}a@7MqoX-`FI&E@wPsalItam9_Jsy^ty)g-R=JSd=Z{O16a6jEY)7>-7M-e6B$j z!8Jf-!{|D@nFK2F>3Hm)L(0vX*vSpre6`lJ{s82;pag5<>Mh*9^nCH@#OT0I9aIS;VmZPhQs?%r=pC*!)btIjq6~6 zu3RK}K`W6$=U)YrN=j4VK&rG&+El2toSrd}XMXNGi^zSWvY#iz8$V62ioh04aGUDC zh2F1Vo6}!Elmd+wDztrbvBkxkx4$6BxFmgw3e7-9TyF|=v``Co5l>W^Zec z+B>GIt`;|4cLSVr*ll>%eH|wao}O5W-wIk?ib{l0l*e_AKvypErdFjs2W6J)V^Kn@ z>71ve6j>^(hBdsLoIR4~egX}>y*VhlIDv*rPBukFrGB=)=I@_O1&<|}-!5-%kNf?( z0%rXwOE-PGaRFg7Q}AlB``(#O0rq>*8}a>BC)+EHrDzRUznSDr?WpNGmL@=&O37&&L>p->5P-r2wvv45D2%AA12MW7Hs zT#{`ZiI|VK#0kmJEjiL1^E#SToQmr zg=SzNE&z?LJUGuJZ(+hzp=#1(ijqv_Wts|6)I4DL`T^)XA^?rbhB0t2~U+OwC9x6e41>Q`_bw=B3g~g zhVgUm>_%MTKch9|hwe9%Df?r(LZXj4xzSx7_|D@3-{{JD(UwK3x3?tCD50vYNG*zr zltr!bx=b2X2FxTs@SR5lzERmQP|ps0qY{7XzL4lb6T8{vVdgw8%#5x~mCO}w5+X&S zcQckMZA+IGDP)r6jjW4;1}q{!%$!GrnNis=NX`y3qY@v1vc9+l#(~~Kw#%Cv1DHFu zhKiwKFT*yD^IIRIA~O&X7hXnJW@)PQA+Hg^wPj38y=^p%X?MG-N~$VF3pUN=qkedq zMueA9*&rgORy~afRN@E`<|u;nl|FHH1{ncJpqIrVfr^A7LE~b@=*n#)c`aK`U<{Fl zM8aX}o3@~-lqD5idR1n+tUzMH zFvd-|4lIzdCCrn4!If#y05KcLY7P~~OVe)_PNK0{(?IBQC0DMw!j&sow$p1&NST{E zz8VUSQIQ!yj0+;8E0;2_Se|oIqVd!$G^%KU-PC+{l&%*e(Yqi79dz zDkkQm{3x+u^ZUc>Bn+CD#HmrC8Q_eIQ==^E-3hhP?~*>`sB}ce7=i+k4C0c6?5g+mrk4nAtnr-#}a!Tea)Y zfxp?JJ*Fy#`Ab6asL%||$A#k2mD8%_b;&ZKI4uZ;V(LcZloT0nGM2HlrUA_Rp?De* zibrL`m`5Y(fO)Ua=9B_p*Lb@(?Zt*Ic0AKvA4=_S4mHdVsnvev1Y`uC7_PLf5s)UB z;wjQVD~1S)V$xPY+yN&`9^b$@SRT)Xfo+X}`I77aDl`MkaoGWMc4mIuJ>X9s9Rb^w(PgBhjs4_zCt_q-R|<;K~Vubl}Q*x=EJ8Tz^! zuLvl89x6NjZ`xA58ckj1cGN4|7aoEwYP*A80ebtlP3EmdduYXDkqwmt5Q;G$u~&6n zP!FBr`Ksft$t(QzpfXYoAL;fx2m!%HZ`9f}uD(%FI$)yOX7hH{LhdrQv%uZHw=MF! zt*bGB74$LE9X;>EW5=fBdhdmM%|^yE=^T}GugCE*&FzGg^OCd;Dl|hmZfgJMA`%p4CAst=*pSYK4!sFB9gX*QOr33t{iC^(Uwiqly%4h^|L=TBKw2N zhGB?F24IMZ`5Tmn8|n3CwTAxAHjA_s|ImI#@AAt|0uGyG0qtPH#Mj&K{aH4*kJZp_ zh&=;J-9#m3U@$JRgRU%i%bJoW+RCO4p{i_215^f?sH)N1V3pL<6%Eu+?9hnB4k{bQ zAlfr(YcCO@iIL~K@>J1#6-`)gy*2ebP zZo4hCrXM=?5ACzz%1$3PTlLLs`m^s8(;RdZn-)?OM+0gTsX_v*i`t5yCNcShsp-QjY^&vGH@E-=oLOc zv|x|NW7tL*wp7vt0KrP}W~FJ+!(KYpv_qNu^Tnx)LN)xxaV!r?#T7JqFoOZ)uwM^- zi4M&#Ph1hm;3k}7=Au~v=yY*p_ALA1cji0*nWL6V-dXLp-_SX_Vn zb(oz6P5lsx40;c^%ZG~0z)xJ#5nVaw6)Q@qNRea-41~@I&jlxH`a z3lCjr0wkBG(Tcb<8oF{SB&*80CCmgjX(36SK^m=WOIE5Xs{>Tc!cU_W5ot73HVl%9 zRi~#jqmuvO)0xpbnLyL!d8{HXkA<#WXK7k1Q4l4|7Fq|?5Fbj3;)!HU%~GBR905O% zRYc^mP}yI{Q40u|&MtC6B@W$BP1@zH`u6L_w0VBF+?iJI9qc@c-GSiZ&4(9n-rC$N zYt_vjx``SC=wKy5s|y4^m*iSdp&0;*%e9~@S2U}NmKCH?Nv#1?DZ-PcB&j~I^14-N zkxWxS3qRLVMC4jf+3(aJl_o{Prwg_VKhse}WI9mUFbK}Bb3rAhnkd^Ycys$Gzn@rT z;+(lW4^hPBA<&hj${CX>Oijr3HlajAnzAfOm8ZE#lA^5W^mvxS&qEXuc?eWCjF7Vn zOi+mtA#d4^5yQkel=NGh77X6)!Qd5Y&9=)9Gi@*FWP}RMfJt1?9bGw94W*10zznMh z&0&bVEK^cuIftQsO&aLxISMJ_+FyAW>mc*{$a`<4u3e)3A z4RdIvnY8X@W_o|JrCE7lmmWG_KKTfr+C4eS9=XI1^wyGlpsgzRPZO$3)-L)()X@Qwbz{Zokj=bgT7_Z|NJyQ(5p}3 z0~HG6ql_DO5)z*~?qryDe|TFEsb4|^+EbHGK21FHfkg4YouL6E7Z)#IE}k6Lcax}I zcnjXxZ>N8vSq>z^qI6im!Ge8-72|wR}rmOyW|8@Tyde%bv?&*_ZlES}!%br{< zo@flg-<};`YP`~ET|=L!DD+`bu#zyY5|XA$64tVmBpJ<^NV6nKrg@g7ACNC20`jPA zK-bVQEFF`t*$Og^QxhLi`I9OK8@4~$!q^hVC$%R5EV>w0MQjOl#Yr{1JQiO@#Nt0q ztbCR-K-iEE?*&zZmrr-y3bJBP2Nif`uGhO){^V3QgI^}@k*d6Cd0UW#sf^H?YsaY) z`eZ5cyvUX0GM$e2mVUmVjK~+DvH^IbgJfpH8y#gc!h8DwwU9!9DiL`+Gz^r$OmG=e z2)o78{n||50v&M~DEJ6e=ekSu&ya*BdS8=DaCu6hj7uq?D>pRH$}DB1&Ks!EEwrst z*BL3esEd+Us;#FJnx&soC?iq|sB8dWn3$b~8MIh1@qaX%;$sV?2NUJcE!4)8VW9jP z$k}VPbC$Kn-e#-XX)aUo#P}ve13COZu8H{zdZM?A#;)EOZmX$ zIb8jJFaE6qQ|XNRc7sRVKOde*4v8-x-346v?i*1*Hf(&nlRxtx!0n-*2RI{7;k~2b zBKn!HoEoJ1_n~VKpUq}`Rvq8=AUJ+?_6Pbx%eH;G?AP6Hy%q=B+?^4g4j@#NV*r~mS-Tl-(5llRTyrzbA<_p9AMyj)}ywuDn_ykl}L-}4c<=&mJ#VdR5q}|V`6rL zcRlVNR3e#e|CiriP4E3^p`F>(hYonBy;PXa#kRY(-p=(p{b8_)2J8=$WL&O!rwxt8 z``>>1{Pg-66hy2o53Bd9d$iR8Erp1oH=LR$Jn|9^KVs;Te*a{v+z9v6h5GL%9`KdC zTdtQTN$zSlfR4894O#5R(#|NoQTpNZy}&)d*Qo~Y zgW0R8RS`I25^u)RKWORL3%!GD9GY{CE#Tz2+utqN9rVSAvj++c!F4zFB>Ee{uzE={ z92J^@)re&H$FTSx=oewnj77ZuPaypJ?y+ZdWa9ef^}$+qU%fhVj-J^H(9p;9`&hqW z8z$fo|N9$bE}v@=V{akN3*J&D2(+Riv`kyVtCEvUsYc}qPct#yrmpnK2xSBr0hJ9a zD_VB>=F5zr2PQojzNf4#+r;NFV*ydtOB!FILNk;#f|u|yEdB>7EB4HPyt3L+5tc{2 z-Lm_CT^av#_&KQEB0X2@u*XTtM3gXJrpS0fXsuO`wKXSot|-rBUF3AS=Dzd^9%Tf< z1C#m%bY+Ghiw z^ToC2G4>ng4W0Cd$D*d;C6p0VXodzyP)0t6#s6s25G@m}8kttSA~2bRP*yO~RH`DZ zR+4fULlGzwEq%sH8NpaVWdpdM!&iBL`{~mMeTGBToQHqY<>bVHq_yA(`5xpgi{(gX zv~P5{=JUnJPJA_;V6aPXl~6DaW4C2(s~s&n3L0utyvrbpa|w+F6`G+q5j2*MVevm& zanR9ZZPwIjrtPx4%n21rn`vp)5MDHmR0)iCoz6^EK8vP`V9}tmK{E}N{LRAZlL*MTFR3r@LDvogz690pt zj6S%KRLCslB&q9^(7b9%qe`Jc-O5}Q2`%U}{kifb(1{J?z&b=4lV68lFiW0wZ*VEnEaOYUi(qA{^G;iqiy^%MBo=3=3om~A_iAB z)zoZdu4+adL1~XMgnoBX_qVG5y6ZNJr}|Nz{ZB+8aJ~*w-j7Pm(1!@>%g3;ISRd{> z3FGTtjLn<~`>Xk{Jo0f&&I8j5ycSm5KdPYt;NokOE@&B&mfC?fmF~U@^<)@IOzg`X6%A7>>^&r@V3lZ7Qd9*c6ec8c#<*! zUk=>KtA)P7ug5GFhaCIWe}rFO4c$tvcX}`KKkTmP`rbbGKXzrl%!v=1ez!m{ar_c< zCmuuO=ssSW-#%YT>;s>f-nL&_2FdYnER)2it#s{jrSvP&)~0@=|7s$0Pi=gz*AnXK ziA!HClB)&DpN&^L5OiLSS3KgWK0SJAFQ5Em|M|p*1D~3=^U_EEvuDRI+P*<#Z^8h^ zR7UHj)=pdwwdqBZk|wQ7A{DJOmA6ToOlN*8pNvvPkWo=jY)8&kXDy|kCT{$T;S=70<6=kl`lW1F!w~Ue` ztJ75RCNI@=2)Xik162fX0F@1(2NRoxmMQYUNTrc>Sf{DJ(8k=OXflAt9DCh%d9z$U z*VbTv$9DR8rD@q?BzrqG7z(+7L9<(_1>fJGW*l~76X3d>K~TljsiP|ws?`uG8A+17 zC6uQ%sav6KCn{^IcPf$b=|YmqPvKV)DSTA+v)XD4szIr z=UX^hxUEw*e5;V1Fh;X5=`TOhVst}SqI6PO4u)sL<<|9ogW-YgVe|KkFLR!cBSNrUGDFIBCr_T&W(7(df5x)@r z?R`mC4{rJD(IcMB&+3PI`e6N+i_|9ij;?oX=4r{JwF7Bd6uAj6SYE@(0^V{$D=r96 zWksZDRhySNE7R#Z{K_XsR1xF|R5l!S$0TQMgP5@Eb$8Qs@@Om6RRPLeB4L*AyN#nIXPkfw8d zw*B*y6NlTAfBEMp1_EEyzwcGQ`%OQWWjrE zM8C0@&(gfDvNqQycA<}&x}>BjR6(kOw|UiauK09^gvuvHR1u^IR5pCd;C-HFRkot? z2NuvTuYMaj2|$un%*;19DtCpx8@A453z-^o266q}>fc<0Ja8-V=XgJH9~17|uP3v+ng=2MvR9$gAlDLIoyhdyUhv8X+LW@IF6XL!Rzw}aia=#U4RBDw6Af^#wDolI27aEn4k*xh zZEwbgHe-)@=vxEf5YzbmL5CZ;H@V{zeQhwi482uc$54^5j@1z?icb?OUvy;JMnpC& zb@7>be35g`%-yQ@Pde{AJ31X1M}ENJFWQW%V%vF=tg@WY zmNL@R+BmMOEXy;h^rkS~IlA^aBy|Lb1eFacK05b!hDD4Dzg4aNiQmM;Gi}Y|_=N>P z1A(TS&lj)nT|ONCX-Bg`)YA-RQLJA=>pj_Rb_=c9=4>@nhFk|MvoFACEGWNPx((w{ ztc7g@mvl}+g=TC7ab3*OmD9RWtSK{+H)R9nn=#}VDVVI2T4bUPH0!H<=0+XC+(2cg z1M#TXEF@yWaPH_miR?N8TN4~T$Z2E9d-~U=lb=W3Fa%SBWU*SBIk)tAkN;V6Q^Yd4>&TS07Uz#G3m$l99gJJ&6H zxUlgOO<~_1Gi}vZ*f4JNekZrP%V`mHTt{_ufLX42Nq8v>eIhfx z;Y~MTs{O2W9g($0Wdo?g#Acxm6SkBATb6&~+{pKgH>xkqvDjNV% zO!68P{%ya;A#~_YH%x9A9ko_FTMCBMEe(}dDrb42AUZ!ujf%_wQCyN5T{&x#Ox8k> zltYS!HU)G$l%&ik<5kjDT$a-y@{`ncM3Nen4S;AyhI$^i551DxmWG3hchUsUHpjDO z$MILo6KU!LB@jc?`SWK{kr`-;>&lLL?0>~IM;^pYNJos!=!Na_{VNjGB!J3LBSaehy&ko`nWs4pF1it z16y$!JalE+u%>P^4zr1%?6Iy$L(_tkEKPWl$g(H`aY{dfS4U*dV96p3erbdJ4p}A_ZQ#Wu{1$~2b~_W0x;$f7$Mt?kS59fg(p*xKu}qucbw&v* z^nco-E(%^`yrF@^&rcfF5lJIdHUOy^m9#jdrqV^Wj~Mi8KMkvg;VW%M4L{j$q=}2$ zsoFQt+iP|2ekx6GFZNYIfydCT#q`*+(_Ho6xB56WorZeBHW)h|z4u8+@bV;69oN_$ zU0GIANWmMD$fnWem;M`Pj1wlRqDquhRWt1fHh%J@iAcVnveO7e#pWOo6@De zv}!vK&P(qn2YC%#!`U}zHV9QW8sB$jf}F+X)#Cf@5;oo4a zhA6Jv9c|oAqwhv_H(R#3HB&KN8yMR(L;r@fODK{yxd-dF9LcY{HL;ggjx({v35n>v zqEsru7+ALV=A_@RzpkO1%F}=Pr)LX|85`#{H3A1j`A{62+Mc!%Yz5SjF>q>Y9k)ZX z(or)^!PZYqvsYN(Rk&avy(CY83eCW2T%H15IZ2q1HET%ORE0JIXiI9^q$K02%#)^W zaz5RKvhnj2O+=mol?~uDH1-v1DTE3>^0!a5`=9$F*%(?{}a#-;LVYyYjB_ul_au^}#isZ|z@z&2xfI1nugd z9$i>J?$|luUtf1SSBB}X_i&z(eCy|iezT`nWWH}M5ZK>LZqdvtE!$RfF>~$zuc7@*vaP7l4D`okThWyhnyQ4!np8a1=r0>eSi&p)AC(nKWmNmP zQ|PCOmu-cAT#9~Nb`t%QOP+*1F7aP4w2$8_7TU)pf*3QRmtzcHxoMibO6!KSEff?q z86&(AjHI=!Gx$HxCp+`fB=s?NdEOM44Pb0y$*CQ7V!gj%SRb_({v+f2_@hp2h`7)U zutw!N@s)Ghu(S{%@}NV4W(t zdPIIg&-?#W78L#vlQ6tE9cn~lV2G_;inNg}bZahC0qIboVVI+-5;_-W zD2-?gbg-4%nx;v~GLk9n#?XujqIdL?$egC760MTO=*5>hp^B$PqbXQN8OlPu*`F7hG^oO^|jn#*%s zxNHzLXqF518W%#ohM34&tq|&AcrNWkAK?p8bHRj8 zTxbSrqViVw$~7(8qJ`$vBGYzFSy95OtRRI@b(7RZqO!>r`ZTG0)Lfpo!exV~nOJn% z!oibO5BqFjyUl-@h8y_9Oak)aM3@nc0VJNMNL0hKl9Vcugep;!x}YgZvRovIcKZq* z2vgKPATQ5T;IctLq6vpN<(|0spWURl&xc8GW1}?V8LAs5PT&$l%mt|fTxbSjqEZL= z%57RHk!!E4rjrv>75NNzcOJg{g!PXJumA70OCx1H4QTR&W7go5ASWmYnars**)&y zVgg_%HphO?*KqTYnovI&%z?2HvtO>?p+@`#(R^HJ1|XxN`S{9`DqfdmMcP_$LWPv1 zq1uSg+NP{H6pPl=QG?Wv=BE+Sd{lNCkf_)k#}5_$1aYMvPE)UkkL#yyVopZ^`qOUU zFh3nZ5We;Vf>5C_g3`EHJ-TuwbJ-?fhBZvv@_G*=Oz3~+ZBZ48%nPX|n}*WVkJYCU zv3gWCfS`#b5!hf7|EP_p{05Z-k0>ULcWb92^ z{4a_h9Y#MpLKKFGvm1rsA~O&X7o$d3&LwAMAz-{X)dn-w*kHL}gq4hCZCcb7pDfv- zsUM?GBVyF3Yyc4xOCpHCB)+(QUdJuMkZ=EzKr<>dbG@~mg`YUb)FG<1$c<^R5s)=O)ZKb0FwY8$yH;Jp)s!Ly0619c?*wYDuEgK zs85gHc;D_&F(ZcTiDHac?SR9qLhaNeaJnP{jS9_xQ(OcZU77Q;sh~@F$|EBt?V=2^_ zT-6}jSOTXnz3S}bQ1!#K$G%zIsXJ~dQNA6s>AF*q&G!>`I&orM9;r^_BGu^1ZJQT4 zu$|HZ2Cpzxlcp5~VRgasQsyPgCmZI_)Q?oB5s_+CHn?L=EQ){(lXwFeb;z(od*y}N zZeg=A&9}{d)oX}p_Z!%tJwyVRe^t_MSU_LeF4gI&9PcMqL|IFy#0;#&#i!AgMP1Rf zO(3BG_HJ6|+OXjoI(eg#s>*rI16c9n(`iI}8kG%fM-xjTNI|=G$)&SwMzWCU*{=GH z2CA7_CV}y0VlJ#-YK&~Vz1e8sbMW@Jch)jiKg6wRNy*jjyRzfW9EI6@)*gHat}cl* zqe3&F6&GnnS8i+VO4G6>t(m;T(~59f3&N^8(V(MA7IL!vNOKwyX+~v3lXq~*S&SD8qt zY-Iq0e(XAph+U(yVGK^JiU4o2!Pl0pd(*C2AAA}*P+YjMLriev`;y2sU1M})-4cy$ z+qP{@Y}>YN+qNgR%?YPtP0Wd%O!)fy@z&~I{ioNx=hiu=ZdIMVcd-JGfskBM%-oOb zLTvLZS1M7|QEk5ymURkJ>tteU=7K?IHJc}e#M1-%N7?o}#; z0tXOxagp?c-NC+mZ=OYelGl}KQ^5SF0`D946b(mD{9}&?q&}(Pinh3~sH;=P-GC@! z{-6|aHZ56u-?B$ZYg?Vyn7+)PX)TkI+1*id&j%|}!Y&L~ASqD-+}}M+6;@@TmgyTY z5;T``c9ydHe%z5DfsfeZjr<9Cc8*~x-(>6*Ns8{ZYKo`tG3_c*NEz9n1zpaZJ+3pd z(?8QGm?fmF#pp*M3RNyBP}+Ve_;b>=`EzBm|h;35gnCybGzlnMtCY^TOT z!ox%munB|4fA;x2xx$9P$^zsA0boPX@I+O8cpt(hbtG1rMvSPU$w;d zp7FE?{X!a3;t{@kmx2W+EO3Q z5(w2ilhV(|HPC5cQ>djNw*Wt0W~>Tt)_*sysc%cs$T0PdrJVa{0dd`>M&Oa01O2-8vjP14f)S z3109&P@0>dL8rAL|Ihwf?(ilo84?WV`fCxG48&#gFoDze0#D+o8^wOgKYOEPVy4sVCG-{~e`$37hhfV8P8mJUq77WT)G|y_fplw>E1eBDKI0 zVEQ`@Oyh!o=nvr-bUVswRKSvFn2RidcwUEelBNqX_}0O@xfeKfVDWf&QV+INTygj?9UeBuQl)!?(>mk~Yx3W5Xk?c(D=@YxKj@}`g$QeN zB3DI(8khb#Ew$Pbq7C4{`H*%YLZt;xy73T2*Z?BkUl9{#V77Qa;Ci1F-Z~zFqIS==~oq?8Ek=OAa(Iv#!2JZ zw(^{%|ESmsbl^09TVm9{!yh(SoiUsA(Z9qo@QDsVg$c9H%2?ZMlWs4O!PV-kCIO-_ zV1zyMe~cvpak^yliG*cn$XqcYvg}T2T@>a(6nn6Q{x1vz9~fU$7%S_}GMeEl<8s<_ z4hL`eg?QiqNS6f2%wzu>02e!UhBpXon(S@wwm|@*2}XkP zaRXE_TAEIkX62SciNu-}7XExv#zrC^BLi{76bOKC5}|~me}Dm{T5@Mx-&CItP~m>V zUDli$Zzptd!6QAxQ-cwW7=bBq*;fKu#9WfZxdd^ZgS0L+UR|G4K}9xNPo8`XIcPEZ zmYNP<>et4;lDa936`{p35twDSVP6=*FF`z}To|97pa4N)ca5zHKsH9>Z6xVnU-&1c+rQ8PTsG)q9WuvYQy)`*F@hdau&3?)CT;&-F6sd>oWU3eqm~3I= zNoo<18A2Qo4Mo?;jCzY9a6)CX_T^lI$$kQ85?~TaTTGVo3GpN;rJAw@537hKs2PRM z1W!(|4*mDm#7vxhl+!05B^NTHeqn`ZM+q4QOVjJfAizUNlQ32-vD}80a*)vgC(^{3 zD*!7am|#Fu1X&VS57wRx9X+5dsO#L(o?Fo&n2|0YRON6H99%X|J<&vZg zBfY8eU<@Dx#1L<|FNVK`DC42RNLq|0^YEj@%7Rb`)rE{MI4~ZcuHD$RLzeoM;UUlBH#-F!YWEgCFaf>ClTVX z2TAm<7TQoQ=xJSO94V!>tP~htHjPRC_hc;CA;nQUtlpB|jBPfc_J|~QG?+~ypVc%8 z(Xl}DH02XwN>c9pY-d|mGmd}m-~an4HmHXHo+Tj$e0{P+$Ay>DBbzXSr64+}YEqhb zsG*HcgQ!9w4-X}UFGfq#05|FIMvAifK`ZY0&jR?CE|p%Boo+UR{P-KtBhv`h55SCK z=)pY?O+s84@JcBRU?B)%c~EF|-4u~oplt{$id7o$!brLjW1>I^JB{*`Pe6}~3--P5 zk*6;DayD*dk?SsVq)LC)aA-qtAz8Hq4y~lV0C4j~TcW~Pqv*0{vlJ_#if=kY3M@(A z9hOK+2mp5uIb>RXOuC5kqi($}TU&Bo6vAaJ4;xcb2$l=0GSIfMk|frmG&7j{EDki;uDm<`w-DO)#JbJ0;QKf)-i2e;h8J>5A_Qu9o()oO_QWlpzZrm4>Fv#@8 zccBQTwt+#+s2MYOMtr zcCCqdp*%;MA6Q}!EZWl@{b9BU*=4YDBAKw3lWgBqJ*ypg+)1GvaZ-a6eY4P*IVBb@ z`zG!djdx-rC3m5Gt#@MkQBiTxw=8t{t8DUY`RXE)$a9qlfZ`1*ih5FfSlja90NvIJ zABea$S(Y=gK#&6KKFFAolN##0Gb}tZ(_$+i zOK9B{Pt;L2D>+d%fq0B(XW?Wc35a{(o8y*cN^31G6Kzw%=g%NFO7ka|$Ppk39>A&1 zwdB{$<+>w?Vi=m@QdMkq-7?6|_J%YIbF=+|lx!>23)$cY$$7(4XGq?&%j1jjOOKa( z`0MEW4MTfph!hkNS!)$Sz!tI$+jOX9Q47`h@Xy7Ah>?%C=~BWD?o1~2cqA~o^|u(YO!5_yDGQ?>n2#mQL~jgB85P4bbr%v zog+KoEwh~pnQgt>1@;{XMJgF^p~Z2x(2T3YK&1AW;BiikCAmrix zz>r5x2^F;%J&%+5`m&MrTbNi~{f!HkJr=D30sy%}LQm0`)$(&Q z2j{>hZKnGAv+h+}Q?^p2`!Ic~$ivRh)0d#JbC57K0x3;DIk0V1lUqV3f_^UUG4oJL zs-0?VY05*=@xco>s!JSYC~q`D8K)|OH|QT@mcpVJbowP!4G(&)==m1)so@DhkwN$6 zaox_;|JB>{QwiA>E`Y=6&(nUUM!xw$fAQ%%sJB@HZeK>)=;Z~qGj=EFv4tPN_O(KQ zqx6Q``RdTUeYGK58x2@rlf6~nePl;?Tz63F+W9}unJvRZQb$q-So&u+Z=n!iL<9cT zG1#beh9r7M6iLyOEm{M8`_ozZ^i)7l&Gw6NiM92IPx}^Illj2&=r6+VPRd)J@`aQ< zE{aE!_01>DKk_>!;};j5Q5w7F8uhh}g7(~>;z7@EhWHv@C!MS7th59#O3o6`_O;t+ z7700e*+$>JVb9d?SL68H-^Y1z95$GGv<|h5xhFmkUN8s0Z)n3}XGQ$=6HyGh6=UUB z+sQP*2~K0R%J+4ow1=l?ct_aCend}0p(e>Hk^zsd@vo@4bIw7^1>3lY zZ=*^H`x~}3et=K&&dmd^u}3KwYW3##jOPzo&|@wGaPbYUJH?GLP;RJ{m~rCESDV_K zHBHUxnJgpb^d)YvCt2yxCR}i{h9$I4d}@Hr1Pj zy6jPac7>AeKv^vy{>W!(`bvIwh;f3YuF8MTMkL@ESva9#p?PUxfweOoG(JzAQ_~Y~o zT&z*>dxtd1o3m%u6D4eiRwSj9C2tz#@^Ptazy?`zf&Db~jTnfwlNzHOTgcD=or=;; zjbDW8$<8d7dC0xxlS}2oq+_gtPnHuVHI$+lQ`u;eGEQCM3w{yWOkD3^mGrws2*XsY zj@%Y0Fg=@lIU`@I!VenA>w6HZx-ZoCz$lm{p z^%G=rXU91jR8-PBwy)Qi)X#Vani_LqwZ92Q>zJ2nQgL(JXkaEEEl4YNv zRDiA`*%vD9?%I*(eS94}Tz#UM9x(@gKN{q5{I(CFW;q`Cc)nnj7{=!XWtDIPocj7h zUNM9nvMo}9Ty65;-yHmX9p26Kvc04K=0^Wo;O5`7iK6cBKi#U}K%TlOh#a8;p}0Q= zGR~1qXrilYnj6Ix; zok|QJ%R|W{`;LXg1bzmh-TX#{T{XlyiPNJOvoZ6hDIZt!s1Q?!96Bgo5|R}?@A0j8 z=7<5r0<8V#+6z;v?>$vRykYQY?c;(;@?eh_YPE~xkz%7g30#9<7xHA}U`N|q0vgvA z7sV{0wl5v^g;U zlM>1eM%0tfK7;;ouK)2qu*GT?GWf|h#@=na?{Sk(*dlbDby5e2BXgcy^$iFTsaT-k zhX&PtL)mljGA>hkZa`T3ZU6Y-bY9GrIX1ca#&bqe-L{O!W*a7i{YHpTvYW6^-c=Ct z1WFxEOAPWE%4uv&#ZZQfBd^4Sd-`8Uk8Uw<9Ht_ zQ<-7k^C0@yDq|+P4p{ut%n;GUT|kpR|IOu5i+HE!umO%0*s?Eaya&2wQVX@T8z)M3 z9>REkb};ibl=WHeIV%y?VBj&s8uN=-X5PDV*Ct5Y-Ah^-!x2-4fVnNT!9IMp{EFz$ zl4$qiqCHPqq?R$qlePZkVU}wC!|5ezs(6O~K|~Q#iEV~@8QHJ#mDR(? zu{VCk;lF~$X&W65tpuc7T!`k5v!c38MO_|+S_rRvMbQ?}w`>7@%L_o>H5ooGcA)!; zFAJkPEN7f3!W1Sok*M=&TrhDAuwhBycX>t(O$@!T{L`Jk>zs(wOZ)Jza6oq;SGoxT zf{+)mBSiWU3Q?F{cbp~kN!QH$ z=HG!;-rH{X^^5q93r+}+DiBU`L%8FbYE2 zZ3a5A^z-a{Z24d6o8f=1Y4Z4bAp^QIRvMI0WlJ`-k`5ndQhPQ3xV_w7wTxca%SiI* zT4keHsw~wcK}ynOtWoOUL49Zq+|@%|<2488p>Z}!BvQ2rT)8onh2P$&+-nyu;kHou zD7kL@ZV0Z41$YGV^?^F(#DQjgaVWszZUKGT^}1htK070METZT6ZixTZpZ7J`*w!CyPA~kReFllyLpA@)DU@|CQK28vScy{ zFbWZakOAou+dEuWz}j8zmV^JX^tDuSn<2iRH?M5+)Q~VlSgf-stiD!LOw4sQ!<3<;4I7Ppteh1 z0GN(ylI$s?))>%@w8=@zUa5qLLw+rD06yjYF;ilI(Xa@z<$+7FSt$$v$j`*7Y?kX^ zWvkksE#47hYWIRrMAF~##d*`(4Yn{nursqLoGaW#6v|uxxq)cG<~B!*2JPZY_=XYW z=_Mh|$S#3)`R4^puq;J_8yW&~IY+*7vKJTgdIzFx)H{ik4J&L}jeSJqSNO3S?_;s}HIQ3EpND4JMXn8-ICYYXb zyJBprvxTj1Z@8s8mZ*sF#NMQ^^5Cjx3G^I{{dEm2CPxfYjKYP<1O|iIk6N(Vc$EgM zGO~C$0V$~2xBg$^!%=2O&n$k!h#AY70IbT9sgfTE%GC8k(j8*yHn}*)S^e8TFjdpDs2_q+%dKubs!T+g%%;*TbaB2ae#6Gc!R#fnJWy zP2{egc3SGDk-6gwFn|npQkxw3?B8^@VmZHH>@cWHr*P&d0{3 z#_+dKzq~R{KES7nsxoi^-)4Vyn&|#U$RBK;8@lkDOcdOn0BLA*(b`PZ@?Bn< zGMG0DsGFPww#PhK_vD~$DWjd>1xV1-1ml@vx>bISNpWE}C8#v|i+Qi|Hh}|ATvKoi)Jy*~4 zj4kKA!*zioyI{kUH!WJ1j*ye=C?b)~-J=ht)4qXuU<7I=8VO~t#q?_e3KzMj66x_H z*)WpYqEEZ>My<1toOzlWMbj#h%Dh0*=MQ1x1@-i)yYq+iN>kH@`ZNb2n^e6bx!UV$&!uOhX-0)(n-AE7>8xQpj6O;B}`0fkq*HnWa7>^tH@;}^~ zp^w~12(B+xTDKdo3UYo0IPsfZudQbJwQVYIT?r`I{Yz+a>g``r#h+YpEUS1CGWsZM zeUR@Ip&D#{n%7vx%Z=OrhZnb9Rkd~4y|ryS_wG1%L@YNG&fz7_Fg4yAAV0;luT?C@ zzRVD6bjQjN*t_NM_I-CSF57(d_HP@&`q8~ZZG@9s6)4W!);O@XI}QIN?lkyj!1^#@ z&#u1Miiq3%dJwefyfp*O&)5Q8e3Zl{S6)qDidVx3l+sXLs-tjdkk$AVJJXZ>2i&&k zL*+-Zu<{0gC>T!h2DCbRC8s&%8ejw36^Yjx#pd8f7r2bHjU0AA$neDaXuz*``?K?~ z3QPQkw%$nCX`_IRDtP6?v21m$IiR;bPc?=Hd? zPi8t^))vLL)td`;-7EU`Ec$g8=)%s@B;r{Y4eH($LWo#6}#Z^|OT z7ppg9C4W`<(`IVP|HC;7ChlqxA&OkT1Tw%Gx=Iy%{BXu;@C&?Sxuo{MwZ5O7=eIo_ zNbZC~=eFmb5u$?2%3^xD7Z=Cd^HbFYX;%;77D?_)X(Kn93<_jV`8OEweG+n@O?)=Z z79j=iBd%?z!BRm=u29%ft}K5NTPt9-RMFl3`>mQ>n;4kFAJXiSrOS&@27x30>JsC^ zyE?5$)K^d*@wa#>gLb>|kn&T{6mh;3L|`d~U7q?p)}GaOyH?zybG@BT4-q0AxEk*FB?TIZru z?$g~Z?fkx-BFPa3E-Yop{mjKGIpN{cLwiTIFN7b4XEHuCUcI`vpN`QTLd^zVL@~C? zo6mp9h3Bt(4I#%F{de4}c-J4J@^J5Y3ElGq1IV#%oXOv?7##5T?8%QT!`kyzZ{-L) zK1FIy#1Z#%ML8q4!}YFaM7V#B+x`rIZ#`3cB-M(_Ahhm8+^Bq6hZd9 zJcRM^5dvEME8dMXbQ!oQgl3dBnzrkoRprAo2~3;KLc4MO1R-c1%x?0ONnE( z8oy{F9o=}m-UGd&cSVJ;R5?enZk54(%ZfkOpP@T)_M<$NSo(eKEh2Ol3|(wCZ4njo zE39ED6P_Cl_$3|L96f7(kv=+k7PvW%rduM-ael~XR-X=QRM_-L)(`(Klz#f$+fnTS2XgdNNK(Mdn0Dr}DvRn$TZD+YOfE%*L^PFy zM2Uu>eCJGcK%pGrup6+9VcUV0 z9EI(}Jkzd6NL?sLhRDn%ZJV2jx@5Bau2y5$AO}$Dxvu%fe*FFs7q5;)ndAACvCFvA-U` zkHJ#KO}#_43%cYE{yV$@0S642@WxPS02vk&4-^h?BTE1g6n>5KZw@LDo?qVf?S{rhS|C zSi<5)JFJ_m6S>4krVa5PPI0;~URvTUk1VdIXSU*k*Q31AEc~a_AGdzkZ0z%nC&99_ zAm$L@duG}n4BW#2sb!YYRm(1eLRGuw=jG_XO>T+De5&870;FhYnUchmYLTzZ3uki*fH=>yv^+ z2T=y%0Z~RMy^FzqMNXLOE zYzFsjQiw=Up;WO`4a0O>y^W;n6uj702bDr5MY%B>HgA>BRHZ`Agwi@UDy$zc{6szb z<%7Pj(5sGz{RvsW!&+%v0wz{l`dnMNyrmnLf@CYrG$Xj$G%z*>JGRZO=ac z&S&O+@6ETb1pFmSp}Y5}-&Djje~ULaZ;cgndZiI=K2jWF=fz4oZr zn5$hDKj(V6=eG}5?4+m8e)snTy7j*XVZRNEx2;oZ_BwiKqe^_0^2m!UYA^5NTdI^c zI*WBPIZ-W0aHPHBV119OG2`M&mnK;dZB-=BpD7;wSQEHmnK1M%ppMzo{j6;{3a8?v z6qu7umDcIJ?Tmz+RV%_?l(-cG2Fh<`eaSXYMR?{eSC8Xk3{atwS**B&furbnRvAP+ zLA^EAr*X&^Ay&Se9~LBv@tA2&msR_^%;|G*JPE%T!ty1D!UDQjqT$ zLCU`phRs9rd{!P7w(y)f_K;@0^xSFrCl$MZ{j+OhOnck}cyh@lTo6IA7b%?ImoXC1JC97< zk%=7y_3g*gH0!+H+-n78eb#+@nfiP#1(_Y~a=rcDmwGgst3MNF?#0z+_}>fLv zUeVKNm08pr$tKs;84tj!c~<(!q8rky%n0Nm^>YbnmBs7)(kaiZvmaT)-Jj3d6OM@_geipg z!-~O4Q5lOM-_Fq9027#*AKW(2*iCv+YN%U8^Hv5xdv`?ftV&7?l&ahPX%Kw(f7ST~ z^MeD`PeDGNRs(TXlbK$uTWH^Bj>aaJjQL)_B^5f~p(uJm0)-W5Z7QH(7v$I&l;;C! zoHf#!3Bk21N09@0!$J@zqU|GT_l}O~zIOJ{^oTTX&U&8o}q8b zGH=n!AI{rmb|%WV!>Xw7jQRI(p<#3Pug{6~IC^51y(UJk(4MJ8$<)L`#2v`SyR&0L z&b(LUF~tQye(|@}=F_^I%obhaVhw3~=&B!`MffpnJeFC7P{Kp`)N9-7dwe!kC@N6$ zshue8qq=i=ts`K9%NwSw9L0L@Tbt18@1EK^T48}|cnPu){*o+ES9hl2iX}8cP%|ZB z$;i8I{8nEaPc!et)go+h9aD=QTN&NCRKVz?M^n5C!eOK_!sgzLFtYz|O=%)uvVBR; z8V;H8x&N*I9k$2Wg0uRLNkM$c^jLc-A)3i#R*FACSl5TQG0e@y7Q7ve@#YSdQ=FPB_;E- zkPYtAWgX&XvN0X3BOkA8YDVh0*b?w~3g!Q%6O*(&QzEFPp$H^ubd+{Sw?abUemy_K z7f=go(jvE}gm7?MtdtS8PJvZj5=)6Zl^K8Np{a_IkUT(**(1(6M`prbB-USKrHcQ@ zgGn;cxYt#^Ycc|0A;RT2)DFN}BQ|=1mO3wMHZ^v5>!=|A5idy5sJPN@K#1A#^!r1$ ze>9pF9U|}#t`p8ZLfT>j(a(cX;vCn0tFoUyT`NmHF@sF%+%74_j(7_*GV8C??Oegr zQb!a&(<2AaX!jl9K`}Bk^z+2(a|QTfDV|D#c+Ft45XFg!7fg%4kDqF}NiWT^ytf#O zU2eDUC$%+fCcqL5M0zvMlVa(K4=(>5D9JitA@2{c6cf-^VwDzxiF^$kdUhMQ@2(}? z#SPutD%2PJutkE2<7Gl*k6xivO+UlsbA~9r6 zF6NH^5b1N(aRY&gwxKc~hwB-`Iigi_MS&ED`5eje2KRvuc+H4kFP2-M+B?Hehz@fc zDLosW?}$CjMgVLG?A#JCmD!wP@2(S--f3njt$*XM1HXVDoN`H#L_z;N3t;#Qn*zHM zB|aiMQWJ@)152BluBM~Jb;+3e2m0SJ0+v1(f~&min}EoThp`RPCp57hrugz%;%D%A z-nehjq{H{ys=DYjQf|h^>wTb^Zg8S-i62 z$A7OqYnR#ACbu3#e4Xt8zp}lM=g-ljJY~r`fUUeJ~iwgP~?V|8qN3ez5J|m ztm6c@x4rOHw6;vf3Te6U@V-Z5J(B<;hNJ6$Nu1u{E+o|2ERYD?Mb-spO;= z+tMu+L?8ZM8l)%(RdweVh0R2I;mI$)4BZl1wRBIpFp>mPFGfRHz=-vXtdlCOB`UueP2$&s^>c=>|YHsw>v! zDsX|*q>lW!JGMvB=ZZIVx1Pyk7DX^?3G)1hgMmfGZ5F*sydz}P*Q%XaKx$_X0_eaU ziWv|hUl_%#CVS<}OAd*f9nxC`vZSJ>x>ir7p?Rzh=s6o0X;vic6ru?cHGMOz~qi|Z$Z0YuT5}GVpImz74rS(StOQXWSlNO`v zK*G9u`~C>2W;|tI_KEe-RmkD{l^u=MGxBBBqgNH`H_N@}UYS=W$RVPwp!40Xo!d?} zw0Kr#h?QB@Tf1_qVB*0r+@WtT2z$nA@yurTFvfK#6AqBYlo2Oe2tEGIu7Tu7E4!G= z?IW4Xp|$y`WVaa2M((k56i@9_5j(X{DXIES=jBsLkcC*Q-y}NOwg?%Sojv~*rF<1b zP$tS|n&I`#oz#Ld(c3O+@_T^Dqdf`=vUsBNGVj~$hq+*72gzm_8c1c^>A`XzYC>}~ zkedYL{Yb*6MrWeyTIa9IsHT+zCb(x*7mh%qxr8K`fBPS{m_!?Lw1Z>&0h)K)r?|(} zFGgSUOTq>j?c9&!m?Oats+iX_0kemHSJiAfLR2~3bC-+0N{o_6Rc-5zb4%mUi0k#TF=CH)crgN<%n1gw9%v)d8i|;sbQbW zkdHOrjFtVA_rgp03)H=N3zdbk`lH0qW0cnwz1A9Zrr7Y!w~Vrm%k1hB@VOe{q||A( z`2JR;^+q2_w%a)Bz61mw_eM;FUetbFw40dtz5Bg%y{GOzIi4BLnBb(7vX2mevFkaI zSm!ot0NpL=TZE9{br~@FzmhHUb%huwuR;4G>Qg9N;zaf{m&$=&X1eqzY=(juUT)PJ z%VLLW4hEZ5n*Rvd6Z@Hs1QcNgVl4(Ag_$NS3KO!AXw>cSKQ8Ebp7^OY9j{-z+fL~+ zjY)HVLZabwAlB#>6$O{DeFgxpZi7*~!+Tjy+qTGNun4^2c@vY)`}=EB8;SDdS64xU z8p&a8qKavr&5>(&r;$Y9nINz~{umXjtQ};a*d9+ftZ#z^a-TT~R}1!mFHx9VAMU@n zaSg{(s>5wLhMh#ctfxHV5V6P|?J2c#}cLOKRbX5Is|CLhM zNZ+fF-91}bpj;FAIHIW)q8H#${%-e7JRWP?0#%+L+8%AxgHP06aX z(E|K*@0I+t_e1E$Ia$rG_ljDnd&8nI)IzV#?3D^$$eS~9U3A2`uw`ug64mJsn`k1vGB~v zQ6e@%{HxA<2#$-pwlg~$=c$7B&_*x*_wDvz%_Muz(kY7I+z0{OqhUhP+K&CrG`{my zoWJo;#iLYzo4U<6r3qhjfQ>e?t-fg_*hIzaLPo86ECp&RpfBW3G1<|^TAVHWs$4eZ zC?wePyy|r+8bg?lza-fDJG2!Og-`~RJP(lvrh0OLCeuvsgD0ha#jGf?->nQ#oJ^bm8uK+qJKQK? zAX?`P<=UH1N`42qZn{&>0sP{{=NsWsM;J94ad=oXE9$R?ZV+PLW|O3veHX`9kITxx z?{&YmlP(W4hsVYyPg`nF!r_C@RCPt!4tr)T`;F$lRlbcX#VarwWmADp1S<-=&$qCN zh%xCUkf`OIsi+rmO$Hl064q^zviHALRbkknI@_$bIdK9rxim4-*%+WPI)R2!C&gr09PB7SUu{cS) zv+H8keG9$%BQT=k$W(`lZT7Qu#*rjnlzqq5oahT=TXpf02E?4zNRi>uxu88xmt(%9g4ba~m#g$NyIJ(nDGGZ*)4~zON~Mb2qG^Uw#^|O3HR(gTxGmOK2*_tq!K2 znbkR1Vk@S+Bd^9`NX<2>|0iU4EUB$-v1ipDK#V-M?8ig?lsLV~iH6-;Lq_MRj_G&q z09NREwcU!gFza>YyY(CknZ9`w^u^Mq)nSeCCc%{;7V!rUbABegcdW=pY5rf~YzL}@2L=AZ(?VmO=Duqi}>@U!nwvMOpiS8(`f8rJ7(Ncyy{O3tZ! zjO$!c$ykQc@|fwxm$FJaf_T!BoGU~tb3YZGC^V(>i{Ln$nyKe(Hepri)?qMzS-?2x z+?y;(p}ITz!UpZib~PZn-_H0GQ;S& zBtuFNc5cjuhukH0ns0e$^Y_r^IaU^?0%8}DT_(P=*Ra(5%R%a(FLZ*$n8nF#TT(6e zPWOve2P5wH;_t>mePDyY4ZnpLC76E+m#jlx-!E(ae~@=#x9hy>L-AOu%^Z7=*3&!LdfTJ(!0MQk2e(CPF*H!< za`v|r%Nf);f6f!YkP4;E)HS!a=RS>nod2MG8#K-uSLqe7Olk2$4CzJJX+&uq+u@E6 z6)5JQ5`{{LTqL7{eEce9sBPtgLh71z%(T?x&QDp9v>>#!nY-khMN9h>w&dMqs48z) zDM78e>TBcTbJIPx(BNW4O&4@I#}+}lPK(COF}-X?&k48G<^=Hy5U z*sFXR*f@<7ToZ6$3Cn`w^ifv!1E4{-D7`y&8WI`G@3oH95GCCGL-T%mT8*Y9cplP> z$Sa&cJgsn90K(8{e=bD=$c__LQ&bzAeZ)fhV%${f3%352h_NT&&r2Vcwjf31Nk}He z5%wR6nW8U%+Y{6h$^Vv#d~i)Yo8^dWr33bAUvq)vF!?CNS%{R7RL{bkYoYTz3&}}C zusWguE)pUh*-XOoV3`-~Js~6nuO9`)`_z{OueCcd9Meah+gB8zcWcONPRAkL%SLma zw4TN61CuN_VXmF-_oup|Ur3?9*Qq!v+Hf%OO8nVfv$QgEYU|1wXz^8-DoI>2p~|aM z(>Z`$^F$3_|5&uq7v=CGSeYXM?|WZj>RCTJCSri}n@+`eu}Cx4psl}q`^mm4HSAhD z7L|^-hfqD-y|by-WRrsuJQ^+mQ0Y_AaW>0f`EdrPrrJz#qNkIS+9EHf%Eci)&F94S zgVWpEa(M(7ms5SUM4^?OHF=iktG zXi$xN+fKWoe^*yvOuIA&5dnnz`t+}P-pF*??!Xtq{EltL;xdY5-EP~Sg_=#35;X{A z-dO0tu9HyyAvTra>j!6Z?5G@drh%}?#FN7zI%oQGs19x(c)pkxbq=7&&(D}0Wz%YE zbmK^FN*CZmu=M%Fh`XPZ(~Jy3U;apWr*Nc;?sU00TqDc{P(0E5-HcGMp+_ymkCD>Z zaSQ0r+PYM)s~Dx`{c+(GiE91{N_V6gW=*8V&c{CYQ7XHH^QL*rZ$D(J+C)QTqlq1u zyeQysS>07@>i9Oi8Mk~+6bqh1$o`cybi!uO1@~<<6Ch1J| zdi;rIwCO$Dx+e(G1NPmy8n%pFl2aLCN}n}p?*Tq<*Ib6kL;Oz^@);ou> z!miwjFitP0!=yKiL{=pQC~)ica4^H3p$Ri?0Mu%dk#yzLo}MEcHh0Ic1Buc=XXGF> zv$Cak!jQ>hlNiyH;ZFi##-KnNkq!{%i$Ylf%`r7JKwIV;UM;Vgb5q{MEec|jEWZf^Y4}b+5M%yfqIr6ML5fV4hZSfk=Rf)LjVy6hVmG{Q_tg85nO}oGFuPX4`Xe-P zg+F2cX-O>X64oiih%zoCBd;?j@@ba)V{pj~(jC6qaszGC;U7>U@tR+h@ih7`G`7VR z3`6e}ty20GRQk7HK38WVxSQyC>;mWFkSdtAFj^KM0dPvCiY-$xrU9ia+#8ea(`7A1 zgp}ct3zHjzuM-fAxc8~e^tJ9_J^uAUj6ZOYT>h5y{Z76-FESj<+jlk%@0ZtU)ZP+| z5Qvcu@_wc4W&G-qx~tvfo(m3ITc@IR!g{@E@NhT%l+-#fb}HZWbn;ULW=)=Gr46wgC?1^Pv9$RI7zJ zdSV!=AsLi2pBoz;+X#qddy8jm?{5^?Ts%6jF_T_FVkCp781P0}$?0h8Sk$BmJV z2YmVHNV}iJjw3RP2O1=h4Q#9e>xyFVXe%Ma5wl6!HmCeCvkc}ORM}MujaK zreXfp2*_Xrx8!woR!ZKzf&U((6rUOJHtAt9uDt$mE@O`VIOYnR;cN|O5gbImy~IiC4rv-c@rz$V}>=<{%Fh5I{bQ$fZ8w<*`hU6P^q{ZYb-gLxrl zUOxk|KCF&H0q30pX(kd-JTHUJ?J};N3zb1mWk$tUh8v@(zWQ@FQwG&y0-l_I16efi z0SXf9$OI?CGNAzG6EU_%04&8L1OhOvZZkeb-gg>T>$Q_(-M`mt5Mi@2j(J z2bHp|@&m$IUv!SafrDHwZkkU46#aurk9r2?V0G#>EOE(*&*Kn9V{4#{d&C803=O2c zPsd54?y`8#0Baat_&sUo!n66cL+F7iggS`&@)(l1j5+2b$H>H}(8no3?<|g4uz3s@ zr3Hj_f-S{<`ku( zNk&Lzp9n-+WW9d-YY4qvv%;4O>^broH_8ww%f^z#$z)@>EOYRRG}e1!<;iS#OQ~XI zc&Pp=No}-w3K(q8#-jU&u4m67qKo#EfUW9LdWjU0ntG`U!?kn|y_6b`?m%M8w5rwJJnNeZ9J$+XWR$o4*E2rjRqT$@~fVVKkTgqa) z=9+?sXektu@OV@-Xo5U`Pp~nW0{nfpALQ)fSCHR7zRNkYv$g8`rU@cu$Hr~NVj@lV zrR@gL!VW`kW~RX2>OC#y{galm-JBdpln)cx1~pfay$W**R+n9R5ur7J)B99KcUBmA zGxXW59IWtylcXpZX5CB@%qU7(Ve005=MnanDxArFgkPOhcs;Xr6Yn)6fsTs z^&?6XQWemcD6ME1+OOBKnG%j?q=Zpfm(PU?+EZbun7V`P+9ebD7H>&+{Mox6sCKNi zR?lNUKz=dJIh{rq6&ay7Gt$3TmYL(QjY0~iIcj4-s>p|f-GVgzsnYm-s`cM zQH^J0R8d*?#)?U*{S;Rnlz&!q{gYh*hd%3%8&Qf2t=Ygzbs>4wI9Ik1)UBv4zrMbd zO;E4~a0jhU`XQh6w$j_Q_}G)CSq5jQ2=x4D0bjIukWH|LcY5*^lCq9mf4I~`VXaco z)w6D$({sD=yxgu!{9o8A1znUXsxn$uKFIf;VoqhqHo*aSMM5UF#tT`V%)sOrK6J_wq`>^vi`<()@ zOZu|DK^!**(c`3-J>x!6Mb(M&AdZ(UyIX@BFA@2G(_B3WUrGk~_jS8_`YL|_Aim&E zM@(u;X(cK&!m8$#R-!YPnV+OVnv*mrpsFbf2~C2SRCQT~by5{oV#h(pX1+9@kuODM zomPbj+Haq>-nUYLf8Nxfo+?5LYARkq`YPOf_CocBu>W3sUS3c6<}Ek~;5G+kb-Gt4 zkT0voankHMJ|;hj!8*6>W)IB#8}RM{Fpa3*lxj{?XoTv`Yme&^KgnD9&e(>))&EI& zhRD^gPxM!?Wr^!RR2>s&63uTD+-WI9o9I0D^M;8Y(RRBqlf3baBrhuKvc2 z`IOUP00cy>2<@QtL;o~~~N~nONl)AL%FhQo`c(6%~Fp@P8VZ186nP7Hc>v z;JDg6oB>%Vq>yDAq1m$T)+}tr>;`)=+zXnXoQ>x(=(@yb^lRI)<$A{qWb=s@gRM!X zXd$?JwV$l=ucMgxzAyv~fHmZH&q~Ee0(vU9VcMl!J%H|MjpOt1%-zngw{|8bH*qQ~3wwEMOSr9XRZOV(PB9%eg zYqv-P~{*i(fvyG%AGo*n@T)^c0riImjM}MvBV$l&~pXaRyCR zjiw7rCJBQ1^{C%I%vfIqjS~c6H$3=$#dm?l!(jYRUJ^5HY$+`PCUHeFgY(#G&WV{MPi7>^QCXKc zqk`k=;xO^!)eysZD+iYMGHG=>jv(!g@7ArbpDlyTov2kkkW^s-W$)_56}?AgJ)T(z zM(+71p|cu{(-|E~jojfz4ohq3n5ugYH_*)Zu3ayb;WJ44i_S#Htq@&I+X0ITx$Q8S zm&bRB+w4&MPGL{zmhYpmG=$H!CXsh@y$Oj!BUxjD!Y@ zvfZ-GoP07PCy&ZHEerovp17`8YzH35uOf+fjI{KfWjwH|H}aMyd_d(d_9fP8a8HeH zdbGNYjy|RIN!lmKWkBvxZi>6Jue{HIBU{K$Ui>q4+ie!m_fSnXj7-7QMAxg~8hYT_ zB1am&el}y8o;^?I_40LzYh&Veatmh;lzu%tKHQRXm3|OTsaaJ?_%_D3x^uPW@DaZ3 zL@hh~xN0}z|Kt}y)E7X^FW|hSWOE+mQS_viwYNy@`4dILNn(J3#bH{IB5E3v8zh`| zi!?z1$qWzxD(kdJD+s_En?yywNMDb8mH*@}rRbO|oI-6$x*IqgQ+){&)66u7`=zM& z03CghzNGni(IO6x#fQVjdqbyjfZuvO{1!8+DV61@&=!1yS?dCAU0D(Hde=jj#QsK^NIoR{@? ziR&%@h8yg@6g#|l_jA4wu%C+`$hG)ZI&+EWR3Ecqy%ZhyDlOOr2kq03@@(^gOJL)`ghC?^!Yls2oH4oOJnRhPTO zPm0U&YsrfApCO(4{>b1GoF0fnmnK)_Jp=;m{Du<5+#O^QDGc%+yV04LiDU+50+n@M zPHgRnZ3i3LNm!<8>5ae{srJ$fRT?H5aSM$WOl=a4D&WamU_&z~NHl$%LMjbkpGs*h zp_r`i3Jer(Dm3T8X{fwNbpdKueB*(VO&c^0eIcvSOb1gW^S~4?@so^(LN~(Sm}vdn z5y^o^%6)yqb~-a9nx;=p6{E|PWJL(+CsNT6pxO;36ngnJtf-Tu_TwtDL;MpHT#?KG zSD>=)`xHuRZDylzL&C)2d;xaEE&1is5Z4+qM9mOLgKe&B1<1|}-e8)3GW-FR7@_9# zYSYn~{kY6o!V(fhRY~G93<+)0kR&u`RZ}&76gjqD6J(Ig02!dN?#l%xDee?c{2oMq z+$e(s$KF&S0jTFXMm36((FOPQ)diz&J1TJZTP>==kvhtBEJBOu+!PD|Dl|gv=3xL_ z;xkY;s+IhS8z{CCe#VWUP9hT3aL117oa7m!B#nYH%W9hN3!mK#%*=i=BeRdnx;Idi zcf7xu+ARQu2K;~y(*mt56pvZV9!1A~M_GqWh<~<6ruEDP_&$$6La7ai}4w0okP*9@<7(X#q{KD-8 ze&~m(?-B2kACcl@;YW_rZ6{OwRmO#V@Ev{H-C9Z=j zudcTqE{!slx>qe29N7T$!E75IDl|gL=B0pL;-^F<>m~mYoW94HivDWO{~$e?(>xe- zd77FwWzZxfVvKPQCW#5ntAf<5%!4pvW#tH5re=aSosr;0W!;wGD)Y9Wgi+ad%E|5% zWV%F9vmDTV)0RmAf%27E9T9iA1=0|~pU~2q6=chf`zMBF{i^V&A{WuYHQ|Aq)~{b* zDnOLPOTl&FjxP4XUou)m$=sWq3?5WZp^LQi4lhg4y z3XRwV=8>Vh#BH0vKPdUfMv-nk&PXU9lC+d|=Z5|e2AokMafKK>wiHoRCADgw6_L2{ zYf{#UPf|bdo4R6E=rVXShn~*Jp`)^{peZVN%EcWWExJ&%B zOoB`f5kY6omTf1_zJo&%?sWQE4=p|PdY^bSV(V4sMN=1fO~QzAC$WruLW_{`3rk%V zQJN$!0+iHDprD#w2=b|l3Cz*dt zzMuDW$L{HacNfZwzmaK&buco5q9?I#q5-syYy}4%M)`?8rS-g+p2|+=rLtY(r&YNC zhFVeY5uMpCO&}p@+AUxA#RAD|qYD8*Tp%wez+Ntk{Q-ze1h=zd(6ZZrnb%Hd_R?FKFau&4EE!NvK{(s85r z;+Ks|+4aK-+pHyzBZx}eiMJLFl)2<96NSuQkGsVD4PlBFnDG=b(jEVC4S_Bd^}D}? zU#iyvzA*l#>g~h|J&tOqv}3#D%iHhjGM~9+;v5!hwP;011Y&_({>TDqzyK)luwkM| z9B69V3W~r{uq66@TX&M_>HBnE`raizBUZlZVM^yQ(SL$(NnA%I>H^tMu;plIQAd7R zk)X`^e!^ntv{^SKE&U)XqP#4aBM4}w?9&-3dsNoBpP)1cSBzhLhFt~UQEZe41CbJF zv;rdc_UorR6BWKL3gbXly1Hyr|y&VvBB z#Q!yhhqmkv^CWMwoCJPS@@robk}{(ONlL$o6dzKKOh9$8NUB@G!>!D2y)d-MHu-lIbct~de9#C0#oD@yy|8n8998C7ZPW!e) z%S|}1Bxx+TsC@K;PR?fZL(n7e-)U_0?|&Dh{-0z_1kv!*S@`kycI)>%AcIR>>o<3! zJGv2S4Jo?rJj|jX2z*3IvG;)@EuiWqz|~D+3KzAkjtNw0X<87wlA3UYbOsy&m34Yo znBcIx|MKg_l}%Hz5x~3pMO``g5C*f2x#{w&#ERXY@$GqgBe{&#iJ%T;ad+V|5G-FY z)*l#rI|2~cqccM8;0GJGBn}*+TArZP5r8qHF|R&HBs=H5Ap8{5Nfyq%0C0BvjM{JX z)PP;kEft4%TN$+mFtaB6Y}P;`2mDw&{%g9e`y;5&co@rqxolIg38>HrbDT#(;1YK? z#n22P_jG0co6wRkJYucb>vGF1tE>)56~#bp6*7`HLCud87F9W;O;y>Cl*|M~WHSH} zsI1FcQ9}R6l7J-rq4W4XuNG;-p*9q}8-8pG>prLiQdhFa){a;#y685GMTOiJo6RFD zaEYJlAOhJ$Uo5?oomWT$WsD-30NdxOv_I(L_!XctkKDjVpJcDY~nJB}(0+U$2?UU&ks zTN80VR0?#!*sXV{+kFX+apHS7?G3-y^5=%WtsPgX72kh87)|=l`e5yFAJlx@2lr4Y zyj8(p{!bCLc_b!$3vQ8uU`RL;CI8iZTk{=4^l_9JF=TI;0=z+mM(hpqfHyAjllBJw zb%|PBp=bRL(P!dM2Hc>_($K2%^C~5b772;dm|rA=swNHf3zlRNtxG$5P-X&dvKfFI zRMwtV#KoMc6jb!fzT{_{_u-2o@zQ1H(1Jt3Zoou(e2ltr8kqo0rB83EfQpPz=y@O# zm-tBvty+P%8$#=P3!t6VjUd9BfF47aM3s@}1S;`J47GSU)Zzi#9gy8YA)Z~CO)yC| z15AR-I*&Ljm;_g4Ol+W(7yMVCx}etbJAk{@0VX#fa)WO6c2zae9N7#s2P*4S zRm-G^mZAudyLDSDfG_w93x1(`q^esg^0=}*LT8PHgCR6{hbBEmNLxO_MM(#46pb9P|KS4>xe|=vXtqk(UDVr0>+K8Hqq5 zt-v5f>6643wk!GBsz)9ve9&9&ADsURyjFS`{&nx<<@rS`u}vmNsE+V)%ikf*Wzm0xIjU4Ob%vD~=YGK8BA4Wrjw{=HGhTxrO#qLo`RB>5dH}5~&@(RP$2@0CC$+ zRG$2J=#xG7d=d%Oxyr7f;i>&$jr z6NrWnjfb$KY6^A%6&hh_^RNppacybff%MtkdR=wr*FS&x^7-qx|9f76^Z|7Zm z9z|(bBt_znaKzr;Z6u$Yy{O zP+5m%VPfyL>(%aZ4domn0X&YM8Xe9!h+tq3MwYe);B$>O7w}Pu_)*DS6PJE0r7NnQ z)S;x#DC2ArEb|9}TFe5b&@`YzBP?JZy1^xW`dMQ_)^$w*cFbU}t>aDvZu~&coY55vJPXw#7tv2rGf(;@SA9>T;I{v4odUZ4SweI#?cc@8y0kL zq(Duo=SN0%?1YlGCWzUF!jXYO$NRXhzVn;h{qgfnz`rX7iCOLNiF=!XwmyCa%;=_I z7*L@RMmG<`;1d5Is~kD)f`qM)4z&>oW01JY3+RPX5@?#B>EEr^nVX=8d(_JvY5T3)CedNwh@#pp>lMB+?oB`zA{h>~&I|h!wGr&cW-XJU2e+qJ-o;A# zW9uH=t$IYZJBc3<1B&EIsa^sSqvB6}@wqGp5$b6FRaiYs)Gfq^WV+-xZ zX(AT#8Hfc`)(LV&B}W4Y(GmU+fbiJ?gy>pZ?Rz@pAfE?0aEU)p%}3yq!@o7)!;qT$ zFo;28&%?5)X8d3!X%hi0aln1yBuok87sfDPRbAKiV*lI(8{{*<2B@s#v_-`ZGX+pI zx!>qx7cBjYEJpg+uD&B?jt%{7s2&ttUHr@ZE~Xk{`!tWtIh{a&ARP- zM(gK%yQ(*9ex3-!rHgJY^CJC|_nw4~^e7nQsvf#U8_)dcarNR4vwwRuoNz8gqC~LG z-X3`}Ro>k%7Js5Uw&;ss4tb#uchob!qqfzp{?;Ivt2`mqUPF}VNQg=A5h4506xtC~ zXvBUr4>95rpOn4qdnT%SJ|dMGP;ZKCL8-)vUI)rZQYBGJBSwM}GV?6YNRd>O1PQCl zI17`YvV%x+6GW2F0Fj`wZm$FF>fr=Mp`xF_<_CTR)uw}g7YoR)a#Jy|#r(k62Bc^U zp>+&Eoy~gi$CWpiuRmSexy;dr!*ltl$Ovng2R(6#pWGjy*>jZ!Q{Y=BsRc!3sn28+ z8aUM=u$2O`1!#FjpywHh%OE6qlT`%R7IcQuZV@I{C7*#+L1i7sHYWDul8o2{%I0xs z6LL2{=uXoat}D#u>FES&Upu_=?t96vPZe|-fO0eME92kg%6oBn{q-djLql%?**(yE z@fM5={`HPuk#`a)^HOH-w~XJ>SWgix@8bHo4lmS?aQnI%K|Jx(PQs5qt?YWRSjj*_R7#o-P#G-2rsnLr?#0sB!B%;6?Rbx#cMg?XTkvwJrftGK&Nuk}$Okhnu z16YH~x}8KjbBMhF8=rPTD*@wdj%vS9`k~Gm?0|cO1Ivg!Ddl}n_Oh0>Z%}gr-eU(p z^rhXH1z-Asm}UhzyefgVVXr4;})24FQ05WuMc%si4TFE=b^K$y z-k}=u3^Ii;c)PvVYp5p_?o^*t5Dg324x*r2CMsN5D^rfc5JrP)%%V=G_drEP*wZ`! zj7$9A<0QeBC&;V3OoNK#NdhjFpO7-;<{PGIoFpu6;>SAt*qThBOg;lBgUUh|G{lTB z5yO{q^iV^G5GEz-{|}f3Z=vbgK@X9kBbO#(d;ym95@{Hy+u>>!!~;ic2)Xw)zR==C zoL>i3z$L3FT&a}92Q7Y~30un#KhZ%noWb1?53lJr~^4WRVXy?yo&7 zxI7zmaRfYx3MR_qvZtlg6F@p)L$|7LoW&J&2Qjek#<;oa;-8*N$f1lA&L`%HC&@0$qAPis>FD_OFgBnWxcZtmh&yK3{_f{JxVmz&O$ z(MPZ;AF&bip>Z2QMcg)0%tOYw#7{%U^eL)a3jIWdO)$z|fE&X@U7i+mKo=$ULt5l< zO6nv?BJyl+)K4^gR?||i4{N_dX zQnB@{WkUry!IPk(ypDJ;uCCv|Jd>$3Nwl+E?pON!S}XoK=q0Q@0NIv9k%UMRpVe?y zBZfN#^nwbFFx?rTmn+N6d6wi!R%9eel7Pg}2d^wMevTC}V=>fX$M%xy!bF!8Gtecd zEbc&}B4)r_14|GK!G`$C?pk&)l;xmVmsg6>%oNoxpRm{hI=W?hpAJMQW&jbcEHgJv z5=3cPlNuVn#dTPULS@2Tizs4E-NcDw4>gnf#f;=WDr?b^=V&y74x+W>pvy>)s~y^n zoGHLypDKj@=ZMarSOVM5GCg5m%t+W@S!S+iQ?sz(TZvB_?wD3J$+OBQeiIf&okoq% za=X@;3GiY@0vwff)wrXAW7P(eS85{wQASG|bqtFA=33rGKWh5_o=*-_o6{K^P>~Tz zGb3SqWtlk->#WRcM(PN*nwa_|kNlEEISYNRFd?n%?5Bm9i7jSiVo_PA(xAE6QRfjR ztyD%e0MlH%Ln)8EoBZ-goljo3gFE~U-Xj5>$-2)>&v+IyGM-nKnX5dE_%)Z3uw>Aa zG^C_V^O(?}VmW2G&rc}3%9vTjVn$XGm368NTIa7pn)U{GsJyYysA$tuz^clw{OzNT zD2INKVmdRWkRBBpp))hGgjbfC!y=B#w9ZLTM*&ny6ol3+BU#SUGED2BNFDJKGXYo3 zNWh`8PMtxC^ha$oID!8YjghSlS*-?yzE7ik-zj-DRA_{*%*d-x60<6>7t|DH!m5~&utH^>x?-6W(GN_b2hshy1)sNvvT}t0rT7Hc zZzvuU5W2nUVab;K3y1b6-@6yT1PDn7I;F*dnV2=YvWP};R)uv{L6ZQ8r}{C;{VE}8 z2*j@erD^CmPRxu-F(adb%DO|TmRXVS8!az}$mjv25o+IcW*#&BDdo7R&5iZyybRgk&<;6|`^+pTnXixR6s#gy{6}w^MvPSqQL*uQ#1w z49R>yi!6*G_zM?Joi$AzlbQzHi79}kI?DKVRRcv&TqQwZ-KkPPFtu}fXd9PxYbP2M zw`(URW<>3tHfR-yRDE&kG<-rrjO0-zFcz;bzIasKAw8>Yn*BEh)O z2rZsf{^%4(+nM;jALdz+1`(pC*ob_~3}T<}qA`?1#CcQ`O6!p1xgScUMZ zRKkTuDBP^LGd^>{in5HWoUkH_WlvKYL={P!tjek=XJu^d^O5?AsTkAa&bX{wG0@r} zyFNH392DY~(FJ7o;RQN%Ai*F0`;A%U_TQh{RVzP(Db0k)GcGhjX=X*9@tK=|79lMY zQY3!CuZKxS^0aA4>C>7;X;3<-R#HDTm1cV68JD$UOK>s!0f$L_ko3oZSN^qK)$4nC zc%ki(7xY}N8W~pq9J1bU zbRgz~y>^h-O;a@y3FEvXu^$zLrddU5R^=?B;3hiECo|1wdJrC$b(qhj5*S?UtKjXC z;QKxbFR;d1D?eXfd%^?i0mSgrroUM;w{^yif9EAQ=U;4z?zoe#Q{$(-uZdAHC`U840B(U2$rkkgc` z0hN{Sp&=ps{(sW~5rOSJFpI=i^5gp0cKyL3F~S^YRN`D&W)8}{jEa~64L^6zDa1I7 zC?fneS0-V^s81cYw!*Z9=_wgp)?o{lDQ#weiCro^|FQY+YFT%;Y_R~civy)^7zJ7r z^D~NG2I#De5B5A4Py8c5&I#$H%%s`nT z_J|U)np}dWX&Gc@IwveY`&AJrdY{AvQq~ey3+NeHd7TqF|)bq(E^g>1F1MM<;CETE~Su$RNkZ%QH%6&hiH z^AdqB@zZ!v<>G*C@#PY>c2WTsz78~?Wy6Y^BuVX)IIbc><0259)5@q0fN$Jxc4qc4 zn2|k1WgTXRiCz5l7n{jpVnhFnzp@AK7f^ChwYytyl|Aq;VcXXsZ&@wfwPOqalVu*u zp)t8cMTpMP+2`cSlo2eVR!cSym%M=A*#o(Qg*{P+v303fQPxpe62F3sXapf+R)z$i zgN#w=GiHUGrh%Ce4Q6CSQCWu$qxCPZFWzuJZeIeg;zseZjB4`Zqpsbt@WVzVbB9 znewyvk;P9aF(;7B2-Q&rCArPkiVv4xnMh~6J$Kr=R_8`!6{DC)anq;<953F;`bKZN zUN9_|i>{CLIGLWy4d&%?UE(L1CO>_ZDQdoD6>r|2Xpty8XIQY1abpaFEFy85rBD`} zlC%iQxQGOazTG0tL~t-85sb<@EE4Ss3#ZCR3q*6!&^f7V`+L-I(A>AGTvt#yLtD$8 zB$e6hw>N`=_r4!=O%fFIe2ax+XuUG~Fo9<%$Edw^`49eEEO>xEs?`{#=b3|9gqTk8 zfAKkmtxFh&5vy2E0-&pnqaY_aO=1#cF)-amO&L3UEi(%q%*cYHvJR_2tEa>{HPS4w zL0;2Nax?b@?J9So@|0VC)GQz<`=BUbmi$g3a9oP$vh!Z(XxlmaA^-8xBi<#z4VQd2 z?|xv3{-SNE=WO!eEyS52VghiTIjX-uS>D0o)lE;Z2eZg5o#H2OK0hLO9+H$qb}EH$ z<3wY@mW4%CST|Wrq99EOzn4%#OXd^c_6z-@jtk!ozYWane=sBakIFiX#aVTB$r^CL zoRA{?;h_qoXJQz*|MkG)1nAobC~gKL`F}RJfk1|&lJrLcXk1ia!LI~8 zT!ghk5JG+6mG@4zJ`rA=5WVA*tbwlLky^-7mSJ`|o}3putxl%W#6?C}-#l=DOI%wY z1WOf{#_r*<6(;A~{R-?*P`Q}F6tZ3s?l7G90;E=7K4I#MC(D|N7VF1k?q>gLbw2M5_TPpJq8J>aZa+NvkBKb)3ic{83;64T2d!160;wshHSc zpz0!KH&c8V*`8d}42le+y1vNsM)-aI;J+X(|2o?x)5%M2V2D}2f$%J5AlQ>w3}iY? zAeaXeaEYJf%&8`scgq7ut_KZBAk&E_6t*&X!?G}oVp7F7wQA!msUiIy|$_J4Jy;12;xZfQ1Jk~H8*~?93_hr`|4d_0g z8RCxK_0^k~!VWG!T)gK$a^M{w*Qs2FiVeRWLS8v~c7N3E(nb(M^oSeZ&B}Q1v zEG|u_xI3q#m-^gn+i^aG-igMV{m%SdBLdE1Ym(n6VkjuUAo8KnY)z7^;HN~ImV{Q^ zS|FvPo62d%n@To0R}R80@wF`cUR7I?eSZuWIx($+f~(W=)z3= z@Gq{Cc~pT25Db*8C-gcTM0i%}4uu{S6KY9up%Er94>;fw{}cHcZvUNl^I*#l0te^k3N3pb!(BmU+z1Jy`&2fGXv~D+ug2f)zDB^?Lr>^`uZpF4w(62t79?0 z=^6TPUWVQ!KC#IQa1ASCoM(S%%D$|MG>U6}?}&jhg%$j&9r=XiaU8QC?4Y<|3-EZYZ`ImRU%*^1#Rs~lt$Dl6`n%)~?;k`Y zT<+Gb7^$s=|E#YlWXl$U$46y75eqpT4}gk{u#kCp0GIfbtNCHxQ5{soCCp;S4YUD(kQgw5ob&*Q-KNSHE1?Oany#bZgL5 z@AA`s$+L!!!}Wi=UW&W&>fI z0mM*FZmWrlj4+gW*?E`vhzc;HSLV4Of@Y#OjPdL4yk7p+N4WT|L-@~s+0nB5GaU02 zsewUPMaO0d1hV+0B#TH<#X!FUU1I7A;#hV|F_ZM+j3hlO>#!75tnYknE3`z#-yAkR z8UnD;LV};|i+j;0lmABiqu1!iNaQD-^Mr|U`L=4;`%dOKxaHI^jIuhyRM4Q$`1Fyx8yr0o)74cJn! zAdE{I#iVZ1oWu#gqL&qStpu_RfMrpc*sZ}#&WAIS^Qf%D8ZfaTi-DU0CJPl|&@o&z zE%!F-d$t7>*Z?wl(k9H2g~W6kdjMRgr{~kddHHmg_{2U9eY$Q~TmnF?r|!)kt7hEB5{-yB+tWw2;>$3x6;hoCNB-m40|{u!;Z>2G=4_2NL*NZM_8ZKC-pGB z<0Qc+YzG(R{+C86exJ-Jp=7x0bkbaR9Wq-a-0sWA&4YmCysd5ly{Y;^NCcR`i;266 zG5+JmL#o??tYcG+D<6HP^8m`pw^_!9o-BtqBDL+pBeZgv>fuc{`;sqIzY3V8pPsx& zMMjwVyyU%0{4@~%4}O&OH=v<2{fXv`Ek>TvB8;n;gh>^WI4BxI!^VeJ%UKmSEKWkl z0cNJ*!x?FKRMuh6)9U?Ev3KijuZ*OT9bgaYQ2OZByLP>8&$wsScTQhJC$l zg^Sc9@LCUS>zDCF>%`V7E`o{%+&ZJ0-?-wi;)Yr02`Qn}x+sdI@EsW-6D$zU01Ke9 z4(r6k4tcR0(Q|B&Z)=5V)_MQKwn9DgjGC+u*7X;G!IY}o^}1ua$V@fZq~3PD1|pm7 zj;m`0=Q~uTX<`85_pi9+X{L_>9jD7i#h8zWLN99Ql38-AsL%*&n+Gp&iBI%vl|}Vb zivorQM;~mf9d>&=&FZiRw5<)PLHY5*yFugPh8|H^i

6v$b)bO@&J`} zSRF35y=yD>dT$MmW70n(m;rCS(e@@$pgS22G%{ERpn@aQzQ?Eaek>P%>^6K;{quit zpIF%5f9M)l`92gWUoBMiq%)EuJ1*b?X2%YD%u3@+Qq^s zV3k)@(I4g*{^HEz=RPa~RaNWwN4q4=PbEz$#305*&|#lDxlNruLw&< z;nrdLFny{;QiC0RN9bLy$i;+vq94xkWR&0a@1gIb@s)nW7?07f%I3bHLhel|nun%w ziI3lubf%Kl5P;jN9Obg1$PR?Qb5aG2CP_)+l=2-Y&KvIUQ%15nV{sX0N$JQ%MkZ1Q zeX}t;&@`kBD)x58J-#!rDTrJtu8BT(f4Dsz6ow&t6-t01lI_xfh1;!p#e^Huic;p) z8n`FmgrM7Fj5uJt<3D61mi&$rt z+#&lC+LgAf$|m9dP{p9Ou4Xx*e$ugwu zIK`iM9^zKRw>2ZVc1!Q{twOW-4BR77|8RXKf*CNv0307a@^Xlw3~*Zrfvi06A@1k` zyeu^WvWX(Af?VqkHqF6{^He1p)DZGF8yq?Qh4dokno9a&`Z${|_Yz$Qua{XHhtWc< z$C+q6B;U}OJ~d*{YMN6ywF#E55D6ke%9^ zRox}OL~d0rm&m9X%kl{hts7VkV+TjJ!YTbHP@xf9;XLS=OMJXHrZ+>v)%vboF#a{` zUGTxANk;ZSYz4ABty8}#NLm#siD}LEz$B@OA6H=+6;+X^_JC|;;>4mEI5AY#u?M1J zdJjB`q#Sp5#Kwle5wIcey#Cve*9*AF%L;mA^FT(lcwoXq5*_Xa$LCD@5?;f{AvX|q zWCO?yPQ?Ds2y~j-V2|ywUkrb$J$9WGj5UIwQ}60swcZR#*LGF&HK<`z(wmG-_jv5p z%`1=JgZKPf*sV8h1^bAJBt@bn3uy9OF;v0s<%P5n^ z274>>E{pYzIEdij>?0HH>W+20_D1>n12>w^!+<4hAs8_j!1_irIjv+RGqBdmU%%kP z0+S~{Cx`r{I5t%hQ}?puNBH(wAItZa_jqc*htDLt5cGWtAh0O@aOOP$OTgoQ_yYL6 zoj^^9&%N@#K7FH#ZUhZ5y}8+n8gG7GYU#~t%~!1wrn6Oz5@22LfHspqn6YE(I`6*4 zsQ04VSGRDF5^)?6QIlburEnHlCtNvmCquT9DV#p2(1^`s9#YUHKKAZ(cu#r|Sk_HQO@C^pBF3O7w-tt{H$*8Tf<5X^z&~|N;osv=H#Y4wu$qdf z3)K(v;Y;tr!=tvH_d%mdxQ9~Ribv|v@WVSxW-blx(h=3&NQ{(-P15mCWCdLuO=Fp1rURe;bi3>Zv_AE;P;)_eSUkb4TmAcUtN!C6BF2a?l} z=P{9yeMF$yZzaxut=^8G^`hkF!t?#7MFZ$k-T_w>{;JgB-E`&bW`858t6`7$%e4t8-8*#@v~UhSI2*? zV}{+~NV`5mtDJUqf6>SlSl+i_lKiXyELtl#(Jr10A|`|FLO>0@b_a1uK)g`UU4Bt$ z8&L_SNej)z_x@|WV*Sh=1-@HJjo^LQd3>ptE!1+W+lFf42Cx5L9^W5Cc^)`9;IM&H zASvP+ui-O@8x6QRD~Q3sP9%`*+_(XNdeE+Z-6*1Wcopm>aylIqDl%e|nSnXIvdo+& zVV;C3dzGBy&v!XM{o4PPTGvAeWV6a$~I=e*u@3qX1MH zxI`=+lX}x*CFHdlpbZ^#|CMIk=NBGZHgFh1^6XK!18I{3aBK|_7;a=swp?!?Am_WK z$~^WfxWhyIQ5y}nh9$p0v>V6>3quxY4l3Cd76T@YpZw5pVY}XJz}5by%gPt)uBTuW z1gC7rpka!9Wb@sGN7Tv0E_e0;y3YUHu50M?u%a98^zTH@p|#_^s4Lj)Tfsmi zIqeTSLtutH1<;BLjWFeT9k0-t%PPonZmuMuKEK&lG$Y)IBa#FxDC#=m23^=q*@T5g z7y#{LQ^p2znX;|*(->36U%+L`C_L3_$~IW)d$uOS3HeAbMTxC60>rANj`JUXlf8zF z)ApXb+|0W%#;+bUexwgaB8oqSB?}cAq4+cKnOByXS($}l9!4aiK|S>;81*2^5PotR8fiH{1P>RcUnb<3^-`F z_AKpZ8Fw<@KN1Gu5kI_ul%(yJLWV!VcL652UxTHH(q6~7XWs5%qmWDd7A!OPAg^=m z;CLRNou7j3%}V6xTe$4P=)$`tQcA?70P-sULEJ7L_<6`j{$k_;)T!J*j)+tlMUbj+ z^6|n6+`v73kQk^QPR@PWTE_D3`E`$V{VB-3^(Ey8rI<~gltNN_1A1(u?vepcxtBrC zP4v6BZ6BzRd;5rIAStgbGt;~Z)2b**6jJU2CneO#bC0;lX%HnWin82(ZpJ2_F}8QT zdd*++8pWf$w#a`Tk|{%64%tC$gjIS6v1}lixO)S6Ea{yadj&SEV%6RbqxYbe$F$mg zM%%uQKUrq8YUgy2T|5J1cV(Gb(V66gu`DDpF!RzlO9{}KGhMaqdkBEmVhx?L#Rj@%5YPp8K!Ve6WDa)d zcAxTqORy0iGrm#l|V-s)`W2lF* z>WRspqMkOe$_VvDyIwif^ReWCdX8QhfGCKK5<0TqF(UsD`WH$ch-)$TDHiLJE)G>z z15{pl0;t5V_$s2duB!dEJJuAjW`Y-pZMW;K2<$70EZv>Dg+Rp9Cp^TA^RET~1rkaw zf({b!1oa+!Q4S&xNCH?rJGyPxZY%yl9lQ37;k@uH-7S#XGb2Zccs7u zZ1#(V_5d}i^X-1S-YATwT-I~7x~6}&TkE#0!;Nfs9<}oDO#P!6@yA8)cAobyrvfge zBIl?f#AyuGtk*jL$71mfRCTOd&2;=#JOh7qWtllB1gCaFlG=}K=52yW{&c_iddKsmiscib-)N$*&N8N`Rz7MQ<6nNRQZ0AX0aU> z9-DBC7)`LBqN~^-r|2p+#wcCIgx$J|Vna|}#Uy%Ny_CHuyvGr;gP79gSFdkVj;QMt z>;oz^LSbiMAFeDj2ds!=8YiTvqKw25%Sc(L0ZGHCjM9V_fdl0no8W^OX9v1zE2z=w zoWb0QumeDZ1#BK8 zX2j*vbPwPIn4a1e2GP^$+2MFzb{L&Gsx#lu%bKKR6_B{}Ba%~^6IO*ZDw8D39o4b1 znH`RCUYF5&Ix#Pd%8k|2$$8-?k_UQ<4ckLLsrN=4=3j@y9IBw%jm{pmA|m4TEK-O% z+TI^g$LTrScwWvHojIs#nx#3gIRaQAPHK{eQB0DwNomTmFi-6Vd}8Ko6D+qgULDaP z9O{V5jZ{Ze-l>kLq^$@X6(n6_cw|k}jyK#`n~iPTw!P8DwryiKwrz8gjcwbuIl(v2 z`~8_eXRcG-Rd-capRT(5ZN`J2wwcOC%af1|_e|JXUFbuos5W%Uy%+b&Kf!)i| z@#Cr39UFhy_`DDFqc%`IJlc6c%;QV|BRo|RQpaN}rCZERy+=n>^L-|1?LrWL>PPKoIc;fsBuDMFOb#UE{3t1-6r<1lEOBiS=4c%0Cu7hpFCe) zmHJYT#021(zy;-a*ukL{B0);*{PL;^_SUJkCW8qO2)4h}q%7$7ZDX z4kH(_f#chQO-&SO%$eM&!g@d)tWr%sH&=d+fIOP^B}hAhE# zPpYd+P$5_)6kBG9OKS|)ci9m!v--p7!+BN26_RSZZX|dg^>C3ht4FA5d5Ftuv5blJC%^O_*EZ zj9Pw$nGSvELzER3i|~2bs59x9&A^>g4r^LQ!5n^gEs=g+y!Gm} zu(>WzFQvHqy@C!=`TI(BYJm@S#e*Rb>@zY{l*{qQY&!C?9#4%pn4_PH<(eQ$nU$qZKNe5}fzI>ubM4Df z$9k&V$|C=!daHjs@cyi{`=jd(2<*Nhj2qmorK{C|B1g!eqU5%2GgleF93AJOuvAOl z@E=d$tMjHPPuEqv{jrUX1VcD###FYj%ztBHZ+CjO^8*G?zFpt{*j#keU`-8d4@Ss_ zz}+r2V%W%cbw3PrpAT&CplxN`_8gOp+I!Zpx{5r%xioR!3$hu+!jp?*5 z!&5sMDeH5^-Lx*6$ua9N3*E|wkhwE1hcZ~xDk2_`-N%P}F@ zXvLe{d`-YT+%Kook@%gcU}v0~A({{|l=ZA21|g6+kN8{yK{^^OPRsqK`J-OK23$oZ zovQPxEIi+y07hnZICr z&ot*iqLPyfCFVQ*P^1vCN*Aq=?X;bW;s)fd!0P0|z~XFasbHH0>M2pwLR@rO<^Al` zXxG*3=V*(wQe8zBmwQnW;u8^VBu^eDlI-Q@UUGruzox2$4TYRVdYgBgtHc*5nknjK zkXXZPRIn!S`9O0K3srM6g!_VtLMXIQH){^zAE%9hY#_}o#Yp=W7T7`>HI^2#Dqwn= zqk{9a=7gmCXI9wa>)5p&g2{sGG8BV<3U3OIf4jchTVEISU06lNq<(P?QFvx}E z!)XAQWWNI~Z4Wt1(*Y;x;#=Bc|Ae>+%N+Cw_%6Vrtu_DlpvYIe%FCMm6bmKN z;S(W)^V=jxv1FP&2M7E_n-R?&t(c!T1j$_i$(^!5mx4=Zi(|29%=lYY(U1krZUS}5 zW823uXC7>uM;fT$|7x^sDTfsUK4Q{B3(&}o+vZX~$QD0H^b)DAm>IKc{a3pFi|Jd` zypDCX^iNXW-0eADX`}uO7%Rl~v-?;d^Y2UQF2tLYw$(CbQ0K8^Iah`X8w6m2Rxa#^ zt(RxKM#!o&grK7i@3inwA@ikGdx&&AG|DOpwtQ~sD4OwtvXFt;O#-wI`M*O$Wnc$ zJfqt=G87T>dkqQQEFlsEeH?w`M}7^Qs!EK5LZc`9o)NKKqb*thu|~JVe4u^tW=kRn z0-|3YY3!`MS_-`>K&Ycv?{40apfswpF=9kw^07A~Ji#Mg~2n5RWM ze`iQ}gup*I%5&7Kj-ZW9!c--qr1_FG8-ynmnx>;n)XyM%X^Cj2N}|}`>T?rv`sULq zof48f;?lFiRWeq-k^3@HQ7hRnau*(Qcjyo1D6q^GF3p#31S~T`L0?CyicwOauJz$$ zY+v2Xy8;or!^xxM;6m2(cdWoV-pG%D_@E=^a&47Hs%qjhJ57C7-Yk9{Hyr#^vO{s% zaof>I*? z;A{^vFa3D!HW4g}qYQ;2q)DFoU0fiyKt_$=L66`?&!B)tC8tr!N8^c@Wo3=e_xPgqg^pA-Ub#_o9b&u z1Q^iWwaJnxg?9(Y7nUBIGs*AtS022 zNKsm{$)H}&oy;fZfe_Fy9tXe@RlV9h{VMySe@R)b!CV;Ug;#QWoQ8tLS-7XAJpnpLix0g?7hGGZf1Y|y*ysmxf_$$A1y=L^vNPhX8?O@aX*2&obo?L8N(PJ#aonoOohj(69H8`Kv`~3MqY(cX0`*n2|MO?UMr_kyo)G!GPT==UmiBC+ZUC{ zx6_1#$3Pwds*#AAP!CJ6w;vkOX*tppN2X}A>8@^2D2e2ejcmkCuree&?*T`QM&53G ztgMl%jiBf83JtJHHLG^0rRHeL@$oZsYM<4HNPYJLBWcf8dIBEasEH*VKP5$)ZKBLN>l8T5x31;&#IW$O)QHT&m#(?xxGT-i1xX?Ug+CQfz`;m#F z-%mEu!Y)OLYIw!rEtOBFmc9RrjRN-eC-4cx!TZDo1cG50kruvA&Xp?U@OqK+DxW6l zlNGh|i9V~HWP~8FMWDb+C2~E}{=?*qfwkckT2GwNcTG!|{s%&V4@jY>v@&S1ScAGe z`Vh*?^YcD!5p;Y*=Wc!tusY55ULfZ9)Cy7arS$I*sHSM)n1?mY#bUqP!N(@iB#Zjw z7EPy9DnuoDq=8j`NJn5gu;zQ`(cS(RP<*t?BQm|D6xD&zM!-yZy-RGD@#i7d&wj7& z-7DH>Xto~~(3cm`tu<85@d3n_g5$71n`AdV<6UYGOAsy(-E8lPJ`u&F<1vhMCSXcT zAV7>>988Sp5mQy@6i^VeWZ&~zf3h*7!di$Yn=}V*Oh6q?r@)Cx@(jXU{4s6?ue@-? z`!A-;i(zrWC1Xz<-VAJ(d`u;!*8O5Ug#Z)xP1A0Xo44KO3ypbRLEc$C`74Y62FAfJ z5xU`(H7yGd!l5o);0^1uPhwJ%ycSwuu!fwp8$U;4&}$>eWbq1f#^?K74=)d$JLM$T zbR@oP+Eh0wmo4-FbfiZj{1J|R3gq<5#kkEpgxf^ZAC)Z%({G3O4SpcEL>3{^m)mQS zgGI8Gg6h+DBv@@;oOnB&PI>%KlREXnTejMN)&`p%9|j0%oIq>{^q&Ev_|wTgkT@{a z*JVYkyKx~CS!_qVAIcw2NKIk^f%=!JLWR;-Zn4c%q)UsKX(cWUxS`ocY1`4FM+;;-GW5YUhMu=IyP_GBQux!=kbKrXs_`@W6gt=Ei{6MpN+r z6xk~c9lDe%hhaN2r)Xf|x`({tO3KA_*~;+iFPKsjEd;hLS(I(~e3Ig`F0 zHk-$Qhqmb2TkGLEvB+L2r4Qw*4q|ho{9d{`u?{j>tElALnTDpE+FhpZ`@_9;01&=2 zy~rUL{~UA>SbNP|2F`Q;@AKiQa3*R$R+$msKB|m^0%GKd^0kZAl;H zL3?-dDx4Fqx6onP&fU9%NcPv}-7dhH+|LiFWVfDi!7CxtVk8eBeYaeNfBNjU(Y`nT zr?2BSZF?Tauht5@W;(g9c#NWbikrbS6#O+Cp146D$;BLT0IdpnF8mrPypScff!+es zd<2ftGOgS)*((cC99=Y4u^V+W&Hwejr!{xnrK&B4sFtK%QP8M}7&Wpb^bB}>>IG71 z1UyDmaf(Jfg0FLz6p4czk$1SWiHgTrMJc7oQ`#bFIbdu|y0`Byl(OEEw)UIw%8L7U zR{9J*@^4DlzPJRffP0GntEIZfV%UAy zJreBayqUf;+${J1hv`E$#Q387E-NG@?bkq8wzyY9>2~iKspoQ3MTd4&8UqE#)&Yl0 zF0LF>1aFkd>89o6F@AYi7=97#7n=Z}oim(9ar zOVJ==`u%r@G8x@;hijtPAGxlD)aq6lJK&7rydYBxvVAnd=duucpyzN zQBw&sxSuDMnEDQHN8o|kcP{^ypG-V+u;SwL!|&%}QHhNB({U%%6h@2zjT230ZJBDa z5A7=t`E#4rCk=W{9no5iJ6Gve)JQW-zXkNGyAFRfl+|{ok#)hQJY^*O15vq_UGrra zr@p}YJ$*7*z9-%+Zbkb$2)Yw3iparw1L?{kGzQ?P_lv;L$D~$GlIp5t&dXvNL)KJB zLeoVUa_B>2;tn|Sl?#qL62V*K^?A0A+LZH2unlVUd@#x`rW2afP0{{Yt-s}gD*8`+ zA(x}J>!5|B^YTwZ7zeMj#xMp$#TQtFx%~k(#I>kGTMTyuZF{%lWqc|-S*L56n04;6 ziwcJ|i$;Op$c%b@b{Mh!{jY_Al3|#-g^VVRs-Q;f(!tILHXi5X*$NX!;jsi^Jt;lN z8G16h=?1z#^PLJmIgCn5qs>8N+N7~{@yrE#iLr5PBK5-&aVi({iL3ux&iGVp?oai+x&lo8mTx?t zFA}=ZOkB`EFV-L3f_6QF6^rwUBZHk}ET9#44pk~13@eV8Q+ZG-VbE1QncYO{;+HK& zJZKgqpjpgV0jTCLR3d0{b3`P>CDi2d8*(+HzuAKiD(DR6Ru>3=xb9AOcdvd#0?4=5 zmT`dWJRRz?rKRc7o|a}VX4!?Le{qQ&l~Q$O+dQ0C@@ONjsc$MuVz_N@xuZW=O(lec$MF$J~S ziJBGnVnjL{4ay+hJM9LK}hQiIq*VPa%07i#Ue&BXEF}&Ja z>HLv*xvVf?kSz%&R$Kx74mT*>rGDxn)OJ@uX2uu>Fu&wuc9XqM>Xl==N zRMr_WB2Ak$yJiy29xb3h%)ufJi{bz9^Af?t#2r-+7(+g*0Y2ODqZglC@={@gEd-VC z7L?9gO-@4$U9-G%v*QolzoCaF&9emlX1fW1+juYR__-H+;e6oU}Ab??;xZz`YmvFl3>{4A9FHaC5$lqJP0laC7rAo8O~<(f%Alm`s2EVP1vb|6swlU=FE@V$9$RXeRaS zS81<-<;&B_69bYz@|RoQ)Mvw>l+P2LQ`;igvn(=C^O{2MqW2yjd#WmNfURmTxDbT% zbY&$`px`dzgoX_Y?u`kFFB3fKqC_g+eM4Tm_rg$>CBW37q(N2IWA8I+3tzci?)Gtb z!*|f#@a|7jT5*^*Xi(C1_FNRYDeq|wm7OV-R^~iBJU0bNmuf7$ge{AX`+iS@;OXgd z+{l07WE#=&?j<#KR0w_sz4G>e`yJmZ9gqpkp$a`FFFb-jnlQ{2o*mONsxWhF+CLoA zwpMjW>RtRk<1=U1W7Pc1z3w?_-U@mB152|@j!43_vfSx z&n&aU5L>03nGAN4Ny+aJxL@eX)}nX6$`*3IsFt_-T-7s>ci)w&{*&tPv^f9R`)VR^ zXA-|WEH`oSD7b2`PEIESHlzeFQ(ZZ4aqW%uCH_;LIJ@aIv1D}iH->Qnb%LD11u8+3 zIkoMGhjF~1fI7dy5;j;Pl)Z_jDqqY+xw3PjOLIznEKJIe>IjYS6qXDawg2|lhlSX) zVZ{2+NDb?*pLy<7?qf+z=Og0zpfMZiso3xi>b$O{o*DUM}pmWJnD$i_S17X zD84nLh~aP}vfKE$9#R=(m>Ulk^#9&eJF@%GJ_(ONX4EP|p{j`txilkCXseV$7-$V; z9F73J^Y#zjH_L6<_W?H$@8KABrT&;>!GSo0%v0Gk1aqPTwP8vszCZg%ZF2?0GTI@^ z1@hqYE-5~^TjyEzn^WETwfN2`Y7y|!qsyo>`baaN*-CG6&65{=dZ`1-V9=|Bgdu<4 zZ|Bo1E9--yLk@1@H1_wCLq2KB5$ePiumxF@IY_GW;UM z9rzsdyII{%`R3biz{jXSJ;ka~TqH*;u2q78T23uJG!|q%32)bl-%-&-ur?#=`1eIh zas`FrM?-!h^+=+)KHy{VH{SRff)Dy8`oY@F5#b>~= zbA5;QlW>ZW=2WHLgM=^#*cT zbH1#BxH_F5r#dnYg9BEL?KjF+xS$P6nG_fOUc@lexJBuYw>CNrSqRQ62NpjF`oFs8 z>+O$8RVkFx^U<&)%HB)G{(k80$G)@@mq8i<&mjv$unpl}DLa0vjl+Tz_eJRee;(Tz zM;x!N{!X}qm%5#Rw={)gm$9)qn6x@EwCTDF7>SVq{qQYquT0(J|swz-h zPD0;dt1_-Y=wqc4p|qg4whfrOsU;SL=k{iT$HhO5V246SswOT~9RcM)0!OD8bGNJ* zCT?;YOFu3%>bRgzT62iIG*G6|%t^KOo(*q}TbC{e58S?yw=TD0;Yn2I(}J79r)?oQ zO9o&Be&0xPILTVAD==YM?1_AlHczlIHYKHhR3h@fP*EbH!T-`M;_h_l+d z35Jrw^CqCBE*ID5St?;s0W;rkO(jOi;m1LUi*pI-`dvWm&7BP`sDAK>s`!l|k(QP! z;e1qceqYVSRjgwMk?Psew#R5Hk(|xEz47YMscW}~GwD0oJ-oHm80PL~+&LdNFU3*Z zVBKEX4C)BMa8zLiryQw?zGJjGaYR5#wsx=8Z;ODuTT<_lD0AeYD3C@1ZRFTOF6Omw zRmJta#q_r*u5}?Xsm3ie7b*8L1Cl+RtaIM2-A`Tt(6!#4PurD%*MUvp71cRx+BwlB zhB?~%O?(5fyR)y2D}24006RTeY+5HyRRF|?UORMUHSOHYHTDymYfhT^@^r$Lw1AHI zG{c12Mz*PChCnD-!WE+xPd#v1Hsxs3@Q|LtdF1(T}KksZ0zXlmiI%kTfh1txx{66hT$5;N z>_5w};T_I1dUNEC{B@xTV9dOpVRBWK!u|Izlz%$ly~OCC?}4{lpYdmR%jQWg`PY_z zkE{G`r8OXM$MpxUgjIr@lJ17*SIoGBAx7VY&_xONqyTE;s-2ln|S`amwT_UX|t zn{G{j^YN5p@@cIm-TIVI6&pdmW+UD0)u%F+s;o_r@;;uoy^rx@rU+8+I->6`MWiW;Y)^T-e#YD?pQVyZ z)ANN~O7Y{hMjbHMi}(~k0K`e^K)n0*T@d zO1hed+pX`f!nw!+>opn-*e$j^#-7}{x&8Klja9*z_f`!CMhaP`(AEzwJ>G!Fqt8Wk zXT3DcGAuZGZKo&M^9;CEI05-L{##=ps_r!wsL&M$JX}&Tx5wvJw9C zTP&*YF>^YzrEXnLR0h8WYTu%sj20mmJ$-M+%|}gB1rVMZa&&I&<1mlc{mBWjFP{O< z$3)h)f(;JFI)anwne0r!CSc(_oBWjD$7}hzdCJltbSQ(EH%sP5l;!b?4kf_3FkHSj z%bxp`#+;`yMC7n8anz6paFgUZ9|BtakPv*b`0|hMfH?ftAA?WB!Y&^?uBP*`II%3{hmBehX8bNJ*yQuMz%=pdHvz_#?=ze$cFG!Wc5vT&N>Y zw0!i<-`ZK-lX2P614|eT54|o39v^%KL~7f1gcK3j+gz%Gp$60SN6+>~6^-+aa^m$6_+94G!G5Ozm0n5RaPJ_jb@<>Ai zqoVXZ$5h`4KbT}hqkJgA|8&TYlq0OW`9|sNJSKF{^6%QRw|- z!I;qR?cQ&{H~4wxP??6sK9~fv+mWg7`hIG*9v_LgL(*gMw0Cr@&<5Vr1F*wIH|^&a zMSiMxLoS|)+wuh~3^SjUnb~6O7rR=he>X*KP(#sH51W}|(u>gjaX1a1Ckm4-fD;T_ zF`%p<2TM>Fa;9>_F+7!{(N1^9-R>A;2ONz+$=@4|FnifJvKw4DKLu$>5;D{S+o#M*w^s3?&o&UbCaM=Ps2a=BfXKeE&WXDe2xIgmC3zs8(#i;*N)yk^M#d`@k4KqT zBq71`guxLDuE;%+Qm<+jfJFfHuZP>^<6MESwd4;DK;^^YWPzT+wveolrYK|jPX@0j z!D#H6+Ym~8NsodIO!inB7x6JU*0L`J>FkmODUHa^De*BCe1rIX;q5;H32lQQwdb&9c{ zXDwA#aK~%Id^}dw(!rn9md4QG7>k>+2ug$>koz*-p@C2zQ!rTEg~OlSj!1oHgb~lb zq4n5TT}$@5cANyrV7F~_O?0=e3#4;Bru(uK%rfr`K-Vf0oCc%* z0XZ@bIE9xhC;C0P8B}RwT-iv#zpt4o3R*$WKh|zY;Arhj%O$j(Gl!!{Bq|*_;BaC} z)g1B(Z%(Ot3%QT|l#}>b9NlS|ZWX&j)4z}h!nluhCw`r%8+Ggwb=U$+p|vnYzzU`> zLjC!`rG`-h%8r5#J6S?WB+QfQR4n_PX{1!8*2)@c+Pj5K#KWP8e3>9nK>Bzov~}yc z5zK}hz{Icr_PZf(lfdLwfYp1(#d{ZkSGw?D>lZwrlyUdZK;rGFuK>9wd0AhbCJ1DH2Xp<)&on&ahO+7tHLJua4{Pf+NM)w%k1M-3L~G4j@+LRuoifxrSj=SW6G z)0!^_tILEwbe9l8H!WRms?4Sh{XFjX_q%k@d#{ub$N_|+oSgOl<|shq{4brIwR`5Q znbcn%Y4=vM;PSI>{dz>4bDpZv|9Dz>MfqEUpf?UA=^Xv}W71Z_0WJo`51yTBO+d}X ze-Ku04J`gl4gWdMd7qg7R{+k^DPOT<`1MFcl<;V>?IwR+ z?x>9^R&=wk@y_mhb@I5NFc;fGhrWyLuT633?Ho-7-Mc*5jnh~;Kvlb~KM#;~!LjMv zFDf+F(<}KbThx7)pnUkFhU}Wn)W*}nd@OW#xJGNESX?8-$ViZbMUYBOfVKvbY+^Q3 zcoLC4$^SNwXsGZqO+%ce)roO7PJl>`Qn?@u{ z?Cel?%xsi2E>H)nyjbFwSe zL(lr@pqcjADb|?P|KC8ke~P9U;M3`?DBOkREmoAfR~vqeWRgJ zB?h+`^W|K{jr;DlW2aaJPz3EoGPIF+!hSqVJjy|nq3YbG*fbBgl~ z#PZ{vA5O+f(QzISRn^guZ;gjX;k(d zUR_5Qbhq`lE9N4m&zgP*LP_|-45V@KA#wSnu=TrN>|z=$q{%5+SmMfaL;m9ZVMR=$ zI=2%2_=h;8y97AMfxI%x-*)4qKkYC{0wmkDpw?$Fox5HQYZLSgcAU8bDOC9L06g(E z)`18lpGH6Z*}KB86B^=h>$>22}p*;0^M#Nvd-Xo*NNH5ZWG`?j{A5 zft$`#ZhqKY>8|(Y8#rAh2-j?NL;bWD{7r0^?bYajyM*64c!lF6^o7^`$dfg)J#xUrk(G8fdB{-PHVM{ml)4>BaFkSLiE&p~>L-jeXtxtFB!}n#hN+ zVw6tzYP={qpv4OnVbJXU-$z)QIbZg~(BVKqhGnnSR#Ju(_{OhdXjDXq3mH=uJvilW zX;2(wuDBWGXA}2_I~msn-Tm^Np=W+~F}MKb{KzsTe}+I7w}@h+AV5EgQQ3*k>+7@d zsq}yu^X`;cR(#o`)8bZ!d^lyckDq@sRijq>5byfEE>r?)4INJ@{B7{cRbRlWf+GofuT^~k3LE~l((3B&xU+66m*exQy=#( zJ|d1zf05yL3oN&ff6z{bATBbyS=CungWeA{>?yKp*`-0Y$$=y`h#zAV<`sGqfIf~R z;AgI`bx`AyrEk>0&-_0}gC2adlS8PR#J9u77c<=BG^#K&tJ zGNxm>yHjCeoc$5K%uASMCO!?W`O_AL??Vig+fZh@7AfHn+~8`ielA<&+I4CTb&$R(otJ;ZXn(}_6?BR=FaTZ=GFAWhN1%o$y|{meartt zCO3;x@zdk=$LFJqf7zwf2;f{83=AH5E0Q1a@kuN+Y7+Bopt5(-vm8T{ z%(R>lbZjYS! z^iB&C)xQ`Or2rBFx9esB`}kvVyQYOe959X;@ZX;}0bJ*z)TdJCqN~rORmk$IPdd4Z zraf;nV%OD=^jEl;F2SKBM?9X-s12R@wJ-~mS}sNOtMM)7=jr3WF0LfL{^ht3)`xdZ zqR1|Q$3-&qbdS}=#ziv-u`kn=l85fadFr8RU?CPDP*E4{iBr?gJNUD!a>OwF{yYid zdM`Y1Bm0~+N9@S=D7IvLV`grfcE^WSGRH`KfBu&}zH8|MR-LFA(1dW|Q+xL1)@^kwFtB)SJV>&^ywd(BLsU77*PjSnBV|;o`DMG)?iA z!wJCq@F(}T?nMyTZSPjVnt7`Fy8X1e`gL-?;a~Js`XfBW1;F zBW}%_q3|BxZy~Y(pJ!Gwr{_oote*(IN!vcoIt*3H6oiKbSR6j-9#Pm$-@;Q{({y_z|mvFWt1;w@&A-%jzOb&R~AtQ zAoG|VTm=gnTRaPse*lnamM#TS8y7{gC^fBDA0w{czShvMJnzP@8M^@JJa?h%ZV80j zZ#z)~LDmddmFb%fRXP7W__C6ZX6A>W1*c7{Kbj6MkEaQzYjQ+T<)7{Jj<2q2(7)?^ z_)Z;?8{ z5AlB#AwYC;xH&y(@8DhlLkxOjC}+B6liSqi-By#Uy0*E;ZF`@d0aE76zpx0_O|{xu z=Vu=rBhV~)s>VIht7RS+4er`r^sLDcmWA@s9YO32}U z>-ViQfd}9Wi%m1hu>Dfu!IA!wcU!Pa;Yn5cNsC}&&S-D)rk26Rl5}r!D}0cUTNWzY zBe9sBO^dvuf}Bm{cZjO36g7glWe#)p8?7!@ze8&u;T4v-9rDkcFhS#)je_7UzrR1x z@=xkA3u7IdOE@f5eOJ+!=j?nlBXl(Hk@xh?928+CaZb#is|OJ&DTI)|(E7qyYZ|1b z-fyScPO|DVx4-azTW-C3jBWDPApVg7Bx-&wW_AVJ4cmSbG}|7&NKQk5zMAUR1r$z4 zmf}6on|KoAQD9hF*=okI1PiUIpjpY;-l>_X6@Mlh;}B`RKtk2@wt{Ejd zv<-N^pyy)ahiom9kljJ{dtQ26E!lNcO4w8wr}aF@qK%A?Q%+?vI_nk4h}EAru!kCi zHp^_B8nTinrpC0>;r-~^8+i5TV{e+kl&In6I%T-$ZlfdkR_3k zo^tcu!N!oE;K`C50WpD*ecs$nR5zH#7M!GYD09*3~G5+X_YeN z-n$CoX6oeT4vFIuDeYdG?rNk$+-S)NGqK^AX7&f%exQXe6DiG7q9>z&w-6m7x{J0` zO*4Xx0xP8YH3r))1n+v$cSOd#%OMZalwc^RF(RRyy*Da@sStsL%2sML&8~=sOa7zyB-#+sV&7&v}vxMO|`8<-0kt;C;L?9RxjXyC&+?a_gO7tbGfCThu;jgT$~8_9}5jyYua)1{y*6O#`$~0m&R!E3sKa~M8qJt=bZge;CW-@kid=ditnK~woTht zD#M8b&h83FVtIY-00H?0-bW=sNATQkB~_y@3m@l=PkI_XL2xs!CHl~(9^a7>|G?(D zxXWX%nS4&M1L1@9*-amD_UqyFGx}mrC`R8Jl}N=Tt>Va zyV+6~Y;Y;axG6^eN(hoQ=dMY?t>C6FXYlwQN|B%FWAz8T0X3#5$vi#YRsV;eu=@Al z@i9qQ2GQXdaSjfBlvT%iQ$Jq(?rMX zxK6za=MsN+;Mo*WyGwDD9yB5>xSo7|n0+u_Fx~)k_*Z4lP|9>i)ClT(-q@9O@$YCESR^5 zvN}*gDKi}hUs0Fqy#>@AKi(X7yf(Yqxhbb5WsNqTV))Q=+luSOiI0_1^ z;*ED01C%=iI|BuO3MvSOj4L;^80+2Ol3`}W<{TvkBf}_k`?9tEv-|QRO|i!Z6NLCA zsyU-6{5qRf&Ntn9kzk5Yi<-=h&rgU{v{E8+!FTi^mT6f>9KFGNexSJxhC3SASW&Bx76;u&)F=nA9GR2=%DNZ>0 z8Ui97xIAW6p#x#5`9X%16gY-qS`myn7ng_Q(Lnu)-7&YyuJJEH9DcFMqC6jaA)@YueV>5?7h!)X*;1y$2I!<>nM2X&ZxoX`+)FH;wx~C zPBZrsD(C%>+61Y(3WD|rFNAIY#LQF8Qj4O;_g0%=OHym(r#tZ!PE1=TZyOp6wkES8 z207sh5f0BqDa)d6-QV0Xd9;MYLErIN-7b5FcncEXY4Eo4e1ClmswvItiJdbt3fc!R z6X^}Dq_5bz+Dj;rHjYo~fl+Q^;x^4R`nN-Pjx_X?-Ynh!%)twODQj^OQ(OP`=Lj91 zGnn{IUFahTb`h?Y(;(9Nd583Q#n(9^X>>eR>+ne15`rE;A$1n2;n_LN*^u z)KIYIg_V`cUMZ{hn)ono_@es?yXy=xWms%1whIkYuM)A|d-Vn8+#@@=XgJuuK()_R z3zHqd)27THp*8sC^Gb7U(HgtgIZuG$%r2L}GTeXA5J-q>`P^H`J+^)V|HHktY4&R9 zlc=-}ukzICgbeXtBR^vyZM|Ctk(`%mjpvQ|#_~!xmJk;C#bI;_gPN@-vEFP}T^O8- zv-i<1W-+(v5QEm|r^q4GRGm)SyaG{6Jb@IX$WMyAU4 z6}|x^D@jw%1MM0EIH69d5j^wWwzo&|4^-2aXi4WGYtplXgw8OD@J<(n4x-Q*zQd@B zFldIUFmS&^QmB`FZo-t6DLozEfgBC$fD;d(`AuK= ztuMpifOdKiM-;6)9#f|j%4Q4egy^b1&cg+f5!Q;RcgyvQL#LDOp{N=wyC+T2-=g1` zlysGOhN(~;pw=baY~0H~Ui9JM4j`#L|49|M0sBdV!xZ%!?57dNzkktx`@oq(zq*4m z>qZM03xZaL)wliYv-|Y!hOiDc6D!5Z&=|hs_~1cq4Ss(iRbNy z(m`N8=!6&;^c0GO0@7M*dX~Y%&u|B<00Ton_ukDr#)Qx`J;0EVQ8U^Zf}4#fA(+AQ zEhAmTot16~dPTaEHr|OOO?gGcAb?0^F)L{;NnSa+iQ%0x+zMwGBqszUhi=T6G)t)$ zY%Ca6K_JPvFL#;s=RSbt{3d9p!`3@|Hi8=C$T}50)w<~aczVb1NSo&kG~A7C+qP{_ zu))T*ZQHh!jhziQwv&yWOt`U~oOyr$bIyn7)AUu{eRp+tO?BN>idT0fG{S~q4zSw?dkFWLyoQD@e%9N@0|$oQJ3g?RN7A+SS+M6U4zBx zP(dNpu};}d#yJV68qJVqRW(_Bjn1*e@~^}@v;rAqC0~z9`4t9(UlRk=VZIAf5kT~| zMB-tVXG!(cAvYw(&$ zU_1&d_Q!}}sV_6^?jV#PR!K*4iHyb$cei=RBi}hKdB4AkWj;ybxtetqF&-Oj?(}xI z)x95apLMvml%4!D7Nxy7)%*H+A!pTfv?ymM=iiyUd^S8VRe1h1;H^;SeyJM8n+_Qz z)OE%8{pf^|jcnD~IuZDJZz)PLj0UELbxY;HKDU{~wtAwVHtEq= z&LpjEB20wLNKJz=i8<^lwjtWVNgB zYGiyr^#>OXCOP2iy?1l&T5tDLC%rbCQ#Lo^CX3ly9)_r;YO6RMy5}AOpm61(E`Bl- zO*b)FW#0vx%Ha>NZ71?I|AOz&l9|l@OXZr2(=@q6-Y^L|9?Q`unM#7e|KbiZnhcCT zZJZXQyA(~u1Y|QKw1{zkEn*w?Hg3mlfHUO&dNmyLYJ0Jr9?$3Oqr`hRr*>eRJWSwo zaiKD;s|DX4koE!cD)($D7;fk&mdD$C@;QxgU7tX)EVyHH>}bNf*wjdN{yJA>NY^uf z^|-$x-|9j_sD&PD!)L!(`}5(gIEyyKW>R5GU}`i;AZ=EXEnj=9ikVva*siSg7e^I; z9wi$;4L~zh_o432S=v-BUDyQri^s^GJ|P7SnT{)KR^sf(@8P&+&KT&|L%Q{~q`fF4bA2NUYh>cPBV!Az89@8e^JWdoo;kd^?@ z54}^Wl805Aax~N7dbXByEMPHYxF5wVo;Q zJ_)}C%}T565esBXbEzR?E8zVW*(_(jZ#-cF7(EYatXw#)_RRZnn=c728OHV^jXt0K zVa;dk3=lEA4H~mNdGP$r-H>FDofDCs~{_J=rmfvs5ler(9C4a>O7i3>k>=Og=o3xF0{8bV zRT>MyNrM3l)JLgbU#XW82AwNHKoigBb{rygmkG8MxM^8RcAEmT=|~wfvo8}%BLp*z z_2&y0oWVh2((vzu?8`zR|LVGhF3K#j@!-tglguw@S;c#8fGYaeQWtx^r{~IQJc1r!@ATsMh1?1D0T>}RnY<WtD}gOOdP^vpO|7$c)B8L%dIzevbc4zhEJgITe<16;V=k7E8L5X6w9@sP_EU z$IT+Jhs#dHzCRcSPgMv;-%Jf~{{e=f+IM%F%7TP*+autmhK2l+1?wSly zGul7!mT>f*@pqR8!7^S^A#~?h$@}Btv7<4>p~Y7pZ4ic{_v-IGeRpC^9{cc?jzTy; z5uuIr5~>dZt<5K3(y?eOt$(0V6$UHY$&smLkJD*-iGIu|3dSZ@5R-~QfbQ4jc~rCt zQ6ZV@n-sVo4hRAV0!^RlMVgxHa^I8k1ZPRP8P=!n!6x=A+%y5Y}g>{IxB59 zjq*?psweiE<|Cf9M_jR`D? zv0!Z!BCwZlM3Eob3%{$gTS%&L%rPqi&h#=c$%~7jX;b&yCSn#<0ygHoaqd-w#pWPE zModjf2$9M-NgZo{VnH0-r&bI4&xWrv^(zT#AZOMyO|-YJ*LU@1jLJ$%Mp-LW#Y{l% zb+8#lS%;jO5pwN90HqGH?By$}j6FzgQlh9j0ON(@o(A#_p~!Sd9=wKF#BbMWMgTvL zQIonbK0{udauZLB_cK@%Z-T2>Yx|~&3V~K3#Oj(D6H$fG#OR8e`8cDrA9M|f2wump zsGb%esS46}GZm#@`e>MMA3)~g@hf+{KO&2tJZ<8P<8gUDALA`&C)>&pCq|c-?qs8@@h*i!NM0SbCVn3*Cz+8wu z0(@-1jgbxRC`3s%Cwp>+nIv8vg^`?%D!b2InWEkgv}lmK>CjZrH0Vs)FbH%<)l&XW zh6LHS>4ucwhnVJqzdN?}gg)_B{Mvjfc3rvj5xCm3Ay}m=G=mAh%ru67#>SL-;+eo+ z(mmDXrp*PnHd5|%zo8aeBfcxIh*m!i85Z9Rv{mI;qoDX{VZ{aAl)c zL6OI*inrT4i`|i#2$ZCueSYhINR$JKmjj6pv*JjLmiuP-uShlN0Xqf9(Bpy(_{rjY zRoin3oM4^G*9Q^>d>Bo|n{WcAJJO38YG(Uf%oF0LiZu`9PyleEIW@a!_Zcu15jEx? zFf~*lB{DD3R#ayTTzfP2k*DW6`qlIJ?$7H370t>(@u@#(NH8i^oUInqCN-X1s@lIq zT+hH@C7xQPj)b^e`N&i#K-iFYJt!W6O3aQFn{R;-h?;@0Y4T3P6G$#Zx2bwByJh;9 zPNDSzyS<@d_q?%_cpc`9?jBdK6TfqtR7>pYWCq`ny7i@4<2owD;l1`aN?`TTSCQ0~ zf8Ns;m|ezj2B)KMo-FztX&K4iuvDpP#uz#u#;ug`YYk-sSy^)5WW<<1J$i`p5Bx=f zvCkONf#FphF4`ZI6x>aTv(^~#T;;HjpT~nrscTY-+7h!}u4P5{Eqa~8Syy$<`)O>qIPfAow5a~uM74x+R@-ZI# z7BVh65D9EA5%XKBNI^$2QM{W^ueH+TSO%9bNCSO@!@~R7nDtuArF|8Hv`oMbxA3xI zC;gn3D(7)Cu=W>}cH~)M&}1RF(*uSmA>kkV8U+9pTgTvH|y3av}bCAa8Bat zNC5*|U(ts{5bpDJTWAOckTeYTU7B`1)%Yv(QtRC23LcnSlyIH1?w_y_w=fHHcWGfx zLeU&UoZQ_qob>n$7@cGa=9o#b^kj7TI`D?H4+d2?sfbRW*B~Z|Im3*JthnxNi8hZq zp*|Y3VDhJpiSDJwEO@q$;>-GrwKKd%_{{V>Fz$YS|j_NL^GwYlOholYvc6*ILA!J??G{lzJZn`RRDSvqZy-jul&-$}-#BbT4ktaNu zRdz+3P*_pw+An{FVC0CV2YE%oroupldpR$Bf`yJ5=9d6@i&9J#owNSZwx?Zwy11>7 zz)l2cF{f8+ly%v5OFf%}Zdg4g@66}ZjIBN_-u~Ga3U=z%bk%LbF5)}&Ok8+(X7en{6d4 zjIHC>+X-fn))42P41#vF8^e5r{5Qk6D7~5U;AkH5%qe`xzKLFA+=Ww_+`9y`U*I&Q`*!*lF+!x^~?ym*Dp*MN#48o#5!2Wa9(a z##^YoifD{zt0Psy$ZF=|Y}*xD@0SzytOSSL0uA3^=w3{Fl%|TF?oyO}XGsdp@oRKp z>>EXyrZm~@jw27kq}e=YBZQu2BWU_ph+z9_n{4g|Fh!I9wtD&h38Y8)lgIUK6eb-N zn-3zXL`zE7Wtb5SACM@9m55P}i^_0V%8FU*T&|_zjW2O+JH}=Xp3WL5qx%jeQ5*t= z8YSnyz6DMYPVu>mLjj2L(9zdWwdU-b*&j8hFX69$v zei1?dZnf+GiW0l+y;xjLLx(zI%M~vu!3nQ@Ai11Maoizzg}KaMk>-|UHsYL>rqi^z zQ5j<){>TE~5J5WS9r*{y8iR;7!a#-FZPQ0gFw8&&K6x^mfz6x}1%2gxbRs4VjrOO( z=gaoHE>zlT9}gXnx5t)XG{PDy^_LDObmHn``wy&a8GE*5?p9UR=BDy(1c`h^-X4a& zn=qBrqMdkYN-i0kv_=A=&rKQ{R#>pZu*|MEL-KQEJ;bH_-^<&y-4C%bCT#gVlOyvU z73Mn5`qtTEWv16`^s-Q;Bj&B4&M%5Za1Im#v*Gu8ScO+&nfELevDB?kaRG1#H)^MB+$^8d-X<&|4dj9v=N5h`H$zT`yO~4-5%b$^ZnDn5aK|#sd<)%}1!aFT@mqTML<3R@<9*QQ zTo-!^qG_-VJGt#8A(Nw}yl(=U{2+0^&)k`+DD3`m!wqmISQhnuXtl8PAV1u;sHZq> zrHJ6uUf&Y4ecl9jS(Y|)*PwxvV1A|8UgFMIm>fy6syM2Vv(n~>l{u{%I^e97R7;|o zrJK;!&}0jIAk9jL9&15aX1xJ@9VU(O;}MPVN;rC+tgzqr`b((3=4VLAJ5LwHiWKw$ zD%afx*X}UD8evpSPFO(!b%pVTqe7k>#Fy#U`@@Br1DEEdcdrFc{p;49;f$-C((OA} z|0LP|zW@cqS9Gn$wSOiXO2Y0B?->C~U$+VfJ%mq(A{PM{WO`jkni~LA@}Z+2>bi3^ zzlD@(FSJ#$Vi&!V&?c=ZW3o1;us=H{kt5hb!GavJFW_---eaOaQ6pP}d$5d)3v#XL zS51ConP-j5Czn+T1D6N#iP+N1vJc(*&-!pZ#xTvn>sUJkU*ZPuJE$8hwrjY#iVPeI@* zBM$hfGCk*zGpU=Tih*fV1t>L-O(J8@8grY87I3r?Jos#K+9akU8la`}U{Jb2=tWVQ zhwZ&3vSDrXP&6=-rMMeDu+fBnTd$Lj>AJJC%Zj5m`*QG*gdV2QM1pE#Qtl)3!Ear} zu8}r8_wj;>2jULe5}1H|bQ&5*ZdoaE7|=!-(O?!Rg{kIl;Qj99D*6O}Nlj!%S;H$l z!A2`KlUCR(d{IU#4$_8Ght&e${Jq>x#tnQ9jJBYuQ$;fRvcmP+h}n4G5|lNSyKb4~ zEs2(Dev!(3(+Dxa#Dq0Ti#LG-OzTAIs92(9;-4ur^HH+Z(y4OL*;MRSCU1Aj<|1W@ z@x{|h42x?G9|*Y#uws=t?qMSK-Z6Q(Xv#Pq z|25l7Wr6=DFQja*cw7CR6H~yZ7t*3k98vJRs>HDBLCmXL0u~^GTne<3;)^$z;FM2e zHIk4;V2O=A%Z}8wEVdj`9KTg9|J-omE5$wK$wtNe-plF*X)udmRA>NQiYih-<9wP^ zywfjvNZ`WmVv!3?;)PPy4Sk!@+H#`X>8Q-=<|jx}z5HMu+#<#!6nqBHOT7x`%LX1L zM-a5^1VvHRv8OJJq}QQgjcsVO^-UE1t-g~c4n>##$iw?IF|ZT}BcuM#)ACx1+LHfY zSH@tqLitXWp%03j_gPMHoZ!Lc)<2FqxPH3MoExyv7>58=Vt-+t^5~#0O%>XwVyv6IQw$(H1(Yql6sB0krO>mXk|0fk@gQP|YNU6Cf*;@xV`_$TE6pzkx-M|Jewuk2)Ce_4~xd zg9BATL~7_=l|<75^J!_)^0PRUMRu1|&itBAFS}cB--}QhXIl70XtUZBe zUr_c!uQLK?O%`x~9X~$xBZtK{KisU%SE_T^xo_1>hgT;kzMTKO7RWwgG#Z`zrK(sh9DKWU zv$h$GMzf+5xBP)c*JfX2nYj}l5lTfUZCSkkYmJ3VZY~^{j1L+sSFD_69vIS=M!X5j z_aj&X&i79&Id$d0@kORR?C~Dav|S}5fdtvno6HJxKvd1%GJFjs)L~N<8K=X!c}Y`E zO_dk`y?p`qHq(_LAu77yo3d>xi9ktop*PjVAse8vF6+Y&?{7z_9=fNrdcK1LbuAuL zA**&A=z7H=90e3-$A~qlF2-JS9I80flQpr$%KX4=QrERUt!K_c=AG~*kOm121-Pc7 zNC8BJrEX+Ru7@y1b@ss`kunWd)VkU{2o|BbJS8IT_fRq6fULx$;vkvp-g|v3I7}pg z-IW*F+Dj@+ni*vko|PY^ib4mZ^P~J|37OAUob{Ov_e)qG6tC=uSQy_Jak?B zk`AfVD#L>eo%GI@nQ08%0az#NUVXn-A+Z=9n{Ah#b|>E*LtxFXC5+)uD&FT zdlHoKfxA3Npv_zHo8Qv}S%h~Mwpvx(Gli6ENm^xoV}PhspIZ^ZWrYk#U&`sa50)a&kl<4RO|su{-a(myjvWofE=;BUYKO5h=m?2G4&h z`=auXk^uCa%MYQUo)fchK6AbW6ss|RdiCe>7{4+W)N^~XcO-oJ_fKy@nf_El?*W2h z2Y%__)-F(c)R*8a(wa%3E+?4X7$bD{Y~B8$gCR7}Y({o08&t8!ddq02>0Gk1-#{MdcX4$IsNvSS|)k8Cia zkj@K!Mdk0Qo-rz!oNlPx7^zR7~6CEv%L)G38bgp*kti<;?L+~qGL^hk#gd#2@1 zMHwZaidYXQK>QA=(WQF{&K$XDI&5B9`1VX|PdQH=uF}G^bg!z|N=O{STbCCee5zFIXQYBg;*!kOKafk##d?L`YkKQE?Ru-Ib~EZV&DE0N!D-8(h3$r$onG1( zaw^PA+Ks{i$wvr$LSv~i`dFnimiC@{seDiDV=sw*6QhmFAhci}5@m=&M*zytu|A>S zn5!M@Y>^9c00dM9cH^p0*{g-y5A6BA6QfDW73LZ_otAjwaz1lp3Z|HQRhBa8Wsja^ z5{y=0dE&RU#L_}V`&XMyjsL8Bd(`XXcI=PEMey(tM6C!Q!=gI|Mv0K%Fhi>s6`5P? z*L1hec0NnQV+zsd2+m!%Vl z*cr>inz;2pfoaJ)DfBj~9xHgfx;CDQ@rWH9T=DYa!zKz$JgY`2;=}J$5z%1^NC8u8 z6S^KZk~TgJEeV?zMeX!)8O+Sd&GyxS?7(F%AJRA81CGdlcNdryDytA{Fbfx;sG>og z-8~+WBA+w<`SrPox|*{xI(wO6OsyOm*i;D8*2zp-o3YHBpBss^roc=wb%BX>u@KT_ zENSdwV^JG%nS_tsl&}^iKmM$TDE+=63X2tU$#8Dg(DqqFbF4uW5FssdjVBys ziNVsu(#!)|+zVQJH~6|cFq5++rz$ z%b_2L!K;a)ra&ACbpg2IqJEUfk@?7q)g+XMLmGSDK{EpvhYlTuR2w{~lCBf3u33FZ zuy0XFFpkQ{=zt`0L;iSW2~L}Db|&&pM%|czqP*1nUjTIjq&+|*e%m-4Y-a7h8ki( zXEqAaC{uAZCue1NdbUbgj7T1nszs$ zP1)Ka>RT2hL`FQ<9KrJp-IyT!2mXIZYC({+jIc&kXra_*lBAjikKA7`6zcb5AQ>l` zgz$o~`jUe7E7>R|dvP}L6&Aq5;a;$ND&wOoc0y93K(D+zQCnO#-;7h;VHQTSl|+>* z)@*KP`1x*aE%D40*scW9lkETW1Y^|eKRp>>r{*pyNdfS?FyS(H_ zA?MG!0-fOv4Nkt)RlLk$p*=Pd+A?U%ERxnUYRTMQ>x;qGTY-DUF zSH=q4b9|a^z^B?6(m1Wy5>&tq&hxkL{0Ii>Q^*GD3{VE@C`!R7e|uN4DB7`MDSsc3 zZgwe7)7?y+*Gi|%zJM4+iHsv=7e(34JhAal=!*i`U1x!VwdG6#1O1)F&p%Jp3TDxjA&u3&@i{+kr@J(dqwG_% z!lrM(Wt&E7bCsHAeFy0&cMxNjz{mi@FVjI{A&L17y3cI(indlqX=sY8ByK)J;!vYFS0=qV$n;# zYfJxUZ{=-cW$x-F-?@f{ubF(YpOxrl?wEymta|z07r{NqG+rbMWwK_Op|1qcsAc<5 z)4aVc=4=m8y6ybxtfp6_cUft#24lHFuaN8XYue z`gQ(WoCYcGz@Z%oPtCo2?~3Q|PSy>~e6+N5 zjC58qdg2`spfG^@Tz1uy&brj8Glr+*b!_pT-#DWy#rutqk?u1BBSgT+pX%ox{IEM# zf|&(AUtuTPFE9{g-K}QFaJf(5<;`c4Q{vCT|LWRr__ul-RE1e71WUm*#5M1?nRhe z7H{lrLpo(Ft+qZ_*tH3a0^`XqVU%)g0X;brGwU92Ya8B`_uWq zA+pfM^{B3YJ(3R*2vLbS+ssg+^Q|s1T-}8=-dbwdHLxA)2zh_&u-?cFAbe|`(rt8Bm0Hg4-je{r+`%CEkp5$A*%hk7O;NQwQm zKCsLiA1uYG8E466O_#jPKwU%YGLRLH@6c-I; z6gNu<$?@qKG1JT~<+mnIZ@7q=B0tk&rMp!pAo&|j9TVxt`y@?H`|>QO+_#8Ne|MbpfmznuM4TP9|gwOn8RAXLS4P^^6Uw zE1}D+O8eP@yr0bOoO|5Wcep44VD_G8TUSV=FLB4DffA0QZ+>6>WrDoAG1>*|76H~Z z>`7Y3Mn@QaT~@!u-4eyj0)&Iw6T)7o%KsiVAKXowo=T+ue6r6thbw9S=JXix*lpvy zP}eD;*)@J&;K(1PMYS{Knw_iY-*EnG7VYizaeKKd;m3eBOn24Au*OsFu`GYc{8ox6 zJiw&Ihro*KS8?SUO+<969xN1pR>mXYPlGAGeB-s5-Imr)RC*YS(1i7R1xv(ptCb$F zuSv&Q@=hVAg$d4%6tJdy!Vo!^rmA|=;5pZUt9&a)a zm{s( zu*`=ZgehnC`G&yvp?EJLGbkjc^$wkcs( zrP;@ z3(`E{a%ILN1Dp}jWgjce`H|4v4)d1#O{6$+L7(5rvY-?S(V!5}z!>KMxN4!^JmocE zwuO>ZIr93QmR#%??zp6)i<#DNOF=(P#JLM^ydP+ripHysizb>R8zuTgqmh#!w<&xa z9v&aW2_^@idpPRatBf^M0H)=} z$t*_l=bIKpv=tTGD_v9%IzGgItk5#QHxMR|9`fAcU?zkyX1n8u+Hu6h_CjF%&V=fF z+_$H)uN@>QPkis`06Jw*FFQ0Gx7e3q8Eiyt>$L?281?MH_(+Ju+mu-Ufp-va(~U2Q z2TX5f>ZGDvk@R;3R)_1P;TmaJH8EgnXMMxkCjGw_H(F5Ar3d;$QF^ab$fCl%@BTCg z`>oRF52kRMP;W6-2L9*7^-x0Z>M$1yPh1avO`vgj@+XT z_ZBqB#?$Y|TKgNO2&C$A6o^QaXuFP&;G{MY5HB&yzxqn#@MUHf~`f+uMrX1 zs=%XM;K@c%zENkLb@HU@Kpm3|V@#^Z-v&i~s$N9o5R57(Q8*9) zh|&@Sy8i><%6Wee5yXAc_mg?&Wb$w48E1h_D%ZZ)hEb%wkcWVn|B}_^0_)C^V{ZhHgn=&wFXv#k6V__XmDaMMj_RuwKLimkKp)gYH9VM!iIgMZ>y zX{P;p6 zuA~S;RU^$sqwLR1?ats8M_-|JC^9v_efFrmXHPf^M~n73DRm}m=rwdS%@hmAjcTEQ z;V;U|ODrfwc-WDF(W5#B5(52_xvOOkx1-tx^;Iu@*S~qubK+c=bl&MARUk>~v4U+& ztges!&HyKkgU^{^*1A&=Raw~Ks@BMU6OORhzf%`!Q@_(^*Vr}%=WOnH{Kgw$PzM@g zsoZFRNn_CUMxuA!D-wadk4~<@IQn^gLL3m_K2DE`7DYGjY>PI~ZsIUD`t9G}`@erg z-0(8#f?~}An>5tX)o|guwM5VBc`79aB`BN1S3aN5ta0j8;@~w!hD~m8lcxOtg9o*% z-I7rRGHJD=%3M>~rh*IsGLx z-`mJEwZmZln{?Iz>%!X~DUNsMScPYI_yTTft1m@8}J<=>?(IZVL&Px!Qxqz)v%4*y?%pRI!; zU%+jQ+G97v^sUNMu{OteogmoO=6>=k^MI2O<=L)?Eg!{?`bYhlOOIc|(=Q1QO~jXL z62gAjTAKcMQ9kiUNpOki$NdRCo=E~hJM1X3PC?(~rT( zT5H`QEYPhND#an!{(md0Cngw&`3O(#uwY|9eLIp@9{LF<+Q@fmTl)pF@U&*RhWQ=* zpnvUnFZygPKWBm@Okq{6Eq2qmPQWbI1?@v{qL!tGR>hi2G8VeV5f2XjUlY1ZMRw1_ zzx-jC=Z4UuFZ-`+cs8eF2w6W5b7T+2LYC!eE+} z%NV!jmaDw2J!P;{!{zt(Do4D9(Lf*k7xK4C68SZM9XVuGM@_ceqEw355w4NqOw?FT z?xH|Raub_oobW|Co)otRusBEMhQyz>U-RSAjYa;5><6$+nnitpC_r74#n7m3MXfP& z+YayQv_6FrqwNbd1I!V7VYe1B{NJG9#xqX2weAwUx=X%h&6uQ8DxFbU>sO_uHi}%> zg!SOxrbiz*UmT0U(c!hiebUt8VA9kPtM2=0j1X$N`8&sJ=OOPUG-!NrU=;+#GB$>% zCl?<@w1_%ctcXxuDs&YucClOxTUhlX9LiV}M+X(Q>wXhof&48WAM+1SIz4|HOtdea3!Zt~{77%@CTmW+`uU8GYemlQjfg zm7j}xbeIVTbmiAkVO0ewDV&h+_BiNB{^|2uvPD)5`9yUNVznl9^}PS zz~3|!vE-_XK0-52)CKz+$vQ7P&)Q~@c?TiWre_{1cueF0)L)?xjv=h7Za`=7EmrGo4YekjbQC2dzvQ0MrI3zU9eXh&mW`>WqX8eS?9H zINaVM`Ffi~z9J1YTF5+vyDK)Sf-Dr1)>`E;M_lUO^Muv?LMw+m>o}pJ>_pM1<1B4> z>(@rkYV{^)4v&uLi-HU9!~ON&21dxO7_#U}t^HkD!{qe9ax{lJM@g6l16fBTU0RgQ ztqu`HuX{#UohoAv=i^L|yOP?ESV!zAPFDNh@B5;C!)R7c|5GUN2-$brDS?+|pj}%A zl?#Y2IgUYKr3Ihi(cCjMj~F_K@EP5AcObV@F@$%T$%HI%@n^M*#+taZe0`1|O+*3qkS{N3Lhj=J+w z@Ntkj2TN(=(&xHgl*YKp_LmKX%3j>DsDDA^fiYQ~#WE5VT?ZR|WK^^C=m*5U&_-YQ zh#h&pYxQW7eZ`R&R@q!EdirfRiyA=n7~%Fvo|Zvp}F7?D=9Wzi=q6lsUxb)cu0_49;D1wl~_X8|u7A+O@L~ ziB_~n)W&t*17rUrjAYz7Jk@$(O&kA5=nq)iZMULwCCSZ+>{;r5-ce3f#X(=W3Km8s2^w~9f z3SMl3#kn-}A^`^?ynC)ZSs(t+I6Z)OUA3>>jMFw5$2no&Erq9Z4#i9W`Aw%OG4iS; zCGnJMe=>HE23M!ToE^gG!2H1eWO?$IAzubsf}Hy>`W&tFP}^E~s0CIy-IhIDa6J-Q z3+Ktae>PmHxAGr$1-#M1g>x!9^dpa64%PcuZzm$dI{UAE`Jy7D34)GMDfU5z+t<5Z z9+5 zSlDmVJn8(y7I<91zCo&bq0b`{CmZ{XVZA1O#d5!2ZlNuqoyqLZxt{Y z?!u*4P6HD|iKPrNu#rI@f+2@0$izS)!0lSgqs~AneR5~aVB&ue==kTpQ?M*A93GM) z>;EU%?=D8rKBv`Wwe}}RRuTO_{Mp2-{I5>fuJu?xZ7So8zCW~vd+XPa#P~y2j43uW zRiM<|E!AmTYotue@m|}UyP&LCRVlRh@4*6LYrf!dahgocfNcC5w*{t|exuVA^cr{w zs?L0eauZ?b-Z?2n=*=Mzo4{0>Usq$~Zr?FyC@h%kR03#+wldWeeB6Obfz3yaKsPZ? zH!BNzhsT!7UNkr;RBA3#jNi9)x+zrLuctIjNy@FYDEGt8zWYPvLdt&Ma<_dL^uTD1 zx6<&_XvEu9>y3QfZY1WX#fuxE#NnjNYZ+qhc#8o zDjyh(AdkTJ*$$E^dZtEZ21qD|P$)d*1rC&*?}))2+jXgZ_ebL$G3{e8EHnE?H(6eC zia!w`{8%|~w8bXaW@ObXw5*iT2xPf&PElf;J+*W<;iVMjzK=wi)&NBTEXHWuukw%= z?P@7sf9$wwOpMk_*zDL?5R60kH1jFK(g({b7A^++WQW1O;Q>$V=$$!X{`VaZG}h)6v^bvMXyfG*A})SSC}fM_VRH z>sY!OIUOFEH!KJ0X~-Ksfh;mlMvjjNV=2c|%IpiRx3;&MvR&pH?fdZ`t}mTh{JI*V zrEQfAWc$ug(msJKry)rxFc&OfXCh*TKEe} zW;2d72%V|Qtt6*$W-fA+sBhg)g7ndfnjWU@z5l!kvQo86C|Os`#V!2C}sf?~HHxNxm%`i$uMG*+&kjA(L<&_!QLoQy47TB3MgNTN7cU!pi!Ut)hYniMTfJHUoI5Fg@D z6#xG9xcb8cf2D{XcFj6LQvhoBq>gB@gJdVs8qmD4!roY3uo8{ z+t=f;Im%kr@7B)s%8LE1B3~zs`kjW}*0_&UvND*MS&TUSsSFSDLi@71W_0%*QQ~YMZIS}XbS>5c z*xl0vD=17PD9rkLLSpJ-*fT#0X<-XSi(a|vpn_^_{?XPhc%EXveBTs2mU?{gSw6b5 z9OwMITW?kW;Bix}ccS=3m<4AO64tl)wQaww6W7f)`5g6bnsJNw`EobhoE{o<+=RNt zJvKSsA=Io5d&s9ol*AUt8#F|qf7?QnFTEx#+$_$=l`TD5yuZyJ5dXeUR+S9@vYgo>e!SM=}8I!wfecVhZ}+L7d& zUMuo61Z_~DL$vsJMT^7|F9bF|7fiS`2`kBBn(+NyZK-IUDH+*nEp^xuHrHbt3Gr{d z*`p*S``gV2a*)Hb3#N~&+y!S0M#YZlMEO5v>*#*+7rN6U(Cq1c_%&*ai<0w5PNQX= zhL})o3gsxVNjJl-?Xy#t6-rWJsB_f7AU13HAhS^d`n`0X*-p7a&*4+(zilrY}ktwxu5dqc{v-Y+uJPEQ*N-pU_yG3 zd%C?G`#%alES4LNnUw5cS(C?8s{-Mj8Udg>wK%hKTSFF1)dFQ5kupjyux@;<+0$@R zw~-4JhpKOVMAV*R2~u~@0FX|bq!POgc(QT-%b6`Rm!`1qVNbu-%aCFU%pNT(W*>$wH8Q_mmKyxk%Z1Wku2*zd6+&HVWxX!xOny+RoDM4Aq2xwCG9FV zUhaZa(>$}ndS7Fx?eKkTot)+PaouL#=%?;rlfv>M8}o6<{llR}_O?#HEr&j5&~_u! zI^oI((eLFPzb~8G`MGg5n%Hm*+@Gsy-GFy6>d` zs@j*7YSj-Xx{mMfZOl@xnMOA24F)l5Zgo0zTTm1rx`VS z#|`1Puu4C*rtmfWD2_wcvtO53JQmfx2BY=6(u4Vg>y=~CZo=rWfx`Z9@7JWrQ2`Aauwr$(V#I|kQwr$(? z#=EhNjW>3(vGL9O{kdn(nR~jrZ&h_ymmW21otqT$uClNU9t!>#QdC(+*V!6sjceT) zFDds?hnjmar?+TDA?{|DhF_$=hwoYZfBP|dgUFe!9pK(wtvqT@p%K_^))>$vIkJR% z`_NL*vVtYwYstG=7^py8A}@UD)vZu0{ktbUCP!sWbxv0y?78^?soNQ~mSx#Ns1JwW!;$v) z4_;quZAJJZykeG$KsziWaI0>+U!-5irb$$jrXgcz0B!3c<+n^RBTa=-Y)SK8q(2~O z#Om?xLle2MeEldI8FdQ5RNQz7e(E{|wQ4pF{6X3f>)N4lx*by=7%3wi!-e4F`_AdN zL0OL^uK{u~ODbG=5o!v`ZB&_RdCPwXpU)GyFRgZ=(V$|V0h^7cF%pCBU4S926UF|B z4GOrU_eiy*0$Wuqe+9j$G2!(qB%L1_{+#y*vPfT(@K`WzBAGcNVfP`X!qxPa-vKz> zoN6+SdP*AL5;b+hyiyH0{U!^5m&fl8{67gVc6)0r`sSX^JmAIHw1|_Mau;gLb>heG zE?$0vR)mA3?c%>T5%)SAkBq3^ozBqcl{dP;y@Y!9;OBg{HhB$q83hesyu!Siyj&^m zP|an)JQ<_;#K(2qal|3uLX7%tolywAnMJ}zRBj7t`XmMFw;KhRsJB$Rfv|lTQwG@0 z$yf0Y-UaUb#+Z{^_0wt2z+B}jM66)f2Ez#zD*+m75>_DMR0Uf6L{g*7mfwoCl^7Hs zX#6QQBLEfS&ICDq*t^vekp`sFI(XAzRTq@UE6IN>gf8lF5pmuIbd_AsQr; zrg5s}Rh>kma}<#^=--%;v$Mc_cR>)sizkvG>XCqNhYO&4Dh}yt@W?HMI$H#J`)!1X zGgtjRlgkk^rarSVQh6%T5!>h-!OiZwA!_*_&MD^o@)%R9j*Z$fa+2IMl{693R)289 zKj@?H^=7=!ZK2=`Ezw#zIv?n!Xo}b=(qkvQ3qd--BJHi&iT^9N@J}`gP=d41hIRoL zUVQd+9d62MC$0; z5?ZmW47u*ud2)aO-EG-TevqLZIa7c#<%QaZLOp(rWe`h_%)hL36Er2U( zL}QbY{^jS$apNw0|Lf298N(mudtbQ0%$$j6gGHMA2j@~k(Y zUF6aG&ZKIDw@pp}FR3t!f`@)I;<)(3aAq0*eAvC}M~Pec&Nm;FxRK^qp4N~7KKp*% zK@mKz>98lA*v&AHX32J_E;aSOy87s`-Tc4TLqB)9iHQqUTF^0YLGQfXaCzBeA>_TY zl34d}ik-`$6Im5vWS|S0d+7n5AZDy(OQ?z&yD-FK5_ci^Xdlb;D;2i&p}&1>Kvh4Q zIZ9BFO-YI9sD*4~w5$RbBG7E$g*H|^+vPwrliV!y@R;cXeDL}8=McWjBo`{ZjE6}3 zpx#4m@Aaw*W`9!LziYEA4+=#?byt@aa1_OkrdHdMbc@Fw8?MCW4yht?Bd zAAVG5nFou6S{n$b!$=vO$wL5JD1PEdG-Q~M%(^r zLlQf>*j5(23^M{@d&#zE^?COeDe}muht<+qoIYz}Gr&?|NoJJignSN|PnnLgC+h2@ z6J1jx)iv44CrXdQ>Jd#vb_E_(60Q66bTd)W0}VQz@!W!g2XCc2ZnjRn*W|YFz(&y_ zb=Hp;xi;g{YQYC}?f4h@bbtSe@GaQ7EN8H5V0+u1xM(!gx_N2Ejg7yJy*+aJ_*-58 z;;&qS@8()fxafDn1=65t)krFh>sp6|1mtFV7zix*J0mIjz?WM9bM_cg2^$r~j3^^d zv`VK(Dp-i;J!}YtI64bqM)~_}2;!^A`Gh52A`rucX6+f#1OK5a3-6(74dh|$HbEw! zc?|9PPmZM1jmM|&@AGiFPEE=IY<%IzduH?fyEks1g=(jV64HQ&MQ?Bt-d5TJYNn~Y zGW7}$PXig1vZNI45jhR-ESf!$e@Vn;1tmFDMOX~NJP>{T1IQ00<-FUcBf}r3BjkHI zSE_Rf5Egm62kl)}o1)G$@e6B7R9z15=x^5%%Jrd48$+hhufYmutjR#AV(x-W=ZM)n zS_C6%M7l{O6rEEc*iWJqtM|@nF^s!Od(tHmZ^=1{onkWiK^7e$SN*_0hzorw+ZR|s z^pdV61S`2|B&#;)%6L7Z4CnqxUIhsPz)X#MD>HS(dG-8H(KiCbo;%B#wb7>34R|=RwROnSbe#hE9j>m z7*AdPFQErnBVxiZfTsqX$&SVs`-b_V_rIvbbqq&Wi-$-92`=yJLlWrNc9qCpz*A{$ zmh5Ied#G-FpIuIxUbbSzNkLk=oeLXFdUhy@g58tqYmp=vxUAh`GH>Hpn1qlkwME3h z8)rWPS|seR>7vjNu8#SqM(aTf(fD@lk2U(xf7^-ihE@VS4BW08Ri|fs-~*~_JZe_p zAt%kQr_;uRrQGQ>dlh3g1!-X?=^ZgNOsuB@Ddg8aL2l!-3$4I+fY8{cA&$i_P+0^w z{q>ofJJ`wYQ*z;Z?Wj(Pk=kRaY`Zt|T|Z>HPs&lOOb3%MxkGOyVJQ-7HlB zL#VnXj#zKjn@E!dAv+&dAzu+)imzdGCoO*Z8Q-{D+XkfLg@e1rqGU-zi30%3x95k0Ayl8`~X1mj+6*3FZN@?+U=!ct4k!&@;#dt zQAe8zy$v>){P?P62b;<%$kGB}Tu)+8d$?w|aMbWO3Opz@-hMAZnBbFEPpNSBYr*@H zh_{uq(mc&PP0F+)Ed`Y^HZ0A0oc7ZYSH-gmpP(i1!4CLJ3f6hnu3nX*LeCJ_kpq_J zA#GFWVmQwa>nSqEcqOEeOqRh7cu`K_}MzQh#NUm7|VdCjytFrfbawLPJq@+SAz+I$L7Q$FAz8bS}ZY9>_fzr`jD}ITdB#6U}>i#7ea3U^iQiS?- zpD{~DwU8al4cppMCq+^%;YMqsqNXgps8`M|Q`NCf$JG&eXy(J|f(lgCD-?zg2@_uz zHeo+J2~ym2!+Om53&(9c&RBg?4a;YEp8TVyWLt8sm4Yy+oR*b>aa0(L0ne>lNRe;} zVjqK@QpJxlE-5T+aHiM{cG-JM?=4USZ^NQF!V#24F_n~}&J2`m=#VE%gKINe?@FB2022=S$Mh;#uUU?51EW4cyXC^Ttw2*d)_w$t!7$jnmLzlQqJNQj~DV=A}DK zXx&O($5SdSO{Ia7dpf)>XIcVjIFruma(kNe1iG9)#yyHFnTngqS()MHqo$i`W9(av z@Q-Y-Vr$R`8`;);twgia{x^a+xV}}S9O^^uN{t^)0due7o&=DxSK(MZkTS5kVSsvq z6_h&i1w=z7g_@dG2H=mowPnS7D6!P)TngL^dk^p{7)nvMRudl=sC#TH+mQZw6_ikA zAgBA))`t@%)fU+sBY#&TV6JTlagPq15dlpc;uDrEAbfo7pdKZRG6r)NdQ?#jy;MeQ z)3i7(+@AA61iXb0CnOs1gGsf)5w67(#cf9gIkQSe3vnihGBK>LUN1cLFw~|dL!VFyCW95-0s$PXvi(4+5U$g z8Z=@1yb_1}8yQ(gB|FglZT0vF(LP>a7DZ37nC`Z5D)G|Wje^&;K%!g*)*b>2;?KAO zHBD<=D*ddCJ)>C-wZJ&xV*1(osf=4$^>{&2kC%Y_a_IUpI+<-x3h8g&3$pkUW~!*MDGvM`MSf|*ABGqCa}Xl%rSD^0I8%zYkUhjb zRnis(qi7~(Rs2nD4$S4z!oi?Nr*}SCHUsdo@Zsf0C9q>Wq1|CNRz`1g4$)Lhz>+Ind|f|25QR`&_CArP3*r*$J_;CiewHiz}Be)#xf z?^n*pzx+9s{OGNdayzE4l%CxW8TPJ2nKKdTL`{JnRiTa1`d*xgHv_aV@!_pU0_onO zq2m2VxAO^9^UR87wVMONvES}h6wm<#51@~|4>hIVq8onRM4It#BLH5CCPSpFuCM{B zG_-B6DB&A)ht`C$8EG`GV+`hi4MsjZ`^ba`^8wD?*vEy@-BS?W1>Q5w2J@>?;Upf8 zJ(NO}F-l4oO`!%%_eb>0QUp81natxzoxcKABPN|V_4a`9AP-oENZ9zGD}Eise4b@m z^VFR%JfhSoQyK%Lp|b+DIC91q~Q->fsqFbhG3Aep)0>(%NBvXJlvm z>BuCmx`E(l(U3yYZ@-t4I{|C;)+6R^m5NEz6pl?x{~}{zRS{E)7LlHYF$u)nK2g3iVj3aq9}2S45m z*qLNKdg)Bhh%*sR%u+!`N1RlyZ6n^KKD>BacCsxKD}v`pMZ+1j%bE8OthLoS_*4q< z`FyfH=%9R{v2w=kpa2F?>Po5G-#b-?60w1ov5co-%j@tK=rp}6cI39flq>mO%yu6~ zNx^`ols6yVE+dtlzM<04lEzlP-*lrj3D^Km_$o5tP^6p;fDAYa%XZjeGp=%*ZA;9( zTubbN&KLa)G}e%L6Z-*{3ECM`QIzDcB*rpfZz}~q-4nvl4%S zmMZf3IPx$uZ+x-qOc)9JKOL)&hQfZ@D&bO*jrOk)u#d-zi23N<%)gBP`m+cw|3F}c ziJ*&iM4RM#7<&9YoEJT4-h~n~5f12Npg_p96W|DW&JxZ%3wv^lV9Fi4DP{vg;K?u2 zQlu%5BU*;suqQ-Kmqfu9Ob#BT9swelgz$!dtBK(32SMLZwdi)93lqk}U|B%ZDdfCp zkR29TZ+aTP%JCQr0F5RNsBhl3%D2yB`mter`R;sE0_Plzg>e_kRXDa(%vNcg1vd#d zcvmyOn~oEvF81aaP94h+3)pLzDMa$_{;=aG;7x(*&016M^HH*e|FyKn{bB9=(Or{} zV@FyA*#{HQ*Y`s>iw+b}UtO*xR4*4u^pf!>e+;JFa@B5qHTRE*q9gleJPo*gtmu#Y z(v6JzLb>%z31M07(ypt7wLMMw%~c)jz0-N~19oVj&+_6Po7e4Fi?;mt$F4cFH6bY_ z1-d?JxE%4LdU*M!=Ts!TegJ0#BEdwcd)f)EDw+Re8COH42bQGdQABfIJ*q8qsh9cG z@%o#W(0Ae=3CTal!q09gOoftn#cY}owW!)Es1w*J^7l#T?6nU>bDPEi&7vfFqkb7}H(gEjFL#l8Dp2+B>CjHp&FjIaf8zk|H zOO{HtyQ>LB?KD}xuK=z3QmLhucm`-4>%u4%pHPO|`d>cYC|mkF`rw7X{8gmNSb4it zzZEKX@4V6Rd0n;3mENn!tx+O3g2vlGmDOUPN3C|44vZsqJ06W+P2>Y{_@Ti;+)C^8kAyjg0Z`=<$(% z7(LX@>%*cKW@h*7&Md*ATfDzFfc)}0ceid`cF;5&#=l;~eDi&IInLbmZCw+z34Kau zzH>{dcYOIZ1XoomMv}!>3Nv5{psFF)ureL!nV0z`@`#C44}X?%I-{ zj2B~?)aO}RK594tfs=?c?4tcAg+1eveewe zZfX2`s#{OF2}90Vx9y5M0G(n zp1HKpXE0-}#3VhcRn*3jMokD?BWCq1iuWlr$!m&$x|qdL|1HK|;YN$;V(f}cn5iWo>nnGWxa}+J6=oTj zwC-WapeE+%je0a}{O?PCUif@%OnTW`W{Q*_xk=(F=*j5hOp_@S zWwbTprf~3QO@s20@x%0!ay%?RxyZ`bi*fnCT=e_<{8X}Og*x!*f!DaeRoTzg|Lhlm zL3?3Q6ABG}dTyUp|3$>|OZhN&G)*jE)fPeYZ=2#8Pc+ogZ#*yWhghqhz5X^_=eL8$ zbdQ5QD~J^OiBWmHmncg2cAhsP*hr_<$esQz{2(y8>ItAMjVVbd^Z7_vi2vM8|6 z$#|$<;km!@ybqOlXMhjXngzp8CeQKaTsk8|K^C&h-50E%(uOf5 zV1j<`VsE^nW{nT|dqhb@N10#%YWK>5EUY)8651UzBf8|&(=^MS#xyX2$&}ns$q|VA z5$Ke_wo7J&_WvKXO|y~%%v&vS=1p1`#qO_wB%Nk^m@ONg^$+=o6`$KS+mRUY?IKqm z7S4Q5y5j{4pa)f!G~ITpg!(RJK23HIkb#z-;XE75T;9xgU4gx5F~VcT=9a|xuN zLKjI~gdTi)c$fB4YGQ`-rAO4L)G$4eT71Am!kte=cYJGhI!!ul0=oV9FqMg>g8^e4 zM^%Q-FGqXIA-p|p&vG~s<9cIuN^AgK;*RYMt-vS~Ez{jzCRxLTyJ9`2Uugp#R*6+G z%=PEHVnht%hkE(m(4yKe>m_m$acbCR`cFwd` zUlRNde9^wn1Tqy={1hmM|1NRh23F1M<7BVN#gT>P>Vru0$T6t3T-faOvg49=wFx0z z_$nslSP--coyU7=3IDXbGO$wX zzzPoAV0;_;1-0VQ3{9y14r1e~sp!}!2Stt^GEFm$(ti?QHfx$NpB$~X_NFKb zKtaoJwpSlDC%j9GOs{;i=P^r|bY+$V(laZu7UgE8YL%=iTVfL_7u2~^q3@_@OKN5+ zhwY&2JmS>9;6k#)Az#()4~ljCaWjx_YzXrVj;vUma??15wC}Bk%G-KaB4u7BRn@uN zpsb9VaUnDqgCTk=6_LK##~7)m;*CfPLof_yA~z4ZKjDT-dj`ou`S|#@bad0*%o8`O z+fDcxdaWzGJ9?{>*QfFSn~4SZW^{fps|v7?Dd4SE}Ejhv@Qqflhue z7_2h8_`ZE7uP}|zB*Cf$p}$3-ZV7*|qn*96xxiB1b5)W1ATtLW+IxL5iwUi7`xsnx z+8|VWXlfFIvI>rXjL*aGcnA{6L3zUOR%I88hOAUX)=g2+uF06UQsSo z10CE_l)#;ew!lnXM;XM)0d4_H359V#d0gB;tm|gidmJ+T#3&S~r(P1(nCNp^VU2o} zw5KwechK2EmVIhod`Pq;n=hx^;Wf&4N>32(WeSy1Hw4eQc=vb3^Vx6>1C{Cw6N8;W zCfYE@>h#iD!}Mk_<>sed<+!YJM?Bb+Zb<{Wv%SIgWLWqWR(z}%PGm|WWxYz`nf8C8 zjWFcvyWfsfpA9kx#u|oR7yQtc{OeeDAx^#%`-c#$q}Hf9g6<;Ti0bDRHo6^}V*k(# zqtmjBYMPW-mtmLkll6k@XIDx6dM_u|7Bxo==lRo+gO>`hsOE=i4MTLHrEGTI${H@~ z%@WJJ8Yb^H4JuphFE6}RgbWYetcw+1sR)Q+XtRFy`SS+z+aGi$D=VY=PfFdI&pmqE zjLF5#jZzAtX6Mp+oeN=Z_^ckeaysjPly*(bywp)yR4dS*tflc52vgb6^vMnXY?tvm zrsu>5$pf>M;EccPA=Nc-rNfEn5Sg~xj4KJblb^6HK5vhBZH=Y$)wfiqKN|RF+HFNk zoNhgWV5rG;==0un*OWiXRg2td_b1 zyH>Bjab+C(KsIKxagkb==s1R)*&wDV8K8z}0J#=GJ`D=CX!75`HW zaDR73MgVz+j7`W0uSr+rL{b0sQSXfB=g&v~%YMV})5ANQ7$=t?n$k@wZa%~6XT4HO znrl5ntpjl`rV4A{tgSP_e&N#c)mL}%_oVpsV6erb1Tg`vGRM%`I+V(ww^1|dCv zmhAkV76JYCf*tRW?thyY+%g0242O0G1jAaknzBM~#Lvqe7GG#I$@^L`2@}3}qA z5DjP2C}?XDtC6;9t;4*s#t zu^sRmPV8agU%!EsS?6S#H_`gm`%nj{srv)s)Q-A;x1X=)#&(*i&85R63F|(F5S94^ zi)&TAJZ^QE8f}TVSSBgNP(Nal@p}PW`U{(&NJC;e*gJ0k*^l^dT7tf8f#SQO>URRJLN7{{Wn7%Im zDBYnav3iSAG`)W8nRBOjmGf(lmXp8bR~YL>Op~8+X(@44Bjt3(XpIw38quzfQ<9^%*T(5$pMCyYYz)5dhgbBa z!DN0vv}1j(=do!~f?%++vco8#bG+P)T-hp^ZVn`36gvaVxhFR-m%@ar*QJ4jIT05{ zm1a{H*VY?NN9$NfGLM-ZU@Z=PF^YvP0MT`WZ*=e{;Tf*?wAQDl>up0S(OVbz@pr3R z!WSMc&E#b_3tqFTDvBt3f&UmfpQn*DTfK%@8af@PYLTK^fNw2As ziK$E|>J2@PK}{}=nj0ykQ$Ice5~op{MFVx`={a=2Ho9e_1SKnW6mtrsHYCfLCBE( zO-{-c0Mh6GV5rGV^w7HT*OBIQ%>p(aN3+3O?`+{R7~#BQJH))#{-<5D7ufsj1yySv z(+pC3zpqlPc+r>Apq~HwLLu@J&Nj?Ran7u(_`MgSn?;WBquMC2$5G5YD?E{%k5puWbV*8FBofOPz zH{QQ1^Ue19;Qrh}kWN{s`K;|K^H{rSsIg0hCI!n@CFS(yG8s7;VMdM(HMvPrb8=N_ z8gspQ=BG6r04I=0E|7?6tCGm4C&aoM!Fd9b(-rpb)QHn0_WD)imG~1)kz=^B0DJEw z!4AkUrQX5|1ZG-{^Y@N+POfuWtHO+ZkzBkP%o>?1-MW>c@<{bCb^|7+#3LVnr@E2o zv1<3{x>Nk4=oxyl0WDN@u_$gb_G6YkbG_s&OKnEc^zi1f9z0az1)eBoH)N)~TSyhM zJ${zhDW3L9mso&@BDLWu!sZVQxARuFD-Aj&`#dRT+@K))E411MrzsKw&~zB$kM{MP zyQ>at4dRQM#WAVeYyE93@Rv$7%NMM3&7mwS)D!O<%ouXz98_FPh&|-v6fA3Lh)Pj$ zLRp`2Kk*ZzexRf<`S+skNNp*U_ZdJF_TDrrd!A=xHv|O(6Fr!CeOIj38>C}`S8*$A zgt#f4e_QjmhsU^7m|%&*bDXR#R+T;O}1vS%&1n!c$fLgCt9O|WxyEAP~4oRhP z;i?dyA?qw9vb4j<7GwSWYkiX7-6rZw##T_*#pu~}iFGop#BIZAZX6O=NU^#(c1F(7 ztq|FtH|rsOzsBfxjH2X;L7v#I%p2t6hu8r}Fbw6c=0v}|0NSe*NW$aiUpn;lR3t!( z#{=Q5sI(T)vs8f9@ok1>r{n1JGoZbJXdPGriM6u!Si+y6>}G*q3fyE$Z~1rN^1Z<& zwwu*&lb&Pd27G~2W{Ken!;M~u9s$i)z1gtp;=X=v*rG1dW?Ls zu7)PBoL2z4^QC4>^MUCXV&>Kq5YcQv03nmGRxOka2_AW?ac$fl5}vYr;M^5Xi3z0& zbON0=n;@*e@tlUwQ2X>kln_6Z#6Avx1jOdJ|*gQTR0W+iXJk%Hw@ zuW_o8lik#L5&kv)_SmJiY=?v>0xNO5X*zpwS_GaB=pDy(9m3dV!bV(0rk)dIT+m>Js7iOgA;fJ7F&BlC9lvKfwGl?88=LX{n#o0hl zVNrgjVfbv`6zdGFc1kZbyBb_h3b3yl%3B{%hBtleH~}*%l6DRD3|S7ej*#&YRDG-o z4(P_j^a{{LFkg~iTqFms7j1yJ@S12*tz+eDA*a+y!x59taD*4H3%5>q1Z|{fnWL19 z;*>weUd*OSE3Pw=*TlR43EEa{B8O21FRn5|YNpodZpUhtgUar2g{!x4s}MxTJLaM>mY9nh+(5PZ$ zCcjU^XEV8ZtIow0g5MY7*u^PZTCie8$n0A}roObVk2J3a(#jrsIQefeaz5Iya5L$D zfB`Yits1YK*PqV1fB|aK@0=r)vr(CVzOHwU&X2o=n1+t4A*GhNbpcK=7o7_70$>nH zVT#`ZAzfB1d!Zx>Mzv(w5nHBs)S`GUKHy(fjO*E6bSg<}Mp3mPnqq9>`duL=a2}QB zE`+$WueJ73#+mVYTg8JQ=Dxnm2ulL})o$cD77P~@Y@-W-fG#rlUR5s+psIMC+}Z$D zrADn9MUJ*pyds=4u~UYugjF0z_O7Pn`aQ*Lyq3aBW=-toZE5IZcVrY>8lm(q;KS$5 zLm%8A1)IP`I5|)qx!-6yx1nh3e&!3B_q$zrAJ1xcft8xCalip?N`xBXp^2?ALb#>| z@|JP7SHDI5z33Juo3ChrL{nZ@{(IpZN%#`aLs-Ec?HC!yng7_??{u0+QyKdNLfW;M zfh0q`Oo^66JezfdjzZ-)fmJaA-*Er4#xfs?xShe_2|eJK2r4dR5mzwCqm87VB6pumf-Rg!dQ zWcaGqa-?)#Y>|LBFJ%v!5voSbPEV53moSsFmf|+2Ke1*@v7yqSSQu-WcTok9;;@EC z=hEOuYPI1PLp3*~Rk1|n=XpGd-hnhzyRJbbpJBaWc*Pyof>Mj6w&RU=b^iRhX`-LY zz74WSgNcxu1(`2O2+T=B=1JrS#!RQ+- z`6})3Nf$=72*naeVDzK%rcw75`*gPbg;s}wp7c}GmGq2oEJ3ZJsa?}e`e}rnBCBx- zvme=T18+Nr@MnqVuWg^UjKqlNDZSmjJ+C}31;k2%`C4MYLP2lB=BQaYS4`H5HXDXI z7UX1BrglwDN;R8z4#jFd9abFF*l507d;Fwk7C&J^0C9H^f40bQ;Rb|Ro_1J4^nhY! zEYW2(LV)%cyWIf%B<6mohi>(WRk6w}s*~e)-;aAN`)AT!fxaLzVC=8=9vWCYMxB`2 zId4@Tqhf13f=x3-OA4b%-FVlcw3v^V1`jhjoDa!`*t>=;c#}Yas=u2*Obca@Di(=s&zeLNw^#bE&esoGN{@ z6|@O;sMxB{&@|b3nv!2J=9UBW$f=gF0YoM8VzPv1AgX9nl1Wn`P@D^#XvOiJf1Zg% zvQxNI4ab8C2#(qm+W7X>z6X4O7lrEi`?C z4SDxAauIcGE&uvkhv5r8@Vjo)Ag)9>;ivKdLC4=u9~{5=sw4S(KCo#TJA7b?OV<4wx7#sm zCB34o$ekRY3wtIDO{ttN68)T&c0?EKb{HfC%Qe|hqJ2cEa5?o|D}2qfsW@18?qxv%1! zc6pj_)A?4J+c@vD;-d`gi=AZ^0Hbe4`h_~rVYL0EuY*X6`pvFO#gDNs$o&N8i4Hut zB>f3Jqi6HT!&RJfkWmKssDroYK8XhJ*%OOSFqpQCY2C*4Rrn{a4@(0eH&6)<`fSFf z&QS@50{0idrH$x4Kgyp^O^1SzY-hJCzwqJVI>)azAn83wjP*H44lhkz{py}zOo)PS z*zxCggMU~6JTzzps2NAL44`fmD#fe1)rRxqxUIQ6UK*M&6-spSJ zXmT{K#@-fAc>KgK!km!$3Zj7q7S6N%Gj~v~oInh^SSY$9@|Zma2b=It8D=G9*# z;L5F^EAUQp?KE)~`$Qp7oi1Dab-7ocLpGZ%l!j{-_M-l~b!3*CsRaBlGLKP8s7--b zckcH+@io5l64xe1`woO_qgkB{$gIcleE4I%T6;!0p0%7sg~Zg+_E$wQ~>m91W}S62kAi%wJ%`aw~WgoHs!_wjyQGAm*)AL>KavF?Fv9GDI0| zf3@aGe)#S%p1R)@zk14B zoA0#(akI#7Ax(}!ttM6kh(Q>m%t&X2cS(s?Rk=tmEE=wR@aqY(C6v3Vpp$o$*K4OlE-x`W)8|8t|HQHZ4ZccC0tKG)b|>NRMQoDnvT)UZ zGp&o;kbw3FjjTZucg&!chI2()j|CY)1iVrk^5t2R0HB5isHAHOh$J^xV2HZ>FzZc? z$Nnr^GPbXSQ~!>UiZwhmBmTjU=V)F)sPtgw&pF4l3TOq*!eI(qCXlA9SDHvf)mp3-+CV?xZH`GO*H)?t`Wc1I zWo6mPu!JGS!9SD;_rk1Ppge~O-J_3%Vh;xc*IDp*gsg~7H6y(@4MtjyK&r-NuthXQ z>exEt*csb*@@~G3f7g$7l=Di1bI*lREHd#$BoQaZCNnz|=VF=n4*Ge55#NcYe zOAvuqW(Bd8$`X(04pyGK z>}l{_I27M+P5(f~7tRu{dg^)ym1TATqKlo2_E6HBmq`jVzw5*ohFLtUhMS^1%7rvl z3nPw&IA)8Q2$H7k1WrXbk{9C0H3VJBSZGop+`FfYlj*qGSWx3Q#;lrH@|Qy~8T$H2 zvCwrLw&`9L9a^lFtM#G*zSUhpM78cx=>9E=LTp=!q~kvn0Hl8HJ+~ZEywpj!L=oF_ z9yRD-#C!`abm|-TO~@Vj9?cEM^#L<{ywn^PZZM+zq;nP;ZZPb7VyGq7&5t0M>-7Gv z7Jp@zQ*ZKtgi_((d=$z+rhx8vn+fr{Dw3n_(n4dflT*-{pvGodL{|mXIE8vjJyo8N zy)P6ifHLJA^Fj8eY6tvf+}#}k?}^Q5*Krfq@EMf z&n3dY-yP)yp8wtVFV1eq1tMflWAav{7&PTF>~5tcQC5hWTMnm)ueT3=AKbjlH1p#3 z$z#HvtSr}?5cu6$yVo|pf1$2~+U^Lp@*eO$&V>ZGKk?OKKt-0Hwi1=6-?)@WAw<|X zAMIV~A>T^@Cg52o$|I-K0$70EAYAirHMg;(j z(!l^`Uk^|yHcIGnLW98mSB{t7KFwU=T&Q2Vqv$eu{DKadoZN$1gG^-PAeTzo9;&9n zNT#)n+lLPGg^a=%hS(RHF zxJ5LaIHv&DV*TS$Mn=?|Mmjq!4!XuA83UEEVY`#iCFSguTY5~XL3FEXjRQQ&zxi3u z>a&_Ab?1c$4~mr%npfLyQ~thc^>6{-5a*+zpu354DP(0h0I$q3f&dA=q(`d2)W|1M z(U)KA)ci&vPP2Hu|dx*tzs;<|=F zu(>v0Xe%N%$dQXO&OinaEi}LlYa!6?##Hy?P0MKsYRohI*J#E4&olV1r&Xq}ruDjw zU%lR~N_KsIpKJd%Z9n^e3i;lzjbDkjI~F-1R{OTgWck%)a_EJjMEP*~&S8eZKu7z8 zo)X&O#pJ1{9hG}5!PWb=iA!;p@=UafimQn!=Xm?&lVs-=B+7ZfA1w=Ht#NO&886~} zn;vvSq3}0=JFu^=QZ^xg+*Bb2HkyD;*n8duhX0{2>j(dNDJ>GM-t(}#()e>1G8?Oo zAw4n-xg^oGolV@hptGv$o6qOd{QeB-G1&L2QGclYH;&+Ht^>=c z8)UADREL(jWt^3O0dgPW6|eWbejj3h{e#aX;?G=nhTV#;E3BI;?5(u6_n_bUOOUlH zi9)3?_8p-4lv(A5d8X!+trnrg3U@&tfEK&si@OUKXs1NV|w6XHNA(eAfy ziYCv)W|J(i;Q}6vWE1O2m>DgYPes~6xC$voS8<*h)q*Zr$Fd=-;0M12u!Q0~SY)(! ztDHnD>K~VkGgE_CX?lvfL-ByiCgf9br`BbK0r8v1tD_a;uy~$RL)?0W1o_)pmXV|9 zitCk$?%){xj*tOnVJuec3|NmK0(nsH#Kb^7wp_$|36{0NKbM`nok50rI}o-A#`mf? zek-zVo6b-S(dC~eUlsP0&~}1SzFS9J9%X|LYmD$d<{eXR>CI$1@mADb9#jy-T13!+ zTOV#xojCFkia)F$@N`2K>AjV|9co=XF`-{NbUX>{T8nG(s1FcUE$r#VN{OKyBmaop zc-}+k8yEnt9Cc6MK{Hk>BeZHg?A1wk4{+$BbfQ$xWq}@j^!>P?MBQJVh9nJZ$Ho3b zU+f!B-+kS4* zwIa&75)G-ez^LkA=c}x{euik_e6n28xb|^K$B9&>TaVR$SGAg4t?5kocJyr{*Pfx zKfQ8;e|=}1Aj1#$y4s*@g5%qukxMr!+Gt;d>9_JvM; zoK3B#u6oK-lfuTOUpjVS;U1+NYSWkk5b@Pij{0H@w>>&Jhd3O5%uAB^5q3RT;Ru8f z-vJ0F`X$r1UY7&!hn*%8EN3dyRY`^{mTV?z4nWCdSTW#0L%8_&D0W(y3TPvL$&0K;yRfnvynw$iKMNvi>Gy9#DA8%B~{3JHr1*oUvRzVBs@%+XJ zT#U_@xLs^oKYKAQHY!M709Eq~dnF4`ynjW8-$I>kOQ+4EBmfd_*wv#^>?>K%9eX1U z2QuYjB+tP5oo$3u^kxT4N=t{6!|&zm_HmYxZ*wD;)v=GjR9UE_ERV(<4R*TPG2y;t z+3IIu2YE}J+Si9;Kh0R-zWzXaz&K-f9$)>|#(-x~O~Df0U@0jX`dpkAO5~w{0x3 zQ#10JC}&vGRIiHmG-g^>D}mPW>tow1FbnjrAe}vvduxIcXYVfP_zWUThFb@LM&Ly1mWt~cRl@nqWwLY#rNCaxy4lSN}#{Hd71w2 ziV$S-6_ zydP6_FBhamflYu$Fks6a@U*6z3~#jV>c-H{`;gOZ%ypopJvy81*&go~T7!q!=(h@l zk9K8Z(3?6G15SlDJz6xI5iNS_7yn;#2(cX~naZ+KK#NyJwL@5>gvW7A68*j@IFI7Q z6SbNRqgJ!?MXfr9a_ToUmeQx+Cd_x^e`4Ge!vuHA%-BTc6q`#m+u9Zh=r!&MP6!(S_u?dDPx#@U_{3m-;hk5$5#mrc`vo zq2<>iGs1Ll{o-TIqJ1<-Zxxfr`^OFGO?^yxpi#mst-`E|pe#lLHQW=z%2<$Cs$9iU zmWsr4zdwu;&d~VS%P(GSfz~hT$grca8&@vDtGhcyQ}{!W5nbVUKtxHn%Q9V=DxtO| zuHK`zS!_G^0apLBAp`r{lm^1x?PWUK1dr@@eV#yw!L10fcO`uT7}JXYq+SOwP&bY~ z#bnbEa7g-@>|pjfy0zqAvtu)@`)617)Na&cYgoHryEG@|7r5)asAg_8c>- zA-3t*VELGjHKjHaDl|fw%m|de^^3cd$p$X@^bWnaEwa{$ty)W3wjw($zWM*Grup|B z4T~O;&yH=OSsY4Hrv&nR8jVqg}IM6nBQkFON_)XbUQzszE2c zzI=zM8h?m5qG}uuh^QKOXRVG!+D8{ari|V!xoZtzUeDTj+x}q=({J@sHb2_e=2QCy z0>OTlf_H0ew-^V+Dwt-amZZC_Y1ZOF*;oPNPc(}z6iR>2&Upb`+Q!%(FdrBI8!!T3 zzCqI<^wdrX14o5MoZ1;-;J1G9{?y)U!)(jVVKrae8#s*2h0M>6$I=HYRb?qj7E`Ic zgG!Myk|j}5&ZJ0-FfZL{K-nrK)-9{*7mc2+emof zwGjRd+;7L?E~Vw6%?K47*v^1ZP)XH{^7YqW{)$btd0KUGNZrkAf6J+tpw{bV-9o~s zGU~)!h;}{9ySVV{x1a8Ug$e33fk-w5&uk5l{oww>;K&KbHpqFxr$>Hg^D1|tGs`Hi zvMMPFOY&U%=`1E?5>+HsOeTt}Bw_BH=xi8louN_3BMu>2W^3jlM8mIp`L(n1GAi#s zgJ}D&ac2+{{}oa@OsV6c8tD&(J|f1GH+Xuo2g)==f>X6SR0mCMy9n&ol1rvQYHw7x z_2YK2VN2C)Tkxr?jbUE<>Mz*)Z%Pa>D&#pGpBa=BSJPd?9K&Gc|p{{Qf=F?C-H3;PV>qzqfl| zaK9LP1Y3LKbbKNE;8neZ*TK84QJ>9vGA|^U_rmzI=7+;7P5i0j9hNq*)x5NJdE+Mf zRqw93u+szWS_1~1*Z$%1^JQ>n&a%eQAlem(RtAZ@yk4?CL+h^APt?OrFQ|Q5nuvyV z!yD18o~$u!*SvYC*OEZ>;imvxxF2xAzAG*QzW*TL%)DhWU2%FfG*o27dvsoKtWSKD ze{1i{l&Nz;`hMe(IMp5hL1I;}XGwpEv0F53M|hS-G)@F5(ljPCmYlGZrX&?S4MnJb zn7b8VK8%vh(fClm0z_qJDnNAHkqQu%_bNbC(yi)HF%u1CPkR@?`Ld~zAsZiR^k!^(_D0oBvN>_IdPy5TNs1Qqh@n0#KG zr%(K(JG8wjfiI5?;X<^wHrHvp*4*}{?X*iZbe|ZD!$Jy1@`6@`W+EeH7*Qfb8I>Z{ zsz{V>%`=P!&Cxi>5t;`rb2n4-VB?O}Jd-Qvp_1Ree7*>7{s1nm1;R>oeumaah%&;% zQnksnIv5MI%F^blww4TRmc#^9wN^9P0IT{Dx*nN;%3Tj6tIy=~ed$f4*V=Mvn~Og2 z27;nGdq~Vl{)ZU&0!` zgg4rnC2ic2@2e$YEwPrcQ7XfakuG3nr4$mm_}Q^1oQ1gv!<(H(#LhUgA_>fSwqN(uk8+YtUm|VmVl{6=z3noO(d9*>H>H^z_FPxVzm}l{Foz<=WU|_jj7?&FH z;=vu?d->OIUxeOunN!9R2mQNGX?VGeR{Q=xwXWf?(={b%4iy@4z~+@$L}w1uDvCmV zw&FC@_G+kd!ebT@p5>HjXIV)u-3M$Ktd^spTO$q_S`TsN0mH@}d%z}_TEur_*UQ3f zr8>F;_Em(e0jJL@WIevCA!ek%<=b&m&q(D9<30AJOD_8066oo7WV9}weAhSk%OI8D z!u;?@<1-geF5iesj5sLs;=+95C%K{Gp=rQev~h(tBB+b&(AtHqwA~1MOdeK(3_H-h ziMu$|>WS!Af4!^at)HAB2OQfmnIvh%tDIzU!L&mPHB_PNudIZAr6xS%)Xg{N!+^4U zMnD-VJNJNNgJS>|fW&<|L6kCA6vvQpRCO zQYI6TaGGSyVD!J_6a$&uDYQI#@J@K-BEn~OnldV_CYPWL%e%MFYg10)m^j24t;@GY|Y+%`?R};-Hp7fR8=p( zH^0L#43YKIVzFbAV9Wc`b|7mbLBBAeAl7`n8@^c%hYnsfMu zwdLJKqfeYR9bUscUCgIG(m!LC!s%TbQ4x>wxwWGIFOtsaBZV=vGEG8KDH;=+(25i} zFG*TdC0yhdD)f-f!=SQ!Mo<|lJ6B6!<9>Kf$|71~a!?s6>9MpO?H?_Z0>|Q@Qw#)z zn8c4RxTEg^26POhT6Vo1tDw?CCZEI9eA~rhVxKeWqFx?$8t+rmA-<&zwi~^KKW&>2 zScA3#epBpw*QX4Aa`%RsYpUVPt~JjeT)qWz8M03AuI_^W6X-vCeyIyxX`01;MiBW; zarox-84(X?po;T5M-Kh;vX=S0vX(ya|8WvICVl$GOPQBWMwbE5SuiigJk5B)HoZu~ zP;jl5@+{+oh6N=&iZc>QSyb@1l6icMVK87mBNz~sovW5yu~cK!(&S)3RMMlCFtK-C z09$|FccFO$?so@E6SUeFrZj5CB$anoL2J^-yOfcO{x5yV+`InMSN78|)-E5VAIgki zjE;*JwnuXq3ul#!4b1!a%iW;9b8xqIih)kvamE_v#3IHxBzgx?CJ|j4pnoQ7v3G^vCJIJOFFr$3rb1 z9AO~fptMl-_JBMvQMaIiEID_WJz`rH0O+8|_+Y|7+Y=DU0vTur{?H?#TWD3ljIHrztz-iQ#DdClmz_ehF4aNSt^N^TG~)N2p4pXo9kQQ&qXSEY?mp6U zp!Uc0Q1|L_S$kZI!fM}`l%s=1+E!v3B)#2_sjbt4?og2tYHME5olks5M*QwIGH|x~ zpZPp0L_=V!WFm{GDpQi>SxzX|W)UwKC1sf=X_82marcc*F^t12X2jv4vU4>AHttvr zF*yzom2|sKs92w*v=53f22Gd51n0kZflNi`-6aW_Fe`0TnEGB|Mf8<^UO4bUE7TGy z4MGOKjT1KE6)!w5ZHZ{FNSi#1r(GeD7kNR?=RLHpdd1UQcKZU4y^Z&Bd52b?P3T%>gQtzwC`uMuV_E0YY1brmq$0~^a?yo&_7KdP|{VehiR}87mMyT zS->0kb@0m)+Ecgn{jzTsuuz@j2Z|Wfhp9)z`>9p~-l}J}y5!8?)V{CCLH20Zte{I` z9kgSDpC1nY>aPFT;S=8d?e7??(+k_mx>9L{3yx35m_(_Kk4i&MRqkl}6&5{^-(v_E; zbl$M7iC9XboI+K>Bq6lolrWV*RlzE!$%v|g#V`o8m=Oeu%FaD+t|-Pa=WTKjC@Sf3 zWblsZRacs!3);3`#!Gu&19h#pX1z5QzYX8e5`Ft-dj@S}woN25(a0D2GaKj)0iACi zR9`!^o60sm+!YTz@P1U^=jY(ZkdBPKSx=8FMMXv&?s<`=KJn86zx%iy(iu{uYc_Q7 z4W4+ov8@p_7lKv^siH6?G>ru*XsSrblQ8E=k!GG?(qb4)TFeM0MP=t6ZdcUfn8Q6e zm=u*99i4`b&?RyFV9O00KvSp4_FWks>)`J8vfZb097K=w{=?8)=wi_N23(Nr@v`8+ z#X-e^_UB;<1*0VP^vsKL3tiJ~J=M2QFwip<@%%@oj>6A7=V8B8OlO=P;EIZj&>8a@ z$)htD+N8}&k&rNlZt_Y*gjW?@A*wj%+PJNh=Y2a27%gT5jH0r0kEAOWaLkdM959MX z9<+qA!QP)-FJLs}wJ|00AL~DMwK$-U`;M7hHw)Dsl;n7R2wn$&Q)(4FKZ}7mF}vIh zdwvF|6KG32Y;8Nkzc^gTnK?Z!6BQY8X6AKc_lf`W-?P}(2(H4Eb4B8?l-g-6!>&Vn zUeK7zD9Uno(ZFID-&xFv??h$i9_pF#ov6J3P*02RM8*DVR{*UuY>ykX?Jg?wsL5+e z?QEB(R(5|EwOTiS)Q|966IX2t@ZPVR?FxOPO{ofq3XM3Q^FkkfsfVC8)M5Y2t|b zAN8%yp4AShtD*C3D&E`Zp&w2EiZvy)o-JnlT3&4))=Jqsd9^h4bDu3u+w%(mz3tzs z4F_Rba;%z7*JpS2@YF&TUsGq%77?^z;(AN^OtNMRCHHN8kX7@;QgUj&-u8Vi>%;ay zR)InLv!&{acPrCl+BTT&J0W3D1-JG;8tWSD>qm+Q=o13%!yEJUnnGwO1$cU#CMq&Q z(anp~^ojrT4H0Z>$}FcU7hrin$JwZeNKwWi3CoJoxJ+r{2}>x4(VFFqXiZdhrW!=Y z9jOLUd9NBoC7(I`$2B1;z0-vI@C4kD2&_T!;`VJ{!{NeK{{uBN=?38N0^sLCM)}aK zL051@)cK3=~L-rF-K8xys+f`ex3 zZXKyRI_Uj=k0|O7p8Z5{KRq(9oDrG#*)ek};j9@oZb}sH`2D_p1e%w2Q-MnuVOu9#Y7Yb1|eP_GfjS~dmcMYRn+(z|rC>JkT zqprj)jAZI>VG95BkS|nZ1n}pDeEG!xi6LL;rf|U$9)*g8RizzXrUYRk(l(!mdH{BkpOQBS9VJm?8dOV}J94 zUN!eSmQWgaayv!RLRB#M3Le<^;g7o!IZa6@ zDo$vs4^a_@1qoB_=CL>uW#TzM!#JpNMjR9>JNNv|jDteu{pV*|9272g*d(#*OlXqc z^>*~A?VBdrvKU?Yi#PpS_2%oH6>bBhHOqfg{KEYky@%6WlLKJkC%dl0RkS7ilNT#z!AjL1Aj=NMg+RolqvogC=oo6nc9iO;-Un#;;TW5mA8n*M8_NogAj%i!+r zy5o9|*S6KKz`rjv>R=mx54yFz4lXx=hG*9w?w320^EG%CHZM!p4y&v8t!21^#C5nW zf@Y7PGj?eg9GcJF-Cklx{`9CNRAj_~pI4U8Cq5%Lv$H8qJmuI@DvaBR9Xmp>_yWG?@_ExFql>m$M-0UB>F*{>Pl>mv#OeB!M{3UZ&36wU9s$77g zLS>g)Ir>aaE1!*>^3CV9a!elZ7TVs-eUsdghd$)8Q=GQL{nM69Ox4hj4vKvs391_; zKymgH4Du!r)}a3me}iVk-!`iQG<%eA#Y*-_f`QGSrRg8VwEYDDodMgS@*px}tRm*) z&lwUgRmT7^z!%_L4zB8&uXKl1<(uGd#+&rU3Bejjc0j}5XSaTm_j4Uk-Y7zQ`AhNW z(hHh(=z5vS5lN!I5l zl0a83jmnS~Sx#6Uaza}cl8Ux1Nq82QaY3`j)5fN>fotUg;2J8s)M81sqylOPd8RQ1N3Q0jH#)Gu+(< zA_#e7*LRQNL(1#)e1F(lgulAHOEsuA)!r9l2L^6VWT+}OyMmGn4}P~xDf_N>axm#=Pn}^iwY7aRm3>Ui>!3s|3#sNoPr|`C zd$!vXVZ1UorLF_SUe{xVLip&8TQ*$CtCCW5zDnXVmvP!eZBdgjY7;`4*d$6?hyyjN z+K@#pYceMbSrkULO3sHH;j&Xz5|j6-q-$P8C8yDgLH&qOA9_8F{}4_Pf6BHiwZptQV(TMT;?{akp^A zB?CxvB8FN$c>!)u2t|SB=U=X`pY31YJF&|!g-Dh?%RgKh_=uH6h9s{hkA|SvT-eFC zT}deN`^(<|e+b~`?O`t?1@Q;dc==-BnO@6Qq{G!8Uw`X%o3-vkrG^sQQKyQd>_x)N z9{bX;UQ)Qk1e;$3wZdo4qoxkSx*;?vp*=Zda7$W}7 zc)j*&xS{*S6d+u8;;18*^653W5b;JJX0FDK`!J2wh0BmtQL?ZidPFzrb9<2D5)-U- zQ4dml=Ca81Hc1l_r)5MaFDgY^RZ00>~yp8jewXH`p|B( z!o)m4Vwa$@ppS~fjmdQFmffoz4@^n?zt|<@EvbwZ&C1Aj^AcXX+8mmrQWLRJ!5{2i z^snB_42xupV(jj<2_dz#?qk0>O%{bezVpa88-*lAm)PEqq>D25l4jw@7H8v~rOLs+ zC_p>x9|)7mD_OR8n-yZI*h*2c??p6E2~SE6sHqUft4UMlWs+r8-MA|QqA;~Bbv|ke zmz{2@z7Y^hMIYL2shF78QqjjWURa#EfVMzuwtCukbsxM16H~o{ zJ+F>l~>pLbbNR9>jx|boB@Zz zg(g_-0yxyIW9B>!SrxI0gbC0;lxagsD)y_oDC4rOqA+hf`&DLJ!FdSp*JKP4Jyph*7-jHoI=nX=sD>^Y8CL`Tfd_J&{wHXG49Y z=#nky9|84wxdjzs3*x(4Z1Dt&&hMc*!L;R+sRz=S!{sq35HUe)y^=U(JdIQF1t%0j z#*DC($0UvtR`a~7qS&($<+cgV2L$1=(@oGf0%C&bL%U7TLz;w}Ao`g9G!w+0$Z3MJ z`%p^J{{uFZooPcYEFfY(*vpo@N@>Fyk{21=WJEP7^MsK$sj4tc+PZWz1x8_E+s}OL z3NAa{etaV!_JcmO+kP-Hul;x!ipF+swjDjQ1-lg_d`fbAL*uoz1hVQ(0b(vQ=!bBj z2|Lyz2#8nwKk1HzGZvLup7EB1!nUAnvmvaCBe89zX-Mm^E@Ee6wJ0oYi<=Mpz-6af zoNolg;?Re7TO1~4S7u)Q?GME4oE;X02^sE8ur%3yOzc3FSoI#dt;$8Xuub#!ZEzX< zjqfTh^zHKQ8B=@B9uf)Xu&prEpoJ%V?H(;fkTXs1U&#U^2azCx1lGS@7hPJY2CvavYP z0xS+HJKZ*YBOtbkKD665F)?3!j6dd4Ts#EBzg-=K(i>YH!(!kl0QQrkuEdbXKJ@#| zur zX(1_p3MZRw6xkS*XaNQVm7T8Zz7Y^zM<3d)>zJ5V*U`s3bp`}<2BL!4I8GIu53Gom z0V~j%Sx)mhNkdXJv<5=unv@A^Nm3?FRkJ*=sYeBEU`4b5Sb@q;SHXF}3jCqnD(C@L z;3|j-4z)5vVh8Rf%-f4t=9~Phal8f*_^|2ss^QP4_jflcGW-9=z8v zwaFmgX%PBRHVN~&Gni#?p$Q7V0CaKdn7Pg?#?z`L4Qoq6^DH7|oo1vhJS&`o*3Qz!+z+|q4>W~K_sBs zv)@D2X#W6C98=^u2nJMWf+8>CQNd^Cl#3uC&PdHuDm-_Uk*dlnQnf5ftEOmkHxE%1 z*@%E>0U`jEovz695CQl@yA^pZA^?9(Nq7C19k;HFfBO7!tW*M*4FCaih|{WW+DF3Y zhsA>E8vdyvJjO}CdVh8I+B#4U=U_P@#OH87%GVaUz%!(R6bzfq7?STF07a{6opc}` ze17O851HCPpi3rD_sa*rx)XwXz`Qa^0Qz)d(}I~aeo1`n_;Fwrgyr@lfi`S?y($3E zjEM)h0+4;gIwk@BtN?VC>6)59rKkS;Bo*Dh>%nNN8Kb^|i40G^Q+NX%^PG z`wly@fe+CF-~%c<-Pq>=AMl5E8~a?~1OAw&P71=>5e=M!RzQU&XyBrDO8Cqy56e2s zD6|XZghrf_k|&g8c~gc_#)_=<#7%bIKU$FYM`fpL;Jmy){?Kj>oSXN@AM?a^b9az0 z{EopLxqb1dJ_5dU^sT!1uTgGQ`cUZSD?a!p_@XE;j=lW__+tphSknY+{ypH2K&HnP zz3r*_2Vx&J7c^Q}J((sHs=d-dU+ZoTYe_CP9zkT)%VrHCR&j@teIfO$$ua(w;DPypL|_Bj=NOG^Ksol<+C z^n55ov<%AN6F)C+IZzOiUbr((HoJSa*0p(;l#Hb=M3%A;yU^w6!-xT5%LKIVMHmC? z7F0h)G>5&nBs@*Trd-zm0(TprjbMltAQ({D*#?L{%mf3(WW5GBX;RnDjKVNX);ie3 ztp)6OVlki}_t8!y`J4wHOnK0OoVsvups5*B_k`1r-~ zq5In`UI05lWoO$h z`Y;ph7L)bb?W9TFRPOj7H;P;7e;qb^28@wAiP}*YkZdQRGskvkop6I!{EaZXy%1el zX^()jlTfx#H+P@qPx9i$T;s?NpPS%Y$G=;_tg_`^Cbu0koScPGY@;*c1?UV^cDDMX4>LjiF6Q)MjdV(FHlUirG&Uo8dCxnkp}3cf$6*%bB*}`5P}WjX=4C|MqD)fOFtJs7 zZdh#GOS}O0g38V|Q}kgbm?Lo>9_0RO@Kd*1ecoII*U*n|FIW7P7-JyQ_weDIx(`vJYzl%?QhTbHvpdK3jbrD=yggWq>*T=v5?fV)&C5HVE zUhi*(X<(){l6 znv; zoOkNn%Ta8-Vz_;QyO&Jfy-=PIxP2k=`bF=@ZgaD-Kk)+W4=Q`ExuMO3aC4j6@yGGP zhBZ|qfd=yf0#!ULcEf^nTzjf>*T8_Pn38`Jk=jbkE`EFcQ#_dHg}R~{0YlbaC$D1q zy#&9l*|vY!04RI23SM3P{i=pvy@r$To_*zZ##53jYq?&_0lTr5Q7wChHiPQ9hUa;C z12o7%XfQxT#i3RNIuEkelF5EV&)Ad^$1(?{g9=S>Ez3|k=*&qNv$z$9)&!bsQkIJ2 zYm%j;E}=_xR?G>Gr+efw?;Jd` zef_}u0k3_k+56D+ZY=b{)c5S>GPuYDBxpmA;<0i>t5zDcJ<%Fh9ORBcbNEGD> z&)b-m+>?H@5iaopgbONruJZcFL6moHKNei_`SyYrX#jt9G*5kH2hxzBx7Ii`MF9*ODK5(X-uZX(8`T z|Lgz(yLwVR*vEHz@f3<{oZP*?HbWszXB}U;YbTkHwuzUaZG7VYyr#4GqSQ&9v#JhB z9zn%4EizJ+iTGE@qatduG)>(3z{G~vBn#j*sO*`3V!}A5{RAqA)A!?Z9i98|OC86Y zIzTg>n;ZV^at|2@Q>Cg>>g&zs?_9HkLkAA%tpuyIQC$v(OQFNs*?0zh4m7!kO8Ctz zS;lmM&dg{THEm5v3B>kPd{P{!qMUHvh9xcAl4foen#6{jppQ32mnT3@Ch4+&97LDr z!c0)X$y**ef<8?diZ_`_Q%n}HB~?#qH_naom2JJLdR2nDAI4AsH|$f8a2)IEWR6`XJIo{h#YUdJ3EuC6?P0Hr>=Y%n z*}BE)sgb>52iXe|tkz6#uupQg-SKZ5IOM5{K`5+PKgl3hr4SEIw}1I6e}O_l*<1~= z>p8?8sL%w{UPkPJ%2j!oW>HpgJC0PJlL1oW1 zZT~okY0rhK;4>a=R#=uE75{xOrQf#=7>Z7CfWg$Tm@0@AhJ27lFs2X>^7HB%MeJpg zfedaPfNw#kx?~3>8O$07(2Frehy;FO$L|l&L~siSK&Z7sj9?D62r4we2o``>KKRAY z3M0RAz9n!)_2Md%sMT-I3nbBHp-m*&cSsYrOdL2xG+Ab>A+(@j(efPFcia|gBWscc z$Qo4kTnqJ&gIMTXGz~tZf7iw5)PbM{4U_e?tcO;a!xJ4-vwnabt7cnn*EqfUzs)zX1v&o;gRWlBuuib zF^x}r7OA7bh(2!i+^UE=(`>Od$u&Kku-K|1lxHDfO~FWL(ZjjT*2d^03otsU?73!( zj^h%%b_jaS)-$8&2K8?r5ZlG%$DLJ=G*T6fv==*~WY5h;|{HZj&P*+THJW zH^Y^XGE4D@#vEV6C6S!m$`(LIVdTj0J=)Mm@=pKCL&RbWa}86#Y8BW$Bp^3Xyf;b?hWS42gAIu>TLWL%Hgk{ht zpSa5-$lqzmAlnI#4ogGCTsyI5yF(4QZZe($5!4|1?y2rwL{eGVNgGPaBIP8udKbBE z+=ekF3t&vB?723Mj^nd&OweoNo*A``-|{`gfL|ok;Z(zpcaEXJqTi}Bx{Shg#6A!N z>A?d%x_zcFy^+mcZQ_XmOQde6pXIH^f#OZ@8$gd&sw2GkOw;w-6?+QSda`k324*h1 zr;nEqM`sIcW1j;wLWL$6@&cgI2fw&6WMQKZu=7G~{L}L-KE2clL3u2&IWUNDp~B5x z>NSUth-D{w+2O}^x0U~+z5t@X0AhaumlY%1%cw|_7YrzaH^3G!)m`V|vyzla z+mgcS0^#-sHeM=OfR{pL&-Df#^b+n3=HjJ%Gx|;qnD|E(c8dW2e~IWGc3~Bt8*`SB zVvPzJYP-4NvOL}}WU(n2%99G~?a#w)y^IT<#?!wUTa5)JEx}OIf?4()QY2Jpf@Lp5 zVWBhUP*MX0H5nAt(6$gJk+O!!ni`F{cbkNb!b%pPuu$1^O#&UqXA+p;$MHmn*u->l zq2Y9mn1`!@5*H_4Qz?B^+qsh`ZnIrU491|%FDg3$h1i0&{9Td^StW5Y8@2%+*wyB{ zalTpx%+UI%IEkw!)A|AqF_QC{h)|IUCbA40GcCX%w?d$+atm^^Juj6I0a!~N5U+GR9uEays8(~LJ zul4Cz)1RDpjE1+}S`lU{Zt1IrDQ=Z_rWkb0rXd~x|7soEBr4?h0dyIAkx%@L`Zsl- z^_{O)WH{II#;T(|ZT9H9(sqQdNB+7g!4l!Pg-8=j|i8gsYV+t4w(06K=s zo@@5_m*g?~dCii1^O+==%pLI+V(@Ugf2d`26+(xIb&j^{XBQF1L1@!~MhNpxjMmYGqfO`>uX*J{E^DjxyZh ztLU=m`FJh5i~-3fe%5WZIHs=2@EOwU?~jau(fQZY=+YFL0+c|?OPp9EDk5{9kkX<6 zbsM}5D5DDiWvJ}A2JeA);RZh!Q0AM_i+)B2&=3-KFX5noj;uu3tn1txuvTeXk^%dE zAOsK^C62Tfd!V7^)_~Gck#xHI5h~-mM~EBPdJojt`ocPZm_SGM`c&Mlh4%w)3>SUZ0q4SJ#rKu@Ubxi*N66R({op7?a8H(uOICal~+sz?vX)Cc}l!@D$&K>TP!F8W(UB>h2h-V7c%M ztD)YO!)r*y66nCQB3@0>Fz9lxJ}#f|awGqE`LC<}U;D24*ZcinFU4619^mxbAs%E7 zUlJ-b!GkPo-i6N0sw!hGbXG0mn$Wt9NRhM^N#e3)Z4+^xx?5UP8(TydV2e=Mb1fDd z$8WLoByU{L?l)9SbU+G^S?HiW2&)}z1?qt06^b$!;AlVMGZJRp!iK4c@Fa}q$V{wm z_2TPUZ^X77g>e{XVL*aw5h=)BR&2l8p2qnwqrlz;k0a+}f#|YkV(83u80Wy(M_L+E z;O{C)l_U*G$|j3b7SS?uSKm+@i9;74aZuTFEdm?IZxQn(Z(Q$v#vX=^@r-gutLK&J z=4BEIM+G-mcfY|7EDT+Mg+XP{ zwMP%M#9@!~ByU{LKCQ3@m4BxXUqc?>uq+q`FE(soDq|=MV^s24UPnFvDWBv9>)8Do zlKQ73M$5jx=n@W@sO;hKpM-&b`Se<&XBD^>j*;Kk>L4RntKYbS2&l>6LCqAV#N6z5 zirFamVg-^TTf9Uvh*$pdNzWNH2YHC?<<%;1wDi3!-I4fSg;v;d_EpxQs|~x`UsyTT zY6ov5kG9~u-~$rs3wMEihiYXH-{`t#k!$pUJa6vLF z^Wh!9B!Bt*`QxQ*iQ6lRPn+2DXSV0x*;DW>R`*gCCP_SpjbDI24~;{CW1p{K_s4oe zpik-AJn`?@Yr5$&(2r02yee6!KGIy{#9)9b8wO9>ZYS1#wL%a;=t4jV3-l%<(40(> zM?nb-k=>FsU9a0FZ3Ixd00D%`&b3KwyzARL#1!YUN4ci*BoI;2_iFEZR+##iJ`iI9 zQ;hk;8dwUu9M?92+h9BU$z=kFbpRhL!(&pK~%v51K4$B@cqUv z;1RDU4kzLbVTukoz%}#fH}T^JE`jxp`1c3+rG717B^Gb0-%hU3^Sd^Ui|F=Zd50}d z0WNl21|@Q>MC8>gf-JFtep9F{4w$N^EteEO!2a0PK;eTz{L$~*>BiWwrNRLg;8E6MOAY51$k{zlGL{&Aeyx&2a;yyyd8^WV{%6e<)VQ+>`mAe3li})i!RGrq zfcO1t0429DU-u0VRpWy{0`Z>ox)t{}kwcfoY4!5~Qt2{)lu!JhWA)f_u((KzHZMpN zrjI>#LSo$)1kMLy%)#iM-@{2_E%7^3KlHEv5@q3E)$JT&Vdpo)!@n`V zeJ#Uz`NWNVi8D;kw$iL1Yu{hSc@jlYh!_d>K2Tf^U8xAPr6QEU5j}4xf$DNYX6H5% z8?BWtKx?70bBzS$DRLRfT$(CW(ClvFsQ%^Z7O@me7^2%h^m$WATYQlArX$XgYySO0 zY)`v;)hlgbv*bkn<&WXRA+;OEHCKA9(~xFsR7ir+Z^@=xvVLqt$IM1*)&jSH^4*<)V6!^ zYqo2KEqF*gTFZik%yU3nxNiF0!7>6XpSZs_rs1~x&erz739H1yBi;ggUEvw3I&Wf9 zClpv|V@`@TYQ&bxle*xnt!vMgY9qzc1xPVecCNQT+qb#A#at#TR8U34o_*De78|=f z8+I6TX(cyO*y;P=m6)J^J#4ea)a31a%w<`DPjldVvb6N^|}1H%fZ~n9F{9wN&RkP8OxPV{M;xVSjq;bo4snhN?KrE zkhwkZ;pehuqKgyOys4r#BaA~2l`^hKQAIf^LyL18g4waqjWU%p^ zPG&9@7Aj~t8Hh<-t_B^#3QAN3T7UY;+;5=^gYpjTm|h@4kU;bf(ZSXj_p9}0h!}LB zAiU0wnBsmDD*S)HUw``l!RtsDri%~RpWWl(aqxJ$ig+E{1f)cqw2SJsn*}09T1le~5p|tHWnv zGQbiZL2`7;XsQyw`rb9dL#?{UZm+Prh;Nz$MZ|U6@0*rE5q;uk`6lsoN%|70XM=|t zP(f!y5Yc66SzU)koe|E;l+cVuq>So@v@9%nnkTHO+ytDd4M9v7KoC*cxn2ny@BPOB zipUYSgua0rUx10(P6^9tqR7WXCARoLJg=hTH3UJ>aZ@7^VODH~sxF2L8JvU6<;8_#W1b1`riGXlCOkGxlU%l7Mqpw}AK=V={V9MC zsJyrdt|i^%Nd}@{9CJAgYCcRZT?Ui$iJwmuYxbvOd>n?Y!CqYRX_N#gBz7JJ+aCD45fz=7QGnS2tB(KI_5;`0~&VDb;2pjA$qufdiIg zNEtJ)4PWtl$t%?#sx{y14xegndC3L6uAhHOp5OSN9T3@=k6Sm>cDMRB!PS1xAEAV0 zoSwl=eDH0vI*4=J_inWcTGp-L9t<864u+2#g>mso6-UFmktS90l&{uGt0bOr?ArxLAjuGeJZ<}Za0JFS@UDzatHivyB5vu0? zN4FsD^h;i-@@WM_@7C(G^?(!AXwDlExLtk$+FCP=(7L_4=y}yCB&ywr!Q6%m2ef~U z*zp_~7p?<-J6;Ck@`;~OORCBMEcDj2&=`I9reLx}y<>Q#!4fVS+nm^$*tR*b%@vyy z+qR8~ZQC{`=EOG6+I!!7&j0m%U0qdOtGnv0dY5qn^sR;XsNHUK_T#~TQF78It4^B zP-36HA;0`*#+}CohlkleB+?&xzX~H|hr-^V{f*Dy4T;kr4>{`$&b-diRm#rwe=nWa z>{M(cO;D8KZGDQiTEmdnjns^;jqpR?hgc`??4}v@c<+zwk`Ur4Qcss&F<$$AzudMe z@ni%gpdUT|f;LhfOI)gYf8MS4;67;eBN>}(G zQU~|kX2#Vaau%1{orsz1pemrX63-7QunahU!r%y}(*YqB1)O-o+3>~v5i;n%q;@E! zU-=kP2MK1$X4noVz=LnGGZQ)Kf6+bP55r#qKY1!7k-y>XjW&w zH>1i%BMLaLx2rYOauUj@s(#1<*%tk>G{jL>%e@O%BpAZc%_bQAS-Gx`S>ivc?P{Qq zmSmqBa#_00a!hrc-{(Mo&l?G#V#<5*Lz4`65;cvv0M5H4@_Zc?0IN$8%nf|I-V}p}A`SZ(!hNmbV z|GPQ_$ZGmWp|CX;a?fMI0o5$NN-m#Sj$EGFG8>h!o-X$H7F$f#Jawaz?m8F-HZahX zo4GtZ9~f8&>)jDQ6BQA(N!Er!FyhF=w|MHRZjo zA7l;_nSX!SaNz*P@&DMo+&b)!vw6+bY3@h#+%7Br^ZZMGx>j!hGrGNue5?}$5sn1w zx+$v_R$1pIY7yQx%#GpR7V)~Z&q9?8Ow@n$Gd-fo;R+=ygI8!dTU(}Zv3`iGU!Sp! zYYs@Of=-2Fb5k#7CQu#8iQjX@SaI?&HqLvjgSi0P^;R_sX9up0LU0DK9Dr2FVTQ4g zeay9GOSQWm5@>W=f+`k6aJx7IhShMmsGmPrSC;wJwH}KT*d9}06>UJ?bUTOC;eIsdlko+l-UO>F{fgwM zg;lh|2@hOkaK`&eWAy(nXkfiW^TVpu;}O$yj6T0)1bZhvYVs(&o1IdzwU;EY@j90R zMTaz_)S@&;B0W<-)W)x}KJAAVzv}V<0!aVEhy?j@tIFtMhOt7J}$i?D53cNSDF&DiHbwT&I#qtwq zaMym1r3vHu?E7wPVDs|Q@hC+x@Qz2ZR^bE6>asu`#IRw2a4c88fbH90;7EUfIyMB& zho!a}AG~bqW*unkD;RJXF7K-CE29%Nf{U%$ek2U(dUL5zUX?Enn194ds}2+L)Fz?EaaD z6H_tkpZH6pHLSj!2BF#y5wql7%*5i2nqoCK8O&fEG@(18eFQW=yhPw8$PzJ>l1HQ= zG|KEuS_>jy!OBR1Vy!t&6|Al?E7@Pf%6R5ay+qThPm%^a6(h^?9k-GNIpLISGi!U55?AJ$rRV*Jc@YjxkD z>70ZA!N241^Xz&Sbx5IMsLAd8xZ1>H>PrSBPs(CIR{7Y21T<1B`3OY8C94Qgb_%-> z4S3Hw4nKhJKIZCdFSQ0m5gj7;kHTf!ckF7xB{Ll(;A5Ts0vpilypL`W_s0eMbqjm- z!&-c-mXF8G$C=pwrS+t>7l0y^_u@i`i_RO~9iJ{X-77>ek;y66@Cff5+=6K6JlK$E zr1dBfp-J2#1oc5nS0@D<6N%N4b0oHscXqsN2jAov^a}Qu7^ogFN09tgFmsiGb}W#3 zAx^x%m-cz|99(Pj7#%{-ngOoO_s?(Sd{;>(L%0w7ChsIe1owe({^UA5kb<`Un!-?R zqG%|JeY8DcF8#5S9qQZE@dI4J5coXrA_dp~*3?c!VebKoBETpatB0wRTUHiD6J@1b zObyX)BvbK=D}ig$BGYMO;pFW7Z>jB=Q4fd{u-mEG5})_9+42|0KRmw!lzREb->V*~ z+PE!+K|F;5e*PS{l8Az%gvX&cUzlr+JV!m@Q4|zB-qfL~pHyswtft^ca1UfDUa!E( zqr=uvlC}ha&tY(PPw(;&U=1f7a8&_++pj@km{2D9CJO@Ud>Od9D+~4aj0F%8i&V1> zCs6jJAF4ay2%vJkSwT&|TM+DS`NP1!G4Un>!g-5c>qfkBs^))wo{N#lKjzDXV|>)hWfif~o%JVBqZCh}E)YZpke-gCsE=D^ZzMUf#aU z=)Hv@Z@t}^JNWtU_r%aRLk+6gNkDux7}UGK8>XEtj#%{@620mxt#Hc(I zFEySeZ1u^n`PbhiI;E?GCh}MJBnbW$x{hcYj^GI>jNaGiwwWJy{+TGdy`1g zjgk(HmujwCB6o{CbmE6%41Z4#A{fG)zZSwWgtjMO#rDuH_Q*(LlOq!W=AqS6qGGy> zvlpqR(a(-s$8F>Fdq9fACXmQ~h>+Qfg~NOX$=dxc23$j{Fn=a>kcjJtk=ql6q0*dcXsD`IRzl2Z=UBP6k$j%#bU?fs;_e}K zt%P?JI`7qBV&2kP*Mmqp1JSMFSzR=^@|h62v;Y$7#5z*x{sToSt0^mY+Q$EA2x%HJnfOUu8`z8e6DaE_ygo{>#iSaR#nTC=Xt3?H!{!n1!tE*|fl- zfC2WdAW$o-;@KD;15&!TnR7g5#S?HcnyUAKx1<<*{yGM>(c<+WCIJ(AMI$#|1g0aHOU0NrvOkNu_ z{C?7{xH{;2PbK_eC3Nb^e-s`fzo)wNnjUBjTDl8t+ff_hlO0So^;iM2Yhas8<1MU6 zD>o+J@i<|BVYxN*XvSAb0%ny}ZBX(GJ%5g3JYHPz(J=3h_g?IJvty*g*h0j7V4e-+ z59k+;FAsN2r4SJoe4nj;Efb-Nc!tUUgV8ppoUkV-gq=QbE4MyHgBj0?Pb95UNgSSY zAvdOr;_qzB5o5q2Pf%JX(Q=ZxsTQ64W3UZde-VAojtVIXYeBs3q$&^cOAab1gu8<~ zm>!t62EL&hJ%IM4X=IB$S8r=Ym^o3BuV?@h_@J_`2p^srbWmKA9yAtSKuLL|A)-80 z=~*uqUbQBj2$R+o_5``Rs1xC|Y4v;q>++$0_B5D=cXRpEbuEmzhQj^?x5p6?|qWxwV@y26;Cx$c* zuZ7ilIB*J|=DZo=*PJu> zoiOATh)OY=!@7OCtaVS{pCw@hVswXk(k-xB)$m#%rHdqndMM&x&^=`;XlysKDJ*r` zXg}b2Gt}s$%zz(-%*yBkew1ddipN(~W~6tP7P)SF748js_#ONM+4r~W``5wyW}bn` z8^_PA5FmQ1X%gVLcc0T z;L4b%rH2bd(4#H2mKzkjMMjH^gc+AB5*!~Hg}IGJ#prOnF3T)7TI|r#77Hoae#s0p zbWtMK!sjxDzwxKqoPbV3dI;&dwNRLldD4667h$Y!lBq`@gHkM((Fo$R1UAf!uZ`Hd zy9Xe+hV4_l+{eN{f^Mi79-}Tazf^HCRq3xKv%NqU+}l3?{2-^rad9uq_wvS|B=<^R z9`Qw_?<|IGqN!mz$WHPV1EMlc8WPR&+L-0_QhD$>Uf%9*BTjepef8{nYJWS=0(kEy z17<{h6-=jlpJUGzAC3kKe--h;N$ZQ4>(<|*t*ElYHd30iVT>j=Ic1gQfYM`|3OTN? zQ%1&|vd?=|%j?=-x50=EZ^u;i902Cpv^eyTRlO!WM<+?UAM1~mAfi9@OBA*A?2*nt z4QGOe&nHHTr~@UOu(DN;vfY334eKw{TA8V8ft8n*|Ar4O z+8#7S=M*UpGHpHQXX^E@J`9^KuRiYzY$sNTo}6isvJtBlpE-Bj_w-5=H#T0~IQ;ti<@LGtfb882rr$;O zZp{tOBJs|eiGg0`UyY2E{F`w=y=)_4snaU(d2Y`iQfKc}ZT+U^yjO&Z&&fVw4Xd|} ztCs^CGs6&T(#qLqA4pe@7Rl8_SI^7+5Tl%GPKWWNb}y05!EG-+ZXuFi)jP$Kf9bIL zl;&pEr5lek3WPytnG6x^gP*ygu=ro{ZM zOHurk;#=G=DAdH`Z8uFmFR&^qbUJ<>)?DT5jjqc+5K2B{MWL?Exd0GNBbjvI93;VR z8JiW_>jfmD3ne=4L?86NdHdYIiTl$^5AVIBqeC|&ReeP0Y*v0`Q+o!6#b zyDa0U3K0EJWB`YH8S>M_6i|Jw`I-q=N(z8QzQtIJT(V8&=-MTh+0}>Zh*PuF2ZNVV zTb=WoQd!j57z=O$bplDtxunJ?0b0Cw9D=d}N)uf890Gne71aeMJz zp2lii4S1C1@?8Uo2Cqv(%05r@9jURU%;c~?lvztd2Q3WJ>da^yxV1(Z%aC#`{|?gNi(%13~B5EHxYRN z-m{go(`8bJrd8E@gIDxdD0r_@dZTmY`v$AT3Q{A){CEf!fv!kc|0`~DI%!$=6e-If zkqO9r6yVDA+!8KpiPzjHIwJ6?ejT2)9E+lm^x!R-YRVEjvzuO|E1`&0We>UYwmvVH zmpgPVfu6GWaU@H{#JPJ>|B%9+q{6 z2T*}%wAekpxktyV`ukgkBbKfxg%3JG5)rgZ>|YvWIZPWl{|M)<&>hE382G^BZP7B1 za1>8X$!UusQzI_cPn?h)Edl_$VeMD_B)p6KT#{m2LEqf+9niYJat4olc{_rVazTg= z$k-OHI`@Y7uX=WPDhU9Q`IBz&>66Fu4voI9OPQ3v6&X#(Qu^6oRDg#aQ@zr4wTddk!+&NmO(cpJVG6i%Rgs37>!D?fS8RgT3ehm2;yeTD8-e`Or^ke=r0Y}P3LB7Z3(}AZ||Gd2USm1o}b^hHa_Zhw^~Gb zXIv|%;5Vh<{p86k(KSjEKQ>v2?60~taXqrG{V$Aqtuxuqu(P9dJ~F8F55}i!?F^Pg z24$b3@cu%S8gjbx4m+vLG~?B&hR8Z?O?uOCIjC{lx^mmPdlFrs|3aMu{kN|1MrTID z9fvM*N7+)d%^KH@*JsTtu=Yb5b;{0ttK+K02Jk071Z)|OkQ7v-VH1p~Ei(=}0ku}Z zq)6uk!3+V;y$$Jk6~-`gck z6nIye5q5vg1Fsh|&w}`i#$3Mx$STH88`1HF@QoMLInjE(kKHM%gZ37Y6yw1IqYzK~ zu^e|{b8`>_XKR<=$Oyp@0DCkiLSI2zxZzWZapk`yk+LblP6YEGL#R6YD}J2_MNizG zF%%693D{4?RC{aaVM0GxJjqkGQo%B=gu|@e=TkI6NN>3M+{oVFM{rPtrKLx4l5N~+ z*(+im3cSCF&)JicpWV(?27r9=0rkM4n* z4dxb~q9Naq87Y{|8dxwFfA+Ir`|syhbWEXbgp*N2?u+T8rBagYL6#&-W~{kd1361< zu$hRUf#P0*nGt8!oJ4GK4OQ_LkU>E2qt6i{LG2MU`kP*AnlSi8H~xln?oK5-MKt<^ zDZFaUs;#hHzd>NpdbeF1Pw0>!tehH8xpQZ;#R=>-ibeYTQ`nQgi^zklD!|LkYIoSv{oY!$R z+dY$9)Q~|^UJMwgjv2n{JXw_d?Nq5Qx1u@HU-Co4>x~tznO4@Reo}V~X=3MRyHJ1B z_@09N1``}>QP6FHZSmbQ;E3}hVh9L1A=^LscAu^I>J@Gqluz5+uQXnug1GV==4Mxr z(o)$y2@dU-L)7S&w~n!?Q)vRZ2%em2R=*DaQ|%hN79)E>MH{7Pu)A*`m*p5Yj%IO0 z9az2W-pA2re<%pG=&AoFc1y?9dm5eI`(!l?nF$81n_;2 z6g(#eU-_Q!_F>1>3AZcda%?7{z)iK)LHEU23s6yOL&@Al%wD8&8zPPjQ-FZ_!pd?n z0uhlkM`{QuAP_YUuyPBD7~;BU5wK8F4yopLi;YGy^I+*{47{5UW+1WubFROitd891 zjk#wyK1(_a`4OQG>IE>bgf)(#2HL-rM4uYL7&3Y|%g7etHtkei9m;aun?gsd^*%wG zVLN{Q8NigqXy6;xJ`lVPt>)FQ@brBV9us)~MI=-ZxaQ17)Ok;sm-0vm5jR&3uo~gq zBBZHT9HcSaKK6b<2lh;E(TNHID+!gG?=cgLqrnmY zSMmlijw_vs8gekGh*EZI8R$a1=4j3^BWXe!&LM|>Px)6AGD~l zRpd>M*xvCFZLc?@Cb2wj!6z>RmAey}*E#7IylvGQ#uWNlx#+a(6E;{1Xq!j}O!T1g{zEEL=`3r+Ax&J8ZnhOD{jZ$q9 z#i-CuxT^!AY~nIB`FqrpEcBx8Gh7XO>hoZ2m_XymO@YY&*B8PGREmot7*xORCDIUa zmX;jz&I2fvXIcMRB1;aGyKxRZRLyJ-0(3cTyLv}5r4r~f45`A_}z_sAuB!vYdH7; zA*sEc=Q-YbKU70toU3lwwmYruy&3Lf!qPh^+^`cQnUo?<3X|LnBl?@(=A6;+$$^5B zm*E*2^|?`?>|rzEGc?@~y4E++&(p{8fwK*piw{l*%g^gw8%=%UoI7H3>#D=IYf>f6 z0ePQSeJ6wT(6U2aAK_ZRL*{F`fI24F#&G8^fo32YsQpKSmMit;5n+xpLv5(o!)Ei}df+KP3K@sCRP) z0C4jY<7__JPAM+9c6iGcl*-_5+1-VlK!eqZi6uL*4aUAmP*4|f)z*M0ys|Nf5IvB> z4%aDsPU!_PHTedX+JZ$D>54?U(zMIfdXd~?A-47T;?paiHdep_gAUSPS!(gD|SZV3KHYGSTf63cL{cRTn z{WOh)&_ts9Lq^f@td5sE!lb%%wD%c&Be2@a_NaI~q!%Z4Lrn z)4vGVc$ZC%%2=lO+7^&$+IGQs&_Y2+b5{q~sF~fdg=H9|Mw*;@#0L*Ff@a_Ui~yDk zPpAd*#uSP!bUX8p1!^xWt{fB>>4xDYo6b0}q%tqr{F)t=EndYggaO_bIw_#&iIdoX z?*UXdZhS#Ryssq4{a2cK{J&ihbQcfMsY77)6Q@*3or2q_D$r^@Gl8YLuU%4PP%Akk ztQbL_dE#vn&AP=fLi~ z_Q0NL`Q1?drAf^T{a@+}t9<>ZosIpSbkR5^l3v2ms5h}a)>g|T^JqzOWJ_U-%~Bwz zEt#!qqwdQ=SD8#J;pSS{51+34haY&y=mxGGwXB5`_vE$avfJ75O?r(cYX#I{k%7H1 z)f5_Lw!xb%l-nh$cGlqck_{)!mzV(<8(vY*Z}YvCCTFQ<3{3A+a@EI6vAxuIsNbAq0c5#z<6wj>Hy~QFqrRz;c zsB4dxtoa-WG2iaBel?5W+spk7HYYNF=B)|9*gw$dE-dB}*oM4;9+o13LU;?CHd+QT z@&wFeS2Xm40n*6|-A=IM$6t}^c~lUC{1fdKqiRt`I37`EYhXyuX`$r)b@$*GYOx>JcKzU;n8sSm5@L}lp5KRr)y;r zw?#M~G=bEU(mppsLo49-l#A^NB}2;0^N&uWAfC^#)OMWFlHK5;hefte0W-!>?SauY;JQ(y+&s7RhF@sKU+q$OCkj z`_&282P_OaC(i=75#0HVC@$(VCTb~AA1tw5l%zr{Wz^s>aXn?+)r1q@A$hhDLCX1X zqywc{54AVvAs}r}O_ZhXaoK!YAPG|E2iaytO(qHnd|pLPWvCwlAlyXqoP@P84YKEB zmR}4m-itY*p=u7=y{blqe52fRL1U{l>4eNY-Zfdu8lJxz-0$A?Yy@EnKzow*R78qy z1JIH|%W01;qC4DA&%~slU_)zBKGyyCQG$3Rm$6hZnzBhf{xVujK5xX=!cwd68@o0Q zTTiAD8}q6pKDPh+cW**Jq{02Cy!-Ey$QJK1>on}0Ia*ovI*EgAZfbF0=NJQnEOjC4 zPuFBhadBxlJthlCLl>Gtgv=pK`%3cKGQ9ERHELiZW--RR(cca($qUb1;0nw-*z?TQ z=NBi$B>}kKTnYl7CgYGD2fM{2YDgv^VzY^VFKkA9xDhwmKNXdp*qUU*ra^gz9Glb; zd?5d>7LxjY%BPk9RjuL}U1T{ey)_b3(PpTnJE$jtqd^y8q1E=dDbKzi=br03OXcFr ztMH#yf!t(oPZ;0lykSE+v|vhIMtEh3a4Q!|oX(2Tf;&i+>^tS)giRjtprV5-&$Nnu z%(YI7VKS4~>l#R{+n}4*TA!Hr%csuVY#zQ)ELy1nVn>Pb?3i^|7}DU=ohA&ifjB>< zvs>wrsb@2IHImkF#tuhKiGga(_B~ zQ~wYN>XV0qbQN$QgmrsS_~1Hk#SR2Hi@AFRP=Obpg~>!9cZ88>$aZP;kn5UAvxj(v z)P8kQC_p@EZZ2n5{=yWfRp4)!%*!A4g=_vG1eQ0^ri91R;Gy9^Wl8!Rbuq6Jt9t^L zo4b4~G`y=gcd9CZ2cTif`oh`=bXc!~vF0O+(jX6Mly7}-K-4>5Y zCv~`LEKpusQJO*=)W6BL)L@TnaYH1_)f;Yw%&*K55-#bDs$RFmt13|as+($;;jwQu zi)|M1@-OG7f7TiAAPUZ0cFq!yS^l-Fund_dd285MzKk!4T??Y%mGn zfgfO;#42RHud}kA8E$VX$)01elTvG;rk*Ga&p%g5^uXAj!J-tT)Cos&P90z*JoKC( zP9G?uEf6sx&wQ4m{t`m9g&$s_c4{j~{giVJ{R@`wM5)`Y?eZ&X_GDB-oR7!*90ee) z6Kts(A36eA;QAwprp9`qDY})-z9M^6o}$<-GyW@`jf7{4Tc*uB{+v39SSGwSSQb{P zycOKNQ_Ks@Cbs%T9+ZD2%V$-9ni9Fp0N<|3_6moJcFlEPuHVt!$Il!+F$6(cd8c5lN%Cczs1O&rQ4hsyZ-ef)Y z)U5OZfLq$-n4_w&#R?82VkNkNh6FPXcOa7w{+`mVa%Jl@ZG&6-&BQ4YsI7nh^?Jm> z)27M+VCvC_H@@a+fDxWRK%P=xYK8aTU;r<2n{aSNWPV#G^q=o48@;w`?MoaEL$5}{ z`4t2j&tbMOZ9Vjj3wg7H_>=K*%=6Pq?kQtmi6n+ei$YdOaU5~>YUvC`!)+5t>cqqZ zx~f4IGuvr&cZsA89Jx0WmQ0`!8N>fE8Dd~Maove>rSUcbnA_xkT`XN3T8VKDf9H`ehzU2T?eE+1?bumPLrvBii{4R`piy zT4gkqRFuqBZlkU-X^a%Dtz<1J_*v@y8I1*^q*}2s?nwwNWG8-GlpzRRSXq~~Jr*sMIFK6T{qm z1tMiuli{38w#sfj$%X78qx6xevIE7E0=`3@4p7T`FglJ}oiJ=%e{@*%c}H$nKn@tc zS_K&b^E5vn>%^Z>f87yyVW2nU)Mw<@YKOQ4AR21Q7+H+ga+oTO@)nyzTw%{@FYA}R z!F3L5P~>UaO7466#F-e)ow%p>fBdDkw2)&3PriJt{t&1UBmvHsLq({etNAJRK3_Vne<`{1eEC!IC!DH{Cb0*? zN_v3VSm^+1G+$t1*1PbBUC9i*KTc8!>PGt{Dg28AGNwqPq;ZEO0kdhplmn9%C(<16 zoAQjNweMXDgKSSB>j`F&oN_REtqcQQVHphkdGL^2zonL>Qi9i=zS~`j@xNwEtN^qc zPr88=k!)ks^sXJ!xo7bh(4-f-a?h1_GWon(<9^d~kBqzxM>Q=v8!_7M!ss?mSO}QX z{4r;6HAjU(gQt#SK^aj;!!RD-ryPD^;G=sSSh zABwF7C2oP-!z}(u2#6_9KX7R{=jRkXY75$To)09b=95g|MTTpU(NJwTl1NN9CQt#D z;*0SYS`s3bpM+MGUOriBpb|;d!-S={B(W>BoV79>%-|e)4O+Dr=xjeyK0!`?%+-Ns z2GS1&&ZW6)q0k(*=DTQ>(DFEA%~yp7G=+zOM5B+Wv>1t4p)NP~MUSGzL9UNqVt92~ zVg>hPBLJrv2BxD>T4)v=QO;E(Q=(aR=)c%WTPh8<#$>G66zZuu*}VCby?L(MK9=wQ z^s$IH&#mlK>DkXQ(G;bpM<(hwqHU>~SHvjUhCu~*nz#GUN?jpV;;e|cGT-)25aq1+Axz^#O%B-{c&nQN-?;#~ zAoP6JQ8~PYrbsCQk!9U&@?ukf_(X$UV*_2|fHPv^hC?969-a=?_C z%n0^?Elzs+{ra{BCF6?&$vKo9@H zgUrV zUsac#&a^-|Ndbk`4<|h8%?T0%n7y6); zEju!#ugOruUpg2SQW8%&$crc@NzIyY&fHEF-#Na+@fgB3HH5 z0^Y&wjrcD1njgNqcPphA+O4n8u%s$`{ zm5BC7+!sgTeW|33iXr8=p#FG-!T8;JzB2njw^ToqV`WV6P|C3j< zOz+>-`#F3Cy!rthJkbyVKq~tfRbbMOtUbpxb71{oXjd>4+ zTvmLg#!-bcG~-Z7ZVkUH)p35-jlX7fR}gp;Q;dOsHVbufp>F#i?Jyc0`GU!-1H~w0 zUMj9kZmE|@8no@nY$#g9MnM;8k$YEcqw);O(YObhfv3-;R$s4VM%`l1BvyY?Z(U^U zJ1pVRo?@&+aD!Vif&woKAaEr_BlGEAcZ!HS$f;^J8o?kx2vVp#DeecRm^{1b5MyWX z8#-#TSbhRX@raiYjihrEU3Dd)QOo!$l=T^Woi9zs|Q6H4aR+#{~DllEh3$Dtyn^eAV2FgZLAtUv5U$zIt_IqfrlGtSE=qGMQOGk~r)5gp-? zjDvp9YxxUJ-it_1a~@(4H<}SC7I(n9O(9q%Pu-6wP`Kl*;@*>#zSe{E^*^Dja&xFRXTgO%v$Fo8x zy(zudZeb3}+-*%Q=bsH5U0yLh;QF7A@Z}2C3$uOE1~uDy5Z7!Y&!j?xXE`P=9^E7w zKZ3!#f2Cau!m<9isyYI+e@J`2+Hct*BT#mb|1Rs|l&i0vjNh%(4>({VQc}tI87d^v z6*%F!jIZxV(UN!!BNF~&eqBpnm;D2)iEc7#2I0^jpgUB2$c-)Rm7Gv0HRN|xRiZUh z*y6DB4sc85bT;?+qm7c8on*cJOs7sq4tnT7^YZ%^+;n|62S#v}9GM8bHDi z)^q(%R}4^Pg^1cA3#Vi365(i&q}}J-ERkko4n^!hb=dWYp@N24WuFGpe+4&f;^VJ! zI-mC4)-Kh)PO@a3PEmSE6FZW70|ySL3}?JBTQ}6vkk}utc=I-9e8x{v@=WMXOD1L6 zP3NWkb*T*~r|9}Tu;Tkcyb&kxq?wriR(<9q;$yv@b)39~o85_EpTAJHfxnBT-^=PE zXi4F92@bBi&L6fC;3Ylv_z~|=;GXJV**1|)JB1=TxS#e1+9+pVjhQS{GcW_ZR2sAs@Fa^j;*%;r? z^kD%q;g|VZ`w=Z<3TT6=B=Vb8mc>_DtPkn%ZEr8zZ0U7kAO7GEI0Ru~udtgoS_4=) z>xVTkS&7Mj#H6YUJShkv!oKqN_MEzDKdAvM0zm0i(Sh8&kLp_W`-=<+UL>cB z$ndCWu*VBB58;BqHkW%N-P@Yssfr71Ian+~vj!HCvY&TnLKD*dk5B1r^0!YU6K-Lm zg`@9V##L+Z*M`3gJdNYdsAEJRMY_WIB|m}WSN03!p$`F@P#1sgzC@imPpQb(8^7dl zZTf?mQF8JogJa=%UO$w|vwUZlq|?_4Hd;Dky3Uk@qj*p>!t9#Ec$Xy^d>v6T`8{8d zBRk>tGn86)YQ0h@g2K*RefhnO%i2kFUG$NTZR;*My? z@#+rN?K%H|`z^&LIKrpT6OZ!c*SI+j&i8?gWQ?{7C_!sqsYb%Ea8<--I(_^S&eppo z3bg*ZY_+vd=;(KQe)>GxJP#PEBN|5$aMM9@eo7N`_oDa-Z$hr``$EWsnU@4A0mSpa zHXtwo_a24X_7-L*3`s4Mi%ux1rAm(T_oFlA?+nO^AUSw+tW#{_`>0T|ck1pmY(E*r zs03s*c^KYrl>n|?Qi_O>kxKYhh6^DPGTw1Q8hG$Iatpnq{h39662t zv6GvQOblvfRfWOs*+#=V6W6;&Of4)=?;pr^zc-Sxm@>1pL0k^$0B$W<*n!ezqunfa zVil39G;*eD8V#?HStxCKLA9isUTEWps)VJ@9a7=jJX+hGz$qCI9mU2Xo2~06LX_yV)^`0$nYqsUhM(d4oN7K$SBpsw``6 zf*N0p<1hY$=r+DEp#zEr%4)%p#%H1=Ub_xW*5c2fe!DT+s3o^LJkg7gheU6J)$gX3 ztQvuD#?{ix1)AGIPe>+5sCp(tTZ3@=jYl>E1|xJcNz8j=RyyjE;{6$Ajgcj``mDK< zu(F9wm_`(tT#j^&rO{ftVk5!o@&#=M?3cg|#X!D3g5T)bmS>pI?F$_l^1nmhCO_#U zi!q-h`!Zs`broVCxk?*$L+Z@L#1LFQaIgWVp(LkTmMIq2_>{FoUslyx^XVvt-f1fz za5uC5MQ{ywmCm*MA&2bCl<~F@E%AEIELmRbC|aWU@56o`R@D?-0DO||4x1(FKKK`x zlWGJ{+ptNH^X)`2zDcb%&>)OMawp_E< zXVHuPG~HUW}eCJ*E*y-IGgk zIcaME2mly0DO5zjha%~=b!rMgOB@!mfAceIA(?nGN-BPC0=6oIBfIKRY+Ey49Tck2 z_flck1s$+8+<4u-GFo|FA=^=T#~`5e&fO&3RYZlZJ#0=(Fi;pWCP}@f+F-+)kP_03 zrDZu0cO-r&X>o+{^^Td-^CSWEi_A(6HfuK$HmAq(U-1m-3&5`BdceS*<$Yx@^3lLZ z1s$)3^ebm)X-n-_ESGmj8w?3Lmv?R(j3k5UvJ~o()e)8zBBRszSw*ZC?rjB)hq}Wk zVKdwC@Ez$sX_FIN*e4u`fft#*jr%wJm_T57f%2SDt$b4c26g-OvEbAF(oerF5qrKM zjmZ)xb+_p>zx5R!2qkVBXZ^|7AE`YY99Y78VqbyUD`Euat?OcsZWRMdDckl6yqI$qc{p+f>mkh95cE0b^}UMvMvt^9im*Z)*Y z*v85+o$!!zWVKRlmW4C?THU#Ao1qjk)NH3!fSDKMxi>T)X4kFMGxh6QX?&`~KBEB3 zLhNsnnsj)2-^RVFG?x<&yHd6oMbz(Hn${92t&9{{VAb@9#nO152mgmk3LRsijL82X z=_|w9Y?`)P3dNzgySo(E;u_qwxVw9cmmoLp?gWAchoVJ`ySr;}DDdTZzu!5sv$Jzv zGqXF!QeL+}Gj_9r>AlosH-#N{TNfEOmRzJ<-2)OC!y4%3{CE%;aBp=UH4(@OBXLFp0a(P z?Bpzt$h(EL%9EweO$(Ns&a>7=;?JKyT|C2`h|i`Jpr1_P<8Tri<61ZUjyK3FFYZg+ z)f!MYNnyot1Ld46pX)T{u*jy{=`}aRq6Ub@&CIEf0gozRS}j(VFPKE@OOLG!)*Ujm zho#r2X_sEqP60SWfF!2TO z5z-m`1EnUX&&jgC*U9A$m--y>=;|jjSIoCDZQTd#-zNPK8^E+q*Lqm4b%HNe;MQiv z`l{l6KKYj`miMA21*T6}*%6zhbg^?_mowNe8q~c!v=~HTDtPX*?Y+)*n zEwa;+9kQ8A8M7)8{4DrkzwcVy0p14;p(z|gFIv8Tey5(;+n2jV}u4_Dfx3D*QdSk zw+naGtyBlT^hcF(J2Ar7cGTQ{rF!f|)2r$U9Fgr|HzHl`w9t7st%_1X4!yzEw0#-8 zdArpAJS`Z&OujkS_CB%{E}u_5nwir7Has)e zn7_QsdNPu0x+mfT{;kS(h#7rL_)%&rP09cV)589F0!VUTkaA>Ote%eI{*YoGr^z5X zFk;+_^gusXAPt~N3L}I8Bjk#^oH3y867+@orKp+nJN(WDnH{u1M?JZt1b)U`F>0bQ zBIC~ZOJ&KKBmway&3iodY23NQ>pP_u!nn~=_2PZ-b-Fz0hE_wsJ@JNb-*1pwUn8?R zrZKBraO_4>RsknM-#J~LMU%RQojMUlZ`^oE77rob$ne{RU;xy$Hn$*1>>$H%6I~p# z`XokTzCMg#3M>0*!DM_iI(_%4L*pS`95oK%Z4^@d8%{%DwXjz+7uV#T=3W?B%;Th& zJ?EC20?KUdcs9kmFSFL2Bx1H_=Jy+6i?YxHHpcFq5Y2|ckg^b^9 z@aAr60{vQ&M$s=l#TZPP`14kXnDXLJN>yqMlh=2#Y2?zo&jp3Hd_WPeVbc-2Ck-H`lAK>ehsG>iS`Q;bAfjEao3P~ zn6S@a)>OSYmKsw(i+}F1B8_$Y#Ndya%+DykNQOcx?-}t48-Zr?U(X#4J>c=#?&7t3 zV(0U9bGP54S+tGL*$luXGK-ddyi)P=*R}GR9or6+plFOH0R+C zfB$0Z^ruZG;SOze+s_uNk=#5j`O4D7bn)Ted868ut1p7e7>^Ihn zI6~uwSe~HnBhQ3Y!H~0J^;^B&zBqvp`xrV|<${0uRgC0*vB6fjyK<6U6Y2-7Wh?ii z5oKS*h4*oiq3LQeF#h(j&NN%-bK$PmK~D^k#$##GEi=$0r_$!T53iiXjU6g~L#K1Z zY&ur*ZP3K({0la1NUP^%mtS7BR`P${y6stiVw3hvm{UT_>bYy2(-wgeR*f>c{#UB4 zsR_XAr8e#ti(zt}nz)WLX9OR{sa!V`wUsDw0`6;b>fj*T8xrd?`K+b zEfV!+nS(Er)NQJ6{pQgS>rDVmbZ#;y>l9Xfll-7rF zPC5a=FqQm0phHS3%ZV7(h0V$3IDF_w-l~zDOV6V|)U?xYxovF2+hzXX6!09W&A$s5 z7kyetV?G7HlUGW!lQ^WOC)A+BuE0#9ldj(H*&w>VA{VjyUkT^00Aw;OL$@!BER!=1 zO(dv}o*5tYw{6iW6sIr*`}YU~Hzz8c3UoMZq`WRIy4&cVET%50c=MRo?#;eiuwYB? zC8N%n55p7Z(_!x<%KeI%W`gWA*y^X!W6d%_Q>gOi7akL7SpmeRlC-eh^W1BE?vm}O zUuV9P=-_>xqVPC2HAFK?V0#HSz#=g&0i+)gtrW%WTaVQIXuGz6z8F#c8hbxtT$pNQ zls?g((8<$jraa@dvy8HUxa$mS`JaHtG&A$ zUHYLwrvFVXm|b^rLHwARp^LBEQq?GVDEFyJ-!gMGe{CcYHu+MDf9`g&!H z%stkatfW$P{l=syUWW$86uZ9S851J5U&_3k4WOUod*S%!d$&K04ZnN4OD=s=8J0zL zo&0m>`1NF7N?5^|)5G=0OY*S`Ehm(1P}fD4E@07Hn*Ybl<_D11-^(tPH^AS~~mK(cDAo_-Egc%rQ^n;qE2XD3;eWfT`Z5uI$;w;_2s@sLMQNh`|+N zRm!(Y@lLz;bMwYGobUU`8r0#+TeP7lnXc^ABQf+kEY*(8I{SVTC)6x`JT(Fw=hyg& zl?bxlY*SIm!$o1qhVeY?H0iQ$1j`6Q z6y(%E408V-FdHW#Cf4|fRF2WI(;&ZX?v{zbF z40s03#KbXM$jklp|M`)I_u$6*^uV$+wEDYVY{2w)<CESKy~it+QkeC^r=TR((rK9)jSm?ZL?#^>@A}cGFxYv8 z{r~kP;7J4?pAL0(`RJ)1SA$b&e6OaE1u^Yo^e6)0r+zVyG)pB6Y##^zHr`NbmAalT zhcR*aC1p&FUWO(!mgNpVz9?&60lzWQ!-PPaOuG~^r-q#gr)f!$5$KDkIds-}^8*Gz zjE!yj$Yftc4`{S&Bp-40WyiS@<2{1?ouT71TeLUgrOvwd^5tmdz>nuUcA~6%`XLX$ zt6?2t|0)0lo0>_wdg=f=$N)m25K%YeO)wl0~~%Z!u}|GK*;VVrS1{k`m%{AwIn z0O{+m4FlQc|E4tIo^5|N7uicqSFO7%c$tEzZM+6q=sirdoD$RBENY&TrOP65jE(w# z;){=>r_u@J$pu+;q-cB8rU5@Ac1l)&>gui3iPrWrs7j~43WuLaF#%B4Fub|AhD@d?(#e8F40Qb#>W-RJno4~6R zM!pWc)a<&?vpucnogk*++PJ(ul1}A^911m0<$Ru;!+Ve;6aQHt={t>|KWK^&HpQxX zqQ!%tN}Ka5I!Zg`Mnshi)L0ohNTAzWFv!2|qY)er>#4%pa~)0X%lGFm z*=#hJLGJ^tx4e106b4d=T&8Jug=&8K#8iHMGAPesw!Hv!kwv z9Bp!rv~bISEYB(r5&G2mVvJHy*ZWd;wQ6b>HYF0HBvfqSDPJzXF_rksF>}Ke!z{`> zI2*+<&@BSpz!SPkm)7=l&d?&UBppoC8nzb5Vx6LE+^+D<=Eb@+14;m-PJ9^R#Lh$Z!H7Z9Qjbe6*2{*RVIM7X^@VNhTidQnUTd(>DC zEs#-&LF3TR(fqW-txD)31?l1M9I1Mb#cuwMrOJMcoG$MT5 zOs1($XzJh-z_yqD*ka8}RElLG^992~zw8xH0*Nickpv>t2>WrC;8%vWnPDR}Yil)a z?d%l0$xsd7>V~W%k7e6`e6OH zv(3!{-Ri%<HsP(lMRS&@r`iNj3)|DmBT;%-hy<|VV z=RY0DH+5OwZ7KNiuQ0hTNOA4x#PBQjRGoe`Hl!AU7u`sg5=??6Mv z$ca#@9mz6FGF{nDx{=X!7{2jZc+be1r-8r(0BO}D8P<{Z1}8LR-pYqF?Uac+Mz_Sx)Te9AvtgL{^eE23UgP$wyWo3mhiT}FIxl?IsKoAUXdmWAh@!gm* zeCB61u0m1-6o+~9={giU>sgSZqH(q3s=gsy{gq=6D?pBwnkrI^DRK^9c_qknXAvyz zTcAod+G~sDPDBbojvGiBO9GBrO%)}(fpb_GcK;7dGHa-|Aaz~ z^E=b&cf7a;SUVCxX^l%IQ9p94>7Bm>;A8S)q$~b9VEgHN=ty?|nd*`TaU#@5yv|Cvpw?Q-p!u~_vlTjNX$<%nUraDb2 zEqPA^%rtaEoO1WHcdqOJbTB$eFghcrIy0nucQ`YYKsgY zoy^$0Yx+qf?)B&JbE`za44d}39*51}>Q%6*7$b+_JFct4-lt$5K9@mLld!4Qq+cn3 z@uH-rn1-!tG+^j;>qHd~2toB6YG6Lw&7>0KzWnhES}&~p z;Bmb`JnztvBNCzALKGS#%Ov^gdoy&HjyojSN+fkSWSoV#1#6s20uR_?2xUHKF4BH! zp;yshX2toMXT!zPAW%EQQ$4#9ET5fWVBqe?_CGB)TT?3dc+60`E%#y3Jp2fg;Qp>N zRxv;9^S5+WvbrNPv6tJEmi%XD<`OWOsZD-@P2;3pEq`DW$MWO7{ew%7K7|ZwD7`Db z1Ww{`oiYwSLECpbMZ^{}X(}rxQf==2#3tQ*C1n|ww$>t;`4BwSX}TEJ4unOdsB7|z zBJw}7mEU6nzXZ&tNBhxr&yoSR#zaTZMps&+#b85Yj#>G)Hhr&7?oY}oF#d|Dj)}B4 znoYr9P}|C!!;N*CyXAT8!}E_)FwUg8k!yQpYZZ->3JYlBDzUT2NB~tX+GV&1d|suw z{-JfRoLoy0*0lFi^&PSRx(#97GsubMS?NYFe4gEMdd8?ocPMF10O2n(<@YgP$*}x5 zkKAZR3CbIjNwX~)S+~Q7Fl!89 z)mJvs5iBmlZ2tbbP&N=6EJPCgS^8=9{ZO=^v$$gC@}ge|MP1M37}r@=sLnatyh#ts zu**WrpwVeQDQ8Z0V(;fkyeF?$u($U<9^@6aogVZ+ z${F`4kJuF%n%r{OjNTELq*9LRxLmU3bRxJ@$&D+0N_T;}b*V1D%ZPp6{1x4MX=#5Z z6Ofa7#ZAdV)%RBssg(Q44J%dofV(V57=kh6*XzzcD^gqG*Y)~=nirw{b_b5E>BzFw zu)w2!Mzyei^27NR+!;( zr?(xk8i<6H)ng9-*H^RDjkHl(Hsu>`M9iSV@MyHI#iXt<5HQWr)p~@;CZvD%`SWC& z)F=G`3(Nj_;3|}oGPNAveoqOSs{6I5Hn{#Yeussr8MT)w_FBUELb#qK`{C>chAn}!jBkXCJ|-h+Y=8r)vj!A)G?m#IkBKxfd@e1+Pd70FhT-R? zcz#+>3HNhTQIw=o?aF$}C5`vZby6(IrTF!1;8a|304>ve=P&;UYtB>Lk#v;g|1%zS z5z#@zsl#&;32@{UBGD_USkl=GtW%pe^$Sx|PlE+ikXbw%$C{Y*W&X17a>o|)fch9A z>CLKueYUPvC`{i}o_ubvjB#wOM4=csw*lUNHlzQF_ct^EJbM5UQeMx+U%$T)d#rV8 z*_JAUhqcDccl>N48FZ@>WBpMOw zqLd(AtFFlH5M%FXdtFsVd~`f^)n&`bU9nJK%;_!|`7mSG;{Ykm;(h21gOzA5Hfu2) z$p>N#<3|$M-D$ld@FM+{))-~ABg(yP&`J^9t-okkxoVX+6gq-5F5u4108#B>wg%!{ zkPR7*OorfVJH>qcakCoF+7=l2ev^vfKE>KyPRmu8ttocTHW8^=cW~WyaatfnhadA> zN^Z1m?*vf@VYc$mE4K=T!SH6741-z{U8fF9@~age64^eIJ7G%LY6>0;D6+BQuS}XW zQSRnSrsJsN@t_r-?evHx|I}Yg%U#85c-JN7hL39wsLr|(dnz>``(thRpd}lfczv8Q z9AE@O^C?PcHQ`g{9KBPt38Lqn`U31;X^iEWf=!s)&+J20)LmBe-HS}t&2Y{W&7mAr zSzSt?y8zP&#_Qksjm=I7%0Sw>jZ=6#I>mL(N$s-HOI~y&6CWyMhc(zT8$*WkCW4Ud zmhL}uLie04zi|DGM-s|={JLJw69TtFK|><T3_Vi$mfT2L z-(=v)5}t^1i>g}uNE^A;9V|6u&1A{0spW3!#&OFUfT)^NMZg%GA1cg}BookzM+r(k z$#C_2A6AySTEXJrf|3;~nW)G11I%3wA?c4tnkehF*F+~QaEL=4{zz`gSducia_U%v zthJI55N72sMpgLY|G=Du(cn4q&eTkQEpInb6a&wsX>?C!jj6~W;{jE(YHu6N?a)W6 z@G;`@h@epu>(}Sr)cg-oEo>=Ycz$LhWuFLIYr!Ut;gxck@DD0R@%9X)r`eu2Q}j)QPr85aIl4c!WM?Q z$9&t{DXskm|MS`SwcqXKX3J(HaFzX|9NB21+YWoXwJryIIOEG zP18%X53pNy6bLyrISg;Uo}j_XLXcnb@5RJ8+6q`y_$R_!je)f z0nuJP5l54&PO+brZ?OXZ_aKGUR9NOahh1Bi=4+SKQk`^iSKG0Jem;Dr%!81BwiAj8 z(`3~64y4MrV+DOJ82l1Q*CeJ73RJI!bc24Qmx0~qz@`~9|IKMTj^paRTz2AuR{5c; z$2j&TQ($r07Oy^^(px)bIG>hNYWt?TnG-WHMZJ(CO&Q4+dR)#~HIEmJNc;bY(4}dR zR^Q?Tz}lPY?9kga*z6blN|>+xgZ;a=(W`dv4A|U-_QzCRel|@g{un!59O17KRLsKv zvJp-;ZzB**lAaU$fDT=I4UeX>FMudDHcG^@-6=yEhdlNEJivKW{Aq9>_NFl?kL1aP z4R;_}XVhkym74FBj>!Pvhj)(Jk6SIW^M9B--);70dH` zp}(U)X#CI}qW_?jXOK7V5CHZT93AYuJSch>-PFEWq-ZW1WP2FxHt-UECH^v{2NtlILi61^*z@l@Yq!5aq^o%)PornK?M%^k54@Qd+xt28{DkOKNoc8!-4NiddEi8n3zIbroLd%k+k_Rh+O&I9Aiz>B05 z2SMFU?Zj7)p31@tWjPA%!R<00EvJsHTJ8~=;ptdM{WaB z>sTjIu>N?h3fW8Tl{KZ98X3U!QHocEa7IJ7f0BbVi4_@i5 zX4u9kJPi)g!fcl`3>ee85}`fDD2MQh)FiqzAA84wv{qiKP95x1?7UY<+07R9t%kO< zFHexW*B7!DUOeDnj{7-MD19Bi#A(i=5v~3F9<^pbMVXm49S!}c$Rv=KC2PDsn;TO6 zZ)XMTe?EcKSa0r_n<)#<=l=3%H3;AW$BLnr0+ht4#>U)gL&K@$|)=E*1dB%1Y_TNdMe} zL~=P@vcLY9Z1J}{;MP%(HoAFJJcu*;{-*;QI3xWrGl;;SAGFMs6 z(Z@;_&ozu`>I}tA)vJ3M^Wzd(9o905?h~Zv!4z8v*3^h8$5!0=!L~iHhKIUc-h$yDd1=TG>z_2ms?M8tI6(h~R%r8Ob|ct4s~_j7tz1dpn%> z4c~#uPQUCnp*j{FRy!mjS3$rx;_dg}&x5em#yw?czyix^T1lgg9E?RVG3RU@&J)9} z+|tDk**|8*jul~sVirlrUZdI`p0~Q%UI%1M2#oF5XDLV3tYu~g>q-FGRip}lv%x(i ztA7n0iY1qlB@-vGEpHQEhWvSPq|~|vpp*U0@ z(fI=-O?DfSFk`M(!e{T@IlbjymWbVnxSFswqB(N}9=)Ym)|QLxAIkelx6OKFV( zDjC6qQDvey|38FzS0YZ&Oh|pQwaG7C?Dz7Eiil_a@NZo+NMM{;XL`MHHJ3CYsM#B0 zLiW0P^>+p7jKf#LR%9^GFK~VB)E=6#NBIu> zH>d6OA?S4SNAj0YzUxK&{~F0@yKNSGKT2byoFyRMBkJu=|9JR_PdYU!6!H;O5^+(J zQ?b^@j!IzHPUCC;ou^}x@<&i>>kkAr1HC9pRYf;AIO@*qA6NG^2ntkZH4}fcC&NxB zUkDu4l-f9faVPAjFU2gzN~%LuXb3r;_`!fxI%c`DX-U4X23##;&etxzzhUJESJ3z2 zIAQ~6RC-7{2=D*}mE@at`d(A~=oLd&has>RDQl#&ECokakOB8kmd3H%evStIH}XGp z9A|QM5tUYW1d9y?GN@r#mds&T8-Kt1zIcD8S=vDCDwT25{iIu7^k39dlgI^_DFOU0 zLRxjtx8W9i2Df3r-ZLs2Vud2PS{KJSAD+nFGb3+V&7PcrJo=#k{s(shzdoC?RaI*% zH;mn-XiClH=qqQwzSWk-=@o-2Os#o@yw88w4vpAATANJ&y=De4k|%kzJc?mHK7hrQ z)-}GcnuZw8p1zx{uFZy=lPPRPnBCz@(!1hH$eG1VD~Kxz(v@h%eRtEJ*VyAFyImEu zkI@+%lwq-*?o)@)990kZ@xa~a&MiigC8fJqABpFA7Sn>L&Y-3RHlN@H##C#t|JaJ@ zHt!rHE8O3CahzvkJyZ}gz=5SLQIE$F-_puP-JR^`T37Ehm{}Fwi%SVIvfwFcIxus9 zc_n}uF<-b7W4>ILPZCUe2NxFRDYCw|DCQ5?wYHJF_rcce6zUKS2MAs5~QcXWMu`Dl@-R|;SRi|pOp0p==epFVb_gO)$BLE0ZjoVP{a@X+s+UcQz?#Li6- zS$H{fEq^&njJ+uOBoRJSAllb&{KsDyR_`fj@#RTsKQ-{_Mn2vPeuu?W2k~Gh&y7fFxh81pg?dNkysggMw3UajKpfN@#uB|oM)og| za2dMk7WgI5_wMF=40N%*%@RS{{g0C0eoz0#oR6I5-`M+TBdfyOoy-RnoUI_e%ySM` zi6cgHE^L$(7b6W92liADDZyX0fWZkz%`IjQc2@}?zO~e_rFDQ$avx^Th+{bE3Fxlr zAC==+^`!9Q_^5GnN}&-3&?^i9&X-EZ{#i-)i_oZMP*;9anN#)_?<`$Nq&cg%eb$V& zpW88tL6aJeB)#TrM*wc{2NioE#dosO0|`PZQ;|)eK|dA&9*)`utkaNlzj}?xEkPA! z6BtNcVlVCq9i3?g6QxsIv~NwS1rJV0X;#2Crv=*_x#X}Vxj#tf@na7F5uSJaevc!A$Lx8FO%0IKIfG)!TLX(?qP= zvJP{9s*{uvZ8ZbEiC1@Zlr%?S6s#nGyR&4I^a%uo9SwS|8}rsE3nV86zEQR(*|`xE zh?Y!}ojNM}uEFiKOfn3hQA4s>!zZwK+jZiW8Aza-&k@`w?rJ+O7h;AY8KuTFG0GPQ zL!GP^Q;quj*GNUTp_dihveEzDJa;_BBy;V#DS~FfSGzv~rI7}P+!C5NA{B)njSZvy z76WJJ^%+SGC=z&^SPUF(88&YN*zRQXawfx);d(4Rr!z+0itxiRxHJp>C!;(S4S71Mfgnuxg%Fu-tNjj(mfbMy+-}_=9 z86*qp`aswDd0aU}230c37I&lqj#+6wEjsi`v#eO1`n+IebxXUfNZZ(GIuxJbD~{=` zrL`muyY)^z!=R#+K+*Bkq2G~Ody>afu0!rg5Au{@MSb*?Yilj&!)2ajK`Ho+1CeW4 z3WDmj+M8RmwqrOpC>1Ofp1t`+XrKj2HnVmV^p|#5p}I3PC=e*>Tfn_vd$I#1fSuAN z?3Cc!xWlP?TsO5?MB4wCK=iQ@>umj~^Yeq@{(gLJ!TgKKBCgR@6czgYLBgc;(u*_i zi`?Y03shaW)!w44TcqX;dS_9PyJoCicugx2;@f7-)&U7@Gp4~P9vdLNPp_ra`UB9k zqPDVcyckMNit;5>h7}m*r)%;pwI^d(|`u_Pxoa!Cr z!QT(f#fCkO59v*mp4H_Fzu5N@)npx4Q^t|%>s#z9l@&nkttBvWHo`D+OBdP05pr@H z+|ov4IC->|aLQtgY?-*+AGX;cAag|1@ ze}-3Ldevz=4<%9;xgTyE)tapWg6yVtZuLLb9;fJU8)9H3VAvo?{*xUikNIQ2a|wRG zYSpX1+CAS~BH&fJc>ZKTHaqrd6j!%I4#>qX zwl>0=J3k+mSNpFMlQLh|L3YnuSB-p~%I_b`aPDu+`{c z>Il31P(3nlY4^#F1_ca+XIEMDiDdDYw8DtW#!0pD>FB}uaMJ$UgJHlL&Wh5b3=DJF&KCw0($j_LY=Fd>Cqb5%^ zJ3Fx?a5fXY)(*RI`%%R@znV}I-Z+0kiQhhaB2~$4%QXQk#A|Y5ICM#xxO#fZ0);?y z0a(3V(1x!BJb@DQpFeB;6Obtu23Rom|Z zq{3q9{-dUx(v&WJ&HFMe3Cl?#u(Cvbduss_3}|hJYEAW|@t2lQBj(i7Xa0LrWoD(Vz+Vxr$M$IiL5Oarx$jGZ278hr0{_6^r0~V)s3Aa zdg^1!f_?e}zDsGWOv%+Fqn(xKGEy^BY9z-L=~nd30;!p44p}|QvEHPn-wPUd$RaOF z35$(q?UkY?Wls~ObRXsT!wgn1DYR5-Fm6jWA%T1pf%}E}DJyi~_EL9=xvW=5n;Qlp zQX^(1s6ZpzLtJK@go?F=Eo~O#u6lnTbuw$J_Sh)TPPH9zBA&L!9)$NVJ33ABa{2;M z{UByzM{3;Um13+eEoGxiR<4zr5-=ckCZM(ZZ71q?@SHF&m}08{0Yj4S7 zszcjHY?&HaFNnawmTV3LGa=Ouh#~}e{9_I4dq9%>C-9m=A|))#tjx>$##7^|+au;~ zC6R2q*ev;0p9tjjbiQg$Bids!e4CM)%#^@r4fxFVbP)XNPO$5slFeIe12MP~+nojypVTI%r5P!dtY_ZHkbX`5y_HtP&gRQvL-fQ;n7c(pxNd$NC@(49CP z6VH8^Fm$If)(C0S+DKxETmax*^I+NI5#-pL^2KU~^fe*fG}{)H9V|=@@F)YYO$?v| z_{Oy1?peTaH4Cq#D=jY^8phlIc0d?0n6bvoL#8L);L*0r{PRXuH1RnlW20|f{}#p1 zlkq$ge;Qw*2wLoEy~@4<(@FMi(W$tE`BBssXcniSysb>Y0`7zv5f%g-JDn+ZN^5Oc zG>v_i5e4?f0fV{Z;*AC=^7nB4djcn9EaS`*v@71NesM6cJzOAVocRqs3> zly>s&MfUq00oU3z`?ry)E4b%k-t*;@XJS{%p3k59pITH5OYY&_#VMh0qPU7^S>KG{ z_qk&&*()zUkc|&GjaCWhD7hH%B|0OK7$*Oo;pG1nU>AXH*jYx-6t;xeipuflTr;r{R&Q&meu(f2EVSw!x}?SEMqTEnLJ!cSPo!2mrn#$L z<4=TN|Af2n8Hw^4G~2M;ogK8R@SFW7yiKJIOL;{UeejtQH;`R8|Br<^hnDFBke>Tq$^`I<((sWil7;elYx>D5XWZK^()J9&cYR=jNBR&x6Cs%NIx1<;!mdHLLlL2YGty z6!k|tn|mFkbno5KGYHl{qEKQaaIC-iZJ>Rl(L_9C9;YjgY{PXO)6biJiEH(kB{K;45!fwkjXpXz0W{)QF97AfMBbz)_3FGVb zEzz*S#JsV3`(`rr#7m6w>G#@uOkSC879SKIt3F+8!NA)&?U3WbLszo696a?jopwH) z`Dk3ab3K;ARuhJiDa*ytyWte8V&GWA)Q&WGm&M(kOfuJKD2zHwYCtOs$IxZ-_X)`^ z3fTy6J|dB|JwXnSj*Q8f8s@{Zkh=DOm1vgTStp}a-P_PX{TIfjysP(huW!%c}zNk z&pU*Udw%k0=Y*k2Aob>rnK8Uw(51#x=;uwH;pS7$@A9O|Ag8Tvo~x~6nzVfOWXWOp zw0x@M;HKEMlGF-C=A-23=u(9ou8HD|QZIH*tOKk2UA)&}cg>7gc6Mb+pr$@X?eJgs z&8qS=iNf;GFYWP{S^ni`qyJpm+l-DqppdoyczCq-&&T9%CHSn}HV^VRE+WZ}%(yo7 zg;Sm-aHDi1m@X>+PpK6O5bN_aFjtl6u=o_?Lt%AHG7Z-CjzwCEd1K?`G(?#VHsQb! z45Ix}?UExDgV;Yj9xVNC%UZ8@KeJK^h%%)0#-%vyJ-azhu-h~E_n?;Fx3{|h8>E!+x zF4MyRvO_N;k3THxjXavCUwNC%i|pNtoDGl=T>$4_B^6WoUEDIYgH}YpSM*T>ZUL4x zEzl=;za9fi@BB_2qnh@+te}fy#a#HPn4F+7;QW-i?V=anf3x22KXTr(EIjiLV8y0w zuw<(iR@UVIm<;IceRPrWhqw|NQd;b`1%^0zhmg|6?`RpE@oX6w`T%t0Ek{U+Cy?Nm zEd_%s#p&ke*UVK4HA z0fRj(z(kM_M=khcjVMcl7y>zKTipldLB_;_MHlb+-Dd}iq6h0{zmA$0MeRAW)E_^) zFS^f|UG~@0+8Z1ad@k|%b3a`BT@gEGQNkRY3%@K%Qo#fuW05~y%AyL<=bZT>cD)4@ zaN2IuUy^_nElc}QtRxF?`<+xv_nTjVovRl|w#&`(GvQ)z^V0GSy=#-j5MOXvOnJVJ zR&0Ub39^Y{&&A!+9a2vW+E`1lUn%*DK^)^q?kmq>g4bfur|R3`n1KT1Y7y10FdEHa zlWL=n`}ol@rEbf04e`XXTmcqyNvWyzl^cWdT7rqGQxnM5;e7N$C|@pV%WjxR8R)~$ z30B{V?hZ~ao7#$2kU;gXnE8_wVN}IZHZtstM_~2SYAB`k`IJIqNR-!Hge%#2d^$n1 zc*pKqxb`F~NdI|qM;sfAqtyzH{>!KTqZ98c>7Dn6p7I@jq(}26B%)w@?3xjfPPeeW?oC(J zS^!<+dFC`s+qJeb%?xPceI|}?teh-z5kk-*kVy4pRIj^i3go}E--_B*YWd3^g2ySQ ziV#ktDR08m_FaF5hm|edvXoJOcKw%!DDI;LG=*;=5laWw zCjqlI*QW#LTjFccl$k<|zly=?>1cFo{O42bMs}2|nD9!eK-sj`Zi%Vf=}Gqt_e@qN zSzOpfD!CfN6HJ;X%62$A>zbo?xIHO-3VHq=BIK9x04jyEk`FGNLEoXJ?y%7J3h3!C zIMVonAnO$ zdSvgTI*m`HDLyTAJ@*F>1P!}4;f?~_s;HSU@(l(phAJyD^G^D8ok{8$1727y@nq#p zmP2|KqE4Ca{8yeFnrfde1MoLj4EW5O0utR1uHrHKS3-zZiF9h}ON_qiNw@?AXxs&Z z4|#FL-s? z-83{5mSIYnM3E30n}*s8dNO*SCY56#0~$Zzc;N)`u5f*#FS5qjh=(V7F{J2*(LRLrJ>xF%zy4sOzlT1+H(o$~fLQ2oiixl%{k?l< zpW8Ii+JC_j1(=w|zr8-^IcxC?NdV7w6@$m#6MK%SHk@hSW=_RE;^rEX_Hh+SA`0| z1N7P_kgj|$BUNjx7G4HlA{2wZO1*M7859~Gv{fgU{M9G4wg=Hy{8KSHs2*-)Rh%ua(Ya{Fc(9LfR5q;XyjjSd?5Q`8twTz7CI0g7^qJwDU!wd(!4`ZxnrL`OeRS!e#Q!|!q`AoC1-|hmuClT* z7V{TSo(Bo8(LaS>eVYo09LIjidvJb4PF3_O)>?4HBcg~5jRC2=Mod49>zpVQTcNCX z$tN>2`zb^yDy8W_+*jQ9weSGOe=1>9W%SC%Ig6G|3|EKTc^6`^mO;kv|M9n97;y@K>meG zL-dGJL-dYAL$obw@qwVF{?`CjZN1mki1F64-tBt8-&eyoWquF#wXPDU_}4b&mqW*# zK}VJuvZ1Nly{>pl9;fvoQy}=dQGp4pnf3w?PzgY_k_(4inq3klXb4FF;2)p%ZiX-T80@s##nQynqUG-AwHxY*gS)1RPij)2s z`p|eucoLg}RzF2^yrleyN489As4`ZuG;r+q#sn$r&op!|DoBQYG#C7Sv|r@?-#exG z?N-2u&XQjIxs_99elL*DI2&33@Ayjozsq}6^%6CqFxli0+S$cEs3O7?M_Vd^I~l; z)C6EDPkAUe0j8;3u@gDn8FS4{#EsLgtL4OJE#*SwQ_tmGB^@A2RuLe7REi$$nCm(1 zzd9Hochz!psjd$uPWLY6usro#&~?r~r&eAFnFc*Lj!~9W`#}gh>0d+eG)S#c%144Y zr4t!evF`@r5Qo>LWbl^Mv;WGPQkA&mt{|rBSXzgD{JUQK!}d)R`v|9*s`O4_9fKHk znTQf1{FUO$zfG%$q}gnW*~bh54v`^uQoc^_;#!oDLJ4M58vqo5^lRtgttEyaY{zWC z%AnOEj7Tm{2nS+?A~OsY*fETsax^_YOUo^C)i2|>qAz}HM#mB^MP1~+{Di;qFT>_s zpgj524kD_RyB{&$OVuu=CArs+JlD--5oNb$G^-+@^Sfr@W&R|I)s;?Ilum6Zpe!kY zd9Lyt1b2FXSZoSI`Mot%+hpHD_+b|&)S$Bm)C|Tiz@*FT;C@^pzDdB=UUJ=#&63%G z{~_$CFFT?5hX?FPYsBJw7CiXU+pIPC&A*p4EsJKXKjF3_(Uy{JL^g6gDZ|jUUO7W!= z4IY=4kImA%eI*@|U%eA>MUMR^#wPEf#dU0bx3ZLS@Z~p} zWXlMrl?mS=!B}5F&goqJ^{Iu9Cs(3>T$P32_A)Kqq@X?GGhbsTOv#BL@Eh7|!6E1R zLuoySy|&24A{pyc%@7grC^y{juBL7$7;N@Uq6{%j{tF`a1Egk7Rbx!GeI1ZJ#Iz&IYsMPbU z)CS_-T)>ArilpM`ZXeic#jZ<9{|Hq7m177adEnR|C9q$GV2u!(uz;>8gRLozu}D6i zG@?((!wFNlU{L4uqk3ovZ_Um4WkOxiA9g5sV$G&|-`Ps@132w<`^cU=0bSjd%h>Z? zcPVLIs`!lsoaR3Al))m*xa}B=lUIvePpQa(K+%epF|`NhwS5v}-DUuiP)Td_q`Z)yD;>Ax#x1yaO~zCY6MC#9r0e4sSnB#PlEjMOa@-0wK21}B85!yw zHiqJ{W2Hp}ebri-_j`KS1#x{{su$>+7b{J$#P>qdN^W7sL*D%id^~zPMf(g*LSi*I zedq5ZuGq@%qa6U!#d4!VI#e6@($dtyOeMMUnG~)4=MzDY<9* z+q7CjC0I|g7t9+G3Z@%DNYGx0MueNauTN=V@!3Y;q8R((>3!9ok_8E?`D&MPno^vb zCFA85iXc+%h{oGJ0M89AGz*`XI)g(>1y-BNbgfimBsU#V_o}qb1TdpFYu~>^Dq2<| z_lL28-YHn#L#eU^JGwn%VN_T+P#;iDEKie}XdeQ3fnq35g|ZopWk}(6zu{}%s)w6W zMn1GP-Ex+|(piL*C~dTwPo>8<_nbIU3n$-)A(~#bw6W65=v@M{u!ugj$o=ut;Lm?7 zM#fG)kFADuR+L*0ZLe|>UIesGUxGokB24=tV=!Zme%AF7@A_~VKbCKUnRsr>Fu=fl zrk45X6P0ylY{}BfGSZSQZXF;I%>!l^-aMv`oq+|K*+tE#Uta|BD);9WGWD06{xJ6K z1-+nh#N!^H}Iu!SC`(h&yqlcm54-kyM8VKF)3pJOe`8q zY*l-;RH3B0R_Xz)$~v+sdeWQ**0L{L&?sch@~zr`{M@M!xz>Le>g|9RywYy~ux(#> zx*F;^==8JcC7)4IUHhcT{XPP^R*vS^6yPE<(C7LA45*i_kS)NN6e(L@7byj`b4F;r zS@;aiEVa0+tjNn1(`6C<#mIV*0?n*EGI~P~{X0tLp^;~Jv%RUhX!?SVgLUq$R#jnv z9il9`sGyhGnuV-_8qv<5$UnK1c~uP`s)wswC7xw}{q;;FCiGMj#LZ@5uV@`T;X06$ zyj5Yb&sf0%Bahy(`AN?}y4Je~79E<@))qWMd-Unc!mg`Js*l|JDx}GaPjg+IRA!%F zH#=E4wkMXD&*wpIXn(Cs{A;i?IbCUf9H>}p{Gb~@b^26 z1nhz^FkCR8VKy|X0lc7^5a=j_H(iT@SjDA%3!>Y(Im}#R?x;m-dR;Qck=aAt zHgoU|?ReTi&egW?;nEmfJ%?BsTptXr4ik|woC@O>q!)^wUIWr6qo_OS8Idab!1a3~Q|%-P_Jy6@p}tR+yFV%-piZcPDFEZq!co z$PMf7V1tvY{M7rR8tek6J*oD0(CAbZZ)j)BR+jTHb)HD&u3p)ALx}{nfrb<0Tti-r z4+UBbvHZIrhC4d6wWtmkGdwuLlEvP%06rAmWfX2wTZQGf;I1|6BD>y@XvdbocN{8T z7*q1qaV&Pru}`}^Jt;*F3d+l2aX)H05-BZn1Xzr6Tw~dRC#M9yp`y~p8+d&{kmCG@ z?w?yWq_#@!6b#X_6@l8E;XKTyJKp!?C@8b&xL`zZ`r$Vo`h^#_cZDXG-PkKm^ov<1 z7Qan|C{3%oi&|%%0;vUlJ}m2mQ?wXrMOj`8uRJar(URZ-T)iTNs`B(ZmMQp+W2k8- z6qu(pm3+Slq^tBiFjR6oO+@ zRJRt>)r?y|&ER*=D92&f~L+%H?lZi+B_^qFa=oU&J(aZw*T34|EF3!f`D}o7r5y3-b~e;m zreF4R{{e2N8Kzzn4~#B2aUOpaj0a*VS=|VIKiJg%y-l}YyK;C)_rUbzr}HZ6F>J00~Zt3Q#&d^cPRnjZ_BbgxV7m96ipi2=vS)0OT%Z&RG< zVuCM%(DLbG=0~rW>sLuLh`!N<(DQKXS7qL8iJn^cn(({IjOhxexb$~grOHO3SePG1 zFyG34;v3z46rr2h{iw6XxP`XpvB+Cg^d3HR=55`WCx{9l+O>9$b(rx9(>Y%m&F&Hx4X8?!Sa5ytlGbif2|t#ogezj;{N zI14E!=6bTQ?+uuCvp6N(zq}5y79t>gmVE)6i=%@^qw9`GpIvO2cJ6>4W)a^}i>wT9TZEzf2JKXbt@ZP@wI_nGg zBVOciQVuGi`V%h7aJd}2P+|>w5o5_nARx;!2+s#`YZu_HsjifU;X#49K!CX%8^J?5 zD4-Y|gHN)Czxu>HKJ>o4qZ^ML=hxFH#3eQRgr~E7pRUwLmL$d!kuZkG62YiqQkh05 z{2r2BR5GOhBzyL)EU2i4x`Zq7g}O@!k~khSaxqsBB2py6N4HEg-$9^!_4Ml0+r~zp%V#=T%xOkrJ%1-ju8@^!=2j-xmQ=+J=`#UHicL z5H3DM(AN?uvh@m)#>MBX4Q(VHA6LKbPM%sNPD0OxVchJGO4H^@Tt%@#`a%h^rgML<3pTAu_hDc}|_9A?D#P@;FkLfnmh&_Wr*$o@~Akm`8Q~ z#NN;bY$c1pW%T{Mog3XAE5sc>+RCOUru9>2%>vg#g`_kVm*1v-@G%D~>;S~pcoB`5 zronsjNH6WCGdeYOq zl^?M*H=}Mi)352@3oT5&+%l&u#`FZ+jFx57be$r$svP6{uo_%87tp~^^VH-TLp8VW zTS?@;MDpKVl&z^?>wFB`)8H%VA#e=ad8eyj$ze~~&B!ITYRNvMfnK%CCMFcuO$Ib! zdR(h3a>OA+-V~JBrqPs=$Tcuc1>tP-pk3@^yf!>rq+C$R(?)>!!$9JzKMii_dPwJc3R)^<#i4 zSRs>2X{~Vv{a@K4pR8fnO0Iz((Wcm{BtD7!Rmm%p>k?nOw32mJwZ=Mq-gWjVe?tIG zY_AqDheo4g>k|qCcKwyMo`rA6%w=qXE0wT4JdCiLyhT=Nmh!#pspGkJ-w>QVDSAJRR+@JkepV z;5VpkA5S$lPP@Kc3Qut`vAH2UiqdwDy!JeqLwy|GQdX4?zIa@fHiE&hlQtqg_Z~Q5 z6RYX$u^pcTcU`lN6*v2r@@~cVG^n?ENOW88bj!AN!&}=G^Sf|>HbG5Q)somjUMeOf z61`%dQT^m@ty=0KU5bN=zPU7ZGq0>nbCf(goz|jB;$p(hpF-UQON+EQS=DktLK8UUY!x3dPO_=bLmCYE%4&lk+=$db7(*8>yej zs_ZzgxRx!VmY`v73F;BV?0TuBciZiLADZl7)E&}_-I<>Jq5ab{X9-R+_O{`-cvaT# zEExq;@hJ}taX`gMOR{MuXNF#9xmKr}6_Gc(qF{*)qB9Gqo^LgLkS(^e;ZeCy z*r-BefluSDnHTxJms9T*Ya8pZwSs;g&-=}P+JKLGC#}AnUjd_Zh+z%w#o&%UTi2W& zI7tPMLN0O3>K2K}4!(k<)yo zvgp6S=9-FnImTyvy;ktUBsW<1^(8he88DeT&{ye^$~_d&D0n8c+507`vb*j!t?5h} zBwER10R?V)yXlf>aoD4@x7xQdt15F6AE%4}sz;@!$Yan*t0Cm9CEYTpE?35Du%{%# zT^1Bo%Ub_mVMTonxUhn1o2b@fZ5q^LI4RS3>v{F7n2U2+uk_`NYf9VCFEk_eDZ3Iw_dfdz1aWRw}{iV!Bmdai%IE0$b;xU`crRHd!&(V(SW;Z zdKOtoO9FgDXa8sMpp9wpgw)4AvmaZW>*#I5#x2R(8s{xzckr^G%B&zigGC4Ie%Q_M z0dv1i_Yqgrx%Y=nJGpJJ62z z#*Dj0KOnd~S$upqd_enF+m`keV5*)N5>0KFMPsQu{4m%)p+?D2v?-Sz0(S`tX?bW? zH6u&L&2B`ss&l{|s2I1xu6V}&*W)*Awc)Mm977CTZgGN%x&&Sl{$}wDsOJ+kd^5y* z2DkY>$zIvK+rElS6{oO0M9d83Dr5tW*rKG0(DrvFjo58m7;4;5mGMK!fRZz%-&qC!uhLpZ9-kLBo!S=J?#_2lSt918PR)ge zQ&~EK>Op8uGY~NHuD^aO0!d6RUGdNrGn9f`SvS>nt}e?QMmDp>NFAKZi82|&NGJjt z3w77XVb$@e!UTKZD1!@Slo@UPh{Qr(Hd9>fqYN)sg&__h)xAogaGbK1G8cDm4L5sC zuRb-M{FIuH1Mejow}eY0>8ylo4m1Bc3HlOVuRL5qB)m5do(Pl?sCPR=a$jdYKAs;+1=}3DmDTK9ozu9W!s_D}4cM!u=aII@0&gQnJ;y*| z^kIC(by0P+T1#BY1h;H9C$kC~s^Di9kjOT~HG*IN$&Sz(Z?7V_Uf-EyqmqX%MMc^5 zujXHq=f?eN?eS>Nu)R2@mGE3WJ?uYZ_CwBz!C-k}^NQ~`IQ>lSm_1PRnHf<$pb>Os zAAWe3)Q3SMM;>g?16_LOkSU;j=s7AcT`n=Ynai@CY=cCAL)gvoOlH$|xcml*B1C@>5>ykyTMk?eB=_+$ZD ztRad~SG3!@Dqy+63kB))@g;T%1-B=y!>etnD&_--`K5K16H(%WtA)VZ8gHT_{ue_q{zS+&NoKVd9m+V|`GFODMr%3~@%4z{HZY;L}rvPK|uYlx? zXdwP*#IM{pzq4+=v^Aav#wSe=uWEjUTIrP??!S${E}VGhN#qdCJFg0RU1R=2N+(s0EM=0bf9pWJs+Upz!(R;=wQmEBj7ZJxo3U$%?jzi$Trnz640`QePQ#q>Sj9Z-0EG^rVvJ zpd{R0tjC~XeZTT2ybwKmr~VT@yzq{rbC@V?{-C2p zc*Ec77Qfw0WWTpu#QKi44TJK8+#sr-@z)=5o#&tX&ocoSgV2+!aqMUa9qZ%87-^6U zV)R;DG>&)^WAV#N4>H#Pu51tdriguJXJcKYrR|}@8^(HEH)C35bz;1Nj#*``lI`3( zy-FFax6US?0S<;6=lHmwl&v-gj)HQr(xDJ3cExrBb2il9h&x9TmJ>HsscZ7buhO6q zQ&K`4{s_z5c~p6@Bz$(Ps=mF71%7)a46!n1b!B~qo>f!MX9FSw^-_oQmXS(rTHmZA8ZuEi&{hy zd=`D-(lDfhxd1nI5SbUwM%ehHldEC~JC7SjLps#p~1g>DE}_Q?Ux@1u8q|hRIufFf)y8F0 z_ixmAWp60IHOlRcT567#WM-D|BYS|kWH3o!5S8#(ywhM0TGJ)6sE#}a7js_<<>DV@ zgC*w@D}j-6gh?OAEW&CLq*U!Js3zMw z9s@y0S(!W~S3SF1+57p;2FpsdNZ!Y3d7kQ|WaH+OiMV_7*{*(Z+1`cW@#WO3)(fB* zRZ;M@RJE^8V~rRkWV&wE@`+-BFsiO%7hqgKDd>|jxh@Dm*GNuz`}ClW?CTkQrT#cl z93shoGu5yzhqJ0*RpykhPam{mv?w~Dd;ESbWPecU)N_F7 zU2{L+?kiJ^>3)QIyQgkY3DG4$rt0+EBYiFxLe;my0^72GK0eF_d;VQ5drFH-)(RWe zQa!j)CH$XJ5w*&pqS#5^o2i5q%e|UeG+^Np-8rgWhgrY8)q?BMXMjRT-82o8Uz7qEc0tb{ayj)fIXD4>0`j;Mxo}{Dk9s;vrdhRWP+~uCp)^kLkbJ$)(AoC0ODnu{A3ISLO(J*B zWR!t~(A0x&3caT}aj)7PXYnzeUkI}ftQamh{#ww?ggQ;==||czUY(3|&Sk<75yBpx z1@9fsCO9CyeGQp*=!d^rlZ-m>t3k{$gSn}2?v-6fmgh_PqbV(qH(y2Rz6)Q7PPXvI zq#%~4`YmRCUGDd6ZaALEv+~6OK2qBn&lYMV?>e#ueKzxx!6qsVAB#(3Bg9 z!Ei@o9HQi#Jl^pYikkl$OR(|6$gL=0-`vom-#xe zGGI8{L{grKsg@dB@-?DHk>ymN*bq6L$noIPz?-9?aYVlu0Bs_!Uir|l)D|=HFZh#f zUZ|8cjRN&+#qIuS_1sL~jxJDnN5fVX8D7(m%I=Bl(w>TQX zgOz@J*vXGNZHI@EoES^3chYWxkCLx_PYAzk7W%7eW7ta`)^nLR5;FMr?~yn1WSTmlHmic?o^-Zj zj#(r9UaV685PDFA7I`v>X-!SPe|zj8W`6p-uF>VNXC;Vs&a05^D;`M0K-|&h(cTja9#S86x>2y@hVg z2Xgj_)62|R(C&k83jd9B;yRQ%9?@VrcVJAHoMjX_L&3lM6 z(~I^NiD1{Y!M}m$41;Hm1gh7mtWrjul$m&@PHAa{HS!$_Qz7v4kfe`+2|t4g|6bt4 zWtn$`qs4RvmBTy>7?rr#li~DPZKU9yUhG%lepd@%bQOTZmxB_{KVYj+vCM&&y)7_P z)}6vVY)nrfubf;^3?bnku*85yrVh*lD`9ag_|f!1mC?XFsoB?d-8XeT!?$y0HjNTJ z;M=}*XKT+QLH9qO&erdhpBKB!n#6Sm96xP(cN6{?YJ-Ru0Nz4yp4x20p=42FXsj2i zD7a(;d}D)bwM5s=@U&ksApg@C-%-d&rQb%qKf%AGMuo|r?L+xsB%5dj`@&t`TTpdo zZcHu#peo2G4_emr)NxqOSJ#tQff%jyBFN$b%&M`-=Xc7 zCuK`hfyXAum15>>)ouTwU8R|gOcWvZ5m8-K+kGklQW*iEvm(}bT#!urqfx*29SWCK z48sfizOwbwz`#p=x4LM(>2X0asP-%iD!`zosk}TK4y5{!}u07DbneudVXMJ@OnX>Gkq-S)}m=4ssQ1u-4(1ihn zR~FIk(*9=fO2z^i(qwJ4FCio}B`hI$$>sd4{z)KiERAKzt8;1e++&2k=v4hAL7XV~ zwxf5wWW97+l490ryReD4F)dpQg!d;9hVeM;H;7qtqw&uoVFZ1S^Ur8#FQL@4w&tX8 zb>>`jvh=jqZo1DDuYP2^II z3&lv#p%q#pGYXq>CUhbUMjZA{LowoQ5N&_Al)OgL_xt7N<886Iocr0qppm>Qx2)u2 zq~q`qfKcr<;laV36?z~tC9H%)UdY!X&XGjpuH5K-@am*Uhmbq!_#4AItec19&p!up z5aRwQh^59hYJy1=Eo_^-zTd$W^1yoHGB47E7hFVz;yj^FaqO})B&Ub4~xcFvc( zKqcV*@^;E?6vs!2qbTJJCLC0Gc`E4qv3RPX-w0Q#?;Wrm*B^cTc*6B&`L{&L886jH z{{T-mQUvP+Q49ORz)Wz^#a>BqeU`it~tq`CtBU|YFt_26C%&`5=a4mXKDq%uoJJnqsba0 zhWelR%)9ja3Fjvw@pUor-7iHEISz-?Cx_h!gp!JX=zlGil`*QGZSPy6#n8I)XyVH9 zU-E6T_?RiYAk2n+Az6G)>rmUij#B(m2XR)V@RrWj&p;M;;HWW~1R+f3nGw=+39G){ zCdDRv=s%QOi_jLwVvvQD3E$qSDfTPDCw-yfapBuCO=S4DI zZ?jxrAGG++&&7H%jrd~_#TY2hrFwJgQipt$?4>0|Nwp`}JR{=9V=BXbi>LKLu z+;@XM!7cpi0ltnS(u#t{&!WbaB-yMo$zY#r-bdt|s_Wi2e0ZP}B;w&#PX!5Q4Th*p+yx75bCyVb8X) z0Au+f$38+`iX_DVua-Vg*|qR+kXdvpOx3zuUV3rKbrjBLxkYCVYRc5#i{S@-lQG$A5s#UZoCjD^<475B-{Sm`oY~nEp^T$k!4-aRy zPbUh5!3mnTjL)-rg*#&-I%RJj^MS~_60bM=O;B&9?bV*zZmbK0A#4s=;&h0Ck*lqH zRFfu0V--c4^@v_E$z#EP3nN(glSwS69J&maMR3p|ap5tWE~k}{@Hvusm_*AI#1?Q; zYDn+Yhb=pUDF(!`dtFO`67yFsWxNVed{^@zD)o$d+9d3ZXL3VJ>{6$UseN=C`*5@j zk6#>UieWcDr_f^#IbG}^&W3?3|9UO;B=^lK1qwA;H}`?{E&%8aXn&@=_yBXX_b?eSK!$7mRK$j z4M&pmM*0@hE7qE#IGCS*K>phdn6MoEYRV`Y4DN*IyakTkk^;n&B~pmS!{rG1K;fdI z&-EJLgiT9RD5P6cbY!rh7~ESm-tSH_A2o6&{jMbW8o4@c|D0(oa;nP!R>mJkoiDTJox)M%VBCW;-F{}z;c*a&D@tA?kL z#4s`eyLdYz`kHw=$=z`!^fksr(#~#A-Rt6Lyr)36o!3la*AQ}1SWm5aYfe9lgT;@z z5D}#7+nh;f{HjjmMeVeWYf>i;WU){XJDF1s>V1A5L=Y3<4cj#^nR?*S{GXy(Z1FO5 zLSY0cTQZ6D0L7e({Yb>R_7EoI(fnoU3XVO%*!}>qgO*2Ep>x2*ujhHUm@whu@I`^R zgJK!7q>FNTHQt|%|} zP*7GJSSKa6&@*IMQ|wrSVp{w6?^*`(Dr%QPe)*@{56{I>P`_GDG0lAm51pjr z8N`y6tZneD*qAD+q6<`lV>j#*A|@p<96f1;+#GQeu6)=P&X&kSabPKhA09ot#az1E&j;Cf%IDEa|#9mWCB&%FmKI_$GoDNZL(KOldQg&!yd&{JP2SG|6EAn}9zjr_oC5A)%t zi6?)t)T#eO7j*j@jm%{5wT#0^5{S=OLp+g(DON662o!z=*5zrTf`P{=o_d|Am5k}Q zA^Q}(F)2R-x#!t@l5Po3v)h`c&R(?+h*XqCt(LoMEnkl6V2Fh`<|BN_^tF=^1N$FxjE}iVSzm^I z!w1Ur9q-q?jC1Cil@Z+#cxr}!jAG#ISPsFIWnj4Je8s{jhl3-D%6L;BQPGza*!Rue zcjI!iLC4vN7=i&?;15a4w#{ga&gSs-e;jinL|rzt)evmFfsf71Dn_VYacmI*<+0l& zTbBd2RTxjO;Qd{%OZ2`Qk53uup`RY^&KT{1P|-RP^igZ3S!++p2+^`Nc)qxA&m3tq zbm&=Umjx4VCSj?4YdBSPegEMq&sS|~`mJ%f^mlc1s^ofHlloPjVt4g=`g*vaPu@RV zSKt&0eMpMBp7b|@wsl*Vd%S14X5T%)5_safPJY>QQRQ?=T}?#fWcWGpS}Jtkf4Kas z0k*dMb+Lc)@8`wMUtJ-eq;&`8gT>p!oalpBMZ#f_IXy(_bP~z?+GdxzOO>~q70r`L z{c=~CM{)`Ly2DA6Gm~1;K}I8d^3traKYdc>h@kk#g|1S=LImI1+Q& z;ln*O;#Q@kUZaBVrI51JFIJqdy-tt#eAQqShc^T3BfskWPd{DJgl=lnWXyI&P9Zb8 zr~>$&BI19pp=_qwZA%Ds(ctzT<)|LRW&_SW*fln*%igt#i7TOhGM^NxDZ zph~4xUy7$qldX$1Wi~TZWpj#2eWgzInnlj|=fSt2{@Gl&e_is`yGMD4I|6MvonT|~ z4*HkgTl<5OniM>l=&^C~XA1a!oWCx2*r^gLg(h~_!a2UM#~+`ea5_l_*)k+ELDe+{5UkbMtGgE zbo@16bX1-|&YyaCkavOyxdHS9zdR~DpS(lzh)xtKmoVjZtkCSDZ>z-IpYqxVFrt91 z$D%scOHWvJQFRk$`~>ebL4}oYGfB-y{VqYfAro=!Vh6pi)AQNRGbb5TXN`xJ{o(sq z^OjCKDHLKD`$&JE$F!6{^#$Yt;0?gMD`2kvy;2MFHhEv2Do6)y!k=sMjis5}K2lyo zOdtUZazC3o7CM_+P-eGU95s_C@k!p5^L&lfC%x89$hE@OJdED4gmP9L)KT%8-^o5} z6eBo#AnSQ^B7|IZ@5BTRo-ysxMNaUH@i7)ABB>9txx}E$Xd{thtA@lbpfr*mhQjKhUw;HZ@0OUryw=Sg%)p-A#9V_5?6vkLb;(L<9vIwDa7;zc z4L={kD(9IUZ|4ObBM^KQEV+?*DvaDvKzL$bZN<<=DIF_3%($2cBv=~&U~M@2KW%96 zh=omSyvsR~_)$DkMGU$OtbvYICH0plCt9H%z5SYK>57c_yCm!US+R@$(P!zFZD+5Nvk$4Tu-;BOZID@DL@4=Ajx= z;`Zun_w>`#QW^3I)lw@MGLDyGAx3))USmjn?2YgDMBO)dm&Vsb_!cURelFU}yW)Do zHJ<-0_e@r5z`~qf(TgDel#n3e+YnMIjKMnPr(dn0FDct#7xp=}_}owWuRrqti?EG+ z<$QEtF0?kpPN_%IulO}mkzQ(~uB_cT$R{7om=Rtt>{;p>JG?St+0_hZd>YIw$z--h z)~UYV@TIU5S0xDDTa;XZ?z&=(=j3WI8@5|fpB)a!?&fh zgY=pe8YVpTJ+klULbfJ+z`Pwb|4o^aeDX`jOT$`eL>LvuH4E4#X6ijw{`dCWy@-*% z#iVxQi{fVm?bfbva{GQqrH3w6^U)c09<}y294<$NDEPm{YHhLke`tGHXN+AsU#$Or zUYFq;=(_8PWMtjjd%mvgYMbJnon7G_8MGhgctW;{jpEr>Pp-E}T?C+8_T8`)n7kBi z33F9WtmcU1g06J<(0qe#m=65|nGWmVauI`9}{!vSl$qx z8!s|>5NI-eR2&udH;yvp%%e--M5TX-r@n-`HYL#XaHfb_EL96AF<_+rvLyGhPy<@85a;NiPm7!(PS3^Ut~y)oGZ zSC_A6=ax(A8~syBm*iI;-YhurX_g~+hn@eDCGR~80G*W5vz6GFIQg{@(#Q!9-Rt{($p0Nu z0c1`UwysU%=6BoyY|NIa-Dg$zz3$bu>bFSiE2?U-Tq{r2E72|j z92p8h)cIz)l0e+s#C>Jdy6}@4$Al@ZZP;zVtta8LTZfC4NYb&G1^NVk3?@8Zj0=DR z9)>P8;dQ;)T{gMfy|X}_u5x)pvm5fW!CFt^%mepwxwgsGH_hCxUe&NOI{JX2t)!G@;7_B(7PiR;EM@7$$zoED|^U!8GyMb%54g~kMHukwxS6I0n14NkwU*GpS%+@dCQ zlyq2RbhWCv7d|~I8;B4cXGjjF4nW4KOgh36WP633uAe+Ns&`Q`$%qO#4RgvpV}E`$ znN-+ND&|bR8 zXkGo?PyPx1zS3IWE@&Zkcq1yicIjiKwLDm&L1cS`1FL8A&?&c;R^WBNoz`QW)O1w4 z@XKc1hO~;M#EJ`(Z?L44tVgL4$!7N}gL3zd!&Cr)T;tg{(aaHV;UA<`Mz}p6 z+I7f{LZ(EZLMCz4lSn^%0a^Idgr0QGRme%&M(x!`_ZFgM$6S-^O}oro`Kv5d3c3+P zn7={Hl*;H}?J>s_mX*SOAcGjFj%OSZ`s{d^;Z~@6HnptGDsc?ZOJmq{bmvq6H4XxJ7fhicVv9+#w;cNJfmf?T} z-Jyh&%>FXR&?X7u1_2b619NiJ8y@LW=}t~ixD6Lt0(kJ&Vu4K7gou+O!ZtBdI~u;$ zO@iML_l4Z1Qr$fO1_+CiPlHro)d*YPxlHljBkYI~o{eq}`Fbli z_s3Nw%ec~y=D^j}lbQKHGL8uTf5@{_Q=A2qGUa8Bfn^&>W~@*zj{(nl@ZhAi;u$sd9fDHyaT?W0Ti#Hx4R-sx0RuMp zO5jYHtiQ-JQ*VX)-+uozxA5S`8S`SP9ho}0C$gxME|ab@^3=Tmm;8b~VPj_0oD2^G zF0{*_8->jPpY-gWAjO()bjLxuqehbb^f)URamff8@XLirtx1x8{R+lVi;eBo@V@IM|?5ly74%}%BBngGi@Th5! zB-C7U?&n1i30n3gljcnmU|hCxEj zF&BOi6`X}pRkKL$Agm~>Ql3$YDlCdwSrv{89}|PjCSs6K-sy#~?XJ@ck)+!TFU}!_ z67OqoNnhahUbeu?I3XOGjfWhw zX^UCgi!Aiy8I8OB<~+{Aa#klS znPoEW4&{Gwo)oOAQ>q4-&-}tp@yJb(F`o!BLV1^MLP4i(LP@7>LP=jLOFSmIW*Q6SennNa*gW~G<$PtaQ>Yc%DU@*AX+8~pgqq8E<|kEF%JX5F z>t>f(&IL=-P}H-!uKnD;hUO;xm`{Wsp}f;hVgFR8ogzuMonDMULJ2b``DkO;eAXM{ z)u~wbUDFzCsfA_@m0|N74@>6LU`eRCj6|6FVaRGfOLQFxE~;Ga^L`Nqbs}btvtn+- zlKDhf63RQx6LwG4WKv+7NXl)R4to9YADv^Vm*_@*a%+kZ!@_?j^hQvJ7fyOHb2m72yg_DoOZ1^xK^ z`lxfE=eTo(?~O8b(n30Il2a|uxbRsX2L+>4ogyz}K!41-KXzIZn9U~wvryjYw6H6u z)oGEG+i4y8Y))${F}rG3?C1vNT2;QF>lg3+ub;na@|C`%=^a~bF?$xczMt%(s3o-q zT{l(xvb!y!o16Kz-@{rxvU#nedNB3Ued%u+L8(?(HPQvtb&hwxyAwuAU?plUCDd0< zWoY__ImAg9?R~RAg%RLOu`EL4vE+OjmJBu5vr>e9Tr=MfsCamiuq>D*ERX7-tV14E zGkXF@Zeq##L@XJ~JDtgv8j781G>+`jXLBYbO3rluxIVhEZ1sThXrZi<9P78mc0-kp z$c>s6(Dcrt35RIo;pTi=nOmqi%*!ZCNz#C4VCapgGant*LS z5wL~wP6LI2t<^wBgS9SweNxfCeE?Pp!QO{vUU}bzSkq$LZfQyF5_-A_6bX+9Ath4M~2hDfQ^jz^=UE`7Fz_KalCH!2$b+U3?< z?@!15pFVHIQkof=^h-Jve|n>W4ReJijOX1KmD9A;TvLMK0 z&>g1IeB-iYaau$?D*Vik>@{d}6IIP8qN-5dX}*rMOJKgE5mlEyoB6_=%fnpcn*pP}MEOyQ{q+w%-^!@u z&3w~tU+ctX-S1Q$`yS@hzEAG~Izo|SZ>Xk*9=~hY_wT(5U45*dODm6_htWC-As-r( zmkEW=@S$m#DAb&Vd7SaAWI;l8oQp7Eyogg))@2gKQR0U&xBHNZiRKU{)a_|ErT0ZV z%*Clt?-z^sn`YPbu>~#!i|X<C2%3AN*k!cMu)VFJGz!= zDS!C@8f{iZBliYn>0(1|E9H0J*EBuNRDgPKL@j@#`m&iyr3-C#C6N-ecP)6S3!yf( zH+-9{tA8@gVq+n2zq3rjay}gi!hW)d##ty#CFB-sz%RL!S>s!%iMVVno4&oYq+76r4IWoZyIN?wYRB=<#T zZKRgW3{aJRm|&_{++nI%@U6N5J4LR#u}C>qWh{7*oP_NZ5Acq+>R8z)s_3Yr(o0{r zKo>&s8t>+G@D$W+O(lY~j>M?97PSuinSu3jf_> zv6)v?r+BxOA>RHEZz&n|waIqAJ|U)RFU}tjL(KBV(8`WQoZhBH$9o&rTnV|$MMc5< zN)*&%AYpl3hO93ANC@eRNp9U3l9_LM8$?Ub^EM>z^fn}D_qGcQ4By%w5IPo;Ajjg~ zmfzj!@SU#3?;bVi3!@F?X_bm!P8rHutk3(oT>Mofx&G}hYw1rk;9vglSBv@GYN&U? zSDyH(_~>`4uctgyZ#&+Zp3;-qsxXauEQ(bnsu%lJLVmJU1u}l9M$FPrRc+bDqo-?T zc=PRbPZAP)#s*(VNp+H1Rw^)j;Q{Zv6!^vxXE@&^;2Uc$lPaVfMwY}SH9RT{Rz#8f zM-06Hs(C&OAlW{GN30)9L{Bh5>z3q`zKgvyHskfGH zXL;g@!0C{N_p5d*z2Kl~Ua7YhLG2pKdvy{aWSD%Z-L0vLjIO}6q)s9$@k5^W`;Iqs zzwklzJnv>L!^Upb1nkn6t5nEod{-I6n)NL8%N@@HH#zSt^SA6}qoI5yI>nuk<}^*S zD2PfH`-ya?G%n>{#&Z@IdBUqKi)NV>l1^r!=}s_%_B?mOXsyGYkf7b2MkWed9uv9~ zmN59t6ifZ!>Wfq^pl$l8A@@5QS*x~wWwLX_ae&WRC<9c7R{n38LpLjxlT4aOL+5mc zo)_NNW+}X-x<2bf4{Qz81TRE|B*xOW%?in)GGz_2Er~M#hgWoL>Nc zxiq^OOPt{@lR$5*xz5Y7s50UdC5b#{Q1(oaM6AwLj%JuwxwTS7GD}Q%ff=*sxeLUD zEBTF`UP52nw3gC}PFGLCLSIF>1G#^<7P0QK_scJ@UfVnbPPJ|2X`Wc&6{$RAF5iSfNjDngumUqDr&{ZGd$>FX!aq z!#f(*7MjT!cn#fBBJ}8;<^5T%)3MMQ&OeDVfHn6H&S=x52IU!(UN2VwxocK()1*Dq z?)<6g{4h89Jm-gKy50GqR-5xf(BJO-NUTSC{{Fko_nn#8nl#X{$-TLL?s;E6X}w+y zMLRX%L+d~v*Y%dGx?}uZJbJ$?(yaK&mjvERgSMPMF71emCC)JBN!UHs+y{4z@Jt!_ z`990?qGD;mXMRwp1ZUcfIWvuU5_XTp9mb5rz8Hs8VA3N&do0))_1VE6d}AwwWp3pH zEZ61buHDkg%^&!Dp-PAA8|N(*7MFh_vWgj{flbY+|DcFouXN2f@}=raJ+;&ErP%Mg zdWOJjE{5;1$Qf=kDTf+srrrQ~7z8W`1<}T`8O!1zWK>))kNlKs>)G8VH{E6u`j5pO zZiB?ma2wn+*SZrpFn?DVh{U@9?8p7QyjMYA>s`G%i2vH>s{UiQ`b(qj*e@5yfM^Q8 zX{~a{`TAKZ(-+>h0Pfd;exrjnYT>k*7rT9Iwx6X!k7~=z-dSd5jjl$M6_n@{&qA8R zP>7UQ2_q;+Mpt3TvLr59N(KI-s30WA>RG-?R`92h6`;7?v!Iy8J#NN{-CD%X^C~Fb zS6^Ch=BrY18Kn*Cy+!`&VZIP|2)(gPslRD!R*Offy`fa>&u-d#r9*TFr7ZzUCUs4I zrXwkn`a${3)$=wXSA98cn*O-jY9x6C-TUYS8{KO z%Ye(RCXoSRR8Ze>E`5RXDh{pHY7^h&5ctzL1W^1^lXs5;OnzhwXNyL+$s9q+-mPPH3lvDqB~mMcYA|{6vr1o_+u;evu(pj9=ONl)CMSWhI34#HbBi~ znhC#33#5bu8{xoU>6u;Ct+~WY}7}*!uqH%Bz zdIO)E#k_p9d5VMWaO5efdQYpF2rm8_9QsR7sO~ro{Y^s`{q=Ju$6V>2>HA`fs(re~ zhx(dg55KNkk9qSYk%YK*DT0<%1%bnw@0GOpEnq_6H)`8`#*-oZX=DhfxlGeAq&Cjn z=K-}EPgx%GocV?D>oCjeI&?UgNrv#Jks+Y?r4HsE2RPWs_RbcK?%l`1On^RR-+^pp z*?R{m-C47Sc$3lUCqQqZL5$OWnvl4sfH94X7;| z-EMRy)u4NY$~@^Q%ma5Twq(3rv30Z~5OLdzGr7LLz3zLlSkqRt&|k_vGAu;9W$O(u zr3ZCnh^H(g2W1DpOxqSUp5@?AV>v+0DbItn409RuRX&USncS>+NwtN=%ohpIB714Q z#5Y+E{xp^Y6u;EBM)r}$f==IZXtep3LsZ%4ZnY8Znw;&SJFNh)6OLwC@yC-0{AnZt zs5wlFq)4-wT=A&{m`LQwB#ASYSMrq7S*+bEO%j1WjYI&&FSW{%ouILx(<&VrZB~gH z1&Ub8`!?kVDViz`OumYx*ly-!*MpY|FVZ1k<$Y-67O~=s$1VMlI&7#UQDDhqV0$QZ zhAmHn?V)B`SgArglglb+kz7})+5l&?vc^>%rIo#@KoXd+eJ~BShvFC7G9Jfa%TUl| z%Px%;TZW<(uA9xv)t=ua;tzJa5v8D2_uzwcLRg8PYkiGW-t*Pnp4@CN(_(oNi(x|{ zw_yjM7e#o?arV^5;}dtNQT#=fZKmy_hX=6D0GJ1PlJA;=04D1v}ns?Ug0w? zmu=?DRht%VTC?qTZ$iJpH0T$KUuyTTzPXiy0mYnFKOXpnqWhH^FfE4blRm$^yO}%y zb5-1Jxiqn=?|`z8Pp>|@+Y}w~bj91nj}ro~iSoYjuGTs`{kd1~R;AurRDZDngX``( z50j{@>|Ho@m`egB&TzkJFf`Q6MNpPmR5Ci)%55jjSSF9Qtd=L+NFHqITx)kf6NV0^ z!O&3r)6n%0_}eJK8;hXR<1S8ShZ4hue`!?PqJ!#vQ+f5KSsHnXo}GaRbx_9eQ;O0n z1up9@m5)RB0m9vOE7gNXvlP3W5=~)jy@uwo-W7{^>AffKT8Zu9-1T<%?%TJ|U%jhu zuRnXLphXmgr|W9tY2&LQ{EfR^X&Pt^HTM-H8P)D%Q68i$ljmtBf>}IEgP2P9*Fg&$I8_qMHe4&_nOH9j9&GjJ|j zIzDo)Qbvu%zN@$D2x@k~9nI#=o1_*8pr(G_$7@Em+rYjimt=MJXf+)#60Dw9$2m-NXnU|A3f=7-sA z76&2ae%XD}#JPiMI5!k``s66V8;hXRCz0UqpFdp_gZ@G84j<;L@7Lb#Pb#F>erZ&F zN$j(*;(_*AHKKP#c=FNS@_g7_ntk8!{{ei|){DUAquM3A2cx1)-%qR;#%}oaU^g^N z2Ac1KVpI9Xj0XVjHYUv;TZP-*rs3gGbDu`ZC?kwTDVN8(GO3uV??>hRcxi2rk_09m z9!$f-p}5oCMhV_n1nnGp{G8C4ki;Jp%e|2f@`HF92Pig`&Fqt1=5%VRbU4|af1H+% zJPu9e^eno%V#QI<=Y1(Mb+9}Yfa*qGhjsmi*?r?0zNfwzzkT`eY@aCu9PZ-A<`%1P zyW2E~9BS@!D;Z^*v8WCN<7q0xPOAS$<^R&y&LIv=h&-4EkwbB(yNwdOu?RZc?b6!) zSmHI;5!GPp()>QFKuy<_DF)J&v~zvKP*Dz6pNgi;R?58p+=p~hNMkm@+t5rDziUt9 zI-)}MF4h(ClkWcys{XA1PNmXz3%*%A_Lm_0D@hrNuA4c;^x<^y707r8fe43^!uA8=<7bg=$-dfc3wa!IXWocj(f7|d?tF93P!SKR&n(tlwLD$v@8O^r?X|9Eri%>pB@Jmi?PlN0 z=%)Zz7I30)FT%Fsbi!~Na{+4ZlN}iqEMrkl{lBXyVye(5)%o;md)a`{WG=wzo#}+G zME+~02DgIqNnj1pd4|_h_TCvvMZyjN=S>YBSx5S&(pD6w8?7-r|}w~ z_;`zUGbMmUk7YRER{+h}nc=SQk^5V*qiX}QUAYk7(TRb2W*`0;Snn8i0u(yKdZ)1y zpk_+W4U>pE&X7b(f(N6-=)!JyGZnC8P@kd-gd)FIryhvVwYmeRXcXRrWzvD zJnvEcp|KbJe`lM7&7Q|2)8RB^8fqqLI#C=MaUA9HEJDWPtY*Yb@43Ksdp42ja2hfV z#mC#TWyFnuraZ1xJ$`y?nQADuKi=)jORI1~Y`RQ~L!zK9G4!29kJV(yqr2fWbQfy& z^H?P|GsY_@DMe;9i4yt+9q zfXEkKxlo-8^aN0u0H_sTtwWJB9A_F%3pG5ei#T1fr$Ju_%I-KO zP8&|cX`%Rd$FYoPah!4JEq;2tqgb_d6g$m3`Yura(XTcpJD%9UZlaN?zaf9vS7EQ_ z?f2__A*i`(`YwZ_t-d4FPDLM*pD8zws4VLDoQB6j&3!b_VlMZZs1QCY z!YpG{lcq1YVfPjjj}52cu~2-xw~WABZ^nt;+8!Tz3NHBG*(hPK(nvLpl$#xD%$7ak zr<~ZfkNBVV83bO0w0}6E?Wo3dH@eb?xPGU*FY4x@z^yJvccI7`PBjhPg_^res+>{! zD~seIgK>GvV06srw}f13DCyZ|RfDo31tByB3?} zylwj)K7G}lVJUc+^MRL6vjYL3GMPd%jMceK5r8PEmVf%@By zM{3sVeD%BfLT+!qcx|)T^=#Dc?Bk-ILfuw(8jmnX(-3B;nGQKrbdyolO%};B4$I{s zhtVmAstT4_V(&^7nFw<<4Pl1jeGosFjqv+e1jGQK&Y zO3)ioP@PfH1eos_fEfxo%=eQ;lH?qe5nVfhfEEnFw(-4Izf& z#<<_DuSvyc(`ceaqh`9bN0A9TxWkTAP!)9xTFhK$ck zI;Op|Ov-AU<1yoC8fFYN_vAw2W;=XxP0 zyXmaldwnm;@AS0+dq+e5@>*H<%@<(R7%d*+P+-_tQo2zwUtrsYFmsPsylzfD=NpUc z2O%wk4u-csDcMsVLcfuHww-Uw5PP+2cCDwtV)0Xv^l1T5FIT0mR6FXDA~mBJ1*!gR zsL4|{8|u@k!DwFI)4(-Rh`7?bAaq+DdCO)|>8a54balIKS~^{C_gyy$fw`uJ(jCEBLniVKEEP=7Pp1F8w>-=lJ~j=+DOS*gv;@{9J-dLo* z$>9E;D)W%dUX%aOi}OARF5_}mH?+OT_gF5Z`O^QJ!3^-GOTHh~9;Q;x>^1AIp4(n4 zUw7|9A4;fAVP(ulI+WbXx{oVxQXd)O4@|03B-JftctE-zWHR!W;@3uYnAjX0-uv44 zad@w)>Dv!gHi=$C!71mEC}!QlyHS9#y5CUGMvuG}6`Go=9&GL;!;@keNfZuV7c{^92Rff+ODra0fvG;Me*v@r# z_)3sFtGW-J4PVP~L@ncxLYg}n>5rz*?%-V?xjVoJeS6^-S~a4jf`DDi1fyR<_b7A; z(m#zN#O<~e9yPV9F(F-RBMz2~7v49*jAfLu+39xQbOyLrYnE5-Hky*L;#;|_FX&^O z9{E}~N1-A4W_$mSoeXi*dLcuW9#SJFM}IA&7wBHPcWJrq&9^&cCfD-Gj0HlMUKZ=t zC@@ga)hewCr4H+)iAa@dNub0}`t&vFeo0Jg! znh-VBA5tM`f{q`Zxg(1m&)A5jF*cy)C`^i362`17qL}I}r;I1FkcC0SOOchOA2@bM zld%!m85^T477gjLSS07RSS;zX*keiWrD2k2*!OA;?AJqDbq!0Rb&=9<7YnffMm3(X z5KUt&K+S$uN+a@9HVcR#T~jaKDBLtdwK=%<1GVmvk(3$dNCFvh6hkPf4QayMTN zbCgb778G|{7Jdh>LF@%3-VhslGgs#y6a3WoBr6#U$Q5m)ZfR9xZ573|LpY{N*$Z~? zf8LdDaVSr5&(ArE!nvt{=&Yvy)Ua4#o?V(vbP*V#O>U;ZAFV&7O_6Gzy={0mQA%CL}5M?+13-32YZKCUs z4VCU2?r~P~h$M!yC7rj#u&;jo`)|_OTUF0&xR2@l+TqIMi5>AYVh7Y5Cn1ljGL=V; zlqgE%%0a+c<>#~9Pk7>@D8(kRBeoMeM!7N?(&fsKWO1G=BXPGYA4{5{931w|5ufPV z`*A;)!Q4P~RbD_Bp8Wy;__m|->UY$eaVy_U@p#sTiY7!BZw&dwo!j|xzTlhQVH|6U z;gL3X++UgwkFdYMY}6dP$^^&0eK=BAS(h$d_Vv+vutt0Hv4Z}RMx~MKYiRSnm7Ko2 zX04|mxl9f}r$vOm%mv+%ti?t? zoIE6M)g6g(_tKVP#W(Zjy5nN11xr-(jb=OdtkA

Q$D;O}w-rs=7lnqS|y_=^bf6 zt=OwCPx3O~Ta4w5^=lfF25Qb~UezK2G_jpY zGiv=pL%P;4$Wb|O{X*jI^$W6a`pc77U%wnRk;Wh}9PQMCCpH?@RiQgABBj`@v}1F9 z%1|cmwT<*h!ZTD-8(0sU6|2N@xGx;8FE0ST;N(?=GhCE5b*+29D40V<4egu~-O5Mr z>VAHAPm#oz&%dfC`SR`8=huCb9>FTDS_#x+D}cHCy!@T0r9W=F`_ki(>RRVyJfm*B zr=QS_h{`>x-UI5jUM)rUey(;awFqta4>gZD6=Gh>HHO}$zG3LjQ~j3oT(!~bv1Rr7RjdYo6x2mWUcV|q`UwE&;_d{=Zy`z4_R6KJ?Ksk9M-7SxD zuui|m+HYs*Of;EgAYpRR=@*{`Qy9avZsS zZXdnx#0pT&gXFKjk$uXyMAKv&837+jDf?9u?)orjZl*5SNq}8er7X5n%0?~3?&=?&wF1s-%NXzZsq5q$ zi-da}w!Q+r@`5!NN&d0nYwt!p{JPd$8{HRhAeM1?2BK!ji$#aPG{?<$hlLT&P0IEF zv)2^=A>)(w*yWDslY5wZO*J=rr2A-YtqO4-`#@_WXrcz6}8vUYdmil)u*Ie$4FEyc?(X+F1(d;Tl-@{Ab z#prQkp3hR@3l>J?#dQ!9F*#*b7zpXkyp#cz-HT1~T>Q@`&%q%t@nYCX1bXpk0^JkI zgVP`yR(G|%mb=1(STt+xH~U(H4}3ANv`y2s1tF{k=BmoC5BH7A_!x0jv~y^BoAR}_ z>fHnPnDMl;cmnP0gInC~63eEdQrs^&*;#+Xq>oF@<`FpsdSE|}b512N;!tE%0wbdm z7#S<51V(s935?ieyT$)}wi_Js5~qNzI-paGX1qO-Ja7s~-IHhk9i3py=8nn*>AXqB zhNf&v{#|=Pv70Z5#d)wLw55Cx<^2n9;GVu;)f*W`Zg%BXISoaYujPiP?iVzPa}Nao z4;fEeiYL&PKDfot_mE*xVLBCvbvbU2?1#<(WtudOdMAm zPL*nrLDEB0c9&z{h1_sTUfy^78}%Et@$gb}gVe9($yUCaMc?o3V{cpD@Kt=67aP7g z^)T-&6SHL*K%p}nZ5m$(YA%W(jLUS!V&SJ$Xt8F6sA|SD9+g>HiPDi}5Sx6R7?CV4 zwQn@eCH4)uL$7YUUjnolj3(0L`~!6cYO)k zCH|@_o9zqlXbhb!Q0+(5EoquzT%}}xFMB+$x}zW;dm+EXPKmxhu0m9=H##+=AT)cFWMEbLIL?%f2+j?Fkw>kyX9dH=lroqOq+O zI-ZFXPh%oM&7lb6IOGv4vy_VRClTX?G}E9;NM* zqt&-)n(zI^bqo5`!l}R(6Hvl!&B-*z4%8fnc_tDWpHx98!<9<-EDsBxC1v1OY0mQ^ zvDa@%OvX-vrgy0|qj4^=W;8}$!A2KB@Lqwq9Ll@x+EI|?_m9A~F>{A#^ir;CB&PaD z%Q5|5nZ6>WEMr4Jc6=13REpD!Sbw}v6QD_5d=Kqj+@QIB)TLBkG|9c z+zlbz9)QL;*8@gVU7)0GWrw_+hUgbV63Bn^47#l9*d#4ORs?y{gQoJ@m*q2@F%;ykMatIIf- zCK{Bih{}ouelbh4S(wzZu$!m}2PY7Bz0gGe2^cUOL*M`1G)pdb+P;A*N(jQy*C%AT-Cgy1 z!Aq+8K%T#q|Lbb|3x%{k9gJe|{sLTais_@E5+-~Ye2p?5UQMP|g@Bq<;fJL^i&>J! zC5wEKvpg;$CPSStt?QJF)Qp@SGbhAP-9#I~n_4X@H{K5Nwa|NSG#Z-Q!X4IewuJa4_-R;r_d zFsiQ9dPDTt#pB_e%zj7D+B2s3(0wz@?wj$h!bX%Alp(7Ra8oz$M*=xO_b{Ksn+b+zN zpZ%)I(l=^ODxrc1RNar#_U?9k!&lobt4CESKYIOr+W;!!@TgLFwjGZ@&tK&K9e5df zDvOtmhhdXxFf7!Z&ElZSGQrZk^5rSLNLgM40n>!-lxL!Hgpei-o8a;X=Xn`~C9PhD zq|WrR(KQ>eV&r9xCL15SGUI#WRUMjoo5vnzubpvNwQRUxZHKbv+Ml~%uEz@uLa8E* zR=Z6P7j$_O2Su1#<;+aid+t(kP*HR^UyJXI2Z)nt05Q~DguV!~GGuj-XEGKH3YLXQ z$jZ7FzPkR(?K@Oz0>mkXSI_btC~x&0D0QCiSSIc89Vj^@nNd*q_1`|6_9Q5N(|D_9 zs~I}?!uuwcYu!glInnBoO#E(0QKF9;ebRK+=i+oO+gpoPQqvIUt#c(!y53U7G3~xj zOMTKlvuakX&v{sNWnB6SLTma=Jzr4LMEirU`~Rk@?*I0ozXq2(-?}PZsB9{Fu;bCl zjgRI=ND39>Q?;$>GYiUF?{etWxliaq%i=*rp;93Ml48$>1zru`j_q0n3c39{od%Ud z&0P!yrfRcsGK?W#MFe!Qw%Sk=hwJ-h0U*#)R}%g8WV?- z`{dErUobQd#RuBV?!GLY ze(%@4BVT(fv8DbALppnx&ZrZZhKeuJ?Ve!n*Tc1oE-a?9Jo#or6-t+yCfLHH+Af;wY2C=-_ZA>~{IvyLHX$B$AIu1_(1btE6TkPfB7j za_K=?#GvEK!Cmkr5>8OTwHTHozB+>Of&dg_*e)<&hWTt#0RK3DR@xM0;-BnjZFQBv%Heg zq=?g~D$AnEQ+q+B)FeKnm?&_b$02#U$04aRJ#I9+0ZQtUBfo#OxE&IGGhCz7>Q6^5 zx?QA-541^Ky?d00CieTw&-agW!mwWc{_%$l7oYd77=KX3jzhQD4V~f-%o=#By^_Jf z2%c`#(yA;IVqVC%ECb(R7FWXuRbh!=Ret^aK~8pvf%i|^wf3TiEP94CEj&gkkd48x zBN4i{q4D=+`sX;%M9*dM*759)bQ-$@Y7Tf(lqC;X5!Y09*%yr0Va2LEuA;0=%PjZp z-fFTtQp|=p&s&ka-CL2=ncg~@!hsbdAGPr}UQ3%RH3Nn?NPNF%4b=?yZR%7k+Se>M zuK3Gt5a5fj^G=`6cybcD)F)k>2)Ruvk6S$U%}slaV5VJ{ZyLKl5*{Arh;p?SrAFZ` zC~=0zO=GP<%|(?K#mo;_ofbK zdAr9!{>XVAH=4KtCG8O@OzrPWzx`v^Y;|Lzn=k$Se<5o6inmm%s4K6f_6D^to^IUm z)}rf|$Gs;Ed6g?c$&Pe6+08)Toa$MrGB9dWJAYDpSLG_&<}11NHFP05SMXW836qM?+FqKb}4$68XHF7gWzKNdOdSD#Sa7m{zT%cx=h+vk)1q*qa$PKZM z7*Av%E3!PydBvk7v8TPICc`D2$Z&!3cK4jdaIs9<<(`<~0z4C@>1!H^JY3xiD%4PU zxB5C>^-2|M@{{g3XWZEXmqbdQ3_e%alsbg`*mX?m3830(hr=bA)~2hg#EWLP^>*vB zSppD&rV2eSzM-^MWyQLRuoJmQB`I6ED)JJ zEh;s6Ht9s34U{KR2XJ;ruMh84m);4SeKg6&r5JcTWD?ysO@~@8RV~Opf2>CohHD#r zp<@ul`e!ZFw%M$D?%V#*3YG>N?}zSt*ygxmqj&Z1U%o!?YvcB{aJ%hUVVzwu#-kwp zX(FRKajN^}cIdfoo=8=7N$KV?qTW%ZVf8giUBi{MF5`cqhtkjysxKAUs=~S6ThXvT z!Bf4Z#~MoJHp@b-QSz7IQB}loCkK2oLH8-@8~o{BL{yVewOOT)>pHf_#az*{0cX%sQ51c>eKZSA5_LG`4XStP`z6eqz6+w}YOc?N~FU!yqR_kAgSx@l>RA8Wjm@&SDV+ zepoR&T(d|XuURIK*DRN(>qH)|>1=KFz|5o~WfQ4LP#$|A6gkfWEi-m_piA*-4}?-( zI*6)=RcZUD9q#BURF7l1Q=M+b{nj%6Ab6mn^PhI_EV}5OE-io9*HcNT#;RtH2l-R~ zr>>int|+g`wYn4F{+dcU)x4?5`B07Gcb12Mo&_b`o|R1_13}IGjTEDEF^lBMm~nYB zW{Er))47F00P^Gc;DN+9EftYpbF1TIsb$j1zyK2ULXW_28>VA*agDV0Z-5ved%;~3p zh2udI6?DAu{GV(Z{|9RB@0u8;T*-5(KVx}P$bIs9AqRZ92u?W2%3W4i_BC4<@-)--kO_x<@Tn+7$BD-u3T`0b<#81Wb z>9)0N-A)vEEie#Rf!o?iNLuT&7SFJ!I@D60-4PZeh6!n~MGL`sT~ktw?mFGkCHjjb zx~h4YFT|bD8DZUn>lPhq8oCqRutGh3cbzil@e#fTyw{GWEM?OuOHgxAR#6g`1uKd& zV-YU{#&c1yG7oqZR@|?+VIB`9xqXe4EI=+Q(aC^_)lt)30b*$kfje!1M~ ztdu@bA1FQ#L!+4EBrJ2UQ#o4t;%B$&4P3g|vZE4HSIEun?4_r(9QI^_VE2V% z7W`4V9$hfe>O*%s#W5b-xtz{|k)vt+mx5vSz=Q!2^SBV*BhW?nX4t-uBW1b4lao_t z9u+fF)3vTZ(lgUvFG1JwPI(s`sqJF?NgNU1V3+=(nI%1_Vq#Sefiz5X^Y+Hz@)=_x}JHcCR&QT-ih#7nHYqEt1k5?10yfCT~GWMJxRB%d1m`(cf6)j9~sruOZcG z=;}Rxt*QH8_#s}@_f7N zhSEv3!{=24%Py0i{+qQjsGqB@V!CZ}iB8sJRwFsCymL6{eE+6xyZP>&qBvkQc7Ijn`G70KnW=rb zYcFh$qxWuA-bgfe8@|5ps=Ktri&Ra0`>x4_QAOrxx`)X>PZk5!C%qMiio5f@$wo8E z!JH&vNyTy{xsz*y$`l+pS;$ex(4wHw8IC%Q76mmE8>&vLn59Y1StR0w@q&}LM!Y9% z*d5iRMP(CdQBeMqu3i8f)kZbyjpwbjw;%iwZOEh9Q8wjo{{Suv* zyXC&7rY391ohwkpK9x`~{82dqLBa||>Uxm_|3;Jg<+00_S3Hf?soA+FC%-;TlKwH5 z=U7$X>>yp+W}v!W z(aVs-E>%zRu42V7(QaC+YN7XSd2Fuhc}Yx5s+=nK@gMsS%TPkIR&=rd{@PBFVR?D4 zdTy!fOVxso79oAU-_ybR`qf8FZ;b)8D$d|b)#+UPq^m(eYKKb*)y4}gOk+A5VZU=P zOw-t6P;(xZX%b`!3sWA;6TL6b2E{C5BC7o?j>0Szv2|g}O}1D*ku3)0tqT*BI)7oZ zOx&?BLCJlQ8@xh6;eLhE_1I6W1P_6-Qz9^%+izEj>Dl|>P%lm$#gAil?^pRy@(`g`r%ubhVh=@B z+x>*)f^hT_dfv7|1Y5L}?n_vy_I+#lv7tu7(@Fe{7^e2RAi2qF%O~>MpuBwzKvLR;-fSBAMc*{d2KfJI zY8#YPDuKo~7P;XDZJ*__9rnrPP{!YDo5ij_Fw4X8f9zIW`4E-;=zi+Acn;pr<>If> zB}(zPzpOVZ`C0ts$(uCby`cp8$)W*9+Oq)%%#Usa_;FH2A-Wv0-D(I{UU=`CAG9`I zo2i#epsKrf`w}|Ll8=;E6#6v z!O>M{rMJlmTzeno0cQ&rG&J6DLDDS~!l*5x3oUfYx|+8e-LT`+*Z%il@q!G;$3yVp zX!Ly&X@4;)RLl6rD27569rUv*ch=1gPKGXGRjD$!ZO-Up1dz_70hPDAYl(8?O=L*^2oz zwj$KrGZGoGoEY((7%z&FWxNdXTogodvab;)TQQ%=R)q5QH3CWDHDWYX5lZS3OjNz| zwAMEk**z3OKK|x#DbPD7{o(Uw{=ii|B)J1V!1NfX=3C>*$CI8zgA8@lw7>0|yCv>s?oq$^dPLG9913o`=Q2FAy&* z<5`pWG}a{4+%qE?v7lI#`4P)!$&96?UzU6(hy-O{SWMPrK9MyE{c^EWK!ZVkewu}@*uI??v*EI%I-OAU)-e_7H?G<2 zuaeE>sWsOpax?iURS>e^3w_7Z#S@+5c7wv5drb2^Y(j1yn?^8%n)^&2MmYy85@8|t z?I2}!R^%f03rab#`{>7qqdJ&4#MyceN>o2S4@DryjQL;`&l$7AhX&eg{8zas|T7w+1_E zOEJYtgQ^`jS?#j@dzAD4xbJE|Bwckt)8E%tQM#lX5orXa8wE+FTN(r;M|Y@{bc3{j zbk~TD7LW#M#y~p87`YJ}y!-y%Kly|EIp?`|=bm%#JWjBpq%RO|4~X$%`&f7{1Q0@qGq2RcQiNDKqJ3Q?oN^YBVJpXQ_=i~UEh{pN zO8PP4tnOv*565fmyA@yY+y%Z=9eaPdn)}cpI?u2W)Ujf_M}w&mYGc>^k6S2cWmV<3 z{2j8F!GlJ6P1axL(a1^unbC9U!n9%1>eH5dOWFqnK?0GUt*?qdYv7wMe4sT^XV-mD$Zo~ZiS z`M*e?g2<-cye8l9V}6>*lGruUeU`qn*U23C#GX_sx>L4KO714akJ1hLge&yb=bNBT zgOKl3Qu&2kJ`{hgLamM@_$=2Y4@5}5oGc(uhmHCI6`?AqFyCSG6k>FEKBFMPtLF{m zbvT)z;}?SHImBpJ*tLo|+gL8;*>@l3m8&|UfCyPe+frZxuflSQLX~z)tIrCe)o0n5 zPjNm4d|JwubUd1@!d)mXmq&g?yp_v*gwLVK3>GFPkBKIZIe4q98fi@C3}}0l5r-%F z)Tr-Zbq%=~nkao1HuQOI)@HUoz?$cR49Dv+LX^er1iDxf?sjsX=EwStt?zay?XuzX z(C*Nh_^+K*f=kb^6=lB#Bt1@Wj&TTbyJ8KW{$( z8~V0Vc6~h5w7vvS1W9j88+Dq12t<^p3A)mLS}t52?oLz^x$O;w*O%DzR+BU_U0w69|UfXfBnMpK@_D~o-&!~-o=HFxz&rK0PgSl5ex#6HCf<> zza8IRn^Y;!6-B&vyAc|D@k$6iEILb@Ii+D~d>DVghZ?;;AbO8H#c>$7Zcj*p+pCgw zoX2^LD}*d9KqkCWImAB&uZ8f4=idwXk7Mk`Ste<5Q@bX6cZtbV;WkkXdODB6b|W-K8H9E4T)P zH8o^>q;?%yapK6)KH&gB_*>yHtPW1_8n9?ius&I7io|o=7x#$Pp6lp&?(MoS|1%mz zZ_wD|^$5!oS3k08c5ll5y~MtrZ6Vv1EOMv!&wanXEvAjdHHnUZ42ZFR)JrwI_2zxL zcH|EaeDx>L&l1J*Gsa+C|-P)+SS9hlHN+<8|WUY>!3@0pTo_&m)4IYO4Uu}9$S)Af+MP6STKfU_&Gki{Hyto3+wE1}81L ziBFyfO`zQh=QTDYOsUlkR}JbMBgb$tIi(-UADF%KQ5`-;HQk~`9-LElC$5~>yUYaV zr${@Hp*h**Wf^7CKQz&8*eBuLv1jxxR@>@+v3d(N>E<%{8AnS?H~8G)^QOU5m-anR zj_k}#TB&yhV`5A(!sQBYOkFcqfbX-qifuA^=iiw z4Q)NK4>YBY{u}q}2eG2S8cuzk@~ZEA4h8kG4aVCMyt|&>`6aPlB|ll-Qy9FP2)%!W z8qF;%KvjpV4*3ljL~Sq-oFa(q2K9Op1uT%sPoEcb%D3~OZcn%lWJ|SBSm_pMkHic; zjih2_ee8Lk?4pm!sKG>>f!_7C0b$RsQ3j7;*}N{uQ0(%z{rWHUd;%j$(@GsiJ@tg` zNrS@kQM%7I`wE~BwR*~KcR0iCoz?#y+HoI!3vE5~n_qn{Da;0;_ApeM0wPOw0 zp9%uJe$)J1YN%kJ+=`AYYrQUdkzG8+ngw!~l-^#xbInaQ*=umz$`FuWmP0Yd(OFSX znRdRQ0s-A@GnZbtmm0xnQ&Zalh0t)ErS7ZL1~AsI%cwOl2|T))CrKesOj z^VdalI~+CeGUvv`8F-J#7>`&KEJ(H>a#EBDiSn%(jg;R1D=;!JAF(r`)m*V-dk>{D z=t_+=|2RY~*lN9en-o<#LqW{x-T6n%N|+M(aA$Hg`0ceCq*tElTIc6)vbLB-Z;7yA zna~i!KW+tN7DIRk>7=cQl9MgW+R!g|}%8=V!JgVN99b&MS^Y`j;rdEPC zP_&OCka8jYoUG7Rqq&5JMXfAXeu-a}*T(uzzVyWhqbCi}uOto`?%gVR=6g@0W$O)F zpH{iV8c=%@K{y0?c?^}7KU-_Ogq0Tj_^X#BF=pf|ZAzdc941fW@aQ8xCVSYJ`)6pg z?3SMSH-Zoar%$9wpwkKD>|Fr&n-0^(;ShCrA%U6<$STqI^l+Iwbl{XWDeV zNNs4_`;U)@bz7l#gk0;AEVkG)+cnF**HN;Jt?8n)Y{EaZBR?5ZX=YS4jDEIQXtl_3 zQT{NXoAi1tOIg|!p(C6YnDkh_Kqm3csRJmHRV_7uwp$xUe=gw0^-Wxa`27;DH_k<1 za~A*?@oKt9@>m@^{+;<=U4(2iFcql7A`B6eh%vOd%$#rf?BD8=V_1`U`5T&~X2hMsve{moOL1`?Ez^$}bDtU<80e{PaH;M2l}9!k){bVlM2@M9 zHqOP2SP|5WT~LY&R~D+Cu#f+`3vR`kV4vxA0pL#!q7tPV>56L{4V%~ znm)Z~P&`4$3+_*+6KsZI5P1pLeJ0dI+ne`-eohK0!rm8B<(x+y7ghT)&L&vd^F8S=jNm3nD?>Tmb<_dftQ)1{469D;o`CPw?IaP9jpn(M||M-;BOK6PqjVpXI>#(z`6>Ji$uPrfD$qH!vvc6M$2WEMpL zp#mC~O^*Wm4@;eWfPX5iD{a%+jHXP6zC@JAKOD(-CT`9zN_r9V`lo$b@OHiJ(x{f= z(&)b^^vWXTp&#wW&u6QYN_(~)>ts|O-NMP{d&Cj4W5B1i-YjE>rG**q7ico(%Csj^ zi587Zw}tAzR|+Sy^^BUtO3XgN-*^(8L36Q+nAQ z_H1U467TWCTM$kk9nalb982@z6Qd*#w2fYz4)Bghdj4HB&Teud>xt9`+7g}#=DTH; zE7s?pE&iB1@|Wjx+!V0)gj2lnr|(gb-Q|;iM5i5i0i-W2M1VIJC9&Vu?chlJNS)B& z%4Tq~xZq`Lg71=JRrgnKEE%P z5giWN59-ndSJzLghj5TP_#$Oe+*27jHvmNbRxa0c=BpAbWDfM%$qXY z&W?==I(sC>9mBeDwLslvq7sNmm_-@i@B{q-pfJDqqc_gwGM|z*JETfOjEf)bAH=&{ zU>B}z*CYvU5Y2~-+Rdg4^$pbT1bwB-kA^4iQ1EMm)=!keu7|i=e-u5w7HEQc%PvI_ z3DSyM4$?#Ji>$&1_65;gmBcB5Jbl?j$O>eGQ?Xdgv>Ork?`pYhdTJnE{Egq9E z#jv}Gn8jZEH`!)`2_w-oB}nFqAZCR+<1)>OXQga+T=3r4=0JNw31N{Wb-!lEU?WIV4|2ve&lyc#EnZt&XQ4q4Zq~z&k&hJZ&zzE2yZ$K*bN{)=v%^~ivbHp~54%it9kkau>G1S-^8 zLHXoIUh`T66JzyO*R=Lg5)#@~MJUI$2e9aW&`yUMhN;JA6t}b^O;Pi3>Y9&}!BVwev`H!E0p}8LT1B5OC zK)$Ey_J=1{MeVyx)kjCs`vv}j+;i0ovF1Kx&wRR9gRrlCw0B|PXzj`D*viq&Ck}P| zzxb<*s}w>cwldAcR+|rg6Q&1}JpnU{8f8zNaA@)h^DnLSj8?l5lBS@R)%gHIt{Tp- zQiB;sxw?AlhXT=Z?6fvJtR%2z%yS@Z|HsV;FzUX>4_2j7->#%@?nf{;1`)stK1F}2 zv;0WK{64SfaPgYhda83{O#Pr!yVLutmWj1_E3b>KsR3U#U)ofZfNo*Ym(Yris?aDr z58e49c43#gF8i$9m+kiiO68)`ek7z~kU}(xtv;!k@$umlEcxofUr=~tLgD-#$2@=Q zS%iW^1a`*o6VoPOalwdvyEv=TNik?K9+C+=_|vv-}ud$`N$5KOH|e^ ztFH$5|7SY@w9W`Q*uk_{99Aa9%{(3PDK5?205r_DVJNGnW%^QIqV`+b7~M z1Jkftad-fOaNVLZ15($>I{QZSP={DT#$jN|Cnye7~;%TMA@U_&n7t zBI>BhUK|ASdsmy=GSZS3op=5Sym;(QJ~2Nij1Efc#D~Vuc1l3%@i>}?AE;I=&TL;5 zOOp|;+(0E)q=r5IGj0LK!Ilkb7_OJs|k4(+p~U|0d0Kt{X2LiCyta%$U}fB7bOu^Q{jjbe23b|PxdCp zaKqCE(Y)5Ek_E7G*(7$L$^QmoAjtQdWsrmbP*~8mmF(Upt?h)l`1RC@u`NB^-!3%} z!ivKZ2IQBJB4zSmv>V`-uPG z+O0B>m>+lkbQqbc1&{njVo{uO^2mJpPfw=pZI?KGqoeCMhi=4#-1N|ur~HjW|F(ao z@}$}?EP*n1O3l<7_BM#S@VT-=XGpm%1T~6Q77RY{5A@ktuXn^!)q-ScuDe^d(d67Ud*RA84kP%TWb-6zOd0S)}Dr~%3|%E2IKGjh@>*3wi^j3a_UNj>qgs- zgTIv>vs}*|vtTEOFvkaF^&}sD81O=kic0jh2zp(4HU!`UpkUp=e@UUaJbH@VW9*)B}j&9<1fh90Y4LVi9pZN&eK0h}LubH~uR57t;ayFL8SB4ae#5up55nIEYMgih7Xh^Hu-QNQLDc^o+^gb>TBJXeuxJ;xLC zk5RDCmp6&bgWvv#G=(T5)mb!zytf1DbNVOj9u9;)>3YnIFBtZgIu8L)SquoWni_Z* z_;gZ)Xrz@#9e)2(**VHe!|t3u{?j2mMGFr9ie0|nOaNMjPaLF!u(5;s_cGpXWPow} zR>#c0$l$v#5Y!Z_Eyc%fK_t%G7-9WODS7gv00|Spe(UnWmwbBqK&0s?c_sZLQHU6s z0`DbGWjPWD>%KO&)w`YX)gj^@ENGjW?m-eIC|cQ<^g@p$YNFd20P(NpF;iYafD}?& z@Bh7deQNaQjTBYRf`(7N3O;rnH_~p@%$_IAC^_Z}*yP#c&(@TA3t!@62gk<_J~I(_ z%#mM`+Z>{V1=p=VR|N!jVxCNiHU4T97Us3(2!=+B(56fd*ma&3-piphJaeSh^?ucz zQ}q=@yCK_&U9!^xR?fH?T zS&h=VaNXg>?ZC}2JAIh)YF<<|V`z@~Y9w;eJ+BB0*uId*KXtLJ&qG=DP- zGU6>Uwlxlg?$7GmDk;@uTPX>!lecD{uWHhj4_En?IvXgx@#$vC&2X@L?6p@}K`~8Z z!6b^K5*GYlfKctmS1E|(S2EQXbx?{wJMtpkz7)CSz`D=zpZl{lf;`pb%}_P0eOg>~ z)ILhsj-m6-s*hL+jd}27+T$P=(v>*7aW6KA)B}C<-|ka)_8}IcdRnQYlCIs5T9_qj z?{J&)6Lo}ZUK%q#p;oos@u+s$@{b?w$C_`d-D=i)0bt z=L_Q_YpB~|Z+Ub_?cn$2PDG1W0iKSf+sfiiPMl?b=IDQUhGvajoDfhv?ic&_GDe)f z$Poi-2O+p3Y3})`SV@ZpQx0kB9o5qzfnKbzM_o4u^>K=8>`>h2@Af@5r#9%GEO`v4IOL}1tza%Djh@!vW^jQRq)j7CS{IFCJE^6 z2%DLtRS}Q5?_kRtTG-ifcOexawUr+*K7lulrsV%KVa;n_HsHuuoeFNOB z*ole64H7VEwRvw%)b=q}AydeV*2S(!NzcH*wRMNGDz9_ed(zY=n^*oVMqp{^buGU3 z#&Ur$cXqx-$}~ACM0k~le$*PooNyTEHwmy=zHSop%9kcX){Iv9g42~C={3n3%TfCtJq&Yy z=Q@Ql=dYWc@;lGHC%t^LCuH6ZzFHbepBP7O%BFsRax^UC0Z&h1t|aNlHiFF9c(he_ z{)OQrg{vFBMM)QKutv`y{?5U_f3<*q7sy>`8#I9) z3KCw?%*FRYKJ@pH@iVk^#G!|;NXTPGSVA^a`T8M!yb75HS(zx$D#;<)f z_rqT312pRq*+#J-w*ZNyc=LHS!eeeRfXRBwZs!Lj7%7d-S4{E@*fL;E&1(-w zcPM@L=e8`ThmSF=K;MGW=+Af%fE~Mg#iiim*Xg(Ls)Qr!=CcX$TLWO zamrt+rdF_fJfv8}rNgYTv*z-5Z2FCqs5i>oL3Wz;=Bw9U@3!1{LvVHXebOPoXzMWY=wR`vFVQ z1GTEs(TXO+erJqR(+X|~cg^U%FgL%u`%z3-H?|4mRnqEJ9qKcQQg}}GlU>mF zOCJH7B`@}0o0@Zx(HuQdPS&xyJce^s7Ndp&*?QONF;YHHo%cDq+-TlRXpTQxHjPbd z?v2-6-;H`EPxP#@t?lv{24%}^O=72cS$*`Lq7@`p*GynfP;3-NsU-o@V3s&#suSXJ17u{g*x3G-IL^}e24r_My z$R#M>{64=@uuffBUx&Ir7a{|Qg5Ui3(fROFPkYOc?2c?ycgSgVnaIAC+&fguMNc;o8g<{ zw}qBIDMuSnUq~ZZ6|mdY3yELSTJH+P1kWsL4bH{>wr$O^fZVSCrTuwo?+tSR;(v8r zeyn*^-5>RQq3!afE+RUqV+|MbF>MXGvDmhO7u>$?ViDTD9%d0yD7H#!3`r=Es0L25Oi&3ih5HQk%&7-jL-9}XuEeBtRqlP0SX1k0t;qj}6 zqcsEEC%F@hR8*j)pS$4yObft$G8kQwGqF&wW8HPb6slFI@lt#909Ofrznl5EC*G9e zh||RkBw!&b4uhQZsrP(l8KbFFRJ9FGYbcQuFgAZRfef9Ec??%4CDr#BQw(>BQx)7M9T1)6nZ|SU-u?lmW;k^71w^Q#uJ4 zZ=l4{!hP7p&$q?9>%!uy!Qf^!4KsHPtym^FSG38>U5}^r&wVOAi~jf7w^h(`9@LP? zf7b=>xYa{h4t(1Ti?Q?sw?5WDNl!us%gqBAyG&wup6mhY&q94Zl9hOhH=gyOqzXur zK04DKH3gk-GjBaaOk4W(U)+=rI)<#WKqY&L1<9JeJa_o9;q#WJ!NFRi`Vh!Nx9B5L zNFDjosH)3%cPx0kOf8)M15)5PSoqz9<_|Us&?>RR|M2|vaJOHvxOm+S(6i=( zK*fQqzAr1eRn?}pT%HMV%e$O}l=U&`V9ze~?>m1IFM07r_)NBho>pq$_lPT*)O+hV zSqSZZYOgOe!iaDWe5ya6GzytJia2C%95Vs&(lx3EuJ&=9)oIa0&aa^ex*GjYeRZT8}ssQ<~Y5Z(-4Quoa=|oyPaQ1mzt5% zogdS|#-cJ*Q$&rW3;aZeLUsQ0zzHXtN;Mp*56F*a!9j}HILnB|W6l15cr;GCb;7a9 zC4F~#G;;V7z7)BL5GLu4iByXYAM*Fq79a%$Y4IoQaQ8jT}w*WN4fd0@Lu?KNRG$Je6^`0`5-lB%_qXZVKz+S2KTQA zTjD*^nl^Z{gaiH>29gxu9XRl7_-3mT?jXp|pA;0wMVesgfIjrSsJu;)V=0vXLnQQo z{8hH(yb!jGen0Iq!`{rh5xjyg(p$@yqPFo6x!umi* zf)e}+$*zCrY}Q$#-axu6HE5HyL5=SjEsNJzKmxoEe}vg^j7 z7Egk6Zz4%!-8D zKUuYOmuSkAmZumpqb0xz0+zOj{o1H6osZl$faWhWSBcsW`c!keVRA(%hS1K>t*x3V zGl>*QJ6*@0v)|cU)B}WVdam495fp`j-Ij=zbujP|j`GCi80da~9(jjs7iXmT*$yO; zmTF)Q$-<=MFV;A;Zdl3vfIz$M9WV_8cT{&L0c~CP7uR3U17|}W#p77zt_ttBo<9x- zHahhluW7wqj}XT6gao%q;FgfEpSfO@^i5z~mY9O~J6Yvy+8_jJ!{u6c0MuRdqAg?s zmCc$fx^n%MZ@06TdP&$J;S-6`pr^_8j<4frv1jc)YsW?0E5G+!XRVDN7}{;_M8EPi zEEAMOvOU_PhlBr6%i!+4WsV2ZFD@T-Z0ehC?Y3DIW%t%c<`;GzxH{SxV$*==nxb*C z<5!DM{CW#uQKqz-8$Q&3XT&pJ*621(2M>+`Gt^_ym{)1Iem}xA-0@s|`?Y_lXMkd9CXKCJ-1T#6PPT;Mw?rg#5EaKE4)5#KMQWlk?3!8B#y=`{&w%RKljBM zoNUgO?CPFKc-xRG4j;AEC88r8MG}jvs&EE|#HN#880^LK%G~dSQc~m%=RVpRdA_a@ z`u6ORS_SaF9@&HFg1gu(Tv)3tD|r$-@DG^ENfpT;;A;+Rq!y_IQm-66k)7=%OI`+I z{UUbesvGnloO&FA2?W`pyaJcH>aer-85&z+M?IWwIM~JSsd|*PeI7cojt!disJ4#A zH{C+qGpuDnkrv{1669eOExo~)yrDT0`y6H-A`S)hmt1)GZ>u2luQ>=%g#h^*dTCybHzuGX)D} z;J3cVUc+PO7OG-Hdw2&{C6J-fMy0%4DuS+4N4q{v7h?L!tYAHcIUg(oW4u{g?gQLs zS%8_47EOKbO?LpI$$8(60^w-*=glIk=))2|^r>fHm9`s@RnTwV|@@o4k(D z&v1gwlOG;Qj<}E8L~YGS(kHqye6q4`U5)cOBWP0Y6`TA!vRujj^TmSN50Xves>}Bs zYsAi@_oR+^;nkjtP+`J5wWLmr(&PG$H+F)kEi5Y}6|(aeWy2oFtWOu=lh>vOG^woy z8=aoY3azU|ojeg50}uGmf-UMAw2~QEfF7CslbR%C9F6^&3p9xV@o}2cU8$KG-xY}t zmrvLI>enAEO1el%H%|KHLttim4Gw+0u1>D8RR*EH2IJJej!M?0PU)gP9A@2w@fzlP zVhAaD`#>2jgFVUdlqG+Y+QIdnmI}j*+yKOh7*{4=BuS}^@X?~ig2w(C8!2j~N^!_7=Rr$Xt^9gA$g-;oD?k=_ zF(7{&QiiDM8%G&KU@{90dr?HQEgxu#Z90>SC^YOwo7^*4Ce_X+1#<&yT-R(viu%US z^%Sv*HidG=_yNLI(?#`_bU-3muEa<6J*Unfa@`;Ha(yc|$47`%Gm6`ztawlNM9c}B znd90Ml+m-E%h1ySS5<~J7W7BGg~Ea3y}^<%!*ZXuy_bJamw^G*sJuZ(nx?wg|6S?J6XMLxP*@l1Wb9WAYHK68D)b|IGcpLYR19- z)iPug&g{4NS8mPdHn6Q*F{`e7O5_qLR<-9#>C$Pr8bxGvOBc^tEG}gmW;pEB-6}rf zUPHfi0|07(-d3~uUf%D*tC5)uG{6~)=pLC2T>P10GU?FnC4jW>k@9m+wOC)j3QKPz z0P^LoWbHRpmolVO{1Q7wOhlwbsh zj4MYBNPw=_ciyfqv|_W@g)1&3$(#CbD{yC$QK_|y%mR&pc3MP_c?{Ey(+zg4Ejpgr z`0EA*R6WKr_s^K^*<;_`IPDPE=O$AZ;FXxrl$ysDk8N;O8?c`_Pzm@ngTQG>p^~o& zI|;b4J_d2Avy~o@>{&P@&zKbTQy=hps+jP01T5P!)fv&B>-wbTkr<69OGH#`UD2Qh ztgWyOhM6EQI?^baLNF5xTC61Qc|*@N7I_+QmYm(L|2zKpS9cydP;eU@9J-U-x1;0C zEI^*FRG3t6*O}cAF?S0;TSE}Nv@V!pj2+xQI_=cVZVV5obK}o!4X=dVXVLd78O$ev z+flW{{K&WGNkv0RL3I#w_jTV=Wz9y;sVz%jPnNhJ+tv}U8$nvSbX@Lj$e&=Jm476= z)Ga=KvssUbW4hhI2UlG?BaaFNS7-|@i2Gh13Oy+8gDGz-u~S)VdgQ{Kx7 z|1+u1FWl}m&)R-~$?$@_c4%edwyp2w0OdU=e>>Xr~$W4#XNp!;$`A0TLj|a?G(gGBUB6*UT6vcyeW?>4IO0u(kM%<|WSLCY z5TMzV`M@@^N=pEmg6@8E>4X2`XG6%F4Hzmi)!%=1)X?pCOO*r?+txq=(D9t+-7A{GNG=hTc1Mtigg3h48B6Ytchsqi-3I|^au`RXyaAGX|>5k@CDyqvmR)w|Lbmu zOmBzd7)16OB!A6Q?#4Prs94@-dTlk{nH5Vqygs_`9gM8Jq#Trr|6SEXdHGZHUJ=8u zhexvFl6aRQ;KX+Q`!i)oz*j16&mk&Lb2E}7llouyMGpqm&yu4SfRW9ug$nBI-wI#< zVjI(9b2Li`8f|A-TKY}($o4g7|Kr^Y6n1Mc|CTbRwZWUrT8)ywM{jJM58f!<+NdHs zzc2S5d8!VayeaIf@zD7(WX(9Ut7^JPHSccL^6V9K*o^Zg@zh z;2VvXW8VZ#S4VQDgDUsvZ_7NwL>z5JCmd|;K41BAdfy{)GDf&jJaarI6I zVCcOiXdmzA}1qQXP-80lwA$v-t70=p1(QA{EeL`2xTDfyR zeL@X;{~!Ry8LB=wy;*^eb)<-r9$(isP{gHmG*_R2f2%;q7*|ZpS~p9dA-fYMvB$i& z`y01A!DRMJ>kft9#Q{FZ69PbU0!g#SY1S{o?sg#}($@OdX5VPhT^3#R3{ub(%M43k z-*kz?W4f;4RsS(A8KDNwhM!|w_CNp7BfZR5iH|x+o<6K{By9XB7OBtnJzc!Xs&+bl zzE#Ko>HkL{tv&mMRm)z!y|D&k)ku#NhW%&5cZ|1AX^CM(?p5PURP;WBFd_nwRypOCO!7_yrAU2R{>#Iem9|y*cX^6h@omPEj~~Ugx9`<|MRQ zDq){@ywz!|?RVxRdmgDhEf)NxNh^PYwjsCO#Ko`An&K`9e&4cs-x=2Uz1lmtm0h>s z`2c9po!iCKm8?)Up$>2xUX!dO^1DAHSMJ?pkLnVD3^dhHkXWDW4;JEkL6ZX>h*t`~ zwQRD=@4x1l%oKa)2kAE`p2-lpteRx$S>kxFaY29+=x$5N8K`!eqDGldy`J_o*J885 zy`@wjc?GfYt-8oOQgLxV2jAgWp_Jv%`!NTM)SQpe1zInn=?B!YCd{7c!V0yuCt6R# z-c?>XZgX*Y(I32G>?{5jE#J1`E@A;x{SX|sxS%tYbj1)l@~AuN9!sfLZk6XTN$&~y z-E+xkweC4?*dTXRrYMFHc-V(=g=#3yhkP0FcTcxCa58%PjP%r9bFPhWGU`Mnl1Pds z+ibdIAN_f8Nh+p(4XpGZj&8cSR zy|h=Nw)@S(zaN5YZB|SvF6vo#GtKyv(6As;bBlt}w-eKOr9l_{ls(SQKWRj6I`5H% zbFk*M#FiS!oZ$qvep`Yd^?0lFOXycMX9kz#MR_%!j9UvLY{@OWPW$1at`(WD8 z65z4S-@Ed%^``aT=^@otQk@bHh~n~IGn-R?i40m-a~8G-8-@YAYzF4iCM9R<>{tJV6O}`MAQMzV;Nw}pFmf5s zK)<&l*4YZ45-%Dn;GR#4i|AXKhM3C`QT8|QZ4^R|S$8%}%pMhltlc4NEaA5a4yx>y}^k8+_BwyvW_xWGoC|)qmm7BG?lW_h54~Rl<0i7^j<;mInwcmQiF-3dpeJ12^=*``Uzh73vRkR#$Gu#w`C zP=}W*Z}^X!cIr`hOV4_(^w{wn26iX2evut2qrn zXE0n*;(p&4;v`0={*_C^mE%+3XGc!=a=8Wx{fhJVm97c>g z%ektiG0yi01t?s+-1~|Sw;n?03Mxb5T?f-&Chf~JNvyHFlur%vGhBWM5g5y ztZkW75fpuLnuL&g-0V6EEia;S$qP~rHI8S#y>V$i&5x{TULQ4=c&X$y5Ff8@ydU4O zQT0b~^_={J?&GOeOLXmeS3Uai)B2UzPJ%=jdiCdQ#|8m=4>l%v;ZWp?ijT+Qj(wjn zMRV!ByzaSbl}|mYtzkd%mX5Rk9;YxMC+8-EcQ1G?h?d>Wo_w-7xa_E`0oN>2sv z2pzwnqybr+tz%ro4+au6mN>@0T?~vZ0=`^N#9~Ijlk7%M9dmk#mO6X9nEGvp9Iw}h z=EwZVztR6wP4ttrD8c-v0fY($c`^MP=Kr}t+Lv|S@8_{_?1fd4@EoS9od@grADzbl zAGYkXv1H?yamuYjC(5`EJ{C~ds$(rW@kqv8ZNC>{&h$Cd?=zlC5935dX!#v?HaEN$ zwIGY6y89c7;jm}A9lD?CMt*KL1w_kKi=R4(V@9;H^1HNBMe-nti(Dg#Zta>U=oH6P zbwcJR^84M8LeAGi8$B^YU}JQH)G^O&+XwC-?E-5Fz9R$u4Cp;(PKR6Q84XOerfGb&HJWd5kGj+@5mcwAZS3T_yl=0MPlLT*N}k;D0Bhg zzGWUY&|DBDjWF+7Pmq6gu}ZtjG^+9VT1?0f{Dhjx5Ty9M(`48S{!f^QQiE9Nv({n} ziyPdM|1K)b$$JZ6^UOu&Gbl#h1$3yjHW0i3+6_G?^w_u61ucOOow+2(9g7B)mZ7~c zuoKEJ*Ogwls_w0e_?>cgjJ@wObE+=;;53JZ4T?Le0}4rd={J5^YU zid`n|-^Oy{U*QQmTnyY|4#nB$q}UMWaHMncZ0NkqbEA#X`U+H$S~2hb{Hv>vAD;r@ zpc{ld%O1eLbGI!+y0uNeJoVY!U!z0*m_%WBj_&!~1T7}`U#@z+G2V4aiR;YX;}~}) zvXw^`2wHK}on>`?8&KfZAkL=e6fk1_kSa$^($}DjZ?#z@Pc#uyY;Wya&uC!0P^FN$ znt^TY^19Zh&BPtTniwCRpz&i>4|ixHAi7Pm(d&aiT2=M%BY?{Vzf(i%9pP`D^^<_2 zC4_rDH;cdp^MXhZU~M&sqK8jWGFP#t*%!h%U()7i`xMAVeI_6gC;f~-`=8EUq50-X z{<>B4--kOR!CEl}!ZQx;+fB-n@^|s(v|+eG7NTXFz|-nN?KP^5-N>B`6~FuXrjKHV ze_V!`$NpXkBhybE8X5^of=92KCI36N@lDjRpjz>f8YL{D2cU*z^NbJ;?7?g0KM#*= z*Qr^U-1tc#T|!i4ZYl;C^WzfIOnR}_uh|%_Gp5_+YGpI%X5xjn5ihd!UeD}aYAQix z!~bFP7$Z|^6q8>wj*8#YqR>KylHShhST>t6#0dc9LHmj-PTImx=5EfKDRE;vl=f-9 z%4=>;nQ%k1i#QzmX!q1|t_O5{v6u(8e~i)~}4yNd!G5qa2|y9{W3JuBD2 z!#L_^6ULoODlo#5zgyb;L7c`t{8n{cz6*2Z1?YTjBSK>*53_?du{mY9>Rq zy*^(!Z@5P)?x!q41T8&JgHz(|&1REg6gFMc$wTD0=O%RG5*;V(v_ zpf_pj{&ynetHV=vCqu!Iy_M6k_wC>w<5u(HFYV;S9tl0I2FBgUkmGr!W{bhu<$+`u z_HD$v8w!)@gBWRE^2Lypw}wci$UPGVFP#t8y9Uudu>knp79J~Vg*fGtbdkr#Uu^2@ z)5EjHW?+v}t)_fH6q5+|xT=)UE#AW_?y(gbyNNvK>d{6a)`aoDUtS>7AF5&3Kjp+b z#INNyTQ=vwu~?CUrjrSe-Ys~UdSARC%%`zQ|tvc2#LsA)7KPTV19!Dv`|!XW-QY`fd1a1Jf7 zF<4VdIYi%*7B1y>PKoE0G-CY?o4d8eT#S{;icwjxb7DHqW&JGjJ^zorw~mWzU9yH7 z2`&MG2MF%g2`-%k4G=82I|O&vU?Et5;1(cAfZ*=#1h?Ss?*8uPymRKx+;e5#Z{(Yq z`_J=RyJ}TERcm+CyQ{m|jdQ6p)7QFt7=(lkj`1ebaV?x0MW5a&9BJJ$e>SMnvM;aU z6&u@Jdcs~Th&3sWH`AVd4c2&JCAaI44;LSA;VF(^%kmBNjESf+zc&Wo!NP((p3Q%Z z@!e=|4TJIzBXDZ=NXd(D!2*Wj_`pNWs25&RQ?Rr@__RfDDjxk!vQdSz_>FBnZ-Rp< z+_#2w59@OMJs8=+@Bq-0k;0BUf z+;CsaSf-8FZ{^n0H z`MPs;95T4g6c4D@9JoR;^kfK0;E59lXR|{v5*}U-)}N|@7LkqHt^1~wZ>7Lu$zlA< z7)H(q_RDnxNxwd$fH0%tg|s^i9#v8bH%v!6rQ%z8HBLKQ%rZCdtQK8*U4QIsov3v@ zT!*lx%%UmIYn|*LmfWu&@D7B5ooXKwK2E2+-#0EsQR04n`&caPx@X`nb#O)3Y2I_1 zTFmRIP~E;qie~rtk)zx7Db32VxG2_J_}I?9ml4mie75zRbOzL_OB8$XqH)N@YV4su zT4C!*%w<=sHsI$&KX~C72r=BjFyFZ$IZ9P5U8DTihK()>y*)K#D z!qBq&vt_@nCaGCt4O85i2&Xj_OoPCAHoJY{KX(H^ir*kiX7UlmNT>UKfAYIqbV(A9 zb4~7^>v@O>>v-+KfG!Ow@Dud zZm(3jzv&1Ud~7gwpS%8sV%t&qrX12r0?ZbWwB{J}X5>oBhb%e7%<;>yoVUa0u zb@A$x#Gvtm79>^4yu8S1a|y@Zkx7)hFU7b;#gY||b3&1mMfFB_1+te2VkE-i!f~U? z@=Qjq>hF#EqD}-y9F^X!^KD%^gt<=IyW~MRasjErFJB;<+myGKdbHGQm`yk1@)(su_tdrbAixLY?$h@dWUIHj*SD@Xz%0A= zXzTsm#n6rJ;jmL<{VqS>>e{tRI4i>T{(Y@m-`yeQvL@37gR>H)VrR zfkE8;nb)1~{bK)q9$5n9p4=H5PH)Dl=l)`CzM=HKf#+s(9zt?=Vl`iFb>G>$XmwND zAv$21L`JOq^$>ESTecgU(P+IC*jVc2&UMx*^gV;@Y^9!`$7%a++^ZA#Y_Yfh@U6>H zme<9dXQ`SMr^Rt#H+(rd`&Nv)dCF zzF*Bu<(IX0%VM{(#vj7ZYHed1QqcAX?_Ic+?sj8s?dBZ|l?ofo-MSM`EsQg|$)X$2 zjcO04f6iw23`EbH9jd7i-rpF`ZxJ?9@n1^f4-&_QJF5($LvHgHCvJ7_35>cPH!f&j z_FKB08(mLZIB#DdLT2V>$?k~2%3h}7UKfs)(|f~^9n7VkY3*gdq1)V|z2pXz>u^Zt z;p9Ep{n>2eA>`_QsFStrD%IJwR?KUGwt1joEIC!o>+OAg;^m#*ebMBt&F-nrxlrp; zoPc`^wamc~ZA*RPGNs-PRt!HyC)r{*rRfb;1b=!bSwuIb(G6BKzg{QVP&cLJ4OUdx zjO`5}xMsPvclgk78Ln>x#%P(cZv@L|S*UM>+-O<9Z-m`w*|%@xmC*x--ylH?`sfgczCIJXZ+v2s)j)M|GZM+bX;)v+9$RD9qZ}?=l3EN?bBQKxP~jR!aJ3 zE8&CX_cbxB6u^JJN^&|ZFPo3paQ?|!@qm9{cZO{M{1?}*Js0;RP2Qi553A+Fim~v9 z_a_F71n(fmvmP+Xd&Fmk@fhWBaV1inzhGolvwU|!xlAKNjv%ENKP6BB6MZ2_M-^L7 z71lr%+er1pD_RwTPJJz7#%6HRB!~{NMc}6WXNYKIJ#~mNiZlXWRMDuyBkRc4EhrCm>N#J8|fVw z6dfW<4X4tLqznedNDW6}vz_@d6M9REZbZV=8Thdhf}})|qF~w#{MZS-r9|nXVEPRF zo)d!Jii$_Uj2ifH5PH8AHHm_mG5D17&Zn5Rts7(uZb?FWNlQ7}4RQpxd_nW3eP^%G zJc(0a01_l5mqa*-!m2O;y(CPNM0ot=z3UxfN6KRwID#G|eK06JM3x4Qt_R5&49W=k zOasT=gJcEy`RIWh0>9;x)w z2g4Su`ibx?s7b4Qf&2dgZT+zER=aQ|RK5rq(-FF@U{EvlL2U$Bx7njb zHJJY_NVgGd{o|!>qo3I$lpAUdMx6~-LboS3l2uAy544FYgJHejudtxNWEI!aAzi#W zVIgoMY6R*WMAB+1|Il#&TY&rG6TbD2uQqi+-JvUwG#HU4Pymk|0jq%@w@f^f6%@;+WLpEvIbC@eK!mT3F6=5bMT=k*QNeK$g07#|52*8$d?EeLj z;h{|mXvcpy%mYEWDAqqHG@vkn4f&topIH9~Kv^&?&_$*l(5CF`2WSt4@=%!NK%pOw z%{LSxMOTi~-|ZL4HK z82(#9WN5t!52gRz5J4jkdBXG|?02{Z`#ZG$@xKi|&VzOge9^f);c=d5P%r?$)WiX> z`vEpUA#%ujCEYJAacj5%Z$g4ZTVHe-?8s5*CukC6g0n9DVJ5Z^2?LrZN1nENn{o7m z(W;b2_@R(o3B5`QM{n%k5#m9U>B>R#{t+B!+7$QpoAV>%SWpwXkb^7W_-pVI%lb#! z4N}#(tS7vN865-`N=FAGd%HpZ1TTjE_rNw*Q_uv_>v#m~ALL)&|GPrj2vQ(#^k&+r zxojG#+7LqYRvL$eY%!_Y7((=RnuCRGGpX7XLiA2rxrNRUDfleM9P@`2T-Ep>3YWJT zdYTjfANRcYBiNV&qhW>=Ow?2!Q1qAKN9|EiLHR?6YAxkJhtwKopo#x?i1&~IWI2MC0bp>?7+}rOfkFu=A;;vw z`Wu(zfr|wV`|Hr*fq+;wj#co_P!9^pm7vyt4YM;)fI&eXoW?d%F>h0O*nbo($^o{Z zB2fe;3nC;7YGNv*Fa-|(fPX`WTY2wgRsZ_eY@W zJN6@7(CSrZmog}Bn@qCtb++>I!27GGR~T*kzuu2u*u@A2Ho%ilNmq)dQZh}`Ph8lA z2nGrwEKW(+cckK+@SN}e=hbj5N zeHgX}6G->LMne{<+PID#G=bPtZA-yHfCUx2(X9!v`lrY8Ld?&k-t@Pp&o z6m-KTg9pc#2ZzFgLnodY7pNij!KCwG`uxE4HhSPDJ~*r&9D~0(j2|4S4-Ri5$+tiw zCJ(0c2UExc_vNpL4&OgGvK|~sMv_8}h#=Dr(vasbA69Quz+Df@yS2mgWW6BWS=@g# z@4JcEi0_V>_5BW}4#;E!TYP{Ql_}1oZ2U=Sl!%dcD4J z4l3GB&6tN<0NkFKpqU4U?So^mKQ40~PN(w0G56qbeQ+H77V(>7;lc6Y!SQ$xno6hY zAz~>6y2qyn2it>V;lTmF(l@m4^DznVK8}12NULYNwsHPa_9t*cKla1}33Pe1hxdJ| zl2|v-U+VmfJ#l*mUY7*e3CGkV#%*ivZ#oH^0g8>N{m)qYB&?L{T2U{+&KY&-~JWF=3E|Vw)@xKiG1OE5cA@<=EzJZ?2{}-t73>x-m$?nbNKj43v z4ztHK!R4iKEI;C8nKb4?oVUaisPA7Fk+C{<85)^(*E%`jOvV2T zrqiRc%Q~$TC?R?6I6Zp=pxY-51gA(tgWn6Xy7EF(Wnb29Y`#dvPfl7p{xor$k9oxf znD4Uy^E_a_O$1`Sps`j!?A==+wh@T^pHFJvhib&j1BgKj)oA7aYLp%Yh+%IFh#?IX zvKt_Irv9;{zv~XACqn5X0No0z-CL-@5Uukl!K-Bl$Y#bSpfwj%>nuR)IjGi&P_0J* zt@mTS`qyud3NP!l?>JJ=dmEvoUMMLZATdKphJsd}GAz*azoQWVxz_ZpzmE9+n|2|Z)n%cf~A*a|&_l-SpDrO@fu=~a_fIPI;j?-#; z-37@C`6S8ynK26p|6sRwiXRBvV>!MYoHZ0A`#p`;9%m}%>@1Wt?Jj8Vln9V4p(G0^ zsUO&@61vwvNdGYsctWLp5c)xO=t=m^=?Jv;^&S9SgCfr9@AQztZ#9SC&q z0|LpQx&C4L&s9Pjs(ma}`%I|zo51P#cQJ)u-VColB-9sdJh_Bsy@?xO_3(u523b3n zOnun$AGE(D$R41Z{W*K;{Bcd{sg2foso=&YRLT=TO4lnu%4Fz?D-ZyrEF?X2ad)pv zIj_8Swk=%0-34xXIuCbv8KvL2bWGdn*}g6lHozztj_G>vaUk_+s6t9-!&%f5m&{}-k{-Dd(K3;EQ^Zag0pd!Wv# zLRAtB{*&H-6R`d1Pmcev*MC)FXF4MEO#O}4p&j6PJZygcJeBq8C}9BK!=-=StbWhf zBOiLr>Sp&xaz{bGDW?K2-KnqHQVR{p){dihTHPBydBhDU7h@h@GMwoO zYPSpat>;YwBwQ#-47Pl^qiv{<7s|wd#}#(qN!u zeLx`>CZObSs6xfijK7nRpk^I_{r7-LXvRcnMnEYSb7&}3&SGex(050jy(4SKU$bK` z`8Vbb1u?IHYc$_G;EL_5*PofX9^M}P6~Z6H{1=&^=Mpiwu5bMnE$gw%V0W)OX&|71 zZwhdY`dhP`K(nr{K(l|#G=FjePPKwkxdiI_))S%pw=%59msx;l?js|;?hTtjvfpS| z7V!he4#vkWz#~F%VB$Do;P@1HYPt&)Uh-FyF&(?uLR8j{H41CR$*Q%SA_OC^o588H z=e~x5GJA-+HWt^n>R9^W{&^_#ULd++d&;m>amn4Fn4UPradaAm)l6 zh)D%v{$ok=(9J8MyI25wx+ek^{KNE@mDrmDMgz5gUYmOs!24Ub#DPSp>CSmp^~&V; z!#`mBr<$%;ErFTEEHFW-;R7ZpPQX-Va}OAs%qByt2gWA$PQch?4?1Q6MmPKJz>C;d zVCn_TI{-6u>IF4hL8o4Cp;NC-VCuyM9noa{4Azv z>c5!5{6~_YQ=8||tKmNw=Fmc`SOF$M$r?asQ9!Bd4v_8TI^ZgG5SYx7@m2$+{yE9s z7U)MBIu`m<(#;?+)`LKYe3-ZDYsW(OF_(X2aR=wSuZek_yqSSeWW@ln(Xm1Dn_}b9ij`iVyoyFP0oCSKkQ*Rc&EFMXHr3}kF zs>3>%(kIIg)-&41D*@+a5yvHLPAg77pJYYH-;7jwH5_j*AJKz(JzW?Np_311Q?4@@ zDt)OKK>8$ec|d>7sPk@JTakQPL)j>PVr|DvRblNK!ZclRw@$^rDIYytH&ULvkX&sk zG1W3+6fp{}k3x->ns02BPFNJUJGj3aSQHrWRG(m23v(45cz3Frt@%CIaUe8`dgeR* z(bgWOabvepnwpb3+_~n;Zb@Rjq(i*>%{T``e5L%0o)wXTTzgG?TY-_QpH!u<2O{Oy zaG!k^?Q>8z++!5>ieR(IFt~J5?be%J`+j-7b)%UzQn={mHAMLGYSS!_sA>h%*z0G* zz0mRc&JCtuf*+%+F)q#z9(OP4CJ-dQRQjck9?r0vll7|UN6r)jo|c8T0#P~_<2 zj{otMQjtanBgTPIp}dPRGoeoHMs}TXHer7;S%k6|TMOGiACH77heERlPc17S)zFJ% zh;G6vO)ln2tBg0^0U@DDr&HNN%fY1viFw7vf+9_EXP@=i|g+p@S- z5g)5_r?YJub649TI)8}662x)EfCm@TeKX6}iM?iHN7I|`hqZ`{0plTMm^tDT2yeXU z$S3TbZ~pDLO|*NNRJ}0dMP|r9kcD{>YkNGG+v-^vX4ejCITeII@JN-nd>3Dn#3Z;7 z$^D)3+P@<8Ay^}f0sjv0p#SJ{l zG6ZAa<8bl7i_q5o-JyP0C`*zX=ojN#Up_Rgw}bcPJ!1m?n`D6lEk<(X8we-N>~(`u zocl^1>gX{^b=bSuj^uoP0jXsZcva||0j83ke)veH4e~8m>a+Q~-t5TvS(?6~a&V(4 zU$55U3lT>UytfNXhhVstTCE{&_$F*qpCp3*-c<#Rc}o;>oDDsgNmI;C;Npi%p1*^qSv+%J_SX4w&o_GU((JFk=}`B7K{ z+B4T0v*82z3<}5nUarp7IxDL(BpQJe3B4KOM+s!aZaXU*KCM>7uEj~`KBkDCqq~N` zbW3h~iWw0gxt(Qc7wn>0=)S0Zd+KZ3ht<$*RN5(u5-bUbg5+>B(-#XCL-OKf-4N34C)P^7U*?7S&N(0YAx^= zbF%y-?=91w<5)6*<`~h^%}EiPxKb{aP2&Q=B||Jd(~Oq`T^?rSkUqkLKXD#fB}|cF zrofvt^91G);3Fyi3qN=L$OOBVbu@jr&|bWi^w-rmUN%?F z3O#55X`ED~be0U6d6qHf@|7N`%m4VMB7yP@(m7$h5SpS>7Av5jq-{5{r!tJ=ETd?P zz{fi{+OuMf?2blzh!#*TA5AdZ-;wyMx*?Z-eSiZ}vi`EF^<+gdHrpvH`fY7cGIlGY zd;T(28zgL=Kl|wLlD$cBu8ib>q*2cT!llR3C?&rDav?jWH_h%F+z%|mXo`!_dqh^! zTt?Bm?)bVqg-LF=Wx$0KCH{?V973?6nXA@gt&f@@$br7^z=GIy+SukfA_8{Z>7G+Y zUiaNTmimOcYB<6A45H`C(T@r$NSH*vD5EseQB612DbsvN8Ju2Er z=__X>9P~u-7`N8&#Ckoiql|ZxscEdm+H%Us=p|pTUy(0~eKi_Zfqc0q7GS%S%d(&{ zG4}NVEl0Mrgj3Dt#S8SH|2l=Ia7vuz;voFh7onsN9hYuv8l58N zx)W)ocG)?8RRhzj+#Q{KShv;NRGK~MvSY6a)7D{86`447n=&x7T%sIL7g4j}wc80*UY5GpwUAGV^bzOE0Z=c4J__uNABtNFoA@d>e0LC=TN1>3w3CwV`80_Fys6DH0ERZ9p@@iqa zSRpp;>Gh&VH8b0zU!y_Nobn1UlPF-8!SPb?2PizPwT~s^jlMNnT;Nzw1EYXIFrk*J5Z@ z8tiGOVK*2?6bxFtrqb}7i=@pA3phYITUZH81Wp?{$a=^`^ z6P+e?Hga&FFDuj98vdldqoz5W7~Rc=s(6giG~(;UVWN-_&OnqcrBP`9aOMy49nw$= zdjq)*xBNhbpl0K4r3Fb-^NFyM;K5BYD)?=|;t0R4*dcx-8(7hh^yFMLhe9%<&T|!1 zJ}#xH@|Ry-fKYJ6Q&WV3hUQ{Dvbty%lRvi1QzlW@hZPAw#PvRMw z7&M5|F+5um-CMTJNW%P`UilB@>j%-_eNLMRIPwkIBQoPY{iI9F(+eefg8ubq`t1r@ zds^yX_{~M1F59aQ*m>_-LVITjZWtJ^Oy`4w5%lN~Z~ZV<+TI;8Y)hG$3AIkMwGM_O zoF{9|^hPJRDr;!>WQc6KZQJ!5Fa{Q0r#yLHh3qcSJx;*DM@H$~*jR=9C?PtB;qe7G%1%X`E9;_n%~vFn>AdwfT~8Ix|JauYX9 z=cB`D@cy~p8=V_*bP3qqCPHlz0ir zvcZNr^_S4$z6SedxmI{ff}LwK80RAZG7~=;t6^RSRvArDPxOx zInlK2-8#k4F{QYZDYKHwGL>o$inA`(c3CobG*%Ezw5(UO(&E)MZWbEuHz%7=Wio7R z2+fIs_zm44@FK1MN+zH!97X^aTZm^(Q=FXan^&N4dyp6ZJF&wIB7x$BjKF@Hc|01J z$gzBq%g@Y@>1#^oU_-e}fHj^Q8=IE2n5zH_%kt&}6{#mx3u9MpF5NGLoh9;YLg8?8 zg0EiTe%;|JJ3)1Ji+%*2*$ou=x_u-;pUDQgMxQ=UBU*P6^<}!)^~bE(6A3SWZ(-IJ zuI~BN08@i;jLns#RZ>BJ!ODlj>i`yoLFmoOt$_LzgDBtkYAQi#rc4FHC5$&cB2gD= z39s^NpQD_e=8wCKVQiU4f-Y_G_B~|8k#4%W?L-V^ROzYrXNRXnm9k>ui0i^^Tft8x z<_03)f$}6(#M$(0vl=^G7qih6qf)nQsmPC)*${ov8|qqeUNwyD<>*&f%{ax-|w!zuaKtTZ%q1GNGANji6rp!Qn-sghB>V_7lhk- zewrV?qBm|pBst+|E9_c~7CM7Sr_tD8)NWk#aOjYB^fS8$x9EikP13PC=ox~1>D8zu z`6+&Ie8y2AI_objXNv4^4*JM$g5gQESGCr~SoM|lko+4K{Yz@yMjoR|J`{yCvszME z*C+nk!HdBng36n`%%g3E1PnN(EUaKx@q-L+_g?{IZtf=?yiYjQ>D_RVQ_1YyL&rX( zg`7$DBbCt4JuP*w&bsK-jrD!J|MJC~6RTt;L0fv~?Gu}C>rZ#KgY42jFI+~n2d1Cw zHj6Wu#iyg{D$eyHeZ2X&NRWOkp3zt6u@Ko_=kS#F{)J&qmp}*iUbBi7vk>y04fcoa z;yR|<@v|6oEF^)A7#$~q>1E7M<~9-BXk*pq9NxJx1Zd%4m1De$x!14eJG+o%2vKaT zGUK^tGvIEyUJ*8A*sW&ex78?8^J)vwb#vI0&9vO(O464YmAtD>Y3mFUtA`hqmU{mY zlSGU@i#g6-e0>N zai^xqU$mYg?kmSpfaUZt>7^j_|heiE{eJZe?`DX5TfuCXN@Mtlcb8xI=+kwe4ux6XILJC@7Ek_=F4bs1_*j&tuPx0wfDB+ zLABb3Mfob8@5PqCHGY#<^*#LQ;%}(Y@{6+PBb-Tq{Ma<};%l5V7{R;U=g5H&o9cl) zsd-`>&#?A4c*z`x-j-2jYu#nvGj_>V(n>6JFI0IMcIL!dcyYa4bX9gdsKR~QyJTLs zMrw=m@7z*}E$Qx4@nB=}VRmD*IvK;nxP2z|43Hn1zSYOfmWW)g5gm}3rXL${j?%yv-kn}f_`kWdJ4-N&34Z?Q# z5{0AC7Zzi;EEY)z!10vx3Y+s0!O@TS9f&`fwlF6;t(BB{ zlXx7p`XKFckr_5`qe}d`N_X=1<;B z+SB)tgz?eJbK$78xmY9K=c4S8NBd8N^bOL)0@Ws3+c3OA;3A6MwxSI&8IOFNw} zb+&D3u|4@QM@mG(G?q1idu;J$i5E9;n)pX;{ltkUvHlnKGj;KoJIS(pqu_f4brU6h zKirv;%mG7I=`8K~!aO{Ggmec;HXCf*6c}|A(hSwBx&5L`WzH0 z^b?UpUl(<3++T{`cnruF8@%Np=a9B228!{`?;gI zfE>8_XI((Kg1E}-(1G{Q$d8;zNJvv**pVaW*)=r89CziJCQ4}rT7qAy>AS_GQf@qQ zjk&iWaisWQvl9*5Ci~|4<84c3>v!|#e!itX8fL0*%sWq3+E&J3XX!VhMH?)0_-9cA z7^VwHt9M#HR#5BL4;3HQ>xU%?H;0nuv((UCM@6fg`$Qx~yF{zQFq-=}8ND&M37b5# z(TK;I9+%YwMoh^lf~$jS}~{ zNK+~9>Pvf7sdSc?NB)Qdb?{6m@E=#B;XA|Uo+=pcRK9illqYrgb_d6$^Q4C^?L0W@ zy_(oL6N#W_v#h(TOuBM|%JAN3)O!&!a<9h{CDSe2Y~u#S9mZ5I9E}w*U6whiZxIen zC~}u(+q=J|X7CMV*9WwU>a5s*ZwZd-=7#JR4Y|p4$w?R(w5nsjpDU$w{+9N$^_L}L zO2K*_()m`mL4tOD#?)bg%Uq5dTjFaUh|M$kVBwBEG&5u5NIUA9tj8kKG0%Yhie?}< z_!G*BM>Zat-LfCqhsLCOX|}Je4cQa+AzYK+feG3frMw`|W^jRKfFOFFNd())}hqpWX0ZmhlIvL+aE- zPw*hTrM+Sv{elXpN;rnHJN#Uday^AEQ_&QKH$&(~KX|V>xqL>N^i1LGDPHrbZZe2j zQ6)we>qW2X9arDUtCE+S@z%gxkiI*u9v>`s0ts4-hwXL*ETu|4z8r$PeTgvhQoF)m zPz2GHyp|y|o0m4_$rAj2>;Y~O(mbZ3oIADB4TEdn(fNK{nOqMZMzOzc`gX2Xk`(#n zkiJr-q=DdKJ6=O4{$~h<`GEmNmyBBA{+PLTv?dA@qst0DVs9#UXvg!Q_1$7xTC@5< z>V+5ODOA`mXcL}1;vEz53CP|lsSBkS@oLuQua58jB7C^UE%OY9c#n5b=;h^hfM6+K z{I{c_p2$^=NFDB>L{FiMETY}XYzXmufk$P!GS=Nphq3#l4Q=y<$?J-+)2C8KD3}q% zWdg+%@3apVRT}YxzOM#8rO8U-F*dCEqNAtYk8mBu!0WVWaMc?woadH3<7 z;Ct14&`sLN!9vgni}-MrxTUJgpcxIFCuYJkYAX@eNmCd*DL6cZdv<7(&Q0!t`}JF{ zWj{icx*`oH$^>miK#GWV&Cj*XuQ1|+Nt03_k{cYoFTLO?ll>DG+o9!@j2$=1(TTDR zsXmsLH_1Gp`Kcq3rX8tVL5&aaok6=h#JzB`T4MowY|?XyBvLHTK&g&zeY5$*9ur9u z^$V~OXMTZAlM5&H3yFIx6;#muQgEVapB!3BeKEwhKsEiPi1xFdoEAmSOIYBjE^>`V}r;kEHd2D2ZB{{YXkoP?~cAQJu30|_E8 zM3Jc6c6+0KIlU}ibY*;Eq@T1?zo3KzkqTom^=Ov$bd`ZC56wrTiD<#rr4B)$ohmJF zKvk^KK*9=&$C=>$IJH!UMOd*`iq6d}TVqH1wD$HHVfZ69KEI|m3guakZK3b^np0yR zyTYQn)yO7fwtcnU-x^-om-?%4r{aSo9*zkh)o$q;N z$7!pvwRJn;6v0i{LP}-nH99q++ zmFl^%dA6dj1dPR_qtBR61~Kie{_PY9T(52YsctX=P6VQ!;SyM3%_M%~wJ)R(7 z@)qPTF4xQ1Pyjc1*{y%=>_=BZm}QQEI}_rZ@)B}&0v~Rzw?C~$&;lz|%)vRuF+RGT z)Z3Il_U&D}_hh{Em}n?2+*v`BmUYeaJI!Ktr57nFpM#$#-ljyRFTGeiph41}p+JVD z7iYV?3hJ=TCBEe>VFn1nrl@?QhfPQ_kq7xO6(K}OZS|Jm?dRQX<6nz?a1-D9TQYgB z*j!uxazhux_S6^A!O3Iyashwe&1QkG=Qw~X7M^SURHY!oKE<;-=};*>=u zYl(!u&njaP+quF%^Mi2BC?`XE3QCjZw4S$+s#Ae&MX;*Px~ijav);QLbKNKi7*b~B zpCU3|)5sqWx>y#kZr!?Xx+v-#8LH8arHw-L!YgY&M%xzIC!xf$OONTK2-75#p+UTR z`mDb11z19gCi)mpW=q#X0bTQa_sD=^QOpuWb&hm#rOtpF=`N(GYM77JKGOUBz9a5( z4q7DtWQ@25TKuG)J-%|s>FA!G_@|Ud__Sa@oP;!b)oMf%Lt<%5uvp;8nC7GTue2Mw7hreN!>))H81J%EV-_!ej1h(a+a$wI2it zstoAv>$5u@CVtun9)8eT6MmtYw#0YymMx*CTX~~$@A|MQ$Rmc>txVOaltQMJ2}D#o zuIVeuk=xke(#R@9^Y~|@;l)tyAlgNBs|6UjSAU;gczu3+?3-73+RBBI&PiB(PZ>dl zt#fOzHbvENNrq#?kIT;!dgXH7C}gBR(oSApST%1Gd`jAXHFd6G9@0rIWOIy|Rjgg< z6!QXwTFB!l_GNc??x|&YL}X>&)pzU8xBEs{X8bK&%_Hg33${{WMS-7-PLMcsvtNWdB zW3Q_d?OOcX!<~u7JKHSc>18&M_nVadQNnzUDNHJ9M~dwX>3;rk>$UPTL!H-FueZ(T zjvhtPcioJRi?LxNi^@)?#qg`Va>y|EV0R-A3Q7JlUP`W?%exr(KF4B(f_*S^nS_8- z^cRwbyT7{on{Oe*FGz-c<&Q!mr+#s@sa()}N8S8T)|3^iI{tN(%;WX#*3niYvz;&B zGXkzPrqtyE=ZY_k4tTu7mJwby$u4Kzj%&50kb!{^!6?N5;_WLmgr591sJck#An^>(=UnGX#os@TEUFYpB%zBmodQr61YkwJLE>VEN4$;3de97|> z{q++q&+JzpmwAMjR<|Cz(bwJFXb2f(&=N#WY~%+Ian&2-YzTg8L50U|eUa&NuG1{k zomS6;6Vvn)(Gyd+y_-g7=jz=ah z=BRk?tvx;6qAxzmH1^!gMb{fs7S`!!4AXtnh0vJN&oisbE38CD@3`$pxAU2QjO^U$ z1&cBl-f$0{Wfj{^)`J2RI>~O>6};v-{pwv~%5T_vaqcmc$gmf`cMaU$-tuWG5!gjI z9uUr|d{(NT+f{zGj4Ad|6(29F4$M^F&`rR2dmJ2c4)?g@ zu1u|Wf7t}?J8!>l#87?X!I2toq_D}C)pj|g4Ctm8E(6?GIDN_Y_WDjbII7IPaiiUzv7~T@1XJ>1L#-1nK^Az>!ZsJhinZ>=zuyhx7xn@4d|}D zRbD0w;eJafmTaA;3Y)m-&>(8Nc>fm;3N{@d#fxuQ8MG8pMm!@W-5d3O^whryvvpMp z-U=fR_A28m-cXrp0W6_SHGCnj8l`` z5OB*i_)uGM3~E zwKT`C3w!9$`byxRX_{J$5@HO?;~6)rL42)vTB)K-U*+-z`6cVGH7{}z*2}IKO7~!B zCQBJ#KWk$eK^U8GcS)B0WW8;OJ@LkF^8Rv13?GeOFOIV~{$`Ojlfsg`s6H)s#i~&S z`*gqYF81QBdk1J(h7<2uwKLb-onjqJHRV0<<;4Bz`oPlq_I6@k@HXaBYiIcS(ot)m zoekgZLDa?OaUdpH7MbAf&E>L)l=C?*#{H{-H=gG7Sk0fqo$; z&DJTquBLMSXs$Mw{LR)_X8sQff6eFSML6;n${&fmt_dyIMOZekwgJlbS$=vu^?PIe z&txAtClzwgcr>uGhVmF??|+STW$rA6mUd6P;kScFy+&u@Q_oEoOysKJzmChQ$@^6b zjKDm45 zR35KBp3B|a+rvt--EA(my2a+k`(1qJ^@_%;`NqV%n<2p)7v#J{r>@hFvzsqn|slZ7NIjY${oem_d2*Q+4jqPmNL{q7w8mFN(Z6 z?fRM&Ffxv-SiW_rI9`ErR0c}FmJPQ2oUL8c>Yz4TqC$*LhkbOK7w5+@dybQ|7C6hk zJaS!I+x4oH(#$0W#kMR*;0Z{|6PX$qf;|5!?Tp>M^_%6F)AMxVPX+=vFCr*)Bb%f} z#EYb#1Gk)f)aZ<=>xN4)YKsZy(z$kG?QNBDT)x^MVI)7=ZSU&f;^sjr0xOh^3KuT7 zf_DcWul~)q!DcZ{AAK!c+RG%X5kZq;KgLH4qO1Aw-p~IjsU)M)$-d54*7ic3CoDfc zMEJs96IF*ND^0r;l9)t$7Pqu^-rsN>UWy|)mVq@I7~YZVPR%44oM()vejJg3+}nG4 zIM7={JZf-bAs%;fz%Mklf;KPPF9SDscV(27E9LN(-k*LwulSiNc&luS?05*i{j|zX zw8#*pJ_DK4kS??;^m@Wo3Atrr8EEEjxII~XeRHwcdN~%DT39fzt=YaP`2J)NuBz~S z>CXCgIeTEg(6YTV`2PR`LH)k-kK*$E<+->$e}5%De){>xt83`>pFVtw!+la#cXWS$ z{_*pVm!Hpn6xZ*6ycY22THIbh_g{YebbT?set&)YK60Eh_k{W77u%qOg#nu&#yDiC z(>&JX_qgii+Sqb~eyeqd4g!8llYb>ao;2HQ@0eZv>huUcynCOljOGI}1tku^)-(1@v-0!l#IL8v~bHDVCYup0eS9p=X zj~Q-@C|_y9{s|lEA2Ev3zy1#XzI%uNUc&!BV?5Zhm;DQ2Hnt(&MYvu#szwhdkSz%? z(l{5J}Vlz z7YqcjMJyR>GEdiFN*c?(ETh6f<&XcYMx-AprMA~LV7HO&c2a*FIWvch$_a?P^WK7Y za053z-=BZJ`1JGT2l4Ud5_Zr2gB#^?mKW$$ z@@Ls%0GGtYDg5bBmxYx1P;S_G*&i2ZLPF#e;dBt9i)eBRKqMkg(uN0@pTU9hz&ToD z;U}*QIKV#`#w2=9EQ#pPozj#O|G0md*k>l`&2jix2On`lc_t$VRUCG zTMED=CQhW~Ag0ZtGLTQ7An(Sqe=}+FR2&z1cQSeBBgd;VF*Z8>POZx2zr$r?;DuT(SXjM`}cjNh+242>$$_QFIr@80V_CtQ+PLz-JBlYfqDnYPg# zjBm5lx&(zouB3ILPaN~HQR+>eMmfh%rr~^aH{#2o8|@iMut`*v z+1h+GR^D{zxq6g0K^mJ|v)twcn~AF6cR**hg%Kf=ghF~UDd=ZGYHvnDzu^Lo6roXo-WH#i5Z_i6I+q|ilH2IrskL><7ztCu(t6_!`_AUwb5A@CBgUV zg3u9Ax3mSfo=5vzPbLNZET)O9Mn*^9a{ zuYW~iVn~Hzs!nHW1=w|M`h*)2DQ_aw+axvW)C-uYO;=%&aS|6N>SMkXNmfeyUzod2 z^ieAU-VxdC2ZZ=NKK8n;@INYdJqYodp**w?y9c zl`zqLOhS+@9$qVsP{q4ut3mw?Bd3>k*%~{(eaWWb$IaL@4L>f&rfC>*K`u?hj~=pV z8ip*BOVcoe^S%Tu)-F)cF{u5s}4_-mib~SMqyGrftq3|v!?e} zY&DqsS`6FV^TA*}l05Nby5{WKbNBNVw3#!rtMMB~QF)-(CzD2hQoD{&T0zT^Nd6|! zVcd5AB+L3=2G!!zf^r34zq(5L>6bXLcqeuMjxwgnhI*5f+~F)bJN?GZv(qS>(c?co zeSbckeCc!pHuFkHIP;)9kpol__0avQS^)gP;a6xTkI;LN{jw8^V!;0 zIL3zg(pmcmE+cJCRMeg1jwh9c3&ALD~1-lZ73pC>@*X^6q zIZlM%3u!0*q$zsyyGr>yIV59AOcoT?lZYk&Rf`u*J7gA=hla14i{|80Zu5t&$} zbw^@46<@T!|3QKE<$BiSU>>MS&GVL$yuUt~c>j}V53WwG6t)%kMdIIAXiG!viqDfN zkmo#PT1Go27?uYJE#w1u5)2bXEffsl8HADcek}{QQQ1HdHh3hThvdt_jy)dhWE-%n)c8OX^xIQZ zZR6`#SM(3qN|ohZxxs{JfMo69vATK<@^+ZXy0RN{2qZ=A-hp|Ba!38WfUinawp@!G zZU94KNZ-`$`*eCfm$x%KNF!Q^9ec}4lgP}BL#0R<{JeaR!@-X%Jq`yahZ?!6%xzt| zsx8(+nmc&MR;k0U!=mb2)S=8LDW3Z5OlE=OAH3eEAuwdkcRZw!LHm(tNT4me%sP(;S%u*F3 zT{~H&fk!ooFTXU3TMcg>KQTBt-FBe&WiYHC-t4x;U>m@Q-tFCEf9wIypv|pgGb#UVfHcbCW~>>I3E zu!?e%2!2_6OA7IASA59sU+wCgzE*U3r?JR83p zsPOtaLgPDl)_eK!PC1^qOwc1 zy8x0fIn%}-W})qgeN)1IhT6ROAZ7jd1^-lB@xUqOVs_{ha}t@Bf6ca9!>AYAWuv6? z6QvJyAqkcrrBf?B!B}=Pvm-$;F!$~hr7LjFuu{VSn>~rM#l;G_24KU3M-Li|*Sy3i zWv5|7;bm2_VFzyr_z0Ss!YpM29T}eGi^|3hPR6f~;zatw9b{ARBV}7n;l&zvCH~y` zdVvLo$@6tqB^&4-cgvU+yhGji239WJtbMA{tjh}&jT4Q=$|XIk5}P}c&B2dU4Voi} zk8fVu=pK{E_z|c9vQW(qZxJbof6c1E!w#ZBALX`|4jwnqi6SSf+px%6_^}qtM~h|N zN_1D`MGnJj4a{~u)B4UNVCT#dB)CZ}CC;)gRK5}YMdIU6fBO6C981qpB`>d8)oggE z8-q$lph%~fzM z#0rUBvnt%M$C==quCS|*f%Y{=!a~*hsL8^3b6-xaHT~08W@&?i0jRvV}%6yR#{bW0IR~u2K$_& zO@*7fo59fS1%@NntvA8B_B4mN>u7NN$QGsl-6J)}$bVm-tfa&JuOk(CorN)@& zx+pMe*I6|wo|sdG@U9tFn;3)Ir@EM8kc;Z|CMW)R31d62tz1>6Y9tv|8}#5v^2D&* z#PJQ$C>O08;sp++L2WOiznhg2KWbt zWi5^ezSONNY(85biJl(|I|99~LB~kDrKh7z?i3aE&iMwtFKVP+AmffjLlGsi~YBE_j@4%iU ze;_|bVuw&|Q$tNbw=h3SfdJs!U}MnRQqTf_P1Y4;e$oeqvj1_;VvK_dra;8T$WV^o zx{8I&ym;umk)^USWWh^gY!@q2d;<~y-MdjDbOC#~NZ=bJc7CJ)ftgf-9Sh5MB}(|^ zBnp0<08uRJ&Kc#giZmZM3eRJAw6a0st!rDKp^gws_`pyeejwNB&V6z5NLAe$|JIr}()&9tDFRkJz(aktq0)iA@fc!m^12RN);86f0qKnjwW6 z8oAL$6oWXKZ28W4Ec8gDTH~~~MQU=9H901=*Nt9bdUjO#+7GN`$cLOfLtiIAwDEY7 zUKCi#iI3N|yV3~NrkPMx+N|rSamJ4xSQnJ<4O=dxLwUOK%dVyq;Es*m|8O#??`H|+ zaN%YoM!xLf$gtNBCsXZy7)pR4B_*r*fumaYolW(|$O>=Hp|dwG(CY(3MeR+G_`HZ_ zCP~j6L#^zGm_zJ@;V6#{u+YU|YhVQ&1CclscS$AbG&-5+b@Wm&sjQY0{BVD$Wb;Uf#52}CCzpk9lmP#~pf4DEs5!@+BcohARLMVz<$wm?tIK$F6LLO3a7!!5o=eg;aYq z5j&ZpwG$rl<|qac4s`Pt0O?+?hX+?+B4AlT)Tr$0#Ck`Iq8GO&og^F;tf6!9s*z$K zjNph$njaYIQXg6Vgha@b?~Lnx+Q1UokhTIxq3E!*gb+Y9xt-f|f=cmn^McCz1=D&6n{E5+rfA>m0ztPz9^ zk}P8UfuqRrBm06Ucfi$qw$?ESILZk>wEq}uV9SuPnAa#J>#jh@=~{Qq;Cd20Pbv{k zl4Fw1k zz)`*zIW1O;5z5+EqHQF86A6VUXOMN?*Jul>i5adR4VE;ZR|=l|A#l~m%$yG#m3RGe zACk`_1xPY zqyH-w%BG1mtsTY{-kwalAI|3cPCIuL`QIxM1^%P-_FXUG|FQ28*5qq2)n zrslfYRPfw6(`h(WhC3*%2~z>7Hsp~qKc!Y=FtBW4*z7XRf!oO1)}sTumVbrSOPgpH z0xLOIZ~FM+C5cbd-Gt93Zdo1#)Fz%S*!W`jl+&SiGA|*^*ZYa4@BcLYZu%*_dj8(N zLbeZ2mJtLUBjR`%YO(f9yFGO_m8{KDlXetCWmQXJYu#=RDM%1p*@8c#u<4Z~2!?DS z+Mlzr^E?s2K{G27hHK!PKf0o?^JlF?*_m zlJGdOk*5ZOaTF%Kv+4k-%j)zwmr52bRgd8VL$T3kk+I+?JNhiR7?KQ^*AvE_i(YPq zGL+u3>1HNvawl#PBD?LuHA!?&CM>$g&TOR_E%3F@Hdf2v^&(#>tL@b&nK_j&>z(fG z8ObcdI%TLgdOV?IC?IM<*upN3+#lugV5lAXh)y{b*TCB1?`$4z+h|-2-@)X9draRa z=kJs0MRLE))1_De#lT{jU^{k2CUTK3wZ?o2mr#toM$aCegyT!6VFj_$_EsMPZa4{x zp??p3yOHZ6KOW+$nk||<^AFumh;e5yROuY1ugTK zIZ+|ut;7x8R#mdHbpbHT-|uQxX1Ii3nMLk${20iyw2F@xh?(2`Sj)4tK!JW(;NON^ z2RKTGKC%VeLIJBofp7PB-qZn=i$+9W@$oaxhb`+~XikUPhG~h%9yZ}uSdDL*j zQBTyVd}KNFPm5KHY^}?Us$C63pn^W0xFq}edeGTHZ2%=EWLD-Ciug%;KYJI^E@dk! z1r63}*gJ)}&s%ih;Zqw=j`jG^WR2F}xZx;fy4{3xEa!z^Aq%tfu2XI>p)!S=NKy63 zZ#e3oZe!n--iV(a49VX%ym5ul;7tT8YJx~LXJ z?lcS~V7GGD9-GT{!%*}!szbB#TT-on9#NG-ZWv0w4#(c;39>yfVp45YxpofqC-9yx zs}2@XW%4$tU4a?Y-YZp!(cP>bo!xv_HR(uUs3+@CxG3Y~OP8m2t|-Fhlz(`IH+Mp1 zMmc`-oW#$Ma&0H9Zap_*F277tS>Xw709`AERIFdsVJ(1BBgG0;7SN)G&2Vn#R2%6% z=O}BtKU_0xZ^s5}-f&dBeR^2W53NqWKQNTwt#`j0T}}3XkJ!2%M^x0A_zg#u-M8A5 z{0JwpB6-YV5h4NdW0Ta@T*?&eJ`xx|!gv^%YMgl#m2-c?P^*`)g8ZSv$dpac0d1AA z@)|ywVQa(;Sbkjc6~Xf(h_48qA3Fs4ullmIn+Qbf&QK*7{l+ps+XkDxXVNH)l^vj` z9XkxAe@SXw!BDV!u`AJSdwf;8=stVo7Rtks=ou;nXO+SKMUb_!IMK?9CAz74^K`;~xo=Ia}Q~q!K*yKl^wxOWi9VOy?!%!LcUd={=>2qLz z_p&GwInRv!C%&ur@u9=$7Vuv@GJa&|xsdT=GL$p>fD@QR%Ad9X3+vB@Gc}i8(F!oa zz!0ml$kRlI%ET|!pBz<)A9wh)>}JB$`c64LjkKWBlW!PG7a#U0#FgN8_9+MXaC!;lM{6GA!x@Gw z^iB>EJ3rzx>Souob1*S#Nh$~2Fw{a`)qUNm#Ggmn439=-7`j@u?hrCg>i&kIEb6xgHIXCERP_%q!;Wubbex~QJZ`l4gp-5u~Bb(pQ1mI zouo@y6bcJDU@?x)*ijJb$BaIh=1tl~98xpXa(--h6$zCec{;Qsd6qbM#i$nT7c*Jh zn~o|yb;D2s`hkgn`|mijbY~(=d?c{{vsoJG0nU$TJ*_DyzzoHv56|e?oKg$BVJIX0 ztcyB{pC2bXNTluhY^8)fDLG{6VrB^moH;GqhBmTl7hRr32>ab|)U&R8ul9gli#b?? zF>c@F^^oLS+{w2f1v!Zo@(qZ;BT@f)h`SGG2S5OCyo@e}s&7-j}RIomXWs+w#4Tv9U zAp>-}EIt5tDYez4qF7_GzbxZo(5DfoFx9A~1POz}FRb1^(P!ytaLZu`y2B&-*C z3k!z*^&jo8|7jyd@T-*~xXO3q7#mxwDnUF@uMP7Lv+hf;+i^om08wr z%sc89_@;~u54vTjhrPY9goU$}i%m+!qz@Ak!}m$J{0PaDk}ro6puG#$sD;%xjG*7Q z3`MuM`+oz=JI}3+i!(vwt%%X|yJaZK{Sqkov7l$rj380-rAGI%N`i4EWaVOPD|$`l zM}vll29Kkn8E+Y?Yd;MSKMM3DJPehuUt!%~s9`T|e4NW|3$c>ma zvPzd$g4#VAg>QgqtnX3fwi1KSlC8j()Yz^a<({BNILOb{eeN3xkuRfp5aI+lyCOYq zw+z*$9~#H^D5ajGq`KNj>0?PE0Pf{MgsCO0O<8B7CGZWK+Yv$0846M_&No@Q` z%|2{6BOBFX@e^ISgVvST0dWG>;{3bmC;xCdK|ku?a+HO!AHl(l!=7vv*6hfa+Z>k< zjb5V}$~Hf`_FGS*HZ^Xc|KY}Ukz-R$x;n$a&B2A^(t&4WYw_b(oLh?@feR-s_Y%vU zHQUdJncdMdh#zH(I#zTkVm2Zr8NhZWiQti2Pi^SYFHx!Aw+tnl$GeBihx32pJD4AV z+tl{-Df@}5LjaStt}#WK#Kei8c`e@7mh4T?g9f<#(_Z<6ww)M?EAQG)L1Q>sba*SF8CdQGE*Z`ES$sF~qb(2X3*XB*th5@| z&P>D7IF1jqA%L6k>0Y!1Pg#vzDY4dF1AKRGViNLh-<$qj8&b*83sIs893}u*~ z3W=fS@{=L)V=_;M#E-%}84^DhvkNK2e)aE=sQ8hXCwCM->hWYqZ-GA?35gSn*n854 z2si!)5)VK25K}h3=SluO5+*-Jk*PUG&Na^8gN~)(EffB5zE@BJ)5iLBqkEO167n9n zHnnH;x~sfv;BSEf!gv7*l^+Y)-?NpKMBWMICh>8iB&8}7=b9`RP2%fw1m&;Js047= zINC^Dc$g{;ruo5`lyW!cw=C#CF@^zGxhoJy*A2&J2(;u7C zSePUQu)2hWq|oWzOn;5`@iEjLK6u{srOWN{Y>ETc_T`*Z3%q5hHXH!X3O(~dJA(p7 zec)stGw;67?h!L-@>FbnglqzSl!iDS8^=??dbCo7uI;IqEn27+YcYJW$mc3ur-hpM z17MYjS(g_XIl~zW63aRl!E1Zxx`H`P3oEY$}vb^mfxi|~_ zArlPz#xO(yY|plWQ}PWFr)njO&iTA`lhJDeL)GG~#_+&kUf8U4x_kLiqb)?Rl&d!X z=6cC=H5y|iDu!(7!O7`_C~&lnSkS0 z69T-=HtOEG30M5k>h$~Xra#-y;os5q@WMaIvi_IZ!`IAkk58MfoWT>g;k)0Bt|qB! z+I)^jm!rtaK20Rr;mb-!nRlDJmX#S+gkIuFuRl2UR6BD;11#ArWToPYhTbyNevVqd zBvtLr?JcnDYFrBg0S;Mmn6p7bW={k6 zLiTP!TP#YrfL#(Pduq5-Er*1}iTCl|xPqujCG7!Fh_94&Y*Vx6pN(ppb!2WVL*eR} zSr4`lSnl?DH=|c`PP8rtq;WdJ^Fn>iFT5V8&m%_(T-8yn(UggHR zFH|vy7j5;LNJ&YKve#qGUA<^zrfeFh?Z(N@DTy@hTN2tIy?gvN6#xMkRV`D}5YxpAkH9JSV{&g{E8)Vv?t_dP`E3aw##y?mktI-C!oTUdh-9Ww^;U;m*NI}DQ%Odt<^hL zUu$iUFY7rTzh-#24(o*Vq$zkIVkWT?py%EG?vhO8ww+r#91>cW6QAVWy0A!I2OsGn zi2=I3Iq}kw+izI>u~(WG!`&xJ3R^^Z%(v9DCSC9=laBPp#J)2U@AG!q zTPQ&Qiw4V3*#0H@l%d}JVe4y_+X4<|qAK_u(4B2z1S-&j*X`=v&At@T3Y#Lp3 zcD#b6DZwOZz|sQS3u9&hJci8%wHFd9Ly`Qw7D|of^90P+rUOH)i~x2j60`tr+RZGU zj~0*p_tVGU#K*t=3U;!>v)Q~Fuss?JLzc6x7;Pi;8~xQj>cg7sE4Do9&a1XCD!pSe z6w`k_?EHw)QKfOb_+B(SVyMS&(IA*)y9m-s=NU3WVD)IRwT;AI5E6iGgzBa#Xz2XN z(n07*Auu-Az~&0*a5WPZKDNm_n|xSk0b2?R%z;Ht^F>xV|3ni6kG_vifJqG(i2Egy zjHPO@gj-dt1x7YH^ma$C!V{ZXNjC^TZgsFhynOsZ>ul60M|fu#77TcB3INP8RvIG1 zA^`*csD0e4ChM-9X<*R83+Y?0H;s^=@9Du#3}-gzbvi2fh*gn*hXTg>M_!Dir__2L z86Lo@T)+!M<;1vRVjO$OyBc>ByqED}E4zW9c7L9A2D2iJbr9rL7d6E>v9v>hgsNKQ zFz@ZRSg#cgixUHTkqA&$B?=xw7%CNv)$4~NJT3BxSxS^v4HwHah3zVWXRs<{;F^*9i0c&Td2PPIuFB(}d>3xP_aRF1?a`CXym{2*)h*{C0Ca_Y~pvF%quMv|% z$+70Z(B15PK4t`eoYyya=NR=_z|M(qJv`V47-?9XIMTtfD>^*ov$6U1n9r%EM3$)n zkenFPF33@d@+f^lfW(O+?LtClGU|}`$9oEkrNISY$@=S@m`iO~37ei(Jt)6y9S04j2Fh<>?OGD(xX~vcE@J#?%C>Y21 zN_^Z4D{1{GXsW`48X6cwE^`prCVe2j;}{Z~2z;@<$B@R17Zofg8WzcZZKZKBBr>C3 z%geHB?MY}@CZk6rL-G1&Etm=j`H~tx=fc+Jf&>Rg`7}0uq~<{H8F_>@9YcZnZFb^Q zL6xf~7Mb_TN-RFQySBBs{52@Bh2wXqtu;Q{b&(i&wza?;(#^w()?nN`%9MpB>D6mC zUGMT=-1*0yqRo6(V)Oe}B1_f65b#-dw)27l@I-c4(l+d%GBzH8l>q#M13y56{xsg` z+IyyJOVCNH%b>p2xi`h43LHUmuqR45{~v*i6Hz)ifx)H(R%^#OOkAJZ6^HQrWYXjt zY(BC%*NGLIwu_Le763^#UTk7L)A}y)!34T9!<0)5Pe%?VG#({b@y>Cft~9T0BjKq+ zQ1?VxaPrvmoS~@sK`AotMf0-cVfN#!r(tp;T@Q@%LRrycKfs5Zm46AL+XP1%GABaz zN{~5mwS$nuM&x&`2$pruP?~(p9&!er6_g29UN86@DxplwysZU%SD71I#H<9oq;Bgu zL$UH>z~5E+z7l}A!`SyNb($(WPNC+UmALr>LmVR;e8_h1565YZyPZgNV?-DgHdPXX z;vHMtoP@+3Jf1TYML%Sq^=bEMv##U1n-e?R3(k2!V8DlXV9Uafw?p@cL+@U^R~?#c zL{>89`xcPRfDnCi+ES01Z%-N`KN>fNC@Wp9OXRiKg<)&&Plkq)M-y2T`d(n&_uRP0 zz9!M|qc*{M`w)$8Cr&&t%Bb}fFpn<84Olr5K*CMzB+Mg>IaY$+4}#ha=v#C-f~0vY zD{=2ff}Hes>34>?%nQ7T#?PMd?LRAh%p~Q+=Yk3VTHyYV7{u{Sj;$vT@EDS_=Y+?Q zo*jfYk`=b4BjPGl!lucPKpli>gJ`krd9WZbklLtP+8PTXh}yCVjI*V=6)X8~3cXoZ z>9Wz);F!zWVmqxu!)8d84#KwDEZ_VY^C+9#27T%#%PZ`DJdlpj(LQG-7fzwa;uE5C zQOIbMYb?=FSWKw55P|kotZGN{V-7L0a~$o{)f-==q-qdBqo zyIG~?@2m57nNGjbxcLz+nfFr^<(n&+_xTcu%vMOPGBgg$x*Z-N{7~mB-GT|#;QCgU z=w~Tpwdib=!cw*-Dzs2(q5Ia57l>}HU7>02V=vRLxDsI`-n9CQ56O^X!tRC8t>_6D7e0Xt1HaF z^k&%5xkAI@N24~d;KRAjpqD(b;4wNzqWYYnwEAe?1*`B$82Ozwj$$M6s7)nyGk`Tl z!q<#te-isDtUWf)Dq`(nNL*}AzRa|Xj@U$lVkp2mDWt6nU@f5#7b@W`*C@ibN?4a- zx||`;d5$J1V0UeoFd-t=E{0s_kxk%C9H0{gzP&k+?t^S3iqGIro%oL(Sv&olp@=&y zgTv_X0NEE@7zq{yc+bAQQ4PSjMX@ z*+vWnez@BSON)F>zfCRp}qQko6eT)A5Lxg zpuy#sX=guz+Z1klbhGdyY}V!8gRv5-KV)L~ z@UI01boR8=`zK(99De)f5(Wz$p`B1tf9wtLd zWf!h(3CLv7iB``nT;O9dqS6>yDbzpN?q?-U9|Ejhey*!bl*mFgD5EhbTi>Vf4!xu% z)+S^nQonDXb%-s6)V|afO%)l6&F^Cm&LXuO@Q6rJh63}18Sk^`t?siwAl$61zzt!j zVz{_nc5HOiFYax+DfrQ$k^MR*J_FP=GJb4lKm$C@@$9|?6DX!43&urL3 z;%J2YNY10rYB$Gqy+;|07@M+@yKLIcBu0G)YZ3uLHS ze?Y=&6N8$Jf{G$jR9K1H2L*eC5zwUelqq7h3|*{|4@3jFIBpl(vbL3 zpyye{7*e1;T{UK{c?C1Tv`uGe(!|(!in*(g-pwjSGg^j1_=iua7Vuwuk1|xie>P~G zsL`-iW1$y$>g)Bviiv8DHhQ*)W(_hKaiYdb4F3?s{Yj*|q}Tb1Y^^)lWRpsL#Ttz& z!ZpZBJO4m4M5zb#s#e>2h68iqVJ*Y)g^$xQWTmzLY~`cRSxM|aZ&l%QRwDYtF3WW* zGPs5RE0$7Z%_9`BSjpnQ2tZEM>dmiV)02tuzvvn^WhkSsR%j6}yP4^Ex7xL-BWj>b zS&8TGfU}C*Rvo2~YpgmLN@#9SW1dUdmBG6}1Lj2Eb^vdR*#v?7{c`z}@#`aO4y{PEO>C?sLaPwu3z(ix#~=HulqnXxle7 zccj~c6D!+k4}Tms03`bOWf~eMQnmvvl*z?ggdK^7#EFLOKpON?USpkvR>d65Pfw

rbHDfH|46J|NNNz$R!cthv*m zKNm`afiw)Krm?Z6Nds(i6|yU%y_8diLi3}j0^Awk7Qh8YNPE{rSgl&0j70Ifc3blvZ;h$BwBr^=-jd?LrwXe+_Kp;4W1^iei>*wbmB_W9@i-= zIeFKKTS;bNRANR>XRuK9R}`c{;^tJGtrNqI+akA)3m+;@gXcto#v^zbgz3YJH~Ds^ zkXRMV{+t;8dNS2{J8ZXb0s~s$Spr6tS`F&$LG2Pmcim9~CySVpp492dH0VzX`czEl zq@X!brmbnbo&6gWdc*wPgFb8Wg62}J^yXg;G(V1o#|6No!e4)E@CYM@p|t#dY@2l0 z9JZ)jwntRznKBfL-;Z*vaT@`Q6Onqk?&HLm9zuzTFvyrj#Ob)sA;Nm&E7=uovQQP+ zp~aEO_)~^5?z@;CU+!$mP@Vl4d=sCU-bY5!fH^UoM*t4%ODHZBDL_1BsGGiLa@t&m zZH@FtNp($6CV_qo;9)VlX!jUHk@M$5#*fm(4$>ko^EP&9@*_Ae0+S!Zi5sVrx`P|q zGU6&qu6W8&3jNt4YNrf!(O)%|cFIsG{cT2|G1O*%TI?AsDfZ`zoSiZhUoY3@OOebA z^);XQN}8&PPRW}xlvjTk(SalV+^cCh?*9na7(^pgNlxfINef?GQHm3{~)t{JkIAth~{v26{Q-*@(58(=|>oH3fLtXM$ zNU)qTlp24gEW{~8-SKCG#*aGf8?1X?!yt8yatD3Fda$M<#wtI0H859_GRK;=3Ol$* z8?kpV)DeHSVaku{WSKStm&^9^Be3yfG0)a*{MgJfn%-6yc;{8C2u#y}x1jg^V%Ygn zpra(go#dSG0Zb8i`Ej3vmY7^=FihdXnRUL1wvqS?g8Zzt*EdZ;L+8hh9yCHNqm`u! z#ThDmY!!C;-p3ZO#j$mhFX+kzQ-9#u@>UAOEUk z+nWdYxOc$muAO0S6`n6t$}2L{2>G$F2Rku1%-X^n=QLv|4gQpJ9hsV=?wwt)@yfAV zL*gk@Mjsh6R2YA-_c0@))$R{nt#!&!P5j{%3O}}Alw~RH$C(ck|{2)?Q*{v8E z35;AC8b7A>l!@DRgK0~H=f|-gG?MrDtFSq+7#cQ%^{?946f+60&2+W~wq@$rq0WzG zJ!L%j*#PS~#=D57^E#$}t-91jW{;6KtwIk9hRWzqX%o!FcPbgd zlS8)vKQ{QJf_<=I=JT~(DZ1*e()X44_DvKzGK_+u{Q5)G0yl;uB0U*uv7eeaF_dwC zu*09in;B}mzo;jkp_KbWeLLFD%dax#87Q?1M+d>IUN*^ijLo9!AgADP_8 zP`dpg=zz7vij6^_B+iC;V?yoEY_hyDE%!YZN|wt-r45#m4XZY~@{C+0e>(Pzz zmY7+b{q~%#^R}4X^Oo73veJux1|#OF&GD9a-p*ino`dI11kE>7J z%L=|-RkF#o6IE83Rb&`MFw*$=5xdRNjgNl_g3&(Bbd!scxZN$Hn$_R5%_zqPO_*s(rw=BM^Ik5XK-*N}UbLYQwIHwA;Ic=oa9|o#-45 zdnz953Atb>#=aM#vkg_#(7}cm429SC&&c}*>(kl}!)Pn8{zTW1EbfA#kosl|9FW)e zm4+W@d5(0p3x*o%`v#)TJ+1K|JwHO$PIdejY1D15|ua=>I;U7>9N^PKxd3j z@90Fl3x<;DwKnadQBO&UzhJ129sz4Ilr*-HFv&~>oStvzOlXsPB6X@k-1<#9( z9Caw{;F@hCiz)%#8a`{1y0hbi6uG!yrMVt{^^R@}4TBTKc>)Yh#O4VwIPsVO!-c(x zJ2}6Tz&G27?DLD0>6|~(syw(1@njC__cit3oP(Oq2hdB7bg=be*`XR z@Z_$@=PF&N1?hgiV5LP)Ve48vn~jK;xnQL>{`i%Sm3}zUJBtE%l8gbxkrM<^=%$+& znr8N_gu#if2?qc)D2@c-04TVT!X4Lh7PNU>R9#kbd6N7d8 zXk=1j+%y>a5v5@+SZP~798s=KPSpE#-+I5Cvy@r`*AM`#~kFcioR!H^~3 z!f001rgSOn54_cT;!>nNt=(>+9b`_|i@so}jqQqX_&?sCuqutP>hxI`m7jOPP}h2^ z0}VPL?~G{SUJ?Doi4GmW6Xb*(uINK~hH}-B&?c=aYglO;TYQ2n7I(o=z`7Yo#_sA= z$9Ez_!Rnn(9O1)rnRs-Zm{0^d8W1O*;{e(4vTzhLes)Ah@gpuf9hJ&jrZ@x}h4z#S z(TYdNkFV#n%>wL3Qq6z*nM7Q`rg=|f>mZRp;jtF)$xL%LEM%xPy#=b!>0NL8z%0{U6Jhi)6q*jWW`&-aQQ0<(h?6il8{xE`NOTOP zqz|LRSE7OOV;=h~7*#FNFw4Xcr=01Ij!R;w4DAuRx*+J>L%19@{Tnc8b2Pg zuk-S<>{=_SW(z3>ct5z6<$L5QCH#oYeYY(nXOsJS0uzEZ-RJ3M;YVY#$|P+EGd9QA z)C$WK+C4KIq_jQNh`Q74VY0+W)5KRLZiaQTO z%He)<)u3Zg3|}@$R(?yWl@v=!LuANwWSyjNLp*enHLSZuXYUxFF2GRF+0}sS&z$Ft zEENVx^{Law;#Q{khJoWP{-i;qp3NSJJmg?0@>~>~F{(0))tAbajRGUYPUiregvd~` zdFYVY%5~Tz^w>*jbo`hR_7@IUOqqjQ>@2BK)zK~(3N)*)HLRGX0Y0bvh(vKFJgL~N zOKYn&4nGk#(^{#h!*PZ(&bw8n57**xWR09mP?@a^cKlbYuT~eO0}p$ zG0(An?(R$dsehqXiWXP9V5p@$UUqf|CibH3Q>V${{XH~NPNe5|DSofFJXp|;mKPPfQW+-U zS!oiQBOOGJ(<|>{r&wG95632iK1F0nNBg_NZlvDdhYjc$o<5} zMWbvj2_t^}w~yAk`Hu=Se}uoz`~V%k`2L)R&51fad%OTcec|0>XdNwYf5A{R_!)bP zp<3`3ziaeYl(@E95UDHX(lcHf9(Ts`M0otj&uPpQhFZRnyvWufv`2|1&uE+og?T*5j*(QziENsT~xyDYaEbs>nEZUF9{rrt0Q27nECpmFgdM_V0>-L@(P ze82ZF#AD+}jVMn;AQG+@C(%exMVc(Cz1~6fwJtRJuL}*P8B8=-sZ85+&Z}L!@OmR= zYk%lODoS0ROtcq;ve0zwDp*&xz_wRO(|M1WtcUuqSehC|UK3oYORNKA^}>B}i8c;= zI4|{|H)|LVC7SO|i{l)FLqwfS&!_LN(Wy^05qJI-W^>)BGVcJW$;65@;Vu~}06z~d zemsgk_m0&Rx#TG6i}kgYa0=AAStoN0Ma8d>h1qDryGc6F8!X`k(-PKVAW-dk7`;Qo z=f{~|6+S=4v;*HrX>iSUZeu*MQWE3KLi8C8k{^9~0g$KSQ8TPC@(zBrg*SbF{vmn) zAvvGAqi`?ei3=0#w7$lm+hp;5;KP|oWvv|j|N8Fg{q3mqd<5g*=ZiYJcPHU^PKoga z=uy=eN=r5aM;YP=o5AkJ(Zide0P&byG`Ug3rFRleZ>$259o^Wqco_}$R7`3CKeL-{ zFlK6Hl^7Q)`Ss&pY+!y;T5HG-WIHkeR#^xXWlR40)5p)h{PeCQeKwa2<%fw$Ylo}z z>-2Gy{g#XEfDe5*Ui_$j1LTWthIqJdfNYK7n$C)vIORG_Id>(p=%9Y z73(8ff*i$F@`CYQoMn)0%MAmuY5`tBRPK)3K_t@a=A7%}_u>3yc57Qv| zaj3q#^7PL6)A9;SZ~&KbdBbrFocX`3;;=7T1yBBVSlMyjspRYtKi+HXO!Hao=%q~?XhIT9WzGB- zNMEq$D302MSsQD!DRfh2Z0IWJ`+Y|bzi4?D>KQfNA?p*28mNxW$Q3O(T4Er&CxVAY zc*z@hXp;kyb;iXb5MSr>|2QMJz0OLcrC_CE)UXf}G!g+((AAg=Ue~JF+E+OF z`b${o<}#tGu)eU_;SmZV8%@9Jl=OZfy`w12EyAbcHn$TnpF_TYKF)yVE;a zrx>K_HH?!Cq=tm+g;BgH1^K>&*UI+?U@IoT7EMYH7m~CgldQQV+$9^+#LzDqu z`qih9oy#*4;h<;F<5?e-*6SkJ|}?t^AHrRgu5gg>x~vQwwD)2n7y z-O=rF$3;NWOzarjk&3!XNy(!*wfx}#{Wn9U!!y&NB=K&YWZ&@RYx}Pp? zRwGpPquYLIVZUrgqU3eMFP_c!75vEL`wS+|>H@!2Wqmv!eSn9yV(&;iWr&Hd4sL`6 zirpI(!Uu+)`-;xr z_20wSTX!TME%oSH~KD**f<=?Ubqp-gBg(C?Z1 zvg2ql4UoEE`f&?xed(M7s6!?F)&8lXa<}n&@jf8V^Q5PzNCi1!F{s5pvoG#`SGb>T0uM9`=Vy& zIT*$D(ZHm>%tDWN)o=UT#druC)>DciE~5j(l*FVVsoGrYW?Ir(QM7zC^$PaO09czo zW`&%bO)fG$kGodPqrF}Y2vd= zUNd`;6Cn9V&-nBQr|r~(-#Pml&!}RL0;Xpdg?2q6M3-qWvFxb#tMVj_J+oPJ_<%Dq z!c+9KgOJXzj+~cTgo4rFbXg?J&F#e$gK#&deq=RIBo*IJ5tvBr{DxNEO-?5hjjBHL zG|JK{CUVL#L1fPztT@(~HoCNe&vW1Q??kHs-A{vuhvv~E_A*vJ?A+FjbOw`(7cU?Z zUV=(!*EY0onEIhjE)@Ons1q8Y`q5fKmv-B8zdC`CiM&NOTTBEYe`vJJBrbvhv0y5e zj_&kgpj~LU3&Tr26*4$rx7)QzRoh{U=R!wcm?DXr?!@wpeszqVGC;~&igo1srF&qn z?OoF0w<(Pi&Bv+!w;^}=j38y~cdavm_j%A@$5Q!~ZXdS(=#Q8VF^tIZDoU?6R&uN( zz(R#Di=RHVHUDDgH4l_NVY>*F*`(suDmNik1}X)Cz;BZU6t4{jgmaCge} zZdLe2JLX8cA;quhIkV0<9eT^}sY|cOc?U<8JP|JBdD(*oBPr6{$8RgtB=Z?8Yg+qjGC@KAK-BsP-EjjNb~&o_SA zBcD~0G7~r~0zpQ)sArx9Y}%Jo1wbh|dMmz_2?caPA9}2vfEaE%igRY_r|b96IYYzP z)7f9hNK~B9?j}r7X`cDbDE<+0d$NKf926eg9!NcFNyjb;t8>*N%a>3+*#&oh*)rog zY82aXYj$vSvGGLkniVH_YtfCxQ?|?&aPKOIB>HZ~@1+l6{-7$>hQ1k_EItKM_ z7}=L%0>^msZ@QsfH8&a7VQWWB6JCNc>{Xh#rqXkG9?hYU*^RcgW@ie*JI8c%0%k_+ zHSr8y2E*r34*~2wid21bpHysqFC!hl{^X_sgrGaGAs(nJYHc|;l>LCCUC;bIsR-jG z$S2&^vN1Q^XSJOgK1|`n?tBdjc}+tP3`c9^UR@a{anQL%*z=yrcjZ7t$%G4?Dgf0u%vWNI@G40CO+W0 z|7%*3QtHZ*c!7>3N)#K#et}It7lKU)3rfEr6FkVk^C-zSE?__&Yo6NHi~@p?)Cz z`(cjksFeTvb>t~7H_2vE){X61k(oRZpQ1ckgLAFFu#TK@Y5G1XR|d;KbCk-(9cWMw zE?yhFq0o^{ybDAdhkKvN8{>wmd4e?d z=|h^0R?>5@-Z$e7{bY5i%L&fpS7YcEGLmwuaskktskHA0U&60mj@$-+^Zs6GIfb>V zjv#GchR(1YUv01!FVH{V7Sp9R*d~GsxQo{W==-U*F18+b(eVX=LpC;X7@1elJ_6{+ zH_I9`{$69OYI!Jzk*g_Rf9#aIsB)Gn>a`JI_UbtA##bRYmzhxeT+%+d&z?=fg^F)(|Gq|%5``V492hgRu|^6FY)urW&XzC4=PccTKmuHSs#!+wZj5+U#eHxA7Mb1nlmQ3ulmUCU2dw-?ZXgh}s zaM&->Z1GvSp!IPMN@w91yGfQC=ZT=yyJCR-S~#Si^bCeQ(TNCsE}NGkqI%+D)>VN- z{>&!!fhs!!GPh;y;#@nOcq;R9wC0ipe;p>2kJQc_?Hl{|aYc~IJxC(P?mIx3jFMdk zbF=lBN>A8*+c>pNFx%xO3%fdnI$e*Ecw>HHYl7=+HE)f;elA!fIR#rZG z@DJjXQBL<4>puui>ToN9_HyMN8SCP_$}@&ut+{&Nf+nM}E{F1L(y29^Lzde>+BDD^ zr^3mAG`a}r1@E?$%xbZR%w8_cmC=mm-KU-G>JwPd@MUh+b%$^GIEnr;y1|jD zc8_bH%%f?uGk2tGE-PG`hz`3JvcRtatUb8&@Poaj(Zu(}q0X>Be!^3-yqyjAGtU^145tru* z4Y;a?n9D82_Y z!{Qd>{~>LC+54ZK-n8_ccVs;N!^QBygvUVL;M3K9d%pZ)7^S^Ie|E&csPQkS`GN8%yNn6q|*EHV#z^_m0!IK;D2x=TZt|@aT@^sq#Z3d)%1wL+U#ms-Q0H zi09B6AuOx3r3M5O7roHb4M+cc!&n9%Px+wC?X8X*c!8Uzry9QDG-A7%VL|t~z*Rw> za8SCTBl?*r`|UNi*S^DcPzbPCGlN(oNP;3^H%ATisqa5br*UG-V8ZXa+0O$?X4qGV z2?g3X4J&T;RE>swQ>yTmzSTdKf>>X*q_@1%K<;RTf$@mY+P%?CVZ;Onr0?%N$QEU~259s7J@ zYmKT3&IzxfVQFq2L`f`P2eSFdoUwD-u0gCnKsO(Pv-}vZZoR-hzuy{MfPFoN8y35X zaXqbLK$}V$k4wp|kw%pU%BAg}Hv+PV+!O6d$U*dJriv5ii}jH}SlW)g7ywo<^&vF} z^pJ|!F^f|y@EM<(0L-;v#jZKbB!e$0V}dH0@Vr#{g{GLos|`-exgtCQ`ns=Jj2^+~ z*A=@_trFg*o<4HW?fz%UKRFR^W&Q5k-C{Ay>kuWeWtJ)7>0Jkdr*i8}GN|^ps2G+A zAeu}PamimZm?fHyV>ytO4q5`42BlsL&ZAE$P`}Tw%SGKjHRFlyJl!fz7ACPSjPms+ z^(g#$k7#q{szkkYU(F!KEgjGLi>xj^|Ki{t8^Zw*4SZ%jd~BdZgzzt{(_Ix|`;tMe z*IsNKf-D$`f<`6nN=mnT3mCf^v=KhW#YDb?hHh!!kws&km5sKGZP-qXs9CS*2K0;* zo^G($-h@mHHy8$SBOq6Q$i}x;hi8<|I{$<$5hq<@+Z7dKZ;5k=#eO{}Udt$qb@7mw z)Mh3dXS9bnm716+GK(Qf>hjB<3)Alp@88FT(-U~`;aPf1Aktw=KrdN$G;g348#OJ_ z1-t=ukI%Q<28ePfMvl)iuPEpx*~wN+A&wrjqN@J}(Yormf}~FSP`OB}u6dCJCvPYZ ztO;P}QRw??=~mM%;~cmL^E`xoAa0uQ55J?$!lf?wuT!I?=XcMOqaTQ&=6<`T-vXwy;RV;6Y{jJDf%vVa&A0^~w1<|H9pnbY} zk^fB5#u?Zz?NX$ar=@9s;l1`Yrv8;#5=pC&%Ic@L_5&R5^XmC-9B}nj_ziBY;KCc# zu?w_^{|O#i$*nwXolB$Dcm@|^xq2h%w)EC!VG4U)pV}%aEf~{y;}!>jXH91=6UY(d zb+AI9&fso}g9wGyaRy+Z`u8R1I!O!xGR1&AG)v?G!HwQ{qUF<9-?}1D1M>vwY zOqrEpk9<`FGSvegOFXvV40E^m74X%q`cE%TN-g#}byGEJBI)l+H;4%evc1I=6w>Gg zKB1x!(>UjX$<*HyfV4jCdkhNKWZ&KwPc{acE!KELViWV#dtDK=QsR-Sf@*H|5ryH5fepwsw74N$!Fa8TtXb~KHkB`nVv zj2>Kkyn46HrzqBCZBly}5;)d)Y)h{5kTEh{ZiOfQ@&IJznf6Q#rg3ozeLUJzg&t`> z&XiQ#&|}W&R<(GOUX}ybDEz;3OZ|Q|>i#Lc%pJisi*ssCh7~P3s*gS_8MV4P#X-4v z+^case~AnGTh{GyuQ+vMDir?;tXO+4&yy@?!jl|(;xt0wJS>-X32w>oD2JeYSxmT{ZQa>DcB0T?EV8HuC?0UL{?B$Wm3scswaV|qhD0_ zE<@6SubOwYfLBeMIVA+XBFzrP31Jpu@573f~!07HIR5~;q9MvQAGWN4^wE)O;Cx{H=5mg)mPnb z8DTlWkHI^)`y>Jeq&`iDLk!=Be%SH={D@ zNM=#k5@rCFcxB3%4+#K&O;-jrDWvve<# zAx_x&sC67Z)X6(0ov~ALNky-&To7rCm__g;6?9`zb3T7iY_k)u#_x;20*riUbOexX z!F=L4C7Zs@4N)QjC$n@UmE(7E_s|tOoeoQ5u?%=o=GD23Gi+Kbr#k33PYM3GW10-gEX7vtz}*o8D%t;O}0tM?O)7r7CY0o!15SWTsi=|G3ug{57LKI z(D|pOgfY&P5O&xeZP{aIE^Q!B*2(;58-glMI~H>LExMUF3rrgJAzsxSfq7K9 zRzwes^H^68QK4+RmR~}1DQn=()g5MN92)LP!SaTCd|*1)rjW)8h(_zdN(He4E%cUX z!~1D$gZT3OxN6fUn{MaR?g%GAO!TO`VR6dp6$m4Z6B6R18GJz-G+NYeZncrA$k4B_ z?S$5o&9VnX2x=!;9gK7-wZ~w7`$Ub)5(Pgx6Xgq4^qFn#YKLM>@%XNni$l~x`D&P+ zB3U<~7blqZwlZIdpN(pV_r$Cp1MG;w*um!-l_zn+T4M6Y*~Donzf;)-2SJ|Y+Czmn zC^g^ia|FpowTYt7$x8keCGLxmhiH*ja{WlfX82S{^qKFY8~e#DOpqDfgmG4tGY1ZH z-kEr(BKem8jezQKFu{_}1zvLSgi2Iu;ZdA)6m(%oZx|Q)g5VTVuVVQf*rFx%@;G<8 z48K&;7C%yJ7inD|MCeK!yM{8d;eAs(IoGfp-{?Su6Q>gss-16DQM1^uYP#1Rc=bK1 zG#{v<$BVQU0-VZlunbw29k30(WWRfnxQtR$rs9u*LH5+6QaSjBxc*PNs!YTc~-#ehvkOGs6yNWuj8PRdxoY?(lR12&kVq7t0wkNae9qrsN zqr!y{q$)f#8H&jXmrW#A5p+4AbwQz@=ktfe%kGqZe0T%nbLB2Ci3Gg6`%9+3F&nc} z-O>iB{5oQ9UPIWp5f^?cH&uJo|4 zM8^q}QMAQrNc3+Y+M+)}m%LcukJoGC^KL917p2TH$2?zhqkXLI;{=K-F8)eW>Kmy& z_KWV?;X?DNB%(jX<9(%)w~6Mf33ArlF2vUgyA91lIK!ZB{Gq0?`H*Z~i1z+%w!eo` zK?KtUr&_1+x7`LpLyWkYd!cQu{qoV=0=ZV6WS?}ne+f>4{cC8R=^2I+{GtBY%~I}! zNECD>m7PNM-*i;Ak=f+?PaVmfmyplYG1xt5IxKKY9uY&#*=la-FQhTj?h$!ooKxzg zgH}Uz-Z_%F61Z`e@#+d*J-thU9MMw*f>_1tdT zW)`fq$5>zB-4BAm8a4wGF5+%``UR3>p3`4)x+`_^>eG|xl!b6>!g+rp=7MKI!8~!tT(to8%cxvP81?#;N^XRv-C#YkI)DsM1hij z2&?$nprywv(JKZIqwFnI$0#WSCZ!hMCe$9wb?s!MI^w3Lh2Hz6-uZ21SWI5`termj zy3M0f0}=@@`0HDl{bu}FSO{#xzp+3D)?kEmDM2Q|5QmSN$ii(^!8au!;jl@h(-w^;6y7>E6mHVOhu4?gKvhfd1hJ4 z6R|TSG+alv_kG*paV_f|X5kdeUMd?bdQ+rbNvmF|o&lCG=lqaV9Zg$Z4{~tGrRAMp zogf(hWmsD(h+6UyDK8hbfU->`-{rfgeDw9a5z2*C#tL_Z@C;qB=f&H)GXW~cAD1D% zqQALKYfIy&aPqu8>~}$xSK==TtXU3_F}`EgEVe8Z4#MWzTfjSNu`CM|)}8m;Gxd$- zN_XR$6Zt%ui^_HHHg_E{XN^5jm3fF%u;vwpGM*op4lu$&GxOLx4~e9|p&u;kmEZC4 z^=X%pD@bH6=>i*HqG(-|{>>0p!!YvGix(Iw?{Mu_n#^Ey**7k&Yusd10Jzm|_4Q%~=9+}Jm==ubd^IwWl<@hkDz{Jm&Bh!9R$<3IZ`$#&A!x%Hp`1s{l|j+3 z+uNQao|JpQ+$+3+CsArQ8E@v;@Sg_7A>PWTS9C#>H>20&k(w2oat~5EKkp{Cpno5m zG7nYi6QP|OuC>E!B733nPvIbvE|+zwYZ3w}wri_w#aSk3vOnaN;vXtIJ$qv1QR`}B z1QeVb4Zmli^>GNOau)>AABm6pUWVtD47Lf2f2y9P*WQBhUzdy*4u!ON$n@=!qmDZ4?e zZ4Pcp(*CUHH1-6P3A2l~yp%nU1mTiaEC24IX3HcN&-m`WrFxIKuUo%))K$!~Cr2-v z2g%umX1V-*-&2I|GaVX`>n38`S(Vr&eiR>w|C#F?caUIhBNr2P3=avrE$VT&>$r9J zCV^G^U50uX%`XvsAT?fmE}gM0EJ`QtE;?QA&m)0REGrx}S@v&IZ9yDbDoyqv9?iDB zA($uchKiJp!Sl?HDm{5=Uq39m#sblc$M#cFIS`eq4xsQaRKr$TT#PhuL~&675RQJu z(=ZyWE8ARXR_hj{#YWQmm0Ph&`D+IfpR5T{6{vpLOqml=b>ozg)MP(Ywj1-YKpy=v}*C{%&nzuSc~V=D*fkacsqgPHS#^M z!!`HQD;p}AT#Za$|LW0prHOw5W#MozCila*q}r-~6j@j2N~`UY*vv#|AB>JuE@h~> z;bejo>>+JkOiw@=xzBW1roJl0cF9;cdsJ?Q%X8b}n1RRG&7&Uw%8-jgaE*x2uW<)5 z!q-3Rh{^-nhyseRJL7#MVW)1J&CR?FHHZ$#s@{HPt|vxGRe=f2f=eZ)d4a5AZ}2!y&RYc(oFE{2q}=jLjS2GQTSk>CBhjx|chKXvt|D zH>}Wg<~5gU!0XrNzauR$SjAykl1lwPQ9aRZkZd#}7tJ0KMf`@a)#c8R$St8uw*QcY z(})GEl~Z~W;qx(Oh+yP7E02BvF`tus%ZUwbPN3-wpNma4xC8%K5QzI+F1Lz)%hHiF z_X!1JI4>H!-v62ImOd$Chm>bDoTA@p--4xSYT6Z}XzUeefDd(FVXKc_VEe^ZJa;T1 zb>jl|iN?YW4A1mgr)+p5ky!LJjfRp=r9=X2M8LNG(Qv*ZldJSST9nSXdDgHn?!W-) z7w6Zog!K=uPQ4N=RyN?(8bLFgQ<)I#CTL?s%I;&jv91f~fMp?9v9w+w8yxeSl)p>* z+VcW*SuefpjocUl#*=vLT$%C%(2n^`MwzqD`)4tl%W&4B>ZEZ5e2HbD^ z&hw9DV3>r@s_XY=@(>b~oZv)tdSQX61Nj75V3%qzrKzZhQI^wM~9 zBnMY_8`HI$(P_n@*F-!s=fjttu+}8Tzw#XWe^|bny!|#64WbINylUIU9^p3Olvh)B z^L2M$@q;-mD6LlD7;&;hOE28#9C~{XTbK9JWgjiX4%vEtfsENc$`zP2njcg240_eN zKC>rf;*54>rAx+dh07xuQ9Ss3)(N{1-MdrIQV%Wadb4(*5_Hb%%89+i;@2vPqkoLx z1Vr=hxl{1@Kr#SL5d?pN)O7ITk8SwKS@CXx~BqH3C5Z$`Wy`sfnthOu1&7Q z0=bvw<{{0uOun2;k+iqSe^O1@EXaPBG0K~5NF9oVn^Zx?nHLh(@5-x_7fOqj>yaZps3nRtBE+Mv2w49gR2pKEqZjK7emxR= zyV$ZDt)2?XS$5wpEI6=yzdg@?<(E;^o)Qa%BJlzdQ8$>n8y=Y(2uQX zGa+H>S)g8q8kUz+X6QNi0|Yt9c_%J6IHhg>j5KE^bF{YX9^-JL+ir^VEUv`c5I4rW zRW=e#SbeNr6f*NzMEf67ng~HktEw_=d%z7J{lQ>$n%cZ^LKkv5ZJ1s_2G%D0Wp&S3 z7h`qk=}Xe`Lx4PBVCD5>bk6KdevHmK3SK)*_cwxtf%%f5Ot4p(-Ia<7MVF6Hh?SSv zFs+i~duWz^t6j((I!QTW57v$dG}G54in>@S!I*0XW#t@6_=6|=iotO#I*Qxdq~nlg zeb53X)8IVBp2021dx}SF+Lik6IftRq_67reZaZAXpVkY1X14@aq9?i*11NZ*=_)ax zM#?fzvV0Y@0T4N^w+QJl=G_T?Nv``K%_Xrla}Ao~yl|TDmFG@PdKFTFI zF`LgB8!}|JoTY6Y9l}ZDk(De@uqvi>$#=9UHD_%ofPe&pF)d;Pb3%=+gbU;GO)Jo24p4t-L15gW+dP)tC z0wpSN@Azf=4V9tj!Eun*R}V}Z0pUqkt?pTngPS23_I7xA>=^CxCpJN<8D>A-J$`yF zdY^?C=4{6`iQ*{;MLKFH&q6K{va}(RtSQ*n-WL#lz19odQgj=q1anQyTFiZG&l!13 zfl(Y|!JrSX!B?lTyV_V5pi4oES4qJ?E#pRBT?5NfE%NLbCT-pWOj>*oJ+>vMcJrrL zREjZ!T4b93VD}0=&r}yrbTBb0GC?>}8|RlX$UsjJWG? zK_@A!Ivp6^#elZ2^X!#9@;Vn*m*c&cMSo0d^>x!)=8HW@rL$299SrU3&Kp{XKZcXU zRP#-KF99sHMT=_nmhbvb{)duwOpG(nZ|icjTC!H)zy8?nV}-gVGw|dfaWThBh&eCo z4{m`Ky|~axUVhIOs(?xe-C4$+@1`D~F1BXqGou$(xm2Dti+5=F)QQn${ajP9@q9O^ zzqRCF`~MK2eZZ=L1gV82CRIEuDnxZRx`ezwjZixcIke? zTJCT!Y2{!Gh!-qvHw7N(A+|!DqrvEPk(Pl?oKWARcdDnmK}M{TAV1+%JzS12G!CmW zw2sm}e~VChk9xCl<5%_m9X`9?3brckR&mftgOy>^NTKJgV#ta_wyyk2Yn}1+uN9q$ zCpTxGT<=Y7q04fYm1wK}$RY_uYiZ*gG<;p4Q`V-`V30f3xnsvf0zd~LcvFt;_3?R$ z>dE4JMk7rLdNsG9(B$=?9Ew%`fAOE#@gE-jV(*aO`U>^K+ zc1ma>lvpPKLVw1Py8THZzJI<>ehy5Z9QlUN7io^I8vkq&*DsY6j7IdyCx%Ay3Y{FS zRmx>W;9rNSmLxYVPO0HlQ$VGT&Q0PWIU>YDM;1A4N@`oOB8s54Z->^tiSCo)r$jd^HIevl zs0e>p|MJ>?YU%QmSAOmteyS<>G$+R5a=+R{7%6$No#c9?oU;&nnPON5af{ZwRHtQdrX1kr77bz~=A49)FF@tO}O^8+diqfjMeCMUuBW)i>0SaQN9^x1RO6vE7LR<^OY3yZ+%=Fy336p==M zeQ?Ci3^GYssvX#}iIqAsrK3%#T14bhDw6M0cvj5sexp8Xok2qk+?7{UMOdgAYrL}2 zD8=Gf3F$c8n8}{eCM~&G1?F|6s^81Qj)cPAA0E3dn9p$Nj3d8nTF8c8n9eWBrEqxd zF~=8PQrXOY0N(j%Vh7@JS?BYkx@IJ>ZgCe`MA=VoRc#8HdlY{GcTmd`xyM!{&q$xI zj|3p5K(Zr&Q_@WNU%0dySuGQ^7Cfg|S}Bzg(v$ksir&aD$)|>+&|}EE_N-B@Ku?MQrN*^E{JZ2gPKfyG=oI9UgI}f~`9YSg1!?Pj6I> zXL+?=7GStZ;nbyaVg@7=n|Y*JUuXqME!zb~5W|P*|+H6fITfhETG88H1|2_BNA;K2V_GEiG(l>D-%3@RX$v3y3QhaJdWTbq&tXK)W zRz{;G3DY4zSnx!hbkDmUtm^Wa^)I!>l3pZ?H#`5CqmaBAw*MX7Ot%05d<^jp_hQ+I zE_CWzc6VLu-$c7hSWUABXGIG&;2-!3HcJaGQ;#vJg;kBsWg=nta5YY?ahtV$$VOEL zsvwZtt|`w!>a_jb+r$7rD#!d@%NfwpkxG7#`*`sqyJbda4I9U}S0J+88}dJ*Hqr_S z77g7z5Uc!_-(@YI_{kcF%#6sGnWNYTzY>4r-JL`Ux|#g~jXarjR4z|HSXWOKzBmJk)us0~ z_K(%Y1~M4;PkOQopEx!ngWZ}fHZIJw9`J$O!D0{v^e(pp>!f8K>uvQ!^~G0zqA~e8 z#2dMTA20M(bNv{wE;n~QHq6+QvrMWV@7kZu$rtr`JcZglQgjw|#6Z}N$n+A=T80-d zsds~SC z6KHOkvfJ_TWY4)+VzA=*=b&=M_U*Q{fp#%^SRwJ1`nei4ePzB|7^!XaPce8`O;Ahudk<3jSga_bXu+M&6Li7nt|=`^>mfvBzcxg~SA zd^cg%jKWu2R{C{;&eeaHo95xxXnZAfOODDm*y?sa}Wv%zaw;hxb9)xg>@=NGWLWz941{=%s z#UC09gpw~S1eeTn|x30rUJY<3PK72+U#LZS~&X+<||`kW05u?5>Khli4Q~! zYnAnh#j29~bM>+GQdSXwOo4{!7Y%yF@e8t(k*!Sx74K(zWwSA$)B7dRKPNaLVf^aZ z1qY{#z65FkS+o^vrk2NfFCn#s=_ZAI1>5aF8U-ZXW#N6@8iB%z0)NTn9}U?vvRIky z#Gz-s<(4tMx%pi8W^K*^*T443oh%UV5a7g*9Q*5~HXuu5t?SD2g1bL`$In=Y*`B~Y z`y4!l$925j*7e^IoZN-Z*G}7(`i+@`?a~-sl0sNCJbReg?F(BpG+!A()aBj`;p=a5 zQ=j*G?;{JRf?Wo!1$$s2x=f)JZJ-9hfBIP=D?Vo-f^vd(J{cgUBkjEJ`~Ehji-C73 z$HeX;x#$Q8Mrk%UFgNo1W{R`JNC&{V52bRclRL$0Q{Pe=h90p`3BNq`Yu>(O(>^N^ zi9WnJpjwu$X_)Iq+U*d{9h4fk-;lzjx+fTskp*Ktjr+5_oqux(5*o0VITuT0>MOzU zFRT|A`;s4_T6G^)`vIwJ$Q`rq2ttN4Wt;_XfWUtf1iwokTaNB{@;@AR`GUdn*Uw$P z_|9|qH?)1~Pt5rp>3aHu&G^1+a@y%mCP9QPkClV$$DJLiVO(F%!RcB|mdt*20m5#6 zk=!w3;RK);@aq&3LPX@sjXXKSfL(WW$@9l%esWK zh1Mi)g0`A4&_YGs`XVs_1A@sOvq#TZkCq`D5GSoXH7uMk`8L0@dLw~(M~nTTUC5XsVwpu+#4oKWnVQHYBO1epS6B3 zw^X7|!YY>p&RRqAN+v@GIX?l@y$<&8@E#L?hAgbb@=A(zSZTiI^Q>=gY5l|vG!4&l zUEcrWNs*S6nd1fJ;r)lPMtJlps9x8{F<1;a_l9ca41Pb`K`(zzpF;&bF_$ZYe&mz~ zvAz_HXkjwA_DdasE3hc3L>j_F=Tm@%Nb7%VT_N2eVQJBaKf3e*Jv69y-t8u-y^|}G zKr<8{Ks6%MFlNwLD8)rDtPw#tzjhcG4`sEjx}?2+(Ci@${gZtqYcj=`aX%g=f^LOL zuislF84DTigc3fL1u`~3Kj=wLn}0{-;c&&z9>ue#p3us^B4aD(!M*m+*NObiAYTKL zyvO<`8Ad2i1`+>}nA(BWC2iHum=4dth6SYrB$}7wLwAj1Y>_CG7ditc@YDF_FOINv z1ZOo2@2lvyP;$rE2#`38D5_&V$cS6=N^_xkHy&oVPpB&Kx{{+&;}WAx6ke-blU-GH z!g)SGdX?uscpSDX(dHz9eI;O=!%Yz7Cm`=z$Lq^<^*VFBNY=P-+j{=Um}Vm>Cv;Z2 z;JquLVd{~&HDml3q3F>NvT2C-=UMclOd<`W(I;F%{iAI{*rtpnM!Ypp4u`n2y?SnS5L zv0M;7u6~n!KxQ*87S*GmxMqK<8N|N~YWQ%*GY8^{^|GCsC5LFKg9^#szKdU!T%1Px zgjQy&KT&&4s*NM74IH1w6xhbS`}QRJz;{iHbDKr=p==r7Cos!K@2}j%f0e6?-)W?A z1>A2w4o=l5EE7r7gB6ED%I18pwhl23NL5j_me$^>al)c9R|%U~v>%*Y*%O`+zxQb* z9b6bhuVHYc!%)(Cc)7A)KOutbjN^=uEdk&_>pACdZwtTnnNqyRkg0v-;$Bm4|K>D; ziR_=`C?c8YvAuWyI13SL!Wt}J{egY>8GiRd@qO!4-EDZP$GnZP!%ZS(iHM@)kIGFQ zS>5-)&KpMZy53>T^QnS72ks3sQ==#Hy0z_FpH%8NF6;*cx<1ouNi^CuNfamYuy zjj%qk)TKFD3Bsei_^nQKY~W{Wgu|alvQ$6g&u|ERyb5W#fi^!i;Xmt76wl1)FZ{Fn z+99mY`TP>OOE}G+&4H6w^U<%+@gw?+DCQf~5s5HnX*!RSM8KymnAk589V>VUQxWkf z^kC`ldg0rIBXq@(crwd)-hUB05w?ypHP$~|e;#97SYGQastX5S0-C5_T!U}F;z*rd zO?bt?#Mm{4CWV}h9qM+B=*YT$5OD0rZf=h$a-Qmcz0`($BcGwo=c|fU^L=L6kuL4K z&IU$)GDWIeEtB<9y)PI)F{M1KnJ8>9V{8i|WBPkk1-v3Rr}rC5SzB=O@x;vWlwXzl zci|BEJqm5Spn{gfd`}i$@kI^Z(P4z*UOdLH{`5vtc4%R=XoM@-{&KcF>}%fg%d=%$ za(;eEF_m6{OYbmTs4oY{J|Bq9cpYj-b{wl@ZJnluiw$FL)S#_z`5EmiMZ)sDS|H}_ z_7}P+7;rCrCqJu9Jw6x;<-3?%`sYrB6pYUO+kTr^=x?<4YuEeVvCyWUAqLi9a}=66 z_!NsWt1fHf66&tSQmo7KDEJq8t;mN895E>W<|;}z;+1!KZ~t4Q!i7J=RB77Lu*fK+ zl>FbpnLsC>d^6|{MQPX|E2-J=w*$p98d0evxjwWp83uIZv#bpr*~j;KbE?z9_I;H? zy>5)EIUvBt*i;QV*OzT}9OHi^ubLGZ`Pm`dWj%;#Urf@2@q{27WQG5;bbv8$=Xq}0 zAr_%@l>(Dqa)T+IT58)#=mH1B4DOqA9R50wNe(i?%6Bk7a~i}^Xvp4oXb>8?i4HCZ zK&FC19UKhZ1uRcqHMdq`3?!oWFrK z*c^2O*ZHpK(w_}O|Htck6nz%edD??ZU}dDwfdrZ$Kgseo(uOd95A4J4g(z)gESUCD zu+wK!@u0ar;L{9IKusyHYiXRDcSOpVLTU!(XF9ZM3q^+NP^}7Q^^fCAOXzdECFk!E zF*Ke%k+C;F#MZSPFf_Wp4z*>|8{mMy{=5p7JpmH++*Ac9Uhfgw`Gpbtftuv>$o`}? zcKDmJz*v$bf;PO9;@=m5s+nFp$t8Om)R30UbP9WR_#6Hl<*n`Eu#5sqY>ha(>am0~ zH;fa0(_${$i!(rm&L8GJFDBf&rrSOAcL`5MqYdezFQEah6=Sma zjBAvgQ0-F(@T4XbWS4JMGZhKvjJR+k(e8Icf8v^(9B~}-Ym|k+GFt~ayAFq8VK=O1jP;4`jnWG^z{IPQdf((#K5wBbMSsqc_L#wm)ItkwAKNB zRwV%5zqpo`SLa{qq|{Wmy6+EJp2IXR@7{su3Eu?baZfF;NbfU(5i$&!WayR&YJ5R? z_-(^M9#va@P0B4_2KD*ET{D<0Brbel%6K?fMinAF|4&_C0Tfr#wLL&^f@^RH4#C~s zf(8%n?(T!TYw+N1!5s#-;0^(Ty9I}TcK6%e_f5V3RNdQkr{+90-F^D>>Ap{&gCjsR z*HHw_T2}wDBP&@FP)fcIXtePW?G>(D3C$X(}wtWHI9?+1_*T+G(KH_iU3kFY}zvnG}_IQSN(+;Z|>2k$I z*HuC5XG02Z9PIG@Z#ph44{2QCR%OVC&}Um6w&ZPvJD8ycWoD1NTcn$Mg>)_3Gx)x( zVH=nS%Ox$X9Rq5<;W2SVcTephYB3(2H;G4Qcq1BmeE3i1p@RL`p9x`sRFzzwsQ8!M zfVIK8E|s6`^LNW`KVIa~JNq8{&OI(sbC}S&K3{EPhZ)WO;`k3juBK2BXxVN`a=|q+)*aEh=QToq<4)qRFC~c>-OhiYdcS5jO+fZbha=Wl}0N|Cc@Q z23yJgl3qRZLQ8x@nKJlL!c#n%H=}=Xa|x{mLpRS05KBc|-d@+zL3|cfnO^4?4c2ST zqHl2(CdMHG%Ehqd^ya!d!m|8tW^VJu&+NSUQwy|!U~qCxfk(e!t0N>?M@6Az%>dmjAX5wX4Nk5l*?Ub%M61u%kT>0mBw*l z3$2D;GlA)7LxVv@!7?rDz)vKhPGFZ?VSSf$6eQtksT&URh&>f}g2vaoFK;5=mvQ%Z zzkDnC)5tOV6pyy^7cXD`t{jC`{k%b2M4mkz^Riac#hl1361yf98WJrla=!i${#Tn- z^I`;1?m1%rggnzj%pLPVLH|T88E+Iu%@CH-)PY(&+8j?wQ<|RZx=L-8bT^9RLnU(B zx$l!<)OTHGB~G3mr>p#QgfmLkZ*h(Dt+&N$)#}UxJHDT4TBLR6l}+-~;mvSD55(Cn z)=_s|TTi=f*S#Dta{mV}w|L(*4ZKBia_zslB*VJ2XO;CymWP zMG`GZJgQ|x5$*=k5lk4lUgF$rP%#XV{1#qaxvXn3Yy09%GA$yRF)^Z{)-y_Ub!Z{! z1Zf>rxY$2g$ZyuG!v3fk%?(@`nWHVDzt7GGnd_T|K9LU&l_g_*ib~TC;iG(mv;IP6 z!O+(r(ZAEEEmts`GN%A6vvbK)D*E;vk%Zd=nr;ysHn-mE$NU(N_1C7w)@`=?Ilae1 zV#34vo#P@sW3-rQha{%849h#CI*~}u>hH$W-)Je}J2~S?`vQ}LWv325=wqsp)9JcB>RWJbow8O;X`%>=XyzbH( zAjs+zzCXL0T@}RK3Hxi8saLZCAdJ<-fmb#_l*6B)o>Pnw)mhbDWU-8rFHYI#9F_lt z-axE5Ka>mCfaxqinQ+O(^hWC)#c43Cwucvwca%M5URFWI6j9)k0A0ps7`nygO6tVQ zH%EEY{@#+9_e@E}H_qLZPw#o*g&I#MV}o3ff|WX9i^R?d=}8ytusJAmBymITKkQG& zHXGbur+a$9cbHv2x~&5xwfbYM?< zf~g+D(H$#Hp?!2;CiPc_Mo5luf>&c65WrD;l)JuL z1i7W;QQL|oiny_DlK%Ys_P#cMJ@_u5&ENMBAy|lmIwP}`!WE7#L88y8ye1Bb}wrF~JjxU@4rvS{TRNpqljR;L>-lc?p6Hx7V7Cx0H7wzRMW;4{G2 z3Hu<1&7c9q6_5#}-vZ{jpVlu&L?1_RKp?=zEet46cieX389BNXdbWOI+O1cnwXBm`LGx6NI=)p5RS@^%zv zyvtHgFRN8}e>_#Y#fpMN5jsg6E}<#U?n;4ZVRIQ)&8p-g8N?35DSJ|5oNT$ z_%&0N^}1W}@@@-)3xiv5%SGU_!M1X_&(Q0Gw{Oxh(p|SEi@0ULgzOKk^Gt4-C-)U+ zr0&Lf7m(U`R#5-ekBM?JhZ=AyIXesE>Cd+8-dHak1#GkR35KL($>)(`<} z6nmgTD3oJgfXQN4&d^@r!q@pXr6RI(B-RE99x<6SeRC=qD9IRkX<}RGkYehQ9pcdk zQr6p99t1^%5RNfA}CldWp(BOFsqN zJau;+9>E3NeLQx#Mrt=zEo5M}Qg2BFJUGd8`FaMkx_OR!*8In~5}h|(zVx7BZY483 zo%>=YJxz5J7D|h#Jnb9gl7I(5Vd-i2&ntE%1MMgGutDg?GsqO;_ApzTxiVpg`9i|b zsf%r*!Kuw;bN#2ZK~h9hb6LJ#ygA@GFz-u)sJYA8Q0yW8L#v8GMkQXzKx`<%m-cr0 zw)qrXL(8(z+wwI{U*T-!-q@kz4N4EP5wZjLC^y~3$o+s>sa80 z19G$(qTY??SZ^_;QrX5Wweyqv6qlqo#pfHcrqHT*D75GB7v$3eeO~;opcbej?*?qM zr7r~R%_vckP2C{MMX6(8-qx=PqMw0Y+oLcJw)Z!|JMCi&?AEc+buBRa{CU$0Q5vX0}p!S zJRvgdTD2-H6_`>XH zpP7)ef4*`J?hIda{G6H1vF0R=%@7J{s*8N9=qD)lSM>ap(S~E4+gl^zgHkO?fwt!D zp1wI_kl&b)J^&YaX?R(x34DfrPN)8A(*a%6J@;;^asg=;#89U&QF7<7QIA7F5d!&> zKr);-l$Cu4ZJPv%e-B$6c0e;Gw0Cu zfqC@zwVw@wn2{oh>v?Njp^u-+NS9+44&=fYcN|qM0$cI~V6ebR9%rIS zD{mr&=8`&RXv0yu@xO;Pp4IozN?w3Z$uqY@xdW^9`KDX8`^GZ!SnhCDoqI7vZ_c!v zzz3b5y7VC5 z`-@#S41+gJvpYlzM#LHf(cR*bM1oqEAw4P~?^XuY&TLbzPA}Jde7>d7^w^+z-a@kW zfkUj}v=LJ*441{<@Nng-C!R}mm~H6WG|f8W>X5Q(G2@mwZKA4IX$()h9V9Ld6!~uP zcDUb z>kOTU9GP)S`5c&T_>-6N8oq8iu9n0561V0*RSO7O#eg!w2;1VC=af6h2|NYwVSuSb|~9hVxExA1wBI=f4;~j zfBIPATr0ZxFuQ|V!A)mz9O>4|O~-!ReO!TH6ZL1jV|T?guU2~J@3q`!6pDmtUlu#r zoYVqlAr#NWBfh*vlP;W{DSRJ5{Aa-9j6VY&cmBvs-g4f*X84ggk{WNg?4)KnL-a+M z!eZg9Fb+}GpHSLmM)kAxCV?+ZVtiSN5!XOwa@qCi@zi*5!icZ{vl#_uMZ|sm^LvnD0#hOOVS$x#2q@L+Ei!iC4hqKsV2r z{4NxFt?i_(acbOkw*oWXjTB#%{?U;$fMEvn>WqGbi7TeSz)v8*Kyy!hhF5pzr1dju z$RuW*Mk}@|2g$xpe~2*&`gIl+yFG91Y*u;k+1jv#_sid}AfB-$#=@nLMus9O6>>u7 z$-+<8j90swm&Epa#;Yk)qt<;@c=u`VE_g{+JnE8)3fC>wVrGh-0cU;fIm!*wYavPI z@jJ4#l{MGjV-V9Pi&BOzO3yyk#et8|2?_}C8x|UxYgF}r`hc7A{N5n-gRJy^pwc1C zfNPKCf=tC#^kv`WfkDgxd!9jy>B1~TU+%W&?dB=R{W;*3vd+dq`#Pbt-C~jEXo}vK}7Wfl?Y`Qz{eT)uN%_s8;W>Jfk zig}MSW;-vo>O~IMk zl>0?kGxH$GsAS(8&~jA0-4Sh|a+a)jKf8a?L@Yk6xWavD+8{ey5|D)AgGkLPit%>A zX^lbu=HaL|14op5zxg5z?J%8nHh5wd{c(|lLl8ew#O;Ge$({>NI%`ryRfC0kG>cxO zari`yxWQGGDu#|Fw^<1qA%qo2Rd3hFe8&kzG0z}^4qvEKVJ8DU1w*agFlb!eA-1iT z9kI%X^C1z{128MciE$FCjivO`>)@eNy3LO!Dv3CQhivpL_Vd|(beg!Yw?$Wm{OM0Z zop*cBIZ6^)SkC^_5+uIYi zVP*FeOqS8M%K8Ags_~Dm;Dee})N`+c&1kp?T*R7pMDJi!vZmN$q;p9s=uIv1zdt11 zfzJX>X3=0Dw3$(#wDS_!zv}t_k-E(jDo{?^=j$fRYV)4BP8H=5pT3g^PfJM4$SP$) z8I};)&7-hUuSXYC0@o=4(88!Y?@c4UV@rc5Bki5Ah3*VV-nL@%d+mxScp2p}JX#Tj z0-4Zt?GBvr@Vdt~LE7kmq*vg6exa7-rTp4!+C zwdE6Ch>3%WeD<>FeD~+we*GN-R%re7*7LGs)_Q9z2*2{N=)6_jZhUzM(~=@@2k@rNy8{V5g+gs!$6-wtdjp3S^h`P941|$1 zzt;F!U($2PCFLJqz1fN*l>}HT$Yy47f(fEUU;TVLv=V8=xJ|43Y zaY8J*jvtgR0kgxn<@bWGD2lRBZ!iG>031NUcu}L!Rs1Cu3IG^J003~o-@02fy4g8e zIf3aT&Q6Sf7Azm!ZLFi!bevW=P@m{<1&Y7Yk6I?6u^TNpWKm1=zL@8bUP_U{K)`Tm zsrmV!l-( zs#JO9-H%{cc9yKD!TN8TA{3D=ez&OxEgydH+L6efu4TacOcToF`3o#pSu`(w5I&Sk z$)tG1ar;^})g^^o`mGX=_X!O_X(f)SEsXSZ&;n| z0J6ae7=Lvte|3VqX-c-e8~A;~Bz>WsZfeRaDjIsvnWgQu1;AP{hV#PnFD6WCQvWV) zpr3!cn%1F=&`_A5e0P_lste{C>G4U%YB8X`1+5Zs6LmDT31P8LSxP@?qR<^4wQ`-h zu((#|Uhqqjh*Q|)FltUB+$KYzEHyRNGtU6pqFeNsxHC;IT)(*;@900 z(0QT-he2OdRZ`a$*KpAfWOF{?nLU^JZi-xBe(n=xu#PomZ~7Pyv;y?MPnMy^m23<~ z-K3R(I~*FwLBaPU0{R7tILnzIO+L@R67@VUb!Im&5N7P<70L8U@t#ErdeET08>pOX zAxT8s<3T-;WG*rYOVt}D9?4(NEkgD;p49bvA8a^oR%IADlMZPP=dS$y<3c5L*aMWbx09T z=bX!OGes(;xeK!<-#{zIRo$e>8;QbBGNJV_so1O64r}p!b>^VX@+c%Wl$jZg>s~@L za$k{&zhYN4X>ESXvcHO|O0B2HT(?lH!brm3?A08(%xO!TN1v#OKI$&EWcd&oYnN~9 z6RE9bRc1ZjsXoJw9(AN7pRBe0{oV!YSgR;Hckc0d1YMowEzY7|aLCHhmf(L6Vvc}G zm5nz500RvG@b<4k?BwiWZQ}ID$UV_IirwNseO3SJeYPWwuI@i8F2Y~RpY`o?sU8%w z{+tIJ^XKNSPTwFtfB4Co)dQh65Ygn5FVW=UfT>0eLw_}0RC;5$g>uw2meEpmh|-uk z7jmS6MF_?R%>oYs7TvK_iTE9^D1``ZR}F~!Vu-#l977o|8|#&J<_ zER@wXp>*cX2MnSbZsTIErKN`Hsmfe%Fp4E7unOF8+Mkg!WDGqgPbmM&7Xl%d=d6L=@?6hjX zds=YRCSUqxfO0}ZXx-(#O@>3e36U*>S8h&q&tRY!q%(Is=xWEhKw-yUBq+UMtpHPX9#wuoIcb|!PN~bMj|2}mIO)TYArx?j^ z{35{G*rT3nd<8fjswvUbrBwIPkiJVUGnR`egqPnYdG{y2B!*QCoRE&!AUC;_(r)cn ztJfWaUm=_oj`OA$v)+Q)TMWnq*WDAomaZF*=hp#oh$GDLY4Zk3!7&CVwc!LkZz2#d|?_d|yZR$25o2E-lw%snbrs_JEle z>`OeZlQZ5N;LMBZO>L&OvvVFH-;Bu0&oE!d_DRr6EgGL&M;UTKSv|D}%N&n#xh1>9 z8PjxE7{0~w-89Q*j1ehizu={XJD-fr%!HpgF!rJ}TxHk6tW{>~rjKhMT8emyBr+b5 z#urTPho)?O487b>{hr3umbpzTTqwN*v-*yJE75YriM-e6j;1$DZ0--A+bUZ*n9xLQ z^)-9C9UzTi)E*VxQ%Szo$>;t;yAa3hWtT1IYsM9S+N&Mx#p^$5-xP>AC)57)OATJq z^ZAJ?W{9V;Tuo2BGo|uyPY?w3^5CSpcdWTAGf>99?`D%2qSsS4(knQf0HBo=2Kh_D z3Dd{HloVbIRS?(eL98-TyupJR6o;t5>eiAuD={bAAi>Vy< zf_(UX1tQi*HKukJq6fN`?(stAl3UAzV7NxI44_+*S2`A(s)=T5|Abm3YI=O zK=xW^!BwG=;Wzh<{nxASC7As8U0Fxot@R6?wazM)d~~pvpOHze(_ukZwdt{WU8)#sj)Wcr%`;Rle3s$l(X&h%T3}A zj}vZ`Pr^Fy=~^3AW$Zj5trg0!G~Kp(m3~5rPGM;^h52c<4I<_2yCb$@z?wjVTp;`E zQtOO9^?3cU(V>uoh*djizFzpm@0<6LKO!T9RJpK>6I+FL?1XP?K_g_R(_3h-q-o4tN7e}M(I7`~c*xx$8SMJ=)afarHS@}!&n;Dn*T>q5ygPUwlXl=vNjcy~mnT4d zJ!^-t56f&VA#9b9_}PHE8J4+39;;E?;<(#8u&W_TwKbm1D~Y`BrQAn<{bPwucp-C}A7Zm=4s9H)OxBX|+{=CYQ2SFQnO20d`3ME!(jY_NIQR-m#5#}Bp<)E=io&iT4Q^+Wk}iGpXB*NH5e8Y zkFpAnOSf&`3-MZzdJQ7wia@y)%dOn|q1+m_{A>&$q1mQu66-~$>6%u2` zL^FCx4Xec2IDa)e!7bt`k3+^*)ZOLUW|?iE$wSzgaEJt@38^mv;_4mWXX(UK60t;W zv<<_+e2I)eS}Q<}|0HYQw$7Z=$s7CeP54-{X!iSbuS@tmh4z5MrY*kB+qh*?43$0> zpD{frfr|}Gyc7a7zw@FI4dL z_s1XH$^d||ospuWoxKyIfxZ17jr+TFxR!%1!XLi`>mJ(QqTtdWqUS%QjqDsv{+D

#qMU`umLbujo-4?0?R0zYG38L;Nc^oBq!~ z|J$hiF8sSC`d7F#<4@uLk6rp5=l4G__X_xH!0e4Zz}_v~CV zbIr`|MotnG3=Ief2ny&Y(NDEr|AD-Cz^4(wg9LbtYz^fcZ0#KB^zH0u-K?#oqsL%C z7~n*F3&%H1ytV|7zm-V-Onj-0=L~B4VjcMW-~vX_p6<#1b?&o#e?LY&#YRwvwdg?$ z@UVyQrm4DpNx$4R&mzORUt}#dVgUg@XkVW7;w<K@W@H4*`ERa>tSNo8tSF--!Bm&rP~g zd))fk6o*>mfs3=76D9n+704>^0%;m>R0KErDtAWw@2pMpMT3|gJk`IE`N`~|VIg5p zZudIS9}w3KSN2GYL*){xIW=kx21Zw7NKP!?;gm%0)8F|F!o-7)q{SpeB~=nI`%!aB zclROAg}7i{LryMUo5;_emnPW$FK`h^=8|a;0NjXxfKUOzxmnRUnHgIf|MQdK1G+PH zNn0E?q%O=OU$s;1zExF*W&E2+Ju`De(mg0M4~o7apX#rbXw!tPowkDm zt31}AY^CrDk~}ZE(cJLcIxW{NBTNPiqWwYSJZIE{i@IHJFJkEcVj}$_2D1OG09$NfRAZmyr*;g+f^`!4QPbdWg|{>og~ndoe{ z#Y-S&4&^`B%Nn@FdN6N2sUAgRz0o_Gf4opV%8+X<)c~cfK~O#Bs9QEEz4d_T>h!3d zijGxNJmR7$en(K5c9Fa9UA8!k#m{GJxYXEkr94OL;#Ut6PaiJ6rnXPc5gOzIn#7AD z{R+>4zk?snPbQpzYiD2;=L09eF8l>`+Pd9k=zfds<@rhbT)V+fUch4pJuI;*GM$K6 zCb-UK1EkUf`1*PvVs>asmf*L~^WMm>UEN~G>d|$6^KOcV=VIIUr)|mIi%lP|w_8mf z9ki=zpQqz_0^hE$ol0ij52y1trgYuEpR2R8Ew=Q$aeHmV=!qbKoU8XQF;2dRjYLN7OU>z|8RA5|Clk5~v_r zyG?v3Q;)}t8-FAju}1u9JZLFqn*hq?n3@=pR^^h(OV>{$rQ)uj7$s6GSYc;M2IX-# z0B{lwk@A8O!!)FZcq5$*F=zp>&{^k(qmeF{u(|Qe+lE2s*2DB3&9<}ldBm-xpm+|j z3@XA+ON5c~jB^fT=34z5XrNH?MyHIWpL^!;zBl$DQfQx?zkrS1Sf6;t`rQJ5kBV%u zk<=?XA7VHos!-h63j3~&lVO&h&v8tZ+Zn_lGE@>#YkyIMFcmB%`>X<|z7Mgme1M@~ z$YNQn#{VU8o*jD#B{%RC|Gb{Xt7%9w%rtTa?8-Uq0&XtWyzfh~bRicrHbrT|rPb{5 z*V9n2%&#XlkqI@UD}n^ohFMvzF@EFQT*F(AWBdku_15>u1JB=<#pLvkW@thqZ;6*( zMh8SSTC>{BF>Pv+jxz%bY-xOwMzgkd6L<(Jwpt$*OtmG{Y3&xa-vf-LVWVcW;mAjf zl^xaRUkS?7oIRiFl3FW_X)RM@RK}=BG0PwO$rrz8{JN5jk!vF#LbDC)fI^9dY{NSm z$7%I{iZ9lOYo0Ad*UHX+-Pn@y5ish&%qNoiwa0WjpyaHJB}A4J$+&ntIaVWIH_;Za zGnC463IDsAG-rZV~GGF*;ih z)6iO_(zxj*(ec|)E=Ofv@#c1JArlW%4GFD?s=7A4eIfnA9h+LLQn`fTW??kl*2NAg zZqt9%S-3ETn}W+vfjgtKIK#-l!!=1;rhs9mz=pRWAef*{K&`G^pncD?OS=pLzIqM{ zWXc>edflQe<_86%Ookq#E9Cp*?A7gO-;M6;JigS#byeadHR|fHN-cKZpBF8ro!%6xq zPbMi;CQ^2tu)a#1bwb?Bq!I=hvTncG~F~zsjC;_M+@YX^^LFkD9uZemc9(HuI%@Cf{Kh<-~sK36WHw zxF{h{BjI%P{T37G>(_*u2J;yfricEhBidDsUZI40Vxae$t7f|W`-kJNp_z9>Hx}A& z&MyxaSuX7px)>eVjJGe$^TR>RRZ zX~vxI8rGCH=Ns=z%U7(xr<^gfRGpQlyjtJS34CX(z1K9mOfS!#oC(6k0bc zlPrk_EPlU^H`7%Ql)YX*T%2C4U}B8P%5uH+uJgS&ZD$J;yL4L_0Y6Q(7ajP%(&&yN z%8lq~YRbR9wR^r)hoOo&6TKDbChtf(U%QrjPCQ^DtjZ2+q8n!7G~Q);-MjnpQv01ZU8vxik0-EyQS?>^!eVyeoG+eg5BYWM>z821kB}%WrLZ1U@p!-No;^ zVe9WTrxCgs@6xz1&3qJh$u|1c4~zPq)}Jx?Bt0E)Lit?~o@C79I%tQW`+8nS>Gy8qO>_GWf$xi!>d%gw%@fzra>wh*p?cSi zk!QrH;pi{FoynSqPF(2sn?N6A)`6GZpROG$ZTv@UsP+p_pUw$v-5X!r$Lcp}+#?## ze>ZNzoNRwJ>aI?jKeu(|S}yX~%}qyi_NHVu@;-THq|^@&WD|E=h1zJn6e4*%>?J|j zV9B1j&@x$cO2wNscB$4fd9eGk-WC^uc>OK#3(5xJc4b5rG+>l6cxKFbDsP+R^U+3P z%=vsbJs0;=(0m^_9^oM$hjP1bi^j$s!G`BkAF4x%%UQFEs{K`5@zx#N)?M?~9l?*2 z80kei+D6m1xvpOdo<)+@9*3uOh?&(}c09T-&r#{^jPT5y-oXdUkm9q+6_n4lf+7dcs<+}?!V+6=Q{ z3F7F*dO@JW1dg;OYFd3Co4o^8dA)!=z7vg!61G*Z3+kX67w2jCe0Rj=7-LEWk>^}4 zE;&k|cwT+ew5->vd|Z%wgrBck@<~!$8a^%5dRk{TA9;iEW0F~hT z&hwkPX>2_r_lT?PDEi{QDCYHI?n1~{Z?@V{G{H-E6nWG^J0ZA^55;(&-?UYyitkf+ zmu>i9&Jm(!mwVlTXDy3%adyc}cSkyQxOYiJE9&Efkps60#bX@BqZ~GgtxRLF3Le}( zhEnVP&7c}R5e)B!E3EVD7Yk8>p0mVlYb6}i_e^gMy7`sRM5wNbtcsw=3Jl|_XH@ya zkf@~vSk(p3u7hl_$IpC7cif{>2J5~DW9YJ~2ao9}%GCW9BeS0=-XIcqHx5FNH!F;% z0{7K4Yt?C(bky5tJa(=v2CuANZ8563s#h0pARFmT6GKi6>*{3Uivz0gRmb+^j^6kZ zxg?)7YSCIpa^(0-8n;%2UW-d_cYJ<#A@4YD7f0JIr%DfJG@36h2?j)DgyS}2_-G=Gr!4Ufh{4#t+ znPzKb}9cI`_CJ9;RvB(xa;iswX-S^HYlDG9SBS3~|||A$s+6AzhN(Pg=3&JMEO}8?H}3o#~se zY+?3o%8P5)4)an4mqq({D3kP6O`;g7(^f6$`dXD~cU#M`Y{qr6o`T{TdF}BI_ED4V zX^Amp8Jq3updT1_qgqQBk$%dh3K;_@_7^ziubiXL-)AGw3m3lSr5g>oy<}9^C*wG?+={~KPXnO4!4{CslxY%E$Eg!8kt@Whb-|DPENS4z0 zs+_D_<#-ih6=J$tS5_gL_gZk!H&$UiZbr?@jIndGEAJl#_pJeAE>%4rt^or_BLcp1 zpv#6vofmpN4EJ0%yw^krJDB=l#vIoMQ$OpaH_SS}acNp3mN8@$gfi^wFO7)VF^vqq zK8;X`7fo1sc|=Phi=2ueifF)d?`W<}cXDd3S(W@7MP<^pBkK6@&7yg&LdHsj+Ev!T z@=YOZ5V)za{FKez8d1Gezg1qx8<0l%UhentDL^zifnKTHvXUE+v+w}BfqEwH!-Opb75k+cJI zJ!W*sG#G^gId%Te3}3Vr?LAY&UrbYAL?=&5XB%zu-q)R+BROLIzxp5}WiEIVo0^bvV`33h%C6~1rXd0i*r`eW~ ze=5C>(uzV%vKW?A`>iv=hBk(dMddav7K#X=%G!}j>)*y`nczpeBY=686XCX~O)3?{ zW8WM4q)%2%z+IzG8aS4>bVy7ieBe0ScZVq5Nrovfic1MwLP}P6LhM6_c~$)zY-6AC z$NaMf-2)-z$pyZ!i0wi-n-e6f=HDDyM3wG(t+PWYp8>wCY-D16h7W9qLVl=f@a z+OAs0EFS2S!Zq6yRi_^}r`a$2P42DVfx9*;bt=3Iix4i7ExHsixK1wd-dd!Z*USp} zoIDp9fb%w0AyD7taQHv$z>jm83;#F`@p{4uGV_K8uj}cgN?X|=;havh0`=VXh^N|k3|~&AmIQ2`LkZG6 zq-g^ZIFvBtzDh|f8u#kZqWVZC69M376c$<33Z{6LAB;8lx|nJ{_!LYTtsPA9n9~g; z84WQ&ugh+v{|$+v1E;zx!hxyeYRI+taNnY^a)A+1r~l!rzKZf&O#S+coT-X zfU*r^co#~jj2*!U=0P!GW;^VMg6=}{{YYU)cDKex_$m%Z^&{!U&9i8w?ful*+ScH+ zQc||c&Y;4BL!+b0Taw6ABq$xPsaM8oG|Og;G7UU1678# z&UJPazYMg!XsSb~)*AKGB34+&p~=3KA@i+I0r)#%f2ld33p3vgRc>_={H-|;wKUvE zv&xYrPXz~c@A7%0!-O6|t|0v6vb)yD+qMBH?{d}Qb1_(5P2+mC@Z00%S9=XSEBTG_ zd2aqL%g?+KiFX$D=u_9CR{LYe566Qm-d_-n`W4n6Ee*Cs-$-;Zf|knUeTzqZzvPXc zqQrU@@Qx?`?2)@hb}=!D(I;57fENY+HB{xWtVe&jo;8cu!NpYt})OU3m94?&D`C&L{UC2~+gfUQw|MPLS z@19qo2t6_0+N8cz2yta4K7{Nv$`I5iqxgGYl#$UVyr1Kabr9sW`+XmC;VK&RgFY!M^=J_jSSM|ThDIvL-97GC$V;%#Nx_xd>cb? z{+)moJm7!RV-ih%+nk?$E`{cM?(xGVoF7gE!XE|xgEejrCc?XgcIz?#LrTVT>%K`CD6|2uMSwbW`GZ=;-sKv{Z8uohD02x6h}*{~O2vsTx9WKSYAcGBiCWb@fs~Gav3C-lC2QdX3Qx9e2(nj*J{LMi9Qt`8V4` z*wKMa5dl@?0>4)3ahK&``?83hv!mJC_1V58HoPZ$sNCCY^4gArb%Ew`l=)HlaiOIJ zWTtW$=5Rm?IwAxf;DV&V=8xa`vm3a?aypdZwnRn<(sL<09r-u-=n4jV9~-RxIEJV6N%` zh0M(kyb#?&>i*syJViXTk)N>eNR=MH^SEr;2y_L0Zz@ z5))uH7{}r7ez5lRrf>)gDwa@Mp#je5ed{ctg1m7LbFr)7H+f6O_Gyj>tyR0|(U{9k z$QZ7K2oV3q_=D6p9rhGSKh+1@>Vt0I^~$Y+5Jb6Dg(#Hmx%{c39xCP2sbNys>K>AL z9A<$a_wdrC0PWOP!v^hEXOHmqC~WI1|Z(|GPXk z2v1~XTEFFKhR~c;$P%ei(Ne5}7pq8tyrt~;HgugJu`<3(1oi}5|BppIl3`v;)9$5f z`P*Wrwao{4q5j4C=wyJc6^ukkjDT1NKZmgpyD%??!smBQORXFfit+C$@iG{?HNSTDM)?{hCRaGreL=F(AgKgNdU>JvvbNYT|G!*x+nGXX-T-?5}RA0Qa7wC7YhwQCU^k?tw;e5L=gKZSaZ|D z1+@J+f8$tGmkw_9GdmXNGt%NUP~w+)3Uu$z>5}-l9Ew+u`I}8v7K)Cpm^sJ*ro&u2 z)YH*%JW#e)BpU~!wLJy9*&lN`w1Me=UpDAW*D~^X8jG_E`RIQyTl8kM*ft{rY)KVe z24bGY9X}+lUdn|+1H3=lFGUNAp%ux%0Xo#&3`Q1HQ0i~`?`y>D-$RLo!>fXFcmFn; zV37c$+BP-FUg(zdJ3rp4*LF9qgLVlr*g@eB=;ZS%mY2Z8U!4JIF@$W{iHQ8KFDycO z*elQ`B1PN+3r}5dOQg z_CU=!Gd+9}>_00P@Ug0v{rjW(FLNaZzn8-(x9{8wJYc>F z*;3qsc{1J%^2=H`ChIR#0v=^J*B^dilsr&8|Ix>o&U8E*hQ~GGE!ZF2lZ3ByH~ZA7 zlyAHBLB6_uA}B=+xG3L{Gk^hr6-89UEiUCAn{o|hU||OG6%j@8FIb>0m<;<-pFai& zeCP*$NpBENd0$NK5{S7Mcf67)hZ`;n@Tm@l#{|f$FNiye_wnke05X^i0i&1rR~F{;q|j60>GE3jAZhALkL#sCMFWqj*AJ_OBv+4j{OQv)Gc* zgBP*9{mXN$i z!keu056J3il6mR=5)UDL%%#LsHV7Bf{i zCXq>b>g31tr9PUe++rU8Ah^%H6=K=a+al;M;ejrf`8*0yTRGPu29$s>^Mxy#QStnw zRO#?ZNqfJpCl~t6E3}mV-}DP#rjruRhoN{yR0Q(JpOyL?ZsZ0;_p<^B?&B;la`fKi zzJuKx9mEiQ^%DR77)yEu{oTmyoP*#y>0h)BD=@$A#C-l3@CWUICHn7ylnZ)#tA@LP zvzU^cnN`%R>;X>O1Jf~=h#kwPfNn;XfaI;Xs{I8K<+)>zCmUub9+$QEjJ@2TV3;kG%DW@%S-XQ1BqMs zeF=acykk}MhiHW%wxVQjNeFKp5~Hv>Mz9;|BppyA5Ql&R%QBsV=^*1YUp&WB`Tb1~ z-kmKdzSOEaLRDatie>VY&qusC`7t08leQ)cF1nisZS0HnD_g}yE{x*Y6|&`wi2_Su z!>nH?D(_a~H?}MjUot)NR85wBG}n(Z{aQ^}7X|mi6-NeSjJPDNn)g+ThujyS*_o}^ zm0UgD+pX(OX_zt-EEO-Z%WlV1dXlLcyEJU+RjRF4!BwM7vWd;fp&REymQ7?O=LweA zDhnO_N^LrxM7(z*WZeyqRO<8dXSm&Jb@8^-3w3rHH%^=PMduJybr;$Xj%{Rzm6wfc z7uukImj6EUh;SjZ0Sv>)l3=HB)?}I~B4*99I$bnkC`pDJN_|@n$ zN0Qt_A!?|9y}By?zSsY?RxK8>mhgkizL4VugUb(af(2|0cg*x*fHRdyYYraydm+uQ zBpzXpLISw)mBA|(@rjV&T7b6)a#`d6E%j_f9Rx9j+&`sI9-rwvoZInK9L&U`C&UZs zzw+RC0P@N3&#aH)N8u++Bw}8;x7LVe3dGr5!InVDEzpEZg-41$932$6{6y|y{<|D0 zl#B5}jDWvaDA*Gc^ffeTXmLE@p89Bq+T*z7?l+OD(EzGC;!(y`=N@b(VgJ9}3ZY6z zI!qApG3gJt!q5T|;udjuqZpi~?ds3^aOMGWto-njiLOTc<4jeHgjNjQm9x<#N6Sv# zQGs7FpW)Oo$7ElyJ!|$_G!eGeH7#p(H4||wRgzqol3tj{_qs`tpp_N|xgIN%dz3bA60riv6YCa5h-ED(b>`|Yyu>#E}5Z7No|USns5 z222I&- z$GVsPR3$|IFJY^CAj`k25tnHS3<16uVUc)(5n<6jq%GNbKA3Rc$$lFwbD_lNn}_w_ zN|Y3rQGcN7vfj`upx+YnEx-)L*5$OB_tMdFG|to zx4h@g$NkOSN=a4A3d$#>+SgN7?NTD%nw7R|oV!^X>Y;5+1c7np;$0Q!( z+zB!MJgHBHk0nhSLRNyjW#w2|PWzLjcL9-4z%i+ZVyqE64SMqU(0n)fgz!-u&0fP| ze@lh1i5yG<^vM1EHuQ`^vX5LQZ1quh5SAKD7#@(JAb$1Yq?)=rVqKi-pR*5Fp`>(n z66WD&+rZv7b}Qfv9Ln#JO9E687?Jv=D;9L1HOjQ0HRW2YSjO%qFWiR9qzN}#Lk|-}$d%0;CyU z^vHpaNq_VKq!}-OKK*KA!U-q5Kf$jk${MMDvY^HIXQqN1UX}pu$OHH1gMh@q)N2*k zV9?*a#<`1_j2)q5fD?z_P{hpdiWxcyaQ|0LIovLLokE<7Wl}^%D#!4;m`8$U9+bj^yh>kVDmAry4z9 zR6tnXm52(~F1#S~U!&|+VhW>127S!>Cs(f0hXzx+Gznh|y^PBYEe(}3K*(d4O;9ng zq80jmC?b~zl*bG#Yz_iaXr6tz8ClD<9m!Wp1wJKNgP(-pKv@1NB~*bahZ+fP z0RlDmM`q9xeGWh=7aU39rp+>KV;&nr`gMf)gT&P(xfVdS2f!u?0+kGgL<wfc7NzPkRE@ito)DgsWWP4LHn>pCYkq zZSs+;xYw}uZ{kf_#nVmgMeunPE5l(w?ag(AIvuCR4G3wN*9q1x*9z8FWuWF|jVVa= zC>rEmy!vz)-SBK(Gt zuNf=MmYAPrJ>TY3_>lVtV*>)A{xU`EiAZRmA#@xP3h^JNAQD59bt%-~4MbcjxemD- z^3e5G%zVA8od_R$NuLB);JK=V5$Ozg2eD=qCEgPsMo3+x>dQrfJ{_UP1&s?tB8Das zMnOUP`a+RjdT49mYTa*;C6ls&Ucw4qbU-2@1QqvRq1&f}^pzdsW5z#)Zg3wVO4$<8 z^R4!obfaQA(8fr6PKVK8EAH#J7$Zf(s^A@x8ghV&yeNWRq=Ap(;#(wVB$h>4t))&5 zth*eD05Qd^1Ly~eG=iZqf5k+V>pY6HV-P?S@%|%5wXg0(ZeR`r7f)ec#%p_3%UWXo zb~wPxUfHM4O~+>XD&Vq@S79O#3nx7CN7i^R!>~A1TpSWH36Wo9Lrg`g$I)O1;SE+y zU&1eII}6N=p(r3DsJOrG)5fp>`w4moFkD#lPYG;bg~cd{uE=n2Q+eM|YRIE(=lxiR zp^0uWSmK`nHIEctmKzK82fwgDBot^OQWTU}@t1_O(jlvHNB`I>{xJ;j&B*I`ys z^g!Xip&_bFCr*kB`!UJyPm@@t9}A^?N>6Mh=I1fcyC(}H|WVidv; zD67TvWKFiQd`JUd#i5?!VzA`akN+p7<#-@6&@eU520ZiQd%zZo zYF`R++0u};I`zB-Z#^&cCxw?o(=KIqgwZ@5eI<9FK#mdM*NPaWa@9O53I-5B5*tDy z0i2Rh1oVrmGVpX&5y&&$@khDaSJ?TmnR;ZWtrR7Ji-z(A_Wvi9;zR@>H7pJZ8Ty|+ zAbC-=MawIKv3Wpu2>bGO85c4C?4d0zJFi3r=4`Yg+Sma0zz!87hsO^(l)LxGazfF7 z-cS(nJIP0lbkD$|h`5k~X&-YXhk$!W)OIqRGwY?xqxljkw$iG%gTLirOR0|z(AW-bep=iLbxsqixvxmK~be~$VI-h=eF z$@@7E3l}yB7z-x!;o)yJ=7_~C5SRl&Yrg#gA_wKgm z4+{$WXXZ6=brgYQ!Y;CaTU0lj`*SkrI}257HJsYF$qp|sWqYm4tc5l-%JPaaYKK;; zj88+kg>8(rD#cVv&u9_a%VeXo z++SBO(;TCX-HC^<|0HyFa{1>nM-*erV)MzGa)c3mqq%Z%J`>D2w5OP{yLZGh_->j- z_ou?P`HM7sN2Cpc__2=lYtvk*%BwL4l7))*&zk!xIy)B4)>E}#R2!Ws7t2;V*Iefo`u~V?l)h2+hI5L+bsp1h3zrWoOB4pyXL;hhhFN&6|jN++hB&> z?j+^at|@@Ee*RP5wZhB4mW3f1YvN{&Jw-+;HfhzbU#sIH&M6p1U^*wY;ZE+oaOUP| zh^QLEm?Lm~+NE<=$2)s|rO_73l`8m@51nYHyIA-5)c0Fh`b>v)!d`dGxoM?5SFv-g9Ok8CsU33H0G;z9=JiF85$!#l~s!7z*e~(SBs0Qa9@A+l6k^c(ii^eu8 z7&HH2Go`u^@6jE(w^_csGgQkop-yy-K)1WG7Pq3MBxZzpOv0S#dW3Pp1h3T2<^e3$ z?dAbz`b;eOrCr_8Teuis5Y2xvHBWVHGpKF+`BGN>=i4!?Z)pXhWx0BhN5}798xjqY z>Jf&G%}Kq==%$w$w2RJ?#`>QnpTaPr#6}SSw{)cD8)#-3so3c5oJ!Ac&dpmVmV<5Q zzw8^=zVtTVjZ};}+!-t$Jbt-N89Mck?a%kYI^s_>qX>s=2M}UnNCl#wmx+c{%Q@hr>V z(`?j6?+YBOW$#T?Ei_6!ipaBPj_=H7t$brs3%X*c0)FI^>=lpl%D1mm|mH z7n9;{da?^%5BqlSCHeW24c*3m_%D;8IqV#+Wb#?|7@|74F0WwJSxfk1bxYAqy3a-? z1?(i^_J0r78wYgIOqr8*PF1FBMa1m^8$eCsXudZg68!2kqi-_NioS1;vr&bR^}}Dn zj!`)L5^g4DH4^tLPwIL1m>o2E$F7LuuW#zgtQD6BP1?N<-j(LX?+O`K?~8mg zdRPO-G&v5+M{(X7Y-uJ;iWzH<;_@mQn@-M$xKeCCyLeEa+LTTHwN_91#cYVnJNwC0DRCD4lrm(o-7n{!ewR+dD6*;xEIb61hQG{?SA{8n6ZP4Q zMA(G)53O_HicC-XBxc>)4a^STuR>p3>Ajc z1yM~|VN7U9x%k(~P1)^QxdoZ-F^2L~zfv-7yF88S4&8j?apVS2cY)aP^%k@;HyUnm zX6k_9kL{)vNl&vxNzWrdt0?o@+eAL|3D=jnm<|=WZf=`ZGGKbQln>e6LW&7f$PVk@ z)mHJ`f`shWZrMee&Hp*D{NhO%PN1?>odzmD(w?WCYcqH=V{^`ib8@EeGx*HmXsU55QXieQCzN2$>j_4R%2m@>v*> z8vMV96^q^;e)CsqHJrhEEFbk;!V4T%d>rMyVyC#hnhcNkK_lw&Y@1eM_8!Gn>00%i zdC6$%t(gE%yvIt?$$qymkAs=zwAR#ar_ZB_3%od@Vy1{C!j+s0mWwe)jDARIFQ}>p zT^5CRMB)NgZ$AStYKY8_!Y@zO{BWx z+m%`pdoVS_pOvX24V-+1tAoqCoMK!d*pS8yDIP!LKJZGrl3=;<-o-oq>8nx&`-_&V z5j)rC2US;T_NTKI%JehXYukwqA!U7LWbxk$>mg)}32#B#0B2azExT0ZuC9Xo6tp6F zU9mhUfj~;h5h%V&16^!7*-Vm9y%LWkl)+ABxAOz>l=xck;GlG>BQI3#REli;urX4!R4%SZppN@uA5Y4wfiLc>+XrlU}HuqLMVo3mC&YjTv zlEW{UfIAmV=L_UEQ{kr1$WqE0vIg_)Y?@u1ualKljf)ZZ-Cca#1{`x0 z+0Er&mL1+&U$vp1p`UeC%KJ#H(D6?Uo=Sb}XwvY|2;9l$lIqWLpB=n48t=;3wWs9q z=B9q^bNP5b$Oi~j7qdhqBr-PbyPc>s&YmX5E?jlGyMaR+AA5eAWKWO{27m&^@XkOs zy#E_piadDBQR>?i>QIdExr`bScZhqHY7K>y;enV)1^$+>fkD5M0Ti#$zvoMh%{p6- z+!$WbM2~PE=S#-6!dK-d?83_-_g7Wnhl-qnH{Kq*7JbK8vRY^Ub#qKRi6ySwM{vSH z)CCXu@2?FN(KvY1FAY;PTsmJiJEpScn9PHyR2F>5+b`*IA9PB1him6;{i)cLlk#-F zo^yAOdUE2I+=eGP|JK-MzxI9@5i)qwO?tI`nQkXS9&>QEl1G1%E?969aR!cAPh-)<~+YO8CD)Icr@Fv)oe8QnqQqZpS2SlyOy^hv>UFL zIl+5SxH>ZAQMIo*pLwx>y`Kvic&{b3r)}4Mf2$jTy)3sfC6BtwybUAWE$<6nGmH=o z2-IVB=ExO50Ivt!w!XrmPp9ObBW!h{ZN$pGu#c?Py}m6!Xo#JNhGtzw>^pg;}TA6 zlxnm@jXR6J4yGanp&B~bvD05L)5S&k$B{Tc-Or0%vnVVp{Jx$0Ea1G^-i;+~IIiS; zhSU%Ls`PTpRev&xunx*n*}Ph|aWvxCr4***w6I)6G9PW)eS*hwm(eshnLgpE${W4n zZs^1@tgE<)-L@w8jQv3-xz(k;zV96v?AbPtn`Flena)K5hYZ6mZNTvW6WIYyJc!o24qHk{`PAwxF3n0Q`<-vsdEgG{%!cZEM!~ci zjRo~*i#5;Jb5fZ&y25hCmp48C8E?AM@YRDx>{|AYLSw4qL-^uw;3`H0c)T_ur|$GrMhp;?kM^h8CKrxg zDqST0lv*Cp(um&P<5oq$P^Am$@WgBnpISYOmef?W8tPy6DIbil>veJRTJAh|Yn8z( zeE1sRJ+bIXSe=6VP&V=HFnh`>E7rQWi`^_sXxrsOLkOEF*QG1~7 z_kG`l=BY)m!f5(U9fI39~oaf)OFZE6~$xnT5o|RZh)f306ma zI+b1T<39DXV#_d24!=p&J4IckU5j~cy^%S$y@h8&9%{__>sbxyhQ(!tU>&APRW?{- zd(Hu~71l-$cZhY~QkxmsR~7R48RX@W7w<^gPFS_H?`PjPB#EDjH(;%k zIcs$aNvbqZ4k}++j>%bOW($PozsBES1U_BOiH?f`vth;J^@uV!#Q>jAR3rvt4>Yft z;%&NXG?bI>k|W;W4k`Q&&_e5=KE z$+XDsX-&oI0lKF6tq?p3CEw`)zVjaas5$BuqNN^4Qn5~Z1}E5>mT;^SLnMB#e7R6* zik|M!gORzZW5xQxqe+#-rY`VRo$|r#HE$za$yRN_)7)myb1&yWT^hQZJ1khxJbk9z zC`9XWJ+*oouC5nMR#&Cf;72IW3`>SzO2{5lguFT6ehLI`qz}UID!;css?nND5!JQA2T45 zVe*_zc{-jLx2vMq$ZL(?3coDVnhOg*1+y<8npaOEgn6V{C+R+V6ypk!<0xay-Vsqf zU3GEVG@Zsep9x<(tt@>TP=UqROqo$#ce++p-pnT3o2hc~g7J*&7%PhjNtS+l)=_pk zFh8XGRiU*>U=lY}1ri_NNjZEHCT(+61+$i}P6f}>TC_7}y$U(9N7v69EI#S!&+fQP ziZ-JwY*ODqG3VcD*Q+%74F(v3(~bZ%=|D|G?+b&3>HCZ&Q-IH^xUb*pryAzZtDoNr zH=`l;=^_>%5LMxVOUyJhET3R~b>8iV<%$u|dA^|mZeN$lu&%vytkK`U2v*v<|`n0eb9t8o`jIC$xSJ+RH`AM$&4C2|E z1RlzU{l`p#RWdVS+onl3(db*Xkk7u!y4 zbb%FL%Kn<1Nrh`_AWMdtB+JdAm3sN@ivEBav7S49sWe&4Z<&VBFs6_r2}4aHawb*t z7Ub-1RkRIU_^kE=#&v%RU*p-&Z>g(MQD@7}$?;+L9Mep{h4$lX7hVpPeqLBi#f@?& zCm#0L9XzPRUQTeu^oO1}3^%37SRLb|l>h(Ighu81dxPidSSP1V zwM<3xm+m<)za^W8J22_uscrWztH~~laTSPr51O?2DkGz6rp``Do~d#^@MopttBvHk zEKYpIU#8ci-ro@#70oZ^iBlxntqwk2R^P_G7H$D=OlN}qv8u)BrUO$?Hp7pA|3}nS zhDEh@QI$|yq#Hy+a%gFllJ4&A?iP^l?(UZEE{Oq&p}Uy@q=t?UxZm~u;1_eAIq!b= zUVE*z-*d(taWrqZV&KbeFhHKX`IAlt(Hvb!Izno%{|;x>pC+TXW#zLbb2jQP{~t5M zi+Q!I750hhwe44Ql7mj7!<0iDEF+LoWly_K=gA*yvMGv@=M2*wk)}OX;LY73j@R_2 zj>@&|{G!+nTpj+ruwHP^uu+MxZ$Q6!Uq0UqSeZ;K%(wR@*}&yJBTsZb&7et9^&2kP zt{jDk!`2aLfi*YX-tdpUkJ+X4GTZt8h*-J{*A8h2uSE=M*Ebcb7gvK5>Y$BmOrTFH zTT2Xh?ORniN7{CLvvf9noy{KBI^}RJ+$5aNFl*D_>tkX44mQOP_x-NHjO|-A|KGMx zu)-QdPS_iD!xxL3`o_L+)hmjLf7R>@)rkrwmao6mu3It=+($&cZ(jPQ5&z&Hc5mB} z^<91R7vz^VPoWqjr5w6wUcqpz)m>b57HU$9*FG!Qa*|cC+%q2~>QDh#%?+duQ-OhV zbS0GOLb!_|WJr?dgd)c>`1nu#K_K_CgZ8cG?nsryhj zbALW1v4i)rr})FuUbd2#yup4j#RwR-THrL zaQ!~qjS@gtEs$yY213tBF%@=gE@^&QAstHU((!`5^0w^pi<){S-vUpCPAe!l?N@=^(1qI<}oxX=?B|+hS!)k zh}Thx4LLIkTJfHwLxp*F<}4Bwxe49sTs%(6XZK($FUYT=D~0ZL>~PPGANQU7VNBHZ zo*tew39lZ(=o6jqFAURuJ^q~$dyg);nc(C%&C7B$;id($s{L<=py2$vsHI_H6Wpfs&Rxru5IfU|2nE*&Ed`2(1mr1U z<&@hi^~_<=y=ubD4VIkeW_?Lxe4V+Yksv61J|+Ki&vjFkurK&Z>B7@8V8bo32;bqZ zVDwYCHq>D; z{;PzxXiuID@oeV@XT&Mo82B&Wll78Pu4$^0Q3Hx~pE-(zNaqygixbi1FLOIP*Nq!@ zETtuBp7k9=(oB4o7?%#aMw~dR{oOogNjO{R8yMEzIlpRP$X@%{8t^36l+W%K;${Z? zLsL#Cy)J8c@iXh0_)wl$%3h(Mt0$(AwERJ8*PVltE2n&`OF_XcbV^HIs?gqOWlhA} zoMLNGZ$h{Drc;`D^7qG3C3i8YiSfE5=bg*YR3n{6HlVpQy>iN|cnt;IC9ZH&acQ8Z z1>hHoJBxXKHsAS z`-s^7d1@?%LyE?WR+-5q_N@t^?eD_I5AoMh-Z3>}S;B7l_dmG?joqgr=Uy?fOKQqk z`1nB44Mdn&)wFsopsRx_QxLSHawY;kLAd#1z03PZZ9hw*?vl=HRj0S7SDYlU)v093@aQS zw6ML($JX{GNL7dWne5k)?hm|L$W>jnLRlj1r2~K%P`mlw+F%49c;3^z7M!}MX!kGC z@HI=2t1NJ^SKv4xoRlc-%j+R(lRQuSFuB2E(|(wSLZ@UVk2ND(&fKj$SG`DLuc5qU zroBVLbM%>@?y`J`fbk?Y2vQ$d$cT4GXa*8&au}1Nt8WkE`@Aavj zdPQpNETm*JN?+A_p1dcH8bw$JCvb&XPRj{NdIJvJN z`LyRMSrMbOuT`d}&Np+@p|r*KXMZ9=0GVPpJ0xwbxMo?aZ4zz4(adNx_Rqqel)M^h z^t9WVPCZ5#i+tvvA>S|-T;qVdr`QTyCAcOpi0~Y6IL%Jmom>`D1~bG+?mJ6|8LPUt z&ev-sAG{`?*4#UZb+J>>bI%_8L4f41BCX(uH@pFG@*@S>{hXQV3S#>=^v36tXjM+a z7v#7w^_(c@!tekpGqxBisiF;Wfc?6m z+U1dUR@vJU9Mh0(lh4q`X1<0TuN95^erI*XM&6@~F888DU9e&LjcE-}{9?z$I1hyn z&Q0`f*-V)UKpW-e34E0{J5_`IUK$6!O1ndlw#=vwF13U2_Zrocj^L`Mc3P*aqtZnc zCc?G(OIPUjZ(fd$nsm-}eP?;1D>FSAG#+fr#jL*yTpmRCy-Ic6>q4T{wFMEo9}cP) z8PLXWQax7CI$Gs*r2^;+!iyQSkrujInV#V);2^V$Ks$o;J*V&61qsxHBr&>kQOiC{ zcnl5xSH`X_gi}k>y2K(nG;?G{1~bP^M?~894jR&u`mg#u*8l@fu9V%Z@#7Zkm=Y9! z>(+?+uE@ZcHGW@*22V`BdI=Kn6|3EhT5#=wS)i+z9<*g1z?{_Nf0s;@7s`DVS$<~R zB6JjQC0k_Ow~v|B;P_^l9lQ9?7LTzmW)Yk$x4!MJol>JIS8}5ew%;i(;mE?*zX*YO z=b~=RY7Nm@#(w@LsV`XVV9dLB*y`f3`e{OU!T!6>d-mt-9xdt+O&MU1K@F46k9hDJ zn?5dbRreEL-2Jwp{ZtX<>U4F+SXK{Q6{ z9ZYWNe?=g|?*PIJui(Pf^nb1a@3;Pcj638YSb``tbw8PZoCC182+Yp1gmH^odryqb zK}g0Ng~F$kevZb#UUn?zH-|Bi{B2ije$bMMKfkv)7UYO{=mu!`KU6O}Ppf&*I1dM; z;L!XztaiI!9=iCdI&G({n)A}ESvpbCFx{ZTG7`!>@L&&-)}vLYSFB7aY_gNcBR(@a zID`RK6)EC6=7W-5GZW0OBDwx-Cl(r>=Vefx>Q9U&xQzQ7i2vZ%YmaZfoVm3HtRdd8 zaDOZCnQR!j4h1r@r(_PEPlcOPB&qG|ZO!j{CY3tAshGAs__e*L@3hM~f}|JOCxp(# z(9JW#>-ba4*Eyzxj&+BeZ+~JT2(lHJ6iYkMm%R3?{mK92eSmQDEGgs_Fi6X}D2K-U ze2+gxotAuBWiBDloReJ>;ySf4;1eF|BBlR}AF@kmd5*$Et3_bTJfhp%%lVF8ZnA zS`IRBl0KAy&NJo@Ra|Lk*(8*k_LeEE!N*Yh8`@<)i2Gi6t2!b?lSSRKxGHb%&4Lg8 zNQ1nKCdpu=BSrU8*BSK_8o&#?s8^A7s}H_idlYm)I*F#EN#Cv3pky3)_D~jn9ie@} zDxy9N&TtOl#?U6Izq;goE6L1W#5R{^?+LHYqcCyj?Jn+C7D%No)2rsL1nsg zBF$2r%xmr^1!?efl74ada1D2?ks)vM(w&%)5dO^z)nDiOWJ}|8d7-M`s2_!SW#B%C z4p}i5n0)=A8jC8DO#9*XIO&bRQaBd=90N03RU6jBB4Yy-f2!r2xMI5(T!|9BwCt_j z)*{``uX@B)Hn|56DpTX-!+>B^#1vHrd_>y_+7NWR$g8gb6|<)7)j&@t<#r}22jHt? z;U~zp8 z2q_W=<%M(4FDhufmVHClFREuWZYB`s(+u-yhCSIEsM437B98r(0;v2oMJ{h@+rD9& zdDHa)2{uoA&gw2o+L`raPj3_B83GU4;ji)#33e_fW=5(4I3-Kc&8ygxCjSYo zioI=_F8&0C$v0xDb-Fh^+w<8v8T35ZNHh9hk_IriS7l|sckvgH{hNGTp>Gq9G)%9DQe=Rx@N)P*j!fN?MLR4daNWB=Cx}t#-D?)7!-vNO zAB{oG+W~(Vh~IK*Nl2PSR^_l(oZAYYXTxHrvR{#$QU}{UGv{VL+Xo(n@Dlm)_9DzG zx~;iC2f6&mBZ;)orUthu{p(sC4IgwlFjD)rqaV85vtI$_g3W5@|3+C!?lKyzIqQUv zJrZu`xLH(*&DH(gwdvP>QehMAhi=kvxX}as38TQ`O2Br^0T)j>jW$cuyL33EP$V<_XaA<}dFCJwH zr;HHOt&}sE)hZGeXToTw4U|<-^lZ9gFR`|*fx{+Sr+&);a2z0e2<^h zJ1go46AJpFPfE8hwLu~$xt*-|hdOfa&Yujc10z@o)g6{;QCQru;d$1O@>@Lx)D3RV z4+<>;{jQ^RGHG%YqH=?cM}3KjzuA0X|AC?=ON-F?f`!ZdVwmmEEXR_LkR%rPDQYi5A>H z0yWP>0PAcvbE&i0gue zA&gWk8S^eQlJRV&acF3d@6Rk9r!h9wE%#Rw*jm8(=@lX?1CGtw&pOmW#dLZ~8%tRG zta5`8eP0;h59On&k4Zbtb|z6bOdEWW$*Bt%Gw2w~dE53X8Y4dc;@VWWekI9kaQOD; z7B+`<+(%^7d>>J~uFb@nRpO?cCP6s$DqwB)BsCP{(9827QA}J?m$ybGBZES*1hyYs z4$ayS4e%~Gde<)NhZMb1f_79^zR>UBtP*D96BPlB+dEeoYG)^8It zkK)p*vH%Wj3LZyE5%m?W#w4oegFddAvW?mHVNxB^f4xHE)yDvn9hxm)^5>JoYx2UM z&oi24ayj33p}Aw?ZL>=w@26~m7Bz}3!=UL?F7Z1tAphCL37a|gK_9>sv9BAxI~msL z*CHum(g0FqpRPsC`w-2{9gPU(5l9}fk?wz37w1J+#*yL=1t1|k*-l#@1&^;a{4*O` zsS{N1Rvq09Ext}Uso<4Up#)lNa^H)NQJlFVnNeL7+AZ*W+|Q$~oJ@eQg>|S^CYFN6 zw!+!4%mxJr#%NUs$P9NGAzOzx1Q6h$++Jy9;3@W$F8Xy*Q1Sj`$s)C8`;D>Vr)%1H zUWvPd{$~C`|1zzs_M3@7Msp~G>VbEV#YHT#$mv&v+gBum=1yC#H5|A+&tys_l3eUz z&vlA7ticU-8H}(HZn0oYBLaVFF{)}2NNn#rYajYv?j!R^fd8@5Ux-02C0PcC_p3i% z^$aoTCZh4)z?zkdR9a%8IB(2S$<$vtd`0>0%)`1h*U>elsTKp0I$?gcD%B!3k5V+i zzwL?0T|Oj;ibtaU4l_S zdzs7&qu=}&v0a7vC1wc1_uOzNp9DnWS(sN|g_gf*WR&myc<8KUfk429W#sG6AdwBv zsExCD3+Z+)&jUh_?E)<~-s)DWT-3H+wFB0mj_p)%v4Z=rAfy8rdd+GUgP(>*Wfp9JcZg1Lm4LWxaHK#e*d5>Qxm%!8`(i{mU@QCeOZ zchUEl>ra|&4QBRQAV!~~-bOkQ6ORiX^6+!*nb=%^`oxq9Mz<*0*|ggIg$L*C`iqC3 zQAG{&WzE5FEZsGiDnJbZv61}WJVqMzvMAw5k%R(L5ufsyQ;>9sLjV>xQ}Ecd>0aEP zCN-WB`uJ*a1`oH130+W~suD=htUhK&)dF%$xQrm?x%`1D>g)z?n!59x`bF|`YP{- z(=AD$)Zf$@jo2MuSrum7)guI&TaRdu3MV@k;fj>3_IGoryDax{!Q+%&q>RGI206IouS`C=d>S%AS*Q|2mCa82DdIPCb=0qOH zI|s?-54p|$MmMvq&JeC!RvP5m!c|vYRq~jxyi{u5lH%3Agk2}lFPjo+!CvtbReEN! z;nq24%91)>IC?!(zL$Lhgi79)S2L2j0I`L5WLmbSa(UdE#gCs(JvbwSVKP`4Pbg){ zzQ%XYS^#kK|EI$F7i{I{^*kFt3(aitxt9Rg#f9DB|J7$t%DRI zT0+tQ&|G{O0}pa3d5qTU=#HJ0nPTC2HYMo9@%McU4=wyzr7|(LpR#_Xz~OK%Np+uQ zwtG1X|DkyoiB&UpQWp@(pmYSK@VyQ!_7fj~Sqh}#-R(_q3LLd>!k`L9ZXa@+m$vws zQQomO_`Q(8QJg^gwd7n2v3d0#=EV)*Q#rpu`Z)>y;FT%DD5S> zOsEuS9vQu4)wbncr&UJ4@48)@fkbjDE~hzJBbpwP?^;Y$@^Yp71;8=80y*ur>&-tN zzuL?j*rZQVQlG3hR}67eXfty%#X&n4W^nn*qXq+vD)8&M7KOK-N15I!Gh3^jA zn@^v|7tJ`h}9{4@-PJ0`AGE&*dW#d(^cbiu*X)`**;KbFRG(qD)J+8&nPo1)id5o zm?HJqu^Nx@LWS_kch7@G@)bgjkZv>H-_j2Si*VfJ?irCx0%e{mA6sY(pd`?c*((Kn z?KP>eT0aIGU!*uUDbN;^U+4@}IEtEYF#T<&#*w;+zYMbJ38L8s~O?4dU23^k20rgg-`j>iUN5eUtjEWPk2%k{Z<1=^Ehw zU9~wRP~s*x+LVNR@_E(MkB>MKuvb)EU|@Na724W$UrKYTEA-^Jwa=)6yXOhS4^6Yl`ZMtoPS;#y+|GY~jrsbfEv1 z;K>Pz9EiuTAMx&?>r&86DcM$akI?1d1u9j_)CnM>un^}!-*bk~o5&WeoOL+Fti~GP zrbtqQUWz@wq|`mre26-g)74znME_G+d#dCM`H884KFDW3y#G%Zzh{J5SyBq(c5J;}x-*VX{&6=O#^;6IFXQ5UnM655 z*0`I+iIt4SgPN2$_;AD%lH_eiQ$6Phz(M(oa*(r)oV#(2+Q=r8CrhjNfJEWy#$a6E zntCqOlQ&K!NX$uypzCYpTv}NTp`4wga^3>D*fh7}XF^VFS173nfx8ff1R8-@>c?b4 zr%aDHgC_aAK{32-#ubiIQAunW0S-G^x*4b`4K&&Ag0oUStlctpoUjUBM<;2ypkk#? zc0}hp!SiVa`hE2eq*mD8wW*%yrC8i$Fu}JUUPjH;0VoeKk{XSrT`~p{R5IKq>If@! zcz*G)9}6Xf{vPufaJaeutz_Xq9~La|&-t(>C4PxTlJH<>^WA3b{@!AzN@9K?>}eQ^ zyH2gL>#|Fk&das4hNW1p%woxyY~PMp%ncVY`GspAC=r z{}-vW5=|RkJ=#LVrSSfj6teCu8uSH9~0&?l-D(Y2|;gN z{CYYBf9An)l0Znbj(X%%~CV9&CGj0CS73p9e+=-|rPAQtp?K2&0 zlObp{!~yTMeK9A6*?F7=!GcpyzXGcx0eRJD*5r_Y4OLvz5=(Dsnr82;4V6lJ&q>Jg zVj(c|ZCMS5xV2mW->G=rEF=*@T(3)Yv&EG#k!Q0h-7x|HLH>VWCOR`U2Dn5xYDUqG z(z98qZYZ=bF!vW3A|ejx<;z=d`5v^~;bXtls#yzK8wz-!_g&?ol?=`G-1!W5 zm}{v>eVopm4y<7yqFQ;V$!sVA8f9@PF!d1r6u0TUVrnyiciT`2B(u7CVGt^H)P%@@-x+DTR0DYtVr}pwXlfBTJ zuVUD{ng8w-Lat23)pU2bFZEV`Yzhak4NK)WX2XL-F6rn?jA{cgAViO18aoYAHtm|| zrB#tpU=Y8hF>X&(YNgR6>;82Z1u*z;xxv&i1a6ZLd znW|%gRIwu*xVKeHuDs2sglulum99-8|7%L~(03y@cdabmpuCOL11Wf^iVaS!&5>CP z20w11*Ml#LZE+IszXSEzlbTgOngM7C(2Fb-PiUM=qprTb;Vedg>5qMH znEwl7CR9l4d)w-p-0HtKrZMDLWZ}RJ&`Z7=MQQ+vvvMjd!%3UeO%6l zaxPO;cXZ)xF1*rN@<~eP1UCS!q}Ep|qJ8^9-M@FPkd6okYHS~*YR@cE2Yae`UBs`< zn9?H!Ri&=OJPo!UbwkV_IXn8baIjs#!X`86KL~5I9?b~xA*c`x>{q(HX|^_ zA3o${vL!_Ct@?wbi?@vxOFU)#Wh;)3Q6Nw#0-|6@hKS}WB|#`)8k~=nz+B3Dls1Dt zFb?ds{SmBB4IK0e_A~*XSgUGMrd%`DHHUHPf!Rq#2qm|J)=aR4Q^1n##uZxuE^;2n z_oT!#B1GZPZq~ZrM$;Kv&Lbl@P|Gg-{&4bF91O9wG?RG-8H}5^jA(@Y^3s46+S94X z?zi#2K>(}&QhQ4ykU)fEqaVFL{3*4G;4X?n-HnG<_AmJFIM;21>J>%`kP3=b7Y)g_ z4|@VHDp|JZA{?`mtz45cFGW4JwT&}d-5i^HC`xzcy6)r3(EKV>UuEl+eg(*6NYbl_H;5`k zH>g9TdZN^=T&lHP=fJ5ZYx%38LkR%fe>a`1A@Wj$L%#D4`+5{szEhz?;r6RW#cKSO zH6Ghl?(PcL3%pH`tCNCcDQk)FY{@!0Bv%bC0WH)T%VK6Eaehl5Ytw}4LN0Ms{xaR+ zLkZcIOfx-^WW8Yg_D<O&DS*3L1yJUH~^hqXnT{&p~*wahK z+rmm5bQR+~znJdzwPy<&K(CRxxnbGkkFUn_h6oRAT&D`DbFDjdjuM#Gsh3fK&b0l$ zvR0IRjP}Vw4o3cwva85FX}`va!7N^cv2I>5!lg*)5rcYdQwuR631TGydCbBCfbPIh*lpBHs32 zV~ao5=n#{9@lS7z!cvV>EYm7RsB@fok#wTifJ}*H{lT59r$-T5bBGn&X6_mD)#0%C z#_^OkRwvzgI`be`zxl&m&T{jN<$*$S2bXxtrCiW8?rd}HSZwt3$b$=CP`tyw-9-sA`3y!-ofV9vdo5yQ zzj4pOSClTINeZ^zk7F8D8Gqto{fugWa|!9uW2eq}=%{L**l`^tn5u#8R>BYT%q!kU)(^WuyXY z)#`ODmqPZK1Cd~Ciomx&g%L`-69yW}eEazfEgHtYtXK>s{ftz{fqbE~7+hM2ut_=4 zi_VRQA05HmCkSDma$T6iQ3jp}fU%$^FO&EN)n2g5X}R~LZ*r4tC^=XhTVyk^S%pO& zl%l#S$RO^iXz)YXM+`GZ2eFhqgz444Y-FMnT{H0e00;RhQ_lAlJyWT3@dGQlnTPWM zg7+agYL{0A1?7?mn{M5pDO;r)={XSyZ-Ds0;}3q`rgB<7NIxuvr+HW4tR7Un>RFol zwszvqgLe>+`$PqD8{Zuy$V13i%pbBYt2WFT&oyW2${FtFBc_cGV6)1rJzZt-0Uagp zux;v+uo7R&@3l*ydbQN)evdBf|@UntMgeW{Xd`iRL*5WTSeU{G3KVAYW$FQKbu>c86c{e2E0Q>d#xOr zv?(_~xid%hstdZ+s8E8yb8+6~P9-v_G?5N5-rIrIC?RUAxu+`oHB6VOjpQ9+RWD4K z%b#~fp~Fca1&l8Z*t_IEwY=!S8{6VAa(2gsi9|rwXl`r`5|704%Az4~^`(ecA0idG z6ngKXh)MdZ3-{B%83xnfOaxE766Q1TcxLX2DB8LAZb5m(MYw)%Xb$_%B$N^Q4W^q- z7dk5BuK(QFZ`y}k=7hV3wM>}rK}zU}iuv*j^>%WpwLuRacEB&vduKawJ6u5zJe8my zlJ%2u9u}$NoIe#&2KYhEO%BpyYBRaUev%D1{Ot0oVh!AmSskLprSop4JSoc!zY8@p zh>S0G9E)vh#OsCG9-@5GoMPK7M1a+x-Uj2^u}zN8U97pC;GNpSwiivT zYwBwyug?dnKgB49C+Ym%d_485VsJN3nS92${i*F6LU3_PLL9+cbc0Jt6n0uF{!)j+ z6gF|VnSm4U#A)dal}uNuD|>b}Qjf15uaZfLy_1WGX>4_hOQ*J7G?puOeBaCE(>vat zEAr_p-7_YK4Y`e(?~OndPI z(VF&jBj3o`-<(>Y?c=7l~WJ;fi|2J zoH@&U@`t8oy7mr>1{FqgBN`Kh{cqOgQu!?w^%h&+V0zy!L$3Mw3h_jt@oYMvoD z?>;|PGPhWvEKV$ELoxhvrahh|(93IO%7$6h?%}eIS0>9tQv9By)Q;%wt4ny~U-AOo zv}Uo#E}v4K2uJ|I(Ir(zHYS)r2g18y=qj^=TYu4vI?+G^2w|cm!ASCmh2zkru_QoJ zSg#kPu##8YP#FIdUk5zI0#Ks;y&+nSz`+3y{S&7C&8PCs_pLAoxb9*Eg)X?7YTkdl zda*?UUddDQPN_5k!?1}NQkpgwiPTrS!-O@+`*khrFfXHuJjKV_24>l+lEI+ck8j3G zL|lKQcmTF=*+5q!x#Y#5Z_XxNus~pOh)D^lT54KiNF)K z&GGPBv^2^8xG7v}wveJIE$$5Xa{-geZ-b&VJtvCnnYV*FkCpaz{0&Jz5hu;#JPqCc zIU@6S7lI=l#+cuAPm_FseqR&$3`)+)kkT3rivRdaV3D$rHZPIu%o6@ZE|Er5_DJgh z;0^s5@2db{vDe4Q&t2Ql38Z-H%+{MgN2J9#?!DLZxjkl{Uv@59Z8-C1gWS_mu3bhO za+a$%P!jTRN}U%9Gbe^|)`!)$tl3EZ?8gjxx6S=A<{z>p)CMl6Nv+Eg>9;$Kfhtz_ zC#~$g;&cbyYLXQ_+GHVfW=Uq6o3_d%sdMu;uRZ75@V9G=ML6pZnUW{}5o+2kK9dz~ zilMAS&WQ5G^$`jDn$xKZSWVU^c1eqe;?mZn@2qg&WU}-TRdtH<)J@SP?Fd$Ulrgw? z{CB|LvfQd5Z`ep3JitA!wXS+1ciJz>81Ab$t=QI=D@g0jCpj!X4%k(GC946ob7$Il z()H7=4x!ZsD%KCx?6FEhIoqN2_ZH*CQl=46t+D905PrqI_mg3_SDE1W`5nmhrFg@2 z>0Dwg!`WH)VKBg2atWG5l`^8>(uL0aiP{&wWWaSHr1u~t(%lF}` zgj6Msx}*XhIYN?41oDR7VwoC93*hND;{Urt?XjX2exJR%^UJR-kQ&_V(k+vd_vi0`HM@PR;AdG>saz+`;~hu;B*|`M@z$k@U{3;TdfF zYdY@YF`QvEB9f`%NFy{c5U$+oZH1*MBgn{vP}@dc0GBq&MS)fMGS5V+SYaSE+W-;X zB$o91DuS24^CkwNt?Hlw4Z#!T3T6mxo^PbXl4xi&Y@&^*tm$a?ez*bmtSsN(F9bSw zc)ECMbe!M)67OMk$WcZs90&&qC39Cb7PT9wKG?cqhIHySeIvsD(KI$ebFR7-%3K*! zeZ=cd7^k!UcjZ2zkI&OfS@l<72=2D`J$4o6MIm&Y2bWn(>C<$vpb2SJK)-=pxYJj1 z(5*zBHaC5|TjwVJZ(}Wp02zwq98gS0pUx4xfKtLNr$DMU4}Y`G^YK06fI7*g*(BQJ z5zBuzC*C76Zn15*F!g6=Ue3?geA@*UTK=6aKr3|l;bA&z!#BNm)OxP6c8sV*ba!cqnl-+i!&*>G+o9?|gO1z~_Tqmy4cIq2YEq+B|1O0;eH9E$Kp>U@D%yn@M z_xnY+13UDxzjeld>pAqr%Mf_3n*vz6mFl24oiuJT8>^Zx{ZlENNFg5#Mb$P(9M_r8 z+GOaH7nTV7o3d+rClJMx74aLJAU21aMrqt#pE%;S4LUZgA|w=m!yQNAU!&1#?aA@w zzhH2%R7~3|q}Nfz>vk}dnxq9f8F2LlT~@Dv9Q3UH_dxr=`V6y!`P{n`ax+7B&yqot zrK|vllWir;;-Y+ZP0Mt7p)tDCQ#X4($mlP`_R2^STIUv3?^>#yc@!geV6+44QV%IR zlyIPR(ctYri_toC_nmzJFb1mb|In!t&^qb7Q1rr>G5)gNOb7Kyq+rQ-eTUM_(qhCv7^g!H<|b?cgis?Y!KP)>dgxdRM*dwf`Gq<3470wTFT} zjiKp-_acd7>5h|s`JQ7zbNN_yQG80cod7K=oM>v`ECyMGSv#qI1%my zzr1g0rGT(>O+v%ey^q6&z@bRx^-jIA@ctK4{K^vMG;ffypKbd>!c97|Lhb9#)QyV% zuk+CjRpoO^CJ}@~+asu7oJaiDQvR$@+ys8H=UN1%1yx|(>fouyzNqt5u@lVfEdWwX zGDa?Yv$e%l7C0X3w6oR0E%a_*PlH!Iw0ll1!>pY5lYSI>vFS&6G9#fq_x*wUNS!rF zCi3YIl=^jSMHq^bT07efXO^~r{tb**kr$!ABO4i$QfU>GJ}`;*__A)ZxFS&9M3f}YrgiD+*d)W@vE)649SeZ{ zoSUajJ71AzghXLSO8JjlOKan?ojI_-7!FN(>}_MlE}wT{Yut4u2?w`V$=Hk5BHMXC z>M>?t=J*K+RE(wKK4*i}+;31QTjZA18$Qf?9U>XKYje5R|3xc}O5U8vf^hEf*WN86wtiR(vMEt+W4}9esf*S+Om21~I{K z<-Je2N;G1VyejirOLMbeiBIvW40(TlmNQBld&kOMlA=)A>MO z%t@z{!91xADR3D6MXbY@s!KL!h-w9vcq|H~C{bC|E)mlD4nO+%r?9-bPuF z+e(R(D7KVC86X0UWWV}oLxKBHC>&}0J$B9enL=^J5Uf6MC46LWu^)6%{gYk;Cf)HK z3U1}Ywlnfl`4dqY>G7aO$l*;wEPP!OTj$`Mvri0{iMA^)9cZ0HSb&Q7vlHi|_{OJk zD!BI?At26|Eh1ezFj@b{VX%ALS@Y@3J>U+^HT@Y6;u93diDXxhKq;pBN&rdMmV8>+ zS&Z`Zb&;G$3VVh2@E<^ecO{&Ad}x>pa0`mw<3a3p^_fdP z2|vV0eLzrMrNk1)U^L>24;|W!`Q-G5z7LlFZ`o4W5p`uQOB@vjfxMnQ_&vcQj2F35 znSZwywm{Lj+dE$<2rC$?GwwR&GL|X$=2O4|6s#6l>3~c;2!%`F> zlPviO#WErx?CW{w3}|1eLeL@jnk}r^XfMJ*rGYEmL|3Fb7O_&oH~(0CNmie49;Ex& zx3?{=fBSe9_oVmb>>I6{9x{f{D7Z$5nU z+3ghlJ0{7??~mN!;$U=ssil;GmBO&!6JtE;T+*>*O$)9qaOqfKM$Sr%jg|Hzmz^mh zGM_R-vDUFGbJs*XG)|fYbmwMYhGhHOsLLY?1sqh8NX3E!r#vhL)Hrk*#Ts-}8@4H% zB?2N#f4tq=iz{X!SMg0L^j`i5tg!!3 zU|yGTxpDug^a45F-tK!%*A%~_^6Z?1(fvQ$W6@4~x{@P>mL`gpn;yD)GMcA+rMA6N z+nKKSo1fzIL+7ze3M@LU07sd)jjduvA+_f~w7uw_-agXeNBFz{s7Vs!^TV0ZZ~ne4 z{-=7#C9s?7n}M|u#NcOtaRc7jUxGMW*D$yrRinsD+}84;(mb#ke~9n-#Zj_siuU-M zuS0P^rj0YeLq(Err#^_r`~p%rqp~?eE@5?Q#|H zwIvrzGs&Yp%_K57-r?Z8r5d~{3Q$^~RP&g|cD>kc;J}F;aYWNZ21ja-zvqDeS$t>< zV8-kC$D|?)n0?E1nD(yGUeUjTWQ&3}R17aC5rUZ|G0N_ttzd}tgA~8Bk>zjA3bdj+ zOIi1)%ZG74aima`;}o9N`B&acmNSJ*vkrbHLrLq`AI{tY#PIAm1#eY2DkJ+rf!Au= z(oSf|7%(GKI{nMhvFJw64oQm94@r!T?vFl5IIT4Pi9?AwJ+#=HLW41lHc9fXrfR}o zTS2{6DY!U)nXyjF%v$#zu+b*O_VH==M<*Y%ZE8z-o^o7FKlS>vym^r2RM|?JYFpBE zD6&N)+)8NuIsQ*c3q2w5(Icm4=}!nwo{rN|!>9~9&BH7^1BtV&qKbP^ z8GF6w5mCz@Kyueyz+@@^J7b|cFUM@ zhhRJ*w>^)!1ZVmFvJS!6cpz47PZ=S~M^Voy4u5Etz@C{K@tN|pNc_~)bE;ufT}}$# zp{g27P7L*h^B+(prg*twMfQ&2od|rbQ%mnY<=>FEv_>pRSQ~N33!b$-sg=ZPaT@ir zlSEp(dHHgOAzB=rRc*)h@>;v&@70bU{eJE9!}Y_;6s_e_zr3<6%$JD^}Z zy4EYUJs%i5*8N56b(w~1Jc6zTEtl^1W1ahQ(7ceHH*tS{0gF@NeIR}uLrfx9TV57_ zsh^PdBm9=&x!sE)yQ@GKk{bh8LGus;Pf?1v!svn<)Lm!f&Wxgt{7(E|zw?WhKL$8* z$t3D6RqxYMnZLQsI+1^ImsrgqtPT4m+RR;ePA zBy#M*rhE(WD7TS(;0I;=b$2i&LUOy3o1Q|4&fbht^&COh;MErm7eiS9Is)APn7Zn? zsJ^EyBA|4K(%s!DAkxj!oq~jbONY|kozmUi-6bUr(%l^k?*c#hzW?s$-o5vpnKSXs zJag^@H=VK7+CVY=+w9+tWYoX3-jnt(_@=hvarrT6B*F47KLtOS zC2vx;5-=&`dG{_vwWf*flBRpS>1OB3;<+GLvH&OcgZr zv|W!&YOnaxe>q*;HGnblemd9~QIDJ!yv@W}TFAdrvD&VzAPW5+q5c*7U1{T01+6oy ziQbNSn1T3;g9zbWyS2gN z6>nd(q)i73aT}~9N65JCk6Oa&Kpmf>zM5qx(x)7>u7mmQGS(XC=iNQF)C^*SghqHr zYy)oq%@~wFR$;KxH2g5MK*D#e~rI2K=AOA^5!U@U=L4()V&=lu$b_)*^0t zPM6%=9!{+UnqGZ=Yf5DE&EPXQRcc|v1f2-TEx z+NZ@O@hkHEBr*LY#7-}8H~c3MJUK%_=+m5}!7pN&c9>^c)38n#gmV@4;Y0x!p?jA+ zDTp<2^lN&?>ogD7TvUgHMscxU3maM)Y;a-VJUunvQOGbi+8k^Eg!9Bsc_~rJ6$HY_ zG1r0`+}hHq=~voiKjBa7uP;e=D5H7yB0u$LjJ0+~g!nJ?Lm{YdC1S66^ty?okrWfS z%W6+ucU9uQS;`$}+!4f06jOTV?mQf$6Z^6nyD9b&@;;Vw69`B> z)%%Ry-ry+J@t!;2m$QCXz+BTCjL6MbJvdUh3QzRhVb9hpxE5r7`wVsKx|#OeS$4TY z)13_=tq2&l7*Ndh28zzSUYSj$(JB=o6S}r-qO(ukJsM|ph=uiJXdpAvX3vw@S<$%p z=5YCA_Si@R>N5l!tmf5jvr<8S@+W9-xp*6fX`K$%T)A3$!Hhsc#E|Xb;d;E8HYW}9 z;d)Fn=cpq3wjdV>ukcS-y2ufvImjNzE$qb`6p#4Mwg*2X{ zP^`#6=RW0iTc2_Zg3(MP%&KfH%UnTM(QNLnAnS(PMwIoYB%A@OLttW(vU{634L`y0 zeM}u&APqQzhuI`G-RdsxSc!6`4P$~|HPU9JpfrY)=E z=uoBiDSP@ldvL<>ULF6OLdo?~QlxIc;lZNnmRn%1ony z(r$A<56DwwVrD~mULO}-ubpzOX}e!A)3BfQ5yDC$vLA`K?Abcp~H8$i#X5p|B)ztC7)cV=;oi*kYRbgN@c6 zAh*!MG2+&g5F1Or^>s1(pyHB=8}??}CfvcdTc^}OQ`VQDO1o>XS3z-Z|4T|l zk9hExjmd|*q;Q`gIQ-@Jgu}RricIGEX~J{fL~1PnmS5wo2!H_HJa znbs(4+6Ga&!}N}(V~Meqgz5H4X#V}dzzkRpc>_?}i}VLZQ^kY1oNJ!>qYazfT^YrI z>w~fTQ>0UShLl0O??ck--iAFk&6x{R%0;W1`q&_@NWdoqq1a0E&xoi;t0mVVE``$s z(%tvZDM+YgukD4jI0j(0VrYqrrKP00*LNXRkN!7VZEJc!y8@|4U9ps{m4=L0gZ zV-eSjL6LZ_>}9rxMAqY|erGCu`-s8UMiSGzRa_Z#3W6c&s;X7*EACt2x;M$^*O_iB zvyi~zOjNWRu$NYnAI;H>kSzgn}PE4pl{_} zj8Z2!PAtIlmL+0;P{D<7WTkEnQlU$27a*91J4@l!V0hRHNEL1V1*=qG4q3M-lPm|Tc!_=4K?{Pve_Wj1X=!k|JKi?kWZp(mA zAWU-;R*wpcqC;8yaql;=&jR(b07J1k$yK)pU;+zRG!Mk|2ad(ZN8T#{qz2jD)q1Umx;IQt1Y%Z4y#$44Qu)MTcEq=*%l9jY zvue}g$5|iF5#BbjH_j!n;hv|Og(%m^58GY4_qL>y=?|tUTrzKPliTJ#x6I*jDEZv? z^n8r-0=`52bIPlOPON8n;KU4VgBEkdsB4K^tG99s!2h9!M6UOe;9i9xzS~`tYQNCf zx5Csm#$%Wg^PESI{j{$E1B}XF@81dR z@tlw!-vORwh#FVk zD$3TaE*!9Ga#u;mnw(M?y5~ui@CrR{@8`Rs7+w;csj)Pdg+wYHtkL-AVwyc&XP2#f zUfoDqg)`gmupE*g8MWCi-<_FTG0S*p2>qhP07%9OMG+z$^18WEs#gi66uP_0oVri) z+?2h7E}I-o$gMBNj+GC+urSN3yKXI*3FW~%-MWryK8xHl%n8tkH%}X`{=VI0S#p5& zNeCM<8z1`u5J{x_WR-97X^3>IPN$=8I9>5>3Xjg08v)vqDvR62RTT>{eUukKX9$`^ z9R#!?1|Pl{kG|Bf^VtzLvwQAM^M_ekt&u=;wK{hTg0P_yl#fhEE1WW~ap{nZ4cSnilnmePkXcipeoAG8HvJr~67-z5FjsFM9^PjQsC5H9R}(3uzn z*)a+(7LF#%sko0 zn5Tl<@XGso(NUz`-ciW-A|r-TJ@2MOH9e&8|H_}JIfG?2O(NZ9QNCO~Uq1D) z4qJx(Qmdnx*2Y;Wf0X$MQcg*72UNYGX@!&GgUg%&s7Xl8rau~Vap8UO{xo&zj`V>l z`M0b)=-T_tQlPnrqr2j=rRjFt9u(hzM6hUL*W)3swPT5rw<}E!T-JRAt5q!N&&-=M zrY66oT-y=n0S zu@#{!U$y+cx~p0Ro~KyV{|dgV!em>|+1A#ARI7x#y9wUnlBu}xY)1}yrO3fl-n=XA z^JDo5TxYb*HM~R8SvqHw*h8T#o9Qt&tMG$Lp~ShIkGqz~%^M=FQZc;5!X|scI{q?n zQeX`(g6$4gLvoTjiiaRIl%Kk`nk(;XJ|q(Vy^Y}mDHYR9k{v&FM{F*)Zmol6&YBEjpZHrMZ%YsBcb z;)87&3S>R;jKC25Wv1&Fb^O~tPRxT4*^;y)uKl2h(GBjU`$7YFq;Y6`_ow3uJcR{Z zm|P5yICWH$Y(j0%PFMAeiygyM}wV6MMbpt7?xN&9!zf-#;t~2Vr%33)h zu>Yq%3z(O4Xl&|@*ZFy>)-;Z{L7>f?0Vq73DrM~aj8@7vQ_RiLwqE4blE39%YrJCD z@o3WyedRoKz^tgjM(Y>(gG_LnnIj;w6g)yq(cqE{d(Zo&gFup7x5S=hdRMO$>q*Eu zLhJH;TM@5X3Tp^-hTU#g5ip?TSr4sq_MF%s&UJPq*pVyON#S^l=6rU7GcR-wjsq2F)}GsGB- zRamY=k5%_!04eeR1c)j{+VVfo6pi?8cL9Fh3A@(&DSjwH z#@fB>pHTapA6|3PRY?y_iRSNVugR%`kKstgXv)4%f5@nMST@~~-R;<>^$ZoIcdyeJ zAKEx^z71*BxcYL~`@wULGcr$uGY*_;)`!#NY3wsY zTaqsA9q3GnvZ9-&H&<;)8l3Q1TZV^otD82H88>H5*)9DP1b>Ew_bwFIC8V;le7lDn zxOaGsR5bOY0!-K)Z{;l_{Oo^G03P1&KMgpQVC?S_54$q!2JaHDvkS}Y4L4#sR5Xu- z3+mj=stiHrH7(*!HeYn|T*u!+D+0dWv(?Oo6uhjl@X)BUq45@bi**gMYD@6cFgL`Ww z?aMZO_?>3dlxV7kq!;w;CohqdWagJT{S$KJ@~jgb1LC>AUw)a`eGqSswSxsK+)8GQ z@SK3%*k<*SSTU*!ekk;h=omS`u8=o+!>OyQ+}3hZO_{ju%)rd1FYx%+@FxkRs%Sg; zRP?dUfV20KIiR+xiYDazM#+3R? zo0|N&7gVoW`~)?30^3*$`v~cuFju@)gc*m_Y^^Kej!e7t?Ca_YnC8A~z07I`HQlCW0t1!2q#UfhG+j@70reIvN z@2w2oD+ENYDwtohn-9{>gS_to8FnSBE$nOl7M~fp;c(I(!ESf=lN#1Z?8IlA#&O%N zboc!IFDBCY1K|!zY||n5nesnb8%_OaaXL(<{VU9Nt~Zrbzz%N}y3nLV{Ds?$qjVPN z7r07=Z`Y8)NR`v6Uh?L6Mz2QE8v&8Rw9z{N4-i5fIaqUgsWK)TuelMcs6@V=Vre^# zuBz*yGk|x^`MFnM3*yU?m%QEsxl&xc(+YgWv4F*lu&buHH(+NU_^Ci^OidB?A|L?iBs4F~8I*>^hG4KR1@ajb7%?BC=-?@Z`p#rwbFg zPwhC^%KG_$3k=M|qy9UK-)R;ec4dk_mK6BhD%O3JMkiZ{T|m)&6Zal6N%lGt;yECz zhtRxQ?71qE{ae!rJ5MRbiz(vP_FDckt-T@+{2M_O9(m#&k~^?|iXrbEO>k0o~qB#CbSsrMb+b(S45U6KKJIC z|FFPhN#$>I!Gzir1UM8b0KR*)UaCfHG8O2fK*>{kl$XXXpD~^OgZIZ;jd=!h+*wYy z4K~ogUPoul*niiZR}3=oaDw()xGDZOsX2Z;n@)HjfP+VIpPI&8-O^TYKLJrG6Vr29c z)EdeVQ3Q(+wogd!+xcIMzW^?FGs_g9#A|Va)5u4_CBjZTbk5SH6R4Q&Td@hAlEuKm z;*ARj@+Z$B?4^e#7{=ogGxv}57kx%f^u6d%(0us?ak<-%3*_En_NtM>@pAbO+M33d zZRQBBDCK>a^A{#S^L+{QXv>6gZ#cmBkRv|zRMUmy*DRp=@7@!43?&fmt@-Qi?%z}v z+qY!79_*X}2=F`0WD+Qv{e;W-|5PE+UxmRtBPB>^rVhuhK;?VKo245=tigT1=O3Rb zSJIsO3q?(04Vcupmv*pNtZwKK#Jy}N8ukJ**qM(^`X7&0WE=(7k`TPDzUlix{A3!7 z@MCi>nP|4q3U!y!wf8npym!9=F{#&Siy8v}B71- zj6HBY%4rZ*0TiJu3tqJIP9UAupo!Ial$}v_Wkm*cE#*PWjzxMkp+y5wmxBWyQh}sx zgFPPF>#4P+j%<3K(P=6+z5Kw*4Q2X6t!>U zVraD1?rYOsp}|F9IVG=qWRo+~t)WKl)jNTF@MPC%dWw!O&+x?n`W#ty`wh5Ib;=BE zBBWI%a|wkamd3V^2wVzO*G34rN({>`8AuOcOOA2|Jr+M5fz5mO)V99KztKQZELdOU&*>2--d zbQ_kWfpwQzIj+jgv%zBurPKZ-n7Q-*njl$H55_ZC?d;ZhNO&2+f0zQ}B_b!rJiH7P zcG4s9(H=c1oj!)4J@p>9%zEV{JIb-;=1Xkho%rmG$vyC*FVQHlWtI-1LtN?7Ach@B z=IOclSqrZywp-X7mxuc91`Ld|;JenOU8_>R!@c#$7G-aRqWF#5}SD+qEe(Jba{=62(4nLQDep5%9rNxrIH z^F6UjZ8Tvp8CheH15E|GDOyOz+};E?mN1@mkgmxm=Pv>Q&6NQSgU7E!v5Gf2Lz>7{ zfAmql>}r`@;m=SUk@67a8PBM&5c(o%PP_Z^hpHcJrt9|~Xf3<- zQL}9bS>*>2{Zp#r`r7(9n*V2EtEEf3p6-rWnv1i-$MX?t2p1~%ww=M`6I}Nt3qW^b z!XfuiN@~rA=w>mlm<`>48^0vUIPwtP8hHK&9-F@gDF)0?&`*Wlk)KqhuM~A5M1Ddw zV>!~B_@{Q$`U!FQilK&5anc5zs4DpcT!!X_l-N$>@t^ zM-^D!rH8wZ9+)h^bd|z^e~FylDiLI zF9>+pysv$%IZT8HN4EukkKcv4J21meo~%-kH}5$*JO60`TK#g2Z{qm#>LC3zNQ&en zMTcE^O(NNB&gD7N|hM=#IDy!38{0az&@9&7h%tN|4a&ke%e6)v0T zhfnBADl{p>&U8P<(w`SCJ)9iIYQE(*DSO`-M8(bn3fk$!Hgn8ZiAyAqwgn^l-Zy3( zyDf>)P;)9{I64UP6G*p_LMKji0>y^}GSu1Eu4$A_RrETR>|!S+H)sCp9n-y+0e?fQ zMV&?YXUmX{m?7YXEWo)UQ9r^vDJwX6Mx77HE*4>H@@vs3Gz+Erf?G~O1$hz)O7d#& zMnWZ>EplI-R=q5!3(&U&!E)m(^>-`4dM-G17=M-&L%Hy-ER5(!r8*wsaXhRR z{zxdxJ*6jYa^%(P)%-VIsrIeqOiGf$CWGY^2360D-aVRAaOpReTW}*?I`Bc--1+|O z`+6FO_nwRnL&fq&EQwPf5`*!%dE8Z;3-w%$%Lp9Cr~C1yln}SophySIVuB4oE1Ysx z)|q~|Mj3C2&BnWM*rh(LlG3R*1jelY$eDpa%Jsj-5_L;LOM!Y4@jJ0+`km)PNhd>d zlVY60m3rhc)z^Xi(OKiND7b~2#sgQ|)?PjX2WLeiZ(T;v0* za5EL&{`s8Y9*v}5VRc%$WM#*-wAEESrDl@1Q@feW`#QVPbC~?qYt|rV#TurKS#rpw zXOP^2!;k=ksK_uF1@^d*Xx8fW*7z&}m%NxqVHK>HOsoEsp7Zuzsng?LZ{n!_k*D$w z$=VSW@fX22X>2*Zdla;2(;Fbu32NsK=QXWT-`xAt9S68|WOM7_GaNpFQEOy2lf_fU zU5lI{mFNEXy4yw(X@XBgO64e#^SU()E=42yb_r$mI9FNo;YhljLtc@BwvUFDydGy~ z$GtF-sm92f#kJ2Sv+!iB^L)*)H`E0aU1&IXp3}%NE<5X6KV$Gdu7sbO-HX4p%|Ar1xS?v_ZK2vudQAWObRL;KFk)J<3`mtv%{$KF%D5qM{?Z~SB1;3WAy zA+H>!%*Nt#qH?tq>-?bH(G$;h8?nA+hl8HAxiKh?8Vlv7S*G;K`#S_+JMj0rcEaip z{2M+0Jk4xu@Kf7D867o0BKUN1twNXV;b~+~9 zC3MZw*7r6St)a;-2u|n~shds6%T2Rhsp~?Ysk3E*%&v14Sy_#2fb*qavq{}qKOEXx z-#N_gn~bb$HC?6JUH)wQzGEq0fBcO(8WHA^<8&yfDea6T>8+Vu8XMbWggqqriohe% z$LEdJ!KMv4afH_~p%h^3cbN4^fhzhNqi8I>6)txAV|#El%~y93_kYziVeUpp2No-Q zeef@jK9oQxVrAC%X z%4;G%oWXhVN%iVtAsIRH?8Rs%$@yj?S&?rGON~9_&|bNjxl6T45>->?r(bf$=&dH| zzHrl!kL~k1m-sal-Kg;=_Fa;Rg~6r{;Blez>cva-KOz2;d)6Kk-%tk-5!<&o@k8eKQ1q%caOoZ3Q4iUJ~yQ{`B>^=Ra7_7k;_nkcmUWF-YR*&6+ zJgjqZzn4>7aLvkYXrR27iPnn_{WJ`}js{9xtaQ@0(!yKESgFg}j%C?g54vWU{X_rz z4#^_0Y1Mzk8EN0wmUdXCICxBhe_Rl) zR!qHkrvwUV$`MVD&E9W4KM3oW-GtZ#>F3Jhwyr48nTX=~2vTK$AvscdQx=JU!u{y^m8F8ul)NL&Jsrn8=VnT5w~qaUln zs~ZwqTimNCfO_G&gWS>bBDTF!$Oj*eju!B3Pfx57URepj6KZJicx4&-Hi`!jYMEW3 zR(VbjlPJf%GmH1OzNcr;yG;`c45y4v6HA8YwCJQ2SjynSg8rEo zZorZp1o8Y{Qq~&_$Sn0lZCgI+5#89<8=P)k9`n+w3K%x1=uzT?ODW#5b7()k;znNp zX5DPO&m4{MqX*yovp*h14X;QSw(d1{d-BWgt(GW?v8WMzlr0XuxmEadQ$tC zso%w#EtMT7-zCm|WCPcERzEih>hs=OFDJOP|;F z&g~m%vV6V2x_eW%+hch@3N=Z6N;0~sI+>S$Ls-E5m%8KXyc%7{F8Y46LR*6wx}{P9 zPJn9p#x8;U?A_nc6G(x=nw_nM(?qM&c%ZIXHid7t4r|eUYpDHA4M-bQIhm&R!TRpo zwO@Q>U)n&;9iY@jVnhrdpQ#*@-&=la(Jfw5(<%lYi?$kbYNQ*)2}r=82)HKI$joUoE$ zY7@aEEL!`4xM&eFYJn5SwOO=&pSYkGRO<+Q3fAcIkm2_h@B0SG$Wf)1wF3cb5ZfVQ zy1$e;>!;ee=%!2Gq}o_#)6<-rA5)QelZ8VN$*EHxT=NU+?rhS?q0Ve4VLI&qc*J(f zZYg*G4>(8f>3na3qwcm|HlV#h!C_?h*Qa2;`8(>}*!FP;NHy$ZU~$MccLUba#=`uWCJ#BYg& z*<}F^!Iy&QCT+5XucA|VSViQ;k934 z@9|!*pQzA8OKFwJ(5^V&yb~zqvHA7wm^wj<^Jy22!X)_6@&6WEB7*r7c@|$Z62Vfj zG?Ej26X3R$Jh3wfJH(ME;LWRDLbdLmWW}>6vS9JvwuIW#Peky5v8Ir7z@Q}Rr)tC} z)3DD*<|9_= zW>mP5ETJYRv-em^O7A+DS4fP561PO`{QvaHwVXZ<5DfzzC_M`Ni{Hh04_6n&KLFi!_gK_GkGlXN%?7;5`=n znEIs`Fc5!`d(J;CGn-!0FWz=l;3wV5lq0;9(;}oh{=+?sir10WsjxBDo8nGJ$ewNg7GM~D=Epo!RcjFD>~kX28fDxF%YF49LgB~VZO#o2C5|1`}= z)SG?VQTfy{m$PJm|2M3AFjU4UbO<0shqYS zTKZpN-s4pd^i9w{p|AU>iWTxf`wFbqJ(B9QHOpHENMdeMdhST6I_3vX)5{^H zP@qv?V&!Qg7_lHrXjHIS+DC=-S87?cbL0sYV-x&TbOKU2KHZoo-o)1#;^+0takm7Y zNDxiAl&fjnb#N?SbQ=O)fz6r;9a8k2+4${K3k^+ITw1ufvV^XWVE=gLi48eya^mB` zCbdL?wYzH}il6n~R@X8azkNZ8BzWTVzOxu(6W#35#XRbsvJ;O1_~~k<^zO6C%qZQ| zUo`;w2$QVr`J)CFxs6KH%ra6K3aee+TsSn(z^}D_;cqeaRnl)99Da4Xu@I-VDrJPn zue*h>1pskgdiYL`?|=NpT($fc+?)rq9Q?IB9;(#pCL3I4TU8jQgJO#+vnAapo@rpU|xOZS3Uari?+g z#T>GBB$D+7i=x1JXLEbK%)VmDYaKINqwL7PNjt1~H%PF@Dp=dE%cV_Y>yspH$v>u{ z=F{#AHqT};?X$8ts|yf+=t;r>jvKJ^$Fq7qLcsaK24l2#Wx;4~lu|yYtWpr!27T2vOgVnNwBaxGSQyr!pOVD-#gg}><(Gxl zyrk@LF8{3R^<(|E3igf6ZtzALe^Hgn)|*pJc}3=8WE~lpW6I3k-x-CnMfkf4F-~|z zT=yziuJhuncXx#B2;-x&2DfI$_C(k<>CG`rSj;#z&qy;|TP+~Sx*)E#D82kBgZM0N zwg00)E_Iti8_mXb`Zqp6SyAPxGE;ZaKN{lu+Au^*jHMurF6^2ofP3Eiw`cV&!b*MW zxv4r{j+K2s{-saJm&NIG{^H72=duQYBar878Y!r-`qw{{RI8NL9NBaLB~jH!T>As0(~iE!ACU8vZy8!VE8bW@Mls5uP3#JpeDb! z`_vsYg~ej(%JwsjrAE`d;_HNkxY;fIui@xFaOV~!w-*>i&N~2ex~q$L`mw?rD`rjz z+a6lX^S9lLBav#fPw|>MuW_0Fpnlhzz;(_>O0<-6%3xuf6&MUjj|n4fdg3MV$cd4C zBPD}D{g<*p=@nui#uE6RxUT0_Tgf}~TxE049Y`&Vp4-_DqD@$;G)7FF!Q-;5HO80C zu6XLFHTxAe9PsYVZsORK9cA6^O=8CBG{2j^H23sy{KSUXFMf+zkZ5)_eM7vf_8*-F z&dH3O%HtZ#5AGi-k9XuAe7QS~xI{Mc4Gf!n*7vLH{ybd7F68y)&s1`VA>EeGDR2N4 zF5_lN9!~B~n3DNTEd&rgyMj3rew`RxlAoe-qaslxZEEz(6tn8kl&$4w6lJ>OB0T?T z`d><(C`}g@GAsiL#HU&S5-yrWabhM5KC$re)h$Jb%A z*fO;Zl6g?HQ$gZ1yfsa#J7l4E81|SbAr=6hzGAdxGTwL*DYl7ke4v%_hW_B-vq+OV zyQ26|W08&khQ>?52Hv6DA-L4leSM9%PsZK?_0)!GV_n}Pc2!V~Tz*kBi&ffb?dQ+sJ%+mj{BrR;>}>*?c@pt zfA#I4mq|}DX|S{H$(5lpp_ybpXh5t!D7Rk0D7XG{Gv;E{}PN}sK zC9?e42(`x_R4NyAE%D+?wVOIrx;ajxnc9yQ^`9WqN&i49Q5h}%5SJglyDgZvKgFeY z4tg+sC@K=3FfmtCUFC7H>Z4#?HprG0VkzO6Z%YP0W3z)q^K@m_okftL#}?b1V2s)R z`L7-DSbjaW$V9avaEqbvQ#3X4J1_8^Fa>>Tr|U1rsRscF${g`SZOKr8-*^^JWOXsdD)PKkhRf1-LHdL%^DNN7i0Kp@UY0sG>tLcep4 zt{Ka)wk1(M#Yt{n_>~Jkk*7dYkRSh|HIi6CLlE{EuAu#IOZ$(!K}&rn=#p)^(_-k+kH{wPa_+K@D&r@WwWArjGcK#HRvsu|1Nlqd1cwJAjOTTr#i3k6-%ymX2bJ_wt!OBvHjeq026csxD+(&(`axFKq>aKwba6dS zP!^i&sol@)H};woV{be%p@~whsakYeQbmLJYc4p`-yt+hTb3ysZrctiuBT*egcL8u zRnLPTNqs|vCLV&|1GB)?#`&s=^(b-0*x2<#&C}a`8JQS3qhu!pO`PR$_Z_lI5ufIn zw3XPSy!r6e_blyw=44Ob7mQpH{mz&M&7-I=q7_Jdz$BaL0fo;H7i2-KeDm{ze>$qs z*4*PoFN+vd+M!I&@pRYYB4!00T}at0p)Kk9dD<$HT==$$n{gUkaNs0AcUFV+zB9io z1EKV4%e}?tOzT)-^;2yHq)aP)qP6Gc2nDqx@gYy@8zTJ|ngYX`){G4q+IsOHbs!29 z-npc#9ylHLsvQF%TBY$I3Q(Q7J$Qx~gzV`!@ufTH8*>88Qwfcv^NY5}XrtH1Qw4?q z4`LftWVlo)y&Y;xb`xA45@v&kn9a4S{?@ z!lX=Xe~{@)8m!6%;Fsk+u`62ou<@T3Y#+(M;a&F;>gx_kk5X6~Q=sW`-?a`pOi+(@ zZ@Um_UZhvZ5pDxW5B~pu5o6<;F?enVD$W;KH1v}$0u^U(JZ0miM4Gsd;-IwNoqmLeGYDN4WRX?IG<@oTVF^$s_8UllRRRbS{b%YX zYMLrNMYA|o<-xQ3s$m{OldX_D_v-c1c49Bd1!&ef`R zv;8^Zp4E)3?#x^MU7nNb&r&?eQnXKRJz6Q`d>&ji>FW36t615RQBd6q%vJfnF%plQK^!3R4TK{(Vr?~ zS8DQ|@eJFOtlgn240sKx(aDI)Rg0pLG)VHiT$oIuQTq5)WDc3NX9NB6-f^t1GsQso>V=#{B10eD+%3}^Z7}bd|w(YP^O9!0wO@f(RMuTj0lqh zs-&Da**~AcVKTiq@-9YciB{GS)|mWWl8rU**&Z={Q$_8r0Al((MmpY-H&#^e<1ceU zN;46qA{XJuGqJOOKK4ne?ltO9+i4INEAA#r3(@>Bj7Y#}SP-q6prR{as=O~lJ^#$p zJAIUUNth6J+)E&W#;{`)3DQ%^l{G)y_wlFtVAgBk!xdlt{5pF2{p4Ly(h_p)j`&&D zs8EALklqO=0o#+26I20|>zYw%pdTs$R3BbG*k>lqd@PYF5nYk}>4RHVwgl&fPU=Zj zW1$Ar9RKbX%~H~i-01eYbz~{aj{fofa{SFSTXbmn3oF zdeNw>TkoF#0T9RrWfj@?>MaM(N%j}2%Vt0p@MrWe&_XnXZD1Ic`UmWbim65 z;3P%qehVN)obQ*vN>tagM$?gbWozo?MxDfYaY_oK?2GfCPAE_5fpr2W$qmjGd@thU z;T25;*r{*$?Jh>|8beRx8!K@Rg1er^?z;8_j}($E{y00_)yDj>n@&C-kad*-y+;Z? zR}Z>U;N6PYtmAaWOkb2KM9bY8`J-2~AjBjsywIwO%M<@Ug$mbC=oVuqA^Va*{Vti= zk6PK=XwYLmSPh>PYSns0>=XeP$%0Kc0s6(;gxh^dI5SQl7g6fgc%&{b1$y3h%`LGV z_U@Ll;3~L(f`Q}74H>2pn1@vz5K=q@cL`F3*tYQ&-e8r87?*B{+9hKe&z2f z&;eS_8v+VZG~%wmp|XKUaE?G=W`DWdEGX0Y1i7(U{9l z*u`-pR}ot*xlT;-_jK4yd8%7Ol0-YxDa**P2%;Vy<48p+oG0?{ENP}8nEV_0hHSM< zK7!nPzySjmla$)kSL}_gM`hS(!NBQ+)9+DM^D1$%KHX0fvv85YapIcIj`?I_X81#TchWGW z$gL~}Fkd`xMr2!*za$Tb`S9R-ibCTn0LtIor&;2O0*0pBzaL{7G8a8j*8Tx*R5y&ESr^Q zZJnC2Ds6s8t8Tsir1iKFe4^LQcq;LT-PrvO6n<6E+3dJzj$N0ffd(&_Ko!Sh^G%mY zS%+ivEm4F)X5Qzw;YnaFI?>NHC0^K*U$pTAnD}r>gvO0;;V`|7qE*BXqUzYnicF`? zypa3ao+qwh>-}bG*9cDn)4)l*#1Ll=cgkPu*L0XF4P$_mg-SMZe*^rvxeB>mj{QqG zoOn(T8;W#y`0D5YS-FC1+^fDTdPT$Z`5#qrOp8&C_mLVoi{K!FP+#+}{YaCS$#On= z5b&SujB~u=C>OrJCU=!3kcMLnY2@>Q5Q!`tR$|LV|z*ImpuJbDiz0*yGFXBnZ3joH4#Wyf1ug{TzgB)G z@i}q9@zs1kX&>Q(8N?@Q@O(*%uvbHv7W)stdi3G(-`vCvlAsU6ra*-umpgzYm^O|a z-cbFn|QFQsG+s3)oSAg{K%mlUcaR~f=fNFq*SBylCVq3 zCW85z9R}8t{|$}Rl@{+wur#s(OQh%>GZ$DQY$#JLGlvzjT?05cjuES0a=i12I<}G~ zN=gJ;cCmQkjo7BmIE2L(!dBZ#D)R;r@E^ye1S2zZ6dAGzdDI;Xr__t6mj8$i4`NUR zXwT%SqI4Ri1mu4AX7dbwRMD`y7Zsfat7v@UlZp-^fF~7reHUc1@cMn_x64pcO<^}l zVpOd5<>wc8E?9FL#Wrl-$FZvkxNi*9w;#w3L8~W>&U{S!!K=eSwW6bNV3iMDG3Zh&3D7Jl%jT|$I=z< zq`ZLO>&CprzisbuH}@Aq@|Q)wADR;PJ@Xu~# z#;Q{ep4PP){r>(BUiN7(F~% zR}`k1uAntZ#&sztI%DE6AGmx&oL7EBJ+1Ih2b1QNN?;Z5La^LVwg!d%#G#Z_xLUh;9q*=f)0P^=T`>B?!4XR>{F{Ogp6V6_yLGy_Wz_U zoj;vG+<|U>PVA%qtFl!=FPgq_+Ef3oAPt*9m`N^ydl%?5I@CqU;P!>R0MvQ_XCkNt zVZtXDDO$8&j=aQU@^Lw`)}BMR)geO=dpadPy!$WQ1L_&Ik-WgN*K>hy|7f~XIAzMK@)|p5SzGxB zgzop$iW*Vta}o1T1?={i(fQ^)4-tpU?%^GPwd z5RU>kpD932kvBw1@P~aCHH)h?ojeLI79HSmX%gPhWTMh~N75=G_X zrCaZlCZI6{vMGgwXGTs3OL6RNuTOFBnEPaq%oNE_USEeRy2$Pp%ZRg#3JZf z&%f(i$urv5ifw;}%yEt&E@#x-8S758DUaJ{C_^sMvt!gMPFN-D(xVT->hu?L&0|gV`(NTFz zIX3OskLRAPvBh_O3JO&ru<*x*3B&-Yn_X(;=^l9S4D4O<AP=td;Oa{e{j0PIiyKl2Ap)i91 z{3f9}?_yz#?D4fd@u$$#LjWmp*67+VJA?~UTOA__>|Askb)xy`=d6H|^F;SN^ZojT zSB2Zq^@3cV!>1N9m;EZ1@?T=lw@&r_o3@a_eRug=w0+*V96J}@Ml?H_@a|H=xWKP5 zqK3~i)dG;IN_?qOEcaDxkLS-1X$`_ud(vsVZVwY?u3xNcTnULGvicZrViK@S^uN%* zQzQ0_phjL*ul$*6L&M0Rv&xvKH`t%JDT-cBx@yqnMXI`Wb=wOTW$<^CfAPjwL06ZI zeHTydH9o0wZ2iSr-FyoccLJhRcap+mJ-}f^-1$E2G2=mmhakUd_1w#iV_;e7SLRo;@xeAnbXuM@f8Z=3IHo7LO4J!!wE4X+b8 zvG$B>_bOzVqCy;#e@&jp-uEb&kqPZavjH0hbVlZ@w%3|vT8$lwzB>S6r24=()~Xac=5jAZ+jYe$X9a1?HeQuXBHmtM1wIo z{vF@%EPOi*^`V7#@%4Yk$K3!rWKM$*Z60uL&M1E9=y#<%+m3ImsYrzrzTv9iVsMQw*VCqzs>V2{ZyXl7$gph%z6Fe@2|M6>JY1ZHJUsiH*~OKKi)68N zH6k**3jEBNGN{>eGjeb1)BMP|d!oa`M{G>y`!tqBz;Wd$f%GBCWxm*0%*T|gi&!Pb zzLXuG;;?Uzr^`s8a=mA|1eRe)(R?xj0d|(rK&eu@f#a4E$v_x?GmjP*%YdF1OWj8t z5;G1C^b@;v->=j!3g3LFmEd9z`pYF84C3ir8Cwo|zwveBgP#3!uQyfkxKQ-&YGga` zm;MhM(HDo0AcED?^;n~XX^Lymq&);6SLN9HtR|l#t!SV)%WBb>32kpZeJvT!&ic9A z=USYnTV;3HpYr+&SDZtwkKw##nf7FFR7VAwOhD}f8v>~ZZyk&gd(C^f9ORB6k>G3~ zG1uU5k@B!M$~o!G(0x7{87SDH$J&tge~v~${Y?M+pI~6S{K@S=B%>chQm=wRA@y{T z{b*8ygFq6&B0$`)!G3Q|d7!#O>3RYxLZWfoM--6*YUS8!To!n4hUE`wetWrHHEyd} ziCc`Pe3-=5wh(bGuMw$AJF(&e!4WgPE2g#sqZMtw{bVQ`^z6Zry&pmVntRA7W^J3q z4FOWoBfI-E%OA7Sf9`??p^@T6JwC6Z*%7d+v==mjS9|q-c4T->N^yP>^Y#PJfWA#Q zugiy}2Ip^jKhkh!VU|xWt8kTmqZk!HP zOGHxW^o&*Q?Yr?Dx9a_TB3Z><+Cvf}MMo=wYfrmwf=YV4*^cWvL9~6AW+3-Ag25-mGAvfHd!3X{Q&sDuI%Hg(WlhqDf zF#b_5^STB-*Ph#%XY78BDr=sX7QRTqRPOUU&k%y3oX(cjL>K%}iG8-zG3$;tX>&FSm-1NzUL%vsfdPJA zQ>{4fSdbX1>mZb+Dw;2UlMQ!ph7(g_p^sKCNXff#B!Jj`=vKJ$G$o`H2cNQbmC${3 zhWgn;1UiKeTIs|_evBi;6_yow={~G**%}Uwk&GLUwa2UPYDlT2NDU3%0f*Bir__Kg zU1*{{bnba6q?WULV=`Fpv65%g4kLqhJsg&e%!%?et}ZP!uN%oMt5X6oX16Qe1H(Ua zKuTV~0ids=)-o~CD`s#J!hyGS^|W3BV`9oL+RZZeHQ#Avf^k9?kX;-m#g&ul_6Ll? ze;aq$3ot_x-B|>)dH!M8ljS9(gYv4`*JXm_c|T4;-3aU2T3;%@L$z!Vqjcr+IqU@P zej-i1_szDY0^pvfB}9->-5zn{Vt~uaWnq3);nzM|))Mrj#w66oNy9Elg0cdYw}H}R zY+m^8rcMQQ4OYka4ft@$QHUbvBPZ`Un8tgZ^k8d$Y^MT2|SZ zuz}I}jdhrodpHr(d*C&ObUyO`)#4dfbBNC`{=4rhIB2q|sOZtz*_FRuAMRWAx=|O} zPZ_$9SN#2cg5!AmsICWBq=3K?J_T;;6iR9_0{^#BW;h4^l6TtoIE3Rodxqw^QV}B# zs*_&+G^xBe_f*6OrlFMYT$#~z?CkOOiyuPKvv&1w0Et*8=GATXw*I>tqx|G?9_f)3 z^!=Hiot^ZsXaw4g(^xF3&`pe`gYa}Y|6Fe?ubdNPJeC#JS+u)>G|~5J8AH)SgS4hT z*$@pgLyl6Xxj|wN(WKR>hdzI1`yJDBt}k&Y>~ihcm@3iE{G`SPG=hZzoC79E-X#s) z&8kycly*)Tq-`2JqVDmy&C66k`BZ4zuwzsEE+@Wtk#}(Dewfq+St4@uRWY6{Ko-dqa-RCy(Kh|kS6KcK=P}%B!>{Yu zH6stofIL{r^KsaEvIM;VE**_k2#5WYUW65Q+kuP=5weAlLH6{v3GU$6Ve zSAv{)sk=<+{%(m>lX!;a_0{J!inWvkZuXJiQ~8vmaRJMvjM9a-}6;1?kx_Ap~I_o?veSa!PS^wyQ(IB-LVI_Wk* zP?ChCJ6sUTtXOa56RhX5yV3ifY=wC@Vpqau$BoBLI9Os{`L#-s}RvWo-)Mm(Kn+4V?@=N)?fy==v@7OZ!rJGY($kJ zQhrKN6GUWre=r-d21Zg2HztXOW3%dXjH-qUXSHh-n?T9KsPW-qSx^T)JKm;)3L{0Z zJCCBy8fuKo(qRLTecVJNWXm*haZe{_sx_3Pu4ny<)`Z128Fvln=@5t`Z|6E=frH0g zkT~tAS%DVQUo5n}TX>VZ_brWAk-s9`n(Xwxc0QG#KRh<8xW?-nJNi6=h~E535F69@ z%s2mvLnOWV4Dk8f$INJWFBwj_8jWZJ4vb*d;KW1Ct6!cK7Jrp_O$>1!p{%=BFxcXc zGM5H(&(8rC^EyMfq@drpWPUtUjfUz%p7ZiQ_dYro7}lNCRLsGcQi27~N4%53LiuW} zW+*PcT-59vk-u-Rp2;fn`y!+;WyPXSGWz(s=}w|bT%5MVqXKGDU4`w!#=UiUf%eeC zg5phlD5qO}++zd9xjwm>ADLhG)*8GB6Yyl71vG}0p9y=TZ={~5!{{&TOiiEU`Rt)k z`e7il<7(!XE~QA9glaFwq&vIpCJI-p|5w3C z!UA9a*E%b$0c9aG)5E&*h-+uTsLec~S`_~5+7{a1aWOZhp9!36id!0$;kjkJC>T)) z0fYEoLMJgi{n_!s5JkXOPTsSF#uD%U<^&0RB?BCc4Hq%1%Mm?CbXY8cH2A7DVPW&? z#`BH!zts>&1Vb!?Y#RZE^mLeDj-ZfU3m4=0M9BQ=+OM+tk~xVZg;hvIyJ2cUL&(ua z`_60?@M&`rkrQ8Y{L*QsLI!xHyq+&e7eb)IW7>4xEVfp`1N^GNfc1@&xOb2XAThib zP|CWEjTBU`S%we2A>)ImrgmDwt1Q$~*!W?}^Em&L5-Zf+qJ&2tlW&8_54Mb7oSXUXASq2Q4o+wEYRr!tOEkv2I>#Fjb?Kq&cEp z>9*@7?{g`GRzr9E=L}Bad@#AymPg0}-pYVGb@}F=pTe#Q zmYyy;zdzi~BL+R+9L5pwF8=tz$eRVan<~zC`PYkMKphmv=|lg9+f` zV9rsEf5)87tQ=D-dDm8B!#HLUD$$8|SYAtAsC5}{%GAgY4h&Hv)1fg2oUdB4B+Wj%Ut+J~C6$|9=R0Gk0<-&E z55r^lda=`b7i(D;HJM?Z+^OH-hLHVORnh^WIjJ59Yj2p9ULi2Y03NK5$9mB%VW*sQ z393T74$N~Yp)lHiw_NfP$&aiem=$Q0wile?KCN7I-|n2jBpzDygAz|cc8u%`k6nIa za}Pr;2UiMZ_wI<*Qa)B&<3ynrkh^*HLgulxcs}9WH80Aka=ABzBThpQI#kyM zhGCH0V-S0iXrKZj#*+!eLQ&GB8REsE&#-+E#vJweF9}Bsc>%V#WBQq`;|J{v`m}+w zR=?pX<0YsCCu*~4Zcr(c&&ekRPe!0%$@A-70;3@+O#?3BnQU67rp$zWJiMvm!sPLD zHL~-?5ZB-r;rM`HbqRe(Q%E() z=q=tbvse*@jzW2Yl`4rg9c*Mn;*9@t>*X3@0l}q)#3X}X1VGjSV}3XWrPg&G&w0PD zs|_}`5o=Kj@rZ|6l4jY{%;nxWXXZPaZWfz9k{U_t)`;o5z|i%~Q-kZ4?7qB^12(=A zRd>ix-14$X29La1Lwagq#N(yeJ)*KuVWd~t_7#E&g<-A=!MDZFBByowH{+ROAIA#C zurNG^#z{rT>7|M&-pci3ZhQT=N*zT!$#f0a+d=fhP@p(W^FRRueG4}Q0b}Lysrt#T zaWm%TNUPQ*ndE8n*(vX?h{j-w(L_e=Nyx}kaYD#Xk_|@USIS<8aMY4aQ?yqMK~z~G zC2?VOQyTNIu!I%%)kf9CA!(#6gcYV z>~1E2$2$whbU}YgjQQPhHEdrTQ`HpzihT#Ad=jhQmeTa4n#-AqiqW2a19V^AKQ$}_ z8PfT166TrBo$6xyInIC5H_{{k=D?aKk*lK2%Lu5#I)*jH5JUv|(0A_l!tm%O&?-!KpUP`ZYo~sD5`AGx^e4Fm)S0M1$ zBuOk~!DbZ|bU^=9KQ0F)27@Gzew`$ZVP4b~y(^S+T$sxV)5x;}#WP-47Fc{yHA#%6+d4{)Bgw z5@tu(@jFXJ;HB&)EQ~n~oEFB+sGXlv2UgcTVuJ!6m;Mf@d(q_-iqsnRpx+S`syak*lv>ix=#J?6ePuou9v9 zwM^m5ONqieKNy=Ao?WT$~n?>Tw%q$0mL`E=`8dicI*H^MHyBEL^$p zA^J>dUaZCBPo()yT{{LN#J3Gb^=^w*sx5~;ZnG1OOP0J6I0FBHQk@oj3rsCZobGs5 z@0TfKP5YE({ER0pl^qHButQ<#xN{~T-w0HE^AP=WtLR`tjx}+ax0=pL#WBfaqbSQI zx~tBrVPKh?H?C1(NFVWMj4nxR5l_@1I?mkH`E-i1M-SVjlv@nwkh-;c7jCy)foBD5 ztwht28{dFs1p!Z}tIdFdApwaIS%-H?0tRl{8YvP!(Hd5s_Cj{K7rYZ#k&U8o9F@Dv zr0~WU!88@YYXnfY&f%OxmtVNr)@RLpRBeyQy7-{Qd`_jNPDT$>o6~@HqbC@B7fO@o z8;4aEZ;zK$j=zE7z{_-4-GH_=IHoU!9-K@!f_}*pJb#E)Ql|?c;@n{L9#UhTGgzUK1b(4APJWt?d zEFa$krIQF>?1<$2V}4!vwTDh*>5oawlViZK+kxP!4s#*QOIdm5BjcE&Gx7){8Z|r2P&d&bJ z+K9#ir`e=$-%~&m-0$Oe)q-LuQ(oQr*hSbH$K6@8S{Had!93g@mW2?EiW{c@_x88E z@vcTVes1j8zr0_!C?cLxtG3E5JIU;QL?7P-|05xnLmn2?z5ZKBE57QM_0gY`gnpgWz@$<-6if+52G$oNK+PeHha#<#k#;zPJ0-EzN^& zabp_23)Ow9jdOU+oBBQ_nn9tLn`p$&)ms;YW=fh4{b7wkQBpD~(@nJp zy4mRV-Sm8FOED_+L@7QiRpXZ7@fgHxL|}#z`|@tiNSM|06Urtlm@DD;4(W#_=N`eI z`pg2buao=P6L}nyB)bBfs6?hT4cVy;TGJ^&6b6j}DKuFstdqWky!Df5;q zh1~_0nb1B=>?&FTRJ3Z{xNgWTPr2cCWSGN2NpLdw#MH!r5-CC)DP@O(i|6B`?=U&p)3r~w<$YKU zU~9LmdhD7jr#I{Y=lk4~(2&6H$cKud>Gf$(G@bsbwIJozF_f*za7$G!`X$-c_)_EN z!a7<;oyXzw{EHVL+ix_gx5jsrA&P;hUK6J+d(= zl}x}4NZ9~!H%`vczH>**!asweu*BHmTPZw*M5!nHhww#*_!c`BlU|3cU9MM_#T>%+ z5L4uk11)K35~Crvr2cih)X{*QRyp;1JI!MZ|Qb&(7JJbg2cV{)T=glW9llZHr8DqwRj>q} z6g`ZW?XhdO_>-WY5*l%ry^FGHHzgjY>fP(N6b}yhTg}!Pz-NtB4+;5*iStq?rK{cS zg#eW9^D=9>sGT)trR9*fo^-m5NJzoEOGsKd-S5@WI+N1ly1czUf`rGkWZr^!Rpd^N z(x(woju>rSDjOs@8Tr8S3y$~W2HlyAd37d~m=^Df;-bQhe&XFq&@+Jg4*y^SA4k{U z^0q7tptoROg1wo>(Dwz1_l&0fi{4fE78Nnw=|a*&LMNArtY!d9)})@}Cb>C;Th&;r z<-8@G(=8u!ttD^i{iWGSqO`EB810v^VBc==)5mxvG2A9u1rgKxkDrQyGG_OyluV8Zf~}MewXP*E7t=fm6p+ta(~$~# z5tkmz&<`pk=*yznopK8M8TrJ>sS~no-S*`WW&*y(6MVE$oR&$3xyL_v{r>+LI5*8b zpFS#`i@|KgyzmQx9(fs&Q}!ELmX~F8F;dnI7xSYS4}E*A!;5N(I>UUuUPo@`)B_as zRcdvu+Pv?nRYO>>IY=LU!{oMnzzNQjS&87<9_nZ2naXS!@c}9bHQOUTE&=!5eH5th zs8XeVlJk)FHC6>R5c7cND}4~CkKunyNyKLtJaN$_qC!|{j_(ZN-&wZKPMs8%urg`;G9M z3(oH&0z0*s*AH7h`oyOwuP9E#1Ug-oXQi#0^jSXFrq2JjmrqNf{5~pm>cIGRzAn@H z;#c-TfCk^-koU}9-?iRG_^FxE`IPhx*>MU0fy03r5At=h^k_!RmMj}^97*w9Nz6=i zPNdc>nvk~DVty9K1xri_H>zib3R+{d5>)l$lq_MlU{NSBMWad7iN3-l*hKYC%W*UfOzz5lV0_W z(xwVmjn7KSRC9Fw(8wLODwSsDpzGK)ez@83*~KkxUm_GBsPZevYJOXClSOSTr9!Ms zt+0d#f4$TQ-jc`W+Io98)-4ikQL-zMul0;Ps?SWCd^}dHMsv)hm@nW_jp_yn53n#8 zxymrXpQ7T~9WqNyBg}2inY5~W94R#Wtnhfzd;rtyFhO*=zgNDsg)T1Tyxst=2c#D3 z`8~Z?5D&f?R%eXh?eRf6gp)JT5NEPrVsGoxcZlnFd6%FmlNsJj?4*1#P;&l0nJNiC zZ-%Ep@L2!57cX5Sk1MRtT{hlr(9wn2Y}^=DYgkC@y~0)0@8g)6M2S_ZeQz-f@@F$y z3EYv1QbaDFFSuNqj!Vmph~G4t>3mFa3{>MB%crHagcc3SdB%r~t^zY|ql^TJYR?oE z3bFVLD4#Ok-pw+WUKgTkZLB|5&avR7Ki~bDUg7V45-fluH$4acG`S#ozom>*qz~Un zGk^3uDtJ<2U4CjB>|(Qdf(*Rur#xdK7~W#Q9W}Yz()67;p7-bJz_}$F@9*iZ+fi77P+7ZTuaKu3TtW#{1Y$Ev^}4dt@x)6sDYXu3?lWoW_XJaAzcqHg3@8IQ$~(XV zw#%M6F5i$9ZVU4erDzEXVf6PXlr}!JA*L3q5qJ>a$C+vb-F+r>(UzaQr0~n^F_uTI zH3DU3$H0w#i!&@IaNbCHh0v>}8p>!IQlCG6Sj2OXcT!z;OPb9n=u^RMT zCOHYCTm()gv<$6}CPR_Ms+AP0Fay7itGN5uv!%|eOAlr@WF?ILMd&5?DG8dAM!E6B zuMv9f)K|_4m5jMcX%i#VF>S~R(^AiIiGq4`?3OfE%mS}&&5|Sivbz$D`;6;}Jy#7+ z7jVnlDz|+PxJ@qLbM>8Ot3p^2As0ir84~X=*KK#WTYKi4*C~^Z3 zZTHEWtk(~urH0yb;WLt=7RC(Tfz>GBCjm=b$7a24S*QGeDAt%p-^CeL;yA%tsXp+d zl6^cET!YwSG`t;`R!NocMvAJ`>|SXOc*FM>?7=O7Ka3Z>X+;J1_!A;J7}(%&hRy>R z5|q%sX_&u1XcYqNb;YEHYq~vL4y{d;6&^RBf z26tBPdc0`18AJ@h3z+3mYMzM*eZN>X8HZ-=mhz;s+Zx)}N>@gly}NqhpmA1UWiZC)?S(lF=Wkz&y{s6rKV zZjJNw44|gk|AD%Bm*46xEDUkPxqEoAFB$oH;SYA9`v*OK62PKRXRU?>w7r{gLuXv> zR82q6N}YV7jkJ;L2J=LCIloEqJZ;7TnK1d2U@-)y|&@pABlVD4SW z+*+=Old#L}SQA4%Us5R9DU$8zTsVEY+jhJ2oa+>WvdBsjlOAoE*@Y_TkjXUbjLM3l zsYWYb!{8=l{(}t~GxZ`O21*k$Sh=8sra@T!@WJ!Fmi1G4Q9OZ1o_^PzHM|h^uKUOB zMZIRaoKhv1ppvI_UJ)xFTz_X$r6^xq_C%4_uNQ-ZT7Y%%DeX?bRzMrnF&R}q^<`3t zswC*6sgZHR{5qaE%Uk>zFY=FF{gVfuvN2JlpFZq`V6J)4hM_)_L+f{Bhh8yzoCvt? zn9N(7JloeQU}7{FTdIw)y*;p~Pi5UZhTEUuVV-WxbT@f>gN(vkDvWSz!@T;ZQ-V*o zgS^vQdW+Bv&a}-qMb5!`BGRA+x13Bo?VcZZlre8HEdJylgFlR?gS;{Eq>p~}g~6|R z&=cVuw$JI#o865tSzjBt=iI1ps|UiB?!1>OF^FBe-k;tb9|Gg^lp`ql14khBvT`M6Bp*ef3^shJEh(G{}k(!>@GiEWF9cXrXa z)tMrcbo>8Uq+eb)9S&a zrj6M#YoynZh37skI!W>)GjegAqi75M^rytHb=&NH^e)jHqa=dl^s4kRf|I`to!6#K zyO>iY#8l~OL?D9k|AzX=$SylF4lFLwIv20g#7^9_(y>aSrSb8bZKWQh9^;c~6-MKt zPNUMj#Tvd zo5Jan+gqf1z_+ST1rDEBybffpX!>`3iJ^0&)E#+I`GqG$UuQUkP>Gxk2Zx{jKAK~O zTu_c)6(ZI>klCo|!adf&;9D1WCX2Q!MEe2C--HQrb`P(CQk688VcP5dBJp4EXrEdA zuJ{v`$LZ=)cK(*#B8-J2Z#TwLyrY1{L@bK_$RF!X z8D@eubwnaT{dZPYv+ygTH6*D)Z2p(u*Y9=l+N!hfkYE&l`O#@bFu7AZg?A)bm1Q7v z$JVTtW_)W%PStOk(cR{dq$A%4^d?FQ5&n~UFk|WgJ_G0k;RI5|muvg9KLn#|sYD0H z+sNEge=T(R0GT|cc}Uhxi28SIWJf>0%>oJKed*&Jm0xn$WFGCOk(Q<%GQG2+qmx>O z8ix1=2jm(}x>pKUDY8g=IM00>TeJDJWpD3r=n^0Lj_iY(>J!;EF2>kVUUekp=+|BA z@GfR7XIzU#6cGg`%~>Ud1XH)%ZPeVh*t|N5D`rq>)P`u&;PIM9(;mX;*pI<)Ogm=B+ zpgjB3KVPfwj0elwxAB8baxWhON_z`4;GapA;vof1MnFHqhj%aLEH6bk)oZum$T+V~ z>&A4krtO~KEX3GW@Zh(X01~CiHt0xTkYhdBFzs$W$e3?t#dh>8d8yq`(;r2HuCQ}l zkwW1sC^Xm^ATl0Q*$9fh}y;`Lry zu#b$QXw#o`Z>54BlMSM%^;J-(ZDJL3+~Q_H5Bmgv^Af9v%Unqe8?|FMf4;rwdzyp0 zE?y6=l{tCjjMYry z>m~5|X_pb3M-cbSZ3aQY9YM=#`Bbty`K8wbh%TeylX408k%+Ws2pU^pc zkAVgrig#|ZiWP`1nV6mb{AU^u9C<5tXCH&_tN+a7D@(V*ot|sHU5)<|T=_N0T+oF{ zf@n(IVY%9Sr}@~~+GZwSklFY!GL%0PVir_S0e7H)bW^Y6-WVPGf%vKnc!6)yaKU-& z!B3E7dLM(giwj|*2Z}y^niw}S(JGoImtc?**`pO{PK&Z>{<-c8W z;_a=uc_4$swd|Yfi*QI4BW@7{<{rmZ3}y(GxQU4%?p0Y$26R%9cN%5*&mEqhJ_Igr zY%aS@TWY|;a~vDCHDqNFy>3BOw$7<8<&k=QEGJmxF45lE%3tHEWGxC*}ipw=c!h1aS3b}+7Mb7Wu z#nZOZ*Tb%N^|z*oL|G=JH+V@PqB3-QUrez6dm;o)3jZu_H8Pe@9IMSHLs((Pd1kUO ztx_B#Z?NL^G@<`9wN*$TB&C{=9^Evc>nSn_1YQdEYW7e9^J{+hx+1jbMsIq!=P!g? z$Mm%AzSMB`htYo1+&imUnDO+kO03)a+UVC=xP@b~xLN8f%aZz_R+1#RSfpxR*h4<& z+K6HnlOSNACMQ|0GB^8nf#F+Rs4dG=)krY&FtEq76>uqYHwDBPuLDf+$4_;HDJ$Q> z1QoW$xw{OjXp+e=24qriPeq&LY6lfn{8!nsu35Ibtg#;zg4r(hwGXda(oy1~eFC)w zL@eK?DJ6{@*^3X4)5`8z0aon^w`(Ktd~54Sz2UE-suHU{P`D4ChI2_-9Ut;LFi;&o ziiqu1XPIMMJjK#EU~e67%=|cnD8mmZ`E}0gF(I7d9)ERBl`RE{0%EIj9O51oD)`M5 zkgky*YMfW+kW@(dB^B-7grtYSp>3+;^gaiJaHe`8g!aDEbAP_lpgTkLt1NN&1fZqmMVL_8 zL&Vvnh_N|M>UW^|y)YmS_$px|Od}l9w5^{_A$#3LadYf~74|@+&I3$w))y`{v6Di+R6y1+46WV_L z?&iAoIB|tPfd!6#@_=HtBOILNJvp&N(YJC!X?OHngSIo$V$2ke z@GXO6qZ)w05~?}8AQDUGpIRlfpbj0JMo^+gv^Bmjq3ITgkq*Z}n;MvtJ{uTk@2MGU zz0bTvZ?F&NG+t$xdNv+&<#aAPJ|s(o7bEHl!L2E~S9&#SsT3pj(Vn|h{je-s|6S7N z-fB9zeeo>hQ3_3aN@&F-&J*WL+wozz3zryc9anyx0ou07H=u2s9Mr}Y%=#>;K5Qpt zmaU4PB6=IDIe;sBsr*mjc>(`&!Gq?~L8haAp6C)J+{|HVPzt^y>ZtRB@T_DDLzm_P zg=^e?E(EUwswmWotc?W5HV+KPm)YVuavnmH%LM}=j!a7JUY#k!vadFex2j6;$y|vU za&e&-wE8r z=2Q#jGNif{@2NNG^BsA;IfM&Zch7c5k2XKAOg^&_{iLpT9Vf_~s7_1G9@`vUM`d}< z0_U0K(SixZpyi<@s`0qX@wkdb0m>%53vnB(Cxyy0kgkXQ_)tx{KX}~~y>NxUf(Nu` z=?5_*=+dj-0jMjZ-x0?)Lm>BmT~|U2s$yJ|+3jiJnN6ph!8Rde@c+}fifj_8nOz@? z*+j9*J^opD6x8*ZZNoN)uZ=t1KHT0n4m$0#AwkX=qYF?4R-*cNaE&6Bc6t+u6d03A zO5-z=Eby7HDPA1d0Aq2)>%bxb98%oTdAnoAe)Kl%L-&V(oA-<$kNhl1d`dCAz<~XktXwLG|O- zSBUkd?vL_6WeiaHMjlg!RI-p5-UZTr(Br@Vr~PaybPMW1N}3?;w)yu&o4#0|uHkiarclpM@KwVf!gAb2p3x z(Sx=g;TEklkz#Mos&+v0+gn!N1BD-$@mo$NI&5aAgpbl9bBm+z?|o|}%4IkCmijOr zeO2ApEp~Hv>>Jk)`b}h_IH4y+W>_tXYzHtq_v1gOwE%lsl2ZFGRmsZ$>QpWE zjmnK-`X^oqvkIqBrW-L*O_Smnwq~fF;anx#KvZ+9Y-zxMO zcG}}q`Uc^7gV*AG!CsN&@Mff^47LB72uXK!ik^Tog<%y6ucHz9Fx@r$b*;fnjO7!n zp;PAD!0SDIle?~cwMXr0xy$azP@JgdNUw{FsE47bJ+da3>w$ShzMW1za}8A22WL?d z_=K?(+_ADL*UOped-(4k%76^0%f48PPi0{OhhAA~->COMt^I6!vCjhMTo!gk+2mr2 zt_!SHJO}VV&PN~r@=d9$0Hj9U5h`G7YAj2yyh zipU0I(T{PA#ir;tn~aj=I>fs7s^MV_3V%V{TPZ}j%d&2H_uzsT7K|hN3TS6R;wqiB zqNOkadHd@cb=sR9F3ZQrXjt2CEt;Dr~f<>mS)EN{pZ0~~_#fWk}Ne3#H62o!nN-}<=5Cw?ud zh8BG$#T*H|%TkfKF#rW&=G1M)`C%$D%k6<5h{*QJ4ZSmwd}S-BgJl(!Y#3n}Q||_H zc+j;KQUAkdLCT|gLXSl%G6YqbFR=k$=sT%4Ifp4Nu)v1?+j*PiUNv`wN%>F<`B3I# zh3orW28wvB=;4&BZ!7sHhw}xLrS9ek`-#Kls%LcYU8FU8@7Ls9i%_D+MFtlF7Ps_} zWxg{L!?wPAAp~*=e{m1?zeD&Uk0gdZ&GJ4jDp82x@EgpY|1GhETWjH3b+vT=9VYT$ z7I()6&zH$oY~)J@VpvdQx}+1;SV>jLgE2Zcyx`xoScEnNROKFx8+0Avb5g5tRTaJO z#b{V;DrO}9~!C7`4ydn#zd3P=L6kC@z&n10nD?brBL6FyM-GEa8 z-2bXMdjPttc}S8?jT$FY*}mln2{4OhjCyWnJ#Yy|7%h)oWXa=oT1UKE2&e znaVCyrMsT|3zD=B(fEN-!EUCx{n&~oxc%(l2~(BXZ9ezl(!Zq^WI30e!tX2%dwTY0 zFX_EbhAx}aATET`q&)g`wy?fXE}Hnjk2L-H?-W%9ok!t(QLP%T8%iSqS%52*9hz$v zcSs4TV1CVImsr-(i|i%wdA#Gzql@HjRG0J82P;8w3e)fAbiy@iGL&KX=Cqy5L z387SwRGAjO7wP^q*n6kMP|0hk?+*G2K{%G3UF#+pxw*q%OUF6pBlTbu#iywF6*Skc zox#+9(?LWfJ)qZ^US9jtGB&P`MK^UqGVZ`ikB&! zmPj2`f2e$ac^vks<0#Y!&QT;61~7gy-Ln;v*rpQL{7^dCJZOaKd?6?!KDU)t2sND} z;~Fh3)K!<)>C#HvVD$<6HchSYD5=Y-W%*d~V-C}(NX@Q)0k~xj{!xlj?^B-JS@g%B zPhTs2_QI@HgJhf1`{PK9!c*2_gnw+5Ts>!MC`CBt%;{|@m(CCjp$W>pAX-D+(wQFh zisO|)_`x3N2c3xYWHA6zd3EU{1qJ!<#~D4ct-!y9TmJ-}(wWx8PgnoP)K!Mn)%4m5 z6nEF+UfiV=cXx*tcXui7E(fQ$Lvbtac5ruhmlnSV`n~l2;m3JqGqWez$x5;^!vN|; zd_G+zanDCSlA#LWF%?1S=VnA)D0H zaqy7wvB70Gp#eumpmosbB!Fmc_|rq(*wfk_&eTSui+Rhky+>hL3ixyysygwma%)MK z3UmxtlwL+?zg|&~x3c+1{XvlP_U# zQhh;PdU1=vX9lQ0Ll}SRPx*bpb=zzYVt5sMbbcV_oeFUe$kB=5hhaAD<3(^sg!Y2r z&e*Ys3mr)pOA5-n#a&iU!G-g7pDZW=?9}E?=hCgZU1ZX0ehz+;E1jKiPjXhrQ(!0% zDlr^^YcILxu(vo_f4|g`CZbUlsWR}L*e#dQ_VYvpgvXQ#ruc+f6P=&1?ZA0gorP1t zRRwPzr?(&y_aJ(qhiVbr_401>#dRQAov<(P^bXWRJbUWPXGA>L5&7PpHS8m?d!Ud5 z8Uwy07!1V)G^zHP#OPW352n}GS<8puyi@T7e*Vh-zfP?Cd!$jU52*mgJ|o?*^tBr@ z=vm^B;-u@!2wE#8g2Lo{@`1|ni(koaZ*S|1@P`#qgy# zJEN1u$E%)PRqqH`Crwa}PK8`s!Vg$w+4g6ZJ9W!%j`@Z)Y?iL7mJ<2XGpwe~)Ueve zb#5Z2KYnS$_IT$626qgvim7^C{w_hPz4p7m_ZEn`NLnlag|)_8*&5d$Juff(DW03G z#5Bw6@GZ>y!T$<8X%HnpAZQ>|-VZ(l5t_e1gl49j_*SBfC~{2#I-?2e9{Avzkk89l z(MuBKQM9^{?}&di)KMpSWCwJUvCEWNb>=L;Nv?k6cA~~Y7wH0h z<$;u1cECXeoM5;vb1H1BGRQxKVdv>eOwz}Ynx;yiEC1Yhi{;HvgY3{Z;Ec=|UrUyQ zQs2%R_@)!o@BBZ)m|!@5Dy}9RIRvKk--hi;YtWUjYCoJ!XqP;BMe@gZKOL>~{cc@8 zRAXUj{#7T{Bp+&G%7$ivF*+hMXnh<2@D9uN)Oa4_r4$d} zQ*HI#WTlPo4m%_g3A~GlH{s;LnnTZlW}LZz*ysBpXaL=-{NazsTH2?cpU`>PEUww4 z&({VpS7o-+lvw&=n>wLyb3a|t97%E?5L0OP>(s>0o-P$Jko%^fP+o5CX~W?*($pFb zZ`UkUM3A+VgCB+edLXO5MC9XX?xe%X6#3NbA#!OS zTl9Q5+Q95q2@>Jj`hrBi%5BQ1V)=7~GNmiU9p!=D(7l(W|JN+K;tFPG&C-sm>x1>; ziq3|?-)T6dc2ew^hFop|jyEGj=KWn#EuuC8l@y%51t#;bqTNj5=WD-_umW3Q@Ug!| zp{%~p{G>THBy!~7;Lh}EJVVq)MgfnJ$YbmLI#@WzMH6&mCB@B9S@Z^e&7G~+#PF(d z&kr2%!iAh<6I*8?Sz^-3_^JL3|73D`9H0rGM;-aKZEixju~bIKkM)`^lbxHbpC`aO z@Rg#knbW3R!O0b#@@&&IP2j8{wRoJTN}hbzOX=`%k${m~aTJ>=vA}IrGPG8N1&7Wl zBns-Eg@ads4n1q;4LA=_I5$flgmvD`d?zdick7UpElvVo`DgY&XSdZSCmZf$m&`H`6G>4%wPRpU877_q`E>E1R? zRlI4;&vj)QZ~w)E#KtVY0JRThVjWZ0dyIQETK{afp`ZY?2YEK|Llq!0hgm8Yb@Kz46qc0tqxvl=6osG^4`->JR zH8Hq)#lNktO(@dwAjHcFUv=aj707rkY#mRvC_$u8_wp>{bpo5WLO9=D>#oz(5AWV(AZI3KO2^K{3wb>;l!f66i;lX1JN*(~8Q%`KXhCN(#VHT<@O zKk_cOntabhVP|H0L6N!*ynC!x(nfn2j5NhIJ`*@A4COI3>y}Q1D?|mKaH9b6+$e-b zAAicJg;|*lk$%is<-+>zBZj!_+H6$RDA~LD-PDfeh?FUI%k^3_tltzE60VK3{%5dqI_!19O;EAQYswwHp2nn{Vv;y?rIN9dMPE)EPL%)Zv@hUpR{* zAkLyWa$wB^>O5%3Kf~XK55UzNCd~j?4j0w(FLe$*AXite z&7;THzJHt%qd^DS3+r8#9yG>(;(@8UqF7utg=YJryZ*wRgHN$gY}7O6Q!&v=jz7li zt4mB~zg!0O?ML_}Et!D7CSZNSXrZa@Hic&Lj`N(Ge2k@vG%p?kZN1s6nn`!@An->dG@|(vup@05h}qFf_;;#GO4d z_z|$=ngP1I4rZC9$2Icb7k z`psMF15tS0jw1b36|9Z;jGZhRyNm@kOmNJ^*Px5L){jS*^%r&`58WC~?Q@OaiN2Pd z&e0!5<*h<;v3pFbVl0B|vR?V^E)V`zA|Bv&r{>V*WEei>VMDqPGAEy~fIPgi=YG>t ztkqH+ui|kaV?kj_>sU*eiOuy?FrRG3UYO~~h4ow5#Lks@z%6$;aZAY6Es$E;KQS_$ z)+;V^zrHDC!g81=oGNk6+IVB4Se+)=z@^mjbJ5|C%3sUm$G@DKL*($bs>qd1M`t!{ z8gKAJI;xjz_Ou@I(0hFfu&5q(m8VMpNiI#MGR(4OEogC_hiVzeM3WWt)x=ueW7 zi~MV>JeR_2MYMVy@(YTUgO*DYdUYq93^O1F=a^PYSGY77=!1MLt-0V(I@Xl@tb?G| z5K%fZeG!5CoFNL)OkYJ+=x4zIpQuY%&Fb|i}v!T5_D zV{6ey8wP_7wquo^Cffhgd+VuFQ%#nxda7rNQsD45n50&A$l5#H;xfaAZ*EcFZi_Mu zepg>+-j;3q=5Is%UXb>}!JyO2q`@5&)>%sL_yXHfo|hHu4A@PqcCdK1)X2SEuN`!D>?aiuqLW|74Hnuz-B z&tWRG_aw~;q#JYCu_^Oi*#oZ*gze=y z+QW`93Uc#dP^X_(kQ@*(J2mtDR>^>5oP8eVj@XwsMne=^kg*=N9$#e<=g0{J!fan> zU+cghz|s!44Zz%b=2@0c_|u|J?(vJf6~TBEw7Yxymf7c>vD>;`YBat3F_#V%snAIl z))|2(!p+F+=WpT8=$|YgKz)TDKr8?&5&+LGFS%Zc+U~b?c^;a;V&syXCwaY`J^wqF zIrIqAA!tqXHKp}y#+SIWc&!hyGx~p(;w8(btsdQIUU`59Jhm$qG#9ch<&m&NL|t=s zeOH9Xu3@v+q5kNJaOBRii<^M&_E_KF=HI2D!VW|Q|4d&h*aU9rB6huB5sc_UD056` zCT-*NMOieIE>UxleJ~74uU)hLIBtr1&MZopUyBf*_gtE-alyhVo7!Q=MDEBJOT^Qx zOucXHc)q0#!RmHd?Ix;M*v{;QU~`4JJJM*OT1IB`xiEny*sMKE68`tOn07@` z$p$k*OioD~4uYN8s}FH5=`HnFu`>h3H*T+ zdSt^&ol()kOeQb$upk?bhv_rL_=;`tVSnO?Hr|rQrY!$97n~|s0$oh;`=aPlg5JDS z68kkS5Z-4nS(}nn51P$*A-g zILOO+53?m}Wx42xyO{1g18g-TqsRv8lFc5WT)46O=N1t1Tkk?$@$0n%F zo@E2z>KRUEqTbcczD_&a@xG2FPZ-JrT+_!Fw)k3%ibhPTEM1 zrdj3!w3OP(OBabHcbPZjp!w4G8=O>>s8I|MlnCwvP`HBd^wc3g$WHALTIpJU@qn;eWU2bkh z9F2yuQqn2&2>JEZFG!Tn|80v_eU-=`K^2tGNMs;B0O)XM+a1xKUWX;Ow1Z&B_v3G= zQ)oGk6{?WjIJq?p=84^wr%>t1$$T`2 z@fmlFi6CD>$L%gbS-;>PeSBa_dfP^+(^s2Ku@S2gs=_8%f~@_66ooEnvlsM&iID#| zIH^2D6phJ{A@oQuv_=329^fN_oDZ!-`g$puZXWgHPZRaMf@$h5&vIK^@w$+esh)O+ zi_!OUP2xvDfynjcIn??tjPL+WU9;zYFfP~zK}_3V+$b2C12J?d_ToyauhD({J!Wzh z_3Jjt!Hmg*j>vQ!Q82HH+H$~0J2n+1;YWz^9KbfZvoRVaA2b3jt=ymtSFF_MeX=G5 zikknpig{PU6`rkm8tF&{I(eO#_l!zdG7r9cQP3*A1kw%~iA`O#N|N6I?xEew8};ii z7pZ3i;&bwf4(U^RnxW&CtV5MwUVFZ4@duH$hARaV4ZNS#bI`nOQWXeD`s6 z@?jl!Oes#^#2G1e1o4=DUH6%sKN$VSCR5Rj-1Q~eg&P{Q@{`fw=vaYjA z`0+}8lMZV1vqd8Vv^>d{VZns%T+xBaV`j;+*NNAv@f(n}q{;*nHJ>LwA<#W;R85=D?1UDwj@CUA@*yAf`+gMJ@{x~XV0&6+lp7~p182ADW3lhRmD*nQhP?O0 z(p%fWPg^~ebL-^yi^plDy<~WB)os(y1>qb_<6!zxWRC9%^pP=QYJj0glftaBcRf}1 z{qE69EhB?sAgYx-Z1wB1^v3Z=k+tBe1u>0Zmi1FiCxHxRe$wWqS1UV0K+U3PJ2+3j z(LTY|StJy_eA3a*f$Z4K!#bIDf1z;6KGDXe20X=*dF|Z`QD{Q1gS5j>Vv|5q5dV)! zdOnRd+4*qdHp}2Tv)&xz>J?)eN!Gi(PQQO@kavItQUkw1(4mi@-$RR+^(HtN;z56C z^9_QD`L_!@e*K=X0>X{$O*AU(=U0=-bmjk!j@elN?5thXJJp&PL$W7_dcQPhKhR@* zBT0F{)s&>kImwEtqRK$jC3_-|eTwwAy$6s_*~-(lBO==UJA-?+yti9W#f|}qpXQ}q z)@jxg6p(uCaFWE!_rr)gRGZZ{p*`IHG=tZ;s$|MPy0G$31NE&_w83_dj7R_Yn}LZcP~ZlW#C*s4BnQw^!` zx`?y|+G9C}vnj~wzgbB_SN5RTA3_@-#V-MG ze-`dZV$SVdia*S45PJRW=Uof5IWeF5{(F5)5%!s%MBEH&n{^%$ML$WCK&K+>k0D6! zqA9SW)p0TDI;Z%Zi`H44D(Q@wTQTLvkoWbKqjahr84_Hc_w}n}_sikvTg|-u-Cu}X z-UQwF^9Ik~g_k365@sZOXI?7E3&mPuN%{Au?pXWpbvknMaLIaw-HuD#W}2m?f7H|b z^1f6*%=9oF_;8(BbNh0RoSfgwXrEnZH1ROJ*)Tni;t_dI|Ke6_$Uo?Qg>CDCf0Ku* znPWrS>*w(42wkYP2wNZH)K6;V4poo+O>V% z!m(tpgMtCaJY;6<1S`(X_Cm?E>0_=@<71xVNyfRt5=X?oH6ce!4j|W_FdV0b{K&IQ zHLN&Oz!Mj)=P#En5;H8A0TYF*4U_s<_}ls#>(>D#)E2?ES)@9HB=+`9?FrQ5}r^j~vqd}*D2x0F7GBpqLW(_C5M9W#?{G#Qy z!DH;Fc;kf<|&olb#PsJohx)Rfa@h&A% zL-gghkt7DiTkiPr>468ND1)}hQ(}GDutT%DuK#2qbG@7N$JCXq=ki4sT1>38VB4X% zZA%{quBY9SxbU_dxF{&DvOY(zc{divS?tjqB+WNdACyRviA=#qVvk$=u312yU@QyB ze7~_i_Va%y>jVRkZByie$V=M}Sg6Jy|jT1ip%F5%NdYIk7}F>jdu&ZK9xLzo`c zD}Lpk^EFs6etGU0zdktM<}FC=fwo239xY4$>Exr+uxIOM%j^^F#}>IXSS}rLrA9#-@u;)BT-$4d+mHP~-J!jBL`9%x(JayAOkW^9 zVo#>YqE+kW`u#yzOffIL_EV&Rk;8R)E3AARDXBm-^@*0QERRyJd-NeYYz#ROEb|O< z@bt*eMa50zN3Xbrvx&6{7CSTT6E8)7_AR$38yyT;mF?c_1O^7r5^UvlZCM2+a?6i!M|}j@d;%XyXyEq2}N{ zJ}#n*%aa-pS0LJ2`A|C+U`Z$4nRml;X2g4MCv%m}GDHm{LUl_g_~(8U#=3xkhZ=0h zlJ?gXL%rzIqNyzTlB%a!;mdD^`*#Jf75TGJR?3HdiT4}$feD-SIfOveBiW;Q-#Ot! z@oP;s>%)t#5&n3*@xsO$e6%7Qe9!OWJaqhM-vS4b$XBKs!x(3?=URNq(B@Ls#qmwk z6}H(m`h9^$20t3MgQ#6#^_fKY`(wduzYSD{`BMs>8Hu+hcMSogtxiaBs!4itfuYL`R>d6hN2@`*!?~o3->acH=o?S2 z_MDVpmn`*n6?mhvWiZv4H7Z{wO%gWbti??7rV(cKqX8OG#t^~q_h48Ky+bS@a{{FfvoJ+HT=ZH2V#y{DWqITv~zr!q#U#+`cEjyctx?jzS6v% z^Q2PoXA>NrcSbeVP+3w{A3HJ^PSe!xunYJhSOyU~QzT8=xEhM^&sDk%Z9EWIo+wk& zN>BK9su)K#Q@XEskjhSiAw42fNQL4~zYEF1CqRpTO#d*1K?LWcOZaJ?mLSO50|C0! z#@JUtgPOT=F1-b`1uH0PxA>^)F&i+|GE zH>0j#F;-=(+NCUO??0ps4}7tcf(NV!*58v6ZL%F_!NwY|RoKeq(NL@>=2rBoVGA3O zpyy(ILPS6Xto+;Y*n@tntduP_B-+-O9e3F0ud!08YE9ekbWsx+hyAKYeCvCZ@!3jF zi*uA*bW{AQ&aq~q(Cqf}!4&7wbWo^$0hE*rpvr)A*IoHTvRP!kBzcDcClcXAumBsH zCy|q%Sd5t4<@*F-xgH`q@!SQhU=pE2B*5OkCAb~-+h?VKo}rz1Uc#~dBGJ^Jy4KJO zzdfYV1z*|bH|g3%niLi6lPXT0#nL;Wi(CC~S5Lcd-UxV9FJRNQW*X8Pm{o1D{at|> zXa_n#FGSedA4;IO)@~C=tBM#HRcRmXjnA#MDVI$5wTXllG~!j=`=(vbQ+5q+r2Gc0 zWR1llxGc;R&#`NUOhONkg^_IT6f;V}@zsgV=5LY+))Bl`9!pHUixl&QNn<~nBj{m^ zk~&Ni*|K1WNaxTLYj*Gs)Yz3zOLZxA`*TeC<--Y&q_{I%>hFf zvPgfXx{W~#gM1^R-i0+toZbkfv$zgFQ8}Et=w*(Rv$AFTMk&;Gy#!`mMs`ig4Vw`uPjL znIO)4O*L|rkp<6El`Us(a~Kp?O>zC*tYYWK6v&w=LBBGxkoUaX+8x|VuBmPugM!*W zQ!nWIP-J|r5AHz&{z*&YXwNh&#et<0KcF_`z_h?7-@+lUAi%V4(!U)~OQh*S*@4fZ ziEr%|)0F-`)v%WHuWk-Qsq|v@8A|(c<^_%WVaRTDNc^DCqg_&TYFA74uTZh(g=^p` zV(*w@_$QWB*Zss@LkCGeF{)!5kX$50yH^-M|69()zUaY5CB7V}bXY(f)H=1&ZE{EB z$b~|id%m-izaONe67gvu*lWFC=EMr|z{d+!e`H zTncPabf}KG@dr=?|bp7GSUFJoWVtb9+y*}qas=K`p?Wg;GS1(s9w1@`?dc= zrRq6iW$Ni4vBY?5sf>j4NcLdWb$)qvIeoRLz>1HvX``4kGykL`alB`?o^r*)P*(o( zIUDo~Ui?;L9P4K@@va%Dg}h55)DLx#uZ25z3*E@AFjt4jm{Bfa%Wn9LyKA(g+1MKp1BpdKJ?zZJ|m{2V%(T=OC zrs0stl1I(d$iWqBLE4zdLRH@w{Sa8IY^)#2b0q0rE3+tgR%&oS!}u~;;4Q3;&HRNwOe>6bu~8d;)#UT#m#|&z zR{%Ik&Rc4qU?~D<FwE_PezIvi(LHphvl>jyqvr! z3vmoXUoIHC@<`=3!aB?EZ*UcAIW<)O0*BfV7_+aMswgNO*n4IlJXHf|R^M(WuX7CY zj~EDTHu9zW3;EzRt#)Al6L&F>o|JplPqH3=mS=IN)hfA;J8F>5Q*IS#p6x4W3_C?Z z{i@K^pUl00skZ(l1G?p+p{OVp!@&PRR=bI1y$H)RPhpx}gXQlErh|$NziP6epcEz1 zYj(Lrk%sje5S3O0eUaZEcmiyiAUA~yS<>-fZxsDMl?&&Y0;!xSS&!0-%B9r`gVtb1 zGM_}R4S8z@1eWX6o?a;Br-I2AnSeO|yGtZz2!RnjT8oy)SFMgxkqyolv1mY@vjV8+Hs1Nw?YU9-`Wdu-GN;0vo z>8mw01q8ymEE)ti`u9T=H#`LuiO*3WrFeI{9yxuVdY@WDsk6$Dyi>U?v#b0${!W-( zPv8566^GQ1!=OW=RrLKfI{s#42nG#Qmi%LMqY197HwMw2yk_D*v}s;VJ``+)zTK6$ z`WJ0Zu!=L2<>V{csp{A8YOpK472z?8Rjtw4k$P+nxbG>AP8THR(To*^h6cAE%w0mZ zS%YV3r<8H3wf^hcERZljr98t>KWlPnt#mZ8o^{M=iM1xg-b6<2kV?b~4E>HWgh5b{CQ{mvKcpS}aq(_(#G>tteRs?>Wp~h(U?-?7rr(?po-^gybmoCfXA;PCZX;GY zS1uDF*y2}Eyt@J27ejMV8Pz`(-5VS4@YFYC*B9{4dB$KKkJ# zv2F=5*wO3ms;bI_`07GsXCb21(BYwJDZv^Gj%BEe6EKu8_SZPFtT85o0mexD!pKgA zcH{YmxXVRz;Yc|o7}<=3b{mLb>jAcR!O}j1#{WKNmMeYc{^6JBoJ9(Kh`* zgE<$wM8Y;`iLB}PY%n#)35=+$`fTVdj%zpI!(`MnzllR*+z%0ArChA7WB{M`I6t=M z-a8f@?R?su;Ek$ERDUoGwHm#7M!mDvXHq_)R>=JBRTT2PtDXci+yx8Up@{}U)w-Dn zcD&Hz_DFLAnaG;%|1>hJl)MF`4J#z|e?Is>hd&iaN8~Ux^5IRSr^VvDRbzWbkCaYn zqVFt=I?ErJSyz;JrGb%TR#}=72Pff0gKxzGZcc1DK5741TMX%6m|v5X)hz4uFT%2R zas8|foN1C206XFdUR1E$s7;y_Cgip;;uG0e}K)r zCG~@+*znJQ)c!d-V%HE$111sT#{^{J4O=1*<*1xo=Op-N@*a5bWNoY9DcT*rJexey z(u|^SEG7?%A-Fds`Bc7w1!)G96K?@CmXC2IdwmE%kEKI1dXYWik3fZ7Ri(qN$4>^c zpPX8#D3VH{`CI2f0#v6hgBG_|lI1V(L1w!Q1*1C10avx$u3|>P2VK$IZIGJ#u3=cx zS_$#>YpPsKr=n<3LyKE20<8=btR!$LU<%eWd6f~0w1)VZPo6j1wS+E3pkjh0SrfL%2KwN0rzv!+KolY4r@(ZCXYvfz;Pac-R%Z&F60CH zCD#slKO}gZJI_U06plr6fCPFGf{bG}xnb~0sF6hE=t|df41y29C#}DvAj}alp#n+$H zI{9)RIeGLnDrinD$eFjgCm@`g9dU;)$z7AN5vwEx*#@lwvBa^jj;o4<;}QLc+pi}_ z8HcYiqdGCb+AEg0-e}b%SZO;_<*gkJ{@JU6^JeEAtkC!6s?mD4B?gqqS5cA>tBt`+ zJ=B>iaS3t zHAV}dTRS+_V>N{SRpkT=c!X4KtBA~JJELT6gfLlX#R>%76h7UFmn_(M$Pall(omu) zz}__szl-H^h3yK=5;P;$rf)E?b;y6y`%y|GP6N+Qn@#WDbUkK+B>NmscB%^0DbE77 zg>CO3yFjT6LAyuJYX*q?PF_{vI)LHMlKhCJ}=IZT1A;rgm-@po5) zotfv44Tt{#4`drEQG4BNb$LY(IkCPWrYH-sE%f4 zVv>~2Y#&)N)FDy;WTj%Zg02I$WX0WdC^xy7P#)E*K;N@Vo@vBgj$B4NxeWuBy zh^bRPtfKdXE7i6~mugY^@x8u|=Bsv2c}VuTn3CuC5FO(e%#$;mmdW|6ol%6!NOITv zUmE(VY(6THe)K5GDKn^1*iQvti40Vho~ki5V2giDB!9c08rvy2W_L%D9QOMjVXyzl zEn~uNre6lSRLc*yc4w!S&p{Th$G4{OtEdVI*1aF%uDi=uMve5K$77Wb$r3*V&62-F z-rq0Y7yQOjX^dOJnW!}PW3oBg0Qszd=sx$>u-UIj1Er49t~6IMLEUng!WAllWr3+> zYx5$nn$VYIB6F9xT;hRyO}{Gn{N>B1iq&`>V0}FlyRt8LRJOj&y_-DDidnDRZv#$g zV}5>TWW0H<#&P{1&=Yg6?RNPtXOm9&X_nL2>i1^p&W!Q$A$$JCJ^@nQ;b?vMPnDK} zu9o{#XjI4bS%byEVcz7(ffPY4sl@%+8QjGc58F#S?Nz=N&MMn<>&6>X@mNza_^_|E z=#%?C=Jtgu-0ksu=Is=>ZaP@TWGeEdD<|efQ}RFWiM)Qg^{hd3O4kTt-b2rdc_KK@ zGmjW%4ioCj9fN(&ftOL${%%V?oKub?rosfQ>VoMYu=P)4RnSZfc}BThW;v2i6H1}!Bb@kWFJJl|h$eLX5>!fH5Hm!`5x0?}{%35v z(hFFc)h3hIvy}fDTXuy>@tOmG{JkmqyS)O%9dRMNlx$;<)Je#i^$^}J%5v=H%zgEC zWOw=e&r>(HQfTjZ*!P)J>c|BnugZZJq-GOU1Epct(1Lo?$F)D4wKH<^?MobNr^)52 zh|8sydJo5jcb!hZw1gH4dDfbvzr-jYLpz*TZ_Y}pU*)MPoJoybYu)@EJS$8sCXgYt zL-3DSwJ3Pjri9HL&FjJ$Z_>?Ko7GrT)+^Os7EZ>iz$#IrfN=~yn{9_6k3+nnVYzCk zrT#Ec%-Px}6R-ZY9K84FL!g9FVbUt~q4^rk3&2Rmp-q*tSu+=hGqq0 zrjtb;v73elJv{?m4D-YFw<%N%VAgA9&+Y)qXd=bGijp=}=q0mf$%HZ^chu4rFyNA4 z1)Wf%aCMm@X=OhZN@M8k!)dCzSZg>aKlYMFtF=}$4H=YI;7=IPQt1o#tuCbrQbX*| zrP<;(w8Rzh4iZAN)&CegC@=S4>>h1#rC+!=Tsesf$jy2|R-lT(eu3lr1^EavTv#!$ z^AhtgdRp#mTozhO&8qn9zerlM-j=yLKASQV_tONCLsYJ*MYH1!!6?wY7x2T)DhN<3`;tyyF$1WJe8g7Vt_RJD!sVM*;L`R zbrA96cMYbd@Mb$dPZ8b0-q<(Z1)qb_y}pogd}98yd5<>$Roy*6J?b~8m3vcvoHt)= zxf!AS(CqD2rGCt`z)bKP=LTUIOFAvObG3nJ+`cvl^}*#CaNXJU;mYV6UX=cZh6 zSCT8q*jNz1>SpCddM!h<+5-Ebo-ye0Xl$o>Amti?ep5=VmFb^-F&&Jj54HoFdlg;mv?eA!O>~51%(y?qSMxQ%L^U^V z-ZV@pWR;CV+}!d;yi>lp8M0%^7cO8>;$O}~F%NA$<$aRR*nD!n0Nl|!;oSN!h_9M9 z8lP$=qH_9Vm0c`{;L+IeoZv;(iVk1c3`)uPydpD!K8KPcd_S+gwn1Q2$b914H?nWc zZ!L;7<$vVCr4;y!)7DM@xT&XlN6cb=T=^HIdQoI_fgzUhG=v?A=2&O}1Ahb2g6?ZNq#LY1 zC`>$N|F7uLx44wvutH^yb4AbWq&O=KN&_FqQAy8nn63+&+2u48uN}Lq`irN@U7A|s zI^7efn^i5aGGLmEU4F@cfkcem!C=|*C;CWh>oH7W0L(sq_E?W7?*^o$V{oj`(1D7W~8pNMzOm#V#4apVFb zg#Q(LVou#iY>J7jCOe}@WQFiKj+w=VVmG3XIJ3DX17~=^>TtcW^HP1BuKOT(9-YDL z1e-hvn!241i}obH30}E^>`YjJcDb*4kLd1|-wC-1HVo*nVTPQ>P^^)`ptHV>AAX_& zcm6?pv!lOJ5B3=irD%-3T1QH_sSm(E0G$A6uF6OpF z0F*TNeyhgt1fA5`c@l>qL)xL3D=`$^8u8Tzm@o03foA$+mO$s`m}v?fU`A{2pl*(2GyIywVi3F=zb z9lDp?^hEkOj^N%9w?ixOP@t=ZnV>!NO$D+zpx@rSMpv;t=x^FQ8eD`2rbVfpeP7SG zy}&0Ll%(_t?#W{ubIX;~4-`<^*cnzKWkV)lG6g8cNBYrxl!3n-)SD?C-^PbKtiu5o zVCm+1a^-P`QcJdvDxcXSj9DKEX*R`ugfK0+3tyTwQrS|HGD_wuGG!iJWWiHnaf}K_ zf>g>L!SL1qu~X$`xpKvNkm2nc^s z3g4`s2>TKO#zOoC%Dog}HACiS`yFbaPN%uh@?OFF@JnmF6NBo1@yDcj;a`sPAG( zwNB9HO^WRrn>|0BmlJ6CMBRAP7y8G?+7vl0@pLt~$`!KN0})oK6ljrR3`4X`nh(fz z22dM@;^o&{TR=f#3=CB+NM#xjnbX;bnBg#sg}nDM4a`nzNhUCy#=!tR+$k|sho2MuE-S<7KBPo&RFDL1-0SyAM5-Ccv~e)u1rS3k+s&(0PwYx>Sr)vRCK#{~;gBB@qP%vl^&Eyl8S^%g1m@-&-Dnk8%^(6; z4@)*fMWk1afeW8IqI|cMg67?c|Dh-Bxtt*OEf2f(i6(j<>XP;TdoP-~%G2n(bxXAq zoaBqO1+l~2xwf5>w^*BCmy|*W$G=?#KBU%v$q`Pbw|1)ifcO9o0&Np*QoZQ!*`m7J z0zvL+ko)YRx;SnJ4QazgwQ}@Io(^_AN01g#OY?ouYrq5hEB~#%)%2Uj`VWZD0nfw- z>B2vPly&>-f@*AIQf`g9t_pXTcV@}E*1 z8@99ZQ08+yP4?vV>e4TxxU$I&Ee(mzE4Ux~I6Mnm7aH_xaSGk47nO6}z0$q){S^-f;kep<`EB^}*b5#WhP$vm ziawf8;W05(%8WS(m+H5iKRK9M{IeA$tHlAk;xd6FA?BI;fIr_95Zz4`zfx!%NeNgN zYRS}z_(A(!fv;h6LFTcbU+U9M6}bEE@0NXn!B0fc9!CTz!^r!;2q3lAY$N%0Gc`vP zGS1k~)v#|E{P6iVGnWi)9Pt0a%ei#Uk!H2Do%Mb0=g>!b;ZV{6e+qu_VlX<*?1Lc~ z#FkM!@f~pPtaAdqdn1Xb(Tt8FUvtB-gIi6_nH}WD&nUPKAaC)3QdCcZG*Syd0;u=`a&HwaR>HwSq{W2GpRlbMt zskD{1SO%Ca9*I!aARVjY#k*U-?70@Z4LcV-Z`l~j`KOCz=7fNPy{Uk?g=`+cG;kzn3DJxGU^eZ)h_1%Fh8KVR)KP4#uS9x=3jJM&Fg+4l0i|<4$sla|uq|^#qhoC0olXsW+bJk8H7y1&!}(jp4{MaOD8IDBK+N z9H#8a%r*w(ekWWe>L2{Bs%?S)mWm-+HjrN{IMA{QDYP-J1c)j_*T(vg1gK;eCl$Km z{_0MM#dU_9p6`k3U!m2wzdo+?8W#wT@$413RoPE<=N7+I*7A&twws_akC1Bghbv2L z)84K#BiA4^P*3V+=*cG@#|AGbYMbSLZRe}AL0o0EcJujcipurr2}M}8t6%_J zPtpOR`_{hfGb!=gAJ(k4Ww-w384a2S)tq24zRiV~SxqxLDpX^Dy#};~nl#>vJh;l4 zQ2uPT(L5!M+=iJyXZI&hGN=J9PZ_e*h%wesN{%fOi*^Ct4lQyl7g|?MqiQxEkQ#hv z;P163Ato-=8usID%N-2b%=qDCZ;Rfnj7T8foUyI(9Yw6>U}*@gDEk(ERpimRIshs^ zWKGwCd_)nMdTSln4{7k;J3gSfD*8`kI5(f6F^Im;!KZAr%#Ki*6$eJ4jEbZVn*A## zi1he=loI!{Y#~Kc{!=MuTBc8@ zN;-hbpOXH0>y^V9iWY8lYU;`y3o*g;I|htjya*eoV$EY*j00 zx#GTx_*QPT9@12%R=im``(d-LX1z#&@MHa(yd!?)YCkP^*W1bIqWD;E?Al%~5de&H z0-hQ5;nU!iq}byDhsg0@5L>_sV0bz=yA}AHcEY+VX(9$Z4HI~kw(P$o2SGa? z@Lz6K@0Pp$M*ha^c^p(mC-JNH>~L7WM6R8U6^{1$*iIuGi5K=y-@Ub!nNgijP@I=j z8kh3qriQxHZi_B&X$3U1NZa*i=+SwSqTG}_twI(;FE@Viz9nH+J3DtOdo<0TaoWOe ziCNN>y&&6%pv8F9@);l`UI-h=u%~*4lm5r${e2N=f^tB=TkO|3jGM0c*K^6 zMB{Qh5Rq7!iPHu`T%=D%*K%IYkk5xm=GCU3 z=g+`!o?60lVuF&=GB4itoO}v%(0~yyMf7Su{{7SfaDyU0NSZqf&TB|vKgf>JQ#6f7 zN5WYHrb3R%J;OK)u!IWqYDgO0V3TD^)n%k#Dzd>xFtUlc&>znj&X}rR)|WSVpO;qk z`6u9U`=$x;sJ}Gav3DXGZtb&_Efsc;;M(0kgh@3$w15{NRTBj4>`~(YpAo zh6-spV@e6<#ce`4C%dmZn-4r3Q0H)kwBz4%qEK0GbRi^KrzWD<#zW+Pw~eZV@ns_q zB;b0l)|Kd+dTu*zv*~bWA9eaJ2O@Gs+h@)E?rB^akGt!xcdO^dx^+XU>b)QXv&OU= zZM&3*w?bf~mfFX#rJ!=%kR?Nr#2>u?lHwPIL->lt zZ$;jNK{Vh?p)W?o-+(2Pqp{Zuexa}@+*o#imh@mb*y*eKicgRVuY6R0rTD6Ha|eMx z<4?hZyF_yJ1_lP0C=N`(&aC5D1Y>|H{*bQ=v>} zmJv*6r|c*%nQKF#>XQ|0neGVr2YbWo8-JB1M`57Xl=Te7k|zZ$xDnsabw?bUradVH zeJ8N$te%2jBLI}tgPFi+A`v`fZ~d{G1A!5vJwMLXrnY5>xGdY=NwP*chHWRH{5*@M zCWg~0j`>K;=RbwtXYIDotaoH?O8$?iYYwmbdAe=Vq_OR!v7N?F8ry0b+h$|iw$a$O zZQHir+kD?&`v2YM?z5knIkRWZ%$AgjPjH=)?BzF7U6BYc2Q$o7-t%YHaLyHVuxZCG zqNe(^j>|u|?C>oVq@BnVP1kwh9J^EjYmcuT0=U3Ju<+Q6b7l1KfLO8>+9BV)O8GA- zAdrz2jFP|NKsBWuHIYaHoO`--^!^<<^35;3=42f`4i3flqBtS)#8s`_82c~X_7rh8 zFr&283gai+m;1|fb!(Pz_Rt}4)H%)BFpnv4?{rk=`=&K_#=r}mBzuyG``>VJK z7f$RouZSS5*brKc>FG^GvRdZU{^i_;BrsIz2)o^bWlx6@1|^qGBSKj~S$% zIUU|ccqTMfOo)`y-qPF!?%A+4>{g$}mK*%Ki-so*R4XmL?*ClAb6?2NX%3BXIOukQQyl9mBWC{OHj?DZY~ z!C7qw8DIf{yU?U*gQ{AtoLY4ffr+R(d2B5q;I)Yk5d$#bykS6ebyTYXYt zY!>D!a&LR14}%o3s67i>_Iro*m;%qdj`j+1msD7zC(#G7Su{&tZ6+Xmb>1gbsJryA zyRVc_)pA?U8VGiv^|2{fL0W5w(SC-&SFF`9}2QTfzO2Sz6#2{UG z6m5*XA6Q9%pZt@~Ss(Y%IkEs2Ibs373jnNLJxGBEg9T8lW!>^0OoNTV{4fNMi zOZTV6V7%Y#Dtf^UoC(nwPYhfItHTE^%RA?k_ovU#i*6+{eMQ0zDy(TcaU#J)?dOXH zw_B2BUDjgt7E0FG?bDi&Z6_sEYB}9Zq0Vd%GEK@6&V-a&0W50vp|52Cz!Ad)m&B|` za|Ua{W>Y*K+b(Ka4?$C;>V z-s-o&y*7T@PC_?0H``7GH?E8(c>^fElo~+|kMgZMZ4is@3zBBK%)?xSXWPab+5I^jAJuAlmtb_+@^eFg6OzO>!L8*A&BtbQAlmYuZY*YB zU|i6oLH>SRvZ9PdDVZ-bDAYF2sH|`EsZ!Eu1rIGoXO@SXS>F`ta59AE2X8c}7sGo4 zBVKF;KQFp&F74PI=VCQM(%cJvMeH9l*GjIMr;tC}kGG7OcvVpCoATu+vdtWmPJb9m zMpOUJ%N0--Bm-_x#fC*K!JYe79!p$cz;D!qSq061>E?;_o8ABc-9M{ zL`31>%rA4GlX80pDk;(tVB+H4EVdQzM(!^k0K` z5F-xcF@3UX!as-U#e)vb%st+ipw>HuWwmPenc7FXHM39kE)cZzMYhJHBxB$pi%2< z)*XUI5<(0_LCj{?)r(foYXPNPRr>~V$(2aciIC=Y316S&TO3JMUP&7tV3f4S4!n_D>=dxGAeD^okyb^m$hH=+D;j1@Z z+uGMno)yM=-&kPO1(KWFMbbN7i+29(hToK$kEnyVGU+l(bWv%xuP{tzJ8(4)@Yd~X zt!xoCz_PVnyP%o54_?Y1wRk8mJ7oa&DZ!GrBpmXW8y_46ie<<8UJ00W|L?sWN)d#3 zKv^@^3TGQ~n4$xu;sdk-5}du1-}K*C{Ux8o5D+Ka+eM&q9)6bIs_rJY*1HAgQCF|HiV1kwpVxj_~hZX}iF$EFtv zaI}zoVm;JwuwT@-k=0X^A{PZM07?@ffpnfix-t*&Pt1y3_@#L5@b}(|(a}@FMXi4W zPFD=Jf(I4l<@9;l6~(Drc1}t;&M{cX9W_#Z7%U=r7<# z2?g9nCu0Jp%gY;k<(mi1=Oi<3}Zeq(TCGJ!h?$VHq!&CNa5x6YDW*Wiao z{|OK!o+LHk#jq0jEYj}Pe9b@;t(MV^qqVj5sQO`8-N2k~r5;tSvwb%;?}p{%X;|K^ z5v|K(mtno0=;Pk(0R&-kSGLPGnae2>p|c>7iXnvUWZQ$qMi*Vikco}bf?bcrqh{BF zbpV;-e20g-S~+d&-ocVHsgGq}8@mmaO;{Tn>WY^R!;O(h1uf_y2XNF}D0Pg(tx4(h z2tOh8yG!3a(b^w7xaRFDs{PP`U|SjeS0z8TrX|tq8UNL`WrU)?+-_c|+ z!&(Pe&-K+z?7WxVC-a1rn2??A&$nfB9z%A@aan z0IczCMjE^Ny`wj@a_z&?+)EG9Rg-LhKnL*4xb+4`Fxi)4_<=u#Zo!Akh98HqgszW#(B zUajO#5}d#f62Xa{)0vzlmMwxSGaVm!U!dqsbISyL7Cy7QXvx~J3y=%A1eoD;DqKMi zslT5BQl0B?>ry5?B3xfEMGtaL2cScYKtj}AFz-j$fIQ7FjCbkpfu_d&XVSJ4(czCQ zL&E-?PzONq;j&v%w!8zh1JKYD9b2D)PKlhJk7Uyu*rb%rhj)yKMeiSY=|p0`O_dC= zY2DlF?1BC2PS-5YTkd(XixnK^xLyfOQ=32rJoY=?YczyEda9hhq<(|#%VWL9po_!h z5KqJAnrmmCQ=Tw81%z2 zm~=Q{Z0kqkH@$X8!aH69k(U@$jsOA|b1U4r#DCfq_k#oRmt?y>9gb-8WU!cnyzt66RdCaTI6TYQ;n{Uppn&=*c7&4JDO?qWEpLUJ_6*YMncmlx*^Y zs}(%>?gVF2sQb*@Q)DO0XroZ(^aB$zIf z*)ZV6vPRjZGvG}FkIPf(6+l7~jH1rK@=E<2Aj)fC)4*_X^~j(hwme?4b|Nzo!><28bvvOv#p z+kkn{L;bE|InS6+=xoV zJ7!<8ksu=6j?8`&s;~9otaL4pz`-f4xS!K#W^(^deNi2xuO7s;d1U4np}m;`zt3ZV z6C)gJ3C)s_%>@^jjKaz=KmNJNakuH`mEp#ykm5S?)g?g;vz~ z2}lM!_4t@)r>|#TyOtUC<*(p79^2B)+|$Gcm@nC6G#(ubq2edJZ^#peK0FQZcS0`) z0(SQGMfHD30>f!$Zdt|5(q7Z>jwB1e4W+7pV^3yBVHV1SCcUJwUkTL~Sv_$d^;UoS zFo&w?7|(gPzqN;t*q9BP*rWfl)2}J+%Vt+fa{UhV>Rz;N@dmlgE0RKYnNZp<=%MlV z8Um{xiMbxM>?ysS)TINO2&Ej+1Q{o!GPpcW6ICrfNl=$Q^`)Kw^@FpD6qbs_TrTN{ zwiKj(2aQX-#pExbqz-T=YNu#9F#GhWA?Sj*VHo_!xH5pj^*+{qNuZqW4x`H}MoVEo z?lTMT@E)x0A1GbqY^@Re#M!Fc{~mm zlvsWTt$*Y;k-hTFIph}=sJ!ETHnD3G`*%6FWqD!dBxV6hvhT&9BX=gkWHPIJp=UFlPjef(*n6v%pJ*is8p)^Iv+U=&xSU83J*?La~}P`&Z`FNG`!g%4lUg5 z-3!9vHBeC(T~K_01LuOR*G+2}j0pkOw!@=-g0*hE=PAp+=M+`XJB%_x;HU9(^t%=q zN(11%hU;oaO|2p1_bS1-@h2x^lLcLzNyY4$9H zAm`&)rEP&d3#S_+sYgyhIL(MbpA;S)nvAuuGm5Fl#qvWUDQEOU4+w)_lwlKm3QgDU zVk8flPOm9DHWoFI-l~JTPfrU&<7ww^EUxq%>RueAzhxLBRjwUDp+z|_4m-=8bsvz7 zF|!#*Fdt+n_B5=S^r-(_noASES(BTS!>o8E-m{nb>b{TDBxgzfwIY=HAou2oFvH_3 zG>=o1lzZd0G{NW0fkg7NpS6RSHQ4}Lm?SK_gt3fu;3;ShW$*W-*{(a5Q#n$}p*LTJ??-V*j+FZbgwk73}v$Uwg&MO(A0m)wHP9t@1&8b|IW z4;UpDPU2h_B`aRGU2E)V)k;HOBLMg9A;fysB_8H9yy?Z=^^}eVR7fA#oo_7(u_AFn z(@G@#1<{*1mP)sGSTPidQ z>@B|HJy~!aJ_cEbD|rA+>}TN3ToNU$!&ywp7=`n0WH_LG1Oq%An##wllmBxkAGQE zl@i5VrObu4BBOf$7q#p?vpObGIAc?2`bCD=yQl;)CBQ@Y3UC#{c@;?H)s``0mdZ*!y z{xsz{YjP+FQtdfggH=LpuNL)XpyJf9@C=%L9@e1v=Y-Y;z=A}A3}0NiaFgHeFZxo~ z^Skm}oQl&goy*@&`rM%LcSpkeu(|&Xs(aIE@)#nfWYGt>o0d-|qTD?jCJxP=;+vKH z=r@l>>wd5rT&5QxqR2xZa)hh;F6x81T}FWo&rY#fsrGSJ-9elSW{y?I%-wo*f6ppa zU$F9mUD>J;mYwbeS(cQCj~H8q1biSOU1km#^9AA&ESCN*ILbD`z>4enQSYe&n(K8= z&{{#K>N$O2uc`d*X{h77aGpGkgSCcDwbr`22A~TM-c6_l#j`w#MV#s7OL|_T36FSX z`RIx6w6EAVn7l)6>I}GQ0&V0$$|sv;so>f)mlpyqR?D;HRs$-)WJMB&-!1EwPE$>) zO!@v)3rp!Tf%moo^=$i$(a8zu4ltWdSdDKz?hA{sxP>&PgSjcC#6qPe0E;!1sCMU8 zGtnlEc45h#HbrYzsik4%8>v@hC9EFQK83*XLx&`wE@b^78b_r5r#?XN6Dw6^zvd)e zcg^63a|R^2sP3HWms$sy#J&q}Bt~M!AM(fU9NK9t9SV;~Q%_U4v?f5o?4VJQ0}8R`iYP`VSA^#e9G#J#WHZZbkc3lxP{x%L4`4jU)bq_IWsN@Lv)HG6EAL?6NqnTjZ|R3i^3q;u2cxhhxDL?@-d5hw5{i2 zalIlbpfa)ok(_-(0g(0ovT5zRFUuPvK&No1mVdKphonCPy`09HFSF&cHXP)#{^7zZ_4(6?S~j;QcP|R~-uv4S6nKR&KnW6CE15 z#r;CDf}{@CD`BIO&O)N#eLMjA=0T4(_iY^qs*_LrZ+W`&ML-F_ue*?IzlB$Ce`;yu ztwCG!(JM=oxqHM{w8@S+*uCt;&oCXdseoa~)B9@|u}D;^)+pQ3ES>YwpzN#G_Qimc z8Ec~`$oXDNw@c_Y4H~U7DX~+4` z**AFVpy^t*$DZJ4nubRg1fb{*W^wp-C;F;mb^iGojCV)RJu*eecj{uP$NoWJsA4$} z-k$60xdc!wy_;&wcj-#UosqlvfDjU(Du8v`ykC1D_sFVE>e%9`80k+C6@ zR;Ov>k6%Tdv^vGQI5>#DDi5yjM|Cd?S2!izS-ipQ*bl!)IEUO{z_7kXZ31w2m)}&| z(x1C=`%9PCM=RJc>N2PLlYjQ%rJGZ||zTTzy@j z5-9RC7c^1J*hi>W)>ssA+aO+Pi7vgL7~7s|CaT>S&Y@{(LfXWDfX0tNsJCG=sHQ?H z#M!*SjLG4IL?-=`{jQz%aat)GF>O zPj@rYDp1m0+Z8mkDB_6>-~?6S!SPpKu`pZMs?)f0J(YtxvG^X7+0Tdk_N!R3WZSu1iP z3zm+?-Pma!U4*S(+hrjiU*H=t38dA{%uVQMZQjxL)Kz^0l1>IN5Y%f3rEhh$*N)d6 zaL(*qF~OvwHltnwU#!K_eJHOu!XK=eBr1n*o=+J=J8rQ!Yoxmk;J z#Qv^y1Q;Y;{X3aPB<0c9d=ewHlZeV5ZSW$`$(f!?a}!PYrC!mg%+82;$_$07YE*`TaIB}G`lB1PEvP4Iq$rn1t{0Gl~gOP)2!hmtmL z5SJ~gMG28i9N)(jCvBRf(aqNNd-+Ly|LK>%;}>uy!DSeOzVM8yzr#_mH!r@y<8ULu zUwqS(N3z1`8;%X*gcRl0Q;8rf5npMCc0#y^)D`UB68`wwk=VDJ!db~%!UP=dU*5ak zu_v!;m+&XbY%UvY%K568=f)}FkOE0cx=a5*<@~}@w-5>UU$>gMBiA_?tav~{`xok< zj9~yZ{_MM~O~NHMS^d-6dt?O;LaH}#W%<1Q%g5>Knzyw3?C-Yw0M@-1p^ePt2~HH5 ze3P&zUMr4CNQ-$luI8uN?Pl;{Xl4qzJS_?-!g((%AubIJIpw8*ujh`0Q(@EVJYM#j z=cAUML)wbIS{K!8jLtS^zn_A}CVKTZ^;jJEqH8ajLEke-#rgrDxQ>9_6u|2!zjb<7 z+WBQ61nbGMKiqynPbwB?r9?E`Qi1Jn_U&BsW2mk+{mwzxR64_mqp`05w&t=@9LtF>mL!-{gcx!fFS_sJ0pMKKLvzfFvZ$ zvc*bZKlB@o{fZ&J8BJ_*C!U&R9J0!AXXU!JFVrBZ!%1GiQRoNsN0QxM_fCvBZ-LEW zz7uKc1cA4Ab~f(*wjqak3?pr?pX+{30>3C2_;K z7I{9)ya+ViZx8is_oFG1+$^r5sQ$5WH}Fg4GNHALHMJfy&9lW#Y}$de?@l0AT^T2A zypsDQc!=1MR$fPyIxGEs4B*Z8ngyF|4q;_B<*yeiTsYBZ+7`B>x4?SGY98|A;(6`9 zWfKy7N>de~WR@330s&GCIH(+ox#9c+NY;IW_32+I0ne@gCKlMaHA&-j_T>Ld6v>=7 zr}p(PjC_Kn-iu`PAViu(tX`v5%RCVZY9v*$&#YQs;@Q;{XD#iB>gtK*_VDCVQxOXU z#up_%LB18^95eQREw`cmq0<^R68`d>gSGuf&_XgIM>8S3*vC~>k~__H3KZwc>wu#8 zlo{rp*Wr=hh6q;<`8e91 zn|#ily)to+WG{VeM)KOvlVd#Nt6`W18h^ZU!`kJekJ11o)}U6^7KP}v88;)Y_T-$5 zymbFf`HD;Fc9Z8Yd`(#)*w?4Q3ii6-evuGkia}wnAfV(VQHTn;O^}yO-sV~c52J4j zgrS-wE0SZQQwbxSN@B2YX}68k$;3j%E*Wz{RwTFW@-W_v$#%5KOY8Dq z9Eb;Ri$(S|u^~R&e%Zt91?BCb5j{ZEFCD#Uk|A*2BKPMXqPG9#5x;Er;}{MCM7x}r zvFIDWnh_)I!=p8*e+{+5a{|oJ38EI}tV`)qNeskTkdp+0+bPz)3bo7}{k4NeOxb$= z)m0nyPtdWo6j?s6tbsR1b52<^Hm$d^-%u~sX|{06mx~rJCt^1 z^*w=8L-T+A2?Bp*Ac{<5-n_2z%*Y?Bh;gy2h{*+^05g-I1=;45N zpcc%t+o!LtpUax-pHKb%vkHiQ7hxQ z2my=DM-J6Elh`Xh@#5Zp_QyeH9CII+1Qc3~xbt*^U(ou0aRU;Z1oJ2{7b~6GbG$$S zbls4z@CNROSM=0wEVsvZX>`=h|Hc>GP9d)Lut1*uQg`%!msGg}D!jQG1-%|eM_`W! zkkgq5ylmOlB5Z|~r0dPbER6^DAnDqfh^FVbd%$bFEl7&ET&-K`{z;jaL;k){cxtdn zT%Osm2Z^uap?6&*U)}KB>WZg-Pj}rA5U-cj73=9O1={w(nbjoRJq_#P@+50t}oA z+OAbaw7m+x?@(#vXUHwVAfPi$4o{4})U+Cgb5Qlg7{{J|LWZrO>>Q}cqKt&$e(X=; zsOnPhO)F1LBj_4^SE_Qdhzt?xKJy~^(`PKXL5~T{i{=w85Q6k;?R^o1sT=t_yn0a- zSI#=P)Tt_s7ye3x?86xQ{3qeeUhcppxM1UvsyK15Ive?d!qM10h~Mx`*awnrU6Uh}Qn( zMec&c&_grFo_We!cE?bYlzkbr8a4ALzxD@8O0Om&P6DQ#gw)pO;e*lvo!Gz*JA^;V zE|Inz3NEDjdSQGi!U{p?s_immQ^y@3)7|;q+)>@W4~m(Fl{umTyQT7ygW?59Uo8Pw zagx}Ib<0_qsyTiYxfh;;XDHy{ETF`WSYP3AUB6)$)X>ZL9Qt9)a~T?8Llx|GgXw^y zb5>bfNTxD?&l2jYyI`*6w1irnn1z^F=!m+gU1lL^4sY`P*rS!v1GY)`)$Daj>al+F z|L$LZ`_EzFt)&19Oa3nWj}_y~tFE(z&YcnTrmWhArPc!QR62<4_;Fqxj9mBm2)8Uhd{7x|;O(H)2r{(!E<^!{hCu;;ZQU&y!yl z)2q(1ca=cm;Voj5P6eOhxYS|Tv2C9;NCZ6LmRbl!9JBLad=|5kV{fu$vORqKzWZ09L>-SCF1tV~>el@QdaaMp5A z!mVl?LyCKJ_^5DlQb>ZQbp+GEP;`wtq9}tC)1Ba9osfcuaTt-ejIBPru{!E{dh=q$ z_ySES_`fVgq@a8AWd~S;slcE6B3mZpD3(XBk6s0&VOfU1e$#wzHCSiR(z>!qgGAf< z@c2y>wE{i5*Hh+^ujpG0H?3;X1Qh0uUMq&y9pTT?dgpY%Tcn8sVMFc-aC~{71ZRI~ zpxYZR07??A7v0G?VsaGPe#jotiPH!9K9}60NwiXi0fwZA1KU* zQjBaR$Ls<$-1e_TZr`)+j&8t3L=d(JZWG`tnzR!xDeYADgMB~_2(;B5!H1&o?p`Pd zH+8k^EY!Qh{s$1D$4w-^!YxoL`sxF)-xG7UDL`V*GI2_>5re7#lH<-M@6m}OaO&Aw z+!C}*eZE%1YY-11`Uh5N3(!04_WC?<;H8TLyCZVSD;cj&GVWtG;HI%Z#e{8O-I7#| z$$krgYq<|Ffl%ytiawTs*uvQ}mRl3zti3sL^SH9a*;b{m4SN>ys@hh3!?<%oeLl== z1Cz2oPVLKr5tSKWD3m*aea*|Tn;FWKqNuDfoi!65`Cb3B%i{jMzS;F3|ICN2MMGot z$!D^S^X*WgiFyfi4oMs9(lN`iD+9AGOd0tRk|%CVUu%Zr1CCXc>buv?W+{+8(Owlkt8t@h{@;WN|hpz%_$gMwv3Bj7b zlY5o?iMI&0QlS5!ls1dg$XQ!eVzG37&Hkr}bQRp$BZ3_|5N{UJ|H%w*+5YodLZf6Z zAsbJWPeYKEJ21sz#*L{-edux43~Wa8I9CVyW=67^>3Zn1bv5q}sLtzT8T(319-)G) z>@6mf?0z`sh2C$!}Oo!^d8BuqWonK=2+0G3BhUOowU#DGlH?~ zBfoKz_Z~|I=lfIR(p)fO3c~zG2T8}quty3+Fsujg6)3 zt-ln5XP;gFcFh4tl+=gpp7>kLpYj3pr6Mv%^!WVkOBFQs( ze&*}1(VuAbQw@)0_Z~*s(_9+37bLY9e=|655*@v0QG}PZLoEutb=gbN3MWQ*?YGNp zEyk*v(pD9snN}$y?@{`FFGe!!UE*T4IK;xzKPeo^>2VZmWyG0l&UUD*WPT1)s=NOn zua%az*8E)o=bYVRCcaUl3@9S~z@+#r|F9%HDaK$jF!LwlNz4Ax`YiuZ7H2s*5v$%n zU|#4-Jg-M0>~^?L5SW43{QGglgIR&Qc!|v;@^y|zF9%;T>a_OZ)0r#&p^SejW!xyk zg;)zmY@&%?N3j10&H_H1;4aoxKAasy$M0uBA1N~u7&RwvW2w7-FKD;bU;6bPSC89I zPUWD$c`tR!SnsFH<*=3y8!Zaf{q{kn_hoxIkBx@115IenDYm_gIIMw!#al?*7- zS^Yyreb+j=;=J1vA(U_d7#Uz|CkJ-9{oc3@m z+X#SDZ2fKJeo{#>e*z_yCngD0Rkd*VwxF<&*g% z5JR`6?xUR&0~r}_&)zi?`7a`lIv@4}{6yEQ_}kwbFC>CflkdoImROBRJV%X`tB$Vq z7?|Da^$t%(IgDkNJAELX8Z3*8uK>iJ_xA;8SgACz5wpR&6e@m!_fp?dSM(lny((?y zw3py!U;(L$yinOSrj*sbT62TDn`+AkU+BejtleT8-*Wum=TbYHCmZ*8Z-o2(Mu-0^c|PGUt4_pLVm+b06L7f1Q~yZ` zpV$XN26b7|RZ&PfjyNE92{3C(?1~oBhUT)FzS`z<8K1xht*$;UhfmB>3;b157=fon|_Cmrgap|Nf~P@l@O9493qMMPVix zbl9YrI^pV1Ex=UxaH>d095)!!uYj0uz_(-w64bh7kb0~=B0=o^+U-0(Y%c)cxv_0q ze?`k{Am@FCHTwvhz*ZdoD)Q}*yWBdYI0obTuVuEHLAR)LzGStF?MkU$^1c+sd?hW; zlP#A@{d6p4{@KK#IBg>+U768;nPuqb@R^{mHH1y4cxC=H$0w-1(!gb{n0#>zU$qDi z2sXqWMMk{{`&AAN;Jy2a5LbWZgQ~mv|IhuP3-M11&nA;+8~}IUX-`1nwJc)n*q2kv z$Wz0>m|+nn24iKp1>F-fQjEoaR^@U%1L!6asDnH(1;>6Lu8P4m^Z4So28!R6R5A%k z=XhtTMPSvx8%U|hSbO)`ol>@}7t#b{FctN{P88o~INQ~0InQ?;m6 z#cd`ry*Dx1beRP)6+P%26#Pl4%`p2mm-MXSPgXYo98WC1sxph`=}TTaBUUDupY#I) zIw880UAXytMG(1F;pXnv+C)vm`(d5Xx)F!zksi1IYtm-mf-%!O^zVRY-MlGQ+XRVi z$?{|JKBb!4d&H*4!iGGC=wWL=tT-qF?@ZFDRr+eVd&cMDz=g+RCVV!lb3~lSu{-Bqv*PbM)ifJE;M-Kp$|_hlkLo856&1K8?;$@ zK?UmerjrC0o#Lod+Si)xXJX#PKbwIyeQe?}6eOft7H`;H@Uue9AV{h3n_;w1=E$g$b zvegt|3r8z2eMwopwH^@Hbg+?QS>J9w@m~F8;I$xpy5OHOVE71sYha#RF}htm6@FsD zQ?Pb)mdo0RWZ(E13(^mt0o0E&dr~el2*gY;h?WXCQqYKKknp05Qp$*A>O`3q3OpAi zE>2mMH8)Mis3T%whE~^48}RnxyuCj*q}=^n`ixb3Ic@IPo%gnGaaeWf{PJA-HZj&^ z8MEz)=5gY~_C^e5$?kdelSHZ*wu2OV%VK%?-4gfWk8^*FrrL)j+?}(dzNxL8#e%iu zP>FR$T8aVA`G_er39-)C;Znv~BXtR}SxNrWV1FjPJ(Lk8yxG+Ggm$r?;`BPSBAAvc zaClUm;)iQ~s32LpxL_VXI#|E<5@!C-2CopP#Oa$bqK{|CZxGO;w-i@ zR!JHbmZkN3T5#CnVy=(%>7ShJ7#?oA##o~DgD$ViExta32kU5>^JC)>_Ar>Z2NF*` zJ_P8rP%)F(fG(bnY-^73kxu0t$Q-o|6G2t27~y*BV~>=Q9bT{w{;EN?Ou)6Nl1JrdCt{u2!nX55BNl3q&-bhXtBql zVNc;6Xz{;)vOi>hb>i;MoU1=F^W~Ja+@AZDZZ~Nm^5IE@u&v@!%7GHVJ~4XeN&LIB5&@gFL%a3CA{_>UMR)t~C_$w9K4<4Kc+otiH?<$h%vd|r`e4u^5Q(rP%vSpNY@rN4<}r@|J%T`(kASq7zk!zeAk5;?N&oUx=-YVVg+QLL3Q5Er`NP zKHXL*Z&~MDO^2pZluBRakI+=QR=H@h(5VTnQS57q4+xht)(^{}sW4_^6$*y@rLYf+ zC<V1=sK#rpe4 zH$X@{%=qx80Bti%O7TW^45bgX3;KqySLdSf;}kfe3M?w|EH`zQ^=7iNhfZTGBk9+B zINT67Ptg~7du=s?%pNa^^uo)F;jUG&F%ng;<*+w*9`I@-j3!09-#k*sCpsE(AIrIm zPF^m42OS~LUD&BLCN@9b&Ln%>yq-J*Ev7c4Hq*D&Jm%NZ4;G7I5~n;Tc`YqVYO-TI zckSNyEd{1GPY8;dO&*zDweNX_on0B+iVZb$P(;%sB<5ec=22QlDrypuCmN=s_h_qs z=ONU|G1RUEKn6_x`3T*uIqWNBbO!>>EG!S}i(3u(u^j@e1 z=ZhiSppCW9>2E5A4I%L5Oc`w zpFAO(&prg$r=%v-mVFV|;{byqRP3Spbwf&^vNo25w0v@ZK8A zrYDOp%(`LiGtNwdrhF2hdiaWM38bSfw*1#?*?yOUs;RCX4vWs~j6p8K4C8vmaUM9G zb#~tk4UY+I>^Mis#8mufAxF?YmE!zdvm(X z5=&?53$`T5wdDj+O6m$u&fOTiGGj%zq7L#Tq}j^nABY}V%v@!94!C~wFgFMgZ8WnzD350NqzW(h;`UKCKO`hRKm$`kpflS3H6_Ys7U(kn(t z2_pAeCAjFJ_)VU?;aLTJfZSWK+UuF>X0;Ok+#By^j9L7R2Uf*kPTVgFM*|I{2mGzX z{uk*{Gd=q5nKw4pB=NLz{u7<{Y0$}ZQ&hi{VdY1}zp<%8lDJpW?=yAV&%S|XyQ|4e z7o*nfT6Q`Q=R1(m9EJA!D7;r$rB0A#%9^KfbAbX%scTWu9RiwS(JyIf;ysHtJ2>+L zej#LW{|obFghmZfCg@WDJ68fim#fv7jaBzftjv9D0B>}X7G^MUzNzIpUl}S=MP*bo zzQ0~2JU~|IyiFO552_^*8$CL^r&_6a5h#cw`#w3tqdzUGqaop?0nKmrsv!MQG{lU#vho0}R?zZUlDkri9oI!o%W_=map*NionbS5p-zd=DpGh7m0qd! zoI?RZMMO&cWjx+@@2HUZTs6X}=Oeo@$)zf{qqCwbfY8 zjs|{g2IK<8yOd>Bl|@@F%PAT$Nzd1}E4;|IvaL(Wg;VBPwLPy_Qy0f)x-GoTk?Av< z(kLyVj|I%B8auZ$0AO%FUY*PIa#wvhkXjRW&%ACmacYYXkM082c;V(Mfvqhhe$vQ= z{xsZ=H#XQBnTfujoQ3@UZOjo6N(}~Tz`Nl}bCcp^;=W{&cJcY-o`JJU$Zdd#AQ#qy z1w)tu@n#{5K~e&|!CI6PH=@S1y+*(U;0v&x0u+Gg47(0wZ(rvQnu(rQbSClB(j_w& zhq<&Ax3+vZ^qGygcbn-1p?HnROl&nlykXp?xg!68YB&#*{`lpq@uuUV`OGeD=9k13 z=lwKRGiDYY3R;K${>m}vv8O(u%6bNX?bqCtf9VGdXT=$2wRFde|E4{ztN6@uSz#=|-V3f&toRn= zSumnOx&Xr6kLW$oHwlZ;RNNu$dyNC9zWs!R(@BU%aSA@ICD+6FSlZ0b$;ZHwU3auD zkRQ&pQ8%x4W_&x#Pq@oY`8Q>RPCu(&+D){s-kE5a|CI%lH2f`eV(PNGVW%>F>4{jf z9((i%^4=%5S=0T^d{a*of>~)Jxj~0Lu-D##Q4Es(Z{X!`VX62h$z0f8eomoLZefu-$%G8xzl5SuU(IHVp22 z&9fLqPm+kD1g1l`>lPz?!a?eG)$-_e>CyJ+q3JU9cGK4S zP#k~%h+E#`5h{3V;c@e3C;A5VYIpdug!#>Y(8a3g?QW!)C3-b%x*@fZe-s-3bO@GI z7)meTf{b500XZ^4W&<*sFi!+=!+r;?-|xduV(UCj&y4Ywx_FrXekd&a{#e}A-d)i; z3zj%WLcrzyFV@s|>5EZMqVIG)T9E zbax{qEe+Bghi;_16_Akbu0wZ8cXvy7NH^c%_`N)T_2N4Bo;~->tTk(9UuD^ym0~wV z9;`Jr8M;U2J7xD+&eoB5``YvK_0@8ZcXaUT$nLkDY))*)rL~d8?q^%? zhmEfAR5D5L-@893m$7i|Q|>=QNv(@ed%#Prp}QGp#jn|s%3!6_kXE)Q9uI+AfCu{x@_&euW_zTA*d#{Tm95) zvk`HG={%6V_V0W=TV*gdO4SF98#Vkx7Vd~;+U%~N^=eweB(WgxQPHhW|7`)Bf0MVNA{S2vM=vs zU@cR}+%72v*re^?kwpYDRl*zeNhxy|3f$4TBiEItD$3lBS_D$yAICd4;~J_me(1YT znFxLU3s1kx{BEQrz_*IqhV30PIO7M~v%m8S6lsU9??wHi6SFEU??Zc}G9lmhp-*gS z;AG30D&bA=>ub%derJ1P4!P6`&GqtHJ2hQo^f$f)aULh)>Fg@;++RID-Z?Ecq$HlW z5h=!hcsB4Hjy4aR-Cj#>HY7IgWBndf14fz$xWIS)?n{I0#zqa~*KO_mt?Hg7EPH5tGSL z_nZkX!Msw1jK5-NfwJ$r$ByhNuS|)SZ%J%_ZI?O1?To1YSC(7W29mj}ZS)cK{LExC zT->s}5@S0n6J%eb&AeopegIf7F!aR`;qTTjFOk>w^D-K;etbJi>>7(f;a+vSWOQN8 zAf{Y&qh&b~&tLdk2eZl3l`D9w+`T2T^4pj;7n^_(K3gdn)%tSP*Es8q9wXN4f^X^i zZ1adOvF+=@lg7AhFCBs&-BQ{`v!-3lh1}S9>$^d6G(f@@sny3vhbEMvw;}-F+>gIh zzZC8WXlRwYuwyTkW*!JIVGq^tHq+_BdsCuZLVR?@mw9`l6?2oP8Ur)dr8ecYPJm<} z4*fTc*;;1Po)9l-F_OamAA_)x&{q>Zc!xu(MlFY>uo+59M~2oT_VEmW8fs7DPnz@# z;D@Zw{PVwPdRY^qbz)9BE0VMIFPfG{Qfr|sHzT!vn6sQc9b(ex#Y^%y=*7^UNU6@s zWuq`?s0|*nV#7cHyRXAwc>}ZU{xh6k_uFwFP~2`wd4XP=mQK6@!J|cxG|Q z=(72KD;{MPIHJImgrio8Uc7kZxK`Y1NNo9g?=HK-=mmm)=FtXTU54CZ}y7mrL>L>=k8s1Z@R&e8`#5F=oTZ|9H9sG1}gO(6~FNGk!rJ@!0DeR6)!z8%H#?-G7IAKztEd z3zt9pmwyLpPWlm4YAj*4$x1B{5?Y#+!Hdlg9f}PstCm&nJ03jJEI+|!Pb?h>HDy1U zDdRc6fclXg+RO>vV-H*T4dCXRa{JZzpHnedV$_g|Dq(aedBSf2Xv$u{+*)}t8X|Eu zUN1z7TzKYXnTeU_&={DiI`jZSnl(&R-O-6++Z?kiNDRT{Qmhc~QfwT%pvPCm?MEek zTdIywBVueS9F`Hqp~)uhj=>W+K8^$2r&y&nt9X9Pem-DbzN%HqvPz}bE>m#s;pM1k zIed%s2f&m+*g{^fauB)gsBiOfd(EFRQ-CLi-kopKy-;BTi(*fsWf-Hg=+GOIe)%yt zO{N}CT>G@O|E7F3?^E7ek2^J}bO9KFmkUgI#mN|k&X_LQpdaZ`1vw zY+ClZul$(}#dCFP$<(AmVqa?eg~__yV+aL(9G_K0{8dudpwrou+;C2w(8vrvJW_U( z8yk976653n5kE=h$LVpbHyAZr4X(tQWS&Scse1RVyZ%qRZr8dUL2}d6Q^Yb`rfG-W(f3r0-HEZ z*cNB^bkmo*6xI{n6wt&=P$ObSI+qCO5c0Cj!*H)*#<($Y@$R=an@F6Fc}LIBZBN+B z5qO!-Ak?jSj`k_IbM{-W07C8jI5gGaFo-p0_%z4!n{e)dZa_aobJ8!+$g;eRZGQv-#O%?6`b0v7)9lGX0%DiO~Y z++p{BOUBi?x?ivLM#4aEhNJfs8{7#?@K>88x|b|U?F z+=*nn{>;FfW=#-FReb&p7(x!rYO|5^OBT&i}F@XQKUz1JK>1+LCgf}4<54U+Pz^(0E(xM zQq73P?oS3a<9)u9O}gTkG{MBh`haQY^ho3=L|O5CF%AX_>jFz?y^U*>L4*SM3i7Or>o3sPRemhO!C zv)0UWWn1D@oWE)+TW0C$^Mv8rf!b<+XX7^~R@WMyecgto__CGnA^9wbg!a1f4n`c9 z)t(H(3!g>-P%Q-mpTv}^+>f2-aN1te)2M#ksl~JT!-BZX2{=Q7zE?Q>7)n2PIi)=8 zQ@p(|47{smcQsI^mU4|fmb7W{ZUI(BoygkDob6znS`|G;#^`)fgHdCf{eZBn|EG|7 zaF`!<mA%RY z<8Q91tDU}`>GUj>k?raD+}JfDw!}LHqM+6SgSb6RXUy=Wa~cIBh4&^pe3$D3N5M=F zi2o~cL1G4tQwLl22T*ab5u5>vq=8-`v^O8ULW&Q>4T2AihluxJjq^g>rsw|h1rgH8 zi9K?kkzb%yeQz%5nr&%oZY1BT^3_1e&(B}hac4Sj-wAQd$F??oyLv--Up}V(HXF|D zCBS~>q1CMDR9D}lSkrdAMg+P{Z|a~3)`>qJWZ1M2N|hyB=8-72*vxDt z1XzLs!bTnz7>Zd*Cu;f?f^mh+s9tT(q{IyvmE z%5Tj<=kwK8{Y2NE;HZ4uM<_~cTfA8D~bzKAHbu7_i>toQM6I%Z(>i^d6-v2Sb6Zn0> z4-R$Cv}#X*5%Gn&$wLL`RlAk&-eZ%pG50Fglq-&BB2SJV25D*x>4q9=IUi?|zXYNU zRo`siHaMqlzx!s2*zbVCw3#YycvcSPx<=Ft&t~0ChX!B~Y140L&Qvm5{M9f>zfWix zu?z)byQaZI;pR>deq#S!!uOgJRx-N>VAZP5AWXJia)NOSl+sh+im$sHPg@>zDQKf! z_~9NTn=LI)#ZH<>U+MRt!+(H86&Q3_=0clLje;}LdiqF5+o4GADr%RQ zAJ~^g^}a&))-|Jp3VA7X6G~>`zoJ=HBgfO09YCx%K?G`cX*<{S#uD>QZ^2JqCa>H9 z9ljRRufj+TTrZp}L}Q~{%^L-@=J4|J{+hic{p1yUfW(dVW}xHRsn^-H59xc);=hx? z0N-T~y_KFGq#pNB`VGMp`>>0{vLlvmpk2{7cHODpran>B`J=k@R4*h-VVbAfZ0T*`1Z!@&8uxe3)}@i)Zcl1@;QP11Zu4e z-f`wVlzSV($9Nw!ayS^KZQBNq4DHs?MI1!#FWwPvZX^kgRf|8P-!daUIB4Ua8D{_V z2Deb|D%$kNOjjcH*9G-Lyjw`aHY%mW6mnyYg-uBFr%vs1;2C8mh6a~BY)%+ie=58*s;J8X=>7LQ8?}!OLT`!+JUX2iM<>6fVKxbVWa_MMqRT z4v5nr_@@q(+206=6a0Ak7rLk)HpZXdWIsdrKT+yvZ0bjac;Lwe66YpLOj2RB4nX2! zR_N%~cOpXLJpSkH?A2q>f6OlgfA0#uc)Py~bVCQ@5~nNNwawo7rG8yurte7Fp0RsP zRiVK~JG!W?yj-;PU-Of3X_1;`D@|{JX*Pt(vnHG0Fauu+qq7_14}dO-a#X)6oqOC;(_#Ju8xZhfIB?j z32q4rK5lT|zj3&N=$y}=91Czk$5@pOkW34qyY>{yOrUzNR5UPll+I*|@)}6I&F!w* zr&B!Zf`Hx~Dg3hx=x1rPE0^+uN3{oJVm|)BFtVuwcsCc+1H!nwXj1jotGCIQy5@|k za;9gKZVng+rSx2d(yg-&M2&x;QXnYy=Dm=){Kv`p4@W^|Q);_lT29^Qwml4DXDX}` zy0z@s5k8um7sJE{Waw_mEG9|E+nystrq2JU3|2GdrS@q=7ay~gf01p(huT`Wi-Tz) zT~_DtQQD&e!N9z&No&1|!7q>eSN6R`+FAwHP)i$+DqX2Tl2uc3D9@Cn9R~*4){W#I zw}LzNCV}+(8~7o6hezTw%xr-5Kfi;|yIAd1Gn!LlN^y!+v(vyzeD@#`$|MWjVz=$o0U+wNh@9Jv)$>Hy8_sPlNB3_4= zAYKQ|$7f{JEB810&vOaBRl2Y>&-Dyb!8};^Pa<`_cb&Bt$sBEut(L^f;|Fdt8j({1 zR*~Kdnn$)4Pp6F}H8zEiw$3w*fU}y_FAtm}P|U|J#*EeojdWDPtCQ!0Y?si1i`i!G zj%s7vCIL7nuZ4llklEVu+VnSLGMrNWFPVJ=7cH14v-}UpvyQ^H?|pI!G|VIEXu@= z=ds1Mb@l=in~9Tln5Ub|Y_27`(kMPf~Aku|RxBbnuUsO_|N_S-}~C&%PmM$8X7yNZmB zB&)+0e$FEw4Nmk1ZUNMjm5rKR=xclYzx9j0nMfPEOYS`)i)J{4;J&jVrVcT zxz6W8$|@!_I|@%U3c!cTF*Q=!;tw;qkL9+jG6>A%|CKJ@0HO7@>8NiZBz7-a3H9fW zSno9fGPQ6dy6orY{N>HPwR7J}Yq^UZFWwY?j(RK~leBr9>I!kCcGq;#xCQsvuq#al zW@uQ}vkn*6UV-kh1v|D+|9HsB7RV3J8t&0t$nJf%GY!PK(`-^=X)4UdPxNBP`MG_S zg`7W%L9D`WF};!hxIgUif7cq-VFnC`82nD^7O9!G@bXWW8`+|AiGVfYH(qtmw;7s&DuVeP zy$Lu2+jo&WciEYiVA`ND$eS;g(1429DC3Z8#C|nAhe{bIgh_($r>dQps}^VtZ>Ob( ztM#l8=r{gHJ!**{3?P>URf-@Qi@aoc+b>#wSD0hx*G!lxffFvy9AhH~1}t?`604y2_!Ei*9m;yyaI0W(RgTRPv_<4iG^xl#o+4RFs zA4+v5Y+T<)A9|+RFVa-3v@!3iX!6nKj$47}e$~TjS43`+e}bra4+MMAv!{qaH?($w z!ja4AXDqcF_m+uga?WH3R&R)rrJO*U{j86_`I#v>h99atB3qV5I2|{n*Z}!fSo>e@ z07)zll0*@!PwIpb@k3+>!xcJW%{sHD@0%W5mKKUJhHJ_?jXWJw8y|gi?+EXwzTq9CWq$01h3aHJ{u}Z zf5+XJsYxqP)zBn{x$;SEi7LyMV77d-(~a)8MU?`z)vJL{GqllAKcXG6ii)!b+^tIMg0tZ`{tj=_Z@IBo z#oxCqrE%EnUK?rmZn-J%&q;a+?@+_klI0thrR}7@bP?|FVD{ZKr-*0xOL!t@l{Hp% z1O-YjGG}7ytvHI)=1jNx=YWi z3WC-$T5bw?mLcl1^o%iY3?zAY^_y0vie{=Q%2fbhX^kze2LFR1rXmFftj8mrKQa zC{X{d-SnFI-t~hghZ+)nN2~6Tmv!D7=ZLEO%jYec-EQ54fM1PbEDx*0&_z1ZvQsS$ z)+?YUv<;RyxPiC&3{qzaX5V{ehYq`s2gFBP8xJc_qNRw z3X~-n--#U#=E!7|B0x0Z={sY-a*AqG25Q;G^V9FDioq_|M4ESsV8SAU6j7Ri(p8W~ zG;ARGYpc;$YD5VyhOsiu<2SwTjqvdtk-iOc(qRDD)$4v6nRfk2_SUq~pJc=dXuB0| zV@k)leiO(^PbR05HBc!dr=UKjcMf%+AT2xN7qe^xusN86VB zN3WvEtYP20%L^Jb&)=c;a?NNVVx69|oVljxzSsb=QQc|s&~vmJNy15s?Wxb@8&3GeapVJETU^1_Z>D$6Ke2cC(12T90s+(yki;ERZ#?_%=Yyx` z0pIO06L_|G0=2u%w*UPykhBBn2O;oW3-s%NOGmyt;Lh$@)2mbRi;e%wFkqZabfPr-h!v^h6&bA#DN*WXj0U4ktF*Ejc#AU`C@;tI9uRBEoJe9Dkq%bEM14-D7kI^*p=j& z^J@W<=cl}7w0j%n^4tEJyX~~3gwf>{MaF}J$E)+p)wIW0#!_Z<^d8Ut50aghNg;Gd zRE3i3aMZ=ZMnV{(Dn(&{{Z>_UeP^QoUALA{$?()jpvex|&zO$<^v z{&I+=U-Eh=e&X?t{p{k3J8L9uV&4ikp!SHkExAW>uzULzY;Q%`$+c*ABEA!UlUE%{ zM5);qFSu}(wgZ>Tpp?EX`5wo&bNt%}4PGtYIsSUrQP(T6M1VV-ib$aFVZ(&C;bgC) zr<%Q$Q_o~khy&Wd61IL~ukiCnbfNd3)6zZ|sl1gTp1gc57!tk0fsw$x1F|l;HgLxN zwz}T!_;{*<2PES88W&^p_*L$QO3l;q_kD`W&!Z1Vd@EK9I4(OpJ}yX~H;(@yg?+>m zJf`2bYK!dkCgBcQu#i?U}>r&HwzYA&~2EGJS`#OY%vs72qvp~y_plqv%fyUYi`1Dl+S*1l2 z;-EC`obEE8;>0;w7QMd9a${OTORnho>$wB3(uP}E{@49y{=}sv-mvcNl^=mN7ZIKb zzPXBgczMAu6;Y094JI#NaU4NRBJiSlcuEdIont9@~8!yO~bD3%Rn8o};|$0R=Bph=+hmhGqObGt@nTG#G#K|b3hJ@$aEd_n)! zMZzpeag7df8IFTXGBL$?!!csw>I-mqQGsm-8_M-2U_|07dT0!=^*PAhs6>S_#l-bx zlcE>uh-2tu6lORE?}ac^|A!oIYb5^Om@D%2Gxw{F6|Ptb~HZv63L4{a*;pjRId?PFDv1C z`%b_pD?8K%T%jjXQGhzE$y6fp*!o|)rj_9skuU9ad(xtGqQe2(_i?q8qzFrck2vU4 zuXaf^3(trsqbM+xkq6r)iApIADY?^GPq%kp8(^5^F?ST{W_9^NZaX1vWJyE4eMsDF zPcr2dx=O3kPi6#g+R5y@{(JJpO_8xBQNoaA#5Mk7a$76$KDx7n z&yBFnon{^QV4JT%ps(2Zv_N%!p%hw=3oL^@?TaCmG0HHV(4jJ5zdS36)qn4M%W9JU z3O>(~>7996lTss?d68cDjswCQkdOruzjSuU*ZbB^jQUgh{@dckUrYx>?2y+t>*FP? z;8Z{lS2bc6LLW*J;?MM@6OaaPgBR>ZLqN-qFarAivJUE(mM%szm)aH_^sZMksw;+n z0GTnwPzDujMveE5`=wQ4_H-Nxv7# zNVFk}V%!@m_J}1=TGMd$C^Nj46ee?7_8Y~8OE^jmU_fZncfDxk25ObUqOboUFiZPf zd+BP_l*nhbSu1I#UT`Tc(ma$k7W zAZBfS*^T*ev8Ko@=uf+Acr62Ug*_kdCVdE5FtzP#4rN)$0diaiQN|R0iD~gkxBDR7 z{Kti9t50v7ZaTd$*Y}7I5U4@7-lzFnC19{RlYdL5L+eKQP1uuJA887Ot9 zsH)iy8HG#aO;%%wrHGNzHOu#LQHlQS}vpogt_1)wxtXHoWbC=@y3Z9g| z@cO8-z#HSfO&8n5qFuv_i zCCv&^3HG$%WG?9EkB`}*#B+(DHq$~v>72fys{PzoHTx1WkvN%rrH_6Fc;QSxV*6@_ zLxtlcF+c17ly=Dpf<_m7y(RNs!*3*k6khLT9$tudUM~MFcodOAt-bSV6(TDp4WWCU zBK+;uuiE@HUIp3O$5v;*p9{)l@T24eq>(CtWq_UgWgBx%T}Q<>X_kGroVb`h&h2MU zUMmLkWC)kD^L<#uS*OvnVc^XX0lkZ&OZmKoeI)R7vEEP@j?X~y^WQ>r!(&KB8TaySiB7m2$w>nmsaN znuUIKu^51zZ2z>Dl3xP_cx)yWQK>%JezVi-Q9&-%Tg%29|CEp5L^*xBJ|%3P-+Jdu z9_oUeQ??t0j=<3j2L0?NzS$041u+0<<;{A#C3K%I?&LAISIGTWg~Dw6s+{8{Ff;}r zALhny%}V$t((f!2>e7_kVJlOdJ0;wNe`T)^-h_w1lbnvz~8b>fJ2TZ)FC0=&6nf32&BY2vl+O5UOy81bT32vxqCQe>FESJ2*Xt&C858R zx1{%!y?o|~p^O9K0F4{0F9>U)`1AuuM5(j{Q8W^G{&j`6Q(x(O2+v!9(RLrxJ= zm_VUO439Q;=-l*B7S{hsFy2r*C0%q?=<6Wu8tYae$vk;LNasH?gTxlem1)X$;gLC* ztdfUID09ylLzuelp)uLAlEk?%G5$S`iNn=!zR!hjog}2>OYF11t=$E5P{hJz7sQKNo zXn0srIF8(Rk=AjhA$!1Z3YB84wIBvO{r0C|>l0Dj7 zu%vXZuVnAc)mk7=8?v%kE6ovCa@8G9Q>c4zenx!N6o1)4pNZjg9)+UZGeMeLe! zO6@KjiP0@WWx*A}W~6OqBz>6ay7h{_Md6W8b-A^bubcQd(wj~5eLj6041`JB5YE1R z>N1)UmW{PdeuVx_ZFI6fQHiz62J)b{f(v)e~93qHo))jQNS6RE)CnE)4&qAhBkBZq6Kh zN}nsgpTy1 zJNxIq3NfNvmpW6Tdci24JDnjNr(GKhnSx5D$nLnc?7XJ{%64aKavQ{s1 zqE$uoAWeCRSWb!8*zqQb^JnWK#4sMtrt?5FE<`}q!+lS780FZc_`I=QE_hybVL9=b z9ryGk;FCEX|9tB}n(*c_^+(M1NwB*b&_B<6rbNd3$&MOjftUKR8ukw2_tKBsiOP;^ z>YciboK;epfx;*|47ix(I+FKGE4aEOKCfH`ZygYoTuqlm0#)e=S^8xf^JEC)X;O7G z{4nkBY32-qUkl!-dBHP8d#Vhp2FgCH(?Oh9wKRO7xYlzJO5=jVZs~K!7XEQ%-zw>5?zhm(Ui}!LF@6NuAB%D zfQVhE8k&G72;ZPZe6?xg_iCp=l9oGo5l{vm^m!p^$Bb9n*hhgl07o>V_1f}2wp%X1M9{<{Sza2&9@3$s88 z5~{VJ9ABgrh`jEQS?%gPj`>O)sIJ=}o80i{RP1)_Pmt67P2&^yQmgGfp7DB)!)7A| z4^NuW9p{$Tt?ei$QYB#bV{V9FC93{c6H=5Sc?qHPQ$LoxOQGpS6$ z*)OO**bWSL zUTVnt!(p`EwDT`T_2PK`g#xE{A}H7fSt!d9#C_sG*OaYF451Hukg7QWbnD7gEe4?* zTyV|5Q&CyF3j|+}w!I|$I9aUljFJ5WMjYEiAPGp@HoSKmD_1kO-AwUHN5XEg1C3Sq z4sis=+33?wvBTNX@$gws5F`4Q!>x9vX=M$+l9J%O-C%%UAE2x{(W2f8*Wr5UJaZ0Z z&uo_nT;v9QH$2S436#Ud5STWhWo5@q3#%c?7ot8ZP$oS^U>tm4x?C?@jADlWPar^2 zCx3Hcjv>%Z#Rtx*$uTne0q#T2XDf8IJl)jpd>f1pd-48L94HF{)w$3+ zW{e#ze}7*HQojsdzpudV0f~GRjTBqF3Bei((6+NUBicw_C;b$ulf%>lh=B7Q1zj$0|sZyB=jWo*}OiT{YB z$vvjB!YSFvps@fOxmPI$Zin+Sk+l9$AJzLt;AD;xmt}Q)iUxeghp}O4zA%4HV$mxk z1`R#;iFW-Q65ahMm7{_hrmW(Hf#szbbnJ*n4I}*u*;!Yyz9#7){Q{{QlNe#78=U9u zVhyE(dle#D_-tB}Gp7!Jx5b|%fxznoF~!!G>AwpDm+e0Aw>sA0uq+FAs}!YTUcE+g znlZUj$(2{gFudhM=D>yI`|XGp8eeL|%2>}v2qhxfU;jXDEL!~Cq`G|~iwFsYS5~j) zRw!Tg5hpIW@RvvVZ(gcjL783D7qJ{`TuYys)rkQ`4-$eS=Gk7lJ5B-JR-6%d zKh}xIu((a&8`6;Hcg^xp!S|0Nj0{_|-#8obN-ZdnE^qSduKKxhfa}jtIs_#J7;_q^ z#6XpICWAQl{{PEyv!AQ5uHv9oy;DvOMW`o*}GJ#PUeq!;D zf~w@n&tc7Fb$$2#M;{qv@BJ=sf$=|rKjU-6$~!BWx_CrmRQ6a+pR%w1MF}hA!Iy;s z8)~A+svEhuHoCK@DcbNoVXj@;=gdEli(}aoFV~rMR z#_Bk;=f>+xp}e^FOwp}Z(@`Sz^-Rv+G3mMGy(iywg~S}*>JF>qMUeWIrePdiJB$pS z&CbYYSYIRZ0P#C^%ny@Gy%*)Wg&h}(+qQnVVSQDJL{_C@Tu5{Vs{SFSaF068I@`d- zvzWqu!-eVCwyhOdP_(B8tCLQKaN}bUl zxmxvEVfoK}vtc?6{)t&7BDnw36RwnNigQ1Jb4W{5$;M!>YozlhlqoD%;*klh0=|j{ zo?kuoc zA07enKhuu<#W+y^`;o=SDz~S6)?{%p*21hTRi{zM-hza+`xEx!hOg_9Sq1{wm4d>2 zfrwDrxKNI9g%`$&?j6ztUjuxJ5!Aa|L*Q|PXu_%r>}`-uad!Rw=SrjUnxE91*~jAa zGydU2ku5V|Z7A@9uX?U5{d+g!SGxF-2iw>NFE|vanXl=6NxWu}3tCiJ`(F80e;~a$ z{forfE_wxLD^yGW?*CMM_H3D^U0_FQ3O2ZguDtzS=iVzY6vZ4F)Cf+E7NGihfC=;w zSNZr8ShwzIEYfR_m}o`0#Oy-K3v+gOl@I41oOM4AGEM!*>@e4501wRzXglSx!6Ch8 z2*Yds+hC?*4`ljI1|R;Be_Eg-2Fa}`udKUalhbe1n0WC=9m@-?hKe%}7rtX6i`1F= zX>Lds9B1Z@ZfB3*isGy~VC7GZG65occzLdU!?cp15{C0+c#AShlN}8UH&vT}!di^g9_BDku=@A%6dR!T41=`uMi8{e5$i9V-o;$+PlA-sX1!8s z_x`xDHE`Zq#E5yW5pNuihw4T@8yfancXrcZ%-TWAnq~`8y>Kg_Edwx_EQrF!i0?3A zgiuwzByda2Dhb?#?;0?Eri-=`&2{We5&mZE{DAQq(Nz~AGb@XQ3K0F}!M#jPdZioV zjRS-a1rOCL1l?}#D>UYx7V=YxtcUw)K;KCL5>qqmj8tmc8@`w0rwWCULu9jS!NcPd zhmr-Gf?WiW%^1gQ04IZ5O){|{sz+83OFF{`SS@gmd0Pg|WWTd;Dw~dkK2rMH-pPsH_$=hAn&T_VP?5LttO!fw z5u5&_iHGXaQf0OI&B3F!nOCJNQS&L2Yt*8BHiLC#k?YuHE34c%W zR>wAmrP`w)6U!}a`ANrm*1IAtjwmPgexiZ!TdxRUZ#sJ-tOnehJnhyBSB^{m{jw0pIU(bCjEwh9G( zjB#$dG>N2sZT9q!l$`l-%Szi&lDszBY>AgAga^;#KUtMciVfI)+YxTCcdIWfZfkwe z^MLz5=i!-2m0^6qeY|&?SuW1BT7FSvBdc?2-h2$lsExj!7PS_f4IM*f3!|}W?j2p; z;J9q^qUW??%_nJ`&n^S7hslVue&DyBEV$3m`g{T9rRHKOR{=-@t@8kn%-iMl|9a|3 zP8FpNF{t8=^J}Hq@fLZyV;lQV(kG_&SCJ zo*>tO@Uu4UH*QAU{gu;j;_l0M76tj-JE_%Ijwq_0tMa~&iyC1Et+{j#(2VNX`EOp9 zRj19kdDhPwbg&)-Ax_Z2HXh+K@HP9xzt^px&skA4JqRM+YfoD2Y&}iJFkB3LJppo! ze?W=YJ8fz-bmuWjGGyieuXaeH=$ade9%RG)UK%CUUpNpTURNSqRub^t3`4 zu~wk-K;=+-jL~jqjzPr3P#yJs?8WGD&N<5<8JXsXq!JaO4tu_gyC93ls-* z&?M1p)0W_<8Qi1!rEx7n31+3G+bEX4Cr1%Mw4Vw{6 z7qt3|&_~4p3)*cE^}({Yc91)VvHfU;L5(ve z?y1xagr!4n5Vx8hE1daFlUfSn{%||cixtz`j4ejf%5a3pnP&Uhf6`WUlCu(^X$}!SCLa=@mN7qee^}wGBM~dz`&y{gxO?z=))X6&*miBa7Pg~=f zEI8gQhF2}Yw)33=^<3ddP^!8kxSIGrFX&jDbcPoH*a#Tx4L=8Y6l6}fUeO-GHj8R80Q6r-dT6-Yk zCquHxuoKl9K$9cmr`1JK`x!rfFI^RB-J+~SKGwKQ$lr``Sh!%GiH7cY#|! zvj$S$uJ&~Jyo!7)f<(beMxaFnTa`E&l@JZWXg88{9W29QIx=MAkPRv7mzLdM;@|p8 z{l9a@$5m_1)O>o`b28}n=_BYNE9?90xmKw)uORuJ&tueKr`52pFouHUOUQ0x@B6c9 zh&G))zp=5#3YOJ|kEZ zErsaO%=PL-(ba~A=N$+&y4G7w2=novucxFB7@r_E%=?J9h78PM>!;+A(#8~;`HFwB zp9HD(TqLXw{$H)(LW4Y0^%OLNwLUadLr{z$lY|nOWS=lH6k{C8MJP$*T3??a@7x$sTGbg~|^>)GLfv|z0UYZAyGRh?|4ADJdo)*Tzy6l0v9Q4rkWKSu~SmW z{s&SKBB6Kh4H(Rf>4h7~LsBDuz8;)i4_eb{op50v>L94W7B z6fqp;TtUZDEI0qSPvL;Wl}M${GPY6;x9Jp=6>a!KU;q=_Nv_y@^|vp;cLZ-f!_2Gk z{CV@4%pYtfr#Cpb7fdX>%zb*f0~sM%Qhf=K-FcGaIdsx!eOfRos&O=Lkl&E`zm{^` zK3FWf+CLE8aBu@akR%=sWANAWm&Khuz;6iKQBS)!HLi>B;m_S%W4M^1{JlQI1r zP6^FVzMlfT)qxb=QIT@qDG&8pEtyCxN}?)f)!gQkwrmQZhYfwIUesV_>2vb#(-8mv z^VO)zV7evHT;LSRZ?VwRtYYgck3lGB!XEQU1?XbXpq$ZB$DY%afRb)$0!_fbq+2zE zrLwCn`|@`$M|43w-GUe7We(=Jhx9Awm|;y7uTx7_n1D{INkjo$Zz}Qnxbx3*5nDaq zDWy`K*hXjqPDcAx_xao(g9KIz-+gaQc-SDa>Pr)k@%{$|OmQGi=o$_aea|c{)iW!} zCnrzH(e4Bt(8zyMI_Pc_Wd!geZoRhEOh@UdMw{>k&Y5EWtwiMahKs%?g$yblXYi{@ zRM%?nZ_=XJKss9I=#0N;D_on_xA)Haty20fTo_=T2@{2pc zLiaCc!-|(Z?82Y6NC+FYq&xPfUH)l374l2 zJ5B*CA7Z?j4Jzb1z74W;W5fJ+uabk9-;72N=HVI*6KTRF0Yaj-@wkWCFO-B zZ5P=-&-@3x_OL3qwSSbj;;8$-xM&q1kE^NKo4S^w_R{Ls_qy^o4PIpY5WPyEG}zQ!xldg`FLBhbHpw}@YMYVxDo7|@yM@`yc< zokVaDtBXU*TkAP=cJ-Vd4am*!esC2eoFm!psUOKKVT7Y=*Cfg7X)Z2c)~pzWXP%sn zORGz~vqQtwCqGM3U3EmHP#VRi=__ugLFYdjURDiBWO!|NmXvopx~j2i6G8fcHv!xId8lJ;T)4?F6y7U}lQ|rYdS- zI-65J#+NdisVHK&D#{q5iKS5rx0RS#6~-s2E6PsV<3Wcer(ZB>yh3ka=`DTrKpS4^ z{>)ef`%B2?*4!9q^K`pg11(o1uF>|Ou_X5)0-5^SL!_v~y-QCh4-4fE>?YAty7r%d( zJIuK=C!X`1Gk0q7j1>QVI7N*yt6I7nbkZ-kaDyJW-_DUVHSIC4IrzL#%1;6*xXK`7 zysxQjnrOzCfM53sc^vq?O=t7sepUDMpm*ty5P&Mf%gaKBN~+%L-94+!nn8!5xNrP8 z`|p^3&H;bnPpd*obGT?Bs`_)HaiDZiG;_QKiHrngRLf8oXoP8c)0M)N5oZCHHG zHhaCjmY>VyOA_W%t4d-x@RTBdibQ@Q9YQGKMeoh=Ax}yEi zyvP~scL~5aCg5X8Z~;1|e_suV&Su1ceroxfT(#_46{*y`b&Pwk-=mWRJch}}l&$JKe#?B#79F86dx2Q5k;s82Q$x~{ zX8qeO8)KJobRoq+#OKK_)UHp#Ue;mkY#O0mtq;^xGXUwBV66{0me!IeXL{YfTI?_h zMU8ch?)J5)&I?l)RZ($kFMlHKK9L+W`)jRWe z#Dyx-_b#+>}G^1ePnO62z{NR*K36y6Ls-|W}#nh+HViTaP~u1 zaxPe}U86>aGdFRgbL739X@&6-p8CvV(6VS@x(qUSR_UyN_aqRafqgBl@m*Rc;7Xa* zSHJ)j))PRC+eEXo`1^V5*vV3oTe%<;>tI{vN@gW4)f&&lxkZZ9^)%JK>tl<-k1M25|-!A+1 zrXM9YQVyb`fD0|6%&$iatQ|cXd--qtxOL5eKbMd`nEFk9i*J*x(1MbF3fe}k5|WGi z!Q*25Cq3=5vvXG~E*X2Y{v{k-goXW-14)J{p&0e z>yE3kZW^@+TC=&CPD>g&i%#noE!o2*? zG@)_V^{WWyc`Svnpl-6n_Hg3KRI%7veoo5*Y?;8bbIE6C6G$|;b-e&O0ijood)ai<+k#h#fE%^TLp ztT-D;q-0Lzr|6iqZtfyx{KgNZZkW97y)U`EEJN9kBX_}YyVOqO@uwp2j|H;wEqp?N zdI%yS01XCwr}CO9Bes7pfRsli%*XgcisB^y%*;uIDz$AGb58FmC(A30Xi6K({BGw) zli)?@Jo~=*qxO%xz%%D}2q+ig`%{JlWxq!-NnpCe2oQ36>U#l)xLjU6fKUogUeNGS zjTvq5UDC7MR4ks~Ra&Tr|J-jYqd!v(;qnXSjt9*9%ywEGDI}KG>}Z%@5Y0vIvwGNF zJ@mffzeUbZwOk;fD=ut$E*YC#Fl$L5&R&6&=zfMuWQd{pEP3C5SeiVd3+&z!#hEKI zm+iO7^=K;+#lqdslt-Ek0XB6YPY6CYUhHxSua(QXFbhvElbHvo8ud*r>!amEXG7ld_(>BOlJjl zw){ivaO%RJF{lpA$>gETFd+2tK~6n^@4ziz47(IElN5R<=(?WPfYgga}fl(NU@e zROzT4^HViMR^diFWJo4g$VOkIojxcy8_O8Sl$=ExPb-B^%PB8By-21XZzdgEJ57%4lt%^P zW7R%f&xn1j@Q4<`dOs_2MueFe&Fv#w;bv-M?l{v8scd-zGP-Ef+Yjsu8dU_s%9tkIqa&?kwbJhy&E; z_rmfMN30MeKQ|kE&~u*7TG64@R3gJy><3!~n_>_3+XkyR&Bb@zUa46&`*&%VcPwR&uI6GJ0_3H1! zr`oa%a^^R|OxBXRD}-oFt+21()G#;bQN>xa97K}Df|H=^sH-@Jr#9w`O*|hOT}8>! z2LDJ*vn4GjN8oJlJ3hks1}oEje)FywKqSx4}VaWy0feIRTPWxo&c zZT;NOmEAVNe{~Q#M_zpi8nT}&IsH@QEVP*_EfuQz*1Gn0eXZ^_r(R%2&;O<+2Zp_u zAof9ZUZrv&-}VXkvHWq!u+JEH)Nla(h_Ut`q+Vq$A?l7*tbYbOMIP3c-;;qECHi2n z+Y)_{*D8pA> zL{2F3!zo3ZRIXWXZ1r-F94=`)&P0E>Wslvc;tF1|O7`UCUNQn8!II1~U+pB!b}lmb zmDSO=F=?q=ROCy0qbkJ!9DX9n3}&h00-C%Qq6kn2Gy3C8o=tqSZp(*_gT3VJD`iL} zXY3lwb(RlW*+hWT2Uiv#irggJHk-b$_ISR?tLY6nA7mES0x_b-Oa$J-gBa-7#=6e9 z2?xG5-XBMH*I}dXFp~QDom(SX47?$%Lx>dfeDf{EX^^-?j!&u*=+mk~?JiCR_oJtp zHheLFTr6VyK6nk*Y1I+E7MQr>CB#Or{Pd~qOQmt_-1VAh3>(cr9mDJbq+V4sxVq6H z>%UW^yE)5W<-)6u}uo9^ezW!94s zKn%+aRY5?P_Yx=Gs3R+qqo4$X`0y0vK;}%gPx=Wj{#=6Oz_=~~C3+GkZ~trKHtby9pJmA4bNtJVDAr ztD~bK8d??t+kaVJRtWMJR1$1!D;r-6R7A0|PisJrRu0YQ4vH5@s!oC~gJ!n398)U> z1SdF~sV~vC@dMcpkO)mY`Oz|x^Ha9!VtZzi@*M^FNtfd*(A@4pSv>4ziFwk zZ|?tIYGtUP=#rtn8=jZ{s$S)_40#N}_D}z$nyEismxq3tZ_>gqxB4OtTv+($9h%-n zq@DC_x9_i{sey(HS3m_TGebLZoA3K+-Whvkz5e8*NNCRqFG8!{PctvDR8`*^jIGEt zJ&*YZX`05voMGWfwS4!x4vOa8fI0wX&P1MxY~dO*5E5l`L29dDD_=O&bs^cZ^JZP) zFC+t9n86OUtLl`I$<57m!07234!|nC>34LeA%#>4|F%?usdX@yedNG0!m>h~B0*h) z4j59$uv)66ujt2MFFzFKMog_?R?Q`n^u3~0E;Or+E`&kgZBkpOzr6p)1YU;1pDtoS z^0Y5=-t@}(Ebb#!YrOJma%i%zNx_PqAI{(JPD%Q*!R@1prapGiDA;VVjxQbQ=qOv< z_-(Lo27R%2uYR8SaPG8dm)Shu!zpgIL5V-WVkmgitI@E<4*#?&+r@X<4c~02E^6%z z6*9C%sW$ZX0BpZ&O>pe3|8={xB$lerd%cvV=)>}4%5$oz@pd=-XbzR$QU#T)*%UIu z1MrBB!1ft3CqI0&l3t_2(7`tcHQr}=NehflJdpmMz2_;!ImOl~z8Tf-4rtAX{NQ8n z*7Rv7y!$B)2n$?GI<=DZSf&c~SXE*WuwE9t`J`Vmb_ymytjsR_#+KXG8?q~8>3v8? zV_p)in_D7I0lfh+&xl0>PrCs{oW4xsmlm$chcrbdH&6Wz_C9ckd4q$U278D^CF`oV z`&!6xlXUZ0k<+A`3qV6;T2ZvB2LEbx%w$TT^5o@+Jy=pZ#;={4S)onYRr*UgGWAe) ziI(d`GTUSiq%Dxy2M-H3)<#U_l2G5l%il+Xu!Lb5>r)2hnX_W&n;N5++9)r?Uoreq zp)2_Hvj-l9UR6R{7}ECbS71S$9cbR7{;Sy4_KteWz>X5N-LJFp@?Tv)2k=rjD%0n+ zAcg5BDWEB{DwHb2c`;iw-|4*P<%(FHNI*5 zyUK6~aPYDNRcE~jKmC=%onP@(V~G%UkIKce<%oJVTfUcB>)R=z9!86E>Vz4X{qX(xS*cZAx&fBR7a52RP^*As^H-0z2DWKTLuHQUjP{n$}y z-gxiDe8naIb{u8-F%Gz2QpB3cO`N#8oOFJs@MHayLz2b&o!y%enXiB zekWkkTzSnYdP(xq`4?OF;lY?n$mVuwdb7KujfVO8_@2)9LW92>)fk!;5kc*H=_E&u z<-8kY%8D#Yiv6Eu7i~@Wk|i}-&k9_7)|7%3g#r12&kN`R=GgKjIFywKELb%MZ26T7 zSw?BZmsM|b;L6p46(7B0t-YtBa8PO9b6rIl)reE6dV8R}aExh)i4?uyq8NXV`F!qv zJ;xf`8;;iFdi#yx>=3GPlBUtxSYi0L4vwfz<*(4oMHO5Re{&`BeJcc?M-Es3=mVLR zaIsV(!k@0UMKR=_WIYAzGX$+bV)8Oy`4X(>npVH+3VhV>9gdd3^iGwLT^x&D-%|3t z1>^dWkgC}b8qSJ)_Vc1&k8>hJ-LQ4gepdd)g|#HZb~+EqQ5w%qlCog&f;)p5cioq^ zVyKcYjrnsV-hAD?7eWWHy-Ata`Me+pyNPflQ*}S)N<5TCKD(<-rd#!}Hu@dzv$MV* zSY0lUVlZ&DxIo2__I?r!bHzD~9IQ52ii1g94WqeY*RC8}VacTnL17`e{g5nKLVkAp z)hIrJ4WmQ%c;!E`N76gm-O|)rAk+~V^CZx;nLi@b*gtVZX}`~oG6PaPj|btrBX{a- z`#yFkOV?`0jM!EF3qzMZGK+wj0I2t$6!QrT#F(H%o%d@{Hw*N-*XCb(3fjwEoS$!a zl5XX0k}LJ{9Hy#xlV0xjG=Qe}d%wC?61py$=l^KkDVJhk;fAz2+Dcbp4C1d$Q=*v- z)WtDC*<3%3vYH*GtEy62(q9VM1UMRUWz5Lp?uooQd{TOCthDLBnxY7FB@iDyoIbn+ zP$Rgf0}%D~UWOTcT;1b!N5|si9yGiytn&e`tkhLLBJVlwtR~f8ENfRu?{f5vMzO2v zNmGN?MUgr9f7jPg&w^N7I?HSEr&8>hrrmtfVgN$)EKduqHhW2PDWg2Hv;9+)%Rv5a zO4fsY&~HIARJsQ=+hJ5e&rs0Iz=BRhG2*az13)!^r2;Ms54>MdOtaj1fug$gEGzMq z-kO^Q0OK8+`n7F&zILoOMtA$4+UfQ&=g1TNVMFkyTCzcX`=DoAwT(1~d9QYP>w_Gx zeRE>~^7Jh43J*Z1Wi7=jO3Lx7-n4#)l=fiE$%x>-ItJEj^8x51GBaAV-E!J7BIvJV z=nr*Fs6>9Z6U9OU-za)Uc-+fibtb2dkbxO1!HL@|Q>{kxI6;}d#a;Aq>OZ3H$j9}- zp9>b(75s_bdTYaZhdA3A$9Ox#AV;Fi&ZFJbT=jKzI)-jsD^eh~~q_1mfO+_@}V4W@8e1)(qcU zb9c8FHOATHp%2Z2%u8HeAFRu_MSj3a|pa z_ZJ?~qBupmn$tiG!SFvh-Q4L1*YfolU--5@mYyvY&hGy$a1>0ipA*|lh^h+R+7bG* z`RsGn%Ddz8;~#4&4lCNj-X<&@3ueOzRR;57tgutjVzsZh2}9 z=Q3p|)f^YrqBj284K&F)3)oOIDA&~9(qAPG9?dAxxGJANKAfps9j6AKQr&1{*qEo! zpFw=c7SB4~jF=HV_?Q)4LSPr0gv2njNfCp4a$*>@eV*@njZQqtv;Ot?A@`Jz5!13G zfKld0jqV~DWK*G)7zukp*Af2@=C6ds-Psv3E{cgG&OBM5b zI;eBu#TIRyTEl()7V#W4}Ve&>E~ zGJUTy*Xt~f4-Ig(E}fj#FqD}V`NZOn{1$E3(`rQu{_>n$(vR;M2wu2e`_Nv9?Dtsu z4pIAWT`UesNZ(!Tr@(mR1B*Ds!wwC3yuNSK)yW#js6ub1PX>VyZ^Rm z-i4LGil;|MY8~oy7rgHsp3QL_-JA`N0bBCI^X!z9yHz*7ysu`|B+=t8*oNU=F4rdw ztY1vdGZR9Vsc)Y)es`aq9ypaJ!RRh0)YROyN4Vmk?l|D`-*@n1lAD?)xoFz&VM0kx z>^JxVGdt@y(E=xtowe1!szXBf1;<6%BvMCcu9aNWz!UvDhLw&51%r~z*YN+LuhqGy z*HH`xU$Fb{-a^qA@9tcjKB;SfZ2&b^)t{H8;{iPbPC&Jq!SPs%yJn@;yx25ZSamb?L3H{!c{c} z0bb})O$=T?5$e&=qG@fxya)WF25#V@(jHslErR`R2g5i*5$RsnD_c%mEw5gib=F1m zPWBbqIOJTUiQ*Tth$-eTa7jFFjpRgLcamP7PId0raYYT@F6q^I6BQ?j>|&TRxJ2R4 zI_ncfoObr@Vxji{Ow%>yJLEXyL)c+pW&%U2fVNdd{=Jr@SRNTl3P|vcJ9}~{e3z** zS}$I4dI7h2**QGG^xJ>lU<(ORMZOGRDvr5h<98o0>;#!vu`v|)3>$y4t(W=Dl&Z6h z#8LWjime*MiG9<&OEE(tmNKLeD`DT(D4TvxA(pIHj`fu?>-|Iwp>X_ufTvH&0eEeK z>eHNepTrRe0Sv|trhJ4>(?*_@R6!A$2oz#4=rn7D75O2i$#j{iiYu}eAu((1cU>$< zLC|%4ICV9L)pZYXA@=+5S7M)?-l<04L(05(d9Mkxx5zM{P_6xzw$)Sa{S$HWgL0l8 zIVGj5_j;-*T@;O<)pAeu0f-UQeD$-;-w_^lqU!1QXa>Y+Y*c8fd#@85bt4X`BU;## zv-t*Wa{T#`!ci_eOJytF^UC`5<<{xM!!-oM8kGiD3(WhwLmsqucel*f5%b0n(R4zd zKNZs-u%UTcoS9U6jqEq;4DYrO?}PT?AqWEwJO7D%rG!LHH+gYjFDP1jcRI?K62SSm z>^3t`IK}Z-M3B3nq#F5lvI8M9+~>FedBeCdTf4cMS-XQ-OA7%yirBK+umWYfs{=d7 z-^;5FSG(6r}3&JjLEsg&{LHx94F{Ge1x(~f=q7#+XC$I^iNv8fbFUPN zJIRzm_czHd_42y$$P#>0DCYa(TdsZ0GoQUjUgr_W3r(A`A;GqSM4OGe)ky07cWyC! zN-;395@JB;_JBQZ^)LO%Ag)*qN;s?;cj%x;$WMYcoTSH+V0-PY1|92{=Qtz!VTq(# z^wMYFVb|zv@A5LISrXM~jDACun(cLbxtqJFoEbY}F);4ve7!w4-Z~*X&_%U2Zk^Me zhdz0+3!uP3Yc^)HS4+0sS8PtTkEne+tFrt#FlFzBi5w>v%6dGBeM46jw^nGNG0_&< z?6=bMzXzRWO&v*6)YEQaRy>i)paStQWUw#8 z*oC_4Gxq!j8F39nYkbcbivQ<=uRugrJev^7kb*QdrF#6#io4NWE(m-~9i@d2Dm`$tl5X-0*tF$I zT!1A6okKEL!=La47sVGjCWbNxCzn{6##`PdSjEUJsf>Jk9KmP%MMC8H0s$Bb=k=UZ)PH7;~;1=ZuRTN zka+W))C@VjzGMiv;d&udjr!@jRwt0<-#$&EF(=!xWJl>pAi>hgNh}{~!)k>kgHikN z)3w0O3hE;lPx(Ps3)j=b`NbyAI04jJT@rw%qhV0-sfFzINJjk5!s6+d>RGH&(AdlP zvK2Gc2l&9NqYCV-kPsgReSMyp===0IN~MH(3@NNA$I@@CDXu5nwXEWP&|_F|cs&f- zgbosZ-SvQn9Vk(X^%&37n+KkST$ZsZ?ROXweSgQ*EMW4a1>9q?>Uyf3e@seZa@(FQ z&N^al^Yc)8&RKcRU62PDZ!ZA1xXORYn61wJs_7wjivcu2K{0)q+6Yl zot~XtvMs@SPhX!%k348c?JcdZ<$nP@M4j8y@>l19WZ=@PdyJLySq#_1v4BRXiL_9$ zzByr$Kn-uLE(UzDd95PX{uBf0G~<@UNh2tRW}9XU|0QB}KVRbRgKYhfT``u~C~PxnfRb2D9)YEjb#ktHNICesugV(= zK?Y~cz+sQMc%3SwN2k;eUq$`7|11--`vBSdnF9C}%sf($I&(OzgnY#*XKzj_!e@X4YxuF#93IQvHN8R#fHwm z1;@Pac6#$UEUWTL9>0et)&lTxkywnsvmf(O_q~w%W$Iv~5Ma9Rm1_syUIg}ka@TdI zsH>i85xB+MiVCG=QxNDW&M^(|ue{lEo7l5y+7RU@k;*9~WZqS3x56BkGOC<5!!+xM zx&)0%UKd#zb37H$4WN4k%MYcSGbP#623`-`w<`GE7-gRF)L{L zJ8t>~z7L zIY|Ze0L~YhJCv?>{jX&g%}hYNiQL~{9%)JrcUW|?BpT!kZ-av%o;Hu)IPbcB7Vw`fmo!E&N>ba^Sd1jTr@fU>bvnN-2LGMy$spo1i?y1^dcZEww;m`pQ zJmLgN?r!H*AY0bb_81rN+^?@aQ8X_eZ6+$#p zOAd3Zw**X*1U6fu4SS3jMwqDZ`cJwTnF;Y%`$(+TMjijLR^#W9?#0`(wlCCeQFF3$ z_2juY+Uv1oDc$Nb5aNYa05r-7u!MLCd>ue=GXWpMdue{e3qbVJKI(Ses@y6oS_>kZ zy1y~zB=>cA^jyJQo(^T5!&1I!M6m3TLT+l%iU;MhnD0g@YH&lM(@_SQMhFXuz16F< zE|Esl3_ro?6yuF8L9t7-n(4-}%wH$o4%D?*UIL@c+Pev@N?(kanz^pMo@f{Ue$hzX z+#k(tNWlk_Egpx0k3hr;1h=&5`Gj9yF{qPnKqWyj$=RMEy(Q>`J7Ycxu=L-SvVqp0 zEcM_+N2GJZQnp53mHg`^;b+Klo-Q9qyf5FOeKmtm_>9%8QD4 zC<)D-k(8AhM*+@yR~o!Sy)4&L%*c31`wd3fN?7iZJ?bbMLAEjITlVJQY`g%i0>>x5 zE`5gheG!f2?f?OridpCb|7LzQ%r>o)0BmPNyVsQ{ByT38ih0cswRdJRL-?~amgbl% zD`(JSR%gc!e{;EYEG6uR^IOkYo7sLO8f;YIC4AE9_c56pBjrf6dk7kzA$C2?n~_+V zpBy^|Pq%010 zL|3pcqxc1Hh0V+hk=hMZ6bJaST`6%+0zs^tdRJ9AD}0y|nr&9_?no3Bn$*G5sBW{W^2YzZa{0+7ii#r~>NXn$x~tTOt5M zfQ}HJMR(PBtl$m?HPNm{>Qla+W7*r%Ad_Q1i)U>wt))2-rHKsXX<@zxj3Q49O%ie6 zWn~)gBJ$z(7kel0biM0z0xL0u$O{HJf%S<2UCc56O}W`6m+P7(cajnvarf7lP38 z^jX$G{ma#ar3w_rE?${af_<53LCRLSH%eJoW{i4Zf;a}T#=O2 z#g<4o5!>Dd20?5$ohJwk&b9LS$s)f!6k(@FNv3RRBS9{0h0q`0Pw-aeQM?FqklP?T ze3qvFvoU(>dqeHGT7LV5xu1)6KgtdEevgARfz2D=Z!qUUM&|qL6NeBsATZh^)=8u1 z1Lh?|0hjXeD5Y*zT-LX^+_+~-s9CNh|EsN{5}=~i;tCP)FHJyyB->8rSPi1+ zdHVue+G%nXW8$Tk-3P5kxYqzFB<3+HDfE}=+~}!C`SXV1tYoh^|CHAzA;aEPz$-}% zN?(gu0Tq>$O)}}h@tH-07t0Cyas!{X%lb3@=SWd->W4@Tzdagoxz+FTtfZa|-aUaL@1f;w+KBk19O1-iqc77i_+MaNz-Y4f!OIN3mJeV)< z6{C*R-C$owvZ?mM#M;U1SDO320&h>^hWDgm#=K>?2-&OPTaGy4Rv2S#87{m@mALrh z2faC>`5(^Y&%CE{U7z>L%Kldk+x9htZu}x?(Em36l9BkroHpoww5{o9yXE#9G`(D=4Od zFJ}BBcW(uRt8zbGat8+E5H!*pWq&+pkX(>%l@9y!l_ZhtctE?>W(@03HVI<8@|wF7 zpI68y|BP_PcCQ(Az_V&71I&@}4v-aRCPJYV?J(D?LIu4Z3wo2~$}imj8hOFMwy7ws zID|Hu$4wCVge0Pdl5xKYY|k^oPvt~1tfJ!xLY%}++4L#OXMZ{#ISH`C#}QhMkJ+pz zk&Kh?AC}+@3^}KAFSt2@evKT*kSXe}cQ^C=y|TJHAG?j49IPM07(}|X{>qkwy zvJALpQnJEn-gP|+(pemQrfLPF_8AdWU3%8k;EV$L*rGw$1?V`f?=|%pB;_mNPUx_Z zrA5e)nta~Ai2YxMKf<#7t7RMY z`|OB}^v96O1a>VFwvuSx(}}1J&DTY~lih{2N!{1q4H|b7*;qm3rt;&=J#5al-~m%*nPWg zam$ttr=WPqJ*>pOhm~zH3f8~E$KbC_Ul=?Y&-h-Z*63dI`cHVOh2#sm?2n@l8Ju+ZyA zvS7u@;vJBpv(^vs^|$@2cbK)bIR$|M80F0ONr;>PMIh(9f&gZ{Rrx(0)345kehwS~ z<EIamz<9i~g%`yY2Q$>dc?MyHoDAt8s2VyHlim8BcV*K5h@wI8K0N^= z3#l*enZd|jEpp>@+jo~A*HF&S;Pkvt(}O+Lbd)(*aHbHazS*QnBq3EXH9<%;IT9Bg z0!T<}f=g){6fuC2<+ju!20T4$QgHE0@yg=G=#VC%G~Z9eWxtBOYd^@w>Sqg*D-6ApZre$u-rRXrbeD|ZXiHrL2#OTj zF>c6vZFo1i(?6zGDH3z5?^NHz4DCp_Hc{ev75;!T3;^MW%%m$=o)So{C2R-wY#_}t zhBH2;EDhDVh6$u|heYkS{|cxE@Nc`+P=7iB!tay*xH1CShI*EFVeU+QPGjjNLw-@* z#L)v{zQmg|L0Gru&v%8QM1?ozrh!u(X-x#2i(GuI|OMa&*3B?b{QzThb*1f5ZBHimrfp*A*pFzs@rv)9T; z=)*eyY6(+MbygT*55v@mJ67EMgFYc;>Vc#U2ox50*S9ixRD-vh!c66-dQA#4%Ht8zuQBRvc2z=nP%ISc1d=eW@2x%*}v|h|8fVe9j9ZWq2 zw9&};VSJu4;nlC)48X^NOGp6^sa->-cc>roL)MdjmxIYOCcida$shTe`}AzDL;%&; zV}aw>o^bGijAZK3vYGz_H_N2s-`$QGCi<2STHWGtLB-*d$C)R^3Rc!`>7^_3rj86Y zoS>1K_bSxrz{H4#wXUpoKJ8dx^mV#V--S^RWlrTZ+>krq89(BBG#5L(JoMxHA;NWe zT@_$74`g|Tu*sh>9C#as$QE)~wDYqMv5z>O`x-yPZ>+23KQiiWTkv$xM=i;b-*zxYzDC7%2-A`9yTX?z zPDa~mfwg(aqHftm4rCzwSfK(f<^F{9W%a$^Gz}9^jepgC)n?VX>&VTAy7iwEt2_N6 z_{9FE^ZOvQ$AS;#p3qtSjGlL}Q6*qQbqaBgnw+R+-A8R#c97<9Z1cD?^MEZj{`I>} zAtvySBRv@X?br-UAl%><9hzMU>Ys*+lWDD8BNB4={{8h<|h~`7W&#I*shBvZNn^v?DuMs+$hfVg0kn>6TAM)j=Bz6LRN6tr0NNAC6I9R zwaK|wv}MX#O@^D;p|#C_OxkC7!fs88l?zB0%&6>MLi?`r{cX;HaAOwh1xMQq!?am* z7^6?NddQno>>)Q|hzOQZZ=tX%YaxClS5?B8EWeQW@Xe6l?H9*8<%lm%*Mh5HMaIj~ z*}t@5>+Q3PnRmyDoR)Xh^YM_Lw5IWBRzux~J?F;Je5$*`WMJmjKLxXLRdb-8 zPz>uEQw!>ZB&@=y6i4+CA0B;gio~dEA$QX{j}EupgCV~)uETUofuqr!sFWaq&v~M^ z%|m{p#%g;lxVRad3VmdYYeR^Z51j+Vh?Z`s3l|7Zqpj=`sq5w8+aC$QRFG7IEL`i{ zu;bl@_TOla0pc9-cStj!;gH4Yo=RuhoI0+ zJxMszJvHF}6|fcbo6M2}{hSoF|= zUg!0{FcAp~rXOJhfx z@sE&CMcEPNcQYJZV;;pBlpYf~jzaqaB-PR`Zfp^C*CW3?*hbcf%tDE!)(-AgUn_QA zy%l&UX_mr)OAopzh19)Sv`~UqkD=BJ1Mun#i|&2p3p&m>FOH2%HifT@ zwD&wQ|4Wlk=U;jbm1KXPYv!j0v*s0d+kbIHWifBAUm@*O z>)`rbrORh0hb+TfoPlcaGStOYAOwysaY&?|=ldAZ+5HsBoyhW#t9;tFo83wCuTo=- zL=)N!=sd*od%z#Ys_Aa2Y`RBDsZJjgQ?pCwH?q5#zZlhvDE5s8RG1F!a;Ys*ct}ji zFeaBRn6*8;__lT%v{h?@;(20dy79L?zpMp#>;^sHp2sWJISYOXs2x2t6xUU1Fq4{n z>+~LgdeZ_V7~bK}<73y5`;(*YXqy|juc;Z3c;+wE{YlYwg5Q7cxn>{#bOCbEvvOL( z`~C?q0}O_iLK|UARpKd&LaU3z@W3i@R4Z~H`n~5YGrZIo@wEc~X^9SeAW%hO1Obx% zpe0kE+J3+N0_`g_rO6JF(%oa&dk!usorXts}PMR7K=EUN!u)=^Nq!^i56Gz5P(p7Hggdk&(LB3Q%FEYNb>#E3l zW7d)u5mNj}2_DUR79-;yvp-!kg*Dqe*@u#-dtB*rVJ5p1Daab5@*AV?D`|Gx8V-GN z#<5O|Nvu=e^oC_+rth>X+elZTxtMa0!N0oa0;`$HaJ1e7NuS4`?I9Q%6J0Ujisc>m zDr_~^)#Jb2J-V{h!lz_73_v}&4#fx3#yJR159r61&J0qiuC|dh_`%7}i#;|? zlqU^jt7)n-4HcqmOe_=J9vH}*&XCPcQW={!OPMJQNF&@*duKWbG=Vn3HtLlFfhIgX z29n=?7#B;_m_%-Fjdo@JTFL}*)PS@XpQ16#K1!fB@KhEmfeD<%7|fZ1ZGkdEG1rHL zduoAdx*T6*SqE}2f_7&byb10{ z0K_BH=mC2qblzvP;*>GJaO)~pm1by^qgImd<8y7PdP2eaNJXv@lCrky=mA@PqTW-H z(X|HIw&}f+kbKRbL~MWzc`mVa!8b@zSH}4m8yJI|{fSf8k~LL5(Z&b!b5SAQz{G*R zhlxS`eF%^^ilRPe2nj2}nrO)j(2tR?^q`AAF8NbBfnuVZzbUc!1A( z3QqA$1L_-G%Va;Ti;1RvKCUJ>PWKGWc`|X9OO${8^=#4-V@xu3goDI)VUF*tcOZF@ zBca6Q*`QbU+}TzCyoDm_n9L%&sy&DF!|p4xNaJXw07;z^Vi)iwx~=55TRwt_FHB~f zv#NKW8+$qvK026ubf*L@*y9hv-F8SXrvM71eE$KFSB993@McYC||ZuC^e5v`AE%XEE7HJeppoVo+b6*}xfe zT)a5t|4v|7&IDtNCsoo(ixp$M8CfW zr!&U<{cl5$G5U@-&$_x-95l^i786S={gxBHUJ?>*CFWn`MJ}C}xxSQV9&_|wNDgU% zZR6VK;1;M)tVe(wrLrD9WIRby7B$Pyk4D2hoZ5r_?LQAi=a>u2iw>az55oNw7C?a}0o@bN4vYSW>+EvO4Ea31ab3x@u(MRL z$wv4kA^gVDx*-?`QzCGTqdQuld(J$y%0;}fnJ;EwoMB#a$H8X(_0_qdGz8@f`}ykj zSK`!xnFm>|`)8oCt{|9>`t)mEtqH!cr{t>a$1`h5nce@20IB?M`Ruk2ty*ThgTRT< zEZ^xhEX!YEGO8M1(Bn2A;iylywrVbD_00VTX1Tzldq5{H5m?fhpzbKZxOWekUb$mR?fkl+s3({B8mmjYcU^6U zcVeMY8x@x&2_q`}2g5mO^!kM_N4>Of^_I~Urg8zV(wl~&xqk1z zz23q^$PSYOZ|Kv~JI9wjwM0(}>>+!!${h5cX;v)Uxa1!Ht3&46)$gWI_Tu&00!>y( z*&5g#uQI~DFh1aFY6E4UStjPS^59{jS}g%!C8 zxlH1ES?>0Sit=jA)b2)`4XsGAR?O$~*FACfP8Az^6p#rPD@-VA=!u$*D6 zv{anvm8oaRtnRoEfbL&Y((V&Fl$S!nWWLZ&b7*JiXWl5f^xk=UiPVLkw*>{paKWif zr)3~5D_j>rBf#thkcd)HDQvd9V9=$-ecXb6lPgk`ND+GqgH=>vG-rqN74Jjs*aN_e z!s37{Hzm6(tWV|6E-qgA_D_)>pSXOiUK$C?Vp!Bz6Yp!CoqtV99`HLf>cK=l0AAQ> zk%~o$J%75%Jyg@*IeqfwEUtALYQzX@oAZ+y7+NIHy+jr0 zbCNg``5&e?hVY}XxZ+~(L>$b60`vW;vVzCngN^`>+t7==FcoD9m8qUPzt%bXH@z|Z z8I5{Bu@8hFHvLRSmK>)n_mdw;>S?|?roZo2gh|};XicumN91hy3KcDO1%BZBtgXe} zfd{JV9SUjB5hH#NC9uiKYp`cGZKYl|3iLWFNk_KiLU_qFhrHztGerNVI~k&6B4O|0 z_>VsP5uVG3Bz}nW0p)`UU6K?PsnRK5MAlUJ9U-&0{Hv>vJ$1o-1051f3_DZuIX|;^ z+pT9fYs_)tQ!S8w+^_jYr^>o!n%+Dj&4Ewh3vceBb@z}P6GmK=Dz}5^o8G!+cP{Q? z1?zRgTVqzIg~i+XOU<-xo_^!E*%?l|PDPikLpMJ#*;pXRQ6 zrG+~W8`q%*@BC#}NIlgT!MTksVJ zkO?ij&K}-VWlNs#2=ZG1O*`@|Trvz7!3sqUBc!ZLUhAmQSxO?wUwk}%=b&q0yyHUFG(5h``RPHdah8toOIF6DguJ2 z9lJYIIZjVAsFZY{zH^U^TID_+LfieH@D2iXBT;=zBnYK_6W%eK*OHJgn(^5qOa3je zmfKQOY8*4E&u6E4OZp13=f1GN#F1EQd#a2)gFopbKBaR%+K9!trGB&`pbe+*aDZqebp9^JNQa?l+czB4JD zh=r@F_j51%Sw5vdmdnDXk5K|{n8SFRouykz*0(A@urpZ?$%bbtYBSH^!Fj8izQ`>; zm>epbRm5!$R!HFg6ztO9eJ~A1(G^D^P0U#AApo2 zbpbQ9Dv-vkywYN7zuX>ZZM}*vRuJk>bCPa$6su?$BLYAmiR1%$Xa+%`YjO~V8GE!o z?IE=&5K3t0iTpYkJpzHlZyH(=kx1H!5buRqCBTVfDu5+u25-oCNiO{y;S%Sv)LFt) zOn32xhsQ*cxuutQyeu6>wahgPqhqN9%|5%mE7sF6=WoO3fu6!ybFX%ow^b&oz{myj2|GmQr(pq58b3rrgWidu+%A#)Eal+?R?pW9M{=IF_Fa z2*m)}`Et>6gK3435%A<=oum_!gwENgqJ^$B*bpS5<;c| zEh2!Hc@y1aJA+Av;w90iB6EeuM~MNId$Z_bw_inx>A7ZQ9IY<8ECl_Th0Ho%e)?zr zePCc>OfW48GD51HlAp0!zjt0c)MO@@!zHDUgjNuC`YmpHh z39`1t-%idzPtq;)S|a4qJ->QNIFoZ%hMBVZf&FabVq)?(whiO!;!sJ;aBmzMqIsci zIiwjIv)KhXBtU6t%yu$zfK@PUDH1}Z3<^dgX`B2oFr0Rq6L3eXhNSJ4JU!yOZ)y|T}UqxXdunM_U4DRTZtCMffWQ(|(e zRa}NsVt{NvprLmhX%VqTup!!y2$~@(k3HJ~j}rydqnGu@4JEz`+7GiJ>dN)`HSL_9 zNag)E)_cgN6#{72l=kh6{oB&(Itl34j3za#hD@(FbQbq^=RVy0l^T)0smu>&9^Ogp zV8o9BCkvwx;r23N0k@owvNUTxZT?3*6f0`Xe(y8pm$T5t0IJ0-KZ`{d>c#8v z7WEH{z@+8f%We-v-&LRUkvUU-c^FFrXAu5J4=viz;SzJ5=wj?1d@(KgUdtVvW5`!Y z5K@Dkg}64qKj*4+Mqq4DQF9EbFZ)VQ9*ASZ{L0;bEFZhLbDIXjv>UA@cJbj3<~qbU z6f$h`lo^ryh3GRTkF#}faaQTNe0W6Ol7R^TtQ4N3x~hlc)6-0Lke0kPRRCkdtF_}y zQ3CV>I!=m-I>OZ}HOElKx5u@YF`)byBI(KQloeG>ccv8Q{5i~uScK_chxt1zAB|u9 z-@AW{$N4ILrc+4PFNOF8^hBE!xbJ3O7=Q`G z)aa0eEnoR@v@I+SL{A_{UIj=})!gR)+9kfq}HtG}q(|c}%!#${n>=79d@Ws=E@#{3= z>hbvgOWJp)-|Xu)hi*JZnzjWEF!_()**`Ow@3u!D`yRG|5mywlu+O-T5?26Rh&0BA zo6b%7(4mqZ!yBvG}Zh3g^LUa&YC%1VBg7aUT9I7p?OSO{UE+82%1%N21;s1ytL-Ow8*CbXUw#ajMpXBWaI2Vgx2MVLc58qJ4iu{N8^r5a7FP`XRo-9zs$wA)B#wbNKmk>**_F4Q?)Y^^&c^i zZlLvQUGIxj48^B;1<@gkAEc}1V4>a3$*|r6?Sl!~yk_qBN;C^;BQ?p~YESN@FA*xg zI*uDYIdKek%w{;3wM2>FEHV-m!~7mH-@Y`ZWuN*U*pu*d+$m^#*UdS@X?Zf}ZvS|1 z<`uJ?HH{r=FgT4{krolT{2kPIUR<+?+e7LiuEv%v$#m3!@7KzT5$@EI1M{6(%i&~x zQnNpC=$5#r0|&B+(}lK{$`lVX&+(41XRfWOreuwYNix5kZK7X}N1g2Qk{Jptpk_+g zwuNo9yD!l%1OkORrkKIjZ~WtGn6i>SJ_SGa#|8&PblZwxwTE)UP-WJCfSO}r(b?S> zqTGm9WA!F|%UFHg;u20qC=w5kAwRtwmILi>f#)2#{UIF0hc%d>e&bM^fDkxVhp?{d z*cc#R++$$({lX+4b*o&^cW%eBS6VV9s@r6bTxBw}T+R9*s%sH`pX@Yl%gh4y#x(u= zm()U=niBtPyGgfb%ej==nCkBed=eYTH&j-bv5wcb4!-83V*&eD1f#bL#DYq*y{$7k z_GV--l7~H5jg7KTttPNorJ$o*7%>T49J9H^rl(?R+Ebgj5;-)I4tC*xxKId)!?ZtV zwFPAz1R-EdIZh`C7=Kw`IK>835yxydqxU${`Jd=~Y%dv3HniTW9)x2+8E!OCPLvaC zq#v4|NNp_Q5>gIbf{bHtIt{VP5 zEv%?cg=0rdaz)eOH?J5N2P z)p{ju{Cw|jsekyy;DCm-m>8M(ES4>EAti3?%!#$#dL;!IbNO+nXRmf<1nFuM0RG&= z;|2uh>+#;);QW5m6`!toYm)fp6JNE!hgKF%H=mX`k*~=AK+K7q#s8p2s&IuAW-3_T z8p$PlQ$O?`Zxo5|UmxZbFK|As#wgMXz>$FK7Q+WP5?}~hnzLXCa7{-_mpJ_PY&bLP zS~qq4r*R--arHg+iUKEcsSN{b$2+vdFZLb$H|F7q zB8M%hE?$~g5!b3m_{XmbQ_w2I&UEVOzCka&^$F;)@W#HZ)tv7?<#9@LfgpF7w@$96 zms7@ad$;w=GY({Kx0}{v6!DZb!*R7AfDaq!+7$G^u!J9F6+5ye(z~%F-o&0ql`Qba zSZAj3+p$=WRG2_Yr*QdOW)xm{Cgz~c^r%%FD>SI0&zZIvgimfmvuTDuY-gYBP&poZ zc)a|+bGjvn=*wA3YKtN6!r9fJ%@A(eFKQcJ@FfO#0f4C(w22dkgsO1-@W~cOg4Vn7 zl&5xhSopf}-#E3q6=e}Rwk?Pc6EJnejQ(9i^O1HmP*xHpF{5RM)l|=0boh!EQ2Klj zLB_Uo@6Ug;vAV>AC5u}FnT`!d`1r-=}WW;0eW4+d< zGP?GlwJlIFp>ksr>NRxV-UQJewI2;Jl#cjQ|KQU!vOIRxXc-~YhEOGa91hfeX|V`G zf0Cu-WQ0b}mZ0`IdlTv(Lrr7%KWAt;A6ZgW7d@9Ffeszp#;2 zE)K2TQb9}lT^=kVC1xQJ>y1HTK5Tu(NL4J5Okmk5<17wv-&8$YzS+0sd-}3`TvAhmT=4*>+CD&| zr;8}*n+~nB-6U^%6&gTv!8eYq9VuuGS{mNP^$tZPaGh;>bd3pGfRT-_P_(Z%JUHdt zeIQ`WkZd72AX<}hxf9|PNql1ioWzNnyjUwfZxvG@x{KwkilqqC9_(68XXTp)6W!Gh zpoA9Ry?CoX`RG9aMa!pWr0h_fCpUh8cY}Wt6r&XaeFxXCU4*tb4jx`H z?Or}4jA7wx(v6Kceul@(sD6#aFjwu320gGLsWeI}! zGvjIYjo4Lc6rlQ&ICqkP<*1W@YeWcUI=cOT zg=>4W+It`Dg;8^;0SOXowAa)2E2aKk8^?#tth*?#^l_78U)Y6UVJXEtU2ia-Ty>qaXCm}4))uCj{j2yW*|zrl6J z*MZY=YYzr>z4FD0bDF($6f>s2F^K-m-B$G+B*SgWJJ9of>dq<3^RUs^1w^^8N3K|# zGc31a3LDHsE`f|fbR2FecU{_ioH{`#|NZC+3(#q~_H^<|`o!MC>{DE0VwnNua$}KK zAMFywACkMOV5E0BPi{4sk=j;1xwzgJKj-lz$(LM|g1SC%Vzh_4R;$apkD9H&R@DgG zKA?#`=6;&3$&8S8_i19!6I)r{f829wR>s*42O&3~Fu19THhy`3&I%Jqsr9Oev=F3IfCd5|fH znU)f|6>B{y7qh0Z1oBDCMrgj-$+S$#_Od88 zNtN_b#OV@p{qico)%C70KHuLJTm#eV`<~7zY2P1&SCO02$iXykK$kCSSD~kkrJLUw zkr-RUz|e()b^3$aMskpPK4Vr5{&qp`enZ(vF@j{gD1u2UktP@#`AhoRQidkbqSLu_ z5`tJ4gkgSZA(C{;@B7*;0aA{oCJvDiLwVcR5e1+ZTN7bRA$geLKz3)EQUTLuH+g!@ zId6^{P-7A=y!?1(-Xc{^#pBU^@+aL4R?mNOVHEzaae`&wCo}Mu@kak_VnXVhK;JRl z%C}X5Up5+h;Dpt0kCBTmdFbEse|q)SK>z<2m(`P(iPhL6wvcz?A-(81Mbpp z^|KYS-{VYzWA3!B>$10e$AIKFj8ly>{+mKw;colMj6&soqCpz^IxUSsuWanCt_QKf zi(XUxdEfJkVthN7uWGRKe@UPh7^f^dI+|D=4RC-hTQPna)AKL1;o?)RW$EC?X?QSs z7{ ziDPJQ7QB3cRu>S|sX+*hDwRPWo-nk4_ouuRNr*GXsv5ljPBM_D{AhI^f&S$mfoL!o z0S%R|Po!&h?+#mdHJ@pWnDS0Urq~h(f!N=<){bZOmx04-j_+-aO1l0ew3C>op-ogT zAR)XGTmzTa8Em>~dS~-xm*#2m#5INGL?M0>wBm^tE>(n|gPb!Q*5AP`Ljz5ldEmhx-1)k^c{j zVi>Em__2QDzc*=yRxtE@V1+?3X47Z*JNn78Fwba3uBGfgtR1zved-$S8%1V&I8u5> zVtbe3h9z1;`##=!sQ#FNX(o&65%#BTt@i*bdms>44Ar(4{b<)K+vZs2h4(9h^(KAx z@QjCp@pok7*@w;EuYO6zO>;a^_*r6LHtWjcE;)%JlTmZB-?lnkifH^elt>TY1r zR^Cr$9~1Ocq8@E!h_>~uL)>olE6eW{GWacz*|o=(QJ;H*dZ*vVi!Hy|!@V!|dD9oH zHWKJA&?hjp+yYF7x#gUjF6UmNG2;C)Ge(MmU?8;#LU{M&z?5H++7IjP(Gxv0?a06p$H1j9|4-eSSw7h7h#y<`fTVP21}^lzOJ93<5aGU7yijFQ za%_WHNi@mU=6DUVCGb#-#J%@31{59b4WR%Q7yw3f0mS_pTRKt2@N=IhBRaV6Mf-y9 z{eG*dL4wc5sHo>JIT%|{(;PNUs8)KigiTc1fnGhhncAXXmdp$P+jy^@r2kNQD4we? zjXFY*?;c*9SOB0tZ>PA6R%AFbATM0n*b$%D^Ox5AoU6Hz zFZ217^SIYymTOo|7^mE#hK^42$CCY?E@6hxA`39O9C8%-hs>Buf9YC_wiQXwABk^X z901d}&uW{b2wJW(N#t#fO-WiV`!i-586ec+(8uou91G?jj`c#i(f}n9zhQhhW}>zJW^Nj*+p;SyOIwltbtBtF`5BR2PFyxVS$y|RqRaDWv!;Y!9vM)6Jyv_n zb`&@sRTxXi0qR*3 z=^eA}@F@{zpKx(rWP+b}bYv2ls3bN`Nhtt%WO7=c7rW8E-yL6+qc}m^0Rr$H7{Hm1I2-+RxY& zeb%Md_z8pB%O6XaInh-N3qob7Y$?KFeLB(VY6ERTwKPozoj9=r^0Uu-g0pqH0N%J( z`EULv^bQPk0}>GiphwIKo(Ldb%vjP+CiJ4n4j!JrpHdcRo~Aryq4>GRqhF3v+?>>@ zIk`64wtHIoH9T*nT5S)XeVh>P>M~!pCj}enUQGy(5b9O*m?u)vhO8gy3;ia!C;4cFJR>U(z2)nv*rR~>E zRD`=xDMHRqSMKi_iiev`s~mNzu=MPDvZpRnNNIcQgS&PBUx4>p0pK&2U(nDhBse2T z@S)aw6`|M~^z>EoLmxB}gIVnaqZib{(9zy|q2@q<=cx3x0KHK5*m_!nEfdUuZF z<2+ACbqvVE{%+qqna-CbPfj#A*0rM9GjQ&H5wg+B7Y1#gWyZ8i2srhhtfiav#2#&T z(*oKO0eKP*@Se-)F^5mkvT+1kapUL-`h9%m&#`{q43e?-c;wjT%NU;ZfHa8%y#N2Y z^UP3T%^HyWU%T@Fe~EuUWd1!iBi-_|pJG_oXi{df_{z)u!FLiKwNaoa4*Yq|>x!`X zs6&3vtAvb|mvhHFPOPiyiU=gyQ63vJ+`gF{SXWaSyT^S%zfX>?yR22dB)-HH0Bsh2+KV(FpQouhC)*O`% zN0DqwyS_P+_nI0qTHw8xOI?m}H#$)0qB{}wK+nfLGq!xR=S`{XkF#vtU5)sh|${khOx{peR z(DObMx*d%WP*adb)B7maiO=f$?z7i8Y1QQYnE-SXGW-02SEgY@#6vW2 z94fFQv$OX=?uzJkzPZRqQ+(XSN(WT7Z8cnU?Go{rQ|weGDA)mY1h`g%I4Na}K&-uG zllJgPrbS2Y%LLj>Z9v@ zT()cKi1MJytjJ_CY{X@wNp*NcCk`?4$7?agR}^IS9Imr%B42twC@dX$6%gq#BIt#t+&! zMg;J4G*H`1FfnPcA3={fuc$M^ECrZ#gn2ARRP67V=v?RKG=S3{`3oT~aC07|k1+nd zHwgSGz`eOOS~D&mKbv^e6;sDd>_te_2GR5^vtJWn*9r^Ou}4g*h}T~6Dl6pu*l}(r z?IK3Yt^5ah%MO?;Uft&?vPuANe2@9nrsgqs6`oJ=bISi_p5r!u`6YPD6k`g^jq7(m zeQe5u&;c5E>;7QpY;&DZAR|5wS9jqCPaIn)Jfw3Z_Ght~WD$x3(UQ3WCpI)8uM#ccX7jEbRb+iB_? z;!Fj1q4Ji^m`zPk4Wl$v|8Q{PxxsqGfLOocOr&StZ30&Ae(C?}GC?sfnSF(NqZBX! zKvZzRDmXw!MShk@@gDsm)PzvLKb7}}V&!?sODF?3SgQd43|jkc)uCBF)VB6{#RC?; zT6GfCb~$ZZE%8u)Io7Z-`IYO;Gs+5w2CU-sW! zS-a8;N<4jB!yx*`BX~o6PZKaF4*RR8DF{BN|LGdhz-otNCuHd;RdLahy%;drWuIuJ zwdMv_9zs|3srx>xB|ohqtw)1rxz?;g1uu_wjBMuMX|#dE7ObR9t>D}!JHLqLLZZ!> zX-h#A70@?}E&u#DIG#*6hb!N~O6^MwF4o%mtD?6yfTJK7mm+PUcu0NzkX|GG67_fS z)vqyz%g@EDO}EwZtIwo;dC@HD)h>U^)j#ehO=wy6RPjRIY<7GU7;vd!Dw}5cc~BsDKIDkw83*u1oPV~KeHEx+hidzh zb9C=5_;{q*nz?)}kq{h}mw>sgSGmmAdjFH{{K=_no%!Dy8 zqIWqegPWY{nVAuD*Z)#dy`M4yAh;v&Zo9vhu`bbSx6{~p&y?yEso2sYI9}vVVklJu zY))k2AD_Red1yAg+t$9fMQ>!zkpH6kSJYO&Fw`h_=i11M86xvykb|uDQh4!aSeqJS zj<h+tebt-ON>*Io@_*k`6ueG~9n11CVN{tD^a&&+S#IYF<)9#%W*~sOdLT^9SPV(BNST%NP~AjUtfXY zSiUYtS$V`oi`%A2ZNk_O4HGnqI8Gg=ecxzIlFlzH2V$Y zWgx=SwFIYJlDfHeC_k>DayABZe|%rF;K=XEcXgO+fw{GSEoJ;t`$}g4{VVM7Zve;#;Gc07V^^ zg`_j@Dv;(N*Ft>|&{77B-dow1!O1VK`AJv1NuHvcO7(b;6%#uRoRo>*>Xwsg_7-H1 zE!$PAOGzHizn+I{xmOzuv8#DXM-1`%9wM5!<2c-32Ab*iVHCAvU8G}+eu`e{YhwxZ z&rJGQlTDICQ=rFQ$7tZ%n!iW&mgl`pFHmjGxwn76xr4|327KmnY;B;%Rmt4F!!P42 zEzC_}gbUuDARGp^qSYz*Yfp()?WW{aB4jyopM&;`)9$KKK733%)cI`Y9ZUYu^Lz~h z#|ci*)05=I$c5W~xUwgM)7=9!3Ab*&)Ru9N|c4bXK z2F$X?nq(m;!U$L$n<1ozg#3{*;te<5CNGv*zETrZx)*+`-3&fiYT1wW#3?hW5YcWk zn%}F#P^fU^#~q;B1LM|CE_LK@dwurj?kfvwe3J(nqwQeAv!avpBq*|V1MkMbb5?6* zX+4RlG{T^60qWdt+My;~D9sMs&2>mFB$c%Zi~t!bMxBr!eB)_l6SmfVIFM9>)?;SY z;y>CB=DjOFiIxCKUk-IF3v4M36%O%|!mZhITFsj3pJ6%$@Fc2Eeo18^HogCQM=Vz2 z86l?kYJ5|uVBPlWl3%f}pu_Fe;^(Ed*hteV?Yxzo*g<|5{H$b#v=+yOEVCw^;maY# zGP++{NajYJyUd#K#+t+OLo^+fo+Hab5Gai%cSBytj9v=qXb-T%o-ZhiQlu|m&jIb{ zH?0nZyE0hdmF0&@IBRMQ9VgOr!E_ zlid8z`Q5QSuAB1|tLs_fZyt5d)Qi>hld-WWl7(c~Ix>y++RftXhh8IXo2?In;lbBA zo_8Tvz-CF0nXb~$e9tB^rGGq-{3xl_arZIVY^o4JC>=rIyhq`jvlHxE8nux86j*Ef zv*e({RzQHe3OQ71_t(9pkyIi#l2<_xXR@d5H|z*+dC!)0Wu?`gL!SlWsT*-(F%YJF znq#gq3mHaWlZUSxai)m`GG2PFU;n@?q~Ff?H{lut0dE}~2Hts48a@l6(T@jlt(~(v z^1B~lq9%~%yz9s!T<-9(S$o+%xzY7O)&Lx9L=!Zm6%`Ph|M@>Nhqvw}k| z8cL~rhU_K^4N&f1TCz^VTa!|j!S!j>K!4x1j#Z|jgW*A(y4dMGN&w1cW5)GF@Q2v@ zds0H`7o{WSfnllYG~e&)(mrSZLQNgku8moX#d_$-9L{-3dprazB2)Zy8E*q;PnKQWD*d=J{66u z7V}wwSv&qd@42oLpK+FTTbQ2EIW?~2ohFY;D;lN0XSEOxs04{&QT`ChUUQfklr@Jw z>#G4~%y;s668yAn5RUV>iW6=vjPymayT_}EdOS^_*CBD&Fb}6(O)v`?_OB98V3I1f zEey-UDVApglsEyhjg8B$C`45p^pNdhs!E5Aa$ZFKc`TX&E1Y;R>&8_yJg9$GuZ?_v z6rfT4DCLS*Se*6XN%;fLdSF>FhFl1}3ZwLE$dq=v8ZNxs+rJ+kr_pEoQK+W`vY24= zRE&^Rfs^uCRP*=N=*3^fP^QX0ObRiKYJFYx86;eGu>s@I#!eqX@}UKo=C@0)XR09V zIiT-fN0Pm*C=>h(5}DiC4IF5rj7RMbWE#sqjMvjB!Y3aaYt$e;Vk@NF zch?~$&f_b|idd98f?NQ{Q&bglz`}(Zq0U!Nn#wxlL#Qoij5-SE)Ek{03H5z#s80ur zLnHTu@?@=A@Evf1mw%Z3N}*D{v|1o|1)QS!G^OT{E*7gqbH4IVRx0-ltQ-^|U5 zrq8kTzSFzO{~F7uAT>Mg+?n70v3iv;`yG#3Be%8Zi&eD~!W-&+fk&lr!NK|Ai$qJA zvowx>D}aaU=K;PYrl0xN{A4t+3 zGY^h3OJ>bf!N%+Nw0f;(At^1GchoATGdSGg?G z4uk^dQv14#@R4t^YODDdL=t@ZnA>+>$`IXzpiX3uU3Ni){gw&WMlbk(dJ)!bg@<=( z@U||H56VW39J(S3KD$atjgwv6*B;j_w0QJpIbk0Th$CksR?oe1?VfiSf^nWW1Weix zz&V)at)zxZm;=B@lt{%6m$ zFiC4$7a*zN6pdc(SpsBz5C+vg`(W0x<(&n|+>iATku}^pQ@{Sw*_0T!CMsAgGQ6;r z8>+nz7`ib;s&8P4q1&i85^{?6#f~mrRv`5vRFL=60Vj_(XUx=SC&juzukf0{J%cmc zTwmrth?EY6v7=itQyzcAJx}t!_<&*ikQ6zBY78Z4D1_{%lqh9s&420Mt*^Z@HJ=cG|vUn5CM6 zniS0bmGI<%qi)?ck`9mvur04~`CJG#EsdJT-w|kqHu}S=G>9&uf>isqE@8dQwJ3`E9LCp6B>C`RolI1a9Vi zV$Td?EWgpHILcJ!&)2&iUDLt9MV-3!P0Z&gH?(rXUsdbY4uVgAEC3h8YO!+2ieOU{ z`|rVYEbvpeHGPcS)cJoOY}>n~_ZvhX&o6EmSh2uoalhOmK2quu{rT#1y$i-KM~=^_ z#Km_xsao;tA8fGhx_B{SS(AwRv!_gTsLff zFfx;j-^Zvp9q;SbWJ8w#G=e2>+hK=Yu0vqM^JE=XI(MHTgL5=-`hr32G zuy>HqamAYgh=HA(TD}heB$gWD92zsqt(9;`$9D@LM!qIS@qMn9Ke=shuc)-gp{~jL zCeUMCJq-GG89fk+3%8BK{UmbCS(>bz*Zjmwi43^=55!A=;mcnxy_X;w4|ZRF^xvJc z!pJc{o5h7il$gEUc^f%Nv0354eaw>!jc3dLhnynZ59f8*gGS77-ZOk2`;B)5Kl7R{ ztNcZcNxx4hrBLSarU4lLv{FwV;Ar#CAjrgVPVsDk6WF?MlE$_9iOAHpiG+_)rBV9* zG&YVlWHA1Nz@4k7IaYT&}`9>eJi1U`e zxT#L%PRzA3XGBOve2MVJ17D7AN}@?T0mB!i@6fW|ycmqAq3w-tX*29G^u~S7{6tQqvU(6BXPP2t%+}ck#_YZUx@tFnG9yvqq0L zq1abGyDgay1~3cFm)fmL$5=>@!IP-@UO&OuRVOnE6qKwtWHejv&W61|Vc;*sF_Etg zOGLB7O<}^#%#}?Y5InZszSkIhB)w4jOpIXbJsR|p1(6T$09uXR?;R))86qX_YVu^c z^M5(N0cEiJwgPtZq}SE;h33r3F)ycF!1n{YB{P;6qiVh4YDH=SQ5Q84L0HR3VKD{S ztY?7Al4txeDTbYFJAkm4N%+*G zY0R?(fos*O=7xAB*@(au45bjQu#=xwh%W8K0v@VRPg9B759o34zgrZ%h0N3ApN-~eB*ULzRLr93nVPcDy%BGL+6h{9}dJkei6&x zDjkGR?ESE8dMXP!RmfA?kxjmy7-e%RXY$rIW?R{1NzaGH=Rcze3mwxiOq7g482O~q>TLdO|eAkCIV$aP0FmH}!@Q^t;a)`fd11V{KXtU6DtAP;`113+Yr?B#kaJ zKSeK!);G-R+hcOa`Q?>6t#0!ZPqQw`>qhscxb7HabyzAk>vt@YoIJs>g`!$sIcBkA zcEozT-2jqv%#~sx55N(`aBh4i@4Qk3%IXN-6qODn)#FXn8{Luac7lgc2+S5s9d%e% z>sW%ZdP4qBIaj`VB9G2$f;2uuzPdMZo8ofX(sOAP%06gN)uz+4lMWY^Z0Q%4T1BcS zg5j+zR>CMuoXz~$VzYXGwJ~rlx%9)F9*8e71(e&2avHCxJ-W`4uJHP|(I7vH;L#sx zMDBp!P`+a&WYrI1io~)ZNGoxaH>`wDDICf!e-M7o{3AZwG5PFK9NrqIcLtWFQt>6q z52~_ITD+oS2!nDu13*;5sMLIr|6r7QO=#J3R6{#NB%Xkzp7lDS*W!)|n)Pf)ao1bH z02t$6E`rfF`_%`qKP`|(P^h>4nMofZr8H&iFR5eZNBSmZI1~^2xERg=$IP~cvQ(8w zINpd~b|KaLyi-t`*_(I6saJ|skiiXV6brF|^c)bMHU7J6tabJ>yxxt-2}*m+T4)C~ zJ*@8SvH_^=Eem{taUU2|cdYefqW3Ka_xvy*ODt1{v>N;Twq@2-rMr`FMGnEhxus^UiwSYc2tbKz+ah?Y78#)c`hO+xMRxO zH#K46qsbrv%|6DjvPA&()2g!K+)fbw>7;N=DW)d;LHXyh)aoTuXW!TVaOVz~PKs6) z8cFMOOam)G4T-*FG_JJDi(KK##>Fzf7@5YZD-8QNQXYn+*LYs0dQto+T&wE!(W-_9 zeM-5H@&s^;-XUMB~d^s#W^_ zgL!Ind@S(z?gj5WQ7F_k~f?uz_s&da+}~yM!zA-O|rH8U0ZA35GDmjQ8IGG80-0rEqrTU9JCBl zsgK%V1_q`dT4pEhpXucvCz-$e+v(1!oNIQAxl&8N@pIjQtCEt&rpaU+l4j(vb?`D}2EY6p-#`EN3oLqJRQG~OF1+HGH^a6W$%egL z7_yo$3;fs`eiJSHaj||8eCG)LF#iApB&)AxOu-+?_qT-_2UcJqDKqU(0-XdI{=|U2 zs7t8$P0!Fr!oMzwxSAKz`p4Wzcsyrovqgf?zjEb3+X2co?qh!h*x#jGx{lwCykm>VpuCf2wtPBPbPfP(vxrWTymT+Uzu^? zb;BZ<(L=QdiD4U)_x-PjXxn&6+MD+sAD>Iadw%4IUM~xK#IJWX?^m`t8tB{`>tjg&bF?z8&y@Nmx?XXg59e+lcx2707)MUN(f5mMhqHzVwv$wB@-Yf@D+<#l| z#fV&|)mpaS)dDwO!;9NTwFiUY5JM#TcgGHmdStysqWJjA!|rQ>;X756K|T4&WT=7! zJ1G*|P5Pu}W+V^^l>b?+c^E>`HM1d^K+*U&tL2Y<)WE$Sc%apB-O4g$kc=PYTM}L< zeF_sdRQ#7X!Vsz1BYmFCMh{?o;J;$|m0E@6k48ggI9_9PXh`qaGqDWGh3tSUuvI&5o=n+ffp;<&lV8-%I$w`;s~{&hjw!&Dkt z>@1nU&=#`EK9FE4+)R}@v@1y3B2}MPSwL6{k3*|55$fH+@V3O; zhBORm;u9mid<)>}og&N?l)%k>!X<)ukTHimfWyB&^(c)vMKK!@t-YAVyh<;XXKVJx zWz(bS3|@9Q+s1u5J?H64Ymk4E8d7X!-M;U(*}Z5c;$kx9CN}MSivcikTEi%T?RCdU zDG=!+-AW%<4n{!kCK9cNX^$#z-nOIa`Nbd&f})p~zT;BD8ahm@{4X>8nLNLcQ-L=R zJ$?F0PfrFEv@X*_LA0Z`4A|Osh2bD`9PA9w2bkcB$t>>aye9b?cC`R6W5Up=wFh^K zYA+9;JZDJcFZ~D|{#i*(&LM;tmk?ZV&|o{L0`q!a(O#1{PnGgrpt%bP$A*5zb3s9=lergCZbQrT5JsFhPG(_+|D( z-WRI$bu%p}i{cdOld?U%$8OX1Mf2U?$VU@Xz#pZS&20|GJSy%_c~g%X+zjDfi2aOWyaO=i7nEzF@>PG87Rdz61Z&EA+{@OPqWxz&CT!ZcR6cmfug0P zsAsIHrB!^dDZpvgUM2;E@~U9)usB75dTc`wD2Ar+D~3f~x*a;irja&E@N8CrmB7Y+ z$ak$+x5}&vHZUzEP}B8$r5^OKB(sj$NWO=ULkd<<=t!}%Q?wW*Gv*) z*j*DOR-!K60gHOV$Zw%xe@yD4U@KvH0ioj5)<4o{386jc!6#rKA?o9Xyh{F@NKu#p z_fxar33C4(LL&?zK;(txeMO7^A~PmY(eINfnkH>yk&@!%&!}bINJTcWIv2}egmn>kd}KkLc)e0XMJMxv&&1k$i1LY+C;pA&{)c6p+@lgutT-R>Qob!6*?N zDEa9=Q`W>pve~fj_vKlARHg9@wc`ChbYcB#B+?iPpu+b?Z{eMh-Wn9$V z^R@_rbSx>2ba#hzm$WQh(%lV9cXvvIbf?md!~)Wdbc0LztlrO0|8ID~=d0(;IoHfw z6U;emr}5?#$#e5mD>@;xpWYZH9hH8};njfz|0z@ihBNq603iU(QPTC4&Anwr=T|Km zXJ$c;0^{jpN&REH@(I#j7os2r|Gy@h76V~4?_=}jK9q!$ZHHouh~u6WL+igDHN$95c6#1;}PXg{YbsW zK_4EmBKxnZB?CmA6KxNmoO|a)VKo$M+dy$`_AXTgj+7H2cKGC5^B5~qe6S)A^)E4& zg5gtvm23dN!=xtoFaN<#2HgydtcL6Tpf^`*ci3e=Cr(b)ndsAR@CWqW2ti!}uh=?( z(&+tSu3^wVSx>My(ol@{&aNm~=Zn4a``_REj|}}_-`EQ5rpf($*4F5N>F_7=ei_>i zomp8>{i|l}vnVN;>45&8BASN5=TC8)jTt)dv-Oxv5vVVgnPJ&)I~n4GIXE#sXT**| zM2$7Y0y;1JvY^EotKu89UfVzILu`k9IMpida5sA5Hl8CdcTQgQuH(vR3tu(FDRy6*woiO^Ia zltI+V$ePeL5u0srtbZAI!M8ns3F2l0FX*xOZF}nHxD9E|*Mto1WSB*EUp+9r@4)aaYuOPZ*lW8mWkdTfzre~o7~#mKq!8}t zljUs}-@!O)`}I*GAhs)9=Tu6653lXW^xo4hI?C}M?m`iavpt&eX$A*)|HL6mBGnGM zq;2X<1@_MOj+l@iFt6`D>|{k0r+IY}gYSQrgQmmfos5Br06=0kMP!tvKBwy7?d9RKrDoC*`WS0WaZ3?Z z`n;=m;qZ~0=o@l_h2fhgwdV|?t$nMGkRe}^kqTw+A7b>sQnk=8VX#jC-;b-Tb1yrl z)6=HqTTLR@MvzGV3;gwgn}BVkymXbHpw4rX_1FxIgt5orD}uXE@n$PAV-zgG{ZjKK zzwz+Dl6s+g{&@sl@wn@>x2rWbyH`zo!?$SxHDQpRNVL9jxMa^}vc`}m0`du{MbUU) z^oyngP3Q@l@x2qN_RlSLvQbjCpGvqd|HOe-Kexp4@$p^`fG}ikCc{I3J!1PPkV__Q ztU=}@Z;NC^cAUYG{}c6g!;-5ggez5}tXG-|nf}yQZ4O5>=zUGlJ$%!5?tAJS97A(c zxa*YoC|SGbUxiQ>{qhJ%uzNSZ+B|BCZ2)r7EhzIddqNw~_=%R-uF(`CC_;QlnC_!1 z+4Qja@dQL`*sTA$_%mLZxT^{PvRA~c@? z3NKxJSVXYG+iGT3yK=1u0EUKtXJB${k)1ojb7{1@(fc+gysKG*&Dgw^-Izh96mf(B zvsi;-($bUWE~MNNIlEs6a2n}vB5g>Hj&2V~K>R6olQ|6XoDU)U3PBAbCrJo-URs7% z=RUEkX!q?sdu@8Ob?moq(#=zH7Pt6MIf;z85|6ol$8u=^q zm$(2iRghmjI13s;}fmb!7_}o@_MbCXeL<(L7U(3ct6II-OyA|cY<>5noWxp zi7P_}Q)Pw7^>n25z;Mk3#^)rk@qf9F&#fOA2f@Z{1-Q;@pju`LRt z6+mqueiZBcLPVrv6aHU2Bzg3X2^SDqR6Z@2?km-Zm5Q5{Sy?!8bSqhnzL>Gad3eur z@S(>-7KpI#YPHrF0RE;6!Pv>MG5cu0e2^d zGB)&u?-OLhz>QBO#t-D~k2*|_@lFv>IUD<8Y$I{}%`G8q1@Ll*+0Na3#85M9T51crac*f32!Fmf5wkcYww&}d>k@iR)fpI+d}(c^jKy@9a#IK1 z0p5xwBLmucFZ6YeX3^eM4BPjU`e-((s)J3CRk@qQmwGPRafg~EWJ za$(v?%B-33L|{X#uC`yy31;fvhuNfq z6mXCA(7Z+r8sNNhjEMa=gSzB@9HhTOC#I>_!=)|;vL|Ou@!lcrMX=Kg(I7b+u;|1& zekJ+eakuZ(n365Zzvfz$crF~*pE3YZ9ZiLu^nkr{qk104p2_C;?+u=(;sk$fH`)_| zcm|Fe8>QN0r{B2xZil6QFOvsDd)IZGX}b9F><)&1sbnF3L;d^|pr7Z>H#lG#@`fa* ziZV$f;7=rmf1G2aSnD27y~t8fYC^5L2d6WhaYUI75uVb9AMn|tt<&pqSY@42*2Dt7 z3jbf$N$RVx3JkS6YH7q*B`6?j)n0x5(6Z)opL^r!t<Re+ZC$Hhe@&1+ylB?cW!9e>-1 zDJI3A=8pF;%wh@-n8sq^7=67>4P@gw7?*HwX!seG>JtYf8G{6&Q`}~>0CEnP6#qNF zH>zLXfznmlnIiS7W*Va_=_cww4ee_6WBYm&g;-z^ouncWJE5a~9u6Upu*bk1 zzd&ZWOQMja=z2*H{o0$SUza1!;!5wE z)XDf(##MeC0~BTvvEU3V$wRMMZf-|Q!oFZs$es#vA!LZ5kYJ%T!Jv{nlg4`GKZ=~` z7^53xy@DmSJx^zXpWVqJl4z}eN)z--2Wu&JzxQj0F!T$;zi5%XdbgeGLmES9c1tj= zpk4UMv!oZb!|&%FRR^EG4Y2EIGEdfbts~)JEIg;$S)Tgn|1V?gn4=qX1YKr-e#8(z zn~P&T!Ui`i9-?n9oXypz+8_-5;Qy?0{B9q*O3v?9Fy#+chQo8{9Q&X*ROR{liOqvW z{i%!pQFS!D+I48-OlpwDB(;_6+U8?@3F@ExFf8suqiZ~~A)=yg>4TwzJ_>5AN!z$9 z79@8!V>sw_Y}5@*l=ad-vSNsk*}U`caf!BJ>b17qtQ7pQ0w1B<6RTkaxm3-f`c5e< z<)Z#oUf*^19bJ34_E7T_JM&H48Ae0nYGrULcX8qE+l9{@c-LTw;Vt+{HhFY*qz}6n2oM5~ zp_xE|W|8O>hHg<#mn>_Vf$FctW^sy9YYhjbo8E)DgJ<~O{5CXgh7R!z`@^*j*~^&7 zAQ|?dhD{xuwqL+ml-e*3xnwOu{A&Bpn1IeR8hgut)TW!IYpBI_~CYOCqN3UVWB|y4b)u$ z&|~FYHuKwAjFx_7p-P=d`5KvbN%G|z9BqQXOTsP@!(Y26==@&t+rsP5=K;B;^}VP- zxNBGb$`-uu7~4PBj;q|`$?Mfn6GgNT+63PPy-Cs1y9mh)@~ZeUx-nBfM2)~zQO9qx zluxa$nS&er^@8O}h{rIygBkg<_Bw>P_kaa!u55fX;4{kNQb4hn4bj{hYgtd!Vr26} zc7C^%T?oRB;Ab4W4T`ez=UBy?*KO=;;H>REWX4#La|N50^Ptpe6uJ+19F9*&Od&p6gMcDnX}>wi zwIJ?yLqg>{g$M_I-W%07`rV6Xr#D?qgVfT2@~C0(r|QIMU-O`#LIbLgx(+r5%7?e{ zM<4{Nnen~4BN{{|VNdBt;TtzAu@(5PJCDFjzt3)H4V!vc=eQBt_vMK>lX>aX`Q_ak zjWjlg{qlAwq5|bnUJ^u(&fe2@Uy8#tAtpy3**bTcUlhLAYl|n7y3xJ<=7FJ{Vo&g> z1BDcs6b=w7V?QXgQVlAjrMX}FLo|)*pt=+L4)p`DGWV3}C>USEk)XB-M*e1zH~f*Sb=61zccry4 zVMY&n*Ffl%f=;+1nN1ca)m%2=nR`=bG+mSS>NaM~LH_!)EINsIO6??cHGg(4Eo{Zsy3GHXN^w;yEB@m}OLUI`$90 zzyHp@C+a>5ir;hYteGfsjqw^KU=!QBLcd%_6dni6n|`vhexT(iT7EZC`_#elIqDQ`R`QOj1dz^2fdwBnGp>v^ z9Da#ZGLuNoz=z)CsnTU;>+19Q^3B5mz0amLt(!$*cSQw_KU*CN@(kDXQ>4 z7Q3r^wU&F5Ut0v1MZZBn-#>_ChY}2^E?NW^j1M{w#3zdH{)yv zkSncfyvza%=3^Iejn`Wyoj_WihU|Jvj=PgT( z?+!j5CU%Pxw2+YDTK`BvQH!kSZxYf3quRT597f&mGaQNReEBADO@2x`a=c8|N8A&Wmd-b}CW6n>m&QX}|A z_Stz)_NZ*^EN;m6$-c(G{*}nFzK{#ck(TGp`Mt*mp$xs(lL`(Eq_`W`|Fp%4cMuFa z1)jDqc3gq|2KYYuh5%((F!m-LW9aD8?j%hF*7zk&Es9CP`;YwiBmb(nDAI; z{^n|sr8t8iIOR-Wl45^l)FALwF0*$xQC-$OUo%&VyKg+SPxJA~X9NA^Vjb0*6^mOH zB5Wo9&RwA}NxN_~xOvkszsG!>@Z+w>&hkmjn={eS71d{duG~f6??e?jPRJ%4!He-; zlv3PT)jSeg-!NB~oSkl$kAixC$x-lVL$+Yf#LxN~+xbYv`&PIs(DhiF`ggUZ8esN#E=;!+4&2D{*En{cG2W6ej)s;g}n0y>)Hg1We8LYYOHx&qRhr^P$)* z1V=kLWB?Uki@=waDqgOe+|5pSYMI3R*h^VK?u81ALa#-7WGW0DflcghQL;KZzwQs# z>k4Ay9-7Tg&C~3aS<$Pozsln+;dX{BB1twJ4$Ii6_k>l*27P$^$=1~Ti23}o>mxe& z;FKg6CEgfKu{#joRrz7{Ctpmuy;DRN)Rm80U|8~BNo2-~79HSAWTKJJFlLvb$fMt@ zN@3dYcQ9ULC%y{8%N+*oI~Gv}nqXKK{xwVeT-cWUpp~;XTZQf2la$PIpT1}C;q$Ld zn}1xRK%wnE97f(}>K(0#2cxLwp+Z{UV#zX8yp2Yx9SQ~QgpuL^ZX_sKem+<_V@yb( zhF2T8Y~X#=S!Dtqp>po-38>~+$trb%N{2re`sObJN6AQvPbY_IXKy~0$&Yc|g0O_~ zYvU{wP%xzUqU47CPdh27@C)WzDG_gv0u(k5VxMwvbM3VVSEKPUQ>E>0U$aC4$ zgO-KGlD?ah{@d?TXENfJ8{saSDK`y`sL{nzHkpQBTY0R|m7XpfPBF~Q;&30`POEYr z@6z11)RER2&lc^TG0vkuW5Y=y98KIZ_*Z>a7N}gc?DV}FBV^E6;kALjvh&hc=!XYM z{X{iEIsIpsw`XM!baG*bLwabbXd0Tk;O9D>GHzkgGoG-Z6Nu<@veEhvhBW0m^(4OO zW3AIE_X2Y-{JS^FU2}1;){q4tUy3K{jJ`!~V_N%Tg;1N2$l5~9K((fK9#cbYrv+}a z=b}A0D$%t@XdbiA+7!kn9>>5q6Oh2_;IlBMLj)JkrD7V5;P)j+5czl|)jzrxFIZGF z`mZbL!4IuB4vR0;zcMCM824oZF4JXru#Mwjs=C)HjK}EyfvPih3K08tgXMM7hVrI#6POhHu(Jt5>j|$&S2H!_ch%X;h`7*iq z+weX@s{|!_*q?u_H+Fq+jxM6?pgq2RJ-0jd; z(F_J}Iz$~4-ppTYWPCUoYl+U(HyO8%H&R=VaGV#=3yo=SJgysAkq16kUBz<@^tw-l z_Ha`h1RZ`X65y`PQcJQRiN^bPF)H*CJM%5=e+H8 z7$QTF{)M>UUb+J^yLnpu{cQjq*+4+n0P3txf<0jn(mIvZ(E^A!_Zh|7?#>>b+p|*B-J>kDzU!huD zuUkI6sfJvuw;$+KYzomzJOVljo4rdo%4#|HPwmOzO>rq&HvcIu_`%?(rT6iB`=us- zX0##d9NfK}#2mD(*MM)ZK=Khx^@8->{ioc3Z|72ywyvAF9pI$bDK&Oa?a*r1OD6w!7piuhDx8rSCJKN?^hx9*224RFTb7DjgTVE6Ro z*EzW5b$7yH)M7Xp)qET=@^t>xd=*bDv4|vi#>(tRl=VJpwO#L|cdS+CK1g19wTwsl zLfn=;j4hE|B+yHu1gAi7(uE^Bx;WA^8DaPhDB;jL396kE6 zXJAqaCh}@JhX~`l4m_MHT4z3?t9sTe%#&PenZ0*^wI{+peSC9Lc`sjKoJzQY|2(Ci zr$vI*?2C_!sNR!&0|VH86+O-^j-qE>WBE`?Dd4nnwmG1DrreHN&f(h2zsxPmKiqs~ z4mu>LYnkUTn!tofJQsGi)+ou+D;4(e8#Jz-oo^X;VkOG<%hK~*h`-&yvP4fHbdr?| zdKE}KR{V*$zUZ}2sz)&kjb*bvv}v=N`~+q|6W+%5%X=Yi>Pn-fU;&YnKz6pYs_uJ8 zdR%QN(KVmFm;ywrEEEueEl+`fAWRZ*8^bd#Bcx2%Zz z642B2tEwnag!xUEk-jW_g4%=@t5Q}Nb=x5ocLS%XzRG$?U~=icUOpPrRJsz?2^Js0 zFGg}GW_~zCfY4;M>u3eDQhMDp&LC7#pBRlqfz%G#1jvM#TWz5rG;H1fA3dk*K;I%h zeFUM6_5;nS#@A!HEMGTFD*nhv!Kl>PI&8^_d|77d!6PSFg+$mWX6QFW-Ufb2H>k-e zYg*xBNXPR22Fb5$eQtk+?btcem#qpNdF#iV(|6<$nnplXep7xz;Oy6)nK|;6Ac5 z$ohwuofxWFK)&_XVcs%jd@RDlb!s3jch%3kVeaemBLW)G|!Sg41 z0Z7}!_43}VVP#Frw~Y6=b8xqNBZAHC<205sEwXl=zv!BTNh?e~%{0u+mN4mDWfASu z@F4E3*A>PoPO=aS{YN6F)Y`hddl;B z!u{}-hf4V zuCO|#=Q)(szM&q!IAO%~1bQ&LMcT`_{}W#yevNf?AS>@wEF&GloY zUGb#**5XiP<{&*I+l(lTw~z6IIi;X}$qtHb*)^bPkprT|R-9v}8J7r%+Pcgp)~ z*ZnwuxJ9w^;Uz%|;GyNpaJKM)u!*C;KAzZG?MsnxGy@u)3f;Fs+kS-}7yqdXD?wwW%DuFAiXb)5$Vf7}WI&#!=R9W z1;s`|_KBC<7R9QIkoY9VUv4x$)0a(d?>C8IX3Q)P*sC!+XyX%4h8dV4-C^96?%wSn z;zo0rEWt9VxGyW1s^qFIrtNVO} z+1W1HvJ^N#XT@$=t&^w(SW~5($b+nEf9h6STsOwU-oK2B?I8;Dxq^RRhiA?&zwSpe zzAa4gdX{lI{Ur;%AXgT%UI88L+_a`vP>(^Te}WrnM`xc4L`xxXlYl+98d68$BP_Iz z==u>#ULe`6k3CugXjAclyO;#pf{`3G=R|va2@^g&E;_i_n8>hU9kK`eo)O8McPIqf z|E_faoujrBLZA)3R%~VHwQlX38>+(RN?xd2llMd_kn2b{lu`Lw}Gygkl~Dq zKA{+1h=M`*a!wq}OxLbK@z_T5NO@s`{U!Qk9kG(t?uv}sF3#l;x&qiqEvf4}c9RNS z7|$igrK-r6%lo6Qk5s@_6|05@`$p%sC^Ge>m&4v+{-N)!78SXZe)nIo{!d9kDRbwZ#)bGtJ%M69a{(v#MmhA0J~>`S2AZp2vH!*@|1+ zzWQ}x=uman*k46fCf&z)n-*GZ%v_Y-dRG9^Ru`{&yg!=YY-#;LYoL#VQqxnySc5Sw z#wgKyJQh^MmLR~$AkRCGX_q|m%9O6QEsMMk=`W8esWUQ8;Ss5egz~7t>S5ou(7`=w z%>;NqpR3!Iki9`G%afM4*BPo1k0$p&$UMW?%s7C^mx)7Z>^R3d#lS(wPPjYMFa0}R=(8h36Zb#w^n(#0Nit8Yo7iR@~To!o@)uD3(J16pI6O)~gd@DfHW3Ufa%i(QJ1RY8qC-;^%U*|**T@eBq?ymIMxz_ zMN}U&8P;jv(~9eSQL@ii@P{8EZ|LqZ`ldxxk~<$@c^~>+BIBnuL#?`}ee2DJl?}iAcMYkwl z+@WH_1VT^0(;=f!#}IoN{D1ptGfrpSno`F9&7~sklUT(v3fh8L9l*yS>@#(e3|UN- zC(ZX2qjD}ZaPikZR`kz;(2;SRV?4?@Z*8rGYm2abWS#Gq zDymTLIe}Ybv+~EG{j&J2ALc~~3NL#zlUcxDvFn%TK0RWNdZ25GkY0m{e|1d(gX4rb z=?n=+tPHqcnF?jgU$1BygnY1e)yr*H;Na^>Tu4@leB5jls^~WWtCMO8=GA;>5^!MU_dHA~ud$r>(C;byw&~jMlJYoe_^`}v)2c|rcGV8jVaq3RN zm@&(Rhq-scYe5hVY8%2orBp_9Mt_8~AwV%E2(fiShbpDAev-F?9ux8CTp^#}aK-l1 zyTJm?7Yz5Jx5X9ko)mm)4;L|prnP-@02|a*?2V(geS=VcyCW)~xd(Z&g^X*y-Kvb| zY!b0bTB;Ct#-(5%|4h8a2EY^E3?D>s32VM@Hu(4sOW9_btpS#Yx$S5tBFr(CeCowt z;O}J{Lk_av_&~LZ}-e~nf6{AB0%*RH-q;0%iw%& zX!6T{CU-rQ?$z^S@=K`6_4_1fvv&Ksazc?Z9|for9(ldpsD|M55d3(;lcJjS#5ka) z7gC1Moz#b|naTViC#?G{H(Tk+m7x!j>;P z&fkyvC6s79sFJ+-Zg2MtW47_(_U(88cgt?UDayNvjS8h;-IL}xVi97}JF#6VmoY(& zDp-(_?Uf7d;N5E}eVxRYABb29H0IN+yuIQVDmm$7y;yTOSH4DKvCPNZpi<@rp|wuG zqs7r{pznGFEcF zO$}FmJ4ia)mCy9`G z%tvqW(Am7W(h1D8%1{0OS(CWrLVB#OMGse9s$#*ef4 z`k1)Pcr}*jN#O$Ex$UFq9iEGS4E#sB4pVnQH^m%Tg;_|!Rf&|C_^#F73 zE!X+c_4VsNTyk$=(Sh1zSfRB)7wzbLg^5zOPH=?cM>$q~v;doP*Z5|Tv}3xV1$*c? z+&>-b2+crzejJAz?bj{KfLQt`e?3R%qIt&~$$HiEv+sG`U8hT0`w)o*!>fHu4#1>} z`aW||Rnh9*QWf9qTM?p+BEe!I%Vvt*&T^@!03aGWl5sE0_Q;S6bVUDe!x>g5I=ODN z#7e#M7(s}wM6f^ZCKm?*DoJ69;6`6nHMXf;Qb@EL{eK2NygF(6_CtJ2lHhzk98B4i>mDGxlZLmW`odpOEcSW7Q%rOwqS5HCwjx$}|2% zGskrzF1@X?stbWrs`h|c8k>WZ@aG6<&w+2}l9x}4ZM}IDRghclO3|$F%7a%n15_x> zAMQ?!*)nN-SBJl&*w;&MQqQ8>^Os+|(?;lRX(pg$cM6TbEPw7XE3vY^ai%Xz>9DN;bZiAxb@pk%7Sjb_Z>fzqoV7(r zAqWfqJ;A>`PA*XiJKU8T0WDzRlF}%2YlNZmoyTP)L(QISg{Tx0M1Fu37B>l*>c`l8 z)g*IEgg)oe@~n{ocx(4v@v^#sn&#qpHmBb6P3J1t7KZD_w3dvO?gGQ$VY!ntNOEou z#;tA1%h_V7%BbVGC2rzkIHTOp7!`B%dfC(}|4MZv>bY^ZS-#f51}#yhvTs{HU(Zw8 zLC5_OS{fLOc-K(zCX$|LL(nkk>x(h>*5V$_?9GyWgZ$rp1MGc#@Sz-(?|{ac8HPlX z#dsd$s90gpaU~ zaQjJb%L1VoZEQOrArI|G3Bc7=?ew#vlZ>)X4k@=@1akJ-a5kc>EZJ7=m(Cj%9OFvu z3Y{&~`q4lQ=0U;mJ@v{l{xFN>C)AN86cjr6hru%)1`_KXL&ULxuZp@eFZkN~o_^mLub!?FqMLW-U*o9W z5_2sOQr882MbSZoNl4ik^Gw{9h5_hPkTHA>C3n`ORNV?OO2yN5^EMoo`F?p-4g2y4*f*v4;jxdYy+k7HhENsS$-4&WR0M7`=P%M(o zsmZs8e~mTcY;z9?S2xee5l0!@a^kO@RosouV~^gzZH$XTs!d`I`Y-ON{axva?oMmY0$D%4WDP&2D~*9;)iaO#6Rp9W3z^<3mvYo)Plk&#TV$bF zNv?@r`Ux~_%AI_Pw3|9+S4GU2!|(qILq2%75)kzTbw_#l%18&7o#b^|TkMcCrdh_e zanhS$eA2%FFDWU&7fELsEL8w1D?(4TECPC}T+maUlYl%cf1(bq$aY$iQJi(%{Zkk> zb-E}R>gG8EP3`1hbrXV|Q8F(Bz9rL8AU_7-F-D3ndb&BKN|0C-rdK%vbQ&MV0n)z^r0L% z85`oM?;c zx25ky4IkQahU|h^6GY=<{(4Q0X_a{5aXeF~ZMP_7KqXg@SdGYt2(RqGG8kJ|aFM_d zr2qMjN$-rykj#UY^=M@0?ydj5W`lqyM^Tl*+J~CY#k{6s@H0o(S1cl352jsZV4As` z2XWWrK(c-1v-g&FT}=RYu;Z+G%4=H8o^n$C4+F9&+FP32H8j z{+g=%qEzM60aLT|$%julSnauUY*Lk-cJXsiDXO0T8Mgo=uEg!?ccK{G_@y87;|gNQ zoTL+Fq$Mhr?coJshFiM~p{u3mU}F-W*q5i6kDSvpWwGxzC0lV&n&C4vqpmJ|#6RFt z6>V1U_oM9#J5#Ki`KAA4q#H|j#KckE6t~`ZZKN8^N%R*7=FN7lIOg8BIeNt-cMb#jOt)&T?J;QE@>7u8%tc3S$-^DdF*L#woeHa$G0B zk2H)?Z4-hC61E6@Mbc`9--iEcgp?018rS8fPmG}1mX&bFe0=WIumIa7fh$*&Fcq|H zm3A97t!%H9NXzdhz#?CeORrv=TF}jhje=VmC&%Df5eM$u9VGD46apv2C?osr_=b}9 zqNn*8T*A64Q~SLxweC~>9han#^3U@7{a_^)ftq^tR@TU13Pu8Du{J9OF=hxkS~?)j zuS#xpNXC8STR!T)qB+E<3>AIfx{nU9aMhO*is6@k+CPrIfKxXF3B1&6v42%zNoj*> zWno2YvZ#b7_=y=>A8}fI12*ByeEhA*XxA5W$Ibn3*xVKoL-Ko6`U$&&kxrz@ zy1^R+e-9dMxnP4Yo5iC<0Z7{100-5h^uF76uTzgjtcANKIWHL0V^McyscMdH+D7lM z?gU168mN`%We|w)Q@IYepbMLWhYHIrA>nvQ*hTZ>ids}gVB_1 zdMN+(6i{xyk?AE5L%hQ;)}qg;9B8)U!Ko_eTJ-oJq+MgBAX5jyj@1 z0lGOg=;oBM8cau_o0ByzQOIZ~DSU7mtVSBWalWOlJ2G;1_iyZO_S8~bx5%j?pl<<7 zm%Y$h?=yu#_6t5tcUr`MoYffm0}`Ug(Dv;D(M>`uB!f+4zCd^J)Tl3M93Vzh9b9up zhBknyBv4AbCiq+a`M*w@VE?jn)O`jY=v5&6VhmyNq}kiZD?g|5)nbbG=MDdQaTV9& zC#}|;taPH_`~DFr8#&nKo7DLo>7|~=ozJoC%JAWU+-`HK6!oN1mIYjBHNy(Y}>#0+{C<;XtUb6 zE6X7IDr1`)`nXsuaE?v64BjspWgV!<5`(qHs{z=+iqC&+XnQby5lx0FW_~Eog|*{C z&hdwS0*XY3iQa(5$;nO868l|khS%kcvmj<@(z}UNunYSz=wbqK@mH7M$V{dF){zjM zXid@fku#u@19lk6IXr31gR<#NseKntd}Kl;3g`2MOQhJPPF!x-{;VNwYZ(3^c#wyZ zvsd>PhB0ir1Qq$ zQfXXOKy6$8zB*&Rh~|dXZ;y-GPLcE6if+2IE#Y=19GKNLu=jeSG9g{C# zWozJ_Fk`X@^flBAFc$hZd^yg~Lay6)F|RV~cCw8-d>b!=KMHKyqD^c#S*hi?RUC|Y z%1df6l)E{MZ8Rfds$1$qkJZCVD!;5KqA_ zzKj&x!=rG=%Eih3avOnqY5LCrF^665ICKkUuwPsNcSUc0*d;&p@uR=?eqW7AjoTQZ ztY~lWbR#moP}%wf969&v>;}S{sW-}=KpP^519|cUzX(OQ5?tm&WT74F{9Azp^}7!3 zHUxh%4W1iWqp1&ez^YVxjIR}a#OqCFRr(LdzyVM>J(Z1i-_BN_SB~CC6^1a-2ZE*2 zp=RWq_xZ+g+tRFY^69Sy`M!=h%ScFvkK}9q!$X8+nI_tPWeOc2DI&t@1j!iM_}+g_ zgr@+MIH(mMD0c;|TBZw)AT;3&>{dzL{5tVoEuSa|gtfZ+A>Tx22;X2yt&!@pF;v~Q zmXC%pywaQqX`EehHwlv#lv+X2U!}=rMwBA{-M)yMRq)0RX}R)}G8#{#PjXk(Pe^6_ zxhZ=PH?F1yc%y9i4e`cRjW%GUjn02H?M33TtEh#{tH)FFk95)TNbaue_(lC3BF?>5W-VTRL(~gtj{1b-Gh872HUp@pX3|%x-7^Jrf@z}ReVX)1cO`agNPc2?k z&KGI^-^bRuXsv(k{_+X%3R5w4;6PEHA_dJEe$sQusSv%RYsfCSu(@f6y>M zWiM2drsv-9LHN_CWeZpUe`lJ*0FGIn{j^--o)?3;X!@;>c|6kp^bDbf9{)V~WXdJ$D5nj#D!|OxIoB{(oR`KZxe7b^e%j@L^>=chq#oOqPl(VO>%-J8 z4%q(b{9f?ER>ZN+&qi72`|rVD6fWS^rr2s`wwU(v&p*D7(kkz;*EjAW%^*@bdS-iz zZWThR6GYqoHOI|@RoaLqw3yYXsb_I^mvCGp)5#7F`IytoB5SWIfjHIJ%A&a`a%LZX zB|k%77Uk~i`0R=yI1;jz7W0!|8=IR*ivh+=H=!quxU)-8KVS=7+ytnln?#Qr4)p+) zC)*!*i;hW1&uTy?)BR@t+VEhP9emng6~+Bt7SFxZ@jF4jKDr>#MF7n>1JSZ`$Vmjs zfetQ#`s}~_iy4Z>?6eP<)6AINOr=^+lmLX7$R2)_$JJNBxw&g-`|3fuW6UkG*39v$ zDEP#l)V~a8PQQxe%6xIQE{Gm-K5c&L!ctBJYlOYtMH&F@3#EmDy~wX7RTUw}_E}e>7=DUi^DM8Ap>$xE0q#HP89=gV9Wep+ zGG_7Oq?|sl>Y&^Lbee!U)wU95!wkz4Fr3xJX{VK$owix^Z+}D38~Wx?kVxCne$${r zU`J5?YXGIF(9kOYUxJr|q<|hJy4O%pqU!lJBJO*KQGe=OH=SaaD6)bTRJsb=q_W$H zwa3c_SCc0il@Q)Ne0lu-)#N+))O6;P|I{-zT~#G>5#E2XtS`oGHAObn;sF+WJizLW z;#mq))#6;sRTXj3a6Vrg?Sv;SP{4&^FT`=!NB^EN0xK-VaqCs*hSO5Wakw=61mC~- z&_H~`lheRiDI;CMAlX{$8=g^65zE$n^X?W^#FN*CS=&g~vT(XgOzoO|1kYGi_tjv+ zdO0}FN&^nea9Sbmo$EUt`^j>;fIIzp;@+`g_4&i9HZshE>fy2nx$SjG`LFh6A_K8c z30EYLs43q{ijVb09~ha6l$Wib4X)QUgnVsYFgIkIJ$6+*!G%xfX=!Qx_t&lnd5Pw~ zs4ur!*!Sx67=tmgAKM5TF{fR~dH=Y)Svp6^-5CKE!Ok8gInQ0l_CPFvwT!jjC(JpO zH(_dp^`fgjy5I{&Zw!3fKUv3P#M_{<+9_q=JG_-R9g>qOK-pU*7K;G2k*+h(zXo7w zB~H|h6nH)lS^Cee21VSymTxicI6H*lvYlmqD7s1EpF9McpWDrcO?*S)cb%c}3FX!+ zj{Q?xNWNsUHqDbQ&PgdR{algyHQQGAqHzB1(PNL?!1UXcG{|o)WYuYr0UfO0#v%yc zv8!O4)^f!I3Prj1{O6iNL+>FUyZv(6FMw|-#tA-#w~+cyXZ8@vPHYkJwHWAK(UV&r+Bxb>@-rJ(l^?}?C0Wr*lyW8H&yuXbw$QDXF)o} zrD6NwzB{OB+seAj<0_7a@9|(4`i#Z$ZEFmpWubpax=yt1mjkTz5#npTR$F&cakmz# zwvIXhd?LybQ=B1s*-v;KM}~DhPv(>c5_R~P6{g;|eyv|lGu%Sh(~Gdt-*V*9ymVWQ zy^K2K=u+rgHD4(pKp?iyVvB_`+>`F_1sPgAc|!uXtGqH)0(|Rdq{KPY>lsTQonV_q z!}Q=B5K9Cegx>393(XSe%yc&Bh%Q@l;Wi`F~`i_Cnn9; zD$|-=l@u3tOOVt~6H2Twm&;Z0GF(i%|}`UNPhE%k9sy)TSfY>=3jg&0XorI8P= zrcBPgN(KsfPeLQoQ2+bh^k9uyay4fZJnk`@0c_$%4A4}iSdx}6q*WjksM;I@+syHw z4?taHULURvIW}|bZ-rg>w6$E^@Ao^vf3$g?Jw)FxS_HMwM#J4x(tW_4NVBQr+<%=d<;YDcqRw?V`8lT)+J?OLJ14dV;2R;a zS^5z>E@2@Fcdd%|oO(~|w>6^l)x!l0`w|b92J?;d*AE1;=`YU5GHn{8#y`sVl18m7 z+HDNKmXu3ELSnKbo5X3Vl*@}bd3w@LWT9YsHo#!%c~d5848ER+TG9P~D`|6D>Be*! zTH*)v$SiMoMv%&8+ z%#_cNE&Sm?p8*%5-XgMLM;erdkL)=~TN!(CsSPdAaRLXD7z_X*{?T()j%|-j)bT_crVV18 z-D7o8&=9_2g1;dP4$bl`HPXl+eFBkY#LGR5ev_!qYfUo0c1QJ%sq8k(P7c#Y$u%EC zs7T$xoE#pNyo-)n4MFW0b%#{r0>QPf26nZ$7mfRqy%Xw z41WPE4T(6JHMII&y8TYL1UC|BS}FD(OWY^gk$A|VN1U~Z=*a}BVJ|3DSNM=CWM46- zJ=jf*zQT9#ri)+hIW|jk2Uh}>DHHcKOMG&&$wNXtIE)YeL;3_T>yY8GtdwwRm)^9j z6RK4RkD_lzZgf&2K=a#ZVVRSUFryZkeKd-bWIC#&6W##+Dz_feP#dj&w$U2K)Ct`$JjN2p;;0jv)Iwbfi7Up%3MJ- z?)!Z3k*SeF<9=nje~2KA51J@_5@?oy6aB6(ADxQ=ah1BJfU{o*x#boe5ZN6Nog0+G zbX^MyIQ{L=PHkBw>QHKJ{-lUvSWr!jL2W5txL|tGBE4qniLGS1>+u>8N$MvS6be{w zxv&+2G{!$bSB<)2eM!E+zEQ3K(Og<}HLq|;(9$njdo8uE;%~;f#bbujG^CRKBCnENr@yS?Ii2Z<1c32Ix+z3>_$86NI%{KW54{rCx<){?D@3ML zr^_)}CKv|t;u$w=082t=(BVV#sV)&K>u(ayOC$co=wq2D{jEYj{@f_2eNIo{@`V~Y zxt!CskJutVFcy|PQkFOn&p;8Bjuo@hpA^L$jm9wCm+dET8HLOU>^)|_=<9!sl}&`T z1ICQky#0;+@z?&E1(#o+H?W-oAt#A~;bgjrwozkG<=UXlKG%#5H_(1r*BLY~pV3dX zto#jfJ-O>_{kmv>bM#{dR9}H%RG+KEAH%T?stLohpa`j@&eM*4tZzJnqLawet4(e^ zf{i-?22IramP7@_RAEP=@K3n}89=ZFmH#^b!N@`}<!~o8_=! zUhe8=m&A3$#}r${*QR3Uy|pr4Rs5ji!z}%yTV)hoI`*}UAwqrXv_NUmh8 z+p@z$HPph|@oimk%;u3Z%y|(QPEn>bOq@@W@O>MzVDRtipx5xDlZIQll}OM7fS02- zUgaT@7>WT22Gj~7x`)N>BbcM`)wl^FtvUeShD|Y(`3Fa`giCHFnUT~U(HG?>x*+RE5DDmsLXKVD=HedjOz?fc}~KCMLll@&6MBnKmo$`~(awn zf*dtFHC_lz6r;>rQ`ihn@js9wTHRhioLo-50j&K)oGt|4nYK0Mu=Y1@EEW~Qw4%6> zj8+2Woz`kpq4{V77-eeSW|wOKa5Q>^__eEp>=I_OBOm1_)(>V5AVlLE(#hL2e*gv+ zI}!mfS3?bWyo7qJJPvZyfH-rEk}`Iu?b_zVlOy3dr*a<)T90&GCLCt8Vdz^*p?sa& zEoet+pyp9gK4L*HCS+rsI~;X-5jF~Pm~AN*Fa&655i-j#EEDNNr1O@Or0}c+?n2Z? z@z7teN?H}|lS0-s63#96-3X9i!ytjc;7=Y02{G6I5+|Ri0SqOWkTM=9q(vUm)X$f> zet_(``7%^4U>2_#;5h&+U;#g_+eG!~aC)+!*G~4+Q6dGAtAaaC?yGFl=U!v>@lo-P z*XL8D$JX5fY!g0APP+wLg$9>p6~rD*Z4T?UwqKVL9uAfdS(8Yyi4&V>hYPl;g3U8} z^M8HKDlQuTHSfpls+NuD9j-mFBd{Ou$@Gq2T6@Al(OV)^;5T1tgU$LC+UW$|)~(hq z>2b2w@5e~di}{`uzzp?u;^eW_fttVtrtu)bP=?bsUd+?Ta|s|?YpmgM;TDxLw>?`~ z2x0ktfpU=DUs*2CDnR=AEYm@zygc53nwL(NmwmY^ax(}Zyp(O?5|&xrvzzrJsMh?z z!Siiayn`&OoSs6rt+fKQOiocZ@3sW~uQ?Dceewaq(A|%lMAAtEw19+uQXb3(zykAS zr;(htO=b^OFB459qdZ^MYM73@Vsu`-a5FP{zH|g5or%yX*-ePDaFE{;R-m=i!sqRJ zlHMCNoI^)UsQs;Cl!3-vj?FcBr}JnRyH#_LeaLSt2W0Ko9X`C73KV9)B_3xV@cj-+Ag}j|AnRYu2g%Nwsl76EM(P ze3~mHRNw4CF+b4a98y|@G=%}W)F7hG<>ukfDIO&#=pTz(sn7VcXki3ql6s6Ml}-Nn zC$ql{(`@z{z2_Ht;ZSg8aRSB&HfGFhhG($)%@%tJ@N>XtHP2ei_&IL|mXY8GpnL)cf3ge$i5G`nvO zpO<2sU65xr5Giw(jm}Ii)COjp^@+H^D(d<714~S$w|ARMD+)H)5o(CMKL+Gj%U#UV zOCsM4j3L<8_q$#(9Bp?HmTc+U#JssX#1h{pY`cUI(`MrsbjZPJp0I%*#P6k#;c0@C zf|K1pQ1?tEYGMsBkBOzYHo;s@VTS3Obl*)WCj^zM;*d~DoL{|n9imPA0s`sd6Mwpn zT^twQVYzSTr{VZpKN$K&3dea>kkT*n;>vrli)Ib$TP;KVyce+9?%1w>#(K`Kx*=e` zf@yI(We@eTYo~8DvDog3u}E;*Iw4swv!@TU;W)MvLXkt{XSC>gelVRVl-OqhRy8U# zG%8`nRh8hwjEPp9NAxh}B*@7`GR)*N>~4jKLHK<9JXB>qGK!?r_sGkU%skAHH*Nj{ zVM!x-2*o~fxw`Zr@{y>2(Lt2%=OB4$Ub88`yoJMtWYMeOZ!a~t} z0WRviKaSwO+Szzpum^FEn`*b!os5#S7!{c)C3j=7O-~XutqP%&PG9AIZ@?$^jjmX5 zZ@iOG5$TF;K(Yfz#=C#jXg8aQtXn{>Z)hLB87d8Pgc?O zT7SrGh~;rPVJ}nn8u6h^wdC#_vMT>DdOb2V~rJPVLpBLdjvVfH(&Hvync1yrnPGyuNs8lmP zLVCDI?rfhD;~JY)R0tv(cHDc|?$%2HIf9WkDA-sZVz&%M6Lnma)xp#_u5?9YGil@a z{eJ{A;5F{eonG??%@eSk9;`k!w1Ov0bw+kL-(}igz5QDC@%Nipg&FTuIKjO?2>j#C z$>l~H`U7nxi>{rc>nF2bPK<|JVuY|fi6@J`uLWXHPJB$M$^vjAwc5(kC^zr!9$3MzB#fF}m#Yj8{NbZQv zoy1@JR4YZBB1a4{(CCrNRq}k}^SYhypakfy4SCwWQGm%}A|z>J{iLSm@)bnQ=jr)j zdJL}eK(WF7h{N?slW>;fVZ-wV;1Ebyp+Av3;RIPjEvv-FH!=%V-3JEF>dy&OFxhGm zegF60gq8P#+51pVgNH$6u0;@$Adz{qyOdLQ`)H|Mfr{njQJAaIS9y>PA*KisCn>x; z8wHmI5#)=9Va+20Q3`|g-gVGd4X58|T%X5;Y4kN$_R!3oEbD*HMd?E_QvT%3i&A>s zcR?3%bKXAw6Dnvh<3r~s)dd?w{DX4U4+g1v44}JElKErIRmalffkd#vVd(CRnzIa)#intZ@~SDb6+dTu(7@{68LUNzXC zr^nMlM{`bvkwh#HHGA6u*c+1#h1d^|NSkPw*GM+aD_*m2E8T`B4%JU5NUsYk zSdJ$%E=w!vZo)lRF~K6*A8xi!zNMt3wWxm#W1EmJJPT>Y4H!>qpBsjPYz_=bXU_kf zZK?KCSX*v@9+5*&x{Q>yik{o|F!-8t;^64 zLvWyTL7xU$Z0ut*KcX58yp`LA20hR=Go+=if{xC7b3|l@Oe?mrQJCE<|J;A)-pVeEo2fN9}O zJC`I=NkQvfmPOm19@}nkJd}zeM{<46RINyR5tbX_{9a7#kpGnfMJx$~bZB2s(=Ry( zgnXO0hJlHmCjtX}O4jVkF|7_?g+E<()k%fbrCoXBlNxxcS^E>EHIMThcerJwned|_ zfI^Q(6+-4gb0>TzBtyFzA?qF$#U4ecM-2VlJX{G+ivr)v zYl<+d$@SCM7Qv8UxaF5BJ*~O>FYZU?Zy#_FCj?}3p-aH+VxiSV z&tq_T(3!}r?V;yIYS}GUnv{|4EA&3>jCUfU;30G99k;l1f)O^B7#etZicwV`h?x^V zSIdeL8^SZvgMq4HEf+AsxNej{t^C&+caa?g3>c|_A9Z8#Ha^~9xXN03bVgS=BmfMX;YJdelX33|oJF_y(`5mc6^7^rm?lL2rBnBiuIN|B27u9{kBE_At4w z5j67;Timk~7!1Rfo_|7eC1>;a_Q|NAg9Ad$ezv#s)>RmfsfL%HH|`145&k+}Qo3Q1 zI_dICbclJP3Ijo1ZsR`+Cp5>9NQ|=dqXu?8)o>$)lB1R>xU*+lkm9{)7og4RltkJBa{MS!!;NNt)R4)WN8N#nar~l3jWKgSC^*XCwQEgQ z+TV5r?L{EUo0fC#S{7O9PASzs=`a3QYJ zoqo^E-|XbJ`W0mZGOO@4yC-99IUk&;$j$47bhfrd>l12Lmodq)BTQCRLeK{KpCLh3 zGBG@^?dJR*OQL(M{kWrxX|7%O0Z&RwbFuH|Nzy@h>hGLsum`4aC$bT&y~@}+>we4s zHEn5mUYyBgX9l_p-LTsU!RRK8@RXyjNK%~EgY(vEtUnP9G;0%DRzc)%r%*zVmSjG$ zjPr5_FiWI0MZmKxxS_^=`83k`cM21GsXom7I<*3cZH8b)1{Ouk!50U~Du&fXM=uKS z$o7TG`Q-`@im#LPemdwvqnBSWk8W01QzZoc_$OHQ6$2!z#tXy+I|@||0iPAM4-{n! z7Iufjh@DW;)Nh_9(U=y$Y~&dHd#IO-9v42dQ^#}ZEZ7kG3?CyG3(!(su6nn+D3`oJ zR<~we^CDHG%@5=@hfG25kH~Q1I=9=*7kZ?Ns~y#;3|k=XBQwe^xHhlPJ=Trg-^5u) ziR|uzw**R`8Y<(t&dI=S>l_9I|}<(em2`zQj?4PeoP0g zwS4VCl1+wLp47g$lwb@O8)kyAwpdNp+MV_Xjkxx3nGnU(a*06-G)dZg62MQ$kh;h z6EJ&AEd1>nw>fvk>4=I4IrD!lZSx}@q)W57pMxR1ZlpF;bK_G^cEk^=nO*R~aL{>9 zH&s{=!Z9M6mLjxCq2=`F5_jltQKC+xQ6#s71jTQe;55@OT^L1=SJ`AuUenmc5oia< zA5I0o&k{%qe-%*d7Y_NgN8q%Bc5^`{dt>diFxz%ySyZNg6XP=5jv~l<2v?I8Mwo5C zkwF3*c#HRsS3(R_w;&*XIa}!OV;5K{^M1NMoZsE==yB8ifxYjlyj{X_fsnFi7=rCl@#iok@l-# z_+nQWfy0Si-#I`HYPPX`8Ue-sT6~aZ-LXorZj=2wEe47yqTIiE4)8|l?*PXxx`{B6ma|&X_vz%fMG{N>@U1;H5Ee|w;Oc5Wd{`k24jHQ4f`%6XemRQ zT_HU1@v(Z}zD8q^h!zIC%KJiLkk9G;o3VYIZ*(105?K1XdoVv48z?eboIpNX6Xvco z5Xv<0yWl`}SIJiNi%jQT>sSC*&_*6A$2vG6^IQfG+J-UhLYAF=E%LFVy=@XO8j!Q1 ztbmjI{ni8jC$yivKhziHU&V#i)2KPHiKue55(Qw<+@i6R#gbFJ=%;k_!t3yxdEi2d z!mR(p82R6dp`SYbhS=}M62fgj@c(uvMn=Wb3_66Yt@%tfFZjG(L#y9Uk>_5m>+hVU zdRu>YzwJA*QP<3j%g;Vim8^|^Ybuq&2l-x6%CNorTpzG&tHKSg`-WBmeJb@G1o()b z;6Il9QN4t)oyZrh8#)n{Kd?I1?@Yv)avob~tC{r1Q=Pm#{#Q9RsG{)wI|W7JdmDs& z>bMCG)JG7gkFUH{T^Dzwc>Bo1{o8JfPm||7MJ@cwybx(coAbYTBs%t}!F)EH?Y)aRY;s6~@A6_ce?qIVLaM;=d0HlgOGgt7heP zart}YuYPNhqLWgrmBSLq@t{vL-%23yEGUPt8h?Mdswh`-UutvYpY7Y_S50N$ONoXu zf(S~c_2i#FVNFMIs`O+cR9L+=b`XQ6*Nhl40JlQ4gIoHvLGxkLNttM(R_$m4)+}8e zPhG&m?o_Us>u~O3{uLb1#7Sg;pJQEhU9;qhJ(p>OE}o42*;24c-@ZOSR^Fh|6Z;K+2V~U{Boz8HK+b z-ObUKhor(%fp1Rn0~H_%#NKF{EbBpxk4cwuhKfE{{NiddCa)qe71T?IqDrzy2aZEk z469e~U@sJ}k79=Eoeydkd9=WAX~qk3FnmJVG%2vzR40uK|6%Kf>^VHnNnB^UvJvAu zxc}vq4XsZwCOtnS#okv4g^_0 z>)avVD9$y+iqu!k0hl)TD%@MMQb$tY(GRfY$T^IwKWo^tPv9M`FT!J6be6*n|$X$KJ}q>(F&jX|HpWe=-uqnpE@?d1Kq7+!GxSnPtM%5JKDRJ zE20x?{&5?v9^fchsQiK$d^JTt52#gVGd5j<^lCeLtY7M>niR80mL=b*}RS zrO0JFK8#77eZ6w=^*PrU_|ZjO!w^$MO}Mj%Uyla5Hu3!5^h_t6c(ZtUfo~XMlL!6A1!_i) zcpZ;Hw+|0qNZ|=Wd@~;PTF_6dcuTlf3?+j2TsKbKjWnzK3yMi{xCu2_VPFIX)&429%T+1W0Mi7vRs7C8T^&K=QQT7dD*F3y*GJ%Wk^OqK#~-)O?s{b4vO0 za#DxN+vZk8%xTj`TieB3?+`bDhrT0s;UOqdqn|7-qr+HpYEl zROOm^{gIW>q7fx4=2*vaSwyOQ?ACq$k4_1iw(KdMwbY(4LB9;_J$-!~`zo0{Nmbcb zo-foYO)IK|{vxjfR-vydrn(RA9yEb;7EnP{ckYM?9Ve+GJY(2M4@6ne2@*=b9rf z641#CG)NHPRU)AY3+_V#KrmQP+?~4>US2(Q?DWjLHE%(xkr)gYH4>8#uULh&z^l`s zIhTiyOeSt<2}CG_FT3SZMpKR{82)j}i63ik8q4rk3re_M&_11QWC}fXC;L z@i=zooNA-4HcXL!hG9nK#*O(sR7)xtB`ZY*#z75apQ{+1%Ckn*m_;Oi5N7`ndS@V# zAGvXDo8^NY3?pRArh>!@ia!aIyK=%X>&~8RC+Z8_HG2s{sn(F)QEDvWIs&ecQ`74m z^qlk_xS(IEzBZ`xUb$F&;euGC-5>ab@yrU}7hMK!(OJjceQ~3g{HR${0$k<87B`sY z6grPanXrrTAM8HPXZgn~o_v%veLbpX6#lZ!goe*C^n>o3LtG#U9hPbKAZb*G9tNag zkv}sIVxm6J#I}Znq}BgV-epHJR;`C<_`u{nS4E18b%cX#Tc6u-ecBvn^}s(K2HM(O z_9Aw)(sI(}ILKy&U$nS#ET2qJdPw(7U{}5-=26?u`pIe2!*cmikB(_VHlbYfGTqti zTSo-xaPlyP)h?UNVh=U=+9vR;gkRhFYT;GQ{M|S~;;LvN_%@n5H%#;@c{H$*rzcyi z&YFj4m#g_1f9zp2%CoibkDNgI=GXkND;cG$Ud%;|LAkWkCjyfAr_5>@ExTHHCJq16qLFGQ3~-G zz)mC9g!deldV6Cy;LG^fQ*~GI2#Y~LDpASUp~C(xMBlf1Cwn%KT0HL?Fue8@JbKUy zfI@>Al%R7(w3Fp`_1RO)b3oGBtIbje(eBIX#>_xJhzAQoKMWV5i#|l;Vubl5?4LPK za^>PqLBh`G%*G%VQv*9t}S_&_s#g`Dk70BtkR~_(Z^@07IvfF9IAw2 zDu1#v+s-UCer7D4ecuS%PfeJ%htKod$dn#!z+XJ+S7(2Mtn0(OEFKqyT1IZ46ljkZ z!HA%XijmDwO*iLeghz$hXm|`Q`O6{(r7Y{6WwG+=3g^(R>~1=ct^-JV6((vO)!``w zuAR5PikYInH4h>2K#U}9_F5$4E&@o*oME?(irYT}Qelrf+Fo~WxT;yU+a{)-UdY^G zga&aNVNt@qw>nU%>54fyc=@Z$iNvX#zZ6oeMa)8C@%|{+*x?cvYgY(cUqc$IsD(VO37oyR56b9 zf_C~(95f4B9m`DGH<(rTA0a?i90xh-+aN&x4k9F6g+)1q8aja8n-%?tuv@XW*n|tEs%^S?MN$z2($CIiTN)T8V24S-mW<|^X+d*p^o2gk$Qenfwg(YBpG)# z6J80$Y;iqJ0NdkhFX5;aIIwz&9Z3hc|N25AU-`S~5T(M-gPxl^8(2q>&f{V1{6W0U z@uh~^NXNemhjoXjyAqp{UYI7IqwkJ6+IcWD#DP%4Y`m)v(YQ|O`!o%^0bEgl;M|XZ zJufZvhv4LRE$K~jnCiW+@JOz(e5sQfY00s@ao#^8N)=t@BG}x48a^jO^>*tTf!Y5k z($?$c;m!89mPK96-DpHM)K}qj)JC=TqE9G%(T8JDX@dEt5KbozMzX3yp-jP&UJ^6V zsBoV8KIe$M;O|(>9Jk%m;ic}!)z^vC=fR}wZz`<1x09>D8kakhTO)uIpr4;afx#xy z(u(GAAfp=uE{AhqGY_7a5C2X5+=IHLgRsu$`6m~~ZLH@tMUsKq_w*R+(m`~pbX%fg z$=H}Scq9@T{9Q=m|7CW@!KY&bA8wu`hl@O7Q%`##?-SKZV$**8J5tlM$iVx<#x{SYWGLgMr+)!5FXM|W1MPv|?e1`tYN(Z;Qer3!ZU zjpnh2Rufwye;X-7Pl|{bTUaO6hgD}6Mz8FxMY`MKc18ZK$t&DoJuNJIO)NjEywdq4 zb6nWNfyXvI!OT`-WL<2Jd~^i9_o{)KGckEp$a2kzO()E_%@vrWHTD=T;Y$p`QYoR` zR2KGyeK6}(s>RUTEZ?dQr(t{`YVBlTK9e6W_*@S(YOG1~m)?4-+Y7D;nty%2T%stN z#}eM(SP=hCE5o~9iX_3loXfp3YQn-0Ha&QQT1L!i%irTRT^xWv>d1~NINMBo0Z(GQ z8AhJ$=9cyBxz`W#86}P5UBIfG3Ad|4hc%#ppJlh3biLd#Xd5L!cut=ex%LahqOY7E zPkCzy`3i)>Ic)jM83lcsStf7URgW@{hZ zxR>aVu(5{H!ACGBcx!x=6w}EhuFL)}P2*I0DW?jg&-6DLfIH*God8C1K}R^VT*i{S zOvd=j@_t(o4djO@9@qb%>=wv)yL_E~()afE>tpD$*e;Ohuiz_1{F@OwCX+W0;8&eY zYi1&B)=17A{83%Z@fXM8w>7l}HR9cLLIr^i^Wc= z4~|XRIDiUSi@c|#qNka91Ma#gr{9v)`rHBmTir8AmePB!4& zh?5rH%b0c=leGKaX{nCAKaQ|R;%m^(SZ~Yz*cFlj-8XtZfLBfR^kTMN;R!lMLLyeQ zu@;;>Z7dW8i{(2(`fF40$sIse^%K7hAcTHge+}_@gQN;y-xdO*g2BMm%SJigSnshL z{<{tYivT8bxPwv=uTp#9Dh$FVj2_W@+X6Gce*-z~=2Zr78Tgf;2F7K#7bURf)58#= zP72ZwC$5(0O;dnKUDCyo#cmRtqxv=Ms7L-b*pjX=B`hEJeCDrjP2PcQP%vkXS&6fm z=L{-`MisADszQ!y>y|6A!9FuvTFdRLwL(W~CEbD%S?J$56#NtT(oz1Z5HR;MUnG?# zZ1rR4(#ncJ=w1bfKKrt*rP>M&Xow7lZnD!ATSU~OGjX&OxPKiEV_Bc(_h6gjanUqs z1qf~>^y-3Wg4{&k`Mm2(ou8_kF=$2roYZoFok0Xj!rE+&ZP#^2%r zzFXKVkA)72%U6bjTun43;I(L_N++HgQ+d+Wjq?%JJyivK!@TPm>;p)9+~ig?ySh5v z)UwFyw+>?q>ftlW9Ov0Z(Q(aoT)& zV3#ybL^yhA$Fiq}J`2(LEN4f4^#)S0ECJ>}CBXeVa8aJed^c^IHNQWYX9cP%5re_< z#?0IW5%p^xJV=j|S8w8@Jj=ajAf>X2b%cT|4o&Pis(wxrrQ_i+5~}{F0;NdYmwLZq z0T-W%vxuH_t%_{Q1xS;h(!wEaucj&DVUz3)cU|Ql7IO1RRE3$XEso$@1^5H9d0yr! zWL!>5d$2WZGM?~sNM z9{lUPEySm7ZSK=s$Lq23Y@Jbhj0tp8xnf4e?xy1Ic((lv-7yk_WoaO!*<3jynFlLA&g%aJg zFL^q#h#viKdqi4KinF~0#Qw?(6y#=_-S@sWr3bW283`w$+R^xPNiB+@#;7RDPJ65n zAe?n#Wt2f@y@%!j5<&*|KlmVGbzBo4a7br77sSSX84YXI`t36eJ9Dn3l_*IZ?u&K^ zfy2$lGZL|pI~xH>2ErZzK)bZcx+2_Nj@!9Z0GWY95c5bY-H*={_iwZC6%Ke^AxSw? zF?`Pue&J^sk8A`3K*%%bY&Q%?1f>)_SR=iZmG+qqy@nukmcNo+bq|(GFDpLYJBbui z8q8lK>fP7+uft}$9KWyueeJ9307SnI7cIosq~9Y%`W;Nfxo`XNA1=M>EFTf@j_+${ z7Y740=SZo5;CeX}Q48RCe>2uPuT&t{hcu4lenKE`qR`I!%Y$MH(Q!z5HDjmUZs!*g z^ULpP@r-DfWv?6L6V8qwsoGAiyS3>RshIiWPuF)w<*;q&a=z?E>J2S(<~dzG=}QqJ zXCw!^huIbn#!g<24%r2}q`WE8A2K?MX$yItPP7cuE=C4e1t(zBE;=(J;tmt7n$eHCb+=qGn+SU$- z!Oh8vC5$b4wc%X&a)RsI40(#md2D%~@{>z{!DdO9>s~?Qb&em-H1#FqmDYV!&~CM< zg`{gZAKmuu*)l#bvAI4yK}O6_O1#OH_B&?_Sx?sEf4&+А%?^$_!Ud zo!aZ6!h1!gw<^6HW5Yf;bvxQ+G=vm#045#<^fOsY zKPm^F~>L7j2MPWRF1Bz25vF;440!ya&k-@wPvV zdjGHbIyD88^UKz`Ad|8v0)ri1Rb)2*?ORdoxf*G#f{xOe!*n4P&T=#U^Wg_`%kMlj zs%#=1fC#JX<$2;$0G$7R>HI6;h?IJL_bYA|+0`J7V{IZy*56F#*s2^1BC#(=S+m`P zLeZ1@Vh+w}{)lm_VBPCX<~Zd&jff(4wTxQwup0U#4ErL2_u=VRLhFi=^0CeH%uTCV zS=+$C6$_r2viKBn0B7_M!NMTOc!lsS(YzpaI9zczoFP(4us|hjwD12jP>ZW&Fo!9W z!PCH=lN{#x80+{w!w;WNaLPs>#ZPH&S!)&Vr;v&h=zaAVp;mfDa^H#1fk3GAfQ(ax z7EL*nAcXTeNIEDuqi}quTmlHAhZNY~<{GM!mI7A&mj>dzNLa-kcIm8qmLly|M$#s# zdr<6eTJrqxwgqHSLh?8m=0jL6+HXwoDh(7d#Eqf{nC~1?`xt*jmdC4l zJ|WhL?BY>y>u-0`+f%;he|}9(2!03wr5l>a(C4 zFLK4u=~BskTN~R9={<9jAg2l;TD|o1dyVLDD8<{W^_-kXfCzweWB`sq-D7GKGy*Pc zj=&uVtWj;@L+;;DGhtKbl~;D8Ho3WkyKq@4n7f?mTti@_eA+G3|ROQulB< z^{{(4k6~p$?AL>(*z5Lm;WNvX;#^o|4!ni7eB(iNjbs#7U=sUU_xyt)Ry@Gl5W9r-*koE{i{*iWQm z;0J7!ZAPDW?5;zzaD+}J{%Z?S`W|;)?YNsVfeHT0?elZP5Alv|iBv!x@6X7KOYshe z(r#6Yf_&}6r6-4qSIw-o zm>UJam*C)*E^I2uhc7$QUO}3Zw0mN3PpDrHJpU{;HtJklst<7+=8USA- zn)h@P?#Pn=U|lLdka8wnyFQBurVdg1HpO0TedaFo@kJ2BI6jnEHE8f#n+a>Pe5})> zW@sm77vNnPkn$YshvmCf$WF|NFLjC296uSSe=+|fUAo@(DR7`b@r#P?MOHQmufrRaR zZ9bfy^E>&06ObpfED4p*jEu1Z7L6gc5mGFP#(*i#0{eZ4D!QM9n$+y!-Ft+UGZTp9 z3U_Ph%SeVYG~fPt&$^G21YC3@63Ez6g>Li>GRo#}-ja~HPw0fB$WK244*n4FOI1w(Kw6U$@dTy92%ADUaSd%?3XcXwhLU+SEC_va~ z!5#i&0Zu{Fp!4B`k%wMM{TtpnXp)&*x2NBZYy3b6YjIM1XG8!VpB8sAqTSaB?$bGDbsRx73$W9$E%TDLB#^&Xbho$lX+HY$*3l4&>bfZx7FEV@ z#6~zPPn~MJl6s0L-*fw-?#hiOe`ef%J>bgp=x@jWedVz~f8q7 zvV0;`*GHsge0!N!1KiLNntd&@Ck@%bDG{regLn7w$ycg6L3NnRsb_PEn#iWLieMy- zhgkv7PHK;9!}-7cj7Ij&A%b-xGX(L{!*x;obv`DP{%W#koGZ z>kS0;1kwu=kO-xNpB8&RxxNMCqjCdxrvCqpR@ABrl~5e|$JAd^qK?-G7+V`Nx`wDm zMmjI|1*gPqqUUGfOV8s++?vI6oG8pT3DN@9dzI?$-U@GJNu-H zV&u#mvk$T;I~R1)Gjx49i5utdKpUsc3(2Qfu_Y6&Es~bry@EJdAH6LSpWhu78vC~g zq}00A#gV7M_CeMxsAW!V@q{fi4vfi*AiUy?^(8bN7qRQZJTEi3=ZV|H-(e`XrwFMh z>}Sv3%B^X}ksry!ViVnQmF_>BA?Eua%W5$Qfq(YDn&ogrG=v?GXbzVH=cYGpG`|^fH=*#>NSG0`sgh3TkSG!jl{je+e8a@%bTWkYJxEm+7v`# zaw==nk?Dkm_+K7hC>=#et}>j#I)*_TYwADbe%S5M5P2XpgVa)8JD9V;lfp>PRz{ zWuANWZQ>BV@-axmw5=Pl-)q8u?g9b-} z&`~GdO-xNx(`rXPOfpcpbDMVwU=A85TB2~b^5p~__%l%^(@KAPzI_siMl=}}5=csp zi0laS@w{?2mj_|UJT6}(T7t+VfwPR+jp6?x$|= zt2Ob8n3Y*jJNdO01--g@M*>r^l{SAG#=1$Ce?V7Nd$&w(qkGPW11+5QaKW$dWW7`h4Z(!zTbv9)hD+jhMkt>^obiN8@lz;YsV8kZV3J>^^Uey6A2=J z8ziAqbRqfk-~W%PuMCT8S-Qr8I{|_QcZcBa?(QC3g1fuByL*7(?(PuWg1Zb31K-@7 z``z>YoOxz;S9Mpf-qlsL$~ZI*Yl2rLz&GqW&Emv)XLtx5A9*5YEV_W~Ez=;nb6{NP z|E__I;vb(am^FxgQ;g!|DZt%Q#xGtkFi#_Vz0`16Y>g6Ze^otlLiyX$pNicLve1anOna6P=$6z&VEb6%S7@C z9W>^x>C;-$?B4)|%M&`;uXLhg&GERrcTqCfegx7Ct`gCc99 z!%%QY|8oTft}l{ijccJREJd^5s2F6M>=R>R#SSpk$Dtm_9f$V~)VMTb z_8<#{yZquN#}at4YVyx+3xs>nl>Iqk9Lk3^Mwgb02!+o*P}(e?7Ny%07ezEy#2d=` z9rUkmnAO8LWE+OC$B$V*7*R%mW2)v( z`+W)1S+)flqo=+a%imYHhp?#j;q~{em+<8=zRxlDVecJ^LU;0+ApQ*m!0`5ciGmx} zoMal-hKTSNu|x}&qA31~eWn)zS5hwPsD64e7~5)F7x_W!P{_dK3E zPB4J4+u6WXsqQymT^G!~A%v(A#v@@z*e>x_u;$%ooIw;>uTf^anoAY>_nOTl1IJhF zSw^HDJ48P02Pd@!H{0j_MTOef6mG<-m#tqHRpN(tH{KmZU;0rOwWlNfNgdIW6XbCr zVufO;@`Iz)CZevGk_U5>f}!JlK5un}HKU1Eo{b z6eG?tpq^EcVGt?}7f!w?=ji(At zGqlGP@qBluLJ-8ms?9aAl&jwmz)+A|%O`3!sgEwoQcgUP=Nn1`vo<&z=*}vwV)|>A z3T+-=N?O+sH3G3rAhW2xJcX-<~E;yu)#VlaT5ll=`B8pQzh+ z*A6XJs(io%gDu&wTU_NypTi+u(QcDcIlT)jaoU1n?j^9TK|$cqu1qBfi-Fi?or{Ow z|A5H#cUB4dp+p#nzx;q3hzFQujLM1`V^zsgLPp5H02i^92#*C`Zzfen!S#fh_Wzw# z#9e+7hFxllJ8NyN_ zM7c#~f!Nnz2_F}z0Y5M z8HgpF;6ySfA{XxinXpT4`OwPQ(0-%_lgLBjOpX)LVm6>k!p`IWyEW^#DW}La5)NMu zh__FV=M1ic05TeFnBb7ZF05P6otw7H>+4~q@VV5mx;_Lb(;S`ajk0(`VO7*Vu$;P1 zKy8nA&vzaO^k@_ir*TG`1bwN1pQc`N&KbhS^rQYB3>k2Szqc%QhGBfGj|PgxcVKAd z4CS)mrbxftMnS@-ASh`iZ;l<*fjTnQ9*>*rHe%k^1&id{s(d*poS7piB*!`uK5G4 z&7TPDhF_L+*_=cT!)^qzcLv1`=xEYuy_LPX%v-~1hU{vgc`IWYQ}1(o1t!(W=;#}2 z#8cYK>vdbiV)BmGftO->ho>_#Nfl`TZ|mB~3n>aHmG~^a2!sb&p?~-*5HK>gvU)bp z_irvYDzEX83xO~3)0}X9BC=lyjj=k~5I1C>STZ7rsD0u$u=@eGh0Y6{ZUA&4g21r< z6L>tm^9UbP;}zvuG}2u!MCLFd7!x>ax#5Tim@Za-)X;rD5{QQi!+EhYL6##P3(%Wx z$CLk<<7heXzRzBIhQywfO;$uCJh08m~?9vX?n^9Tz zS6_$RoU*w)kJb~t$L9A~l$pEMP2bnAv(+^;`BKVyaIeR2V1C;|YZb_K$OiIt?6+Ix zL%9Mv1TKhUJ~xkbTa9Vcji99qCO9)P(^B((7d2v2YCUEE zgu-DhN7fWC6at(w<-aDUxkBkep^?CS@iX4hHYy}~9c7k#SE4O62-W6bq}6ctIuZ_b z`6J?y2|lvaO%9*~L&Y|hVQH!9CxQJKWBY*)rDUf}rnrV7`cGs^5glqSm^gqRZrpHy z&pMA6-dKQF;B@<$qseazVg&)zxWv0+MxSVBQ1+Xmuco;fmAN7jwIqwe@wsdrmdG}W zkD6&n6w@?DVBP#hf4>^XuiZ3!7p@_L*3MY-p;vs?4hg3u*-^TyQDuh+c@)OBm!^8<#K|V zyvAw&rk8{=1>R<&CNBpUbe0BOiRIFY{VA)5Eo4Gvk>Ul%Odg<$Qp+I1RK^Ir{Xb%v z-%;0%sU>UhOd9I08$)xLxH^t-8lnc_=y7~4PIZqC`mp?wJR;K$S$%@+w!YBr(2#mw z3qN{_QYPD@lSN>QMA6YjQzh^%)uMWqr~o6cX(P+HO3@uSjDT8AMAfuWEmi%qY_U+~ zKjmZ9>4FtGtqi84^?PHBC<3}YG{JJ>9&K4#c@y?IppxSCX zg{hmVo~d`Bn%}cUc4uW|AMVXL(2wV%KBVaY<8bp=wk4hda$@h{M%=j-XIfQ5vb7JnUb z)`g>!c3mDv5|=_%$6?g&vcADl(AtKT;w;9zK(Yylk>S-ox9f@HaofO#16Ws&v%M|h z&j07!;P;3huxU?`~yK69)A93kDYx6?mkPVRAA#g$1c`Sij3 zihZQZ`{eER_3Us{*12Y%;kvmt;N>am1fS3DE6bJlQ!$sM)%pWJ?>fiSPW}<& zZTnI8$e->t)ld!?x0X-2eA#}qP8e!>K9}kzUW+P$6~~nDet~#(w@LC`vSr5Qd)@XK zzkt)o6gYE!0&WdU7B>73`54*vzj=$>+nCSw2|c%|M#1si>ascDyEk0!<6PIjpYxnd z)tTSr`W>X@URAAkkdkTkObcl%66{iFBMUtkuKn(XUcgNbzx6#|eUI^LHf=Yp!))z5 zC(_F-#oP(?8*z?MBmosKuzMxaMRt;)hv21>!0IVTYIc=K;b4~BzO{Z?D1Tq`AoR0G zm4^CnHQ7#A!b1uy^#D=c_12EAPB+I2j?)#=G&pc;N4&?ULocQWwKbt9<99Dpx6d#C z4|9TMzTfGW=WOwLXU{&BJS7I_uNJ1KMSGtb!Gx|SBJ>zmTBTHAlh>>f|GqiXLpToP zg$o`n$CfkvI)p`Ra$|=UNoz)vPUMkE(Rm?>Tabk+!3!UxO%88hdgR?kiqv937NI6K z`9A@>&=;1_yUP9^SEj+%<`81LVLC)PHEu)XmtwL@l8Zz=9G5-f<{(t$#{K^AUR(pO}8FExwnSJ>k$G2nXB@RLSqt4{jqL4 z+S1JT&qzzvYyG$46JO3kA&K5()Od$RqP|6a;lRJAabGgdJ3(JET7kD8(>E?pr1T#> zX()aMSvj*0S71@Gud1r1msVI)w^T6@Xr5YBfubTsbV;&g-S8}RlEMOl(o3bmzo7q> zNA+CBdj5*CW*2ni{Smc9;>gun;TO_`jJsS=7ifhshD>&XJ=-j>E0yOn3bTc|G;*8$ z6~$r@?Gf!})n%G1Zg%mF^`Fzw zEMs@u3rTkLhq8ET(Vt%qdvsX7haQS2Dv@mJ_3;rjfs=XE0z#)yrNMOn)|QC$o=*G# z$u|L#58}6}7V=R*0G&A-wARKP($RAApStG)zT?2}?5S6lU>#sJgxX6ieF&{p?0k83 z*(mF8Q7Se)woJ=jDYO=@n-5)^cE3?vh!b=1pa8IZsE@Fcla0%e1%Kgo^40oYP+^!? z_;WH#AyLoW{NVka_EMZT+P*ZS-XZkwXJ9zjgDZT(jg|e-6 zCQUYwaaBlvax}R=r!*2}**WnO3E){aZc>=YU4D~n2itGvQkCB#ywa}JjB)=0kH$h` z7wH}lyr?f4{P!w>`M3@fjSnX%9R7@&ba*U^h>@2Aqmj(9z)^`>8S?-)X1rfxmkt)P zSVT)Y-0|Oc+`;_rFO)!EWBlnRdT2-1LqM&RHol#+NRkKeRR_u={pLz$H0mLYJ7bkf zjgw_2pndD^8^nRrN4g57vfJ%!)wa3$PN$#OO_LAAd~_0ZPUnGK2<5dm6Z!h@;j_77 z<#qG1Cohp?k1Aw?*!3KM?)F^NM?miv;@jOzY}>5lHCpf4=Sfg9eENmXv(1Tzj93^XhvtK;Er5cg57D~`YG!SaR!k+rng+x^2bSN11?8CP2 zO#t3lvtU=y>i^|}9c<`!1!=WL0MaTIq*c95qH`FYZ9G%}v-$CN%^a6|J@&F!SxV9M zdFm>@&-Pk8vlePW8}g9oirkekv8bA=4^rNqd={btQyuT1!lNmOJDSOba94!UW(`m& z&YHh8*X?v%?c! z+bIFmbG{A_ASRZU#!;G|oHEN!tA#bOP{(!;88uCfAWKrh_oA8fIoC}_CI8nY-8&eF})Tpf&i5BR?$K!UTe|pa9YLQUNqQeywwMS zMV_Tieci$qP#v0h>CrHd7x)!<$-k3$Nb} zRK1VrXXYW?7%|}?$&nT?vz|m4G92Cn)pu9IpF`#q`xbpDMwv3uH))pEO|GUcX`e_G zYFxZTyl>(^^VgyHqId>-^8a}$Vf8wJ{SZ64s1|xD0Js`no^Vz8^KdWIwlg za0}e+oef1zz~~7G?K@{Y=SUrVlFBS50enaM#p^0|N|8XN8t*>N`27HJSFS90>tDDU zaFa2xPx2M$LONP|*z9jL+on(2XV=i{@@>&=avS4&uUj9#rfaY=vBJx!GilATl(&JV zoL$KZIX>!@3w3W?v1a>Qc5?rpZ)VrTS>u(q19c5IB9-sxI%^ zE|%IK^sMLqiO20T-J~SX&%ed{sfKfHgy2!r>=0OxAPU>i%Efq8Ddw!_5?B@vG^vcU zCQC)KfN8QHjChRiOP+*~2>*wWr2isl$Zdi9XRU2tpyNc~C)RH282E7rD8||humEh` zr07#aZN5$FHvTOk`J9T<`?I;~*vdmH2-U1_vR`tRU^Cf%uLB=`4a|aTNc?0Sl82uZ z)N$x7L93a<#lJR3%|Q}y*w7VgTgvOOOyv*Ddb!Ce+kP)n=%ioYj-Xxy3*2m1hE#Q! zMX0h;DHmudc|K}HFz{4!eo)5qg&w%~#l+GDB8|d*en4joNHsEg`Qj%}#t~d%h``Bsy=5yD-eE_c= z*V)Q0S7Ywi+enw}%QA64Q3Xn&``$LXL4qZwUpXJ=jnlSAAfr9AXV0YT5V-yiIdFGh z=R4kc2b{d-aN|~)iwX0ji_oqR^^b%MrbbtBoJ1@pwgx_} z@g+@KJulb#R5`Y6jOI{yMqh>+iIjvxaAhFuu_D+|L=r+OVf*_h0IQrIZ6JmXnpQ)| z|Ie_2*%L>zE%&ppy;&^9G7!m?HxJvOYE@A206t`Rd#lTrM>cwdCl{YFwnK-%K`2f? z(A%FS>3Wqo+^{?V#2@jzx7yG|1DW?9PG1q|t+C=ppB9_vy3s^?hWY)1@e7uzx0dgu z9*2#7A1&VxC7M+~Je0%szWYGVyaPWi_Hmvf92Ybb?pPrBj$?;WY$6);KTBOTCj`em zBNv~g)oZ+vP>bZ;lPeL;D~6CDH_pdR(5bAtkEDYr4cPYPKX3e((jYU4pUscM68>xr zD-);1TgveFr#yfjGfV>w)7dUv!Rx{Okvt}Z8g6noUrvSI2F0(`%Bqly03VIVj5)_5 zdfG224c>2|zJ&7M{f8!1BYfnn+hF^#uBT8D?&VOmtTd^M;uR6w5KnBt}(rTunY|guod)0pCcJZu#%EKKEJoWv<2mZiU zLv65ZXTQD$<-8O`O6cA^@a{D<#?&X#ep!H^t2@@eg#;e=TN>*xy$MnrF?d{c@*s&u z4IcCFFpuA3rzJ^cWK|>g1$o8~zL?ltR-2Z8EFpJG*V&W!SaU1%FI7m=r@UbrWCwVc zi1Y??83S43N#r6m$?A`u_4CE>RS>yv zV_lnX%<7k=r28B7lov+eG*=fN_>S)(@P{JN_*lT<$=lQH^~P=Er6tAp({*tD2n7{NxkX&1} zWsNbHDlE8o98xK=qzX@#$^FJFbWtU+W(kvt8xs>?Jiy*>?EkVsLC9{vq+fyhkL#^N zAnv7pN~ea;I;)kpQDzw+Mp?9XaNK}*PY|IAH}w;rt)BXMc_CvX+XNLP``oU4IBMcm z-$;GNTV$YIu-<2*DFO>3`1|tE9UeWajTWTvpO{VnlzryHs(3)~T$%fL-k7X83F047 zD7);a!6|?4<8czjkg7<>di^sGd`Sl%c)R~{Sd&S8mF&*q4{@%Uxbkvo;C)9fH_MD)HKDV*Sj&vu_vNMLUT zi%Y&n(9sBYAtrJYIP8rZiqjEHeCP3-&p<($hnZ!9=8yhq$F^MBZlRf!7@~t!hIiv{&npNo6e=9dx zb}EBGLLf%d^vN`+Rt#cfq>Tuh1b^1br68eERSm7kE+KBl2&_VP_#g4DAaqNev_nrG zO@Nba1Y))hGEVCa8;h=s3p5Vr*E|J0eC+9|klo$BImH$;z433(ldFU@Duu<0Q-si= zh-rXUQE0nZPL|dObf~}g!BL1cXUwJ+wkD$vmUu#;&WD&%xdVO+gNz2eW}LN5dk7%2p2j}HL9 z_0%=@M>5Akc+oQ$UwB!`vBTHr%DYLk!*w>s&#B;i8|Nw%s;X)WZ@3_9aYoJ zEl1q5i63A^@Q_16KkjwPBuK~O1-D#!`5;E(D&@q8I%`xi`W>G1qJh6&WZw|e40BvawwPC{&w zV@P`V?Gzrd0aehl#<@?+Xuc7z^N5{AWUoGt07;xCp2x|veYM#o2^@eV#a533 z(H)8sNxiQ51Sz8LN}28l4wkHlIsCK}L!*o;!Z75EnxV*taYzIS!r_pP%+&^&%y zbsw)rluq{p0v8Xb`40w50^hpKuAE&>w!mJFIvK<<3+^XCWHMd9{gcZd(*W)STBYNO za2y!Ir|K{}eBQs{a?_?;I^gwnMyzbpH4JDmY`UW5Ap~T4J}u>qbhT@6lT6WBKR*=M zVcW3_;SyVIYI;@q5p7>Cw(r{NstfoX5G6$L*|V_FYw7$)ozcNse9X452L+VowbKuQ z4XPw+4WD!Cek=#Y{uC3JFwdLbH?~QnPKaPpr6a`vjEGaP$4AKCdU6hd5j<{%m&%Pd zulC3JEGt81w#fQimIdvr+uA?=aD&PAZ~m^fNg=KyswI^3LqxGM?FoC2V?Cx^uS#5~ zL1KReWaN>R6gT!MC?Rkgg&-q;l_CKemk!E8cf-C(GQNJ#pnNO5E>>=X|1fyi>Ke1f zAHxRHL~o`y5tJDMz`H#Mn2kDgZS$Htto1H0)4Ps_pa+aN6~cK<`V3-r{%_kaf6n->LIPWTBNo5(4M0um{L5lxi>w- z9Nu5kH%!L_RU7p&@3I%;oP6uiR)6pr790MNxNlkA$)}wdeFzSRkRj@ud!UrCid2!8 z6gWI_^aVXLg=sE+*4h~{Z-|^A)l_SiJr)uBjltd3N<5uBlASd?R48UVx47j^3=a>5wcq_+{Zq{ja%rXyAC8cYZ@vnJ2!PGenzqW^*q%q1 zH()~S5gq_?@k{VO1ff#DS2>_N zoTQ(O7IvzLCE_+eKW;&uFsM846wNq|1LlruL;&sX_#3xSoD{d9z1D23lkByUJ~s3= zE4h1Dqi)2fGYl10U*60y!v%&wv1EbAw)InAI%!aO<~=`4kw?goP$#EttUCdNO$FAjg; zG&zPU;c@oDmuBx%NlJY=pe_jP|AmBxYT!UfMk2EyyV5f2dnoe+$zlL{c8lU2ZjR3J zuSM+jzz01H%wK@4@Ym}e?74`oZ2G$plfEvI8JQv>jZ&pC)9ev46D3KD^rK+%HZotF zknCaA)r7tHRfQrrKS5liN~cQjg5_hjd`l0u=1&*U!LahiT+C%}A7##zFS9idTzp}a z*=YkowdV_hFS4d&^blrwQu1(sC{>_DXniuV9B|$)4~U<84YPlp&kgEf;Ta?Unw>fb z$XVfcdK)hU_=zZEbg3sV4)*YH>>QbG<p>mR%IdG|2#wH{GNLQddF@Bs5HYj>Ay%S!dFQR z$ME#H5B=B)h3$O6QWTK)Gd@^3=fZN7Q^|fPI6NFWV!!0GqbZD=Kp*)VI2=Rybj8l_ zT^q}gq7Y?s4K4SNp=$|l{O!2gblac9>W%%Lo-fjzq&^246XVG;;-Jn$mhu?FIL;Ci zX2S3Sh>>i6lb5ntRK~YmG`$*tJT1c;R)m`~6dStE%DP9jy62 zdHH)TXCyn~*o^^rAGz5(v4>{Dpye@2RLp$}E@ffa8)zh$yl;E3QJsyjJ&QC4#f9-lIC8@sjYl6uHH)4a`aC`7Mc5cmz*8nHbcahI zoTfz%^eCyx>5xp&oiYx5v0hp3E`DB8@`(x%oq#WKVg61^B2<*3tfiM(bF<=I*mXp( zwgL5C8@G8&9707WoR_W^&mR;Gj^X6fqcmk_kH?3N;;Tb~bKsj{(zjC_6byIV#M28E)d_7miY@ z=NBA?Frpyh-&pw!goJ?qCvg|~rqqfYd_|$KdQKiLBG&+R zUjJE7$eG4v>K^9VWur&Z+(+jxF#4EG_(&p;$>s=8*azZ|yyMtttgrQxXAE~#GVHCST#(117`&^ia>@I+HcEp*_{ZX2IcUZecA55v? z4ajdk1DdY4_w;yi!&nB{4Xi-8v#`DoZZhRaloZl7l2HSdP09A7(Q!i)O$(#LAzTF; ziDbDDE|@Mr#bo;)9m>nfZpn5*ubmq?p|={AXqfY1o5~ti7S`TK$%U*td`PF0BMU)kum{!Q=B0 zFJg!Z%=JG6OCovB_zX1Obi0@HLdyC>L z8b-xFMWoI(BC|hBY`VaGly&T_kn=d72e-9qMq7nwP>AOo3eqY632_eZB{O^&l&we1Jl@2siGy9MJd^RIx;ieBl#;iWIDgX}lD4QCi92R7MG12TT`@Np~ERVW0;A%>*S6ZrUR}n0meZ-^uJMRyCXaMYwIoo&q{Bs)X;0%a z&!ZOdINd;!X%OoNW4ANC_jNACBXvIiETIxw^wb z%!8z|Nj+4Wuz!=EiKkh_NSY5Wlq<-8uf9=0jaMK>x~ZFt0eBP>xBti(>du#v8rLii z#uAc-&vfjcpVYt-1kR$V7WvG_zk|)Af>7ruNlHZZR@;uPQrgb5 zkz>`prw)C=#Oy^O!%F`vO;i`p7Dte67lqDGq;&WyxBL5DLI&+9ZPn^>tWzQ3M7OSv zF2H+z)l-_h+gPPo4BqHxX!MWTO=y<508tI~b+|Z)gL;+2v{N=*hr}T>K?tl8;>QZA zkO9FLL^2>aA{hv@0%XmJl%!e$cvE>ju{E;>?N=)2_QXj^&><|ksOIYas~n=-&Qb{h>7oKjE57G%tpA@ye=o3@3_P|R*-xzwjH z?j5WU+UG)< zdU0!71|3GKnD?FvK(J4IkrZ|Z6CVcBcQ#L!5CmDrI%iC1$LrEe3TDK8vE9b)GI|U0 z0$~O~>ZmMjp|xzr-OsNii*S|S>afcSd9LWJ_jZ#{ph$BhmCMrf2km+)Y-tGA?;%Ybp-WZ{#q?KozwQ|!2YdKUkYOVL0WKR zO`e zmb!G|0#5@kmE|!f)`OJvDH(MbIIhYb#IG8edsIP_TRTCWbcIjH2v<$FV6N6sE9{xK zo}_7~Q*~Fb=2h<#?EOLUVK_)|loC%PzFv0C=UDjn=1MKZV$JKnW%M8nj-z_#Q)efB zz7Q_7NpZ(ziE5<&3WvyLLLVQ^bJa)2Fz|*%qET z$2{lgoZ>wuA_e2eElnta-&IyR_VQk*X;?xW!Swj0TPf=$Xmlp?SHw65d7qYW?CZM# zPdWPrsEpt}wiC6H@JL{Lyd-FPT(Aq8%Be}e6m@80+(k8~KSh)T>#KPXvU)L*USdSl zCrRQ%4@+SN+0zAnCH59;{_)AqIEy5p7hPpHv?Qd!nHwS1>`|Xd(#_@%R`->O+e53I z@nb&PQ>^`DbR;6!6|XC*9#^Cm;k72}xM-nnAbzRr6ZtNi8Vq|zxZs)${2o8g7oOEV zqn)9}R$Yj7!98LIaEdGF+K?ZEdJwY5KVy79HeQN1;~UfOGl-aSrsswLoZQZ48K$~V zi5TiXJ}p4Zrw#lfvrK)G-Jiq`*$de|IyR=1;6N-*$HkUqZYy9K+TUbqLiOX6or@G` zR<+K^;AjWClIOE+nqoNfsvzv0b5f0^eT%3$y&xd7u}J&f!4~0$*pQ&vIFxRF2S4i$ zLBkBz4=Cq#J`fJ3lQEWmql<(q5fYCincn%53Uhjwf}Oy}%yy~bQJ*x92W=!9gV3M8 zp$H2yLRg(AA^d&|rEL?~$ChOVhuNwHkq7F(Na}JOM{czi>6IK4BTfi6fNeZ zR?bM_YDD=N`x>p~O*o9GwiisTopl&^Vp@yXb0EazqU$h{fMbxK7NEO1kz(UqATg0D zw4w%FQPo-PZ=Lzlqe0T*CdhS%DJ)`uxT7-urdR+DmN$}LKnqY6WnpmY57Y(cjUq{O zOpO=3?nmjDg)YcJk9|ed_9lczQrm;#l!j;nRowN3si*2vjwTV4c8N74GSgE2b0;9aI-wiuLpzGkS*%R&e$8sLN zhp_1+NNEdcKpeu|%8h=I^kVGFhgPu|mL4UUFHO3`l`>EkU?o-Odg`yH(>8MFV!9J;6 zh7>Vm-`1p>qhQ6VDGR=`GSWQw#wU9_Yp1liw9+5v)k<<`tuh5o`)FDclsN3dV=0mo zAlFoKV`8P00N%_NcMLk=k+V(FFv#|af91)h2w;;j@1pI6&{5OkrJ`czV$h>~0^K0G=Ri9_yS@%PVOBU93?qP#|yCI{d zVF7yrNGgL|M+_x>cyWtN3WxZB(jg(ie5kOn#34tai{7iG;xP|NWz`tSr}P!39R)ms z$n75pZ&`YC*K$q6(*_z?1Xo$OhkNc*B8@2%uEvJzc2I{t&5eUzE`8zO@*mkX9hWUC z6??vEkS8-fwLJv0Os-9OTJL9`j70(&Up)Krk&jojyu7ZFV`xWrN6CrOz=y4=^-ed) zE0ue^n`f~B*N8$Ib!>a;UEQ;H;&;QgH_)mU{u$Gx5pyXR6c*yZXvvJwadlGZFLEZz zKZ$6?l!n`8F3i^`Ba#5|gXOqk8OFu~lg`>jns2E(tUw$1m>83gV1jGfx_ke@OU>UI zasGJoKvhG!!tzYUaF0J^4wU7zC$XAGc2q?b63X5A6)ytX9ZgzKy2MilC*0i^dYh7F z-3oQcG3I`^41OKzdgttQk!n>xfb!%^X@zlnt!Dr^+7lONW2k_kk zo|#@&JW zvhbxL58!@6&~VAn1uF6|bAGKp9sy7NF_5a9RP>C&?B9Fv?Q}*r+GZ!l(D8{+jx}6$C#Bc_U9nv`0eI83w_@FicUT(N4*qOWp3KJP8B^7 z8&4qnFa<%&x;Ko>|o( z%;k%gS%pP#T$uTL0aL!c$Zbr$x;ta$cpTg4uhOKxTKyppT7|!_ofCUXpNq8@2AzmZ zs~%Fw$K%%w>h{Lci&>gEQcG3oOwa-qX^!!%)ITm^Z61>F69Hsg`BwN8Q4uj5tCpAp zPZuamTCxufR?Y?TeVLIcUI2L|vq~20`|gexZ=f*nN?f3(`OE6cb5s_`*Igob3d-nO z@fkfPdc>A??OHih7701HFzqLatMWEKF}Fi{4P!kG2kww1WcAuqG*qO@zVKc4{sjzGfU|slat=V0~KVaT$mDh_4W^!TsDAu4QZ$qlIg>1S(aqH4%R0z2?{~ zJjLs%$-Fq+?bjJtO2?*lB~G7Pu>znKW#pnKP0B8K+y3juj@Z?!)@4uLWp$h8q5)o)E@M-T7g+U$(cSTFr}@a0q1I+R zR_^?e66g4vd6%IMQNWrXzh7)R_sg-(4TVzq^=CKV1i z$uAS5^Wm+TN~xJ7wV+DJFFae5p277BGPQkI-qH2zVaSgs@yL57)db768-q=?n_f11 z+$i8!%YExxg&(wt?J-|YxYN3|>bentu3L>7ws>t+%vm|}rC=ZcY6LX6&87r=mLt`s za*8QX5?K5iSxD9!>53S)Y5uy(bK=q9ruYpx%f&^!CEP$>=e|a4Qg+%V=FV6^QF>-> z(fsY~YaQyk*gD&Jvw7@cWmgfqwv!|ir>HpEz>sQ-ezyjxjPoUJU7FbUsMC@amx4Jb z;YZadb06+ca<5No&XBfEJqEs>5F-nz+?ShRZ1Ud{bnkC96f8a}ZAZSknzZrO)%cv@ zaHaov44{nJnqdOu%nuWcq^)}&9S{}JLb5^@5JS`xyHLeIQ7>|(^a^24SDYqWF@BYQ z<&r${_z@2h9^mrL+b#X-7a5uAWcpQ~RUO9?-}*Sp(&|=ySS=xHOMd$_v&3k@2 z<@$xP>W+&(Ebi}BXnz?Ww-nNWlC@Gh7XXg&8PHi)hb6Zemr;k5>RE8>IyL|~H$pfN z)EBeaYoe~Ly~QEkG*>p?h8m=-x)sHdOaj}EueMkb3Ts&wee8= z`p}&n0`&(8)eg1rCnaGSaIp4{H$tx*cVz46^x$gcwbaaY_i^LWs*4Y0b(0C{O2df& zQ`YIIT(wL?@GZG$9~m&FaH?8gF==xXg>hJ2UEB3Bz?kQi_BuK4+9#(Fv!&S=!7TSA ziY?6{w~GXXHs4Aa${-Cjn)eF+a`DPh_PIhHL{K8D+C-3aol}S*38tw`AE>Zho4NPmSm&S-7P_t|0aAZZ4X$ zy3zDa87#g<<+^J5>D?y^oG$$-NK!2|VGkI&S~R*+a_{i@AQ3~f^~S=Ag=#67n&=nS zKu*-u=s~0MBmJd#1R%jc3$Q9+khJ6Y<%^~6nM+3p0{dBAr?2>-?DY5WJx7-=(2u@) zRXHEYp|ofHr#UJ$l?Qee*2}-O;SBlR2}#7+rP9npy$s}!V60yIt_4b>klr!d=ncgQ z7eG;=@itqGk%uv=tq&VK4g0UZ=e?dk+!azWw-;l$qXjhHuMr%)v#<||`INqd z3oX79v`=*3Z_udrNZA;u#xnAuzEm?9+i~pp;)2v+`;R*QbE=s}(7g1IAa#EG-=r1MpTIx; z#smHkro+VGmp$Y@jaNJipA@pjF8U)2?DlxmatUTlnsza+KlEL)Z~BFJ~S{E z$P3)X1Lg+jyYaNwdWCK+xN+p!=k~=KMPd^Hv^>B)34nO_tqjRP)wkLjIvY?krJ8`x zX+FXw@})L$D=(k)M;}tUXUf^Iqip#10KXg@+FEjPJhVaK$t<};>T?!GgWNTfT#LB< zid)a%$J>%e(F-+&9ivA-$AVv%-F!E>d`?%QAhL+|XF0yhG{%;!9Q+O#qet*y{A4Qh zawRghM=t6_O;p4Eb~gK0!o?X5nVBT}&`QU1Aq(^QpL`bDi8#J9dOr0Le@I_ZGvU?g zp_Yvf4&-wTbn>*ry!)K|0PAIVrcV8A&EMjGs(EkHUOhm}x}Edre(`-nl@4ok=&G=z zCAi)4x^a6ww>3jH#2nwmMz>097tOx6Ypk7u{xresb-7thzMS&Lq#=Ao?1=N6&ud8vxJk9Eg)83|R@V}KoGn2KR(njjLK*12=@sAZPuy|*Ws zuj#o?Q+Posja+d=&Pn~+D*0z-HbFu)oq^babzg;BXYtjp>1XkVQu<26b^1MnogIA^ zGp;xq3T`Q-fsv^kU$>%7u%h4LT5W2zuv5GT*fu|%I9|Ru=nVG#`88xC4zUI@X@U1e zBSptmzS9=lBE5re$u@J*K95Bl^Gc6UoD9NI>4}A~AK2@xL{XFJaWKqd(83}b2=U;n2_~fAYqgHp*%`P9KW>Hl-`(SDd54tqi~B4 zLY`7U;!$b!%Wsm02mRXSD_1e6-3-y}iHVm(s?A|J%iVDugpRk1(q*=T+2db63L>-k zSQ6*U?=BaOtULW(%k830KAH%+FlNQ{9-9OgIxnr-fzHeGXbtvQQKwj(-)n6AaYnRkK15w*)>_ao;rnenml4EnvF~x zPr6#hVr_k0G6$8t8_q4Bibp%Cj;iRojm&(#wen&!ULV>06Mx{AImN0aw&Kb{o`Evb z;l-1YHW^mCQNIlp&MgdNBbtp)6yzAMoyhg!IiUoY9Z4OEEO9m`d5n4gwW=ePx9nBT zS#(y_)jf39bp7`(GolXYQfJ=)EiatM3o~cevhB_EK)XI$fS&vsKkZO-1QYd}!n^nD z%OUWn#jocbI1tv;^YL^F`tWfP*OK@CK2m2dAkcU2Bu&YTFKG9go#qf)yWzMG^~5Jk zT8a#8D2C$Jb)5pccvw~7oS05>0PWKiN(xtcOouhynVI%W2x_~GhHIU5+jaTZR8uBS zFWMClzYS8%I2r)2t{ebOIMd5u4I6zyY8h9&^O&_MOqoTK)NZSDX@td6LivS;tylQ) z0CX_Bxy(W#R|Hp@RNjWL3jIpkpzvL#FV0&}$)RjPP}}>7DtjKcDQsJyxBVLT>KYlI zAvJDe56kR47Qv51chNtj7*?6lDBur3p3R|hfvT{U5I;OxDAqHHpHEhLgG4xGC9uo>JUASI@x|2w$m!D)VCo(6By$ryKTY z+xAqU#mZptKB1jcnqoBJ$Azm|Hig98FlN%zoph&vcMhl0akc1v|BPu0Tlr}}QowzS zCuFIxwkN$ZRYCy={PO9yeEBHY&b0MKa4mia3$j^qJkbtLfslGU;tS6WCu}jdEEJB@ zlQ=ND5K(R-16KDjn32N)jR4@!1R;A;h6voPaYrfBTK-hG=ZN^L>G^wo@ zwpt6JlRE|1+YHm?kvy6t)djmA3)c!&KXbkR(BhVOGctj^&eq!d4uzERthNfr`1IZ% zO4au9%4UcB?(D}*X|xdc6xy%19^gS|19psr`uk+N>y7Tmd?5w$fk*0F?ANOKzkY#S zJqQbN0u_w1Z%6y@@XL6q>%3`QzgxALI$4cetfpOVY8Q}+&b{ZX_6HsU>ohKMVdejH zF?_T;xIX*CGh8EhScT2CY?w;PK8bN9)I-#=xN)Hst3CVHX zn`BwAHmG5G30=@gp@)~*u~qbEyH!T7ZCK5YKzVO# z=oDG=a^8!%v%8KYGEMy>C?`0t;=Mny`NO{R@00y--ohxDpY|}!SFo-Nv(q^-ni>-U z>|f}c(jeqG1cJzHbONPdX{O1x$oA~`c*CSmu`lLL+heP?`}DD%p%e#=l2wZi+27U^ z2)9LhnU%X0+XQ^LR>Z*C;0>5JyXUa}ZOZ*q*U$<5yv{@L+}1v+-2TtS=xn{b8ov%7h^_h&1BA>*7InH}vT?E#YV5Os_GA>B#oC*L!DD z52t&zT$q~gv+zw6nX%81#_k#ZX`>Qp%x1PYkFe9G;&;rUCG9l|3CLGR`(8q$l%pF& zu^fEr$;+3_l`Annd1zeE+AW9kY)QWncCM#Ns4E#f!!fL9&ut?uCu}1r&cI)N25L30 z5$+nLDgTN6F_f~22t)@trY5(9HOri?p;ge(QO%N+aZ^JuyNO9J(1tSwFzIhj><_Ua z1qjP3DCy+qogAG>+N^~(E6DmkD}yIX5B5>p<1jj$^@|j7Sv4yIDmPQJG_&&8pPPPG zS%~R*&dr|;R{sgtmF8w5iFKL#Uh9~fH<2(aXC|zvxE_d7f>1c?O9-E&mWPs;Rmfzv zpMjqEtcK&9^PLD@Q#~2;*QsLziDQc%KiEnlsisC^>yLV^rnx*74=2BABQ#I#Uc4CLz9r-?bo4)a_HOKOeCK)AjjFWoQT zSI+Q+#OyaP?!A^RlkWKqVj6X`@fHAO5sU&Z?xG>_z795hGOIGlA(1QCe!#&5EM z*2o9mZ7o0OcMc+liB98R-&(2)SyD8RYO3usH!~#M7Wx&#JxEd>@oj9v7#$$*9>@cI z^^-t4oz-8!?nY(A*+860r4uXscxj9YMRT>TsfA|WWx#kOOXHwf0Yav}>q{WS8;pdY ztXbHO_h*B6!REeK?z86Gc6#8}-*(||f`dAd@Qg#Va#n*qm-lp}LNw34n5svnn%31R zf2>EVlA2O`t7yb1o!s7g@e6i3Cw-F_M-f78;GK5LL!$&2Ss<5LpjPB5b?0Tjxqsmq z>5LoYt{RVWN`V$Sx9L&wG`QOMabb!Wv2Nsqv7tb++7{WqPhEV6^kDLk#W-BCh2`#` z{d$3)wpFF@62wa3CtTw1z{v9OY5orF;)x-SUL8J5K$uxZPZ;W|Ef$0})r(Y75t1aW zA;Je`ju7Vu8Ps%fT=`4kRd-ovZ$C0G8T0?Co)56mr3X3&e#j?s;Ov55vwl}O*DV}8z(#9x( z%~JRhk@n;E;^x2T-UfHLtEQ84$)_HwC#9i;u5hEJ?_L><;@xZ`y>Tm6Uv57kKM*HRrjCJ_)1*iEj zNo#Z-YoQ}cvOrqz4X8gju10fi8}$^e1SPJo0pq+Zo=YR^1v`44_6+g4T&KXBKF zp5h};@#H1#1;8QJ*W%zH5pC}0+WCFHJ$9_?wsnbGcfC!teq7f*Gily@9XNbA2>omH z;l>RAx9n`=1@efmBFU;nJ4;@kW9nUEJ`8`Sba!@B4X&G}O(QLYoN=G*Cp|IzgA zjrv|m#+_~vLk4c}X7w1$Y31)|Vmj+Fdm;JcGGF+JqbQP^ViA4mAo527+r`}D81fsI z^DlPrXv*qPLsgU}eYtryl)cZ}hSza6`r>1Alw_P-J;QGu$`?rRFj^0%(c5ij^O`%y z8)t<4xi?Vux;>wjeoca0i&{rw*;UqpYNB|Z5}%lH<#vZKGgX~L0{F2TC}<+KE~4(B zjO_iK7G~eLf1mVrOc9L@q)OJH>IfOhzXi&}OjZ!9j|5?;kV+HZF;9YFVGK?rOZcz0 zjkuT*{b1LsMNRg`w|K_-PV)+GF!m%Il(Bz04AC_f;euHO6RF{5gz9D-RID*6c!^kJ z&wxaKHCV!)ap>_WxWtl0(vYOF6K$;WZ94i>?DAldU&(o_osR%+fGA}-fr?7fa-Jvb z5+&beOtsCHM8{pOYB{$P{i=ZYPmBO0sym_+h&7E9$Uf{mxgS-bVHxs-*)E~)bSYO?^Pz@uH(ndG^6heleH7jw9rNr2M& zy~XXWUhmt-Q=|oH!~}}ZJZeN>O{)h=wM70h-{j+uS}W)6Fs$5}tX(<}c23Z!1mR>F z?7Soz2r5xZ9_X;SIKy?Rza4j+K+$uZfiNa(Jt!6G>j>?|a*vJhUw&RcljgBh2~&ez zlBnWnfs)@M@05#|FpAm?2ZnH%Sn;e$AS-q^R1qIG-PL;6uENNDlyqfO<#qrEGDbA6 zvF*T8hzm(&VNFOWQBSNW!9imR2o{})7Efe1`Z++$>gujCTALk|`O@yhHQd$XXLhg| zoXt>QSM`mczgvPXO)r?_dHHx$EI$Z5pn_W*S9@FecwBB{v`;pMd>O;NMcYF-t|&z` zh4NoR8sTQt*?$Y?EH^|>5VAf;ZA;ZI2z;uD5Rf1H>JNol9jduR_C1RGr0m~B!IcyF zF~y2@!mm(V0kS`0k1Vr8IFtGrXoG8v+Kx-%q@s5^eL0HegHYtKtTs>ZHOmq1GYqvksYM136~oX=_U~lX$vBM;F};iMe16c`+M915_aYmL89 ze(v1dcziL|xZwKg<8*jDPG{}$i!TIp&SscaVkem7IHHzV0WWzyD&g%4Eu6tgq1|WsKzmG5QgRQxyq#Qv)^LPJm{1st8obTjps@mWOAW%;Jx}^&q|giPj^9Y#I;H17r{7*&S_>jnC?>seH0tSnoQG zze*=8!CH{pFB1e^qQttjt@k-qSNu#7jK+buSTk4UeFd`wP!8Dw}h)b8ifwgvF^+jrN zV_E$s$*v3-!qKKc4OFQV?9|V07M_pBHPOD(;~5kEd3_#FcmgXwb)nx=AWx4PUASdg zvUYRXIu+8LW(ld49-BQy<#ex)Dj~lJlvg0n3rvb|WL9kF7eGEZYp_^yWe|>8B7qnc z9~e$D|}7zsjL6k@oZ%-0rH!?u_GrX>N5KTDKiC9H1;gHw!~)fiqmVGfX!Uq zGpb2%xZ8Xzh0%N9Id2nMqeKZ~CFJJK32ej2`-;KNSER5H98ClqV!#u>DvDkQnIw#O zp;05)6qM?9_)J;2srO8c-$8MK5*#2VNPtxZu{2J?KKu;-VO zaH24!K*$Zk_XTs!{m*~fS{hCJZoK2)rpR9BQu#zfgoU%_rcSKs7%ApEt`gP>%l}jj zQJ*IJ4y;KF0(|TS_*g8#k{*{Wyvv(+JR~8%$D-eMKSOFOvEy3Bm?5>8pu@V%g=+FRNMevJ#EsDv*(;s$A%h3cQ^U(47t&?8?Nn84H7S(fDR zQSjN4PTjIWOTwlhCvzw)pc1S7{FMJON*)HH2o@1e#2HnZAaZ6yL&hENlnu~{jQ?~3 zuUS6m-ge+Nzd>Ick)TfiNoxSClofyXw#5j;~{;bl_R@ z-^E0v@CRgj?5Zs3+14njuvC|b)61|`Q^zY>Fv26v%+^vObkh>?q`@ChBVza^9hiD=$+ioBT)k*^#%xEXhJlHRqPZ_ZmHf+Ji`;Y8b(G%v8SVRNpXm1j_47 ztEOUn*rA-1PoKBSPcuZjNMdN93=7K{JYVo_(Hhy&h!NS z?{yHl^jq#74cQv`{=gp#6=g|gVwDYRPnq?=4p)r0#JAc6hs-PF`-(7ghe85UF?1w^ zkNA~C#jlhxCM{XHz73c?TBv3r7Fw$H3GYU`j*@TmhMt^QD9h|{!O3uNwOoOQj{K08 zs8)-~@?$@sBli;8f8b{%_GE88;r90=&@2(tvV)Y}SBSVC@jru47>kf1X%*05hB$G9 zlzELM1-W3Yt6dHWa$x7h;)-)TQb7QSW#Y9hpXqVcQh#}Rh37~Y_U{+>u-sp$2ciq)B`zJa-n;cYIRStBVH{CYe(8bB>+$+|CE>dIep()$YqjC4Mx*F!T^MmL z^!aRS0~r^S>)$PC;FG64GNwwj>$FoL_k_${VH9VVJ8i)X5@b5&_2tFh4Ag^4dmZNn zfldNN46e@ju>{@M{&nH1de9}V3|vQ&SqsHE+7aB-SD(G_?UDg}&h5uB~s% zZ*|@JG=>haI;gL;3qxz;pGl`&P%M4}+P`yEA4iC{^K7_hu`&*;Z>IIe1l6*I(UR~mpj{LxxSo^q&RhRa; zUQKL0=exc>`s6D zZ?Uarq2A?BY41K|n@T27E7`l5JK1toG=V{BJ+S;;$oWLV@- zdDBxWC)72DUrLu@7G&1l=*fwMz03|$LG4%5t60MQy5MvLqj+@{-vGuPy;`MWpTxX&;=LFy>rrPq zX|3X>HarpPJlok(YqR+3`Q2x7-BrcFD`nURHRMT@X#j5L?7@z^db&Z)SNP}Cr&i-L znTnE6`A=p4>jlp92hGW?au#G$MHAIIZfJB_8I`h_u@ov&T1#9uzEJ!pn!~@g7_3!R z0kDXue)9^f{jKA2qg%w1W_7fFk7pysS{au&WmYzm)k5oXTfW~=9Enf2} zCr0d3X{(z>)LVa%O=dw(UlrtET+qMniO&TAt($J|_5I)r z4ThyJZ_7ZLj^Rh~Fx;Dfu>_tx2|LlUso9Sgmc?YH!Z9ZAOGeZ1~LVeRhMRvP! zBK)o2L$W;m=$jNC-!SUrE;M-y?Hndi$(1XrS3CqfdXf97A0AkfO}#L$@<0^ z)xpUMm}qM7i6Nv*!Q@!|ZBIj!EGQ74h*M(2c&et+C|xaaLeQ?CkBquZ0SM>8?>0T& zjdnv*+s>mmDC$Zii7JJl6?sym#m)pWQURoay4**b;<`!Pr9t?XsxT>|YGZ(T@*9KpeZ%^8m!V+QYVm2-zF6e_U~uwh*Vb2;vz(x2UBmTC zg*%;W`Qp?(e-@5j$H6HKGg$~!kuvr7JPAVhtlJcD7Go)^d~;xWw*RJIVzl;E_Jh+E z;iF-T5dKDNQ+vgP`)FXRL^vy^BjIR(kLgo-QggnYCxy6uiFm!O#jfqdm+KLCd^-c& zMp{zDj7pX{rXdZ~WI@MT^g}3vckY`{UMHuv-E37>AoeWt+5cX4^%@z18#xGyB@KD< z{9B`RJ+mrZ?p)f@6v*%!pvu%+a;3~pYrfS=F}n)t-pBtQw|q0W0ZgjWujse2zJ{Z> z9XHc0U#z?IHDhlFM*);rdSZ%e3BGj6+6C31qQ{i`Kw>gIT8R6|N&#C*tW?9waz!u`Bje7E2=GA#CI>R$Rc z`6UJuR?gfFl=vacnt0Bq@+n3N^BcU1VZ4+HC(%bcN1TXp@5Jp14&mj-?n!VU_A^ty z;h+W1G50>MqmIQfc}PegU7ZtqdhQ=qs(pX6ut)}PsKC=}#e9KlG9OOy>OU{&gvi}x zswFq283YO7+#46C!s)xOVn7oau3HNGdlqBO9XYYc_%9tg-a&^nG%oMW$%?*w zIKn{-*Z#*uT5)LI`?lQ34s&2O46C7d0jrFCa}%HUqLtvCOa2{)SEx+4{@3>htAZk% zwSXwNjzHOy#AIM=d>12DMREyQR%%WWPe&ET6rsO#`_ZhVxX_fCTu}xp+|sht0_w*9 zEt2VRGL``nHFfb*@@L2VMpf_9G-%nn%WzoNvqgZBN+> z-+F~uQqLTGsSM+rkK4v;j|DB;rHJdvLGXKU1c_xEj4b=CL3cWH>MfXqt>HX zxZ^J){GlEHc~V}4E|I@-q-4;_3zY_o=wU-uLV03nrwS!pbMC1lFG(!cEf~+%GUU`3 zLC80<4%QR+^Ahj@Cl{4Ro{~TB(&R(SW_*kwo_|OtoeB6QA`+%ttNLp&D}NH z^xeEGES(~F-eqXQo6+q>p^VCu{+w-^DMDIyLz}#TOFzeGkFuia{lrRPC?0GHp}%oB zknX`LSgf>Ql7r1tFbvMz6j({ZN|q{bsFR{TBScr|5f8Qyq`=XmQn1J#2%SA{j~j8Q8m=KtCNj$TIpQbM3eI z0B>Idz2{}G;dk;q>9LDt*&@x4nW9O!!83BgT#}5_Umgb6VnMJl`iV!{ zn-d9;V}BU4N;+a}IWcf8B6jeai8)~R1*i4v9E&uS{T?sFxuKt^kz~)6E4hag(A(!E zTj=v?FyH7ZQ)n~|ch`R`QJHmf%5MbU8P|gogi<3Yk~eqMFZ2(h%JFlseOT40FQ)gN32JrX~b`=Sc1KnAa%re8o?a z&prPPAMVgGiBKq8TDFMI|B?`83xY4--aDF1DcY2|BzwUi$+%VtgSOZdhLjJDBm)+e z<0>O$u!PZhv5qAe$(3>c2#{Z^joq$Mo2n=KAd5&4_(VMJE8UO)Zf%%u?mDl3VAxbv zSC_|7RTO!GU$PC#G-aLdclDzak7yjq=`1f>)dC2i; zA6fOed7LboXMHst0*4>x0~^fpcBLQl3Z-3_uB9!|9G^iOL*xbeUF~MI6m(m&sQX(s ztt@_vn$z}H>p8;BD?V`S)B2Z+40T@)Tl3rwzkW)A1)bXIOuO;I6V93p05`9H0*F=d zjERi2GZsZwi;USoKvTnpTs~y{>_`w`?X1F6o;Rl7(!cyjtOnJDW=yuH8|&UU*Kg%E zD~peinGSF#YD1$x9<(v!o(y(o%GMhV^hiO%xMwx9*5%sUx>(N3S%_>mIfc|t6v)Ml zKWW$p4*EryRL#smHj|Knxf$Xz9%gpoxz)rii{A%L4g0`BKQln6;#cg@;;fJG?i)B+wsD8oiO4h6t}j(J1soYftXHyM8sQ+K)OcJ-)_f!%p4=i^%M z)RV?lW|yc>883X+<|&)qy>TDz-kj4N>W5bX zI+y)E%i-gk8Xzvq=MsMJ^+amj>pK#B9pX2B@tN29+)~^21#Gc1i|KHthIO`+D7s4H zPyPArcq{kkO@PwAWrAdvJ5Iw7!sVfk4DqK!LbJ}sUHJD(`nLKa0vD=ou@@AhZv5<; zu*5d4rrW!{CcB>2Q|h{PTe@59++qbO164|ncclNeU4S8{gBXdN^#0%L^HScKt%>KI zBbv&#EB9&}ql*RX$?C^9Fn^nK9iV~#XI=Dhqjf*Vc8m8EcYxlvpUYdiT+Z-vY)lW8 z&krlw$mptEFH<%fJ?b{r#a~;VDNby;Mf$4>5sbKeY)ZX!$uS{gCE_S z`b{hDQLN}k>y_nfD}!>&3Ur_Ebq~i;lOa=A3)oMOn)cOyhk6d@4#?luMX*GHj(ayc zA%*O0R%W-?(RHz%=e)0{Nw&{CtCVPX_;ZXa>+cL}gWOLOy2$E2|!1Yspe z(8gtV5wFZwltd$E(?Wu*aSh#1eJw}qQG)UEfBxrC(mJPzmX6Nb(N(m(&g`6vrp8+n zyj!3`)T^Os0GZ=}TuryQUz>@m5I<-|jd&RkL_}O~5tp{>=kjh*pVN`*_0prA~Er}#|(PN0k%XVLjt%O z1v7NaQkvHps$lqNg+@?%p~WGm>$udlg>lD^PD1Epf;yB?fLW}}qQcLzzu0r_7kgT9886J((e@AI%eaZ@q_xhEU^#y1y1dX-{Myl1he@%61o)*7fq}uj=?fMNlf9jFGuq! zn$lp>biH^nzIN&cZ2eV}BKOsJs+C$&pH&0TI(tEqRVj2(L*aqx^621;IV`WoHv7f% z9#)k{rIo&(mxoub#U~v?(X)*%1px0LI5D6zJWrEEL22Hm0nD3sFLR2F9{_%!mLrT# zArCB=`zJu&ar3RDfF}Ab;&rKwYM;t)kc|g#FVY$p#8Q5VH@DyW45ol!tEu*#d;Ri# zp71N#Lb7Rl**q9>tXJ9d-|OOZVLDCFJk22m5N|EMACq%6Lk;CoxR1dQ0l9xnshcv+ zs2epyRg*mshH{U28lOD0J){8CQgR+?RwE|Pg0YsAF^06U9J*Tn{4>?_*-oM3T1ze6 zhwHT-TCPHMW#&$4^aw+*`N!1(AGPr7#GhS5e7l45`*SrrIC+D%aO?q$eN>=T2jV_L z3JCRLpq3gblIBsOl*>uyHD(Nh#>3~!x;Zvml#%=Gv+&^EMgaR5BI9&=D5@533TC7! zu42sN;d9jcyB*6qs(}_V#NVjg_SCZ5pvvS6vyzNVP(o8>yDkzLyDqup$MTQARlWg> z$KSj(nIObJQXYlvGu&s^s=~A=7Ak@-TR-zT4Zp*HM(8(Tel5cGn-YQofC!7!a%NMJ z7$VY^Kz&(JLLw{UU=o#A9uJf_r5_kG4<0D6B#@u3Q@=334tRvCBQ6L6#(O`Z$T+5S zC3C@zWs%}~z72s_EtXcIu@kZ1@6%y4s9_7MTY?y$umqe=sL&TvPdkG-*`97@Cy|bG z)1aq?(8CbN*h$&ugUZj0fD~mx5o4Kw)J6~}{nL_o(8YzQO{?tRQ0TGbGGz-;r{=FT zA!?TS7mvK%sqvGMu$zO;V$?rTL1+tXp8_-GMH-<`EkXn!=YN743>Z7VMTv!L@#C6_ zGnKzQRH5i$4p8nE41{`>?lLA4TLKGM+bQo>) zk>a4g{T8eW6yi0t+=}n)#@?K`sDOXYLTmlI;c?;r=1>%dJ^LrOjCCp(w^@Q7ujx#+ zYH8J2Yjk&fS}V`>Oxh(ON=~gg6N*Ib6Uy$Tg@JeiD+!7rWr`%MkqAbjIEIrh6wPq@ z74cPaz}cEKkOTrrC?YSwEIE+r2fRc)owJLv6QqIzxONwn;7wWt?uoQ1b)~MB#+Tv1L67&dp*BKRslRM zU{@OIWt@(0{{zw#k_eMCYQ}0%$}E;0jW=D;PinQT&P{8TR8WL7KbIx$(M!a{>Mmk& z7OTK1t~|Gk7JdhJI+k;=7FHiW-JdP>6~-5L2XwGJr$%O5Zjh>KLWq5vD$~DwNMD@Z z-_4eVHbN4sVG+v_H3mZX2u@IuuLBHU;E1SQCvhsIC<~f(9T@8)P@vR+1#-i@E?a5evm1i)&t6l7bnzLh|FH zVcn*X8>NZUM3Y3>L+j@s%g;)>08@YD!EJX+j`os`Swz$1xWG=v?6T(O#k)fp#DXvk&C3zJ@Q zNa~ZmE1c$)%0H%vHF**-AmC-rR#(_2_W_-S2+&#)C+=3VOfe5BJ*Ud8M2b9zZAzCb z@x$d5z(b4%WW||5ZOwUr^P@WANW%E+xX0|=Bl}Od76GRCP+*}Q2CM@fi6&z6+uWWq zcPyPv60&33sW+67mj3CRhEL{9UK!i!B2WXG_~dL^E4-A2_s5ot4=K=W%Ca8s=9CdE zC&+t6xR@79w&;GFn3?JLg=) zqam-poY~+Co^;s})mDaF^k1qLfrg@>-l_Y1-C zZ+yIj=2LLUJu6&FHX)lRxK;xHBx};>1Saed`y@IaQTEg8Dh7cqA8vg{8B4%#R|GJ6 zSr|Uh=(_=GLzYMZ!@b;flwd_j)z(=iE|S?52Sz2cw!Wr{R{NU8*FUa=J5j&zAtjQ| zZNK4EZ*d?wC%tNkv*Jc`%Xy(5J=t#6%(j_hn?TvI8KP8x=T>}F=kSF_d>=XKM8VYdLg<{!(#NTIiwr1D>~;*f(_ zJt5jw8;Q>AU@XfQOV_&LfIC>D;+u~$CHVyDV{d#ZF;6@N4Va}|MnurtlbG5cDh9Tg zBpf(x*RgBtIb+$)g5TtIM`a-}cTxGyU)$@9_>i@+eIG|xM|9Mr8sfx+`&Cvagf}!a~ zA=An~incsP0T7n`Fbc{u-=5-?*dnxK5Ow{=7RK?^1W)6A-m4llqn=O?tR8Oa@3aTNd6+xZ}R0W?TIm!20VW%BT1DFydQj6=dC@pAw{5WB|8kO zPOI(qzruDZ&D-@5J}XT$06kFI~c?r4mRHW<4=R{-9~0wPUw_k87AtFH}9^?8VY#! z8~si@A0kYb0~6*@8~;Pa0ykKuTd$rwspqu+UPYx|i~-_J@#oWnmo9C(nnqj`NmWRG zKPjmwplp?XLS|+nB}FA63`YTI-V5kak~70zWX8CpPCNwRqvXQ4Oy;3hNAo~qhK=33 z5&JCD84Xs1wsW_s;ASsoiOYcupbuK2F~tO|z)H5Us`#{2?kzg>dB3=r1x`_6!!;pB3h8u$ zr8I_iS(}mbA7@bEvuA#pv8}cMe=uwLeOvCv>fY=bzq5tfY^4TGX#^MEJ=2QVlDIeo zLeK%ZlShpzA^@tlK!wnv`H#4^pfmC$3jL zmeE)_Zt>bLG)xqY9hF0e&nD{$SFF@ z(gc#*Vns%bBno)vK5O;+Qo=_}@C8IoAVSd6-T9HFN$rLD3x}ak1-OJuxEf4OC+&dpEP*dkvzr zve&BD04ha(3DB$3?b)?$rS$K9ak|N!_E1BlXOls96QMH(vSyKI$d}L};uk&kq*lgD zh?FYN68p2vUO7#q9AOH{q_6&qd;JqIhSDNpqN_hDO#*iUd-6wnb5y4zZx)p}1>+tf zlbf9pmwY?}Z|{cuF9-JzBvF=$MSDj6Q}NekHsKq#DTt5S7bdkjOK;qB#w;2Bd@4MlGNqO%xnnFlI*$=5dPukkCA#Iv`9|@fSH9zv1zKE1 z_sr@)oZfs)QOQ0hX|f1H1ICCb?i^ipMKx|ZzqvJ#l=!gt7U{1>x)OURNWTKC=&bC4 z#n`iOcWnP2H7XigWI_drA~f(_-v40=HYI$^q?aD?Yk_Qnz&#ZnG$*7=YLIsvrGDyG zk~n6olvel0)|Jvg(2x7(WrON8usp(@6?w+o`&;La=yN3&&{T03n&9L4Ysr9_-gv@^ zUXcp>-V1`PlNCUQgx5&mM=pFsBuA#oBrc`)OAMn>5DmXs2Zm%qkkJYuM3dP(GLA-f zw?wqpM~r{MmU_Lbb6L)mAS*$brw>kh+qABoTY})v`1gJhOe8%F*#bpT{N)&Tz|n}p z8}9%>=8Tq;Bc;@7SJ;ehRl;H`e|{atOE$bnZEy#DI}ZR|9@mqqQ-lK z$eUPhRJZ$H5O|*L0@TQ!G+PwF2tZ;zxi-F?r?f~aN7e=cX!}|NzJzpudxT{*_EAGD zi0CWYAuWAmUHQ-p6km|E1s`~))XE{#Tb5XjWC8#y0!vjf z_S)T#n~GDvqcYtbL}4Qu6SqVLy);;CFZx(S#JMupc?%iE#jor^6Nv8rxa1!})$r)o0 z*%cq$WFznWyfN6d^38Y+q1)my*r_Ok;Kb(vamTDaPn8>P=bX<5@MH6(K*3CndL14igiO{5f6AYJq(`3^$`2DHL8n)im*E!f zzmf3Tw~^6WS_-=I(3E{->@AuVBsSEO(S8Yc4{$g1bU*ZI+Y``Bv|V|nZ&MH23t%T{ z#(jm^@W zcBcwaClHy?^~ZO0;+zN7bCoS2=rp;&cZ&2Me<3kCJO6y7k+`9cVlGEd#|{|KvL)?h zMGWy3ACkhwIA$2uGv7@sd-Cfm| z)GeC6G`wh8$8$>yxX@jL@oC(|8dBAz9C9uNxQ_hqGchG z+nT}Fl&`A;h@JIRYIJKih4S#9fi$iuGA)hh*qgdQV;+jy^qzMUFVP|@xzFGQrj=$0$%ZURw&Vq- zRh7S-udJ#JQG5#^ctON(T=!cB-|=lr)oWseD7EBMdKlx#OkXT=A&#o0_oA#UA-N@! z1xi%&F|^Q<`C-U1kDN$J=`!U%yOHO;_%RrTkczN)$HC@h$T1k*F@7}$Vp>ecfvi_9 z6l{7xj25Y)uiNa4g75M~hYe~TcT62LrjVBmupZuwVwc4cwE_b4arVN@9>~ zR@CZWJ=@&tWfyhr_IoF%U>6$hxMdX?1i%+|wz2F!q&S3*8IoW<`NzlnAcVLQx-xGL zx|LChyQO>}iZRfqq#^>ZY5;-tyx8oB?S%Z16<2%w)5I1XFYjKWlGK2gtd~PhZNeMAGr9OmQx5|WaHr%B_J6n3dhMq41KNU*>p&gQ-yD~@4voyClT|0{d#l|D1?w{1rkwS9J8OtsH zJLfpeown8xiI$BEK2_gXt9E^zslc?myvkw7Ex%Kp9gcLr`e|H)ZNpsx#;j z35eFeocAf(b~Qdf zT%h?HKq{bbpms znRYiCF-N{wBY+>*Ae5e^#NK-F4nJ>pw%Qnp*-DDnP5;?uJK{s6P*s*s8Ga35uiK6Win1gv)qLo@*z!v?p=>MXfBAsa(rnvX`f|-V)K#&_z?#113~EkPlbgl zjAfwO{R5);Vh(&fGZVeH!lC+m@h$vU?N>SaFLd7G|MZtPUJd|9US`yx>`)3KRi$DU z!VD21@KQC8Da~XeJ$A%=`~N%{ST02fykJ*E#dI0OL=Op5U@k_^!)s>w(Qkz?Vb4rt z2P@RT3xVLw8Y)_$@f_U=6ql?K{~}{Wm%(b9F8PJ3(U30>NWw=}VjauhOQ~qt z70||J#hFU##sQJjCW7;+#XwyY6WkysB`gC?IBc+BiBEHtS=NBFw`GS z9$-s`qKPoT7I}uL6Ih^pRMak@$XX|+#fgVbDxNWr%#9ZocZy5|NF88S23d$Mbie#u z^Vv9VO{CEKTW4souRrOeg?5YNxj!7HowT)W)#k_0o{<3| zaW?9BzH2(29Evnoyv%AsCMe#*;+dn+c~1XJ=b-u*rSkd zd*4&sJ(IU_%1@Ojqc6m=)U!f9mmOr$ELPDWW^z;}Qc=GQ&>^oMkX~bV6LtpB?xHLi z8Oq{kQnxqlA*8aL{e33rQPd>u!60`#t$uJwhAPbpWTG#2;~sejed}xe%i*O2Vx9M|Yn=pYQ9T->+xZTPMA= z!vk;1fAayAw%nsPH{1Wd9QF+eTOCDOFd5v_7i#sRqDs#nZ~Z%7_WruUevyRp_=#rS z1e=_s-#{GMfcL^O7j%rI8=0fco(ni=wBY zT80`{Ep8<_lnVq$S}CRY*BqK$kj6~COAEM z*VC}S+|Bq{`!=#=q+N=8D8f%nG>^e%LpQXS-zCkpBS@p9%M9#OPfdc-O)9!Wp(p23 zfBvwSu#nFitTlm_*iTuQXq37o>5iVy4wRXjY$?&%BmaDg_7K6V+qONItiSq|_D_G# ze4yKVI@~N};SBZ(mW)cq|twgT=G`< zt=|n@uG|N87(a=9xa*p6U#^y2#M7J*$~DcJgcfSEf|)=!7rJ~a5nB1_&f1sj4o`8S zr}W+!6OW+ZBfjo;6(g0STzRF?PpW%U!R_lq(*~>MyvbkIZn?=8`0y_{-#tHY|Cav; zu`zOG1AKSVw8s12W_{djt}HJZsO*+*F-Z{b0_ROU=IuaPHr zLGN{q4d84=FU6Y~voU|1zk?2qnUo70q;&j=qA(@A)W-b*&yXHEyK8a1uubzGh-%fN z`uGaeCKdbaWs=rV9MU%S3;eA}F*JDC+&UOya}7B@_w!M}1Nj~BR_ya*%(&t4X`=vS z3&c~8A`m8hmjwHVcaCNsT9Ag!LhJ0qPZ8rrP}!0)cQ{hYBE_$SsOWM(C?W|iEM9R6 z7!yd~2pO|L>vQ-?Ac?&nY|2*VzWP|@lF+3zPyn;~Yf9%PLTJA^5F@uRH%2_(oyMRz zb3V~0_N3UcZ%i`m?fq)4@%28AtM%@}>k3Ae=3~Yalf2$kqTV4+m*Pwv!45w^457TV zP>FkgW=skBsHA|LQc04U+9wYg!#wBMD2c2Rmm7K0>de6y2M3@pYAwYvPuCn<3#m2| zU+ZS}Amw-HQtt2tqiN8}z()o78;HIYLQNNFwzUsH{WX?g!Sn zw&uU80NS=ItRw#JT#O(0va*L1Q#-iD1Onc8Aav=pVd!Oyj}}j2s}22wJ}^Y%6qEBR z!l&Y_c#%uvhyEw#JG4i}^6+bKy41bVgJQFuk?;N;kOcfiDFg^h>Z{@QDWB$eKI5pT zQwA#)=cGSyf^+08CS}hS>Xcf?5D}bc_m~*PL2o6qKjZM$ZIf;TS0VY)@MF`roKOGgz_HQ&k=kr1Y1dA zPUNJ3rTA4-OLB&~NpVnQMd{BSvFYSN>l7}0eAUa>jjg3;(A&&J%xL_H1rhq|iA|lU zcaQ8~`jfGn<3}UN*KwSa6RXwHvpFRyxN*;vBqAy!ADKBx3Rwwdijy&hzkJHVJhKGy zvdzU$CY{(iw})ZX;v|xBVB~lmx$|@N#c1KSP^A)J&Pv2!g~I4i26;RntM_Z+8&2B% z_}g6a(KL6a@ zKkP47^&9x#??Cr|Li&Q_x9;3VdG#~&0~JgA%kv^Kv1vRsY%Nu3GljS|UOQa#^2g%I z%a9iHu&R$3jf57TP~vIZrI8(aN**ww{p_8-@kVd^{4P%%j`z?^ZX-Da}Emyg`|(3A*NH z+UmgbQGo?grsXNck)tqfB0P+ZHXLo zHKWDF^Ag)xWQTwE?Cs;2tlMOsZ{N!nP>3A$^Qs7E-DXNTZ;m;zsYGm|DFc=^M%E}( z(=lSmhx-Fp?Gtm;5~z<409iX`D%$&S!}||74FoK3tQ_-$hW*oje*Bl(;_UZM`LeChTj8WMnY zX%Urt+E=XC+8Mn%IcK~AK?n{4pD2>($u3AZ?))4&uP=t+{rk@rk$?8{>>wOkp$lfG z6Jh?KmeLWo9HlIj1Vv_;C6e6?D4ANk7Drj`w zUn)1SPstk7gEl*%C@-{~m`T$T?T)(Vht6+{Ef^qYb3f23q)10?KKrLQ3+pBWM51ZO zz|_-28hWyiY?IKk!ZX;hEClc#f7r>0v!J8|&&Q*7p-cy_Ih%MOHzE&CFFfs}^mT-d z>X!8Au`+CNoxf~{I_w`R^ z4vEFND&y=wBJ}?mhU13s2)L0YcApMPx=VpfAdHTDt&S;aiL#XbqM6>dyqbVu5Je4y z1@Hy}Uuo}u|6U_$ve>z{jUA=cy#ptDypc1^M0s__Xsl zjelEq!r2_Z`&s4ij7C58?&M$t{Mu_@va#WAGHeSn2X<|C4+HDn7mNp<_)(s!Z$p0m zQk8VPcD5D;Y4tPyv{e%i^Z@4k_IG?Te5*gxd-#8J-E!Zrn!mUhLG2U%=!@ig9ckG* z%kQ>o?4l!{3H&2a!ZMJ^Q}&c^H-qn6K@hFb*O9o%`(8&hm|rpSu9x~zyFGUCcmK9B zpWiLfzj0FP^Sg%rz4Li6u*T~MI&#VTzTE#c>kV#qTy4TJc#GgS8=WL>m6cEfLqcWn z68e=j76P6#=7>zr=3YERg3E|1H!@xDWRiLrK>_za<>3MJy3)Bb0PONr;EgM?1#{mYOEeQI*H_^@N}G)Tqy+_v{e=b%w z5wl&K-HkRYVq5rp{9*yw1kG+dahq$x0sjK4d*Qayrpi{m$1?>1oxUGbu{G!w8x#)Yfv3J=4KYk~wtgw9{*E4U_kt-gGttHS8l&ermDIwr3knj}keWN3D zUEE#_by0_^xA|;uOvs}b4BxG#_3(QA>qhq@P~^E#pV95t(mf*iH3YLFCtHd^m9}^x zDIbNY1u&_nI^G>|tox$Fj$GNx4s4mf$KT9FzpjsPFEBb;2Ywe=a<0I@^4Z^l?($1C zrCf|sx*`0LRZOI8HNr_2eu`j9C{0s(p{QG&@Yf&M(oUzK3 z@Rkyo(gO0(f0CEUD1-zv^B-;Uj_gc`+mJc#MMvPJ1t!X{_KC9NHt*+zBD5i>Lg&T@ zKMFteF#) zFoAh^7l~mvJrX@g^ubCAO@(3{62K*{0dS9KAr-%-`h_p_ttIYpXWAit%nqlebyY94 zGuV=QlmZ8<<~S;eXuzI*IouO^ccH^Lzp*8IrT&y0Y`k4!n?n5S^32$GZgv_ym!~of z8D2y!9s`ng0*O|*^bWY0`J%IM%u8;{N+*i~#PFNY#^@14g|f~3GP=S!M%igd@*<)H z&mpz&NbyYXm3Vfzpd2yAsrsfW%gphX?W3Q+%V}CyeW+k9u*meltEc-2t+_!tf8X&m zX+qCWf8y+~JvJgyO+x?WuB`{|a#k*-Gajhm#VGroBDiRbl!(RcQsS3^o{1ZZyG0b_ zK@tH}N_eCWz+C5ln0KPjZXnW_b{~e(U_*Y}AfP=U&h_J4n}oQ}ha(n{QQqCKy#jSL zBW~Lt+8|W08qGsMlY{4;hN$`FqIx9&3?EtLQAA&DWSZYWpzm$`hG_!XuLE*BHqaBz{ewxzkCu6r00U;yYM)uZ$cr0_pUdn6MFcKDo4s{1o!dc14qIXf5uiFLB42dgpF zy{%kRj@-pR7k}v7aNptwb~aaNP?oY3RN@FjVU>ca9ihXIFim%=rT-3!KWM^Jj;=6c zRrnPA89^Bi@#?q|=Z+wpL&zMZGZ-@MMT%?1x3XKfU&3k6!7R43rCKp%&X`LX&o^}; zcrIhBnoK@81zs?{zwq2<+d*~xXa2Sa_C40C9?ajS^7U|W=CnQzm78w$9=py%I}CO^ zGySou#7Ycgm$5*Zgj_4p0pvb_ttN^J9#XX?cRz~KyhHI_C~a(69F&faeLNK9fG$=^ zP&OcP8c?9Fx7oD!kp|8uc|z*r@lV$=Hck+ zAFe@Y_r2?!4O4)a7$%0bkbyGMH3-EeAJqXBX%LDHTaA=tC$A-aWvau%yb-p9IEf<7 zNhWjX*5iy+)D)tuc_7y5G~uB5%98YX`-jjElxeu=U>2dVWU*FP6C%Y@ zb0o=%i`~T{`Gy<`f&w`@^j=xrS$T{Nei~(J6S8A@u8|zo*@o(i$USbhF?Q=e9pOy* z?i9kZ)w){Sl!k89)vRJoH42T#L0=knW8(w^CfqrsYwoNp%8PNMgJNceBt-US*3nIx zJ~KmE5g#moCd)T@H2Oah zARKlpE_pK@sH;L4r$37n%Nkn#fcksE+vN(+oE`JA9#!TpKnk=ZMCz+BzCc;-=N=OI z(^a^47a;y7hJroWe#9p_3i(;LXS_i{u(8tR94p^VvO4E*Iqir*)fUH&Jkb&($%7z6 zB&8}-fWa|+Oj5f+c^{GQCr4ejr}`>zh>`2(f{G`2m=g-BzE<%H52o*416AoYm*bc< ziN&e5Xh#5GW!P)A!Rm5KM&p|$2E8vNE(P|b(QIn`4-TMA z`FL4FXC?64|KtWYWI1H60lGF-Ocyn@sC`Y@W<5iY_yQ1i+d%6a|4o zA1-#TFcgIQW5X!8odkw&r7P$dYBq|G6Z8+;;DSwmSGw5dgVz~Nmf9kW?YGcFv+-=; zRI^_8QiJpqdKWF(-Y>P`zB*f>uyp_ zY(-Wn=u#}E!&}rtrp8f7rGzO`E_cmMZi_gvj{hlXg@%1dge{TUc5>{cZeHaiN8q*| zyx7)c%o(S9cnZfqK{tuFjSp~7a324_$+?7L%E{3db5YO4Qm6hFl{<{=?2f^0D{XoZBs zz+o?r{66VC&3m<8--mzQqssBcY{Lk8z#cBH8fz9l#=kPvfg)~f3cSH`Fdc{Q0?-yx zW)*_T)G1BIr!eS5#|+x z`8>IpAaMO@5h%nW!!p@&)3QX}|5>GkGMkab2L*^OxW_)&$ioOgon|T=PPh-3s_^{E zl$Vt&dJ2|}>Q4uzz|YPSg;qF#*~|`XT8;#onui;X0_R{J#NZUaf3liEN@@fu!8|Trw*1VH=_XTDYU#IKR7SbdpD*lM|#Ji_` zjZSJN4-Ke6N|`tQRk8*5eV{AM#qXUhKfP1LBjJ}5N?cA>VkSv)_DiG0Nb-}+oY)LJ zAMuG_^7_h_o7p>h2@!^T^UhO}YTVpjNtm_Fd<|EW!zGh*%+I~l$SX{aoN{x(;Hhlg zrCruUdr|M_Uv%as8Rt8Jc)aZeeVY1!K~Z%1xP{NM6}Ewkh0*uSBg>4G+LGk@xfLJ- zPPF9di)_{yLv(g&;`md;)9GK8)&#VN_Nm!IcHcB>mE^1G$ zV?Sm@5O%}%t@A%F#_#9=^Qs!tV0$0Rbg_OQk%BZkScIlGjx9L~BBI@WV^Ol|QYnBd0i!nYgV&g*r}QpllhX;cSk= zP-wu2EYSfQ8l8bOP<~sMGiHymYhyuvpbQnY0dNFy5&lhztvlFYV34P@xA%o}tb^F& z!~U%`%Z$ZIw5&bkgIPPe^!mB0z(T+A$S{~Ts;PbF>rh8g31FgcD;IH&Q&=fmmd0Al z1@!0);33z<5XK!UBq_Wr?{Fv|$aZS3$<3FgJfTzq*kXJenW%=V^(Qjvh~M%(Q%ipj z`|0~0f4xdM#0SInC-`sLTn5p~(dd%skuy+666bjO-TZgVS<8=z{aZl_Ey~@Kako?+G>?ZEh0mAYf;Un|p5-Q-tjbB; zQc0X_5|mgNyjbYK4k>T*t0gF zM)n^QM9cpnG?9sO%_Ld;ktsr>-^7IQwim><#a#Fhr+F5){LY*Syt>%bS-J)dFCuys zX+{YH3?n1!`eWZPpni(#PZvU}I3YV#%ycojYu`1Vb`yMqxdGLl&gZpvZAb7X?Gsxn zYe+)~8kWeo4|~5PtBEQz*JI2W9htYnf1UFyp%0|Nct`z}!n;*`veqA5C`5$M<{U@6 zsnBG7VSL0FE#(M|Iwvhy)IE;+CAgx1EM_W7)Da^&C{^~AN(>ugG$%EbXD@k!Yr@7D z0R_MeVVA3$0yN{4VPy|DcxvhUz6bR?VE1@oxWhM}y3mk|h1a2$W}B{YU^_iRHy99V zhH3B~YGR7uPP`|<3ac>XoPnWb<+!ssqqNym-PhHWc_R!8cu9TqA%i{UTuR=!qyas! z+zsk+8{;Wtfb}*aLqm`Kd z?LwKuF;0oyY$YY`a>_d=%wCU@G{b7-9)8eIB?qIdPVE9ZbLzJr=3(lV#GIXB3J_mU z)Z7~GiEO~%?elUiM5zmgH=8g%JGSfp45YVu>JKnO=UP!u$rn%Q+vL4guNq$;EH}dn zD*>Df7wvasfOFw2K+Q_=DUw!gl&&SuCAE~G@mN*$=_44vc@99}9e}`*ii_U`Q9giP zK3;ARD5VX6>Hr3}P>Wu0-P{&e|5{v`bZ*17GjmSwI0YH=QaW2v@}#l=7tD{OP-IKjE!SZXEKgdh4-CDHrfo>+nrgg1n-VwJ^}$J z`%=P9hIt9RRUqo2Y&54gAaOHux;sZ(0S(FiA3LY!Iwi6RCqs8L81` zMSG|^xSSNJSeqLgD%_Z7pJMaX#hJZ!mcGk5gVhn831J(77G*YB&;!X# z_OpiSpi1_!1Mkk|I>eTp*$7}ZSg5iZTv^V}OzEX7v7Y?D*+)vLzFxePymmQv1Db5z z3Y1-i;@cF>mCxCmD7s5{U^5{m=L;hHeuqIx4f(=x<>AOe9@@c_CS7Tl*Ao zWUJ3b-sEUl;g!x%TBW2djHpm;k`ZxG`^K9==7o3K+ySu%irJHmo^&xww$=f^Ec?{M%Xtt zNU_ZDeYDb2b2%l73d+Hxh7OX&+BTwD=P-{Mu|i&~xMLM?dMTK_uCeB4u8vwlY+}q( zb8Wgki=mPB1o+v1l?i3hJz3X?^iktWTT#);`~5uA)8U zzcT$5_0yCfmO==&ku7j;Oj(oE9&Ov)trR+Iy;JG%(Z^`$livlJ5=yeRBdh@5+DEYd zlD;AAO2}$q6>_=Jz7`0TT*&O2Nwo;g!bVRC@DxHla~5L~i30iO#ITUGN2ra^Wr{eZ zKbgwxu$!EVxUwixZ0^Hv8eFHd?Yq4WeNT2VKQlI7qD?9d0v3TRVPjP=F8N9z1DC<( zEB*5Gxq_t-CTd(=^ep!~c8!+8lzdO7!3k`7oqLl6>@0Q&2@#MUhhRE?VxS1ymgqGC zy;E0C1vqjh8>l@>{_LI?%@*zaxYasLu1!=`EBnTbZC$|@ZWDl$r|^TW>EqpVUJX7g zHZk6{=}&Pn4sBL>k{Y4AssTR@Rbw!jm=H%7!%p=@e$8lltO{oE+jL%adYykk_l;q2 zgWOoh-w;87=c=URDZ+dDW&Uu)Zz5Xay&hhfx4pf;wVy13w(gLw+4ABH>NK4IX=7&R zInYiK1YT|m*Xnx)(ZOQUl~V)`keFX0hROH5%Qz;$8>A;#F&mYiNE1q1$#9X2^4{lN zAK5s4c+eV6c!9&w*Q*P#XRHCsOCViQa2w3f2v~8w9rv8V8`j{oz+>~(fHa?kGZmV_zmifWaL(V z*Y(YI=nq$fJ>$GfYxl0bt5t}L{IL{->2>e%`+nskP}d?ZbRm*B@)Zu~yv5V$?J{3* zN~!qqKCTVnYk0!alhHz5qIFTOj7eN$P}G|(T_k!E>I9lCD|rW2y(o2u2ObJ1zl|%M z%|tvH+46eMfpCGcoOHA1VKnoGp>?u+FJ*Tb9gN$+G0gl_;YyBztWrqx0iU{3YG7HB z;;YSEIK3PdcwJ4S9j!mxAE$Y;bCFSD>>nPpzxA&s#1QDsHtS{V#l6Sru=828gD7bJ zrSUHDNnWg@e=SsQPyYC*?7E=b+;>!C`YQz@4&J`~2=3E9qqri>22Y@T;om`7$J30( zyJ)Ce*saTJsLkV}A2F4VUnkP%3l4%}z0~CKC(oN$*A(8fBb#KfNIW1Tyv0)eKyJX5 z+K;A=z!IEfM*JQtcCKtXUStLH$*;5Xix(A0a8p z?M1jb(gK*)o!%hhirHBICynvglU+Dw$0NRbyUf$smE3K;j`8|v=Az0vP0*4227HX8 zJFEp8w`uh@5KVh>TB7xPAxot(aw8YL^hvs98U`nP8B& zOm{w^uE2_yZ|Oc&G2v!9F{ZIgaUbuIH8Q;;I~G(ar;wN|C}<(ihx304C{Xi{A)?T- z*Hj|nB-%^7W^{DE92A`GgMwU9@mvOC0KC+Y>!@csq6WP2;VPk?QYFzHA2&)V6$_G( zBtz{_V_nKdfM2utGGkU)s~5VikmUm1q=6#O))vjfwd+`UYzQwIBXFRr4;igop70&| zK%I|T@A!@Cj^;yaI4O2S<=9)iICE!v<6ejCSUe5^wwVk-=um%w`D5A@dT(!&KAq*NES2Q^AmqkU?6?+ zsW4riEViMA=8`=TkLlW|G4sV*iqVTub1dUS>LslQ%YE)z5YNw{4m(aV=F^tW_RM8KP0w%V}rs0q}MEy zKpBfC!E6?MNQpmG(S<(Cvf`jq({}RoXKo?2;E9>%)}u9+meGj)$+6d^KFH+=OCfoe zz7ZnCL43!Y>bvHMuoF#J>|=$BKBku8kYk`Mom7X|OC^zB{5oE_kC9FpstZz5)^N#^ zsHrbO`yNSsSv_-$+Pv0trjQp6MK4PDm5Y$Lp}SukMZQx%T3%9Gwo;{kYX?3e_~wsd zS4IbWPA4jB+-TwQ&V88Z{noNZbT)@9^BEP2Zp1%9R}M{`l#^UDV>Q7A`#BRUIBg52 z9S71pm#$?~S;=yl6&yEBx8r3hX}+jY_Mq={rrVO+KeKVHqA7@1oGm z^w|6yAH!%?Tbz?eewMg46AY&>lqyAhgs*>p%1Btx@Bd!0fFE6@C-H8WD<3#|=AKJ{ z+yjC4IXLjWg zI0^zMMJ3F9(rt)&ZX2E7lnbLFe0FO@Z{M6pO}8w*`O20ki|?V@S7WuIGBwW7FJgz+ zjj&)vR(EO08^)3!RtUJA$lzE=WuS_SNRPDcC)4F)l1(I&nKHkef=&?N3TGBi3_aR| z0vOW{+*UW)*$BR-21AbDhqCapqz`S20(Qlo;*X zoUbhb+Yr$J;5&sef8X73;ZOIj&Ch7}?a@V{pe@K}q|xwPjiFT{)JkSTnt_!q#S`|+ zUmHN{$~hIkQ(ec`wPRZO%=r5CTVvjA0Ukw#oUh8P(K-gQzQ2&dj1^&r4|nWZ{dffoXe7 z>=8qYZUc637nQoj?^p`7@&{^?Z4X8tGWc;o>%=4F6{VI3R?p_tu){o4j>$~?1dHfs zCFfA24^q^`P{fq3c<>)Q>;kLz5gAL8?n=ul$$a!M1F zmYkLhkY9L1>r`FGH~C}*2E&1;>Nq^>1lSbc;}w9vDioTH7Poxoz48R)Omi_FSk>JS zhE9?O1F3p%(%$DJ0538Q=dl zicG+O8sL~rC%@kWl~b4JY?+|DLf2hYJeAG-vTM3=Y;{{R+>3f!Bz)0QW;WR zTbNQqXx)ZgLqy3q=vc!+1gag*C}hi+Vm447 zq>1oGq(>)N+R;zI)df2(RY@3|K&|?PHj=Ef5`U8(tdeW=)`v20>C;D!V+dyTk($gu zDAblvuIx{~ivGYVIi~pPSwt0d&KcM*?n-Nr-A-erJcyXYgjC>^4~>wr#}qQ&)0PMr z{jj;IVh@6K>!;Bw3V^&+DYcyDsKmzAW;ygEq1y7K=%3?}DsA8CnIL6GpiI~yTGfEw zk0F9$EABOXxv6lB?+oyabA>pP5|+j?ZhW*^mo1uA+io5y!tm(9O3=2Fo7Xhd*^cAh z{;P@c2-x@RQWsdaG7)-%Z!5i194LW5-aPio@$!_B*_ry>G)L+A-T3)X zCle)@TK`~(N1l`FeLlbG4_N`B^j&{%Tpz21d&>Xe!h6?2SzlpWu z*#5)qpyK0G)GRb-%Y-YwARLIB7ce8@KW3h3Ti3=OMe=)Y&@1uE56|4;3&-tg5P1CM&6G6A)Dpc4gEZ{s0l8n{v4 zl{{bBX9P}VNt4|R%b=yB(stUTq%O)xjoF1F`l_VWE&9U5UTs=LCU%m=t6+1W@4htF zXR|>|3<+jJtjV*$i>EQg@ibl?sGLyIt-`8IXY$q!EISUYwWkmMBfmwdV#AWet2O-Y z;K~#vvBUh~GNhWRo-oqfnu@GOZMHczY3ke+3)FlX$e)B4L*QIKA5;KhY;>>1n?$jqL~P`1XjO}rEaN79PS1J%N*ab;?IKQnxHKb) zuZrSO{*B+6dAzzn4p}wozN)mW_9!vb_pZY0MBY8@A)XHIU)-W^746?7%kiZT0=&jfos2%w z625T87EY?o%8uZC?dN#oTtCkMPQ+Vueq92Y#_x+gc(l8?c@Lo-Hq`nnZ^bmGLx2l3hHNiNI2RPoXb5bz+ zW9~3Bw&x-Qi!J$e49a!+uZ*+jTYCfV-{|IxM(<)K-S!K8QlIcg=YP7q6zzzvLFlVD z_bTO^I@tKDA^lTb1A9H8)sX}#A5Bfec;jb0FgfxC`uPhD#lIP~9&;T|BV<+dH_BVD z8H?`POoxvH-ehjg`$IWFOQ`olTl7R^MYq|9))ur>`f&;eejQDNG!xX1Wl@{Rlp&Bm zXvU{mCXNZ8SL%k;Idpx?K8?&taWM-ulJAQNWkdyR0Bw$W-`EUWBnBD@gGy?!0%) z<-B%;s5*b7mY6f(0NLQkwjIYt{?fZm$1Z*H7N@Kbu~tpkM~luYMRdfARVmd|^cJM$ zYXUc()EW(|0mPTvpW5Isy=i~8<`iD=n!mP~qkiQI9mGJx0PA-0ENPRhl<@sb4T#FHL) zbIxN?Ebi>e5vP^(4UFo#A&kcunlTq>fq?ilwRj;$n)1YbjyG(mTHo}VK1LijU=RHA2D>J9CWOuf8V&-!*q-767U0+Uw-ki`MLu|BxNt;eaSFP~Q)?;jDD?Fv`K-65K_~a^{yIdnCn?WpcAsjWb zq7}-P3gM)5VY=doQo8Bwhm4JfSL0*+S7kfTkqY_5@y1o$xN&iC6h;z0 zGN+u*E7SBq@0$$t9)tOR*&o5T@au!J1$*WJF(i|!tX$~pO< zt%OL*?t`y+F+k9aXE;t#O1S{T7PAVEQTnWG>_#l@Nd0P1)mRZePzrSrK085?_h3Cbg_NDxx^PL`(6Vo0c0hlG>;N;b0AowUDkFG>>FIMuTDKL|H-52{2bE2 zwH*7i*%ZaMA|Q>$uq!QF%^yLtb(wqIAz7plA4Mk3OqcY{rpeXite;|~G~w=)k1T}pz(O~(P@C`^d( zV<&WpmhsxFYU;mc$yHbz`hb~=5{SN3@WE*Osy;qCGN$tWI^Yc}Ya9<=<_?aR;z|*pv4LcOP)fuenxrOL!0QBT3 z9U1yl@V*!_#foj`J3HBiKNnz8iVhfam5QhX+ZC3-jVgp=Kz)pyq5&XI9B3zdrkuS{FexVrqjcD80-ddB5W2xZ2oR~Q1!30 z+$obt91ZVS1fJt(&@MpAu-ERNCw&$e&i>3mz*{oo)GsITd zM8vk<%?GvK!}p(vJT9S`yWncujfC6dAiTdnU~^`HdV9eGTg>7fw!Xn*I+g!~^iZVw zfQxnp?uWcYJ9BvA@XI-c+GT@R3wbPr=7y!$K>`sE*OTeUU2e+BN`;V5m2^|soGvkN z)ld8JY7q3MYIT^ZR9vPjwC>#N%G(m0BisfhyZ5e(9{8~`&ke7~GS1shUgA4Yf51e~YUo>3kmO z0rW3+757WTQJPD13~o#LnFar>pYpzmXm7P&+Wx?n-uG@^w-qkAK*wW61193pk)Dl% z?Z@A&G6ml+rBV4#jF2yH_3HjXkjwGBB%`^LkrD`1K{8(`fD#_Kh!QkX63 zm8Mv#Pr6hR(*~vAr+?MAI7gvjtZ*g(6>;Ha6Q^3DMMQFvs^Z|(>whU72df6=Jw+jL zj9=L&=KQ%5@B#cM2525CvX;i@g2qFjCE_TkVnMV;OnHr2PWq4_be`CvvS2*7a$7Io zcLcSVN<40b@rpv6^qpQCs_ML|>Od9wFmMMgwyuebir>W`ux+PB7`%5*W8JLl)x+RE zyfxGL5SPO4Va%si1mR>1!2zOHX+n%&fKl=xP^w_p&IH@ zT{}P>*yv))2f78ZTgJA%dr193^p=R&aiq$mWQEOY6lEIenN7$XU7c|qXuE*zsRxnW zgdM|eji8(GquGWOov@Lih6}cT=&7YWp3V#UwKZJq5>@3o5f+rN{xLf0&nr2T4}l`$F0X|}p{AKY z2UT!vIVLqGolhpE{qD!hSUtfd&GOGSA>+r1h}ng@{k2%LkhDNV6t*BY53=6VqWK(y z1TnS@xio;@p}Ndg=%gdHE%+gcR?S8t+d`bN2tT1WE}U~``UAbHlYFSxeRil4;nHub zD4kZtM&+`n{}YKQn&^{e)q?4^IZgWlsL+Ws<`cta+pSB7zZHBMJUtdQM2UEMFuJ@A z;p}Tw0`UQLca;b)_c^(kE?eIF-{tr(kLw1t;qaH2ABcOLSfkWo`mOQXSVk3u>3ag& zmPI-BS$*po^DQzoJe(bMf01;Xw-gwI0&Cw8H;*GUM8BB9i9%7zief7)E|*gu{`n!g zBvL{ZltvP=p+UnDg$jcq)drgSzZVl@6K{;+i6ZGv)ud=fu3g;1-EfFi#m$9IRH1c? zjp3=;0XeCU!QsLw@S8Ipv1H%oJBYNhN|Cd~MGL$c|XIjt~@I*K!qCC2Q>uoGEd~5hk4%y%M=?XHST~Z}2u#hlb zBBKN}bhzxI8-#5~!{UEI=_1#KGF-nPq+Pql9Bh16s`{Pz*xeAj=dEHasQLHX$dGQl zFCw=bT>}`l=$D4B`d~lQ=@_HAx&k_T`=Pt=;RM@&LU453QJq>gGJQfKyIk{lzz7Cr zIB*ms$W3K5iJCs(Rt464qM`8LJt_p^l;LD_nc!2xZ*)_PP?)5l>6NhpZ%z;5%7*w} z9+?b1M<1L74{Q|m@0<#F0n$HGczfy+i5opT446926LX*rp5?8W{SSowAp$D*5nj`s zY0t~>Z^-^nvG;~B!{1}=(c!MY8IchtBtiHPn2GlVorXA;2-}@hO*RB&=#iev2^BOU z*wfP)Ga{DxqeWE5H+_hK@L90>2yEdD#~8>hz8mKxEI2&j0(>;2ulh?8HL0o~raIb+ zw!>(mym-Crm$hRS!!=Y^d(Q@uA^h!5fnqP<+XTT7812(JAn7MK4u^}a3k2c#y5aeM03@jCFz=! z;96UD`5Tfuvbk_lt5N<}TqgcH;>euXk`A%kd$Wa#SrdCLkhA&8Hx;!`xr3HT}IBz3@(_Hq%eP!EK4OH&5wyv44abpS!>MMeSo52(Qt6OaB!jY zuW@*rA}$6`jEm+Ko+Xp$(OvjuDvs~#-9~ppI%orWtB|Zy$Pwr+b_jBZf-9pr^tS$} zh4m{2veXq)!=?Id$pJHMXLpQ!UF+6LHX2X$EBxpeNBn{8r*ck|_km*{H1YTQ z8;565>MtHV)RSf-RX{dw5-+@X=#8w*T$JE?4SDp5a8h-KqBtl^{^_GMl;=LH`?bH} za0P(GN`*4LwJ$ge(NL^W{V4C5fooyR5lrR~iI#Z%p%BVBUlR+sE?Cmw$}8J?58}!i zXe8NZTs38E3yg4kvNGF#czc=;muJw=;z+Is$X&KlMrgQ%KT$2`;Zlrz-aNS-U=`rH zWdhc3ShLx7@(nm}z|B33y#i*CAeTa`O!`!Ks2Ar}W%56<(~e?D-so4|2|6#@KAP*$ zM3@+pMXJqHf-CVLeR;vX@@t^$I^)q2ib<$wgKQn>UCtQf*wH4^OKj$3(wvlR3@k|t zEYn31_YDr1dJyb?X*{?9i&hFq1Rb?0X+UE9Uaj4Ma`4`P3b_${1iSvZa8}k;rmc2^ zF5<3x7Lr%@6t%VpIr|Les@7WmuDk&o|F_yfYm(mX+^#mu=5Zi=VYPhwQf#Q{RS|lw zwEoXVy{@(4o$$PE#kYkfx5l;yw)vo2!C-4373tLVYts&M1*B$UE=#EcQuP(M=t-F4 zBplilFPPAXJQm4fk`FUN$ML0rWHScK!Hw=`45b_uD@e zj;Ag@XKLb|tvPE}g*$EIX`I-Lael#SZ}PrFNK66rAA8jbhBemwp%(MhGfvU|++7zq zz|(WT+;DOsj|A_05idrV{6t8hNOgcB&gnwtFSy5yFkn{>d{`S^tve?V7MDt)uP~5B z`4xK;@A!ShcrS)mRy!V%0{inBxb>xr1>;$p@O+|8ILNcw>QT2??=>V!fa1#8|B5T=LQ(<6l^Ax5Esbh}(?-<` zr4VAM;AXj0S;dWNugk?vkpf5RTgMEODV#!D<$8+uvT!-Bt0O3h@=vRhE|Jzk5Ie$K z79A}o+?F{9vQw2H#xRpLz{E>#rh&r=H%u;Xim=Vcj-i{kr*U-S)ba_1R!B517V0Tl zN#LsMm!V9%!03q@|G(Km;;!J$WSAm2BV?g)I!+2PT9``_oYB)T3)_MtTq5bGkP;V2 zLBdp`aL{uiOtS)a&Ow;Aw-FKEB7IihXxqmUE5tF3qB&SE#;feMAj{9Qw9QwGdHj}_ zEesW0hK3vphv-mYfAIcJRd$C<6uc_-m4&9n1ksGBHO3vI%j~6ZGn)7h^V(m^`bD2Wm6zuf zU_-Ipy?*5ZKI-IlTa4Nmk`7v6)YVaOu&|8+W2Ycjy!qTtJ-uE7LjM;+H z=W3TkG8EdSCx)W-=tyqeJ$Nh`2x#A%;n-*UFO*_MPzUt6|6LW63PYFSgs%#{p}RV- zko1)DQBNz-;TMRI6EYv=`7pKCosT3LwGVYOAr7Na%C{A&|+)lHW z{Kc&UR?bh*>rGLxru+W@8bRg0F+G?9z{XaHO*6ff;(~K|?{B@Ga5J&II(jbESxpAn zmy6Xx3Vl4EA3K;`mSj50=#mCG+7+ToM~-y?wih?mNY}To^+8qHq}o)kY7CIlyJ$E+ zsMUsio!m$V=U=NjjAO`8OxVZtYD0-m5cg@YGn6h*ea0dhk;1Q_G|3N0KIe1d(=t!8 zc~;Hm%q{LV>@0ja*crOiptz%WwG+jCH0%t2ddz)BDTYP7=>+AOd?9j+9?xDCg5k0e zK6E01IMp%nrHwr)SB@gv7t2NSXtM2{RbkZ_yiwIprp{3607$%-%3RV*SWZkl@0VN1 zD4um1c}`3~v8P2HbClu)>70g8LwBxdUIkemlPC?vWgO-Op+&|?Ok-B%0ZXfa;qIZ0 zPzzrUp@uFsD4i&@?L_GuJtq}^`jZNqQ1auDHB+u!9gR_AmOJ`ZO^-%%J?U#5SshGd z#+7mq{xXdB+jV`~q-g3IB-`$8N11wym4v~FXM$p-Mt5V|)^sH$S{EcY^>VM`&+pf& zm#TXDcG_t-{9VZMBVTR~rc_I3z8&B}%)#WmQfc?EBs31rxmM$qwVxz^ad;fN$XSlc z{(dk>Q92J+D~MWa5qP@W&z_!fhz0u4Z-eWT@zA?)8uSj`Im`+_r$s{M3DipFxw!4a zJR)(N&$BGd{e%zP_BQk`d^zYHy40XPL1Aqt>XXqBJpAchfj*S#^L{M>X)+paW9npA zpJyp^898sK1(+Gd4U86bfqc;Izv@_pw2XCWl#(Oiyi?F0TNxkU2=85uRfjzdfJUnh z1C`N!Gkx|Pm%@~nAwBAeCt0laE6|k{fCN;mQ7W`;UGAC5g0+b;xcqwvz>Ad)VSkN? z?fFANQIZqnb{fzQ-I@EoACyH&(t^%OvJMC zk!q)Eb^E}Ye4sDYA)(_DaN#rr9J;f(N(-Nr2`Ph0nClVL6sJi}cu14n=i+kB+#QEP z8vz%-90CqqYEVKaBH&Q^;hXjBzGEmwud(34U}+hD)}}N-y%3p10Zg5_Et`x1Sj?=Z zGhY2Rf-oioB2sp*j$RMK6UPLgC&De!@rbH$8lno_ndM=UBq=ApL{!b=gyd1-6P`yg zjp95DQ+MrEXd|k^mqS#cOAX4)L_`%zKP)fK4qd1vicx)SCpjt0QYd{uPuLZU*Nh3X zOwB?3UEKr6pX;4tpFf4kDBIwPTTD$sUUHR}NJ`xCQ<$Nv8a8T1u*$?&Pd=*! z)9YPHyBV%6Yf@w@t|oj8Er4|?N!P&;YXgeO?%9wll;Q;0od&r=cP^rohIvTIJe$MR zt5n=|QJNFsT*hfu1j5A}NDZSREn3&Kz+B3kXf07!wX_dqs~D)MQjjTykH(@>E{vDPR&KOvQ^3b(Ws+ToE7kbM zG~HRzpVA4mAt!65=C3Quv)<9AevUTY-QK*my$a*n_3z-hx;T%1HnG=JEB_eKUAOFP z9qhv%+K5n(>7<1cogmlKU|{IZMUne73`>~SLrKH~MrfA#BuwW?m9jZ22HMnxHViC$ zIT#qa)Sz6WFtC&5dNdFWe|~u@fBM~Oo_Y5Z+`8s-eZ0!_t!p(UP5h@Ybir*iO(ofa z9}^iw#9er>-ioqQZd32Kj9Z&(v0ON9k?QwHE3YQo(J=u?vMrm$vDUGtyb+`SYN#DM-yD2VUFL!5wlR1)l;{NAHVrR_?hMFQ8qkPTCH0}_ zS4HxYFZD}q6sMWF- zVD2Wo89}5QtH6kA_VHdAI`BW&>vCH!%Ga0rldB*aHSKYgF4mhX`4(=2V3-yYYg*~b zqIBaFA)<*sHR?;C6vJ{EO@o`EJIfK*aT1d}=P`-mtROT@OX%4ho2a*2E^WA3^m1@B zbg4nPMB!#9%O$qLuw0(q91Nv^d=wS;(+!A2o7fT82HDj_wTbT8#-^PKWfJ#g?p=NL zA##g$CX*Kw_!GJo0kNEQ4d1v0EJoce? zBGYY9m0p80-$f=g_H+doJiHYvm@lM#uZMmd=d-)+Eoop+y?v#ohsg|EzaB=dp`Wa) zzU@4fOYax{REsy@$8$aSL%ibIvo8YgpiuC6{rs3F!M+0?f=5YCP$ko#Z0ODqd5?-9 zCux#%5`{E@F54M_(7OpYx>bn{Ws6=8%7!jAs7g>M+sUc~Tfq&A#~&WmBPfOPPh?y` zH&*CZE?3%WmfR~5T}T`P-J-V~z(8~aVfm!`ycFHYFt93=sC6K32re#X3WBERW?d;{ z88ia!F8_85y5)TcPVYA@)E%4OBjK*ym2b&4BAsU=*-(lTgmW5_4c$2`!URxjB&Dn% z5sxxL3%K!FndVi%vov*&7maKrTl8{BHgu^$;Y25l^0n~7j(OU*4yxh1-GN_2WD=vW zvSMo;0kkijrthCxld0rQbQ}}?&V51!3x}&%?a_JEGkd4!kZ_1&Dw3I1Uv2j{kX|)g z0(MI_idyfaeIgJ2D12YLFdO`3Ow6#;J1)WT2(M@w!VBFw3V0k;QAz^8%t;hv48rmS zDdWKBQAC5Bx?3_uHo_}9%QhT^P-@FDm!qjEMpUvtHGR6Hc@qYl*= zY$*kZL^;l)`W311Gwt%$KrK}dDHs12HOx}tKQC(CCRDvf{&%U$`3OBcg>9=p(rTN+{6@f;J73h3;I?GE8BvKpZkgqLgux zl_@2Z7Ga$FQIu16-+{=6WJNCr$wHSJ6f|^-q*KsF1F`UDJ_(SGlB-?->c#!XzTVNs z?gOBZSs;CO5*QM|8tWuuLPkIg_|Tak8#u|~UXZ|^dAzHNUdVA1Dq;&L65T75z%Ls8 zb2yq1%QdipAUQIQX(7!{RP4^4>WEUDAam0|R_M;zJPylDICoiIg3J{m$qOC`H;)Es zmC~H&?l$s~4YG<}4rGNc^&Yh5aS6C_o!}rPf{5Pe$&M(cU6}ZXV6Pz=L@{E@$q~L5 zU?_I72KVrxyjx+D2|>G2Q%sf+wz;^yX-Yp`3p?(^zj-jU46If}*wEKoq1L+;8mi`; zmsrZ<*{RPutX&#`;jPU-JnzJfi0T+z6H0V~s7}K*p*sgbkkE{WB%afVM3jXjE6Rj$ z?#J^u4(GA&#%#tmt|@*wTobyKTU7BAoFu9!xjWy9lJ)#yq>ut7ZcSIg)e9LDRY^`W z&{GyM92-me_gZi>G`drFk#gjYi!A<{j|rkiM6{-Kcd*`>WNoha&epNiO=^Z3+C66d zxjb)UVVzp|({WKfu{A#WXf6>&iH1cqo(6G3cMhYpWN|VlFl>rMepL}D6(oLKmO(Wy zW1hO3N5?kADSkPK6S~xZh@vMrO++#B0TCVUrGTCG;>3VV;g4_zZ}j8U1~s{(G#2|&*LCQC|R#J9=wB3 zwcypKfk-sEoW6TL;#xy4rho!m-6l1v~*Mnj7yd(ihma2Ane z^lMc8wGPGZ0{Yrn%fmgcjB9`+(rufC?Nt|dqle+Dh7+1AT}E=H)>!MT@WEj5i>}P# zb*tYr1mn{C_j<2DRgblfy|+_+sG0^O%l|vG2GU)+`hQtJz`d{jVJ0gn-(LSuyYrr^ znmAlTjZ!zw1dXL}?2E~ULtNHj!XxjzaPF1#NvwM>%#kJCLVbjl3hy7uhKZiCi$ax}L4(Yn>f0bk6(E~i__f7aF|#;? zof(mVjwO|dQ9WO`w_siAq4WnIf1!1QVJeGp3SQN^8qO5zwabYmEY>h1$Y{Tl}mxI-zOAXvb=m}1{i$-^cLn#N%OZ3F; z?A?1X*S1G97QESAX;osfZ_o<;Y0Z=;_T1h=E*tC=mWb*QjD+>LEk14U)tymiqCNMf z3hqKqG<_Cv z_RyVU-_MIG<0Px%j6`t+ony+JFwXoWVdXpx+?``$8?hI^9AXb$YCwchfY&L!eCt?X zz@Ws)Y=hEmLpnyJYT>aBH)$}bA@-+qD*ji#Ex7m@fKeae1!~{0KI&EdU-bfdG@4$D zh}5HBsBdCw15()tTTUc+y;SsLK|!3gff^TVRgrdx3I?Nn)C(&bXHFQ64A ze$j-5b*sjHe`w{`DkEHL9OK)3A)_&OA-is*E{dF$_X46HrDpClw3)d68v24Bhiz zVjIgCzZ{kkU1~rD;h4m3Dj%YJM#C9V$|IPnebKP(VuPiQ-nw2Q-mbkhA-a)A(uio` zOfVU#vG&$;ixK65p1|OydP|wTp`KL+#_S0YXS8ykY1vn~S6R2K8OF$~{CB>Py#U&u z)v}F{hBI}$51C+xX3cSBe)ua0tWmrl2>Rw6cFB0KWjqaRiSC>*Uc^xplGqPo66HZa z@+g9au|<&tSsbR+odk|;ux0#mU`uqV0i}SWB?pxPMmk`T45KU&;m40EgIT>|I_cH7 zUi^T;aNbwYr3Ch9RRxc(EBp2>?P^_BPSn5hRg43|N0;6w)l|!Be5ZG@tewV#Cli!i z!q?90nmkhPHK>$Sf2^|=1!&i~k!H=#WQQ-k8{I&2X*V9Rp6=q8;1|#fzXZZ1qIw)v zduFJ`J?!Qu2Vk`w!^FEf_Jra*kGtKbd2@9o-pF=+xiWg^QdnMB6h6q6R((YGy}lC0 zTW7odpF3JKf0L!l%YSaSAchr4yBDUW&L7Q+lANHXrXe@cor?&DJZ3&g<2WS|^(&Ii zh1LqgfO0?2%P1O%#@oov_~nqB=u!h}3L`r~O<|-1YHBQI6MtE%<`?Rcp-EpC`#fx) zhk(A&h1H-ZiGprJebOADl6g){Pra9+&{u%`21(Vi5OK}lJ3}5O@Y*#SkRZ)tj4{)V zcG^Qqr^iBXYd@w_Gc&C?SDdb!uH``&&;)y{owx^jr+W(Z07sr(bxDK=o5|l=XJ7{| zt@zbV*CNi^spo4wd9upP%)3?Z48G~}&CfU>^1^2WuRxl!Kd5f2bj&KQ(Y3W_dN{*S z=1>~xFt;V6m#SeNa7ue09@$KR>+LTt9!*X~fFR#?A)$^i4e|Ud22tN*K))!_2?~4~ z=oj6&$_qd8X-4vl3Oh3tZfG8+;*Tj$eMZxgrtU(z*arQ^F9-TXml{yuIEHpmf#ak@ z&gWRfFaD5~cQ0pykbAJHKCZos`}>ctRYuNI;jZK55( zXCB>KZhD|u!D^uZ-rm1Pyu0U~=<_I+to7NcUbR+etnCroW$^6Vt?Rz76S=4@3o{J$ zE%f$YC}-0>PdLBQj~CW6WVsfVP()i!%O}qybPXUD2J;!9xEMB!%Cw&bDAds^jC`w97Xv!D~^B@e8qzHo89p+AK ztaS2nSZQ=Aw>+a{!}9DP9k4V|${|YwCHzIfOtc$@CY-N@RNab8Twg~sWQ>Bv`AC}@ z^dL978)L(l6;XprN?iV*c`K)gx`I)gwFe*exHO^iXX(7tW;Qy?;mtpGD2o>%J75-J6Rxu|?!Q?Jul&23CqHai}Sh^3=>ZS)Ay5e{z*>IHQYSUd?#pjfJYw7uZAdB!*1JLsUZ zVBjGvWl@Fh_#;~a%)EQHg`f$e8);jMN7|_lRx{ZU@BUHT;u{Jh;h{c4s|cO+66)no z3eAM5oN;j}R0UE5^{fD@kGA~%!Q9;54#?MqfC0QQ8bk&g2G^^sWa90{9HikQSISe+;Lb_?v_KxBO#xACK%{H|P&^v<#TpEi2_FtebxoPiAYT;As}w@zFY zn*QiV?>Biy{q5&2wwxs+BX^FMV5=2$CZqY6|NhT@l>SS5xx*i`e`%B0w>>m~i56lh z@AqqyHIrNPLb&$eoP$Uv43(6wp&2crhDVbYXy?dhulVX}p>$aVZRlhSaoJq`Q0^5u z$aE_=$)4}}lB<*c%Hq3VY7-SmM>J z!~3d=$UhWtEvQLod+5UrD{~LfzpzwG*i9YNCsf6=H=n-BY1D>J*5Wr_xtHA7Zlc!~ z>gc=aWnpGoKU>&5x^NBma!#6X#Dp^FaGFnCl`?V{7>{ecKp$Gv}sM|0~ zeFD`1(&UoKVLhKjwR75U*Sd1^P#GC$vF^Usco#xOU#p%Ras-c{dD57fN51NGmK=Al z7OpBO*zM0>Y5WFI_3CF^#0~bgHs)=?e~Wh|c5PL?-QP#?u>$_VZ$H&P`1bx0hIk!a zTc+&0OXG+5ekN*#DVDRl#iA4^Xq9OIW_0H`t`a|}IH>|ZCQ&sn3C-g~C>frXWu6qQ za3cc~8^D~r9Do^J>RhdYt}~=n(6+6(R&mVaZgq)KExodREWL}a*!qva>wUlh=o%qP zv?Px;^H!Wa()FTQN$cQo4{6^Y>rUxBb2<^-gB|465#{sBHjbJV{5wFOn>kO$swAU=I{+uJ$TlLqU9jcV!?eF)8<6i&x^ZIv0DdOnww(^6P!oTvG z{lf!qc5N2<3)Qofj(!kC^PSZS_xP7KQn!GR-a?LBGX9nF8=IzP3%WDvNcM1O=dzk_ zZMsr)vt^;D#D1l!KJCt%@7Jv+Q$=12A^*w()Iq)nIj&%*NW0M$);v~w`YcR-J(&6m zfBr5$(d?9#<@y8j9g{dg)w4t>8a1Eh*gKFzDT}|0f7QchWr7dhwph$E_@D`m)k8|P zZxWk8;PRWAA!{wHUV&_@#=lE!v3#+T>fkLRHNN17zhWz5UKCNKe6PG6eZYD;q5O(# z%JB%~WEuh)-8uFPMk^S3ohIUcvWk+t$bFJ0QB2bW=2Okxn$kufCohLUMwdEQQ=;n( zY09x3h*3ftig1b_imf9ohDBX!V~bf6Kd#H~i$;h}%iJ0TrvvbaB6NQi<Ric3*BO%h zu|1FRmoS`B#7HFsKsIIT=g-9Xw-0gx$A<18f}>uFZhtiZ1VCFXw;^rW7|Z~F^kn8Y zRv&Us&Oh(J-pj9lP|W}FUIpqdy0PKC zx~WrMNaxO8splqLPWDQx$@K$io`j{nB6cR`wS-@IpCtTZr)<-Y`&}a)__f8FM(uVy z+APGYP{6OFhS;ixLbA59O|156u_h8_^6HSetyRt6bUp$U>X5~X%8@jJ*S0lfkC;9m z(-0daIzgpR19_u6&!aR5N*WNMzlBPNM!R_sR78#jE@;U^>Tai$+92=r8>=B1_wIGBPk6HrAj@C1N~|~qu;g(Sj;{S>c*QP>phvpw zH`1N_QA;;g_9BrnD5Y}xBVM`|iwX|9+SF@>lGrKe*mu5`DoNO9T)3>qgk1IDemc6F z3}@{(4_hj`D)d8!ZCFgtHr08_&GW?PCHfK;jqbW=oMhShQWwRV5@ZU))YnT`4&IZ- zv&h>`XAe|oO)8fLgY<##^ox;WmSJ=&yaCvv`=New)e_n*NyVj5?}%PPKQd}(q7=hQ zDV+v(M|Wm(;YEgdL3j*qW|C*5$c2X;7G>^dQOMKK-K9UZ!S3nHf!)!i&Q(fd!R{#G zke!LYgp=T=D0$lz{JZekl*=V74Dl4(r`JQHrO-ux?V>smq6ZzZT8RdH37L|??4yuW1sC1OP zgNt`&fz=qq?R(;fTK6YSnUJ;_ye^x=YKK(#2f`aw-|~~h0th$i^M|gk#duXWzrB|Z z%1i+T8UPB+0DB5wAK+NBX|wFixO>#iy|quftG{vKrF`MrErrOC4LR37k1}o+D+xzX z@Gs?j=+fL3-#ymlRb!8)?&i2#uWa|Yt@jU)c7_pH>gN5`&8^-Hk$#k^T+%-t-kwf_ zx1&4LD9%}!hJ>fQ6w>b}Bnyj>Br(nXl(T|I?()>shPS6L2X9B0I#>F~!rM{8LFsqG z+lQqeBmbfyMZIVgpn%#|iy)*=Uap$a%jkuaB>;GDd2_60`km{zvTQ^_o=oq3Js_x$ z?2!gShY@-nMv_;sZMTaB_p(jCIhwke#puozAzOO}qN?z*nH@WH3{|jdn5>FC$Abyh1iTDRq#e2{xU&BC!I;`ajk_!cMKwa*^ z)abu**@BJkboY8STobgZeo9&PCJ)xwF~jb?$gHF=#z^r*WKc&~DD0c%>|xqy3}hT7 zIzbyvgN&m)^Mc0_D^pTd0Vh#b6oj%cCK(ji7e(&JA$Myd8#1209Aq3_>RfF!ybhv` zMnlH&w=f(>!Mj^aw|vz-yff2v=7)H{mR*q>J&1!gk3|hux~v5T4XDWU(Y-(G?YE+? zzv-@Q!qV6@-uo}Iud`B>6p)NCAy*pw|BJnMU2Ys#)&*aMadynEstCiy`(>@zbE4XI zU81YIE6RP@vnJ*TNPxCZ$)ZM=s`iR`_(3KB5|WjmMCsSWoPA<-*;WE1m6=Rre)*+= z|BRk!*3f;!1=S*>yaJ|pZIXSBd5FDhBe4*8|QYjUYm?RGybqpFMSn1_YL-~u|A6<86Y!PFDH@dS6&~qDEdyPJs=ncm8_MK;fEpuR{+C-1)ZoT&^r`<_Qvvou&cPgw(t2ewgA#!hp3&tF+I` zk*&8F;+WHhX=1~HORH90yAEn>vO;G}Ouz$GoOx%SHcs}@426pqR0!PC{RMY070#6o zT0XZ<5FJ|EK_*3a@TfDRx>pHh#$K(jg7*?S77YSbV*v2W`|3nlSHazC)d3#q2G9`8 zZnmHYhSN6T3sR;-yo>W7-sH|@R1_g^Yu2RD#xK)^@uPI1 zAl~Fsr#i3kbqME0Q%H|FFE7%&$1wUm7zr>p2}o_lW}KFp`p|;_b&!vr(J7CH>k|Ux zG)>cq4jxwBW-~wh3_j3TaoA4*qXrRQ=*=Jm8Zgw5v(=%7iZpDlC*Q&)d4IPT$~1 z5Dhs0F3A(j6bfNd=m^(v9)OqJIV#I2DZ-q!MUyfW3J6xoEP`QLDiBC95b(PO7rOVd5~OkXCVM}+X`0HamiBAl&s3KjOB3{ z*R4#me1sRUa3Q(Hx(SJt9_)Ab@tGS5Uc<_7 zG#?h$^!hpKJ5^1>Xg$~Lq%#hcL@gKi&PA!)0}I*!h|0w5uRd<;;6K%i_n*Q2vil}q z4Kt;>Wv9;OGr1<NPXGvMgO!%t@rHjHWFNeY;mm0I;X@a*N!O=G| zecR@ZeAs+xG5yxkgGStU+t4(^SI%2XPgUHpzQd+V?RfZoyVKuYt04BrOd#-J09UK9 zc!Au$>L%abeRV!%$CJwir0@FAnFF{wBX8_+t5u8r;Of(>?cCg%QU2sn0BFjTtq|@;n?OxwDAlLWn43ajl}|w233&fvQ-=^E7YMq^x-1 zH%k|XSY8f?NG>&MmXic;J%WBld-|S-H!Ft8?~VEqHcDT1AB94P>03KI26`~$Y5_Co zx0|}#!m)70+jiFUhiB{!`JaS^(s#Sl-lEZdmX>IjqsdN`HD(2`c4e{3nBh&o6R2MG z5rKV}y6zCX{`LOD8?er|KwGlv{(i;-IZRj$)Sv8o(sui6$njePRR$RGA74LT>8=kw z4@3_a={8-1U?j6-Pdl*HoygE>v&L4OSu@+%qKRQqSOv9GZ}s16rK!l03wcSGjl93* zFW@k@PiAZp4Acw^X4-M+fZ_uUGz zlfQ4(A!4o>vv%D1(a{E}6<)VC9XDB?hnpmKZkx0!;zqEf5h~h<>XubSn6O-CGOyEG zibVL`nv0t(FNd2Xml}0zlLT))g5%MK2PsK7F-qc2zmyGEHu7h~IT+sBLKmjApFt%D z&TYbJ(f49(0_>spf4f^53#y;@dgowcJ2VmqmgMS~ocw;{+?uzNZC7&!BOb4VcXj}f zB?s<_-IQsfO+4?O`TG$ZI~RBEh5Uzg7Wf;yBnFpsNtZ!=Cp74R*5z@BaURr?+&Ryh zf;Y8fX;#-Pm3hdxC@a>+vMh?COyhLKVYpDs@^Vm1a;Z^=F-h>&BRCQVQDV2U1^roh zCV^10hmQ*rA|ia_gIh4XMhhoCB8m&-{TwE|)8DMU*Wk|hwE#(RpOo#psXGJ|uAO_( zVaE?y2Mhjv_F(GwYg2&iW2Uv~5NU01h-L97OmhnIkk*@V<2(;}NbX!Dd69FOvOKSV zxTu5-AQz0MaU3TyO3KJj$5Fb-!}4;-LvpE6k%9=PCqs6(T5Zo=!j%Qn*25R zN>~8h`YM8$60QkI8VM!Ez3}xL(n2XP%_w>lvJkG%ec{`heXi zi113(S4{SA($+HWlFkE3k~?Q{5|t6J)Y+m))&FG5B_(ak3NDK#7fF#Oewp;>r2x!hC=wPkta9gWo-KNMVH7ydmpkEd~Mmo_%N0T5YYO!ng&+6hu(ekSVsLI z)IIesPGb?^=9l{BXT!~#Jk0*%($hzETgDn_mbPmbE>UygOdI`ssXieQesr*IQa>-b zI)>>B1M&XK`q`q`uCo6)G=-$Y0=E`y5&^<|1aTjLa$1gE?O5i4I!w-sUR>+z zFL!T@wdubMRTA_B20p&)Z>|r_p2F+0!j7aa`tW}JPhaf2ea)Yw`Dz@%hdy$?*btjf zEYA>(SmX;AIgXUD*dO-v)ts_d`y<*hGjX?pybz5oncwLz5kTial9iGIk0o z;h3mva5|=j?9cueXv^Eb-+Y0S(;v5AuJ`7#V(+W9XGs1khl2L2f(IBlf<5!xp4rp_ zOh+i{$f6EgKzLEB>xbE|+?gI{*$ltRr*0#M%h6;$h3n;bF<8JkigM?+W&~)(HnUVb?p~u4Ivl zk}%2dLj$IDLs$b(5sdoJ z$&iBRxzw2U#?zpf4|QoVTQ|KIHGGD5f6vzFtkspQ-Gn@Wmv^pKANSxqrZ$q_)gQM# z5iTsk=fK<1KSlh}ruof`rT^8TZ!tliKtg`X2TVcJl0rxLfb-C_IBk6(VP4Q|CO6c@tIsR7>TeX{*bjY00JhK7bU%4C&3ttoYk$``&rPjwo7_vIgwJ z7n>Qd9B*|V0e^hr^B-^y>Zdbf;s7l6uuCBK7^s;0k~73l{TaYS6>B2IamkaBD_Tja zpgiaj~h7x#2>CZDRVivAS`Iuhn^}E}< zfCWFzHlJ0LAy;p7O>XZ~_i_`wzP-CwpEMNj_i*eOKJi9ph|~!L7|{09F3w8oSY&ca zd$}DqPh}g4pp#$!_5S{D;50H{zK*7TTgclL#CyY|uz;O`?BDC+plmds!6E4_U#mC9 z?!VZuE>mj325*<-8S8mX2)9Nl2botUC64fF=V5rsox@fnaTOM?Px($rumw zh8IzqCYis)Ubz_F>T(!fa;XuoMgk>|^=cFLz4P7qQQSkMxZxi9T?IH`?Q_0eG>?Ph z`5+fDmW__^Wz-gXYjeA7Kj=?;ExCB)SkvhzE0|=3GQ`=FJ{p+7A>a=%d}9;*=YK?L z@z1*30IEpOIMjrG@Q3oBfsQvETA&TG{e8!?-CB7$xE|$ix^DAr1|Xwa{VUM_)NS~y zg`BgwI?@1PGlqRovEM0s83uLu{2bdZ9t_w|20y9gu6nin{mU=G>+kA+wVwo_;{)F4 zzyv|Lf+<|6q|g!G;5>jXxpR{9jORtm>bg=V9+B0o%2IUzYSOf*$|$d6f0e0n0lL-Y z0J`K-Bi?`#JK7segXz+D?yE18QhQF|voTaXZCM*Dj2qE$h#s2qGUVw`A`#&qNY>St z+gi5+`#~lXk-xoP!0wnI`|96jBaOhp_>f%nF5E(^dMyu zFv>3i0~wz?ol5hOYR&cnMlg2VriX3EKNni>ZWX27?))c z@g%Fnh(Wuc-s*CoUUI1sgC@xzk2UCN&|dn^$;1VTv9-wder&qQ1U7uRF-^4_oA~Q+ zmN6#tq!Pp2C#b>7P<3Oep_ZD(4#lY)2X#5>G_aiWXU&d*=>=Op-kq6+_*{vD0v=~V z0JHGIT>1L31J1jj0q&-L`80zAioPc(NcY2m(csm>b}7s&>LbAKl0V_-P0cF^a~gQv z86sl{$T6X#Tc{Brx3fHD!Y5;3Nr@vY_&f|Oxie2I(L_nXiV}byNvbS3R-w8w-l%RP zk%YCs%38S?*y?f^SaPWm3no!`$6D}&eeZmCPFgSxxn1j47@cG5!HpL5D)7kq#FtBw zBadABQ)^mrF?lHw*scLjSHnKaU~msWNv^QaXyV~N?tik0KaH~l(8sGa6d5pIs5!V6 zIH3&7pM5dHoF9ggK|iPn4c-hj(f19f{{9)*SMJ^4%ehkVmD2&J`~+O8-dv-+^rr6f z(HzI%8MrM!Sh$xn(*S)SET&tF(CuN31dI}Xz4*Zwx*K?Kj>>}oicCisJ7Ys_?6e}^ z{!^GbNueXW$9ZT`a_6FvaUP2}cT9Q>N&=%;o5Tad1(c+PA-r2I)$0#(Z|}GB{t2#w*SGIJydhkO zccbR9>kO>Q8TRqi2{|7o*%|^L3p6n1sZDGEd4c7rZ+EZipx@Ry?w{kCf1o=?-f&#Y z{UtX1=-B8PsOtQ7Z$pcH zx{%!lBP2_(kkf}PUqPTkHu}@r>GK-X!J*Z8;81dB8C60gY0BbC)(nQjG9If_43Dy? z$?7_l=?Heh1&3Cb1Ba4Jjd%?b*EZ%gChT|TyJON2PK%{Sw z-m|%UkbM`wudqOE{FggM2x1P=EnaPc2e1G=^23B0u(uO%>_-}C-ypvLuh(Y-ptDXr z`t{ztBKY7F|0eaILx&Q?)EIWXg43A=S7JYXZaGY=b4Cw0bB zS;z1{Aybyh8RP=vA}VFPe?|L-=>i+8%K;n7rA7>s1e=W+<}^qneaFbtuR_RXHCvj1 z*LlVN{HFtKAS(dW;-&&Xyf<&=-Byn<$9q1|dNE8xS3i=IoyqNAShC5aAGiwJ%eLNq z68lqCuK@E9dWBjhQ%pIHU*za3LW9f&ckPt zJ4a=dCS@U6)&NI96X%Rqb;4p^XSHaXysEs#jXZSlnefAfTp7KT*Ok#?Bd%=Hes>I^78Aoq1SAIWKaS zR%OUiE<#qvMaiU$tE7qQCdp#I5k{^NUJMpVFEwI>6Gy5~+V9RI_VuTCH^v6h9tjH^ zK|(tG_j=rKhxIeVAq0B_>ZmFQROFNIHb3|`oIU6_rEZz*4-v!ZSR*0TK?6*7XLQ$9 z(Dg%Qbv&S6y=n)2RM(f-Tj+4v*TL_do?7ahA8=lgvpWi#A+7p_eNdUyX&vho|LztN zlLxv?J3|QDRU$F zlTJ3Qm#|-Lu;0iNuta<#Oo@Fl=4>UonevFosy%*qxM9-^XC8{pNW6w8_r^RCc*r}4 zp~K+<{f$#)R9fN)H+2@yk>0uHoYzHGu&7K`tibD%l~p2GQ?*ScqPi~p^9}MacHPv) zaE|m+BW`NqNcTzm-Fd{uvzWB(S2t_f_f4)hD$3SHJ;t}2$8I(IH>k2xN+4Vlu@5mI zvCoH?qGz8GS%Nj`(-X99=?mJ)_y^ALlB>Q1+MkBp$&WYI^!~a9)7wjITEo=t01Kll z)5+r8uECchVHjo`w~L_!Vs|%Ps${$|0is9?9bw34K@{no>q_!6Y)Tg9FsMYCFXJ*# zSQKZRr%lM?(%YDshly**7lSC$ON|&ZNgvst_3`x|d^%)Zx6}5$^N0<>KVi+JpgUlo zZ$JM9`<&i$K=cOhws4x>Slf90%lmg4YpblJCu%Us_SZM>-t*VBq3G~o0-{2C3Y&6WF2PdsiL@(4YaUe;Fpoc!p`0>~c zRmqu(fpDnuqkIl9teP!!RAd~5MsmQPU#(1D;W~IXkX^W>TDu9)<*I9>(6DW{WJA%Y zUk5K05keNtcJw1y07b_@XY!&y_qF-`EkTFjF#w-qnhdo>(Q_OVwX-?~iM%QVD?U)nDj&=M5&mTcrw!?^Gs z^vKr!;=7$IfKM%mbIpMNpe&HOORoh^hDxI7ITlFm9LG@<#v)`@$Xgv6)Nx&~QY5WR zszRn-ph6yIt^r;QDM>Fyb4%TfUH~@J5e7&}j326UIo1>dt1MEMdzPWZjyb zQJ>U(eDEx(tWQ_?vCe0)f=$oD2fVmoAetwo-}C^{9Ml+_)vO*~fG^4GD65$O5u}BV zu$r?Vg7nVny_L$UQdYxd%+eAj|20X%>bx$>u&jA2y#V7p%w4m&7(|d>%5OIQ3-FoE zR60q|o;$O<-`#xG6mx_HQLC6_IuN`eYXH!bEacq9&jWdy9+IO+dLs`Uq{0AHZF_R< zz;8Ho0#ndo^y>%TlUJAUi+c&W4%i<)ZF&(e6Ntbq`BCFiLIH=9#r~=H*-B!n%Iz3Z zQSRIjA6c{>lB+43?tZ|9KhBoG4Sq-#UdGMiOn#T5ulWz;mi*yiB@HAB3v>OY{`%=g zy9mSq0HGu_5=w|>u^;-r;dq*O{q_F-jcve2M~0FxtPnDEvwCZeK%agKkQkFg_`DuA zy7}@40WqK-Je_Kr3>ZYwa~ujuRaum2oj06i5}F9>re$TFrL3v4G*hSdBFRSr;lgz& z7Xu8^OZgp&{{nuM8x>=E{mRri;hwF>U&kKSNcWO==^JfEOTS9(pX~5%gQe+Fe0VDE zNm`Xz5jo@!{>wq!e~0hp2g7x+L-Kn2HCS#}fWBSZp+4pg_Ady~%m^I*A?I_-#3lgj zXrUvl>@0vCy>kkHoifRpltraSeO4mjEXh-z)djD)9Eo;I*UByiu%nmqTbcg?jaj9R{Tlqt&AZ?=B#38=EzrHcbM*O*oo0aP0#gA9D5}j%{yzrMwW0<&(m?}_i;>y z^FS!$oWLGP3msvcXMybKoq3$+QCXF&%yZ7trWDFJBlR9^+NR89S%&dQlDcw@^I{-7 zdMUqg`Y+%J}#^a0pTQ=LiB?m|bhYa-#R@0sH`PlKCdXOYqmlip~k(>o_ zqj%2pw2)O%Fi}IYNSszmBX*F-MFExH`UjaNJyz0zT^!=abM=@ zU`g>T)AFN7bo$muU-G2rZI8P!XpZM4mb@&h7m|4Gkg;3K9H;9ccRgIp{$ebBQ-GyS z&uwGcnzn7*wr$&**0gQgwr$(CZQGcCzu!4`d*3`&sY)fO)LKb@omt);{}L@F^)WS~ zSJyB$3;*`+t`UAtc6p^w5ByC^>;u#(6J%AWrdDi@=@r$RagU}$iRJ8zxLOavR(-HQ zC)8F8DQjkP#}H}U?B2Q~VP#{_3-!eQg|p&P@vPughC0;zT$YL*pTV+Tl9ADf@o^sLcBCUCla_;)+pZ{jQLZH;uzc# zp6zG%Z0i&TqsRrqu?FT-#q0|&=*@mW3?GkhZ`0W|&iLWGT5Gq8xVFmkNBnc)+ILxh z`kt2PgcBYI@^pLntcNB#F{ysz@i^le812JV?QE?zy4up4bgpa-aGSqz>I)JHj!*8< zf;?&DHf~<2E&IR5W`eLaB=FEKbDF>%{W3#Y8Uj{$IxH3jQ96R8cfd=C-qMWdih)*a zWSU`0DRG~=NRuX8q>*mp(kBV$??!8vXgLG$Jsl}~Q}c>qo{^Hi+EVY7Ufy|sg@-II z-aG$v-&z3k(QvyBEk)Qd22xR z`{I>Zt|NHK0;lV%IR|WY@bEX*X!d2xaS&b|0PX|};_Sr4xD3;3=lxAoSj6TWa z+tWZi>Hm7vXAD}f?4t$CwgEIDC%=$bsoJXbs$97@GBiVxwKp5vYX1-WW*I0Y1b0k4 zB+=iNOP{|gXV}F4B;~I=^YbB+PwU!LF6FKBLzunR5#+5i9#8BRr(OHlp;jFYta6H( zM~!Aqelw!<}%XZ)Nk@&#s;Y z*-Tz>*zT64{wQ5Fz5(`lb*S`#ZAd|GXy!LKpLYG2EBYzg(`yFM8-p|F-CU+I0_Z^b zUhj4Y&cIyelO91aGZ#$k>)^(3ga}$R3}B;Cv&h!BUAxMHI8P44Yr7g6FJ4a&3OPVR zNY2QdWC!`5=SvYt@y>Fs`M(i@;@aK}hZB#pU87HxN`2>QQU2aPg{vJa5prg|oD0K< zue7Oq|3d8T*$k2>Q=OPb327aJCOHw@#BZ`Hg_RUXfV9hyQcm1Qs1Pg4%4`>DZ=S(NFmKcMaFKXN?sj6z^=P>mZJzxU;mKak=vmd}dZay=ZG`0y&B_2f*@v}{ zH@qMRLur$w(^_h0!S_eb1n$Lir)I%C&)91y0;fr&a8^DL8EVd(lz*tNnCuWjxgQzb z6-*l50cO=AA&I$6Li6XM%5E0!79{+p7YW>LXz6BGfSmND*y6Xs-AC)@E4%%kx4${M z&A0=?UET`=TgE~u!qZ4-W3q=t70eJe#`J6Nk|qKbQ+wk6#Qc-rf&IUfE8ObT3q^=c zFr`SsBfP6QH+e7H7xB1UAaO8!=3|XXV=r#)%0fh>X2SJ7r@N2R%*|T+j}M9&Jx_lk zFUl6S<5;bkPW;uLc(7{^_>Sk5Hr|y^-j#iCu3ihYX-8pGQF%O9*+`syg&AS;1nx*S zS`iv5v{cif1uiR%?C`L0nqvo5lVqI9zinqjXO3qg0L2r|FZzNvMRLzSwHuB7eN<-6 z{Wgkn7&1r~rMD26cC>|E=rePF?>y$6Y!;C{FiKoLK+7C{B^9v7uV`Ub8;X-v@!q$1BR|&k~2mHDEJ4 z2$aB`Dw#=cs8z?2l29y4s-bEQC;dPI-`F%$xiQI|Ax;O*(18OUr!!&Sl9aS-LrF;# z(DS%`-Zs9#FxZ0)K5fJrw=Y%iYqibagd`?${d^2I)HaKq0VQF@-yO>JMz$ZCTbHVq z3Zb`_W9bzf(!cKLhiCBsV#0I??%btlukoB~FCZAxrEl%Bl*X<5g+;bKi`+10fy_zb zZiYMe7ZfCP20v+BX?EZ-CmWtTY9LOuc66 z3;c2bs&KL&3Xr!3mzI2o`^yv(*JD_>sryjt%C7PxXCI4Z^NbjiZawFQfn9<*`U;)6 zEd-x!90aADxosu9ZJmng7qCI$|83TM{}k=fxwY|~VC+k6zubwj2kN*twZu{7;ntpc z!Zo2f!UZmrNmr?D_*d)2>j?}td^bfX^vxPF#yf6uD2&@*qUAm&A` zV6!K!7M4!}v+L{#>rBYDboz~$nf{#*e+`0Ay&uh;^X-7s!i@SDeg%7s->R-Zzqlr( zwnBeKOag1<35iwEEospq41jXNJN^$<;6zr*R5=-?Dyvw>5)W2+$YbQ5wImvUPet|R z-n}+VIFdR@m>})W3r%_aOi{FCVV2#qUkD^w^j2!PR|1pagjwhE_POMJi+z4aTmXTX z8NLH}(z7{AY+$MJ2_4lr0Fu+4+E>Z-)YLxP1I8f;+1rXCoku?kAkBGmx+C!KbpqA( z3)A-_WdveaW^?H_2wRns&TD{oW&b+`;t-N%+g|*Mm&2z^6DuNRI;}Pz2qrk&rU2YveHok$*$O746{%e3ZLmPA%Hs~bV z1vd{-I|LyQW1}6ZE4M`%kKWJvbpH8xxBokFK++h?g zH?*C^wZ<56SaBphsvxPDRbGR1BPu!FMufORE9x#_nC^tB2j?U~XX18^g0k0`I6lLq zAfRV)9wQv(n=8)j$$oc#YH?Ph;0vk!YWunrpr*aPAJ?mw|9*}eZ{k{_HMntfa2TMS z43QE3%2V9if3_3QSH_P7_H?|DQXg^#b`o}Sq;Yyl{J{M+s|2)UhaE|HIrdVn?Q0uM zA^)%;)!}f&kj8-zc8GS&*5yz8buz?VO}29R3WL+ZhLQErCDvOHc1HGAx^MB?VED^2 zoC9mCM4U^I5v@l0RHXJ(QST3!Tm!0C=Le4cQsWLCmad_y-L=)-pHEPd@Ue)m0q=Gt z02~S3880t!i?gb+Za+Dqj0mx@Ndil)w7{r6qWz+-xdv zEf)xr%a1wmPGl*f_c<*VtnAS^UHqzJ6 zt1H9VRFe+K%|ZK3hdsP!_$LPxZT3K?I5cj4@hR}q-NoD|=n6IK#i~){L7rjiX*2$IkdX{ua+x1I~w*CmvhWmZq5@z;F(V zWT5$phijsek{*iUgxD4xY;JL16UFM) zlY-N~dbVCIoj&L1pgzEHQq<+=zQyP0*{!e( z#eHly6i=(yAfLEDU#8W})gE3A{e(yte8H_zJ}ZY8K6p%FTbd;u^a-p)YQU1qO;vOk zVWD#S44qE{7e=R9f@U8;TL=jc=2?8Ag6ki-{=IX870(+bI zbv)+vjcBXf!YJAOPvHMT6U2CcXShDV-8)OP;S=3{esu((hX}0oqm;pYlSXa!yDMNj zn$wwP97CB`Qy{01B|Cna;x_W2wOcf>MH=xhk^RkQtH-xu9)>SN0=KH{$!%;DmtxxqK5HBBI~P0lt6SQ^jh^m=+@Y{4*0Njx!H zF!IoeF;{}8bPsG|TVtwpS*fGR%zvIkg8)^|J2if(o9i|RVZ_69u!(ryUfl(eaIzb# ze|TbbgI`|UC%t#SLvjS5$(tmQQLT<;#}~Ags%Dsq7nowHG#?l&ztgVPf>Vcl+{Wvv zWEXg370>I3A(L}h6cf-MDVa$@M~_`^?GV3MVYTaow?Ba;0xOgD zxY11&iyf#`7?RLwXp^yP20Dz~l~Gv*unMT2tgH?O(2)3T_9bLV)zb^g3nOt?RFtM_ z%Zt*)l_k@A!C#CNG;k6$oy}$)i-HY@ zCo!&#VNM=u4t~7(Xs?o;$LX06F5f$7OnxGd;D|YtWL}*%+ zhN~n-Y9!IGZx*?ZoCo6Ivy2A@F}1gFEj8FBTiiu`tSQSsq*Xz@I}!t4nB+boLJb(r zl&{uJ>V~F41w~e~zD-HIiv=3SWk%Wv)q9L*1}mq;aY(XrcyUOdhgU6qJX}UO$=!xg zD7_S}jc7QEDbSU)DLvuKn3pRI?e`B=m)KYY*E6PQsMWdS@1;g(DBBz*Jiw#S+{xoa z;n9qH`Zz}n@?K#;m1wn4j7YijU?bbaCWW*(1+!$-zPechMnuxqt!mdDC^y4xE9)O(8d+^HoiHegntI^)@#@()ztkkK?n&>MwW$qfDlG;WzEV6htuxv$b&5!MH_ zZFts##;PmIv|)GyOI11L_5i>ShmrWF5#2+ikBAhe@0f?H1Or9&pl6<>GKWGXkHBq^ zG{XDm>8HR8`;kC={zqV7$n}v@R(z9g8p5FK!{@Dj89SIudrsl`lZTa~9&hp%=eSk> zB8j2Hh8T^k^mESGQmi7TQ;w)87NFUj)Ru?UL2W5s<*|vbbwSE!MS10L|Hn_YxQ)oD z)O`e?TJ^ayr58ZU^?VJF0MLYe7L2|KZ-yJ`gWJ^Hs4_}KBGpke|*jCKB(d# z+r&SNj*sdY=Mp?PDcqQpGMKc&eym1m_qq~D+nq8(4989T^X3NgmI`&ecIq0?Try2r zm)yV5_EKmPBa>*xRZFyhG@GBa`&%J zsbQONrww-{ShftxTVa-rc4g3Ec^c41Oo)qATc3;UOQx>#dlww0`D+^_Z)_@4VWGt* zUPmb_A34|!kEoPcb7|~8Sben|7XQKaI8R{m>x1?FyxVaw z|K7MwKP-fpPrrmrX)Bx7x@dz8weWWuy#wE9x4MdJs_8wo`c?H+>9Xt11zV2^52b!G zjU<7qe!a-MGTT!1eDIW4rMyjLDzb#@5pCfy&&pYQCUs*2Qwf{!MI+k~a?ez&iK{+m zl`a^wYb{c)?JP^L%13tq7Q=n;Fn<@GKpZp+V7uO)DAZlDGV0ZC&k)>lYDr>sW% z2>~que|6lV*(^q)*Z@}hf{(NK2xB`}tsQq0xqu9z5s8uyhv;h9m+e08{vHAX!#{2vDcln-l{Y!aBvxp{H#mIF3NZHx4c&7}_P1;oYMTvF6%vVjW< z8j-XS1^%0DU-fkfdiixiC5N|~Jn?b>@d|;nPr_cd_+6?UM@>e3mhe=>tF1E(+Fs+gqv_lAvXXr0qsNUO5J@fO4WTtRci76h82_o0NQaA zoRtWiLo{wX%eU}Pj9-+k8S@E`m{zX-h3v9~)Y&j|+ID?Bzn-?0pDuXv>bAx6&nyui z@BL=jwBXFrh!uhPeibNxOM+$q1WpOL>cC{KEiR1U<-RFu4&xJ2Xfh*xe5prq@2}MD z+Q4%3O2B05oTB5Ss{~12347bX{kWv1YG6?$j)80Yz`S%wnT4==y0h$p7Duq}IXEB7 z)^}43;KvgwpihG#Et-3)K&tq0x3#^0eEyl08hTYP=8?fzX$$b|WOtx9EQm_sTwsc5Ao17o)4$!;a`1@PVr-wF^x*FS&wow)b;}c=7eSx| zeehiC`|Uc57D6e7UDKuva}ANfN$$XPMAuXyM?X<=ifTHZUD)xv%SP+C;1Q>dkJ%u0 z90R?JN+fZN1C!ICLv;O#NL14?Sy?4nYf!$$m0R=S#_uR5u_Og7TjwuGBALV$xI=Jy z=`ud5XTsJsI8gGXU8fbSt$zse8=%jOhbjQrko4TOLDlZ0x9X6<3I@ZBS{yTxVh;_?~H$O{WSNPOn2B4OxRV!U6dcGd05Z?C^~fWI zp=3e}QI!ZXIkDXet#JuDrEx-KR>8p{MYlb<^o~0TnP9nH#w zL|kVlbLajE_sG&8S&+KlPPnaWc%&K$5VY#C*7td8h$yVY@31^(EZuSGIqG91t}#@K zfYv4r6f?<~!IoogT23huA|a+}Bg2sH8YgH>jgcr!4BAKS9muKQ8{jExN`~UXP*8DP6Ey){^lK z)zdT7f(hKEE~+bv;D4$`hS##p{oHCb)ly7RNr3`hN7>W01E%Pd0!RQy#@cdYkFh$N z%>6X}3C%#FoZlH7z5vT4T7#e3_tWI=B2EW<7S^lxB;Ft^@QK=w379^{YY2E$=!hRa zSwDxwIqQOUMWG;_Hf=m+P50lM$oaqX>SDk(>%&*?J$|db$}wKVW#$3gN(mJ_7xk3ww-Jw(YyK0x78CKasWSXlHnCecESDW<(!wt+bXw z-VVxyV1pjFaE{h@^0UTit@u}Xn>ihZoHT|Z^Kl~iXhu|5HJFA7T+#vcBMGjOQ{5f} z)07Am^JwVX>@bD8F*1o7u=R|YmcP1N6G?A*68Nn2mBt)xI9)!pl;4R~|LKT|?rr)r zfI^fKu%MR?9|(XN`0G$q2fRCQ<&7rN)d)~NCAFvm!ozI7S`>gEw&s9!JjIgL4o){w z)H|+@15rBl$^I)Hzb+~j4=~YZPb_#lo8t+t5G1YxnEKO*7u=J}Roc^R%zf|G+_)_i zvNms6>#+3)pxsNtAByK^$Wt8F0AGd^2(fk9}$QcJy{D!o94NPcnk` z5pIKEJMMtdy{~|GKEyli=_Ujls7w+b)r3pZeUM-%p2Zb`f9ttU6DLyCa z+;vf^T!82pLqREXo0dkdJ)b3UyH8>m7H3_raVnux`yOc#??|1|`Qw3CYjlF1{0ZnX zAn;`&^%-+#iQ%>YL>$XU7Z<>YW<_vJL?)OL*{RlLmoHkSI2F&EVx?5m91hHu#<#mH zT@ksc0IVHLhSnjyG8iF?ha=*1@R6K~(C)k$0aM3&!6`1^I61)yn*<88#QVgQ%9rO` zSCAMh@6wnI>m^LN_fvsB#4e$wg%G+-t1)HDKzW?{C0s`-xanlhiG0Jwy3da2P__DInLaqQge%kLA$R-_^ zX1e=AgwZjqIW>>%Y=8%8gAbwn^=7H91J?E?RI{pYAjev*+u9W8=2<1Z~>pw0ErV`x@5LWnM(lRU8YXE1}NJb$0Df4olvhJ;gPQ! z;vDcC)LI*mG|38@?t8HuTmNL}7ySWvmw@*;>$mAp6l~U9^n{yAe;qUj=0H)2cEyg5 zUlG;bAB9{aKiEnCBx>dCj+CVV7e?C0M=HQ&L{@89Rav}Bj-WDU2=kCB!r{W2O332q ze)Z9*l?m`|rvE&bmXdW;+3`^W1*POvr1vc%@Gh0v<+7SG;N!KrWkpzqyqHG;y@pd$D3Nwy7Dotz69PBO3I;Fo`r4m=q z38bz$ICWS3yd)(Etgzf#37qDTb(YnIQhOjr?{;#E$}^sQ$W&uO1IW;pDb#S%YYcCu z9E+kZTP6#fkJPr=^)vTM^e5^Z2dzgvCA*2gZ+Vc6x~#6sOVVv3ba$`Us43V0Pk^UM z4h2+n)G%3GT?gda+4UN=o8^N*36YjQ@d04tWk>GAB95nO4-!kZ13_g>DG?|oA#9|T zMEOQxEee7)xt{#4k>T&65#fLXQbwX#$V};{4drA9S)HXL??u>Nn0(Zr&HQGVH-3x8 zOQ!mb=Y4`oq~#JCopTINMfHpiMO*y0$bkr8^SM0q9OAaxYnU)kn2a7sX0sUm=IYjn-vP&n<+kkOl0&0~_3!~*w#r$(*xqk^EyrAJ5_ zGq>!8`>m-6LgL(Xi3%YtSKqk zN{Z=!=>q;-H>;=<>+@s_AlK+7`ua!Bak;g6oCRcR%hoe37JsEupyAjW>NIP^3hl59 z4USWjvt}h>tlk}T8IiX)imo#W;5D$=8{8?=tTmR4;JC-K*%&G~YSzKE&4Goy7A&znwt_wyn1TMt}FHo&^ z>+)5#`R#dklX|+2UFJKb1C9=~r`~nK)_Q>fCJ;;9vF$~i5La3LvE zdHY2Y(HMpG$BLAr8MKoLAo?;dn`uqWkN{RgHBnh@Af36|2D@dz+ASyOn2MO5OJ@GG zt1G{Bauc*18kDo{4x$JP5ijbI*MhWL{=!>JI{ZbKXy~Q-T}8B;QYoBSB9z|W6q+2= z1K$3-r4+bHgZ@Bf+;QXSy!Yy#xxdkGXo+ztR0px)WA3c}k zt#u()OdtqNEmqb)6_99zq24H%&$)*+j!yZ# zt>nggcEMaSX|l#GHZ6n802RDhKWlpLllkbd9}aU)-P$u~GuD;BHcND%)KSySfty}; z@BKCq`T|JyKn`893O(06s-_jx7>n%yh*v|@(`8zKPYjMS_b%Co?XNWFJ=9=1| zD|7a!cH4j**aqyt5EVszyw`Y>-3+=BH({)+EF3jXQrE1#j<)G?sm%B?;bQ-okS_?E zlh$dpxNNqori)Z?5*xR19%)~ncRT+BRW}z;w~uC)dM}AYkX8gI^`Bg`DaO@~eCFU3)fw!BSQE)>S$5VBl_z}~JD1itN!^-8VD*={E6cs$&CIw9tidp#AAesAF{As%HmF9U0inOof zykFo_;Xl4a{s3$Pk?dJ`HvR7-&8garB#pb*#V`CzQu`y{@7Q8!(dB%ppV)uAZ`a&e zHAngOSAREHx88@m9)%^!dtM+Bhp4%`XP2~rwt+$D#Lk!f;rQNq@I9=Gyv`PE{$!vqiH|gv2PNt;!VG zsD5f-W;9g+eH%+GH646kx}2$#ihG6J3;JcKRT7NM7ETP)Hm{q$Z+MKjl^MTN4$7-L zR6RcN6o6s>c3k?IpROaNIBvZ%9Ua%J=0Hr^Rug%;uFwcItoY+9PpjS4_|r_e@OL@2 zaq;C+vz{YoOprN zSaJb5y+6rZ$L5#|LpU`>L~q`^2WtaDkzspLN*Fb$v+YCC0XH0{l>4qYF#2MN?|z+g zG&^bE{TC7L9JOB3VLs;!^??2@hsUHJ3_`Ufd*rItj(Kz(uvXZSEr}`WW0x`FjPCsMF5Bo$XHF1oBd5lT(l?6pi&oq zTXGB_hpa*u`M=#As?|c-fwS6w-9!=|M`mNU3r(@<^utg53g!8l&NbLsuJZ0LdTG+N z2e%{WIiH>^e;wp>czG(45g$$o1k(e1_}JIF?fE>`JqNXWtirTf-eI2F?R%nea|a7r zmMcF`6cX3Cc4zf=JS~bAA)5>sW&*|YCkY)13jttSADUtsC~%-YwlaLqYtM5nnir)$ zi`MFIYb{xQw5F_ElThA&u&#pZbRW1vl3&o6N=sSc6P@%;<>)Ex9bzJ9=9lL5mb6o> zo7GSna~bZ+e6csGxi>Y1y5Y+&UxR`d4Z)Ay89*IRS@t!@D?^4IG|N*BiPE?PQDuT; zb4)GqT8VW5d|YOVZ-zkRX)CM^KNRj8Qw}(1fk^l0h^u2V{g6U6QJVLEy@(Kl*&s~> zfRJzd(GTrtCR}ELW*^FWg2&J@xio6keZ(l9U2(-sQ72mEQ72FI96~G0qGRz64IqsD zkYyhXK$xziBzI!?MKCT5u=1zRu_TD`h3CFOF}*y|6l$$#}#C+<%^Lp@g|`&j9IPL$Om}-m&b)A}Uil5@ZLRI+d_6 zRR`RLu5e;S71d!Ue!X&Mf4pM+Glv39*+I`ZBl@W`Xlls~TO=}8xL*gpuxLT9O3MaK zg*x5bE!Zr)yWtMb>FQ4Jc{DI?rF#95$IE6fB%0C05$Z_X1f9dwydoxM3aV}S%#P;O zyQV2)`Rt^&ws+^1IWX|Mc^rR#`81jjtoEbZc!f@cx;yn?t$2e$P1BP7$sy6Na{YOc zKX$}=U!Y!-&DUywoq7^A?7xQ?EjXmcSntZ{Pqct5AKJ0H5KB(A6bL+d)ZIHotiyV^ zylaa)Z_9Y#(Sd7s+9`n&0M^JHfs>9@YN)VDg4q`ZaT#gC>R(o&t10OqsR_}Ux)qYB zXH4t+j{s)Wqs~D2y!@o&_4WNq|Ek`9rKOiyhh}h5DXS3Da_ugki{J@oRTy995mwY1 zc`T*LfW$W_+O3MtU~r6}GrA{}XA#itnVHOVkCv{l=6HtQ1%ia}o=1+oE?e_agV;re zV>8hz;L$oi#!1CNhEHh=coB)hGI7DP3*ExB`Y4d(j1(rwrpX9ec2KROs3;_fv@S#W zfLj>8R!JSYj*E=OI8xb~`QJ?S0!b`){OuHpPx^7@=mJ**z5D2Qbk6I~wXO+=iMf>T z)$OHR{H}7A>~rpxpFd7kU3<5>`%`c8SIG=Vb|xE#1#lQ!It}kW>b33Bz5uPAdmRWC zR@8qE6^RV6=I zNU}y7&5c>VX~}{6zZ1J;o)(2(h5ue5o&qLdJsD5>{QTYd$u1S#I}X+}+N8;zkqXRB zK$t>e6HnF?>iW7z`e%TrPIm_AE})BxM*;iNJ3d=PAN{20PWGMRRGL@Aqy>Xas@m+* zULwEbX80~`O0`Y~a|xvm_S-f#bIIKR)6u-_S~?yQ+*F>zovlh{At0P=amOcqMlGFI|8ZIPJe3|9oT9AO?@DW=eH#k>DV( z?3heK(U`j2$3M(RGf2OI(|^-g3imI-3KZ2#Xp$uIL}ZXri&?Bup|dONBC!k8u^I6v zt&x1DgBK7EM}1%ANkLH;q`XDZj(E>9h^XYg(c6_W8d5I>VBms0Js9R252}_rap5pm zsP_+6Y|=3XA1?9it$NinY9{);*zB&{)`fGYn$36tfhFI80Z|t~Ip#8GEEQtypQeA% z>icTzL%gMoNPDjP*y@EyXY;^c*gclX75*_95=q%dcRO$bjaNo*SY9k({0Mrbd=AM9 zfFKGMqxn*grAYd>2wBDK&xk=v54^40P$4IxXD+(PMtqKrJ_itG?mtlqNVNZqFrVVT$X>8f0O#hzdywx3 z?0`Z14UG!7oBECA&HH172O_-06)Egqof-dPTX27-9q3OyLJ*jRbgTm_MyZ}|8y=; zaKS@>*v_1XMTF@9{;Uj+s-nhfI+H*pKgl(l=XLRlMi*DsK@u0HV>6_!V3gQ3%%Xxw zY1Rd%bn*0zNB;@ZzU1F^;lnD#2~i3kSgR4{JnebkjK}akFt(Fdul+$eQTjX8Wvz4z zzpZZXnHpJTP`-BO3^uMI;M9O`(?&(cpO;v0Fx5No$K`JI5S9V;?h@?RxtSMD&^Zih zgsc6%-_``&l$9{WQUiW^6+Xm@|5Yr8_LTDtwisf;r9j9ZKRX)J)?Wwr>nEmQk@jqr znsBz}o2*+If5raZLG!F!?&*n&Ii=n3_=ePq>k{()5I#m3{QiL>OS1<-Et_^0)!MH3 z)Xg9W$y9}Mb>;$!MByC3&4%bBa&3`-19!1Vnb4`z8e*gl3R`G{&xgHs6{iEL>>vS( z1gr;cbY1BjWv%5J^*`QCtw&1uu|NVRY`JIV<}3yd9>i%^^FDQU87hwQ0})-&6G$8E z$x}cvypRq7(87(=Jyeb$b@jVlxqqSddi&IS%f_#V$?lulAiIN_W;B;lSv55%U|!Qy zerh0j1|HGJO@leBYc;en#M8&m*cU*8+l8ZkrGs@9j|Lim3p4RR9`sZmY1Tbkv?eHA zsVTA$;+lOQ9V}p~u>VcfkFs9!euzZ|jneE8YN7=y@da+1;lxX$5Zn4OjCbYqpZXv0 zcwc(+kSD0+@ANaC;@Q;4?eCbGgoZ8c>S;z7Ij;i-*i7*Z@3W1 z*pj9TRDZNU2&?KaruQj8F#VTZfqMGt4mkB|;JT&oISiUWp4-e_M8m2^tT}KPyq~t( z*!dZ73DmM7eiOU4K*EEonx;gMnexDsM&?7HYAFp1by9np(wI0ZK#Z0rk{#o(0kbA>XNcoux?uSZ)|6$=lS!`EsHhwn_;e@OXTx1R{%Dzd*krnc+2S?}leu~|uD>r3c4ed%G}8GDJNK^) z5d`VvO2J-Mz&?HavWR+afqmDV+G~$qZ#M02es7++USU?DZ)`1JV(zCBn9=^5a~})> zhqzAgQNimh3KqLY5-r^%?QR5%WT5b^RBo2g$PR`Y9N8tI&HK1+og8bPgaPS08y34t zFcA!36byQo9q@6tbKP1JYtPtnWz6BpPFSaYE?MA3mL=a~ZM<4xo@yZW!^(@svLFQm z7?(UKSa@Za3{9!fr)&jRrCYBHK1}xDg3~f?QgeSC*otMEXr^Z@sg1aB88lHEB?`6A zW!}Hb-vMou9`%SWr9))hA!LT-7WKqb22FQ!PNhzUp-UQ+tv)OKlc)Ug4p+?|%M4TK zh#39IJ1q?9_(e|5B$90QpCN9R?m2W#$U5B&vJj*N@{?Y^p18SO7>9;8G42Yh{iQ9j zl-rfga_cX&Cta;LT`QO9vloC;ulna32hvpEhUM%KIrTA7z&<4hniMISU=*hg4}Jsy zipHt~8ei1Tx{(Hk%DiTV7-8jNk&)*3BzQ)EH9vin$9zZ4VZa*$VD769f?jJy)@_er z*&ZFwI(^_HfYKs!;%Am;v-VVaSuO)Z5dpk^;nqO+p}aJjf{&=dpG{vCpsy9uCPS2q zAg3wf5rHyEUP2tBtU=*AiubiAi?(kBI#CINwDdLn z^4FTMtp|VanM1>n`^|%6TmToddbwv=`J-8z)NJ`eEos<$?s<;~L&mI|f5u5Bew~Hp zKvL0WBKzz1Ma-ls%49?dPrVC?sho;_sTh)Z^@t8Kst_HUu^k5F@P9|@iX!n*!6n_; zpQ&YAC#e}}5rpv$4j*FpN8na!f8W5~t+c$&y+@V&o>c#y+_H4os?fuM^*3sj2h|ZO zO60TuFL10vRRxLpj8g8b!U|zGC!jMoH*Hxw0Mq1x$)!?nq765~lr&LpOR+ z`$ajY?xqxFP2PJXf973j*8jvpT*L0z2DK;XS2W8&TJ29&-NR(GFDv3OW7L*LofEUA=KS zH#n|};y+CMYq-z6jGfM9bjb})%Lqk6E|SbrbJU$klTKu2fgw_39QnDn!p2F_DL!fE zWsrzQXR(U_EmF^Bhy~ynN;si%MI&*yFZb8qzi;(_@;~uk;LU4KbO%p0Aa$*8sNQU5 zV`ATIf~+-3*&u`@WF;wW&{1+Yp{PkmGYsL-QbDx`1M`~cFl-~xjT$XxTsDLssiz0; ztvYue-l@I#&{SGlc;__`d*FSru=@U->+c?(e_n2X-;OvVGIk_z@3W#gW{*1HegRjn zXI_J(x7HB+sKqMah9`fI7-s2!%`6VNddQ;$Y*YC0wL(8HSu5sVDsSY=?P5Ql8;)2b zc!y5b2_r(D{$Y}fLgPH>_C=G6+DVV3vCJqiWI|#H^m7_XtTIr{Q0t-_q(R)#Bofu= zm^lvMU<9cAsiR=l|2y)y&pYI=BCQXfJswntiCj*$PaJO#o8P7X%pTJ{czZhEWqP*B z2=W1>Pn9I@v;qL$E3sa<|wuPvUCBKp6?LOvO`XQ$&8()6O|IRKyB!gvNve=qFl%hIZG3N*? zEF;@S=&}Ce8ca6$j_}ik_m_1@5jLiSODBYq8N_Tu046q?HgxtFzps4 zZJH4i2gjrnJ?2T9@H2RiDelR<{O^h?Zck2i=)=p#-((=-!A7%!WC=qUIJL8atV9QsgK7uYB9x%1}ZRvu*5*PvqrrLEq7=|6b#k1=d? z`cVn|-?M&yB{}!=^@h%<_M^ThXRSy2F?1ZTU(6T3{yqxLSh`PtXZa102}x#h4M z88Mn@eVM4@BSXZuUElDHNb1l{T;w+!i=OB78-Uk=j@|iHKBNDH9fkCd>Xg~Tpg&uD z;TG89gxXk%SMdC`P5dDLn!qw^OTc@9L2`cxHoEs-_ey-W1y406COmv*a43$O-G$Pc z;Piwi78oj#@$ANg3TZK`-+?QEz=4r*o|KXC$cTS?kKOq*Swa7S2zD+GD@{;3#`-4d z+`dVrwjG}!`L(uIWB3E;UvtjdN+e!#1EJRtKipBFIdg1}Txg`oX}{=Lw&{PbbHZx= ztFqetnyM%lSD7Q_VFg_j%={tLj{8LOr29liM#djfLWDh>ZU3MUuE<}`O_aCIx-XRDWyyQ0aasTwXe@E|7?7e_c%)>&yNM^=>`@YH4^ z#$KXb6iTCAj1SArtK7y_(|ZK`!o5^lIE3aloj{{CEwS0Y9N&$zCvS3;y3PjZJ@ss5 zcOv&=n}jwz>T8FpmS(t&=r6;Gj3UX(GOLR+ym0O94bP+6?%vOb@p+z!`t5w>u zsszBwL$10thq|kSBJgf8<@X||F##<3(`(lNOM4?l1q%|TxoCDP&GbY{@_^7SX(gDD02=wTwDgmG(8kfxg(X7U%5E{)mH7dqZ0BJ)^ zq8OSY?#I4-y|#bUH|m(ON}86XO7J<;PB@heElb6~k?@+j;q%~h{^OD7EYaLxMRDLO z)sUM|9M{tlfsz$zY6&GAfmmPy%=!!(Gp>vSWbi5|KUErN{*iJ;GT>=Z%15s`VJqES zHe=avprU9-6RXmoFy-V>lfHuLsno-`RSWa8GP#t3vw5K`A+fm4j*z|4*NJP5 zR8)L9qsz8M{hK0w$d0->sS&q8E2tu!gUZOD=B#{kaV)HVo~Q${AXs3QELq5 z=Ve-{1uI~1HRS+elFp{RGPy+d=$ehuGU>?-<*n-|ewvPEr6HF;^z7Iqf{Idf|HJ@D zQO`enYEN?byxjAW`T!P%3vca?*v%9SVv6OMrZO9)v}rm6oylNBh`A``C5z0r>FZi` z>+p}qCgp`xHA_W}iTHC`M@;G~qzkG22c%1J=7pl}E@u}ayXV zhz-h#{|2ctDZNi?PzorVklJ}doVYlr5HDfn7?T9L!#+AsbZioA%m9{Nr^SzSNk;K=DDP4d*=4W? z>uqG5J6Oq(7!N|QSFBEvKSe{C+3qT#W&HdeEe{sAPf9vodXzC+nraRzDysbr|3}j` zMrXDK+1O^sPRF)w+qP}nw#|;Mj&0kv(cye=X3gKb&N{AL_Y`)qspoZ7fKfLAh$3;E z=P?ZFvXQS{r5zi3(cGh6^!_|PpF|8pUFWVaNJqt5)0074w*Ixi-Q(&n-^6rD==9u* z!Dqq}>wx(SWQ?QuN!a!jHnte;e(yQV?Q|+b1ukdpnpZ7EL0SDnx%^`s85LjMZ8_M9 z2c5WmpzG6cfY-4=%3FrOdx>8-x2R<$+29yT4hadQof$&DtlFkCy|>G8fV$m) zcMGcZ>D!ujp4EmoSV%h5x~_2llwyPra6$3qt51=*+ev4lTasw%gi%#hWF;*(*l6mF zh^mI0E;WA}xg20TCPkw^j-`&cq@#VFM_fQs^0-|U+vhB4DuLzP$#?%F$L#yG{HW~` z0Qn)k^Qy=YvcUuyW89Bid2iw+VE4==@Qq(CZUw-~2Kg!a-B|8m_tYWHlm-n|?UqAg zBb91-f4fW+7o2Ajz(#Mo4TA6KSzb-+S!`@24UJ#gsvPb16icA)PJS#H?td(Q!F&HZ z-`*9JAOF6f{H0PG=n?IEV_!$qt7d&*)ah>iHN+R2r-v&&M?IJ1c%UTiK*r?HOtlvH zkmN8Rh+5H6E4^dSGL_UXtZJxch77ZMCXqVUih=A6wK-IH4fu9*-N-r^*+NVU^bbbZ zT;G+9P)DV!xTDpRaL3PvIZK5S3nkp$o;DeOn}9nW&Dif!UxqKIQbboFy3_3@I+Z#c zzR?6|>A7qIT?6JR>VI>Hpp{jZRqwk&AG5bm)A>sMB!DQm&qpecqnVbY#xW{%Uf4nw z{zzxFwhRA-B3jtQ5>2g-E(_GQpmd!-LE^P6RsT}*&{AW}9S2hoXFWHnl#Q5*2JB=RIy7VxbO0)Yvi~nT$kR(0d%THjf{u}n z_SbR$eL!~7EwB?ao{e+hQu9UHuN^?D()ax{^NxP;t^6WKv@OYf6UR{4?5PSO%h#N* zpQjfdBWGQl#7z!46XGS6spvLEZ_ZtYBb^rcCYOw8-d!^;Cts)Q(2)@!yrNXGv<$5G z>KQ_q;$l_d!7Oe`LCVkmhz;>*7l&eJRuQu_bWylHz!l}xqCKGohBd*YmgxGS`1bza zlCxJOJ!kRKtEbMVW0Pj>&;3gcOov+ZWgvwhUg0jWZnGDXeLfd3oTt4xgV%AFi4Ui- zoG?f5Ak^nWWTyD&Q?Q?O2HZ2t1{G!yI~Fy}dVTXTI`t%J;9HNyAPs`5$Spfo+h>N( zpHGQe7Aqzb=v&g{j^{rtS$;&9@w>~W{#z@T-x*w1ZYKLG!Eyk4y+uYo0W`#(Rc=7# zoVEjm@eygLJ?yi>Oak7IB$wTiA>m2d|Ka!>Uc26JL_FNbjwz835M? zwXB-?^j|1M(}@}{8mGd{Qp~F6j)*Jj%Ezq9ZrPTQrBj0tWyeB=Y@+CVvh77gDpdBv zGbf7KQD&u`VCaPgET-)YXhsd30n&Xf@-)VrDgvn-KR$dhyunaUQkzniUX2p)Q>1L6bY~LEXI450 zBg+q=R49p@T&y$cIf>uJT4IU+CPs`^OOCWSi&3$QS?4g-IOx zrm8%WDz=h^_G4tt+BHWDhot1nS}nZIUNP3ceiD_1jvIzZ1lfRzdEr2bSeW_0}Wveu>#2(emWT8#>tIb@hNh-svPD%ox*KghFrNO1YMpBs) zJYFTEXiKZ39wIDq6aHFfd0J+l6i%7eL8R;i(3ws(D|CcvlXo4i?bd`xVS&8S+fqqN z-yKfJ(I=S;uaqr{fKYc|{yH{5-sN)Xm~>tvkG;SoFhO5+3Yn6cWmeb(_GiodQcWyi zpoEINf850OBv9wnnszBV?@*XiR{wNV&;0(C)Ap@N^wTJm7z2YOC;ou9&h zWT%8vRfh50#cp`mL{gbng?^brq$M@7$!PLFQRJwmhx{X@cHqoC8sNzQgdjRU@20Z* zjBq3=j7hdmd9q#9;?PQC>1Ku;*v7kpUPT==lL(acoc&2}YqO2RQJ)F>fuWY)*6fn1 z55F~0a?fof({zgKxzym>@p^zK6^LBV+z-h~R6kwawE#LY(8JzK*eQ{_YGHv7$hm=- zTV38xCrPasgHp{6S1Drth^CrJ5*4TtO-+s{r5s-jNaB&J3Zbte)a00fAy>lsVktqv zlXNG4_{*AYw$4MKw77A+n9hDqgMQ8uK>Cc6luuOvX_Z+?S}{ zqs|!wDGbz7lJv9it#*8zWggp;N8-f`UOUuF*Jd^wOg*2uxHjvV5vlBuhAz}J7;z-2 zlt3!s^q~{I z2;XNvXE*wx*S49bQ*{>LWF}8j8I*Rqc~S#*XXv`dXd<<)_}S%B{l&w9oa>29 z8cARdOeu7dOo8fuL_;f)Ikz=?R#Z~RTTafjKXg{!A9*IByzD2mb1==)pdG!2)e_Fb z>WJ~JQuiaELO`2arJ|3xw|(JPn0xWN0gU`GVPmtpHAMIbx>T*Fcd0`J_(p{edhw0Y zf#jRDlhsd8jg-rom@a`5o(W~_go%YhvR_(EO6ss;3gliIlFcZ{cU~U!V=l4G>N8|$ zB-_%ct@SlPA7@_aPt{{|`9>*Rd4jtJ#%Yf!&18)Omks80@bz4#W|Db|pzSD7*0g9T zhu<5lBQ?zdivi1&vDGQWJ(fUZ^C(qK}>1?m;c zoT%=AIRFjOJuB3+O?B~DaML+i^s@-MeLW5)OaC!-HrB9fEWzgvohT|2wQY<%8gROt zggR8pd}c*BJCX5Nbp#N1QBrc!VI zNZoXxJ^Z@UQNBIww5sGlxRn~)C2J-z1%(%K_4IhwilbtuimJZy>9%p3@*b_YPfhgX*Xw!ayAI7YG+b|G?r*Xb?dz? z_<3m9W$a2aqa}j_JJ+{5mn1#%N|j0rR+oP*jY$&43;rY=Dn{|bGl!VVNhyq7GBEhz zN#*04kV0BV1taUo8SR^?9k zC?w%*UPvN}usjaQw7X_D)UwRAoXuW38`Xi&1=%eWB4KgC_X(fDog+2%LqqWghE_fn zvbnbWl|ZU(;z^9qm|DCkVl&_lIQ!eVL|kmE{%HpI+_1TIvjG+~ds>QH-Cmz#g+MWi zO1nmI@V84__$BDuw%uJ`pG5n5eM~SYUVq?q@*E-hgTGgQrwT(c^mh;qj0F7JsmS03 zTk)~`y=4j}o2y=2Lg@3t?+TftWBFkYsmPII3AuC9N+Lk>>xW*88zVGNI+HV@^gkDo z_*_WCt%_m$RK2ky%(J1DZJQ4X>VJpu+iGo-0XW$;+{ru1YmIvYLomCMJGY_oY3cQq zEM;%Fi@KE^xKu1c9%cs5=Q0mH64MkDk+ak?74*`8Y6dWWQd2$C-lIh=>!t~^Idnf4 z9k>7kJs26SKA%LkWqivCAKsM@Kd-8}s+ge)vYyqvUN3@Dgup>dSj5&%zL=7HeDt+# zUEusq$+JA~tZuXK#^14U)7FI2LJx)D2zSS`)i+tcDzizucu}ijFACdb(N%{v1S=L! zj~yfgC{MmZ|MKYLJeY0&YDZ@M3cX%MhXNd=Rgd5z3jR5R5yo{PYxp}3& zeRU^5l5H(L{Mr-s?@bnuud@4xXi@b~D&}>A+G~OrS8*y$$UQ5;U&d4{1xp*`Ci))p zS`84nhsWiNL^DxQ0xgL`s8b>-7*&A8K15h%Ig(s8cEziOf?6icFn82>t|sgL=x5Sv z>yiWeZd+_DVRI9Wmn|HcyG}Br9zemO)%Uc?eZQb0Ch_mUS92k~$Z}@=sK*qoIyg73 zf$Wii&Ef^J!g{qOOLly+X` z>x@LP2%57~T<#++VN_(K?*;Y6h3Mqc>`#)Yi0ZdrJ{`>OE#GGNnRZ##sNmqcC0AF0 zUi&Jk)+zxclgln)7jG`Q^r^w)xlAlXXDyKFzi>=va4CcPMC6wBP*GJ;2c(U!B@!|^ zbo~Ko(yp7^x3e{ytwYU>oxGf;v;Q!Vw#9yL)x7qEYtyB+U24k;h!aZqyyyuc+UhDKYg8sU8eu65NCQy9bPAMqK9iXrK@;K_-x(rJF@%)f zLjWcp!ZH@QVkh|S26sXLj?&UIJF;Hsz!y*BE69!HhrX9af`&tu(J zf*|f*jp=;#9nf0?;m(I0*l6RqLj&n_ot43K@TFGU;ANUtKhp?F*>I&~PX#J2XT8W8 z@@OWMAqBj(c#OFWc0xgHbDn+No8NB9OodBeqD=HGlr}liG7}I#v5b^5JGM%-Z2=i* zdA}*^CK2DQw!}}Vbzkrq3A({-X%W@*9LpX-H(RP+E9q{RuJ(Xdd*%)OdITeH8#Zm( z;9Z(mFx{NGtNbXuc-C-kA^uG-kJEUW!uV@E!`2NqcUCPe3wBgeFCywl!m`a|BIfTz zLjGF;@cwlm7e|s@;14I`a1`Ls@EoA}HVn)0iF_b0W5RqvHx6=ZXU9}isqq;T(S zibcwE$VV=UczQUtX+l!blv2{^hJK(xB6z~_kVWwhjK0PzGkaj9V@TG}xMJtGkuVC$ zz4(-*;ey?7)BM+o&HNaGR(Ks^Qlc4JtH=}`_mG`MoB{9_fqV@AK zIwqb(yk3X2s1;sRq~^5@zOqD!iL zE+}S`v#x^C1|#U7sLnVrJ9f7jxiIFX+*>>9*} zN<&^S#DiuxgbZHmmzA#E|lYH*l!nfNmAq zvp7GBbWF52s9+=78E`Nh46?QP%}{a?F;U$UBD91&x#`r&m8XS|{NmadUYgzC&e^Ddc!qchJx++kwsBUhtK_QE*)FTjam^Ea(RU1{IFN!Ab;XU%|nYs95cFIx7c zQ0P`Ib#DLL+YyF)S1tTDpR4_HhsSNj5W6tiB<#J~8OdS@rlAIzNkhc2YV0xacrXo- zCCaEIcKs0I)qMO?Nmhx6)RXDXMDFzUi<$-3KMH%+j<+Ubz4Eq3lT_H^u=Wr?Aj`!@ zeE7;$6YV;WTX2I%ey#&TzG+@fDxIll!f#G??XT_r@vGQ4t+y~|0Sj1Dz3L-Ly zD?|y0#f@<*E|)J5y5drefS=`6f0w%B4rpGLex-PMRmhA!9C_YT1pKF`HS!hchO+d( z6x~6&hG~2mR6U$-vO@Z`%j~k{cO}deJb+U_j8}E~*)Q3GHq}9fp%UB>`xI-*w;IkK z*+OIEj25CuOHE7yuE@nam`jTgR@K7LL>g8+a1PIAvJ|1z0uay8?Q|`y#qt=TR--Y|P4 zU{8|4LR%G5U;BjEaEnLUSbdhe~y) zK4>@!Bt8Hma>Pb!dm&grZ+$*2R+%8d1$7Q+4Hs>;k$XFZ(+?94KL-i(E=7 z74k7jDI19-Nu2jUQ5N@DCD|s)cryTCG78bvVoz2Np6F`1(RdKJtT#k#mb2S*C`Rpi zRI|#LzP6E%uGn^=lje$_44Tn7{xhbbinKdBT$@b;BgAP;8uLrqg4hoS%&mpFgQk)f z_^0!9!Lxoog7(BzpQ67iVX^UEkume=-*Dm)r|E+BCUswg?i-V<64U#`1^QO&TRu|0 z=m2YN!!%JJ92;$Vtheb?=nphmwCdYc?5lMX-h0?m-xtd0=J%mhh8J0QpkDmlErL-~ ztOFL8=WXG;D0tdOWX{wX3?8dLm<^PDGSmA%sCH3!GY!|PbC%8eGAvz zER(b)Jxqf}Sy^h7fT-A}O3Pu8t2%)eye5X94q% z3<2V2j0O-WVuF$c{ zyntOax-bQX#XJKklXo`s0+(S6jM}Oy;$mbc*vV<5yl)3CV48UBzta6FN1+0B z1kD*o163+>LQ6QUYDMMqMMhL|#h$wj{y9vf>eSl7dbc*t7_U@%tjz2w-Ry?_i{x!W zsX*^!v6%%rw?=2R{t^m>H3CpPt!0har$2%BWEI)3V4#SFZpjg5t1pA(dMeh7PE7>d zMGem-(i34t`wRqmG*C=Z&=PwuxSA=!GkL2Ik>$mPI|B&h8NCG}`Hc_?CpF81}S%HGET56ck?Obe_8C$lS48&(;_Zq%FjEhsl>Gp%<@<#e$+ z{fvNa9<^*G_KssG8nJjli?E)rxV0Z_mWR3as0&QpI&~AEV;TBA-ubzl1krnBL_UHb zIytsHe+8i#q6lSEYn6EJpT;RIW=6i6zX*LLPb1>282V9s>=`{~*9QRJSrU)JyJo-X zgKj4M`bA91nE7<7suJgE9@Jo}KM8>bajqWb6+&{>}Y` z^mTdr(;`Klt<}*WhP8Kns*GHAS-0coZ)0PNd_x=Ekg@MlCdd|V88CxuMj0VtBojo)K-EbO$$+r4R*X9vpKXTFL0FRMunC{``K z0V1%*bVl(dro_bC{nA*4c<GPs8$3WStk;aKSjCo=j53I%r6+^VB>+&Z_eDWAHM;&lVS>KuKF%Ppw*~Z>5+aQEX21uDJ zC+Cb29>L-FYjZS>xHzXVG0)fMrjQoSzI88x1gz-VzdY_~lz!Uu;j*Rie!=K)sLx~g zHZ`(53=UPCXZ_rXH!JFB7Va{C`SS1 zr<#IH7N$BOrb34$N20jvwlgNhCjRg^;CL&B&KYavC-;hEp^UfAO<~2#zO6ws)6E_B zv_>0SPt9z~&U0cKvIMKLzn8im(=Gy$f(P;qF0a{)lGhNAU45#Zb_qr3^k(Tl21~aX zy7XOQ4l(ahE?s|^?;Y>$9j}TfF*}H>;vC4rM|Hhogwr1QC^}gF1}@*h1MwkL@xiJq@zRl%T}@l!Nk^YdCL59If)U|RAZ8xppce8 zLo1D1`2d$+q>}KM!V4EqhED!s1vJqJKQ2lE-PYV8_G7kP0Z5xWvsYSD^3+bWgkz*rrGary7=EqiXORe-e7u@ zLZ&;T^aqjro&s-2Rc{LjNsokOKbM2K>pTZAT+VwUQTPQX-igBC%H~DsHJgT^}KeV-HxR>4kmeEh3FXRrFWHyrqskgLO44BbA zvz@V}_~N$$XW%^7IYsu92Qb41qGANB&?SSY3Ub69ah19XGmhdu>xkS70AM*h-#cVV zvG@zGVogH0!I9<++nkl}^NXMpQni;LQ|qedec>T>PUa0)2u!qGja|t1oq0sCtTFU% zp7W0zbM9c`?4d&ev$`op*gu759s}q?Q=P;$#0Nr**RBcVfmvAu@$Xd!jyXd-w_u}} z!z(jvM^N;x{nU0M$4xwh)MfW}KPb=Nojc5>`!A{+F)(~T-P%$4l~Zkxyj?dryLyAg8t|qBn@1=2Y;&1~XkHT* zl0^zz{Y51qN@oWK;*Z1;Nup?`9mds6o;d&X2R8-6T{CdWU$)=8^sicy?aHS8ti3TS z`U`!a&}A@TbgMD)Mx~-N;*Gocy7h!)**Ye_3UV2vkNBZ+G%pj55>+LH#3o((j>Gt) zU+*^|7?`)Op(70oCL3?mP&+VswM2?3UOMDKL1KIwwvUJkEm4wqpp^}dK#6v1KgczS zf2_w)&gv1iM~CQ^zAR;+KXnT_<0bo`ZQF=8!vd6qfNZIwEp$DlJN>o-U-a=>>T9$* z59-T}+zhiP&swXwuP3U?-xbJd`ZWSGUKFRutX*=or{y4`+c68a`%+KpsfkhDu>_wVYWSk8q&im*T=e4r@A50M-rk_G15R&l)?vQND#O;!^>8Zf)XhfwhlQbUeKdqyl)QI#+bK!t^j&-Jh+) zxEG=9GiwRTnopoCt>Z)oR#jrTT*V2Az6ZkD&jI>O-p~B(t;DSvJgjr8GDcB_2FF@6 zY;G`g=MHRlO#oS&fXuWT>(2#QZ;80V=eeq%zYBCv1opTmSz+Iq}KXD6%ig^rUu^RDp z43Bz?qA!rAFcH7BsHxxUsG>Ost}!e4U$GGbL&&E z{}bxSrDs_HmotVeG&)@qoPix>2|}VOQzC)u%(+unRZX|TyGC}Ec)&s0jr_ZRT6QCk zVY_G(&I9fVRc-2qED&prKp$Wf%2t0r>)pR=XmcKJ;;A{ss3X|nqUtPcly?Vv;)`Cb zGW&BU63VTv51&H9L8)35roQU0sZ~Ir*@XABC*QnSsWk!VezCJ8eO^l+b~k$6`|U4@ z8@}Hw+~OwjaoWhal(5tt8mY>P-|=Aj1*wiT2&wrSk{)*{hV|0#sD{UL<)OL4s_9ml zC{Ug(Sz~7#Xfrs^A?z8rO%*}uBy$N;T9o$?%?=%4sbQYkQ}YE}A=-i3326mp!*E;- zvpP?4{KB&}?293T8x(J3KMk5HjkKia(5|WCh&hTGNsO|ba!zTTQe~&)i`30ZJ(BHX z79&h5wsBoK5|2Wou;P?qR2O6HYplBN+kE8P2zUy-C{+E6reVpig!Tb464mZ-v#Gv3ChrqLk9;df% z5u|zQ8OsLv{%nk!^LCy;-^}ZFlJxngUd|LNqHVtUnSZ*3d+_6y|Bqg!SBv(?6xsk^P+ON`EUXgr#Hs|x3@i;vTr=hRojHagYkk7=ZLO?{g* zZ5r(PK>Nl6>}uES-tK?9%K!TEoeO2`S(~oocSkb~pNkZKD8O~?iX^A0?G|@## z;h`-+HmwYAQFrm{GvEY67dj4%;vjt`{{XJ>Fj&QIqn?1K+99SXt@JMi5wEqEa1QMr zKZw6yhkUo9+BJDnX`6-FH6|Ff97E@5SHHzJUrBegtKZJiuWlQECs3(V@6}X)xd5~f{gY!^ySqp_fw1K<7@p?+!={Yfn=C* zYnhb|7=a5@UdeOR|LpT#?j^zsOqth24@k+YN?TZwmRk6 zxOWO6B!oR+`Ymq<8Bs$cqYudaz!zjQ+A8jf?JlVN$mJ`=>)HKcvbI3mJey%dat1FW za7rEQ^{qzCmdQ#ja`su1zm#CRqzdm1%)lUnw-Dhd=8ODwOiDeOGek2nQ6k}-uX#?g zPRyX2mHW=QP%2w=abP5u&K6k`9lgGlf2>bghY zUb5Wk659Yjzf1@O0cJdOmpaq20qGFH4YGFG;OV_wt6HfS>qj^C3g+{8n0|WZkb5Hk zRJ5<-{B?g){d(ag*<}aan>Z7{#WMH0^RaQYhyCtFksrf_aMhxXH)?WGhn9QDfqP(# z$nQ-h;lD;!J-VFs1nEAdUx0Uj!9!V0O0GF$?8rSiWJn={1?}wkcJIq?5XxGVPb;*j zzm_>l@&(Q|_9j>T_UksV___3Sgc!lZYLY`|;aHfVqwsJ)-2Qe*`tss9scsVUR?p_{ zHv7Z}0+TOinT>o^F}Y~b^8Rg#sD$f*f#|Qk*?~_UhJttvVJSyd^-K1P%BT%;=7eQA zM7)ZeO@ed^Dh?>NX4Lw6oZ>wh$pmLhC=Q+FfGiaAFHC%vr=YZ)v6WC6N54y@F?V@7 zGlkfV@b@r&%q*38w3k@#HZVL#Y6#fLWQh?r-*g|`obWYdKpI|HM*f3qz zvSbcYi=I}{u{qaM9F)YMI(kMA*P?xJj#tqTTK-CROhXe*(8M`6jUH0j&KJlYhU^e= zZD73dINVApV_O*{o0dHX-b`WGraTzKZAxd!>!#MSWl1P;=4G8rMdUVn+sxQFLYhgn8fkL;RGT^xVg}6rm!p7xhi# zX_DjC(&>NUzUj^j0n+e>Is@dyn*&c1Hu`rvv|SgWBxQs;e^1G)FND+Mb`8PDv4&g6 zBm^gWIRiOAGu2P#%Sliv;Han@#rr-et%OE1=fp4zt<)G&PL}-zwW98gFuk48CWg@t z?zoO?`%+4erF$g0^f!<`0+CDt?{w=?{U57*t-!wlYCL5 z^bA)&csl29jy@?Rk(74Gl7GfG>3HDzNC&q`Bd5GH*DRlwX>s)vY=?qxjO;H2&fpEb z9l7+57OAedZ*v{Fy67iSJE`~b6*`{c1oRcRjzx&lOqE~wEL=cr!13JX(cGtxNK>2(~jNSqkXnB{Zo(VQ{R^n<%)Lc>T5)s#S3KW z8$z;R{=8Y<0mwJVl-0o26&dRnhB<*|KwJjF-WZtr4z?RG;1t&R|+$`gHqF3AstMhrs zb6|~EoSNfiwPju0Mj`*&v)@pFyaV2z3)#$qfPJFl`{?^t!_^K`foOj@v(%@i>DpbU zXC{OpMhI!CAKbNykr3?IqW)V4K_!N;8#sF=?%(Q&bkTmsc}JKy$#@k9nXSsb706Zq zdkp2Kv#)C8=G*qc4AX%54qp(H4bH9PSy6i-RX76YA-ax68$b5lezjOwjR6EjDS3Yx z{psY`VX|hkFBkkkzA7+$e&&g3LW-y4Kmf);mDTQ6c<_9rQ4RPxw2$KFZ+#Iv<0#v>_Vaw$C}b`4Pj# z&CB4h#i8vdzu>AOKajv8L6sD;FeSw>HBUH9GdQ~KNB3)_A|vCJrDQt8w~$L+guf%S z@L};Q$Tl#q2Vbq*Yb2jPxm<lwXr*huKumJj~<=E*?M%@m!B z0>mX^g+(fCqOpAvl2u`@7mY=)AvC>{PhD&ps#R}ni0-mCn*ypr(H89vrEY;X4r7}h z7B|Wb^J4HQ=-4b>4q6#7nFUbL=p9PDuwWm>zMMwn8Ifqpfh;m|`QwX)&*U)bHDr{6 zVaFg@FbX{k7m=XrMCZEZlHYZvEccEWFU_|Jp*vLoRdzwA2ekwFqly8GZKl>HZIbI z1{c9~(Ms_WU}Xg8G7!c%MQk^sqT=S%R8~rBeg~Dc78Uc|m2xO}Eq#0)vR8aYy=V=D zGmsK7R6k&+`QS#y#6=N6C?K~jKs?T|x|}SWDoT9CkUEm5u#JVhJEbKo$v+aq9&k9# zJ%Xa@!j=_VBPdoc7!~binE_aZ2^8bDVnw$q+eU*Ry`p2Q47EQRZ)iZTq+Ke~iv*Zh zX^N`W6e_$$$;2!!crxH}J8q9fg|t#hCkBu-c(5dcLmEh_4+nsg!O3MXWWvXBi_~OA zk$)eD>fpOkiMbK~@1+v^Jl{5^{XBS`@ut{pf*k8|JOqNO2lxU2p}a06by2%dxG~&+RA1E3<3%GEKbF_LGbnL>C$37~T z6PAc1ViZ3XxsWn3WMk5J3#o%{nPdhU4S{P(xj<+&@Wp+PhMBnASRjtNaBkqVT%W+P}p7VkeVn?yn2`uU^PIrhJMlH8q0r4bpUN=*s@cDB z+>;df1@rMwsspVP@Qo>{W?Cb)Y%hydoZ zrnFUWo}x0$L8XczC;%&tbRjb)qwGQz4HTGiMjIE}CN` z*YgT+$OX+h61#V0qAJvW&`{SsX`C;Uh}t5=vbeH^LN!-d*MR%L8(L7!1I5MuN&|e3 z(3!39XJ`>+NtJ&G98ygQ4EW6Waf@>db;Hx|4sNJ>Xl*5 z>(>2QX=`Eg{a#UL9XVDMGQo99@7+Wq^}IF=+Xa&w*}zyU#hptJeQL0JF7tzeKd^#| z1?vG?_8_L7Fq(M=1*&Qzb#+_1P~vMpKijAB zgQ&#VHq{+;$AxAA551wyP~n$7zy1o5iBa70yusvl#J`|IH4E7TIVwO|ikc+95l#@! zSgG#Jh13n4-vPQV?5=nsn}|j@P})HiRQ8-#6uiFqzE?!wXt1hvjX1d0w?n*2avLiz{?bke;;zbf5e4*lTz=uZ6i5{efUCc?FbKTz9BZigbfYsfB zB5RHAOj%Q+^6W;DA8z???rV)K)6V}!)N$4qvE~iCQCgOkZ0Y@uZ7EoscZ95B{xshG zP6@rd3!-i3TVL|vT0x%~>{RH$$0J0_MNen5=tcjHOi4Vl5K)Gd(^B0K=^DD&Ko?#i z9ZQSuJX(FPGIuF*ClK49_*2ZOjj%sMT=cy1aSKt^>!LsoyImOpWM=;bmWEpar&G?h{2*YB{B{wbxj2X}o!2ApX1voIJuoc?Fjzu1f z1Mw&EIv5I}V?q}L837&I-m8?~TXCb4asvchTN+PIu8VIGdtO6EL)mJw%y$2_(4@b0 z9)^b6fjEl0P?VRBMab2>rNTXGbAx3pj?P}yRdB${LtXZxXj7H33ApLvi-|?u7nT(! z(F&zkYex*x2MLNH*+Mael-_rJWM?*@9mm9tSkuDDW8VdCmgs`19Qjw?VosTm2SA!m zLSn1Zn4cU3ub`8|vQlg6E6u4s{RmbV{y@Xr5fAQYhqY)exk%9GK%N&ezm7o$LNx*E zQ9)By1)z+dfHT!`mgH@{k)I1a?RSr1K=jZn9=$?K^eT_WgnmdDpAzk8RzVSPb)iG>Ld;7whO zgo1eplN{iDj86*iL&=wZ$%SL%710%A1G93)T2U={5PKM?tW~(Djj@pz*GNQBO1Tf}6G88etzQG2bv57#VCY1|{kbeDI8%1u?hapBah$#b&K~M~zC|ba* zpy3LWHkAjHO?Bm24d3oeIc~AV0pRjVgp zx&mtz2a#zPzd}qywlqsv9a|7T*B+(j6z_nL0A@3#6IV&s$asEo!5^DO_Foff&z)fl z-zEZNXA3)DSibPQV4{R;@H{&4i}9W=O8=y9S6`ra|!p70#}fmXN>kcKlova{)=Dtuy?-7AHgs%NpCxW5PUW z2S>!POrQfmbzv}r4tyP95O`Bv(jQp`BkuwpGv4i39ljw7*VtKe24*2W5%_5&KtTec z;EvOjn6Si_*PUV!+c7dCoLO-c+#rP%uzNMk0+grijwD>laFw zVCF9m7Ccb*h)%eR-v)bUzvO}&4foC}ARub95Qx>7ivlWPFxidtgX;Uo`>HgJCVv36 zCe5EecbMSug)-t|#F-QB->ZCGM1-m*)_m&Fku6AloV(F$z6nyl8!@%mX zP)hxzEE2&*$brs;r~zTC_x~)o_-+B4xg_6rI?tFx9!mFhi)c>Dr$PEcak%Rq%Hig~ zG7y7cn6cpp_c6Gu9X2Ry#brb=EqtYWU_9#|Zr+1Qtd~hr8^G&?sD}b%9D)uGO{tND zoEcaU-MdyZ7IIvCUf(UeWGd?MT~#ylf!46eYy`=T95pDM>()KPO|`n}+3TsPT!^CA z%XW)%n=tg^J?XH5y5(}jn-$pY4=_{j+NjLnP?|F7&gxkX*{diN(pp4fLBBll{*nax zCISLV09?s_na1jnX`WfR<7)h=Iy^oTCri6RPpZ1W? zocbJS0oWb^it0i906h%xqMXY;Vb{Nmk{}PR%02*K6Yx~7wZh6GckzfmWZ-N0R&cXhsteP-p!K;^;wZMH2O7Nev zxhj!2ZG)-gK8~T)t8w+SUvD!^xdKSDBuMQ;^z0a&>k-1$T(n5vrxQ+0syA*DPzD;qXZ+rZZAfkzoAx`xg^VR42;c!c)jC|Q3T8a zHZlbpw8c=05rem7WEKQ?a#{9}Tr(m=nfF+dD|G?^zoE>6H~}|NrrW%gOnB4r&y9ss zFD~vRqbRExc5Mgv*VFZSU2M6OF2I1{kf)1b+lRzSz#1|oD<`P@8oj8IYTJ!`3+!49@W~+w^Jah@BDkgog@7Hh zMpe#!MDF@{{s#*|^uEwUc>2r{{1TPv%|pswXdV}1`>4bS^O#q?8lAaE2nm2CPza5Y zB8@0XjrJ6FB{d=Tcsj)H5OpZ2tBI*iNv9^fp9mf(DGFA9`HZM23bFSd{LAMH6%-p0 zSJ3GYdps|>9i6!c>QuqAh%Y#lSLcKqZ7S>vYQo#`ba>k#>QGQu^HQ6FPR(gQ5j;>( zY}EI>+j@NqZ7dcvP8b40vQ>rDR_A-Vw+w7Ot53(f<9UUu(V2T(j6n2XxYgVzG-M^o zjm{Nztu>+NcslfqiYg(`(kuPiB5iN6j*2-o7DZ~CHI&;u4?Lq%zsmyYjki+Le?yen zDqeTJc)fl+H^RMT1U#h>6&azk^U}xBnR_sbK;RuJ9*Fa5lxBn(oh+<6o0vFnG9Bkd zMMvo@Ds9(URLrHbCxWJzMMr(06*pPh4u@-bsOC|Y?0x3m?Vp>bgO~fDgJkEm6&=gw zV^JZuz9#cZQKK{W7!ZLFxHuV9J{0lGNNBXOuUZ~m+0(R(O}#Imkg6jG99NlY@Mb%xzoOfWT>4yK}_ zwviL}quzZ&nZdFC=}9kC=7 zYpmP0X+4EE$2aKo7nRwnbnN|*Tmg5hA#-a{+|Lfiy`+$7Ip+3aKJ@nJU{6P-+^ zqm!uUIKx4KJ-gxHMYFAjW5Xp!y#r|>t<6NRQTBo=S$Wq%;g0K%Z!um!I+FDuG##Q$ z=0TJ$@xQq08T#No%tIj5PK043B&Yd;6h?OuyP=pkWrF75{`%nQLS3?s-Lme^U1Hu_ zhS*`dM=gt#v=b!USR7bZbE2p++X?j3YqbPO%9auMRj}p zuVxJeF2xgwPyN9eL^r>$`L=^iWwl#wYoQzBlKqHtmeG0eU?nOt!e-{-mgvkhPl`OD zOx$9l1&Oi>l7!O`SSV>y&>&j`_N0`=#4QsvEq1)px?x1O(mK+Nol1+zyOq}R0uXh@ zBtBLitE-C3Oq0F7?mD5Z1>gSQvJQn*&?}`pFCO)vJe^EaSy5T9NyagcR32KFHIN7f z8Y5(GzIqj{m#}SkUA^657}~vMwHBqHj)f-kuuyd7D9#stl*ELE8Hc+-1yq%Susq3w zBoY5j1H00jSZIQlq#m#IZfMf2^bSZCRd!6yt?cNG4_~E&zJj`8RaKX2?Fj6I4)dkg zWmb0-N-PR}FF{LR%=&_nL|IOJQnxHf`;Pq$fB6gnENE~ z!@OW=Q7nABr%g>PG(`c;(Rzvwaee-pz4yS{mHMj-Yar^2*N=9oFFv_VdoigG&2lN;wOIMxu4Xdg z0lF-%^YwDc*X4`XRN}XYmQKkzMTJIa>AV)a=*&TqCX`1BNpe6WGsqsGEGJPA1R?js z%wO1#0;!2erYIUWUQ69&oZVWAjd6jNVnevK6qCGNZ(Dlh*_9O&{`kRrcjFcP;;)3N zO6}b~aqpwfCGp6=K5qZr`(0%N%jXl`R)|5w3Q^-JC?+a2LXGF4nCQ$wxX65(N5oGf zU);$+jjJjpl%-|D!ZZwhJBpc_C}xVmKwrT()Y3O7ZANq$PdQv|c3ULIj7kZueJJS? z3KpFu8Q)k}>{3^JRzyV|FeTk>o0TxsQhbk4sjrls0BGH+DlvTh1V3Zm!BZ)(E8pz- zcr`lfJA696-p4O?>nBc^+ozY|V=9`lX~kEvU5Xz|BLdBp_dzknl8R+sd61H|75@+M z5bAY&3){l!U~uvg#~j%Pvy;yyKKcf+x{EM+UowESbY zxjKLD_+Wj`btiPV)o~3qj-=gkp|Vmf_cqp-pk2wD(O{NJ>icJen}AMxYuMPq%ysAO zwl&md7X}6G)HZD`E(Ob%!!^|=)BhB@_qd}iU2nNUte)tz znCS5J548}V;XEleI$_q(5^?M0`J4RzAXavHGiOv}gq6)}=8VpqE#iP>87FDZ#1S$r zQj!-zKq&C>c}g?R>~#uL6M#)|^*7mFqb5uiQU@iJEDGMO7UE9ZIb-{Na&3N>Y z!gp07@fHYeI90INU9*u#91&XNESk0^s3@e z*(1(##|~xUz$p%(j0xJHfPHy6`1|Nlt`^{F~;)KQ*+*>wh!!&o6Sz#Kn+V(}85|tVS z@(|TO~gLdK{K?qt~1*0$|sL@-UdEX)l1%8dEF1X>Hk{{ zCSFk==YYo3tau||7ChMTXkf-iYb)s*b~mO0Z3@rZfpvqty!R=Vp~s))DO5}-Zmlif z^Zzlco>EyG6&hjJ^Pp~YX1-u?o`xl1Q3-w6gOX%f<`Z$jORBVt%7trBG@CXD1$+CeBQ%zE;_kPtI@|CydTSzq)_H(6b4yk&I zV#LdY*S%563ZLac_f+-?on?>;QKx08bi;a9dQ=7cf z5zL2Law8N6;`Mo(L!S%37NR0!UViau?SyMFixQ4E9!uI}W*KDc0Ro#5;m~Bp}myQaJFwc1m7j$OH(oN!mgpiFH(JCS| z5eHeGaN)~fy|4A1JW-ED>g zZ@rQaq|N_eUv8=)sEnEX#nlo}i4pcbk7t9hMk2MW*k$aFi4luOnM6-bqfyIM(``-u zSdS( zJxi=pm-|0Dq(6yk;h}}e8>dP>*tT`KRcGY=jTA1x-UccSm%Ake#rWBDtg+{oLc_boq=Kh{cSXuZas!~SsG|36&agr4@%vfYEahdwXBRtii9N%$6aA+z0~ zjVVNd78D-iX?tGy!XVHn{MC|p?fg+zk_XD9@c@@ z(NxBk-VO5ZL<=WWoe0n*$d~OBp5`5%^VM~r~X$`UhjFTRH`CR8DT16RCU9^ z__pQZLJe;^|0kQr|3PQ&V@(87 zuEf36Ul6FfMEp1u*U~D>S?Rc!n*5(^CjSSOzvIFg(*w<6K3Igb z!5!o`4S9^mW~kyQy$+i2 zhaFK)B=H*Y;OZ`_qruX$jVSVdM4>qCi@JG0^{PckGkb-S+~gGHGdV@5ywx;ODVu3pmg+Fg%cuKb5&GDd zVN?_!0xggs%j2nObylGf8rmmC>THfqRh88pEuqaEL|awkIZ1(60t12dyxF3QGiUv! z!&lf-9V#JD9s!Ht!-5ppqJ+?OT|rVz^8+kZ(m`S7Rq&Yl!6BZemjRY+ z@E%Uzou15jeMDaay4Ru-ZiCL}QI^n|gOWu_SQexx%8W#`3<%A6LCQR!QOKyzsQvnw zo0O$|CS?hgw;MDjWi{x@L?y>`j`S5&dT-euSF4@MO6d>k1I6bVsH_?ZI!wYc_d1!Q zr2;>@b+6#U#8wRxD%Qg#gI!@}Zf7r@u5#Fu0fJ?$-l{#hJr#nCz*1CVL8%w>u8JnFho%5yvr^Glfc? zXHXH~7_rN1{1r+yOvzS6;Bn7LEPwKm|jP60253qMpkp`G`GFPHGQavm@HYk60< ze1CoMnx1Z{P8FSMb%iq|(U*xcBvFwOHa?H9h0dG?JPvr65Z`Cen=LCzPNPCx!~@ya zKF+9}&zzflt$Ze53zfIqINqJaV&jupS|^fbDSLF-{odd1ClK1&!FjfCYgza7471ZZ zX3TieqJ8}mlQe7&DVbQR|C6u*)$>)@YPpknHO30xctaJIp**~zW{FLkY?~zqZl<^5 zrMSV@-AY*K9?9+#;D+yh16ypX4kjA!QJAS^Ul6OEOy0sJ-@m)QLKu%9EON$S{-Co6>^0X7 zB;Sa~kyfehAi^9E`>VhhEmt>gS$0CvCNyW_%9D>lf$^!TV95KuN}1wE+|k2bldzS~By6GbcFRVY zFEU!BQ~$$TwT61Qx$0Zv~7Sf+OC_3n+LIAApD-^%iQh$-8<+cc1y*By+b_HJ3; zh&PWd-8|{)E*pW5)%tg@+f?R z%oH3rS(u?tp+%uWBMfyOEef3(*icozWtyt*oHir9c7#R?svpwQTCV0NePR@Jtf%6T_~qV?z5Cjdx6wNn@zwzQB#e zL!s?`)biE6uFuy6=RFQMmc zOGL24T1kwpj{kgK>LSp_wA z@{Gn|%)>CX*9FNmf#Q^bo#8dbPb55eFk#Gf>Q> zc|bBEA=^8^M^9c=e-MGIpzx}XEmvRStA|hTUd!rx90~#goFWz>&rB^}%A=t8o*~Ok zybxnNDAdv&(c4dul#?u*Hy+}~E+z@$M(Xxr^GJf|%z4T~zf4jBovMWwODM?$>JvYY z@;G5ho-%tm_S_^1<}*oxsJz{aUDikI#=1_I<3hQ1kU9NX+-1Z8=7K(S=y*ebM7s%Y z)D}^N7LIz)$qz$=68&?;d7%u)mqYO3X!Ly&X&)FB>ZW1*z8DHrbWkrqnzL$laQ5iJ z*G!hV?RxIeL3Ldw?6KT?Z@4&$8^{t+4WI|~!piXsG0gs+qX!eS^yo)7TrT@Si*~?b zxsuK0y3O=n^EB8yWa?o@9qe`EK4LmsF`vg)L}%_9i3C_q1b9w_7DY)iS_XN}3m`e! zd_=x5*oyFvIX(iHxA_QM3iA=Rb=rLdF1c?}iIwlfW%p1B*!YJ-SFrB^chW@dtQ)|m z`PO*i@r32TAVVEBWp8`raDYF|T2L_kz!xw`g9_`(490c^uBYzg zZ&oW+BUpF|-8jPbHqLcgmihDhAQA+8;H&_~vL9)qM{0+WbWu{X?%U&0shjoi*n{hq z{!Z7VGClYl&R(~Kp1@KN9Q%jHf24F>u7 zGz(p_eYF*nA=tsrCsf@zmLlxNwVHh>*>q2x>7T&N#HVCI$bv3aj76U(wBhPOk)0b~ zq$N~oQ6aaD%_11$GxwQ31ab~Y#KS`D+d)dItjKxp7m#vbx3R#qv3UeTT;6VDXm7kf z;iBDrZO#|6xv?(TWnvR2{a_RAcf=v|s9Q!9%~oBPfj0ojsk$PziXRHCZ&t<+<-u3& zcCcfa3p#&=MeGn;=I?U+?s#n2c7N&Mn$WacszQK@-*kRfh&k5lvT31uzOGF%JoveX zKKHPlKG&BrvrzIF_dEE(lS>e$-Wu$vEu1OV3RKnHWVy@s?@_G(a}D00skT@9Ba6<5 zI6U3-G7v7<$aB~e?at4Hd6WrF6DzkgAH} zBq|mx53SYx^F?TSlzDVUT;A?cP-36kqf8|=j+^w#vm`X(Ll`D&w~mAMhOPLO1Wr}Z zUu6LF0Y$Kf0$aD=ly7 zA6#WN)zv{onf~*z{|k@N*Zz8c_XRQz+Pc_5<}g$@UsubWyy6ef4tEXd#fIF2(>Gwe zzJ2{l%+4p&v9qYL+sk>|mJ>fASx7^YL^NNdyr4X?0v!1wGVOdG z0TP$D+d0~R&~4{aX^`V4z4E?)`Sr@XZn~|*_jlK>-g2^S2>cD>15c9nDm=ur z4*WuYvE6VE8y{loX#Kn3LC&+^{rW<4lHx?gFS;!mZ02gX^A5>MCLnW&Y^={Zu>OcI zZ|%zA^^1@X+uyYJ*YLhrz_3W!q^_@XqptY-UL$ZIgIav2K!Uj%%=9m!Z}HhRy4 ztx$XzF-K%w=jjITUj~4#$N3M|-jgAb^~%UPY?^YobL)k2(2_c&2ht(9k6$2H8TQ9F z-n&lB32&v_(37^Z8=S|XrwPRU*9->+QjPPmh2 zu1JOb6y=&S650jt}$2R;b( zo!#y3EUP@=*^FA{K8nZcPRH@3_|H^1gVHSfp0QrnQZU?bJh!sLlAG1_~ zEKxLc#K5e2LVZGu+Pdv}7UK_}IS*1l%!`Z!zP}(*zzR|%oRZ4-c~WIj$YXmH!Z#Uz z{!GRnDsQ!GRLX7FmIXWP+BWHVlSUPg z2+@J0FIfUce$wGSJ=81faA^M+A5h*@-uBPDF2n_(@5|-_a1D350Dm4g51qM+(jZ{D zxWAXaIPLo-BYEIgB#w$8FLK7i+)n!SO>Ul#F7M^xKR;>f_pYCK`NvW?dc+T4gZwts znACK2Pyoa$pj8Lq`1+;43?hDEGG7ms6i<)%1+=&5lnaFG$ZI*%ZQ&MbT* zrOfBTb%q&C}EY3`d$A0H))XxR6?xNnVATWqLH)D|0Kl-f=v0lD6ScnOI1q8yT8VUXnBkIf+u(^?jk3&{;LgfrYkkD5gn8 z@lj&K<%)?7b%|nPV~kSF$s85eTM#e75`jXcZRdcx8hr@3vrHjxc(N8wA?}#FcC8vU z9;S~f4l7jJczExv>55B;yf22MZgY}33UJVJk0^hE+u&}c?y>UvDertLhpVrt_r`nQ zbJk6r85-C~)C}5BLcI8~PhX+(5Tte**(X3Hj)`B1?PaU8(oQOXNLcys7K<1=_P#8K zrs>2Ne;)A#ojD9MF3$HMDgBg*Jt*LWivJ@}l1~xOGT(0MCh^5b+X7y0>ex`1m^wBF zw9~xl6CEwpDsL=fxGmoCGL*$bZmO;1K0eHlsy;M4HqTW$&2y+_r{gDx?PGI%taLgh zyYhxq*v>HU)w#LPHWPj0-85X)+Z?RY`=1@(@weM%1LZ=L^{U$QgJbCa*a>fgvcA!k zTesZl3=V%Dg9DwpZw^J64~-DBs33V*#Dpekl@>W?ap4I4nhXvfCnQ{KhuBb;*daE? zC3ZNO;o*82dppFpUu+1&29@$oH$iNQkCKz!?4Yof(Mm$qrgf!*e?2e(@Abe@Jk zkEemo>{nq{MvIWpEC3Ex5D5z|E3&BkjFw5B^UAT4nmi33Z9;gt1!F^9V!>!j!ZC;D z$y5&4Tacz}-#ss?8U>uwgR<+YINL!d@a>i&syRB-?{e^B@*(?TZ9kFeDy)W}C z-F2!$igqVO+x($2uQj`TFu$RWZl|ll(Svd1#tMch_f}nNK~}bx-KVVM9LmaHs@Vr7 zM<;Chc#XQ8RbLOrD9PVf@dixHgDMwW?TXa#yOGuVmd1sE&wG&<5yS;y-;dP=P3ML9^LQcX%q*r^$aq8;55Wcb8KHfXn=&pJJmU7k z4!+3?@iCZsf(yciy2J&c^oB7mXfkEQ^%n4e655~gnJ#y*t;!=VZ^>5tA-422uWGe_ zp11`>ZKu#4P@xfOJCF8&&a8SaiTyIpIAlDgKFNC)M8K*b;oQz%4ouoZfI+L5t1UXz z1!{|qF-C1sVW--<-U6z&sG!+<#e9|ONMMq4$>g@GuH0;#T2c z9&C@!tOz<;NO&AnB#P32WQ-*wE8`+A1L!zptxTK;CTt&|u=V9C{1d=?bc|6dJQ=)q zy#;yr)1{_9)$2bTCqZ<$YsEi-vyb_HhY;mEC@TydeD|9EpYojXMU(lxSMNUm=a<(q z3<)Q~ew5px+@3g*^fj^eKa{7FjkqZRn*a%Kpo_M-cvNVFeazz#pff|u`66c_33FNs z``{^|NydoJ(m09JU=b7!7jNVfpfmS)F9D>8M8E~hOFtzn40uK<1)#{T zg33Dj2s0hO% z2E4{@4kk4s_<7U_bf`>KDOD~|p%KbE z59~*0?tw%CSOtm7XhCvSU^;;E(iK1zcI7p}{@~|<{pe7aC@?hAKDmprk<*+>+9}ni?x|rY)+TNGx_z&THjmSy= zf?xf|=ZDv3S0;)5NXIOG>_5$__m}pr;U`%9l2>!6inh@;t~9ow>(n2t>e1RAm{-c^nXx#|GVP zVtdj>U_y?;&x0J%p)OJ7IgleN>{jKekRvL%KMx!Esq!E!4iKHJ3n{q)3bT=SLkLbo zXhhasX?18s*16T^5k#q{V3MfN2)&+%Nuo3Npbde@HHnIxkvz;PDI=biNyZ>>ZPn}0 z#3aL?he=w7DtGO9ow~M&$$kl6h9=18b$QC9x9-PA6&V!-pWK%!C#t_3^Zwv3eFYS8 zDpuTYsp-(@v20(|ucSt6CJ$2c4V%{1V(wh9WN39{Oy5)oD|_SVAPoRUDmD7Y8lFVe zVUr)NJFnXU?_LkXnGUtXCx!~@=4-g}irrSy=owR-81$n9qyOCC=Uy>ZKn?w_&}|Hr zaGQHL1Hb*`7Ju4qH{HLzeY@neUB6lN@9mA)@72%Vt{S#m^6u?sN!MiP+(jsZu2&EU zBfxr=@18CRErAmC_Pp;wUqhDCDxzsFuIZWZJ>o=23L2#(O)~CBrSHdy{jL+5U^4o! z6MPRol-2iGd$l-y&xA>D-H(m?9z^iG6Sx(+)=FYq-{-n_F`&tvw)}6f%|hyn_ldqh zK~=qU@71?Ya1D|h?Emb9U+54DA^JGi!%k=Z( zUB7@8r?NHnxh8qirJjFANo`hyPDy6z7iU?S%xn@!T{uM?{%$7XSuz3MVVC{z! zvP!qJWLqQIUNPqlH+I){byc0ZNbdFP2MLl@s8%JwBDrVw!`hbAnF+E#Bop}Zk{MB! zlF&+62S`~%Bol_zx;9kOx|CILIwmjtY=L6FY=MBPpaaCjK4^DDY}=~5avzKEp=2>` z4Q~QspMQS!`uWhz69?2XQLw{5ZLA-$0mhrPJu@Jl6EpG3O^s^Z$!=o-ZNH0~V?Ro= zP0)o3hEvBk#0Mh!uX|?KD$h9vm-_oGKlvGs_KlG~r800g@W;SYxw&-&(ey?yM7 z&A1+XK*+(8SIfWL^sYVv*|ohwFJ7~wt2gTxZH>tCaGHB}F(o+pqaAAaYT;T4y9&<- zSXy5i(nhsiFJpksGgc6d5XVg5L4^i5#0d!>ALHV2hv*u${v`hGyy5xxvgzY#vef<6 z5V;4|)HOH5yd?G_m{hVUZE&az+#+hjh)9cu@S4>ex|vs1xK&W$=bsew<(~vp1-&Gi z!ZF56j#$H+_*-cG;XnU8G4prO4D`!a)j7tylN=#GXu7}^24dyW&+OfPj`a^6*Ox%uIsBf2E?T!Zv{DVU%2pdglj$F+Lhld-IJYz zT>HB@iTLl-F0$>|df8*V^=y6ZdHeZk zXnLf&M=ncE zQmS%UaK%{_z6>w?T&ZHdT&aMnphrd%jK+B65o>r85NqSsi$cJo+^gNPEkW=+bSPxS zw8KSXJ3`?Ek@h?Y7eB^DKZr*|GzNlH7evB_^LK?#v0S$ur4KupaNvd- zcb?+K{_I7rIsQ*x$ho|B{&%%>(Ae?xsoAT|_B<12xz_d_=%Y8Np_?jWe!Ty&O(DDM zYVKSE?DOvdbv@XN$FmYpkpYfpLN?gPxcG3#WB%T*tSus8$`0wrcAtIE;c08o`$Fvb zn<^`zf{K{3WP~=nAUvnso|%g*%W^Gsq>ohL=cE<$<)j5v1>FvsZgm<3fVh|u_TI#w z*g2O!e>I257zk9)n|31kYIEtxpy==i#D!tc@xAA`TvIy3SD z%5B=+mGOxNqnpe?gX3qr$G&$EeWe7rq3u!H z6WG}Wv@-4v@Z6jXX>O0LZYVV?PyG+vWt`|2;}5)oi8A}-1M~*7Ya})*Qx9%Qr{cZy zGrQ5fr*`-~?cxsa*IeEA3$miXCP0h(uiXre6Hn^~+(;Ou)#q&Fm zxhp066z$VNLngQ)`ta#1yvYH%xc9oN*=Zn-F$Fi_ z7*F^O;yAYW*nLIJEP~*+{jY`a$IX56${zBc>`B}P@-_enHTpx%1<*V`F}RqP7>rsj zC~wlDqD1FR6H1|Bu9T7}R6PcCrfE z$yP+xEMrQfrc&X4E7VURrP%Vup%hIA9g0#+!A&R~msT2GJc82bGdKM+_oKx0`HuKh zCI@GD;S$1~A4V{Y*~0xSDl!1U(>eyBmh+5qO*0BHuZ@0HQ4&sdMzS>LQddGWS;Wu! zIe-*RO&f(^Oxs`tV+w9U@VG?4=;ALD{t!5$uk(1=5XW5ZyN;-R$RJ!YFjUTMA^D+8 zjCl##5?m@akJ zluh_Xi26xe6w5>y2Ww2*U|3@cZi4l=%&q9+hrk-s@#ax1S8(qE7e5_|G#9YZsYzJ* z3@R}I)zg{;p_cQqF1fKTx?(8|jA1$9LUB^$c~s`g5WW&eNdqRAfDFR2eq8#O`URH zkhCf?LQ7TsuDKR4>9QP3EPejA7}ZG%CKDYyy5@g746jAP43V2p{q z{_xZ5#pT@h^UNMJE*`_yqe264I<1QjYPpoPkizjvLR*|d-gnIn$qlQj%1t{AmnKu6 zG^ZGMH4dkkw!t_>r`_Cw({XHibn$n|o3Cblcz=}0oiM85^?BsE`P(H7zi_G&tLsHu zb=O7{%ci5*i=B3@?Vpk_AKqNcDSsa@7dYvSCu`}n);_3Zn9NzK(h$y|Q3%!jK1`PUZ&rML5SsK@|}PUGuP z%RP%h;1bye8JYFR#$r@4s%RlAxI+$O)aUEytb84+Z7@dX;OkH&5sbzbk6;uN3t{x# z>rV(qZ)f39kpUQ;#=@bNdk%xZH8G)@W`ql#lR_0`O*IS-;X#a+J_}dQ%EF=AhGG;| za0^CJC1H%BVqJOTKx!FP^P#!;>c3h*jo!*DG5-6>t57_h@cM4W=M>2+#EI49Qn((w z%=wGn7j1%<8$K>pq)jr1eh>C%o)XcIcsNlmU7-z@`HemwdTWPD#5YknjU+@Z+gHM+ zZYm-vE9^m1q=c15Sx282xy*~SD#O{=rB4!;vyz0Uw!xbSpF7eOtfLnei-2@w_l#o) z@mIH6oeS){o4K8Nv@x%%gRpO)%lkcr)P46E47X!?lb}KapgWBnL@n!vE0q_NWK2Vw zkj(o3EU!q}P$_9G3LeRgD}8pboRu9!wGD*J!L9KC4lZVaG!ujRN%X>~f*{rnR|4KOR2(O4PF6imU zQ;X#^Y7w)I&=?B`Mvp0kn^wJ6Ih0eHUVyE~O!ed`~mty$PVw6*1}`#u9&i~WP#h#f-Upz8=i zdOXosP9qvo%d9C`NpnVO&6Pd8DjU31N|UtCMZ;xAGZDT7EPbM}oRw%qwGD8jCc8L<& zbynItaf21lnV`NmOV6w5M^CsAU_GltpQ3>z<)?X>I?DDNz$GYH2vHa*>6( z$P$1#%8B@e1p!C&L^GL(McSv%?bSs6f^3-SPcieIib z7lK_KKY$(SDS)owwBdg9ng&SY8n3kd)f3Y7Ahq__S5vp%2lNMG{P9$1IgJWME%SoW zN()YEr3ykJ^OcpABza!4s-YsQX!z>A^r_HtRw@+LHhBBsgG#_<+A!N9ZS%NYE#WQ> z*+=7;(CFHcjf2yk{W4D%g>HA;@1P32=^A{UIsvQmk9U9P24^Bj#*7A#Jf7$*rxBf~ zWvR6`f|w6V)~t$>HS$K(z=6M<5(8TEtop zqN0E(>$3qN_T~NgOY-%&f@7&0P5~Y7Y!LKsv)d#u&Exj)gt>Na#b3pIaKc&l@ppVLpUueBGbC4v@FXeGC{NS`P6b&J{8qAcq?EE-gdR? zU0*nCGmK+WqszWadi%(hKv_^5)i_sv5ec0dN(QvP4`>ZW@#ERmavHmeTIN++6a|$8 zuGtAyHVokz(?nKTR%dwyx9ma0RzAC0&C0H#+J+()RWJ;(sCXE$(Pj4?#=^Ko)%@8t zo#`5JT*Gik^}B%T$!;9g9NHGBP<&fd)A&-HtO?-G; z_Z{@-;3aSq&#)VA*X<=(g!+%Egab!zQ$f7)~xZPg$&5NaF`p;3_m zn4ZRcqLzE2hrrc2p{0ehs5K`_tE{S&hMV&+rhV?Snw9&EXbX16dL0n|)HkR@I3QFo zf@w^w4L`6mBqnyfqU_IKUhLb1ty7!5z1Lm%A};y$%R8j73|(pfyW#*z2-AXrQLM_I@+Gcq?aJnXgd3CwC%0yCm5ie0oaGKSr8{3R-OD$4-?M}q}S z%b&k|4_ffTkJbz8!~*wWd1~c&ii*0Ke@IM?nL5SPn?Ot*4ytc&ppA+Q*c{WSP}Fjv zwWv(ViLRA(>>@Wr$}A(buIh@52D&GPH-}G!R%O`!rK#i<5CSD#8>10^~>dt=0}&Zy8|?TUVL&1FUYMSYJJew2<{9_b6{tT zXHu(aOe$(wP-aSK7}`L?P+Hgzh-6X{=o!kCDATNN!aKufQma{+)QGm|&OnK`FYk~o zF^)b(#oE~scrWD83Qv=-ppkCN>+jp1oaZK@ee2&-X3N2dYoCbs0aL+a=XmO}nnqos zmNV#5+4iU`6rs5`gqtEGuE8IxMM`D(mb>z)%W78YGNLVtSCn2u@j8yCM8yI~4XiEs zu$G(S+N)}4ClPi2yU$7#$^VtS{I*)eBbu;w;);}laf)h)4liY^e6rf;=5rQ z{fSx@IdqcXl4uy*OY52unNvlwtg2b5@vM8yKT zA+WY&b39z#4iMt^zPz8W(>Hd9fwforJ-gA3-4D6C3#;9YX|(@w{}8`yk8-A?_YbBy z_&piVnpV?TQ`E97E5RvCNy;R&6w)=3R8dk_veHay)s*21zshG#t65poh_>hsLK#1F z2aTgiQL(@d3asrS@bA76F6Z(2_hY+)p>qiG(Q4Mo$iKa^6@S_|?x%6DsAUP$Jl!nM ztY`@3j1kUhMcg>gZopg+_qETx*0XZ25k!4+SY}_;Xtr&<*-h4DO>V+elWlXdZBDjb zZ?ScBIvFM&?0&e;ep&uOR1u|v2b!#?wxuY{!uo;JUr%5b-^R^m%7UwV68`BT zx$>d9*jn;CPE!V7+`5x3BO?#>EiCT)9Q6nCR~-M{_2+%Gn|7tk2?O1chna7KZr!I& zkQ2dd_q*_E0i*bUb4IOP^i_58^ReXKdCuHK3f?#vq;MoX$sC;Z#Gd5K2+mEFi?xgf z5n_)f3dKoC4MX|y*00kk@kJ)NPG^iyD9#sQBa8=@gw>XtxSa%C3!(zL$gy`CN>zKNDeJWdWQ!4@J*QhCfeA4(LY*U;< zSnP3k=~X9|;OJvLb!*d%R~Nun#9Dbfq6Y3A%6@V^%zmFW3a&RGHOmOc5HcL-Gyz?u zk}F*e=&GoQzHXs887LxZT*>xds#jY%>?yv+00vsX8sdbUyQBwh%4!J^THdh7V96Xxom->+@u#2K-oOx z)81l?yGoF~8*hf5?d*xAgCVCZSo?9N7;Sj})S{SpsSG)7eP8o7?ou32@#2nzi%S@A zWQD_M-A?C)uobass7nlz)JzED)O6A55A`G%7Y@~#l`D{LmP(A_$Qn!#ic=o0Igmw* z%nm#1;a47Z@3lrSzwW!Oo$6Lm{*r$4_!i&UPLB}g!1g971!w3<6d9>=jYtgTu@kbg zV4U&&v|6naNs3?BEBw=Ca>he7wK=f&LHbrcl)*y+MRnV~1aF_^8Ey}gojS-3#dZ&g z-OjNs)Zm@!aXfny3Yxy^URIARFw@o3{>QfLBgUn}DLZhK^?4&kg=tNt6O$7i_9k*| zEXr5=$;T;LUHF6wFi8R=hMakWrcKTnfVi#|9Sj=AM}-^3e|P(K+Ry4HwywXFwd78k zQI1EFQ7%i8VN3K7p<{1)UiwcI(oe!tW9_5zKAS+*F=uj0nrQz!=80Oot>*csLKY+i z1s@9b(c6UQ!jG3@<2{`*hH$$qH5leAY*GKzE9u{ztP5}55m_xQKwiA{_eGwJmHT7f z)$T*!sC*}Vu>zW&IKZqQi*Ndyg>o{O_3V)MuT(g=?g50l4)pvM;+!H4<~ zV}8#s-<<*ukYEN{7n1>*MNlrHQ=JTzGa|#FVGOqB*O42Lx2M#_FXh>ohDMTDE2CSl z{$mOp#{j(zAIiXCo7~p96stOO1cKFVW8qBbI0k>7v}s52CKxXM?UXHV<9znmd>cI4 zy?1cvrE;bNB}zWa-DsstWvz_|CWe!Y3HqlwaY;Gfr{$%0QA!Ml1J?n3*KQvHkeO3O zs_VS_8|4luB}GLcgDmk8CV%v1F*egeIaX$X>1lH3zZRTV2i@`MJIgiu8X5HFH)H?4 z<3Z`TP=tI33liYW19C_B3e&8HIWkBjac1+sH@WSCLJ|LDGRSGDjR|FghJ8j7rziLT z&V?j3A^CVXC#uJT97o8dGCg$jc938KgFaASe9OBbTt~5kY>6l%bkZ^rQ<0-JDqsrQ z^FwSBFI1gzlhc*$C;S38ZfNU13(TbVEnlNnKV#Aow{s4icY5@+v zl$u6fs^7WIGfr||7GiXGrnV|5?) zh*772@{Con;exvvKY|^QqqM88^0wtCw44#;_jb(M_+?(IWM6OYRWkfnIHuj+;99n5 zy@g*2krW^98^ElafPYral-BLNQM8T)GUZct^eoLzygz;#Azj}Oj6GRN@G#jC%;QN3 zGYS*D9A-$UU*a862^f!wJV?I$mVCdOq6ETAFN+xxOV0lCihE=jQ0bYDsbYgiUl)>? z+Tc(?d9PEHd8zy{meG{t_~cPO>JkJml!IDhSZQBm?@oSlhVRq$`v1FIOlKo!t9^5q z-n7((O!d>A7q!|Sk!|}a#(edGxNkA{uy-acb#QjFcqRj^6sWj&H~YgS7xQAA=2Hsy zf;!Ii`@q@bFBxH`xBqs_yCLk}s!fiURVC9SCCVD~%kj-*>}+$*7#riCL&St?6(mah zDZvX@942^cR}s7IcN19$j^v-g0j~*I-KWq`mo70rnsIfW zAIQ`Z8WgH}^DEjQvBFnJz}MtECmDa1!G)&~%vC#D z8591c-_{o02PIkS$IBaf_88vtPcb{&xno!ekz9_WMS6fAW(zUeN@&&P6+Nlc4i@Ao zJDa0YqFnMgj+(xPVcMzo6-m(H_xgUBSrvB-`}rW<67Q}OTp~vWrowVsB4&Ken3EO|mqJ#DrQ(^a9ahZ@7m$i5G zg4B&ag@57l!vO2f$(=P?+g3AQHO%}q9H5Sw$HNVlCX-5*x{mVoOPHNNFWdmNjSK~~ zk;%Xo8dK^PmFBLT_lMz6`ez-D8?&jh50=SXt9kG4z4zmac$NFfJu35v`$;zZ5G)Fh zLg_o_l12wJTc(yw1vO#0Nm(lLn|eEgY}VBYrx&=QLy(1wMlH<#sMujv8ykyN$5H)O zX~59@L^$@#2W}Rd(1L0Wo*0krVmkBBHLkr+fk6>!Qv5ljK&~IS|IWO%SH8vABcN$J z=f2OEsQ2wqNfaK+@}jxt`S-C-O&lxw#``vvdR3d^{%LfsFw|ODTh5t;6r62@l_a^f zwyC%?frhlYId5>RoHHnOt~jBiT%L*;H`^hh?AOm(ROIXMgRUPy5N>U+7Ku~gFa;g^QoPP z>UHOWR@i+8&%R<#C`$9$(5rGBn<+`@m#f^^a$5*1SQKAEZGhN^hl1EifqB&(yf zsaEkn_487#;?3bflGDP0pX4t*C>%sZSXWmZH;a+_4+&;iDDVcT1Yn(;-s3-t7$*y# zXM}Tw=7!Mm-0jM0t{FZPt$#e{UC7#I7)b;pgYEwL2%mh8&;RaXXSpbY zDZeGMJ8=ao31^$gu%+L}QDu|+Cj#&^P@)q zz3(tN2wsPHgoC#Lg5P11U)p?h$u=Y-4~s%}Tomu@!HLGHT>>IOu_Z=S)mvc!?Cp{i z-b|zT7=#e(3?v499K5MkD67TeKW)S*5YrVUOn)|VHTAaIv@gH;O}6pS+TifYVZf5KZ4N8JM)B;3>uYzR2Mu}O&zCRq ziU>2_+UN(F2q~KjbO1AFsozIg5hpAuN?ESRf-DCk&CPa9HT1Z+Qjkr#(}j~POy2;6 zWTne^b|Q{GT^fj1OE^=vgUSuj9WXu7&92x|-TEg-YXV|;Jag@rDza{`Pww=)(_8dA zu2d6j-Jb@eX?)4&SyczMFxGEi1L8wTTNnI+)yMM0KVX@^|F-XTgPkI$5Mfap&`4f4 zDZof&)t(9Rn$UDPrt+8m%a+d)8md@dr}z0Sz%j7*0HcKmGu+A%46H_1Ev={ogPR!`E6SEg}`j_N^ zKsd<;Ba{bP^QZA|=@(vdiaWXGuiXZi-k&k|d<{Q)_MQgJL1ZXXB0;BlmAtls5!z;!2!{%Mlcv~+%pp|`XvR{&aUWEyky8t zCg?=A83nvppV^MSK}a|l(1Kv8is!&?IXV|kIS4r?jsLmMMMe2v3dA3r5jMkiwp}U}STpo!4W%|_ z>w^voF>GogL>`X3n@Mw;e=2rHqD98Rkg?VX&_uX4lX+0}acul37sr1u?hI$_dIT)# z*!;fN<&rc%Z6C|Z&VH9u^e-}CQP7{cjvKv>=DnDr&Q^>=Bt zD{Nhk1TVYewd&eE-O02=89v|%6XZ#=6{fx3i9&^HCzw=5BxGW)vZ8c^9)qU(EQGr= zrsdcGyFwuI(%nx$F2j5f22CKdt3@o*>TrHkwwdkUc4*&D43pU!&xC@23USH>0=yl3 z7_9Oh5LdXih}%en&D-+B9(wR19afWeq$IG_Y)INV3#u*+lkv&yUy(RAzO?v-ITK5? zy3}-$w+Sb)+z^O)##KDH{T{N|aPNW&Exujt!B%AhsZ0} z-A?^%Iu93)P&uj^Qm%!toDtJm_spm%e7VBk{nq;6jlvgmD;W0onAQ z)81YON$q%SJL^Oeram9lCatR{^3E>ci^rao3M&bgnu}}cVM>oDnaG z+kPVap@?6okGgW^=}`}uSM@Xt&G#ExAEvg|#T&R>)+-%80@=C-u|1_VxHd-#=?YNo z6`t#M5@_n`ShzKPcH*jFW57^q_&vbI+avu4X=S-3L1noXL}j^x!NSu4`l%!CQi1!t zEvU-9$NeGh~)~az8@n4LvlG)+oCTFMe76j%` z4UqLDG6Mz1lv;&X{Jp;me=P?x_Y$qj$X6$&UwwS2_I19^OE-$N{S-{+rXuzZleqB~ z91H^-rr%s)s6dbj1;+kI!MKV<+sewMcvX%4hy+2e@L<~PM18>q=y`YuZqI`R92OON z6P@<&!T#aU*=}$Z{i0`OmiRQTeQ6W%le#Gcbs45H5D5B4;b>+PugeU(!0X}B@@Bis zPVFnsoR^9LP?RDv(#r(sZp9Hh;S)!}y|71tn?6CVY$xf3C&Srj?$(K3PPTbFNebJy zZdD{i`;+QTUXKlNM{|Wf_;Z(}@&FVh&^MC~i>d_{H7p_NSaJEI**F-1KlLbNi_kZOq%qjC ztgwZ#u7wh%nls?;mRd_V7Dj?)v9bX6FlY%Cd>d3rn8>Y0T_dRxA%vY0-h}I%2Qz6w z(+~KnDe&jBe;TV|E;%%W-LNMxm*P!^R2mAhCC(5#kOYoD%ZLA4Y<|f5Th=7vw`Qj) zn+au21F?52q%9mvC&BWq6l;Z24Rp7Jk-546*UwMqmNs5Z?_#CUcEb7O)##&{i?WOd z$xiDo7%-Y>UcP1sA(LnL5r1@FF*GpJ>)A8>8qk5^9e{)iIM-iMz}YLhX)#vDM6ih5 zJbk#8Dw3x^ZO;W*7_psNgc;Ii<)Q$F(Hb7IA3f&_L%}7E(fGryFEH;G{xwCBtNpy!lt!c51Z z*3kiY*qx-!htF*4w(OSktIwpCBCV1c&~-MM&Q9N>De%?EUE2-`>wSoz!*uKwXx%ie zFO0HMRP>09b68`<*`-p=y0(x0E99Cb0Q;4VZ*cZ(KOKcjdbxklFVu{*pFKb4;r2o z?rn!~ujbT59RQSIWN79JgMBLQa9O3HKSPQf=dT)(to|joLjj{RU3F1+@7dLy-aV^7 zm&itM)Bb?+9Mz5Chk-oB$Bjs>mLGoozrWdewQ(5UqHY)h?Vs}LalQd{9FK!s9cWHNSgMJ8%ZRBoKEfUY}W$h$Zn2)-Q+*&b#0K(N#XW3D?S4X#-~ixyWC7e z?hC4&>M2hzp z>$lq7ZSBWU@oeH5tR+I>M7@df!gbOf|9x9ugSkGF6IWElnDJCpNUW$_!BykHvU~N> z|HPCRZvA?n-o#jTxWV?z&5|Eql?m#%ld1kQ?jMQ#kAJZJ?g8V$B|81@`Sl!lpROz$ z9iTh@>5oyMBi zXh3GT`ph{jz>UNSUyCb9Sz*s53+YzlGEJQI+fBW1NIh@(Var85YEy=8eS;Nq%F|rI z+Tbl@7`Jw7%*)oNW->-Dh>=Ch&r8mXl6qNPps;f+q822ml;(#Xeip`xs6r$Q13clH zZ&Pv?1siaKo&=x6`aDU>fVH3w^GWZSH_PO)t>{Gsx%KUCjuRkeC25QTZ8VyJ4T>TOZBYza_3i=hi7QY^4?#NhVBE0 zPHtKo_XYRMeK~yLXfGpGv2#}jUtAoIWfNt5$+a9Yjt{j5jEUqUbY_^8tQZ**O9K>? zld;62vzJm!zgBTEnem|%2+PY_m?5g#NvOs#WP~}pYOAIk)}2mT2*veWG2qo$04+BV ztt6m8WZ`dSt(-_cPil?3)p4~UF9I#|W?}WQNW%?^Ww)W_$F#F;1t2Qvw5hN)FltNm z*JPnO!YbFq2}U2XVqpVWi(_O}yWj?2wQuA7Ya^3K#%m+w2!Y&xh2P9J0*E8?RbMFN zMqNT&iDV*l!h}%N?vhM}LcNS&sk+o@j8c>MXJaNR9ly{&@QVvD$wd5@tCsASOfjB} zD#G!nfGIh9{geLE%VTqyAI^v{;3|YFTQ(n1eymXDW=5ox8DsvKU&e(w7np?a#*!M= zLTj`U{FjR&Cl&6$5)Ot!Ly$s)*|1TR2nN(*7TI1?yMxzX>9zbdvU^Q)cz6M3GJ?Ua z0&!>xq1bi_7Gy*Ku>B$~UiI72;k!`S=mLse72 z+PMyL!mf53o&5#=NDT)VJdAaM12yEDkCCh-`AGw^-z}1z~H*(Hj5mE6Cxo8R* ztdmw@HL7ci$EfVr=}yn8k4S*}uol%^D~guUTbJ^+081$BH|7@k?jO!}bGb8%nBECG zc~@PnF6+I_%l1vXT;avMX9*ubeJO~AL8S>&u4VSSO8mV+i;Zd(GQ;K!#4 zyJ^nI<@~4V0JMnVE}Tl-1KoCM$a%#-m^B@dqq#IBhW+vV#a>4JSXy4gW94NQC*KUp z;8w{@A^SV0t!WB`O})45c)epGor?_Z1b*V|R4XNJq_nR)`7huYZpB4r-9B|* zSji+7LwqpBDFMSI2jVL8%EhN;8ju-SD7&4|wh~g`+`Dq5Lgx7)7*ho$Ic&U1sd;?X z=xewVra$18d+}^eMZm{JMm7Zb1H5KnkiPWm#H-u$;o{>SWCfY$^9(~7@5{DUw)e=B z1xW9avdM?a}oe9<>!>|l0Vu_J(W ze3Yp$R447LW4H*dkVX*f7J?8eT?)BskYG6lv@*6?eW8HLG*LjUjXWt9?a}UelMEAh z3d8JX^jX}uy;#pMU1#&~Js($eJoLuJZw`IFsO^4gnUl%)73_`xc=D0!2PSyR`C2+P zSwRK5=2Q(7+AyaX!>BVUx00AYT!s(K68x{i&XNkrJp7T5h~vhG$N1$BQ;>r~<)BCF z-{q4XT>15~wQPv(9}dXB@~Sx<22=0d+t%P$e4soy{0CpxH5;~_1NGBI}6mnUqH|q_^HF&e8-ltCL zw^rB3dOqSl2Q zP{AnrhsI;Dk4m4JDeaK(A_9C!+6ndiOmCpyIlfgL8LmJP;jfYYz`(1HEBK9@_ak}$ z?#!Fqb_I?YJrLrbdnGn5A;gW9I-Rxludf!RAuTgqVU$T>j{2XHGBb}+Mlw?pWp~O1 zfVxE`AgHp(n|gr?`OG)sGIh5LH>9MP5Z5==e6B%)FJZkdgI|>odHy;rQqK@Jbl8cbGaC3Upo7=DS4U7_c0xJWvZ!fcuu^U!L{OC(h7Fau1CdwoOOXHJNr z4xP46Go*S@Bi=f0=i1jZ!LTebd|ntA)Ma>MGS%Ijl^h7;w_WDkv8$3SoHL%Dozt)Jz&cA<1$cQ8J5hiJGJQOFIo|&~p z$?4s>d4CCmPe1t3_aPZf1#qkx&WuMn!ew^PML zlDhhVaL`(F1PDF#v(mO;z(Z05bT(ZSVd9AuiS@yG`{WjB!L;r_J<7FHb|ZVBwyn2o z>YbyQw}HHGFJOqBk#?A`$8P10hWQTKP9FQ=s1C!KuB3)P`R0!(==DB%qJ6^ z0ONcHv6D1H5GbF6JBMv!sy8P~1<1zl7 zn92v631xEs+bZ&G*v{rU4?wCPWes-aX0?-F%hVIaRh2A9SR6TjV&@#IKqi~1-?9Jj zZK=sjwF3eubJ3Bg62JMZ?WS}9+53BUy{_slc>Le3^@?i(xL&Gkr&M!EGL#@5f5m2% zlFP?VXRb(WN5r>W7CzRTm1_rrTjf&2a0NVuTp=5uY<{V=m(N0~khHa;7H}ijrTN1Y*qcBC0HC4uJRyvx)Iwy--{jannjG zbhU5z@q@YIyZ4QccPItmJJ@ zZUw>k#8+9M*M~h3qQ7kCT)To7V6u?p^45TP3IrK|$wV))LVoL0naPy; z3e!1Zz^Ao{Vy{FJN7lwv-DDHAsbaUxoku|My{pbm6$0oc8o_#yV*K{fHh^UdB^^vb z(y-Fnw)P-|%ywb!FGnjPvW%8H;k(v-xW*rf5_o%MN(f*&vN*=E)L5!b>8X#Qk-}Y| zZV^(#PbDr!D3$qBE=0}II*%Ek*d%}{!J)BTAyUw;6Z882XgRNB7Z%#ptXl1Y`i2wd zhZOpTE6A8WEIV1Eu{xj$6vBlFK1`={Bc-DNcAo$AQ688g%w6AB`>&wlt`UijZb=wk zb9N$7su}ir-vB=3^$$aJ)j5cQxSyUD&m09#*!<4Qf{dlP11^i6-Jz@r=xeCYmbNHJ zYiF29;?7)hQ$jqB!p;Sn#@#YkV+-a~=uzbJW-2X8nm`+%`k|2UK4+4W&?qUx$jG-{ znSx~htnCvzVt>YDlDG@*?1fi!KapbAzXCh(F)(uixjmI-^WVzNDm4_P6z$ZJP<^AI zoNc76DZfW{6lRxzgaR5Ke^vd^{L5I#5~Qi_*>@wQ&Ik3)HDG(TPJeW5HJ=@YBgm#0 zuiUPQ(Md?i)_v0d`xcoUPBad4zICv{>urq2=hy~umNMG9pPv#cU}FzTK7YL>nRyUj zDS5k8dl$ldCsg@4tJR=QSQXL2uA;g>{B^62*W3GDcEE|Dk}^h9y_yLw8WJyA25vGZ z_r#~?j!ljn73Zk4)*7m6Luy9*IT(f_4r!QjrgUDX+$`-*oM{JRm|IkLC8Sdup``p= zTF%~;FW*eKX4t$03{VJTG(;KFc+>S&=WQQELDtW^!G8bEB_fEJCOxjP8{xTQi!|<3 zIFJRg-j3700K@n66O^y+tq_IujgMeMD4-wixr~v)%+X0JDE2+pGXV$*Aq|xjl~xL+ zA&mU!*pO3nEo;?7nv&mPrZa9tx#AC7RT_9&9FZMHcVr4;t*nPX=D7u3V)1N4T#Z|m zV1*4aE4Ibl;PVA@2aOl`n3tTB&%Z8((q>wl1Ruy@mTH+RyH;2h7cz41|8qQX(X!P< zV=82U(o^uHa2-|E-lsu_xl+_{`J5!8eb#~Ie=}+^&V>-*aM}y74MgsUe?gkO27+dE z*jf=OH4RTpM38(TY|TZ~&zMR_H@5p1HXf!A-1+|kqCyybhnDp>N$^kvr1h&txDnXV zv&)q=YgXH}Jh5+1M?EMSgnj3pnK6n*<0_Nd+RG(D(gS7;h$X3?7gbjh!VuLiHdMY0 zKABCGjjvU6X#)hP0tiqYXEHe;PZpu!x}zVyJX}}j=g@t=fC71bB}o7XVfkVN`;s#Q z({OQ8F+&Yg$%J}{jmc*l9WKCIC`;6FJ;64z)dVpE7^?#qtBlSY|A#SSX%YN+-PL~e zsY8)ycQ+pj;C3xp4G~yte@iXbF8Pv5^!iX25Ey`{UtOaYkIj@?3~fq?%Tl*0yq+LYO7}vmnha^;Gc-&3HRbh_xC9rK>cG8b4qY;ZCJ1!Bh zbz~d4*ptfFFUbmGLCy@(wGc9#j94<9c_VQJX%`?S)6BHuN~2O;bBXUturxH^r1Ua2 z&KP~lhJD>*W+&nRip>edl1dCyS;lEg&BeqezCP1ryGO{usqp14A1rFIEIFs*HaYm{^^uVYAX5nE&PeBPl zHUsv#!jQnsu%;#!B@ce$10*d;j)VMPezF5af~kngMF+wX0Elt`1bg;~3IKut0KwiB znezAUqH6bJ-$PCk;)ftK014uZ3l4zfq778v4iG15i>#Z5sMdbT>@bEhvm`B5X`dCn z)g~+l*hzF=pnBNBpexP>L3k8X1*ld!Yaqk*TP!gWV_C8Cwu^TLtA7FNm5`~6FqZKJ zhJgq&g+Q#QIEzh1vAKAnE&?=RXb?N(F$`#N;7HDij4XW6_aL&!7nX%K71Gp4Z(vU) zVy9O$-u5+}MIST87|Gx7id7#k4>KTaEbV_HhKTLDdZQa4ijVc`w6>!xrlfIYG9)Jf zWCCU2DTF2_R~8m#2m`y;ap)uDja9H-q#J0sC+GKm>832fJ&ZQvmFoNC=x);gCM#pz z2NJvm(E$qdU2%~ifvZjRzoh@20KYw^t0bg;W0=>~kTy$MNhDUgzE>f!BjLkq%@`oC zm)M%b*gD`GG;Z@{^$Pr+0u(HNMxktS#ND*xC3ds8-mbRo)PLn(Z&m#Mj@o2txU!(L z8T>==#~07|BR>d5@34iE`(wabobS+Ds^) zzA(f+T@gp>C>WuDDY48EtUtZ*S?9^?=kutDw-|_XiYIo36_6acAg>Oen)Rh1xp`43T3UD^PQ*1QUaXBtQDM@w zlFoS{2lVkAc-a7Yd=fNr5`B^5qy3Q_7MoY;b>~rYn*np-rBx&$z++2L7e|ABO;`y! zb}I(yozp};e?1(TkR+E5@5u5muU~;O$=(CrQ*uT9p1*e|;YT)s`F|fbSOFgiFum&K zW-JS|EJzZrBVQfc=d{#R3N445aR{du$7lkT)ts7{_O#TC6jDb+*|vU@`k5gN&ClzQ z`~Bz^HH;nq*TQXwdB|!%A|(Ag?8#f4;C%%++Gc>Sy8ClXmiED zOO^Kdr*Aj#re5p`l{riV#4V35qSLe6+DDAyGLbA$#+V5QLA9&@G-jhG|2bvKr~7zg zgdf$FywxctYyI|ieO(m4hfRTpNHybq*J~81gwGJ$AfFpEl28fX|TsDo=nu{iFLBtVg2V`k|3hL zP4;Y3XithCX^%!H;ODZJW|g+g%_hGy&`C!rd`gKRiE@nk*oa@4&TC@})JUFJWT9N3`-92IGag1Zbn(y@hW4XA4*b_9OgfA%GAzMR^5PvD?eaWG$YOoSB88LHe*lgc&w zX_`b2JB<-ChPYY?Vmyu=L)J9s$Y4({2}M_Tja#-89bS?Q5D>S;#EAZ}avFs1C>0+5 zatqw!2%a94SKy+|?R0Hh26B#kA_nRoW1rSVnD?Xe{-J%K$N8b_Nfh5JyAtoST5XVw zyyfI^LrZnW^UT!ydpqzv9<}+_2R>Ra=88VnjP5w>=^Whz?E4Q*ap+q1p=C&J?x#hA zIAe6iPCFRwY*n2H?n@~_CT@(2jHg0cLAfPMyO8v1uA69mOOoz=|B;2c13DL3{}RIW z6Ml2p`44Yxk;_Fwk4T<58#F((2&|{`CAEw7C-&Aqd&Wi$V67I*a2DuRPlI9mcK&PZ z&S=9qt3{$;!5%1+RL`GvEg{nAZoS*ga?`YFqKR}uOjY105!h(>o~A&$Yxib+8g%mV zvl%nrt!0n8wioS~!#afo5ZrSjjJ|!Th8+SNy7*6rK*Yj+cFw${|;VXVWm0Dpp*`WyCBo zn1%2tet~gqw&S3&zKFNM%Vke0NsTvYe%-a>BO7h$CSz$QV0k%-ItsNJS?;jK3NR#w z{g^CF%MJs7Z@nT^QqOaBwvhN)@*}|6Wq!w0e3G`UMc>O632q~6Tv*o>!jvx2x6RDn z+N}A6nzI6xDkM>Isgc5JB_k@maF0tXFs%fPuI)OqVwXTF1OET3!J2*o>kD0tNI9gv zmK}XFX`r&>Gu&NtW5yVwvC6{q}Hvyjl{b$>SSv#k!Cd|GfaM8+}LQ3jO4E z_&o_6MqqMS`1q~^Bla-OOv%atv7D?WzSX#ImK)hf-5%f_)1@B59ZFeg7^{T4tVoI& z_cPwQnc$p9J^t`aKR!)2Ce6o1>JDm|&!NL$#{=_jSqst;fnHBrwvJ-v>Uu@j5CvZD z{%NIWh&(wjK3vjag$-@|gee>KcTI^s$F7r|3HHtIw;r&Df6*#w(9vW9=;+yj3P%ey8laf*leePrS18v z?{O)v`KcdfTNJy#cXxn6d=zQ336Jdz4~{;x5MjOcDE&-45Z~JMn~i34*sF}#D0HCNOEcsj6zz} z4nA5My19btheF{lOTL8A*tg?ph)G$?mhvg&)Wa)Lsw>H<;&IzFHd_van4Ms!tqX-ds*uTooIv6#`{x(&juzfE2qIJZ`j zyi*D|{QmcYu#D)3%$4B)kE^~N@8I8O`Wn8=pv7rwi~{dJnIyg_LTKVr2Zpnymx-5{ z9{CXA6&nJ{D(x;0?uxEHDv$9*k%~(HvNYT)l|lc0zcG;RBmZBQ#~J8(QB>Rbm_)Ep zVb&?Z-7onZIw9>mY^u7vZ#>U@&oF9BHi4;uP5j04 z_pGC*?RjGipRFihsJO8HJt}R`R75(2_y1uys7Yf#HBLrcUH^EKKurTH*_^HE*+!HRJ5HEGA?8T9PZ7b?LE3PtRVb z{!r~K331GY0>0P+tK*! z&YGhBHlgD}Sya_SGFv<3s-M4Zq4;#hH zt&owc`Y=#6Xjt7|I6PYV(WCZo1L#L63FQ!>qqPjruTqk|e{m(GDdgmft@;TjW?cU!`bO*{%k z1Nfx;FcW3wJd4IQ17wBr4pZ=GG{>`gQ{ODkCV14W;os#^#Jq(ZG87L{feeMt=>)M< z+mvlW0uL^~`_S{MpYu5+4+$`#z%>>2FGl3;0Sq=(_6rN1A^y_O?bo7NE1qIIDcWadbQ3(R??))z*P46h_axcqV#9r4f2 z5MJs!$-ZmLEu^TiPIv0UjQz@ALEp>&T*+^Qd*|$Y2wjl)w56}x<^$qm?|tjw9|Cm8 zlpovWi-S$D{kL8p_%D@A#s)FJJe0rdp?Q~dS9;r$7jQ#UB~f%V1o9C`w;-T}2RzAy z9%NDHNxv7Q;W9NztI1iP{gRTm?}aYOFRrlEKJUO0!dg2Leo3E|crUQ7^`A@3;m{s8 zj=-Wm{3|FXaw!dd{~%e&zZiHE1}+r~i(}$T&XpCzb_}w$3t@9QvLMcMha4-_PkM7) zQx>Pf+8MJFc!k#XL4QnXqABIrWy8xQ)i21sp)W^H8akbK{;X1vbvNqpNPn(K|6LLFWgdcc?;%hTn^yD~8DLai?X2^HcWR|^K%_Uk&m z$z^+UL6}Oe4aiFkYlLueLOP-_3S!3s`QB?yTzy(GAg|i=lO!UX=O0CwqL+x2O%!yV zjh4P^dgr!+u(=|Ov2GZ3s_H5S1A(xEEV_ez5GKk85eBZ*-~xw<0`vo{&nv{d zUj1%&0e^=VV_SB;;UL=6Wiu|EJA{ zGs^9$r@{1J2Ccmp4$Z{c7+9jDmMxKQW6TqibCuyv?h^vbGqY5L{^$5nh6{`(buX^< ztJ6QObtr|D+ru%8f9V`Nr2k;GA`D);!Xanm*i#dUJ&<6jQeSQ#qy7X7-u2dAQ~oSZ zIF1T7_=lns6Mpf{IqzWdwBT8Vn|I%(F=-fshCo;XhN2SOohO*r)gxk!+TOKEx_ZHb za82Z|WqGyDwZ$sbM*ngL71VjupZmU4`p|Y=H$#0i%#j`LuIRmanEzQ%{OZu_xZH$H zLJ^po^El0AjRmfj)5s*b6QnL?WhjW)W2RAL37LQa>x(#V@2e%h2rW@po+Pi9A1f~Q z4XuO4Bkq35;SHux5Ywq|MO4Nb?CTl4>3;L%Z50>>+HQXk(M9UmfBnh*l~Wc=BLqns z!-_*Oq_(Pg#fyrVbfkIq%gMcC5)V7H(b_g39X@j$#!qDcw@Lo|?a7N6yooN3h6h_#clqk`si zmL&<`Ob|Rvxaz)643vcooHE@WZ@0j*bMx8-0%8YH^E-v4R-v_W`Z}w7@6biGZ}`i# zA9cIXeXh|Jm_InKauSUCON=f==$c^Rqx{XgY=7hBkcEWe9WVa7VdBhZ%CTRq9@_D6 z6WjD&vLy9*Z|;~^mGE1QMRl+rmH8m(mL;wpoK((2W~)r=g`16BkQ`-1^%Z|tzL%2O zAZJl*HPQ{pjEzvso?&FLV`dPqBW}?mEu!o-I_0c{ia(z#%v628N{r% z>-74TUSCCgwXftttc6g`L33T=XBY2bI!3HsR4FNW%}ijB;6O?3)x36b$gv`7PK=`3 z&lEfXpE84I1#8UQL;~2)6YL|R@rY=!pJ~ZIbn}(F)I7fA|G>umr}uA}{HHa)jFG^?v`~7v+*LxOQjU-lt1ntP z>BY5e1sY~=oXB)%c*5{HA!Rhu1yPYQ1yP7SoGOpbc56U{9`|A5%mhlfm*iOgD($;M z|7JkYlU`@SYQ|9_?rQhR7h6;r*0?9 z#>+T_1<%qCC;Qfy!&kcY@8_#;`-lI~f9I3^1^ZY1@Q^}DV!G<-(zm)3{xjk@E8Iid zoS}&wrL)45#H}uuWJQHog4AfEE=H89YC^G3AtcSgfAGT?=G0e6aaEI3F@qYlXKv2JZs_!dkq!0F8 zLa|ueGsUtkl6F(n+Oa6`_wACtTdfPz6!f)SYomWWdkOoKdvF5ng#heR>nqe>tEaX# zIV9`f^@(!kBHia8_J3K?N9_W`AFt0D#$W5l%{6d+2uKXreA5b6QOl~*MO_pbsY-jW zr$R|0DYgG&s+8-R!#wuz=JPq~0;3uSZaz#ry7@4{@a7v!K;w^zZb3}qU+yNhwFjtn zm#q6!|9)w{--*bk!z_GQ?+Mwv*&?{Z~7Ip#7t8=^@BW>Gy&42fk(F zDfMC+rH)#z>zdJ=DpF>Z-A;9>V173zrR0^+jL|f9S>{vf1owzT9AwX7%dnv%Bt`Acqqi;- zO`){r;k4;IJ3l60Hc&O=(p&rH38Lp-c1CV2v_*4pZFA0I=bg848xPrHw>J?+MFwoK zY3w^{xv2BHppx0sm=yMK#u~yhS`wbxZCUDqnKGQ9TKMdHfzH_+w#6{<=oZ5S!&_{0 z-(dVX(LILdCBU^oOCxR^Ln*wEMt>oFfBnhd2lNI|IG!&rrt#&dWo^$XwPKuPTv-%C zNq{W#jFiHZ8I_`-u`67kFE7wZp2JXxiAPb04)XM_{ShdRX2kJ_9ePm^=?m=G>Whoi z_BFO;F#UaM=+^XIz{u~eSE>zuPB~W>9ErOn^DMQO$#<7G5iRBT?7|tNJkYVI=rLnF zk6ujU(NW6{S4wJD5th5bU{Vp0SClkdWL!1{*O9SE)aTJDTH`usyP)D9y6$q_TD9*e}47)`VPUx_pT8ACjgnOvA>j;ytx0D!r z^gi(ZLf7f2P<->#X&D5l<$i+`_-H}~0V8(TTMuBrn%aIe;hP!W{C)-jMVtE$+x(b# zWb>m|Lz^EHifn$=mbdv|{qs*`??*ESx)OYcSlzeOTy{zDUc*ecEjvH(JTb=g%KE2y zO8ykb)uGP=06^pC4|HYdmkgB{0Oo1jJ!-iR?g;RiHt@?b!no9=mLkparUp7Q3}&CZ zr_;E5R6GJ^Ozg9FNJSt$mbAy8)C2W^;1Acc#<QPU}f(ED+@+f=&MZcSda@oHhVQ)~KeZoFK8wRInum8cm zyMWudimdLS)XrS-PD}P@x@`WgkQVj|vL(iJnMQ>MY>86Ou^67_$B9f6_)7c;&0*za2%}Uo9ZJc1*oHDl}l%PD@2VE%*E=0fxth zh!kd?R`!2#)_@ogJmFpIry|g4sR*ceWY>=CnLS4AP3Rei?OIIyBV>I(`_4q;zy4&S z&E9R2XE%7ruEl$JciTs}8_Rw=NVlGTT;=fXEBc8}7wOh+BFG)A9OjMKAH4jbHv0%8 zve2~$_ucrM1v)Kf0kzzdrUWkO356n1&hm;>LMphVhdcW4zVmYy=(L;#RQ#9o1uJkT zznmIKA{#NT2ib~avl#FPhs_vlu!4%7$^`a)ZeE)<;P+)iHW#M$Q(rsUYVs=gVV}6q z8Upz-75u2s0LV|vAwVrx_Q=Gw{kD`U7xq(A*#MEsif}3HUJyc;MRYa5v>XCd z{8q@v^&pVP1f!4-Bo)LUkB=(GA>Va$L(qtU5=>V5+yjti;Qk+Gjb^1}B@b^7Ked5Q zOKm{KZ`~YmJ;>%jQzT-WBbeskp8nHjwNy{Bof64*c(zl_-vxPZl&0M=^IBMf4#}BnXy)a*Y+wK#REFU3BNVHq(RBC$J;znDxDPD_SBEvvdN3Tbj8GLaKn%NjaBbCOAuH3ef$Q-n8I=_f;!(~==j@f$bT z06o_?7%CXsVEBVazdopFY)=KhK&V!~Bd@YL?svkTlAtZ#&Znc`HS2Bxy{TuP!PV-# zm_4-E>r?Msjl_2*kd1^c6#q`4BJpihPD?95EmM_CO{;<^DJ7wbRghLt5+Nne1WYze z!!2t{KdqpgmR5j@-@1+BdXQ~2wr@KA;PGuVFx8-Yg$|x=C+hQodv6W^UVkpvl`jG$ zZU=d$*st$w`@yWX@F`lgzm#)iD9!#rwmYHh4(gI2zRxm>r0n3ozQ8966&kR&re!&x zmTSTDS{2*|eL8Drh6;S5&{#cxF=swalZvAx&v2alr?&nR$-rNW==atd8s85nemG>6?%wXS}( zxo-~v>*V9cej?Ul^>l!LgdQ=jNEAWx7}_2c8i3_#v^{DW9IJJ!ideTQ2(^9{x(x^d zp0(7_Av}0A^r)sJEIJE z-HRWD6T%vLTDxl`^&r;w=j7%{n-=`tg@8Std@rYw@2F*-GnUCr5nV#)U`k3v&MQ)K zQ}B{Cx@O^W{?aGk%W330Dt;@lBaPE>V2^Fpjz4%D*yuFq(+!RvM0f+8T_ZfN5dJar zbnip2C4|}W)N?tFdPXfXu6R+FC8@NHbg66%;bldMOf@Sg%o?pDnDwdWavJrFiroT4G-oY9P1& z2=2#Fzo^gv+)tx^QOkXxLBMI-W1h^2ux^`V)@y^)2A>_qy-)p?)2Lrm{8rqLoA!)~ zMNvPV_(es}o*K!tI9;Fg_2u2oPGk)kk-m(ndUOBF5T$yCU!! zQr>sT%WYeo{zK9n*Q))rKqz(Q;JUlc%Oa{^_Aa_~w3Y;w7_j}O(a@-6VREGyRRj*U z_Onwn!tBwOH1=dm?ZFn#wc+jO)6nHK8X6V<_0%aB*>9r+7XiWOj=Q;-9hEp;_$#m5 z793O`Hacl`n@6uMF$rfNqBfvn`1=&4SB_l%wp^`T3ZQ9RArnc|NYaKuW9V7|#?t`&qHDUHVO-!DaX`PqQx-YzyeA2p{Mp~od(XBK}a1juUZlwTAjcg^f zXFW6%+wL}hKlS@XT&B#PvF*MbZb#Xz@#zxH$mR-_<71l(CV5M9;uG3r__kw(zs@@t z+kM$a41Q3by9r!AmDW2bifK363-NFD*d~g!c7V}n1%5p4RxjLByK~jLjX^i+|7GuO zo8!inG||7pn26n$BLti8FK1%!gj;gkzQ^wNT0ZW%A3*|?>bR;{Q>>C(^Xo4XFC?l| z36#jG-Tkop(#MvS07&9VBr>1Oq^3C=7M`0D=f<~=ACvRq+~~}vR3?GsFM-J;Ob1{sdd@Hvy2Jz|%PDnN<(TE_StjegE<9 zbPRFWQckZz*A=Vz;ki7PB9j-(QwHd@#OPsNzhQOXs0!b|5o7)1>!)AFOc?}lFE8Sc z?+QQM=7q@7nN4mbfowC9wlOEPD1_Mw_5Yy!Uy->v#JL?J&*z26QE@NaCJEj;1U+zj zaqWIo;)W`VYS`;y`+bpynyM*N52P!x&y|OPK@OHlMU&fB$b9@_OgbT?Vm1icoE_Ik z8rKmO(m+fX@e}a>52*gETViba{eDTe%O~Rm8C{aX65VtQG^UR(2X%qqAKQD=8(-d8C)AjwLKA9l$-Z9PCD)?@6V#1`~wshS~7sV&~Bo0OM;K9|mPj{~d zUw!mCMo@sw=r~NKvjOsXYyfm-lix@n8H=PP&q&o)4Ut9Dpk^AaJ%@?S2FT~J0Z?%- z3?>QQIs`p1a0dSmu0~EbJUY%tUEvRdgzcO+``Y5?F4jXvh`=QC>EWdm}XxscCeE}-HD z64$|dxc;t(!2Qh-$4AiV=RzRpoK{l+e*s4cFbF99ECwYm_wB&vrNRC9T2>w7$^d&% zCH}@JuQR%YzbcnYU^=fMpT}!JX9jK=Fm?%0c7=7txY*HcN+9NIcslMKZSxxPdAtTx zeEN>|GbNB6J(b~rzXH_o@@BXzKeF+P9k~r;U;1@$4>yM3kGrFPMt1KMb^saM0^WTq2fGI~Ci%Q?krap)>aHyzo9cGvv=^MUx6s z0-8ajO-6({FaA?zmB|5g?_WE-pU(^LqvF%|FPd-e;g_L;-u*j0-y9V^Qp3vs6YRFM zf$NHL-k84_Lhp(~)$g@kvKZOP=qqyV@bR89+zLW7hXkTGR?_!Xh{Nk`XD)GD>!+NOJdvC6*y-vx19lPQ? z%IJ=&F2Ik_Jnu>VL+38~|G~8g*M6QJna<}$rqP*!nhq340vt!7o_RuOR<;DV>4ppJ z+|Pv_nJ(rp12cDCq$T#tpI7P9HPFp74{N2ovrza)OA**;-q z;XgPQ;5=rg$773m@mO?bW6hI{inAuIc|_`@ED6-4F$Fi=XtCq5#k_bdDn1=86XLD6 z)5PAn9v`#vQ3+EATE<|-CRH?2YImryTlVn3#KLyQ;(y*}5J3?(`==AL9o3lDqs#d) zuHWhIi>i4j0;`utcTtfuKs7JAi_WYwsVV~LuOtN)!V0ty>mT23Mw=>In=qOt8TBdj#NE$$$UG7v9Tbo+xhd}G3{r*s%6pk)?$Po zPNT}x9^u7W+7|kN4n^gA_)UqXYZdU_@a<~R_oj!Bsk$?$g2x3NcQl$@Dih1BSNVVRn~0iL2^dRDr_fD3Fx9iXYAy80bO)vh=f6nS^`CCNtz`Mp+(6F zgu+a?!M&61fNn7_po@x6-^tU;r%w@k=X!kD$+x_PR3IdtfXcp;*Oft9ZcsxFG9~=% zhSTZ>r0EGjv{`nP^(OTYlHal81zQ0)&<>`5r+K7yz0SAasFj0$h0IKWDEI!eBgDnL2r()?egFAJME2hVv3IV=NB5trWVle& z-A@8KvlbTm53&@-`9bN0pWx-SNSHd?R9}Sokn#DFj%gnpi*jzx=`rJCUd$Ms+2~IK zkqeU6btR0JloKe+Y6>5?_qH7~F5EHWTZm`A`)jili{0v79^5?e<_CN>WWQrW{(2*K z_w83?SL4y*!45?>HZCb(R4R-keNX`M<;v6*wude$VhNayf=&I8p(an$ZJ|%63P#iB0S0b?LPX`f zONegED{s>+nOX`gPh4}&2!98j5#-ctpM>3V4+n<;=2N%dg6nqE^>Dl1ja@e(0&@)w zr8U7>g-pa7SjjN?>G$~2@i1p#Y+f82ow=q3qeab0Rb>%Lt0*NjDN~ZMsw$c~siMTq zFe>dhcIl2|Pr(>Eqz7ZDoEKvbNe{+QNhi8csc*u#e}Kw7uxGCUKk(v$Pn-(7oU|Pr zFXBBmOR;_7e{EytG@4%YePnwWCczwZ8(q(BoRx0$yHJ-BXj90n)d)a|qfGz03{I+R z!|}4!okrYJ7*YKRhr7D;Y{@}?=||Wa?#XMhaTJ$IgHZkIb(ygO9EC*Wta&rf)xG*(7)kHHDl*pqOdJyOjZB z>EDpg29Lbq3|pG49<%IvZeILeDD9>Bi!Ny)RMWU?)rOX*uAPzq7m%D}P4$nBiS=N2fd-z(6!&_m8)MC5CCjHr& z><+5?$lW81(DyI=pseFP6a>^Q6Rds-`cc3MVxC44;`Tc*kGfXYm=Ms~@&lFeI`{@L zV_{`%_p04D+yNe>&I;Imt0)<3x)W-B3BN|+k*`&A6d00jcMt!u7bcF>7s6yQAvIuf z7`Kd4&_>!oTIjvSZZEgVwRkd1L8#KpeA8P625NAvf=+0ZStquLm{O_)Nc@D~zJ~dK z5&C4SHy~Fw)cB!B)|J-B@OBrV#Z8sm@#Ad{J|3oTrn5!Ld2A7M<}#1!I<6ZMrIeGD z=1>WgmEzVy6UrJP$=x{zrOg&8-E5Ib`UV@)r*AMhzrMjGefkEK{PpdP=hos~uS!z1 zn1EDOK!d2jffWIGfck{`j1_2-LhxgVsLB42GJ?k8`k}WwwqvI=Hp+R74Rq!-$?Gsr zGSbv(2KAN;Lh~>oNu1J#mrWDJo)gk$Y?N-s#-tsK4e8sln4Evd;*!1{dn_5ev9=^O z>_@2sjXngeYwaY^i;#Z1T=FHdsird)%6W_hbmpjR#3qUg62?G~ZlM=%np2Wg32lou ziHg|m7%y$cLg{8KOxje~kiJcY$=!ZE%uzyi7AEfBS?D{s!E7%~;x}MJZx{0ZV+TK# zpJXj;0in^h(n~8FYfCGpAIvdX%AS*h{|T;Ci$igXdv(@T6kD4#hz^Sm$^MCb7c|N% z`pYoWFRugiQS36dp2q^SN#D^R{b6OS%~P9exH(bi`qRJ2SeediDChAS(3!K6R!v+$ z&?<$p<DpR}`mtog^NV+PsF+&1;y1Qfx>cN-?=JQHqKCQHs6;6s4F1wzUx; z9)m_1)0=bdK-daSV^NVOU{TsvLe(-3{^wBaTHGIiy(e#IkKOVSnp$9{elV7LVSBn9 zF9>kc>%cJ~exfcAjUNAX@DE9C0{6!jO7{(ZoVB_boo0t9O6@hX8vo>zNJy z7>#QWl&2Fr%6Y^NbmlBiXv&>saD$C;^n?m=YFMVHM>x_feEeo7hphi5-)mj1B37 zGA4H>lreEXl#eA3OgU`W-;Vf1*TK(+g)rs@s;fi+I6Tb-|Jd81QT+jWGw#Hjsh`d| zP_YHUj<<$<2IqdUS}f_-0LG(JEJV8CI66&-M;INLom``?OmK|t!;y4lU2wXL_0deQ zMxpt50^_8SY2?ZcZTnjR^xD(9*)CReJ4n6`J`NRs!DAEjD=;{eo`6NkzUJn8t|)xP z9+Jz%@C#5P@G+O*BiZn+csOxM+({pa<$LKHzNXtncdfaYQeknn*ebTOVTB$(l9{rx zJn>==LDd~t5!9yBrFX;z>iIZ*bCQ?&(Xm<1&|mYIH0aD_OIgd~f)tDkQ>094Qqm?N zSzJ?E)kRi>9#h0-(v)r{%_RMW4e8TgC`aWy{e_A9^%o|oLcRwLq_rnS{1kQMVxyf> zczmm(y3%w9CDQQiS^=A?TZY`?LEi~PLOeqzwITYjTNB1tgTHWaU%n*pg)LrMID@0K zYg^U(MTR+~)zB{>(XDw3t{xWm4`4}r{ql!=lCR(Xcy(=(^dPL#OHCjjTLzf*?~9-D zR^V}`{iVky)wRmW_yxN0o_<2xB5KB{x(TSaN?UUMey;Xwsf4!lr(DMZ3Nf#Qj)8Zn zJPi6iWsam*vW=dJT|@9ka@lt}3DK&4{{HJ-aP^*d0y1pBX3&XS@0?e!gSW`{fj7L_ zLqB3Do;f6-ob*U*^(Y3@^Q&0P9dJkWlsR5!+41Ii<7#M6w&R#2|gV8Dv8m?P1 zm`9ZtL->B96IzTT^yls=_yMc{**r-6_#5m`@s?njWGgJ-BPqFm<$`q|2F1-(1v}v% zF-1JR=tw!Q=mgAx4e{Sg}xaE(3Y!uf<^#vS=WmMdOpc(RVsUtAm zakJe)F`{b|vL?VBboD=lebOI8?ub4)hPgLTbJIk+kJi>p6X(eoT3Zg9b~JsA(vUEf zi`Tz#Too4s)N~$OIfKXc$uIt}+im*4y?G;^X1jj9GF_uzH{DA8?9GOXbMcKLbQ5@X z(k#0@Bk&#GASlKjH=|Wp@Q9Nn1r)b&2E^oouq5UJ&a@E*l^ex2d9M7gC(ofnz68Z+ zClM6IlL>UsBoA(b*s!Xr?X@@+9{IA{DBO&-1|R8i!PK4xw*^F4t(dDUzdraI<>n*6 zRZ-wj^frmLjqKfno-xyDXXOmq*(bla9}=sMK`HJx6!w|%FsbWOw|&Aufjw}PWfg@I z7+JzgD1lKz35=4|Py!=4qXb4}v)!uydbS%n~C9pUTj)cAu@1c2k9Sq#lkLz|T%*gG&*-6lVWqBhG zJn3IhB+fAua2g@#O8p3_X3&;C`Nhvi$e>h+N(CZ1$L)#yR2iT|k;W0sps%2;tCnX? zN}@2883rM#Xc?2ZNzx)^Vc16QdwFH^rz$ty=I(!fy8U&m;60!vxcZ_y03x`-IaJuS z+_RFQbPxiWX?0`pb<*a?UK|hN1vtuJpyFRNlS*#)T8^bo2YJC6OHU|caR+d4#QBR=x!(ez1Qp~Z8w_A(bj5pezO^D_nb1e1YbSe zfWZ`%8(wyXRB=Jw8R4)4o*wP`;5ET@^neno7crFZ(1D62-GOI~m^@N=iLZnIuiHy= zRs|^^I-pa^Q(TT=J;G3AM^&~IS4nFi%RL~>-NT|Hr+(jfHQ|qsvdERW*Xw`KbM}q6 z&>~r_=m&MBil9PgXv=w|D|F_($lDwk>|v6_!OkmEh9x87RHu0rHxxk85+{a3>)l=e|=UF?7*u7HjxAMaNghuni7 z2!3*>`)=~)Vcjjeds*vS`xU_k8FUMm{->Xu{}9Id0{nnVnHUtQe~-kumj*&#ZS@s+ z2hAs_B7Q>k{Da@lV6rF-R*Ut1$AzN!b!gLheYjq!l6%Ad3GR7Ewu6VwIIHSqSC5UU zN0ud1?z@91Du(wdMTStJGw?o-vWCvg<18xU97+q-4M}STe@Y^fCq-MwtSyto-Snlh zDQlIRvNjp-IBgBZJ1XMB`?T6Zp1ID#J6>!^2I>y?u{n?Qc0O^M!|Avj%Z{ozz{nJa z!yeHM=(GH^ZIvPGLQynWT9-(Ogs~nVAZIga573UTC16YAMr>N^-lc{)I;7 zUzIn_t~U&8KJlBRla&ZI?9FMP?u|p_PI+Q)jF(s@X^M@3=5*h> z26HPHRP29#LUaix0jbnSE7ujjWQYZD44DOs^-lbMUHe7)T5L8Tc)+zEKzgO2Tufkp z83S5Gzo2!DC^*C+8YgD}aBhT7lcobWI2PMxzk1Y_GS#OyH3@_{z+2e5YFV;8xGH!r zhf?a1?Hh{*5kP=TnI$rNRz4>9O@8S${lGk;Bt&T!p#-^XBq!5GEbr9aZqF8-QgAw_ zr9bl5i(ARyt%NaDyg`^ci$=Ftg=Rm{GpJt(o9J=BTth03$_$i20-@OSntSnj)?$^I zQkhaL3Kcp-ugoJ=qB9o_t=cfm35#h((macaxSBMC@sg*s$#{{wJBe2|sj_mDDktj| zlpqNk;}&XTNE=ovi6!lORXO=|g#G5fc)VN3cpkljilKT3llZcv>w_?t2F>^^|DCQj z|9bQ^wppVJya`<+sZ;<(M7v;1__&t70O{a3oW<_H6@1yNjQWM4H9;NF` zLMYV5e{vlWJ^VDScsgJ@&@F16VfzWU&ZhHOt9g7@bY_-@Q5IG;iSt-!(X>oSMT?fu zHe_)HjdDGGJu92fTDkeGleH+yO@)2@nf7?A!>OXT4pEP8M8#0u=&TTCty5_|E)AXi zT5RiwZY#6t*WH@P!ju|yDvw`hm$$%pvfRB;I@#GA)Uh6FfGh@SIh7X~oxZ+WLB_Bq z-Y!}V>Z6Gd)SGhcj6@{}umS>YwW}Xl236E!?VdKe^oe9&?gZp-pVo9GeNdW!gRszqydJz&ji&b?PFX$j}dbx#>@TiLtQ4(Zn@)yTx^VG(dG_In}Qb zJY^38Q!B`b9LmlgjG$~$E-XA5Zh$hRD_{w)HniCp?QL7*OK8-JDKG3B);)1{}21RmrfrfcAAaS@+YThA8^rH!Oa2H!>%|zG2;8?kFw$5_#N<80 znilJSnvw=8UZ-jZulGIV0Mr~RD2W^3M*J(^Lf+1w4;;wu;|f&yNm;Xm>k#0x=j)}3 z2d1|CyYw51Us)3A1*1#8-ANTCZum>hXAM4^IQU_i${S!y8M3?%Cki_g;^dHa1XRs? zI_P&$<3Ng)i;&e0hCb^?-K+IuiVFLlcx7=^RpCw>s%*ArPQA9!=#Fvl>O5))TjmK|ET@H@ESx3oX@b7aOc; z-EWSew3i)0gX_88&mVQDh-N)NumqZ$bTl7C)4O%u(Jiy@Mv~k%_@brJq`c3jw5{>_ zOTDCZ3nc2Q5{N_dyl1mt%aKQoHgFpbV~%TP{rIzvs(*yai?TMQOX?*Lyt`-*;ez4MWQpawk?aatVqRKP11%7J;oR%WzNeuitCut$gRh0 zzH8;?yH3_)I8D^4$9!UE>9J{j2EB7@J?8A4i4G!O*M_QMMdoFSE7eA*LP@qU-n7+b zr*bA6i6p;j0;>TF6`~yoeWMCPY_PJP*-;CrYM8v?KwTJZB}t8EImI66cGd2ooaBy+ zr;_(9eKV6yS2oLTv9tBwTlpxbVufPldkzNPPXA5Ta+8#LaO95_+YTNFyl&kRFMJ>^p8=9nX%UZ%>C>)!{1*xMjBW)wDWI|8SkUKM2;?Sb`!e1_+3-Do` zx&RmZeh_(i3z<+o+5s9L#;Fbbi#|ge;Dd}TA?#s-tM6}LfqRq*ko9)3Z*cUW?SJ2& z`6-V=SmWHv6{J~&%H3^lWsi$~p#^059?5|mRGKgtA?nLOXwY&XNjbiLTx`3wT#`=V)bs&a zgmlr0D-qBPAyY?IN!Pgy&;nL10kq_>&P~^YL3diy;GY83G`NUY(@4?jng*Yl=1~|? zUXUzF8YCM`IvNg>`$kF()9!-OZy-?FkVoLiLjk|Vm*{_Na zENuy?HM;g?s^&n)=QF8a zSjkU#rc(|i+YtqOPrO0%j>db^zE`2E;q6I1W^$075+oB*%g2u@@S*bXtnijJ5rB|y1&UPdqZ<`;8sC`; z18GeH#F$RiA(AD^qzAwR$W{1+bwf_X@%vL@7u^a~{B%hlIc5Q!`%O-c2^SO!?pizD zLVC$ntH_}!IH38|LhV@7Voij~Z1{0{%68E_n5qtD3MluoP}iYzmPr}gs#*Z5Jgxnz z#S-XH?DDg{urL zFwRW98oAihjX4dqL1}IMQe;R^7bISFDhp>Fi2WxsVS*K;%fZ8nWsO-an%ID8*9kOn zT<8q_I*TTb&zxth;8{vZ6w;ieVU?0PFA`FP#*o+{_+oOklxvA91$&pbD< zRPjie{3Th`{gZ$>G#<3Ink0*B)`6yVgBnr``=&EUh!|EU#0{NHWG=$I>1Ia;A_YYuEsw48m5wlq~Dpb^$9VU^O$CTDRCc{I76+^BJSfe zH(}E7D9H&=7!<6I3Q|LX3(hKW>E>w}GAFwt4pUpLUxc`i59?LyXk}c`6mZ!T&{f3+ zdQ@> zjtIPid#qi^1}i#M3AXK4m!kpl=5io!>FRr+>P8;Jk&VmvagH+^4is@k@0x|34|zJ( zP_5?|Dyx+3ez}&~z1#2f-9y^r+J9&2w2l-kOg&&P)N!qzOu(0-bMyl?bCX9YZBn5X zc-;!K5Ap;<8j&>NVUyPx4@2hG51FkWE<(V^hxO_Qv|8_r^}{5Ny+h1ZyZ{#iGU=%V zcX5v1eE$2Z6V(ZVD>2I}6K|I{B2)ZQ<3zrOMzN^}>*e6!1V9MXTU>2K$DrhVU|>OA zegk8+*HJ(@w$)cc{F{87A(0V~s(-E9-czW7VtA;gCf~IT^2?OL8~ttuyXNoXyMfE3 zUztAl5Q;6U8^S+(wdAkD^pWz}9exaa;f6b;!yzL)K{?YOR$u`tv# z)m{%_GaGik*#IWcA}v!yTTST6jSHQjuVzu*@tI@J>NJvV60($}Mbi*kLY1PXjGMTP zBOYgNeU;n#>LOHkd|0o(LJJeieG6`jPmF(7qanE;(K?Odo{*b_}OOYtB83Cb; zVBuo53w2u>44l1;7kq?dLPNt>qks{iuzBLihl}jksTNjEm)E8X7j&Gv6Smdz+VJZ2 zzubKKh#?z$Lk>G+G7DUa&cQV{b5Uezorf98ik6YIZfa7-5tKA;l8TkQjD5H+Y+PT2 z1&$BqN8-fjc(qKZeuy_;m>bM=#{n$(3+;(53Vfm@;3M!J(3WC1vSQ)?~oIy+r(J z$RkshN!RRE8!YhiH(XItF@R2JfQ}2D0nu6XXME?bTw}e<+3?Na1kva`S!gxi~ zgl1{QJRaiGhUi7;&-kz&h;oH@sm&c{uZcc!% z?sNfawe;@i8kh~{m;~;ROvaZ#SAIUm-UuriC^sv9L(+}fbOZk1TL(veJ-mixT1VwUCFHz@>Sr0vQ zim`U!$XG_ejeY|cxF=JKrRW@RV>7chp<%^236omb3sF^)GEWL3pdQht&Dywhrc1?< zO)ZWtLoG&!b%Prf8{%ohMm!B{bO1N7Q8C@*ReKe$0}XVnlbYjo%B_Dg59kAyjMdw z0GxR;7%&v#QN=GhV66PHmINFbEm4_M9yf(~bp#sdd_8Bh@VQ%mb#2Vb14 zTyddQm~OHY{N(h9Vk@t7JsazH0tGp?f%pT|dk4P+upGqw<|lnp z{tI0U5|jafu<7AC)J@}0RodLvZLfph#GmDzN5)s6b_R#}dU!dkgGzDAL>jLtIuc^N zIWzFltXJ@n)EMNS-9l+8px5#KaLiYj;+arz85cT3_snB1qcfLfTox>)&>E;DX`Y6J zGI7%hlQxTz4C=zWFFBFTT#hcoTtV!qK6}Bn}aXip|C?%sKCiSvwewfhd zu%xA0>qvt;_*b=HndP+QvJ}r+Gq+^Il~hQ=pwWX!dSL%-3cKX03}DKdt#UO#X+LII zz7F22KdJ)mM~jfP86iJvp$Olang>N2O}pEXB`sg@PQM35lpZG4b<}=x`G&#ID}Gm8 zz9e<{wc~rrwwin>(4+XkoSFKVi=nfny!gpB0H)yMkgIQ=)@~G_3C+j5#4JV6K4yjB zn?@F&{1qOuc>o=(MZau2_)xMIsr6VN=$6SO5ku-$hr(j_(*1d@jOL%>1dvsVw!6`J zuOAT8)l*o|sL&a@dL9cJojK%XmLz2;?8KTv7)luIamz^76iF2|WyTwKmPur@prgyM zpwVHSx*8KYPghUlKf7PR&`{H_xUq3QwujquXvnze6?#$KeLWIshh$OR&~W)=C66OI z8zpA{U!6T$XA8wwoBg0n#gD7iUUAmVj}4LLzgSa$8*B6JC{U1fHi+U1t9K#Egx6N7 zQ&r^`l6=K8$@&G58Y4INNGH-IKCxPE_>OXF(CLKZXddAhotd^A+6pA3%9zlgw5bR< z`$&?osH~Hix0O51H?j%G(Paq7=&()=iV1y`cOjIGgUWeyr=u*mPhFy-%>#!PSQ3!h zs8HKPU)pqMSkn$j)w-9z@nkX-@MnGReX({*thopu4r?@__}8CM25I;QlQ1!iz~O(u zC1=L40J|R2DJ1p|RHW*JK0yEE`r!<4#pT zlG$vVy>TIEl_-xShMfn>nJ`rH-AcCNpz~G7<%0+M*y;+rawcYGVIAaz$fP#if)^fU zIRD^B2Tu=8B=qYs{Umgm7OwU7km@035Na2W6Zz70a-ot%Hk4M&;>234Wx`P}RAsX; zLobH1e3*iqQ1ToXIzvIuV_c&%wN1bBH1@b6ZN_zU z8OAj_tW!b0Sm@RvBoiC0XVl7AYvAB9C9Mf+EA_iET(Y5C6+AV? zEhQ}hC=U?nk-t)dI}so~{O;Jw&gcfvJEzoxejZbLS7nY^>EY`qT|X15c5a^~eu2yP zT9<%1Y|C;g*X()-7a#oV^>Gf`@GqF+nL?dLh0ahs^QhD4%yE_{ZCaItgL#(5oRW$c zHOaE5D9eb3IgQ=F}B zU3R^JsqWYaqX_M})67Jd|{?=u}Ko$5hqJkQGc3RC~YM ziHT%Evfip?_9z`ovMi!_PwJ+!(k;*wEfI1kjahNh-}ZVOULEeB9QIJ23CIi91!*8S z%4{?6Z9~zJ`-hz>1_$Y(pik7rV64JDToW4I|5jZ~Mq@;%lLjhlgW1sUWtVr`-7T(c zOH+wT=r1mAA>x0>rLH*Nnf@riDIdG0*qtcH&L!HrGghO60X5(KN*5csHrG6P2V%l$)#9p6)Ebi5b<(VTG3?FdcSWCcPZanZU>*gJpeU6y(0nSBnQ~l7 zMc3Fm5xJ@X|T8nzpL~%VW|CrgNtd;8CG7bnZL?JUVk4mN8Ev zMv|-*I+vyuDYLL3EQyM^X{scoxm)Mj1o-GO1bB2$Bsjq`m zne>|9hG=4(Pk){!1_()G0&>dX+Obi%l|_vPd!^?~rDVXh(J!Rh0L&no8d+5E*J}B< zenT7nKmNtENck71`j)HHZg0@nJ1*@-{ugu>04DmOW)`nfeEHxlw4D={mr#D)_J^Dh zRHc03fq3K4VJ}dx=P;*#2YsJ*_CqSv4_(WxH*?V0K?NaCJjoG7^2w^}tAZPP{c_-) z>ca_)+QrUxuL}*(v4ImO$#w@Uyj^#ED>Rw?!-+ON)6fEN)PCx*&0;_`67tT};~GAO zP>*9pLQ`1^Vo2(+A>?&{=tLZ*7^`kNeLtE<-$!Sz>O8HREF^UvLh*nkBXwI)5|>R{ zhB<5N)T0n>`hIj7`aU|WTOp#0aVx}We0@~xltMgcgK(BI=; zp6V?!Fu)X@%T`c`62unrZJ@}T{F%W{T&lTc&Cs2U8E9iv{r+KX;R9RJZUaD68vteM zDmV4v491YNYn4bA#!uC#Wgs_;wX8ZO!6v=@M-}T-&nTv{{ST%v9A640PL7qerCw=& zm@#m41jvtZb)@7`9e+J)c$8*0CEWlOIzt)FOE*AgZX1@QMOc!u0KYnK8$xNDldPa= z(H420rtZLFY^NK&ef2c!>N@8G>-MZf6?BRHMqtX4h`tj)|ee&vsrZU7Cap!IpoQoMq-s5)eW z&>!38flC_%#NKLFf*#?k@%mlC1H5`2*slrhrSK+n8FJ}Kdwx4p3x-<7I&Jf~rPR?i z8hWpbiy(OW?sYu`>1H=IFjYSYRfU-C8wdq1!7bUTYID8rq7F@r)vxtn@`$Or{r$sn z4+f<(nR>OL1mQ+|E$+Bn8m2=`!BK?`{eCX>gbMl9Q#>yN0iC(6avsG6CskI&kUdRF zox~Yw+p?m(YV$gEc2F0Z&sI;D$v{Adb*m>dk-(##rX?WYVt)06=PsOY3F&%^r*)H0 z8(|ChKTsQ8kEMqOij_2Pc5oxs{nvHdI%ay*_5W9gozP)ZG8s^zGj!OzOa^r3G|IxH zZc9=mlG_!9gtk>nvbJa&UT0~RJNpca|6}X0%VaX3!@6}CnpNP@VbhWrP_Z-GaXN&L zkSB|a9Yhw@)&~?dKw^U3OKZNB-jl&GazDfpk$ar?p@Tn+3naJ!6}bhKa`P(Kak?_x zh(_04fCxY%x$H+l&@1uZr@HHY$YrXQaKo?kuTBL?R}1|YD|k6R?AU%vaR3x<$M#gF zO(#YKKp)!)N8E zI_&R!2iIF1$#|)6Rg>ruWon|L9x!8KU$%=!u^T@v)<0Zu#>91Z-7ouE?BL)L@(tC1 z!X9aK&}(?2G22l3O_#=hD+^?Awz8WD@EA==eRzkWYhJ0` zy*g@2shS2Hyt{#M*)F#HCj|4h`=t)o-Ra_r@AR6+(S%W9$I&+W;~b1E$?$SUnOA;T z77JWx(hZ~+K19^?NM=gFiv8hVJ=+P0+(<){;Y1z9+^?6iLxL4O)fK^YJzj`=zEQ*q zMRcQmr>eG(aadK4(zv`AJFBC^@iKZz7q!L?WVxTAL+hUz22h>2HQo$p558!=fGWK(T!F0W3v#djQ(UUB-S^(H zl8>Li{PFeM+uy(a&6-q~=T=x8G^$ic2DV?e-Cu*pc~nlC-k>`PE8TKDP=BDzbVJ_1 z7P{aC;=u;n>?eIPzVLw+vhEn%>TZ?`Rq__PbHa;~1}uc-ph%K6A*Kt^>;o*QhHq)V zDwxL)M`zBmqD~r~k($CKE3R@HKPzBSN z;<(s(J;m_>^mXekl#?~P-7W<6RmY4}2}~2=7S_z2ZiJ+L7vd+nl^a8vbr`b*Q42VQ z98#Ti4-#Xi^t#=gHgq6PE*}8?Vncd#K-rY*XTNdWa9cWbbnP9(HyZkT4|eIWF1Vll zFwBF2M=r@wW0@~IuCH4@>9?uM{@86mq=J(Zo-A^69sB^TEmvUPzZm6@-+se%3ifgx z_QiDWcRY{#jn3Srr8pd2gG1!q*Uz@i$#zY4lQy^6b{jT4*>19JbF6C!>BZCr5T!4xyN|Up|KEqJs!qgaqKMdyP zt=3rVvs-j|nVCU(Cchj>%^x0q!#!Q9mLwcO?&{M0(mlLvb5BI9Q0YPGp5SFx23@Um z0NN2_q5>00}_QcVw#>A3EKPw`>*e`WDG#fHs3c?poJ*O7H{Iqvx7BUCL9&qQT z2QsIjeoAvK?(-u2Czg!-_{Fj}yel(k^>p&+Qt|Vp8L8x5fPrD4yJ*6m__WEbH%-W|Ewp zJBBv8$xjP=x4VOW0Z;G1=gFVzSJD=yTVrq+>}z7Ystu|&c}b(AO?s!eO-ngP{BECf z#>(f5Nr5i1S_1OQWQMEhk3H;Pd@(~e7)>X$XidvT{a4W#zh)ZdObq>*7qL&if+4^x zm4ztZFNV`CS^~=$NjL9Vn^F?4H((p!5hFsVjADPCYfb3nRN2Lo?TD^3Rx_q2+=DR& zNN3kH675bJ4vS-tQ|?rz++$%PBpiQQ$e2bTkoT;WNFAlp9%rKS9WmEe#WUi6)qa?< z;&s0^81$aV@iBbuE?rY+dCJe08QyIh73D7gQZAOMm+>+2vyXzmj5tVx3?aGS>krD~ zWOKEfHD{)3)ba9w1;$apM64@qrs{o>O9VonI{dwSyBd72l&l*3RTm?QV!UARdRx}G zkenU)SuhP4vmShq<*)Wx6+j#u#M zUc<0Zg9~!TDlAg0jffbwkji1vA6N5&>M<&c(sx;kpg^DBb10Wf(LOo2&v_4r5;>C~ z1v?@=nQU05oGdlvWqzV>X(`_Tjhp>byODIbDi=DH7Xd-b;(aZ~U&j ztbcB}iqW6U#w}(DPbqzIU)5Ndiz4*gEUuBf4vGuCwscIrky7+v?c{z%3&Q;p&*Hw5X$1JWoK%|F&M z_v&a!znUd-IaI+f;(P*H&7^Jwa+49veAmVo7x>|Qe6Hy8i}Jy<;U^w{yi1$e_3;;b z71cnsW{ekPQDzCB!PP$M?9Fb2#^mIPgV8)ngp-28TPjc=7$b~X4bSAhjU0UZD`2Tm zSoE`yU@f-^2M(raBu}Cf+F(?{WVXUdDQ_J9Ze;|TN?bYVCnbaSd;*u;3YWr`TK7kP zygVK#k~~l(SDUl1*pZVW?$x~^~)ItxHu`))=q;))3~Q=OG_d}pXgdZThlg5TTnHp z7N%9b2m!2o-s;L0;*E?etdVrajyOEZnfN3*=3>WjL*3(mVWqbMWI{$US^lM`mD>kU$K5EQ`OuHDNGj7DJ!-k+?ZeqlJ{)#F2Mv`>N3}xH7&hM@st1_GVW0#AaPu5*8eygk|Y| zAiUz;UB#dcWxiE;=O(!>;`7DbC%YzTyoIq@nR$1w!|XZJ<|zLe4G6L7qAru<#a3Bc zl&F@etFw~@#!x79HURy*%BF2HPc0(X_BrH|%`aLNc0Q#g(#4Lj6<;Js+x;znppJ4X z?3ApZ=?4;GOlX|6CYta+AXt~}9q<(Y+CB=KzQU_aGgXzH2tCnPdbFQ9pA#b>L#};d zGSCLMyGHhFo{}D5#J#nvnI7Lvd0Vceq|HK7pf^QB#TQegRXd{XH5=|0B6h|xLB8q| zIQ{ZzPBV(IR2kA?y4eAL8s|38_--|0lXOsYMZ4*&9EE!1X#c~ZhgQ67282hM9*BTg zsv;_b1IkhGxf&dewC``&?Nq;Srd~)#7bW6rWGcBWzP|$>2Bl=RC3~nodryn~;Q@Xz zsRU)(iNr2Pr16(lboGw$Ow(tU%ajlp9COa6ZCoE6^Ils)T_jHFI?wA6kL)khf72BIj)P$@1sEDqyQ`Tl!dSm5h)X=JVEJ6osDb&ZD9U>q zK3989P>gTfY2g1kr9d+Wwh87;*2~*rwS~2ikcAL?sB0;I@#w9Q!RxRYvn-5oxbEKB znA<$&oip^>;Icx7BbXJ!`uoY`vFzquhJT3Pl!G(Mk~$6IaLS8UJQq!yRIHy=?v~fU znIcRyj1Ww*9mg$+sC<3x-|KnWF|Dcdr@Kq_XUY1!?0U_=*%|oi@6f^F-X$lw=kI(P zA89Q37k)aH)-y?wm!kHe%xt@|cQzGXX*GdOxmNk+6h(m^M-K^BqraqlV<^j|G5ZHZ#4wyu7Bary)-6 zb?9ilgLGuthGgWt`K(q!Cur_k_WKckCO2nP?c|qQg*pt`+BjWkVy4H2zKdD!MYs4( zu;Is`6V?a)P?dVHflgta?N+?Y-C`q_VcJrJy^6D@yV|C6iTi>riyNbg`T?tjM6@IE z+E$$&kA=GjvmL1Fzxs!#6Su|+1#SmCWT%~__h<+kbrRV_g3X)F5-tcur)}6qgU#V2 zO9X((#)MlP+rj^DVp*&bb9xv8-7DDnQ!q3BjE2n$g#~%9cyw4gy!htKFsNGqz5WDy z8cimaOK(}IB46@Xi;)z0hoS-M1=n+2%4fmT5=$}%v_TSRY=C9{h`5Z;j$`qV*AYbC znQ_S}^T^9+qqbFDZ;&H*GqMmn&!x^e%B2u3uFq2PU|PYSXq6B*ZTY9sX-fn#Kj*8B z4DB_6!2*Jv^<78juhl6nhluIY+Uwt}(^|DWJ%M@(CM<1dr!b{$8hGusPgo>_wW2(G zlK$b-y_!{d#$D?20DENW@eblF0_}(bV;P$Y|;&?%YO&y$||-9 zZbk z0GX?ooVtRO)Y6M9OLXD?F*RWi=5R~+g0q=*IQT6?o7mcpy{&M?Sh)#mF+C+5g z@yTK%78Z+cgk9b8*C$JS7{*3U-E}*XCuV{jV=5YySEWAeSm!}^0g3{1CX*EGI4|oL zc&FewXnvH&$!a~;()1B!{a{@1%cs}d9idbgDg24@y*-(naY(O*-e=$t$HD~J^8 z#h&jE?rs;dntwgQOU0y8XOq%7XEWo}VUm$U_OEOM2KK!L`5Ka!%G$dKdsS|D7LaoE z-o<=-`ug<8x7vsPLw}9jDRO4(KD5inu`5$l!ubmRcF3J#xfOucpHb7UWNI*qxBSQh!i!xv{^b#b4OE-`G#0OpeR%KWf2! z6{RZJx_<6$YII4C-FujC4FGl@eQKG<6jl!oEy)LX)yl(!OCV=0z|1evu+GrF7x_u( zMl=$iA?;x`@Z<8UvG~VB8(Ay;UO`@`xsxe`Ti}Rs!V-CTkesYKxG(WixF#*XCqAHD zFqqf-k;$$Um3%vtQRmp1|3KINKYN)yL^PT{b52NxLx03Z;TTvL?$+*nmvMbjbqx_>7Np@N=yt5Bzr_$E^;AcLhObX_+{o$Z=W{Y z_7?}L!Bz@88<{z+g04wyFi0FZab8??XL~dUGKAzS1y3kKPPTy(WM6y>7m37p-{@BD zXhC+Ko$0BV(3vV>LGXmI4fvN|GP{4=>vx;|vy6SB{tOphB`FT=a4IF?G6wM*7QFJC z$*|jYgAL)Qv`cMCgWWi2Q}OyBZORDIam078KgPgh@#ux^P6s>z2c=puBKx?R>}K|9 z(8id{Mmc6v7qXUM0H=4`nXL>O`8F&|dZev0n(vXf&Mr3dFSRZXK~)S+*3;ji^h5PV zD_Wg#7Oedl{mzLPgMJSU^f05d1&!8cPrXe=gh`UyucC0M&L~WP%CwOqOW^Oa%2`#pECUGP=o**i_ciNDx3>?R7j4T|!2r-^8-z+jJ^i0~& zSOXIyY#iEDn7G#;_=v4Kf#0rg7*OAh+c1JH#p|yRtD{;1ANKSgR)EH+)D+>O(tHKN z84L94C45YNOGLPApk*mGSr02(T>yJW#474+T(d*z3?^Bga7It8HlK7j<_!!cqbH}m zyK)*f|9PH!I1+wZvF1*@wW580xb7^aF0O93cSi@mSn-dEH-RubuM%FlhTg-eJ2B%} zJ#fx<>AXh2^6(Ik$t8EG`LF?*QqY&t z`-`1zDLjVR z{c_noiy1mfu!h9yg+y`MA_&PDKPlzZDom}7RnbbPrN?!`#~Ww25UWTha$Qq!Y!lQH zai5_;eXCS?mrsPSiVE zemf%wfowTHr8&W?C+?Zea#vI`zjDNktUr7V#ClFo$J9Q1r)QliGM4)ppBxj&pN3l% zsH>`BzgInmeVos!sivh1vBcIP_*a}Hb~VSuizUkz61O+{9ah@e`rJwOTHjGqQcM!C zdNNjO_;FR<3BhLndwbcs+HbbTL*w%TNR7SN=*trN$FhZoZZ#$KzwGiHO6wMem;9uv z0Z;!2F_|0Lwe9^pd{BjwcFHXF_E)W-mOKV#I&MamM^lPOqT3Z5wv0N-H*GcyWke zQ+ZwMH%b)bP~Q}zfUgE!rSOb0{-vf>)sl(6dKf9J4FAtyZ8**3cjxbjkeem|ktyP= z`uZ(DK3z(-46PJYC5?%p!2-YJp(DuosXFFPFE}S09}dVHZZ5}k8W=^~yy)6$qqM4M zp+JudL16Sp0zkS3i1E%;FT)VXj)1sd(Rfwo1V6W6D z%mdsi4_!WwWY1_ZzC8I96R>;;RuB>p^4v#FX^#uw0xslykHnIbcy{V|&GW)}O%4tX zr3t+G43D04Fr7CF% zK@&G^&xg{PBj(kiono6Er@Gke>}6*uLvfcM>8@VaMrF<|G3jb-#LHGnFqt%Dfuch< z^O2u^WXKZWRI9pua3Cqr5MNzChB;>9$l8_z`-33|_I%&Y9Jb-Or3v282>V8G2O9&+ zK9!VH&-VKHN&~?7fI; zeerbs_Y$--H_Bt!YMD`9<&qr}l-rVU$Ir16vBtl!(`}kVxxUCrx~_;UY4u@MdiFC| z5rnz;uE=K67x+;&|2**OD#+gYcj<{y6cS4h6Vm}`6(O?7=eyH4hjnh3g>haMUK9%79=&ED?5^W+ zw-3`$d*?~9FZmPsSRY~M0)Vjrn-5N zavJZu&Bn(EnjS+388}!{$$QJkvBoJ4+XL7u@NO_%Mz>0pS!`U5H&Sn3!O$Pv@wtb_ zz7M{vBGoR|Xdmit(l3CGCP{))_W$1ZU#7>xBYv7O^A-(K!iSwan-1OW9Z0yYYn6{i zry|zD{Z!nOA(iMLK)WR#yXV)JY7K&|>J4VvJN`|sCNHgjAUFSO!$*RvGjYLKPK=AZ zFr_v@Wcq7n8h0(-eGxMT3%XxnFUX{ua%+K$bV~s$0Rq|QDjIwuQ;Eu~0hbup!i9n6 z_#a;e!mIGYrcCZF$ek;&n;3w`46)trYpmoo|dzx53 zkDl%85(0kN&FoXQS6yyTQZi9Y7-PuiXRpKefLY@GV&{6|vn@Jky-iN}iqU0W$`v|$ z3?t0?_wCWZ{QkETnqK~lrF?63zw?^+%ean~s2DxY^}fhUPrgf&YKzbzwpT}l$2fu8 z&5eYZXqNSA{NyT^-u7Yy@+35uO6EnWuAzpVb@n)Nay}=ZmX=~u(Y&tZ@sMsH3#NDn zs8@2=`{@eZEQEAZaxQX_azYsxUMIV{3%ZRumx94}{v<5v>>}xh&N5%5IRg15by@j* z4VePc=^$&rc;(U-M`vRM=noo7p=htf8;j=|@+50MN)FZkkH1>VsjFpgt91sc)@2?G z$Vp%FN0UuEqzm+^TVl&xi4pCB28Ue=hF2saN!h2#)CMz)t#`56PyoUOYqmv6Q2| zR&Jw2zI+#zS`KXqZ)IfiBV7ZL5NWFKNdMW!YCX%sXoX5QET-yr_{8ZYZyl{dN{PVz zlD|#O8GA95j+5gyvxL<`Ndmhv$bD&;(`veLJpm}cPO};e1h)`7UZ-(_f;Y{@FCilN zA=y+ei)Zp%P_-3vawu$5er%!YIm2RssxrPLy(Pwq$Sij8*iGpI1>NO;pyOm$Bjca@b7kKm+;%O;HE^OR9%3MN2QLzr2$B3ZM z_+Un5Ej)q4q=Iqwc?0bg;Fqh95v&^GER346@T*L`DZR<{PSE8MLwxSVc=MP9PUBBXV9-${Z>jIc)-Brrh1rvhy7gl2~ zz5rUs~5(QF=X)u2oS+}}!9b=ZUd;QNDyLv`A zu;;&*lbe5ccEM*`xo)Bu6xuS!3y6M0JX~^6uCuG>tcCOBy(If5f$Dx&&meYSlbvCs zsq0#$Wf46UuM#!2G%UU^wSEkT%yaSc$ zu=kZ-yh6^NKgL|H>*{0zV&0OIuC^amMz_cNxS<+@9^;juaagPplGNg?G*Vt&6*ifNUEO+VW)8%s0c3< zS|qh``$z{lpYuZ#S7?jU(bz6yMpvhsP{v#L0H=$^Ka5eDv0bBhc}%151H0@7tt^uo z0z}oW3uNbdkId2w#kqlG(2g>wN4Yww>mYMz!>%ovBNKZ|ko~8Ja7jc!m){fN*uZNPH}cX&es&I38t3VF`BIM4?wE~&6CNWR zCwnp*++LZ$-^W5{Nh}0aO+qz#Sgz$IT}V{gCUcCO5Z6crH)l!`k;8 z*7NdsC2y7b5Q2es%1APo39Da(Q7|%V5M!OrWE^@c;xHCXTjUy0{DSeP;Z~m8AZrR0F?+?P{l;U!_}3r zV2q9fK}iaU&;x+#(g_RzIAEfL@%pJRr}xF1!zYK}VH+=ZYygD7MhL(N9b^?#fQrf= zg7uqkkGI9(B$H@DqF*s=`YfS@vRRN@qLr)FN{0)x`2;`Ryy{9Su;{0_nb4>3IbDw8 z-{IR_&<%E>FT*VeOu)*?EamjAZ;Z{ihJxDZfR%6qmtP&~m{vtXhEOXU!c0NyN zSRndAhi2So6<&SB<$xBP`(1xWL0N0eW_pDRgP&y7)riyJ#vTRRBnRJeg???kFGc|P zh2)``a}4&oo&d3L3OB$eZ47XvHZ?1F%Ko%r?K9TXWj#g)6;vKMXR@)%@n+2yKH4aW zZemNXMIzB32L5a;VL?+R2R`#RQfO+yuL-+}62c1JBR2kHz1hU~3U*kt(6sv+n7@>P zWt^i(PBSyLYhGlwHJu@K>p*uC_x1sd>*nPyWX#|%DwQ>>adstyi1?7PpYtRCC*3q|upF-)^`*@-bWF%CE3j8~KP>4g z44w5jT1A9Q0;&V#4YY;oX)K_1$LkPW{uwK+4v-cB=}}I!sL|&A{R8;k1B$RQPK$$k z4v~=Jc;GtaYtGNzf`o5}MLCW;euHMq4P6D!y*m(tTxA5497u`n&P>r;(9>;Gn8Nnc z0p)TUR^wBW_bV+1@891MC5&048a*PwD16?PveT2kY7yX<;jPRlOnwJ8%aL)y7y=J< zkZE)7O6#e^Ip>D=FuSGiwo&u+OnZh{B%A3pY^FuxC0Ev%=uJPTxW<6OF6TGiI16) z5z-=#nK}%yn|%!Rn0dLAeyS?IEyc@N$5~kz$53w6j6wC+6b9WD+=>TYWX7LfuwN~_ zNeFq;AcS%{hIn9v2*WfPt?!V06M0vq$H0C?J8~NAoD=tB#+v+qwBkxH5%|MEg934< zOYo4KGNpV2`Ba?3boXLi+}P!6f-1wDZ|%h)+(L2A{!)G*e;8mFv3zzhv3wfBUiU71 z9C6=E-=74I-cw}Te2bBN9LT&Z=^lG8(^nAdz@7@)-M&-E+n{*1GNn`PVqcdH=pT1` zo|cQpzE~O})q=faB#k|q0krrGUixtg?tBh+v6k@@tJW$a6F;^S_@0#(q?w^6wceilJqR1}T9Xn<7J$CrJ3Z1))4@>+9naYKy+wkAv1Jh*YD!09N3JLv^`Q^o zdRQ-aE(C6AE(Au@fiL~hgTcNArb%?y#V6xyhy|P(!p6+!K~FHRoETKh^CNvv`xad0 zc-QNPQmGbX(|9R;ydt4TlkE$$yC|n=$Y7PokH_I-!s1oOMuoXGYhoTs}Zk8Z=`FTPqkZGowYuNEI+=OP-!( zOMl(w4u$Hip_gda zY3>omo{c>Mt&-obrJ7cv{b+eS;UZl$CmlM6}46JnxVKf zLvcYQ>0u=v;-=*q5}Wmcoztccf=SxGbIcpru^HUl|4j|`oIZY%3)vM0rr*vvkBm5RmFg)AB;_myjVKerK1!-!k0tZSwhayAdV+0LVYSodeyH-bP@ z{;kH_P0FZb76Jt5odV~|Xo~q1)wBt{={Tj-hC%tK?tKKPEHkwZemf7WU(T|11rbYn z0En=Z+tJuMclw*J8*b`H@PrQsqu*4k3(;0gk&%NOVaZS^3y_k|Q1c}mb^a76n*?3{ z8HWEa;&8kSUuu<{>W8?r%ct_(@w}#(X#as=s-4X$i-=qy;Qanmk-7`ECcV z&se}Dta*sbH{zGSJ3E71*1xZ%wtoi1)D3Z-X)L(HzEUEXZ0rZ01;Ur)ufjPhNZgrE z*RWEtz{2OC_hl*UDj|M%MQCh4yXbH z;A&Ludml1ifwGxOI_THXLBEDJEGy=gM;0UF{%{mp2H^g!DZqmz^;_~gdp^xkfe-EZ zN;uM!$>f-t;=ZkbCo#sB9qnk&$oFN$8}(qyur3nQPC5ZWvA+3I`*X6_EnfVv7<2;c zp2S*{fgiWlvS=+s<2P9n=Ru9wrkhvVb^rD^DLJLo?HF_(Kck+{$s2WQrt;u1xG1-F zv4Y0Oa|qW)29LY})W@Ra)^N!~G#+2yPA^G^6(@%vE5#K(>CYpfgeKxcBnj z(@@d-b0n-#gU*0 zy`^bJd_y?U`Ci4K`n6)FWSHi#1KDle>u)>08-@BZW|p6Pj3V5}4QI6)6N}EH659Ek zi@ebqKjHLB9Ijp^ZOtZ-p5H-+^PRQ{%@?_4hLJ@l3%~+}tRxDx5VNDk8gUP7f-)*c zJ?PnE{K|x#pEl^L)@XpTlk4m?+IO||hQq#@${OeV&hiT?CJFPB$%Rmj$uHnC!$`|w zm)@KJtFQQ4Gkuk?CP1ikXAE}sm+=Pq!vVW|AFaad+}>;W5p{5wx9nhG{ws*6S$ox>tDyBb51Kl!>X3ZiCT3=h;Z385eR$0rts0Vu}NQY-vBh{ zUn`7xg%9Qmy$F9llT%o+7k`3|#uEH~(VkS)qOi!){2w5%p$dQ)ssPYA`2&9gh&3_X_V-TSJ2I;QT_8}<`D%8j=_1xZD&7iXr-4nTW-JBE5rs}TR&Pvq1A)k z=Vy+L&d^{xwfSQV6fs@GXx(&10Jf2OX)PuwlL?jOik+*pi`nsV0kO%s6iU%jC`F0Q z?O(T0n`=}N_kboT4>3samDhY$ROQVq97?EjDJIB}?jWDfsN~;?oeM?`h6Zz}Ss#Vb z&*!|y+jzOiz=Z6yhp!GGBSitwW(tvJVO5{EXIC2JkbTIE6Nxa;9b3m;+OCAncrKjq zR>q^gxKt?}NjWB)K=8;moI4e|EUak5(qy*z8m@JyWaS?8egEpclQ22~waxH!yKVM6 z+3ZxEjhehrCB-e~Bmw8~csfBr5=-D|dZ&C^2V!dCi{pZ!%xonCD1FUF2VjsP%Jm6E z@*}&4CKQ%>JH7@L5!aQ{(p1%t=yK#cI=b`}tG3T)q;Pb@vICT$5jxS4qW=cL(R&we zu}FT&`v@@U)_lPX1;GX?ZFTIR_VU1&HkboG?PXkvom)hOIJw*B>X9qE(j@iw!FfSU8Mtf z4OEaSxS))e>7YQScN{@jKkt{9p?ltPfk%!+44~hKs_hWe+TS$X*;8`v^FC49u*8zT zcn15k9LiZMbaVqG-;!>Ju^xG3_FndG4&<4-4%_`gEQp=9LHi`%Bf-=B2rNKkhK)HF z$|!GBO)W->f7V1ipq2czzF2%R!FDV*JCP!Qs!O_YN>m8c$N49$%q<<0d4;8tcY}MMOhYJ)|V8{rCj=(5GJSi7oC5m)MGbXb7z$L8NvN46*C5p$5Bh;EyQogLWH%@5u44(ysB4+aNc@%C!u4w;#S z7sc;{Z#)b`GeYtI{UdayMv$-{Z*|qbbqLWh) zm*YXv9u7qX)KS~XT@MOJrpJ}et z9=WJjyP!f+m}(-ncbXj@${@Z_1~IZzThq{LYo&7`m#$i*qh*-a%8ZPC{!ssCgqJCJ z!#TwZ#pn?0r+cw@1Ij*Qhn0IDJb?o<#{re)@8L@PsAaw&mL2`_mdJseMQ=?dfl!uex2s!QxTG-0}V(K><9ev#n`` z2faF6D6TT1Yi(wPL4I0o(qoiOUoD;;^*Nw5{9}nB{NsFIVyZaIEaU2&-%^7`$ns8q zpMQ$GWhL)lw`PTEdxc|h@nwrQ<%`gmp)B#=n-85d43idgx96n$LylZU3@N))dClc) zp>lNtX*wce0NZkuoP*)9cRKN0v``)ijtQ6q>gzO(N76MQt;)<>opgT8F%5&U+Vls(#GR#* zsY*P#ta7~nc>{5%{>4COTwnhs#%zVoC?%3T?%lz5M~KW z6N2z^0;G%eF)9mJWt;umlr5=TmNhB#VB9d&pq0?n5ZG;R&Ccw~Osidn#Y(NfQZz@|$3cO{QZC z#{nBLCYSW@y5r=9@(lsETic=M;BDvw?sj()VUVj+v^weiY)kv}UxVy&+r^R((kS73 zZ}y6J@`yr60~^yB?AK#&bkNUZaW zv=?Xw7HY>q*~QeLm2;%$2&>VlWn@<=r<83lb@k%2(ipGfz)h%-0syXCGE$wDp*a z&n@5PA@9_o!|o9Hz(XSw=cg^?keqno#Jm`f5qqtaE_-}Do(ZK)yToTn@9E?x2+z5* zkE|ES2OjvWA|1{7zz(rk4ubS&{|QlM{`%W;a*9s>8j<@8CX4oe6RGD9Owa;A0sV&5 zt8miLJYv!eWMeiSau>aL~f-y2ftSTSR{ETZf(f#ClNI>4tbJdm76 zEt0sy2ZdHT_L%4XTof1{t#Qp^dxLR<6ULbdL2~*5069G6YoyW$u^$##!+{HY=f?vm z!9xSF{ad%}Fe|`j^6E3%jVr45{|g<@ic-~A{cnF%io)|uA(LaM~9N)4%rJ{-3tm5&s zX6M8Hu#RC!I$c=SxViQ~gmz%$l|SblV)T(s1R|a!2wDQlc_NQGdQyZ71aTM3)Qb6t z1!nnjJ+!{>C(l_be4b}<$m`?4%YFa2?nnPZ-VJ8_r|;-Xuke65+=zTBfS(kwlljw! zVr$aruh(8d+nIVXOuCL$T!l?)=PHj!@C#jNEgdrtY-`-*OH5+6h->PcocIGg-V_(# z5uG<*zGa>ut|WsCoNf?19@7#RCuLX=PARzZ<4?5h-+4s2GOW6&tLb8 z%NkzVhD=#P<6D0OH3ZF_3Kgk(^c>{SljO+c5A7vU(?7=GpHDFy!)xiKg^eeS8BnF= z>x$Gc$FqX)8MBe;1wH73ln)VVUq2_P(wQ3r5#C5da%Do35nXO*tPyQr@@&Nr2LJo| z8?~gm%>P$xvG?b1CZ0Yoact)#h4M^I^EE~4%oNG&1A?CNrJ;5KB?oI(m`WY-`>SV9 z?phlSC2CqtKdlxu!)|c`)oAVZ-PV$u{Ejiaj>W*cx?CwR6z6#!dDOgz+2 zWt(cMaW0+;uj$7aI)Ci~AMZ99I>FXksZ^l^jIZ*XWO@SV{PhWvXari%pV#lc0=qTx z-ujUq7HHq7uy)9T%KBIvP8HiepPRcgOkT3YBz`JUE0#gtcoy440D3Cfj2!j=$jwL&*6%n~T?NTLqx~wa@--=1%7t7?@KpnqR3^9FHL~7%T|U zN&69#UaoRt$>gC)?5h*>Go|V2`F23Ya@EQiC3SojPlKoqY$`z^CXjWGJ9iv^rlqp!Qc>*+up)qxO@XS<7@=?RZ zi&^20!&H?~Ng>%Ino^NiFk@m#a6nH|eVJ}q(h~l##vS?6KNR%<3s$+z47x=bY#Qez znb&j*M4fJAoaznQkfDgT5GiUzG?c*ltCEZj?f z!&xtj8!g7j60Z!NB&DDpr$wC&Q?BOKMf1IAA4{@i`b0XekP*Ng79D~;gu-||IkhAJ zqY*3NNpenK?onpWd)vXmwehw~@al_I!F4FS!JhZg63Qy90=Em1`B~_VpYl{RxKbh< zO-cwmoX#x}loy0Ehpt^lf99<_iIZg;+xpS2`eo!OKb0LjjZW>0UI42(z$Y8%H^VIe zl?gbp{QwvgD55A3Teu!uOf1AtIB&27KC)9NINTX~84HEEMmx6`RZc(zgtHK^Yd;uL zMqt%b7A_3SBi@)l7tdBkAKf=~g;y(9rKx_Xv{tUJb>4~_sS05(xhd=dSx#o8RVA>M z&4`C&R-bG6MC-;3R5mqDilhxc%#Ej}`S~%AILJ0<%t#iP_uHd@3 zK&-SytNM%nRp)BXADKpmyPSlOf7oiD_7u2Pf0cf+Bp4Q<&JG*w8+e5aNTv1+J+xC6 zBMX)ZdYy|`ETd=AOa;h)P7$ul-t=R_Ez#7&Pu0>(XP>#!>AJU?EQ8)&5qkUQ9QH3M(_-+i$#gZVOqXoGyqcFAA2zNh5ldI|lsrG-g~ z`nMU~8+m$uQ369$aD(1u+QCd#iBP6l0uSNlB1ud#p42ULH%yb$I8Pr|0mlL99CTxH zCg$D%#$qW#^^H04~EUc6T z)>Y>mhF~7u9jZRkJq(-UxM{V)-`SbGaibh#L5?hSyx5PBL^{!-0x_Eqa@`y0rFVn%OW#@~Z|Aova4I%1l{k7wWP720}sq=zG=FDQ-p=FFwXw{07!XzcCkrm~S z5%~V&{m!?$f28qNZ3Xe0MkJi{Vmh<%d*JJN4l$ylV$!7+M7bQnpEr${vzVE$DW?8V z>AxyHx(ioA=wgPuW0tc0YENwcQ@LSH3rYVZb*)LjpS*j)$ZbcW;+)3I!MR8aHhdqO zKQrIglOtDc`z_~}oy&KP--;4h&bjsU2hT~r-8pc5uR10RtPx*H)Y4x^yLoxoEuw$U z#WRGewW0Ms2oT6C2VzySSO=+hOpzSK{!3df#gR9S2-R~3A zZ}71CMrn%gGxOEWcyXU=P$XYe)mgIVU9b}GO@0@7uw}l~u3AXNvS(rD{st$zWc>%R zoPWLDH7a6ca{1f5kl$V+;pA_I|Aey2`D!*Boof4876yTwqlf^VDQp0c%QQJDKf13m zVqdO$2alz!l*VrX9nV9L$6yv%cJmp~arFBa%h7KrNm3x^9oR}M{z&_lAHT!Vm9k09 zZIcb?&xhRfxMa38&^O;mm*46Q|AXUIVV{dpE7~6bR4Of%{OG}?}IG`(7WxE>V--DE=R zA!7`#u$m0!-se9}&LV?&e;YCe=e7X{{dsEVUj7U3>a>}T@b958rGB#iZ50fQ!U;Vo> z!NCv-hCvvp!6P$F`(VqazO;JHGa|>yuFrF!~AhZ0#thUce(#Z3*PU@HclIxhf`!Q=+ zu??CKEFlnvjZ73fTSgD+lZ8x*wL*Qe@kk9bVgPOlK&*}xFVaSpq|8{3eKw+M9;ss* zO3Y~}G0TWxks0~hO@4e!8}OR)gLrri^qr;lH;a|^3|b?gxXN37c?vj3)k)ojmi^qscp%Y}86Sa$JS zip#;yep7qbnk@8w8s@sQsKvX|UNg_J=PDc|DAy(gQ&~WrLOglX2^J=?1UB%x44#5j zM_Y=`jGQzdQ9!~TBL<`jfB`*kB6%W3oPkVJnoAcZ7=;;z8`ULSeD`}Rov9WF2wyljf$;P&A z+qP}n-q^P7n(W3c1XOvDB_afU+aN^GFQl3xz4H z7{2m_RYA|&f$CoaS%HI6P6yN{;mP{t)k7edW>b}ffzp4BAlSUn54BuEqFavv8NTR`ftXx!oUosF7Mmh;q>nJZQ?XEh}CM&`Lm=Oc| zai#+CtaK#bmRGM!phJ#PI!XWngTcGit6huTL-$iNuItU^rkh=((6MMAhrqBN7IV9O z2+?PWr6mS-rHI?f!j(KonN1{WyS6~{v|z8%u<+3@jslWL74PwB{SM5^pbR)zVQ1Vj zQj3l!=w#f-rSO)xs46K7jCDtO?LGgNFk*GH z48uL=VR_bZ?TVnATJ5c63CH`o>hr#X1e%LXG@9G8({}>s*&OdKr-H9eHqKd{grlZW zH0B0~ou*L1H-?>D-;0*x5di=Q$56Xsb7I4`9J4B_j@H8jVM`X+7=7_R>2>-Id)?XG1&@BuBMNen57NzcM#7ke zJP$Cg{QA4X*ts2&AGjmVgH)AhrLfV+s3ybW8Bv_EOY_6pd9qU1k**%8NY=|7DBu|L z3l03J@B4R8!Ms%WVeSdmq`|ggAtHp$sJk07o1rnoKFB()Utj4!V7jcla>cCL-Xn)y zFx@P>UBD1j3O35-fb9U2C&eX7%;_dMgP}xKfwiegEz-v%hX>o_sX0TPO%+O9oOrw^ zPT4Cqp&?~Y%{XOeCPoQhA|PcAr&5CW250W54By?t^cs;y)gyEtM(dJK1~I+;>B-*V zr5J>kc!U`F%(7Keh8aHV$d>rb--l z!hixs$&#QNfK4XI%-|FqgWHdk_zNpsxuj*7RthTdytjao>L0VLGCd!Ktjj64_rx5) z@`grc1+&I3BMIv(>I%CBv_Ey;ZG}8T*QXaaZ-P4*vic$ek+Th~hox@`6a*dK_+BZL zAKEPiE4#D*f)HR31VAyaqBd-13v;v!V~z*-_n5+k`^yzK!1dhagD!!b-;;nXRNEJJ z=LH)9ukQ!`z|q<}V$Qx(dwUjW{q7zQ0w;^-5Nbypqc0xxSWMm=Yu~zl1!(DmgLilz zJwF00jP< z|3e@Q9377C*RSZN(TBYG;l?+l)~NYH@acLxXHn@zMm97GyE^E1DVEeCQEjlf`lk!^ zt7Iq#z&SrghUci5tVJdncU=^{x~RX<#-tTX&zy39bt6dC@ndnI((ycJa+sf^s9k}9 z(Hua4lkb81IkG^(+RD;TeLvjZQuAy=4%2dPJ$XrfMVIyy2i^Q2|*88c$30V0d6 zrW@uzW{u9dU!Eb3YXaCxJ(n8(jh&evHG5Wfe~e(@IcD$!LF_-~?e%b0AaRLGTF{*7 zG=5<$Q|L(+0WBSg_CJQ%u`>`y#Y|CCs!V_z*sCX2P*Rl}YbDT9Hxx~&WT0Os{hNw` zGF8Ar5>Mt)@+1EPc(HT8PtD9 zph+@P{&+0Vf_6Hxf^<{WTL4Uh)9FYxz;#hm2TD5mMoo-}su34EN>bhe`?!EsgsA*O zkiF4pX-#FM0&uRL=G*I2JeEL|Y$5JSp5~jMqL-E_fN3?mRziG|HydlpJpFbSf1wwB zci@8(t?%#IPg8;6DaWY7S3V)gT&e)C*k=K)g$*q4RsTWg%%ssh*+#Wuv+crINoy2} z5EYt>bPBNX_{*D#fh8d!f3LMHr4^T@MwSmvBPDGlzt1_D$Silj_*muY@|V|hVvG~8 zjktLyEF-aP;{wp0{N;{Vgo9SpS|~3Y}kg875G0NzeCgyp3R?G={aHJ zamgGIN3$HY&c#*!l#^145lj76#6H1NJvp-BX)0X6LPz1m(Sk&npw8(}Y|cBn+^s&Wd#lnvlL+{jKm>xr@w5?QRJ zJ!WIoG0TZj#Fu57zcGYPXNKMl6h&PNGa{}=)N;3CokLxas;!gaN<_WU#}5H5r(;bK zqEhASzQx52^Q5Uo6EZ@~IpINMSjOd@O^P;<){ae?kMr#3h?(!!r~p>Yk59Mq4Mvx` zgw=Nx(;4AKf<3(lFw~B9GDz~FeMUD4q{K~?m7ZA4tAANl^PZqLm|h2R$k?y2Pe>>w zzNczf1ljj#WVPbZ9>LrIR3 zqts82XV)o79g&iRoSi>b$2yHh>cJy4q-*O7t*W*6?B#)BfF4fRTH?c(I&}*ib3?`j?zu{_ASpn$@yw^j&YM#k#7S|k?mpie0 z1b!`_g4@AZI6oV#OSD=tEy+nH`!M3<5coF+C{$LrBfDAoz0tQ_UG> z@jCY{NNeMfM4yXMEFxi&KgBt%3?eZVR3Zjw`v{wm#D%7W+7I2hv42Ua8#9_G3Oce} zzCxDz$-j#qC<1C#D<`n*eerA=ic6c_UwKodxl8VN)&-nfpYL9^>ds6(uR-xss4Ki5 zvRYQX-e8K6A-88)f}i`XEwFO(A%I`jy;W24w0c|sX_Gq*@CA5tw3hI|Et+*|v(069 z$J1c$#Ut}!2KB(7fN~>epkH3@y|uP;f9yg2z?9Mtj^TBJPp_O?u>t0|pq$_;S+Ekib%g-@*2`5M~##^adzsSADys@&h(F z4eesDUh~}0ZtkoEGFo`>%A`KTN0~1UcvGB5(3G!?Jw4WNX?siRj@PfCduKzOGF8FW z5AJV%R;SKnF!qv8gSYMbY4d{dnO^~fuHVv%98I3#WWts+M|FnWA~>6jVU4b3HzP%B zhk<%wc-ngnWC1)2g*s+jX;1*b1j^%OK#hvgxuax2)sdPQh*F$!C=kqwV@*(^5-k9_ z;%aCR>F2_i;6t7;`@IBe3?P+K0RgNq!G_XEd6&H>k#4Of4)GHCvKbOMz{2R@d{!Xu z`euJy%i8x8zi%bQN2EOnF2_f15IdUspKA_Y=Gn(c=)|&mv2I^5c{L3^`iBT`{f&~|FEvOTa{21Gh;5Aux4|(9 zbVkf6_M}shKkkGafai2?P1vb3Uf8n0at7}R|9qE#m23w$xHR||tYJp}|V-VkEe104aThpy=Sd^DFa!r+|g_wN27t`;4t#Nec5VDV>`14x> zQ@a`GX@r2Ev)QU~7qXM%&@$T!$g<(yJUCzA>$ebFjy;;{_B)-Z)1#S5@nS+C2jeL_ zuG*DLtP)`8@v!jNoxpE;T2aIyrTzq+(?dRh2rw+*^W zUXPurjjv)XK^0sJ*B8>{_u63LNvcUbCagKfA9w5Skgc@{@EeA}T8HuH)E)0DMen2n znNVT^XB@P}gX>%iMXcZYd*&IIdKa+EZe4gVQI?o+Y1gsX3`vEZaoKllwyUnE@}n3D zz<)+(#O<)5Ltk!rDy!<}5$Kti2A!cqZz-<)pa2yZl1#A_egID%uk>UADQ|4DCDuch zYQChTY$fmbLPeB_t9{_WF*NG+;q@TV{xSphTm8EZb)}*G^g9p8C5uw%vgJDnjVPP{xTA8Zt`^XwZ$c-XW=JRc#kK0S(`i7QQTyg;gr>e z-`v{AQqPcV=9t6iYWMY{2v8PP={9QING4l8*3{)8P zPIs51R7;Dyb$3lVe@U*ATyj`AF)o%VLH8=9J`9wej$xrtDFhKRCr8b7#7H7B883>( zFFEJaZiy&TU)`F!7u=Rh%+eMLRs1JZCxSOQ49yOT}Wu1vfDdS$SHoA_@FpDRYw`Xof ztT9WA4~w8Kr(EQM*&4BhG?+vIH{b&t4g%OZyxXs_u|oyK`abSY@5FZQ+-5bdxruq{ zg;pdPJzh^Ft&ky5i^mxM68spsul+yZuVXXW+x(-*Y7Vppf&Y!J)Z%-{L*bVMSpz=q zfMQ9j$e5|WImf%t7q}W)Ls6(`4B<)5Q|C?6WUi@TbXRrO?ge#p6(`+_H%Q3CkNu(U zu06CGwai1i^Dv7upoFSZ%pSV)*Li&O6<5(7OEhB}OeqNPqUa))e~quTBagY=R$}Oe zpBQp8k)w~PEWF^T0yaXix&kSM^;hP5ln*hXx>b4U5Yf1R5LpU(2tM~YE}nE>W*PK= z7@XfeUDD`sAD)-Jp7&#_Z96cg6*tr2KGhvOy*tTuZAln@aT;>u%n2{sOGC#x3Q5gs0v+S_@2zkce(~EwzZx4bI}Y zWJkl|G`=ucbo;t^MiJyVSexZsGf)e)Yo*C}CQl1v4(3J~o9tH>A~=DEZOxDS3ocAU z#-hO1x#}&}a&!;!!-y;AjMC>nKcnoN3mXKhwpr^MuT^)=#N8?_X~)F+%G6^2VVFJLj5H%QPcqx z;RQ-^F*z3H5X~WXRrF@3mA_P1abE5Pal93#$ot+CzhsRJ@nv}eZ=g!e z9sZK3bWmc44W@j1u*n}GM!Ue44_UM8+vS@_MAJ5ypIK#ciUf>#GnFb+U*(0+N*%z_ zn4yntBb`iVti!IMW=R<4GWQh>=xS-vzrDUT5 zGj?ziy@%ilXHFc+Op6(B-w#bkNnxyPTr?3`S2m$lvKh#exd}jH6M#k#4*(5UvqF20 z>nv6XFpIV*{|qVXYAh>m{Ekd|o&E|}#ugnlgkN@Yr8G$_r!au65E>|xJ0=NI8AC3J z(N@wpZ$J} zAUK!J2uw6^))pENSaW9Fb34MGQArVu-$7LT6dH>{3y-5hVh%?WEJR+d0S|9r#3&CV zb#^_@H~0(s$O`D}KTGQOoo zY4zf=am56|dkI3EQ5-C(oPgfEzH#I(JJCQbSrwVGY)@ajFj{0_1$x7}i44GG_brL2 zFH>ufAoUVM;uJJGnPoWGS0l!_x5FB?2r_lho`cq`mqP{^4VXxgPy^##F$6raxQ7+Cv-F=#-(*BiGou0pMerC7D|r2oUC_0Re+A^dPkN+*fV_}59{t2ehl zZ+dQl*a^@Yi4SWWfjG^tO+yY|Fmz}uWN5VwQL}cXUo|e_;p?OW`18>lLnBw_W=w54 zQf*IEB6g82KCTRDkiYa1j)8X9oo02u6x+$~tfUx@QBA5NYlUVYd2em+dwviq@H23? z^VF%wpCW+Q-VwYyP_6V~HX^7nwA9%0sADS;XmM~t zHFjDnv3<=y?4s47zn2?yO*H>)HIa5dtQq`Vcnqf(DK7gmZFzlgoIyw|=hkwXx!gq( z@N)69n6#9NvWL5qc55-Y>8!vUErGebzF?g+OO{qfPeRfvnrNMQ2pZEF(o7nLp5*Ic zYc7pYnG4qAdBo*Y)8S5XXY}<_gBW#Q$(U%r>|}5{_rA-_)1!(K(5ht6E(?OXaC*qb z*~E<1N@ECVTN5MfZ5)PpAIxm3)o#YKY;kTS(m5md-(R^9{r5K^7Ck$#XpJ-%SZYIL z4QE<>&0|s^Dzm6C(IL1W+7oPWoW@^-Oc)$qYJ4J%lsBIXjVOz%eJ^R*b0m^Z%P;>eUNl2yR+UGlO4JpC5>Z;k~jX`Q@tO#!ZTFr8p>P-y<@h`0iz67y<@(PA=M66{E9j>0Dt7k zzm?RKgHcN9Iu;u*IDnB{Qj{<9vth5oBed;EsbMB1U8OWR7uuM+R7)g{oHHkN#Qml*Q*6YYMq#-{=g z!9WhsYt)3%p{RS*Kh_NT1H2NeTvsxx5@K*m(NVai1mCT0?O)Z z?FWSUcB^1;U&nMrHHi}wD4~ji)X#e-x+bL5kD)6?@gx2@vTCiC_+qca)|e)oDHL?? z8s-EKi+I|D!Ow@9#dSco>&$*q0u9GRmGAT;FW?PDWzTRyQ+uam#o=@kJOs^ywc9gnb^x zAI8}D??4?=)IUo!WptnSgFnZCMv4wBCOa+GF$Nnx0-z20x=@F*e%(MazEeu;m9kP( zBNyA3>8y1rH~Ni9DUDInpA$=KuK!>8C zN3fPFY=sBE^1)IQlPgOTtJ@1tmXWGu9g&u!U`G}e6o*EmtXXB9idx~S&XQ&oh)E&z zQITKtpWVqZ+oktjy@U(&{&42asaBr8iwAG~!`N9XK>8Jj$%uVgYKqH&s-j}X42UJC zWvGpS6KED0P}AtecU9#r3Cc^2iv(wKo`{iQ(Mg-CF<`HGC7+6Vp{dTM?xB4xMNAPw zL^mL;UMYf_OxNsr!PlRg2PI1ws%yLGoP0E&8J3bW8M_QL)w2YlOjh~&GmGYG2r4Vj z=Jm$Y>{>M}Z3{l|jK?-@rmL-k6Qr{ol^0uFYi!V!xq#u7usoS&G&aScpqm!6G-ipjYmjiunPce8 zGBFBKVdJwe70WC~$CZopIFBLdn4Ly!3n%Y<9VhIbZoAe z6wmHpoOTHWxA?>0{h50(!{NUxJovpl61F&3u3@W(;puqF&wcIn+tT?-_Gzo)Ben;& zjvoB>-q^0CJHy%lDie4m`%B^vyMBseA?y_x!_whWHBp^!P08!^8aQf#yEiCmPHNwZ z%7p;qPR`EtM0Ws0$;ABiqk_a$$A&8?e3)Jiq*b%w%TG(3#Y`s`!4g00w|V_{YAP_> zsKu&no|fbzT)JnS1lwFUbkPQiRw_84pq7Ye`rvmMT*K9tW2~H2xV)&9&=W4pOWsft z=y8sDQOfv#wA;W+I-lREUCoX*&ICs6*^N}7d(1PM5!b@O^D2KmSo5I$1<4Rb6beR2 z^D|kBy^A35NT42FUjXB#x|$IkYp3#95pm!Jh9S>yl9p0KPdW|b23vGQ>O?YDQ7J%C zQc>g^C4?zX!SyRMZ$kZSm^PneH~l6IVXv@(ZHO26f-<%cN(ia!w%Fja6u1@mIM&%U zYn`m7&vx9oNs~+5+QK9a7=fg$2qxdSb7Fe4S4?2_gX%n%gB9$X+{nG7% zw`iUJ-7#;bq6vVh34oc0R1M+?giWCq*FU`d*`;Em`ck}Abp%SN2bP*!Lm#l?cr_Po?LFBau|)I#^s zw&O1ht(vG!Nnp^9lX7moV+<`}!QJbQa}Smv)Ok*DLAcLpdvS<8QAG@`bUMvh8gYi2 zZ>Ii0;B`o}5+(?YBP>%sN4(^F#*M8g9w+t?iT@XjzTj3QuPede z5c>xiKhg*Ik|Uh5;{F7%WV*OVKf}iz(^S6oo?Y>>f$Yw-&VzoBrjS#1R1NPK!LEof zM9zr+xWrCsh)+FEsRq<~m}R!Q>Gvg~ShX!d-<;uZ@WQ4G-vY) zML{Y3%HxdjU~q_62MGd*7^*CEfIHJ|>Yyo)1W||ygsm+6T~|(8%UBd+GFYp)8d(1{qkC3L?WSeHSSMzLT zAFwsw_Z$ld16{6;CzuH_6y15mkh^Aj@u<14NaF|=2m$N}MlNLj2wat9Yv}btGYIpY zCz?e0Ic)xEc=<}o@eT4zxr$uH3IWbWYvkKQ6vW$k9x?s*aQpD|7bEvVA|BK{dD2yX zfGz;FuGK@q+em8GA6FpA!He=R^7q!M^$go}z^l=2Y;d?>S`w||17Zk%%e?Q=3ZJ_f zcgIZea*)Y_PS?%rqcj`C7Kr}*(0>P&O<6l8obIgj498{id$oXU*eS4w zR~r7iQaIZ}S3a;FsH{&E><}b_C{t05+8bE2PE(M~UgX@c-hgv16Y{iv{eI&u7GQFh zSBLOKHMpA9W}yX6SXFh6-9hzPs-j;2wOgDb34R^QZ4f$<7>%~2Xzi}QDA8`YI5Mf{ z{Q1D@YHIZ5RS{6Fndzm;5>ANdQe?TbQCoaDzY)6X^eIsTq^C{xaJ-M(M~e)_2-XQ- z2{gtf5u=HoY`uteZ0)wR)7*u((Uj#F_3;IE226JJ|MxS|qXyLz&?OJ8W_u;!W`H1} zX*WXjqsK5}@iD%!w3QC=aeY#)?)}WUZ5kmY!qUvd>t<3q>uTCR>beTT6ATmx2vDg_ z5%zgGL}l6IOQTm_{n1ei`X^bP4lO5zq^urHOWQc5TgBdzPH-2VMgV|r=XcTOLI{+4 zzlbhE7JqzWi$|=1Of8e)$HvNtT{ihXp`Z4ZM}J{O9qTWLXv~tYpl{c0M$^K`uc$w3 zOe$*m<5*^G?SpxGZx|QCk6O_dOfUVFUlFp{Y*njqc@1$Y-EXY20+Twqb#V?yJN!!4 zYY_LZ?6O0f!wUy$v7FVVoMp>aTj6*M`}=G*lK$OtiyB3f-9f-=o|UDVy3rdW+oxzpgO7i5P70Y%c_WZUE}uBK-^m3 zmd?4U{kB??_UdM8akhEydttWli_;FR?8zBjd8wJ@A&wusubDIE;x|K0R9EX;;Rab( zMcB^pJf`!T?34L`UK6q68cIvU!=uDQU%LlqEjAbPr!jIIUyEDbEX6*{ z$n>GrQ?a}L89v%1<%X&tj;q)n@Pyi^k93`%2&!WODr67R&j4-pC=tHlrRI`3FCdjl z7ePCqCRWojCQVj~H&#j*otoBFu!=$U@Ex5|rP!t9a%wZ7)|uc?;Y(_|AkMS+ko!>l zuyI8{9d|I{>E(Mr|Ij?ecIL3qS_S@w>F(6WO9k|WbqY{qu2qgv_#9UXL{55dqWisr zmCvhj;h9wNR7d)0fA*>S{j0z#S2>U z=u!HD)%yarn%8OBOZ6w?AF+$UgsVmOXaA+BjQ5ehS$>i4?aq4iGk6G#jrOBM8-x$Z zTdUYYwOoACQj1N5yVIB+Znrx{N9jXmg8L`A(;=yXh1L+;yjonjpYm9gQoURmy^uBmL77reyr^E6&KYnb{CbP|HP^{`2nsY*1~KXY&;fqhcd7R0RFp!LwVI zL5k1zkK}*r;3vmPn3YKpdKoC{3vW{6ygmsEpNhZX;rm-7*|2g1LMShDmU1foxZ@_& z#c<{`Pe_s_#EB9ois4VPrd<2U7$(Lhpv1=l?y^Y1_qGVXH+7>~)OP`nS=n+j4&M2)XV0GX?Xmiqh_{emcrFhlP-xyN3|E#-3X7|8d zFid)0*5bVeyIM8tO`z!WH~`O)Ig*qWHWGB64#V--@d>-i zDvmgLeeYf8?$f12-VL6$n=IthD6I4#j;gjX|a$x{lh7Gdgf;TF#>b zddHnQ5iZWl;47KpKnghhE2#KLKBGQf(-&hwF|}S#k=jD z!Ul$ke*x0?3y=mp?t*KWzXHiro?)lYdL_e%f(RVGHM!bgezrVYsAHJ%3SeYBA5OVl z-9d2w^x8K@6&c5~ob4=$tYb!xWDq*L+)X_iL}v@)RZr{t_LKV8u|OxZADX3~wQS9)DRG@NiKXr)3ydd%@|`Uoiu;r7mb5z-nU){bRA*1F&%^e7&x~IF z%v384{{Rtes+zowQFjIz^oG-rj(O00$NO!C(^FYRDyW(E1 zjagm39hSWEU$`fIhG>G$TF)GpdnE<6l~EPS*0Y2yDj3m(RNKOs_t4V}sJR2nBs# z5x-4#P)tIlOiOBVvR-zbL|(!I9ApkMwqL^kp_s0q?4^+S)=}&O)dt_;s8AuLU(RJZ zy;ZmAx}ETF$Lj2(2ynX1wVE$1;+ZwA)`Xxoe6JyTiqrmy;Rl_GBrce6pBczP!M2zG zy~^Q26Xa*XdCh8Su^@XIZbn{~Q?4jpS&Iu~EW3=sBmthSIa9XSa9oKnBylBmkTQ|&=#tZN=t9y1(eB6V%#>~)kmiAEzK`!vWm+KEWl}DziuIXtK_I0dRPn~iG#c9K zMaa%_36fkO=^02BW8PX4))NSPNXC#$ENEqB=~ zp2h>TG=Ld~9AdwnH69>gKhw*>#y?Uf2`v~Np&oF2^~_iae2skwXY;NA8}GBUX81W> z_s4E8Yl{2vqxGxd%V7I@{SvJK@vRTpXX8zC=SX$yY-LHD*m-*XWaJ@AgDMib@~>D(MaKMcl#W!esa8dl=v8c=ug11iUu`aTqP^UibdwUy<%fc-^RwO{KC(@ z`@B237Qk`w?}F)_E1rkLe41r^pE?q8iPf*9)8LrQZCtaY)3|`O>pa_u&&M;~jd(^) zs*~j%m(!oB81~-o&Zjd^`ZadPI4(VgZ33@Lg4r86chl3MiI{9jG; z+`WjM{t}7Ar??BZE@%eZG1A%?nGM9&A1LZR`MMCj56w5HcoE6qSQS0Tf*?=kq zRiy>eq}6N`onLB=iZrtzOc!FYkRfhUw%$bQL97KZm#9^ly!&#s8R1G7Dlqa5d&=TV zP39YxFg5EsdECOZ^>Q5!up|ORO7@l#D1UFU_W|LeG>zU%KvgM{V_d^3P>{{L4@Z0L zD`a5>Y`@O+`3cs$2pfS{5u>xsSL@^_TIzO4`7R!d&ZF2D09Y^|>=2oCnlTb0JdE2Z zBMat|%JcX;dl0H-+mCkj@1xEdnzr7H6v^Pg-+OVw7?1Cxs|!NvLJ&SO?u>(=UNV6U z6T2+_*Wp}bIRZQmepjQ7T&Aa+XBcw1EoYfckslAA?=+zT--pZi(=oogiECx0zb{kU z`Zqdb2eT6I69*QiflB-pj?Z;)*tSE`x)j1;YinK?x!VnFz43EC2U_27-?5E97rZb( zAHKfd1WNdozB7frrbVBlzC*r5+S$Au!cow)nr;xZI8UH4|dd-l1 zrFopKd$3@B16bZ6d@&y{KR;M5uD7vOAMDJau09_1#t_%(!q)Z+T1=VBl@6|=1WdoY zQ$-R{K(eP^qco374vN|F82FIz5CP|jU>ZM%UkUP^qL3q}!yEK? zr0CJ^tup;mr%h^yp;50*zf~p0@~{b~+fGWC4sBB{i0P}h6cvxr(Zih9=YpEPhRI@q zW{2XNH&Lzgk*j1DD;pPnlhpx@bA_s#*J22iX=xCzwX1Q*a{ zMP6+LU1;&YMiNwJe{`w8l=K}dp6nV_8T1R|^UME%_FskyBIhMCmIt5rj?brapxQdp zRmp@+%?X1I1(=Vbvbi{6X-TecPH3eLbh(u7*YXZ!p8V`|+tp;nlSvtdm?iO&A4cU& zY&Ev}i`1``35ps$T^;7)kUOsC z#z{xzxd!5nT;?W~nPSLn_5~U~qy<=j%4DbYym+s|_@A)mU{F89Ui_k-(hgm`@Sf4B zh3PY!Xr#SvJ&UZS;y(ulxN*_G4L@(wN9%+oQkV^S%h%2ZJ{l!NTU<&?Ht-8z;x}M$!mJswN0G1c*`@ zm6!eg4L$okZ4y#UVHlF{Q6kSo$uh+^EL#|oZ|JgT(^>ppxuOs7nCo|onc&H8xhyj| zHw!iT5K61rL3ZS)`E6Yes3O)`j9-x@`m=1%R=O0be!V|koM31eahvF~`&}(24VE-f zk=5RE+~oc{uAc<3RD%$$+mw=cRQi-Flcp8ZVho9rSRyYXYf1*`NbMS;RE}0gL6lbH zNfw+!n$|JU5xWr%O{5>1>{<7A2=)9Ee52mmPx)c5C*W<4NuB;0A`gKusA7mbs2=o| z>9l_7hxc{v-qzpG5%+}A;)gofJmwAQ%3=Pc$-M{}_-#IlW7F#sDtFZFAzXlHKxtV8 zZIss7;w@Q`p&>3HNevk}9hJBIpdrlAm8*Nvgb%Q3U zHjBBi)dKkDvCoevPX&knjOm;CvU?k4)VoG|LU-56YumO`hzgcD%8ZRyGI zwZte|K+vF4ub8%<*Lsd6VWYqFj8{7(YV(0V9U((7(?FaYys5R-zuxi2>K~!_8uD{` z9M~t2=`1IRx|e&MH_=Lwi3kyD!Z;L*;=hl@0)qz!~Z?+aZp+o zSZJFbvz`-lzCOQg-u4o@03H#G!{kc%P2G)C!jl%dC6N*m5Z*^-``tZ;Mc6JY{KQd; z@1dpCc^t$@VG07|F@DlGUrFio5SReglej*j_D*ei6G!(36nl5T0puU*;J(?HxjAzc zU$m7E>MQLR-VB%4ZEvpNh33L26s#O_TMX;x6IeWGb-fLlF2=ATK^WMClF|Sds;#Rj?S|(>z{G5vdcp7k!<$M7?^=Ej)ZU0CFnN4cty7{ zktt&9Zu)~|_l-lKxuZ2i)Wgu*uEw1cYLKoI_5JOa- zl%HGg{+xjXPyGzvhk~D{Z6EQs4o>t}x5~2+QjvlGd|%Wq-g^TZZ(JuE`-&j1zrwL+ z*fSdA6$_>+O8ZwuGi)<+;0t@c*TIp0NmWKMKaR0IebPRzq*$-mg=Dnc)~<_jkcDDx)(@=hdW za~)%bf^J6&%Eqn_!zkS@lmR_oGK=ZgXuy%Irk^`qj+1JbzN*zba=~TuH{O&gzh0u( zgO)N73LVkfI;5=}L~|*8%$Tx6Q>PF1@<|B#2OCX$_sR{Enw()rvnn0ah%H<;Xs>hA z+vTY_lwjQCJaQU*AyvZP&^R|E8%ZiZ3R=@b?X{G!6S)(M*K?Mz$_vWKyJQ`;#5FOE zn{l?;o#}XxoZ$iA#ci`-dWCyIDi`V zH#{Izp8{9n4Qri;-NZ&~rJwu&mDcu7OAQOdIRURJtBrOTD+JCSTI}!bFULN({dI}a zF^MT)bgn(x)q_|oKp%fw-rXI&%JP>Zt!`mAHW#_rt$Xu>X;C&B2v5Pdm;= z8(SMEH{RGAZ*XHf+1R!=w#|)g+qP}n)_33E_s6NaRkvzpdQP9G`{|kPHo@-W5hdT@ z>${r&{k7@mVCRQx-Mr67wx*g-S(CgLDxJFg{Fb@q4d>!@Q@uX>Pf(x^c@L_YK864D z^ML-%jsJ528z_D#a-O)PbZC^pOzIW~NT!Mpn4zXDL6Ik-P^b9m;w$eee)pi^%ON9^hv-nd z;|$0O$rz@_Kiy~@vo>aT`N@Oof(CNoD}{00DqF1WdpMPDeOtbxZ&dJh#JhEF6mC#Y zNj{nBkNtr6cUj21Y@?qy9B{g(gVz<&|9y|W+SBGrz{|o`QUizD#(xyRnYocN@rUEJ z|0`k7*GVk|nKmoLaDsa>)?2k8T7+I+a>7$$%!+DO7 z&UsFp_jyh(_iva9CEv%I{in78rF-Y!xZMvE8^)1C4t{Gu*pFU+3+)*@>;mk+tRoLL z>P?@BcC-{K8(TG%9*!w|?yP^{biAq|XBeRBk0V=tg|Gd^u7BY*&X;|k0;6|-;*A=M zQxv=f1S*)2P#L8al82u)OOgZY`Zt>BnoeS0LXTrXL7#u3BhC!dGL+)Eai$6162Zi7 z{V%#@u7}L`G%My=At*eZ4t{Rnn`z#91zfb)ajm#4(t+jT$Rc!*QVkcfVBEP;jCk%k zn3K{FXWSzbtdReE;^TU7TPHi`adT^id`4o2yX;%xOZPQNs+#zVN=%pHyg zW#bnA!!)4VMr5y$z#E{GGE<*VZ4(l-b`ZKlw-b`*Q!K(r7&=Z`?S0}&xV^- z9>weTB(w{6=+A8N-22ckn&Y9%&Tl0Q1%m&QU~=3N<7>nIK;XW_#OVGO+&FHMNO%eT zodD8~<7}Z^kwDJ_eEFV@fu}!hmWvmil*~4S-0mf?xah_n77BpvSn7QGSD3611ud(z zfi%`JK_;fSs|9x?UUNiqMbo(FwL4)eBH%2@HvK|sdjr5Z0TCejjfC==Nk!u*plq%W^obPb$bz3rJTzUmT|U&`l1wVETt2Yh=z;y9D_VCa z=&5)SIs&AmDQs^&!V+NrJ(q^w9r#$bSlaZ8Ic_KTp~kKD4dr>SsNptVK-!yJE_E0QN%u-Jvlps9Yo&3`f2L9l!ko_9lm*d|C?3T zzUDnz7L{e`H5-i4TxnyfALaGT2UAM(uyXyh54+I*YRP{i;QzyK^W%#}iRbgK!`1BB z`HJf90%b(tugw$D&YIWph3l1*ll?=-&TSoyS@UbV$H3{3|2<23>66Yf)#i0GQRJg< zLX&#sR(a4>Yx1lAT~@*q8ipPc7V+;>B7H`GS6$&Y+3(?aan0WhnSUv&A24Bxij*Io zhI*tmrh2}Frg(y0)!aP>B{5(>yAWCbmJ6+2&Ml=ZM;9qio66o!vyVJ0S@S4@Tx<>pMHL&@*%){=$-b}oeR^Zwa^PoYM4|}8= zb)sJiyBO4R_ujaaXCu3HIXU5LQIG-ie3pF1!-wi~iG;C^ezth6YsT2W*!tG*;t8vT zu)eI>cf2sl!BDag58RD1{3lczqEbpo;_EZ3f$_T1Gi2MR=>EBu;S4=qWq+Mcq62 zBkvZNqOA>)fkoJ^hMapU#U`&aMq*te##CdgS#A@~;tJ>qPJ**IzYIF*H9vGLHecf4 zQ65NSsmdfdV7-t-Wq@c@+X5540Vf0B3kzx1t1ww>6v#cJqp^3b;n836a~_MfHbOu1 zJm7!v>STi~3@5wjRcF{-?)N!AC8JD1Mk2w|W|VxoKI-w)7^((XU-r2QPSm;oTpVA; z6l+ikU|(d4i_zTTRU(5fRv~no`P-c9hequWJ=%|Xh6A~_r}yNh*DLQ zJV>&OwTeX}$Y~!Y3+PWPBjW!b9pA*jBLM7&Pv-d{Po_PPWUz2Xo4fOs8#-_3YOgF! zkC7+z6cgVX5jiIvNAEDj0C&=NY$lOG={hXg&)E(Sjuk7Mp%j6qE<9 z&WW0(EYgIVyDS>&-%W&}-%Nl!Tz&RHn;>|%I!gJGAx`1#K>ndCE3(JfmZq`PUM%XM zYUFo>obI)W+AH_~5_9+pL>~!nk%_#-m;Nsd5q+2J!B9VWg?NAznGhMtZ`9k6;^;iy zs?iVuPXIEi(cEYl`phV364byGk23aO0?P(}^~^Pb=V|gfoI=#C;60$XiFAb39FJul zi^=-^twpiBrzyS23UaDuWrQhQV{Fu#yl>jh7uVn$CJd~2$L|I+WE#sX8VQDT_<-#Q zX%C&~pk!c<16$^zxydlMdXVhss@38)p8sf3s9THEYf!KhB^@8WQ*Xu&UBW*GPH@u7 z^mG2Vy)>&2b4ashd}8u7j9u;S9aSC0u$5+CEEjCi#}b zCSWd<5xt8NjrHFbz9+$kaQ_OP8OWRh62T&G($FWNe(NI1*n zZnnKFeZgX)K@3${@cOYYq>~;IV>~huy@0vM)3ij()}pcZQ9;pmk-#_+bYJ025=t}G zc7ai+l5L>VjqylmUH92yMD#XE^*Qf=;JinZhlxQ*BIg7JAIsG1N`S6?40cKoGOfMW zP;I6#5NfIb!fgkH)%tn9CTWXUZln69?==_fPWV-Af65*dD*b2&E6XMF1bhj3iX*qb zhLg@UKD@Vne)`h`B`NaFPXekcwJirVzVUdiiOKfe5-|mU8c1RITzI=qmSr8H`qUQV;oy#&kpyl8#df*TpU=YxD zTXK`e%D8X(dbm~W3P7^BhiA7|Y1&1NZlwsqlWP)K`0jht0O?kNUQWb$D|}b}E1m>A zg5Cx@)BbE}G5?>6VOdEfE&=4x4KLGs#oG*5G;C0mCls>fwFFEu6fJ~7d|c9o@)p#2 z3!JalBIDVC)Pp~obQS3Y+N-yr$bnR;*6Q%Ilsx&<6G&Z8oCSplrRxO{j{lD5FI2PIG!za zK(pz9W&=Dkc@bUf8xUOsasHd_?2F%bdkKG8`)t6j#EZjS7+wi`k2a&cNWmCup82g6j}R8>;K$^K?%1`lLzqo8-(` z@GYO$pk&=Vvud5&`p($rA`AZg56g}q<6muV6519D(Sskyjio5$(iZ$VGY@*~V8_v! z(ZO~)NDcQW@5EEGy`cF07w&t0bX4ruR$7@M&2q9!K6=>4h}2;fqpt4jZQ@`XY#C3J zeUf8d-9~;v__lQVlpfz&G@H-1WaWIB=k=Pd8f=~J*GZkpTFG6IlWu3JS>4I}H20lJ z^Rc)Q?}Kdc+G2^=+CI(k%Lul&#reuspHB+ALgDs>i<9Wtqp{)xxlo6KrIm4�o-a%fIkW&7MEP zwG0y$iXPq;rIo8(2ewiQo>mVIzB-JD@UI!SnN7yJN7pyD1Ga6|A*-i@WQ3VkjjA(a zg_Tnca3gDN4;>QCOH+a(Q{`_y*L6F0CXa!LU(kLXBkD_yJ`+n_9xrH>v-{OZT^!kb zKMyWUJ28pVo7Lj5&G$0mYkeOl?1)eY&1FW(fwQeKymaf9yR(#RNmQh4ATC|`oWeg9 zCXl!o0v~13K7=Zsorl66S#u`KFyx-nZP8x63c3yRuV(>e8FSjq%WN|0!QMw->v1T@ zFsJRRStCC;`2>Dy_iC}reJYO+#F{ui{Wo2S3UYs=<*;|@3!385vIa%O7l)aS-^COr zw(WbGu@H@+GZTU68FR?Vot~|EB;S(*jwvw_K`veYp*wT}a#`eaNcs}O53_52I;af5 ziz0A!3M_xk--wSth}LrXsR;#YRbZ^krQ@eS{oxI<*RCuQ{rR9#Y9QMbKu8@E9Z(uk zEGrqe&l))op}N=rtHJ(I!;AWW3c@K3&fpu3Iwvs7Z|#LM#PT&8Kzcs_He4Ju=EirfR0rshM9@x0J6?+)pki38L{VkKY_ zwJMg;eyTp)t}7OIt8P-T3JFUz==sQZDIgoy9LF0yv_z12@IH@vnx>Fk)Y{}|L-r^% zC79?ma|V) z^P*0nfc6P$&NZkwg&2xjct$x9KG9G4@#Cl`ZUMgRlj*Et=lT(;Fgbl~bly;LE8Slo z3AaC>2t&1RD`G3)2vb#9{5v#lTxr;EEh>r}iZY4B+c=C-^?g>L5$U=_R>8yot!)1Q z$QrZln1R^ZxJ@s}ufv0RR-A1y5=aZ&wxr9Pl)blxkH-B;2czt|*~3is>d-7wD4FHwKgIC;lvIo%kimZoV| zFi8!zCV0cs%14_;f@l=+ls;R}Z*#eGs6o*gRBq(1q8%AeN{8dcWwh8affaK(>Rd%4(d7DNRu7p zA8?jxJ{r&YyE$bmfmrfVI{#Sl)Ddk}Ee_du-Z(>^(XS0!^Dz>mS*Zy@e~6^Q6Ccmb z$%TWH-2aTPxSI~Q?MIO+Qz~}8=n)Q!2Fve7Ck7UogbhH|4^*xaLxp&{Jk)5n#BZlJ zZ6#LYMQ~Mn?uB@F`PbYGhY@_+2A}f`O6<>WZO=!SQFbr40>U{+KZrq^9_fnWxlHMZ zBzh~&N?5ZG$80}@aI1M6f%8H&G)z%}P7_E@p;$?e6z-Q$^IBC3P){q+S7$Lnjb)X# zlHv!(fV68NjtaWOjyalw7$f)dg3Msd6qsGpT54Tc+-UX@+DJq6&jOA*Tj&ihnL==K-;Ww3IxJQsgfH96Y54Q8N0KaH{Z zbu&)UrgR=C3RYx#$crh86XZt$OsT6Mhbp76RwrA{m8z>RX=yN}Ly$r*x?_q236UW* z8gqy5E6>P=ZV7`4UNeH@ef{y{s?Ri=S|;!d!~6mAv-knn=x_PfbpnAd+I=Ukkb$5* zuVAyJ+b?NS6(+#R6{vIJhSI6><%a%fL~lNW%)kC#{w}1e-l4^zEB2A|OINSUMUE(a|cHYk9`S&y*;eN1|7KouAJqgBld+}l!-=cEGiXV-CE z^{dLP@S*Eg?LM5WnDu^7iAE=G6Io_Y$>%A%kFj}K&IYM}`GJtmTi={|#dDU#AT6!i zKpJNuc_5{cle|fUV>=8pN!gtUWjg*u|6#8kZzgP1a3*ZpGU&-H-Q(7V6OizV`I=vo zA&gH$3jIxQGuM`>){y?-7togASVU9B)iAS4KaIMBu5P971gC|b;R2T>sbj1?DaDQ;inB2H*%Ij51Y$5gsxTg)S_b`5Hnnfi=~zZC0^fp7>xc#wJ)CFa z@m9N}8JJ5AjXG**jTPu1$Xw7IHv7~?Vd-pI7bqS6=%P~DmjTp$_jYXsEM`&L>~|?* zy_{T^qUn0)%BC+Bw-O0H7@odAWw&xpm|V5t%P@HsI18-N`#kGPB|h^{90wEo#l-C` zX_`MM3gFD$X+x^~x*sSIO(`@QP{&nxRM$-UsZ*kXh3OPKZ#T|jjmeono8JO4nUD!K zbfXQfp9Zc2-m$Mu$3jSkLGi;5ReHOB+f;z0rnhJpN83U2G=zsjh|YEG=zDZOL~1g$)AS;;;t-`^Gzd9JL;dQ}g%27yCnS2)7 zVu$+6k>dNPH3@voXT9>WCLb|TN0lW&(TmSS6!E4H3A|32inVf_+%QwIrP{*Cg%s|9 zQ^vjo8MnSJ)OdT8X<_?!&ZsL=Ur_^s0#|m$GXtgqr-f-DST?JnyyCQWuOD4E8#tiJ%p?c3pYhr3O2j#JeTk@g!i;;-e+z8r5e3K zvpCN`TF~yVsV9$@2*2jIj8reoCc2Buhfh(Fa_+HPO<{VJ&CZJ-*t^>wKU~JA`gaLD zr8$ZjPkM}vPpQQR4HSR**(k%|pwZ&-KS=O>4%I5$H?&)ITHJni$&|}15<0;YmK&lp z6;4UluH6%>B&oK2kdp}?>{qmGmIzumPUH*T|M9Z?vTMt7#`F(p>b%cEKC8#a;jb{! zvdQ+^GQ5*eZcTfYfIKSR zUo0F|H#FW9Wii_9vGde5Hpa9(dC`l;BTq`GsO$taz0#uT#IIEM zq9#ra4rx=ikC4158}<^Rgb9nWiW=gph7^0avZb~7UkXXYP8i;Jl zI(#TdcC3*Md9d&ViElxfd}b39c`LVE<9Tu!vfuu$nEc|SBjRVB>V7IO#V5x1pq4g7 zU$#p92LMhrHCuX4Kv$n?k2jHE4?lF{B$Xj>>L}GUuV}jXme(1*_0kzz#$yX)718}$ zf=2C4O8K<(Q1Lh?Bd5Na*}P=7+x0+np9FAz3>V`%qfeG;QM>pZW>_RpbhnugSqk_k z@JdYik}bOm_;lX*bkSKY9ea;RXzoFcwr3s2oY`o~42jRhq?3$KE0Eu;2ACrZx+x!d zHHIu;{$cscmPPXyGivW7%$B!_R%lLE2nO(A0M~)4v8zaLN@`;#o@pF?E08b?3hACh z;DVZq>4@p$&f1H__<uIVaF7dL7~dN+-nJ_OAi|LG;3+Y z3tfFXNb|~Ck{{w}R_!P;TbWZZe0oR7Bp606A&ARFjCgUbDLiFpImlmBQ}Sfk;+t@m zFEgn2##}8C9nMIrtu=%H$c1>Jy0$JKi}3+ig9NJ_^L#x^PYWLL0XSDo8564%+jv56 zu3rz%QDcd!CeoeQ$Nl|{pfYGRc3V1fS{{1G*?3A|Qj`RsPM?~dpx*U*?7dIe7zPW)Epi1nsEtz<*)LYAl7iKwu3$_htU!U(=Z9Wati#`5NtcR0IH{t@GVKlcHh2=mZ>=1f z{weSLGa5uh+n0YYl8v680c5PUqC8Xa4IG6A^`r*NMHgs`Aqs2MNh&4yC>bj&VuVtk z%lySt+w?;I!jfs6uBu+a4pkhy=zY>W(@ZRM(z& z4^t{nsJd24K_!e~a+Z=|b-q#tH9b|}Mmkjh1h|a8Zk#fV-DX6U%7l}ls!l1qELmM8 zf!c(<9ec^fOH==}5h@zy8Jxp{%bM(qoW+-yzThLg=HPCTX&1DAxd%A@94JNN5^Z3b zdQv(lG>sL1HvHUXT)jX&DoN}~4R4Mq>k3iRp1A>&g&*wWG?Le9(8nvPSw~sn>y`c% zY9jgVFG$m%=20Bnp=upHprqlr=)K>cd)xzz#}M5-`uJ}wLNZ6mfnzgtfoR9xxO!kwAZq}e`p^~`;~5FWGH(sD;-9pv+1xCKKPQFFs0(F z*L=^`UW>CTYjeS2d14wy?}K?O`EpU6zVK&wg6c$niviD%Ds#>mfug7MUIuAGuO`k{ zr;3$jE4=&|b#sL9N{Hb~*C`$^kxOV`HKSiWG5;OHyr?_8L2o15Qg+g!4C@w{b=jIT3jItcNEJ&Mb}@FPhsM^~y8chD8PgOV%u9-i& zDu|_tBHB$;oDQ&>Q6Q0_IJTK$ge0pNd!T%Xf&!H8FwiH=PPsf&Kko@IJ^}Z2`Q2i?5+Jf(DpDtf>zK^T%IV= zUVchS<%Y>fv}donbhh02{_?jpJ6mcfFmR9a@BhmU=Apn+NE6PDcl?|4VXQ@_L-7N) zbAvvOM-eD*>0(}y6!O)&T+$z2v+CUL#}U2g4(;LV;Hb@1^i4w=?8Oa(HiHWoM}D!J z&$Uz{RO7Q;GFNE?7@AtkbDfyYJ%HSFjR{7AS@;=RrgPZ&E2bgGE}P z%*CLV)tNi z&JR5PLG7)@b+AV{KLNUpwK!Ct{dnsW#EoWWqdo_<%#`pZ7^S!D&EgjN57Mqg>0N{Q*CrR zO<_Jc(V2NarDH`mA0dxcxd`#DhTk{w)1l8R7}j{w{i;E@Bo9g6ZO(G!elV!vbNd|BR)XJm^5dHbCPZNe> zUk0dF!gUUQ)3Br|I40L(brE}N#}pR%=KRqIkq`ZCe(NEwMmb^dr1IpA1#BOYABv4N zZ5#0jb>8-{7=G?2jiMM;`)%O*e0e!(i_@q*(SVsCY`e1w6WpmGr5{Lz9bp*zXv1^* zaLYL?k;q~X+8DOWU@Ja4^UAQ$&fbFO`m}C>we}gMtNytN`{WmxS!|T6{Qf;n8w&*i z7U#8WXvzvca+G-2HlCg8DKn02k#r_Jb{y&t_~qJ$8%h;k{6|7VA$^+jk1`qA8hfOu z`cga1&$dQ;bA{y-X$*FPp#y&J|8S%2ZP{k|kbgSPuQt8MN``1%OtK+61 zY2(dLYPRZKtvnA4I1*i3Zi$=UZ<|Yf{vTF#dUCKj>TRT71trB-S2hWr8C6$)0gXyc z(LC07EZJv|10mj8xu(yciBS3wYDibICuFAn)a{HTVfzK=8lX~S7s{_OXAOY5STB%k z6Wp~+UHoQWId`OF$B)_*sbx$@LL&U#xLJ)kQr#B?J(7N*!G@$&Tsk`uR~v1L?fG&- ztXj|JYInz5OlJEgw>muxeu<1VS1JQC?uIDx*lZ0WWjL5IqbWl3qU6FafSNh%k`aj_ z7Q0zn0xIsaIeg{$R;x z<5#q4N8E2peSo*_s$xF^FQF5^70X%<=zRK3iVXdk_TVlf2Q@#~N!WC0*ErVTKW7K2 zw#E^rdfWKMt)|9q;g{srv?@3C@=VtXa|_`!d+S5Hjo#oacWftpT$~*)Tg|Acp7E1a zypF6%?h**iwt|8fw#0&Dwz5R3yFMHpP}heMVpOl}t<`GYhm1QmEL@20zFwJWNJKi^ z4s?-_-!4;1zFTN#fD_Nlh+W zXKswmX2G3Y6*aS}CBLz?Y-2~KwPRaSe8Y()pcgxRz&KJ*iD_CG(yrK8) z)|d=;U;CBJ*Mo0#kqH!bv5MKdX$!yU@NqeZ+TE(r zIAH~8!Rb_B=>h+Gm~AeJ@i9Lh+dw5S3o^p_T28HO8Pj+=HO?;=c?_yVnfA6?JYS zC%s*wBN-$$xQ)-Y)2T0Dk+7g4ov+B0q?*M{CYXT@*|nnn^i0C%f)%ueDm#tER}Wt~ zvdeqWmxZq$LWI6Mcy(U;@pL;voT(SPZo8ObQ*Q=sJ&Zk%j0Wo)8kw0r3l$K*m}}0oZSad;UiYfhQzg&g{%u64j6 ziENU89PA9E%C$b}&q0DOaKO$#$@Ugqwu#0^XMXn&&x6dtAaTkD)=^$Pb~jxlF(zqn z80S|+2DIC_SR__0jSZfTUi=l|1*Fbib;(bh-l+b0I8`h(#r2JYE8d6GkXD17lv?v; zxzjRK*Q}2SYcy(C6)(@Py&#_~G1XkKT+5u6UK=)+Tm!8x69um|0|l2mbDEj#n$z&X zdVvnP0!K%%_2%W8zYX0}f}%v%>El!;F#vHl2IDK9`*u0~aaoXNxgr_1HF!y6f}_+Z z$jZ;UtyAE_ftDBo6-F37+Y#f1UCri6sYS3&@g=ZwJ~2WVmu4@@0refqs!Gvk!~dLj z1CrB$(F%p76x@VH`L9DM1oBvrdABlL^G4!0LA+%l0Xk>YT;ji+u|!+@u)ahB76?@# z6@Oa0M1ouvV8iJ1wEpA#Uw6u?r*PeR+6bb5IxOORb>4ENDytXYL7f8m`r@bG2AqT0 zi{FZJ4UY`DUX7xX351q0B9MN=Sv=PGLE&=E8*4=9#C>+Pl!zR*=0}%2QehPq1{&E zf;VrJzgNRQ^$6;g60e6T`v_uCrGS1VAw)6G1*!Uc=jW-~B%0)9+K70DO;V__6CD`L zr;@Ob6A@UxF|XZTk*4D$7z$N2J?<@Iyt_z4-Npp;;%f?%wem~6x9{l&u9J=`r(YR* zwx7}dcyONOJXVTzuG3+N%u<7&XWf;!P34DEe$lfXI_V1oku6_=szRbkX+G;XKz?g* z$mp2J#3@sp0G54ft64+!Ay*mhYol1^ z$+e`B4NBS8QVUT7AHjV}#>}aHsXjZcPd_BWPY5LKPlK)liF!POUFvT0cG_<%duDsC zg`IiVV#yddf8Ru}A3vgP79>2UtzJ6hUVik^bUjkO?x}XFMKyp)o>wWqtNwVtBzYcG ze(A2N~J1HbbfU2gk2iA%OF?KL?`dtH*T!u~}C9ga3kdOufElxPLn$37ln$|ScN z=EF zMT!KeqS+#4*Ls_>_OMOv1@DXpZtK(K24Tv}XtTQYo;HrDQ9q5?=fz@c|FPlEOn+$Z#RWQ2(Uv%kP6}7l?^P^*n(s5^s@%CWfD_7q!ODG$$=s6C!3W zbvR>iePO}u`FN7$=+S-tIIQZa%C^=)#VnK-8A6saKzlsZ{;@@JI|sJIUr*1P=6ii- zs>xYb?6!hpm2Ql*V8m*#sBHoro-Q^op^X_?Ewyw&X_Y=Dves*t@y(^S3LR~9=Z7;Y z!rKJ#SsmDV?86Pyu(U9qpT~lq;qY2ce}j#&W{Gz;FNT7bw-4{;{L!=UB?<>OCUTYQ z>+{Gjy*b}5x^&v-xz-oAdWHj1~!P=KvVJX z3}C(|oL_JVv?!r&dHB!)P`USY`PEZg*S(*NLS@JA>h9WR8yTH@F8=1<%2J({AvnPY zFc{23txR(o6la}p0d6tL^UjvAd$tZdhN+F)ncAQ`exfl%jCWAb%z{b^;d_bMo}RQ4 zUrHc_jSA*k;A?3s=cT|&mXck0I2uQEL8iOBu}r+UNwZ|MTsVB-u$k)9Bu8nBiH_Nm zElpi+P|jsc^|OM2Vlxu)jamkLC*G8r@q2S4<3YsL$6>tlX;X5xuW*~&QTl)mBKD_k z{&6w$rP$m<_f?VtCu~1NTfGe@ejRe#T( z;DsPDbk7}L75quw1Y;)my_$qgH@1$uecGxd8{UWBx;MWO^COm;Rghc8_@nQnb6d)0 z&!bC_!IusO&8VW;av*Yg&A1?uOu*io#khiBtX+LAs{2e>1@ygc^F@~ju^$BE+EaDbkqz&0X=0?Ymld!$BoQ<{KdMq=a?TlpYstsrg0H@r{ zre%ibKM+5d^+Y9KOOoe4?bBnYw1Q-PlUtcKg-DyqtKAtFP6W?;Hw!&vFgD7t6|<@@ z4#z5xU7N8~Sb33F0+Gm2W5efoZuJ+d4h+pP>%KO1uKIvAD{4#u=lA*hziCQ*%y~5? zRW3}^_8P^~$}`iK9{U$4&NJ)Hf2mkgeb?_e%{U!!kARE$xMdcr42s+^jCm=c`Io1a z^!wcBocL^9C!UltAhImN@G~Pw>#A~Z8jTd2pJpLK&qJ-`ks_hD-5QxY)F8wGa@P;m ztaIuLm45~i%k$Nt`^AlbDWkO*AVRZr8>IPjj(zfO}RLDpY_^RkE#}N zRmbvQZ)@3LlRHjL6{*I&SuhIl5Jn%vs12pL00CCz$)GmAMkXzWPQ)RK(^-gC_Po+( zxGgvOE=u#$cI`NFfR{cuaqE(u<)z4-C<6KAQ-&j?DeG$s=;ZX2y-7~ci`G2~<#q0^ zEnYYtZqt$I2El}(tZ*d2)5bQdkjcuRA zvk1#JCFmgp!rB{hmE|TZGM}-kFVhp#rhdAa;v9Xc;S5M)0A%&}Aug%8LSx>1_o{l+ z(Z=H5!iJ?e49X3yaS@I_J36|h0;^Z_K=W-?Z}K}b7M2y*C<&a6O>~5Uw=@evoUlmt zSs&$sw^8a~+>LxJLa&+9f}GKiWeY^&CaiB&{25Fj@Lam%)aP{2K5VBSO9(9Zk(ku1 zr>v1&K5R~us7+9q+L5ZRZ{Is0oxwyf^jDSh1Ec+wxhHyD<~nT9lOyC}c;htNpw0O0 zLf=$jGM$I8_&7YtlsBmg88;vMBQ`=_&DZx-*hVN1?iXM5W&lgDe4L4u!p~SrLMfx? zUUFLp6@`2S4&F({p-({~p+e-K(5BL(m3WB+FBS`Gv@HRwBy&6mW`TF+;Ek7X!YX$JF$+akUm5>3 z|L4lLl3;+X*C(H|(1y*6`O;X#asMlYlMW$2u!v(~Q?11V`@*g;mANGkjc-vug zm=n(W5Vw14v!;Db3~6#*jVkbdy-Ur*L8RKjWj6S}EAShXc|l&!4SqauvbELDc@q70 zc`86HmY1YV11-B%DKD)~b;R7wY-4X}572Ul@P8z7`Pe=}pMQUP@|3Fh7lr)wgXCTK zAAF8ZXRc5*+*1B5#oG3q9=+Gjfk6{DT{5FAjJFeN0Ctf>2OcrxUcDFZ%O2+~^TjQ! zTa|lS7u}Q3$JoVZmEb*mdDS;Fe?yqEQr16a8}=#`5<*rYbAYg0@<_?IS9ANl0qJ#+ zcUaR&T6c0*Hq^gV`9{=M(mk-)d+ei4ZT9yH67pacW3aRinqqQAm7cJ%No==D#!$h^ zbs=l~{12<~)tRzpeg60ZLyAW;fhuh~aZx%5~rRSLxp!Ll}ciEIv zeo{!wwC)3~u4t9hczw9gr;vwg$OzJaV$DHJrv9il1F2w2~#egoDHF2ww;Awg!d>`NaOY5LYGAz zvg^i71qPSto;jF4%EMrz0lOGfbYFcB?qF{)XkX(WPMx~CL0w9=3t9tna93k&e(oEL z0oTQ>wVo1IT4&<%yXH#&=myVq<(QnDtgyNHzkc)Ulw|{jiNQYZemimA$!T;`2c{Ru z_mPh;gV>GX=R*uT2<-2pCmwX?x`$Y_zzEii#ajbucdP746R{Y=GFU9Ay2YNSR zDItCu?z~Zj5-^#~yTF#lvme^x=RNuytWR1oXyOh<y8YHW@X{_%^JG11yW2vCOqx!I8RvdM&|MXovUGSFtJyf+X za+9Kcxd{>TckJ5U+lY8uuAyN2cx1ZeCmzCTFiw0hr-F2tK^QuV@1hZ1yjG}aexjNm zyZiQ^cyrw$@CIhsMrcp>q(3nA(7+i2I*<*`&`uAe1GquB>anii1-SfBbMo9mIhEsW z!|q_JOMk62f9-8xjZf-Js)DdBcO>LW{EfK1bVP69!9C1@c7bzWg*xcf>c`q`VIj9p8GECWzavB*ZwQP4i&~Vj9Gq<4O@C+QICTE+6)lyYoe{@{(JgtIT z%-$YI*Ykpadb!TbEjzTz>Ivv{1E32&K%IWfob5vBl+XB)eC*C6DNxx}@tSwdx6r&5 z&*@Pehf^8}U!OzZ=Un5@8@IAc&uOe-Wi)=5SeTRdta*Xj=2TVKga?T|Aly*8=ZCm0 zVO4_3Q}C^k|J+Dg*k5O}VySKJQ@NuPCp7qk^TZD6E(Q3{&=9+9fbXWso|cr#OQB^C zd(5HE{hv?RFE<@|mJBz}FcZhL5rr0d<92{~p<&b;L%1_CYv`Ii-lf95Uq@kpHmgjLJ@5T?6MYp&vix#z_)*Ww2xUqvhJ^KuuZ zL3*?_0NW}J3Svm)39;HuMdX(%_EP2y4aZV()H$Odr**j3RK4%CHOJ>sk$=@za6BmP zA5Hh{<^RgAUJD-!*H`5s(kQJXw1V9^6HW)2$ZNi6_CS^*FCG>#6J|Oqk&)*0*4lnk z6XW12iS+*?>YE?yV4inln~fV=Cv4Ezw#^gUXk+WdX>8kSY};xYH@5D1Ki?njKQOb; z?#%4$U?-Jht^|Bv`E{!|*1rAiY}sM~vMSoXL5{S21YfPx_Ewy6*nbb_1Of`99Pa=TOlTyD@!0$mW@_kRN3C#MtGwB?X zmEx1oo_p1l(*JCE&!ll``Q zEU+PFoTc!`U9?Vsti@@mIi5zCR1d@^F1xWGP9Lo1UU8Xe7z zN)RJRy4sRLb&nT~$`|*G(eo5|{l270?8vW+vN29w92G1h@{d-Kga+ZTvmbWW?xaLW zRxDAR(|m~5bBj&iZxfvRh=#GZab)H>V+%KX0Bf^0G~76G2M|qK@Vkt?&o#Mh9CA#1 z>4J*2;p({1={LQX(hhY-MwmCVqj-OwZxffi{iuF@Q`}&v1tlCNCddIZ|HMcs46N(B zndtE7B(BfUGl1f&EcYqFOZ?-_^{4wL>vG-HLtnN!OTb#lZdW?W&)SivY^D1(q5Zqre_D!~Je zlQ?mgkJ!+hV#Xc(XiO8mPTBEW!E5~9I38zV?$>TuU54jy%)+kzB#3olq!tjN*rpna z3`(lO$nj5?0o#I^BX*FJWuiM3@_cO?^oT>}k%m&^H@yk$dXWJbsV z@6~xR!0(V}r+H}7B?iUbE+m5Cb<1f!_bh%NZ$!8GJG_U0*Y<>va5fQdH*V{PpP@Tx zF1%G75`mJqi`?>I1`6YPovHiQV3pi$Q#3Xv@(SA2pWBLzCjqcNwHiVV{GUGAwcV57 zgsD@vw{aVt-jjXQ-J4v1<8P}uBkO$`8@&4(#H~!WULuiSf2FX`=p?yIkVqM*dp=Yx zj+&fx~yx_~2r=sMz+DiSVtDoakVD!;0c z650{Gv%zy-^J-d~axijsTXwc&=;TFKzkq5im5sh(>f{}&A+r7o(rArTi3GZ6aYxV- zhbuG0`(_h~_}k>hAzyKc(3xS=Ca07OC0|dfXgY6?DrjebTE1j2q&hFuv)S!89BA~3 zoiSvECn6qtM{o$lL62*4T(?y~3vWbA4p{OwH7iK?*1Vr^shvDJj|ny)TPi$hwJYCl z;YX}nfy`IUp=@R-#;zv4wL*a6p}RWR^_;PMnseUTYAKl4J>Hq$l!>y+vcstc4tSNL zr@{d0x_>wug_;K8M(+!zNV5o-ph?x7n>}wLYX)0?3uo|0BSJPdf5b+U~(l z+~?Xbeo7G|a+nzN8;+Bj3KrKo;qEF)YW7>HbuPvr?9*M@)PN-R71;9(v-(RBJ>Ma# zJ)h*Goq?z+sWJ&pO4^W0I$NdDj1DXg9tr4wAw4oPDki>5Vi41PPI-EHoKiDdDz;#= z$9bc9^1s^fX-w5S9RlqoY9a*-K z=aM*Jx@LGcc5=G6Iq{TYs-2znF{stoI<*y)Zv2doLzc(bJP5z7o&j!fxUjZVu{0nY z`BvGP5W<@jlhReC(-$he(KdzcI}jr|Bma^yEH5&)#i?=TL8uFc6K!o4V5IJ;H z)9nVGa(GJm;g3#Syanqe>>ln^Xk16#5KLRnP{>{ey&U`0SsboOh6=A9yWt|inYl6% zzB9`KJiNXucFirDi5D?zTR~qAtk#TX&MF4OwoXm~?4ae)$!c2kY$csB!#4Ir+y&a= zlr?+VPZa|rBfOBhlGK`ELAA4QLEW%liX{| zz2uW`-=Pnc856BcFdJwnulb`a#yci-uq9-2TIl23DR)`qb2Gw22M)ZRQ3%gA|XU`%IeFn_hK%Xf} zv8`LGPx&q?!R9#UMK=zzZTn?|H+9$gFWroIc4X8NFljtZbWDeOKUqQ|gVtI7ud_Mx z*yzAK%#(m03F!#(u63Oibri^QxI%R!|BF5Zw*XPk$0q6wCJ!#Otq`azOj+IHM>ktk-+@6h6VH9Q{i1Wt9oBi&~Ir!p) zk!B_==J^cY!o`PAk_*lJ;Rexjo_mvfm)yI7d@OCXia{*q2_{RSf_lYyzQ@&{;4zlmR7yK zBaTmifm?yMb*j?i?T{I-$Y*yx!R&99S4wHcyw#IB30tT;f@kDr<1_4A_Re;V*C{EC zQo6DwPlolCFiyzpi^rS4)K7tiKjiuSBE9UxX|R<8NO=&g9QYFdAZBlyFY*hrsA=-( zOnVVZ=}^qmAYIU2B#tRaayWyWh*^^l0G%gvkLQ9ft5-0Gb?hgzrFkXtmKr7nPcF`{ zPUmgxIg6Y(3tfhcP(66B{<*jmVXj$+15W=wx)-Ety=)kr=mr0}f5O7rzCREYQlDUY zhVwni7((5kxaoO4KbA@t-qNY^x~dHVms{u$vNtD6O!{?nR$%EncraNr-k5#?JzLxYJArZsh75C3K~h@{tLUe)x@DWeqhz zP)RijWS2~-B*$Di7(J8T@#2{FgM}IyL5?v&L;1)*7+PjTH2&gH@$?i75?9rrKq00w zj+cFOtQOzSw_!35*>XkT3PB(WoMMV02CIk26cNGLPEtq?R(mQL5@AmP^hfo0Xr4K< z3jGzH4hzZA39jrp*^z?_^ffLPQoQBlJlC@NLbSMiK1E9|G_cJ=`*~0_j)sx|)c|Jd!+Xg$2abyALm!pT>DqTo3@J7l+>n|U6QpybBy+fceZ4ExAwI=n}m zb~Nog%q(>N*~n^IsI(| zW>r)(EH5iiw$1?xDxz4-3amj@$+hH$+7>Ohqvp|t8LOteacPv^I1+|BlfR~KyZ0h* zh2NJ`?#!B{R#8pm8Q>^bqFGymTG5MOjN}^4qKOFvnul$Kl}rTI}z)`u3(j#pBd*aP#mb)getfAkon&C;|;DP8Vo?j3Y} zG85YIpyCaKct}E^OJWWF0+f-b2fxpUnrE!ZTKacjr`~AVuqLNy%@lu-z3;3G)s2C) z@99e4=MubRmy&bd^p!~GM~mu^LxqTLw?M?M2jk$ldDv_9c#votS?=4QX(?-1;9+zz z1AbzTTVqd;z_x~psy|wh!?7cj#9*!mQe2WFK)5hUY^VOz%+YqJ~h(323aC6kk zqcjmCbVQG);O!weeArW*SXJ_!F9ei%UBDqU#J7moTzGsS>RZ)&qUL; zzJ|&8NO{crHaO;)==Ycu>IJv@NJt>`Hmr8~LvQoWu8rVbYKB?&z}-t+Jw4y^dv#AQ zpaqnUbyZuV-x!GKdA(C~;`=2u2>D>`L?z-S^ZVEU<#2VPUyNn%iO}UyS&X=PRRBh` z-SIUe2L`ZRV`AxeL<(0Wx9Kjtt}7Dyf4Yn{uq2r-#HT8_qqI|b>@hu6vXFeA@U!H- z?X1R2eXxm#_Y`Iw3V1|(OL+tvID>_FnGSQ)-O z_z?HN#g}2ZX5*#!ZfQ%{wrx?vGR4QDHS;d__QSlziMie+#I5I!j@ze7S)AE0Jk7e_ z2>lWHPLf?x>qns1<`dPr4F@Rn{PwsvU)9#Gz16vYwU72UMal@X%L7s+E&3~Btg0rX z1pX?3!aXz&1-Q%4R~0RkhP&~d{ebLUiI=vo9nnl%zgrWRo`T9!{z`^o^LyLhY15(1 zqDx0le=s>e#R_qqv8Mj4e!8`aIk^2|#_LLT+GNMkK7~_Ya-+bSkH1WAd%$O>m*{44 zpzWzJ%-g~-47xrVnlaQx*?JO7b$D9?N7~QxR<{l=%ZmC&xIAKH%Dor&3`^_YLw6iM z7@&_ei(Oh4ZSk7423!YX;H=ppbC2qOJN*SuCzWOis+#UhEjr@R)F@I@Pt_UeRHsT2 zln~<9*DAjzsu2)x~H?785s3k?Smbu#V?ds&?~@_1QV^Zy!V#X^wFDjg0k_utJPg za}k&7CEt<&SL~e)>1!6qc{;TK-z0xO%&vDoXbK~NIN4=CUw3!xCffqF@TyB>&HL59C_;4P&ZLWC!?y@&%Y(Fw>ZM)qBot(RT2IN6E?12e zC>J5d%Nnlr0abJAvv2MoX^RjpcJJ80OuzjGro=SoV-k_hwdtL|D$LVCHLk|;jbg>T zHcwN4RE9{l40;bw)uuf%kF<7#S%ce1d}+G$%L*9pUwls)eW+Xgn$pp;b0AU$@2u+Q zU^pq&+N&8V!;(fSl*3Rpn4lx*lI!g=#$q*SKR0;$;Xv~-7mL~GnR5|noWAJ>I+MiK zEl6YQvoWZzvg$0oYjX2U>kk+-v5v9EuG8 z(Hh|ApS-BMcB0d^WDqXu31L);sYcFG6-xt!{6f_2ykP}?R*a$DQGp*D;u-rz`u~At z172KM4^VLnm?jw>3VzYp!>mq&R)n{%Fh$j+ZJ(AQe{Z`F*s4nFn=q=~4(RfRRX!H$ z5h+CE6)#aBnrK!TZEK_fPPMRP=;Nx{?1|8~%A|fv)-weOMqiv~pretGnUCa$ucZu4 z{uEm^o(mN-FGI`T&U^{R5kfomT?rtb2;uaXNEH66ZpwQyjLyw^R=sPqdXaSLfe`t9 z5Eqh|h`P&(phVZA^6 zm2)bog-JpN_f}$Ro}yf)QP50)RlJXJ&a&BGEhl{tTY%$gx)B)U2%#k*~Q9VsvGS_twA_&LpGB|bD{8jo(eT7?+fofjqTXh;X&x`OtxfTDE#K* z5_CxgnDT=fBKv$?l^`Zd)T1tz3cdZIjaSm4Ucxs|G!5s|+B4gi17*uo$$S1+h*#Z5NtP>wnj0I(`PINNO|D zpnaqSGMbD=1I%T%EhuU`J8I4~G$Y48sXRVL;KQuN;ZX!9YnUw2zKGsf6QbDvrDZ$s ztPptT9GTXR&cA?te;#t#Qm)6Le(9MtXi&Gn;p)RUg)sUMY5i#cRfBDqd#G?RM&)0Z z-lCIk4xFo_Q8 z*DSxZVNH}e_2RQ~TuIRUiS{MdAa2@4tK2vIeaolw30u{wSKG4X$1Diy#hCqKy#jed z@n7nMrh`reg_Zjdqa>o6hSnd8&DC2jEYN_A<&o2F1leGYi%rh7Ku427lnN_c9s=^) zpe7=Ib!I73tvyH-LbL(6lDlo!y2x^M0?+&F!mrpq3XRUwv^<^^9xCA6Mk3KdjD+)$ z`&hAO2a+XMX=nFxR7Qd32)C;*gK%Z6N8dMx~5uXV7#nKjC6SrYR$yHL1^s! z9G!R$(RNgt7jT`IUpYI)Rj6`b;Ud#hT%7P$(MN3i;_CNCjl zNKi1*Nhy`sB?hLAG?>tx9h4g4A=xC_8LyC@6d9Coe?A->%w{ekr02~;EOf`EA^7!| z;-FFvUf_8_;V#>N`B{Gnug0nv&j%Hl<{5D9Qh&&&c);qU7uDpX0#r z4XrJp=cM{JI>(W71-lE6rfE|_md^On?(o%l+BDRILmvv`k-Yh8O^MKeUBxDEA}x%g&7kj!zeur?iwZlZKzy^leMt>vx4G zaIA;8XN7TEUu!W8o2V_Xt@`qSskH9v+^~g~zpy&o6%~%Y*;0~fs?_*6>*i-=GHLVi zBg09(WiWVX8GCvH*@@%mg3`pcH`R#emO?Od;Mh6O;(6|L;9)p8(|jl6M+}`QcZ#3c z4G;qDhKsqAUogZG*Hi=qFRuPQmB*i57_!W>YAvEQr6IDLZVp22(W;O$Br6lXu_5iz+a}*-txkyKRoxj7aWLt1kH2Xy3_3M38 z=odk5lJpvS<@|9)qmOkXyq{11x;?x)Dy2dEeO)^ zrUTElub8fi?Ydp0I+|Y_`^H;<-N2GFg{mV|f|l8?_$z;}vqq@MiFu4aQu$?5W-&jB z$m=SF75}1M?tQj9K>qhP$#uT1e4aM%&kZT+woa~%P5(~`G#hz^s|lY{VyiJCf0au2 z+F`|sr?cHdP^Iq<*j>K-PD}wVbY>oHqKi!2qmI7iONErrVcQOM`RV8d(s;3+`^QWZ zo<2QI-jA8RygVi}jh*u00`b@Ghg3n=a#mJvyAg_Z9kQ*Pt9OhaL6(Bt8UtS=l+3F-ySajf zwOKxjk_M!_TRN`yRz>$$VGj?F9$7tVgDy;(3wB*l6@wwwbCpg+K#0N;B{~^A?)nn) zoQa#!*JTzKiO9=iBszrGCH5hd9h~&tZXUAeamO$fl?;qt?epOS2&DlQ22Ys6PW=sy z22Ki&Cp$88;5yzjJh^sm1_{&y?Yx<}V!xXmh;6@P066ULJla&2R8W?s`R@aH-h59T zNiSUfihD*Pxmm{6u>h3mro+c?04L=}F|FZxDE`Z64v+Iy#=)`o`tT-*6F=Z%tL1wE zc>ozce^UoN#ZMR44cKD1F`kYmv&QX{m9Es+VkEfwKtTqEB>i8a^|Mh)u z+`;7hixgA1q0YS;x=)I=mWpqCVs&S%@UU>laLkp}Lh*14-jf@AHdxEUktoP6+x38H z!r=vVaqpDGB2tD>{ZVt?{D>&T6AG#kRg0cdAC|%wIOfU-(isb8RgQ$ z?{83L(_ZQ*rB8O|QI0q1h1JN~OHJ>*Ib49U`KLTkhk=>B|w9_EN zw=7lRs&s>#SqLirsL}T(gG4LmlwvXS-Jq%&h-hwhD(Vj?eFhWvJ~)c z!hCI*4Mz^k+)R```v%eBhp2SVW)$G}`pTF>UqW;%_&mxQ*0_eees)i`)cqdNP8kgPZIisMbTm z-SG>E7d{)Y7HMRhi`1}HND67`j@aLLVBB&hdh?Lt4EFmmK=E?3O6s02C4sNI3kuxp z+sK;G+9An&&Q9%%ZZciT#R)FaSXi{r&|;c)WeMJu9EO%yXP+*t_?J{s4R}Rk;gG4f z^H46j}*Y`99pG z$rL~2ttk0ZjuxWg$Wnb_+*h~IfhVHTh`drI7BmICvJ9H7MH;H%n2h|-wG7w>Ed89A z^#-i89N#+aJf_jWd(ocN=(@KV-#9R{>zHfLD`m;B>rtNLie=0C*9Y218=Yq_m6DkO^1E##xik*oY#l_WyaYC_%WJbp$w1DbG zDt|@mWnL^AK>=XzBWf$GZ$e>51ZQux^OGI*KEm}?li;-#4o7wh0kmUqWWI{+M?&nLl-1?&=Hm||H!`!D4o^!>je*o@gpahiLh zwu1^g!}hhc-=1K~J_Ea5^XV>^CL+fR!3y5#Rs&pExs*4?{TV?k) z0Uq|gXc)C^Ia74Yb0IJ$PQAr6kEd*+!1G%k$O8kzUH5JY_#A3DatQcc7jma^eqRhsk5tgIih<{2KYPQPt4xYN=yxCEL+1Tq-KDXYQM zV#x{5-8+j~Me?ZCgDQ(t?>qn0f0y2x{jnr~@IZAR#(34z6q=Q0)dx38uf1lxSPSaz zLtE#YxI12+WA6bM6y8Sbb|HUNxWnrQm7DG8*zlfRR2%VkO>~Hv*GM>B}p93S<1|`5BOem zawF>4J09`fD~0HbU>XK#`Di?bwsu#HcwDDk!oIrKzZAqjb3wU#3cP2aXZCiV5D7vO zzuxffHT7ricr#5Jmst66y2*X2A~AJ-90gN`-0XDl10w&J+f58Jb}w0K z2py_mjvQS^12MSjw~DLeM{tzQD;7!rS=YmL85n^S7=f`H5g!3PZ3o$_ zr^L@A6%lOf{^F#Lg(~!(0^V@w1Sins%x#LS?X%eNeLdwDPSuQ;blx*o?-G?mz_GAM zdH7Ti=H;L&izl~$Beo`$OtO`NNE3)8i)Jf%Mv><~x8s*6PkY@7V_8HlGz|6Mlto?d z=G|7tc26D7)8u2r^VXYOF~QZ_2F*SFRIL^ve;9>{24rk-ow0-N^Y}DK@?X_iSc*4+ z7C~(mLj!Acs0LN&tlXRSW>~})k48j& zQV|2Z=(b;?80}6cau^~5WZt)jbtgM(pt!9)<@bOQUT4RZseD#8b?Pn2K9lOdBr|`? z`);nNcUN7ZV*I~Qf?dVo1a^i>?kS{ch9$4>oPJ!x%aF2Fjq;E>vWsQl}E#K~!vUxqS*T(6s2T=hemOla+c%6}>P5C8Wi&(WKsb0V&&nm2&``V8E`-{pkQ;&Y|t6QAH(vVpCt}?H`7415lDd33T0H*+*nSMsi?{Fd*4_G|lwl#MmePTCM zjfI+^U1a9=UQ)R>*14 zOch1A&=H-@`gpUP-}i@!aeovQGwkNgmO=Mlz3Rb2rPXp@N*iM1aabAio$ZUc8X^Td z9qjiEQtNeAUtC*VA33d9V|PQTD(f@AbOUF6h#9^aKyc_>9vp;;6y3?uo1Kjm9f{$_ zp;#ady{Rv+1{g(M1eB%;vITtZe~p%}6sQzeJ*+~31=gtz zT$RXbr&>u64ZE*=Ya*8g=`vWArtU_tjGBtUn}hi^)DSQygqD~YCg}#A?8yjwL~jge zrbm+blj>hZ@5(Xop9-hRfhkH?X=2sJ{sOcR>GykaU>|;wVuA07%MrWX=7t;OTUKJCK~1ro>Yalx zqsf`!&!dsKsq&5A69z2hc!V9wXL_c8GUwnlyq{e6U|W7I~;qx9|Cxvjv3yggxv`_d@(BkP98Vo;8KCO9ZCi z13{6gDLTyf8&yel%t_)kZO$auZDrB@^{bgws^9n{!MywN2z2K>4{g0JI-Y+P&`xg~ zaG;M6PW%}Jp7_p;EhNcwGa*coeSBoS=+~~^y-S6+xj!X(G2{oV_|28pQVGT2Zy&X` zfKTlzTHYIXiQ*JXvRuVw?U26mphTlx#od4>nZRPCRz@(TQB4UfAOVT_*u92fD=k^! zbP{-ivf;%VVHLg%CVDKV%sVVEIYU&rrBQpyUbUi)gGDca&1t82F3mz7mGEqLbIZY! z*gp__weMrF7(wYsTxNY00#Vv(k`^R4anny1!klX*E*>r5n+k>k;084}akXyB`$teg zTZjb8SCFGa=TaSk(!-2@`TGb^-mc)Ns%cbrURUd$?ChWUg+GZttGdKIo#Jw|Y?8oh z6re)d&au&ul>n6mzF=)B9b)18p)B|rSdw`1Tc*AOSZ-pW(Wv{cU)!8`dY#?=M&t0@ z4;QS7K=b3lrnJ50i@(+DWwYmr%0+5HF#&D9Wv$UIO5=`7NPP5xJIUJq-`=1Y(o~pl zHU0T_+3*4dxrtvn3}!k1ic$en*;wcVxnvkLODv|;BM~*y%@Zl5*)nQeJW7zkw{Sha zi97hb>^s#Tw^3HOpN-pv^4`&gOCy&@Jec1PA@g361;H)|IPjtIi&}kuP}gwmD+Rso zaF+VN;mj^zVN02p1?w220-)+wHcBuh-_O$_pusbt;f4e0KDJJm9@m7}E7OnhW|g=4 zSq92(mm+e6`n38V03Oq@z+)vHvOlaXj=$kF0;7;Khk>Le04n3Ib7}0Tiac?ZhLUOT zq(%Elk^w`~Ry*s^v(P+SSWeOc09ve@abGlwu3BBYGi6%oO#O@=){Rdm6 zk;I4&!PBiN8j}Uy$SR|FJhHC9miBVNd>>m=7>WW;&>O7k{F&Y^m zT3q~luu^W2UkG(wDr(*)YnUyulS=cejl^fg)_JlCg`AK9`H4gsv&jWZOme(unSgu% z4&r!2Tn1+KdfM_h)$fWmL^j_2_%y9t2%3vxd5FZ((Q^2c^l3O5sr=;cq`aiYs8Z0| z@Y+tIjHhpiOxEk+In0GOKB;)jRssq(mLWM03aS=Z+Dqp!c*Ju-eA;1m-8i%mUmHB3 zF}8a&5^yr#3v6yvCw5O4u3?E5MXTiNRhBH?z1)hM?$m2!S$B&nuE0%fiNqNV4ib%d zxVLpWwI9?^WIVasz0Z!OtfhEwA5($&8}BbuRwADP;K8MzFbEIy5kZpJ7%}o3i7V1Q!02V@YjW|Y!AdoK{gO(fAkNm{N%>{Fhoo=x{7dlm zYyq#$ZiOmN6dT#ZL7akj@`r0+S;dIg$g>*$RrDcLmGzxfNgfd212ZL)%@j_Xu$iE8 zg36Lv140>6m|!idN|S~|V`^Hy50lwioJMUf;(W_Gq}5TXu(>%|QC$N{NpPQAjwMZF z-V-V0`+|{Y=`Jz;PV|pJgR{m(XzIS3tu&JEk4y9^lK0+jO2jU<$sBO(_KQRbH2ctT zQEu@sB-M%%3um3Bf+<_R<5sgps_Ke08Ajd$*uqhB2Fb*3qQa|(i!TzEAu9db)!Nun zwQ3sfiH3E1(bbk$^o_D%5X@;;_ThTOkj$D!_#5{~xwL(2)f2@+D=-T1-y`Qty8XOM z2`byHwKGQFl~~~|!VAW@G#XtMoWzlF635i(D13Qv_AWN^BPJ1|>O-_v#&}(uOA9Pc zFNn^$e^H6q)_>Bxtauqo_~b(=Uc=KqM+Bl3Ts6PUWYKA<*r*TH7IqN_a3$1^5WJW` zSm(0l!7I=R<7J>_IZKW_Fr{?TYBqP7%4Sz3`qH+$H;644rBti|slo6XlzSa0%)$5? z5=i(?DBt&P^$?BuqvoW0S^vO|6SF*dx7QpNyvR5`&;J`rdG-0eC7%6~nfu$f(O`2y zwQ^8tIP~$PwrquU$x4ymeZ3dC#l@6w%w~mAce}L$B);>>n-G1UQ-GKfQ~bwESOX;3V*vPCH9^LqmU} zTk1r`$=UFBf@RDND-0%6;?Voxh(iy0bPVkBc5UzJ{gkH3_|aNjivcYFz1_9)4imv z25v0hWYUl28paI4O;K=`F}|1>TJK|$b28Il=SNC8i7WtGp)*(K;if>GqCFkFNxJWt z_>qXC$HuS>t=Cm}#HN(AX!Sq?d9(DD+D&)ESRFB^J2&oM0k~)vo3AztXguJR>aSG&P z8Nv^V(gjzI>WeZ|3Y}ZI!O4wV$8M%;1eL?skIyKY*>2ll4%4t4l{8#M3@ngL)8yji zcQ(a1aoKRdb_%*HcS*3_S4}qvphc*fUxQE>UT+r)OK`HQ#;x7y91qO`T@EPw-bGBc z9af3^g}iKHq#R9=vL4D+f29}@Hmd)Nk*2Rs{NyN-bsl-;W54F*VGou16(_}%&x0GE zW1*Eg0(l+5gh3iEIIn_|;&ElB7jf9}T(GD^N1{s-&(*}JdjX`~IqptXFYsV%lDfJcazoQRHxTwr?eXH*kbKp6u;Rl!XtI&OWFg^vYks&`205x z2*Dnoss7!MCq$B>E$$m-`5qht@ekaX(mi-Qwk(xv$K^+FJy1kl13{6yv4yAycHWEX zqGSzcJz;ShM z*&--)TcR$CNd@!iDeFDVQc7&Y1vhgaJoRrm;c^%xS(NDy{yDE`#d`HPM(z9Mia`*~ zp@iZgF9ZI?Py*k_gjEb)SZTklb+3nZUFqa0I@=YQnNBLB)5IDb)Vh; zn|(1{aAiB!2@M4|d>OzO*l(47(2xez%I=6tAi5PaW4j>!v#8Da?aUg`z1KuSg4_59 z&u)pSDEwH$&pha!2!i{&1}L2edN$4hvT!SFzP}_mhX%JpSzHvi-arjNIW)XpQjEZe zec`I6>os^{9lml$+~kYrqGK68JG`k$8|aF{N`+D$AtBmiRAiCd^%avsBXEffz@*v7 zA5ad-qV*I$r|)TFZe`*8H(BzNGpnm~_~gXUdl2c_sgu!}pNvb@p(<1G z{Zm^`s_3w1e0P7A!a#|b3~C_~LaOR>HOhvbrTMis$4u0y`9i_k8Yl0*dF}6&JCxcV z!EIeoGjUx|x^If3|0K+CuSU*<1X)t)-oQz$bDk6G)|cPfhj%wW7=|pWZZ|~jbZ|Ch z7aa8+u+b!c{z;9y*beY(RTHd-bqt?#+uG86zW@phoP~LX;W-G1E#zy5&((AAFCWJd ze1law_u|%RxAxFPi{mAkxyqCj*qlYgg8=;6nX~$$w@rL%&}d-yGUFTo7Z)26H&Wkc4X2{iRNXybPSpcpATecnA5#H)n~Ok{g^n>ioe(MUf@ z+Tn15jid+INYchAmK^RY$WExwFeb6fjPxMJ%2%*vW}gOAD#G)3mB<)}-}3i4_~Q*g zMyo|3#&e+FMlT`$d3=k0G90T(vtLB+CUz3EiCQiwME!X^yjp$}GaO_WZ^I34Em#|M z%TxQ3?bOIwA**@YVJ;aL54}bM{4%9T*bi1EBEtnL^MU8=(Ex5U1m@!xb%Tz4%#LL8 zA(`KTA*YL8GOclB(1}@JcNSS znQwe6qyY8MDS&o7SAj+}x?T#6#KSK|SyPp(b7VDbhI6f@37RuhSW(^ixuqRMG;FD4 zG&&JLDT8~bS5YeEbg%3^D2cs`v^LB#ekwWWf{O=e`I~Pnz$mAw4*b=^-W*bwni@kY^ zE|qAG?>lqT;cZzixSJv&QhtNCs{*+AVvDNBkthgNeQ+36DM~JA&~g#L5@8L;^^;n3w>4sw(bP@|4q= zCBVi4*{H6T)HU41F%HSb+Zd<8$LNh})R`;U7%eJ@M#l`27WM8y@&pqZ5{X>h!0Y!N zp|Wg3E%dr0s8?#uk0y{@&7E5h*4cm}T&Lt~(#)l2pB#|%O*U8a?3y+0lkhE`69pR2 zI?QFm5Jsge;F@t~o_$lB@=-`-_UatYYIP8Drx&=eh5o4*_YfFv6iik!sLkoy^(JM$c4b1hVl14j3K zA3-K47hh!3D~#U8s@1iGv)daeXbCqoBZMAIn;T(xX8x6gDbRQ+d*{G^o7^I8+I#KX z%3>c`amykpv}!iEram||;OE14p}r$lZw+cV(N4cgDt6XyBPOFsbTQ77d3aO zn*)C~PCR!gn~2e84^ z{$PibTr$cFy!NO?t!AOJWGkF*WcpCx)yDfI>|%;es$eS6(UqnEW(MP9VB=B8L{P*P zu(7mHZu)SL7G_@O#@Q55zG&k~P})C`_SZIoP_DBJ-%jZxfl#LL>-A^peN&Y=Cjp3E zR!mCGHF^=Xr#jQTRkJ15Pph_BL2Q1z8FrKK9gmKn7K97LMQ72$myup{{DWyJIu+HL zerXG&7qs64^7<+R7A7o95(+JUU4~hGGfBt zF=p~l0WLj;O@&*JkL!^$>5nKaKfwBeg;Q1>HVkb}|P80%tpQ@=a0Y zzw9#oaVGh~!E8~2c+8n6B`JY9Oj;-YjxR#3Gt8(_YKD^+ISw9S8#~tB?-`euKPxY= zqv=0TTPAe=3gM}|U{e{RAw^*+BtUe?L)B&E2Xi2ENaUHYz-+ou%okBvuxL;rPq#b4 z(+!(paD6O@sJn^3J2taklIt%I>wGo+Q8UU4=UN%hN8^q=F)$W3lHjrGhOh6EiDQKwk}`r(X1(LaNa&pZUC?Aj8OTb}`xiIz7{!Vygk38Sa%s&YwU(72*Q)KO`} z{=3iqh3NCdn2B#+Js<~tyr3u`AV>2R=g5Kc(3Qe7T2hab_CZePavWN?wS_L(+qX%v z&g2n9JN_E{TVQd5TszquYKHZPvCub5OW?G5Dv)HF^I$=s0%1lLEs;B>xEuv|Qm-|9 zZ1q-JnEM}sfbU3ANiW_3rj~T$x7MvahXR4<)N1zj#(IQpjd$!Uy~H#UGBi%lQ0aFd zv%g7zF(kTU&}hUgl_KJiihS89PKt?Uk&@P3^2Eq*^S4rH5SVB?u|Z<)#F3_;yL{9Q zm!!$*Q_C#B1>J40qo$43_LyEXymeXSxb1}W>eno1=bf7z$A5h2cTMSz2JXcHYSW+9U(*Y85ZT*(^&ajp5?ghv!AAkSX7!8;wk$XvRmv)V_zQRH|uDrO0pP6 zkJbo^1I`#euGd9)8JaC+xg9+dj#P7EFFQSA4lHbvUCPp4ZXJ&@h>HCNR(wQzpovL% z)%cTBrq*Bve0j&o)@k+5ZoGF>dUSMzv3-oH?&(J%t6KXKb@3iLE!{10^_wEjncD)F zaIL!m6b&~2{xy9i2MZb*K6LURE1YnLFv@HOM@D*oFqHy@{eUZ8B1JqeCILu78i=dP zlbjioukPl(FbKgqXVZgTrN}4?zaxHi`g4WxS9mSSUBEx7N82dvuJ5h8JZKGjKkOEM z_ng{nEEWF{<9%r0G%Q`-cd_st5N={UjwY{1kTv`rzQN+OE5T;a^mM#9DgCm|YyE9K zSz8!+Ix`MmCfPbjTzrBGs&E3f6hJTP&&~$hybZf&l98Z|7u5iWirRda1;wzh55~^D zP(fX~9;YHSdG3lwrpJ!%ze<2BBlpj`uel#-QX0#vQf^+A_hIdZvl~>rN9;PxHV9mW z;Wz~!{vLleplixzDTpM8^{s#H-2C$qJrE#}Q2r&bG_#XrXPXGdW9n?m@RPMIJUBVr zfR&=~zS&<4gHFITax!D0YzJ$Uk;2+F&k(%WJmz4Zxs1XtEQw*W0+>)^1T*&mX;UQyYE!=B?sWsO2c z>+rNnD?<16#6cwv8%^V3B7eN6`u)ABk%U6GQN{f2E5!FRlB`nq@4xp4Ft2&yOca_h zL(YP4F^OAV#`%zBDL+d5L6v>&ds|a3u(|C}-b_n1j9sNQG16`dG;xs!lB?#o_Ry${ z_6RuyOEIm8izSn9pdkQRsfwJI5@!Fo8EiGhjHPMZe}|=>X{`O1!^&fKFy@d zDm$h`D7~5_p_kW3vSg%+h0>Y7)c+mm&$i2sM*kR$xq2P^B470o0lo6#lCL!}{B(^? zOgbrVt|}(La$^ui2RcL|N%UV|*b?~ATMbddP;1b_jW@N{bD1JgYW%B0+8{Bi_QQEhOaS`0;X zmXy%A>56G1`G^txE`2l;775LYXygTIHim_l8OS zZH>&wR?k=vl5SvLY`gfw7wMfWQl3@q;k;ZP(b#?=jbI=iWN(UHu8v^NQ9l2>AMXsT zyo5)erEPPyK27R(mNK-2eLkQa$Q~6+K_T z^)Xf&;b8GB65h((-gpj&#EPWzFnaVji_#73f=ZbXVT8?5 zDgcuf04WS%{bDtIT9q73{L^vPYLCB#{N-`6LBgf{czX*|EubyxtT(No{&m^ICgVTW zlX(?pQSRU>58t7>E7#BHLGFC4=?P(Wzz??!=%JH5{f%>*xa)lNdCyp}Fc(KknY}}) zb_OP>Y+mNObLH!#Lh?zt{R9k!fj~97Fxc*dgY=Fadg2jNC3oG>R0`!ASso0+!KwI$ zUG}Sx0)_~;nW~pozt>6#^9Nj8G|tTxh%xEjIWNLa>lNSBN_!>=kI;WjUG*VJ%)z$I z7s*j7a$C!$@t8*wx`omN>iF~cd%?vr7#hWq;o;QeV}*J7{F(8w6f~v$PW|HzfM+U! zsFub1>$9_;t55yPIYR(B#jMOzO|;o%TsQ6q`1p<$ETjv3-0iU_{sSNuW~-BS8YCZk zT$ECZx{Q_CUM{ zIz|CRap!@~+^DjnY8O=Cd^;NV@mfFsNGp#b2=?NbZ42xMK#}B$j#6SN$v;&O0Vh5n}I|d5#h z7rOrreXaJrqJcXR0g@|YEn4+Z=!ff3^#U^HT~%Y~7a6l12(#vE1$XLaCYCx`piYQm zU%SPI&F70R-SEqgnL#3uS-;Oco%g?d^M3EZKFX z%G4!gh`E8&YN9RLP9Z|4A@1m(aDXuc1_6b*rzx`nxs|mKeZiFkcTvYEFJ~*-wfxD@ z>F2CyK2ozn#9za4vFUO7c%RGyX;4;gt?J)Do(5Vc>^|9ysy;@(r6r8WrYTC5{Fa4oQ*$_emanjtjbj?$hLvC6kb zwzOYgw?lA>vPsU^YxYr7#}Jw)1QIw@q$Pm0XFj^aO^;|ZfFuq>%RT|23%rj)yQevN zdO-AXJho=_EtYmVvhxlh%9 zh}ipLH!L#ILvUf%fw8{}{zDi@SHe*_ypR$<%&6ZKTv$p=Wm!m`^EbFShrs6;?^QO{ z&>zqirl{N=;S)LQ{fxC)>u6nvrIlo(=Hc5>LAq52U0Lkb<4pw1=HC1X(7E_`+of;a zWzOS$6tbia5}FzY4e(Em03veZ=1jxM_?%S^wEOFW_XI**_|h>*gcGw^j4U&-+GN(Z z^^Wma`0?}8zu=#DOxsWEr)fzGItYHReX5RHMkLYrnL2f`6WFJXj<;wRr`!8O5f@HLv@eWWemZl2lE5CH`lr#9^-HtLdjjt=+(Lq!oH$V_$SR; zbu(-tBvl1@t!>7?PYa!p$b9Iz)~FpxL(IIGEk1eck2S7p6;ERLRpp<;1a-h|D^UBa zPG{tQLq<#LfKdd7Lx|FLx;l5YQg+a{WUb z40%SYhe?LBomaMjVwiX?_+#OqO2HC_m^_v?jYuUlz!DN2y-Fy43HhYx{xNSxtTGs= zvG4>%VpFa|0`QS#$h}t4*Y1jgc6+D_3B?~Um(8c4mKa$@5 zMh|nhs_z@RZ`636zJNWm0kfxSv`%S+kwr zXm+_kn0h$VY3F(Zu_mj=fJUI_Ok2P4-R2_cWJy95*>DMBJoPv3H@Zeudh_ikGPhHv zllre+qMV4Zd|ely=VeUl7K&6Gnm%TqX^Ef%Ap);s(hOXY znnp7i3w9A*cmghRg^UEXRU>+OaWRMOCwYBtL)>FRQvu(f>V4;l+PGjmYZp?H%^vgG zs+a<@+H zG6hbG=(pYS&avjDGeL1E-;A5!5f0H0SU}pfAo2f@7YkKJpoQ8Rc%KgYMVWJ@zUmay zW4*XZ+L1tp;msNgCNbKQDGxOt`;?~|_6mZ@mp~`W983+hmwMU)!1!%rbn>e-4dHIu zG8+*lRZqC!jIz&J1V;NZ=4K=2xY+1K)Sf%bLETW|^%OovJ6=*%4`GpbalS%$XTvDMmXyx;=td#C`cam+&at_}lyz*a~X5 z*pSe((}z_yx02m{Cy*#WxY^Y_Nb%8iWoVoLLd?^^-zOO<@&DdHhs$CGHk0R!-`d7EgBR2Ra;h?N?F%3)M z2s$z!eKy|(8gdF?(#z+ZQp7*!zPSGlNiZ00wD8xand2+fl{@`P=2(2s71ni5hwZbm zkXgTRlYE~!G2pnV<4{tbZFNbeNkqrFbVa5U(9D$YrGI6k{#hOP$#=C*lF?vz@_55l z2N?aTpdYFMWRGHrPcTm?3<-vK4U89&5eBlPTIR4;v&AKHO3*i$TKq>O8vY-WuryOa zbl1ckyvs9iZY&yYjYURrrVy|n8m}s`<*Q^we6U$!5!6>l^(&=E6Lh!&iXI~USR}>e zXb3gv4lM{W0& zm#{!_ne7f9OdnC=ZwW!7hr)_au_KpiO!`B0^_U-LVQd1=UJ$bAi&?5aFsU+nv&VaB zTn-XwQ#6vv(}P3%1jeM5i?JhsN*$V1=Hzb9=0Y&JH>O*dG9MeIG1W@v^s7r_nh;C; z|2&z*N7r;CFNs?3%o;YYZ`UF)`c2ByJqXkQRks!aGCPO! zK9FDUXIO7@i9$IdjgA0e#%F=}`biZ(NngF;Z=3Fmo)?ZJlA?Fkq;x7Tzhp#cMd=R1 zHB1q}3s|>`+eH`ckJoY}`K0`Ph7lFBBgqTBT%&P1V&nF9HQ$XwSz(-)WqK9TeSO_p zs5sq9@1pB9Co*ZEn9UXK6m}6>(hC5`fqS9zRwYL!{Hwp_#6j)VCw9vgA)g~u$k(tj zV~s{(6vmi;l?gyIV>4re!DqL#B%}y=W-COa%B8aH?nAT8gvH(Af0QQt8HKfyai>Q| zRwY|~DxZ1;EhTq#rf@#`L=}p5i!V2E@GTfH^OaR66b;CJ+p6MNZ4Zr&%WD$gtU^gU zSV^nBFE`jX1h=`N%Fug%q)GkC zcECT9rhtmbyMQ0%z2XBrG;+ zURP?*5-fh$7ybk)sVk+IbnHc1tv=B2*jy;G-2O_Dam3|2wUMsTJt77h?8rQV3Er~W zbRa2$O}$ZOmXcXI=?ATlwutR94~;-vBO(zzelf`;-!SH_sRy}?P?W825Sa}>s^*~k zMFTWTKXs4y?zv1|;^ke+uZo}a|A{TTp*ZRk&#a+zsE0l`a zXq1Ygeq=NC1C{7^IB=6xA;sI*7z8A6Z%vQ>lO6(=&LDtl3YKnc7=0zbr1NFW>9=C* zZn1|%t<}Yey!Ag^8=c#NRGq_lA@K-mhf}t%=-F+ve9dE8QsnU#hx8Lv+kaSd)S(YO z(Z_Gakdp=zdAl1rPFZ+)8m01Jo|m^+WP&5Pn7AdlK%#W* z`Rp0*bRyL-8}Q6vd4n7(H778Ex!IRJIDJPKwU;GaoPj7CJ45tf-u2-aw%tOST8s7Y(FlE_l6h5HB%^Mhfh0Rtlo21b_; z^$`rrt_tjiXQ=Gv3KvsD8H*$_Q=>K^Apze_4JA++t7NzpE+@h6|5C*CQ0u(&-F>)y3^JSF! z!4JIw)l`NUz+7*xiein{VhBP9Lx0APDj_y1aK?`-AqL-v8Jza9uJmV1ni7k&SJcB@ zr_6Wj-!lJ*9Mdi#m@M_<^$*kO1$1%bIjRXJo=6cif#D)p!6WF5CK96Q?A+tAb*)DD zIAIC?D&EsHeM@Gm7WV7))!qEu#RSv@SRt{GnDYWF8Hc}btBR|M2RGV*Pqb+e-RBSI z21NMNfO|B~_mlJ2CCvaEIn~_QV+s~Os?34YQP`jkGWqluzF z(9FgPtr%4Kx}QnAerOzWec8Y5nsxpUSVA58)U=P{KB7N)_tJ zJA|Y{Z5^W;#l}|3rJxd^NBqKx`Xb=cvK7|{GQ$5CkuZhrW78=e7>Dldy}wiP8$n3o z+H4Pz=pCW}wy~`(@FVft&V$D^3j5I&NXJTOP@5r$XC~dbPc|JreGyRyD?<6@{;C;OBT7ovWL zp7J2%ShbzAs$Sc`<1TZsy}8b%quVxLm*WEH#i`5GC6v`NJ=ZI)%iS%RbPi; zz*_mH?Izp}ltmtQ`&;J??gyU#9KUezbSA0Q)YW~-qo(5fy|L%>YS6zQeCz^0?u)Eh zd(2Tnqx?nv>U2Z5f$SrWRBDjPR?x^zbJcYH{eW5SNHlcCxg_(8Mb9C;0mc-=R=~3^ z%5cS!k!!Lt2I?jsnQqzz0tRp1*1s?>aHoP~Jx-er*1*h|H4(zN#X$m#hjm)Z=#$Np z^^ac7E^!W%cp~_3I7{90z6WnyM|T&kpknndxXmfy$m`36smF0PS@6!VP)=(UApzbn z@_MLHD*fS+g6@ULpL;WIX3+?LB{E@Z-@7q?hd%h!{4sXW-45&FP!TSXpH1$Pbf}u^ zxoChZsGWEV^7LrLf6WKdujl#3|42G|7{|)~o0hv~lY8uFwtxU>6j+zKqX{Kq#xgC1 z$Sh@5qL|v~Q&RTy5bSZ86mOSDy#E^k)|NzK``=WJ5V@{EM+HT<`@EsJ;lJ17Vpa|Kjz7;*@;;y45{PUJ@ym(wmL+d7DXcW@M>hgtV9 zf_eJW0%R~{iV$UR2AxNxKR_3yBK49Yw<=oD>P%7trVXs zmp1Ikqm>9qxe-R;b7^-=YOsfY+f((qk;=>V&>a!8D*axzu)9S_bPMrWx)kPG%Uc=J zt($?sSD#VNS`57QJQhn0lBM}*@+?YZ49c5Hzm3#Xu5`j+%Ru{S3Qt>VcB*xgmRuJu zqlm4*6`Hrq21h`ZJH7}&h-u)I*fBqiiW=A%=Rcg*MSi#_|IU5 z939QFQ(+_R*9v}jNjYoUWp;l0+!XUYOJ)5SlH zL7wh%ZXwEYK|JrG&Ze1J9Nw8n<;>|9mV= z`2xRP@It?<^2N()l{?oD-%OAw2qyH(v=)NWMk*rVAe6E5B>HJPUfgBlUZUxIkKb)CWia#yTbN;U$@FP z8&5}T)wlU~-8Lj~Npl5f zf!3BAVOVaCTlA~2qVJG1#4Dw^E4U#nsJjl)2p#FDE|;>_gmFC0*YKTTC zR@poDXSO^1Y;8($EjSHylH}xOR1uk0B#HzF9GW5^Z?fIjpqLr+W+Yz;FhaZtRNm=C z1$XRiP+<~jYnyEMa}_mxI_C-gyK!69;3Jv^3gI*M(|oIw*Z1D3vB&|xk&1FAbkI=o zfa|T#RT?8y9N6`#6vC^oNJgqRr7RzxB5NE`iZ7L(lgt1_Jh!alEiD@%X?<8iSF9ost^u z%8_*2T@esS_j@_l{X0YmyPW9-t@yQMtdaiv!y~u9XPIPhSX;MZm~FFbAY~2Nm?J7N z7dmw}k-%^d`FBL-|J3?4+`4}1o>LW`GF)AdbW4X%{W5x#g2D2{8zogOBU}ocjv)B9 zuX0cysZO>wMJ3MjC1E=ZS|uWJDpAHqphOKs-r;CV(x&VX3E98Zx5x*q5$Zuz!&P$U zoY#N-s9F;MigJ&j;Q#oFk-Oqp!P8BeD@8E-Odc`yMiaHywgbk zbJ#nrc3+$$DmX3_jYM~Nc$R5Cggup&pnLwf#r43o%QYw_ylP;y{3&KR)+jNJ5NI}i z^>Z~nm|i<6DTU6l#g)F_qLL6N|C;Ancb$cz?bVB9ImY_7)UFrMyK+Vd|9B>_21?Z( zd%`*@I(x!-Blx9^Zs~IXP0*X5Pi}iywBg-lPzVQ7_dxJri_S*5LrP>Yr$kTxt&@#O zJ^Sa!Tx~aTqE6^;9TGEwO7H05*j03R(5a^hclBiEpa)ODR7`ipRD4h0=oBsuJ`LHh z;owBXpdpbv6(r=5|Kz>RB$~TDbyzHl!#g5$AM%Y)7lsc#Xw{#~$yO@$uMpSmXTrN; z>>RDS{*cl%mD$U84rccLqMcxK?7Q|P^6@Nt3GuXOQ-Ad8xWuXCcYMyyn#1_@R<7^z z53DzY1JElI-xpE_uq?kd$r*ujhZF{ z46Fo=SAUa)nf4ix7lqrDsic@k|402xvo6cdclDv-`aC7vX>C(yBDY@TskO` z&aEhambwbfiufR3=g#n#4OfDa*tq1u2U=d;cRR}+{TWzhMGSTM2x1g+jxXnlZJN_8 z7wHYMmD7UT@0+C?D+e&D?VR!J1Rtjb;0`f>#p8QOt#Rs0%ykE9cyn z(xtI~w8J&9`ZFPDf`8A=VYJD^|AarX{?qKccMTF$ZwyIl!H``&))S!`Nh9@uBthyFQi={TtE3LGZV)BzA(?f$!L zRm~Jk!aRy1vV6IRQuep8wQ2o$vJfNGde{GGwcoPzbbg%h*%=D@sH#%F`gnORTP<8% zecx@!LHl@WfuWnB@Fre$T9<#l>AU&yxI2o|wC`$`x@g^=g8ZcHjh1i5{`1E1@lfdL zZH(z*FRk4mn+SC6o?3Ho@|t)S>a9F}I0a=p_L%EoWTB7+am_R3cQ-;BMA}>Qw!J2P zHQHArC#7&JKp~E;`d2-!@j9cVFdAD?RhS)=mH$gTEzb262*A(sskX~jcG&)(jU3Hg z&ik$RLipTTSkE2TyrWK#ba8wccHHyBZZDk{61x3V$^VoM`CuBzW3UwvX&#R`trs>3 z?IXuw;Ubd*lAA83l!&)$kE7hH^`J{Od5hgMsv3-&k&ZEN5g8x*A~}-DsFXTjA`w~o z*~z59cST8TC`Hz50u#dmod7dL8uw!SPPfU9FUW4qfxGu>;F$Ss0QY^}^8D+8kLmZU zyMI;z13;$84H{@TvoKRXi(-ingB~*uFE1W_H@mB6!`8n%h&ed+ z;wZ2M_~W{o^qPZi=nmzi6Cx?e8)Xps6Y0n*!;R4A7-;FuSLD%S3NnGFGxFfuB7f!n zrS)@HF4+UGi)ilZ>~`6I{3%ulFlY1YhC}WZBi+|IKBYPUyH7!bFF~1qU^H!6e1zuf z#cAJk2^h=00;aMkdF3&4{?t$W7(e-B$tj|Y^~7f_>f$(P#sWHK$u}~9V5lCQXeEyJ zXSLZkTHPYkp#kDy1AW_91Kng)x=6`o2xt~Me+ssjpZ@T`g5vTcaFXkL%@ug21~?G6 zX*pq07{ZkzD7AI3=%mGUh4f}rQHUfX#KwVQN>0qMM#1_hS)98u)+GQ~Bdp6OsLo?| z0*ub$?)m{k@0Q*A3evk*^y=Bl*+ACvB`t2HzAq;N0Hx_Q` ze}6^MORmkCe2u3cdVI+g#v{^WwSv#1#N_c&j)C$q!^W6c6pvtG6f=^T-Y^IwT zwow+7zBrpK{LXT4Wm<;@XiFVn6=4pW%D5hGQcW6QjWm!SnC)Jj4fAq-8lYZuv$0?^ zmFfM-S(1rC+Wh(D$?}R0^KQ$o=5z@5)ZCszR!GQzUQQl?^9;&N&P^ch3(N$Cy9s^~ET za6nVTuVA!{!Dx+u{)d+FHD`{%SU*{x&Tr|EWdV*JdJiOzjN9L}lw7c&gxdmWpg1SO zRk~@;z9YUlR0eX>V+5_iUJ63(bnSQ4vb(m zXLz*swvXEW;&iJf6|f?BAOr5@H!7>BiFvNxdjlXLp5O@eSD1-P(t1Op#^ATuKe?9X#9AF9fZuLeez{JUy@Lv%+7pi57vDnM8VeKFD+`Uha`)jDL zEc3}$kKx!c3j2`;KO){RaF|6Gr_;ToQ+scj^G(YcakWFliUkx4gR$IDonzyhJn-v7 z6TH)%nd-UzPrCBKAfVeyy_r-+TYiVG-x(Lm5}e2sssmG)&;F?NC4ffPmM)bHU9D)v zdEA1`7=gLfE|d_;@|x`%GSws7n(jB-jsLtE5GhRgt#Y30Y4LjXnhCkt$6y1No~2M2 zw>d7edT>TCcslwcvi7hjx!W-k{;UlNTGafa59&*t{!h~KaF!yB_kuAs<-x0ieX}W6 z1h5W$;NR~J67M_s&+f{&frwOH&`@@hlTc^nZPr!Kh^~HHC5Kxx%g$$^s4qAQqK|@4 zTL3Ipi_8T`cr}kxt-to1sMXefEi+C^seM%|qH%+XSu6ZI8*JmhW%aEBOGR^btR`7n+fQ3qF{4E&5hQFaJqBa zg}%Pnb(booAh&^*bKf9>@>Cqy5%9If2HONuHg5sj4)kPrB%%TU%gRtd`r8M+>@1s% zCs7-(eRTTJI14+NPo6v^AudAMyh}0GalV(T!JnOJ+8qlvzj6j`ykNJQ2_c3~n#ikW zb61v7Ptxq7YWIhF@nl#77*ipQk0wmVRMAUVBe05A8ek72M$;&xlhqE$=?nQys7auV zufbVkRFCykD17-gyto(xk4J{G%q%b?bEYp^7hk*QU+Uik(ZckizSi|PBgHuH_y{oQ zrwB%Y-e|rjWi!7}m^K{WcIsc%UnKm>SceT)s}FfD_U|6gNjQ{!@gP~94g%bA$Tzf- z*FDfRd8cPkuOwjc?(;H=r97WKva;YYL%}FJ)kp!6v#W}t%uFUS|MSp2?-$x<(tlq5 z{5B*SXNSj|>W$_0t$8@`(q8Bh4Lg^ZTd#mhi4LfSgw+GPW|dAP2{Cg}-VxR=Z&{>P z<^oVD7}r#)wb{ud%V|u-J?Gi#e7Qq4#aQIAFikZW#;Id z@Bg{e5c>#TNiy$j*H{%@xOIAYHtcLkY|wSnU$Xjj6N&wo+kX26?YhAD!2hjkzEUSK z;jAtCC62KpNa-x;RwN}UF^xL?Ay!;OYuE{+hgCZ9Q?0pB76G&D1DNqa_i#K+ zFMi6b=t^FUW4jDfY323Ny!h<+6!D{Mlo(Wxtkg0`#uJ|ZE#D`ma!Gf(Q(LYhm7m^A zvnw1UwT%49E-fu?S&>1K%H-eUsK+6sT@J$M$fZ4{@nVcc^4keC#ihisXbjP>lO!&# zj!clGfa95e3!EXPN9sI0T$sK^T+UM#iu~T_2(o~6>q4+QKYyJQ{=}#x_N5>f0JmJa z8fRR~?6G#&Ax7%2o&CdF)h{en}BZ2wrNoTWjyCafIu z{$9O&c|VEbSm!lCzxuny28ABKGVc&~kJhG{-@>MoJ3R)RqZmejB03Q&O%BZ|7}Z`jhD1RKE<#ZKpZnmE{#P4p9-I^q^z(fEdpd< z#MDQ?_KGB;G@jtn4qXQB>8Fdy^1YfkF_}eOHlB(&yUv<`+>?1$JV|eR+i^IPEw!L} zcq~<%JB?Smx7I39zuya{bBJz=7}VJ|3~YUUL(^jrBt4W*+3q}=Sb2a?m%}TgELoA5 za_+a3i--m?Fwe48w-S!a4D;C6BOQv5b}_`Ddue+yfub(w?Gf^MYPwS!{cwwsy=pdt zyoWS1oH@-`Ih+#{RPU#xsiFGSA0fUI;1+;j^%70<==q$h7phb|C1#`HMLa=piq7JN z3D{9$cq2t4W~4#YqioaIV1G&{!83m?^5kL%r07;g@)W0y4KaoI9rEYLu5<>>&Pbjx z%hGBU9c!1T=LNY8TL6CQcJ0vwc~LPVOh7kY2EL~VUX(KiHl4;w;#bMp$!KFDFj50x zq|654d?$EtqldU7*(f9&3wk)FV}ml@YD60ji4n$^#u`U^J@fTVr+K-&b8AP74+5?LN3r^J&7vPkCmp8L?<)qb5>b0ln0cbLGIP#N&#WAAZD#ChD901@_B3z;4grv4HB zrKIyPx|FSheV#RwimQ4QNecxlgeNzB@~JGrtjv-`;ETZMHY7(e^J)t!QK|gNHYxbY z^6+qmT`|@&o^h2iL1c#n)}1s4Q6gn0W@FHKY_zIhGk$;+$5xDW4Zyy=onqiseQEb^ z;RFF=L>rg0l{q*iD9s*UARP3D8UTB*y^+yy*4rcN{T*0gZdg{YMyFB=AZs+D+7?ks zsMC`D1MtjhL;Ou+oW!ghdXvAWKO_7~?=22na2Ev{;!OYyStpWee|E{v3Np??ws&4a z$Kq3e55N)Tsu>u zaYwqOzkch5k^5CNVSYpU?No#8_5OP9xH{~5BqP$ivdef0<>1otXjRn{lN`WUhk0v+%pyr^=!urbMl zjL1c}R4){q(Y9s!g94l&h-FyXC_AYRC(q<5r$yCRlcz#rMpvYL268Vp&WmS)A^`IW zw%}iOY7nc;cUS{mE$kv5YGzj@3Wwe9Izv`__ol{AE7(-Xwc)0MVop9xP{wV(cstTh zF>^D^_$0&Rcm{^X$?PM4#~gU_3L?6XIu?wJS`@xeoMSc%bnpsKy~4UMo`F}C%gHQ( ztBe3BXtv_uzd*@Et~H&z#1%A~=UZ&fYv zOzQzn)>>?s@cgJNCqkHAPRW1UBxn5st4P8H+s#sY?T-k(OR z>`*TV$d9A5U#l%8Gv?7XViZE14}Dk?n4l=Yl>_Ao0x}pX;^JnA5)M@9-Fp=AgX+a1 zxtTmL6vu2V;N{JUW(6A?8L7)n>6v#fM!X%UtgPbE#q;t@?+!5Rl{yd!K0tfi71le$6rVQ8p2~t<{bc3-;)2 zQEsa)V+<1e;1gbCsg9YRxC!@UsDLMb8ygkV);5*L=lG!xp}lFYxmOz(?gZ<}s*s!; z^*q5(KRd$Z?z4@Et;ynzM{X@^Ns{kJX%8}jt_CZF5-h5jk_3#92V^whvgI=6k6bnE zC9DJQP$za@cA{`$&2!&|ewlB1VLQ{px9BGANWv24)%_||%0J@)k@-9xDe>ee?EMzl zsp|b@NbAo8F45oSOySsME|RG<2>?v84Kv0*xqjOHQo<=0q%Dd$bUOSgZuCg1fx7SQ zE0=kB=u*nYL`cEHb?FYTHbQ^pQnBmB%@wqyqbk*uW@^bfCXCJn|0aorpjlEmr^v)5 z@`qX;v!&rsJ>JkD%<(-tbBRS=&Rre$_+PQo%6v}GvpwmRF_x~lp&~TNZXQo0(ib@C zB>FKv=ZKc#wG#F6sbj}KeX%Czh>v6v{E4^Y!7fRsnh!q?Rbhv1rfOF?6Zjug6 z#hfx^OXtcKY&0AaB$KGi{;a^d@%J6$k;J5Nnfa7gU zU9f$JTt-EK@!IF{twI%NDx_r3SO2FuLSxJ5d-fmTORdvvV|1nq@rbvzOr`;qnRH_r z<6<#|oz`g>_XO(;`SFCpw!Ey!((uxbF&n;Nl{r%_I`HbHk0tBsbZJ9`y;+j$J@Ym; z*SLEMS>|(}dmbJ@hFxz>XV%5f;@XsR(6^Zx!#UgdrF@iKvJKesA0q+dv%ZF+0K}s;pk{Cfo zjaJZ?n7{J1P>5sy&JRHg1#v8QD#Ax8# zj+Uu{3sfT#kl9W>C zPdI*181I}Z3-}vqGCAhr;yePm${8{$gYZ@$=5coq)wH#iAf$Io?|%$8hz z%{RjG8QQo|+HdIkCa(*?Cegw@6%_V$+jyyu%twF}O+FP8obo14BpyPi3N+C`|7iwo z$PpKgk-t~D6)&~siGGZSCVzcWnfQ!1L=ZPA6m&|qiD+om2yy3@jO361lc{w^T6b0cUEFBb+9j3&l;N*M+uRk8q6-uygh8!p$=hbJDEWMA z2R`*%$axoSeQG{ug_a&i;=h`aY(tmMeqX=HFl?>824$Tt5^G#`!? zNUh0du5E%Z9Fg6e+oKyk13kWC9@vC?EpdIe@9t;WMqDgMX;Yop6kfQB3%bZ8OC&#f z-hV;7P3LrGCqELcyjm^>1ZF%C@BV@+T52wyL5S?WCq(8#Xt%swFDP?fQ2bSs z#+0P-uB`KTyT?Y?F}F)Y0}U!ee@#?n<^SF@i)r6f(WKtejI$)+%kEuA)?IsO2Y4E= z;1L`vQ+>mr3^*4s zJU|JY9YCq@Q$>=7tCc40rZ?s0-tR``#|y8EhrV_8bcMLqW<;kpwna`k)?L`*4a~LI zBQhRvN7-4LlmbgGT}KC19a?$LyGs8;?%M9#x7W}gg6abfwwfB)7rswH@&mN@5P}D5 z-FQUZgk-B>NsT`V$Q*}144|0@&6ur^*g5ZiZStZlT82)Hl+Kyraq=}F(BjgSOF?3f zT2S#C^8TXaD5k=q92eXtn`M>A25Mcq2yPP?)#s#zXcwsY2?i*;dG*7l|Jqv`@LdkV z7HN2E`FU~K(OcLRh}(GG^q|H8`L{bTj5o^ea>0vU{1?S>aQSch#w0G7bjWMYQdm6b zG?_k}*QS{QH@@ER#90j8j97+E8p&MDCZQ9bS}i#pH6;@3q1AzE14Dlt#rd7%UGDE* zTFik4!`lFwFzB)KNBLXZ0&~^u`x`ani_2#r3sfD|%xM_Edus56k;eQ;E-qTax_tM1 ztR9H(mj2Q6}Qk{g$I>&~ZEaHs%X!NdCc-4c1LN#pLJT(&d83(0!^;{xr zel-&IVh2*nM%lfr zu3GQL)O25uJXl+rS z;lZlGFK#15iHbX>Nx0NIzD6f8bs`2+FGB?Me?0-)Z!!T7ql zaiOS>amU*P3y`bv|2)?>cnR>@stEGk3ql_`3H_QIg(h$9b*i-q+r?z9vgWLnHw*s7^t+Ui0wpduW-*9RQROd2%qWthrj?G8 z5uv(CW6@ws5L3n)X93ag50BS7w#tQ4pD5zmg7p(8Bp#$)X^4W(OPb5__c1aqaF_5j z#}%!5TL3JeRqvSl5=`Isd~8nfV{iG))=Mzy7Jt*!xvFb2y^Ob*`r6$^&?1K5PfLL-&dt-zX5@KN z9rZxVb)ttAOUdBVn`uCjNuUKIVvLA+F}ZPnW6rj&L3|k<+!UfXdAhlF3XQUgSM^^< z3$;)Uqcov2@2r;9 zKlOlTwcuXxs0P>JfjZ*C$)*s^uJI{)Gj5)v#y&*P)*H}3%2==Ryy;bbGy6SkU{6GHr_Tgy*_B%OT@z7 z_8A(H7euU(Jp#W_z#)aL@h=D9)Lo8!k=k&R2&3S7CBhdvCMoS{Hfb^HoBnlPenQv@ z({ZSSEKxZehsN~RiUwY+B@_&Ml&>h6fgc|T=dGQ&A6t}JHrVjbQ<{um7LA||U#Nd#b2$*Hl_{d4a+GS)k|sbO)|N|P%jZp2#v0D?b|x}NVT@yT zMq$;itQ96Q3W> zT7x*@NM2&jeOXK5$B)hz@7H55IkwTqah5ja;>vMDcE6-qjjuSZ5&o`Eww&MV>2z?k zLqHSb(V69--yjSbsyl>IfV9b=mK-94dA3n<97V;=e!Mz(v5my$gJaSFL}*qj$)Hti z3YC#06SqhUFfKS2Lcu5tw4G~qb@$hL;9_PvKpq|R zj)kH!^cC*;K|x(iKUR$srhM!_m(S|q_I^C)e9KiFGAPimrmok|JVEgPc)IGarr&69 zA<_s+3X=vUBuAr!D5ts5((90&`syztL$sc@rX1SK%n0WKD9Aivo zrfbTuYf;S9qN6!GVb-Htp}{Vu+@6EG-`OG`W;^^Xp3X;V_c0Zv^v3hv$y+UCGx#`$ z%ljJb!vCnUnxUf)-=DhHn(#*!YG}O6?oIwq{nNTJkA*ylRG!yL(hHM&&hKa{1)ng$ z^PajbFNAwr{t=vW!#rIq@kWX-t$e32ZO+qy)&2r>Q`TqunLdgN9F( zr^9-gIdF;No)0IgL}BHb{`oXKlIt&==I@M8w{Y{9SH!98w6Cu}6kx#*t7#YwU%jsm zee;J!-WMRJdM$-t>K&P_amtr3>)z!?w|~`Hti|8#Ia<4JKg`8n_CRWd+*Gc1fUMah z-kDvoy&Rgf*S!j-9U_IYIMc((lRL=L(A8!feehJz?IrRFlO!S(N9bz@p$C=zNL+TsO#~~ zrXz>zmYaiNUgX!)%!x7Doq`+cMWuqrs@JtJO!eN^OxqRT50GroYc;p4r92tf;$5wv zX7=|9?=n$c^wLws%vt8^@CXM`>2g-}wnuwcPeD;m?bIoz1al)ygbdI@-!2_+;MI%& zMHAUoJzc_ar~Tyt!%sezx)YW^Io7%?&aB(W`sd{p9&PHwW4E6wsVM4RZ`&p%aDWki z3X0>#a-V*3GkmZn=?A_s(N{`^GjKwY=>n7T&m`|)!og{+R0 zxcw@9>pe)dEc8Go2J0-cuYxSL-bq2d)MDLqKN>od;;+kO}st4yjLp zEl&-7Y(j3{wnubm9)~IXvf%sy+t3A z|36jw*648N$r4x~_j%Rb%c5^|r7|L~Xp`>Mp>EL)TrK~ZgAeNEG zoFCz3Ruk;+&hkf2h(9(ZEb9DWkXVEczVr9C z^S;&-gLj{}g{_fG*>wy12CP91{`zXW0a9ElruVa+kGhHR-DaVuB z@!uiwh2$=iDea%?JOI+rDky0M8mr7q>fP0Ac{nSf?EUTOGY6ItvEMT~iHmP9+O2+d zT{$<0zNvdag7y=&YXkwKLOxsX7ZgcSTC#E1@nG#?S#y$LME(=Z>IL~TUMG{B3U>14 zx;w_n3$bI)JFbm8c}qiRENx|+C?_Z9JR4(IIJa}!lib`0tCTrL;#oo%L1lVu*G5Px zjCmN#E882`mw)$m8GO&46)ScZmhqc!#pLYDxt??gHu+jXyI-v~4EMbY$%MyhzHdUl zYh+#{Bp+D$rdDzESp^LF82nyfdD8b2t*Lb`?Z zD0Er)6zwfh_TIy0FYUP$_jk~n^`Sv0>AtajcI$v!cWdX!#$RbQrr8>0@wj!iG~Onk z(Q$F0U}W{%A}VtG2EAj`l6dwmMWZNJl3C(gPoJ&y_e>#1(BgI{#l>aj3irj|r zJQJVSzPkK(Jq|`b8;+ya+Pu%2JT4?5Xe=N>41d2AXL0<5;`O`7f^HN4K9WUduTq*5 z3tg8kZ-^F7INwnpKj0uvykKilpS-0mboIeRIBr+fY4}^@Kw3C|8dQk#II{X;M$8li6#l{SpaaEbo6Qptqw9sA*qQ0r0RyWb?S!rV z8}8}78AuM)B*e5A6|2_vjcHE7ov(HL8To8wunKkTOD^-Hog7U{F{pzoX(-ZijTyh+ z`iodn8BNiU#xJuR(+^%nye~DrjkmrJJ$kEL!PptSZb7AE&73GM(F-2 zC;R${S&3VJvF4Q(h31U5qWp`-RmMuj@8?ygYVnCP*C+>Ti_#fPkl8Rc&u6mRad16B@ zG9mM5X7V#)3ViBlBrN)bEKk9?Rk04|h~!gv>h`Zj`^$TtQJ$yhSkK=z-{shEPGo%h z&Y$s&==qC=ZVY_JM{1-nvh@tJxmy8FtnI>gUS5~&{%|dmF8qkpqlF;s45U8p24^tu z@DzKhBIo7D!n9w%|G1cf#?L>LvM&`12PGS(gx=+mnovMolYq|$S~kG&A+b@|2n zIKL+LMRv@*X@&YrGghs@*9o8FnIuFP$hJRwzj{@zDEN;g8;3|531img&ASe(+}>9E z&iXwQ!yfyb-IXcmJZ(2ZjPa}I*AJ$aXWgCwz6jl=f~uQ{PQ3#46tq5M>wiOCZquoc zWY8;XFH_OVP;y{;5=li<3+^t8PyCQ>9O|h(2LWhoQgDafy&})!IoL}{OH2dI83@O@ zKXV%XK6oT3c4sN})))0o7GGs^K`u^QTO_$fK!SF$odM7lOxy+66lr%>GW*WT8s+t(uZ$ zw(Cxf#QJfFb4ZeCp$vR%fX`i-tEF?;t0)WH9_p)|7(MW>zsUCH_U%5KM( zhP(N`INDgG$g$>&ym&=+xzIN{%)|&-Jb$J;n}%KaW0&5>49TiTH1nR=f_{J z#(@RFznbyS!>`4?UjR0QY2?EXPUjWxFC1q{F|}3bq8w1uW+<>`pK3i?xsPC?3ojt^#X zU-25I@N{p)1@cU?|d;b2bHbuPH!Dc-A_Q+xp?nlZ(*ZOEDx6UJ-n;$HEH*b{j zd0BCs?4MtIJy+w~8rkC*Q9@CYYQC>2>*YJB=SJi77I?Ilt3rCyzP6&r9(U;P!J&ALaYgA>*~T18D5o_tp6B{ArEsPfPlsF|RWs(f|4L&HkO~d+2}pc0sFO zLt+IM8S?~2Su(TaD{qW3vs9c*JhzYKJZU`LduX28@+U5UhP347$}`{YP2pB)6R}7y zC->PI|ATRh-sFa-5({Y_wI&@-PeyfL>5Q_+Dn?C%=g)AG~Fxkck$NtGz z=p^IhJET&yp!YxR&{wuvO1SwJXB-`iP z+V^WeA9(pR`a#icvqynq=kyZ=h%wjE$H>~7?Uq!U1?&}T4pjs8TP3*+M#o6JO0avl zC!hBa;8}XzWa4o@ebjrA>zsS-Iqi+l`#t~bmS8d&P(PcO)cVgP%T0DzC}CBG$^JIDgBjFinwj7JId(WHD|f=eDaq00o9GE zhv2j`vx*g*l%Ir$r4K3%rrl|>H9d<)m2tx$nD^LkE5>|UVD7-vfQ29WZXG_w0Y*pkp*< zzMs%T!%nM{@zB+n1NU6*qXKTldzZp3E9EtGwvw7FuUM4sH;L5E60++7BvOfjk=K>3 z7pZghYN&t9)STD-q}3VuQ+@2wBW^b4<`WhP^i!1v#nBNGS!7YS8+2d2s#VZ$VM=rs zOjfPX@vqLMc=U_q*ImWG;Vh}$X0%~EFMs7%*X$RCT?}DH;GA8D@&}bJCM;~9L^pOW ztAoEV)-8-~PDSEFody+kCslTLav${?n)aDVt1-KUTq}?+RDIwOz0^D@=p8qgo-gN` z3*Q0&x83FE6?%I(*c`&+xh&}IFaFb_{4`C63d56nqtsj0U%6OUei=R7rVcrKdTw)+ z7hn7B?$^Jsig@lvnmRnEG&vA_Y5Z+<&wSJU!PdVNP5G9Xv?Be{&o+!F6r66G;(-rH za-w*CxOO2EC_GqF=&8iEM_~rMZIy* z=exQ?3ivhotD(BspqJbx)lZUG2ehHo(3`jBj;=i;>G?Yrk5sv5(Hki=z7@DfO$5KV zI}$C^xv5tZHMuw6y+v^Xdu}hGRAkeF(~7Fl1n2i8^i<^0>0$S1In8Y#Ez%s%J}|d! zwv+0%q1Nt`;^uSZW{G<{>xgxYgUZVyoggu)4aGMqC%qCOo9qr*UD&+tU%}9(0fw66?}(W1nwp=Dx2Q%j?eEUGY5OgNM(3 zDIfx>PZnQ}2&-RlRDa?)DM_F>{^C6!p{;E*_g$`0Yx8>KBGX}{d9y&4Q%)sq(u|yU z6lr?JCo3k?O`e?KLa-N^pr)N&6NR9Wj(RmFC4R&BuBQ4uO6)|6xq47Gu!@RWMVW&7n8o1LNz#sbRLqBHfr`)1@A3SMndWu;5)4&s! z<2RXblkR%VeK=)P1>8fGrEsgorQduKOsX7;!EhQO=F>>|FpDx>Jp#y`A~0n)xWWL^q-IS#UPNDg9#IX)1oTQI~t2a9xip6VZS*zs2@D{be#R}Tvjg9 ztUSU+XLli0G${(rBh|b9sv~=yOu{g;$~)yDuxc_}gY6rG`xCr8s=S{X6yE85uKWCA zxaO76eM)}C{S@?)Zi8ar1PRE6(IyNTZ^472E$im8dE=waCOvhHZ#OIi8>*t#k8K-0 zTJGiKJnea=(YomJV|;~S*DdhcsOqO4YfGO>;;-4bTHo_nkC~lYJsd6lG}ouwT;5f& z=}1~~){zPTMyUrr$b_v?{^!aiApR&%e&TGSxACtNDs)UQ(olH;6i7@e@J+ zYxMoQL216-_n0SX}O`b;Nbk}>So4&oLayZ=|>y3wp64usI ztKiO5E3T89jg=ov$-@}whPri9|0G3o-y9M2;AxFnSbe-%*}z&V%bDNG)i5t(_rRR! zdJ{I+)CO%#RATvQB=&`xN@_@L{yLl7P-@-T_bC69((THdvcFPoueCji)nU^J&H(YC z-hAqj!0j~_{rZ532cf(?G=DL#v%oF*HhD^Z#wF8;dn`Z6^&GkwJXv{u`8GHRT*`$% z%3Zkp{pyzoEff8J0um=Bqy_68#EX=VNZ{8uW+{>Le3|<7X-jH5e{#~3$3dL0DaZIl$$C3qmkV9}e$^2aotC$Bz;#7QTYM@TH0+-<uuAB_#nLV^p}lzStmfI;}&;cFphhZm`r&P+^28 zwe~@eP^)~`m*E*!>!Shxp3PA68$aMMdqw%Jo2tW)sjeOvu=c)r{Z5@f_q{uZ$Xx&`%_HUyT}PPL~ObCRq9l`?^;@(8uJ@qk!|3%`%CU zf&5vDR>XS?s;sdBT0En`!Q1jBWM>V{s5S&VRKpjasuQ!xfpXx~qR>a}`k#uFQ-w zr#EiPF(Oa0Tt$0py5b zEAy*Dz>J?F!i^?Z7&}l#Db@AlW*tW3Xfq z9BT@_ujT#ccOROlwWt@1+_A%yS|nJHSeL5En#mT3OhxZ+udgkgc?nfy)qYi%xwgvl zh}NScqn39><7L5%pMmawDS%%e-%ov0M4F1?bZExJZ-2j0HhoI+uhjh*n&pTVFV!kr zUl-oTdSelm&;RI7UN;k2KLR>_{=~2~{%#5XRz)vI{37nF?gaZ;YC@158FK1-*7!EH zmSv`H7-Yw6vTSTs*ME7Y5@G`1H zUe}eRE{I|2ZEkQCl|r9?T$pboRKP+x+MP=I%s>C){S?orijHTz+bbj_SNN#k%={%Z zexf>FEb+-HwYY9iHCL;IvSjOIv$J~7AyeJQ_(l|YWtGX?bfJUKAd&ox39L5Odv3pa!Bp_r+ z^56_oH{RRlq;>=83Fu{gXg^rAGkE8_$m6A4u0IwdH``v(zwAvRFn@Vn5f(11{4(vu zS9|?ktD6nQ7-^h;FHl6$#@VSuy$R*skIb*%&)H%O+#62Z$uoL8!%oXZjn9Jtzm!!P zRGtqG^KM!By-54~N3UX9`t^Q{Az!Xbl1Xm4xT`+0chf_lB?RpY7AMpM5I^F#dYckOC*Q`c$+<7Gv{01lu zof}$geKAcqQ4rGzP~OElebw0WwT|yiVfdkOEvg^D^xl7!3Chmvbszop(`Uw+WS@=^ z*eS|WML2=6wbT!V0Ou6=;on&W5d%Vla-vTwllCE$Vy49XKA(3}+#%!2H`qV&|^qh`GB@!BtdXfg7Nz%Jb$TC;LBvr}w^1i`xdGn%dZ+ z%Lv!;DA@;d1 z9G#`|&z25G`r^WS^F~whNJmrlM$SJBmM;B|x_dS@4QX<%qNa{srEI9p)y|+e zo4e7`5;~3{?*tXRFEJ}l(OkR#IuW?cS6~aLGt>y|vd`OTC&sqNHFyHxL{%KcP}}?u ze?oejotjbs+(W83EKxrzyzNynm4v*v2nI~0 z(b!P!VWDcTT+Hv@`I|o9U)Qn%yg22tnJDsC@VE+FYg+gp1?}6Rl0- z7kuzBtZ5SzU3fS#1D4gyCw|AvDtH~@dZV-e$8JL=t5-X7sW=roq8n~``^pL|o%nd7 zb9@=n3SZEPlkGJh+d-XG!-U{D59NK)XqBZ`50?j` zEW&CPLYlm=9_Ks1i@b5+?N?V*a~BPV7%AaJ8XELl;1$%?{4J!FP{(vc(6Cj42sEqQ z3?!byLr$DvcqLl8Z-k7SJi`$870ej!U;>9=rMYA^X8Qw$HkbSj24#NaViwk6d;huT!*r zPplywi`CWYz^5C{o4x80hKIFt#VoMxt|3pT{34VI9R&Cdl~RB zB3i1owT(^YGQ3GCREAc?ei`SDb=5j=ol5Tgtb$D=nMBP55XMb(Uxczu=+JXtK5ohh zmFzJu)6rNhG*`@D3}QDZ1z9kGr%Zu1x}+1O`;bnAi(Yxu-5aWQc&YtTy=hkX`JrpD z2%b-QkR&2vV4wDCU_9p>vP6q z#6(2bcS!Z{KYVQVAs)TVF?3xy-r->9b;52u{%W!J#d7jF+TQ(WAAzdsb+}#IO%4#C zE2_BO^`XFX@96q4ry?j06OFgpxXGuyyL0F`cqwO*4jfcy&9c@DM^%jz0=uAZp6x3i zA?*R~^cjhO{r$_m;B>cS&G_Q?oPo6QCPvLH*Zwd-S<15;b&kvqiFCIgV-X?&8Embd ztsYj4jcP7aLB+ar~WPG+hcKwXZIR;Ji z-iu{V+5q($7L7E(S2`3!;W>-jxhC=|T z0l5ZB%J843R(;~8^?8S%v@%^La>_M>30O}O)oqffsQ*_~TIgpP&`Ygjm*if@yT4YE zkN@oe!WZB%!oId#i1WbBuCv{$RJ>b{KB5ffa074ZK6qVb@G>Fe@xBS&E?ou7jQL>d z{Xc2%Aszd*WZKO5t_)jGd~b0!{;)~~e^3k)UqS1|Z*>4>o`ruaKVQ09zH-&n`OvZ2yv?8?rO=8j^@8S(NL$Xy`Z`a zD&9x409qw&YFagl?DJ+J|Bc4NKDku>TYz+9KP3k(%VI0jiPECA+;{B{CzK%1){jIu zfyqm(=}=a!>`bcA=6{{4kA=?-&(D{4OKf20z^?NmqQ6q+SDbQcA05JWYm}1>u8V6g zo~xT$mSk-=55(e|yfuS zJv$uqaIktSH1+a%C4n)=Mkh`Xm8DM}fo#)xF-Z12vUvUa21%3dX8UK7ESfj7-*69m=3I68WRwz z6#rT+yep>&a*FSTNb8vI@%*0XIr|9tGg_3Yww_0@AiA=UPkR=>*u&tq*3fFi=i)|x zScY3e=94e|h%+=4$R1#;uO(Lm1kJ6WXQR8B?H{>0wn8kPdj<*o%>EeRJXBd3Q`-S7 zESW0i_uui~@SXKX9^Ie;+6-;1;C>(S)=lS}S z4As#uJn9YE?)o-v2rb&rhSb#(H;(XUd)bY9OTTJXGu49kvs40eJ z@vgEOJ_}m)sBmd_*Q*2D1rNXW#caF-|Gr8);ZO`BkDH z&I6yB0AvHeeBeZ4DLuW+tzoLu5mx`8E4Z0wWM(1|8>qka&kt(P5#)mJv6q+luCn;` zu*!P-pOG`%k6>f1U;KxN!NaLH5qpgQRE1?*RX>4s28=)r7ZJlyKVqJ;`7IWU1$1yj zH(N){c8`#qNmgevt7#qqg=hH(4Lj-cdzSW(smiP>9blRH)!0h|M(BpDQtt6eUII@R zSO~mfFTdZX8DQJj9ZQ>nZC3zTGp!?iGe594$P&&7%JXCS7e@iIh16_N$6rFO zmiY|ZB{6%A`{!Ht8sN|!DbL$y2^KFvA(MdZNE@-x)k0G`;geWBV!Q_9e`2W1x@
>q@Kg>tCOg3z zGCvMA@FGaWgYo|wg=m(}X5e8graWQ(%EBd_jlcy<4;WajqxR5O-{KAod6tT>CF_tq zeTYgpU0WYD-Q9_TR?ph#+t4oMR6kgPMF~`ybQI54vICAC&8AQ?-MC8c^~~?ab45rW z#l;cyVYZz=uA3Fu<$6?w3awqR73YT9FJ?p;px}6X@E9x@jxLPn@q;J z=dG^Xb@0dC7;kNyvc|#_tX`02`d(4hzs6cB;stsq#~Ln=J3NI}4Y%Vi5h8=Yr7mU# z%+@n!VrzcjL7zXf6-~WN^#!56NjI!m1m;n@XToLvW@c#pMRAs9xKej&_N0sW8En=? zd;zxLQawAS7qV*KE+2wlAJraBrP6@Q!U?!K9yInGyx#ycMH{IBbuczi&n~pJ#OBxH zOx%Yk&M}@G@E((Mx;2XmN0=geW!oBlV=;ODbVbKQU>Cg{= z{okEj70({q04*mlz`cpsh${!3vxi`T)*z#7+!9bLOXZY2nxt_cNG3{~>OZfNEJDnY2OdCTp6F^R`S?B7i~3{ z&HRMK&slgA*4RUSM~iV%ldPlC2L3{in4EQkWe-HzY0hPMj%J1qQboBdvWFJLW+ z=bb=kr&#JEr+!s$9B4BblsL5H_OPvNGg0~< zJ}QT3edZt$tBh-vWlcdOi*{SFXAG634v-sJ|*>t*~;C-%y!3P*&iakeVlVn zIh+B(wMLXU;oGH&v~U5kp5K!rsPLd_WU&}P0qrHcgLmNu4>+!~^2eYPVLKQWou-^B ztE)*HrIkzc)9?wj2fR91zS2Llh(*HtjDLa0n@}#q{ude3)NZA#xzL_|G=sd~POLlr zrVZf^-N|mPXVq3*d3@d~$f4W}$~?6x(`6K)fzeMi5P!^4?@R|+xg(|=k)l;)zk`y8 zQ}X?wSN+Sh$nL5Kj%zFpR96_yi}}|jXqEf=#AF-MWGn&-_I#q|m!FYE>ob#a{st&Y zn+-WR?W|yi+|rBh3Tu2dIX8bn^mkmhG%f(aO*j%xT{m zKj0s*qO6q`4k$@NI}3#Ni!p1RmhNaqt|QNoYg1mc?v1QAkluH)0OoD#2ozT>>Wh3> zLlq--R>)S8#PQerLAH{iKBPGPrW<%wb#m7$PX4`c@D`NX7wUZ4vn63{V$es@L^q;e3F zAHFzQxdjO|)t$ZX)&g?SwW=~lbk_w8$YIKcNWWt6mT2u86MaF(-12ZkKz5oehjR#b z6j)MwehxuDkzXY1-<+Z&zO_vG_dVn)HRUr1X8UU!rq66o)Mk(2;hpz)St+UnbFCV0 zZ2JJxHOqGS@{9wM^26?&3ws0PDL!%#yZgN};{hh4N#PT2z3*#@zLpkB@kk&uj1+%-G3j#Yzt?x2H=J;o zc-DH2L0OKbZLozv1B&I28fw_+DXMo&0)~xHa}vTIUAm7nG<%5f73W;=}}cxyvs0yphGrwtYHJD zpcNAxaw^2rQ}77^to7>?`)XignDsA;9LoR~#(^Rke1XEny%Smx`2xo-9A&%&-3OmzHHNjgH zRyA978^Z<$c3yTW`rNbT_K5__%}aU{>CXp~@-@wTyal@rP&yq0r`?z|6OT~%0=3J{ z=r?X#_hBz$4K`UXR7>zv#zvq(xV0cfPV1Wr?S(o-5wcQ7 zDM8DlWr3&(+vyL6`DC2^b0s{X7*Z_v{x((Z#Ch6`6tj!@ z`!C`ORq#87Djc~(Q=#|f&7|rZ^fGqS&4BF`m6aL83toOFj#&-O)BfhxOl<3~za22V zW*}+rV%Y7c7P^jAoqA*gwQmGi>(dc2)^*QlXC`caQmNXHN;oi8_?-&$ikVbCWseQ}zfL}9Y z#UPX{nA?fUMt+7W4u2&Q?_~7WGVA2HQ6&*x*Yzg=-vFBz%YsN|p=Bx85l{hFl%+om zd5Qg=eUGq3)`bMM*hEtlxOg1@`&sKrTfuVSy3CW8qCy&3dn>$%J07~hJj zeS`hb^CHL_&T+rxA3hhG-GorPCtI+nJjC}xtA(iCn;ZOo;mG8s+MbF9`6^%Ups)g! zk^E=Ne0k4E_{OuUiOlBc4?z>iio*;?3sb2QsIqa;;G&pw{hfT3?2yn@3QDfi6Z*R| z7l$(m8u}DDR$SkGh;A(t;c3b zXrCQy*fNqqu`p_^KLi;BgkUpAO}*WwNFgBH)+I9LEQ8vUAMM`ZHF(l}25{Qnd+eyS z93s9dyhZFiZPA>cy5!SoJp%leGRe-)XO4T`h-vw)HB?G#zxIVbpMBbgmx|rj!}`?7 zVlV0VpF!ZKe+-MOC1Kz8Y8M3bbteY^A=UbJ2{cMB*_NI%mWeNem4_YM{qK_ zw(*8GSu|N8I=OQ+LZC{SA+I}_FLK8#0nY;URaEKY6z%?mSxZsnSPo+B8u!x88)5uS z9-zUA-np6}s6yLIqk*0{j1Yvnb=A zy70R+aH2dwNTzx(G}aa^({MFUztK@~!O$Vn+Q%3ozUWlVY+qvEmZoxMAf{|!4eMcN3Bi03fjjsEywr$e1di zSG5-x7;2qHozqIC+yFZ*ox|kO*w)OKm(wJ4Pe$Jh$OwM77MdB;x1t@{cfhZYL9K#anE6_ zCX`JCkGE^s#guQTHToS_<5cFRzd?eJ+tmfBJdY+5qnESR5}$XI?Do|{9EZp9XeT)b zhSLzb?^yicJSK`${DHD3&t2u_O4E$2bG&CLONwptX=TYydd7m9XrU#pxl(GoFrR z*Q0|z#)X*$$VwfYyYRRY(JE~V+4zG?Mc`&y?=IX19+4ftad+HRRroM=?Azx`gf6pb zS$N$-eTFT+v~<1u%#at$d@#pV|CPkg6~(7aHr!96fpRiQpUL!hV*DEO@dqVilEMew zGoI}LaKIt}QL9q1L95?2mfQ%qEtnPNudq88%HviZ;(7|fy6>W&AA|*G5VYk*yawnVMxQ+UjKo{1dzves>No{ecbr zbcoY0(9KsmTSJ`{v;j~tCdvnx*Z~067$s+&)ke4*z|A3~G>oI0l2I?G9k$i=HAb}) zu6m1yb(iylK$LNcD*}Wdi~8RXo`Hv^ zoi23SLtsAuTTtK!EKkD$)=5f{Z5>|~W-#j6!LFWWvQ4IR;hUiJn1X!+n z1LM;vupgQ#58Pc@@GxXlos}vB)w)hUuB{VAw0_o{l!R(@r^aghcbkp#bQEj)j~lAJ z&bgPY9K4z&U8NaHoQcuZB;AzT5Gch|vD{Ed4T`of`lH?m7=Y4VPBXlE7-y!U)PFCB z*`ZSatk!baf{^K}!c|NAdDNQUcXMYP57_ut72deuvGKa-g5fnk>6!zD@Rpza0)-s$ zmy-M(xYF4eY58~WgZIbAl}It<+v88q0k{J;HEJ6%MR(h$N=iPYugi4`Y-Aw{kPTAP zv;vZm9>m0Ei~(Bpmo2)beM6M)mkXzyme^f6603H8m>p0kCGAK2D6hWbjejA6NqP=| zh9)YUw`bk>c~Az0nzKEv9z6u5XER@Q2r#FX`okJNxyYi6c0wnbopn(`RwWr(^;Xt< zMaN6}!Jn4s7FV5tg&*{{iUd5H z`7NQZfdAqa*jA-i7ppauLY}zlx~2u%UN!0vvi>4*s`Y7h?e$c$@9PoyCkzohB!1{= zk>!lP)Tdz=A#R~;tTU_VPWMR8ceuZQ5N_H1(R?EY(f(0K`{InfAo_DAv<%&Pwc}E8 z%xu4xwEU`gpvk%G_A29vvXBsu3i6C(M_9S<;Hvt*0Ba%o?enx2H;S@=wdZSGZR?n!H5h2{avr>d z4|v}`vgnSoQR@zEJ2>ec4i1*0iUS!sDX=%*qJCMjJq@h?TlvzWEF(cI_f&IHa(%4) zgkem$wXfQliD{RJ3z*fd-}jI4Jm~JENd&3={RRnw`1(7GET&R96lIBZO;;hN-h_gc z0y>uu2*x(o(O={<_d~)K;h@a@;YtVu9*%&6EEj2uwZaA^!OHRD$A*zuQZ2w~Zksjf zt)9|N2*fsrYz1xXEhhm%NdNT!l07hFyy^#*ZG#hR3Z)7tbShNxU_lRs+teRYd-~KV z_}(bd4A@8ld)xMDW-feiP`RCKb9(=*I-k~l`y*z427hfHp6MQ)8qIYrL%8v!uYS7ZZCM^X8X9ddOOMQgPdIQwrZXs47;pJ=mvzg?BKl+32&~C$RINI zu0*>JWc&A$3gWGHKC4ZUaQ7}(A&YaqGp`H;d+DL2`)NI$-o&bQe)38A>o@*oQ=)bL zK|y}$F%9F|kqxA;$2`*`oc!DK^RbL0ddbHptL!3$jNpkkX9X)^)gWqyg+fhs2x0?{ z25Xk@>Wf-gE$YDWQa`h5;y$x)1Oon+zeY&yY9eW1zozj!4wgWx+2|r__Sa#Yv|AR+ zYXU<&rdxd6rX+VwjZMHe_#Hs;vaUT!Qw)E{u!OjMw-&`ZbxMG@A{R7mdY=+20hdKQ zWn+xM2`lS9sLpGxvx25YDnnA+f5v2C`?0|Mvy>SrddB51*^ZzVUzS%)_*ga3LI;f~( zu&u1J$+r8y2>FwxxB;6z#{BjjVl)?DAIO~NviEo>Ak7{-A^QrI^?J+-N({dsp8qJV zJj^E{;&l_y{wumoPDM;HT7PdkEJuV72&N{S^KFCVOUo#!6jix3N!#d(EDKVZ3~Ca&zT zwZ=rHl!sFm^NQ9NMTkyXfno|{))HreFEN7}cB5BRCbZQ9-l z_Gr3i9TmVI2+BYd{)B{whab-ji2LCBRz47n-wtZaowSDKO=57TQ~Q7-<``7baf~uZ zJ4!T2YnFoaXWGhQyOH`JkBk*klqQso&d%GacKfPfD{r7f6}Fvcv-j=zw_*6F-;9f^ zFH%FXmmiB2x5UUlzfAob5{|np&kq|H1E7xeK5^ORYM!)iWXZrQUf)y7x|6i*ta1{YiwHSG#c-5H8%;ivpEO)!nWH za7+~i1D(J?*${lV>`(0W*`Jzn+i}9)CdFn(@!up;a1y(Iyz-J{=G{ch_R?pI+C8Jc zrO&U8*X5q>cnl8%=Gd|}4hyar4tZPqzP4YU2A{1H|j zv=!CiSEGUb)gfk^cai%+?0E-$8OEt5i!_(H7N}bmr~99RtkScz8v>L92LY^X8@9QF zLSN6s)>S}N;Yv2=XIIUzwpp=Yn5@dIin2`;O4D&L;Hzrm>WH7pr<-lZtGD!Xl9Opa z!}9k6m2Q1nL=}6p>04$QLrvtxNhS%Todl6Y6^$5Q=IIrYG)V zJ5I6dSI8#4ZF`w5Ac|;;!pBSq5t~EKmr=^=C&(Na77?UET^0R%D?rl0IOqAd<-2O5 zuFl36(TYm1qBJ-U@qvq55f`hck33sy7NxCHuMWo9GB{1DUuIOU56#O15?kwr(Uw1M zY7~d5B<`=v6YxtTe!DntpIIvH#M*0Urdj&|hC?Q`E8FdST;V75>uWe87*5h;2JbnL zR_@v2H7ly{mj^3ObcD4xE3{o4$ShPbXSa>k>!U8d=QJKtDPTFhE+JR5e_4&G$Pj7aq6=VjDzl#u{XJqI-sk2h$xLoaj6aNwOBt8-Q$&T`KOo_-LXgb5tr zdh^!i#Ogf!1;1}tE&hqdml4z{>XVHVz)m)crTt#9yKomNfo!fQHc3KSU)6MjIk3{y zmeC|=X0lF1iOIBKzOqdWv3B}7h|_i8L76C;WFZIEpr^eF*NMJ-%q%4~&ZMc0b7 zhog1xm+4vn-8=_wLVl2MQ);&8Z7&DH1x~zLd-H=YI&J(4Vju=Si(Q8eI8K6Cm00*r zI2;uHH7HHshx|5t5PN~7>Tg;<+q>^**5d0u=kYfCR!+;L3&|oOB9{E|-!XARrR=(X-P=I7MOF zO27Xss<6kOVW$jJ_YrTat9O46`qxuTtg0BCI`#W-S#)g1s(po!fcHsnLaAlmXm8YpL zHJ7?m^>GZ?Jv0Cx0Bd87o+VxYy4==NH<;CUFI{0faNo-jm30@{)=;=yPC!VQ+-_i+ z`5G3Ym-=0WxY^1MFNGbxnzj{PK@mrZ!gQB1I0Fca$+RV{??)mbhCnxaWq&@jjv_wM zQKi8NfW-cXy|0dn>&vnxxCMec1b6pBD!97_4-(wn9RfjuCunejySqz(;O-XO-M*^y ztm*EVU(59L^vrzI|7`9%XWw(qJ+~IC-hNee8$pkdfZlpfx9i(0Pq#@azW4c~`x#Gt zrmoL<&&3;ZB+ib$zUT1V&s`)a%lB1*zH2eShoZBcGL%Qq2a0=oxM$89?lLZi>{S~M z7Al_KJK*MlxbykW&WWk*kqwu2d=XbvAFu1Rh`77d~5>pWfg+)Qo&Z?+#p7gB8RZEc>MNoJmBfZk6EPos~%IrrEO_rTMQ z{QFIki@?=|r&5hap1bQ?-wg5A=Yvf5%boL95*_aaMq}hX5r<+)oCJK^PiV-H-P-dwrnY}fcv*zvjt{KTg;!-{CGJV(jfXC*5 zr8WGkb9|T3qS?`+S)x)SV40C?ee7d%?9!Un)wvePF*jN?M^tJGEHm}3Pk(Gqe_Zpp z8jnVusT$s&BPlganW+NmjB@?*TI-EI*$FKC;?%ke+;?4CoqJq`?$2#sTKzHd_WRk_ zr*}1{AKD3ox(h6XJF?G9 zSh_<)e!k`rb?)(d3(qg=Msqrd`g;d)=?=)@R-X=XY^-_6pL;}sVhr!|f*ce;|9>5G z{31>K8xp7jki)4y9pso;^B6hzkO$2e-RA{4_0;hmVk&_s24dSyi|1d;o}}ZWVSSF|IbMeKk@u|C@w$^Vf$Fv zB;k)ScTU#HmYKVNM(z^k0#CFQC}99=3X~{7DFsR#V4ngd35ZF7k_J?yK*<8eQlR7k zrzud1fC)T=0#DXdC{=(`Dir8zKdDfffS6P$EkH#oln!7l6-p0qnhIqAKud!%1hA$- z83UBkpx!qYoC_&lE13p;J?e2mDc==!MXBHIc13C56?H@D-|coo`LQeNjxxL3?T)g# zE9!yrbGO?AEjLItI4oi!q<~wcZ4jHVfTb@Cc_>G6(_?U2@NL0 zo(SzG!=4HKCc_|zK23&!epqbMB<*EzBMuzE?;8dJ;OjRGBtZK&jF*7bZy2Zmh(ZiB z!0SQ`48WU03@m^_AqEb>uMh(d@U@U0fb-H>Kj+B5NFI3?qF5et*RNQfa2KLPo?_Rp zM4n+6qEwz^*RNEbe;1-mUUb*5tWMrk(_FO1XRCtsMf zyqbLRzU5^6g=x#pxW8!&#Ka4;menzTvzDJ@FU(s`#{A7&?$8wXr=q`VmH9wVdt8#& zPk$s4_*+1x`A48-3(bTIjjCZtdO#*VXSZEJ@5{_1P6tU+rAQ)WMb+$3Ozf!}QW$a0 z0Le_HNK$1x)$9+eT4na4b|p9;J^l%QTMxp-KpRFuyw_1fWq7%&g;4?OWSAz{Mg_K& zf^9QknlPpEI~k3$_ZY= zOK|m2;KJMg&zP)Vfi{Qh18D68;2nAiZU8KJn*zaI5CU!A{A*Bm{($CmPW49<<{?U7 zl1=}0pl6A-r`L@S3j7Ngz@tA49o6cYM?G0DK-K+i-~>l)Z9gTDT0NlVYCq0319#7p zdE`t@ZS6eOl3G8fwwGSpwC5u~e^ST?Fdr&9+Rc$GGaLi0=Knj01h42fA?rKH@mt^_ z{i>czx|`k4GW!lqhhQptb-us{dPe-z=&yq?H*q^_Oq2hKFj*DYUZbRd3OOS#0EE{e zxP&GJjO=#c2`gTEguf!%&Dnt;%ar$seMPjNV~Q}=A@7m=iujPiSs|1!jE$V=m|`%( zsXdN{J-{;ie;WL%>Ni1@pS+$cOzh9WZf4EuJO$b)e5u^}{BHp?*ztc0Jmi_`xpt)* zR_Aj}w*oBV(i3GQaQ59BoZLwt!{~ha*6$s%Fg=tFil9eI?sSD_wS$> z8)oKx4NX1QM=|#QRS?QnUu#wpVEJ*HuD+K4h5&WO+x>)_xb!~Dm%P6ALmm5n5X_z- zXRuFQVE+~vR)Z>KOfG@d(dN*92`Z}>-_Ck0m2-7I>#b#b&6dzIe!)H57t60lVq171 zPS?xaqcKA6_+|;!bXxD|0)7=p5+(OMOu?)(St&2ktuNy@9|qYe&(IP~Ww*$kQA-)K z&XE5YWTm{pygM-O3dEB>B)8v`9q{fx0ww7Aj{%I1HYXCOiQ!8~|6_p-T-q=AH$_^4 z9sj$);!54ldg`HMb-oZ!r=v#Au|B}E=)FD6jQa2fVrj|xJY;D}@^M1!q(!fWw95VK z9s0?Z_ujdxHS6=j?mk-n)|sNflKxu7ybN_SZNJ(_6Xj=vg(o(1h!I_SM!z}B;5wM| znQ&XA_vKit*x%pLcQStNQU9RL5?z8@XF#PbWYeKjo3$7)XBFI#Fg{niz9@ZbrR{H% z8&q3@TdOR-p#DmmHrJXyyd-|27OPiX+F~Kxh~A{e8m2N~e7;t%C`n6*Mw_<6nqImj zey$cPPhHx2AzX!itJWH(Fd=rKmTXFT&RRRuBKM-UM6*WOXF->J!Px4Sb756O0Dpy^fz1W3e()hx{}o@<+BC# zi?_7**7Og>@lUmK;Bp~eug&dbgu-8U2&yA=r`Bbeey{Im$MN4f%Pg4?)S%;ONJ{Z1$C_|syW8IURaJF6x zIUyZpuN`Ba`@O#8N42uWqPmq9Ew>GLb%b?TY3hSf3y2Ezxqa3>`3YwmfK&5a=mvQ& zEn1OMj0|<@nEmejgoA_sI85dno8}8r^6_2L&do_t)W)WzvA85#@p|b_?H3S1S57z$ zt?j4kNidSer%~yk=$m>F)dU;3Bs+i@llujn6dZhVjfAaC`_7ZZdJBQLht0Kcyz^gb z;e@~-1qP-0FVpOA!SD_Y=JRubciC6vaF-H?Xw^^flT2ohF$KCm?#Pv!zCM1DJq(y; z2Z=`|rph%)TBF?-IMu+oBHbTXuQi*#9tu^uC@ln<9cIrg0lBxwh%rTjJeyY+Pzj|%flyfLF z?jp4iSa29y3-=aG?EFQvP69<-V6yc5RHr+A_1dnf_)uuws{u;AQflV;sSQl@0}~-# z)fNKbj|xFGE~lAz5dWtcqoJpCenb3Zx`$4iG%D{K<-}e zqC+9V>ylbHcd!xK0c`9C8!5oXFTa?-jDsx`SFaO2^AClXuH_d34UW=k;RY7@tWmQX zT<3|69gnL8;CGfmT^V_VQotAmLELDI$9&9x4nXlnTN)QYQGO4ECjuL|0mks0@Dd3j=r)cTmXbRwH)Zl1w;AjJ& zq}Sl2p5UYc;G}<7+7dXL4JfH|9Vltz0x0Ry;lK_y$s~JC=)Yd(9bJKHa0S=U1g_yv z%=+I=3j{CszZklpTz}>0-w|4}-aP+$#C7Jb=t^+QU(gikMLfAAE{M8kL!JTWTo(f_ zCn#TVL6!M?&-`|5c@Gks=AQqhHpYV_9K_efi&%XgxV4LIp*Yr$* zO7QU4^&fx-0A%|u@KhX~B;MPV6de640F_@(aP$}K?TUhD{1g6$9&CcU_NU-ds72AU zz!&3|zvz#k8EpI0V7AB`Gx`zm_k|%S>bTM011NkPILANXujoN<8arsa^8Xxw_6*d@ zQl!z%^DMzX0fk`4e={(HEBGh;gL<&)xKcQZbkp1>zX0X6te=1QLh!h3;tC?;ddA$- zZ}fh@TA+RB(RrSD_52B7je6ql3%a@f7y6O*rTdG&hWPK}dKU>Y|3<_=CQ5m#g7WE3 z?-vM6?qGqc)3^j!pkBJefO7J-M9qtM>ve!?%bQX1EEuH+6~(j%l4 ze^mS*r}{H%U99`EJacj(V7=}*N4?Mm5S z+?C&od)AfdIo$&j7fWmV0eTXL zr1I%`$0+(q7ob;>{TYY1>rErvrR?E5tTq8OO?@fWcMOaw_)qhPHr1FY5kArU0O zoi)gSi6E^GL#rD5=9feP`-!5X6n4UGzgE<=Db(Wg7QG+<( zI3Ov{3oN|df)%>629QDr;(!x^6}nNdLYDzn=mfzE-5(Nd!JJmG`(7RF(FV`{3r4U) zCkR&Pyub?GEm)yD11of!V1=&#mqIrRmhv+GfY<^idV-19zlh+p%ivzL%z%ky;D{h$ z*6WDGE%{$yY9h+(=oe553dpSxwT^%{+_{cC!}I?;xCg%&uE84FKMej(V%-0JY47hV z6#h?(29m6&}e-osGr~PHX{iVNq06_ZT{~d?}FZJ&Zy-iTJ{NMgE z2-p$d@&gM@&)j_!L3f!CC&$58{ix4+X3@VJK6R`h9mY7PlY*q95q8lt_i6VKkWK^` zeKoN2b_b8_mVcjLgd)Q<&Gf_OdGR@Nj92>a$X9KD6|MK092CM!6dWS@R|qt42thJ% zJ_&HX+YjJCBxvA#&rP;QVS`);XwkdQRZhef-tBF>vdcf04z&t!w@XZr$HP zmX89-6Tjg1IfkA~yQ0(=09iE1ZQ-X-lZ;{0#V?&p9TtlC{iU(AIckEuq)8R@8{{C{ zR@+iucD=jOWBKlS12i-hWcF@l&qxwn`7$b#ar}KJchq(Je0+x$WQx9RzHkRyj6fvf zbNAiz&mc~pm);%!KPi8yFJ3=E-3kTu@J|hnqCl=A5a&-1c9K$fwTYcvzwd~+_IU~Z zg@NOS&H3$*r6CaUnk@r$sRcZZ`43G3V3PvK)ZFwXW9#(jy-y-sS~JK-4W%IeT|^O z*X%^lDho^mNdOjKMnj{tw$C&Fyvh6gwktZajKoLaI0L2akXfNGX{L!ebaY|kaTM6% z?Cj<7)VeIc^Q=BY``|NQJE6Z)wA1wz-L+NHi1Kj0Tm48w{PcX1-*t6;d*sARtXKQ! z!r#KboS~3(SP8VbcHMcr#LS4&M~%LoIS1;ydJE{*dEdGT3NE+#HhGnz?%68%hl0M( z2-MF&4L$5?Q3FdU2PpK9nDNkoE(|; z9ZakonSWidGPzk>F@diSS}YwmcoG@!Gyqyk=Pw7Ut#&p>2DD@98u_+GoidKtr`Wj- zTUFmsP-M!Y$p*wv-0mMQyPc3qFMm3ewH_5fTS`E`EXRg`v}~JxB6%*Ap0iMyD=9rB zX+0Vo^ts!pwcdZGAF^sy<1=6Rtfh7`IM2a1*E#V%Zi=lfjv#??rPVu$bL04CzBFMKJ79;&@3N=gOy6BhkvU(850p=|#o4WV@Xk5TZwmx1o7>I#) zdBoioUrd7wWzJupp-|aUTd3^mbcLuDw0xueK!PW9F%gQSS_gr8+8Gd}hR6&LGlX$8 zE?!V}l50n+@l+bTP-SsS1jDe`62SUR6?FJJU$|Ve37kObq7_^dvus%@mtoQB`^C<> zGPS_3!Hl_n$1Xs)bQKzAvE)S$fj13w!?3kqYsC!ew+Kt$-|Vww2G@>5qRd7)Y`j-h z^L$B-{)Aldou)r&T^T3Hi`K$fs6Ulvs^d`mbDERW*m+Lz;mP|DcACXHiE^AsCK*IF zYVpg!*ZSd7)=o`_>L|OWu4kqG@O=|Bz7Q6tlXSZABY$n%->nNs;xZ-{ak^T znB3-W8a=eVFX9d!Xj3lWjVXM?f5B3BqmetZx;U)1G%t(o$sdNO#Qk1lL#bsfLD|jg zQD?u!{E*rW203pDr7lQWJq4w{roXN-ICIWlZj1_a@DlRwte0x-HgUg6?H)sfe@#@{ z&q5JFKobm2dlH#xb`Nt0|ED%n9yNl`S{&Go9&68NsCky6UI>1WRP-u&4g+DH!};UW z(*6mU>7lfd4}fOe?J1|9cxG6|HV-d0hSC!^qI1LpGmI?x@%8B%;#>=Nubom}z;Vmb zAJIAL7ed->B~)W#=(bYf%*-7%&1^0J2neYQFI!UMWaKyZ;5@05$_Df=m5&A}fw7le z4{|1^ybCfhr@^;HA%KOsYfoByy9n`pU?Gl^~05QU!CQ` zPs5NpuB!oi-?!uMdP#lcY!CVa zgqv|aQChY;bNYrD5$5M?j2cbyF@cmiDo)=L8NtV+&Exd6aKhvTfx>KM;J$R?UCO;D zrmUVSz4H|nCDtxP*e+OB!K)IsU2Fm^;Bzg%*YGAgLads>tq zP`@P_nvNV0_e>jba-?rhJ>zPSmyCTxiwH|CI58?V3hYL#g*VtS3!~n|cFZD2ljU#7 zlU#j6FO!h3IHE0o5%`9(M6HD8QfmvbtNXi^ z^r}p3NcZVO^rs*DZA`-g!TuYkzJ^-GgH0jw9#&ph**N7{jV9BeoQq|NGgUT!_CkJ% zPYoVtLtz!;nCBe974%QlistAfirw`Gi*^d5?yKGyx^_7-nJTnOmKsOoynr=XJY`n9 zP577CLOJU~zCa*{ao67_-%E3Te8M1WUTE7V z1sD!MDvn&V7dj9Lgt2O~^nFU|lN8#Je6{WPC06tjbSfM?o^R!d!;NrrjWJ^}E#Gw{ zUUCV1LO^#Ij+>;rd7~kZ!c62MEyvAjet|UCyk@A@+?jU9J@*-RJ!W6^?q)YN|COg& zVwOULO0b9)4NpIWMt08d;v>#G6$oDY2zLro^agWGLM->sLSFR2kr>ywM`Ah!xiK(a zJ@5SeWOAryD5$yC-+e1{hHCOQYE%!d`7lTHd65&fZfW0zzBdD+N%`2M$RdMUxc#|3 ztk>>D)>Qrc19pRZq28eC$-7?-j%ETPf^em%N@92NNEh%8EJ{<9K+{Qde?s zT2Rcc8_oIN_C_3c?Wh-T;UF&TzX$Z4eJ7mYWmi4*C)xeNWU|UNl8G-fqU!%?#$$q0 ziq@3mCMNyZvCM(`O^=1C00Wx5JR%zKh+Qn`oFm_vc)dk;XBlJvNUD%#iyW9GGNutd zQCq&>pZDs9t0I>2EL|L8O8cES$8wRH*4HO;AQwjmhc{KNflG&ru~>DnZ*88X!zF_4 z2GK(VnYrg(e>6)^mlL%=lDcHl_)s!XFC1@aWrf7=#W`A+;1m_TtPT6l&Mjwoa~s(Z zMh17J@=aaw&1G3e8qE1MVs<=P^XL=kSf-3pnjfiV%AJIW-`S*`;Jr5`;@;0XKs6~S zJDrgOYtJ3nd(wVRM&1^>W{PsVa;N|N!Uz+^*W`}P<0HC*p4UIMpdk}b{(3GyL0k6| z%Pm^kkSsTFFOF+z7`s34+$u{#Rx(996Ca6uRrtA4SXs76vUTf7Y)|f3@=}hRn}fl} z>ZgI0{rDB%3twRUtJus_a*=pu(pWfP=ttGBN$XO5dxI?-3f?6$f%3cKelKCU@vM|< ztpUe{Ascmmq3XrN!q8!pjb5I#twAOLGcp$}D_S_sg@xkXfHs+F;c0J7WaMG#YVCwI z;ueuiVvXQk-MNMeV$TTAkkJJ=&6j)}<0;rU?rA0MR>O%JLv_b2lQI#nT*tAFHyf4s zmR`tfe-JP!(QVn1sMCYQra#=8JaINmKA-BLNSfeuujHhISj}jco|8=NeAzf1X}!ca zw~rZF7%Fw~@OeC1bTpcJ_=onSU%RmE4rVV)e5|J`I#TWgg}6`7?iQUh#PLb&Ww14RO9OWl_25q?v_L;2JVogE_|sHTD3{pz+Us}*!SrnzwPmMILhgV zovO0WLx{8G6rcSaX8%(`&%5?e(iA3VDMwXBL0`<+u~x`%PBBZqBely-vnl zCs-oE+Y*)MM|H58vI^>wb`Sh-nc<^I*6zl?V1L(rRAm;ywD$ML4ieyO`-e%Z;TQ2b zE0VD3n5DTmZWu+#(KMdIpj#}e7I3I~Lo)Cc>VvmIqQ0-4n#VNe=z7}FCe;C)1M zyYY8Rc8jGM@tO@O6%Le~oc+@XgcB<6Ux;aBDVJEW4qI%n7i~DNt=ML>vuqkZRzH|L zMd@@_ZDy`X*yM2=(YlVu)mO^$LAt|^c0PS>P+=A&>Z~y*WeASWoIP>s^>d=XnM!b$ z_z)@)u->Olr4pYRD42Y7!=o#59iEwES0IdjT|d`;#lG1NI;zMSs^PQfi7edX%;mz>5y zO^@#QGkrjN&2r|1Vk7}{%<2s*&PTx`=>*b&uQTnkty4E+xU&0r+K?>VlxMO@M{)kc z<&aF{(z3ik-s03IM3v}ga)sMYI$G`e9k9qd@!h%=;&YIZu%}J+)_XClUOd2% zGExdUIJ3I1nQm)$5?M6TB{~`C@Y2MJ9%Sd~2(O_!rx~^@I}r|;>gcuUFY9HBBe04i zH+*toeB})|y?8tN{*=pxV4}m`xGuyh!>&iVVYZ6_(a7iwwXqE~ow^EM{jO){c=$2K z(gJEBsq6qZKm5}TUS$DE`19ph(d(YL)^2^AqO8^OSVbEGmW-J7W8_96Yc3S`AS3FL zm6qble5^G63T0Kn1bSl6gdpeeZ1f~6LP%G=`v3%msneafsOlebTc$qy3> zLv8g%C$`NfsA~z_ZQ3f29~Y;d8v&Q4SWI7=cU_9cB>F2hBo_0EVLgxEX854qhhi*p zvXt8S-bC2M6vVstNUs4(W2a`Xj*^6_-r47{tEd;wU{-Q|r+uO(B9a)tVmt4R{!~Js zQWMM?=}U3)4nXWPY55+yGf)ajg&BFrkgE+in>-R+s7Xj{-yb zfvSW|wkxAEW2P7jR0dl2;j<0N&?>x=HcgHLj9Xnym3u11i{utek@;_}5EX2iob_Iw z&Ym9y?bqQP^C?Hs1REPaH(#pcZx{wlDm-;ONQ!s>Xb_@EY~7moVxhaEdH9(-QWF9$ zu93`iWo7YgVjEX*Q%APSGM-Nt+Pt6iGkov+^nuUk%)ZapZ6>#Jr-HuEPgJ~K~uAb+aZuyBl!*^6FGa4EiJ?Km;t!*Bj&gZ9Bd)DdM;@^jxrtUl*-!B{uW+)j} zsAi~AK5b|?@ZZFSO$Z&n8ac$N*T3zYo3Y3?7yd47G4Dfr&)goh`XXW2khI{#)b4vE7gO{E)zs{5Y*1nXg>uolBx4qY1t1K$A^$g6Tl*V?!4ysvGR3pPI&n% zewS;Z8^W+JLNN~*=-j~L=OI<;hbe09Fkd>EBX69zQj~y`$E$ogeZLpj=}1dmUz(~; zbz9U@I+AHfbSz5!9+3s3n+OojlsWdk4A94UCA@B8y4(8z+Y4c{AI&PU^*GGv&aN+8 z?$PUKyV9zw7f1FUMN|#g)|-{h)nHsF3aK9tW@D%j!(mtg2u`E$DpPy7g=)U8{SN`sJDc7wnZ!7t z>63?RltMRZgpLyKAl z&6_{X(zy;O+TOw07CykMWKI{-1)OCPL>^p^7&53;d*rWADu_f(pmvZ!XcMIKLdnJ| z6>at86wVbx`2_8CuK@@PA-NlgAm}OHbWF!Yr=p_?}gUll=5F`vddG zXbdRA4Uw&gMVT}bOKu+hcFDL;uL!46B9G$whC=gfy`*8rViWSN+&C)I8F(J6#(38( zKT4@S@N6okusQ=7ShByx%QL~NiYB30{n$ zR_MomxH;|Vqr+1shs23n@WE%0y`?c$NiAcjGp1?rwvrN$dF|`0wbEQZ+wr5ARf@Kx z-g!XL>)vE=B@tPzULO&U8q(PVboAmjz&vZ#_JCo0!Qeu8tGjSJuS?#DHK23%uwy*5 zx96g^?HPYd!cI>z!eT)2%Y80YBuVI(8p}=s2;+GqO`%qRD*nAulcDJnQad}CL1c&_R^f(>p*5s!+-8xh|@9@O~L`S00 z1T35Y*z~S;NVp8yudoDN)*^k5>>*M&ra6)mVRZFmZ|)Ju{f=-WjI0tE78sX*oWR<* zsg=TJDowk76+z$X$i~oCKMgBdr|JtN`3B%6R!=B6s%Fjm93e$gkaO(iW3@kaiAs~N zXdd*SsX@80OxE5P^N~Sz=59IM6kdo4Z!io92p;1O>F9TSFhaiU9tFgqUbEFqmn$@+ z;ji#I8%jEfOh~~XJNJ>Kc?NHd^ggS^vX3bGJe&?A2u7VO&V0o?HY>~{y2F_u@P+*G zSsFqVI*~Cff~3u3L~g+)TRX9PB>Js@1t!U<+?pB3o=j-=D&aRuy7F1E=2|uwD#TfU zecJhk`smx2YwCV!gy#UUz{95Y&8%xqpPYS|kas3jjG}fNKVw!UM$*~Q$ApnGg}9*$ zQPIY;JE8{!OgW5|;CCQgQeaEc8;xnqpBATH2M;Bf)xAvAND4;6Kn)aTM(}|?<`t<_ zf`u_<%_h6CE_h);nf&zdqCHNzjAW5%OwBc+p{%>k7Lw9d8AUPCVK1K+h8RJF!yo!O zxqcmWO$Iq(iX`pG^plA?U~gq*V?>eivEoY_;l@A(dx*u)oj@H~W}L!=WEb6XOi6`S z$511D(hLocKE>q+)=dcK9SYDVWAu{e&IW^q^{1uX)#i8DPt4*mwQT5&)`Z*ivlm7N zAMNzs&Jcel{5aFyH_lLtLzp_#v-7^9rtpL@>&2rY5^hRc?5aM7vrM^mIxl`%*wS!f z=f@xm+`&d57qtIqp0Yr1*3oPW!?f3(w1OJEl`H3<48_`Mwxft2l`(fW*|cH|XT0GD zXANG*xaEpl`#Phy)zgW)Nat8eHL9{W6Cps`WJ3rJ_flNxev&Td&lciI$&awtW5ZjxxEjVKX(J+K;Wgq-m_FR^f-K1>7Zpx?wPP)BDs=2V&{Gp<=2tTWbzz|bd$m{%^ zgq@5Cb{?4x;!(;Rh-h@4Z%VF&EPh^euIUglB9$?CshJ@Hx!E1oI>h8TEZyNP7^=j9 z(l8>*P8L(DU!`mhgwijI_qSIH-_~)AcO_vQV|6^NF%=tiG|9|7*9kNyW5@swK6*gCSG&_w<8##t@%C z6^M*vao;!usmK{*%IQ8_B(d`A#m2|bwz#Vo*Qk?I(9zcV@KM&6Bd^tg*|JI;CZhC z6Kj!LLJ$z@IzQNQnXKYVQ*tPF;ATvxBKw0eJ&jfC$)|ToMKrCTgOB!J7Hhf4v`AkHcO z5be~&aG}xJfNXB^I|%5+Kr-&Yo#YzR9g_~0c&)b7?H*1M-7EVi-qv|;3+qW1QK=C? zh~dFRH+*UxvOFrnY`I-KY1gB9S?>UFeJ_8Dd2ManIRdYRC~w6VdX$>~xL;{aV!{qy zJ#yrjA$6T-TH^v0k|-q%0!BiEX;r{rh5EJ`SGs1j1Tl4a+L(a4hlkPdnmAUgS_ z%|LMx(q=OGNSZV&ZeevF%?|;O1vSST{^cFhel$JyNuz5|>~cyC5qwWvlWbZBIiHy} zQl|y^pJ-mgiWZN%?*&CVE^q^`oPl2$)F!l8M>_ViCyjgy%eN=YD46 zMSqa|(XE#@o`z-ydTUC1HnvOBFZcR_kHte7-47Qrd^8&2t3^ZMyE@*^MM=Mhg5kKp z3K7xLYr?>}fZ%n5>5f;7;@ss!>B)+VS!0$C1V#lsNAZS+ayJ)m*)EL=n0&IHND7E& zcM1bcj$u$z@$g^7@!X5whX$9xG^3as%bKGhX^y9t9Lh^@c{!za07E57W6O-_-y zqx{%_Wmkwc>(r_Z#>$=p#5|)cvRu>WxK#q!UFl6Mjy_YGLvPu7s{(Ru(3?WE4A41i zxQMnB;aQCVTeb^%j+IuErnaSNA^#oI~$AGTCU#adq zmFdwZl&Xr&swrI=@o~V(_SXZiTT_Kn9b69lL}ywO_1?ufE45^`5CpupjFeQHPONL< z7q;jb&lgE6R~oj6alVvj=NoDm?AqQ5eAI#j^Dm6sqXywtzi<^fzYHPLvSTL#pmPG* zHX&CmcU5>Hg}OPHaM{k&9*pLLVfezVbd>onmW7IzVu+k2{we)-pgFNz zhMYE63@f+m!_yBrJ2z%c4tv%1vyg1=cPuwCg@Nu@Ho>h1e2}v85ASoa1;suXBOEEo zzF<)OW`MSlV0<5vudEjb-&1Q4JMX*&5pRxqTx~^Im$+Vc$9su%|G6pC|0mn zK*0#zF5P%P)&SL+)=GBk82eQou^D=Joq}?jKplT+Anwx9@=O89_`EI%@f>p9PG0A> zrtj88@SQ|gw##bWXFsSi?E~ZPeB-;^lgLW>FU8J;F|C~zpWT>;YZGSg&=_RViCyJ4 zZr8yaAkWkB4ttzv zJuTXmKP(nw%ELG;$ztP*x~;J@&v8d(sbY&7(6!2^GHD=}_9yhX`-L zVSlRosiPfeHqBcj7?+|vTiV;@`fkRW(W3ZuHIwqSD%wtJ97Yl!_wNU-`VkAF{=gQ`Wg$ zF(Za6k4_3a;}WBxR}nb)^u1B`i(St3Scd)9qi|wwLugu8aLLj}qjmz58<*FlWj7(N z_a=+Ip|6y>l?K!)bChN|g{pjY^aF9YBoXBXK5FTAIR3rf(MxH{j1^%pK-5ZUxldtFXX343n@fyH(b1XlRe6yfU zY7E~G^lTl*1TWZ+#4|ZHl`tOUgbz*Tf{P>bBsG^GW*0jQpbacF&u&uF^?VlhAkYrp z7QW0=jDYF!pA(@R{<4=@G=yR6jABo?d*i(l=EU{pE0NXz(!xYk)Q5?Ko z9-Av9P(?NOg!GEy>{8ShfN}WgyWjNoMwtnn*3-hxMr!#beTCC9oCfm}RT_g0CUcDQ zo?_KbMx;ebXtx()l*IvptANGHw-(RklK!RC%!9j)*Cl1}`<8AC)<*NSIl&+@|bw5eIX06IsBkf&-T(iN)siLRopBbo+`Vk!r zQ5oS*dgAj&4-jep9LpeP@O2=@KBRNMy3$$_(yxTqwmLez*QjoiZ)v`#!{DxHQ`3&j zhAICpp3lQ2I)8g{#ZFZ}Ba7hMo`ODUroEwjvy?@#NaXnJuJxv^=0MFk@fJ_xlMv#IN3L56hW9N^#v1zrG&xfsAd{vfrO>$?t3h% zLqJ;i*_oRgY|)d@lbP?3&1;RgFJGP=2p`H>XG|Aegk+*Tzp!HYdLmhEtzky4b11g( z&K~n{VUwl-2(z;@!f5SQ0Q&hQ9hjP~xx8WMsJnZF?TJ!H4pWAcUCK8~BjH@|xOC@0 zG|sSi3|GPQoJ{S*J>d72>Kg5VL+oq`3a+U2`zm%b$s>i*jMjGr?HSelkE{eTB*p#C zEov_XqMt*naviu@Fi3s`j&lKQb(ezfvfDFiJF zz3QC2Lr`yYGGQo}YUwUwL5tOBfv(YP!75LGn1i>_#=3+`YuDy!Hf^5}+3Q7Pnm0I> zY$vlJcxsaNhjX>=Cmt7+Onr^^wC)J^6kYEjB|Z%^hkaH|i`5z^cYTB3kE>?yAz(PQ zTlvb_w2s0c3i&;3y@adkWk7d-OgBZzqWPB*f4B&}?+>4cqdSJ9uX5IGWO+*<2V~>| zwj_L`{D^`iL3d6f>0MbkWM~rl)S2f-k_vBEcI0`0gYhBrGF)HpWHYrhG(8g|D7y5Z zCHz9A*FN*f1bCDb@1=ILga{y@+fIJ8-gFq!4tc~9??RKBvO_@0t+BvlJaic<b7-SHvnNzIp=3^Q`OV$3Oa^_4PGrfk6@&8whR8qc&qs` zgU@kr*C>kOQl*8rU6AmhMOaHLN1CL&X9X49&d9bno)U-At_C{3r2|Jmt@@i?fdwhq z>lTx#FRyd%qwbk+5@+oS75rTi*p;lXx#?8*U`pR=uyOL%Swaj*)!m|He%M8iX7->ap6df4LZp%S% zfQm}*JoIi#a+SdtiNTsJ(u#Nyi9*o_8m?6sE+lq%SNaa~Y=g0iHnm;kbkW%E;q&+G zRZ0GbpC2#3H0!l{-Z6M5->@dlabyZ>MD3T^6G@L`zeldQXmiR-z-FgkbHhIRf-$O^ z$Z*+ULX!i~28I=earK;}}Gq=5!=151&-{jla4R4HS9kHsXCQf<{ zNgpof-bHDDfwiw<2yYUrsA^E*X68HK5J`V3Ry~fs`EjQhgR5Wrw&Fff&6Bn^RdIh(ExUSTgus5{%P znA%ConWKuH4W30G37lZ7MXq-kMUr-i!x_g-ec?t;x7Urfy6}0le;UPg1O-h2N77hb zj8R8eiU1cjoO}1t)MhG92;ymquh=(ndPuh)!D!^TX| z*@1LiJ zpyF@)@=V2`s3??u%+XNOG+Sbf=*C&iF79gavYB*Mv@hzVKj@=A@9gsR!dU97zKP;K z+^8s$e>w?G%Xo=w5V@;!!*2#fjN6MTsUEO~aelyBz@9mXpSCZ*6XWDiu8i&rSpUq6 zg%Npzu@eCaER8R(uaMl1(8Qz1J60U?E!0Q2Qzx!OM-eVxThdJpJ|aigL%d~LF56L) zGm?uGs1g`pq<=ibAxy{&M&gBhz?}f8CkRcVO`K`Dw!S_=yWhxP1t>N$oNftSmPZ4I zK-x*eL$!-w9kNLs>-hG?&b=GGvSod8s(GiP^?iBxa%OdlFi`zm{pYIA4aEN4JC32-SSa9y`;3;4VwJ=mqlA#Hvb(9&R5BQcgfD54X^-on zfo{}3!4gCE7*sP&X(}0ycgh{Z`s1N91I2lo=#c^~V7<3(?y|P}_P4bgJ0E+(KZ&EA zbuV_lY(0Rpk|YUM>s*lBe7GTW{@gJiT;>q7k7-}29g@68{kk;XT5M^x$VuTyJA`fR zJPn&bl54xjbMkt{UPIFD!3?{jYE9uAY^@H#;9V6>)=ctzd&%u8o99|yiE9130ak0?5c#!h(@~ffGy=0C>himer)lCzH6P3As!nWHQes# zfS23i-Z0tu%sj}L-`=)c3awA&(pkD8c_CYGVHI2D(y`uhCDk1#Fj zk$AX(SO42dJKWMGfvFI2yv=qNV`C%nFXr_aTnp1zecH{RT9Md{jZxOuP*~&>5X0t{ z2Dc-xpkL>8C3@s*?<>P7FysajUxfNf5H^!K%L(BQ?k&j8{d;HfLfF9jUbl(D%) z(wz6qmInwA1VIuD(d9(D>c(((HJd|}#a^_w5NQDms|mZ)o2LGp(zQ64DDlpKt%Ay@ zjrMc$55QOaKo=f09>h}aRsIAGj2c{8R{v*I)6p!Yf@@Y`1wI$t!ScAt`heV3XBa>m zm+Z#Hlg_@>MrCwM9%*Dc39l$=aP}R-x1gj<-23QMC7*6YQ;rd;5eBL^L3yvF%wHkb zOlyn-W>jyuovmAq3gUd=VGeD|u?@^)4Q|GARfc!i8<>jk74B3|H$?KstXF+^`)^{> zz*@+F;>ZDpya76`?|jxiDVI(`%|tLHxm9rIwfR`LE3(>H+YIQyI7S6z!FLnd+9`Zk z77zo8PRF?61sPW~L0_T6!bnWrxu`-0cQ9l}?q2FOE`Ad5T4s&s2MS2M89Fd@$mQVu z0&yLciE?KiF(T#qQzZ(~aT9w`5%-Z+Fx7rg_;~Ym#W}fPocR@d6D&q{BIA_W9g&3h zMPoP;E7EDd6pYG#;HNc4iZ?#Z@BbfP_ZS^n)V2>k=p>z_V!P9^ZB#loI<`BuI(DUF z+qP}nwryLJ=Xqz%`(HC_&9|zrRj2Blz3=OHZGi3FlJZ>~Qg&WYT#DzQJl%U>4&)^^ zb%7k^N>%G!-K(%H@`qVEx%X#8cG$}?EWr$0zifT@M0r%c`H<}%59s6sEiSvlGEbQ^ zPauyhv%`?GhTr!nRLAyY>X{1*)?P3!b{UbsA2~{UPg6aiWJQl8qP|PxVmxb*=~=HL zwJq0w?h@O)3CPwS5-<|Uo6a2#A%(A9T_W<@PtX3?pcyTn?2vyPZkwaN@r33e5mLoA z1)oMV?Y1Ew<@1bEIqPy~t{wF^X}0{(`h?WWEA5Ol+WED1QTHKlFD^eco{ZG?pzaKL zrLQF1%^O`jV&sa1twUjERb!ZxgF%Sw=_`)uuc(UQUjrPAfy+Vi6aal2ie&E3+@KJH z?(S~*rQTp5-&0{ctHP>mK>4x}G`gT0VlE$Ye%S#Xh$*4<_E#a2<^fr@WAX_lwa{>T zP+itQ{m2iU_G@Itmo7bZ9J2Q<&jkQA8-(!F8id&ZJmjF(BBuHJiZ_$aPkF*+%+a|e z)1rXKs|H05{F#(vgUy=;&GjMs1Me2Hl!9>89uyuU5mhgE5~bMGS(68-aYyjzK8Q(!aolL$uLjHe>IXXZJwuSJ2%@Bv@cqjkl~j#;XXQ-Ob6>%ilVr zvdah_kQZ*t)RIP`XAJJlqqzAUW|XVB#JE=ZdFJ(=2}9+ln~vVy-Z8s;*!hw8Bz8nm zH-u2^{}GY>_Lvs_-^rY2dMsL>{K%`ZCjr2z&BQsZGVEfNW1^LCdUhx>fp->mP#*N! z{O?I2`taw@pg_@7DQ(DyUPiIzRwy$Y-@ojRhwTAWjtLd(Gx4AN1+c-_r=(h50ekBG ziH5LK8&DSW1IKs;Q#PQGji6g#7uG$+7RTH%5+$6l(3pi;Y0-<2&# z{>aTVjTCIlDU~u@^?gl>U*|+JGaPxR*D6^%3rDqklviYI*5(xT6h|l#Hx5qbn`-Klp9zHOk4=2G#Vj+xK}4ml(ActZq^TP6e;QpTAI*nQJ zPe6ZmCckePYo?R3V}n!5>lO2w{*jpfrMAxIXuAfqYMO|pq)iECerI~<^!*5)HWJJ6 z%Xn8N#WJpt>yd*S{QVHchbSs5#m0=>`(Ni?+MKOxT*8#Q=es(6-eG%QC2h6`~P%JlNz7syb&*c-o)0N+)W*gn! z-Cf<=ZfEYn{-Ipty?X$Vy(V7@fpJ)98wN862crSuHQLHgw^FlV5N!KF9mDOZn@s4c z8LP4ihMcR8*bBhI@>d=Z#K`959gdYm(itNTr2?y)OpH1xW>m5Lc)0fN{2!5_=I~oZ zX)o}nYEn^3L=aJ-IrMsp<v)ot=bf>CAlD zS$B}ZaO5fc<|x})9rVLQPuBwHIFbXEkI;)FgNC1i3eBS=Z&C$#M{5HWl zzoGIzJc=FX3q#Pa61^z&_>lLEY_;2TH)MD8_Hp(SzgX7h!+Uqo%UEIeKj+n?20F9q zh)2MD@?q12Is8jTHsH3F_&S$q64Vzt%!`K#guAsAe^VR7|2_78qMI$xgf8QCAPnGBDa1vW>v&p@d%QlPcO;o6WYXnjyFWSAQF%?-<*MyO;xudXzvw5QH z;-2-aQ8rLa>Eonq1kA$Dc_!SqZXBu-)*aT;Gn)w z>n4bl0!avbhu_9Ne40pgMs0-_rs@w2o`l&=Yy5M{*{)#`j|cO{ef}&xZ|bg}lS4E4 zJj5o85?%zDYQB14Ub+HgF27yPWb&i;WI76snG-!CzaSzwP*Nyhu;3ZJis)R~%p42D zK?Z*Q;8z$!f?N4bP@7UHGMGxBno|qy5lGFY2x<&g<>cj z7cS6om|ynC74|M^Qk+uIRmOi_PnV4c;^xKoyuMAOljmJ$WaD0=H2p%umqiS{Q6QxR z#hHDhj(^scw*FhNx&QGxdgvW8`T0y^>lj$v+JalW5GDVFl9p@%=K{>K)GZXWzX%!a z&Cr&KY5Y4WpY{~=>rl*WBBU!wFf=Jhpl4sq5FfiQhM+*>ES#Rv%qm~|7B;K+2|mZj zHy6BDJZk7!Aw71eS{MaBgN{9p0bp&^(cD&R|I$1NZu?ALFpVekTP;FxxKI=->E97J z*`-Is$w*|mw*Xh5B*~sw@ql3eQpuqBu7F)T_Zgc`; z^jp%B!)_CxKIt&(AUz$`{jJTUXwU<(O{B>6j0-C`ktm!S{_<;6n*lah*T^3!OsD^i zb1oWhc7OQwg_i^ zA{nsYmQVgBm&YvBQNiUZ(4=pHlNz|W4B%R8uYhx~>2H{jK!4+ujqbSn&?J4QJeq(kIy z34n_6{Z{{5H3G-FPRce}_eGTLDrb`ikP z%@$xnC-({?-ZwsMlUqq)4*sPjo%}aJ3XEl@XkkYu{7>mTWw7rBGde)zFX$3r4@|Wrx?>sN>^j@E)eC2pB6fy=lA8nK;y&N(hN{tcxY}(ajkKJ{J7#-m8Zeg{ zmay!Lt7wh*jFoYTiwAUpvXYBwj#F`uzZ84r)fJ`d$+tWiU3 z1qH%weqZpL2H{3{ur{}^vetc^GXyvYI>vv@a0Nmo$$dowY7{x#A}4;lt?fy?J~E9Di?bswu%PB^o8#RvPtGgKe^7pBoRHa0`;a(QY>* zO}6;-%?&tJlaTuwUf&7yNd{ZyhYakwTVwWN)lIF%SLw32v5 z@EZ2y3DXR`Q>7y84gI?8|{&lJBfZ{9jrzgf{LN z@wirj%+ryq3Mx?-ka=UC-NDbJ@(c}}zB%ut^Vax4t<-6EQXRV99%eSE#o~@UgcRbM z^RjSJFwq=du|_ZxW18c2B5hzlN6!24%hnj4STs84_SrZ4uUU&o>IqPv^3Mx_0P`LW zT2yZN$9HL1J;ILZ)A(%N9SPzSB!GyF$-Dlk=(%GfS~VZIN8u}uWArTys3%`e7W%bI zK4C6!;zAyGG^JuV7o99PfFkg3MOZ%!XeXP&Ka_a*%8Acz9jbX%LGjUaIc$adK6#zq zRt9xFG}xE0nnlx$0?)%Lq}v=vo8ewZc_es#Sg=)Wf@gjH7g1cDEDl^ih8!hMhz~b% zg-aC0qe(L_c8Djx{%`tzHkJJ4Han*}D??ir4@eFykHH%&=X-Wd9g|1Rben!cO3(+i z=D>oZF>&2cF=i5?8fL&d2vEtVY%pfcNr!%lZ^Pze3Zt$c~K zA-TXHxNvz{Fsi+_*;8Y-ho-2T1`d}qJ7IsoMc@|%zW1Br6EP$%_I!SJk8Lu z1VfLldDy&5x@d&6*Hv9s-1tN(xbgxg*?4XfsD!D_i^X3ju#_Fu{eeYiJnMU1qX0{hKM z1;fC;-r(E1BrM;+86N+N9DXA=N?d8b9bqpeGH$67BA#65=}YrJ=Wdy?jchc5QigX?IzX#AhD_?9);8TCSTJ9?3H*WD|9Q0-Cs z?H*kfYNP_Pb*D@|OyulV%XUk0UDm!47@lBs3QK#CG|7rUI0k2YyB!@W&Bc%j6MZsI z?tyQe?VA=?)u&h&?GzOb)tip5ymY7(6kc(hE_2s8rNL&AEjOv63z|1R%}E~ADwXwm zgVaqk)HmRfT+AJ0lFD;(fMM#tSR*{<>|Bs=J?4qNhj$|GME z;#Dud@MVuLBHo#ri6a%YC|0_wFB(=@TFtGU9wAv^R1!5lDXA|5K%@qnj+(R;I+ula zu8~o(%@$kr#yJC0WJw$?$=Ux2tcqdJM_fnU&s;D|Z{pXI?zm$zQc+fUWnavRqfyqV zww_Bw{E&PG8@x=X{>ED?G3FO72?BZPMR&(V8A z7>LDH9J)K2PPimC!jD3GX+GbX076KI9oC;hh%*5Eu)qv8LPo_tCx}BlF8#*6s<~3B z_6SJa(<*ZG8;iw5qAxAjPkFy(^4+D#KcXE*!eCb%}ZNsT4HBl((z|HtiONh$>TYfv(buTYw? zxFCtHkqXLM8WJ8Qe{&Ws|2mX<)6=NPGNcxx^|nhD41p`=PIPCdPf9SnYY{h4vRc6p zZWQGeE{pz(m+&y|bTAY7msG6^wJ*4b5v7A$Az`16vvH~wdfIbMnmfX)BR?u3g`b0P zGOXQG{8>a?D%}+aDjEeG%fv&GQs^?bMffw~t(1^*?h4KCxfc>4{kh`^7TtKxAZt+y zZdy`#S*1f4Dz8ep@AibejeZLbFGKQt_xKYIw9QL)87#ZlL^vnqvZ^cx>CFy*rpVLK z5u!(vvd>N)n{{zUY6-!#&&vkMdSE35cLx0mqHGHe0F#Doji*`xW4~w(h`VocdC}wV z1q_ctNh9`Pr<%zX_Kz0vnB$*A@;gotCjzcUG};fhKQ3=;6BVBV8gCH2M5CL;u5)E; zM+UC@V*k?jM_*iCB2D>l1^>!6-*x(tc6qoc@bnQ9Am_2cIzpwRc73V~9UMdqCgR%TgGWx`?tgz5YQX>*tVr*SIA4r5&0XIK9bFa zLze+U+ByLsVx;>uW*>1t>D@EgZe zJbqEGm%x2JJwi*d6l4STno*U+a>H@kE$+l71ffQ?+jl#%lJ5t*{ofp`>tJO1EBxs8 zs~q3hEn2qTV(yzX*%I_ZoJ*P4a$Sm=_qka>ej;;Ff@e&GxcoLmdTeKHX$15)+?u}6 zDRh+yHkZ)zA?)8da=+>;3X>QdMMeS_~jbL6@I_P6a-T}+O^sz`8(w**r zJC|L6_*!mg=An;DW%*>F;UXbG8{1Sd^w_+7g|t}DbB}WP6>|D3|Hg8sl7pW$+XWtn z9se5@kFc(ah$H2}%|YqW(<}^2@kNAA>J{3nPN>nt{hr_bmA_TvMWAuf(B2(2ttxvs z6R36VwAB?jZd}g0`}uP4a4yDl@+q<~?!8y^&EsN?9=dt$7;nnSyy~5X3+@eHDKgTJ zCop!A-KAvCv~(c#;-{#o)^>pA3TO2bJL+lv(=4=?aU<>zO!LbUQ4Z?Y`&-}@yRI>h z$!C-DSpr$sN<2jAP>uKJ?IG~}eA31_&mWX)f3?d|rdhfXJX$q(Ri9+rB+ zkf(S1KLBpjIn6ok+A9AI9L$oAArE;S_`6C(y8W#CpL=(}6w`ewiNghJ1NO~}@-=%2Gg%5vZwc%c9_HhhFj!oT|B`=3OKpKPK|PW)vR} z9gd>zA3U3Jg$_z2R}H_IBb0w>Hio7k29!|X-hbKcT_`Lz(W=&|=wXsIwC)*C-i1hL zAsMV6kpfk9fSUz(X^aJ|`Y^gXddH*t<~B9^ImD@WLy}oNEX3Zn+a?V^C!`Sfg50R? z!KJ|RrV+%TYQ>fmPVw(HXFoRh-)fY()FHbiRi2G ze@;3c^W!W5XwFDUnD&t$aMI(Ph9qA(ikoKb%)q@xl%IRm_wCBi{dDPjW8#gjkXWr4 z$e95^?MCqi=OQz`5RTcX6})+E?e<@fqj-uKSMVi0i^R#{Q`_{MS=*~ve%USGFdnM3u+oIE}@ z)`*%5*sDCBMz6WO#hrVP#=@PZW-S8euy*X7=qasqUvz^Yf{I9sBz|5?j(f$v( zeNFxUg4@7@|6g!RR`S2#w&}m%cIf{Ax76;)(T_OE+0&B&zI@jaCS>Ip%fcDwh3sXGxH_i+(TMCxXmM22i97FK0) zok8!tX4kmbs!c!-(MIw4Nuzvk0@Y!2OZP`9;@B$AnPe&&2}`(T+ynH_*oX)cGxucI zU9q8s@Zy!8qyZr66C(i<@Pv&8V!OMEu#cc*cEFERQWpP|Q*w@$p?X9Y!+_HU`j{R| z+El4Jes0eDt7o%vd%bO6pGe`N z0HLqTq#XqMBI!JWrWWQ`LyM(*!+$@v`lEHcef`yWy*5sMp5EGgKAj$Vf9zj=el*f{ zQf(YwZt9NShqoy-_DhzlTw2@kqhHR|G^uYIoxGf!l&JOWuRi+hAMBpbukwmDC#AZS z-rv8BH>}44b9W4i`HLmr1}pD;uJSPoA=ilORx9l~p8{*^=S5@pu=N~n`j;4tKcSX> z^LEv!m%(8a>0$9&=d1Ti$LUaPV*T@`T8Gk0w7qD1#ZlicoECWkhCKgr=B01R z4HS;vb+bHwT00Nk=DcPzPFcuJcm4_7(%jZrsIHb|Ms3GL)TutgLWJF(5Um+~H)VWu ze$a(zGxsy#sUHAUh!!iB_Irwhi<2DMP6C$==yyjV@312#C%7KlD~!U^H5U2e;XU@2 zBXdX^fRG_t2Tzl@ckIw(kgMqS?MWmbqJ7Z0+_ugr$dYL2Ke(2Q8aqUNGPQxMwF^h` zw|l|DC`Mn*0&y@uq{Ul>xBop;c)&l7to=TJ+41z#s!&&CEBj@-AG?Q^=JGwzjT1ke zXGGo|n^r8c2H=DFoGUk&<8nW`HBb8;ONb;$RV|b;e&I|bh&{NQFfCAPv@6=(6cP^| z2kGJXTq8`T@sXn$Xkg9O9MqydDU_lGo!K_Qt(`mj6n&FwyQd+R(D=S(Z=k#@8h(r5 zkpBcdJ+Ye5ZqC=!_4RB}Xz;9o~77G&kY-`V1@ZpQtivE|_?m6jYJzZBH0?@ru z5pWZ46O65AIcK)Q2+2TY5!;m44wcJ6k_$<%V4Zj1wCJJDs1xIK7sk15s5(O*0!u}H z7P$3GlxWQ0XJ60m-Fl4kLf`kUZM7H~jAEhse~e)c*AInCz;U%9&yq4O;0w0}sKeuQ zGTdcqYAjfjA;Pux<`CA$jkei;QRE1lwAG{admP3YjP^*487S$g3+cJSx|EwE=dbU{C1c#BN0!QJ%i{m1lrPA|*5G z(w%WRPO+7_DJuw||JXxML3Ty{BuqaA42Q*<+~ohPTA2Jt#f1Kuk&AD(5J`HaQQr%q zH1|ojg}mK0Z?5Knq!=xM;r{^5ia)u2EjX<761Hf1It^$I-P8v3@5a5BJd zC59(LmDv%>p4k4t{yim>Jp<8;2YI#bOw?0!?chj4>@l{G%W&Aona@aM z2!Uq20{Wb8`Uwslturl$g-a}X@G_XCY}+~6Jv|sM#lS<&6z50=k$Ra}1=k_j!{bq8 z1hz!>BDE0TUG*n0>7BEiZzZ7CKb!O=lupr0>o}0q6dVtTd228`5IH`!Qnw=m3c;S0 z8PHbOdoyxoQ)t>VxH-hHy3G}cq;X##{mPYyJ%?E{TCZY`DwwssHBCxrs$7IS7qinO z#*?pz?lAnzhnq;`2S6dD6LGlBg}H=bj%f%4vCZc63{EVZn-Gb0?dvCr&eDNbY%tG> z0lB^%?e>i2m46jZ^rzx({J3Zw!P(Ore0`V|FXVM&oj3j(gWRSQB75DP?D?oE=QNxS zBpEPMdcF{QKC+-Ic;8`yB`KD{B0pbON;b5+`b3gYsV7z3x6e-^`@wv{XmFM~`z#s%bmctV6C z67#sQn5u9IQ>OSPg*{S~DU2H%;2YgFlAnETs4>}Ww`%RU8ncB1mjg5>CAwDKw*8Mm z?%jGTB@1C(`L97P09)m@D`tt4@Sbq{?gDvssMbn`Yq<*#josc{9jD;^z*#nym-quw ztVjMT*K86e#I!PSsuT}$K1dG@^t{nJqC6l_M*9V-+G24sIqL+OH4{8GrW|ErLd8D=LGyyC8z z%za^ck^f{(x05eC3H_VJ5Hfobqj)76%y|1fjl;hKouHCF|Y9ZY`R zK6U7oXxPq2n_7}S-a^;fd+oxLCec>E-bTI8WVF;bSvK%}nlaFEu zS-r7L$~hv8?_igl0SjxX!FC4Kb#l_qL$akmssoQ& zLb%VdJVAty7(%dbxte0RX-PE5@vHEm@c*8 zgUpmV%8TVj-;m|`t5y5o*LxxHv>y^-^jK8?j;5nHQIccbr^NHv8xn=Y`F=2+$fJ1K`}!fE2uMzZU_&)?>&gXn zse>r+h>IaSGS}-pbZ58E_24OIcU&_u_k|i4o8sWs-~mdA_yv}FllmLpF+W)1mrBm= zYyXc*KHC!}+3(XQOa?C3YXT5qIKcV8rXA$5%s+5S`XYZplbx{C=3YuZe+EUO*@Dt!;?~}_b2c#+Hm?Gk&H`2;dZ;!jIx8cxB_Im9 zJMIsC+#^}PdjZbMxWW5;K4Vk_n)qAwWXCe#-#>XAkH@3n z3V$VJu7i2f5*Kj2b_{n;_lPAVM0R$$oG9Q5NiTP0$Bb^`oh$;`DbD7UJMG1%MLX+| zMo8l27_*6ey<2!T@GqN{x0C7RQYfZ#6Z`#9e|qyX%Y;%z4*#xIE2qxqaY@-dHYRdH zzAEE7<_ReL9M-)f7RPaPAhH+=S3`A7jR>f}3@%1u;XQxQ877$EcqlO2{}YRvr&kpC zndZ7D#*yg@%FcLqn6k~W^>nn!FY#!Nwbga?XIQFJ{kJk91d;R9;{V?+tL+qmcFk&^Jak(iPu;AXp88Uvq(}is#H>G%3(&JDMPLiVw zVBmJnrT_eQ3-EYLT5lt|&buntEo-euucA9$rgMY&ZXf5b9gcgr>$-lDKeI^ zoukD$>7Fd8v)0R`n$J72;?$|txCF(B<1zv##0Y5Bbi+LpAScy;VOq|%@TnE%?cK~F zS3Qr-HsA-unhI3=DSTgHb6X@Z!N@QDm}D@a@+YisgHZ$dM}z~bT(Khh zfe?CC&hL~{NxG2rr50s`&)mw5j;f{}Z{OF04L^B@L&$`vo-TKdxRCj$s0@1}PdziM z?JiCoCXFIi?&PvRGJ0JbLJOUEH+u6$^Q~UqObIeYe@TH19xadR+$R9YZs^XSCx*8}a(8E0PCy9&r|ZHSh9>;ogv*2iRrj7waeu?1jR>FH z1dNdGmi~WxPL%_wvj4ZNxA)Z#m|kUS*x~m(B+N*@tGXiboUP%tc+?|bog<^H|s6_VedB-c;?EDR}Bc+1+Iw^yy zUNbWvSpv`z>^tQ$sZqji#fPDGkB_$7j+ME8uZdX(mIR+6^YFmod2=#wgohBZg-G+h z&TOkMk3iq=s*18hAsjkIWfwB>sk}Uym!XES}hS`}qLPRT% zbN^+3bet++rA~cC>};g*_a7r0@o~RpGH)tTJ$3RK;8Fr}_Vk5Wn`ylH3=f{7bE`F- zXUh7ZtS5X1BG39J)_KNqiWpN30wSUNA{W|(H7Ci0$lm>fQP~so4fjm;gc;GtiB?7k z|4LV*!gmlbK!@vk5A>fbU`r6*8)ZKu37NeW*7$EULUmec6>hCVg)YY@Qt7GLqi+Fc zxSXa+|FaHK$iiCg`%8U^);{h8<>F(NIx(FW=#)HV(P(egSaQ_RC>+dPNLrcu=@`5PqUsAF=82ak}-k~)glDF{= zSnJv5*oq*8`NH=xdb(_RrHH8@f<67ApX7#9j{doX-jaysmEed6UD`$ZSH{X@zvYtU z-Fp>^iL!o_wk;~_Uz9H`aKZX#!*x>F3Z*W7L^qwPT)koxyl)l@&TP?(c>Fidls$Wi z6LN@UUMYDuXnbYy)&9){zZ~j9q__Ls>_^2=miB8vV!&%)HaEY1a+uP18eIy(GB3fK zx}ljHwvZArX(3C_I!0DF3MY4@t z!85h=tDg6-V7cY93}jk?YIc@4jvsa!WWk|_t&?Tk- zxk^4YNY$*2_qm5kk)lPRj?FlQ%$BM8QXPv!%{$z@nmDz)Aw~4}w?>8UoSpbVAy=6oat+ zgK7DP)&V^h5GqdQMse9-_rxB&C5JI(a{Z%;5lzxF8F76-*X{zxV$<+RG^{1b@X4wF zVWWG|oM?*XIn~TF+ zNQC^P-C@s$xJt=JcBF;)UV@;W*&N>S!}}b6A7l}sF~w*+8(;$HLWgDBT?E``n0f1X z6XRp$l-?!Mv#ma-WZ$ujv}Xr>2XeUD547xwxy~)(x`?gu8W4+?wWbADyema~O`|#I zB=ePsbRE!5y!z(g+>sDMDH?H(N=+kukl;^WPYdbX&TRKA%`bx!LemFC{L= zVguNmuMcG2Au}S7BKvOzUAF@LBbnYc2~vOzNs-B_`}bIG`LD93 z5+{t535-rfXPUhcM^*+sN*NxEyjhH>8!H}aQH<-DrQ!xVY1sY~)1t4);a9>+`SGpO zz&{L;r5@va->3+9N_n2u`%}+CTymxLPZ9sAHHBP-&=f_0m>(QM`v&L9XwGr~beY^n z@9%AL{bHuMxbx^EfBDSdT+4Q39WT@_NAdrh1eYZ-!iO(+I)9o1dt&e% z|DYxO1Tt@rZ>}STYiOU3YxnG3=OI|*?6m3i=loB`3UCI)AzjdAgBsznwTs;0~$n>@!m z#sj0_>^fW-y0$-6UT1UVkYC)8I79#CL@w zvs9bg{epHj%s-0F@520KhsP&h0s0p+}y8URoOMrS66N9g2Ugwt8 z;H416j@kFH0KZR*2+1P3$#g?XzY_xs7w4m$Jv@kM`M)v2CZ#W0EK2O2#Cm{Z5JRY2 zp066CV@v!v-ub-&c!yj>CyEjlZSv<*@k|XGlE1z6O0i_kROc_d{O+E2*!5754u-U^N77 zuHnzL93MFKa}(FUp1gw@?=ZZ>pR**UN6GUTU`f)m;iSNTmCE``$J7SW+3Z`tHaN+P z-1E6?&*-4<5&A@n(ZUDhOAjh{(aeUe0LZ$whefoO6I53e1K~w64J<52>+n^l6F%nc4uVf}Sy~}o9+SZbgN6m`RPSMp^nhVG@;)nO>81iKh6>r#Q~&IB4X0ds?ql=i0-U? zu2ElS>g#-j8TpAHaF>zD9Lnr$Q8^g|+_ z36fmh_HlM)+J#n|b{;0Ea8}sn#e|3=@Uhl*-}pZdGfjElsH8I)yaKJ-Ilhjs_Hm!( zIqYXuj2$Q5%d4@{hvGJ;Uc(XJZ9$KH-e_8SmC5)Q8hsfs5HC;U#FRgK`R(Yy0JmTh z0hyj?r>g8}crXy^HAPt;7fd_U2biRV^z< zgP#>S{^)LX>6OfN)R2VTtY;~Q`@D2*4QIj22w0Km)g(vzG%KpKQK? zD1Hvzjefbkd9>j?DTr|;yB6i@ilD=`>F+Y2dQ)?2cUiBP^Pls|2c-b@#L|3O5- zBOxJIJI$bmarr9^X-;VHM8RbTeMvBzuFQ4_sfE%=?rsVP)@&9ZyL#%3k1?fVy>;H# z!}aF!JNgHp39iW$NYGWNz-%B%@w>)|Mr3YJHmO0%E<4u8OMvcnyx+(|E|-w#SGY#0 zsPa;|rQ`CS>R?s!&>lFbrV>H)KZ#kJ&JIj$t9Rvthspq*mZ*ZZ*zt7p)88}9SR7c2 zZG3(;)^j?k)>AuSv_C`tefs7sAtl==9irC|^{GJ01*lUfQrV~l?-1r`0p1@W%J#k` zUE=`Qq?Zd*Ke(dPiFn%2X2Jze9Wv4NQ-bvT06MM| zgz#gY0v03m#v-h@0ak&JyaNTFB)Fz1`YU5Y zcqmThQB-F&4BYc>9D5`&DrcPrS*F=JOhN-z*oY+pKG8R`-!vSxT0uvM(rWvaJ_ya) zRL-;AGs^^T?LVgtMw_Puy_s`1-B;kWleBXiq?}#!1u|*8 zjZ`>?0OR0D^kA-LdtCTd>_siHU)I!3osQNbX6!mX1ew!IOCmLdx6@G1u6i`Nb8Oq? zM!3|k-&H8n!n=p+BD}vY3~VnQM&`e2L5}3y@4ne^*IY0{XU6b~=P?QE#mG&q8--2U z3;4$=fjU(?!m?Pf=LT*A$FEUZG}CPPl=b=Je^h4r-&yS5FEH8X z+AJ8ivwh;#G4!r_ye%Lx#r~AUN6So4?({VXR6uv0nn;Vk8EvJ0qg|_MT6C0o8t>1G z^zItjzXZ1r4>t_07ABa&1DOv6H8G}ILmfiV{%WBbLJ$(!8#G;~%;(z3WIb;kjWQ6eWS3~>dAdty{l<`b{c&RJx_&jX!F8sVE z-qm0w-`Ihie^!##v92z`I+)k=69g|LxTGEl(gg3Sy_xt99rs&UG+NiSq}#dD?RwG2Rmg)w z<2`OeA$H}o7*EmCIeHA>3MsEc*Km$FFcy94fvjXp?={q0+z9E~KTdh61t9l?oejV( zH^G}=_8SudrB)I0tL?0(N3BDg_;JB;*(h|-6vPq(lhC_qq3JR=TXqQ|KX<|iw;<7z)b~i_30?&Ei9xH4JAg_sR_B6*V zcO&|ADj4(Jj1EK`yR^6sz0hd>%D_z_@V53O-n*jCUX#q_>716T`Fv2aYmwCRf6luy zaDPw+u{nJe0OEFQ(;^|ir}lkC|MnZ-=kc)FYV!Nf`@iL7Qn$>Tbp5HXP!1M;e=7)R z1UMC>^G|AUOHsq)as=x%X@YiUfJT^HOc_L9)jqVNy&Z~31`OL%0Q<}RHpr}7?n2IT zYX)+5Ph6r8vZtpO5dyrelWs^&+r!@LZF^S)!i5NzzC#)&^uxPXslI$-Tj5AK) z$okcSx|Bi%qG@JN?m63Fl>FB+S+r7G|)lqZa!u7^njhF#PI#4eoBAml%CizCk8|6$3c;Ek=K(LLYIGBm{ z?27ts>|F!UGYd;|jT-#U?z(Ea_J`w&QU7%>vD?9KWQY8uB{3mA_nf2da?5~uEHXXX zPPMyXl2H}uYcD`;aMKI*tNcB=c!4Q+Z(m@E3UD>5jReJ$d{tP`B4-+X$=Jhsi00T;^MkM1R(r9AAjE5%Ct z@D>-icRnq=hBfXi+e;85>4jGs-z(4iW2Io_IRXmdN0r!4%Q)O@9V-7&XMyEtempXm!hcb zOl$$j^>O%Lyqb2?9aK)6>VkK2*OaaMhLyhjK;j~wC{_ag6e2#3-7_S+ZLQG3=Y3?q zAav)%8QTW`sp1S}X%Sy`zK~b;6l#u~-m7S?C>-I36zz;VCinS&0enD%zyI2M)80ms zByI4o2q0?kF3_Hlq9jV1L2V(A%9#eXdKz7|J%jy{a7H*uFU6JN5mYii>~CK)KjPpa zcTz_f=Ut#GMFzQhpqN%^`|FE}-MiZz$x{0jrCY~M`tWJot(k;>obg2?6>R}_`F&WB| zgbfx_;?~=YMPjf}=kuDhwXXya6vmg82vYFA8BON;@$vCpC6X04_^MSBw;nB%c~WxN zri`0FD<-4B>W|^6gTNp-wwS)3-Obqa{pJ1TB@_AA_wUMN;fGG&9j5T;VTmNP$G82! z=!HsosJ0){Xt`~1ER^bx)WqJ%MUo_6;gzo~z_0D1_0?tiUBA1IaK-6-1Ydcc7%K~( zJn`ADMgFyI&#(4~xb-x26QNrvT|y!316@A4{@~YYRrtk3Z${J3-m?Mls)()t@cOH9 zf|poCO<~mU*L9J?mxM0m=f>qaAtGgt#$lo;f%3zxK#`9506rhw24_I?^a0OOqMrT1 z(;f42AZB|0v|ZpSHvl)S6sBy3C)6xH69E7`i#rRHhgiDh#`yauCbZXY>b>jw3x(MRyG#?Y1u zSQZ{jtzpjz7_#)}7JtAk1T29957@TU6wo+wLwI5XdGMN{I?P1AgcaJj8BLD+F!m*S z>2nM|k4)LoHq*;K*F(DN{fPv-kf$kgI^_C20emUO3mQO?Y~T zm9G#bG@5|-lgcr3*o{_LCfNcXH;Rm9I(F}HrIi{(z7?C zDR>{D&zZ@k&D_+1Ff!gLiQb(_cJD0~trZAsdeH>620drjR!^HXxLu|k!tiMC(KNmN z5HZyg=Bbg6O9h&Ha3wrqn4qS&2U=Jm-W!6V-iLv8`$~An(c@1c_(FS+9`o5+RMH}T zaEoNSw)%0=qdCJ~lUdf(Iu^Kf2L_KwO62CrE#Jx-yIh32;<;J`*lPrZxwqz=+u9m< zl)1vXInVqflb|m5f!ZX3^W@6+Ew%NgQLXG_JT7W5E$?-GE}qh6LeDo72WNB!T>f9*rA9AGUT;7(%WwB?a7d_*Q}++)3kVm)kACX>BnU= zPxZ-K_fdW3zkP`2Z6|{I=^mrDDZvOx_87E&tdt0#$4#7|aB3c4%#9|Nel)0OC@zu` zOg|Ciqzi3sa|XCf@lAgG@8EzP=t4|dGc2SG;A}MQ_2qhh(7sH0E&`A4XB745L)I|vtsglfs5u`3&APsqRne3I z{YRcMVrs0&lK?2>`QG0CDl5!Rsar05jA=6)O?3Wwm`(nsEjfhQ2YwIZY&6;VV5lpg zM69og<;66bs{HxwU(T_gb1j8#wWwlV2DdeNCRz!dgA){SF{7wbAF?~?a$KUt<3mY_ z;Dw_E^N)$Oe%{ReJJ)C;^{1j#rpV7C72hR>SJ$hmsOvO9SZ791rap);I@v5gK=O?0 z5Di&N9Wek)`2sE~RGPuCkw+e|8j|F7q{2#-%CZ@Cm!}kO9)aE2{qd~ZK&-tZhM{e+6EbSBGyHzCN|LkLt8RU4 z7**XQvS2zT#px^g(GjH6Lv*J1^ysz%OD1ANWZ2&U76ZYm2O*|Z)@ZuZJHb>|JV=HF zaLh(4fAHe4{ZJ{f=>4%OvX(k8rg-G4)PuQR;ptfbI7;00&{ou?JcQ?%&qga+@XQfv zwp*7GqF5};RY1YF8L8R@wAq`?*j-l+veth5vQS8viv^xL>q@k!AEJM%;*qC*<~CXp37h?l&HO>P>7wR1 zS0xgYc;k|vjg~=#N-9ywb&5yhNOzkdt=OkRWrh0u@$35XT~fr}x~Q|!DoQ+AI~*{u zWWIYYKT)YaA#^rc35e4$**Z3?XlhIo^uwb^MW2GFPcQJ$@evjTVb3Z8P|{x*b@`gmiia0K9?M>%_aR6MedUt)ly&QY+bV-x4qh=Vh4W}_8x2!UJVxXrro z8YFT^_zJ%;z-+XF2_dlH!?H-Amn<*~>L^*?*=Xex0_UAmHF*|BdX6<&=r9`hm#sKU zsuOBY&Ip!4*pIDC>ytU~d|n@s*f%3s9brF8BVb@Qa(M0sMvt((M)%PpEc;O+B3xwelmT z$YpjAxA6ArgZM#Gq%%Q-cbLJnMu-q-!u>2ak~hWOE4PLDi=!8Y0!sMV9m+63VqCBQi&So&ZOa+^%; z;%xn>&Xr#s6+lL?`a$4iwc?Q?6)_q)Hl9m8GtP@(y@as#P!CN2I(oG0mFi&42o_Q3 zva+IXkKMP+S`YcjURYO(>nNwBCw4{#?x?^dP# z0=JXl^+A|Su+q|uU?qmFwy-2h>{tngQ|Tx@e>^I|$_!8SxfQvHb&7BzE7+EbYGZ@C z(f-#eBifqi6*N2|QC7D6t2n99JqeGYRPLS437U;@0t0KA1*z9 zvjZ3YX9hBgqdG0zQ^1bJcpe`g-|ky;OYppcrU*DhCs?oG;H+&+b?iaz2Rarpg5Nhsk<%@# z7NtuA?-kpIO9k5$P302CMAeRE!-)*NWIS2pd``NLc9xpGy}w!Laiu~3*Nb%=J+3&I zql)2^Q@WlWhuXzxS26`01DEX+p%SbpV4=b{@Z2R?p}KVqtG2Q#BdiuYJ7rcAtSVsf z&I?{802IveyzWZInWv{9B}=ak^sLT&HvVGtJC#*oN@{8Gi&|u?hVMM3A;=Oh+vP1n z*u5;}isDsKsJ0QF+PL`=3pd#}`Wu6uE6O&8iCMJ%C+iUDi=Ld)^JDR}T^6c)3BIpt z>|?eDu=v!Ef;8i*>L}rAWry-J>?49T1%}fUBQlYf=}HStX&9HicnV&!M9Sg?o1p@m zH`0FLZjEXSpVbwQg>|&Ogk?dnRKdYBT#gcPCSr9@G0{O%7sB zaH<9OpSax;EC;aDewKwstys;0_A2GNsMXKy+n^cZv`PF&HMayS2OMk#rL%>fS{*k$ z^PYO#609R|5ON!3>4gpZfC|c{z9m?E;2{1ruOx=&g}|TlI`-yE+!8E9aJcskJJ9*$ zx^thkUy!AP9dNj(;0j;pWPmY|-Z-H5jRG%hQgsUsz;;%iaUGum@(h@r8`Qi+{cfH< zIi=y}#t#f-Km6Fwfbh9--C~cPy^9enH*m1aWxg&RfTLljo-~KgfT|grw!31Up8}RF zBil9GIsEiZEn~$VWdb)-+oDJ2lklKzsO=ixI}J3!XitpQg2i94xFBn;tF(JrRc>DM145DX^xUZ6D@x;8?9x zyEE*dXy5IPBe*443 zKmq}@$k9)SdtKaA6|Qi97V{@NJyW*ahrbEVfE%_w|EvhATT<%%KB&4J`t#tP0hi;b zGR@<<_vne3)^2>~4Sb`&1nxMkIMcm=UJzJFUV2)OKSz*Fre3B!Ul*qn|oGUS{M6~g( zHY+h8we6Oato{}p#TSD0?8&y<{HQ3gsV!6}Z`$eA*{dpe_)#KH+x^u=o(IFBM2;*R z_yb7rk=2N4FW8uP6NKo;MvwL!t}KLIC$?6{2z{1yf%Yw1A|1?mKw9(dXo~EC8EfLZ zsio_xDMcN&{fKcq>-+ej6C^!(m&y%~d)dQYGz8_?pM!=TO@UiT8!6d;j81d>LRUg{ z=QJYkA3ykkQ(`Q;-G~Ka)3p}$XIgO8tn+Pm5jvUx`R1Xr1qAeV*8=d>nfCH z9P>rR&SBd2>)S_ZbKkr7Ruk!rmSx3De*n#Bn(&we@F?@7cvL&ODP8NrCap(|7K74p zmMkey;DP0^XDh2|;1c)noi1VK-Kq{S+6ZdLZ}qgP5RS0a6ECr@9DvMKt+(q+lwA5X z5pD^p%Nrs2$Q1+7BVnB#Cjxd$P*Hw+7DtIx4@#$Q1@sd=R<(o2X+9ZTq3RB|1f}Bx zp-nJKx4?5S{emAUZThuKIF9Hv zAJ8&C0pRGd5UkDvTN!F3WJT_tLVqPFmlongAgJfQ1u8A#2Ujag+nJbxh-8trXqHc+;8iyPRHQQCKJ)fqj{B1*z01b{-1{Rfj z!Hw^`whKW8_kHcsX6~)0en|Al)Yckg^|x97 zvQF4@Tal|aZuf9A>aAw^qAF0Uv?%;%G6bdCZQTzHQ{LHK^eMsC(V`zCJ^uBAr)s1W z*mXU`URG7)W~UpqZpGSFxQ^2XyV`G*Q`BewUP8yI3akOgo^ZXzgRcWp-u+Mb5!0hg zPaxi%v^$91a4$uWc>OI!CHH;l;di zwX9j45;sav)%_IYx^B+V4rPKm?|$$nl+n2*DDXaDT3eYHdetg1e+|C`twU8~j?GdE zH5pttUaMa7_?vlnuYnkCYxu+c`gJeOO=`>9qP5bN?7( zqP4YB>93P{JDQ05bGjF9s(*)0D#}nqO`i@bQ|>G`g0jYhR>=eNJL3t8z#r4~CUa2g z>gzb*(=?=T<}E=@_%|5v^cdP3fTl;zULEuuLB;ns08Njey#Z)?RO}5vp9?X2Ub*@^ zg39dsaUQH(FLL-z@zHhb?+B`~`?(p|6)#e${*It9dw}6#2e!NBYS;VG(&J+L(PD2R zrWiv7dO_lvFg;n8DN+wiQij8mRkh&=I!E8US4OEn z8y5#gRHEBMDji5II66NkTDQtn57!yN7(LA}LjpD=eP5m0q7S?@72)3e_B(=F>n}70 zC~~W(=kERi;YUi5M?H;H5ACE^gIT94#hCL_bD8=H1VNQ^ALd8s*YcPD`r};|f0fD4 ze+N5)r|dU(r?2`T^Xu>SQ(r&f8u2%dx)+~{tZZu0rHt5ILw_q#q*=pO8m^0N!WxDe zs~YPkvRK9eTNy>BHAHF?S_&W`;=3*uVODy*td)8+cwvqve*VTV>GQ5{jf@{O(PBle z%VRM9sDh`rzX|Abvpr3)j7vW2$ z+w@tOQ9fiUE~>44yD9=UY?5N;JCyvnAn7r&Js{hhke&`{to>Mifb?mX69H?h7Fojq z(|vTfmmlOzk-sY4&vLJYi+j?lzz88#IaZ1Exow4x7tej(q6i zN>FLsXDh%vVHeTi5A8tqOmgux3_Whu0$E__ zE#4aIA-XmihV%LHjm48RmMwf(4N9w&4|~kb;Y8rUuwqG4z#dfBJbthRtmDlbUawbJ z?p1exn#v^}D0s_0-I0lpWfUY}2T1*^C$uA9#{ru3pGkr^mHk z93nmc)Kd^)H`B^4MN`i)k-(mR`(e`KSKBbR_bgkJFgR}fj-Uqm%VVTRuwEV`J-^e- zW2DEDwlQu!XSrHh-pGJ;_z}|cCwUMm)+E&tT}Y1yy)Z!f1m~Fm>C>Ah0ZuF%@BGtgH3(wpA$ zk>zWzhRGd4-SHP2p!Dd9M{U)HYY+3K<08*7tZc2zXBAfQgi7@%rUUc*py<(*y`U1w zmwBOpkp*-VJ*Kk%L|-3sA92A zFvw06P9$wsD^nX)i!7igDN&WfAdSgnvrnoXOkJZxM=8}SStUkNDr5vxA~1(>&vmt< zR4jR{h5TKDuMF4*NojvSwF0%h*)JzDSdb<*hR{xDtw9^o0wg)nPABID(?RMYg9S=4 zo@6L~X)0V{WmFrW-Zqn)1_7g-9uwLL+1KglTk>#|8F!0Nv7w+TH471ky*ti|Nc%)9h`p6HBz215#_g;v|riKJMC3hf}> zhFkCOHxfNYHc%7nd}i&ma&?JtaHxrsduXSTZZQ3tA3Qzk7B)hzS*PeyVY}$#CM)() z3ABRsbb*J(gJ4ab3z0x0!4HC^2Q!wjF^R1pAgqa=KWCAHQyd0 z!v1WxaY*e(hP|h<8Bp_S><3DTA07d;UHxRfmZo?86Q7{o`745@M-N{SEF~uR>R``+ z^(}Fq$uUs|FqUbt+1jT3AkTot*}y+uma3<w%oL6!1d+yn1JmyGI6b5;7aT_}o_dvLCbM_|l|j+uoj$bKRyLHZ`$K}GS9ZZ+)c@Srxn$e;!|1IBeq z1DFxeuKfOXI0JHaLOb+NeEn^32CQvQ8{jr3+up{bs&z=%$^B@;Pwor&C3qUM)El^Vj`V1bANmjrf|IdWBJlLQ<#APJ(?B;CYN|Mxb6uGhr6_yj6)Y5-Tn zaF*BZfP4@ew#H+u33ezF9(`%+9S_2r0e(+Vqx)bhsGOH-RiOL3+;sjCXd6FFddx>h z9b-~oTXD`Ra!12rWPWV)IL&KpjAx+Iy$!Q}isi>Q2ERE3FISIvhO7_N@E+0S?d9eD zjTVMQ4=swk3c#0@*5*c-Rwx)IC=6>8_`~_TRh@ZjW84!I>t2^#s&wzM(PF@(N|fua zF-$xSp$7!@x@|AHzu{XaK}~L@JvbuWQ@_IxhaSyo;S9Z1CLX`!u{cU9i__a>g@%5EDV2Yd>l~D#DcJ8K?+ToR$SVDib!VuKaiivzll05@kZ8E9%(7If^;w zpC8j$9A#hCAagEc&SR@0MURN7_`ELC21B^>1iGt6%mrp7px%GSwb|4k<3&)?x>a}7 zp>9p)Dw_Lk2ZGwwEtod?xGn8vb5Kp0+llr4@ivpDDw^6q1xFLGKCQahLGOG|T%>I> zTg~kH<_5DXd<{X5)3iXkE)N%TyFUY!>t_{pxF1dDn%vN(M|QUB54u_j;hjs5@U)#% zHPDk~RbVHEoG}nov_2gRJr~T$SO_XrcT0XKXCbIe-GWGROzf?>42aGps6V~4i0!GO ziIJWdqZ|N`F2M)_IDt17j~JgEUUc!EqCWMuc@T@LmJ7`C3jsvWU2^*RN0&EXP?3rF zN28|V`Oe#zsfSDxKCM=ej~YH(y2bs40Eh4?MxV%HwZhCiYpAS zY9r*Ajl||L()d43zv$b*U-(7RHWoaC7qvwGzwoU5xA_xqoMWk(xN5R_?^FKfq{NT< z&54pOHnRt=gDG5SnbSz3QRs(7i7pvfb;V_lvL9KIG)BF~h@=_Qw#j1?v*yP}k0}kZ zL2z6P6Ch*Oy6|Xwg8J4TXsCvU!p-JuB7GHByuh40Qfk(x-~|d2qt`qXFFi{2x_Iev zuGbyUlxUd2iXT+NGW>!}|qCAJeZAAtr{1&3dy!go=M0?*!I+j8d6U{i|9&cS_& zMqkMJBSl5$mj_9S1+_kjAEGK)T{R&q=(*FHjF(P`E@0x(BQ^USN$~Zo##EpHXCFmT z=HQ9eX}xG~QYv{!co9Wq=A%Zft+JOxhxBzSJo39S9OG$)-N9%wYtpx@ycq4O26Lhl(FDoWPFLIQM|6sGR!m4u+LzpX;X%st7_897vRn{%;)e!CP>Bh*T+kGbsgDo_flO(noF!+XRamkBIn$v2>=a2 zkgmN6cOj_M>;rCB`s9cTU4Zi(IGWX?YWuLPP#37|=Tz>zq;t0H2X(#bnxQ%Bw@@f* zJ&)WX=g0O=n+s<_^DuzObzOK(MLVT zSO9`NY-|z~fj-=OeKF`3BeUIU;_l6dO=i3wJV839F(TaFLu?E`n6sc%2UeL$x#CK& zE9L;_&Yt#fBLsD$4RBlgGSX`d*2?QEY?!6UDyXC>kZ<9q%>>1v9UWK+p4O|*=VP8T z=;o?+Enyr(ew63Hl=ORdDg(m8BwG-2uSp@Tk6yB4oD^GYVRRkk!> z(b3O#>M;0Q;T(9A)3WG$`}!NLZnsHTrZ+%7BO2wXqVCoLbKA0Ftv&bOH=(KD)As~L zruUgRCfOG6)T);Fp%ElcCyrmYht)i!OUL3_kB^UAsFUI`PYa$zb^^ZRs{H#dC$MpQU`G3#VDP?d4R<%ocHgcb1@l^}&5f#lSc!Stz$P;U;8A zNaCFKkx=OmY)p5-Y4vG2T3EFgG8a8#aqu!GE367XB_$|~y;~pBkAfZ->!GlPSBCLC zp~15Njvn9gg4=u5mbvf)CP=Nil3no%MJ*UCS@8p&iih{(InXC<(PHvb5)_9;Q1iO2 zY{u`$5yAPeag)0y|Vx#=MQy zidUr<6+s#9A*y|fQI2mEX@lS8f(zQpQ!-CPiFHOWi6L!JT*^PF32JyB-x8HDoJtIG z%ZyDP5>z*us`m>vf*&M3V&wnb_9IjED8KN;40QjVC4djYy*0{ZP*52Tl;fn0S9#w7K(#9uL{ILN))`6{g{h9 zUZK*Lg@$zmQeA~xeM|K`!YiF6>t3JCD>ilB3b-0SG^KvKza1#?s26F6OK1mWLfDs0 z$}1O12DY(jn1I1Sk5}1%^lzpP6XK0_aJ6f%Ri!mLz3%-wiv?dbXK8S&i5)0leN}i0 z-YMPsTZkSh+tWhkppaKctIaCW`t#U)Q#|xtp~`wU z>iyr~UNNK=d+E%_@BA}Vv{Rr4uf%z zgVmvEmaAiqH7Sa;zdF&QDBpep=P{$er^en$6F2EQONU%YGV=qo!} zLz7JAGJ`dzP8Gv5xS%<47R+yW{>wN|ju;SULH)v3O85~KPx~hd0u5^ANDd3b1*R7RwEbSA|ahF{jqN!h=k$R;DF@Oeoz% zH>n;|u;8R3Spt#Q!XdgP=V>u_zBYdYQR1q8er~|pKQKa;Vj!66hf9fO9u3#|qhZZx z9cF&Wlt|{Wki(ZpO4RaLl&j(qttfkR$@l`J&T3d7p`X24?124Dcw!>!qdcDkh4Wtq z7geI?a?7z8tKM8x#GN4oyOSRnK~DA(9Y#?L|3x~Cq5}TQ0HZ`}4vs{ZhBy>_Q%4L; zN^~a7q0*Uq(C&D9n?*X6RqyZkJ;jZ5Nhd-A}MJ{If6gU_;=r&!e2 zOa!2`o1&?huJj9oBG4;NQ7E5E)6gSWeVvEHjWTg-WS4rfVB7EZI{hvw3hcK-qxJS- zwi_lPAKdqXmx)V?GW*AGfLl{SmTaxqT2^%fL*IRPu#g4}h5s!W-X&Q*{sGLk?}EcX zF3IZc@14qa_1;<6{4gm|yH|uskF@QtaTsF`U?y!dKadg#06IuXm4D6_~-8z;WEsZqbcf-(~ob>wf;+{>BVO-5HT0|;vY71 z?c#T^6WV8gx%iJy|GoRBzg+zOkKZneO7}So0U(tZb8!L7SMrM==vdq;vJx0@XU4G~+F0c44WNxhy23`PweUNQ z0q4@tA=QfE5^M|p_@R!)rVc_qs1sNTo@{JOY{}MYXCI};F~Jo2>bHQwebH~ zNp)fLAk>9i;O=;_;%jl?x>9eIe>dHE@kw{*yNkarE>v;B^8`28%>@jBeVZ*tDB()1 zZ}C@@kg?-L-=P0Vg>wPFz*c?gKKkqT65H+{MFX$?yDlmPYd?=y@4RhER(;=2noi!@ zV5|@$vxT!N#5kNre!x_nWUmI8p6{yEtNV4Xa*? zYTf$?C#-{w4HS1?&XBc`pdSC*w*fu3*_OXL`qs#}P520_4RT3Poqt{CYzYt^`KJGv z@j1+1*1r;}Pku>IivKlGQu2Pi9!lblE1Pj^9oHBrUcm$nb<5FG($5u!z{A1iOA&y0Zup~l}(TFb3#c_i{C8@k38=`9?qCnD_i7ic+roO zAon_e)5Zo4fco(fWL*dF4Xof$c*N;ex30JP&$cw%+K4545t7p8ccrFn2`+~z;t5NP zFEeUTCPV8g>N2$3sfl*7mO6XS51t<5dg<<^N4^dqY-5$Tq2}s4^B;|lro+F1^`v<> z7t!^f>&0AEtNd5Lp+ij#TMRn+Y%4^J|wi%;1^ zesz4U=}Us@^fq{|iX&^dtyKwzvj|qYxExJw{@_9QZtb^lFk{gKPXI$(QrX7O^vhyk zXly4@Vut0P3M(qK%+VQT{jnATH36fUKKSRLMvaxACHC{e7VDbBz7=q05o?^%z#(z=7zFwDY_ zlpH1M)6~HemTSFzm|NQ&!7!bbx2P}*7 zhq(BgIUTw9Yp&#SRbMO%nJ!7juVXxDbjic8idZoe zcNT7f;R7v1g5v70g_NEz=CzQ%HJ|xn(|a#qaxHNY!3b!*ed80IudO4R+xeJW{I3t# z0vGKkVPU$ek_)Y9_^2_(+g+6 zU%RH`-6SPfYVPpU?94BH;weMp;UFH zZy){p|NYm`?8|I+cXKtnWw#$bT(axi+e>yoz5SK_`uXSyKUVM>|7i+7-Z$R3JTm8Ig)O6 z)amzVy4NpjC6@55_|segQGL*X<&1TO*-2M^Q^jC&`&)(F=@p4qd25C=)M)u%HRkl> zOTX*m%{8?D6RzlY0CmHN*BpI1?4pZ%y>KUV7nS(dz%qq5_miB_M6+LZ9QNw@;PA6f zf{>I0g5uhH#X9jxc;?ZYD{CJY0Y*v@`>n&v-&`(Ri(BZ0Lx)8n?>5!2@yB1_zMe`9 zoAUp1dhVA@>XJj9iGCm?p(~H+62L+%r8if({=F%YR_QeyXOykccwx8}_8h$JVkOe@ zVo?>@#fLa9n!LXFL-5Rx=B+u$XW)x11g*c)%vD@TQ@YbdIKi?}tR+scNNcfZnH4Rg zWmQ`Oi6%is>ZA8EoT;$lqw*mVCYIVI=LfW;zX7PGB|R0!Xnh#%TWpSPSf5YdTxxnq z7}*8Z3S9i1bAMY3#DOc?J?$ZbMar)(o-F^aCH=pk>KhHh~d2gnpiAC#v z-Wmb0*u?0kNkq+My0sknq0sZtI6`3M7|h1+2Qn73+1Do`2a@u1&$K!1`T+l@>3cJp z;lb~g^1#FPzrR}LXiP?zKg3`D_^7Yn!3c*3fBWZe@XCGr?!Wys{qjLS{IY^I`6pB= z^EDqiAJ6{t8(VL2V*fHth;_kFtP#SS6f>PuSk402@RXp`^xGdsPTyQ!`tK-!EiOLc zwsi4#Ue!4;#b4vX6u$BQ-nS-6|1RJM0(T$Qq}Io7%J?WQx>DU24`QRdDGpQO%FR3T zP3v*++7%oMtv5e?bIoQiPUs)D#)TqUntqLrt93i2B-Xs;`GB`WkHL%*NrZXVd4i5x zCw|kE(2D}kz%e7okCT#%$Ml^pQkRP~I4^8EngnwoS$CNhwu@W^X849lSqbe3M&Fd5 z|IpK24#eq4HWoF(a?!ZrH#z*|Er|7vi)ND+2QrZEbg>7pQxDtnX+?9+%4j;hxxSxW z2Jt~xRYSpJRMCY$PDdA+p>17wXy}9bi%~S17vG)Ik@eKTqhGNI#ecza4v)E(Kl&S3 z>?`&=*oZ5wiDaO__7hc4-et&(*?l0fpun(WUe7u=KzyEssDGc~%;?Sq{_~(zG zKVE;n{K#hSKh79Dnz8#U7y#EFKFzMCv-h+6_kly5x=6HLgRv1ZSRAkof^0>CTF^uF ze+#T!ZImu`Xm?z59KqnXRPwtY<*1ordx!1%ccW`?`|f?TR=icCbD^BQQG9>->*c4< zvoGxG>cdQrUH0+Qbjq%Ny}o-7EB5Tm-As?-cC-D>_?lq5`>l0o<4$P4!m0;;NN{&V zX-ws|QP@}if+3go`aAgh?j8Pn4gY_^z_C@UC+LE4bVIxgamG+ortZ%nU3_35rOv{O z-AqT*oPL=1M_4O>h`f`2CKHOcy277;Z$L=oQU$GDGukUU@&#td8KYR$>XWp7|UR4SEdmHE)&|7cK z`92kS&ExvQbdCS_y)`vE^7p;DX7sVYk2ukJ9hW&l(dR>g$bGneZ`T|sbg-ik9qpVk_NmxurlV)DRZ*Jxq-UkzZUUPJ!%T$Uy-T;%@pjeWM=4mmHGA{F| zr32C{Y;*q5VNicTFDsDwvHBfP>EXEzf8sObNqYjXzI%z zm*9e{x~_Qq(5bCN3Me7^mNFR1<`e}#q*x*s3*bn3&AN7BXmzNP$1vJ;s=9FzUd?Xr zZ&5AD*DPbXnNDby-Qt5f*G4Qioxil#FeY&yRXta7EnKtQUEg3Tl&@LFazdf{Qinme z22As1E50;+AMv`zb}1GbTOv{zAYf7DxSlUL2C=Z+mf~wJQ$B|^q~7SPj#PZdh7Tgn zqX|O?xzkI|71NEBSj~RjFt|F}F#sz?fstAp)|StP0RvlM)$Wbfv3~vj>h{KOZ4(rW z?yZ!GSTk*KL^4mrcNR+)dz0d)1m&T7n1;D^)`PP%%>5w8qHMiQy+Z{PQn}bA|4$!_ zcOCxey~S2-^4Jf7UMRU)LShbItaqA9z@UoEa~n;DVYql5Yg^<2X2F{)K|h63*CFY*#gB#iloTtV2%ebG{x&hWqKeK$G#BQSPuw|=T4KZ}Yf6vIs0d->at9)aFz!v#8}@hdnc3vWx*SXl)tWPXf*+mxU< z{SJ6M)RTBqp4y3Y#BxKA)$ZUMCKA z5>Icw>qqW{++6YFJ0s%tEQ{6-)Nlf5P7q^yu8{w8Uil z%JC})J^DwsspzptvQ0&gf|}~Qn6MV@0Jf|n6dI_%%j3CkUibp$@l1^2;Eju4p zWx6{SE6@2YIK6idTn{e!F(p`>;e}SFvtws_jXsmYs;8ncuC*fRSHwm0{1IpRuo1?l* z^nS`d^k(n7%%5X;PSqOvy=tlpo1{Z5R1vh;(qluXVx5>%Sb^aePCOFRhL#mCR}%eO zK}~Y?=7k$vlk62-|6ZmAu2(RsIjV0$bEvv%%vJ<6Ie~|Y%{LaFR~Y|_V3mhc)+{a6 zrOz7664T3NNM`NTXjL9g1~0biu0%VU=;*UNMi>2Rv?>py`xMm61g>2XEG`ig(_qf~ zdcv@{zQ7Ag7a{h;rpM#9>ke-{59X*>qt%IcW|t<}k0@Vrw&H$>^c-aU;Wv1Kv19s3 zT6~wP-m$bN@S4c^9Cmmhuep-&7Fz;n4ue~WoDJ@#qgai=Qt5ROUA=kXh>+OjUJdbY z4XPQ`ysEo6EHdh-r_#41#Qo6Nk`?=D!)MMZTvW+BVr4U-7 z$nB1>9$?)aw#NEU7^K_NDl+uR+cKk-xA6I*Z0HS^hr&Ey)$#;)A$%zut+d6f`rCe~ zi}>dQg9%=G_opiI$^P$QTkpp)73Rdd8m*?r|HQVW$6GzCk_GJ+B0oZUywbNrXFOKI zE2?ufS{08|kcrABJM%d__hX|+9iL@U%Mw1BU~>eGS$eGUEz#4Xif@UY9#0(B4rs+? zbv&fVq{1|;!rB7e7Bs1_lwsb3?+*{W8m$z@GgxvCgF)}fR`dh=e4W|AH_VTewjg5w ze0nr7$rb+JO89G_Xz~PeUxL*z-n38YQ7r6J*Pqz8sPtsYaEF!Ix*}L~V$PNJR@uKt z3{QGAY8wmM;id$$9}PX?^eE=6A4Knpg++XkDE-e7okfos9fr4r|Bir0kM_J6Gqd^GX!QZ+1Y)+RQo^1PL}7*k!FQfgdJ8qVifjN{_yrcrdkU=1i5vgZQQ9 zbMTcP(zk-GaM2MMH{H+}+&@#f!VU zyE~MhbMANU{chLyXRSB0-XzbH%xsxGD|^pOnlLkiMUuqe2Tbi%->w>IC6J;CP&+p# z2jr9tZOH2M`ZdIqO-8DwL#VW!HD-+3!fW(Wu0t{8-@uL0`DOU&N*~`}1Q$sK!Vm+V zaH8xJ+Vwp*qc!lh;L}w1>=-2Pnw`it^uM#qKI6QL0;vdCeXn(#T0}^1nfWw8(H(@! z?B>9tlM%j6xk?NxgvJ|UzzCpiC%xlQPE&k@KqOXY(}*t0Mc}Udpe1DtR;TJ)jsBs7 zB|?}SNUx&);m(kwCTPL)0BeD0a>6V@lpzd(TQG7YM6DckJ{)8Fp=AaU@SDFm7>kr$aoj)B+Jh8 z0_YfIMx8m2D7O^<^*u zvmRgzNssFsBr4mhkIv8?(87>peV_8_OF$sr&TlF$g-zvrtNjz~2zDy@v!sfES(3T; z1WC%zXH89@gb3PcDmSGz<9Ipgo8X_l!< zLbP5ZCKjGe1xl0dxpFhl#QIRKXYOqX+ioP9#TNAG={C=4bLIQd3Kk#$P%TYTdai5146Ygrr+ z;d{L)?>=7&;)7=pu~jWPmZN$_ADJHzct4bhOTUr9DSjNV{HGH!|M`b{-^Ftjf}k#?8d zrI?t$rz1h_wsi6Yi5`!KiYt-6F2)@=f-J;xr9^!8NBL!RrfMi(1DUTjCTN2oc9#(g zm(i^|Pip0;0bj9>f1C}-jR#+qhs*>@#yfM-*Yq0TCB3=&S#MXZQQTNg-K8HmEcRgL z!N;=7)tZZN?pDGf1pPpe57Irn-33*_9eK2^`R;h`AX)c2V|r#h-+v53So4+c7zhNf zgi377g8xdA>_tuHb#uUogBo zCgQkx7>N);J6kkmppf4sLT;vQbiw zJMtM{hu4k`YXeGa<4@@r-j^lZ?-yzJRm+{G&du;X9m&mlm@`R&l0N?alh{JmvPgxe zFMe-Je&U-a(EJQPy%VxO+`Jb^sNqKSZa2Q1w##g+9VL6dTz{Tseqy?~pBM~C?i_P; z>4Ge}e`e;Ve?xW+>=8T{+_TqzFU2v;l)_s$id5M!G2eQ-Bz!MOy{z!vaF{F;M>Ysv zEzZNA(?}Vh9jzPAD$F|RIfPoB?`XL#r|JVQh)f9<^;UqfY(13#&&1rpC0a(8y1-S2=IIip0t#To>3L zc3%0O-%o|}lLnpY6aGmkVCKsBfFRY07TUYD!Tnx%TvF?lWT-) z`x);lHwlptzsxoVo7pr-WwOV2jV!hq^adwK*-TvwRuSj2LvcDkNO$GgO>f`-%qeoZ zpJzjUH#a4_u@NF=o->)#^CR@IRTpz6aE+i!u9=Hvnu$9FJ^++gMCF4^PK(^(uakC5 zON1*h#xcmdfB-mxsUXD{@CpvvNv#35z4cO+L%Kfpf7hXc|XO)M2v+!+Q~q-8tYFp;`82<4gu507@~ z+*9UD0rba@PCzh7EX4I#avxhR_-f%0KBLliBV~r3=RA@o=1soENdcFk6 z3TwUfP~1TlNQELHg;V3C+`5U6Pi_mp0?f#`!kq8myrh%>OVGVq>%{~c*O0kV0aHOV zwqvTgWM!Lml)RB74W6xCLzD(x{VH7=AgpRkB+u5d_CtnB4N~-;dn^OQM!K}fZbr4Z zg#k{H)WiMySd12Bp6)wK`>}MXpUXt~rlqKoW%a2DT^L8D(y1dRsc?ECnu!+xKUsOD ziYGO@*~WfUWo*gIVbm-Vb+5m2Czn1>s_Y1(PdivJi69^MSZZ~YMz$)7@gqa2m%0Zc zCzA!#PAVyi$5))np`TV= zp6p5~HonaEPoU{T79ku|I+I}yxXtrSM4GTF8)JC~lc5{$Gu^!Ro~B%*gRV#A0L*|N zTD^lTJ{Eat{)PKcIa)y3i~0^t?6%jvcNRE)EtWsPjZxF}q4d{7{-m%oldpMC-4~-> z(b-m>SiIJog+Y>boogcp;yfksf(`pf*RTs@zw#TcU%xv?T@Uj!cJ!HrRa8b&2PvF` zzA=^!&fU1AZNy+ychi`WU$<(WPXptaylY|~2Z4bk3Z5;(b}H5*-uHL!8?}7oDa5t^ z`BDefmvXPVhc|(PUrvo@$iv(j&UXO+kzHsW`*1)WI7$>P{V*p@yn(aLKTGMc$(-$= zpp?Hzo?g_qLalc5OQ0z=7;x5%%-nbCIF=Z_I4AW25C(3XI9*dy2eR9YuodoVTF3C9QlU6n(H#pWc0IX;P$Sbe5Pa{fXQ z96uXm;Sr{T)1{&`ywEs4w{&2SDw_~3>OGO?JkSt6vWX0kK<~$n0xu)IUvz9=btIe0 zor$98lDd3EJ~oiw747}bjg8r6{WWBiFqIlSIEV!Q!wmP0$Ij5RjR6CI@uuzN;m~og zNt<;n)*zFgt{otvwC&yA_>k4Z?k%zz>-4ml#n;X6$U{a;?niVMXk5?UMAKjPe(D|Y zQ>n`S#|sR*javQ%egM=L4bdHe9~Iv(!3(@9;g3R4MPC87r378)KTIwnOH}NylU^1M zC%gQrea=~rjc$5!r8e%O_2xE|Q%W0@WUa0~#d3R*6~C>*^1$JtVpUNVpRR_RPVq1E z)7|JaK&PHOk3bM>%3Xo$5v%d{*Z@eiJ$RD&h#4QphKqQK`sa1MO00Q47AGJYAN17iu-f+U-w)O__C zcxaBXrcLwG4*;KwW-N4N%2jJ=!dPH1yW`FJyE*vPllUHN}8A1G3 zkhe*f#ie0!fq4d>-d1c2a5eXZ5YNHs?#|@O7augh!WV(Rnh+^Pbc04w2vXUof`})% zgeNSDuMH$5K`-zUQ#$Z=*qg%HG42V*!TJIAMP2RV7V4)E^?E8uynAm`JGfr~lvt*< zK(^13Qhgd`C*dMMxK!;X%c}(<|3=_~7<>3Ssu&JQWXN-OjD#14zQ(!frb1~8d2ukn zgkBuGyQ+fQ&&0G$o_{6KD&bRFu7E6y+i@rzDjJ)?!6n8xozI&Z9IAY-XPy$FoYg5& zDpzYiImsPhTEpLDB9E=v1JAdc*eXA7EZ3ga+DxceAPC_1;pQPyf6J)ZoP}ET4MJK8 z<6`#ihtw;vPj@@lIlT3?)AMJb4>wlZ0$0gtnPV+LZdZ7c_^ywzItIA2K(Zx z!{H?8(hWYycoCMcXI73YM5p)$c3QohSI?jaFYf0iqTj_$3g{DdH4uN|INc1qJDdw@ zwg$bw*7l^5$vIjV!66kx?dKe^ib)KdIxf}lW>K=lCi7<>XMKo;y9=Ut89u~8Ac)qx zJJbmh(WoEdIg&b@hh#uo2}cOYE5!86uiRklG_`lV0X$JDO;V!S9UY7o$%pFKk0MPy z^`d+&6#IG6fsos~+Se zQ4gJ+YbK{91Dx3C^`f%mGS%*Y+wjqy?r(~F4;p@&b^OU|Bq~JYH6sFRv;2FafjMnS zt@l)~zfUxWo$X~OCOhSt1W>VAaCh>v@|$1WO^Q?-@;U>kY@DMi!i0`d?tiMS-kv$6%Loh!I6P>z&(}7Lxh$z zR1o28gm;DE{DU$jJLG!Ki)9Eg`Z3hNt`6Eo4LHK*k9QRGz-1OxI<_pW$KayV+sf~& z%R#=`3DuC%1afUL_J^<^Sev$BiS7FyI(1X5ZEvU+o*9iXU@Dc>Ow z5PxXtj=yk}Q9{%4VRm%w?d!1`ZH~-sb9`*2f6g*&B$g!?MG#q6Qj7QdIa6x`B*js% zo1WApoJyAy!b&sU`#{Sfz_j#!YCy)=E1IPfFy1SeiBwL0a#jf`kZFo&> zDx{ogt?32w9&vN$@yf~BtKS2Mr*s(=cB>91mZ2n3hq$f~l$ZEcS1XImdzRfjJ4-8q zO$ioaSW(9T585NbqJy!gkwY(;$fD`!1*_3lcz^@11e_2~+DTyY6i%hcZMM4d5a|I4 zt#;qFneYb;kzM1E-IO-hE$EGG8A^xQCi=`tZFr^OHgZ}bA6}fakgb+RD3QlC+&~E+ zzpZ!1w|u4NBX5rybhTxGK!}drFJJ(5R(0ird@=U+b?)UgM38k;7($DaIvcD?XQ}s4 z@ra&rYBBw2g1E464`C2Q6Th|`G});^qqt-^XzAzq?uTNnGCDvJe2<|O9O6L5FLF$LdXFYdZ$ zm_B?m4c4fH3if62^Kk1CN`{+Vmr}kIb@bzRGs~G@K6?BQe86l!TRx;30~Qm|u=SL_ z^hXl38c`)-93#dDuD8!LgCq{RiyoN!`tZvkl9(~4pK$pzK1VKObo3BIX+lWiweJae z6cxQhn!?~PM|0};VOXLt+mtOc{pcakD0XOqpaW>yAPkW{;eZk`4i5_!WScwalei9w zZ66Y3o;e|S6(f4RfQ9F8CQs8h@oip@`UaO=XbPQ15k5*Im?FyaZlUuQ*B|!_bg=!} zBC|i0nb(^slY$tr@O@pP!@xZh*I%kr|EG$`pMZAO-B+~UfJ)S14stEAHY4b*$KQ@>gsSXt{J(yY)g zWVSq74KLBA=sw;(s~Vr8YtV6N7u6-PJWKPyjjzk2V4A)JkRHEkfnYG~1^l?b)N(3B z2B#`g^w2t{dEV#;^axqn%=Q=6F1DXDV$%q5pI5$F8i-Zd9~?;oL2z2n){W(+#-wRk zXj@w;=m~767U1JirRL@|s60Dq=ri=L;A|RJpFcdYuo;z!h9YqV5$&iY-$iE+9>ku8 zs(g){bzt`2S4t!Zot(>e?Q5ts0Ygel-=uN@SU^!pWpOA*_nn7Jj7MEYLgcXrLFA?U zCS9KDVlyZVnx)wH)C?F(FMoheG>3u~d)^Qq?TVaQRS(=uH!({dwKMqW?6$+t7q9Cx zutC1bjK@z&OR!`U;QOmOTyE_}1^06NUlk_nrS!Q-;~RbM{-qRexS5G>pZvFCoa;@t zONaJ4K0gwEBYUQk+xPz}j?xAI9Y4z@R9r&l_WD^PWpyQ7mkYlsdly@4G*?~);$qVg ztKKrke2dN&?t5p;cf_-F z8$A~)F>^-^h%uXHd#ZGpmZ7eNz=4?28e^ILxh{TVInPRij>%XR7-a6+&DNbL7=Ebv z>y*=+s*|%8LuAv4Jt(b=`IFm5@&Iay+U?u{Je40*sP17svOtn_5#RtM&-=dpga4Ej zVNk+1`DG>JqTZ#j+(xF%iFHN4`n1i{?7g$fu#-No>NWM)TFaZaM{oLU+^C_sP>kO@+l>0s6S)TYl`3xg#_R z&90ftGF;Iwd@T1cqcpF-WZ6}6#}~NIU?v2$_K3@-N~Ljq2AsjLu)0U0PZ4Rn=A~uC zgd+SN2IneD7exyn#EqfBzBf2ot13}!f-8W!$5uPDmqjwZrsvk*5S|Ehxaq)E(u+NR zkHpxXBXQ>f6Yqq2>5!J3SH#J^{kUuq%$S_&i@%%jiLkh(PLX|dnmcByacb6#hW$5%^%M%+0 zf0?dza@1JR6SR7ktTV8%v^I3F7M_oG@f>=lFC24e6;@qBFU z^C<6J8li_T3>xeco%?O#64|=s_d8e)3&{*`5Q1!%7k0VSa&ST2h2xp;Xr-#I2x-(o z3R*;_0gWV~6>8C& z>@5&}Ra}QUu*vV=qed|w2s|AVAUgXki5E3XywaFy8SIvfApZ$ZVU!Ou!nU^4slN&9 zU=D?haC^`zM{ne;EfU*T)Er^7*&Ez-SF6sn=fesZj6~L8#Pj{-jZ^peeu~b44TTdw z(~w#(CTDcv)pqv&BOf}Pz>*6Enylid^Ql_lZ;0!Oc6geo7YO{SPsa;E{>xivsp-8Q zB=zh$i;-0^eH9+mTCs12ero;{CYHEip>%-g@Y$R!Wh_#ml@yzqS~sdNJPmQyr#ZgS zgFXf2@|ECaSx*{>E>n!W8}}gM;JE2L!%e>HGapC%;0AG_mB_p@6*X>A<2OM?<+B%u zFP4|h(8+Wv_THH$Iz~m>jS8Sz53EF;h?&nT?^Wcac9>+lJWu#f;FV{6n0qi(QY$ET zjp;>q<7KP;2LKqn=eCaU6QDwu%*<*l3Y|79W$|jPZm!(~Jz}9v6}j6N@`3o62&%?r zpv!?tv&h%@Z@FvFm^hguA&StvSQ$Yr;wv*7z4woss=41_UuPXbOUp;5C8GAIk5f~$ z?hYpF&Rg1~66%jMFc78uHzCQRUF&)@S#{oVd-3CXBDVu>$>TggQkE2W2CHTqmmM+X z<=+)<+L5IX;Wb>c^mRtkP+r2sZ@g2)k{ZH7DOPU#UC-S6XWs(Jed7swU{_*ZVmNSa z%O%=H@5LZj+ZPp?+Yfajb8O}6X%4OV6d{r!_#uOKf6AI#-q%_^@K~6+-2UE!nJ)5G z5RC%~mWanbSLsW-0mh6+wr zu`SGj6~Wu_n2JBJ0{aM1i5!{s!(+K=x_R@k5TQ@*Oget%?kqWD2~9@$)h7%R-x%h> zq_nA>-+@5jHqV%HJDWSVUz+nH;o8~MWL?Tp8;x9Iz|3~9t2hUGFERW=+w1# zDSb>hr1iwEzgF7PWfp9u*|p9yH2VxJQFWCoRT0zrZYT&n$D)sG6>M=2m^ByDlD#?E zIOqo~2B~5)szlMy;~}MA`fTfq6j?_%esxz_pDNp^Ms*w6)O@H>%GEZ~gM%TD-FM@; zGa-tyWHjrr-XqXKoGA`Xf|nnI#ecnSVlKI`P+y;-pPV?R-d3C@$gR<->k5>LARs34 zC~jV!Dz)Qp_-|-+>wt^Ofn*0hUoJs*^-Vg8V1-{yJbG*AcML$vP?(Qt^d@gEo zb%*3pEdkl;!r)cw-uC=@y<= ze3ZLuzi>W@rvohTp1M`dg&IwaOh&{SCA<-m#xzjQ@h8fB)eO~_ ziCF#3ntZD5(-oK3tCd;3^jzYhBS~d?k^wHq)7Ul$iZ>FDhlh@UITo;8krB24ZBqme zQnTtbzW+%$LZ?v8(R*xEAg;(?gq%15-g?oFalqq@;d$4J^1G(-Y~zEcibkJ~^(5q% zS;TeYa+IRI-cpKF*-gtmYeqJI%uMjUnq(umhD{26-TaS|E(q$9)nrSDLwDGW?iN%! z8^^gV<;p|wFbQpNq)sLSu~_aQ!LMtvfwB%jlNDY9J(4+xKk?h zmHX&vcg5ndfDUU~$p?){VcK-za5N8EbajAHBejKduMKmT?2V|S3@%e*iYY7283~?c zKcHzZTYDJEuCV(Ny9;gRcGYHD!E7)C;)qU{L@kX)76M6TJWGh{TshC$s{t{=#lSDG zS#P9Da*$A1U|?WyV3XvNS_N(rzk!foU_%ICV0iDZde}0%+dJ7fTbh}eLz0l(c7UePwTYp36G+A`apq1hKZJ9-WB~1YX4#TaZ;qQx@-D{~Ud=)Gn z(92XE)dsmo2*|WW4mc?Q{W6z{S@4rr{XRe8z&FK6`=nw$?T}wtqOwe|5em!6mJvNr zSHCGr71iQ@pKR2^w83XjCU>^_9o~0}ST-j>aH-O&d67xvNFgbm>KWHPw{-G{H12hh zrUUB30!BdVVXP-BvpD20go>0vHaVto!Af(IO{o_~Lle}ck)ba(uRFY1Q4IKP>Omny z#Lz_p?7D#o+O;1Do~PrPy!&0Ud2G)Q?b|8q+c}#Y3U-BZyLjc+Xvzb=xnrE)?BTej z73P%`jWpE%&H_AbT5N|@bZ^BR6zpe6te!L%ufru$VR~KRzPSt^$-Gch@?7<;93ZpX zaVxj=7qBNj-H>VIq+i}!9@LSMF`aGVM|Yj_OXNDAPx-*=Wd>0UjKKtG(gbJ{z>!aB>sELamClVZvB}2RvHE8f`&QjozbBT7sza*YP2= zta!Lh#sWE7TAEkhe)I+Rm=OsVx@@>UO9CMO!yYBrGA^DmsnqV#29UXrkqXkpglBj}r2vLnG*~m~A18N8IN{ISXO<>iD)H z#gKx6BX2U4&qe;KTJ`1&eIUYi=gish&>dMr#52xvz3Nh|1Iik zZ50w`w^qdHTRsrawT8>u(^0Ku*b`ES&*^KX0H;bBsX3dZef3C|X+6>PEQe)Za;kd3vbQ6zdSAyRdGR@%XJhF71v5dQyWrm_M+b?y5T-9 z_C`i}h=Hcm6%Vsj{kE|@wTNSsv;WYrlDRC>zBEuB2YP-=L;f2_azj{93-kzoSffTk z&B^$Wc@lj|9y6c?2?uOoX4VSD2p`P6q)i9<8mF@VyPLKvU=u`-B zVBIq8gm_m#ffnAG``0{3IlbaT)L6 zO0()r3I08)<9Pv=ZEn24&+4;|!7L;^mPh*lgs5eP{YJ`PVQxjT*)GfQWnDcc9E&++ zVtmMnic~92COx5s1Lre3e6kfr>Bw?P!_02KQ+{3I3f|av$9v7Oqb@>QBhUz&2bQtG;3mnl$~Dlk8*YMUqRqD z+L~6J)hC4-Jn>v5Ww9L3hVCvuLk>-M1k9Li&f3J2-t>x){6{Z?Y)w7uxJQ=*N5i!x zn|>(Q${REMP)G-IlZ5dJ0223h2&FJ>V&R1Kya#wFot5`$a&6vrjqbv@%AMxSFK2v& zGPf8}h;F*Z{H)#9pD!{gW>U!0NzA{7c{Ukb>;Kq$B^mL49UFVkm|99iab5%4FM_N# z>1$6ba9z*86>`yEgxU+JGvTZ2@$83=+llm9r+<6U^lzLieD2e8zO2CM-{!Y9 z>AEg1ImG-*?)+DHwS{p{shQ0WanC`a%;s$lF+^VIa|& zRB^N~)EnsS$wl+%RDD%yq=NI<#UVM!V4z}RkbgD?hF)9{5+DsH!Vm{jTyP^?PFiCC zzQRleg%2|z0bY*Xr6YS@Y)P?BhLhcQjR&qLIq1lb>SFKN;w@|f@icMWOKON_O6wxb z5a?F2&j*oBX{*=^!~HA62-2;EQoNhV-9!H?7%2jANB|gEO$Z7%t)VzP23Qgtr|__2 zFLy9fH^(^|IaH*09K__YXIvitB}_k}JjH+r92z{iaF3%fNO}PUU0MtcTq5>KA)uxy z6Ti)Mtk|E7=l37sOq0}cWY@a~#DM?OYT!mp~AYal8 z!CJmhE%p_$IbuIAwHIX4dvh1F&_!m6F87w1$ykNTk?lt0yj)=0&(f>AsKHqQR%=6N znCY0S^^sFfm@$VVZsK+UjbZPaYLKzVZmvn*`9$NXCJ8zDNKk)gd44&3dblk#_4f7qhO{{Ae6 z8gFrI&M9~)_lcUMO~nWJ+&EM;$*fv*R2RJF)H9ZKXU zPlX30qrCv$S_38YW*~LnUI-s2>!QqG4ltT|{>V9|n96{Qf8GFnFSXNs}5u0!E zUyNv*VOfh6u^V+=H)u{Dg_f?nXAZ=LgJHzqz9k?flap=8GzGg58o8c?4gS_wYsnbn| zBoZoomgze&)xQff=3RRU{w36ZDezw*`9GrlTbcX5DIf&1ph;F?IDtt44s(mk z>{f7?(Oh1-dqYMNj!x-Ym2#r&^2;t12A@gfztLFtWe^vi5=BfN1gb2uwef)^G7?Ax zx^j;fgb5LY*OcmDciM{QP_+_qdY5eGQ_0S!5 z1qJk+4-5WxUkf$~wMgF;*zi4W!F=!Q7cqM~7c)B-12s;bKpbS}Ut=Fq7Cs(Wm>5S~(mm+0$sVWMDYcb9%9cL7rlxzbyx^XE2 zB|rkPUHWBcyplGu3c8x!2EM98Lf9YNQSfZ#d+{N~3&&)U3P`bIW0<|Aht%Q#F1Z$` zc!j)WaVR)S`g`2lY%>jXIS9LBj#0fS!kP^Z9_0HX;G0#tNCak zRXK;YHP)m~KA=2Q#7Lr8=7&`8EBKtx?LkLPTl|~%aZBWwYCUYeBL>cbm+RK1msyf) zqLyz@Kkv(2mLB54Ir$mNP?hAsA+R9-vy}T8)R!CoK9WQ47ux&v&m-V{l)=DE?M;-N z>>Zq$jT{{Q8r(n8CpJy~2!DO@UH8!cfxfo^;NAZlZDQ|a_J6^n(5&RrVBXQ>{}Sgv z3<2Oz@1*bE$;HwPVD_(P*8hv3EL&=kA08IW!H@p$h3LNt0{h_p?cVjKHmpB~<{}0dPDeV7c^Gb5i?^^WNu-Q=dka0{|~&a-R=MY diff --git a/spreadsheet/macrofree/security_checklist.en.xlsx b/spreadsheet/macrofree/security_checklist.en.xlsx index 8cddd3c8d9d4da6e7af627e5a37d22e5d098d9c9..059d0304f3e02094033db27cc650c184f9521525 100644 GIT binary patch delta 29903 zcmY&fWmr`2)BY(bsibs?bS~W?64KpBclQ!UL>lSt?rxTn?hsgzSP{vLZ<4- z^b?Sur&k*oAZlb>3+Z%xz0>w+1pI2qVL!n!PH9r z-#i$B)7~8a--0b3GmQ9N7Nn!d(D;+*fa-Uy-K^UVhE;vtm(jt*)~sza!77(_GdWK> zl)Y(mL+go!RadRK@(bI!lz%+Ub&6sm&h^Jk+wlz{L}vH>`V;+?7flIBJrc#XXO;6& z(I?J#k10f6lJxF6{8#!b7b&sv#Z|Y7`lf)DIoGxs-TU>G-NkYdcr&gcrd*~z#!G&*toGGplu z?0#cuzP`--Ep8TZit)LDE{Twyu9bKIKd*dq8}(RP7}GoK;N({e!_m!`N&f$DelPLU z?gZ5T{u`qH??3$i{%b^eT!#ugcvcP^AIM>c@ap~J|DGc}>*K)T?d)dnZewZb;m+~r z#`WOg`7VRR6@ixOTb<{y`qWBq9%dQ5PAL4%7jlmlo5Q0&mtKK=K-bUG6@eAk!+pdBoxLc#aD>!MURD^yNS zmrITQ&u&ln4cfJfz8o44NZz&kL6)4o)wi}~I4a4kxqmnt54hcR^!zIKXIs)+dYKyg zP3HHtH`O^yi&W;OX|v%Ql&j%X;`-ZDUF>BU@T@~R@{fpzyOHBr#mZ*=b=eXd{mzCSMBVtVTG)( z!f5C3#YW2w%e{L%p$s><%mP>5wY>){D)%ttYjZuI5pG^$#!;FH6;HX|(1V?OYqMjz z8d4aWL@h4{F8k+{TR+2roBbXX_Sq^=Qv(`Tlec7Xr4~mn73^6BysA&N(G$HM%y_vXnl;3 zPl$nhJDa!9jEz2AX+7Jx3KET2{bU$wlDcsOqv+Rs>j-6nt53oS4o*S#>#1rZ1%|L;#dS51W=6=IF$|Jb~dsoad zoJ;SZi=dm(w;3E|cNhHU2JdaVi!OE6>mK0(rPrZLbU9UXVtVV?mD4U7cY8_V79iKB z2v0ekEiET6?olxe-~Ya#Ywpp7w}R%J!If*xwRT!vorVXf-}+5UzpE31e~zyJl-{!$ zV&jLKcJ1Q7_IL7*%RVbnw;v{|F!^i=zW{!5pb_nLX)27@YOw9?uVjbXaNE_uvZ@_u8#uk$kT2Tknv;E9-y z?Tx65#9u`#TaB?z%<+I0-Pa2epSu{^mk?E0C-mmlh4ERS9@1=yQjY1VXFjs92=v!Cj;K9xf3rA@xrA z2>C)K?dncdtBeX-A{Bg!LRI#y3(jufti_RW^ExA2 zl1PQ8AJKs#uk$2FyB5%KnR3II%w`PxF9F<~Z;YLv_j2krK>QpUDV4sswf=d`(;4MauQ z0QbRKOCcv9En%(y%DQSumGdm)SLhN6OeCSeJ#UYkQRo#Bwq&m2jqOPBc^YdQp3(6u zMF9~DueV|CsVgBm$VGo-%;fMQJ!E!q@Ur~~Ka(h2qarSlfM?^$&1>ZII(+!sUxtz` zcBPg`r1Txc5;LUn8D3B3%kA)9WAp0#&f2a3RF=BC^{8HXsXDGnYKdHo9CxUB&hJWH z&@|YfJDhfYiYl_(`{hDQf-4m!LmQQLAkdPjl9k7}cU*)C4U_wW`^``4iyxI`)2d_q zWhegf%W~(^f5BN3Ltf5nm_cyV*J;3O1`}BLkr9&LE!8LyRI~_sTjmcyh6i7A+l~v0~ zoIip6pdK$Z*onzaJ@7wEUtkW?-&U;*XC-}aH|Q1l7Egvf^JmRu8!?16f%~o6v320_ zO%3RWe6?Gd)~i3LHN&xID*$i8YElGjh)c%Wx}tSyMN^6&l&>agJMre_=h1AmL7TQE z60QP{Ftun#1lwyEhmOBSJDqCA3%4YyRCLrCjERn?kO<1od@QD8#Kpjfmy!M|B1syq zDL2*jv>h)AD;=G7l$_+Io2soP)3+#3gpu*@>ru9G@sa?5Q1ZcRh)YJr$)H=nD!Eqd z*<$rgK+D=HJYT>*P;uSHmG^GO(v;%rCg+&FwZ+W)r&&N-Pk;*ZR9GbF6;hbSOjEO( zGh-4$xw6)(Y6WdAOVK?&oLYzRl30RF+`%2``Uhv;=;BY~c1|R+Vss__n9=Yxe(Iu) zJPTkuth>&|O`Z8O^8M9okO&LUz=g2>K`q3Ec3>ep>{b?pyO^3YhHZb%i^FS_P}Hs3 z=tMwqP4Z26?kkEpO8A5K?vWm2<^6}mD1jhuP<3|rp~N!E96mT&#n9w}JUedNu-V%- z1AZ-{{_YV0H7(bRCo+)7`zNIk3!kutDqC9Eilq=c8#6!r>*?M8+$V*EFTXzMvv&aF= z!b_V;7sR$cS61Pt_1tckZ>m-@#=H?HEWCPnlM zzSlV%DI?++J6}A*>|6DYdPJtgDbvUvqo2dwtS;!=%@}n%v`I;-qO* zfBFQLHSchNVV{#^aU)pY(m5v7ugvi!*H(_g#?v(q3ZNu}nAbtdPF^MLgiNbbLZbc5 z`lM8>Drh_n89Y}bP6X#Uf{?1&|HAeg532zppi>V?Q@ED5Dh?4R9w`;!CH&#ltWJAK zQ20Ag?McQ=BMvjfzx|{rOt^eGA$!7>ODZgi>1h^z-P5D=mG4NCjPq0ax(TVZ8BWno}5su<#? za;nPLw(O~`mAra%@eU^-(O^zV6>X8k9(cFER!8?K3Y+r-y~hXC{Hx+8*)!DV-8{%K z5ux~tPspK@*adMv<}Y;#Fv6DNzXrb4h;>h$M@UHENhhclRrX4*5$`gu5o<72zgw%> zI+n2iz7kmnCtJKeOVfW@u08Xz0?YrOGL8CcF*ab~*5M*NnWWaeS(>3`pBI z&gRw}6-G9A%u;MhctdVoEQ zTkf-@b2QTgsDSL?V^HrzcBP+rg}#~N_M!de#V#oJcr9pw2uJztcj!`;y$o@o$9a_ykw6O=(rJm8hQs%z2v`%JZc|Q3q4` zM43OU94#{o9CpPbp!Ii~N`A5YDQnghdW;|akwgGUxJhk*0MGyd zpq<7$=5o3Vo3`JMKu9~Ky{M+x^!fNf3nz4Wc?|8Q^SZO8+rU|fSbxyXlhH4~iDQL8 z?zaD_v*orsJ_}27#aRbz|Cubkr`262{=prfjZ!~VW|E8G<6C{f1&2+E#*gmxOQ^Lx z4k>}zRNNsi$7gh+6rBrmKk`@>Q1sao+dS|lD_GaZ{lKlo0a9~kvEE(@I2uI ztqE0TN@FAa8PBPgezfrI%zw zps#a)P|bOpBE*ml_swg)7>C~)$9xOkrS*=>In?S$ZYANq3pM zNi~?nE3~&8bFh3k7MOuT85{2QvNg-47*BAKnUMiOH$F$ zNL{D_gp-hzw^R%lx0&WZAEK=*a7mU-r_|S5kXC+NAk&nCY(D+P$9sB45|#Xl8I@dv zN!r7Tc{6qU*hSNE+WZ2gfX7?gq2!dqVNY?;d=O#|1F?Hdw-I+(>xU2ydm_FYR9*6a z^zm%2E731wzYfN{V~=As3|=oz_XMoL`f;udE@@vS2m0nO->V9Mwd3$|9wh$MJPhZ! z^}(*l^+C-s>Wy^TbVo5=DjcZ*T(9f)Nqq=PHlKBgLDsWjT^3A4>cMGhNRrx%pfhsJ zamvx^n0E}zz+z3kS+tox^>4KP=JIq&R{I7;?~-2Y*Z0oEZ>oHDl>qcqJ{D^|4jvRp zB!_4LVEy3ktbKVA(esV6V;Y@%*V%b*DV6Ds_&)-FS}-VRWcr)&;ItXDB}8qVlb%eS zH`E?rGQc?a&WdAl606r@l+JF{Y`A_@>@>n0Rgok4Wf2uRhLuriHZoC7CMoMg=g4xb zyMlpbdHfsLxoychtnmFz8}3w8iWEOtN;i+5&4wKW+P`oRoCEnq`zeIej?krSryt$w z)i7Mj@k&`^zWCFK*pY8JxMG(?GvikXJDqC}ohVwq02>Q89^<>w!d!T}5(hX=)(=@s zE?d|PRmjM7DukB~48#K4==hUd@-+s}gYwXafg8=YjP6%vxnrdjXD|zA{&BXs;n9Wx^ug>dH~^ah$EVWVhJv3xtjq&~8ZN z@Mv|mf|z7hIZnN>-)-QPzE;gLzhh-TZ)_t**i56mXXTooiKzMZE{$!z?Ed>Qthn6J zpHE~Pc$yuFwgSJ(7JR>Bq#Jw!WBp5-NcXtRL0%saYQ&sssAN`X<+xYPVfaqwMP_hw zib5iT)Fl5lcZl^5`J8Ux7wpvUI-ot&wiJ3X$I3*JhiHAua(A+fr$?ZwB1s3jS8uLD zDcW&7dZH8Uk9N&7H)&wxi-MIzf$<3;IjJvwq#9<M!sp zYFG&$znJ*IUmyHFiS@kmUx+VB<`6G#@sZH#Nt0Cc%h>@?|MZKwj#dp(Pw!P7cIAu4 z0M-4Cd_9yhP?p<6n#v?Ba+A zd7lGpsPbc~s0m5e+y{Y1zq7jGmfnV=E!*})0_X>T!Fqsk&8gzysrX(oHWlA+wq52t zF<1uIH$#MjxW$j|2*KmqNKC|S@G`lQk>D78Q%VE#1?J*gyJs^^x3Bh(h< z{UEEAz^CAJ4fI$_?vN59xj&&qCvpxyHVj`_yoUqPy*q*rWw{ih^$lIhEy)r z-;k=H+)8xCejP7a!Iu=I>DXPBsK4N7+b&YDKINoCo49r3GiSuEwK>A(uv*VYM!f8> z8r53Y9!a!e#m9a=i>Ni&#u+?`-KhrwGLEfpMKGj^WLB+Bk8f$w?^bhXZ0Qj)e>yO~ zx+7{1Y<^t{Ak^lwChE+$cjHw{>LS(rw{F7yU7Bo;6!IV@uhJfJC{f|#nOx085v}Sb zV@cOpbbdcd{ixRaJf4Yowe1B0ekZJJ-9<#-HO1jId5-esHnaLlrMdTGHQ)SM&&iMr zvp5a~Zyak|uNvJi)>-=$-7R0iP5b~|^&z?xnf%;hK-o$7T;b(|(4Txe<{VcTN~ZWS zc*~k`^Q19X?mC@=jJu+6kpPEsX@9MeuHv&3nb?9OQgHfNkW=R8g5^f@ZsC<8Pw71y zj2lGF=Rvkp_=2Mn0BxMWR5{sXNgn}?7Ers*QBR&@y(nkeYy4MjHG=*5Ry`Pj&rg*| z#w0Sh4ZTcs?{#V&fBKf1-4`xQEvw6P?UzJbN|!Q_sbsLQHEw9c!vutc$ZQ)o%pLhS zlLULdSh=^4F+E*trab)lhZl;vPA$^cR>X;%Xc5s?AVgIf3+<{xp;bWuUp7E(xI;8rGIPVoCFa9 zCGzCgZR0eLl!;l>7^hSgf6<}@vYGol$xIugCe|SJViS}r zN|xtku`fa~&0jvL?)-uiWj4OQ4KNBS`kwbWRJst+L^yFS^MKA2 zr+MLee)(4zUV1xQ+;LF7lLv`^7H?p4FMnrw?x<*qg_l!~<@w{Hv1@(dtvT~=#an>| zGhnXEQnm((jZXzWe3+KP8~|gsN<2EC4{86s>((PacK31j=20{8u{1tPzR+H>E&9ZN z2cv!^ySOB=t8y1gDAtlsKZNvyL<8h1aKM&-8+R=jbuCuUdz~T8A!=wg2a-T%Gr`KF z=}pHa90xu+)dfkd;3>x~UYOh*0t084pS;HJhWS(2tyOM%1kV@K#CRO;hamQdvJ~j) zt>ihvv@$9MH*zYg=@kugBE^C6JkVKbZekcD+Ew~$Sei(=FKLt-_r-Ku4vbC)4e|RQ zCPzBOWrmvcDw#8z$L%Rv+62(62QX>z*NbTuBrm9Od{WPK){uV#{DxF(Yw-A**Dw3m ztX*f2CEx{jbfonKald$6O{pQpB5GN3&wmnwPOGUYW#|BCmm0-K@)X5nPBt~x24IO>tv>M9FC^R;q*f~yb6De_Ae zd>?vB#Nviso8CBnc@*h)_Twa%I6=3e;ZQyPL5U30`3<=6A)R2K1wIK0^KF>5jyuYAA_2U3$4;rASOR0eMsMzarlz*@Ab1(SnE2 z1lgKdnqM`xr?a`6MdjU`LFMuNOb)pPVWyT~=nwGDd*F-Z^qVgG4>14>4)}<*oYRJx zD+HO4Z$b01bh=+pbNPoO5OnJ#CDZNZa35p<6!3|*pPXm#CuS-}sll=^&KXo@#@2uHFCdqx?IXNV>?6vfB^5x)`N@}X)j$}M{I2mN zK+_D}k=q`sSl~EGv;$JMt&DOt=Ig!EMMfzbtXDInLNLe=2oQnLRVgeJ>diRnUan{a2E9%VHR}>cgaQG4TDQu z#QsgsNwMc`WzMse`y%4r{j)Y8P@Zz!HQEljFjBoM-!RAg`Df~6WH#!OuXzbW`VtSM zFvFA!z;ozkYIQLmRPG#6R~KeFwIW+N9!le18l5u_Q);%SUh0!H2uE|IiDMNBX8UlP zUyW;Ot!Hu2*r^F(cp3ke8y7Uy*r!A>TW~08fd04CGm~3j{-^=oVsa&aZgRQzxs{8Y z@o0w}!(-x(m4q8WACN5h7sehTyns|qzJq$$sGIvcGeYw&D}Iv5!$aa>(%f>YY7wJ~ zArIfc{ARjLBcIyYRQVx=a$nW#tnJzF**42x z*q+|B6>R5EjwvVVs+-PqKN{@=ec^vBJaJ?g@dkGQbbOryf36VgyYZ?mzi_u>uLyIQ z{~rgwP~V1nquhqpM=#RtR|~tUKF+%h+X2juf4knbJkjS<{2^iVvDpDpY1Rf)K2CF6 ze!CEC3VXhqmDzQghmVvHV(nta1JYE)9k0ABN7sGsno8I$yb-jyr{=3JIur5eZ?OZT z3UYO_2yjJPVrfoao7v2n(lZ5^8LdbW7Obx71(;M>RkpglEnFf#JFtNt@!SJHE{DC& zg9%8R?9=T2!*HxJdN7#1#Xc+Yu)Kmg+kkMqbh9QUXG|3re3Qo3S_IFNdC;ZKhUd&s zF?JG^BgFg>ubmZb*O9~uY?Gr&(PZ;4A3!9Duum|Eu+2%3w7k2YC&HI0SO8(DWLRi9 zY94$@i06S^fLYiOp(a{3=>u~#3eykGz*)vu1V}`dEn){_Z`z41!D)zxdf5GaXrT}g zr_tZ@UZY=kh!cv<`1(n-UTfEDrCje{XW#lK!*HXfB<_@VDuk14Z#BK^8F!t0S?zt( zdW3r zV=r){G;a)X=QNg2^DB}5&Pp7y-8_HlxOk?G{ZzaEZ;FrX^li2zvB3?zlHo1Pz}o{f z+q)6#>4Na%??IfHhPzQMl!Vef9`Ba~j~$<52X&W%6C(GyJfJr|?;{jPfq`A_$d~am z(tAZxdD#D65rWlV`ctRQG;K_vHjai^2Se@K)7!h3l?!&sFdj9p`HEt>BJ{k`J`WSd z_w_F^pO3Bfe6sif#wswhp5`#Ss$Y;{zEme}swL=adS&b#WWQ&En|U~G!nD8Zb8`or z@FzKL=U+enP>=`f1H7kLD$-rdoNU6FqwrAhm9;sCchtn{jh=n>igIeFkdf>_c^JA! zl3KKWuYKFfne1w;Ce2<$0QFdAeqY%(;0`34EIOa{k3Z_K1WIQ zJpp{FGjTg0pMb%5a$DHr*FGyt$#C#iDt4@@SAu1BLDA)ug|K)`akuv@<8wn+V)XR6Q_L|Xw zYMGu|?kT__m0|o1?I+4U9r-z6u?BNdAx7vl&l?6 zp=0cbQ7KTPeOTwOrqk`9lgXj3BC%i1X*_Nl&{`xu8YYIJajt4?9zgKGjiA^9!jv0x zmdo2r$m5=0#z0-g?2^4@eaq}9ALenuhV(GX3(WPeZ7%H`Zqpo^$H}3J#Rg26bF9|* z8)4v9>DIbYJw_@a_P^>Aex)7`asG~xMVPm-40_CCc)c+$NlR=`DS)cTs7piRQ&XJSEzDpKc4j<}Kt)0pjTW7+4#{vu5 zhdAK3o3WOe3#^fv!10H**GkT$oyWiY+NZRK-F~Eik7PKM*r9%qg`&HV(qzm4;*wbG zWZ?zxKbrq!uXC$}G9WgH62Z3K1+a#zPnrxLC~{JTFNiKQKfT{}vY_CS&P9Cyb?#}4 z9G!R~)3^h@1yt5kHzOje9k4w{%~6bs7UP}|dyW0qnt5_8ZaZYuj$T3D%$h+vJ|jVc zV^7l3qNduaACp!fX8u)+Of645ear9!G;Lu%(%wW;%)HG$0<2kG&IMP5T4=-q>~%x4 z(3iI(70edj%2Wsh=A{*rvLKRKV@&TBqC@?=!o1$rS+%Wh13_Y5Iy=TgJ}(@JLQt&r zgd#-3Fo!2cqB-6zVEt7G$}^Jj?71SkHPiwDZU&Z)wmGd*L#v5cHOcjsHSE0*Dan2f z`VfTWE#ui&Gj9}8_-8&*sO0OL?KSF=6BaVv#7`TMohL(I;-8*7J@gG8{7P<6azXa9 zmwKN7AIcq8Hj&g2Ju4L-qAil$q7QlA|I+Xi>{BP?l1;TK`4N}uwMUNSfoRQ%9DrVp zmRGa1c(8_sY2)OLc;Ja&&cW~9ULko2W4{zj+R`JXX}Gkuf%f8+c)fV`C7uZ}OXcq} zxU^SfHFw|Qvy?z(U04kqi61seZ-)is2M?T==g$laAsX(EInvd zz7~pi9q{;;9#o~pq(fgX>BBv8Aq8qZvog>T*vhe0Di%m3RGALIqW;wfwE4B-ov; zcXLo|lvE+DeY~SaG4aB4$UUyu!|#N;`3W0KNnIY_u)g*m=Z}wZI^G<%rB2pEz)wq- zQD1E-_GD+z^J;ibW2{o{6`+#I zd&qaYN&RGpZS9+ooDfY%yJoWN<|WZ5&}U9l@5*7>Zq*1g(yKp<8rg($4dQBvE?^-c zA_XAMG*xcpYx9Nml^&t)HcV(&M&1V)?bpKA)HmqqpcqD=Nm<%?c<&>cVEfk>Hd=IW z`~GO{gMrLCMiz&ZVyU0)#6mP(I1k55s%LnS9?FP5TD#TbV1unHeeA`+OnvMSB{KU` zF{Pb0mR7c!#QE&`H_eyO(`=Q@*c)UZx;d#Ga-w~#N!rX2J2YbtVRgiywnV?q61yXas`W-bzuhcZoi>Oau zm*T;t9sXvG^2ZoMAquK8Wso5~E9;mM7$?@~b=-eouYbw=ka}7fa0#*=_Bd*NvS6`U zo}n|-1ZTSo(K^=mEz=%JDU`0ryev1go@Z}bX>sbf+dr0S3UVfrSdU>c^qasIMGlyim`cnZcKkR*??hnSZ+%K`v|IrCB#}>7HEv`q3L{Ce2h) z?_WIAM>D0+C)lEKz@J$~g?n5+L))hrb4ZKPeZV>xCTE0$C3&k`8PrczWiod5#H3Zp zHq2?IcW_ZUM1D!qI+ls_3pmE}@*y_1JMzyBrc3(1RNmE*&S+tm{uVVam!@~RdgO71 zJOe`-rR8k%%V1MWTkDl%VpWYO$yCy9UusyhPxsrZ0TK~X{~G2x$>W@_kG*5}m-8{m z^d~gwLup}}j%645YkJpc2ghX$2AcS7_K-S1-x=53$=#}pNf_ZG+c7VQd zEj~S%lF?)9Ux)q4C611v^HaPz#4GPH8nL@^(6;xhZYN*k${8?zt&WKT;qd|2lAU`v zVkrEkD_vnJmwDLXs)$y4Z<|XdhJYmI;uL|(#&$=kp+-E7$Hj*kC;|eWHgJZLR@$1* z`yV_|>6*Ziv7_{h;|W6`K_eL<^bdg%$(o$+k98gph!iow>hereD{1E1E7v?Qu8G|7 z|1|r;f}(Yyw76^<1pUUgGP9hS+C$U&^Z<1^en$>dO<+L^Svoz8*dV-yMQM-7PV6zw z!wp>#{Qzc|wwCwamESYXMLIL2obeo$5DZ|bX8<#7$bVN(JZSA9eVD6KCH7$o?lxR< zA+W{FH5)J$htWM$%Z2zHcTKwu&vvHi)Be^?9V*yDf6US zbW)c3)qb8@#*84xn3eSNlB@2S@fz-zvmzGT$A@5dFWESv?x#y0lr(?3FG5Rm;OIv; z?o|2dW9J8>D|j4rHHraot->QE4c%(81&tKwJU`RRy$voHer!;vxseFs^qfxs@pNL2 zhwedtUsB{bcg9*43KN~p_>+7#v;-NOx^140e$K7~luaC5z2{$OSX$rK#!As!B0CEH z?Q+L#;@A)lPBDjEUU~vGcNYCm^yPOF{V$p0?5;3ae6tI0dMh%j-P-6Y*R|mG9o4a$ zw%yCx?z7~!jaeZx8Ri(r(OW|q?r%BIzTfO**_9YO4|VtWX7kMRj=@RkWzddzX_^)# z8ql#XGpvY7O0GKIf`>7QmSQHyvR4kyH03`_`eFZ_0Thq{7PU_}>K4;#?ub5Tb3{&E zMJuq9@!FsH!tjd}?usbyMFRSBluz=qht4;q8C|RLQBgs-9Q^bC9e5;%pjGe9eRMn_ zn}@NtkPW=cGHp#M*p;bCW>sFVz1%NgjhRVqFYn(tBrceoX9ER?bgmgHFS1ajkS#|+ zssJ#`a*Ibmxj9OqEBKlR4pmtTE29iuI;39$I6q81pX)Mp;#(j=Wa_X*?;%E-{bs_R zz`f4}p#JeA7L)SoM)=i^%RD7jz1d{s&|S*%@v+zk?c}HW zTGVR+p6)E zla{mDXmW)-CTp#KjTq31baty*HZ|nQ(|>qLC`XjvTQsZa2NHc$+Q2Oenf4tTQ~Gv6 z`JGRw#NDC{vof1SA*7pX80!D1yU21 zMAj6>L-j81;f6d`o#SW)W><37H>zWt)~YP#kFQk$z1&7UqWKs2j&Y(dAfG7BAPbEA zbHBNiK+U>9jaGqYj}u?aXXJ0%?0D@p#a{S;M6a~L^ilJ7ZLo1iiO1lxssBQuLr zyA_zOjiD_G-c9yKR$^xC(P#mUs>Fo|Xzt7`+Hd34ZDp35*+exi&r1~KYVv>cH=7xD zw$CWaICIU7UbVj$uw>vP7U+V4ne`%OlFc%}P0@!|`}!O8oNiV2iP=O;C~e!$FJyIt znN?E^Bs=@6X2hr_HZT}lzsPCs>d^Dr#BYILxZ}llvG=I4=%galdaqD}WkIsk5=k#;{@*pA+}Tpe`-KGq63 zGBcH?5C+W|-BMIUGB;W;|9pJp)!_Z*K>0oY%J%rE4f0A2GE7r)_cd}hSsW{EuzP9JSzRewojZBG*tNEy zqGO4u7RSj__u!}dzo+lJMCL)$iieH&+lm*MU;*uuwLD{*3k={R#iTXeImSl{>>zxL zz+M<99xG!TT-8c)WR`m3%K&jV3%SAf@Fsq*@uNLLQsIX~bkGB8b6Jm|`hJfik3tJo zX97*(0DMtvtcgCP$Vz_MQDux8%Z_Ty7N-n@@>VLZOhQ}B=sZ|I0kY=0ZU@>QgpXa- zU7OF(-=qVpDH#Ve+DhM9PEQ}J3)$R;=N%zEgjB%KS>g(rEkyzR(Kh@d=5}{lqAy-{ z9XW{#@=o#uk}GI`F@}&?+=jE)1t1EDHVm81=|1>EqeH>K()){`U{qdzzX!iaFZss{ zpHFWQ@heLCVL;ncsmm^!0N=y+)y(#zQGk}aP2{Cy64*2iq-U|rUe&-K-%c`4AhaPE5^1l{ROfDr#*2J7Tnrm5i{v@-sW{x#R0!c(~*L-FOPEVrr;}<6^ z`r%%1S<~r~MD5CRhI-dQug4qgSgbyF7y@RVyhIADR*EKKd%sElzVyaNG{v2NR>L*k zSoNrmQvtTB(nZZO(tc>%TY5Uch^VD%D*3^`0J`m!A(nZUAN(xys%wj8{-v=64Mb2| zV|n)s;%W&S0(IMhq|LBi6&$zp_WoT6UwdN)-6}j-kE71$=hQuUivRbkJ!SyOJX*g;ZB)~WSxK%RlKp5(jL!$3)4zbrJI6gM_FwVY zCt(kS5#z~CdbkJd#m?JXWi;D@ft+krz!9clJw6JCI9+%BT4OHFQ5ZjxysLE!zT2p6 zy2QH5?XD4?jDg%2w`wvX(L{Fe5{0>sozBKbh6JXdk`Pw%lw`D*2BWNe&u0_`%JyHxbFP#roX=+;3DWiG>W8r(cy5gAMhO5o_AX_JburaXDUr z-aWN(B;v&zq~Rxyh`BChJ5G&`i%!?f&U-bff*dfKpwU?CN1c;TQPsFm(|W3g$(W4T z^o%!l4DeCzYR$vs20nY1>X@@i?{nu^f8!c=EhORDpQ|0dt&b>dKQeKUGs)V-*v>fb z1O|$3wO1LmpiLii6U*y>XK;go&jm7jg_gz{Zljo1VSGB+*3awa$B{8X!_%4zd*Ml0 zS$l-5$&}{=#!!jvOp7hnoyF*_>|-@;^T#=WCnbrS~qihgS- z3)`Cj<~NRHlZYcmPgKX6lbQU>C~`gBS-jv%?M@$3J5IkNT_3oqgmNDMA+ykYnlX3m zOFwqVe!9ECfc5)Vq&Xbq-Rmv@{A=vi2J%#MEQIW!I-U z&C0&{eCYLgQJ=X0(v%DbbdLrS`BJnBOP|0ErohGCP~O=Mbz=cU0of$$X*uH?&;e;%d#a--xRbhaueSGQAWOxppHsIkD95UQ!Swxd7STzQuzFV z@r2l?HA&7Lp^;dFSZeY4;knGRI}G&(ksj@{k9fNVxp8e?iz*ID}`t}l$X8u9kF4DJ!Na#wN0ma zy~Q8X)hV0Wn$THPkb^w@U-};J)72x-p>jhL1XnNSCOiY&uvHO}c$znk@}So?HaFx! zuhZ_)VnB*zx~)|{z1}lmwz(IAm!-apR^2qqTkUyy?OS-0dYj1qd!BMI&__F9ywv)j z=B~MP5dDs8=-qULYn3eOFd{23as_HL9q*iVucph7*2-@?y_!0``)IuIeYy3J($Blm zA;Dhsx4PG*-fgt_T;Ee&&0j&WyY5^fZ*ws*4d)LFqWb#6eMRXESL#(~Q$Keh!$M zFv+ZyEo<>=?t~k(+h1A~Hb0rvNQ^A} zPY`GdOjw(fvA&en^65?+*R*k4&q~R2Qx=LiOqnH2-ay@b#k*{S1Z<}B?>$xv&_BkJ ztyf3cSyDsBP|y5`K}x_Q`&MS z|8<=(!%n_-v zwA)mhc;)N%^9r#|95%AMPPQLKxTFHQ9A+1K|E)xoSNUnZGycV}5N2tloEaHph3luM z$RFJ3kMKVSX0#Q;|3y$NYcEk&1}zzuC&D@ohlW8mpJ~gA`dm8|PgWQlbAOC*=w|FL zBQyA>EVnBPisG4>?_#{-di^8q?p zSl{GJp&7=b1N$avl-G!eB|IN&Xb`#q8mqqm6btbCUH)r7o8TggkZeY5sUNp%FWjRP zFR+RgNmPt_mM1w9YLe2;!)mBz8~T(9{*udrcOt^fWH`c%xkTTz)aV7UzVjBx&yIE5 zS>0(o{?}$pR?pn5(D6l**ROxspz#$yfF3FE6kizqL;rab=^Va2cwo(vo#T|Y0kNI)8WST^ojQ^W z;cfhRPL0R_3XRC}w4nDwCKv)t{zk`Km$7zki|W{miB(o(%H+(&k2Fr?FB{aVi^f>b zqn4{0W_Oa|<1)FVix9 zu%AIwPthNXQko1S4n6QXS%P$098WT9lX)v!>sbZ`puozP&yV|$@ih$FB*~6MgFYkp zIQYBZ%Yp0d_D$lAyEJ=O+X<{W^P}lB`a|#|rJ1{PWRy7-p6vVXt2T^ezf#QAeTovl zdHdFQc_`=EU-t~~O@I*Y0huxHcx4}TJK!eUZ>C;jg-_}#w6{X4Fy_h^OZZHf<3D2n zeag6VlXdT3--^8DaW~uxPhm1S7H?Qo;GPIHMMFcpve!yp;1S1%w_Zs^U|fB~0@B#!k$L!%d1IsoUda(|Mf%@*jvq_p#lh1QuPR zo<~Z$kKMv&D(ymwfMVHnZ+l-bI<9E2DBS5nAWDp^l3e~X(}Z#rtEaT1>O#4RZ@7Q^ z^NlTC#%zk5PU}T><-Cw+QKpiLq5rGxD+8k1+O`QLq?ATFq$Q<82>}I>kPhiC=@2#z zlHy1R2qK|0lG5ER-AGD$8l+#V&axjw>d*4C;-K6u5{-Eri-^E~sz&5k1C zCuM4p17u0fVzzPF7TLOYo~-k-4=0pGp7)YwD}8WE{^s>PLRUp(?S6msN?T)~m1(gE zoO5bDBeq~g=cmzRB(Ub}Bj?>AbHN=4~pb1 z`P6vA)Z=u*6ljo_t1i)JU7rupS~QRLSgTAnX{XG^p2!}t`aA6v?GSY!b7^Jo!Ju)r}9cW#d6O@YpilD z#LRhCKGMm`;#L~S`RF}}aBi+MTf!1#d63oyJu4EOEEIN@IXJaluPdc}Y>Uvbhy8AG ziBE1sqZ&<(rN|y|&QlrB5^P*_?N<%nO2%Oy#9ckseXdh&Knk1eQ*g)xqZq!h8kEi| zQQj6(^m&**!n#0$qjVSRUN6yv*#!>{tZ|TrJCKuxr^H#V4PAH49jO={TFRUZ6ep-P zzp7dC{^5JREX7>+>iqAU-;QDz`oGNA*RIwb#5}YDaQ4RCP$!~VwFS~Le4m$N>w z&@5efLkd1vxqEzmm z2hd5qC>6V6v-`;z>xl!;2L7Yyfu&aFz;p`gX|mGFTci6U^~2=KAJr35!-Y8F-Tc@z z?X`xDch7f=Qm}bfU{l34E~0XF|J9N4FON$eNEZ%vVnn+w$x{gEn|&x2>ZzwE|GOSa zn6BXMmt;#30MW~;I3c3ZSg2@TGBuFvS+15LrVdf>W z9@uNSACc8E>P?2yh0@$L!XxpQ|JZAKaBnzRN8kcnnU--Zt(>laa!zfPWv4l!pE?G0dDj-joK7}JG|KPBPLIfWmh9(i(UuqtU?lC~YPzEhHp`PM z8<~s3p$+{|>m=z86Ep&L9P1^W9&>wh)Y{Z_=C&CQNk+FkWc-=Gg&crp?##7zzfj->-|TYKznptFv}DmPJ(Jec z=qZRH!Iop=$$l>q;@&DTHAQKG`iA|4uobAPmBt9UN0i{#^sLnstngRpr44t`u$iUw z7p`XE5&g)dC`5bW(vyTnxIiP5zB+dJNVvy@wiq3u!?O|v2!XcRJ(w&O{ryS(j;mgJ!W-i&Z~a$O3u>_ z!pR}D(!_hPdNE2r25&?!0^rY&;*^5a&eV8d2$}_|cd&d&aQgII>1n{^Q6Bo{lArLm zaD{{XbF&$fmF%;7*(e@Taw&v^dyuD%M2xsq{A+@4&yoPhhhw(Y+#RzvK9ECA9#Ia)`UNwp|Kf!zltWp z+V>ymeRISeA7dS388p<3mgq1<9N$(m%i>tpYJAh@7rAl(=}L2VIm@t0C1@@de?qnOg7tytG@KwC_qcKC#RC%XBYdjwpHG zdkajF09|!SVW>6P&!jMq3vc8hzR{E2Zns0lL(+j@VIdL;b!J>#=sRP+)|iK-oTILv zszVB6g1nRhZ4t(p5}c3?BWf4>x9u~2sVn2$pGvKv1A@}sC$om1yjZJ9BydaN z%4Bs=Uts23%Cw#E+4!MYZ%%IDfdX7q(1K(py>?hFKD&ZyX!5V*i}*#T~B z@Wk4A$bRO>>^NW;uk=2=;1=x=VNc!;D<_F0E~CA5OUOyxM#w#?%zF3Ed#Jzljh|DZ zdED)W>Lx<{3fGrOn8tUstaY>$M@jWV&{!;r`QRqlW`A5N$l8r>KtYE^V5d@;y{Zqw z+F6*m!`Q9yIs|<{DC7f0Y$ojrIj*)9@bbbzYRb>!#C)F`yyVakmQ-Fsun1k-_+Zaf z#*%5_(sp1gZ5e9F=g-9T@wVtV24X6>W__BPI|A|Vd}x{+83(x;(-l?6w& z{jN4zt6>!0XqHf%P?llbxD_tH?yPj-wr9oR+~{pY#V}ZvGZ&Gp?2Ii|Y6U=uk zJgS}=wS#$%&`0AGIPN9EjOWZ-Dtwl!mC!%Wj&)v z-bAJ6uJ1s#(XdD@65N0LGYgwl7d-abjbS7wxQ2l%b7FH`ulsd%Bd*q*wxVj@7&X+d zKvZoq3%Uv$IJ*Z8m_CP6eK}1&7%T+{ajfsWCM?MGC6yxxSlj7Bf0DG&_7c2Fpw;-8 zx=7@4nz_+&-W3sktE`_$#%PoyIKfp80L5r>yzU=rn0l@ItoM^pgClZIK>y|ixB`a} zNolDxi_x&#AJI_1m*M=zOQF^MUoSMtzSckO~PhliD~7C zYT3$4#~?~UOT3iqr|hcD5iwtP36w5 zl1v}+Bo%f`i-WTns?y^Q@)iU z4TPw{xBxB`pQmfCj{OsV9DANsX7OuGqOz=ZzK0ZRk33!d72MkGq0JplrTw_M*VnZ; zrVhh8qa&T!>RgwwxGd5JB_7j4htK(-F#)Sz7*u&hlXcAMK=cLM;j3?@cBH@ zjrgavuOf>Kzl95{&qTJkwr<6aqtK~duD_*9DM`YFEqei3=Bw+a-_3Z z$OV& zS=LW+1y(yqab^xKYM_5x{H#k+vnT1aZL?Z^khM`h0URn+@i?u#S&R3yQK~QHi)a*K ze_!}AXx~r)w~_6tjUAI*8lJzBMOm5X99OqCp@93|qcoon6)wUwYPL07;JI;PXC~N$ z&cbOMCtJ@g*NpQrE;AVZEThK|dRdRjgFyRlh(RL_Pg_alO`TVbhcy$BHh3i?g{V1!x|=!P%cSbTillO%*V zgI$8U-K3_wHlQJ04MS@pkLWa6eXS8 zN)3FXN05cSoB@f?RG>HgVarKafQDHSRa`Jlw<~Yd-nDw0dY!lWl}M5xYY38>sBL3H z4#9`<84cokTC5)Q2eT_$u=EP{0sCb6#Y+X1^?T+8OH!4jFrL;)!BJ11E2+%1Xz!EL z4?>2muJo#bE&_e3Yc2QR#j4{|lm{hT9-i0JR53o;(OA9#6WfwQXyG>7VIl`tj%+7krYLlLP`TfK7< zx8Ng!nL%pc76w8RTniq>wj)o#p;+PZ{OOgHWNv^)<-B9Wp@0TQLp|5ZNr|t+%uUY& z>7tDKPHggco2`r?E`*pKM}m5Tqs}?|Oi_LrI~r}DDb6P37T5R(I8`w>_Aj5HQ|vPU zFt6+}_lMk&Tai_h7`s%+dQuNB-E&i(by*>h|cb2iuvz19Wi3?zOcy+$q@y+$}ZlgGXlrEZ) zgOyW7k#)wOWs&F^hqMn+o?7>$iRv)!8uj9?Dy3qs=9?jVprB>|wS2WXty4T7^HgcS zPbt&-s6Aal0}$@?tFkka5t;xOXz-4(YY6&r>~*!1M0(5yaW^poCVO%H z$hM1XGp$&I`UlS7pjVMFd_?yece|^4D^X3Hc`t--LK(|PVM9FajG&#-0HV+)+{NEZ zS2BF;2`(eSej+f+cu36au=P~b!4@1Cx20d zb8qjgSFHq^wltme@9uIW!On3=>u5EH%nK47**Se0pIJCG>8)Up_~KiSw+|~bxlixN z?kX5{-4I_bLG}$0XTMJ1%$5c*R+OY9-keAGxL~a-+*S?K(vY?-j(CGRjo%1Ug~FDw z3Tv|hg7%qLndaS=Q9M;<0go^WPWZ`m5BWxu2+unShuEo1QruxSoE42`(^TIDzM?CD zwi5i6qZ5U%~8?(4LjA%uWi|%VIG{bg5Bj^1+m~rsb0Qg zCD<*!EAX2JG|6~LD8ArIc~#)+3o_tB*Q9}h7i5&(j8%1%OWnLioq(KgG&uc?XtG|0Q<1k(gJN@LfuR z3-Ke)czwsvesU?C+wUn*D0F@Q?fInA>)VT>sMqb?C zAQGnU=Hb2T9Q=1Af(R9HkQtT{<$I{zFK+YL(#MqTK~7ARxYKMF*neBfg;)fP5-~qA zjvWd%&`&D`zlMZksE$H0i%ItWui#&3PU7m#Z5R9#BA&!w3owP7NcbiHyYpF*ah{=I z|DiW#l^Ey=@YrAC<}k^Cf5;2QT{<8ZF@T?*IN%60o~7=oqy8Jg@GvI&1o0yW{R;NK z%Y!TW%TFY(!Js9-`^j_`zyiYv3b;rC;zq9R>!!2Ue~)rcokXIK#7_vqf(IA>J5cRV zC_ro8OJ7{627&btKYa}H;f4?Xn{B{6N^Wd?+e0k$faRB(cG^4&(yzk~b^v+6miJ23}x>*d7aK(+;$OAjRiPFWycUi-w_ zO5h-y%>Koe@EkRng)s=wRriyAiT${?zgvIPufrs}obPp*RiKLAB>aD+DNHvk5zIIr z!=I!MPl-66GBBq>O)e-}AG4#bvn(YDk=yPUO@0KwZo}vS)C7KEOe9PUAaOn9-Gga+ znRfM1ra`KKX>t*z8;OJbaz&h%vv3G((2|6GUg)2_vz^wW&lY|;kXc~E6byTutAEK4F3yWy5Y&iiM;Zj zzcIrQzq}_Ys1w)>&*$uC%V{moyfA*(>6w>hs^gxB6dYXu-RjV15Abd5F9I$DRRwG) zd4`MeS61-!JhmV+&H9ZPU=6%IPyRw+eoHmvX6p*$Wp4ZkHkkRrJ{d1)k7qM^kiSRZ zm(~Cny&@qSV@0R4}hPHL;C^p#2ZC|Y;Q#LMNDH`{%xbvHpl8y7 zk9aP#Q^_#C7`(CCJAn0Urmp`b1J+lG;pv&1qqgyKp9P|XmGwes2trM}1s0YhmE_{v zIW*{FWi%5L9NM~HEWA-cQpV3z7q;x7=3{te@I@}LovU2(%iLt5gpE91FMiy6nTb#} z4F}c9M46BW+$8j!3%KZ^wB!u9gwo&Te3(L>uqN@CHg~^Bi@O8SFO*}8D(2@~4us&F zQz808c+8(5+CW0g^&n?v_!6*g3vWPq<{mqW!-=$@fabI}m=I(87yivr5qRLZZW(p> z_n8TM;~kp*95SuBTp$WUYDEG(Y{H|5Yt}rc;Sd3uhz~L0l8b4-^@?zLiR_sJ&3_&x zI03Jn`)UTG(kIv76@ZP-M|ZoY`vuJ8|2nYEzv}m2N0tV?m&C+zKPsfT2(BR$J-FIp zg~-Ar3d}7@!d+Qh?fRC-wEL3b1^i#0y|N&`Wdn;B-d_XcfR4Cqat_mt$8o~S5HSm4 zWCsTth>is>-Ett@Uw;KRJ^}9mr#XG2(Hm_V^Jg|a;P-ZJNSTEeP)bAzLSyL?G}Osf z_@fH=UzuK$Q%p11$q{J16#ECE4i3L-Lk5cc&72HLVg0|Mu^jh@WKIxfmqrGD!3s8X z1ZdhXz+To023QFgE@gg#?tdHk|7~F4A{DxRA`_koFcmLng5j@BcwD%YXm`n8)(FQ$ z8FjK>n8LdR>VINN{tvJwDgZP|9KYb&a4Gh%Jo3K`*FT45xD2Y_v;sj@P7Q`xKJBk; z`i}$iz!KsAG_t_gB}s_FGg@GyIUz@Y^pd^*Na7-}>u-$nTL4WPf4A0D;)QDioFCv( z2>b&$;P+o{#^PhR@mq|*hF6e$D-x88B!+Zb@t|12*$;wlEkXjORsxS{=Oux#)S}UU z29dS7iE;sGh?g~q?nNs7WXv)9OQ8mx3j6+du! z9a%K?@UhxJS^kHS>`l8G_3jv<&M^(3uD!lr?{wL2q;-W2+&jX}g;R&jxpO8Xd+22D z`SR+)1dbJU*TxKBFM7P<&N-oR>L%b(By{||JW)pnT5IC6Y%j1CvpbY*>wFyQd33n` zZLfRNy`|_(eI#^c0;q8xd0wl2x_x@M8l<*04pdK1w5?T7_=&E}J`((afL&9`LgDdP zxVBZkQa9P9$ncmFs5%vDjlA0ot!<{mQTV`c7@6Gl)uk7h(&JCLu}Y+wBEnHtyLJhtS(MH}>5a^fR475M9|m2A1#d=a74?+ZIJ+otm^lZJQWoY=8 zhTh_EZzsA3?PfpU`9UT6W8v-w1bXUN4(%GAao?P-b%1_4-kVvOb9X)#zMFX3KXuwM zv*co)2vl1h9p>2+=}^`#*X})a#A%Jr8U{K{raD}tJsaNS+${tq-Oded)r2T3)X}< zG|Pso{cbJtaO|pb*$H%sk7xP}=lA`Hkd`Y=CXf*jxG^E+PE>%7@;op8Da*~fW&Hm6 z8}hG6&>p2|e3LJfP8)@_P z6IrJcs6D^jewgA7h>n-$m5)t&53W74k6+himDET9qU5Ep*!9tW3|{vRT#0ex>bQ^9 zaVR(n}70-PTlyX2)9dB^l-0@U2-JEXX2JjTc4uc(Jqqm%U5xM#SlvJ z6%IG8LF$8Kmp$%$G;7=D+j1o*S_|sokjLnqDYLmv0lG8wz`h(&634)oqZzBIN226( zR#yp4-wU}8YYswVUbK`b%=_~y@2Z`TSZC4hXnkI6W1vkP>H54Pxj~WlHtkNvVH5Lf zi06wyQ4FLxBXoAXD>hP0;I!P#_+0_6Sl7Gny1tHRDQ!MCQz|ss>eb)sCH_i&RkrPQqYdSU z8>6XGOJq7|Z4$%6vsV-Zh^3;sGL*`w_pC8DzNDoKoBseGP{da+$sYD?FBVsDeYGN3 zeOAWv@}_G_+K%Ox&YFX91t0bs{?b*vLkbqXcF!p@KRG3BMd3ZG*YcW@9abMT9tccz zPxVm0cs@RObv|ceh?H%i<)aU?z7SpZXXB8Cr-+R7Ox@x={DoNlXv>`93aC~N!xKxa zNPxF?u~QpAU^>m8O!K)m{s6

qYMT7DNQ8BA(_6$rskZQ&mN5!!**Z5bP*bq{usSF zn7chz(`J===K+IVZ<`-z%HMrh^q$A2D*uxwLm`?wcPRkgLrAsREI*kL>Ss}oX*?^< zBBx#uine)-tR+5NVbGl+@258uoI-R@BRD=i(c`ve?ApibzBJNX=#*vGs2EgKNmqq2 z3C6qQS_}8j;s{QF8akOtT@RecbYLscqvgyWHoVYvbhe(MC}kn-(Iym zE>hMfFlGd9br~9Mb^dt#p=SK8ySo!dYM0CwPb`;Y^d{6T@0QnW27U(@`c+PB`QS0f z+Zlk=)DMP=^ymyhg)J!po^`#+;6j-co_)VE-Ad~?USI!hFA|2lI%2j0OQGX)JolqU^|U%XlX@e^Ikt=2|l1eyUwP9n@P&F z8a19uyP>+uf-Y|`q<5`{SD?10#;%iIBF|{W8E=ElRe0Bvo8oD~m|~Cf6_NZK2IIW+ z4@8GY!qV@OO4X>R@^{tt;os6OOw%Ca@=C}J6Yf?ZUKD4d4>XR?yAi|>^fROy;q@BC zSYlK>7**$U>W&MGxsw@+5|Q`Nb&*4A+)}3H=nkE0lD>*i80T1~y=)9CW6GNre)1-$ zvErG83Ne0}ucbaq3wpOvW{RE-B6nnp^`K4!gg|U+Zf1R*TT?OZbO<jOScpia#%K zt6u=Y_WjEAz2~~4pSwf%fsD`B=d+y48NEjC^flKA98-A_Y19=EU-ROsPZTv(%r;&A;Rvo!8TVWd0xRjpmk^RGlle)Yq3h4yYFD|!7oJ0nSg3eBH7eC)P zWLSoBQV;b}e9O|~dMMGN5YzP|TajZR{s_~grUE=gP76rgehTb>y1chF! zyY)!UD?{1%LyAX{3Iuqv%tXikqL1*t;gr*6xJmrur2>!QYJ5)w1#Z*ZNkvI~*C~5( z)}hHew3cgQ_6tkd+%F21R*s+>)1lrR`gi$%#=+l-Ev z0hv?lNa7WCeo=MqAwhDKlyYmj<9Ory9a~af$_%ElQ}J!)7g5^ZfaFMil7RH2(hQQb z`u?UwT3m$@UB#Ad@yT87{t}>&!&6L4^{Qp%I?v3(2Ul5yAo7AD_wLP}?zKVuAd&PR z+nB=lKXL|-kz*QQ?aG%eP1$sNkjJ@HzP)$S(+VlwESM!wa27=LJ98P2acUjHM|H^< zEhKikN8H&`V#PC=_A+G`Swx2=AOOu z-Klbj5b6h7XiDqX{;?gy$fB?f^6W{yBo~H@?eQeW` zubvC2KYM-mw#{K%Ke2e%94*gu$Y3RtH`<_*_&qv*Dnc3LK_z#pVd=fjpi?FBmnneu zLZhZ=PWoO%NXB;z14PX#N>uMoF};aAjKDHiw^i>J{IC>YErha;s!idWw>r|sm$ovx zd$Qw+ZCC}-S_3GK<+tvO#cI*8OWwl_kiU+Aj$nXJUZ7YPhD(RQ8fD=fV;$;@LgG7B zbszuAI~h8rm(_U~S33xvzN@a2H<}Pb2=>4JPJiN^jN>Tb4H=2+i1$m~mwQ~flSvkZ zO$X0OISz>wWHFI1?X?L}0T!>owq`66_3lQ5{{_ME{dUoG>?@Cm_1lh|5LJIpG*}C4 zhf7GLKOtg0B*UNT;nGf(Nbxket9< KD8fFlp8o^pcBc^l delta 30541 zcmY&eWn9$X(?vl*X+b)LAKl$Z2}n0fcX#(!8l<~Hxi|B1G4VL*PmG7$6|68g*Yg){_RH3r2~xMUhsR$u?J2q!71Ek!Y9^K z-EGaLBe zEh_jdgJ0i%Q@Ekt5omdsH1L_Nj$Qi=_y5=5gNNCbfCvXSNDc>w4F^|`_xuYY##14A z2CEFd+QPxv;ld{_Ad>+$E-Sok)%TiO9E~(W4rs>l2#TG%N)abb$I4=-g(W4|4|T7o zM0FVI3X8;N(+wV<3xW!Bbuj55mCFWgCTq`sh0il(F$?~>YzFU+UCWGSLyj(uTkprt za@^Y?v6`AI$1=i^Co5oW=46#h?kVGvhgCs+yG0_pi@NE{@1sDv-0untHiL)L8i3hA zmRqA~bVuqZ~E%~j4$sybt}8>cRa4oGVp{a$a39xP&9%2 zOKri?Dd(HmM*7bW9pyF;N4b}`^}67xy6HC32k?kKsI7w_Y^t@%ixmSRd$*@D zdRHDA%qX=6$NKt_%ZtKQUGipr-M^dlz0z$Pzok4jb^+=R&EUKGd-rDV>aioA&bw-n z66oTkFX-Oj_wwphP+iRB!b_o*OOh$A2vyDRR}2xqbXd|_uH*T$+R&S;`%V_OE}FS> ziBSs50vFZK{ofp-XKRIMYHoFwzx5^hmN<+y?)J-##J@Y{D^CjAVcjz)zf(_9&(SK> zqYu5B$yvYyZ+=_MKA4gVw~=PT!+MrwT+tuX{cgY)GSNWeAU?J2@7Y`bC9|gZ{;<8Q zoXx*y#X7^G|Y%#v|iPR z>-P|v+O_)*tR+0zMzMu<;Dl$k%|Br&b-=g%?h>pJlDFZR42E=`%{NyHm*Q62P#mN1 zG-5(Rbf|s@2MdU`sPGhZaB^4h<=qRt=$l!~mB*5Uop-SHf* z0w^x`{Wy;eSymj36`4N7@=sav=h*OT79Oc-%M*r5R}dPAD4#>oJnx&l*Sy?vdD|2} z=N}v`3N)YX=zH!Et!ZKqbolFal6F8PHX*r!ID9Q%uOLU+!}r|IWD@B5-PfW&HX#B^ zQ#c*M75X0f>Q~QRlEq_EQcwg>uDv|m0JzRh%BmfyPtedt@q9NwVU%Oob*k#w9NqyP z`+I($KIoINEM-h)oc-WXe%STAC2F1EzI0ncc`#CcFkpO;o_DeNg>X?ZFM=pBl8gGE zhjH`9>zz~7Twh4#``7ca6Z7X;8izwRU5pwMGk4pP>I~cllc}*1BVpx*_G=^g9sp6T zf8E24zJ00Bm51s9u)2XcV6M)F^o9Y*|4;cmC~p(;={LcnWm^uZJJyb|YU}M~24foj zD}@a=6t@o21^Lg93#%b7D~@=lsY7&kolVNfP>#H7m-muJ(2}V#y^6a87s&cAp(1LR ztt(~Sr4A2`dHGE{of?R7nHAjptpLt}7|_a8t5xdcwVaXJHZH%%9#&Pk1yyy!rYi{B zyeHEXkbM-yagkYT7Qh*5cx`JcB?PX$|9MDnV7Agcb!l6_T>WWn#TMfGpDW&uwax}@ ziaJmE4UbQfK+{^pL`>9Cm&E-wD)-K8g4aObafqFK}jWVf0QA6y?R-{-%_GW z`UZP(kI|zy%jvZAe3sJ;w4Z2zjs%RVVqM_8Hm0Hqp8lDXW6Zat2A$YzA5|MWXks6v zbnhM2h%`@dWAIq8H|v}sX$D`QnPu81hjp>(9S4o?`IJB2B{K7k3b3YGRYiFynqX>F zax>1wma{2U+Y|b9=mP67i$b)xQ_b z?W^@la>?Yt;$z-UKdKGiJyBji`=k zdBq-wHyMp0-`XaN8R(i8v=1TRy+$qn=7ov@!8`kVrN>9m8lvn2z`t=?N|2U$Y9=7e zf#6!`CLtN6Al?IuqM4|1M*cr5AtddofCcfdI6BENpa)bdqmI zr#tRjZ=OAwVbHOuz5Z~ZJw;+Hbn|wBW1ju1cW8!v?trfmlcoS6$i?%F zSBuUeQ=r-w-TxwOiseEwm*}kjugOv+J<-)r_6SX(vtS@oK)OlGJd%k;H%sTFUed#Av-{ zy2NLS2uxoX-CHq%B5FPGvwQ9aH39j zwb%%)ZCYPFyydrPQ{1qOZhb|zM~B|`cw`EKi&Geu{eg&VRkn8Kd&qR930_t!DO5g>nBmHjCBY zy+`9QT(-#+O7L@{3eu zXJC1rPcbjiev(-I4y@&tc!Dpm9{Q}o2+l4X=Iv{WqJ%s7N#MbYcY`$5HP8fwVdv`Q zE>3v}6d<$egImV@>ulK(Img%_Sdk6P{xvi-qulHT#0^v~x^`$r*NO1)@izSmr%+iA zF9>Z#i}Xb(dn1c{;qM#&96vfNoF?sJhT4(zUrj<@;ZkjA#ths)G(NM}qy6|$pD=kf zn{#NpTt1UHY6lwTI4$ndU!q(?oOx5)uLQ`@79BNF{QBgFkr&A;2!eiZCV zM5P9EWluC#`c>g#L8BY+e@wjo z=3X6SzxP2cz~OQ&5&R&g(+_Pcx2jl5-2*#UqtT;V3!z0D6S+nIrFh-u zoTUtRUu*2Tk=fR3+is{dxs$&$f&MZ~?j?|&`YK&K>FNERdC6bLr+vA8G*&Mj%q)OjtVmm=jgmD2_(C*2-)hPVdd*()ly&!le z0$2^7N?1$L66J!WJE%5BN6Mi#ldzZzS=`2mZGS|jevEXDjc~9c+DLF+711e=y`l9m z!>&ANJd7Ec&;S&n(|E01dI)a5M$Zb+D8#n2BBwDw9w5_*c^5}yIle8lAbc^I6N8&@W&7_X!degA{;YgWzr`Q%cf7DK6RRs*VTkx%VYo8=n`CG0G1{Kd}GhKz* zv{&a>X7}5)VYx3$i62WX57h>vp_(6N$$rBeTs=|0ajR~7sG{2&lS5-4?u@=!L*_3I z=0#I8kAA+VLKB0>S1$BJS71&?6_+n>X!V_Ej-8YhR>BHOJH%b?r4!*3;c@L?W(~F? z0}3YPJGpMX1k16Zz1EBwo!Y~mpz2?$iSLW$ZR#5r?p)b6gz12CCv!I>{ixK)6IH%7 zQEiM~u42|$EeA$j_@H$D)KHu9%>HGc`YO<=gH+CHC;SpVQXQL8Iv*l8HDky0w!(0r z;3)nS2Uq}7pC$iX3P;)6MJG;{0NvCC_?Nr;&@XJ0lHc%EnY4-JgH3;Cv%t|YRZ&e$w`vbda{$*zfL zC5}9w)+=P(SNrZy(vatmO|O%h zr+B}-cl#i;m>6IUFTMs+e|*J(Rk{&Ro~-;spqKiu(I4C|CW?P0+g$H&SnjtqA0xN`7)C-jVW# zg$7rHUL62DJ7?w+Mt_b&y(m*w8ebWwD~pIV7e{{G+SSr6@#%>vnHq3A_a8L3So&$D z9)7^dhK(4Srcm$>zMbO61*?{POm`5%T{eBGy34D-kEi=hm`0NkR%cXHHj+PeKF5?B zYDF%Fm05ME@?gYW_Od^+)xV)IF*->>wGGglq&ZjD@hjhfVbPk<>pjJ^WK6Uhk(0Vg%21irsKwHPiwOuYBjG^Q*i zR}JM-o`uL4Qorm{&(Fyee3m(MIcnX|oc*&$w-PKvSw+9aNhnzM!($B-qI%Q2`(Aw|z1fXK5 z0kA-}B7R34wF#Pe%f$bbb7P6i_X{SlS~JNLJYchmMdcT#S!BG-JVHz&{;j4G%B!MBT*5 zPgBc9vs3{ZgknTcI<5=PI0s{Pj?S3j7HnR*b8=%NYadZs;?5}PrKu1Y!~an{jT@L+ zgPq8XFkn#KrN3n4S9Hn(*P{kIxIm2hrV6UrM)W3F!-! zy)R#(7-2A_;i|FXzco-;VqiAAh0&AL^;j3vVv z!-`aV$zasHZ&@f}?WiN$Og!aaS)Jp$PvcOdN=zT(+}DJt&(OlD363*qvqvCVj1Jac zt(``JK{W@Z6BQV~_F6!UwErA7mplXEf&RFlEY4`pF%r zdhxl8q8Rf(uzEWq<82eB#aKtF-R$i9j-AQ7QNadZ^{3d*FV>YZCXIfMh4HL>y4G(_ zKKd{8UJSzOvo;Z%dp4|wyN2RXY5D8j^d}QGJbYkuUI@?SR@-eT(`XIsJ8>m6Ptsd) zxXuPi78Rc))+?Ft>2e>wgXj;dUxOQ8{P>X=u^JT@hP9KdEJ$pJup$T=$#ca0PglNFG z*e8&u_^7d<1st!uT5FV*=WjVv%NvE_gny$;y!#qAgf$Aq2>%H$sN1`(=S6t6g2QU! zw8SH`^G%?*y8yC?-kXA`2HIewei}M{aVAo-1#W{8Uz0dKSyh?AO>)DkW@m`uuY}$g75a)@O=U~Wr zl#e}khDmW%`n#s(vstizdcCy;ft9ZGcuQOwj9$1fIRe9GvGayrNuklUR%kDA%Bh+Q zoKlSk^V9|faxzny{|n4143nceLY;4*C6r$cFTu64H4OqB+_&3werw*)cvlKV+bA>I zu3oY$)i3WBV~N{Wc-5vXxjI}$mq4k?Z9;+j1ads%1D}d+svc6FihJ*|D=p%8zBg;+ z{DXm1D6qyFD4cK-GMnrj!s5&^n5|nU-Nwy;5rquTwnf+4yI9q1!YEz$?&;)N8yd%0 z{cMgG7|{ylkEIWljkhpPd{jP5`_-}Rpe9h% zwSeNSKQA$!wS*WGY_M8;9*MGrccc4j=dExEEGOap@62`yWSp-R}c=m6vMkoF=%s!c*nZ)0e%9F=uox%C#vEN@;hl zl|L9F5$(gQ?1JUc_nU{g(DpOC3tE!=;qBY+Tfy?ZYBa=?@F^Ej^~4l!F$` zS*I!aJQpmfUQ>Q%1g9rYQmGT9rMCO#LVKl5R@%L)B;VisfEi8ca>= zsZP`6JRtn4rFK9?VK>~lm1`iH=)Ev*Ye0|OZR@c7MrddElJlJwhqG;MKIx+$Pp~+) zbNKc75d`a@kffnOP2HhQe57t>E;12GK9zgrKsI%am*1W!V*k809Mfv-+r3{pRSr9&TX~+G!*=$#XQ#S#Hwzrs_moBKjx38!3*_ zy5W3G%Hh2xbdSwyYl*j&y8wE4TSj$(a?b74qV?knfwaTB=0z=b=|S^P+v8igWl+kA zZLOpdpOF|dmgo!AW<~@rn9nh>xUlvirjyk0Pf} z5$Jaz1uHHKGfhAfiry2nt~ZnlRaLjHjh!U#L7ycT-UNtGBhqu&Kes#N0*dj731U~J z-85fVh++nZ^l@~qOJ`sNa{nu9c9h~>By=_z8aVlCK zy2)G+ua&kcU68~2$v5+^`-{O@0AeeX)j_0D!p7-q`3*lt(#4Qg)!&M*m-gRqGQpL`hPO;qsXB(5!9NG;X*nwgUc~ejIu@+T*ny>}O2~x5v;XCL z5w%C51I3UA=EgZXFNVL{C1&a&DI0op4hubZJ*COeRObBv$_99^%k%#a=WY07hUn6Z9l%U zGVZ1#8w15y`xkryR66rkZ%xw9$nOzuu~Z$W6-{oj@JHtbQpw6NnkF>O2>CQ@`|BB_ z8{^+P%pSR`y6KxCVZ@$js6Q94YYdW$KuUjIIxYyW+Iv5}P%>W6SO<|YEg!*7lx9s2 zBiI9N6{E`t`oz)w9d)(o6Za;0;u(IBbK|U96WQ>i0;(+Ot4H;SX?|k*I@!EJ%5Y#r z`U8Xya~JZA7>^SY<^FTS)Tp!MPlzO>nh=lY6T79FK-iAiWE>5dxM*;^6#PU?Ivd0; z9rP~)E2w#*9VpY}#r$$jY;P8u_^2o>N-#hfXUj9oTi;Ty2qZ-QAb{Yx!1#$S zNKSEy(-L?4;07WIAwbRpZrP6U@EL6L?d6k(Y4}v0#*(_c zxg5GL=Kf6Ba(b1|ky#^iCfWf{&oTAUgY(E(Zt6Qn4!^bMf6gFU6X z$v;Eu5$HhKBpKvaxLW^dEw^r?YWd*49^@K!fd1|*x<~-Vu4lS!+t1g7l91HQft-K~ zOWdKfoS8+xp^uX3RTzgCDyNd^Iny+qNOTx~Np)KYK;GFh_;>+ZV8)F?>HDQ9P;)1u zLhkq9m&cdjy{Y=iq=)yrnLRp-zTm4VOP5W_}FET}N2?Fxu z?p@-sMjcj8zSBzWh`&Xk2RJs~1#^xW$xZE7a5L4VTTiJ_dubKU?s<#lI;UYoVEz*? zUnnHPfoE^~)rJ(Ii|6KzZ)4&4%f1xJ8u%LSibMNwa9pRfpzxvWkf|b((I#5Wn^-~U zP#7|7g5#AC5|9Ur#I41hzbL6nHm~COc zBF7zUGpyRR>N;x{ttBUHv&E|ABMI$i&k2i<#2BJpaKds32!8(QoK>J}t_XW~P~G@FH7MUTMXgWoUe2{%JE9mh?esR z^&$d+moyA%CYQ9i->Snc)e3YRhBPt3AD>PK256#OzfnFD7W2p49VYcA*JRl1no-)- z7cVNpcdnHS6cftm{4%jZfsutsYLn;BzJQ?elIn+h#$8#B1yQC4cNYJaUn>Z5zmNj) zVdtU`)SVyqK!aD#DZ(1+jj}3Ss=ZiQd%eIy1*i}p4}bQzXWerk^q;f98N(#gX|C!k z%?GPcK^E~$@1%k-K@uL22;=Tbw(jUe3hB+e(_S2O*9EQ9=TAxBVV1Ty;Xzqgm7Z0J zD>ON_mX#jl?)MKc}tbWrR#^sl+IEQG3}d?%qp{c$Madg=gaKK z25HYfDiER=z!>VG_56k3q=%Pd?QPr{HFGa7W}_tzZ(4b3V7h+2O19`h{cyTx<*IM~ zO%AfC;;!iY^S@j{Xn}0KMdTTHr~6o*$awR{AVPL7R9R4(IbSBS$ov7`S}(O`m9MnTKXxHP&*Soiw{V;f4Xu;1 zwWPhhy<_)L=}f!rE`;cT2Iy-~2Q4=$yn0n=dCthv&f6RBtKXYUebtU@W|c&!;!0`$ z2%~_X9WR;|u6JT~E4`8d@XeVKKt zQ!U+E7WSE?neGT;~X)Q?r4o)FopBdvw(r zp(DHLqA(1P+6IxE27sd82>NZh+aw(gw$aF@Yz-eZ?zCao&pSLtgU2#0nM_C%&SMVM$S>`gMr9M_fdw@U5Zdl!$Wi;h>{sIh-*`^acNf zhv8R#-P4PAxm1iUEGB{p+>yP3^^DmPIY3{?w)qcf){k0$!bzHi%wtwkvcjQC37OIQ z^s9y@fTLtMkXI+kQlox9Uqy%;XVrVoZ^oDoYgmYT2?SSJ(krOy7OV%UKB`pRHN17^ zhGA#hemwm#@#Htpl0k->!htf?8Pr2&>r^QCQ+-)QA$xVKW5+M20tL5W{Q>wP{ErFZ zLmkNio&mhpRN|oQNV{r(94@Rhk*QSc`9{(1h{fVjdyO%X-@>lPn%T`FrLr0tUHz6$#U-YHjbntRMDaL4MUDaJrs z6UG&WHKHJtuQWBw1HjHFl2s=Se-y3D{xqluSkex7ozX?V^ycLKH#UJ_?kfw~%ss+{o#y?HKt)qD;%R&qx!_%l{o3j0bM@NA6N+Fg9f$ec%w zJ5yxJCw+8eE62p2k8Zj@^Z&Ni#aUm~aH_t2o>n)XOJ5Ev^J@Yz6XGm(~V zerJZ;GK5ATV}Q#(3fc-b>uO7qv{L>upBap;Ol)}o z2iJ99YZ-PpLYpkoQ*bGry4G1D#;LThEI+1vYXLnu-qhf5s{pxF$V%O;i)!P}ay)}w zy|JU9UPWd7h$n-I1Y#WFZTEQgp2+Z>ygdM?iLB)XjpzZ~EXTiATqnMt{`Dh3+*k>V zY>be;UC+Kz2J*_U*xTY#jw{CnEHZcZ(sc)%(qfI7qI2NkJ)_cCqpmGz)98g$ZnK)D zqbi>7T-H?x;`>x^*A-X5Hh|G7lv3~~wR{-IZw3MI4;3QBJhwpT6qnK=wvB^$4FV@8>4KEXI;tlXs;l<#u z&n06h*#+peOz&C=d)_~j6{l095%&1aIdw8!BJ>JG{!hrwP%tVvBBGemuh?^SI~W0c zv)MGEpPjy0yZ@9rO1(%LNVR1;xw034zjc;lw-QEvk)9vGbf86x{De4#-dP8k%)0^o z^8xEwO|E>XRCEzK*XMQ&a(tY3tjP5BU*QnB(zVhQ2=aV!OP`fy%4?+~X_o}-lBOeY zd^E)TJDrCtVY1Tl!lSY$3xNTP5)GFs#HhD=>L+E8Rt4zq0=MSHG4^u4RnF|?s?`JZ zlg!0Y-xYfx^>$-Djx^XXmQH2Ar`8Yy)r>GJJ8B09qiOEl<<6oP_;f~GM*0#VZZ}|* zk#$;7UIVunTb9-S4n0zZ$Iz_FGMh0YNSH48-)JlbqmP1B(Gx%%H=*~*$55=^ZNV6; z`Q$q?qVF@~jm?6$A|?Bxq*sOz-YD%!NL0OICsC=`CCZP?SF zO%5nwP!&uSZmSffu*4CY{^OUBOU5*9GQ6iHlV7eSZ=zQXho3T3AzYLYC-D8ho&8z- zUBNl(^sw5sT2PKQ+J*5A1SkfyCl@(|mOOT}M|zseMwZoha?6>j65fAo!p;{f-pu0~ z$`@lzvf?Fu17)gwS^Iex8*{;RnpmOW^VGtRJR|<4(DkWgw)kBNhPk1mRzk)N)ss+J5z*H<ttt%B$vNS!?|&%Sdy`7_fG!1N6UFYK+Usiardv z$_pwI#{Boukah0-JHm8aBp9d7jUzoV*HQ@tiH| z>3Lj807)IYl&@bo!;{HBoy37A>fOr`N2+1t)Z1)3s}(V=yEacmy{Kxuu*E8ea8|LlqhI*^iNsK`v8$$jz@bJTmjHrh z20{C;3TY+_GoMc>Jp_@nL`J{QH4v>>)%MG$tJKNRp@Bn2(25!!UTq=NRcCIxdFor&`ir#P5f+tzx;kDg#P)>k{TqY51?u;a~q|3Y+HHBDjh!vvu=~ zb5lhtljb3`rnM00{xl%Sg15cWXLzKn-HO^0AIq;tBpvjvQ*20+vJA*@WK@S2PY=Z_ zu};dq@{cy?_PEeYts(x*l`Rob*iBA7=ZoKKfSG88!wUgfbQyU^$2sw+h@imk7Scgo z!t^Ouc>SjTLg)@PWZxo4iz>5y+qB|PAzzKCuOo9B!3jRUbsTkGQ!82N)a#40{{ftV z7e8V z`ysQXVj43)C4RgJWNhJmujs|-2qGNLN^adb>NA#!6&?RKee$+N-hG`D(3&=yv&p7< zNVHRw8m-bQJV}*Y?n0YsCO8q`(9H?jsQ_~KChEcW{2-SJXOYFnb?q^5b^5~Z)YVF9 zA~DoKoQrto9W6{mL=H3-^xmteUk%VEo#bm1uo}uTfF*`W9ZU{;fs^+v*a~+kUH_+v z_e5+_2qh@J^C>f~ZxQ}?Cx{*Pk#&oJJgV&Yr2^;twA=UkRiUa2ySc9bR~Y|(N=<7* zlQ~B)B?%%0o+|B^JR+1<*b!%IfFgC~A@HLt@-sXb0^m1i8B;hq4NKnJc$0j*j7kO_ zyS=_si~IZip9enMHI~Smud|=Eq>Vm^Pth%mStYg0?PO+gIXozH+oUVJQOB653=&1| zY`_&|9B>8wC8^*zk^Dcj|yS+EB&jwPpBd73<3V9vdS5u(2HDsG8)$}>H2;)qoxpJqkEKtZej0v#jhge~i99Rb+*l~9kE`Jk|c&S$N>h`!&yR$!G) zA_G1DKP(B^&+L(?mNND4C$5$=Crk9c&`znN6xXjV4sj$F2U))S+fTUGFdL}&;hETy zxiTh|y6o!AFN+92uCZhWb9ui8KquFEnGDi_Y0NMEI8zW{GNfQEk(>qOD~qScGz#2t z8?a}8I>kDjX*&y@t;Onp_te)d3%uPj4%|2gJ00_1GL`5`yBuL>$PkI5BK#Y+T1va8 z?W4ZxSGz72QvEyt+idBE2|@7Gu%A|IFT`;5Y{rQ^+o8bPnPll~(XgwtiSZ&QLF~a) z#h*4Zsl|lxcbl&9M9m;_eBI9tNuQJk-!EnQb3)+Bt`lM?Kw2xWvIYZeI08Lmsjp|k0svB*l9++yO7bGGr4 ziQ(HRZO*0&#Zt_ZdN zhL|=r6yKy=5wDG4?({jkhGW1M_}!iVvk0t-Rxi4ERKQ=D)%cj`8p4g~*PO_bxZhi+OPK%277^xv72ej>;G zw>`2f6hkp7cG`!$r?fmj-^xK|+HDlRn5NG_4SN%v&Cb4uHF5eY%mdfSFQk@UOL5p0 zJ{p;5$Q%18(gD|Rg*YwmZuJFlWa~8o>*)eZpsw#yTzF<>J>u6pPQI{ySX))>Bxe|Y zbFM!SMm?YsRTP}$ElkpzlXOOUrYgSGBg{2_vz%}Sq0nBap6m`Z?2<^^{4S@ye+_Mfxql8d%`KB9a&Mac^`G-3;T6jRrwJ%wx76elPyl< zO$xvSuMt-CnM?q6`_da?xW)0~UC9ROnK$2V?7h&_=XH>~MhC2!cr+nf^g=vG*n*ng zWb+sC$+1Pt4E|qQ6f^O^vz=Jv%b`9?*9gSaHgq}l=1z1k987B+1O1RlC<@pPZnBoL zi(R!`tZ1<@9v(KNqbSOW2s31dAtLivfA7NH;pWQJk~JV+wW*tFW4(AY!e6Cko7|%z z%TP5*Svf^&iBX%w;^IchO(nI~?%B*mG6GI|A=UO8Hrl$<>6vF4(nxJivFq7xJ9{z9 zMILPRh12H0s}Xh<`PLsV>culFG&oVU4$T5X(zh+Fc@M&qbcgoUSGmX$tiL41sZ4zo zPs_Mi+eQN{X@C1u4&WWxQ>blR>a8uzJaDL8*;_CbDlIJgsgi)}7KZ8;nqK(5Hb_P* z($!8+@ZjRtZtgTLSWh~__3ENiw2JGVY&NCk=~Qa7C(afsV&tEV#muuRj69>TMprRB zq;a^UO$8+?MR8L~m@a>#;}DZBPM#k6Q2+K)okjzwar2ClT{Kh1e<9cAzKhgKW=@B% zDkg{cx8&(g$n>gRci-@iQ!&)*3s!QEXwv=ia)y0OxYlOK?W8&A3&ynR^V^z24sGoE z3(V)r=@t;&cpSVNJ%qSl$I_w1xZ)$25?Xcip{rb~cS|w_%KN;0&SIC8luCXv`@t~) z&^L|QD~u<^d6oN92}ceA)GwhG9Fq+@Z1$XEim_;Ys(s3qtoYZ|i?!7AguD#Z4%5=_ zsv++FZ!%k@_fSZb<{VZ>*ZlR!8kaB!y}NH&$eN(!-SATc7AGq2nt7i+7P!6$p68z^ZJ1(xMli*gIb+V%31HY zZMTtOg|6Fg!JmP`_N2){kpaBDO4{*L)o1YcsSJdhEVr`#x+J%WD%d9K89-M5L+dNz z5R8A=Qhpb|@2YTEVP{EVH{$4Tf6X`6tm$3TFY8e6W4{6JAaFTaO0T<_T9$J43~oH_ z5w3BTsU}~$2|Uv#e9Nbm(fIl}$D5xz?wyQ6I;XCzA2;lUsw1AMM>6^Jp5h)LDVE-Yq>G z%7;cK4_BnBv@&2T;pev;NX|g6Ez3(_KwF7BvMNN$UQRtI=~C+IP~p*B`|Nz&l9EZy zLVThmecBM9iXL*Tz>qif;}_OmVp4?xv8F>z0ycHa(U-4NUKtkHz>2JB3Er&0-$F0u zU6X$t;{HNM!#}Sy0YWEHzmW%{9>tt1OnrGJ%MzP(V93orhj!v&)2@9y7G+-epB?H| zn*B1C>~cXoDgIPL{Gbl|o2AtIwg&^WJzu}|I^!Oqy4>8D#*bIF_AdG(qHgJ29cAjd@ad39AFDW z%RZFEZkwC`Ob`19Z(A!9i6ON|HjC&`S3|+M_k?GaHJ20iEV$N6WrUqYhlQlqFVrZT zO{9uFNSCK+QH%x$xmme0xRUjMunA))PxiBU;ltQ_UAOmqjoYk zRMRG_+svAl1z5X(0jgfee4LxWAGFO-eDC!oMV}0J{=>fb$}QD7>~^hpmwWr|7?3`_ zhbU=}SqQ35+?r*$TKm*a+MkA&1Vgu%Bc{0t(R7@ukY`86r66zdsp3WL_oLBOy#@Qm zI3ghsd|NDQNYqb6lFL0ycf>&$gi)gR^#`3a$W#>EtIHun)fg=!O*UNX~X@_l^Z}ulbj9W7oAq|wA(+I|>gRX2Xw3e}hhK8K5DmZ*GAFPk; zCSIjmR>b$NWxIM_1Y!^sc@wj3#vk;#!EcbV+t4b<=99t&VKRAu@&-Wbp z{s8w!;u7dclA3vVt{kyKHjZLKjJ5M;F1FMWh-Io##{kZA_a)1g7w=&!zSJA6yRg4{ zG`Fc;Vgf(LmJs<`niP(QP~fh>)&5$ia*33KyeX0+P}J)lWx$uw938I}U&OF-F$#b2 z;i;(thv_z${l*4}#%$`UC!2F{qaq7@TEDuu7cM;L7I%^!{q>k{tb$IOy(4PMA&v!x z2eqHLqipPu3K9J;H)=0Ae0{)7ZCc^&uZ>d`#IdGO`#dhOI?CDgq zoO(b*wl~GPpVX}Ji#uF%5^>37R^XLWGZOwCdfE2Cu z4;)7#hL^($?x4D7W?GTixMirh7&A*vM}r)^B`N)vINzqmGjN`hiVH)Km-kZSzEb?EPJZ_ayQKzqL!ns* zbn16;Q)SKS8QZMGkHjI4VREz?|bG}Zg;*W2zm`RpJN7E=9N zKnd11vN%SB7O#U%bNW;VL&iX(opD|&Wc`>$UU3OBsW8=9iSoB9l>*^!oS6GQJyoSG zRNEid;HvBTM5VG>vBFs-@WHrIN|_X2`Odjso00RAY1K_8#2N+nD~Viu+IK#7PnY+q zRIE8L<%{@WYfm?(adgIVO9jkN6rqLJxALZO2Fz9_8ycvR&BeVZO-!^7ktdi|mM=S! zRM-!mO`QzpCa0GFjAQbo zWQED{XrB6Y_Oa3XM|t+*%H>Gs9a&br4(06P4t}ZZ8EKA$1uh+N8XxGzF9tfCpqaJ#F zsa5%$!Ce!0lt&~vTuj?5Q<2_phVj&5RQ7C8A!x7ue(l>9OAIikZd8OXzJv8y&>H;yT^+5Z@=_av(s5{Tz1Q-*}{|c!U zynW}IlRT9ltSa&YrhzPiuh-fK4`h>-WpymZjSmxsZu`9vWx4NKC|z0Pp{Gp$D#Y`s z$|uj=YHIJ(N-ZHCKgjUI_gQ#eG~F~780kPz#xKa2xlPj1;OY;SK8kX%4mOrOg+XVb3GB#oJ<6>-I zo5GEs(UZATQAI01%js~ArBf!N|IgVx$$hMLCxqHqe+T$JRXf=rWcOD?_r&{PPf>R#+88 za!^b*#)TxO4UVLrHJbOM`JA}BOnVK7Yr_I?$6ahqU$WTAmBuQPN_S_=CtY4RVh*jz zkTh8PnkvvPwQ987hR^K&!*by|n7Ulv?j%$L6$fVQdWuQF^`hKxH&Q=|;zhV0bICu$DM z!8ZZCN?4M&EzqJE)nbe>&TQjE5Z3-V|8{$u^YMd^?}+3GrTp9JxzN&8DFxR9`{_`< zFT+6_Dxz>SqK&}Ma?WIZ^h;P9Ok%zw2Wk! z#}_Fz9^jvWfM{ws|4-FNU4QA+(=fZ_?H^G=KRg$1{C$wYa;3 zHP(=0Zq1hOp|<2#yUkM=NlmG4CIdn8;8{SPP38p#P{@YIbCAm#{j(xF$iO_&!rb(! z^L-ywJ67f?)T>q8(2OdE-H!}y!WN8VvlPc~%73*D z1?oStsnK8`XloY@&z*OiFA?^eF)EuWm1)i9{b~8-yhu~<%+U)s9(&ljEyB(VlsS<5 zBzTi4P85dma(!k^dg+9PuS6UYM^s?1Kb`L_POC~T}OA?~{!2hg}m2coaK7(!Gd`7B}`_RAuUJkTE%Nf0w|OQQlI3=Q zpT|lg%2t@%MB9Zo*rg>Eof>OUJ$Pu4zzrJ|y@wo+AcvkDqw2(n;AEx|+G92$G1mr1 zZWDW~#^(AHL*kT!?$0sB(4}vWw4k9~QsWENwdT9`G27txkoZ2!SA-(>XIS@l+`~|) zNvf)U(hJ!zjvzR)<=H^Y2Ebu_6N(p`D|Q9Sqgdyp*|`sV9A6vwBn;QqA64Dv97P0E z9!`SvX|tPtPsDpw+7eb5tvP0eg+hn1z_tAcjaGanRhPv}jT7$Zchbz@S$iIQk&dX) zd)VVz6lMcX;~~dk$(ZV{-+=67OfamU>Yrw-Sov52v^hedig_z11ea0~*xm=8y2EWD}4!|PYOUn8sN5O5*BJix@yBbB4MhMfr z)$)D~6fi{+ttu?+2oH7Pb>1g^8pcci`62OZN2~xTM!V`K6;E>oh8LX#L?R_qIKS@$ z@1H!LtW?%w9tI;|?2&!^q_Iz@nQR$RF@GrMX56sU98a`)Gn7Gb z!-z5}lmT389P(8?l=2I+(lpLNf+s}rMwyz$dAtlxzS*0z?m3v|`PiLyGV2W0b{W!D z#Sk^b%QSNrt61#phfil!eM&h-naxuGukO*6aZ28fTpy5Ze0TXGM=P!_OU z#c$}``h+3eQNh|t5;Kq{RhR@x-xS(;r${cBZ|2CUcOlpFbA0jsFnFXYd7$a_sy1BRuv~9lsecO6Ex6ROF#CnAEjE-%+4e&} z@B|gK*oWK`OCMuiWN_qErE56)>|BI3(M|7W<>}4%jSKaEejuc%Mjkat>JGSAuk4aG zTl{kQhN=D?wrY-v@Xe-1r(&wvB;RF zhu;7o@$n>fB!gjqr@~J&NQ4}f>oQ}}q9T$UlTkHk>;rT%#LGYK&HPN6obBb*Hm*f* zZ?>#J0`oHfCeN^SFd&A3zSARz5MkkZWnnfvY}A{(nT;nFu~Pm z>K zK2Dy`F1!xz)jU;ZvIF`n<^9APAEt{xAn-FYSJ-xY^G&q4e4k5`tzTJG>Mmm%$B4a28--Ehk>2WON0IBK-@<2!s<)9YkZV(*gk4Iyf;QKsT`M_=<9 ztOGQL`AnHmMN&-88H>~~vNrS@%1*fUlDXJlJE>=uk?=#AO9pxr#uDZs=6tNT;qcJd%VtUKE~3ERY)6`cvArx!r(yjhs{k-Hd0?54zB5KV z!}mxoDo{Js*POr{H3(%EsRuml?0{Smf!enk@#?y(9xBVJTO9MR>q+_gbsYs-i4=#0 zzoy^Df`BQ~tm--G7a=A};q}C=iM@C33-i#4` zNy9CL?}^hdOpF5t{%(zyZapD(P2C~k>gebfm^*!Vw>aWIbjgsFq73=ey^%us>?PT& z;F;tP@tdJV-I3nH0T-6~ncY5C%LYGLmbh`UvA`-qk2porK0^wn^QGPqE0&fGPH1B`}qq5IJ402N{Wy6+c>D3eX=AL^~6*9QFH)4moHcg@x0I088 z6wL6{MRkPsdqN)MvEV@afL&ajQE%dCh##qKeZS*1aFj(4j1`x5UdP`8-~RFw$BD@EEe3uTXW!&mR|ls+?3Be!@kXe&GsDjP=;1d-W@X=(+NH z5C~X?h4@z?sHkY>j%d(M(hl$nz4aOl>Il5rKUvehg4I3%q*JdoVO_>i zy5MQlb>DZ58ZB1zoEif?w@QYWDd)L<6-qZg4_WDs60UG3bKj=JUxi4Oqms0q(ME``rjtG-4iH85}7j9CAfDL#WMGEam)J^D2PvQuG zLMp*Av-X493H(!*t{oS)?MvpdK3|gbqK|n$jXA zsvW&|+-xT}JeHc+hQ|{W9Rxj91=ZE;`n&nBkj{HlgmpDNQOcpdfb>|XfobsR%gE#%2Uh6 zWS53YX{UTlyT3S#2G^M@uJG1?wdDYChP729NW@g*3DnA#iz)9 zTM4d9zMJ?}$39|cL7UP-jALt`SR4|9R=*GVY(ZDMe@7QL)F^WgbeC}?U4YPTr>*#sa zj@%i!&!mc=ZO$=JuUMjJOe@KrHdVyS+P|5q;G-xdGvuLD3Ik^R_!J$gx{<|44L;r$ zOACbax?*r!8xL*%`upW6SzMsvrngP{TA{R90WXc(S%evWxg4Vzg+&_l*{IPem_~3s zhbX~pdJM4~ni2(urr_-KC$3yRJD9C|0SF0w4syR?FvAxTozCSQP6-Zx!EauNf7sP< zpjn@9Oq&q1tsF{E_?gwyZOQ}7!by!U?J-m24dde0?AO}uKz5oE{XF}S;%0!fnXd_F z11E;TL>QR1Dlv5?_IeE`_#QgB-~l4CPAWbvs%>^r$}9M2uMWUh?)0**h6E31dG_Ue+2J;8jowaTH18*B6Pr$U0c3rlT2S=)v zj5-IHOrX+Y+;-P6UKGElO(?Zp^Fzd7HSBUzoTTd8`t3?u4V77yuj!$23EtQAdkziC zGKM2-GAlLSi`E#7N``)l4=;E+{$eMq+(i9ALD!~ErFz7ofgL@ix~c|p)9A)rQjIh> z;`zKB*zbDwhxHBmyz}cqIxkEC8x?#fj_#02(M7Hvj4-J3vVS?*o^TwO9b^1cm1KPLj953fu-FC2anAWok;y%jXY0vLyaB3 z^hob@YjxYV-X(82-t$sBl1SfpnnmF>Vp)LD3b)bJs5vn`oK`?QB!RHD^f@A4%?r+- zi|mnlnl)XWNO8H(TwVv3!WXz;GteA~SV8E%vkz|4>bslNS9NyP5N&@YFP^NiE&SeZ zUFPuw8s^ipqVIAzR&g`ZS#*V^`oYmsz#s%>bYm}RP+A=w)IZ8Y=gmf@$iSg>mjClo z=bCiU1Ykt|?T(1^L|6{n6Dt(3=0stur|AkVFp9=RZbcR~i)-RuD0~)}c%UYknblN< zbiwk|xiVNd2Z9*BD(Ln-W|!T;J1#L`9emCUy=lWx8o!nE#^8y0e0F(NT1G=( zHU>+4h{$Y>9zs9cci;RQEH6s=ihT{S5rDuG$gI(goum_KZtU|pmKzGnE6j8GcoU{_ zl#Moc1FAlUE-r0WEGB5+5-(_wJd0x!GG}{Bz8*t`GOc+q7R7*h^|d4Ycy=Q-r3CI} zERP7LLYwj=Zjoil(BiO@lKAf9W>pA8Jv7a)%zZr}?Wd@OY4?c62Pi_d8&a;nSL`@1 zXWpM~&~O6VS(CF?Sw>ocza&5v?@0%``qMTc{*-ihD0a$?I%x1aLanc!DiR-C8|v)N z=??jRUa4dMupQoW<}-U%7t$l}yighXqq1+qFV13~Qy$Jjvdi^hHvwi4Z4h2eFtK&1 z`pTVdb7mmzhx@9W-(>EwMYz50u3dvx0cv*&AL=y>O~gDZ#YEAWR3o12h_lHv@@G*| zj{>r;gEkr{o$oibZ?0(XBv~w4AvQN|US-5{|Gt=EI(X8CAc6B|U62_z-KQH($OwkPJr^}?hdkG-}fp3msWB$!2DGihiWxSL@A+BGs)kX5+q){f#Y6N`XHIHE>Nv62XfE%J{< zl?qhLM_Yd>p2Bk<&*5D0OTB?}#fA8YGCN-XQQYl?9KWSIn*E(`p7mtBfboycF|!gv(P0BJtmjuA_7qX0 zE>8Tzeiwb=!hrKzxBh!+x5K^RW8?hcgOl%*whh(V)&Z;p`*PQ?+^|P4Gtep8!oW8F zu`%hz2^-c4qa{KG4=r!YJD`r|eXl?VKLPx2()N-i;fUP)Cn9hgz!TYqV&-1}qx~CT zq3D=j{1oz(<>!~qCb>y?E>2wX6!=Zl*?sAAO(gy}2^r;gxK&EaU4wIVStpE_vf>M% zL2Vm1N!@{ue*sJjBK|LcKf#Ujm$kqX|FRZv-ubGz{!3{Mapz-S#1*&`k+#Wzi2n=V z$8b3R0vJ5;FKeCmy|5Ob_Wvi%EhC(pge#h3N=X#&(seI5SMN^`zw>5b1sZh4{v>UQ z>(af~qG$gC52-xC^ zXFdO-)JG>@Fm%Aj`E6ZricuNpWNqis<&RrL&+5X73=VUCc|D^e*2(w4ep_)G;HS76 zE#Xb3;9(0K=hA^fpU!rAWJBR||0}Qs&hCTEhmUi~ms@1xPW??~L{F1%lWz zOPAp9c`u>>07l*kCw^48!qH8f{1*z>&Gt8vhtb;pLHg)ytgde1tsM_$ z6Ckx?aj%Zyb|gO2XC;_Fu>bUcau%3CN9H8)z>F&t+2gAC6W3zJx1au&%&41IM*v*u{qrle2g`5K^tx%q_*Z@` z9iY}^`u!uXZdxkdl^^YUz;RtJ$NicnVXsWrl9P-HGj|TpX{iwi8&8wXV1h`+MYL2d zkU6{1{Lxl|t*2XHZb5QWF_0-jgEiysV(dR8Q}Z!g413a2Tq3}7Me^g8IAuKaNLpB~ zB`?xqG;9M(h4>V9%TfdJCk$$7L{jy^GyN{KyF2_31h4rAtZ0m#V0bpPeBe|{Y6Rl& zVHRA937};b7slZr@iC|wMbHpLLc6u$8vU6le4g6sG#Q-mw@&h+fFyk zNJQXf>AheypSBC{6)oZRNvFR>DD%g_(55Q}fx`_R!=~&=e3u$?OXww9II`ME^q{GB}yN@-AomS68?V7NbF6 zNFP)o?BC;AEt;8p~W|1)KBc(4IX1{6a(xN0Op@B7%iS{6ufs2wf;f7MR;s%iq? z|DOA0P=i_7Q3L0ltLy17PqXmDI>fEH8k>9>eZmTH)|ZX8YJ7?1BAPHOn=m&Zl=4nV z%z}y`VF#-A*jwAn6Si-^4(@EXR4(m!dvO_-K#Lo#-6ts>eYc(89qc*swP_o?PcB>R zj9i*At2y+lHR$D-#4hz8IsLR=d#d?0Y-0M|nVAcag>8G*u~0$wel=Q;o8sN+%Da== zWU`u4^0Zyb*#%P%e23G3?SsAH$PuHHqxsc?#?|W1q1ELg;9YRzymf^5*(F|u^yRHnq8Ixo?{xa(W{W#x$ zT)#d8G`@(K^);!4`NzS=d^+-9j4v#zek_bx@2OuA*_&IbvyyQ={;;*GGM4=M$y*h{Z(cXl|L=DSnF@nhFv zJC0*%uQbzQ#Furxoij%0LIn<7n*qh~R)WwpDJ zq1VteX_*#>yN9xsV>s9lT6}PD%uQK%DysaWEUo_sZOq_mdjH^TuXn%#El%vzP3%we zz^b_KJ7|@zd3|cdopmB!|Wv=}o}$K;ciP z5uqM(=)R>#+IQLsr%)WfHj+~bkF?qTAMM-gvN1<|nRx)R^-;`}ort^4)WlxYk2&h8 zFl-#k9lsw=9%lBZ?prFNZ?5~DoqTin0K_QQ;!FmLlL*aORqwYRi5aY&>K83dy&AP} zshQfFus-T@c+?hiWUwy>7F^4<8qVA~>-VjW=DX3^7c^JuT!leXES_{*a0;%k-wiukJM-|p z3mn<+9e8`yoRk2YqU^&f^SyOtz+`uxgGF(-=1J79Z;f6)2b`b#VIzl!&V5s?P@uhgZ2%2a@kaZB4(33Iu35<&q3=Qfr)3RHg*}d=mD#_ z&pu<;}=SRLa}g1uRl%bW}~Pq~{S3F_T~&*L}e3bj9{~ zA7otN=y13#$HxeSARSt!7R^|=AgYyxbr@IpIdMF?b4avgsk%kLia=?N)Ccj~5h9&? ziDVw~sOvtbVr$sq7I(}q!Wg8lyA#|lox0X1bEv}ykfj<%G4aqIl>8Uaq=4s5a}_Fa z$G?<0jusR1JI3B)AD?;&Hgz$C(C9g1;IW+%3M4c=p6SQ}rlXpD>KlTF&C@-@k`un3 zL07)+zfOF8M=LGdeNEf+fo55Tp0gt@Q%sl)dhugYdVKR1!{f5ZvYo~3Waqi;zoo#Iq_(zb_93RK? zW(nl`WbUa30EqF3w0;&UYFgVPP@KIfq@SnXX6;8e;ZN5-M(}@o{fxXq&8konNj&`B zIPzKRP!V-**lW!fpGBCuEu_CF_fT{2z0m&{N+6DuJ;2_q@Uj0GreHPkEpPut>hqkD zrOK%#?uB0w%k*@g{cpD!Uvtlo6ObZ8+KlD#U_{iw4t)STs0{z2geDx7r9W8pLM}H1BKcWJ^U3|kCAG^1)hsa6h&zVk5cz!E2qia+-IA6St!0Kw7Dr1Iel6p zsytrA#T%oERfp_)M4T(otcWjY_!uob8Q>@^=b{OzKB5Vipwf7%Tg)w1)RF%5bv9eG zQWqa^V<*q6>)5a%IBhmMZ8nK+=U#JHIdsA18jlT~8^BItPgcYJKYe68=xHV=F zmyL4^$8E;OY;4M(w$xd3NRljHG*`Qyn9sjA^W=UOTEatH|5LKh?Lro(IUcGW6}dlW z%ovDD!*1{Qqv7Sv(gpdvH^*ov^++?uORR`pw&2{}=hWih-15nMs|@W=J5uDc-^$ER zrGHegatMUxAvk|NaF)owCy}3E|L|JVv^{z1Q_<@fj1~s7*o4Z0gvw*Ds)(|w$-^oD zQeinYHpbYjv^GvQ{jBCTh%)*6(%km_XVIjt+)D!rVbtX}?tV*6;=YYzMA76cRC@Ak zf@5q|xnXs6iThb&N~h6VlXl&EMQTzkr4_0l`8f3ef|iq8huTEmwnwDZR(nA&#MyRQ znFQvz{54fc-O&ev(i=C_&TP1 zo^^D*cL$|asYG5I&-93gV%R#!PM~;fQ~n)?mdH;&t-#|DG8X~@78r*BTMidjFI#gL z@Dqh=y4o=_{J5tq4<e@3IcMM)ffOaUvAbD~_ZUim7cYPoiAaho5dZ-jsRxu($sqmcwe8me0qfb;J6Q7?nGhUaE*XgVCXBu7i3Ao(`SE67`U|l5 zC%X2HGzipD8Qj+X_$29uKewm=8g(xT|H8*5-BLFz|1M4clns&+)R9MwWuaWR@wlQZ zk`6~Q^y>tod2w=PNoqS{4C98?(D^4)WaBQ_u#Bu!R4^C-D=Hhbm= zJDt4WPg&K0vC6~4B~n00gAO;dGaOT~HZ5wq@K}-lv$E2jbus-}K_g5-7JnKGTe@~- zoV1(gMVJ4Pr67~{^-S*`9Ul{t5vwwta+elaL~+1=C;#S9JIfdMFY_4=IhFC_mE9|V*PdB;nF-@4;eCdp z_ST5OaMJfya;K66L!^#8AEw39OyysMv;airbawV0m3?1$cU-9O)D+EUp6L>O@3o0f zesAVFF4ULAGXImHa(p zq1{Jv;?;m^#Zz%sfbTG$Hag5dEC1EZ^W$ktlkS`71vX{;=4R}lg*08)K73Iz_!S!8 zILdmjd+&tF0Pmwe#%hUjWu4RBJ%Sd08Ky~L#Q2B*3rV5T+#GBqOm_*dyR<~`>6?|O&V-=_*ED_sdjJ%B(4$Z*b zet4f%IlB}Uo@Z$y2IHx_vtneOyg7r|EKC&h9( z#`CT5v>Xge;t7C>4am1I(aDFkB?Ubbq{{D#WavzS^&0R(7Jnuc{Q$LDBvY4~mmrm)fn)ZCxVr37^jz!a}3KHLv}Rez{h6 z3Ke~0=$YL7PHWy^2bPd+*a+=z%r~Iw+Zh*Z#dPOv=}-wcUVuM)_~OBPAC-0&!H*b# z(ue{R+0xL?6hGBUAG59>fk&}d@$w5EGN!b1JVCMCaC(Z6c(cN8 z7^Nxo15vdMV2ae*=hlK_glop=dY?7W-G1)&txRgW=sDDHol#cEwd1ibGdr>3h-j!n z#jjISA>L=rLUzBA^dRV3z#TQLz6!hkUMdO4B)%uONK!O%fvax%jH;#kNGB-RG-J|e zxaidPo8F4W5x>Twi4CPfim=_em%Cvh%pKv@Q*gRwdW<9bcYuUx_|9JgzXDn*?AMKW z{y!Kt@Z;jtA)t(i1^)QwTd%N(ft+aI8SrbWu;@TS#4=cJAQdHe>K`8%g-6?qe*uU; zU~_>q=WVWhYxKM>{L?0|7^-~p>_t@p1{Mbj3JMWQ-h5G~|I=VmD&*S;(4Qx;i<#v6?tL zvv@n$DGj3rD8z!LTG_~EhMgi5WR$q6y|%8!$NR4``ZuWTV5u!m49LJq*|Ndz3$6k=i!M;ijN*|y@ zetTk*2@TU}k_p{)!uFQ2{tct&5*hZF!TBdlzmz`7T-#J0W_~8LkEwHKLeIDB+uO0; zSIcs;@$bjsOw_(J88s-u$Osc9S^h0O+W<~2 zfTvSrrIb^LoEfjTVxB1B0Czgk!~H7 zX^L$_sFI&jDUuO+%D*x0g8yJp2Pnspa3GWarlB)^6LFHV)-v`x|B=sz@rrJ_pYFX7 z(Z%49YX1)mVOs1ZHm49RP8grNt--_X{qn>hk${Vx%k#QF9lX1aU#!#8{hnrdUmky# zp5Hi$^akG7kg_)3YWMkHffGeGN{kqqd;PA#cTJfaK~D>lD%`(mWS*G1WyG1{1a24G z$HaBMSiV`^-%mY&i=xA#gDQbvOb&U|%_*fBX=efoyWulOCi(5_U*Rl-=*<)j?=66c z`-{b_d9dA+uPwEsaV)wxInb5V%Eb$le`eyOhOZr4g?uMkxfK6n_?|GFQ!!>jJy(jA zeO!a|F*HStp;z=|_D2aDL2_vn%o;i064onmURlJzY%t=dD%_RhbzZ$V@Lbz@a!i;* zNQE+WSqwp4u}+cd*t>A9*i|u(sbs+{S7Y|}q+f@aW#b2L>oNGVg@geI>k)5@y&hQd zBN$Q?IOZw5FwAt#bK`rU!m*jHu;6r$mDnRNq=tl3^{^DzDCEcRgkd!zcn`SV9xE?kP2xyVZ29Dz#etFzztWd0mHN$* zF;=GiHlGE{9YQl~nd2$<`+3vXAmjwE+EzhzZ(>>{GP^yeFLK`g7sh5D#(NNVH*dIq-x zj?BY5<&-htUL){MM2p+U@2)YUquPSSE;~_cta=om@gaj2gtgauL4YNXzLT~^l8h(( z=KA>yN~jGju3oQ64(wE(O8GBo;!=lD&O5l|Z(_kTY)b6;CRBSsnf@#`=+e~eDgox6 zE$2*B%i_VUtx_69@(#kt89R2g@SMDOEnrofm%^2e6ICPZs^;O6oH>n#TpBkOaJMO$ zZW({DsMbV{u{SzA{T!KC8D4%pvg>CYW*AY}CHeWRV&LW)%8h#gJIErFYphBDf6pdd zl4eyCE1T`@uirXky&sJij(oKw0_eWVO&ZkRE&^ABQSVv$_ z(WWSdAJExm_2v=X8*+?=p)5&LW__EHX}XG(G<8(P60f#e6D`JVGp)1@>f8Zems|1K zt&Mnp80Z}*(Dm3{QjESn^!t>G78`OY#`b~do@>tw^WA6-9ySbGRFZ-n8sa4E&1j6> zp=~d2`d9`CPs$zZ%UyJe(jKSxveC>)^?QrXUIqoL{^trm%<|Kf@c9(WpU~g1duo5m^4O$O{zu`#-G6&a*dT3L+aFJlsV1~W^FvQN zYsLlZDe9XHA02v+qg~%B^@_~gwNJB-AY_la8HQ#?qn0%XKgXK&0CPea`bC=zq4JqZ zTn4F0#t*mxg~nC*K;_Cgci@EH4;$f}6+*4vTf;2g-Ik~Sul7^neIW{Pgo5h8g@Jna zUkUSaaua3?2IJj*OwLColbhht5Z?C%Q!%lfOrl#g38(j!cV1HYrw)J5hjW}oeW_kS+nxMx~BLUQ_VYL#-j$KJY62G1wH5O_TeU~pVIV+ z)bI`(uM3`fu8`H%#_XsGM{hmYGxEyoTHd8DRtD{%YY*~dQZl3a>KQN1R(f4gY31_1 z{Mo-~qWesx%ODa%dzZ=k`I0sxrSZwJXIYjS@1dMFImm~0VQIgwyJ4M+?6KL`do`WR z;A!%6+m={hN|$jf80u=Ws&nV%&aKloCD%0Ffu_UYd3QqpA#yl-d6#|H>$xH2b8K-R z?V#E99gA_Pn}?@|&n$0hew4^ai=rn7v&xN3hERa~fL=I}V&e0in(?2`d)1Ay4`YF| zQoSl3>|kOG3Vxiz=RZt!yLtf+HN~|D#sKG^xe~wchqwE3$zQbAbv?2h=yp6>pZ6Ko zgn+5N*(I*@*GFrcP4!R5<;Q;%=WoUy)|pjO&5w#6Uq<%9M;Z5ljjWza8UfwC3tg=D z{2*hMDy1vqb3eD)#DtcUvy-na29uug;fo#=o_$G4L1*_GKls%m3^O<9EIvGO5I^?} zmY4Ti$NciZ>^2VTlz@qKKB8R3mxA4RnCEi$cOx(|j96g(eiQfO{;EOPCD5@ekZnf` z-h<*>tayY-LOsiS|8v>+NWIxTUhWgJaRd>>swb1)TMNC}Gnj>4Beq|wuHUw9}2f>jsv&*rO>s}E9^@kz#v!9Ydhc)+FYHNV2bK7FZD3vaQ5k|nlY0&y} z!{qMHy&6qljrQQ_q_%*EG_xVK2htfowLQ>orr(44Hej<1?^CaHY*-(~W&%d-+*KRz zHyhSD`aYY!s67&_S`r))tYj}#iKCx||M2@q zs?>nq<$&x*s?Q$z{ujww)ED?(u>OHC!hJQuZN{s#38&a}*4Gz*ex3-dqO?73#cpf~ z{J!(Jx*L;uEBulhONl_6)$`bm-LW8j8Z!KCe}OcL*gp_qG&^K+AGF`PfGFHU8?B0f~_a*KboOUk4*6;&ZHa1k^%(WpP?{UK~TjS>7tgJZ5CrE;r zrw*-Y+GLke4+|lXjo3Rsx$Zo%?9U-7p37>#`zqK*f%F{#T3*iy>D;-ms&>fw4Xqxd zn8zEGdoz08%5hpSGkb@T)kB(VTVWDi<_H5Ljj<+~ZK|-OD44Z1u`7mI*NzG(Qx6^{hiG#3qspH2w(K)1E z-nd2vz%{bwJaxs4HRgQU7xc^O26%uo*BB^B@F{-~h)X7*{NP7}<3M3O`OtxRuGgq; zZWCZfUl%@XM{z-jwYOe6}AO93!6?>_6dJj{8m9wz3# zlpW6r%{F{iWcN=xjB!unCb6S`H(ssvlMS#<)H?2(ae%ONE5FA3Eydmt-TVcx*0;rK z+BeqfbKO1j{n(x!P%MzS;U9=2P?mF=OR^HMH2Mi?SN7`rsD)m772y*2$TYQ)7IYDS zWj9*37Rz^S;|60y*rI0SiA@BzMwmFJs#ExJ1`TTnrl5W*S_tnU1eeN`p(jj3>mG_NV$!_Q0tJL?4l*{CrPAKn zWyCh$xA!DjxKS)G0a`lvG^;*UzwbJCS9FNN0j1#ae?7Lr8LQTM#>Ta{nIl2an+lQ5 z=0)zrSlKceW&SB?Ef7bWFeYB0H=eU>lIJVV#N60;oU!6Uu8yY~O;>s(>X!s_68m9F zb+n4an(oZufdyZM@ycw3<{s`v^G?o(UBI!DL17+HW?Q8^1E^(;uqt$@d}jXK+QBri zvr>RJ7X27d8keuJEylZsC{VyPkie+t*G#X*)}(hA^CZzCEZk`qwwZ*Z4_POp zWDeZx97~otMZ<2D{E7EgDGO3w$3Phy{=hZMBVYmuaGYJ>@x=;N`$E~nN^Y!(kFv=^ zjp?rs8O+87m9~eipRIE9Z6_-DJ!!St>`Pl5i9QvRZ)dj0l^OE^9 z)5hZ@?b=tsIw%1z*Y$w5DpI3`o2;^MDgAyzXlFtp_>wxZm&<^wR$)4+V=0R+OSi^f z$}CW;<>0#RzNLF+^QBkOtd zQ^WD^KqH5lV@?MPw3_k4^kfbv9CvLdzeAPpQzjad4ez{QBE!}1nG|~l6i6l;%1Lb? zc5(l$KyQh}+~S5(iw6=|MxxQ&*ifXzIG?9y@crHts!$$Nsimn?r`2KmoO9r@`eiYD z7Y-a}RXR#%v%p+Ql{~=wr|aF99Kt(!JSJW09dkL}jD%T(1Fn*BA~@x&f!?U_oj8>gB}X=)RKKDLFnn1r3e8w zQFsYx6i{F775-*Fi}l!jujRuhz)d&lA+t>EsFi5qyzf*h=_M5e;7=@eVBg-{_LT4t zB2LnFAU^mZk2&D*Hp5E5Mf65o=s>RIzkQkdOs;Z|e_jIFmwq#<>ozLS3%ptf2iap9 z*qMvvxz!D}5^&&8)K_C&hw#hnz)dV?IB=pT1G1$S;|rNH5Ir9(QBG;GPFH`8Q@E>O zH*#q}x2^F*LrGKMBfa*O74Z*WhBSAG*=wHjdtl6)8HOFPr(f8X6OMLi2@RNMrceFU zQ{;KjAx+$Nl&ZDAo>VDmBkwTdr>};UX%b+|$o6pY-8X&!Tl3j$X42C!U}FGA0OH%&3Iz`3Hc8S2VTUh2A2N& zEC>`QZ+B4}*48{Em(jKa%2LHw;^DnNGI1VlA)=dfMVc#gB8dy)m3V*QXnRYn0t3Y+ zBs1bY%8VB?WvRT?F08^VBqi60^hr=vSCqOaEg|<P&KTT@`2(sJ8}aP00i z$Jo)T!9d18`v3}8l5klpU2|+Tw0WN7G>L|sU-~2E4m@fT8!esC={cD-+k*OIq*LSt zgL~)}y<2`@z(fTjc8Q;T$?DQA+#`ut)$jiE;|$gW^m z@;qMjEGw|nV8tZDlKyY$rwZm6Cg#RrY#ixD(7m*PgkbBtmddEl`dK_@cs%rLpZBW} zEOgd*nR7;cW-moSU1ESub-qCAU;zqo^B9zCAr-}koMR*c%7?ADYIjZ}$Q}rO*acuz z8RbNGvx6+ueo588)L!IHKofo9Yzb#G-fmS%xY8)J$KpfmX8fU0B7P|7AY+A{C@lJ4 zov{!7Nclj?mRy-eVaa(e`!M0SQIovld)i0pDRMviBGEaldVJ!WGT0{%5Hn9LkI`GK zE*L#8kytaFpYBow6{oh`8#m5FrPd~Rcytxq&LVl7>d$tlg)WmS;d)FiHXJT#VuqY0 zI5WV;F0PhH=rp2AW$O|-OYV^>WF92qw;d(OiPAubi-EaH0 z`KrIv-|euEfyg#80N}bJjp9*YvSNOvB}zK*=WRVcoZP#mBsLC1%34dA_tI=x*#SJJ zlDA%M+7p}UI%M5l%Tz!s2^RGLCy9dL2*H2Y(z=$n5-kJub`6LY6U^|IL&k`W+iNYt z&pF5!qL-6sKmE5|dIX|q8(I6Yv*okvOnv*$m)%Ri&~+*k9jb2h8|faKor3%4isL+) zm6|8*%ug zgpZH_{EVaF^y7!?9I#^Zo(31ka6;T@IHDWlZ~EaQXE^?H75ErPNE25cZHwV2H(J)q zoMB?`qLB25jb|tPOJlISB)wr3+E(~+>~HZh_1dQLC;0iAh)_Uoi{mFSUIl5qJTT~R z=%7ib>MO&6r+)Ue7@x~Unb2Ab^?6dM>bAB@{i4_BgICdWv8>J3X}N)H()kA$+=RO(N=AT%)-0$FJ!|H zjcgl*?0V%2FJwP!xXl$Z`ko|mr9UC>yn;y_=s#7ee%upNn zBT4(n(D0;ncP?Zm-asOX?6SX&BMuy&tQot_0bsV%0?d7%yZF6jlKL5Rg#+HcI1%#< zl4(@Dw$2!dU`h?(84J^{8=WX#q~Z_~B7I9hL&Tw|n!N%aLGS+Nw3O03Fy%wsk(5)& z(V(Kx%2$0?6Q8`iq85tpu<8HWl=}dT?~vVY!jbOU6SQ2beKpgplx<>jrT8>jt3*A~ zR3t!_N{nA46KJ7co22F$phK+=dq*y)TVRNh>u_=#RtWeOi^tf^N!zz zs|wZ(k`Gqt_p-hBWu0crDUn*7nA<(5$y62N4lpS=^Z^MZ(Wf_PhhnxJw^6T5*-`h{})f<*M7RwXasK6mf>fc({Px z32C86IC#9t1&Awu*$_x#g!sVjEQR{>>!l*YcB>QTx2GhyhTZ#+`YTBW3v~onsn=-9 zA-G8WlxnBcps(YpqzC36&+g1BS8PZYkc#z|AW(3a^P^mkTAL%nbGpG(N|dtt8bvQG zeFqf-XF35ovp2JxDkHTYD{Y0@8djorcw1RDS5l~rO-s*6-RM0n0@{u21R0aHOR~v% zVbgtzztUJK5wi)kR3cc|gLZbnFUKFQkH3OAbN@5=m;O067`!_MVMLJh&##PZh1ss% z3;o=BXJqy6Zo#NOd7&7Yb?HY{%==p{72xqg4$IWUR0gjR${W5~U|l&A^MvR=`{B^C z%bu+4FaavkHyz8L+A2csX~64hT-G(K?Ys`q&)d_~eBOyUznY(ldm?Ny45k6h+* zIXVTICB8+e?kqb|uQ|VuwiQJTGk=j<9jP)}F4{S-+W$~NS5CTin7G?5VtAI%5~gff zq+iWF|EKQB_I-kWEnyog=GpS%S+OIAMPp$ZfRX!)F`D$j$Xifz!0^pV^%zw}P{llZ z_VYl4^_<&dgZ+GXQX-@Qv#VM-CvqOpVlr!4(u6a52K`LwO0a-}pJ3--y47Lm!RYG1< zbg@Df@r5+nPW%@RueaUFsb&4Cj>GCAYM_RC>R7We(?IZ@5nVC@*1b-`WqOeau=r%-!7Sq6EBz6jgo4ELfJkf@`X8AmF~YE zbO(*F=p~GAGMODfxqAt~+imiMYzu)|a?I1Yi_D!|C|9M|1}gU>#=_1!?`&wNHxfu* z70C*{n2MX-ettFRKbZIVC*)Bv@w)t5d~`gt+G}YEJ>C(|#)m?E*4JqE4z}ZRfYeex zt6Av)-s^q8MTvrwHn_2Z7MWeEnHUT{S8`X_^bRx81Sa03ggI0wX`GJ2w?*I&Zr|3 zWEzAEWz}o}_;tBOel_cNO`6WeS8Y$hgFGr(7CwQ$Xs*@UFSB@d@?SH10evf<7$%7G z>s17n(f&R3BDQk?1s6PbiD#`$ot;s`sL1r?_e}nYwgcW-i-vS=z7{5j)emiMI%~9a zmqc_MXJHI7Jy8W$F3O;9yc4u9E9Z=}1TNU7TtT~{&!c>~eVxN&urwL2A{LE zVbT_{C)V=uK%;dMTd4FYE!iQ=R7CfTOj4PqnJxS`F0l|taXKgAi!1r_ZeIR0m@*=w zqlS3cTg>A0-MhLE$pyLKlA(+ybHTT7@FG^t#K1oN=-qRtZJ^Vm)H?+d(M`MC zU1UC_7AjG9k4}~Ka~WpW4ty`Wh+IDf>aks(&*nFR-6n*cIziVzz`P*Ep7lfHxtgE; zf_LJ!A}0$M{41HUX_C3}9vndrDqz&Fn8F@*orF3!7t>7mZ!L!=Ej#YDPM&fdVj>Br z&5z=i^X>w8Bg~3jhke8>exl}O{!US?gEcQaDvMLOLi0dE*TsT2!dj`cm_35w+v$Eq ztQc*pyFJ8%@S~;#Qs3&Mq~47CmhXTf$usWIP^Z;dmL1dMpv-q;wk!fN#GrT{?QhpM zfsI(l5mV=Q1HE4$$N2+hlO@4x%}^f0PX5pB=9EfQC{I(-Pamc=W+7+6Yq%sWwg1B{#wBT-w5683eb>V&U&Kb%+I<@C_wI|!QKLAR@6My7ATs>H5i^>K3e|8Wl z|FD1W!y=rs4>=OuE(tE&8HIk)!sglJMznQ#XkH*32tA}X9TGZZsJlZ#31gmJY`lES zeh7K`ih&UktnGP|7_$b_upNx6fQ<~uOfY|F2g!`P7w7n%BqYsVr{@^q2)JdaH^tmEa`>HP5T)gE$WTaQ*|n=v3ZTD8TwY|?UKPlJ(iw$C|5^elyXWo&BLs^V9h-64f8Blx^w1U@mLzC z#dVb9Ub*jOMR><3uLL)-L7mkZX<^^p;a)MRthjdIcT7YG;^aE#2@#DDHV<^6J1PpE;;ho-)1g++Y>9_2&hi@}`(FL{C4oH0T zud-oA=m+{h9$N0|u-R5YL)g{W79|wrQq=N2BSMv+X{8gH^WDLiHC`ZFPwA$_b%a6H zR|-yxPSpA#;&??!eSO>-p5xK4OJQZoRH$^*R1*oiA*NJ^yi~K@U?@RQn2IXy4EPtp zaI@r=Gb#Zi*tPq7a`@ts$gfAXO>)VY&+)Q<7mb1{l@>88kmxkC>77%Bh!>hbM+=5*jEwIYCK$IAH*XWWc3|}}0q~wP|6)MSyP}*{&QF~D^(5P}Pfi~785Q<#ScDLE%*7p-_p0`{T}Tcl zfIr$m-}$?g+cd(pDMoaA>2GFa-Sa}L{p~mUe;H??kGfw?^%eV&zZ;ADJOPtFX-1pP zf6;bL7O$(~hubLpHyB4|%t9+yngE8J6@1p z>tq(*J>_uj%Ks;pLb=nX!Qozk$|n0ZB%)92+hl_DxluC4l;c1D3Ur>{L&sfoT)#1C7PO0<_saJn=PE5 zzlRQcQ0R&N!eoIh(90-3X2mg$Qtw@FF7BIGTKSp9VPa{(+!PmIo#(ZMd4gBtIbBMN zuM9h~*WiJh7FI6X4x*2gq-pCrBIw^Lx9^*c8y6``1VP1+a>?^TR5GnC6k>wTTkH()GYAjnx2? zuIf=n`S~!65*G?tnDh=iD4TYComxiIjIfM#7&SnoDIqe=EcvFOE`NiP`Zf!!%`3Ar zqP?+MZ4x8YKzgaLD-G&>lI5RvZ|8SZPvIiWU#htj4lDkh-69IB#2c1?fci}gJptYj z5)?1;1Jl|W;n<1u4aEWQleCt3l2^!Rx7tUk40y_h@J59^#36@ox>?AvrROtpvuw>i zqFy`XXK(()q|*xHY^z|RD@&fO9&+mO23=J@BeTuI62Vv8&f7k_CeEJtp8A z=QHtkI0m-`sJ2_JB)v-4+ycapt5*gf&omad&`Rew`YQ9&hP;SvuUjgE2)3==>N|58 z*1BVxZ=86W291|#xuV!EUoWZZ_?k$c=LFn2u9^F=dGR?eWWNXz8Q(FP(V!)kt|{(< z=QMLrDsleiM*56mCc6;z7u&kh$xlfF_J@2Lrz@=mnB+CE5QG0jZu!s(oEv+FLCtiL2F6p7jpq|VakHWdFcS?o|i7*LTUuw@EBvI!LcHDDH%zwUr;Ao+bb8pdWg0 z_30178qK)tT7y6iVFg%FjW+Dw=lKvkTYlFNIf{$S*fR`W1HZRg>DhehU(4dxm3haK z3#;Kex*9qVbM6|9*)u(W3?YJirD|1arkE?aqOnj>WX-(-XjvPY)vN+MRgjT2J79NE z@!}(aLgJAw^r$Z>torK$k5J#JcQ=LLXdop&pU24ErQm4Ff44Jxd!^pncSuRYtD6xN zp6ijF>QH_Lw3BvKn3L}w7Exnkm46>t<+k!qBS zG}Gh*YB*^p?bDk>%vVfVLk}>|?0p9``=R>Y$$z*QG2zj}(QTZ$O3FIs-3qol)B)Hf zHp5DaD`JWT=oHqhBys-61Ts#U5)70QYsdGQdNGMEJSjoS}@6IN2F(-$G}U+~1WUR?~8jHE|CXqc8n_!nPy;$s){ z3b4$V=Rm9~R7R9S%d9Rdkph!z@?+@q4y#}xtiyXjC9E>qu}k=IU}p;O8msk}AZ|th z6ZF?8D2IMTKeJ!_4vB&Qfjk|4@jMMZ<`A$=gBz4XydtBZmS~Ts=pj)j{N-3U z8bN47i`kSpCE$YYKp2}!L~$B2_n;B^8yWkH(B?H^~8(E$K{*)HTq3S@)20 zi;{-6JCErSm!?0+3&mZuu3lId2r2er*yeJn27SvzY$Njhk@4OH!-?zd8?$U5tMB9` z%ws>24rxUfKC!q{Q%U_j7swJXXv`|Abg~x=(W7LZr==^nT*?zCDl^SPgj9Lin7`wf zT1JFq%Jrp^sLHVC6oMWBzC$GmzNYWqCVZ`8_Vd0UrFw;q*H&Lh4G+Z_25|7)7pxgz zhdBQHEE8WgT667_lgchJH8e=q|LjE}(-;X)fKf3n1OqdpsLUzkRhE-BV^%2Sq1#a* zT~~=oMfdP6^ey6ld(W;+>}`})FwuJXJ+(@4-LeKo9xTGgg$0ZN~19m zETK{MO5z6ks^-R))Jjti*Hi;M@Y~Kqoi~Grv$n-m63LmCdfeKoJvf)+IsDR3>z9K1 zeEoH8eltj#^RDFx*AK)OdR(*=hfL_7-Vd#W`hOrK4rv(g=KPvGA97CbeL;Il!dsMIv2 zaQp+!+@CX)(h9}%=)=;7gAE}Jk7OCL@<2Oymip4&Cb4}$Sn>KGs z95X7MiIFSRAQuFrZ%pG?jUxh^WOCn%Qw}jo&=8?Uf7P*ECrCo%(LJ|F6$Ix#L@Mh3 zp=azpSdndG-VBr`rIP)^aq|{7`d0xrYFd@xreEBH;M|yvINrngOjA2|zMlIE78ccO zSs#JNq$+^+{NTWWO>e@Hy?JYlyaXfBiO26u-J63`C0tTU$ekFwfd&YK)V6d8!eOW+94mw!?B|n z=Y>w-!)5g^6`g4ohe7=$0l6TVyX5q-r?N%$D?+ctDuV#29f5kyZX(?uD@h6=kPYHY z-;d>TK+RzpUFu)6+{qIQIx$zyJt`|l*d-X?;mc#aA+DCd@o#*@9` z{us|>+g-xZai4wMNTpA<53OFnNZZ%Mzh-}9p(?=yXu1xFjvXPf5hvrI8LEP%xs>6g zfs}_Jc(YGR@2b3Jo$Q&(Brn3FpH9_+jN)C@0*~Nbj(N%Y>EbUqpu3%d)re1>jnB@Q zHF!+~)9_G2sjcJ$Q4MoZR^*0jOVLgKw=z10e#F@j)yr$mMVe(>nsD~#50ru%w zZ8PprOivZ|$@wB;(F{!`M@nP=bAZQ09KEmEL%XFf^SPau@K5~eL9gGe7?Tz{5j>Nn zSgcqe9ApX-(!Ib1xXM0Z^UAr6D;FExDm|(vm#d~%dF0y6Yks$*{YoCOs9W0pFdZ(- zrZmUJB(ie+OXphP-HsyKuXRcmz|XEO2MigNwnsyir=+C8b(XW?*Z$zMa(EBCBSYOE z9`Lr{@J+B;{s0}WgSg@uxKc~Uj|y6GjuJEeI@Qa)1; z=iq}5X*6oJYBM31K2FVde-UY*tDR-&uw8k94jeY{m5ws)S3M<;Au^r~q^WcI9Ec6u zOQzQVG-d9|#6s6R#isQ=JcN@b z%beU%AN;wdfPpOFYlADWac0dGvzDR!2+u>g&eew|i>8cg=R^Q>_)o+_dDWKy93ttp zl^fv_Pk-4HQHxWeihNaHSNiX1%qL&QvEDVY8L{XdD~DE=>J4wE5Vv1Zw7hocdTtmk z+eGiuX6Lz}naryBn9LM9G(6X4aXOzon?oe-Vg;ydeEc}?im*|@Mj#j8(yPtk?aO?E z;a^)42|v7vl0szM1pnqE&kxS=ucRyZjZ3F`=xBg!L&?$0g=}C1C?CY^1UPY2*IIkd zXF}b0fIqYzhPz8bfr$US&SI`P5k^Ts&(^-ncWoK$*!~2KT+Sz@yLUfRQWx9NJIG(l z+jM9<`9^SEo@aA(0KvAkMs~P=1%qzSvZ|kITY}e#`uD)}s+AwW!t%hpRH{1XLc{755+IXs!sptgN7=AQ7?{sW5o?{sk^z!KW7sUQDhx zq=WBCo()>S%m^uhqmD?HS3AHu-?*!C`H0keso^K%W2;ftRdwg0Px^T;9YQfL2mN$x zCvWX)j)*zn(`E{gJRZ4$dfQM`nk1h2pRbEE_51}*@EKYjo<2XW=Gk}O(`5y+T(~Xq zFYvzbj$DH?#xw~!eG%^q0S|!sHE{I!{(MhTLMa6yMEZ0REiO?m$x>$KQ6l-)u9|O$ zSz+m)q7%)mPK)@)wR1Sq8t1jr9g10}1)&jI@O!6~Dp{noJlcV8I9im8ZrT-7S;{k!Xs*b9V zW>@Sv!xq`jJIX`XD8L;?l`T%u7SBgOp+oEdawb!Ax8~JPiO+)}I6#DyWuv?@tzXkD zkvh2ld31Ckrjs6orp0~x(ISPv6e_!KQB&Dnl#}0Vq4BnG`QCwbd-No{+LI`A;+BuU zUg=082Wv~KOxA>2h_DT!13vz7ySQXLyr-zig+2mg3$(0?BnB9rkm}lNtj*mBOV;{F z89-!OqNFMscJx^vi8SZ{P>p8_J!4bMQOVXS^=#QaM#t-*9Q6ZY$Hk;rEj*b$$Ctu9 zI}ShZlp3kLUDiJlk5fx%K=-ZQMQ!F?(4G%KjWE)pwDC=TYWh#A#_aC9I;ZNX`}1pn zMRPRv%yFHQtcJwpUx{R{c$yK?8;ghxPGV@Z6~T1pd14V*pS=3zQz$S#3G()7nX6j{+*LHPPN(o9 zTxyWWI61BN3?($k%vgT2UVi)6g|Z12JA1?o?o82lM4v3;-}nuBT)Z#iY-c+i;K5e@ z*g%e_kpE4J)|nz6^&7`4fh>l8ZTv-CZ~yxnjTzCXPfKJFL+-FlvDSc>zMIw&;kx7m ze4Wyh5vl&UxlNhf!ORTMwU!yi)^a#1yB3Sko9jKiSvH)N)3Apwj09RI# z<5_seMn?90PU$*4#jL2=;B-Hx17#Gi+@gED3vq<=YRQOQw#^-j3#Ble_M7~ zLvMx)wyNXBEUK!p(@@(zaG=NyA#XVJMDUnwG~yKT(b|_Yxk5Cd(}1nl{y-Q3;fGIS z-&IF-ed(vpjQM?jjj1F=RVYiV&DbV6B9pH{#>F4MFyFF9cfJ)*GR0UpbvVAabx*QMaQ~q6frjBait0RXZ*thJ6pW|5dgu^heH& z>ahc7om|bX!jVDopd?qczn#2I)xtpx%lwzp{T>66D&&>|%ZbmUT#l(A%k0WNf%iS& z8{H>C^v{kQihv44IZD3Z`qaZ27fvs(6Ug`xF0(w}7d~iQ_^feezM4=h+ z=ihXlQbxV~dO1fwn_A9fw49Q@qBAf1@=dslx)9Sls7$(QQi zQ2`NKaZCC&(|lQ*EcFr5JPxDCgG@~2%S25A1adU~!Q&=he1b?&3dJG+HwmRHLvXSR zeru8_3rY0*^p6@cUY6lDkpK7mzdL#)-^Jq8z0r!z`LhZ>SKA4UMwPuubd!9#d2HWX zJuQU@_=$V@&?_%x26*C{!#HrRx*rH}AwShWRxA$U&+|l9zmc5&v~xot87dwHFJ?hX zIQ1n0>!UA?x|5V;6I(J1BX4~LuU~l{t~l5K-uRj)=b{rtK;Dt{x7as4MC^ zT;v(^0*lBjVQEb+?W};e&&J5Io-3bh)DNI3#A;e7dJt?#HS(tXifu^WjWKl#PRx!_ zltyZx09u#_1A7FFrlt8Y8wDreFqFfXREkAu=VzZ3RrJCBcM5oAmB5S3dAuvq-zC@- zW3Rm)zYE3~cER_HEVRHLY*aWPf9>Ov=34KI*6!GbA3ZfNP3@lS4``1!yLV%Xn^@9O zkzF)1UfS^^Q`2uoa^6Vu)zTle^Scgu4q5Axw-k{hXk88Nits)VWtIpor@G+U%9k+3 zg*VIg<4=}-ihN%$?-}!?w%0qCN<4Hgkf=MF@n`Yq1{LGaI7Fma{Sa7g)&HL6Vay$s zqTtefso}>0xlg|qb%o#4BG-Y}yo3Yz3~w59*N`$**ola5|5h6Qbx(=$|->yvHQnTxmK=gNoEj9 zXA+DYv{hub-`jWLxv#;GSHx9K@?e`;RtDZ;;0Vi0 zE!GJCIz|GKH_`}3Re3MHnMs$4hY74XcS8#k0#k_0=q}zsuQS&+%KwC=KLdPK})J_R1IhCezTv=-fdJ62a^s07WXM)mTe zcb@DZ+9+R8DnR_6NS$}01@k##PO12-u8h-2J~_^~u`9?_=`naPFsZ(hR#0X!;}=DA zlP5&)f*AkPyUxVsl)TYA%pe?_og$*lQbOw3$xx0xEQGFPQFQ(LkW;CaX2JKm(9l>n zFw~u9z*R9>%qn5%AEFmJ%06wLyK6v)N)h>;)=M)L(-r$3d9J!Ym$3J#7?Vg81%Gk< z>Lz%I1n6?5Ij%Hcy*2|iHB0R2YuWSFk|@aSVWa#t`gb$O*A=4xyC8Hw3ypMFP9l3@ zV$=6(i1j=qLuiNk3pP|ZMjd-TmU3TY@f{(grgRG$OSCIlv9qeRYrPMEL(0X#;`s|_ zza==bfe4m9bxcxY3+P6NMQc*&FsQKcnZKaqh+lT`RU+vnlw1tk$KWXomAM;LrBSnZ zV!Qj@)+Q6b_l#U=sg>kT6lSOx@)hX7bp(+U!j1Di4!_$29M{UJxxZZthjl9;`rucL zOTe5__GJCw@X!IXkPI1~a+>hv-PvsUY6xKTN-5Vz{uTHCmGmc`C@-YRO+!V5#EV?M z*-3@Ir;-QK4)ChYb_)t)#Q3FH#vl$t?W**5CbleHZ=bC2idBX$aJ*Did0xYz7_LYZ zJ8vMN3^vG^iP0ES0#LW*aTIi>RQjqoS+kN%Hl_?*jl9*T2s8NaOiqHXH!GH=aMv=; z!bK`H6j3I=NmwbiC%6vRJ}Xl_1JY1FfpfP9Y@><-%zS=*sM~V3jKBQsX$LTCg=t8$ z@hc?lYVG-&**ZAWo&M`<+^>dp_q5Vgq^lCsiiNWkCPXvZE7Jv)jGgg-x?g7drZyp^ zQE9$=B(O7S#sc5FBZ_}yFO2VZUmkXOl*Iu#WwG^%W-`L^;@IEVk4%@mMYEcheKAoW zJ#&y&qE9K8njg~W^h5G9+bPGI&yp}VPx@_t~8>y+B^pKSA zQ3&KQ-FOUvfi!L3=~2Fmo?RRvG=ME*DiLhuhSxv-x8hdffsMZ_&WM2gZ&tETI!{qy z7Jr>x$3j51Sx?ip94DV{t>VvgqmwLGoiP`|2k$S(%ULuV8E7h6cV6;iwI%CN$JS@m z`KH|j+_oZ*v&J?8M7304*aFLu-n-9;h6;$9bI(#}64Y2?6g#@5__poM3lN z0E5CfJ(=Pi4~278Tm`%QE2EFV^~%bdoT(L5D-|$xr_V?9T?5N(wO>&dUpCN^5NzwB zeFa1*E7Hlc_Vx1wY6nYjfhKnVfq?oyDH?nWBv?oL6vLrMvi?mqOPJETGBZs`_~E&&07dk*@F z@_yfU|M%*T&2QLi&6;`US+i!ZefHTXlqKdZ)4L7C18v?9yDTO*;{$1G0&S_6CwGS( zHz~sVuGV3i51#nYvz}QUBX~&848*-}qLsQ)+T?`#5+0)N`}F(B0}OE3^^tXKX|f%p zVSC<-&MVB+qw!d-<`yBAXQ>It$JN^RQ|PliEvqePBYtk3Y(ufB2+=qbg`jfDs^rj(E(M*{NnB``&~0Gi~w-q`AuR0zuZ zT|b0uq9_lEcg5d6tp2EM;~$~$G-LaHwCPHIU^Sq{9zQ;;?bD-giB3iB$I6V7M#Gl@ z321RR8t*0ZH#&v#K!A#f@*|!1iL(gvJYUVXbaF^b$OYV_~ioP4d*`wk*-;i3DZD>anml z5DJ8pYg}(3sxeHkMU5ISM6CcL;S$Ft_Ko6G(p#5V{t{=0Di!`1`@XHeC$^HBzYev1S`_z3DNo-A>H-E2uYV+baxPGW*>~lbf zA|b1(t|WdnMor0qmxZUy(fEWX90JfDbPv6N)DM>`Y&Ej)qX&#@F`^JTomlpG<=&&u zc|Sl3_n3^jO>~drjCrRuQN7w5Cc8(r-ZtKJ1KF8`FRolTv70POgGpW}nZ_G61qM2Qt|)XB25O0<*CFNSo+jmULVN*e!E?mxrglHY z4&e<0&}jkbP>TJhQ9eNNp6blPrK(E`82+69w!T8<K6&z;fx*4#?%z0P}!u9ECs< z;3AT-)J;x=Dz<)WLH!K$t5T0PGM_x2wtW zN}|*^TA8xem~~OwJ%v)aFH}gHh)hL83!EiO5{nJ7Vom$cSUdXzm4?`k^F|jjtq&NZ z9pXnE*lS%ZBa6>caq3IPCQ1*!MpRs;^a`s!^Jq=1Di6qiI=0)%QPXLx&IFnnsfNZU zW8bY?if@#mRfgnYv`ZXRB}yxII4O^)Mq6-T^XZV3ge(@MB7Ccg6&wti@f-ZMo?jNo z@7B^(S_?jG98c^d;de1Lj6je=1PA?ipDCi3MM*mAhiCn`2~FujMARWI_U%XDr=93cHYyo*67ScC{REpSHDAkvuDhkQuSN(qOL;!#{_r}(HTkGz zdo8W*k`QFc5PI}v?z}K|SXFy-{Ok*hiFB}bNbnQTy#gp4o@P?2d^vJiOw{?;4S;q& ztQaz-Eq4bzR8xFMgwUfepm9&WB#inDelD1(d#=Wl`c0{*@GvI`qw`I%TtaNO+oBwv z3t#es)kOBu9G>tXhO7(Lk&>%S0)W`Zr1BNGvh^xl$;lWzk=LMw`B5O&ELnNn>l^?T z{$!#3r*Z6l91AO|uqtB0s%OlB4{~7QK%*x*;02oCyKWPhN*T{&Sg9kIU(>#)B(EZw z^1|32dM&D65*pCFh{apJ=O<~JRyOlU*;esEaLXq4qVp2yBftdmm>)sKfm0x4vi%H$ zn9~JH(|+oQZO(oaaL9*krDt6*L0)K)tY&;Lu}`uLQ9OE5qlEA1(cbxK2QB7jTKr(R z6JeU^(|JCiu*KDq$dpU#Y>c|Gjoe0b1>EX?HNj}>pu6s$o%)uWOj%~?-6}H~-e6HA z!;)xR%vsirZ4LIhP1dz1kNmn9;SGeehoA7>vh*wc$Ts+Ji<&|pt9HSo0Q}r zOK9zfG;GXYMGa@-Tdb7Jqr2*EzU5+De5(m;?@3#bWlS&8?HU#T>^Ac-ko9G@qgKgo zaqUdJD`>|;kl*ReCK>gBHoVwQaQ@omCo>OV)MlL&f9^6<5aXEX3kr|SC=P01@GpDb zpkxIXl?vk~N;PE*$)_QFlbjG!0gWaxP$D|>sqkVBwIXaSZG!JrLs`m7bT4Nsa1P(} zq-gt`GBth6D7Mgm7AMOywW@&`U{aq;#RFVDe1bOw0*Z%E`;y;qNd5#Nv3SZNQYyxC zQCy;q=#69?q^MM5&ch}y6M*DNKU^A1xzj7NOB8vi#oz$s0z)J+p`VG2ffSZZQy)f@ zCD!A4e6n1%ZfRA(HaoqCW4UDqlKnzkPHIWDHq>{K-*4?WXr_s_vNjvn~+0X<}h(P9coA23W1t%DnuRjP~l)!QEW znPjjcCoZT_d=r^Hh6ph*ta$h{HB^3Ms_4F;HHj=ApI~8pS?ST_mU&aDE{G8AgS<9) z(WfLWDX3_UIkE0V6(XgLwkibFD1+%56JkoiXK)sUDFAfa%GgBx=&R``bE^*xsUro) z<}={a>ABKFvw%Y-^JX<`6V5dr2^$Q5wSggB@;|%(4casUad07Uhq_X**hdB ztSTu(XZVqKw`%vq9_`CR9l!^B{kr7pi=u>AmuIsrlQdNU0_i&0C1GgVBTZXJPbFX} z=`D@FbvfCli|rnMK}7=9I`LLppWXHmyRIo)%FLS{k8;)%OvEUhEAA7v^elG2pXiK< z2&H)pwh%=#r^L8Um}PREdG*sW-MUSyPClm{{OWjk51&QTYhIh6Q7CZbGba#&QPF}x zVM6CzG>g1;ox-o$xF9t&X|+{s&pA=TAhBUtv%&AC7A{GzenPRXRG0gL)_i6#fsO^{ zT|>!11f+MTNu-y1Mc$!fIr{7h^VoUC2Yr+t{g^(BHm#|$1OaebF_6~SKfwrMh#s?4 zQpNwQR$aXs=wbjj8hskWK?e-~Mddb>tni&uVN!gloWhZ`B%R3ty$@ZU@v$%C*|XDg z9gafhM$p>xFvp;^)=K<)M^Vq4XGX~4^XsAObK`=Y*{#^~ITl{lZ0{Bg=7&L4bD9BU zP#;V#tVU9SXa1mFgPzr(ks>wKB>ZHQW$1)zqkeH;D%}!JX49A}eV8F77&YDSm*-&{ zp0A(pZMy47v!HV^U|Mur&$?u<4X>($@-I#o6DBzSYQDnjH}Szv=uy~Gulk;@quS>n zx*g0T0Vwt6=U1cfS=?GyI!P1&R#iEijjZsmc{-CX=-eE+T>IP{U7zN1s+I*^pI%BX z=F{o(ODeP&oAo;JPaUjA(tu69UOjH#_l$IE3Qwc~8}&LwdC~>w*CCoGB(8s@kH>|g z&EOSz@h+aHS;Ui+RaxP7Z3dhLF)N>{8v>DXyv6nj88*r=59?(O?3VhhAdRq_)q+Jn@e;IM&P4 z*=#AeW_R8Xzt8E2lS5-_PT`R`7&m*~%TM)gl?(pG^++cl&aafbX2=(JrRqi}lCM9~ z7uZ)=s_TCd+aapluG@sRcHS}@w!-H^Oe zx$v=e?m~7S+1vCy4!fQQn`Nvn!ZE)*LjO#D)+49!)UJcYR)tZAeWp*SvKVbqa1W68 zt#04*&^a|!i19Xnb_PKuZ=)kLUrRT2eOG~@jjfFKrJ4(Gnu4QuLh|^Pn+8c>J*M?x zzOlqyV5eHwru0smnikTUIx9|KV>e;ODyvHjehxjpvdP)V;+&aMFW4$cULSucG#~$U z^-1yXFtX>OA3k zIUrtw&TC{Wj3jle_Ih{!36At8D2r=OOdIy9UTXXIpJGydbGOt~c37MQU6YuD8-iwL z3V#S%WedV%GwPG4JhT453HY3(cH8{|f^4bR3?x$O9D~JXpH7{TODuLyds}3}PT#~{ zNR9K7NuO$$H8?Vslz7QL7P$^?ozF^u(xp}G2 zNRQcS6PWI8<65k3t)eM4C?#4iLy&{Zq{2+P?~*HE6I}>;5UfC}zYxEeG9%=|5%eja z1)KJZKAYI#khh`C^vY9H4y(-cx07@0T8&ewI$OQRHo!xFSEJ?~YozkSSuaAQHJ*OM zX;_q}&*#UZN)|HNzu~)z^n4mdoKm^)Blds(wKiQkn46B8z6@N9Ik$1q&5FvTy3FUv z$eB&zzpl4FK9)DJsJ3K|4c}r?YiY}(NC_1bdANp2gQ%o`K>v>9W6*5OM5b^m#6*=Mg=>=s zPDB}q$85SBk_!aarS<;10MJ(iNjbj{M}nITMuANQ&poUnq&S-uSQ2T_(_VbfF>&0; z41301*I33q2S+ruiI8}HF?jGUKN0`C0|5hou!qe@G0h z0DP5yiXTYK4SIg7$_q)tr(Xq8Z5Oz*wMK~)UNal zoG~MFzAgnPSqVg`r_19OwjQ~=TD@o^yb~f>#O#0@zhzJnjS+V7gW3gVHa!V$l@GlB zTdm~CeG;S9_)5jRDrZ?f>;e<)Tmx&{vxZfKu#YoWjne6UTch)|*^zYlAE(p|;#qCP z&$`+QjSW_vBnwo?s;0f~`5+6uyHyNeixazC++No{7bQKRn&C>wVh(V~WFSBtZFK{c zs_+}#p>I_$ix;?P;=)(lW7lL-@Y3sSMY50r@bSA^yK7lwm1&?T-FCKtDO*j4?Z%%g z`kPyGu$Q_y}GUiBUdUrt$RU0hpiv5Yia_~$!1T} z-WB*1xXeZNv8X~eDW++C3@=zKtykn>jxDIHaCq+AC{@Y1hLYo`20O?FIo|GSG zQVqv;+&*DiXCQa zOy;?xT=uD(*gRLSC*F4^vCt+?lJCA?0!CSnRW;8hO&GyTW;-mxiq#=kl7{(RJ>2A868Pb)d15D6eS zMhH0CHhhS;v6`&bsdQbm7&CnI0Id9wmru9e@2O_g6Pi`SlnN#sWgsW>TU`cY?NNAc zA|(H3w*`GYaJ9`B%^L^Jh|eQ^Q)aE7b*+qLQ#0I8V6WV|fUlHvK`xMuFet>%q5n++ zS>WL6sy*6mHN!v1YlT!w`urn6{q;MlEnJ7iP8mFO@KUJDLnRwfri(MvoI{Y9U!0U& z-T`dhz0jkM2S`kM6G4;zs%+4MAjyBw8MM27Qy?ekt)r0n{-*P+?`nHXrgWwV^bC2; z#F+;jwYa>D`fFq!0N?HWC?tsCcqA?d&aJgr z5(llzWQG~Wvmvu#Cc?1FINECn?#m8+xyWxLF@G&8zHJeh-Z%~*uk#?0*FaA^Uo0kD zDVZdf?uqpmB`_d(+VfT3qUzHcoL~s1`O@29Ldxb+A`P2^LHZ%JVx>iMkAMco;+!^U zkM8Sz;jX^J0^`TPBYR!< zeOs=*Lmz>bwbzRfdF>%mh8?tjg_90os(CAOn#F)GO!boO0LrYcH0{<;@>s<-)??Q`_fjg#Yx7YD)OR42m?-qWtW$vtab8{YTc>(=5&dKaX3*M(J$8K27V-( zd+@}G(#66!@m-iuCkxgwU7oO^?oG(0v?AEy8Hn+D+ zT=2z>57h0^s&xA$J0CS9kkP1@Wh4b-%5tlvH)Op1{Cl+59ATE^!BYqnLj59W3O;d&S zUj5^VmO5L;HxYqW{;aREv$3O5#h{ue3fr+E}VJGhsBoqkva8O3Y{4w z7B{b@>}|E;RYqsru6KB7M?u0d(SkV9o!j(+I*H`4b~9FoXu>b`d0x?Ur@};#hgj2~ zEE5+6Hb2UW5unW}xh!@5@EKeP_-Z|m5p^QF`9u>^-M>Cz0?h5DZ{uuEqfc}yp2$?w z8>a=V?ah`P{4ga7V#)EeVlZR>HN~`1jM;TCwV7JufMhfNUo7I{8~isr2OJnlTZbF- zpM@&KdPc`E6b9m+cvDEs5)lCd`q-6FpYC?=xP^TeBXm~CEhW^NbTOtucIC@~1h3C9 zrwj!zhp$@@Yvhl|Xz-H{sBw)9vLY3}l&?An4rg6^<9&U;k^tkkQD#yXqeh0oiM08A z#pa_fs1-E$YD9+%Y06GkFLp7y$>~BEfy3@tN>oO&xsOxEarq9m(Ui7|`If7hMXbSp76vXb=a9 zDF=SqeDMs*;?RHa)tb>T^smjL38vvT;+T!qs$vFhs0I|NoQ3I%8C4#|{q-*q zjg3hoKw|$4wAGVmaG^oMw_8-AlXQ!P1=8#_&cy)^n+fF)DKkw+H}|;Q{$7szc+Nf!<3& zL{CDuapq1?)_HCxA8%VN%4AH0k*_P*EnbjYUirq0M6LNcO04vpO%)Ac_{qs_#HcPm z%P2=AAO|?pNea6I4xkxL7gP#dl5%r1#0bjLwc4$^DpxZ0VG3JH#>sG4m(Ha6?c={lCfa=C7C>Sns2@o4M#1{9dvo-pZoDwULT?h>=60XgJlXIYNO==jc?~m`+wtKTYV^wtPRa=PiAQ76 z)WWv=k2p7JCwekz7xM&Jk%>8OGI!tPBP&x=0W&&{3BflTbUz7h0uA!#-c1l_Jgme6 zXDx(bRO021cMEloUGUR-6JS^Xw1_zw$@M~8RO!Wmnn=Iae&IF^q_bBzZ5r)`^d{5_ zwuCjG8}z9P9TwF1dP2X8UTvWDP3EX+8x zgT39hBXTONJ#~oQadtMRc>2XAm%yb}AFm#q5bXK}YvLKg6Nx)tAFA-kyd5`Uk=%Jk znX&5b)U1yyg8S=2v!&5+IKWlF34}xSH4FCJD|Yo<^b_DoJ@7(J^o@0gPFpNP>L_b*Tb=#7FP=YZ8M5~lQC?9|i&+C*IaE79v@EDwi-9(|l``gkEhXs3!u_HSXyi6F7 z;JpV){@HiLL)bEm(dK;bC=gX=BXStzl>~KXSkm1;g0haQ!4oKO)|q2QdIwTZ23AiT z2(`E^L060F;2(oPo>eho?HsoSZAdAo3_MwO1L;zLzi|E*Gmz{kn3 z!a$)VgD| z5i$u$%t|78TlHgv(QpXcKC1Khye;TZ?w+ph<(41@j$FFM&J;XQsQ*(=nTm5ol}2k@ zjBM^2*^;P3n)oZeezIR{G7!I$%x$CcA&{(K9s_0Pd_Yz_N3o6rhmE%=n>PMcV>qR@ zY98+uvtE2UCIe&>Pb_W6^@*aOnCZ|KsuH~zfvuFKrvNRhQ$+D6&qY|5O1 zb9m|IKVTd(f%Dgj;j>NhpZC$vm;ystFJCMebm~ z^}1GiQ4(Z;uE)>3v~P&CJ$hLyjhge4Zr)%MM;c^-Eyb4Ml6OP+<*vfT+n-VA4>7!Q zAw8STa0<;Kq?Ig!P#Ld@pN#TySw+Qd~!R596fRz5jhyS7u^1cty|H%iw);k|g{`;Vu7+{Bq zeiOxG=~n&kIr1}DKP~xZE}5xtj`<*Tlx@GD``SRW0hBS?+k8j=9Q0q!Ks+LG zBfqsU<2OU#NLKE}^fp+Jx0rld{}1Zkfu!In93nw&dH*sY}a%^~4Lj&K9X|mxOuF+3z>p8M{c51$i8iY)qB=$j(}* zlqg{$e)26{az8}X0EH)kK-=^IMxx6(2Tc8Exsf!?rm+QWTt%(g40cc2OcIHr%@KrW z4DI|r=qyS8AI_elWcfHK_}L1|3L;Vd(;pS}&8E!PWkV)0V0(;e0m^DR)S@>5F)R*O zw5fv(faak^kRJ>~Huw+9M!mGELH1w`p(xOZDLpLQltWnlRc)&c&>rmO zju;yFv1(FweMx*B;ew~J1o9O02MS=3k~1D0_V?4Vub^IubkW8~GD4EPNOX3$Y7#M& z)$(~lo|ki(aYP&b(r<0wZ}k{_xOEZ7_I*crP9oAj{skLLBU*qCx4Ns{wCTb=_M0U9 zQmjq%MpF`WNCf+Kio2gW$GEUcE6ySl*Td`%e3VTW=0piPVBLen{Fgq*{ zGr2G4QX~WaVIQa)SpLcXj=zTmL40e*FAy1%Du)K%-NiN~*->H!WVhr$-rh6H93vhjtko?ozi4`%&)B6yEN{ z;J~}v`THM?0vq|;TkfU5y#>p^O83i)(&Rdat-h$*m;(m`% zD1Q=)`^!CuLGnL@%6l=0{)e;wB2?J_CY1dh#<$KY{za(vd)|WNJ3{?AEEr>ud`BpW zdl3IksQX5NbmDGSiU3FAH&{a43h5%)qfA-zX^5UD3E;Tt?@l?LGm4;!tN0YEZ;%Aeh*@h z{12hBUkt+k;q1Q%CHFrGm2xjbrTm?tKHc*cB;OJ0&tbtBgXB9xQQd?1Z$jNS3M}7w zyL``EkbFld|9f!<$#)QA-h&t<|3fHFF-ML+Y>MfK9P|erevdkR4~aR@8Vz#jc8vxt z!}rcwQKJtf{@1=%f4cLpuK(-g|I4WVtLy*&L4Wt$Wn91+nEqdR+`R7|BmUz5{j-%h zqI~ARL-((&6H<|aR`cU_pW zNP?F{-!7O>UpBHDqls+6b0&JAY{DJ6{P(?$~*8wK1`?cDNH> zII(k4e`y{TUZQrqX4!mwyk_q@WqVWWc6_>aXx16Lr^Ok(S?D8hS#$1De!af!x@`;a zn!VocI8JSJ^Y$Eh!?4iZ;c0icYJ4&?G;w)3ZXM2XHcxcEx4*b}4Oo>I>=;Pv$VO#~ zqB;*Jo!c%YX%O-eCJzC;2sj;|zfK;K7p%jvZEh00KI}2xZ*qNowjj{c#2KyZbB4S; zHe_=g^se=#kAu&d?D13s>0H_?k;$7BS6kA?FFpWz9NUsJz0i5}leGyec3s8>M$yVe z8({Dy`4;Zb5tr@&L%5*(MlU&%;L*c3N9ZfZwxlNzZ^HRn%U=0Tat3#Fyedy<@)}?L zCV0e^)kLUS67HQ=ypDS;A)vH>Q=1h&H@vFHes!JSbfruucunV-wyEj8W!OBm)5Q2q zc#Hp}^zFjpjo4LQ{NVQbx08%T3vu~#0pk$;7ilZoJKJv-wb|sa7BX`PeUi>_nz;wE zo}a-M@(%=&@cBevA;B%)WZE(E`^5bA}bH&W%lFz64yO;Z!{54OD^y-SpnBX3*Yx&N~*}VKb?)>Dc zAHLN!W3ueiMcor$-sx9nXSK(B`>DF5SB;HzI*TOj0W_v??3$z&&z8$W5BKUT zMORKi`pNCJ(uTCAG}*;Lwd6Es#dkA_6}{_&GDS2Iw6+z$+cNHUBKY@P zSJ{f{^}a(xK)gnRfcP)3tYZPcdNovCS9z5K>*^_iD^Q+Z4$5yg%7oHCr;Ls_RiS2x z^R&8HEUxk5QFcqSx{J}Mnv~n)`ijAkiII`mgrZn)4(v?R(&`AaB$dw`q+{bI*q;sL zRNh2^z7J&5fM(p(k{~qVL%LRW*2g8jV!u8U4vWj{VLD}Q?*M|_o~(WR5vsMKC5+81 zduL=1#{l8t+#aTBXF7My=^FA>Spw=q^j&2U2!t{EW2>lRf}CY3me3BiL{z~A{i?Sv z?VMpRD<{po-Jj+FyzJuTqy2_3V9Y)%LtHg3K?OVlqMIINkrPwcMtgkm_LT4$qZQsP zZe0?7*WzYVXmRw|kQ-;oU$@|d-e!``2A-8d<}$vx;bWW7C$$$l$on_|Ze!IZ)6Cj+ zha?3S_QskPf&8#+*<}K{eoC$4#M8ESGo0&sO7AWB${jXMeX5cK9HC~W$(z&HU09#f zkDNEN%?g)>3DIkqL$!9GFG118Nd>Jp3P9-^`4N}~h7cw4BidL!<@VI_h9CCg5q6!o zMyZ@bKw7d5Te@j4ijvBUGM0S17~b0AOGoU^>)+%Re__HHZL#169i$=9;tENqX6F}z z;`mV?TJ&sRM@qt2=TI;yrfB-oar}~1oC{YiK!$tk2v6KVANx3v!41~^VGEZ5OboZB zxI`kozk_=>fVrwPIuIcz@Z@=q^_tpX`d~~I_3m@vmecizu>{Lk83l(gZS}@*`kWY1 z>bN+zG4U7Gx}zHE6=zt4;DS*^hs00XHKlU~Xw{Sy&x}79OJ>*D6ugGquJC9J*um>t zjxK*j(QH$tCDiG2ZQMtw&v=I#HQ{R&=ZM9FYhP~E z`ma^aBS8sgYDwD>?ncLSk%Ny@#Xj#jNH*gg;c)an7mr7qH>r|shnxn4h?}OcWyyX@ zAAZbi?C2E)Z3H+m0*EcCAMod`X%?>8mK*JFi60zjh735xN8|7X4Wl=P`jLt6^q;9= zPIYQmkWIfNU?I>?(tCxeyy$iw;2SYj?gW^CEbrniFYScu$g&h~j!MXYBz8J7A{uK_ z7w#EMhLr}rK0@I8DcUH9c#SAVT<=8cCE8#^e}D?HU7S_v({_ z&2S%kqsr`B5Dsb9k5ZKztsfmWhrz)b$j7m7=j}pYqLGQl?(q{|Aznf{_2d{rAsP{- zpjGba6-Rg8Q> znytv0Eb?8ot*7vEMiT}IgB;u~&CPawlp-Z2n=Y8U3~qeKUaTbgWz&j-E)V!i(T!#} zD4z>_o(#zmBouGf$l~g68OEZ}smRtOV)0Hc4&fV6z*`fhp$s%lDnSq88llQE!5lJ* zdx=>8d`g4Uc_1Mqjx9eJHmpR-ZH-BM=A~rk1=|xhfT1dH2=jElgLE7nbw*+*7jgTE zsp7SWDjwE{*Dnp9cES&sLW@{N9f;USGmk`?bu#E%& zYn9IS%nyyCHo6UR4d{wOg#{$j8p9Jy3$WN^N&>qU0-3W)uNwM zZJaPao){+iT42B;CDN%7*Z)0KDJmzZV&%d#-oZyrvzAap(}95Lg0=eD9+&#ERYF9-!zb9z7}fD?^$2z5t7 z@qh%zL>J}B&4CSjuBLxQfw88CCL2C_m5H!mTVZvh0b49r3^PG+;lrS(N&W>Jv6h}& z4g;K@r?pC^aRwSaE85kWv7DvTSyfF;J2qvI^{UByfbR>CxwLc+9xi@~-j5Qw0A4kU_D~d%1hWW=qIH3Z$975UO&TJIxUAA+U~h0>dmJl>Kj-@a5}#Ne z^V?}+BqQWwxex2}HUpl-39b#P&wdPcMc3?=EnzFT@Ibz~20dEr+%iu5DH`qFRn29=tR@^c#f#fa872MNLXx@caw zT=J8QuH}*GL*wwukX_=!IfIP@|6Ld3%IR+?BrYF!vKrhsifSLJ3Tkj(r^pHrU+r_# zdLLKwBW^s{6^uWSBg!zXeY}%{5q5HM;fl2^Yo%J<983kwRP(w@<{D;L5RH1ptzjP{ zNN;oAJ%T6Pze3Kw@P533#`od4lJK)9{*Q1Zp~sax9(|Vh))#c8Bpi|9qw}RrOQ0y{ zTiAQx5uy>KRwF5#Z=aCCYzboE2RHXE-%hL$(DS^ct&h4DzWQoF?T&VTc=AkoCZ!v> zELI!z?Z|Z$VnXrSWQ?NEkOJh;AmAa4;EBr=TSG9OK+r{6`o>uYyTIbVo^KSxdXO&p zgeIb?1QDheTR*+2RnBBq2;!|jTDswEx}?(-4!WcW8l+f_$Ht%=Ya0Fk)D-enCi>qw?i=(O_hnfMXY_d zk(JmUY25zpG<2%<(F=5G(4zwMrKoJ_E<}#AIaZxa?K;zH?8OijFKG+__L&;A?9$KZ zGuR@APo~i5){iN=>Dz2Re~@wf@%$S?lE>!Z7+0qW2G6yMR?OZEpSR#<$^b@;-yv*L zm|y8ZO0yA+e@7rQcZ_qhXz<)Vm>^i$%5YH2PoWQNhb1yRq5OeH==CLMpFD`3z_1~u zN#6wWy8}amp0#2`zorZ8jobTq=)ET}?YY}-5pL(aN%57ail4voodjHPxQl&9%2-d= zs?b+NujQ3H7?`dRs@!gXx5>uj^^oskXKwQPfKkvSEN`ELrWb6;f>88M-sauo<W2AlHGBZL$jwWVn0oX=?mFprmYyIAU#TB)dc4s%8KIcf^w*5YVzkSVFCe$DW zk=FoJykLTS)fTa}aWb`W(pPb}Gj-Gj6SzaAPp*v#?MH0)B(2M)AGD=MhE4{Yck7en z&iDF9HqsYoRv23FDq01P?B8MU@ASKM9UYyZK~@fGh6lWOyYfa!gJX%U7ww~C4oZ*3 z%3_tOVtnz!Ypwo`vjQYQtFjz_kOuvv!ggxTPX4Mj+ech7Ke0&uuvWc7G#>GnQnEVg zp88(OJ%ZRzTv70>WZLneMS+7-NI9g~VWEtkl07OB)=rt`yLdpJ!Uz-`1-*5yRhIE; znhb=sLHpqLglFng5D}FQPf~RwDM?sD78`nCVUvR2Bh6={MJh|%H7qd4HS>ncJb2e1 zD*||u=y?R6A>a6V>%$7)@>#^pV@#Dc7O#GNM}fmdOOwMi@de=*Hy5AI3Y})YM?tOnyx_`t)YmS12farYmGo1fu@P)hpDRr}A zbb4WGZTjt)O%HDsfak!!-rIg(%l(VzJ1usu|53~BrSyF*_lxS^ zS|9?E78sFFto&%YFY^itcy3pUm$%Ci(rg{GZf*zw`aXao73fo7>L+C5_zI hbAM9a=~4Ipk5g1Z8U_?}2nYnwe}52jas$B9{{vq=!6X0x literal 35641 zcmY&chzL!t{+jol_m zKnBCaj%=3KE3v~*wJ0|61moF{pNyW8lrpTCBP@k0PT!MzMT!y6bwVPn@{r#tl9WFjCAI7C3C)d#o?F9B-g#WLTgj4>?fF- zNlk}*nB0^3JU(={>@(rok0uOmd972%!V=CVSz7@9H7p(a?%!C96W8!Gu)0^hm#E<< z!m{Q?7zi_d9Y)}i0Y+d@+#a&bfm2Ih@(-C1i4COp-3H3roMt9WyT+db1(s7=%6N~O zkaZCxGqvH#@h=Q@uWfiqZEY&#zB1f+>A%r@k=;VWLc&@&9PwlzBIaB+qtp)_r;HzIYQbsTmWa^v1{PjW zy%TywGp!QY>9}c;3=`+h`CfmoZ*NC=+%8K=e*HWSWu)|tR=-XTLV_PJ&SH-7{I)$L z!xA>4;6njzKcaJFh^Ot-^;C5M9nLQlJYu2?0kmG~t ziL@YMVub7^s}gKADpBHxSxGPgm%BFOe*Zimqn2`IWztkl-stdYsg4n?Bp|N z0M8wBtePS7Qk?!Or(3dI=0YvwO9l48U)fkXtwrZKiJ$plA_I5r)T%>Q^#bQ*7tv={ z?iItwGsKMa{lR?d1&KV5wK*)NG}U`ZorKBHCAuAI&;c-cj@P z01aRQ%bM#pj$OMvi=<@lmsyUt=ZoUYdwYRyzsD*u=K`qYix-gie2 z4XGRcFN;$OY!~DbFSMN!!nDymzkjxl32Ww=fv@iGCmukBQ=(CV6+!=u4*>6E5mODb zHkuE<=Q4#SxbX5Rb>M^bppAg`;DN>bMQ_qL(CWt3lGs*17Eu`Q=R|1k=#I)gGjUqQ z)rzh_yb~c`jBOaQ#}8#+h#FJNnqY1dT_=9>0T8L@9x;_}C}PP=ERKL$CFNDba4XCq z3G0`B1RGd^xpK13p&flR*K!#j8EhL+Do+NA#HlINEKnT#6v7&{D#ZLFo;S_OfT=a^ z*C8rs{NQ6P3U@jmzuLii=*L3$C;IGA>I50)1%Nw>iI!>R*DkOSbUJf1D6JDYrce~I zLHPUW_FCsGf09009w7{1MMyrSM`0n)k zM1B!%3PTLA<(Y9FJs)@2OI0FQ>^(pu9LCTI6g5A`W+l|Xvy^jP(= z%28~Zrxc2Lw7u>t95iXCBMY+i*18g9-!j; zguak7$}wddk?xgC^rta?C{9eT;Gyf_mv1URF$;kSuUS84S zE^}*XPg)PTs(QF2WlF9hmBdC`zS|H_xr{wfP;I0{(;X3#d$kavaPN}CG!IN=9joBM-m?r5C0|uVOK1G}>q3*L+t6U~*h?d|k+r-DdDGgO zh2w|hDb7&s{wRIv<#dq|(q=BXMJW0YiUiq^14^s3?kv1VJ?61sge7s3w7waMhTAYv zV>?AO;Y#y0!9vUy<1#D%_MM}<5_2x=wGj`_@7?1#TCST*vJrQO-hqioQ2{qXjGXL` ztb6XLpGK>&&>@h*<7BLnV5cDOM zmU(jV+1}#UO}q95xnej&1W)nQq;fsp^{P-VP0d^joVA;WcdePB zZluv~TC?@Gt6KLp#g(A?X_>-TGE;_0EjC5NiOG|1P=Q@8UpD7bKA}Bi$)B-;tKR)v zFO6fj>4o8cQ&?&PzyZP$49trL0_@YjDa_s8$=cZh2y}5~_~+}NJT}*5ow&ljT=k-% zDs?JlrV)oFb&)ilpJg{xFVXzFC^5bKWtS=rvI9q^Kv??J#qR~-3rvI+tx(a9Y!{K) z)&g2zCI+@+yTi79Zse88?eK%!)st0Q_3P`vwp+);*&axm@F7xd0}HPkOIkgNrWw;e z1({>cW6>FKWDM2(~j-203q(kaXzzEVcc`}U`h ztQvYNMQ#F}vas>-r{%neXs!i4Y>hO6 zHlV9zx_(7(^ji_h9S<~6MKbaK(qlTEwe0fX{q~`+5xMmC3XT9x_9;%AA*YtbFY6Aj zL7$hv93S7!+%0f#UcJX9V?f-m|MI%%jSILh0N8SR;j){b?f=6qvqrh zLa9jcx~Y=ltfe^4S?TVMNTA;8$$2Cp7F`KJPXDEj=3(b9o`NXVv*~4JLOmGJ^^3Nj z=2b~2_jBGBGLKR~gX(L(pWj-ne(v?IJraKpL~c*DK#ReuROA^crN!OV^*ZAE2AziQ zwCClgFH`o%Q!m&Wko<4cV(~%f$4fBFRe{aQnB3=MDX0`sbdItY~&|!B# z`i9MgZG8NK2eTk_bWtmx>*n-OM2s)B=K3~hZ`l1dzW#NQ@DXI1IW+Qi;!)Ni@y1N> zGPc4qVRZe-h)3Wyh5qvNyKA#|MOeq(pD|m(ZJc$8PIhRw;_F@Su*0ttwYR*S#UN0^ zO*b2dQ{W>nd!y9gA{7G#o_hUAg4{xfrp^@3XoPgmju@LKR`N0TnAk*Hjh^cs2L^|U zWA}K=3$FIdL4RbTjuEo{x=Y>lt*K5?CEBG%flf^{Ljfv*{hD{7`_VV*pD42xyXyOu zL=YD*$OEF?-1WRhWoNw{lyO>gn!}Y&rA3ctd*pNpM=NSMNn&cIEB0a)d!Zv{qjK}B zlnHYjM+f#-y)B}wA)|B(t~HVChsaxAi;&L+;Lq4-dtbj)e=kl^pyMEpNgN2~j!tB( zQ|b3T(#*-^q>XSTKgaaetRXQ92$uYO(}{(2q3uCdgENYA#3thSLp}B@+-!kk8t1<9 zbF2m)2plD6HHFr!2kR>LdduiaTD5*^g?Ad4L3EG>GCUePhK&&36ia`}!)IcPj6#~! z(%HZ@1tES{*p!QO{M&4bvqhR5L2SYtlCp3aU4PVe8fgIb&+4%)(ngm*$Kq-Qg^N(V zQW8INntRLpJy3&KFj?nZL05KBw>2HN&81H{QgtJ#FGuu19n0q19hzwpjNFdd^F@P0 zpLv1V{5n~t&V9@3rW9U>tQJGY263G8>IFek8tDYuD7|G|*;Q)s1mmTT(QnRUTSw?BCDmOuq{thrf3yDV;_yZrhC6Od&p z(oU-V;RY**pBl{C6wcQ4jq~=?7_Dvg5<|*cp=MV=L@4ORobp`l zUf#SSYYbks`#__qPIR_`)20R9o}I0vGnkbD2z6Nm9Wb!r(?sPtKyE-}$&`Dsacz~E z+Ww)i!!MZ68P|B|mX5psL>^eNc4WBEt5WO@sHJLB2Fhuu{&-opOs zG6FQS*)N*im_>G0K)XHbKgURbACe_YZcdLr)>Syub>PC|+GvP)5=B;dd1XF2sYuEe z(zYF_jKY9yBF`SwW43&-wz+?_hF1I*x^Zmkb`^iZ8eq0gn%dX71(y@6XnE??wAZS~ zWIIdQmC*~@u@xxI2_iT!EE?B=Qg5w357kv|&}ZBYehiQkP6_^AXFDcU(wqx?gsy=g zh)#l1CCQ#~XC&A%^rC~ogU3DjHM=V%c+A7K_3iC7#D#z%_c!)iYwD@Kk)fq^vpPhL z7|R~FC5-);6n#!hSp9AHLIQ^Nj6-@Wz1Ve+nL>e~+1INF-Uq3zs^b_k;XISxG& zCTIU4W|y>j!G)fcKp9Ih!bN(+WgTVKbCEeaKd%qOl0+dpikF^@xY6hxFZu#uR1Lido9uaRow-Mfyz`R5xc~<0AWVGj;lhace{Td90 zu0F_k$cf8iA*z3HR2+Dp!=iL|E*L-QQ@j$+xV;LR2&-+U7ve-!bvQYr6Mfzv2qY4f)* zlk7{wWpn3P)GvRKDk~M;=1fs3*8X!$@?Y0aMC$ueY3(Qo3WUy_Q(Uh);3i)Y7UGxF z41?&TUe$POTg>>Fzz<67k91%?hA>IjS_Jv}t?Z6Sgxtp&6JS@$!ab>GueHoQB9jPV znFi)Dw|rDpi~^u=ol8+Rh?0$jyd``gpNrt*IxV{;`W~29|3$h; z@h&&N)A{*+kA3D58C(FADE#(S+|Q7f<#_o=?4UpLh`2RP_={%TQ^4pdbDRJjmEevG zc|KK>29V4~T(GZnN!;pP`jSTgm?pKa-|7g@)M%^!`3!fv=Lwm0yV0>2EKB4@dov z-`lqXI1_y7@JCdCaDiA*#G6i<$Ki^BbP3q~o)(afEm z&lex0FZ-UT_4Hl|2NY7!0uq`UD??Jz{kf;JpPCL=OZ$Amj~O2@ouuxHbrV7%2#vJD zNt@!WX%XU!)C0D=`{wF=byz!I7>QY%b5$<>ETQ!joN&rNG%kx2bbcVkFG2`AP7 zDNvw3oo5^H#SFC266!?SHpU8^59;=z({5L*qg8c%Bz~<_($}9wWc%8x1!UJb2^QO>#lEk;dSxy+xct9;QRzV(RUD|Mft*wXb;(V^&omO)`+{=m$%Tj_RNIa}qX z&T~|3)-JgQIHfu{YvWdTqEJ=b17ygm8hE?UqHZ5b)@99k%fBDUMqDDBg)&NvF-!f& z)F;X>f~c2HKC0hz)F4h;M#^t)=|p2~!U_K%??)lAGeqk0hs#+;0IQrR`jU(?^Q~=4 zNSzoRD7(K7;02ldPmba^Lb)04#_}?yK4{iFU8qf9!>84*lPgqhmfEdVQ+^}MEK#u0 zN<#eBQAYPfOk1YjI$!c^b;YaXdTC0*kB!WO&EQY&)qvaq zRwf+c*78X-NHeCT`;u2Q?v51dW|5!G-aQPL=-itL=ogi#Y$w^+wabe><&~leRcQbk zOhwG#sGV1OX(K{wk6TxqSb0%o%>P$t9|04B#9`OAgsmAX} zbu>^_Ggx+^0VSM0m^PuaS&kU8Lvg8hVOHr;Nyoie?Ec<4rZ!Nh_o3p}E2p-NwGBcq z9>e@xz@~Aa(-n%cF?Q=p9sRf#ZxgaX>Oq@vP(a2PK`H;LW#R=Z+yu|sg|5f|1Y9P52dGw8Am}oX zZweii0puqnLd6|B&us{QZU}j904jtPR&xS|as(RjCh4!J-1=X3( z(#LDg5u@pX2cAu-y2_WQI0`Wq_oS1bS1o$<^u;?{J!<+4Cg%jSm_|@PTtc4{sf;Z~ zrhlVH1I-NZ{JBA|K$3PKeOH^koVBozxya}rwF+_#SY|k3F$zN%u*bI@j6vs!ZGDeG zk7AzW^)c161g-AH%leTD5S)N9j><$30*>decc85{9c^lb~byQJb#e7twm0EeC z+a-cvncPWQ|TXl9pN@x~2b)uh`nZsdTsZt?lNv{XG&U*1- z^}sGAB}7X%Hk_a1hf@gw&pt60r$iDv5vC}vw7?bmNe2FOdik>CgsZ-<0%I)w*Pyvb zeMwo?M$+%a!qXhaPd!J0whiV>m!!iFGL=mL(KuQ2J`m1V;`h)unGT!aG#qce1-x{) zraWr#^IdR5-R)GXuaczJ#t61;p?#2aOSbS&*x|x@ysO)>sh}R(W%mD7pyyQBgb5j+ z$L#)*SXqW1g^Ph2#?fY)ws`C9g!AsCH+i-|TSo}xzYJ3WAWm?mLwWaGTYz6T-KR=6 zf@k~Nyw~P!^alY}U7bb0m<*b=0Z+NlK6Lx0Zew&B=tY?^)>x@mXtvcgPHIK2r^Tnv zcP6KvE~KtI(V&?3%41*o$U;zgEox!;27(Vi%$7mk#0ZwW37!-e*D7EbM@3j~Q-7}n zAT{&-s*^Ms9i)vQ!uX#&n*hTEldXukUlU>NVg(9buR&$eE%6z>E+rc@(Sio3IrJjA znqtkyc;W{wdfjGWRa#Q_M7f$kzVZ_F(QWp#uqTe?BAS<8uNbxh&EC4gO_EPz<82u9 zR(858Q=KCmqU)wh7oBC7$Rzy6meh8B#kSGir$awjK7WtW-Ua3;3~||tXGq%wP>{;C z3PTYX4Qf8)@YGpf{@lA%wH6P@{)?jtPDlo)kCfwDW~@n$DL8U234QKXs1hnQ-4}+% zd-A!hrU5NLncuDm9_^@kr8^ZqC2JG?7#nIlS)dKbHXqjP9YOAqwj}xX&@n*fjv)Jc zP#EeZ=dv8-JqsnhMOWHo&P?QNrrj#ZIS-+|?qr;9$FKh{`=%lrCE`OUIj4*v0<(6V zOt45#oR$*wv2QazO#}24&emUV9`Ei>x4s=erKVtS*raV@&n#MzQ;dw+Tjl&N>5#0N zrdjkl>BG2DtFnL0kGqvfR6rul&5~(g&93)rFd?IITWS4SrBa~Id31{GNCC4Yub9pQ zy&5t7rGwT%$}H-Y*;Uk)2*y#Cb|oDe&bcHd*YeM~(tjJ#m#|;*F%gAaL$9ICq9*Fc z9@j>Rxqcq5-f7Zh0GJ9}D&rCFV}n$5I98iTY`os&@Zz7AG2>aETVP7j!BhM^x=V`YKqus4!ZghhcsFnN-tp-dUexjlGO!G_%taojt5I= zWfYP>b4HWLeEGdCW|90P^rth=MFd3SqvJcrOnn3r=i($%jVz^x?Ou9eUrO*Pl{?)_ zb3|r1_xv(z$$2*5B5k6cF&kMiz#|bba+-K3NHWRL-p4^F)2my+ha=-E%qN8rmYOV9 zoKdU%h|bJ~qV^swnewE^Q!GWlr4>a#78snskTzQi(~ez3aMZEv9Sx-e%KxVKmMaw1 z5w0jkX3Zr<==v)hi-gHhOlyrycKLOUvI#-QAhZQ4vgH^Da%b;`Z6wwj_D-X8W}vKE z@1>Db`eXZQnJSB{9s8{+vPA`otV*jt2?CHGyZl7rn<7$hewK_;X+xX>TqM2_N#Z+Z7%^pE6j2@L+6`G*p4Cnf@yQ9|E#36+oo zg2iSaC8il?G=#bGCF|H?c5lqB`n=3Jd_Tr^wL`b%k$4d2mvAkApJ?69+Kt#pWov)< z-d zQ66&%v}mNK6y@Sd{0~SA*)GLj3@Qes~8{6#2Mt)OdYhu+$=ro;ZG!fu;4&~{@lVal4%T7 zN1^ zOW8t$JX9(SJIg@i;aM(ZbKBL7S-EjvmUzF?$xOCcA;Mge|Gn#G=r6e&c#p)gkEWa| zp~Ztn6RJl>G}lRe+Wu^J<%=Dd$0SN)7C97Kma9~8_&`jy0oMurq6ghlaDoZRTZN_T z>n5DCO~24!RlKIbskpd;NlSqiAISKI(sw@hK*X$B&L)h4nWHC5bp8$O z9bm#zso)6QE)H09*-{py{w$toNvcb>=%`oTl~m43sx(#0z;wr{olyu&<7L}fRysrQm9tON>}EN9Rw~hNDGph?LHI|6@Q?S{X$6+8 zoe?lxrYXhEnC`F&h{$%zCn0GT?zFFb!{;S?e46pDJlqNHDcnJnAO_ z2!c%JVq=m-d=uOmr_Rquk2GT{{C@vJ++ayUq24qZ{1NSMjg&6(iPQ@UdPH@QYm!$F zGW0bT-Gj*6VI*eld3Yg_{H?TH^iCwzcH1aIlbExF&{zrvTB4wz zmGGCqB`2n9YY6|}3Vjst9jyzz&Xjr^UjsL?RpUCfKkm433QM)CeVfSpYePreMQu;)QzGz;|Qv&todf5Xn9$f-Lk}(CRi~WlWFI)Yl zZnK=cI}hNCDB#NJQH^Wtydu z%L)#4YF4%u9exn}HynNC48G3S_~j!D%rg1TGDB$VR&ZBw4OxCvr$eS6xxU&5i_8jK zds-c4%CW6Er|Pee+APqm=%PczF`xSOlz4rs%$n!@TJ;e+^e{Qvoe0N+72}VsWb%n` zd2F~)Vf;>BE!Mo2D^Y$2jAr3}A)>jqSwwFl->=R(&0i)=L+dxQk%;i;p&gyhHQZ#T+A8%R< z^H{gje|UPoeXj&z2_L(jOEJ9znw=u5BqjSnCH;os^PKbd9-kHREG{Ffp%jZGD;Qz4Pjo&@;^V#?;Nw%?C_T|U%TEeN+k=Ncyz@_)m!Qu*8S}$f|o)fz_i@ zAeF^yDk<9ZPa*A0aBGS`r`%hoRNfgzUnp26!vAWUP($7`Oh&@@81i$f)iQ&gPIJ_t zcDMH2{m0KNULr=JME@R*CTo)WMm6tFH3CQTg5f8n`*CjOpm?5)$#=M}TF-Lrwv?)nZ|d}zH!-`Jmq&Ll1I-uJ6Hz%$*;fMJQW%vTFzNCX{b9>6$Xwr$}5w>&+XTtr^ ze>tmRK=4;@sQy9K!JbU+BY_%zix&%SUHp444f|GDUQgRjuHo=Pz^6Y#s6XZ?*!cdo z?>D}TnO(3%33=xz+42}2acjSu^|Ltk!#3fN8I95=45lZ7j4WmaHyVN{KmNstu!!QP zdw9y|vX6-&AH#@lkBai|5C_@I1hwaMqAy2mu%ozZbi(@lHI^EeG4T@sbYd&@mV}q7 z4={~$9s+|o6XJmkXBHPwgUrq~P~G?|Cq`P|w{o4naZGs{b5G1{~`n~ERNv}a~N9%XIg&G zg+C1~@iQSF*I?6`Q*ye;OV)R zl@aO;=mbx0v;Ly7T*gjPf+~ub`alX>Cc-?GuDsE_OB=YLi=zLRtfXy3_()X7Q6S{An9zmUQOY35i1){r*(2{=9rjA1fMoM|#2 zH;bkA{F3$9@jX3GlWE;}XMFlQ{GSLWU8&ob9;f@q_Hi_)Nrds}$n|_j@1x8ekhh)e z8e{x5lD4_96V$)>+LyJ5ZQIfd(0za8!Sun_B)Ab#dC}6doN{EXM4zMmhnF2QCw~Ef zn?!Ah__6VLizTLF`7RyTbLTc(%g+q?X^<+XbDc0FpSFQu8eWAXe}LGL6g}NmU!Fn% z$BZ1vpqTCreNmjf^4V!mXf7&WOf>rwx_l7r9$_*%GB=SIiqBu&KRLku-qQQv!<0Pz zTd|8fot|r}sw|jjH$SnXfKtF*<3~_Y)FnND=PSA1dsBR_JR|mkRMwihoZZG7ULgoP z!*NJ?)I9V+DgSOQ2yht%E{)c^am_E~_=NOvgx0o6gAL8c@J!>pGt z|yE(3ofb3KjX&f&^W4f%wdf89QA49Bgmz**amuiSUj)P zirsYtPl<=@0R&UvLV&<`w<=&V<@h-t&7M{D9q*p0!erhJ_&+QBNWb@J&>Enth1z*_ z_+NcHJY_fh+D2?YLw%r(cJ|0BhekqixN|pJfVEwqY{Fj13QWl=oXtSEBL7=kIwNk% zb<$jrgP127Q@NI8W>L%W>|M{!ARetp^l|CZMzIW?vrdc-vovJ8>2uVu9DQLBm?;PG z!gx6|gx*7Orwk586^#3C0_(kYX4gQFO$5vmTIo0+gwBk-A37J8L}@bohE}@7TmoTR z0Y#dXd*}_Z4)|ZLb_1pPdk46VG4=Mx>vZ-qW&FjURi`%SHkZ;}Bc5yGiRHdH6PB&t z(x=|6420zVMimqH3_U;OD#p&!(0_ZO$TO|$?fjT__=A5v_!0|(a=&olSLnxOR6EjL zp?9b|PYG5xqQAEe7pNJ7RB#O*(sRmyHs#^jec@~3w*RC!Kye!A0BB0>MAkq`;zV_`3!uGO|`b=kvKnXg_~md}XBTf9ifuNUCw7|0E<3 zu5f_|bmf*UwZVfI`vc5uUyXD+Yl!V`25ME*$Dy9;W?KC#0W>bwnVSQ6r4-pVy@mRtiu8S#cb@%aSQ=Q?*%ipG6O~ng9>(CwBGNt4wkjiS=Am^}l|^)rKLcaF z_4r&sD5@Ua0@LQmTK@+_+wsYhVONB8I8xZz;(w9Un455xj&A#HtSGW?DD^)qm~VvW%iTz*37*Qe_6tB&*JX|0XjKTbtM& ze;1>Yyk(+f>p^Yx-IQWQX)SaR)BKn`OiS;xpUU}sBUKc|q)K|eik)hu{KcyB($;6K z?$s8lY}agBch9!UHY}s(ph)d1${BAQX4*lWuuk3#qdy*T`4QpHscTqr-S|?;^OsqZ z7S@QUxzkfx>K0AqY9Qv>JFRvXI*y>amlNP=gcT*iu*oDvYh*ip(d8<*t)>Q=c?B|sh0fh)%Jc!!(}NrntW zw5M~3%^q^PZj0S+HD25etEvMLhXIe|-pE%AhxaUfJrqRqGqTP@$d^>+wKu`M-)%+W z!IKXhyoQVByKSNNWf*u+VGCL zhg4>o$N2PW!ipC9L?R-@IiHcmdV!5Q+=^!-xi8a(;MhcHOp57G&?JMopaQ!Ff-QOU z+#jrxQdw zCVMHU@$_o4BA@&+z$Z%nb~O2!x>=1cgwm>YSAE{Ot1i=w>q(Ssk4|eo`3;6=9)|Ce zPQw05i&;gGSyMMjh-S=XD9KaopwoNid4t!SjEZ#8gQY+yxmKgsPZdS%N4=~V=^~;b zdDY|a>Tnlbd7NjrdqTZiMP?!>eP654v;Xy!j~O*OpO7guE$C7kbU25)h%zW;rb2_% zWS#f8`|rs=s|l}wv>5v@%JLl>qK(mxJrO@gG;9Yts*isruV%|JZ>=q6=5N+hLrI*}fY)#la}x|7V9GPehSuL$ET7y%f$J$K;3e)i`fbhuq4FY5jv+ zEg;0}I^h%1lcXg_>{B97dk^!7MA`Yd5OXeIJOft1lam6qs|Z)SaNr zrj!V3SyLX|#?@et6?0bLEleyr`E_G<@%v(IYeKP<8eew4{5}-Fe)L#FxZ$xP3`yM= zyxZzae}Ru-{pPx_&IVZ6bNppa9`=yME9|>RG3>@7%{r`}IIFr=T_;skH$7UGGaR3J zwA+8JNDZH9WPpUFen3&R!kqY&`au;9(N-zSJ3%RdA-If(%qT&NGy>;ZnWGls#Y&ne z@b84<1-lZYA?5R56k+R%NBTZ+H=tg^G z;;n`isn-NL@EU|i&#S{fS3z#wFKn#=%ZzglUVm&6_dff-W`Ihctk|cr6tYmVufU_f zZ&T_K6x*5V7bpX@b>0(kEk*E5su&$Va>Vs$b?rhg?a|miw!OOEL?aqe{Xz4>4fB%; zchfMd>!*C#n;I?RU}h4SqxXwmH(Dcz{1g;FKQJQ)bt2IMIFM=I*vwo4^&$9bq;9lBRt8khNC~A1WvL(==?W!EM(eRJf)Irw$PH zTb_!fTUuf^zMP*W!j!rBw3M_jWT131i^0But zk@*d9k?arW<9gRej)yziHcu{~5J?sl^$j`G*@xrdeS^rt_wCWpyyAUHctpLyLP%i# z7>c?ntUZfD&a^yfL}MSn(LipI%s?{A->>+V8L~z;6`_k4w==MA{5dKSCVP9=uC}r} zzTRv8J_2C7E3yp#?l*!uOvW~)~yGx|e1i7WpN6cN^P;%z5I)BykjQ=s9Dp1C- zq5+xx_mb+Qp#Z})H0zu5D**lW>h51pAqsMX<@!~eJO1`Wwz$o zU5?lXyVCnxGUOs}b_B}&u71Dw!?O$5W3XS)#KvX1&l25;n*N$?)VFL4o$ZQwaWa)- z$L#aus?4u>D~m$wJJ8Qo3jUGX-7|Y&ABnBZ+M|A~7b>y5Z}qieuys^-0o1Sr%Rf?I z_X;LAwIzj*Lx_~3uLN@ihy|trnUSMqAqtx~ibnsE)^~)$$xx|^KyxCS`j-5xKKbgE zaTpWLjB__EV3Sy(TkdjmxyH}}q_+0(vNn#6>fBdHK{~{Erdc&%yjbx;L)r#IUgkS4 zn~#^Zckrz2&C|ph6?yNkP_Ut7S(v$EdKj zjYsp}ztQ+lPJ-n4+0PX3oam1_zUk&z(OU`F>&;SWrwU<=V?f|*BZ)T{GNx%cxMH0M zO~O_!ac}nPWdbjKSo4dTu!B3mgB@NF-XECDwuW5;J)R2)+hi#Sz5yS;e4W2Urftmt z>;Bi?r)-dC@bm#4vM@c|!|5vqIn}pmo=x zEY-b$4+~Z-T&U@Cp~F7Rq>VOFr39Zdd`p@Zg5R(HI|9!TF|7K9ra9(vA!waLk9emX zZ%{bvx0W`G_96xLD2DFb%6>>hr$-o z_(r#?n5j)6GD`g=3G@BF5%pHe{HW>up^B3`N6 z#5d(XNO#qg{w-6D_4v}3>Z$MRBq)39l=MC>I4rp{W(^IxQK{(7Un3{Lh<9!X=Fay} z2%h_FwI6OaWL33E{PN$v$|}kuRco*xGr_Y8NAHZ9Ry|tc*j+1rP+j*TxZ<9%|4IbE zsopw2S*^6L74K$L-)a}tT%&?g_02IDgd}tNR){(QBJ(?;-#0)!i%@Zg^<%@v9qog; z%nbcg6?^e}9Mgs;ZhT+zG5nIEO%gb4scs~<0jQf&DPT{uaI0I;Mi-X(>x9-w0V#np zd1SMFCRLV{cdk4z{2ona4Kvj4dOzog?NrQ6O7gzKJ(M zSHU`|>dIvzM66h=m!dNPy`HQL%s$J$U9c-fP{p9_`n2Ht#0N{4Ae`Ijx5=fY4y8e& zmj_(c`}=t)n1aOc?|=mpZHj}8XQ>pOtV`f*;8I%AXMHlZrb7y#{7VT9gn=pbkqIUp z{;I>`!0?_zevBQW7f8EFD$$vrEx5Hf>oX3tlSsb-9JW;6(2E^jIhi3X`OhtyI!mJHidS7-!)_J3IT ziPA{f2}$>!I9Clr!TrHA^K2uXXkMM;oB;mR`=JHGQM|}s90*v+wMCy2+2P!H zMmaGk%9d%1=GH}Aw0^*TFBVD_5NZe#oV3BkLvY z*)t+cVdEi}fgcNn0R-=Pu@mDb>Wg4^3fvvA`*X72jrc1oGftUo{7gb^hxG5qTpcV8 z|2MV`cF7M$YFGXzIuAl4{wpK0bX(|EV}N0F;W!xT>mTo4%}^+h!n|d!%4&fwKwL*e zYI?*pWz;-iQCbWXfxY@`SUrBo9XN&$p0Y3-P0p`j57FQ4v-Yf%g*#vh%f^FTq{{Mt zk4)^S%d5K_bIx-#f`UC_sqigEr#+CPfmr$k=Sm#b6?W>|k`GG#9HWsEXiFGlyz#43 zR#09UDA$$@(k2q&4~_8cy0PA}sx?WB-lK3$FPb-8r*XeiFm+HIbr+RP4cU_Jz?ch?tC5hBSblJC@cFEn!(b>*00ovbDQC zsPaF9>WOH+8&v(>pp@=7qjRc;8*=M!zmL94SGv(F9div&rhx}wu35N1zXvD*4sPd< zL-Sg`8tK)aU)h6y%fepbl#Yu)@PF${8{~DBJTgPdr@w`3z?Xhzb?ho5VBDCQoD4(B z{mY_u*unCn>jzGyArbC!JKN=_Rwr^+c;v|ddkWX&FXxCwjbxdAN!zg^Km?_SXqX$Z zChJao`xOezwnc73VP*!Hn*NDU(XxY8oK35$s%}e3KjwBt=lrSivD|sbq|p`^&2HfV zpCSHDoX+`d1mGj3_OW;Qmj_JZteEhNMqQ2O5B)i=^w0NeKl9z7=9M7Bkl6H@%F*Wo zwrL~3r8mv^FBQ3}Ev>0$Ys8Z9v0A(PGOR@wds6h}i6ql%$YNUB_RmH?|?AMc=Y*zox#8_cryi~0ODvHEkFZJW$k#JZRO zY9`TOc+RXELI2!sF)gfv>PQYQJ@ahY1r$6dN745IciQWgHr;!9vw%uQPvV&dE_^>Y zXPafQN#zt{N2$+OMfd_*CSIMJc^BnQ-1iAwCBraX3B>xD?~$7Yn_Sl&&U&^pVU{Q% zsv_fiN=z1%R-N)LYN3LC@7Akd0w z9}X9bloH&YBIsIiKBi(VohgqW`dU(gq!^z%R*{r;z0Xg3XU27zr-yc|Xi8p0i|El$ z7f08n^!+}ws;@h=o&S7i9r=hS-yRjZ%n<{`yIO;Z+^p`{fYkXy4bj>vSJoyYwIvlX z_{W~ZkWC3o*UwU_<;X+b8c(!NZJ_N4hA2b^`wY4Km~}`enQdb-{lsIKt2{F%HLpO3 z6rnfpFKLSIa_!h)kRjY~Xx`moW!u`pI{62iASAMU0w=VmW&+KEf@a;*jPb(2|5Msm zKvmT>?}JD;SGpUdyFoCJPU-IMP7x%P?i8g#I;6Y1yBnmt|M#M=!TWu`wZ8S&<-xgk z&%S$Ro_S{Wxtw#Z7{EHN}ceK&vSdB49u_m zw>JiTP>~GBL{s3^_NYk9Dj+DMYC2s^g|f2XH4P>F(e2Tyid#PFb{W6QYxw-x0?7@n z8kSU0$2DMMYKnGDvJnq`rh795k3^dit8)en7&!y8EqjZM z-ABT7Yhk%k6{;?)@*PspN#=Z3Av7t?4|#!@g&t|mXQ3eT;)YdMNYo3UjPJCuXd{p0 zL4x%jpqwc}>zAq}3J@H}D1N4-q6P9@8(tGcwq?q$a6Y>}D$8v0^Q92a`f=Pb@sp0Z zO%c&`hiBARFE!~_DP6Qo7e_N|oT;m88lXB@487VB9i$MV}`}*eg41PiZ zxop|oIkdW%Ky!=Au@;>8V)$h?3z42DH*6CuZIL<;(o4-KXCEk9(jFptnpdWU?I%ktIuUmGnDO(05r zmv@LOI?BX%vLgMTa?x!eipAJOl&#A4W8uG?sratc^%|dRtR$4hBpp6yNMLIRK37MP zV#i3%xny+-qvUIzd`heNt-7U_KZZT=HUh%pXUQfggSvk65Ucnqn;@ZAWWAJIvIhuG z)=Qkp4oMThbcT3d2Xnu~eUz5hpe3I3N_XgK0ak|@zq@wSW_>ZG`f~lY>hA2yb&|jW z)=7KRq0lMeh;4qn!A4ElJV$x6TpNYK*N;RYs+Vx;J)^MT86PkEatOCgo*(hI5m8;< zYii7bQYmy9+Zp|Fnp$mYkzCx1_-T&7tLm6JyZS&p6BV0`76Wv|O*#im%lAU1!Ov)L z-bv1qZ_k0F*l&?d1Ul%`7e=CPaoW725);8wfi1!}fpqv@S&m#)f#T5g!^1An2;j*h z6#~sX3wGHqN*3d zB^tw)nZtiM>52V;JO>CvO{maplXMz$g?Qe>m1SA1i&rz(YDg79{0F`wEukwi4 zMj`V{SXVNDfQ;CAA1SH(R6{0M4YobgN2Z;kE@p^RA|o2t+kuNLv#_*5HZAHhx*V!e zE}BVf080#4w02QE_@)@tpxct)yg;tw!)3k0;bzU!MI>*seN#}HmykqLzkat^L z6Luj*-d_(|&_946h)+x47g8;8l;WG@qVk5UTTDiTA!vzIdsWm_9iBxV!yxMu>mFGL z@03CZbqP$!>@&M;_rXesnaGK9!p9n0;<{1-8T#73aH2n0v&tLmX*Ue*$Ku`Ck9~a= z`Pjvm_7!tuB6(MkTk3wsPlvN5zgh4~LM{XAlG8YwIr1O`#!2S+OUnsBcg)FkMdI3I zIKW$ZuWG>Vw23uR|5GX%bI}(6US4@k8(Lu{$sd8g5-0n2|u(Whw z=}=fL)Sz@UDj$x1!Em~U3B&WAy8@+>lCSTLDTj?El}veeAA>#?JN4=I;mUp=Y=ZxT^8gYGbACGN9iX??F&C})Pmz7^L2dVfJlaY&CaA0uP z5mIK0i+zPAx`aGS3V@}e0#%AQZy2iXSXZM+7O5DQY?k)OTic>1I|KIN-Nz%?s$f7N_6s3w*c$%AdD+&YhZeb( z^tdx^!XO}uDcpsCQa-;ORxSoLA-yPxbH>4JfTR^T1VagAHxqQ2NVK(Kp-dYqs+fLJ z6m07BoJvxc@*2Hz(JEy|(n$?l^reHk`K0VI>h`U6Eqdn6EljktqrAbqyY3>XDX-gO zP}z1mD)TOP-`F@tbaAztsvBoCc?|3k1Pk=bcPN;JDJpn{o->eI$BX8K4U?7263E>& ze0(oMN=0|i+XaY1A87%!tbL{#2*S%X22G#kbA;K9hX_A%IVH!BxSz;zRK9U0J)vlc z4WmXfYdVNTMF6@WCLxq;%K`6Bf<130ztvMJbI5JHHS35VBY+k{Vx@Apr4w!NbcL6K z)uD#l(4Ygq4=@df$1vcEJp4lX2Px0tz5pnvyr*D}s*-9^lvE;dCAuJl&IALXyFAB{ zJkbbt$|sz-p84z8$ z&Y0`Rl6?1rG!Bo5I6E(Ct-`ZMOfN5vv!BhsQG1cZD(x|{>qjP$%(3pVAVGVVZFrFI zl`js%QkLOE*;F{WXE@?JcI4EJknA_CRgQ1xmSZiLXNLhv69;wx5L(9ZM$FYxLNni# zG#E6O%Z{YayN^R=9&xY5(n7RHI$^`ta*`2(cdp+$4?7rFaUc0t@)S!`@eTqZxR)m(|`Qkps{zp1xOnd?-KfGlyv z&vRtT`pUGdSA(FW8X}yi#aW_IrJ)ic43HvR_P_S;a9#69^BYu^bcIWLZ^z1845;xNMBR#M29@yn@pPf>WgNu zbBk(ImQD3l`4MFh?_Ii;qg{O6;42Hs3?w{L)(^;yvVMwD#v1NqZb^~-xKaB1b_rPC zg3|GhXnB-zJHsECblzK2$ms>K7bVEXz2blsq7jefFPH?@qUYL-Frr}!Tew{WkD(@0 zAQ70OO;{sS9}kSUQvo{+mk4rK*`0wg6O&xCi^=gjmz#q6-OgGcb3K7_iOT6}?vr$g zY7<0bUAzuE6P~$=Fh&^qL_0kk8MI={b%Lt->_o^?0cH(6byXuroBcJ7SW3TkrH2BW0C|r7; z7&aYBIg``AXdd(mCzr!&l6`p<_K=nNXKu#8s|{K`yyt6$qYO)GD&xc9tL4r6-|T53 zV8nfHahG=GRk~+5Lq@AIgM_W3P~#Gg{wrRFrZE@4C3$gn-w;rgCK97m8(UJv&P$U; z(2>es>VN;1ia!B<_Kk0p=Sj2h&$L3qe@qB;6+d%iP5}?H1Ad-jHNJ&)hC-|;x1i)= zq-lQdD<_`amdgX`GQU)-)901Bj^$L&++ptd;dBY)+$Z$zJFn_%?YVo;PNLfzA~x3> z-kdtk!TPe8rXK{yxHG1#XV=4+fFGcmObD=Xw zw-?RH?&_(Ippi^mK8VNVLr;6~GC|(&W?bvecVvieIKWD8(Vy_$fh&IhT zJ4|<$%KDTWdx83z3J*^?+S&@HQ2oFsuCBbH_aD1{bh^m@#zjt-y}Qi}15^ywBh)ce zm?~bcJqAym93lRY!7d`Z#U+B*F7j!e$h^lu@CS79Ju%q3rMC=O%NA{J4P(yE za(Spi&oIVwUnZF-g4+*@JLOrV!GGCC{Gd%QCqL1!tWA&Amlq|8gLUqx?jFuVn9H}g zGPcAKZK<3}V@nE%!>e3DyFItBm}2eTNDnd1cc$ZB|BPP%)zALH{py?gCfa5lA6&tn zg}A4n@tnwp3j~jya-vU*PGmP-S0;%x{Y=th)>M!0t^7u%x|i@jJB3;A4Th_d0ZmZk zsu5$3RP))@28mGYNF`R;I@jQEJY>D}`Vy~Qk0 zw1zNS>lSj=ZggE}HZtQ;HYf_gTHWuF>}PuYPaDgfguV}z?T$rM<I)jxc z&5GsVb)vEyW#4EV9T44xWREGT8}Y&s z5moG90#h0}Y3TACCEBghDv2zd2;9lTY^BK&_kb=aDnsWn^YSvB@2?NJ#ac!7xMB;L zTm4}X4S99$+fwwNiYdB^$_*C638ZpzeDRkcP*W)o=vgd55r|x~lCg>a(41(AJ4YOy zF}iNHj$t+NK!fgCe9{~ReKqzxeb|8o?`F?UK!;>}G*YXbMviMqFtKQTjIWFOvo%$w z%qfk9kG&bUGp%SS|3srz#O5(&9t(lRy8|GEamHlM(Xs=5+`1}4(%kPt(J_a=$>Rh#Ep%KI z7MrDh2*RFJFA|>fAM{6XRJ%aH?EpMXX*Z*C-o*!s1}jUFneTT{=&F3!ZuR zm+B_+7K^=Os4z86Fy}aPqlw^9yz-o3pI-(zPiUUpHa-icjs}zsJCQ)Q0ZRxCmVbdV zZM=PNvILW-o|Ll;nu89^I>YLJR7astP$lSDH$Pr^jvN zlLtr$34dez$k%;HHx18{!}0W$^3QJZ12>GmwK!F`@fRGySeB0_@7PaYMb%v=8noyI zFugWvJJ5p#wLzZI*sbp4xJb?9pvl$7(dF6_M~L0Fq+a&-or=T`#rg=ERa!Tg(LC1u zfJN{1^Tfpr(YF?+M)FKV!@1q>yv=dN8*k+aE4p=JbnbeU%iaL`1rB_IFr8eI*BRk- z0s*cTyl{^|#Tb41ld-KUdFM+sXU7xzW_cJ;VH75=T-DPK59Lg^DG{6|B@O~KnS~e- zM_?n`9XaiV!0lEe$PwS~5WAsdi2Gj3`yXuBsvCT!k}o^`VzlC>)4gi=b&PRK8v#wl zjCTth^g$`oU-f%Ic0mwtAi61yd%_LrS2n~Hpfs`uw9d#|pK~0*WBcuGK7Y`%*qn~Hug9RsG zYGH7h@NWQ~N@Lxk6IB*CbVpC2k+367R<%~UNqN+YsijmM4EGfD10AMGw-LSYXafdS zkxEE1a@(VE`vXB9vqS8*hII?w`O@=FHjG^$b5J95hWHs7EAM?|7t~vA-YWOv2tb^J<;PaM2~j)0t&@T36Fp@| zCq4cKk@ym31|-@{M`T|faVD+&*x*baE#49Z<|$$4)eeCZ4VjaS7X6|pe*7qJEcwv8 zXGQHU$Fs94$`3Q?#+V}pik&8G+gj=dRpGq}?uiR2-iD($>$xls!b{r_D6)NW<#Yv6 z!{i+om&e6GT35k3ehZ@YJT{o)PZV~k92dD~F>$Ay-I~5Sb0()YTTpma)Fq&6nJb2H z;Q@GU(_p#j2almakzUSCcR1ZLkef#i4^R<-ap6zVv4FTQYR`7RS%jvyoSBOn#rlwy z(gsazj-0Yc>dTtd8Z%aa|7^|T1!th}Ux;r===yT>F@K~+i<2yx6VYj3>9K0+UZR*j zI1JGk4(asbU}Il*)2uCxnv;wjWAugGVND);dtWFVrgmR=J~iyNaEVQGE1^y9%%G|; zyU>q-2occ{-6az2(y4%~rSGwL25d#XWr(_Uxjn5?W`-_X?yxs7dz!e;H2+1LQJ>pk z`v$n<9oBY$0M%ONSt1ATcqJbeaYHChJ-M_wFlht-5!XKHE-8VUswmP0o7Bh+O13ys z)siTCgLCz=2=hjhrV+r2A0E+oHNr4<#xu!MsP<)S#$;t0Y;y{3(U2z9+*$5g$ z?KxI#(hG$(q>Z)r*7Q!0kvlS+ z0fGU3KIM2AdPRGIP^5@)$qS!i7vA0%g{|s-{1;Z=D3}|+^UI+!TSR zxpfi42^5 z=V$sEwXZNE+n;{ZStT-ujXHtnGxi0T@2&)7AAFgzVJ)F(lFvycwx_tWrSAJ1@nRLZ zlhE$Cl_e{ci~-pM6zy=Fun9S2yiK=qdO>ZS6OW zUh8baj!tj^gq0c_@plcjufz3cM3t6&Q#~{$ThpL_p5P;g4kO5i73ORX&me(P9g^0n zEoSx9nU}zEv>2V^z8c#{9UGK{mX9dVk5Eh@OZ6P9>uqDk-E}g601?ccW~s(>_rL|J zEy35v>m`}l-ENfR)Do2&JT9=X;SD5p0{Y5{1A1L2+rn3nXE**_$oC8x;?0RX{`gtq zqOcsQ_YEh-O{bSgOkU?#+FLaHFNqP;j5mjP=7BZUUtlih@WeiRTMj@46&`xa_v{G} z(H!^Jdits$%aMY7A2=$3hjC6z8hK%3FM)xw=EEd{ed5lrfFW@#QU>H@b>D2%`%l&P z&O$xQ^C8YuH+ZU3*o^>5fF-&!OL;b@mK$wEGB?r5@9e_Ilz)awA^u?;!ksml@kgIk zTWLeN#WF||^9H*MxCzMzmDYD|h1(YvBxhr`v$4`!Oif0iVYFH^QtpzvIVlQOOp5ipRKa*79M{S*bZC4AygmtP73J{rCP zZIdob#C?=eLB&i#s3_*KHCjXu`Ws}4Z^BKHLGeagdZ~ox#E@K@YCVBJDmZ?e5em%` z4oZNnxE|270HA5|Lc&l}%Sz1ZX9T?_(kgeGHW0v1qf$q4h05eb4s{;pgwI8;-*3 zo32K*SWCgs&+m74ZC2ORL@lk)?&tOjZ3xokDe`~e`SPs2_%&8_BB$}%Wn}l8eixDn z(3l@*n4O`(iFa3@`4{;&t}#7vI$ON0?xc&rCEG8yNblsrrf`f~*k+ZQT&c7UIX5Iu zZ98SC4PZplfm>}!8*?IfeBZKvqf%ESTUCu_@CsvG0SE1S&#woxH4-}z$#h}{s6#{= zma`dUajLR$(>xxjSYjRipapK`A)=1vTD(I>45o?KzK>Sx48$tU9m8`gwaS-FPoZ;t zs*z%yA-xL88OR?U($-b1A?J*TS1$mDSIxXF&08McB=ylE1q^t70ykrgqP05@# z)(WWJS@HCjv&6KuAnCp`>cVeQGC?IEb7+VdIN)`+(8lz}`_YTL`#F0*L)x zh=E0(Xn<5E{ejz}oJqi~(ravTi&)OOX7^;5OKUr12>hQr1q}Shc1|%6_-#OP7?ED+ zKXM(e!axRKwppcyv;i>hcWbEiQZH%?-c6E(Xf-_owVhrr6*zn>`%U-be z-DcWB4LeGbAmibHD2kwtO;Orvpo({ZDA|)cIA^SI;|3=jvPcTG7?}l7b@J9)0l%+K z9YiaQ)p*XJ$P(#>0`Ku%;IZqNeq7hc=zVaX2?#%SnjE9?opkg^l$C2~dfU)9q7m#E zN%oBG3tUj!6GZ@V?^qw~k{7eUU+De>yfckl864N*$oQ~OG8B)|S8pz;dtTx8=7id_ z32u~sQES*tU{_zQx=~y;g99JG6KBuXw9g)I_9Aun_{wRruQFM!byeG`(awU`Z2e;< zCa7hp(kt?KzN}wu-!-B#q;DS)m=k;K7&JN!vy1>@H#}qi2u?&LA+xq`YRpZq8&*Vh z4bneMi=g?I&%MGj{0ZdZL88P)7V+tdP4@b@nlP-f_<+9E7sq|A)gEQaYvL*SD}E*2 zqgS0)`=({}qx>mu6ei`|N!K?DEp1)$?qr*XCYXvMah5BW$6Knkm5d`=a4+J;g7WXO zkRW%b*iVNfG3pyZrO(C|753yvww`ysnH2)m@yDpYC$?XX>^uoZN@Xn(!BW9Ezyp5O z*`qc+Ua+&z*bDZvwM-Rc^)`%cBHT%3=^l0Mu-d=UN$M^YM{`Vmf~&#IrNNq=oJ*$} zU}BQM+f^@j@F{Se&9GNz`LxjaKswvh$yjKC`NK1;=X{II2!gR{zSuB(vQSIBG1{l# zK)^LEs4s9PUiqYJ2xY}^liA@dGIJa#quGi!F0}#A4&09dogJ7YIt4oEFvMXpZgorD zKr)v&=9xr%)EZz=`>BI|)7eZ#PAr9LWmUa~QCZL3!lqaSKCR;S@@*)|=1)Gr&D**IyimR-W9Zl&dM}$;}nu{z!A+>G!%Qr;6EaFVbheT~G;sh;r zP_(6N^O;g9pUxbjIJ0srPC4W(=|5~!~ zgJBh4h`{5eHmZyrrH3pBd+`IR-nr0n8ZX29J_b_RO3 zBenspcw?dsb_T6DeRC)z?Qy>yb_PAD8(U#+Q?GoP{5&zT%BKsz_EC3u0!5lfPX_Z| zs>i36_7TXR#SnNB0h9kTxJSbfUG#3@F^-sJ;chkU&?jPSe$Kd}hqt zNc+4Xi#txTzqjb3wgShs4N9w}@UhlZ+*~e`zG+u%&I>kU&zs3K39NVH3H}yoGb3Yu1ayi!g+H zKN4rvz9*6d>&Pqn-`;kNoHY~=qh`_<>5ao1Ily=14gYP$H_&XqK7H#vn1`T~QJJEB zB~FOgo?-?xS{Af=Sz8Kdd$)G{5WQI12;D>R)KG4~?l~XO#$e(9`ZjPfYG(2b+H9@} zZ|=I~U}0wQ=uRf*4C&Xv1%oF0vqzAoC36&2Q)fRJb+rP%9Y|q5P#nG_uK#S z+17dTgH`kWwd(%=d({u$PA~?a@?>hq1w^;Y4T{$Jh?XbqEu2OfTSzg2j2Ney`KmVfMStqc|h z%0CipY1zcuLi2ZaF3r@r$_Ck9k$|#5xyHqjbE){{?uT1uCp|Z^|couPnS52CX!l6 z{<$WQ{3GWL4sy7JAE<)lpVqvw4gSXU=ZD_Q_kP%==g*I~?dc8pMF>iGKq^zh`;j`z zH70#b9F)J92Iv-${DVtCOVWL?B#@hIf4b>EsFE-JV9|SX9_j++-{!PGFb5?6HmCA$ zb9P1O`g#L?ASQ?Fe^LzwPW2NJxodd9wf_;gd-**{ z3BUtS0OjA-P(HBc@3{U;RkVdA(b+b5{R0r;@Ua6Nqt8A#TlG0}cHX6aS|w7jUYd zG*A$4+x16U0X+|r?`w{o@= zo(IYI?6bMMbd6aSMcC|mD4FAxuN{gGB69tO(y>@zgmiuuNt z{tv*Q1(7CU01v;csa$yA384Jjn#Kp#{1w-KseXFF`%k3DF61vy9b^C%D>Hl zd|(b=b}KMrL2U~N6aSMcaH`)t4F5-3fjkeCf3Qz=kmDO$hyM#r-~aF-sE&aK|H{Ze zH9<@Lo5JxQSQCtP@U!~_g)aDSM;NyM;U$ppCzwk9%sG(o-y!@zt(WH?KY(fqQ248p z051O@EM4Vrx&HC)znJOt4-bO;037_A-T%}CIsfl=Ao+nCqyn6N?z?~?H|&4lhd(o} z;ZKJCn-2fa^`;m$%ZnUd`hB#oF~n#d<};NpAP3fwQ|^Z4H)%mGz-Z>CN4u zg{9%m;?C-t&CR0QiHZA7^M!%!#p3K>uYlwHxjKj2`iimRvCet#sSw{`vt@bA>frV+ zSr3M=_Br=nUGfQKY64*rQvKRa!K}#bIr3}G>s5y`-l^*=lZ)?87sI0`hieAks+Ygy zZg-!Ytgg-X2UpxJ>`kZ8Yt*|t)XeVcIN?>~9<6&`t^rT5kFNE5x>Z~paWGuo-JEu6 z)VUuXDC{|It5=?6T5Y$tAGW1*SbJ!fC^nN6@YhCPA9_#U;=ws>1@-sWZr7c5O7Tna zq)*?mrQB>@ll4z$-a34P(@fT!cUGIuy&6s-oUPHkJFhqz-8o!_b@x0dILY)}M~+F! zKivxH^SrcM%pYq$x!&DtUMW}uuuOVb)zw}L%x-yJiEH$iD>`wg4NTKiR?l1S-ujZd zCzsfi-SlhD=X~(Sk?|^yCrcAGczE>CyT-4e+N3Q4aCIQ8a(fLib31V?{LQXhfacnoK53`F z!{dXP;Z;N`;pvd`rK&pjva1?<$Wb7ROQ~YwAZhK=2ZBpcYq`q>mQHtPvCbRw$vc7kcIGDjt6S|t~(!>2qyTrZI zBHIHJZ|8QihB$ZjWr+!&C3!$W=3u7me9$+BtF}-?n zn!EV^RHt?>k|EixX0e{0qe4-*IcW8;*}&1SKe%9QJYoB&yLX@2h2O4Oli{vprWW8S z;5P0#)?D%R`{?R^7x!-Fja$)`re6i&(apEI+xA_S-Ss=fl_G(~=lP726ly}af zfn>G+6y9Ddxz0;Z4Hz_9n7he-O(N%%Mvn01z58&pR55!ZY(q#Dy;u(Wc*Cj-mi?F6 zAj)XWwpxE-@4&S}up>2MFu#MbBcsq_G#>+56v#9c(URy<2a zo;1TOix7Wd| z3SZP$%0nDymdmEsl|~sO1B1^x*<>&RN+$e@PP}wW+hJo1$!I?`^&@y0l)go$GGO*se#M@t!u+A92+U?`#2ISXJFmRos2?f-A%LWlrNctH39|kSPpciy3V-OCh}m ze*qULFE7(Xje0Uf8DQMuMVE*}llgf&A~Ei>#u$z~$$M~ZNi^lQZsqoaMUM{YHUDMhzObW8ck=1GEE92Ykz8KUcnwqsrXv|6_xSl z%Z3Z~X7F7(3Y)`_Cv_iYeXTUhQYUD-L_5hPCJO40`y>krpDsVI_eK^%Q&Sg&MUO0T z6i7WI-n*WqTn=UPhcMwYA9cZbEAXtV#)i+{rWPi^Ej#uwo0T;r0>$~UE-vocjIbOE zkLLLVY~1`1Vm4%>K>$AHXvCw_ZocSJaV*()Q{W6C{P{w*gNm95@qRt^!w`B&WqL`F z3**PtF}W=5qlBsXZ(`65Z$G2OZ_>Ap6h&t6CkuT#=pJd8>)TTN#TY!#Ur!fenf+|-{z_ z>}6v}ys<$*Gr&xu@(j$HFg`lJCV@^*BMt%~sRAL1!@UylnTp`bhzog8=jfY`>|HkZpMSUE^eyjzbr*=8(ZU%=QgR2_hM!#HZ z8eB`rFCE2_3hRf!=P1c2KdM$fQxX>CDx}UpPT}lESnx2Ue)UZ{G9|zCpD7?x*B>viUmYJhDgjv&t25 zs_Gld&Uk0>WqI91q_xZ9r&p;s$A_O6;-}$6o@5q}Ni&YWjq@8A%ZUs#60xp6SLC_+ z5W_Tfd*Q}3g<3tug49Wy(MSzu`FT@A&@FoUTVK#xJ||%Lvj-QAM~vOTWF1#Ekp`}E zgMTcX2a5m~3~@g;=UT(2YQDX(M~|XM`~h|z)T9DcfiE*IfH}B0_Hr^=y_zeS9XV}X zC4U>K$7}Y?B8JNEV}}5?r4$uirbAk8-~r6!k;NjLlAEv=mAbjjuA zCJwJW8Oo>b00i->#E-|>*Wwgik`iYoxxibKH%5rPezJgw^r~um2B()brN`sSh=y^lm$!=>-(%P)%Vxqs-}O3mgu>sWBG0eStoT zW5rs(Aeg8tn)1HY6H}ke+`_SBV1)g|mIxp#uD=wnin-Wt8WmTg)u2)vRBEE6piYyb zw>=U?%0@^#vfu+dEYe}xlRU=j5Ju~%*^b~Taq!Me&$)!NZ`!x_N<^r_Q@Z$r5G}`L zCTXyrM{4HRrO4|ABb{DU*eufmPJKQ4E?z~uo%#_ejeXy!#wl9hr8qa#8h{25`0sg= zCDqnv+~}5lX!^!}-n?>POxfJ=Ht(M05pG8r#EfhK&-Apg8%G z=d-SCg__IPbOLK}<;*(Ld3=gCzL#L+37$~};Q|5-lTi-Yhd!@{^32YY+L1+s44LVE zvDy|%bue7D5BP$|txkDiVJaW?ZgzLaR_XIu6>KeI_fLrdtI(s8E`Cvs(#J1?1U^>H0rU^jFQZp|KefEHHVk8*& zc!|8MzF8c}Z#m0NhejhWV7N32)=$i*pJ$9u^PNAfQjk}WndO6u*vORKAE%|q93GP< z2!0pr!RSbEb81_4)P1aqi9hSwCC|q@<@wn8{9sU|&4EBlUEAG z=iIGJhJ$>e+wi!R?#9CkRto1ZM<*Xbsx12*ta5Uq3BWB zJ)`wmj2B-5{8P+*ClHJ1y9VHF~hg!&Ra3N$<6 zPCqc&Bi17#v3?BGX(?;LSmVq90ObQpXc*KP8tN=}4 zQ#`xn5mVko;d6iZZvpFH;#$IVTaHgZPBai1p^5=7i=it(X8q)VXFHv4*2dVPHmSh& z6|C5lS}WQ5v(i&Gv1fFttf2!Z6DYK6N8}xJ%@$)7; zv9vV3Z&Jf8O{W=A+Uf%-AGw!tACx;F7HOB7A$~B=BX?HT+s4BmBqUARE=}OL?=q8>WzCe>F7aZZptzp57ftW)f|@MFSguB{uyQwsMNQm-=;un7O(xq+_`W z8|fNM!|JoN#7&&qr=gzPOR0`13$N+uhuY^3GGpKV7YS&oQ2pWgKWv%b_#X6;E9hZ zL6#ZY;5~VN$?p8}93ge>lS;9s4C*%?$^G8Ra>0`AYFLXj0FR4QI~!B2dj(oft&o&; zJc>q;HZxpafRsf5@#2`yCrMb`e3ku(?MZ=r!{>6kl#fhUiI&8Yb4jl@KYgfkUMwja3~HuR;yKz;-w7w1Pne}MPTu-*f?HCzJDn-S$z0h$e%u=(ca ztXzv33&6zJp2)2onkwnkAd9rzeTj}M0`YK4lh!2stR1|7!3{6jN#<%EuqZm5 zmtOXqJsf2xuMY6sAta+}O;DB?YrN)J^rFAVeU8Pu6)Lr#jXEz}?OtfmY}hZa%ftvv zr;4-;m4p2<*Y>y@6_Q0cutqe!Kle4cx6OOq{C|TteGylQ5C~o^VE+OD+N%28(!x&P!cJ4(*-GD59R%Q3`EJQ(MwIKQ zj`61sn_dtmE~#p%&>jtB32lLzhZbU&XJ%+Bu<|N7MAiZ5d*6GU+7Ay;P{2$2ltbPd z`7e3PDzPuHcA+%drXzJ4FU^;}k%{>__fDl}{VWF|xj{~n&rgYNTzWex{d@MZIcp;( ziPy_8zTgIpTomqCrlJyRimsaOa-9O`WR6H!X5uZ_5HB+NL=n;n(StuSxW4X`4>h;@ zY`BA!!JQk5gdwf5#<|QqQbwH$x7ueN)DrtlaRMx~#D*+MJ&b~Y`NMp5ClpkCP$0r= z8cLX)m{s*0Q*<3qi1_1xo~Y-^WO1&Cu&Git@3tzIco)w?r-%Xa&CKpSnzsB0^Co%+ zDX->)jP5R*&T{Rh&LhCtcxiKi*a3g^1mX$McQ9ZZR@3s(f)YAjK&c4$4+Z$|pFeMb zUIqixv(%Ngv9z*f(6+JyIrpLV)Vls99B3pEd#L}Y0)M^*FZfei*V0D+KdCojqSS>$ zfq}IV{RrnjGrR@g08R>ICOad2bNwGjrvEfSObM|Sgf$qL3k}5m*8A54Ub!&8sLj?$ zU*FD_;r_>eoaNyL{`V{^&i`?i`|bQgUp(xqf6W3O;c-99?=JhH>cismTQ%GJuTu0- z@gbT2Rt)#~weo+c{h{(h;`pts>wB;KUufjvJP(ud_dHU5|1m|S#UOz}2Lpox{`CPO JC&eEm{XhQZoS6Us diff --git a/spreadsheet/macrofree/security_checklist.ja.xlsx b/spreadsheet/macrofree/security_checklist.ja.xlsx index 1ca90ad44b65a193aa84c3a310366c89a8eee5ee..87f0b92a9e934a1b3576fcc4100e14f05fe59322 100644 GIT binary patch literal 36987 zcmZ5{1905!7jA6ZNn_hi8rx`t#`d~@k3`;(W*VE|=Lc5^;*Lx&Zs~an<)1&X8mKozI&CBl zTS13C#kS0}9m;+xT?;I+Yy?F8z(Xz~CITNQuvzjCVL{*?-*q#XE7y&hJjr1QIX8AG zko*4Yhq<$%qM(MO6SZ*GY4RhzLSGN-lct=M2{xKlDDlJWq!@v#T|04)%fBgTCjcSW zNFlXS5yrixuf2+9<1$6deXVJ)Vda<9Trns%Y0Ojpgb$bD?1&M;!O)0v3PL4KJ_}#q zl+(#F<4;R++tziyF*6oBde7^_@y490Wyk`H)8FKEN>|IBX=QzAK%NAv8p~$189XKl zGC?OY@HPOJ9Xe{4xWEHM?>YH53~!GRH_pqAnwEM4D0ZuMeD@Z0yC!wuIh_7VuO`5B zt(^7|149WdnrpiGD~(s=0^_I85_aZ0E=$K6vQCe1CME?|l*A*QTJSTU_H;ptCdCuP zzGo?1qCENEpiuZIL=m#Wkz7(z8-jfYBy2Q|U1q=XSkT>3ul7@u3E*G<8dT~ZLJ_1w zUtzWj&|m}ic-sASymwR@>nG%My?=XEd(*~sV4G*2lgY3po^ov@1l7sbfztvyS>9aR&M+Lf0*P zD*fAM3w{y_c+_fX&myKfQ7$PM-}Dohz)H-uvrVoqQ77{)SMd?SHUVV{6eSV3wS`&* zN@F-7?2+pttkd!QX^#3Vt#RAOs3qgS5$aHQ(**?8e{X(AD0F*a%>GWBAj`V=$qmIw z+c-123nT=c!3+&j`%IqYJBs+AVB!}vxs6ZK#IODZI&NE3S~+%Kw}KFgkmL5H$6daH zvAGB-9HSUyUsEC{pRMkT;S*N77X{xV4Pp=$f({OLW%BZ8G7B7k1vO5_*D}leDiys@ zL~HD$F!v+6SkA%&HjKDeAnCYNiKQO|(H&==$s4jT-~7aWCzv5Ld` ziYFlr4iB%V`joaR6Gp4_SdFo&QEa-G6siTZ!|rQbG#TXmq+P;zEJ3jQw>mkFQ?94RbL)(Qz`3gTfj!s^(v8#8$iSgG>3Jo#?^dNKx{9)@*J-SJFg^zP6r2kKPW%H(9UvBjZs;yD!M$)-%h zi1ydn!7^;p*53ndpQ~3cUOh12&)S zjBSfdY%et{Oys%sIpb@CV(E?Si?jFMuAolRs-`#A7y9a;YBlbzR;H9|rgKEF6b~&L zm(v5!N|mzI%#FY~+XXn6+F9C0I=!Y18!y}HO&?=CNt$Jg6oJy&a!gwBDLQUUzI^>k z>>RC}%uP(3 zotXZ<{mo-%T|NzKoGIro>T1WlPP3(OE99F}jUA<9SFWU`$zfdQ$2DJ7OG|{&Ru_%! zEMkjnT8`%Q{mH2V`_V`uHyxfQg?wko0!V21zkv8z?Zgr{cj(_=B=L^FUD@}nydPJ( zg%0cy+uGhQ@ZFI-Y*`a8NYGUR&P9lB{oLHRUWT$0TyFA1U+}ZYUk^oUxb%Ui#F)Z?_9yZ)7Tp0dqUPUCLk9g#`GAH-_vMfcFEr-7-D(Os}2YUT)@ktxror zf}?zQ8ia2EWk2EfhZ3tN{dcWe;(61aOeCRxcEPUw$`z3myM?X_qzYT4hpjchz?#hF>G|Qvc8^fHQ@5QydusW*tsjeg zcey;l+hS%xO*Pde}vdK81|oo{?FxIQn&{i`DHtPFA8<>qQ^V8-iTJlmnJj)(gB5 zMZEAH!UC($S?jagl5;oM{o=IV_UJyftDpyTk;!nm++fh zMm^cbBTK3})3`5?@`^qAsm_DG(sPM+T0bX#Y}MVOpVOaT&{KJMA#qh7vrD+rAz$mi zx32l70Wzj=ocdog_h{~7in|(E?L5o3n(S&Td_B5Ygi!2|`50$+Wn%04?IFii4|-C#OLGu`KlhdKawLeKA0UwXB4~fO1}$K5nLfd9 zpWD3JxtO`Icr(LwB=o$L-92o{_+ z_Ki;9asIrdM|gq?)<&TofT}Q8V|$hY$K$T(E!rLR&LqI5%>?cD06gP@xy ztK_hO92M5iHloc?P%`kD%MKF#mshMoivGP{Yg?P9W6RT_fi9r=1#ogH-{jL8Pnp)f z;+Bf34lp4E5^t1)uM+Q{=XvY*a!p=A6Tal1UP<@fVoPZ`gE`YimEg*2$G~VOhoP0n zmDxwDNl1@siyNyyBMe!%KH?+8%1Tl52eO@ukGEp0M!g7=Ek(V2n>!i;TL0+E?3(X6 zAVxm56tW8ScyV1s#Nd0aCagOg6PoT=8W_mA?5)GzXgf+@Qy!dJ4e&oBad+r0)9x1fqtRfEt?1{!MMEOQL4k@3b+)j z1R$v&z8HquF(9Lh?9t64U6-~{d@4>R31Jo6cE;Ird5ldx;)uf8- z^*&|H!NICHs+oFZXtFAI76?k(uMvI$E29@FzND$4D^jkBQ`m(I(5P_?SthEnMm8JL z4j?koc3Q?T+dwYP#@z0F`Oz%c$GcVMYXB_Dl;7WoOb8j+Mf6o*+3C9`3dx32)n%Nuc<|(R7bG$b?6un2HOsU&8Q4%0@G2>J zDvuaTol;32@zUdT)1&H#m^1fBEVZWv=o`6NEy}2$v|Cye(2gDvxQx<|srAtP8Nzu!C>d>$cG5SO_oSQ0Q#;*^hl|F4uS< z+m@Ip7wJTQe_$`tH2e2}r>dRMqfKxir>F>iKvIZ$US-0rdJ2q)QonS>EmsOjzS?)O z2|7J=1^fQ4|78Bt8Wqcg%o+_J_CxDvh*jUa!@~u@xEZBxa2&;iOw4^;upZYTF83kX zq>$(M=dF&&LH_vUZrthJ6xL?0=V!Nny+H10S}nBH^~haq_i-3x03Txb1EpXa z1Dm#tIBIhJ;-1EVl&R>aD#u9=2^AHVi&m5E){y@UN7%w|xqdA@Xp@&*IcQU7gMOEp z>muN2LvJg&JyNK>^Ye{eXwuPCzl$>#*7TO}gq zMv`*lD8`6NjCA@7wi36w_&+*nB#CP)bB1F=erX$x2(-~R6K|+3$(L6EjwKu(@>QP; zjf6fYXB@syZA;?*mPBpg=9L*Oxup0@1Tb$JaG#Gq*bn-GekP}xl`Ez*-o_F`@4u^p zIw~vSm7*P+tz*#B9~IXB=W%z%)b$+M5H^TSj>$}rtG-VUEjCUx%%ZvlAuftph zASYO#gU7n?#0L2SMG!c=Sx8AEXoS`3B5#}>G46VD78jThy&{@39qHUS5{U0-BJnnr z5w9y~V5$N~NfAjZQzSk^Da|zGs!8I@#GcTWVp33Wc}KXZ1&!1G7uL?pVss-1;Xd8 z!gT0hucyb>T*R8G9j}w-fI@i|Grjqo=R5;1VeiJKdl%WUWmUVnj^G5W z#b3(;@%Io_0Zr)eRAKE1H?oO`plBuR#G9=B;ti`18>}~e9j(EkEg6yIc0FYnX_I%z zzc<9K`6dSXktvK&WMc3X0!kO%;c#%zb_w(m$y&tal)5&{PwF;&I^$zw50&qPGW<4b z=`7+h?lBt|dtlu7Jd}P9JYOQ+0h%z_@O;1dQMM0|xI~GZ;HY773lnN4qnUK=mKE`c zB#l5E$f@(T4?v_oTTSBL1C_qT@j@m4B{VQUtRUu!eBPl9^M<+X4$%hQ6gcR;FjqvO zaf`704v%Who)rF@$k}`Rhu>*Wi21llZw-v+;KPr5^7V8Tvjo>_N~(c}gTNNb6jwHx zumGZ(yDSdeIG&hR%o!`eBfM}f{5XNZ#D<}Xcg$7IwT-aI6&s*%)Ee{+QjJp|}?OW;I4aY%4tF_)eC zA^I&=S5#J)x}6Cj-qpuaBtL0p9M;R*ATA)$#f~ql&2L%g?x3CyBo}K2QAEns5l*ii zH^|xP@zhZSh70ll!POYPFRgAe#$EEQ2MCJ!ljRI?goZ z8)Y5R3N?pde;fwtof4FNseR?r23k^D=C!))Z-dcpXbL z128vt2y+m>$h@8U7r(J6I^s9A%@9CPKh{i4x6+_bdaOY5IIXXgdKl!iN{&kq%U#bT z)OqMe?;d4LZj!az2r39J_C~R9 zA{%?1U^6G|W=lm1J+W?X(6reDOo@nQLGZcle`(-ZZFyQV{4(Ia;$wdh?Jy(+{fQ0y z)BUAxNAGxv|8if=qyza+U!?^;RhoT^LLVz*OK4Xoo$ZHUACqVzyXOUXzSca4yFoyL zku}K}5-ohCFjd*nOcZnSu`m$0*Wp z<%*o%t1MX&UY@_wT5kxRz*|kwT1ms4`Fdl1EqHbjwEkS#N^Uh`k3P49z%Wxq60*5` z=uP|4{hnVQx&7#OO8D_6v!|5zxFeQkh6VNw8q|0WS-1BklU~DWA0(~-&$()=q~fp> zmt;M3&{^<6g9`uW2Gg2^CZ|A*7UWuw(O0?(bYrA#8dhlLG#>xjNdo^Pp(cG8()@Ha$|di#r!dZKzbP`ul8X< z_U6rjlS3~}SLu5gt8+ud%)?KAoQeCrzQ&5eDcn3K-Qx#s{PbtYWK5dMBpHe}zZI1I z*MBtLAdk2iO0<8=*Z2Z*iN#2APdgv@Mrv9F`gS`#IP^5v8=GYZJhKx*%1K8PD7GHq zm_;+4h;6xx)HWogOUNjo?1}X-_ryO3G@_1;TPgR&QLqQ=OX}R!rOL%8`1d72c)Q31 zQmL(!L#x*!R^GoI`xd&^>ulk>X;*XIc{;U7Uifr;diC#n1^Z)JUr;mJ+7NQ73OKTi zLpWFqXBUx6|xrl8Xzf^l_-v>fWl5OKqJxYYy>y zun%g+jO)SBe{C8&!*^k(0{{t%y*w5+FmFk?t`)uxdd70DAxkzl+3qafZvaDO!-?$b z-VAornX0#;5lXoIKg_K{0HNs2E-h=!%`QeKP>O1ySC~+0QBqn4_4(!*Ds2~pR#u6| zJECJpT`dAUo&49Q`BCg0{2hf8Y4KSF%j@p6Vqh^bgCU6GCjj~HjKu8zR7PFB*tUS4 zkUH8!qM>%$bW&-5e`&D&6Y_vfNKM7eFB!VY`@pwBJnQm%=-XDdbcp0@f%(?}e=VUh zdMS|8mRAN=48j8L0jXKJyiPgo6j^H$-dr9ulvC*cvLVM1bycoh;9cmKC)RNm=ZcoK zmWCGS@*ZfZlg$@y z^=hiCq@AQc%zQ;o3LY#nyzmK!GC}UBRP)}xVIS=`q(Ty(g}AC?!nKqRP-)$t@oT`C zf@?vFsq+zF;!?vO>+=y#8#f87>lSBeHW}1+{(1b5;9m^XI6+{UX8>>`#puMfx`VyX zpFmVv1iVz;37y&xLl??%@|z>X1+|8;m`sJbfN$v7QH%_yh;q}ylLFo}q@5;k-Gpbm zSvnIfJ^B|&imO!ZBNG$P%0sFh52mJ0H;-zYwRA=L2`*i#FI{fUH{bn(`9NXaDzj`W z#K402su2guY1K3bOS>p( z2mXoanUSOm(*EQ*(}#xU_jJ~_A2#7U67d|Yd-`E|Gy}D*c8#N6UV7U;UZNRg(hBTZ9OYKNbc#8!X<9Z`a+Nob=s-=u2g?ce_v? zU@m`M(8iLS4p_e>DZ;$zy17?Kf@6pIyODeXGm+;rT@*`!7<7z@UdnLQm;Gd8>5S@5 zLAb!Hf00BG4{|UO0ehY#!P)ymXXxA#Hql&{E^5J%s%eEqpwrnJP< zwsO-5{SRr!%vSgM>BXaLWb94vgLOs(kv^4+e0=+vM1PuIo4QITM~+qj&Jq^bfOFTi z(jkG>ZZ6kiL3dr)q83;wyP(lPh~I#ug9z%+Qm`tYBCJA!NojVgNLiji3@w; ztNqu+Cl~y-LCbTaaxU(T7p=i~d#uv#vHjkm?TE(2c!v$mc(DRW=<({cHtVkHc)k1n z%%&-^-p@Sbaqrhocx7FY$Kb>5S?goTI-d9jBzX&h*ZH~M<&H=L7W*#$(+M5q*cgr^ z+h3Ts4NoffCug7IEyT}x5fc%xwDzB-xeUq$UuF@G`;rRL=HQBHrW`ePl8xU=OG!$Q z{)=N)naXLr;b7xbKPEo3YsP(Z&y*Wn`PqCt7_yYF4?!g#O_V?mBwv$93vLGDUbJ{e z1S4|I<80>416uC#6Gic&QQ;Emu=n~2fTEy$U)v&buZ%5T8JwT z%IY1N=vJq-gz;oWAqycf7H`7cFxvNZ>;w{}=`c1B}V~X%xKYB)TbI%tl0jm13`@7$x2_L@BG3dSdd^;&^ z2ug%O-FBk>`P74?dn#+lz$-5ECu?=_QW#hZ7rqxxyw!|diaxCIX5;Xghh(rT_;LV6l&5DadR)|ejqAk(fW0MzrYyaN`98j#7ZW=^WC?5zBb8FWk zG}XQ6_n1@C9r1Me&hOIZS#zRiIuuVi-jk=gukWv$JvaOsspwiH;922jw)d$8KIT(E zI`*IFZZ4&wf1Plut>0y68mSv%tV=`ADl%GCg&_2sgPi#W?4N7L6|gdygLvgm$AL-m z+DR$D5G*Gl-S^|WMvdvXjG1gcH9kb&QQ8pWJjOjM^%)mkvgz$=-u68KgE z{;znx6EoqRHXCz>Aw2H96WeEz6L^k3Z7keEdTaf0VencN?{e_kQLsV2)32~QC~brk zGZef*n$|)IYxCQgF}uqGS*tUmy|X9aSLLOL4$2St_*0QS9b{gQnxTVcSW{0W=DDE2 zbRzb+V*?g5V;sSTc-@$va7Mx5731f7P&+rPlxfHRJmiBz=|s0HtOBBv?ag?hOE$Hm zAvmQ@+)!pjfxfH1a3LZK<&k65yEA{)wX_ILY;z$;9nV7l(k%)9-3&JIQs#saBC&{; zuN3(6^ztq??73uk2c(0$H1WtjtEqO&MXY{luvZQV&eYL=G!TlFhu$O#;nobs*n-oR zvaG*p6hj*E=BSB`>80YIElPy8{l+vz|@X}!b7o*wj?<(7J4<%H1E3ovnYi@Bd|OQBzASB;m(BWS)Z8ujVg7#_VkC~1ajEsbeS!pdZ z(!{oPS^cHXBkk=XPwJ|E_||nh$Y~k{q$?#WoMi&O1q9)N>rccSEe!<>rFShM^|8lX z0wTjsOQg2`+M(2r-}Yi@L9$WxK5W-PhAEH8Z{XTB=H!AwH#L%H3?bnX8q8z{kz9taq|QZCyI%r~?rRpX3mXtu_ut1SX*!hG*R*o^cPQlvT+EhcX67dq z^hJ>gpkQIwS=(JF@l;c`c@&}>4-T0rX>@e@th`Y~-+5ov!qtpfa~ngq7^ z-JDtB^JmFtdI@aqLlS=c>c!>0?A95Dp3a+*b7s9?r}u088{*|IupJlXEngFd*REC4 z++d-8GSV5GGNx9Iq&EgN(_=P4T#8va9zD=y|Lm=82d@(vq9j%gd-o%JE0KJ>#h`)v zsM~H&FhYhlp1W4w#Qm;Q--H&Ero33wd_g{}C?zDNNx&vR8K*M7?HVpdI)q`tw)ntB z;iCPrblQ6h{vWsmil)lP&}S>N$fA>7Hk<|oFM!NRax05KH!M~Fn*8D z1K^4B0p~%wSq&pIz)*mx&+_^7ZlH z22n}m1%oCPrSY3o$q2^x|5~jfYmA1eoahx~!sCXhm9mDHG1YR{=hNc*h8CM7!I$R) z{mr*cU7w!YAH_fcp_+&eMGB*xH9^MT$m>;Q2k!p9t%U95sX$dCy2cm%oJ#g}a=G#q z11il*7Y@3+X?06Bul2LNee@p54(MzM0-ukAhX>ezmv?@ z)3NG<;HBT$M7Kva4DlT)=6&%=ZHetygTH~Mn1HH;Re=yARE`HQzHSZ?L$FLz7SNB1 z*ysEwL}Tr|#QEYHlzPXDKj($dSAtFlzTHRcw44u+zfZkjmnQ^YMHSF;U@p+m#eWlh z(UedtIiWvTCcY0ihW+Q0Z>78cO-5cEF9M-?aqfrH^rPW&fMs zE5Z#lRNzZq{Wnnip85E042$n-CKYGX-XTT17z-{MwRIv7vUUK+zcPQPN#D^R&l}9Z zA3jUs&B5pe!8Bey6UUbH1E6(5iNCUw z)inxc^?Gc8@1G2`koOCeY@htmVnN5J!LK!^)0#LssBl3+uxwDmRc6r@-@t8dEYq@M z1!u_5&T@;O8KB_3sRU&Vz#U%wC_N#yyhd-5ShNddigfs5W6X?6$yHqRl)qFu=I6)CsA{bs6vvIBdCrE*(0 zin)@8+W8}dU`gkPe$GaAWP9aGD1MW^f#N2K`g0BB52}zo1}6)kGoe8Jl|ZUIhOuxE zG2hhP@H}?dgo`5azkVg18Yf!-KZ=M~rD`Jh(Gl3@N)GR~zuFWtugi|htK8Df=SQ2r zT?RU~20G1jq|-s;;hc3Rooo_26t1Xa-7qnP{K_j4aM%!BeDvTX7Rtky7iJ1M_c0e zX|?>ABYQs_?i;&$d<1U2Q|WbZ>Vf}wx=bbS-z(`o{EOi7E3`W4)1!M&jWJ)x8ExTu z7I*@V)W9E@%-!J$KYix;oo17qucH*Gq4Pdz@^M$zcWO+6i2PrDd1|c8&hN#EC+J+n zG%zBXI>5a`Y&u!@u=t7_>dM`ek2PatcJHPRrF{28^9^|5Ho%}M=<#dgasKSUfqbGn z6K z=6UAy8_D4ZqFBA_41pmC_WtJKkO}n~hz@ZTovfV!OMSxQg#W6Ez5-^qd+Ri>-%|SD zgF+Z38-sZG9NylS`-E}$Uwy*t>uA2&f4Gb*2ZCTgP=FG58NC(=Tnjq}>u^B2ys4C0 zxoBX00;@9aZtur;V*G16_P+7M!5vLOg@nf3igRmSIhZf{=T+X01>HldbeiCqrNO)7aR?Y!efW_g5*OXcPq<@Ilsi>$upU z%Yl~21z#r0j~G)p&|(2s^Sfa`;h_&|-m zlv8c&{>k-W=^j}wy(7>zS0!yNNIB>eB?jX%IKpa{aN}Y?s49gR zX;A=e=Onlz;GYjpqW@~TG22`HESd4s18fL~JC-9mJ$o=@)@}XdONph0<}hUoqjkd&wk_MvLlDuuy!!3OP9CicxOn~vRE7gMX`N~mh4Qk*B&nUy z!3|eJCy;!HKi6DVNXpaPew^m~&PCGWpX{Roco2@XMD)#%zG=^9wdYgk0qpnEY>-&j zb|NuY-b%kUe-PqnVf^0VHxiWB3*^GPZ`>)OCEk@t^7%}t5(Tt_t&;X7$fPb!%1nDj zTwe}KbzKa25)wRlO41@L$9$q&Sr9kZzpnLO(}_z=!7(9|la)|_o^ zdmL=utL_$k^tOKfGpO1^ye!U0E#k=@Ur?2e9X|9OCRL@4k2vvaS+RD?q}bursCwsF zN^580j5NDSP}C%1(g)tyEKU)hAB7@s1)w>OC@irLE5}cu>b`9y=8>}ccYTE?i%~t1 z8@-4`Xn|$~OEAEaG6#?Y7uDsfUSO|v_%6ukldVcUp0ZMGJ zxmg>5b!RB{X@1ljHHV6V-s{RLMzG1}VBtP}xx-oO%5zfB2A-d|`SoO>|p zJy++iMZDTNx3=c*T!mz~Zy2roJ3nS9?*4Ag6aEhV@a^1oll()2Qw(K-RX&8LI5t-g;3Jc?m4T#G8Iisj+{i8R< z_ZUv&8{_IIp2ebFoo%&=T9LgD2zbR^{0w%ybh+p1&7o_YkgSTrT9-`yPr+vx0agnI zN(y6lr|+?rHTl+uEwKLT@D!d{ZD*&@MJ619xw807Bo;nkhR?EJDjfdD>X_6l{QD2Y zTnl^x9bevCD&l=G0Yc{=D`rA{qkW%{9S1+?2s){Ca^anD$}(v(82>hbQsNydY@$)) zUcqFU@JyveVutWvy5QR{ znvq8LY+v+x8u4*%?kzNF8duM!cQ!mrw@BTf^RA25*oMkQaz6Z>zgKlkEhSL1LQK6v z_lu$?3oV^CnabibeEz6<{^$1ClRH%%z3RB>QE~B8+$hGoMZM zf6L-Z5r#7PEvMGglo@@j1)Ra1;M^Bq`+fxmo-brq36efJyPN6R5l27L4+DNq2eP6l zHjf@t0<=LC7q{4f8>*Np9F-^^Tfn6H%4*5s)B23z(g(WCW5WEn|59W?!R0h)65U+lh1=iI^u!E#D-Y3NqPG!78x-bARr{8% zv1wk7Yci+|z0(84R}nAblUG{47~gl#z1tqecP*^J7Q1!-cAa5yKv{)K7XLn#>7HXk z%HR@~Qo$<1uE{Z)82sA_#iVJL#gnF!LuuWW5FI+-=5IpURi1Xms_7xL+udnqnhzLVbh64a>=HWr zSOc@GI6T3+-MZL^VyWfvPjiDZ+{~*V21{#E(y2}=n}Iu;I9H@VJFpCqN!gdKIC3{U z@R>~wNc)%1YIwv9Hnm$*TswJ!KfIctfcZAHg)Nt_^)WFgg90nX*2+w!!$Db*vyJ_* zm7pj(Lv#uz=Bv2gQtmnTGe~sK_AUGK%@-6Y=TJN4U`Tlp=a1xKris4cfc0}`PA|V> zk;jM+%2$=u)DvC_gx?gOau}sHhG_ z6H#_kj;SeKjCnh4d=Xv1N!E_~C|iBOCdNDh`Op8=Lo^X6Q-QCSkU1E(r;dsd+oMwh ziJlrWT0yQ6n`q`%pc9_#BjP9L09X1`r&UR+>7Dx@8*GV+U2cZ@A*jTw2Zo0mPKsHL z=+bgo;l^^Dwl_SCt@Z*>#z7_P0IIRLU8CXijZL8$5mk%o&SEfNz zAw%OaF`i@e){3-$@V`^AN2E^mQ~cZ$U|(N6Ai}e4SPL4d*@)XWhh5y;ZYoOO)9%M& zCuT53rCymF^8A)#8a))nxjCPc+=K}N;i3UZSTC7x+$0rKH3(+TDw?6XX3D9a1ngqD zRB-O_=MT|TEL94J33~I9c3Q%PeN=-V-c=AA2~Sghx8NK6rN)esG zQ~q{zj~$Z3iC=69u!yyMs9XHBfQIiU4u36!UhADxh{*3{WVV2c ze+jdbNhkt<6`kAqVRusUKzbs(y5#8UhQ8MO*XYi3T`Uu?qS@a^>m7lIzao%dSMP=& zfr)kZYH5^feTu)vJGM&CXVp}h+P4}XYgceOcN2^o{?{G4bW@WGWyTH1nva$9^LRO( za&!o@Z8XfG3(IKrI9So+5I+t`FO02FH99&=%HAgiKP+1x;Z1t4wg$QA+L0nRuuDyg z3r7ffFOZ2=(NO#T3F*&)+j}Uoz`ZR(<1#*+^mfct3jMqK)bM+f(e09}#XD0^65i zRtn0uSHDmSk}TN+4vx40nL_uyi$ zsytFu&KFk4Yiay_oV63G_92@o@I=MO5mR`1h+OL!E5lXkJ=|3O`>`}UFNgHd0}>|U z?ob2dvC{2>j}qnPw9;Ae*nmfB@`!{7nKqJNcyeubV|ac=ypevQK|ZI@6x^u6k40S% zhYotg<6min97%d~13U5*)?C1U)^A$!Q0GTXHQ4)k4gX5(250Ho5$=vi^Lq@BsNfnw znw;qamHnDf>ev1Kw44&8<#oliyn#e-N4NklXhOS8k`R(y(h!gj+Vt>-eEVVt-T-+< zGQ6T+P?UZfUh}3)V?RPJFd$P!tZ|O4rHq!{E6eGoVr=4V`p0;D-Xc z+3~{K(N+by`KW82FneE*F6mKXT1vOC=n<+bj~+YCRw@pL=lM93ZE4BJcqJzkE=&vE z=(}(gcp%!}A^vsp+E_7WTgFFnR-(LuAC5B@0lHgjKx}wF1g~1RlyW;Jq9nM>D69>8Y8 z#aM=(Ow|}S9HX>sg=@n)Ge$Fg>0Nl0=pRJy1?Df_qN{@Ii>bf;X0X4V`3c}Gjt@um zpfX-_I^e3F=Z0rTS2&wx&Na=soGzD(>!{*BX~U!{D|Kk z00f9F0FV0_!k=BzzK0qdepc~pRP|YM-aRyq%(6^@dD%1lV6Z;7f6mGm3AS|u+xKAq z_4o%$fUa1xtEuegENzdgcIDRhA1w3Ih<($v)0f9z@U3PTv8*(jS#$hWW0H7=vqPsi z4Xe%I&Ivx8GdG8CspMM);p<*ugNN7lJ6IUEZ$$ebr99K$u83lOe;qTiIqKc z$x4uOU%BZDZW@$o$(kn{!dWP1R< zlU`GU#@!#ki{Y$cRB?ZlVZH)%zJ}HcGhLYjiM}oj7xC2#O@8Yh(FptfPI2&mAlvR| zm<~rED2}ElD;rmf&e#~3INVVw(jx38`!o>`>#{qi~|H;z2-CI`PMrO zHix7ev*8WKpN~!_PNg>|lNHYT4xvr683?Sad=_*?d*H?bH9HFB?l5UCXB z5VSIMBtA#+J7^t`o*Iz+AiCO!$nBLEsR`1}KAKBBC1dhx0opHfB7I*~_b9vkjFfQ7 zBUKYLN{SqJinS~DJwfz)qUZq}-MqDw?LC>jO#apR}$&m>(664v1N<{%XkOWR6YXOf-*KQzxr#q?*GM1YT~oYk5ZhmPEW2`3pyJzkk+ z6jx-$_SkyTs&B!!*X|wf{SCZSR%owk&B0Zg_4T#Q@#rXC0(5tErxLRnl?Ac}(ba*m zWT{l?1Ls|9iL~H|0` z(jC%BcXzjdbax*3&Ou-G<^J#e)?HVZn>EWl^GyC`p66`#xxrcBE+%|p?zwrSb?uoe zkg4=Rj0Uv0X-8iAn`{VieE;X)Uf-J=5|DqdFScvNS)Jx05Xi**3A;|*A}@;c1T$I3 zl~0{R`1SXQQ`uUrOM1Q*Qm#Dop8`%6NT_9P}ik5FtqA#cO%DVfWI#g!6&NkhVw z{4KNg=5)%bdC3)kDrC^69R%x{3=s<4?_#TDe63W^3!R~y#BjAbzpcHJ<*^w+;?EY! zAFy(nHTSta5s1Cv18iIm+uDfj7u@@4Cty2nH>F5rDFcG0UJ4jYrX+QNeozy=ZdHl? zA((C_ltE<5o!P6naVNZ zm;JNd?}|7-;KVztto~4-bFAJ>(rM5XKxVhljVoQ9I$0s(2BRU z3Z`l~g_AG3s0AvF;I}9 zSBX;>tqadb#!hPI5aA(sCEDKOn-P>9QNRPazcw$?RApY#B682rV@!}yjI@x!*P?jy zAxoIvs~{~hHm|WeH(Lm&_jSCU4bECRDJ#92a#20YRPJ(`PxB~REPM$IQv@Ya#rwH; z42cMQq_=#CoeDy<& z;K?x_R45yXzL?v_HZVEqt&17UO)BpB&`e27=K`k*H*tcSlDM}MFdFr|H{ebshNRf~ zSr4gx%{dxL#>cl&;A!%z)b*p?2I(~;>y~2)QZ-+-+YE?R$NHuuuR|HS>i9zmW>UtV z9`al4T?f^r=((<71)q>k*d}S1(*&pP*RD8Gp%{nO=rO)zg&u~#u(Qe<+ErLjIQWL_ z+)uuHFhKCx<26LfU>HEn*yqXt009tCp+`9$C@Q|$7Fw93cMyOiSUT6F4krg^D9^0tM{Fv#@g(u zrF7ZFmG3S?+twCYUiQp&iP4&-u!qaLChNH?G#yC51$?orJQvZrojK4(wJFkYhi4x7 zz!P8n+^-67<+~I;#ke%OS(%;v6)qXgz^w@5oy4BytIcn7;r++9IRulv1_(_m7jvSO z=6mR&d+0qBJlSh47Rqi@ADEj zY$A2o={}Kp=p1Ec=Y*anH~5FA?xYyw2Vc$-!+txlwxZ|p+&m5Eamo{ITJ`#5-;Nm^ zIGx>`ysR}?bUIV^)OEae23$4Gy>j9G1s~yA`xzdJxqUbI#Cx*a}j2?nupANeL)bPCw&THWF1I?Q#X<72uZeQZNyAPO` znTLHkc#(4emxP0>xnXlg&TJuZ-)7@f&Mr7A$841~=$-hNz}I3q&f871wPikI4zaC= z9{nKwdgi@K(jmYHXS##5Y8zO8_y!|0O5bV(+G`RcnQ4BmHYU5|n@%;0=&P{Vg*<6P zCxgSf=di>VpD${k2M}MNz0)$R%&$p#pJ)s~loy5_Z5qN=AT4rMKB=en@?%61`ItpU zi>YP$!%Cjt?xf0IyS@qFY>P5}w-k#Jt}b=QHjUgRN32|OD}uuzc4Ja(GHK|am+Vv@^={Fqz7OBj50oG`m?w8A9&1m;xEM^sZnuMJYE zr{!|YyRvI%gz|ZR=(X{>q7{EZc|!VyqdX`g4UQypX8ax5+2 zjkm2faL4PcXQUJZ+N@QHF6J+0j8%!Q<|RvYduSEoNrcVuYsJVS#2tqjLmDyb3t^WR zw^4x6Z-ZDieu#c)`Xw;>+P=Ed{ZuzkY1WCbpi0BHcS+cp)Z@R>Y&i19%p6ztnA|Z_ zGc42Mc0h4wKsZL+@PB5`IzN!_ITFwfZ30|6qSOfEteGH9AK*v5atL0=m@iK#jPtyi zwPzIOoE0wXf983Lhc47h()c_TOE`VI}%1DA-gbqnBT|Hz_ar40KM11eGhM{;}EuQ_cwjj zv1({Eer`;tIg;WYvL~$2vq%??R$1o6-N0uG+~p=(ZgX66^0oIXYv(sV*||4aVKos< z6f-hfN_!-MZ=E%6@Fsy@ooRW?z}pL$DkxYcwPVoB!$n5xL?0!_I>claLXkHTwIDsf zN2EEkDPDWZlP{YaWeIY8ygf#(p#=JwtB~C6i_fi|Z(8x{W1rW37;E$};AFaZ_S8wl z>dd~bv`flfbjst9VceXTs=w2}WE^@uN~X2jr{S~47W@g7;aT69{)LKYU6bc@#)M0b ze#*@r@VQVYWUVQ2-EAJfJSREzQ?z(CAH}p>sR(Mdu+wTmA_3JI}m^JU}z4QJ6d*phvG!*AMV+rngaD2#+9pj6jT2S z;Ns*Qd9f+5{Xs9onDMwlbE!|kAN47j4Zm^hkmu&j`tu3~VJk8m=x&J)sMmR7Xgnt3 zVNeA)z3-LuBJ!!%7R}Z&J}w9#DE|2J#yM-`OK3*-7#PE?g%8^^%|?S^t>*BH(+D~r zBU6$WgDG1_{!4EmAgVU&@f~{cf9S&BdkgTwbv!)>h06$`jS;XkXB2<$#8-N+X~_mok+!YK&57re4CG!%$gS{s5M( zhtP=S^cgJ9?vt!mnow?Hq+J=v?%neDLhs}kCAo?FA-RO#sh5=UIQe)cc~0`3ltE>< zH%`9qwYi!-K-JM*iNDkOjv95?r(?aLoM53%A}^{* z_(9$f6q5kzI925>iS$H!zucZr*sM{oec#$K<*y~7p)MKn5hZ?hRhSjIHI@(gyh+GV z5i=jlVgx-YT zQpbNtZN0U-d?j?qwMBZ%G~EXTp2HV6?>g3E*VaotK3x!!^3&un6eYJ-Fi`@hkBZNj zorO%U8M)CU)R*uv4wg*37)8Am%4BCHM%fHS|ET4-VzR~p7Rj5m2jw-nQTn;(731f< zc-Fp|IV-n*E!MhV#CRg_u?j;7DO1y?re+-5OJDt4Lo_#>UEuhIeuO!F@3Y9|Gs|v+B!Y zIHWiLf(*;u9@BeY<~}Dd%EA)duDennB;QMWVsh^{@k}0nk*RWE&~NYy(stzZnUlUv zq2DLbka6BmmKw@F#3DfJvB{t?52ribU`NAYLHcZ+93chq%%>q)V=EC((Nn`JB~gPz zYL&am1m36POT{KxZdZcTDCjBX6iD3kHg0XQfMKNuG*d$xq$Y=E9Y#tz-Mm8ylAQp^ z;4ykA+OXZOQ{Wz5&*8(^o4Qgi7DR>EW9;&#YL>D7gu-_kB6u00x?y8^DyPBJ3#~;O zw;QJxvMDvkBk3Un?yso&mW@w$$*bE&2-p+6y;cJdTw7KKNt+p`fmloK-aD3{;1z&>ie6?d2}B_-2K9f! zSGF>|a*7}jOmf56UBLiOGA3<_uA;dA_A_Tv$+^}7s9U`&s{;80cvC51BhRGrHDJfE|yg> z7cz^L3&*8659fr#5NGn)u*a&?_7+BB&tF|~T| z=QzS7JG5crp6zzM(dT;ir93nooqE+9wsnS*vNWdtWiRqGyb||xq~}B5-L>!6&a^!| zE!uf%rW_bTNL!9h||5AcnJ5lj~WQNmiy2sHI z3LFtl#*iBC(e$`x*44y_XmP(&sRp4pXh9OacJ0wKbsEtQ$}Ti*;m;fq5u;;EfuI=S z)$yYE53r~(%R;pC!4-AmND9nqgR@Khl*^(A3E{;-m620JS9sTG(JUMw zJGM3Z2}v_3&uuyl&++M@UsIcYC9pJ8g)#MoOJ3Eq^+RvUYk_6>mF9}UuRk1NdxQC3 zkFc#T)z@gVV72oZq31NKj8^%mX%O|@Syo@|bzPdcHsG{{h&VG2_FT#M^h9PdXM1pV zzvbkMoh((-siV@lxRd44q6}Va=r$$FNM_(t+6%2~*bF(9z1l@?W9+skp2}1Hv5>U> z>;wb4@`#j@?E%6V3=|6yW9&)>stVSubIkzT(pMFY*5?{l+X+{1aXuDW=D5E^R2iy5 zd&fKL3OiII6lC|BGYh^anSsaifUol!BB=hfv>=L5ZvD zznQqcQI0WGTf5tRj;Me5rNS4~8nSN(zV%eEp zp+C?$ojl~>pT#}rb7D(hdvkyOeJ};u){C%z)4#+h1X-qa^8sfIkp*5!Mx7x4-90pvY8 zQNC#&pkja5%84Zv8^fQM2|uDv{w+fy$slGd$cT)dSqJOsYrrqHrI?VmfohLGs7=bZ zDvr1@IJ;x@P8AFDY{r=FMI4uFs7&CusIh?3%_dAfR_n?$nmyXL0oWz?M>UE!?yi}r zle@ga$Cow+YEplY8C34G*giHgr(1fG~j*9g91V(O%rvR%3C>+|8X(v%MEbP z7o5mx9=B}CtTt$t-V@c9{opx+e-@TqQ7o0o) zD0`4FW~KdF{}v_RI7Reg_-tS>VJ@=Q!_#++wsk2D$1|C<0RoheDwyr&jr`{aCm19j z6{+}5M6v&V;y?>RIwI;A0Ab@BEpl!QvPi8%+iHEx&=6Q-7EfWpLsoyxO4L zA}i*U$vJ&2XfnTwOFL|*tp(F|}H1wW!S^g+i-|8t=FYh?F zI=3S^;3JrvXe_AR@|?HG=>cv;-uV#kmRC#jm^&;H1i(xi&rKl^QaS-&S2~m&zdH|! z(}dk}g@L-14NIR$n)*}sq8C-{QbTD|6ZAJe^Z3J#idJib)sk(JhjdeH1g+)&ZV7NI+WOy+^r_z(1rMgu=pKhQr{Vp33Wx6UrnGoV#tHl zFKiVrO|eUU3rxZ_bClvbH|RS#BiG#vtjms=J8Y-gUf{tZLY#XWEUGKxyxD4simJk^ zwL znZUWtGlHv1Oq1Q&zD=0BinluiGYLI@DVGtB@=xaIeBUzpP*kX;^xCDoN?mPT3jflF z!ts=N#i%o*#USz>Y-u&HX)m)O13T2&YQwWjM2`0_Y@R@Z`t^2UuS%gFr>K%Lf>6OX zLC!eL{K$~J7)r&&>m2|ZhY$EKr!}=3GJGO3Ay}o?Rp*hMrAKdrE4^3DMU@(WWJodE zi>{4=7k> z8$+2A%L8Bh`NqYrImXkg)p8ntm0=iJ0=Rt-J>vM1>YK0@z)0|VHFzZPyG`~>LV`Nj z1pr;PPBW^l5XX0&eG}iCGKtA}P8_qUt%^niq1M2Lx0@Bpf=7B=WF#(aU zgdvy%B@_vxN^&JW1UXo>?bm!nwUq-N-kE52y;vdbpAre#;U~F2zn+WJPD-2ToQx-z zj)iX#pQNif*@vZbjw@q(D$_*gdgOZF9L8bL_c{t&RC$Jg%JNvHv1-gOsd`(-v22d; z{>ZFOt>~a19epga1i3ncx2DauH)z%X%?)>V52U4JWkeQI$=qis`MkxRi=90r@j8he z!XkzQM2TQ62+@N49rYeOadji|QRQoGOwp};DlYMu$h!n?uO5S6HJ`y6CPl8x!J=33 z@%a`T4{HbN0ySTSM#4d=@^tqJ@LfV!s&VHuN##Gus_mr_C` zXV-OvHrDL*SwCAu&OM?=o<-s~*M3 zXq>fTyZ-p@U802*TK=B&arpcA5ol1GDmQ<*U5|y9fL0c;!XipG#7x>p+Gp@qA?^0Y z6%BOH!+{dZ`YO&_v?nh}I^Aj_;JVzt>om)GjP3Dp(Ku?9@0&CFSwV#ZA1Q24^lK@( zTT`8gm{k*0fg-ZxvXZq40n~v_ZLlHZxP{gzp{_H+UBW*UcYj7KOyDb+nf-H<9A&c{ zwwUYBOERApa&dUhwK1AHntf?NW%R0C;m{XFa3o)AtH)hQmo(r!;oA?>#H{#W%rgx{ zDc}hBaEx3Q&(Rv=JJSdo49Cut)&YeysosC6yL6Pc7(j>CdUH)yd?LFc!|>#pZ5+wG zDH#Kp5nSp}$j(1hRyKjoSR3Tb5*_LIp#AHsr@3;dcP zIOXu*Bw9~3eIfmxCk%T*z#w3G0&)<|b$FRp)`f7oNZm+5Q&n~{`ozK>`z}X*|K5cL zbcn>ms7irKO-3WHlv_w8%F=}gr=~2n-B*b=8trx3g2@;5%&`bUgiHXm^C<{;P1b{v zYam2|t}gst$FlVJbC@+>_sxx`mi-5>j(|B-U8E?mU>*7mWtXsAy$N^RTV-(lke_Cx z8x_i!_=yQar{@j7jEKdVpkl+s9*d4`wZ>%Vg#EQqpk84RVS?_&8R_;_M&+2ci3;YO z^ZGV{a*Zq7Bpl}{I?`vvv3D|*SD0-%lwkVSii7A9YBdIxow?P7yoKgr^m!keT@Z#- z`Yiq{6zE_TKvALfHJR#-l2T|cr8%iY0#SL4ZBH)s*JBl1G6sFPhlL}}Sy{rqW-2no zqJ~Ntvo8C%3#P|Hr|sTx5*%)=h11V@X4A_M4yQP!Mu~DqO^Z=lr7?)&+P1Yi3Q{an zJS@xYI67r3Z=@2;#(OzQ;<0(NYl{t<2x_ z^i#LpM>e38QvH=Jc5xi7kun0RA}ma4bx_ET33dH~=S;85Thi&BS|pRqJmF(P(KIxW zImLVZq_)P!2Ih}PSMTt4cISBD+Y-o&2s9d4%7{L=K7V_F;Q5)j-Wsj>A)!(yZf+N! zL}h{EPzw7YlQXSM&|4>jk{n(jcjy$R z_RP^17SmCFjW^p*?!0$itW1GXtU}c;haF1tEqkctlJD;s91uWQGgX?9TPDTzHk(0| zWlePms~j=G&MiSg#drOV)uLK=>O^N7D;oF_%W*x&cC3uR0%(y9Xr%Mw1M3o#d&luc zuFY&pa48C16Odn7sH87+?>BsCFFa>&s5kG1FFM)hbu40^l+MKP-oqPLhP`|fW}>!z zr7>t9%|za(keN)Wa}A|m{%gwmsDZ~OnbT}U@+`ro2Dl2KVCCELlePlX4P3@~axayK z*wNf}w#-w5>e}rx5;o69D=k?WN?yT^lo@|&!*YP$%<<(h@~e1_e_&^GrAFx$boDbU zD2nvCsVQYI-kEPuuFpL&M=q~s(Z0g)iDYe5jlPpqb61b8JZ3A?e+^p$tV+pf2C*9%i- zmL?kCknVW;16Gkm@Y^;pPPl-3Y*-Ky(|AzOaoU_rYspoN@qB|msdG) z$XdZOL)`3uAPJ&~Y^qiV@A8;*BXi;VTyJpEf7%%}l1(P|viF@lW-$~lV?Hsp!1>(O zj0C0on$ifJxp6(AEc+fs{X1xy`9&Tbpv~R?@wIdPlA>u z(V1H*mN6f)u>+Qmdn@lqeet3KC4XWSa8BYfzmIf$=d@r1JvuyS#BN$K$BX{~jzx+d z6wB}0Q`8wu87`d`jt3;|Zwx;LvO&INmJv=7BXk0+=ITzt=(wOh6oVIsOT-h^N*uy~ z+!SXIV^ocR+1>Rg7;oVT+pFn5-`M0CLyfupfVax)JUY)~wGAYn)pgEY}gw~3`Ow0l*6F;Ye>rc(~}vM*%I z<}>`3C^}UL`A?kqaSa>%8eI)cA^0#t4t)T{EX8C8ml2ENb??seIQGPpyx!#VK4V2? zzx|YsoD7#^!0X!)JFZJuE)+8c97aU#ECfVfY42wsRZW9Ft>Ty#t}PhV!4z~c#1lUR zTJ|%#z_vu89GRIul;KAqagIo-V+*BN!HK)AS3XpNzXC0SB8plD_7zhf3RQK9^*!94 zjkIMu-|V_ky)3R@GT9T}3jH}OVRM44Whe^Eny8%CEur1c^){x;MNF7Fe0j6ln4|sL zil^dbR%ET!*m8&^=sz^)3w|UHVptF+`R+l2Mitg1K%tXA1y8}2V9e3|#b(~(=cVOV z$01{0hIM1I+>NY8A~mZNC?jI_ZppyoWb`*h%G5;$9lnPo^j2-fSIzN+z>_Fb176#B zLWD1hjO*wv3+~|S=o6BCqYe!__025T{s91j1+^I>26%G&_ZJs;v;7vgto!rjw$gg= zIAPKdZC;>rOLoSruQ|)i=<%ugm-PvSk%>Ja&jVSXkRu*`4@hT6UfLTAVI2`Jg3SHZ(vB}@@Ix!_~&%giCR5#pP? z564^#B?6Y8w-*Lh&pqC{BMM?W3Zs+cw{hW7<=;UNN6hoiv2XE&_234E7L|?Xw3;W-t>?DQY3XL zriiRZejGw?==G2gTFQ~^b0wbw}wlVv1nPR@&;>sXCVf{5OstE%*ieXq^OS`>LM%`T7leNCr znS5$nPR%do?Oy=N2CW^QjOf~BQ=LVDJujUUg1gf-^g3LE-kLq$two20#Z8ocnU!2X zsAUn@qWyBllX&tc1d0#9L7!ZJ{5aksh0@d4YcZ<9B!sS%t{D?p6{B97xaOb?ZjTXv z^UG2L8ryk_x|AD`rPC5Pcw}^!Sun8pO7S}C za05Mr`w?}2t^MQj>#1-;?&84sfv4!B7%lbOE-!dECjpi-r~7A(5JvmnZvn+Et=Yv_ z%;vj>d^4~OlDO9B=BJj@>J?DNv0i+1@jv{9I6_K9=F3VKj((je^TaIxWSVSmfG^?a zBT}1kA*h1M*25FgC=!yP`vfyQ8IqYPh4#@o+x=6v1d#xlu+*Dtt^y_{`}-4Zq>Q3p zGY%~SlI7Y|Mo}7hBMJiI>2V2yqJLniW1S*=g*}&97k-&ybE+HKCHljDHoHXG%t^Im zGDe*00$CL2{9#DuS&NVMWe$|$WELt=c#*cjkZV+tU+&_kv@gqP``po=1ku$Sbcou< zh;;sAsx1Y$(x+vd&9$Vtl|37krxdmwdO~v_x6r0 zxkN;TWh@w1m@85}bKQ-M%06RlWSABgRX8U4a=I!aVr^UCxJBw?9?>A`2Q1q+>UgEf zdXs?q*H*rn$=l+#ZBxZQm`cv>8-Vm%>xtNz3A(%wTD@F}QBvC|6I7Kj zEUO^v&7vwI9aE>)R1(y=KlHy6`qj|d_`+m=ph%t5(KdKzX{fq9m0W5YotN0^QMydK zk3M+WcAF3*^XwKi*2DWJ;=M~vkr7kt;i1Cy;Ds= zXCZDEa30i8f9~Bjc{_Mw)`#0#t#!9BX%|{Y%~h`nVm&s=mIgkgV%u$kFN6cXzkv4P zGqnAI?v<2F!{LmO$2SiRfB{Fm_f}6R0Z>1m$=Nh&=W*@+BE0?hR-oLeqM{#lxQD&W zKR>g`NJ6bXP8L9jdNA(#-lcA7JvWT`>8iHyi{kP9B)==yL3u=_?7FRC8V4sbr5i0q z5;?;{d6A6io}8tKc9x<^_m)7tD`~{r9}(*wQ2kl)txTNcLm2RR`iI!GT-Wf+REh=? zQfdnJA-39fyPF8|)(MDFhIUdZR2T|f-%Dg1PS?IDW_L%&mu0TwtTr}|k6^fu;VF-AC zvAzV+53F0ujMui%i}qe5|0qow=JifN3=i_RWQc>>=6^}%1HQT!n?vEJMKp&gk3^?< zUq%1-%phU^So9xwf2jp>#{YWV|B3hiub|KkNRFy#I$~ z|6$!~VazTO!Mt2Z+R|tEC$mm3ail2x2nc=tF)A0L$(8xl6D*G3CDjZ;pBd%_J@~Vr zGT?9b2R3n3ze~mTFuu>06T^o@s0St=7RRr0qCTu+&(PQLV*XuFw1;ng2096RRusCFo)V!jtk#Il8cxeuH@0DE(upv`^}IKDD4r0u`g7I5Ku>{dL); zZvoEllKsjtD*oathr$CGl{=qtZTOC1|Nh@fj+_Ip@s;F8F_76Q`-e~+R z7nZ^#oZTKx#u_}7-@&Q(Ckun^+hsWPewAd$#>9$dzStjwYTr-*=?IWk11rI1wuADd zZU6XkB{>5|A=o~Q801SeH#NG!fxtfoB`4Xp4g_NSbcGh{hHn!3U;46x=$~nzR&O>4 z$4>FPrp#=uK=ePRP9&pS$^5nGJc!PGKwSS|*@E?CJNw_Jl46Ozq5@um9>R}Rl4#%i zZ>4$B+$9{zvl(Y`r`@QN1g!Ef6QTiWDY2s?0;qxFem<3tUytJ zJYoFE6CnCm3M<(U)^Prv{15a4d=tFn1={*|4y)pAWqwlq1;L;+<$Pq#zvG(x$cf2l zN5A^uf8qto`r`@vN1g!Ef6Uo%5iL8AV60+^G(n-S3SgFyOc zBkKT`6)+NiA;<&$03bY?Zt|=f-hbKp2%9F75gu9d@3=xgaw0U@%C8}-9B9sCULgI) z6WEVD0iu7K^YT$(3B*8v1ZpIp>iA!=f<*oHgr?2EJprPBL8;0>?f1XR3b-DKen1eH zn#(e?L9)MW)w9iv5(HizpbMl@+#_rL9aqUmPLz~r|21g-Cti@OKc09L*q46?R`V~s z1SJypCv{-r{sed>d(f?a=fwZW3KI3l6F(k#0!aVC(w;{U0;C@hp`Os0_?Js`TBzvjs%_?T7Qf^9)4%H7aoaJAru~#SN(9A3r?O7i8QYKm2VeFgZc$ z|IVcUVhd3Fe{d-`(f;pp{4ZUu`7aLwx<9_0hl-+llQfBOOE zZ_EM`|C(O@4TfHi;s#Xlw;whh=?gOMw;${;=Oy(HyGFUCFcsQ9AfKobaQE*{#J#Ek zRC(Z#4YWz+`zL&F-Cyh-M7ZYdoKF0;wtQ zWF6n#^6Gy05`f|M;({Le7|?eEgMaqj{rw>v_hm5l@mKBMjf6hn6~LV}8_kx{n#M_OyZIy;|);p>UZaoQM0K{Dub4<2tFa*{#V_7x$c=K^Ci;D+EBQ zDwT2zVKd&=bS=xi_?JY&$>g^`Qy}x@|BhMV~Ww({*&eiRz=u|2j-~H0ewUNWU?Va;o_`rteNlx&P zsU~1}hCY?XsbQw;psQ)$bHu$mIbmkc)6jmdHS;qQ|fk-{IZywvp4frq-D*r7MBz1*@tvT(?N{s^*W)772X{i4iJ z6(RlkkXgg4CB8hB`|^9-s)ozUt;4;A_3eF)8{?Cy0juh(t-}V{f^y`7y}gU`RNjrG zfnv9fH2~zjVP#$It64%jhuS(<{}OFY%c{D)nGP$@m2yCEXp`oxxdZm6)N|{zl7YK{ z$@6W!`yO8W^|rFQn|gOrWns zFH)Jan`1)(U?MU{RVR`Op9M z{tDyDSqDX~@si+%H4BZWT6#*>r!qPTS$BHMd^Ykf#M%T#J65wo$eU7Gw+S_xwnAaf zmm}!7l&lcJ2%YD`pPyBGcu8C`r{!~E%V8jLnJ&IxIAFL+s9tmQqjin|UI==%MP;lD zak4ao(^yY~tV67T-;Izt@A~~#9xfGY zj7ULw^y8$0018gZW-{ATBHhv-gpff#Q_?Z(cQ>$}MI;dGJfBhq-=AP>bf2+MLRNf{ zWMVmvwdPaUQOpK6Up&1ItTM92gWmKyKTgE$+DVJ6uM{JyE=+o&BPE$~mK(xEH0w)4 z++#s}i3L}Q_hq8b51y*Klt4}`r`3Z3+Rf+-rLog#AUwG?c^VW4EB2)F*>Q9}sof@i z&Y1#T)CbNchL>^pecYf~*z-#tK0higEkPX-BrJ=;72x})A_|5{7lX6fU^#(&oUy|6r z>FHeSUh&1FIuOk9A${UVEb~n`;)txcry>kCMs_t`(jvp@0I4;y?i{i6A<%!kH9Zf!8(!R(J zOL@%LewzZm6DjKLkMlhjyTtp8MJn*8rz4pkHWV{=i5uCR3;}kvtAPnit6t9F2r1OI>jGo`6+V# zl@9`im;0oN_lqJmGJjoq=}RX5@r)w27$lW^z}=l#etBE8@kq1!EjNZpr;hG^1Rs&`36@!q&KNp+Q+_wr-2C8!FgZNJkRx!??{l_S zV9MZk#znYl{v3ffgksk<5*zqpz$z6@c1{Sh=vagZ$D+c*r?L7x1Ib=FWb~P4gO`x~SZwg*?I3WZ3A$Z)A$g{a zkz>lDymXYg;ZaE0D^=0g|CzC=nBF@G+OKG|%?z*L^l%ECH7+USP0Y=^!%4G~nQOq- zEzxlY&eeO{(|gwesD;RETLC}UDRzf3fJA$c1CQAz8cGH;Ki2ws?h@J3Cc92Aq`$r< zmxOtZzhWBcB^MoM9M|$0JdXtmHX>50&;m}j*DFH!*34Sz{bC@7g8duMls|30*#zPl zB?B1P)1P0BZU64Qg`qtN#P&2a!VB0??q~uo2w+iODxu{)r`nE~%^=xR-ll<*(VNhL zA7tZfYHYOWBY$0Nu;qxp_tKgB#GRQyyL3i=&=HEK1XXXAja-~}aw;T?@3}~$Y6eGt z(=Y~^W?7~h9+O8>Q3&^d9L|~`75PWQ#9~x`juDCs1N0%iSaXDL;?t_^4g>Kau`GGO z7uOd{IIl5?%$kdJUbB!or|2qig)q+K*-6IIQl=$za^Sb08OqHxk_BPk0>4Y0F z$V=0)0%s0SvmAdL7KJIWu(Gtf%d9S+2{<}4t3Y?GG{#uvBpcxbvrgYyy;Uu2qun4;g)A$O zTSPRhA}5u$lW4tdE?yuIO@bM9qMLHy83UF&0Bx-X^@?KSjPb?9Fu`WN4wJ;|PPy3r z%TR^LEdR2VYr{A@Pi3{5=c=y(ZchoQ@!*Ch-aH}K80fl|^2k;+%t>=CSBmm{vq445 z5jcz`tiRx}A8M2+yI$&A(SYF&CdX_{mr|a>jzTzuyeleyNC0i{7K!x!(26xj&9^LH zU(H301sAo#K#;Gkpt4?vC59uK@mX*ItUpbnZ~jJ%nd`RQ0Q=;Odhra_K)q{Oy9y(Q zgX9-xB?H5bEvctkmBgOeLHSQP)HM%@UZT7hYF$a~qmE>&u6t`{mT=7)2}kvj$+o8` z_z*j*SISnuS>30g;+d+lVgZgp(s&HXQ$pIN4mkAes1=po6gFObo@ET~ z0vgKD=5@QQOBXrLl3@P$rR6RI`-1~J;~4%tS(k^1+`_qx0Wi|NPcH>0*==uXuTI!tJ7u;Oa=%0lMgn!?n!u!g?+f^v%L-Tq)w>4%JbwTw_;; zMNbc9716UKYF7wR(tiPDuuETvbqVA417>H&*^Ca zz5+8WL>D3AZJOnc*Va8UB{%tGD&6&n`l+2L-$HE^7fcSxSz6cf$jp&`czMVke!;xX z#-ZuV>BWoZkg%En-d>~v*!KoZCB%SE9`H%?XCXg)fttL_mT!TuEz*2SRlI;sz_ z;|hZOq`pL0VvyqsE<}@}r+xka1;I~go|-?})OicDPQ!w-j}i31)$0jiKJ*Fb%oQVi ztag6C{h<>hByA^%u$ib^Zu5gG#NKFkH7UR3Y;yP0(in}gC+}*>gazU>i0Os+5&dLP zz~I32;P6Z3n?uk@!Du7QKEzrEJ3hhnUZ@wwfchdvO7*Fs7y-H$Q~OIpvy8!<09b%8 z$`{?aFJkYeu~5Zcqks!nxoiwNGpFLNaT|}{KWDhY{x>96i|zz91ECNL0t^fR_*2`? z(88YnCFuG&Qql^75s|+H%}`q^uN{K1aJuw$076aRMn*z=gns+!dFXUAkqN5geM$;l z2{OwUM?CwvEQ?NtcFh@O)*`Snb1Iz_+jLcGR!M%kG?q`pXVWOO>nCL0bZu6X)l&Ai z;-~NtJKyXp44vRH&cH8=+Y(76UaQa8eqffoADAD4A5Z*TQn-7Y!+MzAe{x3jDP2_9 zhW0cfQ!3aox`a1np)vC$OJA?Td1>?hWH=Xt=c?&5LssDElrS8*b?FuKzYWEH17nv7 z4hBX62?mDz6Z@U4?acM8t<6E`9~xUbsLJu_SKSJWry-VwWbf4s zcJS~=2uVKgRHS-D;u|CReN`E?rvU8lM<{=GxEY;ww;S%g%<4-ZHH$R`HjBg?$+-`3 zwX?4VsKlxzE#K-xJ5`yn;z*QV-BLSz;YefE(p#P3zafmZ#_JYGj!y>P|IXZWfKJ6$SeL_ZLIi_93H1un_*Z2S_Q*w{YS*|g4e z=WycL%66Kaa$Yjs$Mz?9x@Y9KD9_!0WF3(B(>>FzOK#9M0Kc?*S*K+w|EXWik@?;^ zXaRDc6uLcU$N7`<6<1$(x^%4}P zD^h;F;3^&3n6V^Ztzy1CJ@mlkZ5S#T)beM2A>NnzIU z89#RqFK}ejOJRnojteY??wPQc14lo5<(bG4o;##WOoJK93PZiu60000SX6@#~s>U3wh%Cxz>raYs8H=4zeW=jPYC-i9SwjV4@R!x{ZVW*~EW{}+ zquJ%_ukY9TJyModl$+WeoHhF#B0jVo^zr`N)~w~{s)WGg)d3DK=s;UFURzteGqifA z{pP)mq5WG>0(ZRWlWAi>xsB z8;E(Z+wa_Ue0+uiUOuQ6?q?FP;-jF-_MN2{rNurAsmF9>sX|FUu4vI)y?^5(A2Fp_ zQHIA~m2OII=X2I>-l`=_3pTNra0E|SvsMAhD-m-EX-ySZZFj{UK1@<4BpeH=c3eoI z>_G{{EJDn%PJ}Me8@a-zpaT12UZ;>IxE{l$$<}*sSFdm{ zUwoQTMz#%XoF@U~<1rs-z zR&Dj}NRI+iJ-~m!-Rm>vG4~G^J$QJ~oxt2f{mlyo z_5r-*Z*F~SJH!9P-hz$N82JPYtdr*MD0hjl05U#;jd<6|)Y!#E!JTl0UQ{W0@n;P}Iw75u>b-@wRYIgg9- dkDQ2*|5&1OlF-1Q1CLXHe|>?Ovm6Sd{vYGrOJ4v0 literal 38380 zcmY(q18`)|`#l`nww-Kj+qSc@ZF^(eww-KjTN`g|+yCr-_FM1!tD2dvsp-1+xu?&g z(>?N1z#u39000mGM|Nw<-~uuR{$JnfzTOC5ZzEenc?VlNM>>5wJ6bnuE175>Xdngz z;mvXZxNkp{V|Iz+;Q>(5 z!<%JwN^Eda%!&-%0k{t1rXr`sCB9cI;FUrar5(t8z(tGZIKbgmxyc@!)Y%!6_ZJa@ z!hSkfZz6VEo74;5a?0etML_ zZpmZMbTXZYplWz3-cZoqfE_LIi)Mq{5R$p`wT#8;HM`%2Qyh=3a;;6Z(iq@1Q|fkk z;5lcDxje`&Sr>w}Fotw4xvkR%f?|$_nLC8M8)#azT~BEAlebXR5ZX6A*NCBKg3_ji zDA030?fO9C{`vr*oNm&L0n;l0vd?Vc``v$}Te5)xfW!xuC@Y>Mg z8JbXJI9K1bZ>_jVtgR|!qUi2CbU&&6q<4_e;Lw(iN8Rc0@Y+in^EgN;$U~EH%hVO> z7dH;$oLPLqsEA)>KJnx7y@DZ*A&iX&B|QYV0n<5kZGQ7MHrV;LeoX0k&Q-^3yaD`Q z;Cj&!y5hkA0EP$v0Fb|cbF-pzGBdU|{_m6F4|L}mleTNDDBbYCJ_(L4B%4WnL7btq znqQNc1$JGI;*!lH7)Y^5k_ITCV9w1`0D*t%rvSE})5B2L0#UoH;3MY_F1;gq#&-*6 zSR}B1ejSlgO`Zqezy;Tcha2^jy!FVLPDmF1>TOMZ3oW~% zV2ehuPNkpr!+pF8V}=b63Id0nm*p#N@?O-0Qb;4th&wILXBaqq?PDAB@@ZC$?LQifxn1`vsKVN{`yP$yyoJ6AFqvQWV=vvlgXi#3C)Bkf^QM zw)66_s+8jsl(BKXB^mx`hdT5u;jRuq;gm?c@Q+N{D}-miTLe;X*+^VQD1s|83Im`Y z=kXg&<5yX49Ol&b6svs{#5~wHgG2It!w9_O$Sd@={;EvC?$0}e$Ge9mF}{4>H+y&2 zHMebS`!=~|iAkRC^K74QS4G#4wtQVaFI9MS^-pTuUiT+4d|QRORE=Gp4=2wJDOV19XsaI&D~R)Pz%#XXMdX~DJg?$tMV2Gj z3zIEE{~mn63u;?{7+uR8Z)z1;Cwc}*7_Q?QHl6le$ef!%6dJKg!lRJxUXV>3!YAzn zBA^0w?QD}xGxB7i^{JJmstp*8mRF=Fw= z5lk%tXBrQ$%F*Tzm;%>V+N>W`@luRSgsupN8b%pWodChe-%OD}HO^!hejtbp@g`^@ zNpBEJ;J^9hYrAfdt7qG4Z3V&y-H^d2ovrQ(W8+r26$U-P z4WZx`01gdxW^i(6(DNK?0U9M?tD9zMiAOCK;_Cw%D=IFV;YbA`)q}eYI6R%nE+b8& zh!F0$r(Z@c#vb=jmdF%&F5pv_C0-fLpGcgAA!JFM`uHW*O1=o<*C^p-xyJZUY;%qL zb{yw7;A^n<2sQBTxkEs~_~`^qRHsX_B3q_jnS@=Q;j#~AS+xl%aksQ%T6Jd6C%ban z3zZ!~=X|3$=HZ_Z@(Q2KVvQp9iXj_6UVczt{>-P!;_mrepWIeyOlz4IqdHzWhEDyO zOumS8&~<}}BniKlxPu#q#tZcDkqaGYPL8VCrJoKmlPOp7TNJ0rI*{oZG_F^`kBnZ1 zAxod+pj@mkl^(DtA+3VzTj!2l3am-N;Lc7F83aKaR>+(s16*)=W|V4qMT@J{y}2z( zJ;=K9@rr~InUX{z3rYEYLmb5_`e1&wz5;buSa8xc6pk#I!(kY~u_rGt+sEK<8Nv0ro;$Ah3(M2S*+=foQBLxc@%}@Y#mgKpxvlEXjaCvH|LmfYGVS{) z^+YVWSPNc?H<QyFc*E20K--G(H(?Y_YGHd)?gADl*ZgV=CC<$`WlvM*ON{v+kVqK z-TzHt-OPs&7ajlrIU~RT82_a(S6c^5M>At%Cr7%!!{0o1*6G`@)*8q9qM|I(xsujG zdw{?Pfs|&X6wSkQBg`}x)gZC4y1EJ^F|rgL?W8(axBGsFP5>F6I|JkG6{H489v@i_$s${oSXX>*GW1Qnn;yYjXp4-1S5kuX}~BG)r{pwZD`5 zm=E6eG8!J7wBkkVag8gUAOJKY2`$nKw#b)VzH_s9N5#Qx%+~>XP;(_jY zbjG`li~Q-<=LzWZc{o|&hs=9cx6ML`;pJAtZu@%(K3s-HUQD$d-SgrZNd%ik#aKf5 zN&ow_kMC!3qL#Hy_T9(ZO6G0z^Ne<}LHFk%%=1si{v*SMKn$hAk1fx8MeF+(J$i4^ z&kc-WA7|FhxB5?8%e}|@q{R}Akphpltq*IZtj*)V4-3_@Ca?AEshqHj2EI$a2^G)I zCpL5MREKV!rOzyHv##j-$MNA^bKk9xP3_ZpF~{r|y~hllTi<6_&sooI(mm|>683!( zSUAB|fe|}|-Y$uTpdD(%SQnVpXn_zz`3G2&Q5L2%gi721*pL}D3Wv}}T%t}4qEE8^ zuv`r{n9bjMs6V)Nu-?XeDAl5Px=50_9E7<+rEK)%5+@8bCF7>&EA zo{d2FYondL3~m|BY2pje<`}XrH`aUlUhod=A>OQ~oof{0$U1n6E-%4h3`2ZHuj?R@ zb)46r?T8ZMo#A{g#z`#;OYsu2dbJypucZii4_V3kh$1BK>*mN&99H+(d(k}E&A99$ zm<0C_kFs$&;JH3({2=Q3xS zK))Pw>EPqsJx@nw=@~~G3F)aoLlFAS1@VLj|PG4bmjdv(2U>kSJzxoB(Y^RV^9H@xBC zGl)6ou;bY`ygQ2pz>*iC?;TJoovs$ArQ1ww%G?v=Bs#Mx=kU3u%e0gucw7wP=?(Sj z*>&=8Z)b@9Xb1p!l8(>yV)=Qec9XMyCq#nszYNe{f< zMQ3%-blz?n`}A$Q@sVrBEBGb6nm_)OUMru&fyZW-<1?Fn4yA3hkl$`=4fm_0)mB!U zyDJi5koTy`hE(&1&rX-1(&|SR`9}Ma7^XmixS%5w$u_sGbY2rAbJ6`;s(i9Xh!3V? zv!M>;Yv9El<80REhEk1`qv9k#iS376gG*-NyVkGE{i?xp{{(+aMmvqU!guZlQwkie z(w_T4>u520n;0pP)zw*D!U>%A&@0_LwJDLySLWV!0nnCZqW!MA?&D~UE9lxa&Pyy10N;4hvD~^JDIlb?t~$xPA)98xl1r*i!RlW z?X9CK&b(a-JlXOag?h)QY#qL4FgZ_16koA>E-ysr;i^G+cln1a^0q&5tIWP+}+p(8scuZ|j2$iwDKRxMU5 zg5zsJhE{=^@Q zw=!O$DL5YUdTzT``Bhwkth(@g5csTvjLa zZS7k5VHZDm{djZT=*xb#Wjo=6rAdvujJHt3*O5S8Sg^YRnZ?UnN*tdqa3{=OT8^nU zT=#P7pqA%}tGzj16{EWDczheq^C@LeH!`@h+($H%v@H!87AzdTM{2-99hVC#CX&3{ zkr=i^daDq@Ws{@DZv;t1jlVMojVDC+ggGZQQ;dB?O8-#tuwCs6sGA<*>GHsRH&La7 zA0V;B7#fu?KF;n!=oTbbG(0ZuZB8K*YFucku#t2m)tEv&?XhLs5v8wuV9XA~sC`u& z$}M!;xaNE?sH&@Gf(2oGx22^d}^vI@2a7t9-h?ah4jcgJ|p27Ngha397r zw-G<3#O;rP_y-S?ho8-bi}CQ|t9Io&Kn6hV%Qdje7{<#Iqw%S5<0g6{Spvwv6g2fz z@>k-tBaNnN^HkE2PDfS%=6Esp;vc-mpK8|Ewy$&tqQW1}s$r0(ePhdR(Vm^86n)sH zr9weSgn^KVf@o-fvQl?MrV=ING?`>VQ4z&YR-){F+)`Ctaq5`r3X%{I3XUKNtMU$z z3UmHIIA$Ul$dzG3Fc|oi^8>+qU~wR><9do>a`m1_I?G;3ar%`tyATrnZUqSk6q5F! zxH$tX*HEm4;6LOz4Jvl$CBbty4qrDUlF85Svi3|)*FwC{vG(P0Kq=t_(a-?ByO^bd z=d$spk%QHfkx7gw5lBJisR&m*&SQ8e#qAO5LE@6&?J1+9^4K3>C~3{+VNuX=GA!WA zhkINoJtJ)wGi!D+E_5;KN_!9#^lkS9za>>X3vP7BYFP_rc zo4=j_Kj-9m+qU(6KInRzmbrgj{GzSaT>|bgpXKDLZo@nT(3RV5C?2ewI>msoRzQ{8Z*_R9~q3G{>A!yXHm$>Q1urR^Sez zI2E~rII`d#Aw5id5#N3-a~BHkByY<$Jg;96UAmsAo91U3-VaJS0*X*y3qgTOQ7=gK zxTx~T#lM#==g`r1BHGJ6W# z5NYhTamQ{m@>?d4t-jnu_mAM`JWX1W_dxGL=Q8dRv4JEb0!TrB;B1go%q}u6j~$r@ zs^dmY2V?rNl$MWq5QNs|%Mu>Q4Ds)2z#15sQ+b52V7~kc7HpXHPRx^89C@{hHL7HA zrJLr#)|Af0;q|(aGNz$BEocQ?que(Q7PDs5(!F3pT7GRsX{2I}wDL1MdBB1Ru&TsU z1(z|RHDz{6hZVF;;15T}6Ewl%zg}2>e8s~>@wfCg3*!sb0MeMVpO}L(!}$iPi2k06 zuHrbqVqh$3Xr))El!f8K`4i^YT0iRszlDFD-rKp%I4fY7tGLnk<@{=0uE3Tp4M+j(%FZVP6t0Ak`{on)l<vI~h#z7>*)BLUzx*yeq)~H(O85{GJW# zZ4gg?NI5p|a!;iZu2CDK?@>Aqw+xe-idyrw?9h2;Hwm)nH_nbB?_|q4;w5us98Ksy z*@vrVE?~z8ITxXswd;>=a4@a|6s2|I?Op(%Hxgce{cyI(OHKCU090t8C8#7&+5_?< zn;M;W1YCgQ!CQNjQA&eS$q1y9d+i_QdcOM3jOttS*|d>3cQlYLHzV2|zlpaekq4hK z&$SS>T8NbU0UxdAr2-`R2}$t|9tR33{yDA~maplkT$@RhJO;8~M%7d!NkMtnFr~EP zse~y10#EeU-5zCFL|^2x^X~Yp5~8szMCXDGmnJ7j`Xs)^kAXf^=XFPN%$`z)TnK~= z<8<+N^nKI+#Mktw@U2;iX}nvWtJ5(UH~;i(`wgq3dm_00zI=}j6 zax#Jf37A{v$mlG{|K1`v?BI(LItb_4Eg9*T1_&|%1Mp?45ty>2Lh`Db5PJ<&pvMQ@+N0`ny0m+S|zsRMKSE{tmvp{z3>&DEc^cbCyT#Hl+Y@BIOf6O z#&#NS_vTL_JJX%^tFRC?&}tsoYa_7o*U_pIAGyr~f%FEDus~>bUFTgKL6P5#VY#i3({J?vEsUgdC=tQJKWOXM+Xn= zJK?I&rA-wRju9|#Z(AAgBxiZ?T1XqyAk3c!tsk(H5)Dpizcpn9<1-^R)n9aj5^Y&Y zQQ+NXz|LBm$`t0d6OE&XU5o>re#r4q`B@S} zFoX&D`~iEE`DqJXaA<>^k4wsq!_KW36Z`;wGFqFPG#HTk4@?LKR%ek84`;E?OsoWZ zfDv`kiWfHmB|?kkCq^P(x>%^;=<1W$kInh9j#aK%ok6RseiHo5GP|kLd2})(JAzNQ z4>sU!2^*eGfwY3w_P21qHuUXRz5v;hkxl@atb{U0y7aObDt9k6TX)dGJvbqqH`o>|}slV;^8yU8jmziXW*;rKqII&Rk4kw#JEA(a^B_NSa)SSA3JoXeRY>jfV}E0)aM#8clGAK)l~;sJvF+|Ory0#y`qcZEHxS&vzoZh7$_~g(Vq8`oHG)& z$wI3fe(T9&(1J)C_D*;+uhPK?10I4wJn(8QH)`$i*fKo}eTIe{y+G0L2f&d4WOZ}L za_-sCIeOfkZ2P{=5c}U?-@H^5FB6VBcFJ!D-#hS?x?{ zS5#SMJL%oSwrn^w1|Zu~2l2w3$-I_?N=zaZnLrsCQ_>|sR=Z(IP}ftq90!o@0*w2c zk6sxu61;@6^>1W;k;U(KXqb|;Ql_WW_Hs{U+)za#eM%9WbTAEHM6}tsmYrEJ^GrK$ zU2;tkRG*D8>bvFSxDVr+rr^eq48(h%3YO?DrywbIXHuL)w6^msy~JD*FdzOO#TW zD;SU^?R_|_($9klCll1)5Yh%ljW!Za)6bI`DG_UXgQ|IZVe(R+|6JtGKMu$Y9KZwT zWHNtP&hZ!&EsKu9rX;l{iD^QfJ0xiTG;AGX4?xMNm)DC~dGbMZG!=a@6g0YkLqAGU zIBkx;n+{mN))}aRO!$QYDF7l3LDWJ9;{H}2_)~3h$c%c6&&KtHAYyW9X4Rvig0;Ox z>~3=z=2#5K=0Hog2t^7t(JiL$!(tuq}{D>SARYKHVrSO>Z-b4VIz8(CZ`B71$ z7hmSLlMfZ!SRGijx0iNM@BK!Tu9cM|e@3)Jn?{y;Kq2KYIEJHDwgY_ zKxl7-AR`E-8w)KOq(qA2S2`qNM5L^3{B_oTwlHed=~QR%dhOvTkH6;X^3`4wP)0_n0ZCjfs7$re z-x#K;b_Ml!idd=DApbdY%j03H6X^@ge3F6Hi((>Lv&^uSM1xtPt8+pXAJdhuA1ljJ zcYD_B)g;d0ZgcAEE&LJF(E6&nL9x=_xjemX$mVK)!S3w+ZgqUIVc|O7C5;IBiJKri zc*2qr)fVq_49Y|uU>qpy-Y<23PR4S%0ddh-qcnbZeH4p$jM!Lqz(w3??%wap`{EPjOU9g~df&Fm@+N0+{-o4ws#fpvLwkW~(8{-} zx8T-a&aISb%sASF#AA3k+_1aPjL^Xd-z0b_!kHId@X1YD&RjmDOI#;GjzX%Xp4l(1 z5FG7xS2-dR>1ZE5BUy^x(5 zLe^V|8Q~{*t{NE?*@0kQKjWjU3aPA0deBiB`Ey1p;rkp+=zr~HI!*$!5U@MoWWeln z)aQw<$j9&u1}rEDNoTr&NsXE;12n60zp)R)!``qhnWto$%<-hB7R1il%CxOdsxXG5 z6jOM`9&oXL5S7K$Qb?`?+u1L6wfO4FhJE%0k zzlbzWZHUBg#!rAhNX;NYk`u31%A8>lg4}k5ML8bH6Wv zh0>T2SPIo^7ct7srXvJkEczJ7p@TB6NV`+cgP2;k)E~l323O_A42@x@CHi7XY)9%*}LOdZUs&IFL@BGkpALv(HVtI$>nu>Tniva2>w4phXq!G z5I=DF1%*ZU>@HtYI*{R7Q)M+x*~U1+gWJTrcEgexnnOG)CxhtA`Po)R9GGy4`8MC1 zxl-W9jL){;%BMBgfD0^k*kk)Uv9@7lv4JJkE zG{5bnX=;#RuMZK*gu_?)0&Bz}Zr~vr4x|!qEG}1tgBp|sVVJ#d{w4U_U+xEJ!2Ls$ z!$mq7IBJXn!p=&%ctDARmHr{k5S%Ec8hW zLSG3>-(n6Cac}@8<=s+bqJ*x{cX%u)ld?Y)tyd0Dl*-!`O56)Juh2Cv{Z1-`N#~Y? zuF@vkiAzC|S_Jg3gvs^@jgBDIcanVa+4)v%vk zTKJZ#_%a}C$|_k_pvHaZ;pbg17cZE(9Dy!`d8DWHFXcYoT2<&CV|3CoOP)dwT?!)5 zeNW?<_Bm`j_)pUwJ4Nv~7${1%+pl;+T@!zy9HW0VF)o%bgRvZ7z6BfC)*0|2&7NDx zud6J1)7UW5lV7U~U1%b%3#B9t9mZURAmx-xD@i6#>7a{N*f*eO5aC~j`Oj!~Lum^z z=%e=nH)68R-LeiujMpvQ_vf4pmigcu7-<;Dtv$p6W)TC3FXC^kUXk!ii`}W?R=+S+ zgTm4IV-gb7fA^0>pu9(=YmHtncec>1q9&HhgN`nn6xl@{)`4}VR%ris^uLjfGUYiOz@f1V2a=;hGMCueWP5n}-Bi@7Ji3{t= zjJzs>2UoEQ&xH9Zo7!2(cU{1M624U~;{6$DfXKC&`%I1Y{6p=NEWpMj6Q%OYfeZ`a z?idkLt^QYo`wx+5)k4O96Es{O;72r+lL2x@QO;@I_hW}@Rfe9T$!W4?UcI?w-p6Zz?7I-q@19%zu|{U#@jS#9VGg|hbvjo0Qb*Xo8Ks5 zgkMb1j|(HTWh-%w5t(d0#KTPwTZ8iak$BG#6LaF0qL}@RmGn8%g94ABQ7a!VR*@ts zdKPjAgTl$03}dX3TmwlRwKP4R{XHD~UlM-6N!aNn6TgOtx|aCGWH*t{Gkl{vy%la1 z>$9TmATF0&o1rTXGG83(WfSAO@_Ri;5C+Y1*5AjqUT3!`bfUdN8`8uh=+ZgJkxk?W zxYMX3Dm-r1)11tJV=SSApQ?g! zP|{>iSC;>j6w=?DTX69@cN8<;8`^24y8 z!b{>xwbp=0d^$dH|hoAKv4Z29!UdT*Qh8iDLt#X=T3&fR!&1l?azVmk1iVK z(r_Rd1mHx>L*)8JJq*(yi0Bu7I!s{L?9C00Ik>a6{u%A`XYBL!eFQ!Yz2bISek{1A zcgklk32T*6p{vk24-;6+F>^mXa0yY`v0LgOEnpO@ebIdkh@PyW?0NnG_pKWLMl0hc zW}({Sm#s@l#m{+sOp4+!;RZVNxGDezvkk*QBkx(-tfWFxT|$a1QgdS5G&dFRUlE@Z zg*e{;IdGT9zzdlJ8ohE`4<<$9f<#_DZvd0(2MUwT^|S)8cGpCQNJwOBA&$6t0j0zX z@g`bTk(Qn&b55!C&AHsU>2%VesIKmbdB@ z8OxW&KZ1|7t0ZrIl=^LPu24f{4zNsT>}G+6k7-JS#i5PL82Z*7)*~qZ>-B0MQf|Qs z%K8f#?kr6$-|j7I*;imJuM6l;MS10%fP4=GjY2?$_n+eQ8m3{#5lx~m$8(=!5CW2l z3UNTExijr;sedQ^)fOGyB1?I*_?5rzo-naZ(f)a-UK;4*vta*FeBErS*ZDM`QRCSc zNPfn=`sn(&Grb-)kbBX@BYz0)1YW&7=s@&BeZRX@m$?p=b%;vc5Z!gX+$AlLh503(e>^P^BFcmx-X`mF^W<+ z#xv`FSgtnwgox%ew`F9P8s}Kw&Xkq*w+0fxCcWpHef(xyz-;nL+s-oePNYsp>A&;U z|3niMQ4T!jhTYyFM_kUpS7vRZ}%g2NaVO(T+9y)%Hy!`n1e$w#i{^@2hxcTsIfeSbvx>r+?BW8Rh(Pk!HS=#O1Oz-C`Il> z=CY9(Bi$6hRMi6iZFVAUU<^8Q`tNWui~8Q=^k=&$Ui*`PA6bsG<4bFvmZ&q<*++Ma z*W=;xfs%;`(S4{j!4E{@McI?o?@g7eE!~<+frgvLYI4?it!(QILT; zsr%z^cfVBG11F|BT&9*V$3P3rChwtXhzG1DJUO5j4F5%={YnOpGbbP(7qdvyUX8rl zN{;cg_02JQA@r#4r;G};Us|3Fsz8;~t?`om&X%s%*5w*v;;WyQ+Q2j+`)_F+g^*n}b zQ1Bm9Ov%7mVDX=OJ#u6Ixuu+M10r_6QSvRmxZ+V!>H!1?GPp=kFAlt8L2WK5s`1@m z872&gnnYc*Ryk2r{rA^}wf|i>1o#=lo+XE08y9Pr!|wYPw~aP5p#+P zp1I1Wl);R4He0lox=c1_65(Yzt&I!@(JWT%Lo=@9YP(wwM_;RXN!mHFdfT-F?9tzY z-xWh{_9PY$+oh5Ky(2g%T;Tbt^?~-4LN~tX^QKzY9>X6qe7@*~0%x%zVAKn&=~B@k zC>oiUCE_3Ff&yKr-bIUIDjKm}ApLj3-%WAF1B`E6IsD^zSOt8bKN$f7->Mv^v3xle z%3}1<9%!oWHO#DVyX%sSJ`mOJJ0d|&R=@V_0^*8in!ddGx$5V`s(!`8YkyXXC%-*s zD2*F`rVWek$Oubgd$J^nlnj3+B_R@FlxF`pPcA3!KgW5DR4BQHTsY2SAluHyj$y#Y zE4(eS8o(HfHYd&Eu+HSjZgDQIg`HWYSS*I#(!^ciF*J3NBS1J*f*APoq{l$^YYQjU z^6fVpo!oD8vQL6|NtlPfq`i#}KH5N&MLz9TQ@XozL%V78d~WrI->0NdbCq%aXzrjo zRc6q~^t@t~v6dtfZK5Dd3Z$u$+bQAgyPV2^l7oLYhx|EK%ea1PL3_^l9#PVhX$d0 z3|`0*&#SJWd91Uv>sla&ireaMMCUjHdhJ4HwhIC_!xG@p$Yb&;U@BJ+)dPg4IX_uJ~vT$jxK!N!uSE%8s zJxZbFe+^P-as_(42zLD_{{04ux=c|28*s1*6`QEwLZFh0ieyP7;A9TF_y+9p5p6qn z=U=$Jc*8AdJwT?Y7BcMcX!1f<7~D2C%jAXUR@vt+S6(_*xut@$NgsfHaJEelmYbhq zInb<8OyysSWVwYe4oQIfG9bS*W9ZjL zZZ&YD1+UQ_Ehm*c4rF{`DXoLPg|_(dRyDxl=>NJJ{YcKV5K9ijdBH=rVtC*hXS_&5 z+p-qEAHyf#wzSY&9vvQ$L><(-~3NiCwC-0x%ONuvKIH zP7I9B)~SSA-N{F# zdc#^u>{o?w@F9~5d1Nyy_`Dw8q_qSr;Gi>qzz1YD)>fs|E6AsE7-(z=y2-DUCvvyZ zY@B6zfYM{9@B{mAvp_1s5M+j1TbeT)%`j-j(44_Unm2R1G9pL&f#Z?q6vV>&$JmSe zt*O>@qvmIGC*EqsG1XyA=2LDhn^!X;vM-cA-CqlTLCd}E4(mM2iiu}@DxlWqqOeQcpTyu-Xbpc@6*e9rk|xm#NKrq?6&2wxb|a=!{?{#0vX}! zO30kcB~@lFU3_VV%Pc&bD)C@R!`tLc0fi;Jd7WL88pt2kWuxq;(B@?lX7<&MS#p3^}*SqaxoPZpE|3>XpF8Jo;1kCS+Go>UF=; z+Jln@-GuC*i{3{-^GOvAAJMa$hbgaZGp(2K-s%i_KFq?W=3afEE85KG3AhZON4aph zq|`uApZK2Tk1-;|mzDUSR4#B2D0&m(lE1 z+hfwrW*2RxX3bWRXRdLO)s+jzYUMm|mn8@coz6aOv)J>p+|K2@qkFNZWz365&niT17 z%2rwn`X6Jt+J`Bu8gexq2hQMPNX>9n<0{iQE~x5UUBoCXZ8b5YwUO)f=NIMg%)d&D zU(As)RxL2tHN~>rcMI&ajg6PZxT&;JEIFB@WzSxAhMw0)_jf^wj9Oivl=d_o;%rXm zoGCRGk>^zS=a2kyFeuz1__GjHIf7R(UynnEz^&(I(B5fcJh^(}(oH(I~W zmtJl8vL!>Xa@`q4(Fs^!nb*IU3xM^vGhmx$^oKsr(pMn~-7gn(kC*p`%codg<)RB} z83^O5{%_*fkt^dH2B0Gv?L*G&(SE}y(;JBG+Z8(O!tB+Bg;hQ5i*JhYZP&UMk8r0j z(@v^28AX#r{9I`cJ3rFZ<_kN#0H|{M$+3FDl_+w)BH~KbnCWg==cV=P@vuupv@0+l zt;pKs`$3RX><^ci$6(If_tj+6if02yZrnn=-)3VQCx~~STcfy=ohX1*#phuj6hO+- zrgxko5QB@FVNg{Px-Fzsu@p;|%7qfy-*NZCnp}}*aF_ESVD5y!dT-tLC>+R&f|&U=MEtU z(BTTuA^Oi9UwsQF$fqov|7y9;RF9o-5bf{Wl#kB!KcDO>(Q7kq*6IZhPQ}|| zBdgQcW|@GCe*FvjY37kAT+k_V(Wb>$>bq%_f(PC@=4HE)=>*JrP6ItyM5X8@=CpRc zamV2a{Z-O;$NHD^L@F7aC)8`($X;#c#OH7n66p}}^5g-L682TT!=UK2i140xO>uUn zrs-S{F}i`^Md#ZkL;>GRVw=ArN`qF>`FnYr>meyDRO(>HDGRYW=s4*dFjpBUM_~o2GmfOGDVt_*w zI0w{uo;Z|=d&zAFCT8UzZG{vkJu|Eq3AZDW*)g?32lzzNsN% zwj1i`LS(T%ZsL8raA#i!lYAC1(np-3WbVu^2Pr7bM`9?Wk8g|C9Y;zLR()aJ(*+Is z@(b(SMEpNT5%-%J6hEv4DSZdjciXbbmL89^k7hMD12R~W|%{P{h#J>(AfwWn|Z%VsYAzV0R^vRJS z90QlhGHqGH!arPKp?*EU9#&E^ob;I;_smu018#ajyMA&4tm+~VPFAms>*)}TjDSIH zi{}igfuJjgI$WRrnuh68>-!NwO-DL|pj01OHR9 z$dj283HaA(riP3PA9!!(`^N;%v%Mu7bej_ww?}xzc2j)T64z3KE|IEb%v6F{e@GyL z`Vk;VpyoR^#wL4~H6xV$MrrvCx8=JHCN3(l4 zY*yraIQiKedc>9HdN^gbGnD1y{xK}ywio?gT8zmyK?7msO1JNe;S-z4E_LtQHs4F< z4_hiKC9a<{Cpe{B@O%)6+?>Ha_+Q=JhBgQH53%<1$jOWM;_KgU752Gie83{Fe{9S5 z))K@?%Wn(SmyM+``*A`xR2;$pOr$E`@b4H^h}11Z`n#9lq|bnQPNr0jQNQW-oF=Dg z3Ba*B=lNyhOGYX7&>7Ji6VfjW|3{|`GxpXJ?DA&wf&=Ox@8?izUD4DXXwpo#GQk>%(>Ku~k_sqK;Tu<4KNf-T0+_ z9{9LmqpK2~NV~^JUpl4NYgbxb_{AoGTM8kB&pA?O5W7kc8`(t!ztmptZk9YlO-&F- zHV1lFU|}?O0@r?3ezD>Q27^Wd@j0A=j#x{j*I$Xe4|7DR?f=^YKpWn(*+V|C5sth+ zHovB1^#ZcJO-7vd=#Kcc;*n?G-ZE>b=1MoX6e!JbpOBFeZ@&%RA{CFmHtX&1Dy>VB z%8b~xjOfH6G6(Wyfv?BhKuN9?y+B{Ke+VsPW0e8o(Yh6?n-P>)29h{wyhswU29o*L zm!Gq`KS7X5{)x@1GdP7FaAgV9b5~e=bvm}V%_w$pYlC7*p zaK_YL==N0wt|qsXNYr0v9G>^WP;H||jL2P!=9I5%H+*r-lsmKmO(gf^c?WX7R%HHE zTmN*JScw>m;r&-WcRxot_EtvMBjw}1<6EMT20Y*YREThfG^FRCG^Fjit8>jw>=#&% zGSZi~`*RbUA14?|nR%((o0Ovrd~~i^Wk1Lgm$r)@Vl=Zdi&6!WUiD=Pw^fc&h84zb zQcSUSzq?byNiT-BZeF9XiHw1nop9%H8y6tL5yI3@y5pmm@> z2Kuv9$9+q!V#Tqnj75!cJs`xIs4C60NJ?UBQV!qeK>raZ9y`G)PA=665$_Z;Ui

dMvzP2y6>63y#0jS-0-xa$w!f|goRA*eD#u?jDa4PXvbsd>)eVt zVs6>(+d*UKHObOJj(Z!-MBqp-Hw1#lULJR7^ClnTeK(@g97$IK&?4@oO#f@Z({f+W zpWpu~x7w^KYh1z;y1X4oYec{K2!LDrG z(nk662xE2#m!GZtLBz5M<$4 z)gmmi2ZDhT0;xz+VIy<%u9z-t*%I;plbP(lWTptn#pCTdGJ@z@#pnFwWsxnn_H~(~ zmWCR<+DQi+UG6n)|AN7Olk9(y27XGj?CkKe&fw zQ^MZ8Qp0JXX7~-irNpNSo6gw}$_9|CRltZ42+D?{lz0bY=uq9trMvXxek$!j4f?02$Gh}Cwjb8s)rzq6 zBPH`lZkQuOC)o44LsRyd>)MO1wToFnTnl(@LbPQ#)0zO_U$tWDL6to;@(QeuSx&kO ztSpIb;jXp@%9b40Rok>V5Xk7yxqjE?n6epKvIYE*Va6D(c`QOgA{&>G^Z&=#TZUED zM%}`SASGQ&NOyOGba!`mcL@m6-AIRYOLup7he)?{!`T~stoM7rbN;x!u08i!W6T(H z-uDU`qF5YC{O-Cz%h;<9+#WPo<8sR1;mudcG-$moz>X#AxRG&pc(vhzrShp>(Pl$w z(au3x$NS_!7b=$4_?x=8R7h+*m{* zOGw!eY0`|m&dDT582d8$b29yoIDYW~(wHwmx75)ow&bo@*(0wU#l5#oa=0w3JEDZn z^e;YZspH8mdKO!bQx5+;o1!g(Bo$~MH5#Y(v=R$Gi+3H8^qn-Yr+hvhHU)hf|NupD_@A}0q*o07WY;bHB> ziv}M~a@47ZE38^B%CShYVOAy~s*`wm0gGR>8c}2NDn<4Qo!Lo~sDwM;uOwRlg*RhuQLm(k^{P(U`UtBUO)3Vb(Ho({*dKc z&;c*4u{f7EXGj<*x`JM&ErH(pD>$KX1E2ut9755ycDY{lpek(#WzIp0)lhDCTTp+_UOn<072TvOscf$9*=cBETD`dy)gY2t3z6H-v3V`AFHH`|y1H7Ol z-@&9DmOisMo3H?aYFZ^uy5#NdJClL=z#7J1TUs^GiR7#kNejmjW5@_?|X&dS8Ji#uXf-%5}pJjCR z3JW3jGbRYQ5`iWWEat4)k6(VhfXdqqsck>D>_Og@9G$HDq`tIc!;bDtjOoTO#Ef(D zOd$hU6VH(&LSUbh?|d}6Ov zT{51>h9G!PucU^FwtsYoBnyPk3xl(iC8w_zo8$I4CvNn$dWJMBN5zPaZ)lP1huEm?C?Xm&n2GqnRIDt7Nejt4el*=o9-G2xFB<>0Zwoypg7X;v=VK&`zLD9J^VV_#*CHM%_k-z&3GAF;QiJ zRSg)X3#iRrL3kE>AvcIoOe5APWe}r;FElRNnbC4HdyP*8kRx|U$OS0r0R2$8sL%9) zIVJ7$XQcCGd*|~BcoN+M$qpgD^pL8L@7faOdHcLG^fgS-@$h(f*TKka;?NWl`h8vu z!;*8ZMJ#Z_+h^kwG@ZyAe&i{YBo%$v*y4&X|BasgU;s( zv&CzL`xor##iH-fJJeW*(xb@`DrK_uSvw53=KAH0Q;E(M&!kOO&feeG<8smBPU$>S_~*fmb|xZU`c^eldio0E3M4Jx}3hI+6)ZSOe_FT`k=-GQ|8;g zSg>q%w0{txg$=l;^0T<=v0K#=cOG9yt#NOyFqbKM1n~sctp#OezS;b_e1JzLm_geT z>vaGs@=GW9Pc#ua-DeeH$fzi~CkMqQ17hWIsTSwC{YYGWy)d_lcjh)AENd?%afAJelhwB62q_)Mx9cgZfX}yl z-_h2Ddu5{n8N=HF$dPn<@`+6Cpkjn!+KEH0)C@dI!hW%KF&Sw*=%bep+S>84?^qe0 z0u$R!k_iY*k0|Zb$A#=P%Wtp~-aV|EBGaZBUfX*HgKu_84V>0gdZ6wjB2BDp1P$G} ziz&;Zj3jho6*Y?V_9(C%-WIdRjOLVBQ9d(Y#8D#Ur_iZuZ}ZZc?Mt&uob{$U4l^Ek zE1J|!qpzGnU9GzPwZ6fgS;u$PwG7f24p~^u_@o_{ap+C+#KX*L@qBDGu}|9RyXW>s z4dJKnAnn0MXh518JTn`i2wjynCQ94+b(7pDf&_3W1JgCm|^9~s;}6uLgItyvJFlfnMdL*bqu z*(7Kqf*)VL^>r9G&nc|dly-O=Iml?Xzs@&x7`-Wsc4+r~eE-fCxODrX%FY_Nbmt;Z zdY(+2D;Y8fBrdCNojQI(EJ)w`6eRWaf?h8|TIudrKVfl)MAFTyc)Y!XmxH`A^ax-D zynE_Bi;&hwL)S1nR3Y4yHE{X%kFFman-gHn{MG#P7YP04)>)H?r&+a4Rx;Kb`_u|2 zn(ih+O~2rmY`pF|OL&!P?vpTV4O4D~?Zf7MOPx&&bLmB0W%*(>v6EUX)V0uK zmIk^F8zyxFC8KZynQCsm8$|6|p00pfA4zg0_AsJutJz2Pj;c9qF|6BNnv^tJZNgWs z6BA@{hU!)0-tC#D2XTH=dDGD&w>_t0wuR~nh3z@JUvTe_&t?iILtmyL+7OLW5ayJV z*~+>|F}VBK(Z-+6Hs82lTwdbzY;d|&u@BvR4~3z8YUo&h7jg&w!b2;c5fpb?*x4C<22!;%UX?EWIVHQ z9oA)3m1lga(&E@Q65Zb?k!@XP=j(hezheMyWf&5PB|a6pmW*vNXY5%t5wfjVnuOMY z+m*IUFeKq#_z-kGY>mC}A@Lg4dssw^wmZt(G#3p1z`MZZ zwQBolKXje>M&5hzq=`J^UvlzA|ZX-K-!6p_@Py;n7N7AAOf$@sBmFJov$al&5&?T!e&85=*OjX}VD1W)m)jYBMb32u{Xe|3eQb4F0_FbZ%^Dp&T3 z6>P3hoxr6mI~Y4wL@(e1a;&c-m?>o|q=w4n!x#D?W+$CFR@mNQ3D{&&fuJ&BL{2A@ zFn-k>k}U%sP{4iv%OG1Hy_V{r2ZnioXSZ{T*~bJ&?n$#c6ckJA8C*gLI+aw_FU(XC z@P_}IUtj9(bo_D~^2SsyES_P<6Y(Nj);#TyI@GG{0u zteRLt24&X?3b?*nAdViOYv4t$K=XJ);0M-^Q|SZrPT3HN7agpz05|pme?Ss9=YqIl zr@i^>i zg);rRcj_@+k$$t&(-KZf?MU-8gLMjCckhu2sVv2@g*EE=)zNn*US(4z^qdXw3eqk# zf27ovbUCcU)EK5j5@|6D%RUg4-8Ldn9>T2mwh3VfOng&mYng%3UdwcE-_qdrK2Mx| zKy!EJ986QW3FsVeq#LAUgD4z)d>%nz-3vR?OmmH5Fsjg?&Jmt6*Ec>tCJ0#cY|ZWw zfhJ6o-UCcz)Fn-nhM|Y)fLue#UV9!fcV8@igr?Y3N1Hh|olzCdytr%a>|Qp`YAt58 z7w8zsF&Afhmd#saU=}yYc@v$+{pK&#N9(+&Mi7{FJNqXIc8!4bm$O)F%38vIbhJQl z3+_UfUb-N)||QbFQABniwRMGa0S6I6~S`9pztN+6(Sg z&M?ZM!&FbS^mN$c8hSglW$tDT>vfcCf_0Xt zASl@&20L&*W#f&FVM~QZQ2`z{yM(6;?GPY>*!mC!+flCp|0IhrS0*u*XxwN^mZK5Z zCdWXgz6;hnduZ(Oq!7dH1WYQ&$UrdLl95b$!>OoV+ z-lg+}0;0Gvg1xJc|#hu02=t4)>s+Dn#K<$|M#3H+tdz#8+Rl}*aCZZ(w=8edMiLswDTA{YALl> zPi%k4Ixl73zLi+>vE1bNtTQ;T~^p`DF;&Q~=1^*Iws?t9$IaDgok|MlXv~ z)V7hNmu-l#!;UU;_*Of5>=M)@d^{vSidi5jpFYXL3;K!3CU{a=k1! zA^GlJ7t0V4MKz!`gD%$(1qn@~0c0}@S9c#}b(95Do*x20pU#qtPtf1J7q z|4IKxk4UgsU8vYjB5+5dJ@ia1i2G`&JsuttJyqGMuMf`qb;_ukstmYFNhmv=vG_D- zR?NM;F4 zehY+7UHr<8lcqCUNLdOFsK68EhzIBdtb($i7?Q*vh1O#-&)K3C6i-CCB|Thy&d+{I z@aP%|C#MUQ>kSa#TRpN2BgM&8Y9iQ_PL)@@f;6kK2h)v#w*Kf|iPe9~GGJwU{+c#Ow* z((x!`LC~N+S2b$~6e9%@6he@Z-`BjVJoeiku=WsFZ62O6YjZ^V{}HLbu@ zn)Z6_O;gh*ox33YepaCAW|>9}>Q1?3i?cDtDO~aT;fh6ey@!!63p1SLvjAsMyltx} z&}XB70ls7$yVav%4cvic`MxGH&1CDq*`Gc{z*O}ScjERaJ>=@5k!S#^zrN?>qV;cB6Df0$?y-xp~&nuVIWOSN(k)0d8HDY`A@AMLp zPKh{8?&%{EDDH1k(Ex8u9Ozav#Bc*25idL#@@qI`g6&B)TZm_XI}DwG?xnLSRj=Sn z;8a|Evk)Sd)5<#Mr6aA zfmb{oV1SYj+GnSJCD#s-%<}xF4B&=|CgbQ_yG1crutjtD_EM;eC5_FGq${%{Kda+M zwmN!EhA>=o^i7n#&|hGwVJ^Up0%2wmnt6H5g^l`;mz)eOUd9ttN7^R7YHZNlxny>5 zu&A;KdppXeMqav)bju1V=^0S_h=55aa`VD?W0AL}=$bKJ1-vEcBp&#ZE8`aOi<7Tr z```79g2M&B-n~TZwIV63Y$r1iMvTP0@0aVfALa|}x4jpR`WnWc@A_RBvHvi;xqSIY!6nhUfB!}6q-kMKcqK6Kc*Am7b40QRl!Br`YA`s3(G2s zeY5S4?dJy@G+>E*{$q?dRL}X0_{Lb-^KI(DDi7YKt#bsqU0sUZP~o!H<4VfjJ01!Q zeHgBz^_pr3Uzk^Hw6oS616Uo31C|rAf=Ld@x(x^ovXH4|t|p`dbrqBNi9zcOtL-H% z&(x6?vZCAHKp`+QYgUU9_sKs4=)W-tY`y1VDifUAlpZz>e1^5{b71c-SJ>FA6t@fO zFG386RS2}D5|bxVDVWY|eRUfQC&yCv?B~cc{U%oZUB`JnzA|wU@krE7{m|7H`jKX|um_Q>E3*1ZZ%yXnpzIQkm6!hp<)p6}yzn~>n+mCtiJxi|ED zH%?V@WAvs7_i1@iA+Dg1tsh1}PPe8^eqS1e-&nFILzkTecv21A@rM-v%wV|;x-L5I z63j^XYf=lY_t8~vjT`coEu>ED^bgV!ygo86giwo4IN4s9+DT`V>d-Ij8*aGN_iHfT z#`|)l8hR>bkFOLN8m=xs98*^;2f2Ay7^-eV!=J-~q3x3tm4w#9t%9+$1=gefD2Y?PDQqrj^x52tb)XS)-s4M~)gZ_l*&^F=v_M}2=#d>*${;vB6n_(aIo zXnd->e&$#3I5NS-O$gWo{sM@nk+n@~iVH+=C{*+m;!5R(A|-HyZsi2^-BFDpBqQra z7=RSwMJ0^7F)j9GKzZ#R6qxq%MMKf^Le!`Adl9W@72x3=NKSE(TWP!C!}MYZ z#O5fpi}H&R!FTY=!B9aI(9nV*&>H%FKZT*N0{uA+TM71I>>!_Xf5(wK0XnrCH7(la z!JVx8I((#)r3{4rTSkC(vIz1gU`*X*yG;gOzhnWA(*d%=IVCNeHc2Iuk2CQ7L_$UY zm4Gv$Q74>07I31ZmR4&aSZI#K;i8J}WqUY%KNk(!g8%uCdL^EjEbhekSK;v%O zR*HtBlgah^dLW~AJem7FaJTETRIl`_X%j&XUL8N(=xzEZniQ|5rd(xmj=K<=R)h(T z+|7u&9f{l^pn>BF)y8N+R8*F5#H+pZB0M$@avD*(C`0u;#w`!xz&0q!|3)jb81HC_ zjIXcY=m>SXFwI5V6Ejq-<`NqEC6lr|^C2*@x|z5}1XQUjJwGEXe$N6)?1Cad@p#A~aVm{sXs<9Io6lwVbnr%Ar;SK#P9Z z^+UsavW|&~m%!Zso&@P7?8P@LD_1OcLF}(nU!NT=CS|76B=K)Ot+8TcTj6@Rll5)x z?#GnEFMEbxuM~aEZVJ&%b1;)gC+s6TaLvQ~k~xa2HEicIA&=_YnoNfC%{#m4XQd3* z%ZzI>`BpM>^u|w)c7_V{(;);QFIiMP zi4mbd2r6cuc*BE>oK{EzmC!>zxR}+?&52L0pR;Prp>`~s;iCeo<;o}-+{eItoxwfd z&|aPMz793AA`hPXcwK0u!7~09eg9M5}DUgnDM&8B=8Ku07C)^i`!m4+o$GmxSOHUFeeK>{QHTTybG}9 zqnhwbs6LHscdzJ#<=d3}?~O|>oVkm*wp(d)WhGDfl>%NUuUh;@Aok+A(sS50#z>G_ zYo<@tF3Q%^G>pBBy+TKW9IzB0)iw+tuPV=zO<3u`*z|k_OS`yzHnJz+20L!9g$4w;*7Y9$V|7s=h3m2t~9 zD2x1uy>6;s#o7B&d%S`a$J+q~Zjpc>vT*LcbH}eq34>DD)oFMPc)FqEq26K?C$wPk ztV7WMehm_0OUH{CIC^<##J`DtGjZIo!zY}d&x?yRgr;to9LN#L<$f#m(MzM?16V2! z@PbvrYr^mP&ndNDDRlO-mtM$!spz*aeqk!-3-`^ent9f@T$ONNF;6!^?Z9?cX=-J$ z^{xN7kMj7J!@Kl$6q9>zh9mb8v?8r}_S;izt;VxcaEj4aT1B*6j|99Dz^x{4j?B-; zPKg|c*iK0kJ!{FptZE`^_Hya(Sd}QKF$bdi0GLv z`_4!KNH(+;jrMdN(wG|A^`-gd+lJDtEox%+GZ#Zw^ts&^MMs$&7Drr-%y5QP*=5ai z@2>^n#n}Rf5uZjP%-9Og@<=PETYTk0Vqd}-VDGfX;6$h->q3vsq~nm$7eL5oTI%u?6ei=}@!9 z5Fdh2s~EjiOpctUTbJ1K9-$gdA4}FO3#srgr?(~aBvqtj)!(<$T{@);Ufsv%cmP2?#zrx8 z7JUlwBWte}zN%Hdj_wFyu$0@*4xEuz!f3x%`6wqwJZ??|TuyW^_*0AW56Is)xyl2L z!&HSp<|b4iqgTxcQh=iE7mJB!6;z4qb&x5ilX(c@KWwFnZH?lC|8c223Nr`yxfWW;u=ao=7?pW&ZXdvZ& zi3z0)0twt#HJ1Rsex(EK{q#l7!wY!S0_QQyN_j>dopP!Vm*9CoLFD+norQCi0qg zz}KAw5R3M}EE;#{$9`@kJrjT;6Xj-ay%GPJ+Os+_T=Y#EX>ZWK4U_|*e}RtdpxO$7 ztFLiu2c!9Z#bE#3Or#?o&yR{|EDG557`hJk8DUJI%!HrzfczM?1b9S4#Cg$l5%may zdfSSb^~GuKw8x5(Nt0W}tACmjcCI=t<|{aquVAbWVTGazf|wej=PjA7B&u22swGbDuq~zwHepW`_n&l@@+zpBG(7J9eF=XxC65=RaZFkrH zTa1yVRIx{EDX&f4D%8Llmn=*ObXB4mK9{MAL4tA~=VJ=8Z8ATw#G11slhA2$aCru`L9|L%xf3c-wKu3b&zw3d_qDTW)Go5~ZSLHEi zG>6o|%=fZeVTa4yHaZ$cSG=9#iz48zIB0CuxtyV??b#aZ#qGILBCkH=tiOV z<%G7j6K}hzFi@e|d@!^9)@urJ`S{+?LB63m90C;UILX^3d)X*G4@tfA5pm`G*Ubd9 z^md5Zc)+4U8XR1cY^VV|cIXyu_kLW#CTM;BX9iz7H}O`DrZ_Z5JaPxk4rT3g&os>STx}sh2yF>*M^F0n8(B z8MTH(x{cHG-Nx;ltrL}1 z>le;S3b*)VlVjpm6Rnj#m^#YZ5Wt}ZZ9S+w&sGHwFPko532|dQ#yzSwDkvr!zLUF3 z#|!soAm!X*S|h+?Os(b{jvog-XzGtr7Gq6`oTm0S9v*ZWA|G6nJwx8kaQD36ey}7C zEGJe}VM0mP z->zTDd>wo?6>!}=O`R=sF=et%i#)VLloPlmqKw4@5r-Pf;GjgJYc3H1{~BL%?h)`8 zIGCy&vLIhSkfU3fn&z6Ss99}wMQ8Qf*RUVHbD9yK@<6jLQ;0-B&`n;SIf{IDkaNF? ziudJ|Pz$jG41C9=YLpU7dp2a)a6*Riani2KXcreOheY;^KP;PE>AW4+O!Va_emMD2 z24~v)`o_f4TZ!`P>(aK9dbJ@YsTZ)89!)AvN8mFR=hqEG3uyN+RV_`!Mwgy1buLYa z2WprX_P*~B`Dk=+bsRM1rOg@Gn=P~qTn*OjUZ!4O)M|7aHR7fae3M&EI8mSk!@S37{emrX61L_3p04%u`O*H%h4?O}709iA-<)o zKRmd9e8ttc$K+;v3OQ4FZ7#6_ay^;j9)E1-79nXo-vWM3K*X_adFp=k{rTncfyAQ- zGxG>HtlYBt`#8jL5xiIRtF?)mAxWPt>6#bszAc?T@EFNqF@7#cOi39LoLZNCG6Z7f zTvR{jF(RFE8-{b)-E`fz=^Cm!ieB5ioo#ry(R9FmS>eAjz%_^#{D3j9-MsMO+krfq z)>>Qh+~o#$g_S9roZ(S(+ra4y>@#wYiGpkS*ICj0R~--)I&O}vmf^z-J6&V?@cerK6mO$hDCg zjYkW!ntUoNwD^1O2Iy6ptj2*W(0F&WO}mB=NwYaXWyk|EWoFUfy(Kh&_q;)cC0lZG z)!OIdE`3)9lbj_PdQ8iQ^i=_OCbuuw#m6T|gp6qm-cKn;#lF25mpJUjVkj$~*hiy6 z6fdkQ!^NsAlos+mrjP!qsENQ+mZc{OS9-*QMCjiT4Xh)In6;M%&Ya<$kwzOqi36%j z0@hWbAqR~%JOMe{kWM_Vk1%T5M{BTXXR1SvXyoZkiI``$`Vyt?SoEYsL;9a6qQwY` zAzN4!Ckkb9#ZyUX1R{eNS+_Te6E#U${{VyJL24j0p7=c&SJ;a*NWQ3#huUxQEcu2u zT6bLBuaB;dAMmB!9wTRhd;fX@h#Ydha`eYktkRvpX+5H@tb|w52DX7&jH|>dX0D2- zzbSD_s7@eR{Y7bHXzEOV_9rEOvvJI`eN{fGUCiHriy#61)scwckOOA8ne8Y&Jq#z9 z^NgeZ9_E;( z-~Py3!#H#%_=856Rqa~jf2Wu3VO~5I{v#+@E7m>uE;+5p0%X(c=})$Q#Dm=f;7EYM z&!9TI@4yQG1Nq_;l>g$nd*#ReR)p4ss6#(N9nVCf_6f;Fg)6Cg>QIG&2s%=T|uz%T-#{NeAqwa7pH-3&l-BL2U^ z1|WIL*qye-5KYYSR`aoW+>TWe%^v?MRHXeYK=y0* z{47&{`@4(JCK6?93BR&&_85@+ZDIfM+qpUrngIUbS6Iu|kVMS9vHpt;5JV2}2fu1d zyN5Vx8kGIN;AE}UU`qgh@T;=g!lVE`a{MnRg?p^H6M;YYB^BOSX~L>V`_4boGHaM9 zEOz);+A-J^o$-%%ei?r%-A~TZ5||jt|M>vV%ge&?4m zBoU;Zc0-^B`6FRBU$GqHUef<6r}oZBNkmAbpD_@B|4AZw@AV%CSMT8~(fgT|okDY+ zb?(2zM>KrUfN%0`vH2eOZ-6u@7Yg1p*?|Hb6r3V^h=iD_$x_ah^TQW=4!fAC#Q=ChRi!55C0t3T1Mb13jvBxq~^ zT?^o`AAv*~`TJW28_Qt?0L&km^i9Pstd{jpXARW>ot6C4S!PeRzf=uCNhl`ZKUD)# z`t}c{fIle-{Y%N_Pf7sOzbLUs5e*LoKFMik#U>`e_LnvQya=TDqkuj+PbcF8=>HPa zK)WXr{||ftsRh8i`3L4tEWk$a?Wbk|8U6WfA`A1@r#~6>{KIH565vnCETB#UqXe-1 zi;|vb=YL%jNXhOWN`rq=()*WE9qS(<1epE`FffEzB7hX(e`?vl7y@j6=@r0>KoURn zN}R)NnD(En1d{k61OI<~$2$V0$~Tj(|G+GcxkC_1WAk63Rs8)eFi7oxGD7-?(V;NF zpTtiR49rS^?O&823BUa}g#ai?{*#uhtAA30{D%_pUz7l*f7Mx779d6NfZdYzxQG>K z`>WLgya=TDyU=|82_cZg4^ag~@Go!t$#-Y9GZ%pQk1!w-g#miyCzjuZ_UE_2RA=4z zlM(4ZjQ)`hfbCzDVi1piNmdbS?!T1&(vFyaD9Qar31IqHoe2SjD-t+=0SgUi`)8p6 zN&GIf{(nLUB=JjF{#U+d*54GSlTrR4{Exl^ayIB6%s}g3M^^lY?%!2t)b$Ulpuc=Y z{tqMI!G2YP%0H@80noSKh4e3|zZI+KpNs__>sMa=Pf&l#%KwV#tz_eHV#S}5^gjek zUj|f&53p0#i~&4lkANH|C*#90@qs?|xW|lu+kXf#Es*AUAiE^to-P@J{T%)A*O9K({e-za54_T&Be4su+M$(<4~3eZjfWDaljPhFEc1|9 zkKv6M#8U&xu}b%uEhukC6yd05HmBVmAKHc*HvAuxC@mWrP}o}TMou2+S4NJk4(1vR zTNYQW(FPta?kTGBn<+-&pRrJew8E=~_TXy)HuJ62z@_>ncl zjA*V+l&@Umwu^rVybl2 zdK+Bi_((E!7Or?;Z)fMZ|9NUxj9a<5GCcJrbD86}kg~$Ny!Im&dZN2HA!vPCl{tobpuqSE#R1z zo@}KfrWLA`O1bwN$xR2<SGu1bLQ!op?}g9kT-`e@ z@V8tqF!!v4XkI+#k5|23R=VsNIGHiH-7CL$n0sq8SKXqwG16$>#ctXBcv1gonp-io z;Nodiu}yV*n~3(f;EAm@w9>qA@7C0~{7~5P-Du$4_1fcdy1~+MteDB_+^I5tV1upc z`0lXv@o>6k=HtU~d4sA|%U7q7lK8@NQzorTr_UA57!RC}#S2`Bo->}4Rs#vRcJYdhB@gqI^-~L869hI|%d9kvZ z)EW!&1G$V~Vhv$n3OQe7Ed>oth+o@# z^|veSp@tq0f&A~Odj&g25268%+z>am0%qe!$8k*G_1hW}A(R~l(yiD-kt{K0pZu~U>zSnnlG*-ouCut3AFaLA^mooC@3BJc#C zR_cpb<=2|=JdgAG^4^)oh|$8e8>94daDpfDf!2m7pU5J8{o%^prM@d%GIxL1%=I9g zK}=<4b_5ZGdg?Z0aY2G-7*3RD?3i7pXX;I}J5UT0@MN}gZpl!x92 z7)he(=XJtpX-P*bX1x<_@kmUm1XFqyC8LHr?3Cw;KVEa2S>b$7-f z)XUxqlOM-4%Z!3E3gL1xht4{_aT|hs*z}QNSe-EVeoCyKWplN0nhUW?aIgDZzGjWT21(z1*Lst zHe1N6ZCq}%4@5b?D|HxPUsa%KqH&03{94Kbp)J?eMA#^lRTTN$R7QRX?d`F>e5q@- z&4PCct6ALgO5>N%ov!M`RdFROw7UEUL#1!(PEPxDR8UP}_VG4=SFNNQSDr%k!_*CK zuXavPi7ACl!7bF*WtmhM6ntk;nB_#&dELkVB}BfRS#TDrL$4@@+-bxpOnk@MR8}a# zp;mp2q}FvMKcduRyA%dda;Z=a1936%5ejkLJ$X&q5k0q#_a)$lD3AE+F`+svT;p|L z>kbd|Zz7qx(b$4@`s=Ziy|`;LSJ*BPO+uMfF!3ex5kd=vYyE@|aC0DS&feOMVBReJ zYJr@JqvVUDV!_JO=%R?-ioF)cZwVs{lw`8{1(OA*13B&HSn9c}ct#FRltheAtHAa+ zL_%J;?L4Q6W?4W-z%&>yf zcI(?gd#;7N`a}3(F~tF5JW??(2*fZ90k0e#QpKB4JUL8|qYX&WHR0JgCw&QhM~ip3 z{cx!``9d)H8W>Px$~U2?5|j+Kaj2-r>nkrsln&SX`rE0F70tc$*?8!t)YeBOvPCcp zy?bl|n2~z-mBp5-+iAum29Ve#)$402F)`CJ&@4RNUFRzDW86Nj4_`~?N}pm<~!uzR}624Y|5`<@tOyd z3lN-XyiNy%;q%qHgfd2Sxs}CNVlY|^OwnygpJ81D?Ir37&0I?}q02B2dGb=YtYsd- ztfshMXM)3Glb+YA%FyMesJBrWwbgw>E%le;+dB^9!67S4pl>13nXV09?sqO4t%nj^-T6>_T68?<^9-y_$PKZ(P-%xNY@H4PX zoET&;MQ_mqo|`4>Ax=P_?#&2Mp_3(N&~tvMXLqdIy)97Z`j+MYW`nAVg6?sUL~$7@ChS8;i6gn*3hr5>my0L$ z>;;6{%guxwTO$Z5D2$9Lz*z13E4!WV2&Y}e49aGz-r{DcDOmL-x`?mI>m|c(-jtKw zW}u&)WPVLtfD%E@EuWUAnfZ|5KRR6y6KO1B({QE4ej5@`JNiq_s>BR&tMc`_Z{()&?9+43*Y^Pf#B8+^i6|BX3wXTX)n- z985e0l{^xU-xR%^QzR+%qr*U=3oHM0GncB-z#7H`m$ju@vIjfpwRCA2PvRfi%l*bm zii9%PF{?1>nCAFRhY7<5ST=##rNQ<20MqINg`DR?#m&tQI)^*~eELA(EAjf|(6jtI zaiV@niA&Q$qQ|_pXfa{ruQ0HJ^?QrxLkwwy9=FEqq^{uUuEVMvM&KV)uU>KJuLQS$ z)qFR7{q6(~Td{%###$AYLX5hgn=c4Wd^=aaE((o8l0b4$88fKx!_@%G$y6`-q~qj9 zs#R7+>|({xp39|vV5u(2JnB2*g5K_+i9qy56Ojjglqqy;hL*29$$Fw`zFnSZ1_TzC zP8Fk*Oy_nuNV4Jv-=fseR!7WY6B@N!RhxnyI*YEJO$g(<)Oxj5|l%-OddlL#1#!06ySvXTy@^0;TJE}KzgPJhp%zLxh zeZFk(SD+U0T#^K1AO#ww!k;jWXKqBWFRkF)6GVrPo9lhH-V@1iG}>?o{EW$_L40j# zCLig&ba-H=oOxLf*+dg_WRt6IO?QG6HlHvw94Mhu7^t@w`5?d%oK=OjYA!*7FH^<+ zzVLX9sg0CytfnA(Pjs0ln|d+V6iL}it0)#_>6m7AGA!Yyz9?^a30<ClBv0)I2F1S?%q%zm+(GBC9Ds$ozyT8 zxkSR{&G*ushEF<^%a&q2$CDO=d>#q!t&9UBEwqQDnSug!&}o4f=sl7G|{EVr&G5&-xQ{06d5Qo`~1J zg9eFo$rZ>w7%bj`AOt)l?z@g^p2*i_FnAGuI3Pjh=WN->hMe?44#Rm52YPqhf2(4R z&|Xk0Kn+nro;`yGd}`SmnA=fP0sl>j60-!Mef6#s(LhT)zY~PEXtsvKY9 zq+aLQMd)lRjxmDRV`?g8DI7z(Bc|O#ws|*Ar}~^CWAU?cGg9qTn@nXgMzMF484MAl z=do2P`mlpU7SHR5)6B4<#Md-Zme22N1O=g+T7Iuh|k`Bdj@KG2Ij4lRyAO(v$4 z7VY2VGJek)JUz#W$P^N=rZ|ht5)XEaDdkFCYR)>%*3+$YUfF&;9nC}LylzRM$qpQ! z5r8DJD!T^zn<$z*xNX++XU~XVJbMQBL;jttY|V77tjvH7AT-L#Y=H*8yCsMi#J!5` zxY`lsi%z9EOo&Ahp^J+C9wycpHh#)pWtvA6mJzJ)7o~AK;`_tHNW~O~+wpmK+tL23 z?12OV(>Rk|a>&G6v4szib@OaPq{1~~78-hBPSvK2uSF}a@5mg|Suy}`iCUX`cZ(fo zg=xJ?_{@Ycok6H0XlizjI$mC}6|Mx=C>-(r;*++BYSA~tkE7QuXqn=vV|sy5JA_8} zn$N`;&?m2;@Qm!@oJ|_s_P$S{f7{KlRm@MO^y_?ysdG+r2an;to_&PxPl>M6klduD z|NP39szK92CSp*z&)vJunbk%Y# z8H8GP$?rpR)jSn@4Um>uNbIgsJ&d$X?lp)7O}tVziSU}iI&@G)fl`)%xU18;>5`Bb zC92<}_vW}ujQHgAh(SylaK4G97UJLTq=z)WXAA8SJA5HIcLl50^wo|A&E zWf$@HY4K^-Pv5NCw&T|xFZC~vd|FR2h98X=ou<4oZ|W}IPs@Mi?X=iw`ESJ|e$)tE z9ap5c1sIXNz?3TmiBL%5MUGZ*LOwdlm#f)8z-_%y5rcc~%S9_z=iL$07by92@JP#< zDX-pY?+RGhowsE52j3IF<$NZoXC0j@yW*`(=fxL|K{t(dTQf}6m2zz?wK!wG^{d-Q znObJQse7{o9vSRuyl6yBD_aBArKT=u|bGme5 z!{PU*?NI%?^r3WwJTUPl0NXFXUL!-abADb)YFwa3Yj z3ArVU(%(ufvsyiYPb?trnZ;wHD_b=eay>m)*nMP%L--Ab37d;l=EhD`lQZhMzxyN` z+pO*`p1Vr~CI)*K?7n9>ZJ%|&4@>8nsm}9MW>$aVTDBf}HV?l~xTPo@a@eT$ zOnkB3$NO0+ALqN>bISPt>(KYrCAWS|W;C_YSq)4(j7%cTBEYcYV0ck*JA~cQH>nZG z+X%!0Knw#7z))sjNXbtQD9SG=)=w-b00l0(?px1Oe{q3S0@I!#Oe>IXU|f%^J2}57 z6`S^h;sX07u`w_lQ-DM#%!CHU7eGUS4bzg0)ZA1EX^72${U*;j-c>O$%s;^l9zuW{ z(72idYyc<^6lbKSmK5uQDXgZT4@4kLIp2)c6!5SFdRU;htKp_Fx^<$pveC7oS3U@> zF?}di5xPe7!W^N|wIA+sSkaEI8NJ{@Xcn6Y){LVVK{p3IQzFb^nuIlr26(dqBb|YP O3kX|)DJN($hz9^d5>?3n diff --git a/spreadsheet/macrofree/security_checklist.ko.xlsx b/spreadsheet/macrofree/security_checklist.ko.xlsx index 25f66db322431f43aa0d5a5c31c7ca6c008d778a..9a605ce7465a8e925afa56e597aaaf4777e5eb02 100644 GIT binary patch delta 32892 zcmY&=Wl&vB(`^z6?hxGF-8HzoOCY$r>&D&P-5nC#f;$9v2p-(s?#Yw9x9Y1p=LdDV zYS!*vv%05yHr)ju>ason3esTUXz$*=gL)@rw5ZYJ-=CiV`fC{UMFM?|Yz-A0Z0#Hw z^zH2E-K?!-qeo#rFu{oeMPutGUcZD6eM_aMlAh`kxPuz0tOFnKT)+w1GCVmYXUP=% z`p~~ot_QVSi|sYPAMy~{Fx9j#?NhkqTVPuAi>$*&EF{1OQ|ZmOUhoZKg5w<9a@C(H z`w}^Em`xXSYUG?R6Wm{C=42qxujb%L`8o3_>7G`uyNmfjUB-Pxnk%J(@TOci zp9Ll+U3hf~NbfNKA_kY-=1D^#aYw_(I2Ezmj8_4Jv`y*)V{u9vDY1)>7vN@xZY_RKKPP%#HXnI_6UjDymn*RU z>x^%=@4Fxn{{)sat1!dV>D@cOV6cSuzL)^hpJ*O;Sf;G7r&qtITaa0*$9F(bp@7S0 z@za)!STE6OuiDFdbmW-$ks4X%$6Jslt!3+Vy^qh8fNAojj+;16yOUO$r}O)@*%H

;1Boge6xQdWLMI(alLycd~12K1HJ)^ z(7I{@t$G^@lMyzj4;EMBId2-?$tTs})>P{ko);yy>lN}|RMrHDM{{Bl_HS;$q^q6} z`q9b0fcG{~AaHMdv$>u3_-k(x@cKp2=V^bx0Qms+Fqu)jBk)$IvlcP#)3By<(swDp z(VhzoeTY%(D(k#DlJZ)2eeGNZfK?x#2JIwAcPDp`bq;mN>@EyTMO+b0yit6$d4B_)-lU3E0CRln6yBNFTicC}FV#|u;=4o*(re$#8rG0krQbf;qUol_0k z*45uS9(91Vlnn;_yO0y_D^KStM7>$}k*-tqjK{a$|7571hxxBiw4RfZ%QH$$JCt_30g6b zSd4@Q8~4TCG}&LREZTViV!fR9Es2uK5)MkCPbU%?%+m?l7B6LI2c{!9uc=%cP+i`P z^4T&QPfXCl=wt|YJqt0#z@^oQK_#M_cBBvYOTr+Fw~+BQ*kKNTo_txPkHkv?#n|TF zZ;CNsAgkykE6Tr+KO|$>iJGKs8}fBu;IuKP#%0bnk!$Mr;5HS|5KY$cO+n9tsH>r- zru^BhL6IT!E+i{az5Zu!j^6YBww%tI4_d$N(cJ6#U`7CMe!NY1abS)onbo1AQjaxB zpYUcia(v!73N#?vLla;}GTGGuCFq$icq8kfl#vr>hm-qAvRNamxGu?-p(j$BUfHSc zv)ZD5qh00!6U+g~e?o6G9ni7a^iEdRlPEZzKUjlX zAn*epN7DQz_iy%Dv0-fE&JmztNsS=#T%ETDdU^=H6bJ$7<(;|qH-g~#TUA!{dL6M< zW;0j7Ysndb;0}CT^H|p@Amq6n|dsSz_67`^3(UEy@qAlrr?}T{tADcVbAy_x>~ruHbJZIc)dV9JwysE_5- zRQqD%{Py)(-{fKQSoBT2Lqk4Y{p zp#>C8(L63KX7yrAEb8f0E;Q*%i#soVSwxz=g=Azj{AwGIxvMZ}TC+_FA&5A6fmf%i z&hU0*kW}0l?d}?ev?qK5+rSeszieE;;Q8b^GkagCdc#3FhVwp4YUnxjL0`!KYZ@xL zo#3>8vPd88c|k3dTU>@tnYvXIk#FEf6lNgcCrij|KkjtRSA=;(9Rq~ho~Js24WDKY zBJFp22o(l^D&MZ87SB7`qd|db0+E9B~V>4HE__a<4!<2+%vQoqZN}3(Klag^F(D1_97-hEMH)udV zHwwDM5S$Rh{9JAl-{M>od5p`GAU(9J_Q8f~|G*p#PiXvk$yxbetH=5r4-a$4H`UK7 zem{Cx%{~y7%W*&nYl%Wt)r8RYAX>06hHQT6@?XPrZDy2I(7P$$D<-__pen$f_nxQ3 z=xaeRu3tTss9Wbx=AM=I`Bk`BouLVYb>X^ozM%rVRs=39@-%FwLdin6xh`8PlLQZb zLq3appAq!%`?BrKQ7$z%!s_YOZ&P;`9*Rlt>Tw(=7s&U2=g2H@Uw`DhL8!{SeQ5Bf zm+cc7c}YYSOz^J_{6q?W8My`l>&v;3P7-XvvMQFLiY1HYZz}RlFd2afE2ZJE&;QCW}Z~#)B4T zi?Gr5ns!q;=p$Nn0{b@h5vSWjVa+t^(vy|xG2|302r=pdm19*dY97C|^d3u(GB%PL zIFY300jm4>bbBPH-s6CYSl23$tw?D6K54A*I?A6L>*EWym_FZ-sF=RM$7D75*Vav7 z4huZ@`(;4unVo8uiUaRb@rt7Ox4~!b)n4DmC^XfnMd`yw)f8a}llbgt882JT(nd7r z$VVxu(NbB;$U{TXOO0ZtpKY&_cf5T*btmH(++`uTt&`ZsJ$}%R+5=_)HCj4MP_chv zi`vh$FiQDUBqC&Ka@nFns?9{QzL=LnIB5Wj-msud!Hil$^D`L>mA5imX2iD;FK<)#$xzoQn8HGEj1)WXsbNME0DRYb#iiTDJm8!F&^Rg3Cb z_e9$H@Xbf~Xc%U3sq_Q6i4V`Osgs(a);VF)N|+Y*S?ZkMn2^#yLaY324pIv2d&LHQXP%`J)dnKPlhjcw}p9!pEyfsq4C0e^ec9PpVOTMXX(!LdkRKK05 z!FRQ9e|m1|0Ni*(Eq&h3mD$cO-5aQya>mtqbLSY%*d)>{KYsa?LvP3+3$`WdCvSAd zN?3-(Bsp3dIs$y|^lBe6V}sLzSNh9K3n7XM=&s*yH2h){LQs6 zU^oG16!;V3xWugK{dHfIAz10@H!-X!h)2Wn@+!iJ)wrzt+GPS4nmUU9az?qt+oNgN zU8G=Ur9Cabgd+DbM|w>C%oOHCQ6aZX7$H#R7x$YVuAsztrq|`A&3AIcgQtW{XV#r=BjP-AV`af-A3x$F%hxXy z;NeveJ#)J;_v81RE5qFH*STY+H@Tc`GS&gCn6TWz#hMQ9TC@w*Z8x|-ToAj)G^VKl z#^j&3Ce?mr@j)KF(R{Kg2>=6Hws(8Nh>5cO*#fG-J^mnGd9GG z?&rm99!s&O7!8FD_s?x#4JZP_x`Mm^xUE}5YQe3+<9pw7_g6W8LyxC*&kvid zOaN+^L@}t`KqgY`-Fw9lOC#HSnefn_*2(87qNz7GoliiQstVAz@kKvU$;zF|w0 zy%1ug1r}YaH!Zm**qvt1CJv=$zeiRMkv6%Dlq6EtxJwh@HnBL5MC=ckf*~|J6rM(- zcHHOz(k+N1DX{}<;~z+OsmKJ81DR;NKL%h{z3VAf_;0`S(d5dtQ@vofgO*6q@TmEn5T^8`FGBGJDm+B)#Yuti8;!8Yio5jO|5*rNOOCf6Tq%$LYAt-9Qi0W6oS?Fz zqZ(AJt?s^@$NyG)FcRb!*QD&q{vatY?Mz+NjQ#f9a8uAN9>91;)eMFdt^e zO$7&c#9x5X`@?w)S*hA3pVP`!&*r{2ApPal^k%_B)lPJBHYYZT^%#-I2WjW(5IB$f zzB`A;bnyBWD3%l_x{)TjflcCSQ0NjRnr_z-BTb1R)hD`>KnWLOKQR03=x$mNo9>k< zbcjLymjT;yvkWiTvo$Y-(-lV=$+q46FcgS}I(Cjn3XbUWs4Kck87SEHN;XND;+b$2 zu#;-vx2c>3>NiL$>84E^Pyr=)6b{Z`Sk#NItYo3kJgXm$?x&Zey<4aRWm2P~q1E5e zjr6Qs!AMP;*uHVTa9`6xT=pn{1SLzcMJB=@BJy4`4b`2=Sb3@h89Ie_QgbYTm65Iq zSYc=~Ws1cJmNHR#MBna%ovG=DT|vCWjj-Q0;E9TFtx^ zt^5L7q;VQTD$7acGoq;y%4!hSqLM%8F;_eggcuE+PB3zIa^S?5pJ#*3Mk!{f^B>?WT z{)0g&q-(hql-N~0#^ZOaM_7nHZqcFqjE9zQriJ3LvXB+YR?d~zzlAC0=e{>+h0IX^ z^XoWkl!iX5IM|*-90>K(w>-aoX(iN8gHUpF(|i%fqBt_?gY^YRI|eeqgc!Q0`Ph=w$B^$9+FaaHj7VymZNuNd#;i6 z5LC9_*bo>2iA`!hp+~X}FawE`;j2Y%2zT`)yA2Q8?dhjk^H({P)?XYv{}}(N0L~2L z5;BduO5AqHCsJ0uGi3f{8Xlu6xL{v+=yqg zow^9+#FdpuUlL1Sf-$qp2^+iUwUZ%~xW9i+s47RKittA>cFkjJOLwTkB8UlPjCUn^ zC@B(yCBGZ#=qiyUi~h0sE7`0R<(WS4<*PnOOWDA=hd0IC&sxmoqM&p}Ul)yIr^gtN zAKR6X<|CyYW2`5pm=U(ihOBuW9yNlh*d*2~#?b+%u4r4^2pH2gd!DVc3X%Kv6TGvRFcH~*kha`4ll>_&hgNF1eTgZ|Q65Mc{M*m5FnE~}zX(d_3+gbnOs{FSvuAAxS=8r*LomIpW8?5eXX^0z=lMUztYo@btm`#xbv%>v2 z_6i04)(eFXZcD3>4wD?u0oT5B*;b7?F+U76Q6p}eRtWYpc~=#d@S_Y+M_z)3DsibD zExJc$Bs%LqB%^+WM^+oEmN}##8z$LEIV+K15*8!z)!_Oo6u>?aMJ4Y&wnobfAql2m zuOMrit}%KQu#73lmxxnXnU+;9ZWlm!j5v*1v4F?cxyqw+_~xudMBg;Jr`lb}>-^6B z@Rvb$>rL|RcJYqI3})y0hS|zU|LbRb7noN1K=alk*>})prDI^Q@2ikS@^guM%w(WV z?WN*Z5w`=C`_a;9DSW|M|EZQkCe-g=mPkKufq+PTuH=B#HR}ym2%96p=!7M^0<6!~ zi@SZ5-CR`aplk|@+p@>sLrQSDkJRf2b^xP2?2pra>vFs`o^IKM_Y$Eg0Z0JLY11AV}XwmKFL4 z%wZN_^z{ENHC}!@`$q)SyvJBUbSV7%!_e(WA^2%_^sAq8+xJ`xLZ<>lB>p|T$j+`; zmu8L4W^AA4AE&9J-^q+3X-*Go*bVXgV%~MU8Xs_tLIv70QtAHzPcARDxLsFAR!R&a5EU&e#Vok_42AVKx!dx|Avt^{ zl31~qTC6l>#*FgWjxA|kf+}LKSxB35n7{~N4$V$n!-Bxu>ASzN<{^GOeW_rjs{Q9035 ztX=|x_J7_xckOWlgAI2Vyyw~Z8+sy#6e3VII)Kex7b6b3H(| z9JDuH9#|3yNH=HBEnub8F7(;(C)78;H?j|i&|GC2gN$!}PimjXj7UprqmaytqAxYl z9BYjz_i@;9gTfxGUvVTwF%ezt%8!)(AE&%BC02h3DeHdar!TDxc;M|wt$yIO-*wrQ z>orz1Mf~~B!~~S{deKH~Cc3WG7y~U}?o!%-tL>tx210k(zq;#6M{&ts`z{`%Il0JaiKj)W7gt{e2${0) z`q^;&P_x? zk&8uA`rV+9)Ha-nZsQm768kO5B@K-`O*o%9)A{P+Vz9%y$Kb0;6 zU4Gl`Jl5InJ;(o2(w<#vBaE2AT(DR5=pg*ciA;s#+5xW5Nz~biOnZAc6N?__Z=(P0 z{_|^owGA5uaL0XA{Z^^;Aj;Fz@E|V=7G5!KQAzV|k+m#O)kaEAz=&;8#*C0ML>QaNG~;|0!Tz^}m*qm8 zz7n}GFj`9wqoy~$3rGAC+*392ew-XiwQQos-0LL`SV2#mTl-5hWTcy8ddTg-n@tZmTNEm+= z{ze&C*+d|dJzXQbpp0o$m&a_1j-DYdS{`o~%L*sm!@EQ!3!5BIESpbUQe(> zzxY=wyyfi;>e7P9JAVMmv}A8bYYbw-wQt8=yT3c9mfVv66-QFXY5-y=5#-;2kXn`p~gyxwL?wJ@c1I*YEeO>=} z61*7*u)vaf`RQv&i3RKLPh}|Zxd=wrJQptbOgYbmwE+-VNXGE3+X})StJCpr#Qn}u z7%2_DeW|)&b#_l58}Hl~3pF?^pCZ3R2I-x$#oo=&vAe)Ri=IW!Qa2}b;K-W)Wnui zHoUC2b#n1{>Z4}YLu2>ns7^3_X9#`g(y_FUY71r*inz%={4L8g%!D85L}@?hflzGt z)&38KYvxxFib@+AcifFS+?@s2t#biWq~Bd|W2XwJo;-ksQfh}@Z*~n=&oO~oNKA~o zvFYIK&lQ6WBP!~-oQjuM#betY$$?^P$c^7xn8(mc2U>oH67cV(&@e=IPNa>yqFGQz zdD;pq6*Lm3vI&#^6}e3m6x3O=Vnr)b_=DLK1byuzO_#I*uu*j#`g5U*VOJ|-*GxRv zORj+W;bN9QEz9}9r*1fhJ%p6i_2slgmJsKhx+$)!kP{D8FCv~gG@c~GzQtNU9j*W! zE|tBpo+L|+cuG!jZb)f~Eix`-dn{Nr#{NCbEHH=Ne+=KZ+ZtIi(rKyMvCr&vh#eqR zX}?CH9UPAyJ24T6WIsq)c_tkf!vs8>bvAIy_2!{ss@vUlq@eZrVCeV?zlq*FbQ3Sk zQNs~UFyPU5t%;KNe*^75D<@u0&X2EzeR4(2+&nU17gi7#R(}F9InPR<7znSgPX)E_ z^Euf(zOTNe@*Pe=#b;ief1LtqIXCtUxXH#O-slPqg!~MA5BX|#z|&DE!&EOrtoQUF ziHJKSt`X+SM3?OsEQh6&0bOcE70qEQ6HljR-Uk65DcyP{tB?@!Z( z;LM=C5hX{6=v}5cF5Oq`wOGv_^6mEq4n&wC2v-p2JQ9JT3WB~py*Fi2RMxbis6wrZ zAeR_{e;?Byo&umwct~cbAv>166^J4P^|(8Wt>);NY}-xCtnsM>^5OR+IhDu3PT}*7 zGh?L$<3`P7eRgg5PqFd|GT3M7X84!x$-?)Q&o6hdz(5vIBmp7Lr%?&^3u9rKP=#($e2U9BV-apW z!j)aYw3IzRA_>m_2`i%$ac1u@l&SV`0cP$AVJlIwxZzD_@LaV{mQ6MvpB0p*K?rKY zfC(p+^q;y<+%)X0DPvB*jU-@F_N4?#sE;Tx6eQ$yNEgg^UagUQ4MBbJlsEvzrL{!Z zFF~#8)sznEZ6{?YB7;)e-1xLapG9uLzD*;fIuL_;=G9)hI^H_@gSzbgAi zIJ^PI??jc#iq;bg?B6WEwW3-N(<0^-o7Y>rJA1F{<0EWdI|^dIfW`MCsIQ(9B*gdE zo_@1)s=sf#4JH^gn1wnU$prMO^!&0zK38K>gN6k&dAgW;tmDuOA4wvw;z^0ABw|5* zC%pnngh=hfo6!?@sGaaU5Vp<`PW%2%Bb`6kc>5e;59i)a7ce#m#GQ>X*|bHjp9H01 zma7L5)fYnRTi8$Bd`RC8$0IboD+y&R2F;bj-163uSr0W8&}ISAep+Xp#aV&7?6gQ< zgph>%-ajBMoKlZr>o(iw8i@_~y~s1kky786NO4f8-f zBZYaYlyVpta)go#MOlmfhxh+{*jdK;9^}J!e{jn5J0S7pPHW?7#uVK)eG-r(%2>fT z0rouWat4Y~Ag(04I>%kK8#a0@+T82V+j=|kh{_la+$zY00|z>tnm@WYrlB1LIp+iw z7&|q78l@k^D<)sF1PG*Wq|OWG1C#`<6nO)$ynnUE$CZp}$QK>t5&; zc#2*ZYcf~y^K`-YL0D;P-AePL06_g{^fr2Xp`gkh-oC?0dT)6<(Xq|6g=Fb@a-Cm7 zPBCE*?=HNZCT^MwQS$zUxsJ>Dq44~ z>B^atty{B7tO1k`a1mBKKnb)0e7c3G(D4sqC;A8!0XTQL@Y$Hc4q&Jl`c6qsBn>U{ z(C!AmZ@G!=))&)Jei!-=*>Z?QhCrzJ3GjD#}orb>jM-}5DF(39;+8fQKok<+I zOPInW#DE3<^&}uD=-D$PBN~#9t>BU!s0|qrG)fU9l7d8a#__LaZY7-2Zy=qQ?<_s@ z1w1SIljRVriKh7-bg0~ICI-#}Oe-m2hzyVHo{q&>s0{y{a>Na-Ld350JH~f&Lhv?@ z)k9n~g3iKYXy&-snsn9!k?Mm+c)x#ctOIfqeW>sxWCu~u#qy3{Lt}^Vxe#}xWyc4w zt)YY(|A{${gTGbpFrl{g@C{CvPaa1=fd`^odhwc|(h{**Fj_j%PnYZORbxyTN$$Ys zBXfS<_Q%1uOf>`%#}kh6ZZC3CN010@_M4rW#-YBR*Xn+1KNV%Oys@3|1MrDRZT>{1 zuPT@;G@Uz{F3VU3WvPfDDc^SKhz1!6nWos^u3L4m&e3*1FJ1xGN{QjiFUf-78c7Gl6mCCQRpA_b^dBrrzlr<^QIAFb=6LdrQ$x#l}H4( z)!L0fPd*{JW!EGEIvW-FpXe|Q7>Upu1Nd5Yn&bUQY?D>o7EF?`da;Q?Emoo! z7U?TyibyH{4kMZ>JAtEO37hqe@m=Mjn)2TqNDOR=4kQ-#9B=L(o-*#v_7Q}o)C#&u z#G=!FV8Wu|77D%|j;e>bMqkY+0C>LybZ{<%4>TJoOCfg*HV~KF9HQ8R*dKJjfjGmb zUW2<9Go>BOd2jSDk+>ONHeGr-U!af#^D(KfhJ?^8IYUaz+?IBvyoockxsYi!_lONF z$k%tQkV(V;?Uac<5j61x{dwkHCX%GoYb zz6H$ptkL8jqd

d&PjSprb;L? z>{?K-{YH#M5B_&F3qYmAl@)_sk?I^Gpfx6V$y8z>w!NYs`@vpXBtGds^wHSZ8VS`<$ zi#W0nx64wUl&^HguFH_JlYQ+PrGD<3KMS4oPo$UHmnr<=s$Q({h&_~o(f_!4>?eLe z9ct$d2|)4IxnBWa2E%k=`%>Wg&;+&BppYhx-rk6$KQ@w28170`nR~fQx6_uXJfSh{ z9n^*yfB`c3Z#4As%elw0VE9~1dl=(mP0_L3`SRnMda%#y@M7Pvt5JJ~$GsSaLIxY# z!Pe|@F84y!NRH)l-~qk=yQ&v|?)%=tcXR-V`mLC`Y>&O$HnJ}HIwvCfGTJzTjO_kj zLHZT)>vM-d!G--n8?TTiTT1Ugsg18KIo;?xS1f8D=rX=wMsuweLy1_%XKK+$nF zQ)cyC*@qUG$VQjx(npL|Ynx#6d6IPR?~cc|wKvxRGMC=^$<4FSC8FRv!5<$KGUqfME|>KTZZN!l_3e1)ejR)DKs zBppoZdv)W=-9aSc?BW8cDcy?S$5O?TSx4!3nomv-j#Jf7&J< zhx_K`VW8%G?fs7a(L&{ZWGodZDc3U=t?s*HeBi zW*MkJ_4h$1u?;CoSsQ1()GWWJT%cJxQI4mw_6O#Wobi4$|0=4Zy1rBA7(BIviCyey z^QDr#kIxtMlv}XxMzF=p|D zAiWMxt!1W??1Tf0M+*Yg6gudUSR|;-ssH40$jN}wkO$r@MkZvnGV&IJTRXq5DACif zXdtwKB}*QMmX8PUaX4M~2>gxe|I&&etJ}c&}Mi-;giM z>wBeq;?qesFFE?!a|G17i6g`VQ6+nWW?oVE>Jx%85#U{1|i^Ks;kS|{r*%ZthIvt zyg0FVIFXDYT4pa)nJ!YH)7-s!*j=OW^648neCPTwV`TcNYEIS>gD=zLJ5p1;>cllj zaxzokKfmu(T9|qt%7_mSI@8^91gL39%vU_k`3;>SFY&JL8;CbbXEl~xhRwa!ZrA&E zjIdEj$G*J{agefVfsxu6N~{VQ<7GUm~jmE|D`f@VCqZwEzSK`+fgf(rvIDN$G2WMf0rt)^c*B$})3R+r zn|1jv=3v~RiO~9;L3{oDZ>HEz=jNS10@n!=xPFY8CL4TI(C~v0bbD>iaT*^XF<=EcT<&sNU`Z;m;)*c<^#HYgDoW1THEU(0Mt6VIaCKjovo;pkt+4i>f@Xro5=(tr4G&Cg#hx5jvXj-(Iou z^Cd=hok-D|+V@6FM@qdUFtTbB6bv+y5k>OhnOCK7sOhO!^&pCH5$q)VN0BS8i{ZMg zlm?z0;emDJ%*nFi%DReIQlC#?hh~Yl@sth4fQq}!93pJS^M~VeYziWdXFsW*tB>E%H5z!60gb66!SQ5&w$%& z<=KqI9UQBPk<7}@9+S!uV*~1KuRlZC@T>w~JdnupmcS@JHvRWp2Yxy8;1z=da~!uJ z+=hv-`BRI8lX$|}+BCuFsX_a4RJ%br^pc0-WT12$PvJj`?AGD{BCKkvfA+-1`ZO5X@64Mw2r* z=5++u?seYu#EW1M!Bh5s6ZDj7ocKbz;2;J9r6xe$@le*FR}v#A4)gTT## z3CQBCF=@^?x1LX(zDB!y5?Qlyu&)+|>X8-ctGhC4=TJd`q0F~4 zPI)skPE}ZG)2%WV7iL)f#JVxp1+Be{i~TdF{U}lap5h|c}RGK~}g7lo^{*0!JG@0FZX+q@5zhkEFCiRGWfZ38eedNe9YgkF2er-~aKbdIvm(g5<~U zE%U0*L0La1Yf$7#s*4J{4U2m!jyRE}TEE)G3#%da{Mf{2@=yw&1G|J{H6|)pP)MZd zzvh+H!VK|&R@C??YS;nIXZwkJgF(?7~Vs)xODI32#W1~u3h)R8vBA%fR#T2Es~VSEKgfnFZWJHg;}9zXT_hiE(eIU z5Z7uTvc^pFJ#6}8@^|&A<3MT(lH3slJdh7-hzA2dSg+AUoW6C0m0=ILmP`-2^ePJNe4KcJ=FDqe?LG=peS` z$Vf5$2a;+JyI0wB{l$_Nb0oW1OZ-D1aH5IN=Tkfa;?kQY^_WFqe<_U zyE(42_x@O`VhQnary>5ZuU&1g>^GdrLOVuKiO_-zAo#Riu#QqjzJi&5^+ter6CBZ@ ziG{FXMnO$FOl0hyi{g1{FRt@-tXlqF=EAj@$zC#Mf&) zNQjn$@q5LNuI@VL>2VZ@nDP=eIWeZ1ZhXT5_cibjtq7)H3G!0Weu7db*)~`!^X(jP zc?9?zoM>ryPv<##^5kNUze8z){?n3?r|qkfGnYY26Viy4LQL>BRyx@(Z?uOeaWn+~ z{~Z|?J7SvzGqe?%BA@o#^4+PUlx)~2U$#jq z>74Q-#QxvtnUI2&9qWCRGo_&jq(f;f)`}ShjhZl-`XEqRnn8n?V}2)8_P{!6FV&B$ zsoSx75Lj0QrWLc8ny1Z@vr%oHE4ZvzQa#gsg6Knr z5I8#Z)vW&yi`+=c#6ZSurFe8=(mDDDi-cu=Y#a5X|e(2j%d z2=A$PZuaV^4|eYmSJwP$fXZx^o4%XIU>v!{q44|hN1^%A!FTF%mU>eGEiUDifD|7h z=KIgG6dx5p5jePiXTfk&mtM6rI^X^0HLo=^Xfbi$`!fFb0VJQFRcL-9W7|Yh;)fWc1|@fI&i%pXP-)-_uUqNf^=fX9L$Pyx zR#DoM<@3uIK!Ijkf+otP9Ai?I{fpv9CA%}khzJ^8{}z+kDA zjwu7M0p(?k`9I-%k`+Irperj`t5n>U(TNy+M;yxi-!ZN?Oi)(*tAe$$QO!oH-Ez~s zgG+@x&5{7x?%WZ1@8jHxiyj;W8gJ0=;@+TI$nC=4Q`0Ea-4m+j<7K z8W+OG(X~J{k|vah`iCG6N_va~z)Pat61Mtv;Im~}@dq;{bV;OOeUT_XXhpeyW1z3x zd6@@LlqFSg`#-)XUhUm%biJKM@giS(2)}l=Vr;y;Q}@(yb+xFPK@O%p-Gt5Rz`?68 zyKx=)VPrCN=))V8ZdF~fgrA`%k?Jw-9MuEy&1{IFM%QvB1LOYH4KUGH*d_{}`FUia zXdza!6ehBnCxE$+{;1xuuX=0Rd#ai+oei4ETpKKZLzAvkd?G6^tey+T;drag=35$9 za7VpKPa5oCt@!UXnwhQ|1o$h_`_6m4Yc=m$)VGV$X^s*3$oY>{3f?vlNB(G~YJ@Jx zbege+nSIjaJj9|vW-PB9%$6uG4ChUYm%@LR|0*?SF2&pfD74ZJxGZTcYraLjxN!e! zc`d9co67Xm_u}5rbZ%-13T!d zNF{D64QNp1F$hTmU)QnD{=>Bbs{k`UiAsb9lvU`=iZDvtQ%T8?M}?|bBY?6>YlYbO z#|P$UV;YszjSHlzz`tEy@j6tkv}j+o<t>y8AP}VlMfZ>AFF&BQWW;^ZPmE=@AQ6V8)?VHzfWc?0h0|U>!RDJM&<PkYu^n5!22PT_Wlq>b5EAf2X&eIJPGui<^-kW-7! z3`EH0W)*V#qCZhx_*B^Wo232+qa+!d0UGR{!>8 z=g9g3N3q#Ke|6eOVZ2lIGbOV0m70HVpv-t~*_ZSWL_BDhSnF@4H24jm6Brev-2?xM>)z>dBr198fCkB#IBLK6x}V7T%l-nxZr;y#=!2m}b-8 zAmkUc{Pqhu{538{b^4S8H&JFwO;Q`HN~D|)Q%KanT31#oIjFiaqTqS$qr@|q_5vmp zcjBJ<3}z5l1>Q|guhi`*)^1Go5>SjUIYUYjL_p!L8MqqpSsBbfPDAS}6^j%Y@Mh;v zQc?5elz={sKBwL?bcud|e*_x;!rPeglJ?E+G9%*=EUS=XiU7B33S5Ii`W|sX+=RF= zjz4x`n~tq?>TdLC+hB}jT9D0|$n!J6)E3iAhP}5HHiOM=j^aF<*c9Q{<;0cgTvvTEEna^R4#ZbT{UG+Y`&5XylPpo69X6H`iui66XlzXP?55TnxQAU@u$ z!TV=uj6_cVSj$`-KeS9~%P5NVz-ipHiM3dpWx9!6`dQg90}UR-Ui9q_I51BN9Oyvf ztXD<7DN%mpId4_D4di99bSDB*Dj!%izZT}~yRZ>kRPDrZdR--G@E0gtz4 z_sRl%m^bLQfnn+4_tdH(B?~^51l0hKEc;I#yl9o86>^s!>>L%Ud`e?{ZPbEfunv*d zXQw~rtuKY-;#*l`_ycJH*gdJBw;BcE?Z?#oNii7AB(4$*sbZj{@8i##C7|V#p>M84 zcAzmS{XUZ?qyLF3VQE(G*rDYNcmrO#mz=_iG<-VN9C=;9a%AVXwtQ{h9MU7+;!i0j zL9O@XcOokqWy~`w3*jEt%7tCwg`FmI;Zu4d4;rDMxB8p5fCr1JUxbaZ517y zy!<*BvhL10=FSaY%F}oCs^{yqtLKGv@%mnR(+MI2LR|x3=bF-xDW}V0sjML!3bk4b zMHQn=kNb3WPlRHIPi>ZAJ-)pWd$PWOp#2diw`f!$EpKb=$vTqk$qQT_v$B1AR4sKTD>1rY znhm)oF)KHwjxV2i`d0S3z#ka%C&FRL;hc7UjbKD*YpdLf*>f}(nyDdlytY!-JsH4TS7vb zgLI0t0@6r#gLHRycinTqM}2(X@80kF^S2Lc?OAKh{Abq8thMW{K|oGk#{5#S@P z$8~x2c^iK~4+mg2uW`MwU~zFew=k4j>a15P?LYpV=N@Vl7tNc%T>gRnBD#YEb0rJ@ z9f|jRTjK&r_}URRKpGYlaix9*9-PN$Hc@=lHV5rm=8$*+9%+=3ioUJfYXZv>{;Wlk zLRZIH`ewYtDU!sAq@s44C&?3%1;7qgj&vIZ6&>QB+j$|m^E$QWA#oV~<5Y)!mOEqbQm=qgdY zCxbRvGF(yjsqWz1f^bNP*SdM*(&c*>9*IZTMaeW5$3|@AW%E$7*%}ZrJf3%2{@i~) zw($t# z;bZM;|?-#g_LBh!<+* z??M8ybtB-8?0)Ws%%!uNg{4nrs%P66`l%ohiv@vE)R7Q%6Rm3CQ)R(9E4>z4RkCtr zBbg4!l_4Gmf2?vg`P6(WD6xIy#xntz)?;9}8zViYYUojtN{B6b#*;mzUXTJFIXOyT z7`a0Dz##T}fEZT^_94=?7!9RmDi}F|$nW80HE=6#9+63mPJ`4XWZBjI>rt*$d&ykS znPE1pUihshM0vi4=q^Ikg#+itR-<_ZC`CVu*01F92Z*kH^eg&~Zo2bzgPPZsSm8J( zU(|g3p>~muEv6qEk>2ap;H2;Iuvo3kfS@h$Md5We*s?!+74;F~RFM?KxokoEjnzI1g1ZEI)==nfH8U%{qAsznX zeoH$9QTE~!*H0_DeD5#_y+0f_654)}2PY?s!nPgAK)VF4h!;}{4+p)FEH$I8IxOG? zk5OFCOofyV7sZmshUmy4J6Hx4*!$3t`#!GN5fPrYWc(AB+A?0TlKzZ!gpDL?N2EG} zGgPsmPP0m}uNPA?gR8+Ey3ty4SIWp1+Lp%%HQJp-XL|O%Bgtp7#e`M|O}U|G3V!Dk zXQ+U>2Zk~@lp%i+ki$5v=<6wY#tlGch`37!3Ytwz{HA*tfbr75ZAD*Vzwjk& zm9EHkG^xq*95?a6r=R9QWtAr4jx2KOMpdv7pv39fsK99Jk6-{?-LO#?^mJ0+?0m7c~dj1R%0f^<|)$@xh09v(kwe8?{7_jf( ztT+-n4Jh{;;^UkRKFR?wTto`!3{?dD6AF0z*SFvl(GeBo`NMky$Jm+n@8987fWomj zkc@O@_q1G#@=*rfc$V{fhbs-njgT>#1nM8y-HI7oqH@bx9JH-T+QAG$)*d?EIx`Mb zgl1XTXKN^mae!I-JCRlt|Mj)@)AF^PF<~Y{^GXs6N)~!UB#6VKxB?w(&+za?n)iO| zi6}WR@W*-jzQ5|De6YdxnROS9!YH)DtY;kE1M#}3C6*&(5yF_aFhc1+v6`^*mb}VN zQOxub`xbnF;I)7&WST>yeJR%c!*1j|xyKY8z!f6N23wzv!sc4V;aWpn#?R*(=OVoX z+qf<|zc$^K;RB_M2n&-@TDiy$%R;Yv%T$&vX7CEe;(&XR>aizrr0Mv`qKpPNXh1h| zuq@@XNb#asWG4B1dYqCW(Of49B^#=0c#}d8jcJN*B!(n1Bn6#iv!KrA$CO+LUhY!M z8ki`1Q-+I`43@Bb6kj1a3ZXnu=J!`|l=*Z?RVqA=X-U;-`c~GKN3wcezVD0K3Uy-l zT09#x)6Cke%b~lGPf#W}B|S&VV7dwfC81vMyX7zQs>I9fCr>1D;fIH=Ne~Z!AaekA zI6L2=KWr+6`sJ8SLaV5rcBb7P1mN z)aArQII2Ei9?qGirrwD>$1E_VKh0)-O|vVFq}Yi5+;U+64lmPWf=(sfI>KS#tT=G& zg&N>`R<@HH9>A^j8Pu=tF95CGto@ugd8NSz?KnDIFx%?FtL8g;wSBODeTum0|Ax`^JFnOvxeqn|) z?n=wcHg7N29+*4hw<6-`372i=Qb+bEJQz)Fh#3xGeZ(IU3L@nd`th2)%faruMOWr? z4zc)-%%pc_3acsn{e28+$Y!dHqyF>78nG^N$3PDGja?dh(TMI~|6I5ZfF!X;}>W$P)m`erX<)>0-@WB0}sd$P9_vJ|6H+esE8 zV;Us6tqPR*saraoHO;}{MIU85bHQ3Kw)1SxCJ-cFaW&JCaWHwG)FEfN-#YYtT&Yl! z)$sV4^rv;ncsCR()1gPtlYfL7$paz@h*&fv&DcIv0^&}w9aualKEyEy78h_Q?kJ!v zNJyv~nG}Ed95cY2=JaI$S?8L^$^6vKiB?g6v9JEUk5GH|${%|h^7>+0ERzz+Qp&iu zOQtjOI9R`m+Bbfe9q*09B19piY^$tpo8DzCWG#x-n;&*~JJt0@eI8300K4NE!a!$U z@M>a&$p#Xq1sb&Z$~~h`eKJ23gf0R7MS|1fm5gr37iNw6yueQ;I2)nU-+O;Q)tcp_1+O<`|YX{2Wlx@)|yX8VvE6RSll0Z$A7r?ml zZN9)H#6)6N)x<8xTCYS`$Hlia`&^@2RV7O-YaO6Fu)mkJ{z?6@%t`J{8Ho9X&go*P zAr;PHI%*1|4fr{eqR}nOYawP9^Wf%S;tLPF94%-6@hB52jBh79p(hVzL`j#P9_fGT zK2G^=H-vKnv%>GeGnwD5{a8Q0-jE5*wT~=ks#)6sDFvU2S3!hp;U_^CneYOyX6MM( zlpDaeU6=YcXY(8>53jd-$}+0ByR-D{7^9?RA@OkdbNFOiX)6d%fY)~I0aIdvZRO`r zxRdJ-@Q)mqlWFT6yY`Z)D1COObB!)j zgE8i`!lSnowSQFIp5jwM+50ClY4tURCI>sH`9_W;ADoX=ui6LoSNO7nk`5?)BVed65#?->=SZR>CPh=owRYYutZTxMC zlsb*9fX4Eu%GC#U;6=co1ejOD_5YREi*Es?mF z_6{sW(l59*EfE%Cqu%*KlEzQg8Ry3BsPj3eZ-LoL7~uBZ7qJn#wPv&i`$R#UO33q? zk$P)^Vd%00F$GMRm+FRb2812SSt_lLc%~^;gH{NV$D>ihr}~(pUufJ7ifiUgoTno8ccmW^^>rX%&>h_H`fMHDtd!_5Qx} zDC63?Bb&QCHJ-hjyLt;~)*Fz)1>(d&E`nPYobPBRsuLPlE4qE51_n^Ehh^E|2l@wY zGut`tlhBREbv^p$Aut#8(C|sAY?c%+)xzl-Nu@~@n~Wq?6|l$yoCJ^pu{H(fz>Vy2AH*AP&J@35 z6=BK>A9wf zANFDKCe5vZ!RBQt`+la(h3=Ufbj33_p8AsMVLPhcS(93Y2i;`}9URPg$h zaFdSm*;owPUE>MwH74I?89riWv5_=XPg%+I2Ia(w zD46Feuv@FT)Sh;6SHa<2`}}k@KKPfoqp|f=Ts|;foL)kzA@_o2kF>BKn_>}^>AhjW zbRf{W;O%a7+_^Vq_2wZnLbM>S)#;Zx)hK>F40 zY(nzT06Y_9HglqoUh2kT!L>_ap_g!ae&%6B%tY77&@_r*MJKRCfIImL2NQFf45?2- zb?ItC4WyPce`&Uf{LXuzGKO^BHNxAmSL>;v`?7y&equ^r{pBObN;AKYPK`a(cZ{3q z#eK*|>3F6QP81QXxO_n*6aUB3xs^yDa(~!Q^OUbssmM|H-J_qrmCypph>79Fn*1cr zv>sOnv$cEW+mIfX*um`KYmJKglpIp zsU#u_kv{3p68#CT!dv~Ze$tCCV~WJ#ac1riTfew(+sH9i4xDBPS(BXxG%CnObe3`J z|0woT8}=UxEMxrM^G>>jCBkO@$zYM3z&Wd2$7&{(Nf-HcGr0q$z-ZxKDMV6vAS$iuwDrQ_)7pKw85Hn7 z&^*qV+E}p<9fb3=e#_(&fNR(7CbOERVlBRuJp-pnp04P{w@wm6xL~QV7ijnOoEa|U zBqGtkPc$WEdSD>_aIcrAyIXsZz)z*9vNK?8fX#^6l&d3mVl$T6|NhHp)}q$gV%S@7 zfZE0hw8l(`r%AZnRb((#4D-Q+))OE?C+a+QQOxYoA2cC(#O(HuI~3+PjSNOkevT16 zSlONRYQmlpOPMhh)l4wBlg{F8`aI?))$5+2ATf?5>6_V+*7sArvgEdL22;+j&UO7? zMtufM)w7MKpML_f&$U_Lfes*JN$z%i*evDaCEh-l)*D@<gm+zSy?$9qsNmpG0-;E=n^UEz-#8oN24do|(pVkv4ii4E}bZw-Hw>^v!KQA>z1 zc>)#0EeN?T_t2`5Fc!|=H3UHwm%Ca@EwQBnzx(?Pb5c%_j7$H|Tb#ipD@1=Ns*~xb-hI?=l8b37GS%-i+CsTCf$C>40K~Ldx z;`k*>@~~nh9!LQB;Y+IFWMpjb#~-sv=eHFj{#SrP#YTO-z)7e|i*~ z{Qy%=PSTxags4>;c-&kt=6GxvQa!FZVM_eO_u&>WGE~pkU^XWNS#Y+P@)2mD&|d2m zO*OuG_GB69HZ*Zr&Ct3F}@h?gs^5@d-2_Q4=CP) z9@N97Y&2ETIYp6?nGmiJl5WE_+SW;|i4PKh^&NQR2~o6GAz81vqf?|-SOx{lt6ALB#(p)k-WA`7-)gE?)wF*c`DkC*`WsyjPp9-@xoUt&f z&fT}|kM*d(+HGAVgp7*_aO^V_3%uz?1pMei$b4>W9W#hs1S_F|km$l;;9x_#y zKA!tXh|G&CR?viQ`s!^DAt4<7`Qy($O4XIlqj@UL*q!*q-X0KVne#>!mM7pWf{7@% zWT?|;m!w;w-6)zx(x(^6)@2cXhj7_!$fi z2lx7!03pz2HW<8L`k;2rlP6s!G+V$=Y7uR4K+*elb}ySn~YI4gO&yEb~)~ipmZY>KBnTMup*2pM87wpcd!jA+a0UtW0}}c!f#9*{ zce@b+@|EB0=T6@wer*f)8c$N#vtyFs`)=Q=#+Yx0Fj?6yFj&hAG*Gv;B{i1V`tO^C z^Fk(&XzWLBzxDSxL*8I-Ly{9M>@16%oQ26*c(Hjw-Yq2HWrN!yoi!=A{GRKH=urxI zyA=TMx6W<(uD@SMb15YiL$d5t*q*MoeBNosi%T?8w6N7*wa}%?%1=c$d{9~6`>E|U zsf6Y7@KuYg*Mf!oj>j8rP0ov;i{iRl3=NtbD#k#H1gGXG4fskktc8Wv@4Z!nLUZ+Y0r@2#%B(S^<6FujzyeEbfcxo%}$-bSQ zZ_A{j>$10M0WB1|sXwuw+1fwtFlE2lQ03m?L=+b4GN(OX)TG zoz}ogbC~yC7r9ef;p0w)Yd!#ISc&s~tn?PuWF9SHK=JME461mShgR8WUh#C$M%8v! z?*j@Xr+5}@8it_I7SMq$0;q-~M|6~O(+DX?f*)HaWlr0_^1AT!qhY58UnW3vvcS+_ z<7+miwfS6EM6h(EwT$PC!(+>d>DLyI#p4axPP z?lzIWpa1eR&E6x1j?cPZ&@y0^A?pZlFx~A!cXe{~o2i=v(51X6E^tENuz6L94cx$x z3wDR8_&j0sW3~5hH+#Z(8y5WAuSD79iNQDBnX9dZSn|bSgG6I?ydaBM)qWoFDsrl| zh>Lx#@yqAyoMOdJfB-dc;J$ijhEDe2I{5MASs*KE(!riju> zbGv~#Cv;w{)>e!@ z)0|b05}djKN>LNM?akWn3&tbzU&yFQ+X;ZLFj$E{W!wip@}8Q2T(S-V`Q+NsPcl}d zh=gYh64b=3dfly7ee&`9FrP%Nn9u=J`fI3CjNcBCq*&?Cs8r@;E@%g|T24cwWRctg z(;e?_)A7Dogx?iL>^;SmDpUR5*e^v_-Ow*B)pFqzfC|pQ+U=5=K+tz_uw2eUTGWSf z6lm$EkJ>Icd?b}$z%~%E$2XVld`G&w`1~$Ep5?2M0rJF53lB}`{$vAp=W&t&WQ#!h z%uqBsyOMcLv9=(CCM{wL`d64AtiGF2D9pP=GeRA1qo9H;(Epn>i>Ef@M& z3;6ARp}UY^;j0nN*P`V@{Toh8^>#Z}t6JWcD+lW8#yj;-J}C2W4Z7Hp|K1Gr6Gmz4 zuVF?_7e}la&-OS6aj(e#F>K-ij$_Y%49mNVb5fW3hsZ9o%-fzqe}m|HS4((%+l=Ck zF}VfrE-bj=A5sAST`yk|l4glGBmcs>93hVaEHtmxozJfCw%YKdDn~#~*PxryTce25 z)?1UIh2Y^ymDPBOCG}g+|5JZS0A!e-mV*L@?;%e;xch(LTfaGW0IJ_k!Q-^leptZ- z?+*#z^jd?U=-aL4-bAQ+PQ4CJKvbeviHf&K_9!G|X1n4GSRSe{dwerVmKgovYvxoyn758mt;iBxtK+0~M zy`?5q((j0fYvlY=$IW0x-e?$005U;(Kd5Kr=?H+y!)cg}Bu*Zt@qejv{o{O-9!VnB zBR|hS__qDU_kU&kuhUhTx_kzI@Llm2-(YeP;1}a3e=`my|IPTHj6oRRkpQF0srZjv zf1ieQb}Lr59)a>KFE(d{UZHeIJL`Kv2+&~a&ux)0g`bz1094xDBxHhiCN;{|#aO{7 z_Bfglaz#T)X*ES#96wB_Ubqm$7&?%_zI1BX^9KwNY8n=b47#;xy$8v}FK5e=Gah>X z(>~SDuij35bxx1zAC1U+&UoMv!eep%(wHZlHrOPvIB%5#G;(IuS@H*?!XPL7(pud; z#?O!nh+e<~K*kXD^Mvd9r8r$rY(+@LoeZc?cPHf18td+v{F1St4mlfAaVG@==IK^u zpPsHK>n|x)XTkahR{&s1vblo1kuHx1R+$RwVt+|Ww+qG!TybZVU(^X$oYq3~6xy{TmvA+y9(0~bB5qw~UKzKb5c&{X5 z5nEyYGasnQvBaL!gAaFhgOy)ni^}Q#+uj3h&$lJ$d)5LWq8sn&m2jTW|I)3w_4Wkx z(kiaft@esev(yvFu>N3LZ1Wu%)~)ig)!a1cd(uA`0{^I1JweL8F8#xuvD5KoW33Q~ zut-O>GdqK4Fntf#cd8Q373y1qYt9^+pG^2Y%bF{=5WwX-dz*h{i(1b0C&RbpJ4dSP z&A$X%o&>2U#6P|@T?iKckEXz%U@Q}W`}&Q=;$K*R%l}wKoNZfoz^`cu9uQK#)tw!% zr!bU2_J_1h^WvHB!G~Ysg#4i&KrztP7GhD|0e2Ra!zK0?j$)DiCer`4F{CY|v)@=) z{~HSeaQU}9^Z%Bo0&Gzn0M(sIfeqvTr!5z_uiscS{e=a%{L_xLpRM@EKmKD1a6rm; z{_A>vA%_cS{X^P-=5SeL@Zq;Sw*Qvr-?|O?OSd63=)E!jV_O1nU%#iSC{Idf|Z+0T#=2bm-PwEbT-1$Xruit-U)hk=sKdk0aAQ?C`29o`jXYRk~_LpiC{ypcH6XZ#gnD5#G5P|+`3@QJ{qTw$r zz~$cp`TQkN(jde$K{5rb{5aeHMN>M;+pq_=#1(K~KYb$@i~E0J0WK>Vf?{o+02hIB zxyuQEO!~h)cARa;Uo8JyeM|p_iYr~1=Vz7x;rZ{j;PP*ABjX>V{mYoa6(AH_yeGWb zU?+T=Khc3r9$fohs5n50wuC_DKaTALJNZ>N*TNsn(1qBki_`tg(;)o>{ngLE(QWxl zO3?tPmfx)Y-4?>TTcXf;Ebydo({hpKldNb4x)d;pLToe_rZlI6|3b>7_1`iSf#CrC zaAF6=I#a$n!QRPT-uz>Z|A*C&{a@X~@gJTAq8?XB!~r$9@ZsOiwxs_GF6fO58vq&f zmmk^WKaRk;Ol6DC7R=e%V|lnVZ6w;uKUCixdSn#I7LEHd8h6%+NYXY|&p!5v_Hyc^ z*7DfUMYI0vm5H-l?1PQ1^CO!Qtv4a;fd^A?CRCR295=+<-S)%SmeCVS=lV4+)zg{Zm&b+O?SiZRKWlY*yYA&h_B(mGf({zKv z=I4tV@u1w#an|q?1hF zUpGx%#rHDuR}fj&+}K?Xtb|sd)Z12_TuW?M$0weK&Y;y?ZdzP3p*wB$@=dvq@E&iA zCCk>NZQLX|S`t?+0_tCsE%Uak@f>xAMxq0|-72TupQvBj@anif|D<LY zTO>od_TxV9LIK~z#Y&JgTFKwMf6!~Q%gx)#$lIk7@4ov{TiiSI8k70-22kK%Pe1t1 z?d-nl7}u^;(;G97J)U{`{NjA}1ZzsEwrq8+C3(5}J+LFYZ&>OI-rZRgdYDw(evOL2 zf0<*+G_yIa>N|zsHPGIT>Q{qE=`B_Z&9l1Sdy|YkmgaD}vHf;9zVBe0debB9p-1hr zx#3f-X-gSSj-wvMi>-Pv4U%{)44KHetTR=SdTYjxqe>exGKF&yo1H8;O3G2=1Y-Mn;k{KgUK zz%g)Npls|5#}UFx?$CMT!`!pxT8rB2si{G8XQ1TDPS9J0(Q>8yype<7jg@EY%19m6 zbaxMxpSJ>mxZLGv-sZ&AdvrJGZv|S1LL1 zh4>k6ipo*iPAYrPdtFYa}Hv6c6^T{*|kf!;?{&VHzPK=

6NLL&ZvV|s?!wMP>En}d>59sqT8EuH!In|ljxk$s3;$Y z_@)OnbQvO5jvtA0AqwF#VtV(IYYTT@{)?1){JfcDBA$(=X=yxG!k^vMm2$1XP`HDOuhQjtP zUge)C;aQNF?T_zo40eZt`rHso zR=dTLeMb0*S3%&H3=FtbKbaiZ%qz>7UR{=*RI^8qU8kHXCs#7d4)RIn4K!skmN6UOixWjl3WQn4%WX8>;$B61L zH#k9d9~nW*8x?*UR(nFDb%9F6-$?`6jbI@QeWnk(SgQs&h^492y?F#kN?iHGKQpVD z)zzWc1PRz4fTJk@`HD9%Z!h;N%qL+1ScK$FbO~~W{Eu+6n-~r;4r2q}86RA(g;V8T zev2=%C*yV2Z*DA!<62}c^l(aGx_(>FXr14m;pjUm_QUC-Vs<$;4N0Hk%7o#o&Y0pn z!dvm1y&%Tywe>`m5k!1_`PZ+op9iBygU=>Ll?k+zFj-tSM+^mIj!5WbyIL6 z2yWFkDBp^xC*+V9941x0iyzP0uk3p z^dP?^M+{Y()w19G&RpOy@vmC0zO7UCE#Gv9tuRk*Nb)8s>ufCcA(>C;&JTK94MB;f#vU2bbQ})ChVPEk*UP>(O;DrAbn{ z(Oqfx20$n&pb)(p#3zsyvlS!>sppI+wu4*nW)BGm(FY`*m`-H2rVl zrhUxApBcOt7r2wRe8BC<=6b{}P)Vs9lWzOKyb!miynQF%m(4>Ghwi-RP$GVeTbUccGJY zyJ{tkwMb=7Fh5Xw8z+dp0}&LgP2iV-3i{3cr?UR%G8gZNOJHL|E@>~^&KK0!Gv`n&s@;&cH%ZW=f+?n=gdRu3b8<37)5^|8X+}a9aZ+ZTa z5mu-f48oRYA@Iwfl)87tG6rFVvhM92GCEs6q~qQy{{PA#ufr0PH26mWPe~p%#eolR zfV=S*d_VE?^8blL&z)@dB*6#AJ9Cf37+cW&`NtKDJ1Z+tAP30gTz&R?@>C*KYP0`9 z{4kRG4LOe{+v{gbRku#jk!0u&Z043VY>M*N9wHe#mL87J&}O`TkUzg z<=Ac+`Ipd{eeRN!_4huCm#q`&QbYAe?|7^BZyal=?%A?|*(&^NQTeu)76@ALPkA?;u0u%P9lTr2SRk?-1fK4i}(`XSw= zcOd+a$hsu!jd8jp343lt2{P`a@CaZ4T&NOQ+zDZ57b5Pv1>x_xE4YjD4nP>x{fhy( z{hL8)x=Yvpg~5e8-|xY%?gs~VCD?k9{vKS@LmvPOSf1`O_`lcximQ5!&j$tg=>G(t z=T7#J_FZ@Zt79zF#a{WZxCX}X*K{Be_5XS)c#8iR82JA_GMLk^mc6z{3$9-_ z^1nj;zb^&AiiV8!N0Wp90vgi32fF!Px=Y)C0R{Ijpup|FfI|7d0tNg=>VK~N2U7oY z_P<63bNUM?{Qm?B1^Aa#|9LHBtUo}p{>$Vc?cYGXPj~70FQ91u00jhtql*0?xZ^LR z6#pgDKTYbdYws`p2T=cW_P+)OGXnlXD&;?s`nOQv_W%1*$WVU)^)HKJ{mY_ev=XX4 zuwdC}@MIG_J$b2xB0S}yMY5=cnl3$8|js3##+44CMykc0RbxbY|Zf8yt} z?j8uoNlP&F#78(32V<+8pOE4yl7Qq%$~P5xs^xO>w^748;|Ec|hdaHccb2Yf{YzE| zaeM-*7lFh-9Zckp0)HtX>!DNUujI>Y#A7}5H{F9LR1FTJ5lRVxUfd6a;}Q_PNMRsC zF?xvt>n96RW0^328_dip|40YLbfE(NmMK<9e%mhu2T0>jfdG!r=zmuzr17WF`;#bs$DV)76!3Rl z&6~4@w~3{!n3cp4!8Zb_L(4xp`^kJufT)z%x`5&4LESU8rX^PUg)0P+DWD#x*Vwh)|A`NoMwPV0%fTdVF7Yr zpuzZZnQ(ivVspD%x@~-O<$amrkcEDGxZM%-@^Y`Ez;B}9boo1ZTY;D- z1>4nIl2sjm*N2z&U~AF5r`)&>H1yU#W5&0B+xPYppWlhiq=4a#gV*LzN|D#Z%u&i> z)85v?%8%noP=nabc~1jhM)u9_!p8MQ2h#Q4Ms`N*?NV$C`R?`@x#88-evHp2!rh_r z7IJ#vb7tDaPVgZJbh}t^Q&h8bZsvip+bwjolQj(h6HYs~A=JKEkx!(I`=SLDz`N)d5uS+E;Dpp|=Xl$vy;O?lZPsYeE^_!tha zWeXdYWY#^W##&*qtPnj*Jqm^ z5S{KeABC?urVL5Z$L<_^t&QA_`kqY<0Kjz#X#H^a((l6e;{ELwAwy!D;mj7T=zep; z2w8SP{r*IW@z&0c@rA9M*SLyy!=-Q8#a5()7cgG)GH0WDE>EZ_L6kAHT$&y`Dd;8Q-lrCO0xLwDS{esQ0`)y$&U}pBr0l*e;r4_d4** zUfaDn8kpc48QBMtm$kt^5pY_xdC={4xmbVg1ZtkE-@c7Wnmw%N0rqx!YQ`6J^bMyQ zn@PxR%YKx1b*IbT3fa0e4(=reB+n1(Kb`(bPX3f+!{>!U5Zp*ZdaqRYFd6Tg8%X5;hd8>sO zw&Y$VY5Hy!!wN=?Qx=9+_NUa@BtxD9=`oRXakir9DvKQ%?av6p5eBtEgFZParwm^b z$X;edOXW9N;66$U$=UO?!q(PW+~b5+x#7u4>6xcR0zZwq3_6VtM#09}+XLd=ZK+CH z&XicXDbKjfT_$xll;4;A^wvv*W|kRCn>DcvHphXFeXoH(UDmWEM7zQB8a>AQ14WDz z5j>AW7p14(2>#*djh^u0fPmJ~l5T_+#V0!5VYVV7m@Wzoc+b29cCCjuD>?6!3%Anb z%Zy^F;T*kLnZ`@3FEw$sd{+V0%q_J{)lNLgdfTjBwI*{HIz5dls53oLtws&Hi?(Z! z2g3BO&)lG0)`L#1PLd0JpQBrgE53rd)Kj{K#`~mSMU9uywXdS2vb6_3)(2;a%dL-kDVS*#fK; zJe=*`l!SC9uylK2I98T2G5sS^hRbu+Weu(fc2B>LwFQ=1-v0DZO3qb#uZB?YE^j2e z$s*oj=v#%~6rQ5>Q@4)*m%CQ<(1r+3`qL_kEA1M|lAJ)vkO$Mb5|1{M0=r72EBskx z`pPVG`clhSR-n<|>o|Cq^%7G|M)5_?ISkh_ojj*77JoqOM}nP@qn2)>SdnV`)Bnd2 z!M1`G<3tB}A}wB3Yg#ak!?cK_R^ia_Mp5b2%kS?A-&MKlTNbzU0uiHCe6%tv@2f^N z_2y$AQ3(*1jD!!>&p!k2nl?R=Qa2Rd+n7-@Tt8(S&A35b)-y|xS7KmSw)K+yY?nN5 zGl@tQJ`bnqoSyM;D01r=g1(|(Jc4NKdP3>j*|RUVZ(*cc^{M6p+%xi@Re;Q-Ud5A} z!qy8C$&=A5Q=#gT;{tRm-=sl5*k0BbVXU%Jojp0fgnC>|8|W}4PV;1|kx=R)!7Nn( zNj}2kTXxYyf=jBTmoEy3xbTx+E~uFKD@=qaSWl1%ww{PoHC4)mgKo?YJ`M04`io7& z3%x-x+3S8;&%e|m=zpp-H4fO^X%v={MzM6IA8bAjM<*0@U=3Zr>RaXLgBxDLbulb za&BLD)*~H4gkR~@hB)yft{|-e?Oe6+{gw#1x{hBT`D?VYpKkMC9&Sn5FT!^6))Y?o zUCa4wyA&O=&36?Y0=Et+9_Rgh=b1}E^!_NU6A{`;k7h&%^v~=U9VZK(tUI4g7U}pL z&(s;&8lIBARG#|0K+A)VwEF(TmltT(4)_)y4}HtncC1T2a%O&DpFXUdgaam#@x{x1AIHi8o*q&;W5eGb; zkTd2;zOpBnco{4uc8NpJzwlZnGemT;)78d8KH{1JTY-{?dBipP8-2Ve+2c(|qAI0~ z?#-}hSB>$geMc-=Ev=zpEi{L%P+gznb-C=b#D4YMr?<%pF)<$DXRLR%0BL&7WxhNQIZ({Ox~&COh@Q4Duv_6&G}1?NvwuRF7zJe z!Zt=Ihun1|iI>S!wS$o>W&GHSxqbqV{8C)MO*9KMP#6*GwT7i4`*Dd0AW{wy@~^b6 z>zBFN`1R}frSB8Iho8`9C=cNz#^#KvO1+rKGHeit;l;>beOk7O-X8!uwNGIHLZiQm z5jv|a4*9Z(7ZUcJU{N^oxfq$0H&%hF4l>JHEA$&`od9_>NBH{ zim#ODdX=A?J};%aeb<(tD2FqLhW@yIbDC&?JGkq)%<9VPtlnb0k)DZsR(?fwIYkU*Z9oJG|K(DBoU?lXMOw!V_zSQ zx{oerIpkL-O;-)D2`6f_k-w3~9V2q&ZkdzFG*`$D?ga2H zY3%Ghs=tl$9=lLrt1DS9yw=B`A9|6L)@aiDv?=oAb6su2N7)veqe;{}$1?-Q-KfBm{Xkm_uWJ6msgQw7dC3|;wJJ)IneU>AIwsWbZPAB?#H+by zW&>DA?_QMiTUxO83hTITw~VS7?S&+@O)?7(oL(~;VYm9BY`s^mZg4sk#O?HxWt)Vbyx((|0>U-nNtoS28RLNojWBk}X$gWRZ z>JR&l^zlhSKE0YE!jk|1>vgt2EZ^l$rebJneJj6w+*LTzgC=YnIzfFB`xE&1^OiGV z)BN~${o={h%Bfa=wpyc)%2yYmRutgLgd!u!`q=R-KgH%ZCVgLAk5aGFjSIH@GRd3Q zX-j==2Q}PuUhx?3CcknX#*TVEQZFZkrczZzf{w=w)TKaERa_4MbjgR=FisSaBtm9P z;}KqXRV05GVo3kW76$ih-zf?z1*^(#9Ihjy1;0kt{6W_@w@wTbObZ5AapnMb`z7Ls zIh1xWOYlGYqHSR6r{i*S`q1L>sVG7u5hy93#hKs2xFe^k1;YB%s-u0YvKt*;2I8{YU(i}CK9E1$7hLnf(kUMxDbj55w^#I1^ZSaToG=A z?{2ouuf+aYO(w8~F2k-lPH9#XgbhI7eM(plU;EWH7NHD{204i!@x&|u96c)&*rPbe zAw83;mKVs-;I0QyP~bZB&!0bZd4hiw#T`u>K4$Z4cqphY3MeS-KNL_<{?Ka)Em2f= zG^cDwVF(^jP=?ts;9~Z#KmUNz*U|J85LW-JcmGbZ1|&d7<0cqHW8D${JJ$au^@k=7 zPKb^s{x!Sz(L_QV5l~RZ&X%?=Y^;!@sv`6Q92guhJt7o@Bfchrb3S--^e|9R7{5mW z|M!O`icElxA-&^PYUIrN5!@LKMu6xaM4M3wqA?7=xIK>{dN3ZH5E4TRPag}R`ad`c BxH13$ diff --git a/spreadsheet/macrofree/security_checklist.pt.xlsx b/spreadsheet/macrofree/security_checklist.pt.xlsx index 6b62a5c68a4ecd83cfabe5c61fa10c4fa5c2adce..81dd7feb61c225f93bca31a7ff7e3c7deacbf00b 100644 GIT binary patch literal 34861 zcmZ5`1yGz_uw@e59YS#Tpur`$4bI^1?ykXu1a}SY4uflOcbDKWxH~NQlee{Rt7ee; zy6QXaea~%qX$VNnckkZ8zLPXsQ0w;Z&53*aZ}9Dl`t~)lHI#R-wR2?Dx3l}~W^E-C zISl`S8Bx?Xe`L+X>$ed2Taol+!eezDcMyoiI`HAv1(K*G&687dhC-pI2fLPfEvVI6 zY`5|KfQQJssk(hpkNgGSJoBnwMD-_>JR(AfUpdzE--4JCIY%~K^{0!qBgVj)3_&MG z&N+bK-fA-^137*b2S@6!>4yn-^s-$YEcdDa_aSMnq*9I-Hh77Qy+iwd6)?1QF#e-KP>inhFDA_14ygmrRLbM9;0hF4{_jv-{+pT-Cm@5%5b~+x z<+Ry~W%)Daz4XTxsuc}2%7_3QQ~Jh<0J$5BiA=Z_SyvLZ;A$Km`4v;lt^ zn{Wo4EH8xQUH2d?$j|P-?_fn-ND5dL!=TJNR+!%BbuxYXK)_3h+qGx)uJ9=fBCeMF zwp~|oi_^rAdB=dve|>pxzL*zWkD`Sjk){DpiGQZ2b!o&)Zf#X6^MmoqL+6$38($H?@(G4*`dV?qO#ac+KYfe=mq>_4Ou)E1z7`5 z55~{ptsUqSVIBn6ki*j_5Y_R+!YIf8He44DYI`j7yLWxW@7`g&8P3g$(aFr%+W7BJ z=0B!8Rv)!pX2C%uPg z)=zrha?FHCSM`C;WswNuXYbrInrCc>NSZ|)I|Da8vR>TGDc{T8+SXRM+x3#9#1FC& zD1C)r^g7it5aRrJ(PlGDr`OFvsphbuIq!4myOA8jg50eiFUKo#7;t~1;t>;tGR!bR z&`@b6Qh0q7+k{X14V#ICixLy~nMfTXGE&f1qCD1GwG1_8fQ=N>f2nOF`fg#Lf_C&c z=mI&YQX+ z4S0nVvb31Pf~=+$Ej^~s`3_z)y71hQhsvqa&-p1YGFpX8#ZI)+-Zby-`OE5xCe<0- z$MDnMkEVWFJ+^4kQa;0d-a+!3mU+SSau0H4KU=M6sL_XJvuwt5YXI8T1D{Xebr(BT zk4=_~Y40#G<-oYCi=U7q_4YsNwOpb&x@iDSp+r&)Z0=kqkj>(g2O`K_%$yU#;8 zA!E&*YKPY~I7(nWPlvXy-SY-~Uz@b<`#e7`_vMUI{F%O0T!=n`=Wd~KSV--s$%mD_ zy|{g-@6_nj@A9A*V*Ea|vWhB)SnAIP-f|hi6P$T?71{B@y3vP1yYawc{r+rN*W2jA z)ezTIGaQ;5n~$Rxw95}=n~N4%#TIL76;UmA^qwS4 z+ck7NMNinAmskt|tz6P0kMUZFLju+(1q|z7inV;S#-R}bo@qFb2@ACLE0U!s2*a(+ zRm+hd{usm-z9Psn5yPA8pv&AC{rdo|U}PV$3Y9yBj~}?d7L1td`uI5`m^N0LWsbxZ z)ll6i?MK_YAPfdmbSU*B8RlSA(LVk-4RpXNi6qg}w;V0kbt<(?Tg~+V#5|PfZOIX5 z%@3^307e{Za)IB$k89f)27J8 z#cE{D2ZRJF~uK0%Ek_t z?ADar3#fc?_q?x3Y$`MUY?%_JGF&!h`m@dI@luR)0Y01hlA#se`U$r;%x#)Z{Pakw4Lk{=55@h0Je_-2nMf*5Zj*S6<{5@LQ5*cTWlb33iHY4=N!CtBgja?o6?$=G|v(NP1Ulj!j(+C%lG zB`wv;MO%J~wb!o$@}&pG3D+|hW045-uq@L+ha;7t>s`-G=tBidWAIR2gMI1fLkQ}< zb&-l8ZST>}0$lw1+9tn4BHYxZs0&w&*ofpWFS8bze!3=|u8O7%e z-PLHE4|hCD6^oM6R{f`KX5pPHr)cZwbm~{FJ#EU@yp2AI(=3=L@)b@MW6_F^({W<) zWb2mVl*ks(IF*cQ^qcdiE`L&Kztc|U*r|X1|9XFKc0@YGHs8W;;zQ6m_VDypRbPRTV7vC7=0Ls@_0vl)@@vN1lrv= z@o(03wBiQ?R>CgQyck`j)c1N-@Mi?VAHyAVC1O-ytT}LQyiT;OL_v?6S-zG0;bH2r zg%{-uL%v?;vc3j1Gy;U|i?X!UyfzIvcXv`Y7bvfH-48j>zeA2*HsrnS&c{1Wd)vII zP+k{HA!Y;^Q)6H6Z`qcIv{QCk)Jf)F?>47i*d2CVoB`JvSuFS2y!W0e{M$q};q=-i zwWY&pzRWz|?=n^fwuz^~PQKgsH`=7^v@3c(7vl{NsT|iK5A40}FQuO^oJ+zL_KM&q zvth5ZZZD*4W*Qg?oJBikySQ|Dp(~?!pIeYF9>HTJ!x5r1l^3Jq>K<ySMh z9A|wB)LSAdy1v4Bpy{d;P&^!DwCed~?yEnCkXg3Mr#=n`wrniY<(>^c(!lQ#c-7e^ zG7)u-@ZnlqbES??FBU?1ZGGBO8(5qT0QjsL z?QERlz&MLBXp_spReDeyfi0)Hfn;~W8_j6`*>(Yer!jWYusGm{mbBkaIAG=Vx-5}P zcsNz$Fe12h4$;x9z(xFxY$o^TGWyqT_1SvGYr2p8yxPgj+PFlQuQKK<&_X?hQXUF5|)5MxSBB(UFS;PPFj&T*5nc z;2y$XD_YwY>3aWuuiC0Gy0e&XA*$5zx`*QJ8ZjB8I!?5hVv|U)oyhs}aKBY)oPxR7 zZgJ+5p!$lH)`7OO^0DG;d(wmPSN!|7je!78eCf?b&0h(7nzQCVb=VPpIS$PZ(=C@f zZcfaP6FnGaXWD~Ws3KcSqv|+0uRy4eA&am0#)7N4zG;y!rhEP9_>v)aTlIZQrC_V(IFpx&1;4TJh-l{0V?x<)jbpq{#s2{k`>J2#L{WX@ zCI_{4^_QH(bmpu+&Az=wFeC%la87?@bGLGQ=87d4p|kBsKSC<=i4qb=emNwedd4} z(pZQ2{b&np1-)wXPuoU2Cl)akH@t^8RX}KllEJPF;UBVP{LHS1*g@ev@b33M|0j&BZ&!^M)mD}gyi%G*G;Bin;F zNE?$s%23eyk(4obAY4K%c-(VxW5eUbEj`~Qnq|xyO9#K79 z9uAG&@r*f^Yt6oTyr#egaNU@J$5a7@O2%+t*eWVBi zmhYA?$VVRQjuaa&IFDfWS;@K=&pv_%SwOMsHTnev=4yX74Fr5(W_9! zS@TCyuU0^B53^(C`RXWZ?Hc&w{%OY+5=G@ujs0)c{NiW~pLRMFqHg3?9rK~IL*tE0 ze%^;CJ8P2gCbb~=olaYh$x%7Ibq-9EW@dyNBRDAVkC6iPI>nZ=Nq zC18DPFoZS!pX{4Y#1}71NPL7xt>m2O!z?GMv#J@TRHyTTtj+ZCG(OS{s|c!6wsHPe zYz9;`)!12t02X-l5^bT1(=;qykK?dG*+DTi{!$_|-UvLo^hfFa-N6P0>I?FB%TMyp zfsYh42-vKHAkyXZEBWDZumMc-f*o9?$PJJ7PEKfXHMAJXn<-d7HCl)lmSnGZXPzRH zautE^erCd7m+9W-g4GxORK$jAfO^(P4>r_5f+Hx$!A7D5dQ8ay{AEzOlg;DdmsK&B zp9%j!&|NC1?Cw?9WG9=e__W)N+Ief9h?2gZ2eD_l z?Gg{Z!^>c82urn+v7$l~re(d@qJ_&)YVoMqH!;&2X^&$8=Q*AZte*ZtdoRGiEw^%>99&WQ0e8woj>u$+S_HN?rYc6Sp7Et~2m6<0|sO{49{%G|ujpIRLuhO^r>E8807Qd+J?9eBj4r}1(9$uu3Ycy<1v^1C$*Xfdp5)ASv8ewxBYWt6p#6UHPJsNGal6*cg0YxVX`yq zgHUx2@Xo5OXCzp^u%bfVx2b|@3y;TACVeA?=81N+UwPNQV6u+31b6qlH*j2XKdM(| zP8?fXZE9;yU~n{8<-Jr(fpOedQJPE*fAxL@8~Em=C}@R?-M@ZI@isFdO2z$SAgpRw z23-xyf;|u1ES^jY=;im)O(kJloO4QTd4I(6%6_6NNUe|La#9`g{){V5HaB6t-YKW$2hc3ro?;q$Vb;#9VtDPx1o)w54OZ^(ojxcmcJaWtELn+enVQ zT2BJOlO+_$$YNryqRcoGg=5fRI-5J^JIledKATmwTTDp)7)?N^rmFM9u6i0`$duL= zk5rXiq~d2y9nt_Wc7RECo-o|~H`7TN7lKww(a^HX(Splvrlk@i&YPgTx*$bP{L8R0 zrh{=7OcM*%Wq@)ADsUoMH8i`3NOP&<=diL5L)a1j^!iZLQ0>lE-PwFwMTLhn^>}HR zZW|(4);@tj?bNk2H~pSYw5d;?{L z8m0O{(#T)&)U2)qj9^&;-*j)6V}tg+{6ErPl^3F%(JVot;8u`&g| z^(8b)i*n*ZS+{*|Iuo)DR6?rHmp5fRxXq+?`#6m_7b@2Kfu1C`v$S?UxsrK6wxx5; zM9>laiNoDr7e?TrZqadD(s}aUB%l)hOQsfAOk3lukOmek$EKLx?BI-tQWuHWPw<)v ztZF(Ots@=FB`(z~p+iQuHIymW0tw);j%ECK#^IDvQ5&&_NuM(%dz8wUODLE=<}gHe zIl7_d51f4K-{mV!$HAZycdmIK&{lGg%Wsx`oC-^I{Z`}widOdR@}Ga34_(w|`O)Q> zN`V2X0^tC#RJDL?{ov&MJ6AU7^_lbZvff7Yv=rl3<>XjYgV#ZMHS5u^%+s)0yKP!` zYFaQb;I@YPI`#1gWr=2mNli{J3^w|nzsrcBBbu44+Cv`3IyNOdoRpe*(xYP$arJS|%Ol{PPY zdd)b5Y)aT<_=QW!UW(#r1KspwDQMOsOmLPc58O}3?%}0@Tb6iIo005&?$*a>q8Oz+ z8d;)W=CkQ+T@HrK<{rB3m*I<^B?VqPV_$fyz+1G9I19{WN>ZHz&-U2o@}eti#4ms_ zDZKj$USJRbKk|r&9V21?&+i%>vWqV{hYocDsTO%LZ1g>4OT)y72+XA_f;dH~!xdXn zy0f)@He#h6{vvl^imiSYL_SS5a+6uc22-`~|D{g5zPP^1jXM*a60>q)eZ{y01fJAm zjD$#bNE1p8VdT>AkL0fWo7$QmdTB`^IVENtv%)4R14Kc;?EtMW2|7W zekfmiWvj|zu98x(=BYY26crtmX=E<6M=l(RW0@4&TyJRx9Z7XWFV#>fYO?2njs|D2 zb=2uyQ4Ep>uI{tVB`g=C=lqAJ*e5iyG3*$zNG{`g^tBlI5w#diz-TaQsR+Yc+pRT7 z<_v!;+bb4R*j&xHu;rWSYqi{~%fS-`B{K<(u2*JE_t;FBjkJ$SVuJ^8+)=}M8qRsL zj#(7$tm4>||w1z}s+z^b>Z{&<8sXU7-t zu))=3;lR%HJ~AAY>uZ^$|<8n^P$V__u+1>a>nn@TD5dedjortAaPfJ63c(7 zrfH99`Ic(+ELci%&pKPiE2;(PKHN4gCCJl!TE_`PyaGU`ng#rxqjuC&82%^Wl9KDv z+s!DzxA#OWPJH*s%>7%AviAi%1x{A*1#4`KLT`&NGSVTE?A1BfK* zAI3Ci%&0ev{cq)f4xt#&-&{tP%E) z8t1y9CBQKIp&4WilPOoN_=Xeo2j_~){wP8J2J^IIQv_AX^Cu0#A%pQ6ui=|3<SEI9`vdzGv*re15m z$3%V(`F%}b#VrCOHu0Be=1nJkmvNu;;7i=`J4TSvrr2(M&VWFpE}|!Z_%OSP2^e2u zv3X?2SV2)o)vO?b)s$OOAGjPBn_p$q5{mKza0iL|zePw2K6kKr)D+H1=i5J$2UFq}{-vBU%lBP2k= z$GBgyo=yFNS><6PJ9<+d7@j8MQc0NDN{j@xNKr(u3B~>uuiNjSNr}(SuoRkF_0_b$ z+7zZDlbhl{fxlyleC`6p9`8|XadN2^Up>Ufk}m{LO4pB1$3=yVgOJ^YgXFPbz?ZQq zx+pv#!Lgi~`8{VX3qV#Wpx<2EHfD9$=O~CpW zpUeG8*8g=V+1i>~FTETo$V~3gcvM_ z&yaBI(->Jo;nf=njSUd=fo{PYgFWU)(*tKUnBK;`n;t$|vl<+{*diH=YKadOsq`de zK&j4Wck8}D)wIBJQul|M!txuQ1A(s{#AgreQTs<~GTftKU2X0yr`|;VH7o`JcufaH z$cV*@;19}<32aRpRlwP?=Z)DNU<>iCnv3-E?C`6+QA^mAZBieYi1pQ`fF`hwoO(Sh zftb195@wQF$EHTSzv2v%(k2!B+uNINp9Wy-9e%IzH)LXLHYjZIkc@8r@#KxE1{57uJ3d z0u7`LU~@$?I8fG#n%c9CoNRyHgr$}4|B4T%xyOZMmIG+6zldM=5wE37{&~E2v-(fKkd3P!n5E79VlmYl`{fN zb^zps_!6>QadGMyy@gEW2@vQ1)jUEhswqdM4E{xjxrh+K&hBVWdI>(cJHI3k$L3PR zH<|wmjBnwMf*U3WDvwxJD*QYCF9a%&SKJu4Ev;o!g+r^4N0Qc$pqKi(xafw52E}}- zOi9JZjm8+&dxa>!`g+$iC1+6UQ%Vh&xbozWgHM^2y!RqYaDDZ^$xp4&&WO`uiJ^=Q^4ah4N#Ezvn{q@={1=sc9Po*o zeTXuYOvg#AcMyHd}iCedE5dC147`-A>4 z8;G7yReA|!O7`!8ru|uLQr3(1*ogMs;&}Rx;tNe%6OhB=4ObFSAEaW*6@Fo)buUOc zTl2|VVX!)9P+?P1>HFTPaq5^^kv`Q05dQ-BbmTQ#sEI!X{QFt?s#;$JH62&W-CGPc ztFTU6j09ZCzW1<6tmDip{WoogN9B~>DK}dH-bY!QNHpL{{bcDV>t$aqlByrdRW9WI zygUO~J#p(bKdKG)*l$?dykQHUZaHl55P_Rg!Dp7>C>YT9=7|aOM`O5KEG{w~y-R{l zCzgR*q()wR3%(}59~Szs1%)C;0H0UHI4CF!c2WPeIoy4Hdc)Pf9_9YY(T{7=TE|$5=TxY4P6B@g3 zaA(Rp{teVBSo2bUC`7Y?u*dUE{LC$ComRUPeJ$s+PpXSwoh{2UKsLKZ^TUxW6gRpCIGj z>FjJFq1fkp!MrjEI9lJm}BWakNz@cc6ko)acdPhpMln`u7Iq|=4E%(NFxeT|p< zR3`_}aMcF_n?{if3DhzutnoM=O{^|NL^+qnpP{~vfBHyi&Z5oDb|x|aD^~YAjwBac zj8Cp4{<8F(>wI`=67&vDIdSD3s=DR43m-5|>HwTF-K3|l=UAWxRs-$i*-PEZl6?J# zB4w5U3bje;eGW4eudRv_oNX%K-ahup7Is{`oR-9E@>rPHrtG%Q+aPm$v?5olNrdMm z`$a+<_Nfu|&TnYy%R7NXH=9LE-wF)K3fx=#>m=J{06Z1octLSg*#UDds1xOHskhBm z=#1jQy2Dla)+H2-?!$Zh8z{`-UT-4?pJkIJF6Ru8%HEmzPEyVi<iL8j3d$CYjpcgnV|%Hvh(EYMT~BoSRQsXU=- zY?Ei~*`*=muMyTMd>}6s8`y1(9{m$oRa`3w^z&HE(n8Xwo<(4BW)!G6^Ju%wvWx}F z7$=+>u75oRL%f>nM47!``KzYzv)6s%RrZ0M^GX)v?v?NX?i4CH+qQ@k^joZm=dkXA zj{_DmUPeXIiD=%PR3HUcp_7|wK&e=m6QgTVpZ0|6tzf4I6<4W!s?1A70>PJRr z`}dv%F*LRlW&b|qZ-Y{OtzT8GD`nHbG5pqjz^l8^H4YEZAC8$vy`RLla?1S+XnMsw zdnr*Sd|%Q8B9_UO1j{fCui26m>yI%^a}9z|n%B3hA1;43s0|})BFr{q#dP=wl7U;w z59j+TCYLYGZZ;>QLF5Q;uk|xB-v0^^G#kacU%97*&EiS|l^%nY_g>@LN0J$&wH-+QfJyU7tP0X&pM8?^oBLltQ z|EjkqVT+lyDYK&lfQoR*EB?9UW#uyMbilTIy>+qL+u}N`G_Nc(1TYO5bNx^$w7XJ# zTYe(xG49?L)lZ)sr*ur%qa85`@#v0WkMov!X%Q{*H*~|JwO^BA%(08;`5;E8WS5!w z5`NOQPZ*R;g{N$HaVHYav%9$=K`NJ3YG=2CE+iVTN&=Yc|i_!!3VLF0r|dAPr?xTpc={gjy1qY zq~@e)_Z1wFEV>ScTn?cB)e}H2_hwJq5AGL@wWTW*D4GgSOPrM0`7=-n^{&b6U{(Q(2m5@&fh}$%Ik` z50aKIKN-pYcTr)P`w`QYHo$;ZFMb}7-q$H%{j17yqF7+Am)Ko&K7n}L{aDbV=Oa?h ziiicISlt<=5?PcD*SYF*n!K;AD98{>QKnN-Iv*rr%t0bv*R-t6~6?yua zullT!BG9TEJH4=b%F!;bg;@T>KN8szQ+`thO6tw$4oRWQW->E}T3-&KG(vy^c-0Ep zg^A-O0`q(fQ;r@mnYSK2d3lc-sI1Jv;YS>3tpAxm8P2@Juv&iGnlrT4jBrqqV{%w>-j zWlY{56n6_(Ybg(wb_}E1a9x|q*yS~LZ~v|W6zcBp4qdy7?LHm%uh#A&_+i+R+I=9? zaEtT9m`Xh`1RGDKe0HMDQ}{#d5Abr-t^wrMnKS!n5a!R*ftKH{(21kQ0_PYT_5c#O zU*B#T+F8XXsn?W0^(uc2!f-8exZY}R*J&d|vY@s&=R8qU4_TPLh7`L8PmJO7-VR&PI4bRNTkn;8;FgfpP`Cxr6~B(;%_gzw9}D~jEZy4_6#iD`QSzX# z+xuLqaY3~GM~V?9Tl={Z#HxP0&QG~{-5(vZv29Z9&rf$yb6C_>Ls zLqN`JV_N^k1;|&p;#fr2PFi|FP;6rSB~)JXqrcNc}7}Wu3e4Fe1bq=$s(GYxfi;eJ%;;FY{AXIfi&*zlXz!1xQver z%bto(DOXnld6?Z%CEv;03~=Nzy6+C|_g^U0-rrfo{?9fBH z&{^lmh;&*D=&gHbfS!T{JUKR@DSuE-c-47P$nZ$AioE8eTmD`m1(YRHnesTE2)<$8 zRt0cCczBX_{0T^mJFKH)55CFv37(1J&7Rd+c1-{uvWwdQ{56&WekbXTj}c#s@Y-8x z9`9^{mF~$-8c3!{tZBA@U8YxQh~u&c-&I7+!?oR4!}#I+osq^*U#Nfga(w$V{E4ra=q z-$)H`PJ-}&fs6eX0a=|@dI){s=PSBtSN8jXp7XPx0+lem)D71GoX%+|`blrR-0T`h z=VxTs#>!iqq~bItLaFeeuGCuc%#e!Fpks2Q%IT1*f4$Kbq)-)Z`;`OHg!Rqqi-<4{ z!W=<_2BWT2+Okt@(Xz}LFsUY_8E>Y!i#x#dpe`sa0hf9y^cSZLT2V-+%_oh*)w;dK=MgV!}+Lsz5@M*K(avS|p;^)Qa%NNu;AG6*Pq57*nd0zR9Lp^@inJGA~CivlV zB*d_dFM6bEIuDQzzj`W$O_t(^0juE+KpAX(#-ub4ciiH0i|oev6MylkR_22 zcc1jzraJ6F=XdNEBMI^O+Eck;?b%Zkvf*$+hNGGv?V}|`G>a#VKY$#px(#%0M7DLb zKW7$cl;OY~CkXb_w<4&GB_)Ob965j?>CBWVvKyO5O$}oxl867J;_TAc~){QHu_w7 zy=$#_TkXW2st;$qS+D;-?-vP-QLEs<1_l@LpLiU3|HHAdKQiB{;bl%(%=y!&7?x+} z0$Qutt2rbmpx~*Zioo}PvNhNM+vvm)tr(Oh(myy=$@k3np^7acA1$NoEeTk==1HU> z=5;hPPs_L@3m&8C{x4A)Mt6bqE~4v#(rY(Akt5!dB0S)s>(xa$17txee!9Of3ID5E zoudd?D*w!HDmf|Gz2MeOk@Ujdp3#Y{LkRUi zaQ9{QX6++mPux?e8~R&($o0j^D%olA78HUt&Wg((HfDwCUlngxr~9!zuWyRjE@a+u z72L#r=kP=5Z%4$Bvxq3QSeu58^T8NdvMrKh{*)=SK1Wkax<$7BQi zMj{LE6h+)t0C!;cL%p&4is_Ou&gU$Z=o@3FI7bLlF*Y&n~ zbxWsl4}M z(|;oq^FaTdP&=T+stvoyU96ragBv<8cP89F=)PE(p{GdleQKwR+dPO*;Usjp{=?3o)x_AA8Mb1DX(Y$U)$IR>ij&+bkRJLR z`-@q?D$-8t%A&Kd=aGH@?dx#SDolepF&o+G?1wFDZQs)pipXYu+jM0g$!0uss{+fA zlT3-KH~zS5n_*<^&_<&4?Y)i5Vur?k&#f)XA_{=LmPv$97?hiAdb8~q9?Ni=(GwQm z25KAr9r;=`HAbKNe8<+}?CQ_O@s6xVj74SLy**R)>R5C*ICLCY@+OH>Ou{zrW59Z( zSr5F>!9j`E)fSgwCbyPT^?#oJ-Ou0& z!$qKEHY~^$7_1*pg7R#kaw(evj6&bMxM1@cu6xIvh64x*`O5gqXy=wjsM(p0rUNN`6P%Y&GyjJaw6S&TH$)!=r;$6HhPLvi_z~bEB)-)6%)%p;8s!UVoe{o zeoPXo9IrA|vG$)lDwN^IW6}HPhgxxFy)JU-5vMEX%ELn10Y$QyMWUZBEi4K1k#x5$ z@dt*K-xfWAUK;AGwn>#vtt*l4MyGzH>`Pyv|<1)e%w*yt&U-pKqZK!{FSBQaf~yH%lBGnYUQn)s^HSTF^F0X5`aOF{=IwbImF& z*;&3(3ZJglcL-(+Y>cCU-)^=eJ%J?C2;A$>0MClArWc)bsSqj1B9N?M3bn$~4o`gJ zs0TnyE9H6+ai#@@I;q#=eP2T)uO6gj3UvE-nRr^K;HJb0XUjss*JU0Y>q`vs#<(wA zI?-eG)GAdjKYcD)`e1Y^bFDNj(A+_DTihP619NB8g?1o1K$@}{sFOZG`lj;6y?UO` z3j?2)W=V-HLuA^ogJ%AzlxPtP#&33%QWXqHBiUL7`HYkZtaWtfFjP?rj;D3y^>v9pV$_6>pfYTLg>zbW7!IVSrCQjia zva07<-M47M@I?;ONQOBDLo&ugKTcjX2civVunS0737~Lj~jgQ#T z1sJh9*m0D{I!Q=bj!$kQrykYgAgTZcs}3}$XPAvF)NTQJ^uEmCQF`h(Gi19HHoIVB9{@^yDNBo?U8|B;N*G>2z*P zFj3Zf3xQ3{+VB+aO?f0VexCp*DiJ>biJ+^jh~J;kdZLzh9!H+#vn(qXklJp)*#2tZ z$tPEan|+M!#6^ORDMSwYC(|I^r!Yz!b^r@+yX(jOC70$QBMoH>4q7~ku_Ghce}w*L z4V0WZJrFV_(x;jcX-DVa*W>DfEl{pT%Kt?;uGf!HI7lMuAbwo#A_Sw0@Z&rwufT$E zqa0OqrCqBmnK$%gCTb4fAAi=Fo`h86LDIw>iZ~vZ+)|@c=@(n~TCTtCGv^%&e82g} zU-07v-2}!>5WbbLo0M#=9QH?-o83q0R_HR0RS9lX1NH(vy-^OdsyE7{dmMQIF}s=D z_1s0K%}6H%wFZvF2qMAQ?3+~{&ZSxbvh-^Guf}0-O8O910U0e@8<_5ffu<)^A@+a0 z?O9BaeS>_U&*>`s*i<(5YR2c{79huIfipMUA~u3AXX*yX34q*Md$Cw*fs(`j9-d>tJ)0iUkFpg$ONMi1< zW*#n4KG&j#+b&GgUOrsq z!S=Dfg0F={a|je5FXz3i{ab0vz18k{uWXbuobMqzlt6au|Mck`PyvO%F`_e%e^*l4&`QP;3 zj_uJs#mMOQaSK(7Kze%o1B8(qsmITuPM1sopZdG z3ZhRBDgtU~$i2AXav+6*6?@W0=Sw(-j_t;}nI?Fc9tF#|a}7@X9xzz=)im^JNb~(< z#O?WK=L;5Q?CyL$MqHE7qqJbH>5q0@+uV&3w%a=(YcsbnOZI3ym&*dkTXc8&hd{ce zjN3RDw?>XuII@Rj$D`jAZTYWkUvv1ZzH@>rF-PMJznGRbj8A%=vC%b#=GaDv3ak@V zAZOiBexp~Q!(E3QYAGpcV}xN0ut<_BP6}^T<!pw>pB#){g7eXD|lLDuPYO* zQj8|c3Hwm~?jYwRwW#64b~rbjzi)eQ)0PH6BOCmGYI_T)s=BUi7^I|;mXwz6E&=J3 z?nXKe9ReaHA&7K0NOy-QCEeX1-QDn?gWjUt&+~r&`;GDGU^6Crt-0nk=e6dVYaKQl zIvdG26<-4LvJzi4_o7nMc40MT{ze0wSOnzWJ!Nd+r%F2U2g(cpk=!brk_r=_+&tW?wLQRz%x>i~XlX&DmSfGjE%%+wVP65s*HE4!RZ?=AW93s( zEQYG)$dp%~KKm0IF$?-v?m8MRKdyRG<{O2G5_~e>M?fRtw^9J@Ta;^FP;tP&kWl*k zrPqo*4U)AI)_$-;vrK8LL?V7dxhIzrf6P%O(l)Gb)HOL)O@25y?DeM?T19aS8&y^2 z${_>}7&236@}g~@rIj{cUOe`%G|4>nA|mw6?0Ex9_EQ~f$^GDV~!+9|gUy-Y8tia@cdGeI+>z5`G@IB%mLOdTEm7EHWe5wsq zw}hxbYw5*sn0(UkYFcFL{r0?vtHQ~Lx*i23C2ub(F{-BqY$F+HYGinmX^~mO8J@#+ zTv6vGVv|pD76lE4Z~^@e8=?-@p4kQP=NWXbJ8M76ZID`MEnE(s#Qey~bFxC0O83g8 zs;F6N4Onviu~8=Q)qPV?3>M_4eC|L6pr2|AxIb|*sg2c7O$po(%e+4yiewmBQ!-c5 zYQH&JnHfVYEo#V#>(oHp?dV2Zpa2=E zZMcGbLGJNfja69Ner6axthBto-|4ypFg-VOOlLF53(lNNg?8rM z>}z9=ND4K;nP>=YZp`zG`m6lyDkXzNj|O4+o(Zj3(QkY0(x^& zPl~d0k0P)V_1sWY`^K~CtQaa;G3MT-(yE)jD=`SWa-C+sHGPqPI`yfbOmJi_p650) zKwpw;^4p6jUoV>HwA`?z5tSGcbTs4!>~i>4It~r^>_!`O&|cA8hvVt~4KxUb0;ay8 z=^H`-W2gqbvxXPqaf2R?Zz)pc!MTIv5?++1LcIM_$~3mu$aYat8Qu>#9bskOBxCre zkAF@o%QbV#<)xhsvQUsM+B8jraC?2WSs3)86i=i;9kvhZyu@B8T5aJ?AQoPy0RQ->8JsGjx=iW?bWMUm1Uf;^`k!faxN2Gg$tc0waPeQ zNu>=Xq)|Q?fw`Sick`XP`FcQYOUHFb`o`l7hRHa+>Nb;FOiHsNTBHVJr*c$$Ew{ja z$ITYMw4#-^P52X2D!Vp3{#j7m0S*eJ>f@uH95J*iBz3vK};?M3;=< zlS_T8^Ty)Xq?bmnIKcXqqkCb~9$!5mNhs4Y=;`z4KP#rnCG6*$hs<(W3Q{H8hr&Y* zJsPjpF3LYgZLK%NS8h;Li!?bB zlfpE^p+M+JC2&VsHJG=!WfWW2m1;v}STMBm0q=He*PaI%D0eay%Li0pregVbqva$y zEZC8chV)s?Er`#%l@tr~1gla0GHP*2m2&g2Ode!ZHRaqO@VO2WEdAunZ9j`WQg3Qh zC8JrTdF#o!^{v{D;hZso?n3)4naTQ?7^XJFydOFF=m=&562=xPLGpbghIOa4JqrDj zE41AlYB7L!gQelm_DnRU5m$3vwrg<5yUf`d z@?Zsi^6*+<`idoxxLb4>t~pRTZmynvT1QXTcNKay7sQ|82WcFeR5yVi7ps`l9-bS_ zB0jrgmw=S75$lq;-5E!&cw$ThJrGf-6nYZ$?T>=w%`p;T|dNp-Qb|9lmX9^gTXMl4C z0(KMbODz4Mxo_Nu$8{P*77&B^IA))y~3wC?lFG@gjqV=k&Ic zhGwX9UXkZH|80%tO`oTg$C<722OCzXm9nw0s6#>Hvh;>fQ|cij-Cfz`e2|?NMY6olE6EYAJY|yF1n0Q%vc6hZn2<4nn%rbGCUSDLw5U%z!B7cErdm0fRxDV za{=mRO1@R|CK~_+Mb3$FVc}*Y`^?n{^4P#wnbR(&ryE{hWB#`1*cRilL1m_Klx4SN zEOB#hQm5rtU~zc#G||157R%B!*k%HI0W{I(r^~1XsiQD8xCNTdTz440D#Vjfo+gln zERm*6h~tuI{+el-?L?XFb_>6!RJhb z>4Z$VmksJ@)U~BM zqk=mPIo;TxxvAi{al-9b zv~?r!hUYpyfP&DHkT5O!9_EZzDp%E$$yz;9q zW9JmCDp^OPy$&~sVau(17kNZg3kNqhen&30)82?BFsUb6R<&?z2RTP~_Jv~}s8rQn z?;hGMu#vZdW+b{HmAvfZk!MvISmyFlrQ_0LxmAgirY1067()!7KZrB_nv;D?VvJKw zG!1!!_#KE!WA#kvk8y-X04_V_eP|R8oYzvB*2%r^EJaO$JDc8>_ z>MEBx67TM@Zn^SlEi8m(Aq2Mx=y7WCnc+``vukWePo0E1zV*Y8YhHNa`-rbqrx*n5 z(f_j5e@T~q>MhgLH)m;@N+N_f`sx+jnB7OW+bmGLXcWF#p#&M*-W_y9IVJ8{pR_?Z?q$NR{dQH4fv65$E}^0+kMQjw9jMoZDAw>Fz+mXK{O8d z-WGusp$y#H=IlN<##>&-{+PasZ^Uuo8^Y9jwDwuPrPNBv>QKw^`?1XK1YOP`M(#;@ zZoAB3lPTN}0HeF9eUi60t-^cg&&{!&=66LI(ye7^yinG~C`GTgr8o?UGH8K;Q-(HY z2S9|9dEhW5Wx&GogcTd^)Y;;1d^lfgVMY?kPr0kgA=*C(<>Nsh8`>nm_IIkwh|7Av z-L9ANt&gnp4~#QQU{PSBMsjIL5LMD;OXhuEG|8D>e6>>hqQ_=8>ncVs*><5=xHX z9FfjoY+_AUA!jArB}Kla=M?QPhOoB`I4&$_w_d0yp?G3UT|1Rc8Hn5r7X@eXDl1Oa z^Pr!317yYB_~}mqWBI5v`4Uu zk=l8gukPH#rdaX@Ww)$ecQKYIv5tWiP7l384sRSsy0mU-UhfekF}Z52gX{CQqt>E--5z(toCZpMT|9pa~* z7m2Q~dK(qLXi=ZZIKWpP_s=0Sg#n^gbb8I$*LXi4eNlqg$BN4VFen%VqJf_l(#>!n(LJ zt-5#hvOl5%040B4UppfI<7OasgeSOLu45g`PMyC{JjNj%h^w`w97ii5OE#4;Xg!jH*^H&PS+G0l_UAyTA-ryyTu zP_~X8wHqH&`6&gDfi-YpD0_iUcw`TAOUbuIyYpTEm*?jfF5SL1^8Ot){3=>6r;PPF z4KSfgmfO6F3s8c^^|hgX7B+iJ9NMjnO(@X(ai_MptD-`j)Ktjgtsz?>yUUIi?lrFn zX!vHlvB?-)Kk#y3kll@w&@)#gb_`0m21$V|#ES|xV>!Q>R1eU3%obGH zF8G8(YMemFUvO0`gfOYrdz)&TzQJ;oGGg+=0J zQ>ioFU}G~n>|L%gov#C+2QUW^Gvf13I*C~Q7 ztbEVvPZ_Kq0a=lHhM!b8(-cV~{wZRgK}HQbh;zt|qlGTIgmxX01ZhS3X9{uO-3Qde zCbz@`KakkuRp4Y-8fAm~Zk2Cu#@8dI(^!KS64IC-+ren34~L`vQ8rWhu1v9`8K)JA zxHym4awm@&m*`S>}qS0q{eM?I0ti8jn#w+QDDs;z1O@316d7H4}{u0YJOHn2wZ_c0s zvz#wBHOoUuEg#{3d9wrX5k48R28eiDT!@qYB;&?;>?VX;d%MquD$7&~D=3i*BkL|& zU*;7N#z5q=L1;%rn^Uo)|p{e17YI0yq!-BmrSJCM&t^J7qFxonKjBCm2HKjC8Nn{>Vfpm?rzA zbsHm*@tuKwtNo*`pqv&sP*rm4s}9jj1&RosSAxIbq`%lTHE+770_B zFgs1faKBs<0w{({hRllzxe-{M&UNLha`E^Q)>qh9&x9e0mK17YS7xQy+%wV`F+Z#n zSLxdS(p`ylPMg1QC{@cJ9AgNvsW2YyGbkGNm}BD7vBk~ay?yefY{|sioZSg`vv)i~ zBjmBAKUv5obFV@WlpVJ&@qlFAYSaS=y%+w5xmk}}hXx8lgS0RQ%z>_dFZgGv;JyzIv z`nBt_Mp-ik6UJ+SU)u9I`+>DtZ{mL|BOkD(v}#6OW@f(&D=HWdzeLyumRggwNcgkT(ezK> zFf`I1>R~NY%+u|>_cT2?hLzS|w`7VjlOTMdg3$a7M3=%M)MWVNyvFF>v~3Po zy@VKQLf3Dn&e+{htv(G;(Wk4P`3c-D`0tiPSPcV+h+l%S+zn)-Knr+k(jo{aA(s`E> ztq4|o!N*EYA!iJ4f*mP$02Yh;N4@=sPqaonex#<|3+q?J*SK+k zU|Qv7kc?=jwMDIoyAmVtDc7dYlL;tl2qLB>%anRdlvvj)E5mz{pT)%%$cohoBd1gY zmx~!H@4A_s7qFnJY4x)Vq4}$8lmk>cV+TfR5Rbl26uPWsh*!TBk1>mG<;`@9MIvn2Ue3O==n$@3YT-IWw}&PH!~Y)J?&D*TPl?y%CXS4R*HxW zMe7|gE4<8?2zTO1G$Y3?ke>Tki9`M(xC)^{Z6*iu@!k2z_*qU4zyB@W1S4&dEZ>Bm zXe?6mvjQLDQ2gjiuOy1S<`=Sz?KF>h{K+;e%2C6r^~7Wufio>0*y`>8vlhVc-kcas zB&Jucg(9|BPC3GQW14)!fx0n~6_z5e;4J}e6GU6O5oOneN^PWMw%J;8wRLIqH{2aX zX9y6#Z*|HQrn*wP-@71>dCUfHx@^GBiK}%g6n)e=0zAQF z)}Ms{EtlOKA*VLd&srWc;{=|OGB=WPcQvI7jyO>eejYW3jw&0hY#DyP|5`vpCR60D z2oZuPn;0#wmOG`F_)-SWU$K=ZRSoNneO|@>@Dlt zLjEiVY{ofkTUd!ONbp`iUknFc%uUF(W-NaU(Yaj#IeEX{ zwfT9lGQ`o}!WxE3(rpMF5O~?liFH*{fQr)m(r^VR|G*%mU(ehxqVNS=Qh4vs z&@?fks$5ZXr2&PM$)zs&FHaTsagetp_WHyCgK~-8`R$~`SidOlV)0``pJ@E!X5zNX zN75`9n0M-`Zz`ab1tZ^8II8vAcx1QuSYcnLwwQGDx4Sl= zPY@tZgS}r)uYY`>^Iq0AG&O&-YPWHu2IeSheWbKVuv05e=}@b}?Fci!U9_^~`lBOq zmVlI340%Zw6A?o>XtyS`UTB!Z^WFl&!bboZltrP|{6qE@U+!8zsSEBi>VEXJFY?1+ zzx2$rW3+z1<`kHpOPg*wAjO{>|A+x&U!098BJ)&t%JB49M7p-$Z0`+qJgnX;kEvm9 z;Rf)wWf4pq$gr}i18wy3ScYA_dhTMXI0@G~M)aoE#^n^Tk7mM1{U{Qz_2 z3yTCYg#Ez6ZTlc*LXQSpHnZ7BjF#NH1<4SVD@in)%aQRb_}#hn#$^|-sEzXwERw>L zUvSN#0NgCO0LC2I6y7Fp!D-B!Qy(+ys`mGjU9 zBGASkvO;S7baSzzl}ABq8f%%uzU+~;Z$V{w0=7pQ)iqTdL@7)b&E0`Qjxl%1Qq8+{ zhs$7!62nw8!qVYoanQ4y&@6Aq>8q`grPS_^seE!d1&>vpH-GGbAR2nMz!Rou z=EV*?GZ}5_h5((Js2boM&Py8;ND06B#H#&`r{2x&e5tA|FTC8c+=!uDw;sNqNkI?# zZUdzkYfEwTI)1{fp(O*Q&dpUXz@HNu6vo=NkVIXA78*@>Nu}rJK~OwW6K}L>g=9!i zP36Bg<3ao?mEr(+-t3763>dGrF$U)Ft}k4L$((AKqAEDl$};y4$6j$x<;l;SJMEK8 z9vq$BU&2YMsMfX(B1T!2l$($pa4t}4 z0l^2j$~eno{!E$9GE3w}yev>>|7zMH^sDIw^6#cuw>&I8NB?R%LHVnx2kh^rE73eG zq5FR{wI357Zf;U|N)X5G?44Ql^VcD6n)lkJMb1o~T>^m>+keQ!rJ2!RFARV04-Q;s zpCCg>SeM+Let7#cTK$+16-p~Aw)f36rWl;GF~gos zXlR?ttnNB(6zKHFbdRA8as15WG>NCaO|vJu=bsR}{)!NoUEs9sj5T{e_)7Jij8b3dQpVtfCth%h8 zL&~J4(K1+vmaI~(-6Y-6oA0d&J8BZ`E(T>omH}!#ErXfxN$asJFuMlQu ziGU;GPd5W0xXttJcnST2nsdwW4#2wycG~o}HXZ~}fSs}b9P~dl<3*T;uqFdq2pr}g z&mA{GOhfqJ^Y+feHpo0L@K@MX|G@BH)FInEz(4>}{x1yR_ZUFo`Y(glN8SPcO_VW+ zJM|BO_0y8ya|wINb^cC0oaC5l?bkuts2#2VSL|w-J45v(6ckjeo zUfm}2J3^BxDaMQ8#7vy}aTUOz!L+9~WzQKBhc+d!Q)Xfk!AfqygN9ncO;8MwYQzU?*H|lvDX!qN5 zc@VO`N5qs$jOgJh&QHmvH#a>pE|m)DV1^>vW+-m*EeHKTLP{-jgW*oYfS#@wvl@B( zkJxt~9kEsC1t&p2_-Q^2#@Wfx8n9RFZ+J8|cWPo$6_j(hg1zD1T$A8crC|$x)$r7&j z3!f#x!juSfxzmkl9n{Jg6N~VV;vfSCcvIj7gl+IGR!(=P4BFoHpq~R@>jQQ)NSh5~@xqPa1Sc1#t9UyH?0$KE z(OVx7qWZ^Oyb|6J)r_BES!~t^&?)_KQ!|&BPU)YU>H2`)SAX10Nar5JT*VUx10+H(HSV4^#ghmbUj! z{_Wz`w|~2MHKe>1=sM8+1)+Ut6i~iL3-bUiNd6snJe$Ac4w8Sn*skes7lY(~2&FfW zAoK^=e-R4L_HV_16N>Z4A3g?w&G?g0s~;br1e{THF0JW%{Mp-BGlF$gTlUxW&IKq!!W zPpChK1^E~#-xKQn0~h~IsE0-Y<$JWE572_-dqO?PPIV{M> zK>40fJ`Y^{H=!OH1(fg6QanHll7AB_;X#H1$@hf%_Q1tJ`5!`Mne_VoVN)pw@Bye& zj{8w@A9w<^Mz6g5XBmEY7m;j{Q{nd_{ja-!!uem_{6CEPf2|ks|5wlJ)~Pg3jXxam zuW4uTKl1<38)NIPykFip*Q?O<4oH%jnT-lVx z;1}H1$2IUIT>~oOv~-+qyY~l1%o;U&#ylH&c91T&39+na8+m5Cod>iwUo*NN_ZiQz z>ClhPy}7o!?kTgL@@#N!49DuTrg!ac#jSBhrt^4{uYFnL>X}@-J+RUkPcnCXeK|E} zceS2feO?xG1TJzwdb{uKc0FRiz9wtpGk{jmpHw^Ld3e4~F}B!Kb=uC)=d#ssDzi5` zMNxD5+IC~Nk?76Egyjvx6X$K&o!v%L0=HA|%W&(pi{!(dZSUx-zOvTEp5xiPlFQu2 z`nZCuO`}s^lar|)dw}Q5>qRw!?7WHPeTrR87oP=D0zElC!8bSC=>)oaVKCTH$a@#B zOR8h&G0Un#T@!9Z35?5~NV<*(cFRVt^l!e4Zd?;O9fje#PUmIK@mExN1}?WJ8|^al zcFFQ~W5qX|`f7_cWZz&6TwZ?pOn5x#GLz8Acf{SZMmc93ybr&v@FvmSea|guC1*~f z+Yhc=zx|5Ee^a(^ z>aiDeYZ;wCC#~YvXK`4ty0auYwi``&!>u*lZI!&*hxLVi_ohQ<)yY)zjmbs3)-qj` z)>Y$W&Sl!AD-VNr&#h6J>2h5jfel4`-xh(>>~%xgW_ofod-Ud%_jvX}yt?(J+gcs) z_gcHC>#l5STn49*>uc(3)smgE8Qj^!k!wfHYN+@*v}mFT8#ScpJtsV_>l$)euUy?d z1shc8tL!vAkGJZKuZMQ%4LDO~XYgnFYhVbgJ&qT1-O3NwH)iVV@>+pB&I$K)`tnWr z&}r9+Uz@(Dl7C}oC41Sm;mYB(?6hosYQpTWY-ic7M6+<20?5CsB@1^uhhh95Tec1E zP0{TtT_diniA8lJNsiWR9tpRsQ_w#ycgk+m9g{1IRStJrXRZCWolCF#z~j>|iZ!oG zucL8_Zead?rz%EL!$)XHFt7mxu>bZ#IwsJIRX?a$DlD;~+)(2XJfD zvB6_clv^`y)t=%q?4T$>TPxb_l)(#;fYm{5*iN4@CM@`|FA{I80rt#|GP5-N^NW1G z_7Z8h=QX?o7|-K6$|*VJ$9|L)AncVhQW;I}9``PNg2#|LpDR6ZU>`XNb++m6Kz&;@mH3CDO5n_Tg zF43d0&V(ioL-rBdiFAC;p0YZBU9TnZ{HIs)

5`J*a7C^2y{;Oj(1;U_~+;<>u2 zw(+kVnjhCxEn;G--;l`DkPl?P&-}Qrz9?^PrHeaM3@%k(-a|iC9wh7bM8m7qd;mIW z7}KFfIL(7{n3UL9;%4xQJ6ru@o3CWZ8!k52=3ot({z68(2>Ikuv|PE66Brg2+V3dY z$i>hkdk%OcUu#M@CgOTSV~N`*T@kQE5wP%x#@eb@m!Axg8S1_uYZ43VC_~4@?VMOT z$b;G0csy+skLUM@%z3LQbo>@kJhgnd28{5DCjsMar;>JfrF$hip?>lYBQz2!3SGj^ z=uqgrP9`F+0lnUqAegls@6>XJ%HA6ov~U(~_Y-b+KQLp|3fYM3(a@o{6ID8%>!XMX5(QEQULsz&}}FdbUD}r8=B9`A)oCP|o?&8dK7> z2JU;r{2b@2S<`VgR%VZ((*Vx$O_Fs&c-;X@HB)b?!Sgh`fz(%OIZtxFrM~7IajbHz z^HVkJ%LmfPNov#(^UI`zZ&8Fb=@QyHjsvl&S^#pz6~QA(Ye!I0^SmQ<82Cb zVhS|)q1)<+ZUo$1)}a7No-7e#VK4(9zAu}GARNs|zIat=`^SY3>82d|4jqt!;;Zou z*+c4yj|W+e5b_a=cSzXESDifGj+cdum%Tkt2*TQZ#cR%SO=1r}Y-Hqf>+DxqE4_{v z5Rt7dBc!Y%5QW3&82RpOx~qJg{9O{2h(Wx^e&V=AW@;F{CDQJK~H9sq~j?>;-=KC8{pfHJq=-M;R! z=PvwC$wP12C%87@Kq4@MOb_uBKpLz321&79>ueCq{qf;7$x`+jz2g8qoghX(29qN# zf<<)%-{-R)>S5mT-I@-l#HX-NiB4o5Pn09iXMLzOQ;#T!%$mxXK8CwU09$fZEMh7s z+1&a9xe;he@?L$1fG_;JmYW~E1!3!qO7{`}-?>Bi00Tq(`7%p8dlw5M zySq0rYiNY#ffC01Q-a4RbV{f>xRe`Vlj$Ve${W2y2ynJ4c8sf zw&|RC4&9jvbc!cl^*TcG7Cq6QWFr^n8yySILaR^ZH`sg}c9A>kMT zGmCRuTg>XOGOqWJ&C1anD~!>XILQV$!K~BPXJ5S09+dG0aB(%;(1 zdHKu(ORcFG8_t923x@#8S;%Tk5_7rc=H!)XelyJ~i7G^Cp4=>gQ6)L4w5`OqtER#k z0?~MwK_}WV2i~DF|C?*n-xToSOB`HThKc=w3jKj`{*Kx8d z#ct&d=;+CTQ{Mn7fGpPvz?dQ2Q1dOY=l{q6W4-! zQ~_a{YssM;Pkl3!Dzl#6d>v>>AVHNI(|*;qCpdkmIZ)wQ%HS@bp$uhSx5YYln(ZtJ z=8s=o=GwE<+p{^0?$4WfwuitY{F(9n1U`a3;-O5{%8XTy8-9#aUE+(Y-uCdyo#J^6 zIY%yV?;EGdD2MhDbQq_s@ltG;7ua2GjV2=d7ouuBoMJqO!5^K%F!BAT*KbK@!=?Dd zfe+JP&3X$i4Yco~iB33N$Q;b9d}e~WoSBR+Mws2C-0zfYY)=Qiz~Fi1Gn{xTHw`MK z9P*RM_6v4^su&LSw{vJTzi?OgGv%c*tw5%C;a@gHtfT)h#d-@&m5D>JLroGVr)Jl=xNIZxW>W@UM3{sXPuVc;QzexA~*@Wbjgrs)@ETQA3U|E}YO8q%D*x z8iOdZ(v;n=<2m~2W?z1K!>J00;HR}Z|2}{%*u6-?IvY4#NBQ>gu)N?4QlDp-Vi3df zuFpnAkGlM?cdTRb?R_DvlJPHZSI)K*)SFb08dD|tRJ5>npSLN)o@wN>;ICV3S zu<6-%xwW^dkG2QDSCPJuoJ{zRSRAP_1Z`hKCM*!GK}`Sh1%j^(3K%SyJ}iFmtEOO7 zQZSk@v$s)}L5|Q*-_6tuqeG^Mky3taD1?XV#L!7;Xp%9U5&(PegOZ{*l_F+8j`>7P z2nAfY(si}hnK}9CGLP}_EiS`3*54_yN^~=@3785oAAy0v1HbFo8d=!U(}AvupCqjw zF(SMuLN(Hn%4vDTm_J@D^d7!CU^P7!_=1I&qmvKgP0vi8NZuwT(H0@Iq&VW)O=ViN zF|=q-D6^~kyp;|>g!uno;oScX)PV?+^O z(oAEj7e85>PcfjheF>y^2~XR|;CX3CnvBHA1{GCn~ct*G3DTu5Xbih6w# zqbshSzxdj_|NIM9npDz&K>*x3nenwYxFieC@EIJjv0aq2X`S2V-U!a(MyjoHP6Dl8 z3pAeIG5Hk=uKSP7T@rs<9KE`P1|382Gh4bkZOd05yVV?-Z=C~YAa+QhTCz8tKRTat z$3>SRzZzZRIrhC^a}hp6NL@)$FV%VVq?%i1uVn-VaN`@U z5ABjW5Hb^INCpk_UN4E7T6%+mhF)UrzSem?)-~Z;S$$D2L2VfaYo2(v<@P`2omWoSy;xN!~xhdPn5ePttJS3@9Q+sJ39D zmg{Ms^Q@*Z=~3*jzP9*uM{I0U*UF^^S!LwyNq@g2korVn)|!a_c^fZaV9iT@f~k%h zERq&S*vo;Vo4w*#WFOBRLMF1o3}um_-fNE8Fls9{Ee7vKu-suL@~n8dYraXRX|J*| z8#65Pd4%;x1=#f2Hps3gP|Rw9^%9wVd17#9Rj=MK1op8IC$S7>m8}TfE_Zt*%`GZ_ zX>oAY>~aWu+q~Pw_czwe1zc4^AbE9x#S0n`tA>!ZmA#Rby^f-bjgg%eh`_CiT{6uK zC|8l+$EY0Fy&%k7Q#DgzJeo-3+X8hCtRyc^El|~A71eW}0Rk{~x4NC%4-Sq|z{`5o zLVZo%FM7+Xvdyz}qI|W>MCveIoGVv)66B4$CRLfI{ms!0M2$_T!As^`7#5xo| zTH2=>Z)0b1<$XlLl+#|}SYjHkpiG5Z?ga$3#Jo@$2m4rNOPZ(^Moz#KJXhBN4ILL0 zh%l3Z5~d(&Q#Z>P)yN$x1sTvCDU?JS>vjN}DqH_Dq5t?E%lY6(09pC<( znc;r2$gH5r?Zvm#Jp0MBaBx;0nmizPz#pMQpaXsP7);!7T=m<#*0gY-)B*fL0e=1S z?=8^FU|@#U26DF6Hg@!SHZ~yVKJ5L2MIR0h)Dpet!%8_0Qf0*0x6fsry$f zl*UicU|?;}euncO4R66OfJ&V$=*? zZl&+F$TfU``1$Ru;asIe&5m0>$m0q zr1poMA103b&MMw_o&QT3d8p^%q`cQ7UI-Q6vC7%aG3aCdii*Wfn6B@kSK4K8<*CvVmLehd_K zcFkUUb?;t%x*KIVsP`WrARyo%4nMD{!-^=F27v#n2Y=AOA9E)&Wf!N7mGi5 zLlTVS23bA~_sSl5XHXeL1=pa`357%V2kz)epSPG^hf&O*tz`mh);@2WP4nJ)Dz!D& z$>YM-PHTV8hs`|&<_ThYWS@)HA(=6Ioj>M9bf_h&G$u~EpTQ9Lh&IJDzTB`uE$7qm&ekKb72$=k{p0Oa&*S(|nSRuj8 z8~*Wv?)|M-JkvIji;<53#W->Cx8Upj=I(CP7tpGVbj-&|XcLt|2E%#&zJ0>}b}0c6+65HE+P>zSGYM!an_0#cF)#zht=T57!%N*`Rw9fZtnxEy3W z)P!Ir5*?`6SP>`b>TeEORcHxg9ONGYSG#}4-!C6h(oLO(T%m;2N=KUal|J_=Sxw3o zE%&#jJ%^WH&~V41Ii#`7d?mWOh~Pku3=W1xUQiS+Y4!!`BB-Q)%uF~b$!%ZPH)dff zcJWy>Lg0%%QO}TjDNcV?&@WvrccYW@rGUnx72?Ttu~F07U;@Ko*Fo^5Rl})SnV6)L^-uSuBTYHidjt!M0y`>_?_Ju6b7Z>)5Jl4x-^4?+6fe*ozFwnI`YJ{f zu_2INP|=va3qAX`(L8aH{mg4a529Hep!q0Ba5X%lJTQtTM2)$^;uN6C4(0W*Gkmmr zP#Whi?0fa==Cby>oqNwQ&pIjD`(=Uq?fIhk^3F-P$M3P4n7QFztJeo~94EY0WJuT4 z<9&Pl(3raA|FSfr#Cbs_^}^64CCU)Zf4|%|A*!8c`ELE-An_17oCbpiq6lU=A>dsX zyM%g}oe41bj@KN4=mOwV_E`|_3qu6V7k)UbZ6>p(;WiK6*2MOPiHO1kKNn&vXHRs# z`KhyN-Zo4n(q9pZ#W=Wq+z^habrH7N1c5Xc zBi6R~?IZM($wQ<%G`@5}A&tY$P^3c7C#LLBx^Hr9Kgc}M%yi5%W4a+iFd3~dpmk0a zSVPeyMuZY|G2}PMWJsRB7U+9!QETTo>1_oe6`{uel9_bZd&llBtayZGl6^&mntZzY zOPqkH`b$ypEy~CTqC&`#k?u@BflL;`BRxp-WCCrgOg-rsU=fK4q=l;Lk~N`RFh&FH zmm!z?Q^h5WnGX_VJ6;*Tqk-{9eYB+t#omh~^yNtx<_pI%rx9q`GADjtlj>w2MM-Ma zh_gN80w#a*k8Qh7d@>bobO3~#`u5$ReZcK-LnN;^q*zfb*RDz?sL1r#gR!gLgqOMb zv13(z>MX3da@~)R6UFR)r8*7>NDO;IP2qI-AoYZ+_-&$MzoFtmSd-Js`=KGFy~={g zEQUhr$kj07VmHdp|JD*dLEenTtc8aOsNZawl=IvNfLNc;q zG%G4wJ>@_)P81FA*VT_!WX!45WRf^3D)t%^XjXBC3u;VM=zAhUk}nYm6=7sI!#by< z(Sr$sZ%8i}VIi#^o>&YT`G+>(uMqH63PwStT zY6OLen>s3Eh*nu`d@96hH7&RG@A!3mTWZB?xAFZ8&rr`Ko{sy^75RwUBk#aOl&F9k z5f&bA^X=1^a^+EZ zGHCH?Iu?-uj%`81RdVX7>4%XP^M`{H+;Ic44<^Mxg+F~ z0zW?|;lZ0AIVm&fW8JARO5bkSU(=o)sOE7hI^~dpsIbI{!|yof*eV;>N5cjeb#8yo z^xUXadM)?l=Civaq@T2^<%6xuP#sjQ&ePq-oN~o{j{GjgOPkjHWDiiOT9%r*5xC$8 zL~yU2r)#1&Y~FD2cC6m?HOH5tUA9RPES)dMqLY}R=fUF7H>$*`P%K|`tC-RqwGql# z!`JM&H%Q~&Ykpz=zYCvX5-Nk-$TW_WGTJ5?NSA<$|=CP zl_&xi#rMha2}rRYZ%;P--?WoRD)?#d8n?Jl96)i*=eJKAty)?dF4Wuwk0s0Bt5q8c z*2B9Wt-QQ7&SYulAM>Uj$8%=7D`Uo5jh?T6gRE3|fAc%jZ%w@TdmKZ6W-42L`M(NIal7d4 z4SQ&gpOP4L)%C_?wHuJA`5zqU`&Grh=4f~hk7`-uFacM9dsDq>XA;kbH5Lu2HohIg zk*3!|=yq6+EW(cm{Jv8s`(nPCI|cW7Q9jwnri;ACqHZ*zF9(K(6U~peh&45btyDa( z!(tbYW4pbbr2b{Ut2!pN)vr3V-@cVT@w?A6Tb54_nRNT#Gn@)P)!(mTZ+^QV>&0uTx04;V5Lym~` zN{H|e+%>|URn+5kYiwC9NC!94{9cE5*ICSe!9UOVpiBcTO``zBH?;2tGy2I z_u0BykbXBIZLt%dw2nRwJ+z-a_Vc!~StG&|W4XM}pto2A$N8!5=KtvOF4-@Iy>9e} ztMq3f5lsK_oZ08zj+1q%r@c{VBM9KqU>$+&VlMIKtCoth;vr8vhioPm&NmA@B33<_ z!}J)5TM#t)QCPYg9W?klsW{uSnvtsbLf(n)eL2&cIy|bQLsDp@*m5^DNC|Rc&~Wi( z20nm1jh3fiE2N9}^$e7{wo+xMHCCSdUr8%ol!~Q=Ce;}^ye~)dlNwL>(|xoLfUm!` zys<)GcQocx?q2e`99;8t+Z;o-)!S@BF4Vt71e3&HM55I!DjfZu9JJsEai2-e`NRd= z!4Ag-ldKk0Ntv`r-P6c#K7UQ|zk%Y?(0GAT?JZj~!t;NGHK^E9D66pdV4e_|z`R`Q zU5*81Kl-n|)y#_0{=Pmw+)C~eOfp^bQ6kdih=T;}av%6TuLaFG^&K#0&YVekCKd7{ zAm|Fb`g|@VInU7ZpYyum`8rdZIrAc=^^ z-k5s56G>SVd~7{BeCz5VL($_3TRE(|W6R$fbwY+U#4#s&opux25cwFZmmWL8&41N5 z_IZ0}_#!W0DX694riYc=BXD1Ut4W5cwVc6-G3Cf16Y80E+c;C#z?9DS~IklGQ-Gi z9Gf^C%`e)(Qm;nkd#;_6$wMANTZ~7`c-=)4e@qS1NB*^*X!l4V#;R8Cs zIJbrCkzW{f7#o_pyOS`*ehs1VqQg&I*iiEcOzy{y>e#~4?yhV89Cn`k)`w`ngyoE( z`)8RrMO8c+`aoX0aKf5gwdrmHDTh0V zgx{77hk(LECPt^@qVCT?DTc(3Zqm1_OU2W4+bgF#`!^eEda5LD;785zCR#1dY2eZ@ zmjwYx&VDF^?es!7mT1l3&1}MBypZ^%L2WksvJEK&3xVp4)I?w#9x;2_te!+$gnWNq zj>lrvq zZ#lF6GXkSS))dncyMP$Kyp7-L*G)VP=`GdLk*Y7nIbG>#XOYc9y|uk%73Ldz>&Xom zjkUx!74Oo&Z(ZBwrY^=WOtFjy=pkPc*jl+Qx93PWgMnSUOCD8ZaMU9!*o$F)v{<1% z94Nwp)t62E9!-x~>M<5P1!ei58Q)Q!+@7wKu^dVz`5!k5r_rqSu6URPU~VFip?m3X z2fea7C@cnCs8%F@oxl=A9XCEM2MBTL58RQzW!HFQM_@~m{n=2b%~7GWqJ7=p(Eg5m zrIOC8*6+h{sh=Q{t+6F+1|IE%VgP5uNoT$~s19e6a@WteQJI3w)qc%ozWvM!Z$s51 zFZ~}o?ANT8`>Cvr`Dq844@ZHVu(uA)m=VvTIIE!zU8!I(4`n_v~DR#rE-B4Oh5nIDQ56pj*V4pnz;0!lgC(j&g#8vEUyqu)w_N-96C6>O0 zN4hZoICapPe_OoXdb{osJoZ0U9OqXtvmUneT%PESoI3C9FneL$DjAkqJtOSM7Hj>> zVu`lL{>pU*H*g-30!$k98xP2+n=0)%Jt zSk-j(=EYqaQ^{ub+mjtlt}{rh(kv_)SqiLB*B-?hM2 zebx{qNbS&>f2oY7K%!EA zy6jPMe@)D}Oxv|^?dJiYuA=Ai2CV_s;8-M;{Ew$q?AIK0M$qfvwz2L8R07(2W_0%D zMq35eBA_}_PegM60Tcp_-Y@n>EBygj8XB0a1glosXmqm*zoF{aW7oQYqoGl`>R8-T zZ(BX3+vj|1cpRpos`P7$WiucOS>78c@5V|FaLk3u)Ng0LF|B>)MAo^HYf_eWI_5?e32` zB2 zyb-&P0?jx2^x!27|9vwIO5^A!xm$}oN;TFQkF@gbJKx`*wXl2r=YxZmtAT1&8CeEm z*TYjw9re0<$9#{F8{f*QDrhWU5VOfY8lHM+xb9_|X3~FLvQn+ysj%I*e^S%nETG}; zG}V-?&vDn);ZB?|Wt8FC?Rn#8tZ*vh4nY1%w@@9hAapBUgAm$Omph~JosnPt3^8BF zb#lI|YAYwVX2@~$cuVUIxPAprZw6MkT$xu!ef&osRS6iPh)9$LRdm+S3LD5Ip_7Xp z`pUp%73T~uhW&uSHu`;r&lUxAc5C%!Yw6xK3f;2y;VS_ei99rOaO#1qbNzJz>p@O=+SA#Igzp})ezM>YENFOwye6FR@4PfR78nK77wF7*Du<~K>ZPpwRv?hxt5GZCLN^*plZ>oFSH|D~C7Wz%@@*N#N;7^W z+B>CUpK;C1ab!2`X#k$+nEH#ISP}vqeVKR?+s!_1(s&P&tOcEAG`GS<5`Y*bPHP5* zezte>y!ZOxEs7%}{~4z-rX-vD3{JDB{4zT1$0y&9kDRdI`Ib3NUORd5SpRv$DXZKB%g;t?$+-$u%K}@iuQMl zk1!pe9D!H-V~ChoOm!udtXzJ$OMAkFdG&{_%a~e%Y7|1P!d{j76hMD5@8?1Mg zpPo8}9%omINVR>NtXQ=Gdfguu%fDio9KVQgwz$^&vAFdpsFz0QlRN`(`}=0&O9H{y za{JTux`&t^a3IT0Yt4C5l>c-3F5*&i70dKHmxyz)GUk&h{Eb?n#A0eIsrg{^;svXT zQEIgcQWew9JXYtWncFscqedrGpcw`@iOAb|q!x<%Q=2Oeq!17KC=|PlzxXeFtxrl>gR#N+mJGWo!l^{S}xIbYPr9iDj!3zZ7d%)mk0ij)oe&?~YCEBg=eu zlg?@$U#0G57kA@}oXB)6#2OIjoRsr>v z%!1WacY`O5;?pYmrxTG{c~y`@O0C9LwNC#mjskZ|42w?h$k7+;YGQFUU|X5FL*d9qu+V=P1=K&AjDhqFjU4bI9Xse8kmC| z(<~%pF|2 zJNXX_v8sujNOyFg4Zm(%>gnrG9JSY}D~AjxCwdPh!B0;1W7Z-THUzkgGsz%zt6 zJzv9f_n@14g5i(cszMyudso2XqiCh4wRC9%-uMoe63fQpvoxYbqWSN#LmeH*S;P~z zGakjE4Hzy=Z!u8tv}FuLP-MUaY9G`$)UIK7!)s$A}*WdGP%bweWC z(+`bj!*Z=rPD zs+#H`Hlfo{=&04MSjCb*y(53@o+!T%>8O+ehX@9jwI=5+fV%EFt((Q6qf zukC*F{``j#3T$2%&e$zQLW#u1-Ko6@8qCCl3-HKFo@p+ti$>G)IFUEp<1hJL?r3Dl z`3X*qB!WZZu7i9nt2T@k$sYEyP|+*vcF{Sfg-D6BjTAG5sv#7C$f8sGh26t+>07gX8y{T^kuxVdsx!G(+d0u-8lCQ~<~~YG*u5sbi%E4l_E*YKAZfquaWW zF8-2Nzyu}jtxXB&I4_S5n`E*j9C}&I-^QD}kbZxkTx>>~{vNf6{#~j?%kh(o6!6Fy zZFI6B+bbT<)A0e%##@^0Ukqv?5o6cWTnSY$x zT`6m9w7<6YY%N&rm-FDs9z%6X(afH+PbK|$X^A_LcWEC!&+^QXKmgY9tn&5Q@(0BO zi)9BLLJutZ^JdCDsd+Cn;^TMJS+GCz6-83b+XLK+a-Na0gPr-48Iod$j}<)M8BKc0 zEBc{K5b>Z6i2e1ZF4l{9vuy*UX?DVxEUQ3!w-|T5Z*nGXY^4rU5XT*I{BBPy$2WCU z2X*N${*ARaiA~*D{tM=Q_01|v*4!*P?vv~0-LME9`taXfZ>xU7 zHI2;erxC12@BC@Kt+rr7ZxN%v?wIKg3GAtHYj)qe6~ZCVu<5lUPH_~vO7>IFct3$r zCQSU}s)J|oTc=OJe8bPBUyzWp@1&CR?Uq>@&S4>=_CuI@$o`^9ovrPrwzpo1J& zgS*I?{tEzipq`Sqs4%bL7Yv{57nw4x&H7n)wUGk=K~HcP13VOS#MxrQ5$Fryyvo1Z zPB}WOvYvK-BqN6(`#LifS424#X5fY-*T>3$f=;Iv4YQ;mUIrE`Ax`$Bes?VXqP;}W zHcMc@5h*`(G9`DNny5BcoFGtLfnAH5DOJ8G!aSdZubzY&z?Q~AWL}#0Uma#4#-y|j z@|iVl`ZEVx_RqSz4z{OWK=-6lF~XajpgB;mszOq|*iQ$Uzs=yFsfK2P&uPI1r?vWd zIv1N*l9%NdyA7>SLJIi3?Ot8iwgZa{1}LGRjc%%(9mrY+(`F37PIXr57?1QDcxN)f z(ZV1YA*Ty|`tOWbqsGcU7%&!m_&Rf0!{zmB#^WsxaiW>kZb{jrx>16-T(m8oY~=~a z*}mkwi$lD!Uu`2VuCf&u@Q^`g;-|J>ZUeqE#~8$L^9I*+l))#89Y*piWp)*^q~$aM zWmGkK*&7`!`Pt?=5f5qg=6}Vv{YwTFghJbP62mK9V{0shTj}kjdkJLou7=D_6Kge^ zbq@?HOsYCMsu+fH|s+$U^YjGDVD8%4`koE3!2=I$SI|) zMzEnStNN2h&Q_RNQwv3S@EuqOY2-3N+OtI^Mq~b9z;C@{+%FXPB~^XV+2Z$OtJ>0N ze5z`)vgrPsz7b0_K)D|O9Ii^6dO(Gx0J@ihu$lgc*HuI^+k)Ij%;Wwqf&xc*C?PB# z)KjwGoy=m#8UrxY@e*Mf(qLH={f^~wJ`2Li;$sf{&+e?FePFvIxlhl*m}Run06|H; zB>Ya)#Wg%6dWxkW+TsSg%{E0&uSU?%y8;Cpz~U}2O+2xoP58b|O)dkSN}0_NifvcC z0$#FdJGCT3@j!Dmcl#)ox+sIEDC5r^t0)gbP0M*uCz?@bBV!1&FhRQ~ySo{pwo#Pk z{73yhp%~|-jQRqY`bira6AhbpHd?>deDx?R!t#p~@a>2h~q7G4{#`V(ubsUW{3sbQj8V$w5s?g4fK=%xd4N4P(5_CpoVR>)tf-rRH8jtNkB z$;ueo12B(qp-QX-@$SqlMwKOrk|w z_m{GX@xMTwQmVoF9lp)sUD*hW62sBSIc^73O*R@RX~d~^0Epd~v~icSXg~6$IPltJ z&1cJwLH$PxjGx=+#iw%$;=`=M+}pzP;MTKO*Qs#ZC0$?gk5PzZ#0%x|!s`+DDBujo z5P!?Y^TdogSB+5)$AzEimj^iJBd;rB&oJ^|AMl+SjkFz<_4=$?s`8lFj;7c;eG@DF zyXbHI_ayqK$GXh=G?@J=v(>$`wnojkrVk)|T;K!!e8pO_k5(1IVmIF6sU=58d*n(l zYCQwcwJ6YQt0~;lsQdoT+r_;cQH5BoYStT*j2L%rpqpdpI=@#1RZu|i`P)KNk3slF z8`{r+@p(>Cf!lR=GydpwX-X?__2nHN#U#8%!J~W50l)dHEe?jjKLfmspb4B)1Ri7+ zBHywnecqUcSj76#nQJuJ^UbcEIjU*7=|tRi8syZ>xo6y<%uPD6h4Nr{{6XeLlhw@^ z)`m#!>#QrL4G|d2%VZNuB}O}zh2bJ*cq_@uZB7QamteHnw&2+5r@!^VEOQ}G!Q957 zd0zE4g2q|oY`SOv#DRpEZ9g0s91lr)`O8*{-o%X){R#Wq}U^9bCU+sHPDe z26l4{dX>Bc?^mvbgnMIdn*0j57phw$?8^CB^?H0>SRS@6_lguuGCuAWlV&RZaxfN0 zyqoWudYGE$Hc$_S{7GzEbKL}KHtH#1{UA>T=*B{2qbeHJ$#}G}v@4*ZV$VUEAi_nv z;`o!xSog6C#PCOyvJ&|k*n<}QP+JYyur6|C3#*v@moNi>al<0Opkb3+*P9y7SYjG< zfNn=prC^3AQbBxA;CeKz_+e$lIuh7*6!$Dwv%42ewVY0}j~tyH>Qp0} zCZq-B^}LG>gU+1V--d1_5<3#BK9I@nil)HO$u0HGe`c=J*BWAgXY6jzufQ7?_#j^* zGT`-%w_bs5kICHTpPVVhn%Jz%FvJ`kmhkD%_<3E%x)mLLc3;m8o@;}n_p(920JxAJ zzWWG%#gv7)QL&GEvn1Da5^M+!YC}{{se$y2SolQIqI?^H+26*-L7S!}QNnGDo(V&MDT1-I~5DgbtE?o?F#IowVk!m_L`GvWgO`vg>io{F?sUtvC&Q zRBS9LwzX>=)PX4v3~=p(Y%}SuTP+}@cSlTPMgRQs z9DlF~?4KVN=02{2++@BURx#eGbOAEwSwnAchAwnVCBC zOq3SDg$2LIL)6uA0=t=4X}~NFYTWv%#=$~kG<^Sug^hrbEVz=saO`t+mc4f)!Cw*n zxPkIf$yHj8%PgZxZb(G&-KwkEd1yqAGieMwB-VdA+LyM8`)N4yeOX$p&{kT>H+C-EjK!SD-@w-RqV|9@9;(so_YLWqbQ5d@t3JIB8-bEie04!wU3p*tYofrI>5;SG z!Y90$pf8C3rLxvttY4zI;hk8CUV{7tH$OnPLscJb15d+9w0`?#9PPdpu_~YzFqRnS zS5p-*vJ`}HV>y(c)TnRhyLdC9UV*6vzz7v*hMEBkKLPb?jLB7)uG)|Wy=ZQlAZ$qC z%KlLcgAY~qB@qH^VNQu)?DOaDjYPlo&eaN%-Vfu{5r)pC_~BtOxH~2t$kG{5Y&0dG z@_4D(Xu!MO`M~U%+-bHeoO2aC&puLOCok@)$GE1oOp6%~D!wfBNWWf=nFv?c^gcAx zwG=Io#=J`g_je*%JzQdV1F*`bGsn{E5~EkJQ5V|x!sAO+LibRzU~E48sXDu@;^Gfy ziWjEE`mNef0d|K(4D?veGMqt)q(7vvPoL0fp_#!ACLWeGb{PyOa+$vz%Y1{)CFHI2 z!e87XNO00IfZ@y+6nMA{_P}BJNe`FqhR~5D-XWxv7<|;u)7{-r(O*hOK<{i@vG2$pk6np$eXlHi33B_Z|ZLT z2=Ay$(DFB^-ckKE01Mff2hCDd_k=kHHfrEU;`dT{4L3;J(%jioH%$b)niUL|7Q~fW z`-dUC{aNd9^FiBi|7sMCtlQz-@PuGvH_gaDXdOR4wI9oI()W=Z9BH6LhH~npHr-j% z)Du~GsW^o;F*sWJV`Xl5#`Vrp(=2ZBvOCnmI%6&ji-ai-DS#EhiOx}!kK;^5vx7XC zK*1|s0xXy8bu=4E+zafU(WTDg0}MHhfR{MK*WJ0534yVK|2YHEV8NF}ZSXzg)L&N{ zKkM18yel$5mSE)bX(xjABJzE(j{31fhIpv;$IQr_ zn~m<%I)#&w5N$0j(Eh&I$hXrDk=gfj;2x<#t4BxX5j+oYD2W*HtbO7*SrA|nhjv5r z@x8*oSZ5UjsUQHwcgY8I^8ZTa?<4?tS`&FNkrU)wDhV>u^hTd(K9z(;&D1fAuf7_U zZwp&sWc` zscPk;n!BkcRY0yy%Ej}f!Pb9RfEHC!98v`n_xnLx_P1nqo}@ZZ!&UDt_mx~b*~w`M zU~+Gm(#cj!VW(RuA#<)T6m6Q`&1Z{>rBs0E0faq4B zMBO+h!;AWk;h(nHjY2TwKsK|q{cyWUtl=bl7TT&9wak1YvjU0`rYp^4IiLc(T?8`? zzKd~I9?K(5RV)=UbK&8;#l>?GQYg#Uiwr7IDF4Oy9)U|AWRtnhdBUNJsr}=6Fs5Hk07}$^ zCF|&r8rh0Rn;C?MK`q7&YN@Oo?krgSt`3X@$Z=iPO|g2bGx}|u&Lv^(X;QH7ET=RdPKut5Byt)9Xcb*lH*WS66{t3OLUk;Of&Hp>A%)!@)Xm zk%L-q?8Ge>?NPj`YnUQ+&V+J2%?`4wdoeJqs6DjMy_vr?F^1|CJN!#*H=Nv1e(G2n zWlBSbE%q9Nre`9r^YML6bYt-5%5u=+zc{(=>5l~3A<&K~eQ^|cr0vZ_=~0=|M{Y=B z2PK_G6=@4oFsQ!TVJI}kuUvG`LRp^)_=uH!7d#RtabYNdNWgrFApE1)!ntPsiqSy5 zW2gmgu7{x^6aP|SCzuJE1!OZGu58qRRB%PFV3Qky8O5`$_6{wzJd=f3HY!A9L|kk^Cj}#S&ZpF)IHeJXSMpYJ&6kmuC+)pfJ(x-8#O8anP_SLO`&eEDG=S-6 zES@>{(WN5eJCp9(@f1I@sQofND`p@Lu>AA1_K`l89?18sX%oQ-MVUU8)U-pNaWzV# zCxG-Er3driX4&nG2WYm^o}dQgfz}u^7S%8~5j(9pDXt=jw8L?-)Co{JXi}8uZk+U0 zapI^FI-McSIn5M8f{ow{HkoK~y!cV=(4iQT6?+L&*g7Dt2n#+1bKj9bg<5L}TN?m! zOu_JbB>c-VO9BNTcPz5JH*??V?f7uD-<;hO_vdyoL_1L#13$EZ)Amz7Rwdxa{F?CP zC-?54hjo=Dv=JFgS9+B1?#hEMu*}e7XP>||^`CMkNUggBU$F+|`hzLbOUv|B{fzIX-1tg{aBlM_ogm_q4b0j4=<@P1i=AXIQekS z{rAfpL^S~LqoISZJl&w>ho=sRlX8uitNu6=Tc`E#?x#@YJG$&e(d4{WZ|aulj{e#( z5!5UM8PYNa-vgV{(D}r4B(;^CUk z0v;0jNb(ViijU|85elJ`g9|XvG-!^i#0NUl>4L_=u^iHccS7+>Y%+*vJ zIgB4~iCDb>oq`jc;#0zuzoF(+fYCxFQ5@JDLYLbXJf)AeB@fGAFqqqHucq%kD2~YZ zY=kLe{L3^RSe3syeYHYL;m+rtY3|Bjx6?V#JWJ8mV7{EKKFx9Asm^y_)8#}5n(@hv z=ge29D!ERS1t&hmZD&yYc7@Y?X~TKRlCU`_wZtx0h~wu8j!bm|Gc=s&16uI$ z2h-?D2+{H%?G=}TQ=g7f2iCJ2S-vx*42gazCs>B;#$N~{{a5$9SH*=AeSn!9y-;Nl z5uNd+#U1Z*D!&3eMU~xIG=79#J0M`o-?-p|aSZ#6{ikM<3Bgxv&eysu;QoGB6tpOj z#|J56O4%ZvO$s-rQ)bc*)hfn=_-Ar!LkMR2in?E?q%il)L#*8#bNhMR-(%LU2DHiz z>dMjF0w6NvKjwK(`PFqownwxyt0^o!apj-xf8mF^l7O^fTCfoA)+iEAI09F@pUcZb zM>HO$(hRy4PJ49jH+&O(U_UKRgq3NPqH*>>f)E_^C^XaRXRlO&*QmbOu&QO#a<<;i z8M*;dy-=jb|Jq4CP$PMUuM~?X&xMsM6I2%O(tZ2Y71b*$w)=nhmTyh_owpce+bHgt zq;~qzdu+78O5Nc_OP7iwO@3ggnx{53{$p)k^f{a4&HYwwPqRI*Y+KE4MGc2n)~&7j z3>LV^Op@l4< zjSWM`M+J?uv3zzmAg3vDU1m8S;=)ukt|!G#pEfB}TaJGX)hGOy%>HK8*Jp`{;(xOa z>P6lY*cw;Jd|Dq=Jb5l#(`$90Yzn#t(d{d!6*}1+D=b}9=hAhcgdJuct>%wX7dU~B zec^L+=K6)u)Num~jkt9VO}8}9?nG6YHCsulHbp)yeBmo_P494n(O#sX7OWD)VQB<^ zCer|2gX`-~&+PI-5w3ss{;t5X(ye_EJeYZY-`Y4l_rtmw`N;+pT2JNxJIAHQp@eD$ ziwVh%yF}i`v+Yr7Ro-HnDZSUe(Q)s__FW)ZmU<{ zyDbFm?rMq76HXgG>8gK4#}WduD(J*;&V@PVP!LU(@f#vi~?jTO-p?tOXg*G{w$A(TNuAZZpZw11=l=KTrSG zm_~>Ov!N5)*cawz*v}V22F`zTaQ_}R)!KJ?GqwSl7yw(m&J;nbJB+_|%YPV5B^}Xa zH1QOT%eT%NUq;yDMcbjvTTYDVbwR7kl!~P>d}YB?PYHmhvSYVm&3+&5OnWnq%5Mph zBs@FcELtFw|93(8e39g_M}yq(^zpAX|tt6!11KHt(dg6On}QR;P&s7E&BZ5*Gn&S9<{nxg*PdRSoaPN0F8DN2)?Ud4TEhl~jfwU1i*}~Ykh3_%&h*lry4aDTjqORJE5O)&C zK>YUK^S=$tWp=_r`;f#m#)Y{!D}4fg6j(3X%nVt-u`STvantbzR=F*tXZMe*FZXF# z8pvdL7Lo6~n6soM!EW($_#Zx0lDrrkpS~Mg+7<@#Icx58w{u{T7&A4ex z6LJI1-^vBtG&1%Ld`M*Q{~H-`K!V3oB+r+ZQo6`=&h0v$lXNSv_Mp_6A;uN~R)+W5 z3cZ&2?c6lpaqsm5)@1|?`^EV%8stlO@;_2H$b-G$i*t%iJcN84_yr#S&%dS!8*)iM zVt$h+qeusP05XM|6dQ}+b;X_Zn08u81z?ds^DsuCDrpi2P4wHpNr;;R+;6m5;%w=$ zIonEN-%&yNX};xr=~s7!BcHQR<#H|3orK43Kq)maWcucOyc`?iZQ!N@95X78V39#B zqi1u?Z;c)c2O;mI1{d7%KG%4LKeK0f2fFbAM>1+78^$$9BAq#$?l*>%Hu5D^gem+N zgcMPK8$+&U7}g<)edOQ@kFtO18brbf`=#WI#~3J9WW$A6P`=SliC5pb^6ovL9_vI2 zP?*UDY1GP#W+Mkjf+r@{k`+$$#{zrTwlW(jW!jy;w3|QGbT}l$34Qd1|5?c7H;{@Z zbo_zGZNUXWUdfp)#|s6q&8ZPkiP^m%LoPTEe)_*jEnXNQ1nPdNlET6zr_SynnJqjN zf1qWvjYv>`;F1Y~+?Uu)w0EK#@fxU*CVGFxWk{Qg0Jb7OwrTydQ+=D zY@BU(Pc>!4aln>#>o|5x^~Tzcg2%?=p19>>5B&B@EjSg@1x`_RrQok%z@O>f7d-~K zRJL->mKPkm)oML*&wV!nInCF%hsm}-7>z1?$ewF zs((F85dqk0Z?x6$BlodT{M^w~Skj`~w18`xuc3y5(epzs%!e*I*Dhd-9v zPBP+%RwQp3LA9eHrAnbVpt=^xzLm?LQ&jnP&0m3YBoKQIP8=fvZ|9Mjzb-QMqngb7 zX)vlr!M7pQo&{Yd18sn(MA{gO2YoOAopE3$=4Y0vr^3}Q1<7tp!!WdAc(O<+Fx{V= zi*T;BOHkxCCQa7&gfLSE({rh6xLcuq>iyF9hf^W^*Ix}VQ_lK~5oyNvxProQU<^3z zOYJ=X(5VvC>yUYjWRX+Y%cJ8~^hRVMgSFEztC6gtH?+AQd6r6z?26)-ljzvipTpf} z%IiAYwwG7HH1h72)2CP9sf{omeMw2Cs8QM%K_v5s`Y+S{GM^C#`T5vMcq@5iFxO5_ zt^ad-+DcXHVE&q8>AUeJY8ArHA7A#$2C7iAcC-l>3ld)^avYB5{1{Rj&Si>5H_vK+ z*L&4Bol^4jeEd?yU1LG(DJtlWckBblg*dP*)4dEzj2?nkL=d`VPSMnkls+07FiXpM zTvKDP=Xrj>=GqmF+rY1l+CpJlYNRP8Fq=mSsfxXPUd{)1!v1d8i6Xd(o#;VL;q_=& zxDKzAV;Be}P!V&Y!?)G?Q6ng|Gxm`lKJ6el=g%~(n#;TEqV0Tsvgx4W@Fc}`-q6GH zUcuq)(81i_itG&UPv$+o%VcN)B#XaC&sOoQgf}RL&sM>gC$5}l-k)2b5F+)Hm_;x5 zW6qKM*<7eL2(&1@xl{l+$??v<$mOCJ|N1zQH;F)&XBgNN5TE~n)#_T_U8S99S_c;f z@Y`BATmw~OQcyWr6bVj_o&GZK=jq=MGttBVnYc3?s=D`ojR8;~*HNz@5x|yjX z51uLYGUW}GhdL=AK*r6rO3iF-q?p4_Ef6P){=vIJ$n8YR?eQKkWW(b1*y=y$$2CNR zjFXA|JwIm~*!g&P7O)DvEk4H_BO$z@QG=R$tNHa%g*tr;;mQ!$(^~2j3gA~L$H`i+ z%&be?)96fI`raw(WNKi)=v3cr(F*!ylWp@8E-TLnJzny-HUc2=iMTwKl;%(`i@#?0 z|CRO?P*ru^+K3{8l+qz3-6b885{K^Y?rxA4kdkiclF)0C?*AP0RbRgE-ZAd@ zb+~bI)?8=Kxt{r~x%OUr?{wr`DyuCEl&KV*V)JQ_3?rLvLe!8XBz716_XJQPuSgT? z@Y^MXPAjwO@Bu1cO12lD4VYH6ph*dwkhdaDgJn4+Bk9)mx0AM{S2rohSY_s12C2-C zLWS7r9^V6=xZBHWifHoEEP|<`H$h zh)~8G8xh&)dd(DEy@Fl}9+(HsaiF+EhCmgdI=c&1~HX|pi0+nl50VX4`43iCsuVKRjNdUlcw%Ek~0gZ8pSo0 z{XueCEG_2~Aw`|i9S}}&C}XVL4_WH+zNBYeTspE^&YFe)c<}*y$YtWDf03*}OE6&BEfCIypNIRG~JL2@H z&nXK^Hu#m^UP?AY$F7bMTczj)TVc*q9teC}Y3W!mB-7PAZM+3d#)ElB*O9T8J$}R- zgopa$zBD0+)4}>UN9`R}RMsNJCrk{7^^{4v7}aaoH_mTVwaE*_X|koH||g2&P+vJ8JXM6&(cPs`ahu8Wf+q~8TIVVv!c`}Mnxh*sxLE(pvp!R4Kt4Hiz3W!CFV^&mvjsd;twAcm2G z%uLc=3%R0l%U9rtRy&&=B@Zhps~I}KNik)g@jWBkZ$~~U8c_;RGKoH?v8-cNug5-l ziNuhJr#-4pcS`p$LYBI@y(|wgA;Z(MW3W_Av1@5SIA+&^yhyvh+;w2zCjt2C|NC$kx-W1X#syYCPjQ&Uov`F?mdpY4Tg0EQmA3vHKb9V&T=R?O(&-3@ItTfucJw zIYy$wmpUxetxjvO| zaprZ|a#sa5&481icAx{AJ?IILHy@t~S!SkH$m z{-6s~{v1f4%VQ3X%G!WKoFg_ZYK_|J>F3*KfD(Z(#Y($F!q81u#1#&EZF31cBrLg; zjg{z8)$N}IK-ANgZdH+KZ||gbEwUJOx1@`XSp>_RTYIR+(7AQfzz)@%hYg;;c8U@Lu8)N@uTa)bys!QmsD;cWbks z(4l1Iv{Mm^YmrCNX8HM3z;JRK`haHX1SV*g5}1`fo%L9QOxiwrZY5i2Kragi_92T? z`jv@qZyHl=LAcS7+xH*gq-Z-GIYo#tMuS4bw?DpIWhUIk@A6g8=iYNBnx2T_yw&A} zd8hb1yVH8zKb$bPnM}9GVaGvKX;6Yyil_paS?&Ea0Phj^vl`s5UTDm9XP?B($_^ zslKn^C~s7#ps%(~UTRZy#dY!9uDBQ1v+hVGQrv&Ka(6O$VJ!g)gc<}xrHlFmpg)z4 zBP2IV0c-7mqL+t!Fg&}=kQNdm133x=gk2K2uB#rbh@2b!__Ix`<~T>iz0uJdyU_eE zlsfFvssP!%xh~V7%lo0wC%iXW2BTNHMTV8%a^$bS#oq+x?q?Xs#6hP}``R%H@llf)i z9M=Nl(*`2Nr)7I~hUkReH9*1t;n(%OyallKwLRm}v`g79a#BO6# zOpdjui*#3At94Cr5>u>S5qKAX%5+kqCM^`GC%|)V7v3;Xr#3Q-bQ9$pLfJzUE9U=( zDN@*zo6=%(nY@#skdx*VgOY1^OC~^^$(Pm~^!3dcQWKp0-Wqaf`mFR-MliLc+=Az*8 zB+tF^=6t?J$6Qn?$SUenkXi*C*#I|bx~}PGtk^y1vV0C?MxZIIo1VSXQ7mpN3-CvX zwd2ZSxBTO&7=Tn>=tVjIf1n)Ha!(qpVr>&G+SY*)gq>k=EQs z3?puj>Gd6%jt=;AajGi8OpTza)A<-|R8L7C5`q|x)2lr1+k~vWPaj>w^+{;I0D96H zRUf;q_ID`ZZZ%I+t$K4YtQtUHe5d@Xs#15a%U^JDut!<~hUt5! z1gGje_U?*8VF%k3sTjHqwcb_oO>Jz_Cz47l@nNKXR@=t1Z0toNJ8ud-;B_nc9-G2% zNZaj8PC@TEs%H1>C+6eq!o%!jCC^o_-hGTE8{YTaKFeW12IYUh`;(1wb-+4|P_2%& zP$~Wn8RyEjlQ}|F@pk8=UqMF#hycB*I?7!-jyakMfV(#f31eSiMf)?XRG6|2S#7-f zrrFFpt}O;F3`BU98xpauyPjB=#GSrv{pQe|TrUw9rJ+m2fPgq$bOsij()Rg#Q_Fgz z15I^BQ|sHf0p2lF<;J-B;FHEcx<=Xg+oQJHdtNgw$Ja{(XZ3IS{@G`+yAz{p8 zm0vKD4q2++>F=>d@4C;=WK@|7v67w%^n<=C8z6G^Ga;(plFdG)f;laJsauyhSzsbw zi;qmSfXMW6ShZ(wtJ&ye8}1qOruK8(KAyDsIzdFk?ifv(T@%KotCI z@9e^m@~DS=(6!TsDe-qE`)k-pxrThp z1Pf5-+SF&QtxVM;bB0;eYfzbUv+twRN6PoP25`vkvXMuzqR@|vMAWDRhCWoIHW zj?LT`4)O|1JmG*i=iv^XSOjVH3XdycDW>xDJf?nF*Y;V75}Ffm#%MPUNX^%*R2xXz zTQ7xwE}B~;N1{!^;$etf)@_#Mro;3T-Xi6& zAVcb(CFp=;AIVfVt;Gj%wl0ek`Zu}(hNHXaba{Lf@nb8Q6KlD6q{6b}gs1GGM*MlX z`Tg)&^2{cAa8HGf^mx7Yjs)*n(8hrzip!ReGk^kPIw*u{vA9+=x1Ou)y23S)U_+x1 zDu`1QbVIBCF&!ulheHnuL=_hNy$P-7BNemH&(nqnnPW{n{R2Q4LHJ(br!2wmK;=dTS@Rh9oSna3-}xijAW1$!$m|A(xo?C79>)9!LX5z-n=yIk?%EPE?u{oXBBk+xP1h^wD>1Il1+) z1u5v7r;HR12EaD&L8}B{xoD5|R7k5RWzpa?VLblLJ85W#eIaQUCMUIp!qdGlU9}#y z4N4813aN2k-;DNkrd~$5L|NPN%M8{o=mu#He^Gj!i!^{vLRMRJ?&SqJ>>M*%9W4Yj zBxgd-0xW1wLoG_EalC@mKG6#;TclBV3aU+#qERz}cdTY2me3Tq@t`<+^z*TwyN0#1 zN7!V#KzhCVHC(Mh;Ko=_SAg5B7B@;^^?5|g($0a#9NTuXVEouehvDAD8(ozi82=^z`RcGlF|CA$eC1kxELrw9-`Bm@zGEPv4eAK;<(nub&vdiU#PsPbpShIBDnn$tx+U z?-3%z&5`=Fs4YToh}Q2^P6KN7cZRr;9oPN$<&+6%K!6Gb2UDa^O8{_5 z0MMa#yexSYU#_{!KXL|~#^vvpwFP7W7;|%5i~LCyOsaB+{$5 zhLa*B7c{oBHhqX|1nfF9(2>Xa6M8wi+jUS;ZOfq*I06#CYTYwTpRdf}2*5p(`qTXq zeZYHUK3v{#HbT-CYXzV=TaXolgH8hJpK4V0E)7$CpMVBcJ1zDOan&B=ieCswmo*bg zXi%&(&wW0rQfVs>846>4{`UT1#pO%2l2(Mw38f6&kYDgpbhR!&yjhaLo{NJEjq=;E zqI~I=SiGzWw(awNEY8&!Wmk6y<0MHMmb6+YC0+qM9Fw=I)2U*>xixT&Z?*E=U0mXSON?e!(&i@Zp9Bt^o5bm z!;5xK=__PGWv}GZuIzoytGmi4e#-RCRaRnG#&0G!ONd%B*UNZ}4(Ua5W@2D5`mnC% zx)_As17s5VG7|lT&`Btrp$d3jvs+XNDr`(JE?2yb4Q)uc3#x7HLjeMYO7Jev?xN2`j?xGr<>9JHY2nomIc4nq3E$6!pN zhC+%>k!fiT;eI(&#d&?!Cm*T5^(;Q&_(~6?2QiqX2YRp$2DiK*K7V37z>BaD$l!r!Sj$?OSV=q=|;Dl}S1c z_F&mO#shG@>Vi+p14md;7?Cj{|KyW45>6}eA#G+_zg7}N(XokPKbkIQ>Y9Yp> z%uI71ajY|PAAzNtzBNmfKWSIi(z?)pOl3e3x3&~DCUBGW^qcCp52fB ze1!(gV!TpcEQ#;W@~nMIDx zTvaT~o+q5W77zkxq8S))B9nNeP_lMzWKVGtM;Y188Zo+21(vg(M2#X(x)yVq5J=Ao z$%gHo7OI-qZl&8=Ucdi9e;r_lsVDLkc)h~r4SS?noTXoe9a^p&F1*5maZ8>WbdqDm z_F&x_aQ>O5Q3ijQe;5NO7m1X#X!-%leK0Wz3UE5t4cO?t6lAMJ<3c~Cfg3(6X(+VV z@$$1WTks!B;KrmaqSgYtURbTz+{}pgg`^8;uRyWTaF$>#z|O3YRKW<;=Y(uaVQiFRzz5?_i&5r^888UT)XhO?va7ET(dn=)yk;J3W?aZ zx6zF2$pbb~bLL(-dMDT?Ei~xhz*%N7fb6jPpnA)0lW!(CZG6bTx+IC%CB&~;MIvEh zI^5H*pjGDu=xmkcED4=={0l#N75#Qz83RQH#891Mp$BPTp9*}Vsuktwi$a7 zdOZ=&iNq<%n(a_W#<*6W^i<;Cs7RZjWFGHE0G-r-Jl77)`pW)OGQZ8RgHY7=I%=^j+EAya{nwh1n~ z%^Q^K?wRT-qM_Oo1R`?_a1(4+!`FHgP|~KO6Z)Fho0rfTzvtgzcoPf`i0}4ED%e z$W1~DLGZxKI~5(vmhkFy)Ka*Y*fp=haUYgIL1}^rxS=*q09h`7a=Ib*M`)&evdai#z5}s{kztqV-qmcnYG(} zx^|yJ)I*&oh+=4^G8Xga;D(3ZeORD6jR7X|fr!(BJcU&dO)Y%~VfYhF8F*Q;l7>d- zlsNY+D~4BHZ^z;GKT>E>5lMbNe?DbI=Kl~@2q()`?oo@}!~$}rvQCe{OGMC|veX88 z4A-2)fUS0WHF3-WcYDcuL9SE65EhR41+BYhzg8<*k~jXwTBLnN;VGX=cXdeCixZ#Q z%9v)v+f%!-P7B7+(9R(nr0015tOlaOXcR&IG&_-=eZdveimJ|KT=G9rh!K`$=}n|K zdCIkdOPn0o`TAFV6DANwSnwpBxkJzwzmM@tN9yD@Vb(jP1r9EDQ z*8F!APc;>ufr#HAY8{H}Kx(Zw!)U_MX-zr($;&wYX}cY7C{tXRz+Y1_34dNi-z}WVnH)R;#m^=AP4{s0s$`z)Bc=$UNrx<=+t(G zW=6y`Lm@pTgMgGfiXY^&lIzejc!3W9j~Kn`OmG6w34YZk{>=)loS8ru*w5ZM2%ynu zTlWh-SmHC!dsX|nU$+Mwy+0CoNkeoN_Y`p;y;bHPj0>h^BiOSdYmqIPyhZPF{06PK zUfH`R;S>m?x)c~>LXI!#nun;LQy3_{_-PJ31;)3PKrgvtE@XFx@IuV7U1aB6D|R^ zHVe|;^+k>t$HB{T^tRc&lkZe-8_%5)HnX#GmLC`fKA?-`^Eu+>P<((Th}utxFOR6V z0^2&uuSjDArR%*Y4CI{9PB#edCi0S=oF2UC_FuP-c5I-dsFWe5T=Ar50$|ODH2^rA z7G_(sA%BrlUYZ2Zx-Fn}CWRPXmxh-Oym)FMfcjI84F0+^@K`|;k+H98*-SC%fTnivdgOf@?| zel^S-f_oUiCWcYDjW=AQ*E-aSq!pDXaS>D~T})^;2UuR_I}=cA+&wJ-g^#yjh-n$iQA?hl*r{|n( zA;=5G?w_=rZDCI7qq)#P9LZ%e9NqD{lI#|1%}KbO4@OnpMf|NK<-2SYI&T zn*S7Z;Rw~h2hV<4W+UD&h2 z4x(pNtv24YBg87tFJGi})1WPiLcHy>Mt_bED$zc#K?J|e=;zxa{Op|5%F`i9WsRs# zP`rXg;f005ZUbrsx@6of@Z?pJrGAut%}$S%VRY=V3{R08w4e55Cf1?ctfsymBW} z)r^uZ^KBSL*?8Lbm3W3PwIaYl8Ne;V^iqneCx-HAvgQ0s1%qSn>Mg-}QFc-ui9tkRi-?NvU&DSkw)bD&g@J2OEVLzr2E3@6ZM*)DHQ{D! zW7?!#N%T)|{0pFt>scMt3qJ$kPb=)3+|X)ie6AvHaji7VaP%na)=N=bsVSqTSIpja z!G~-$*j39mYP#5W7?NwDffCfS70-is2zS8*Td;mja$mZA`QxP-MLurn`byjPv-XH?6W zB!e(XLQVS+Y?PYTCUVr=$?Mbjg-!rY zFLp!Q5Zlko|DEP^Myx|0tkvhWH!(z*6rB7sVy^gnQlT{_vcWcJI`Qp$OML0;GhpBD$Hoa+~WV)ADD2k05-fZ#7W6{L(4ylrUVg z1Q6Uw@58eNxDXwKsLyk3M~Zzd9W|2B$!#7^wGmVq4e;%xV8`0`!>; z)H(p*PbyO5OmxfrX5RYG$Nv$tt&5~bR&)Hz>i+-T>c<}^m0W-R%k1?>W&@l5W%gfo zJ(vw_{b06H-^$nE{p#f~m~dSyKoTjElzz*bMq*G%1%Y1u*N;I?{sTCPj&oqkzo7Kc z*&hrzKf(a0^}`t3_vzf6ga*&MmUAK!{ezMQcErqK9`z)s2P6W=($D5*FK-i2v>f{z z@;etmPy>JQ6U}&U8n2C55qBJZ0X4nv8CwG|F?Jk&WrSeIenTAamr1|T-W*H~YL)a0 zX+wv#g_-ot!TP^5rfB(P4(Jy@@$&y|LP<7Chp_%{NKpnystE!QeV|OzJ1kJb!c6!L z<#J|52Rz_``5}qgu8k}yOnygaWJzJd2XuJATkXZh=6c(Qnf~9=_iqamdkH-JjDFjP z(Ipk&g6JQ=+p2><0Og+vwzO?&sCJ-mQDb zBmRbBG4qfiUNQ5ZNFY9n1W^9t4e=vy{ynb$p(^~HKJ#HJ0S)Y9U6A}c5@L@A79{_6 zC&A+1?#zTMCB!2>B=(Z5_5Vo~)YUHt%lEP@uJQea{s;L1{57=~Wk!9Ze*s3zGJTi_ zc=+v2)}u&(ED?6UsYLvUHzhg!Z_=$ztRdAd64`t=h)aEDvl=5{{@)uOM+QGz{BrI^gS9^ zko?CR%YU2n?{WPPRgzc#lpP><9_fPQKap7ecO+PV@*j8FAGsqAWCO8uP-PVe#Kiwe z71-6!*_T4?-TLRh(h3-Pko>?tn|n*gxh(5{0p<~f1HE~aups%5H$dwA8>WxO^|7in ze$uZ(5#-JzU6A}I5EZC=x*Vk2lSay!qF-{)g&UKK6fR zI-om`b%FAqNO(Sq1W^9t4#XpOIC9#684D^~K$!SHsRFzD!^1ECN-I$0f$~rGsSUK3 zwYK};(6sYc3_c1)c%_DDuUmyOeK0!kl{O>^Mcl;G4knlH{O8?F| zknlf4`2S=t+dpvt%_%_PUzG&V{C}`?oy+3<*Qfu%OlN;Z5EKVs<3H^Fw!5=l4=^@i{!X`-gfB z5o}EKj#t%i6^-LeY3bFmlD713>td-hs$(r}>9v9XTV3vDuXb!yG26LZySc1fuZ%y< z>mJo}bhW9kLo>6mJaQ_#yoR+uUeR{gOHs2py>3(p&D~?(?&&f7tW=}g4GCg{E%;kEV zdcACPyw24yeRCO)dVB8%Jd-)kdFhaMUVBh(!4mHx9pzq?zjawk{o zburj;L)Y>;&iQ;l{ft#E^M3hc{TTW4ql?kqttG2+r3Q|>whros-V6PP-qbrr%X*fp z@uRDwr6cmj;gye&C-dy7oBb}ylZhWrR@&rUy(arzyspp}nN=yde(WFE%J({0X>r{N zb|*J_P28R)A!-(%P74?pA50wG;yapX;ottch3{icM0iUvrMuS2s!&q@06~e zFv!cb{Mju{KLK@k(;rhUtN~5!W6dH&Hjdk^*|o9#(X6Zbr!)9VR-2O(Np-)54Y8Sy z#@UxRltQz<8MlX3A6;#>x zj7R0q-BxCKxsH;8?=`V6|dFJ#RiH zUpo(Lf49Hgt9RRamv-KLT-m+7`=J$ax6P@Z6o>uNq19d0%&aijm$-Y?uXhiVldVBX z-MpZm8u-MBjmrU8_xhWDt8?L-+XLBqMR@g!68Y#>`t7RZv*WhCc{ua=wQEb)+mKo3 znf`m6f4@GF0pD!h>lqlB1w7dQ^!h|P&})E$eBT^4WqazJ`mGWRq%n@C% zZOKQ^Eks4nrZ7ORCx%Hb`&b5e9IHh0vRIxi3TlME!Gyi5JK2{XNNxk*&j-VIHy1+l zVf4W*B;@(IN2lLeRAck)8jRCwU$#^QJ4{d;!ij4ni9FMwpHsptwN`U8M~TgDxQuPsV)nuwLvJ)k8Z-F9edW+i2T{(nA>KUTU;%1FurfKSFuce z+;iT2UoNKR>sLSPTuqA0d5U*|+}?NTp@RYOu`2T|cFG+3G+`>W>LmrlmCCPTy%?qC z_BnFO!rI2Zzy>=mqjlIZ;X@#Ly{MP9`3!h3~If8pi#-d7j)WJl1Ed#!VB zq*vJti6nALEZ6xn?zT_O3AC|ZWZJbeV)MeQ&j_0e$WPw)d?)D@NKO<;#`Ah>mM$KV zI2B?CcD6jO&YE~kE|i~7A2l$duj}$20ar>QJw4#H(SJc9Kf8 zfIW=fmsb-K6wZQ6{^B!uX*XHo%_)<(a4*WIUzB5hy{}CeyxFrl*G3;;N0o?R47o>}lDKg` zr0{PH$robt4Bux!3bL9CvcfhMl1@8xcjhdwhYSeGB4=pby?(8inJ6<1z_|@-;!HzP)+(Mb5cxLXS2Y@?vR~|gV-;8+g_D!ADdPBX zWG;AQdyYFeEu~RYRW2y0%F;16Q1H*I3RcMAk$ocs>-gkDVg-nM|4hAya z@(k;LgoH@qNp@%!V^1tjR+Kw5Ygj*Bjv^&JH2YSZ&?pC>*Y;;XmfF*%TY0AHI84t_ z&j1<2ZXCm&2fr`(smoy{ZJWZuzKsvD$<@am<2j-1LW?tIi%S$5C5yocdXKD{s}JO;^9-AF{aM zv>xY+?D=UU9F$393a?bws7lb8bT+_EHZw&1jq|Sw} zF+M#pPSAcm{PK8v`~wvRSwadu$Hy8ryXvj$ToulxbU*ZIshhf%7{mBbfk{Di+Nc{d zv`H5qUao5-V&Izj=rxQN1d?Che7Y%^d=b$jm8x`&m!d3d-WlfzSeDUFfLpsNA-hh&I5|pP zh?|BMLdq%`lb{*@80$AMmKzafAY@s4AQ(I&JzOV6W-}?6dFrMb zw@cJ?RbSv*0W;!qsv8TrTeQu&yqXEU3L7yL^8H zk0V#g3~QkTMF^)}egEhX#QQpC-IfmZJ;sBGgxW?dbs zE_QjF-Nq4dwFBSC<|zu+-t${hHN+;jmpl1lrL~sltjKL{A4umoo`$^271gqP8LrS< zH(cOYse0^%(o?%jg-cl|uC_faJ8Tet{G6F1X+Hbfny0m5O)H=tQ`+Q52Ag;B#!e|p zKKD6EASR-}eiFhF<522qDBJA(TN{G#kRcQ8G>dJa6g&M@TmLjHR#oClGh>-B&)L0Q zYlYPF8mM}jh<(c}6$`o}#Nese-ada(#XNuQ?XWw3_Q3S=H;X2sByT0lxm@xN*BP5h z2?r~4!?%U!xHG6{vWyTF%+>QFk!KHSCPso|uWItM`(`o3s&bcGjtoZlUa+VYuAiDt z^Jb1ub6k+s$jQh_&T>2t-^h|W7^k2@9Uhaw4)zRoqp`=nJ+rPk2Hx3=`exR-ONN7e z%Ke$+#o?e(yB)T;s;2(E(CTS>=5Qx0yNTcA+p~}f_p*t5y6|o7)BDXU(VMk%*`8#{ zI%n}8)@)5L-9;xwNU=6YPv@C&w+G0SU6Jkc9P_rWs1FNx?!LsXbT=PWG7ve2!DmnX zpgRs3aUho}eDeffLImnb7=ot)F06#eriTK~AT|7%2o$&PoMsrLv13ux5F1I{59&`4 z28WiP!J=Q4n2tlV#y6r?e$WPQAFyqM*FexAv3XD7VQ032`T8rKY4FPPiS8i7r!_O7 zsb9Nc!%*>YeR&}9aG$)VNO@`p9V6-a>?5HR>_Ca>U_UOeMGVs?1aN+QA&(tfRT7DU z3-DVAIQ(gW7YI;z?^`Rl!_bOg@k4!a!2?WASu+mxIOqdx`?BwLwQnA=V&#YJfF>Xt zqJV>ey#)SLx6(DSrltZN6TgUw*8tXD$duXK7Cl>{+ac_lrl_o7e(u>^p&h$f%#3dHy@7!d) zJIL%gKE(}9{lITQaT1me2(*hR1vNI%Zd)+%$D-?%>>$VTG0Y)qud@E;oIhaxgB zx`g;Q{iDi2TBSb$10#M41_mr$!5mDeL9hMRGB-DVC|AFj8&A_9v^NG2gS(cq9#+`F z7HgK7zdr1W=MNCz-A?z!R-k}MXUfz(|eq~O1r>3<$`TiOw${fpL zkr2%A-B*SWtpTGGlhn~Na!v3Bc={o)Z_i>hgp~4^^t=Wx8&OjMNrT${(3^z%w`xyB z7%)aIpz-ysqZ|xtowpB0F_yMctmJYMD1E;_$I?6{xqm*9S({L=uJh!= zimF!4R5G+j(T@J!AprRJCjyA?S=$bw4wr0k(WUT`V;k(JK39y6{1-4OYhRU0)Foe4 zv56h@PF8T2Zr4JYr6aOAiFdrCt#_?_om&>s98(dg}Iz;xKicMa?Y1c1!@ZmLm?+XkZ=0n}r zQ`Z~so^-0Hx~dZW-KL_+Dc>f;O2Ozh75ry`mK@cc>Z3XthbTc(O&uj*T8o}nK`MY;d#MUl(jYLYI zS$f`q=#Oh`z!zepw!}BtyIB5%8y-@VbhT_?k(3zx9=6OqOy#Enhghyp#UksC5SD1_ zJm%?jqIP0aW3cXc%4}yNFN#*X7n;u?zunHIpi>k;wtGh~f zav>Ag!=ae~zN0_o%j^?|$-qGl4x)Az?34*LwMo_AMayK(3xz|GP+MbOrW+|IO@UtR zvkd$m^Im=eEVR^$AW=1p2%GNnd~N6R=W&4nFth0hVbUTNwR5yl4QwHRXZ}5ryh#MH z&PPxw;&q-|l}qf4=b=-0h%&8ou0873oQLy9I)}*ub36w3S1spxHd7bjPu{Upks z1RUup5-@fzz&0$VWgxjlwLE}QG4LM(@ZUdwJ_4f*2Bu@KEn#JDVNI=RVF3#6W9_MR z-79ENOCa`M{i6!}`SD5N-`d*dR=WR9y%`mu;mdO{uy)*^!}(7SAD?UhI|VY6je)MI z?$0Cbf9oJUjyDp@5)5pb=IO&C{C5W)c`trbo3(+iu8lSI!;k;k%j2c|pI){c|7$M~ z3;V~hcwATi?&V3E+e0sZs_e(Ak0+l$s?}cqnu;DPJ|^=&imBeeE&qqwA1gm5jz7xQ pz7NX(1C2cH=W$a0=||n~zow{!2n2A@!N8z_f4zaoDf|SI{vSux^1%QA diff --git a/spreadsheet/macrofree/security_checklist.zh-Hant.xlsx b/spreadsheet/macrofree/security_checklist.zh-Hant.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..116c8c2c55db52fd7d26165748b2dc462894f1b6 GIT binary patch literal 35587 zcmZ6x1yEg06D^7acZWc5cXxMpcXxNU;O=h0o!}0^-7Uz0;O-6q-pQBzukO87`>>0e zshZi{tGidP8ATcJPv{^ZAkZMvrav|NgNF)}f&YyGf5^a}se_54vxB1xgOQ^ny{Db6 zT-*dK7!$l$K*{8$x$iIGlfZJBxzyMCWbV)wD!Y)ENB2(zo!LH|Qj26tgM*ljl$)Vl zcH#$ZprhWRTNYYQ<%5bhd@D?VpqTp4NW}#B-~)wrD}kX*@SKx79!3ildNI={d32!{ zrf!9@VMFznuEq-d>dr2df;p$DPqgxVz0A)VvR>mdT1}qQ6QT1PcqvK2Y49nJZM_w#vY|WRT zn)CaWx^|b8b+*Xdy!T6e^LJTnsJdxQ$8S*iXG;ZqXzsZe!r$SE7~BimW=w=7TugFy zi1-1RTJ$|nn8-tI!mwcJypFD)%-xAfS(Kw7ta<^Apv8iWfnZ;FiMfOhZ9&R@PX&!> zCHZVIR5;{TE-+AkQ&;-iv zpkg9oE+3D1G2r8OmNk9LNP&cC zhPeJ@dE(g~^g27;|F-?Y6L2oo$?tv({(l>;4-2^`2@(Wkm=FX64QMz|TLxE4Gdr`t zf0_Q6?p$liVVxbl7wP8*;n9V33t7M?H&~sP*Hl)aUH7BJG^=PPvd^TcgOsrF=T_;U z;2lQkpq=N8@HF4SXxvu`&T887cULbI%(BMU(bY5NgeqC&mwUT$GfMA9uX zf>TlGq>=ezi|@c@|ANj#z(Gn3p(oG+kBbv>kgQ3v)2K#H9Aza&4_@ouPI&rxL`FSz z9(scqS|=H0`lIak4+V=!>EfS#Z5h8KDy}Fw;*jk!7-s^%JYGezB1DCRKp`y13zRnd zEos9lWs+nko|fjfZ|E8_(w8{E%lJ`&Jo8sKmCtF> zc}?SGgHC0A2Ao@W>Z)GhyzL|SF37#3`+9|XuwMacTN{iZS#3ISJzLcrn$_MeU=3D( zXq=m`S5QBpqbs7ua?G~qQ29hJ(G!V?J6LYJtsJY%xIDp{nHAcQ6O46f!p#xw>VXtb zizSJM<;Y(lKL_3-lljTVd|`$qydtMG1`9h+0yIxt<^JZfqPeGB>!&2)!@U_AR_q@^ z=BGegWpoHqX94$m-WfXHJuHh45b(R%ySuKtZRgmxFR)BW^?6(1`1pNQa{cHa(BuD7 zgU`_Lq|xhpe-baSRjg0l)Z_DT^4yrd74Wt)qri4WF7Za&B_T{3!}IjBZ9-VHz#MGj z@G$uZB7zc?5~LXNXJQao7mJu`xQ)?L$Rn32?3XKV-*QJjXiwTmNKYPUj9>I7O+#(& zT&>CN4HJ*Siy7{PIV7R|Gf$v{t1#BjHaWCoP8M6Q6Qe@xg39H|N~3V< ziZlxqC$K|Vqc?<@XA^ldoDG=T5`G<{lujPOe@Eud{2m-5vZB6@`@#%ObBWNl;@!H)0zAV>I}LV(T-QvWz15-@eispxe}j60-B1HE7OG& zsk2DrT&Yw4z?AROFTwyxg^ zS7=tJ;#Ow6??c+uY{E$0E$>*=oH+@|uio~-=0!8O-6)TH2PKEUBBim}p-a4C%O_1# z9yC-w3#hYs`8+qIwO5Rt}^MpEgvFSEWqJRiskbNGtan6DilQh6-zq zlxTV)LsPF|@#G<;H^V!pV^BhHL+%K#7i9gn0dSA5c}z=Y>8uk~JXi--p`zp)s;HTa z@V~A!33?0-R!+S&(wkT-n~}C{Y*;vECC_n2z8{X$mtW5n8zFAzlUs(N%~B-Eh8|H` zXY}OYzUVPegutze6KC|zOElhxiyGT2q6$}A00fILT8%5L13LCj9?C4ZYye}PoP#}+ zI9hJotFn;~$3DTyh|xiJLX4d3FRTY1DA?mQm}uaL5eYIjh|n{i9>=3>j;(tzQYX@u zFvVO^3!WpB1x!iI`ETieh7{#RvlNQ-Y?!v$HCD;GcTw)pQ(@EANb@!o+{axos2iNI#o@*gd;!O zm8+Xj51sA*gh|=j+~IdlgPETbbLUDFpOhN#wd|A|p=sCet8LE>R&hTQp0Z1WlUt#~ z;<2BzZ{jO0)pvJ?UpHkArWBa(Q|-Ab7!k3D&J{p1O%fzZqcXV_&oBXZl%!>Zes2U)g*G2DR7>4JQWA zH-jpyO8JUK*UBmF5i9~`^|6vPwj6ktn@#31OZu;00+VTTf#gXoNZhz z&CFa~82)?xSH~8+?OfJ5v)*6TbXo2da$PEC$w84xTRhxp>?{gR7g1(R-Akvd=&pn! zTkOVY#>Pwq-aw&)F|BmL@alccx0-l5NTEsH0G=<~!@d51^8hYi`}N(Wt;@@naDm?! zx7SZs3@a<)FD^cHhyrK$Yc=Z2op0UTCjl1%dIb0nHP#(SfGxcRQk0cP>&7=g@0-n| zc6)E7huo_Wpf%tLAaN^QSpwL-wr{j+_Vn!P)p&IfX!hu=3wY9d;d$)O=g8+L=)|i1 zI5!|zEPF8V`5h1S2KqL0+Orq%x?=9KWsj5%c(C58{kZB}xigSXo4sHG_`G*m_2SFF zf1F%-J>H-DFVNn%o=(X4d$_4CjXc!W#M>?S0Y1*$9|>&S%BploDL#H1);>@7SlX*J zufG{b`L1Lb-+8!(W>iwX9m@DDY#w{`n!iN7udBzsT~yp0B$s_$Qa_JeOrK0tFMjJ@ z1-#iU;0c^EyaCh}YL|8a*T-yJT@QzV6|wa#hHH^!Ke_Hs9@mfV7wfIOlgE|#@ZF1^ zkFNHW5r+fr`wxIa%R}8uXXi0Re#sq_wy71lB_?giL+Gp(QPM}kK8(yviqI>wrU7Jj zTHg~AmBO^z07l;{@lzADUpR5}=nHX!g&4ZPo)xhcKE24DS%ei%JG4Lhr9ie%PyPZe zgR#BY9F{UK4e7hnXb=4JSt6uB7WoB7s;t0d5rHW8Z^ryL=7qg*;)ym&;ykev|E%N2 ztx|gOCvbu&r{3wi)fttZ0_F>-EdGzso?_+;i7futP%&P-M>v_@-Ld)YFa*YV;$y!{rpEQ?P&7`DrlV03)s#M_QTeW^Ddgqbil3Af`VJx@_; z@9&W~f)KFAJ3QtsnxA1{IN+BEU;@sfrSsGpKSBhT_8zoKp2r#+YLp*oGWdB_G}(1= z;=Mu$)?b`@x%@j{TwaHo#w-Xb=n@4wNq*hyT)p7Fa{IaGb9N{c6b#+2NVHxa>ze{_ z^WQK7!0NVsuH*|CU%e2psJdK1L?710ThoVS!6~|2y~KjBLDls_?9=`@m3igHP}#O1 z^%d-gg(;E12IO`j8LcAK*Ukzp0cN{=gg`WYS9eZm)VVRNJ-!Nj%*DrJyzEUqDa=&o@2d z-_c+00=hcyeQm7-#OFpjkOAKOPcFZ{a_~4{e;~i`v-IEi+GD(I9K83v_Ay`e4V_+x zi|aGIkSqRnENxZ($sqYnVEMeo>QRGRS{JZ!j*pw)2_D+@!e_=SQcaCz1a)Af^I%<`6rnHGkCj&f6-+a+_Lh$a>zxEv5Ci)Zt?DE=|?>$THor zk{nD?cDdW}gP;z8a21-S1d!J`HY~|Rf0^*@EBt{)?YX9xFgf4UDVVt5!@ODOO;>Hm zy}o(L*hm^4(B9Kyv*iCe@K(BciP(969q#QBP$Qdv_%i$GC0Qe)(3$_9?Q0#s=cxK> za{8Lvh3oerHMIH2=D%F`jE0)l9Y{~MYc;)4O&C){)1PS_S#2eCveNA2_P;6rA?kTa_ALa#X49?RM5IL5cr~JdCDVg^GOCHi zfc)H{ZPfJojHgK-J=3eZpvfnj($slJ?ale5YV5p?yi7f&+{D2%&Aeadgg7Jc2OzO+havx=;KvMEnJ{{WcR|T_qBlu4#E_0Vl>e61|+;E zl6SvMd`L$ekj{fB&#m4THd1m>n?o72@EDH761sI_HJdo1V`Ku zfX{t870MNoGSOLA!7HK-(h1Zny{+10HRbIyXS>b{0K`-bRq1?YcHhrtPp+5)P}1$A zSM_YVou9KHGouQlL38#?x6NQ05zd>oKa$^Shsa65r!%eda5`^ z=j62~UtdV5>D-MA6e{5d+>cgK-BBy2$qQi#tI*@-ITw6bKmvMG*>=_91mi6-W;Pp?IEy&}?w+9BUwbS9DB#(Lls zWu7Z76tlP!S*?^GRxx)Z z^vBv7cr35$zIC@$uKc0X665n!N8{Q`7+rQO^R?~n{vu>bDOjXa3x#7@uDLZX|4ma? zSETYA|M^Ti{%nhR_{T2K+YJnE{zM(6+B~hNn=FklTd74doX4$=qLL4%qF|6DLQf}X zfPpIskS6)ZLg>KCmZMYyCNS6T7jcjE@D-2sqRRLVTu0Sxo~@l9olZ64^?`kwfhi>_ zh75!gEUPCi2Ix{Up8AT!YIHCQB0S5atOj*&eD07YpnvzmiFsA7`NJX-B1oA&3Zkze zGhx|9i@wCcUlwV*v$w-z)2lb2_rdmr?Z^2OkHjXtfmK_oI1M(#4Q1s{p@zR$y#Lbq z?LhCxIfKB)%167^yW+)zgqwuFJK3AX$fw_BCSdQ4udBX_UxZpa13YK5My;sJv1 zr{?QtJuiAw->SG=+5WiHgRJC~H!&$u^n1!xwV`N>oxCZD^&DfLC2?2n!R(TxmQcwZ zm5GLhQth<4lUqSbwC)$$_4__M91V`kS_k{OyaRw`8u^C9CVUo$uaMDgA;E0)WOQZQ zQ7X<9Po5S_Yz4iu!ozvl)OOoe6O^)p^(E|58$AiQ`D~!17B@t#vRZqk>I95NKdkSL{3TdbQk1g0q8$KL82=`qBmkQ0s#dHpDt&%f>GLmG;!{na?adI@0!Kb zO1ng-5gAe@pzr7VcyL&|WwXAiI-+9mq4QX0rXjR^zf!?2^T?41P}LFelTT(HQ|Q>= zEva!?I0l0Z`W2d=DJjA@8a)~R$ICcV4!?U=`7iL1ir-$p+Lyf^-`X3Wf3s=rp2nJe z2ID56k|`^gkY-M_a9c*zGR4^D{$X=?m{WbL&H)zOP*C5K!(D zABIolaT@S!Aht-L{2Kq3e?YOk=@)*eLfu$#Xo59Rf9rDe`zka%`@=U5h&G`40)n9v z2L3$%p=!PEPO@5VWsuen?QJmh!eb$rRk!tBO)WFk!Qs=W(I>%iSn3i59Em{6DB4^I z61Y@nrBBf5fEr_i?)UW(ni)@Rj`327&6+sCS<8A0|3#Ol6l}$JM~vyFeiuih@7B?- z?#ySs1RVDaUtq=E*R9JQ5R?p%=D;oM1c><4g#F>ECs+j&xK2VcmaG9n3T|)!>wsm5 zIqs}xjl(uruW+8ufGDn*iv z%7|^kd9&D@Z_P$RGD64;n^`|i@LtF9MF+6odk;A zzUerx`Mf2%X+T!1zmvK?M!SJd(anX#XFPPZq=^)zXT}Y*UsqcAd^SLM&XgVU$mkP? zcjaZRfUMH!q!=%ATZs6f;lAM#=AE(nw7odRl=+rhSC3v*I8>wk!{f!r1$#4d^uYs0 z!(8Iog8mns8#kBVvSBy0rV{c3j+_fy1;|lF$WdR%lOPM)I_%Assv#;o`=Do3g`=u# z+ycHbYb&K4ZPhaTP=X%%X9RFvbaV-epdH~7SN)67NnDm`tT$N!r{!=%}VKH4bN6mmV)`$mQ(!Haz5Z%YiG`tgl ze}j6@)-%@Fh#NK+cA>K(Fjn=H8q?frNO+{8ONn)hJED`6g&NrEsPkyZGabTrXLg+> z5W~vx{!}1$M|5fl3!#1C5>YNr$X49uQrcbjVcx{j`w!ROObYMuD~3UZ`5oB!xTig8 zTg~6QQK3d*`3|1u*jn_`3vK4D@}d^q*_fYqQ+vf7`mv%%KD#2K+Uo`-eq$it=Kb;N z;rUtEvGxRCK?Hi5$}z7;()BU<1Vw@#uD^4b6i~H4YnJoK`!!vI##Ey9hO~?>FPit`ckv z4_fLtMm97&e0@$i?*AeK*O@ZYAgjI0^6J;bAW%Q-A?q(-Fkq?h!oR+s#UgX@5G3rV zC*Tkm$Z9YMfQ5?SvgFqsg2>H1XcRD?FCRFxm%p98Y;?l8`pt&`y{iPh`)99=`t{RM zF$=+avDGjR)_mT`ZX!uJmCe=4dDNHQgrSW1s{hqkPD#-|PghKA2GywNNb*U0b0(U- z&0ok6cdkc!TXB+DX5SZdyfVaqQly>Wv=; za^&pA>Skuas{HefBOmTI)8zHjAE-RtVICw^2Y8C zc4dngRc3_D0z<73i#Mvu0?&{Wt$W#jk4S!LVP*f(!3PTXe7L$Tf^NzM8zuZ8LfQ#< zG))`msr{;gwb-#zH>$RhId0b_eVzri0=l4)%fS>6BJVvJM4=o(F&}*`+BMM&@K;~& zu$yKO7NkuSrbVHa`TPTwjHb;ph15%rrGF}Iix>@Kj$~fAx?TF7?tU0Af=u{tRy2`E zPm{FhLlr5>*bX2%yNq`4;oxsNP2G@Za7^^}Ip#ny%O(KI6@wS|GM3gn7?U^f1NvS5 z_5DNGt(RqW$u$ED#$j5@U+5x&9~H33wem{e79+pR&8q%HflpS*C2*JwiZOno&#C{w zvn8%x3!a`Pmw&`K_Tb;Jlg0D=oa=e=lqdY@&xQq&t4gi3)hPR;H{iL}qK=&Gr7N@4 z+{V?aLIU)`h$H@mW~&5Ige&GJCe^5+&(p=}9Wbd^pTLjY*Dltl?ymx_HkJ$m*i}*> zESAgWAGlu7dBPk}1@bPY%y0y@mL-Hz(_8L|;=3ce>GYFlKn0Yc1?Ho-B@}Rb9WK|+ zO|U~4;yu>g>nf*m>)*T^?bz29pl*iJYwq|$Nl8@GSOuA*s_8ygU@O_l!6-zhNlt&N zn6y<^F&1~&ANyo z83?6 zD7~xe^U0t5al=oqvRMHrOVGpc>`;cIgodN^knm9Pbp)-k%$dzgfbF%=_)0#!v4Ks+ z2)9!mTF)6mROnPPIKm*r&%|NEggFN(lzB4Bs#a-OQJ|(-k!X+Dos|Tw*Yqh&EAW? z=WHa!uLTXRuxDbAO-M{t&*s)KC;F@_AK%o-EE6+_eCu$C0RNIGy9qjA#QfW3Gdrtp2O%V(xgq-b_QHugH?tL6|149V^d5K;WC74z)9zkS5$zTN+mzcAO-!J!_Ccsz2yGTTq zss+Yf^P*VwaNS>f>U^S}dIJ_is8EO>yEPYt$!pH z%#1(Zx^$UA>%_!Ht*9Gz+{%y=&a401wkx*ZAdv~;Rh-aOoF4q<6bdt;`v{>s6c9Ov z9@SPUmMl_PUCUFgg>)5_tYls!&O}Sv&{{qskb@TmfBQxv64*`?(CSkNA`&pYocAG8X^PuC|it^2F|uM=GT z24tQgiIRA{2Otl_7}yZ;l7^SB!4d)DtgC$ZRe;?VqRM54S8(XTJKcRg&`-wR@RL$$HVz;`8UL$nfucs!!7*ukCE05r;vM z47Mu@vIzp#cq_J1d6lz;hmBXg6Ra20C)drVmqC*M&^ZzgzUs#m=g{jNi=f2`sl{1N zs}&e3(^zO$qs5+HO`gL}mq;fg<>9THSQVnNY3A~0%HQ~_FVf`1G_2M)JY#HhZ?6a6 z+8#a+g}7I-w|L06D?8OOG}6{s45^OG0q2X?xy(D~4C%l4}j~$7k?QH~;f11?;Ga5~ZH%C=7{hdU(zckG2F84lwcX9I4h_ z9QjlBPtMbwFH&iDfH>M?bJ;LMQ5;;*o_2KiyMD`F4bPO-QMr70a9XUwm$z9*?~==> zBV;QN4zJ!B-1&Dd!GQ?t5FZs6kZ^dg@H69Ij%l-y3slU|M8alcV93U)Fl27|*`#7- z^2k=s%GX)Rx~hd#m8JR?o4@Vgh5uEc-C0Zsq6QGL$KYAagKK&uyP(S>k#$$`lKeck z?qVXGdbt5?z$+73WRHNE2#&lbx)XSY&DjQ4-V-c(^}P{^%s)-@ZzqB=CYP428!jO1Xr@ z&3gQt?PFdpBazHGmW?VxdPv_-JK4(GTEcZvwoC6_5=7f<{r!Ah+r7&7ne^9*m%zw< zMpLfX)&g^KKRwCo(#`#rZ(=Bk>y_M~9sC2<6P_yx5LyPZ9P)Ak&m61x{P&cs?dyIw zTK>A>Dibb}{6G_d?-ijovv%f0PBw&H4dx*0x=2|A-fC&qiWhqyGevGt{-y-mXUdyI zsEi&gO@77sfQ|Qdol8RnuTNdIh*-BXEDqeYXQS;b-;;b1)lt=*`bf0KF5NGJc-dbY z?e5!PNp^*$QK@Ch1a~V_ZlsU!{Trtz+sWyaGOD-oFL!E zuJrlCJnVlKg#{WG(wa`ng8rtRR;thE}jfm27PYu-PDZQ4cXVf>7~sTr3&)zUG0C6FMtCJ>?6;Cp#Ybu!1LMJ;lwT? zsQ}l1k5}Mt*K$lI&akmOedPAi6vgG`15UEW;lo&-gx~)N$4D;aP4bMmf0(p4#?PT6 z1Yw3@%I18y>}OsDg$E8K`ue%S0JXY23azu73cY}?H^+NjJO%^Luh5e**iMa(0>+4p zXzF%-7EmlRFVByBcKi2igDhNwEZ-XTKzSEXR0n6V!)lceeqxDRuQhp1D1)1L`XOA) z{>vkEMOU)?xOq6#$DO`kC~xZs)^-KvntljC#p5W&IvN-v(!1y;DxF2_F$>tm3ZY+iKn+cn|d$@4&wuGO?L~eLskNIf8DL@AXmZKKXY-)Xf{LS=QjHO1lXN8m~Pds zcds&>+szYcj1g(Tq>>>yrXrdWL&D7ZA3#tg6%yNR?$On?6M=R4hv}02Ezv(`lyu4R zW2@j(@AUi;)48PGec7#H9OJLKJIoX1eDM@9O%yQ&GGcr|%rBiHlhob#o*Z;a)MlnNBAsz3{j~Ew z0Qf|)f5y))N)Y46ZNLT^e*=$lAyb1foQ8s3%!2p~>!*1NMgKz$pn}Z)-H!GCW6{a2 z=7F(!R5RcFr~h=WHM8v?p50JXO*{wmkD?S3dj>=>mmhxLt>O52HaHN#-ts8t?X$xH z=03a=CtZig2SA+x%8*|IfZQmr;Hhu5AOk4mfT`1(D$y!^%);;Y{TCSv5`DhD>=_KI z^B$S}iU(5Bxj7kFS^lu3HeBaW8}3oHGg{TThK;05>saYx_8)X-rFKRuI5-S1joKqn z-}FDT>LZgH)(%9B1brRE!zKXQ#~|jK?~KDh)?Mjs%pfeFEy9tXP*4=LbwSti~ii5m)XjwB26J;t*tujA*43jYy0SZFQu!t|-IqfqIWyg+1nG*gOGlA)&v zll&s)(Qz?dBv(~-C=#fumQizyy$g@^DW_J7y zArHAW!<<$|^+VXA62vlo@ zqESIZzz&`cAc|e_|#SdK@XoF>-4d~aQ#?P|mkpleuvSerJ3>u|eNFc^D?W{}zHbP^NC48OxuO~c`Ha8f_LqIZ@*S=?jT)eG4ARjq5Z}szAxrh(1(y&8x5(uh`Ft z?v9HP0k@A($+{Oaog*d^nQr0E25-%*ZJKv?%a+`yFmf)q8y$T0`aHrNv^)BSJkvty zfBY1E+;B083t$59WsHh1`?zhn_iVIQI)&TEBp(^9be=DZ_A{6-96MR41pBNTO6Hg) zaDE+UhC{Z{MYl?;h+1T3qi{bB(>18$bqr3=gTY>O_{1~s4=)1(NM7u<=c7B@J|T4cP@jNO=_oPLcgN^gH9Lim{Bmh1 zZ3iAWEyi-%T(I@kQbjhkwOF+p=&~rZ)$$b9r7X7CceAU00mv{~?0;a+QKHpk$A!bB zJ|=bv%V0E_J_HBcR!wLC;w~SouQd_mn!Fs0n3Cv84y#xw4!_&7axEWL;xJ!7s%(g~ zy~3VT=FU-LujnaCdCL-7Tri zL$xyJC{Kssknm{P)?18q_jY9)+7aMyzMtop`-L58KAGoUU*R2L0};}R{pEE{U6hY^ z!_M05_19Z%_o<6b9}a2%pEwuI(77Zt&y{YSJIz5)VrjtSraw%{GNZ0jAwu~F7I$lO zl(Z@F5Fl8FD!#3`%lqB`j>w_6=wVV5S1}N=RXXi$PK{@9kr3{bbwi}fl#QGtm2;i= zXk7{D@@}}DsC`xwP5XcsHrb|d9Da8ZGyy8=XU3Lii!b?$N;)6eI7W3G`S_21fa-wH?faI-n03%~<@mByrRVB(^DX65YpH+7|7*wa;0gunZP^up z5TUInR9*k6$ta!t(MyXd$WHtF)AV34*H1=Z)Ved_vWw6L#$cuzd-;4u9Ko)RsxQcOlhEDBsIs{}3da!WJ>AZ|oZ0pz<`fR=yP z`;$}Ta(A9Yro}VG-B#IPE5(+>N*U?17#yG;8ctEhdQhwIA|<-EC~q* z|9Kz|QVBUb1Hl+Bb&;$8y&o>i=Xoky5hsAP@8iV1b^YTOer?1Jzx^5vL~ata;J)p1_uD=wI=74R_`LktZxX}Y(EuzY`vlXt?$3>|dC-?7xqyL(bp6J5S zL0fdK@?y#@h;hzq08Jxk;b=JiRmg=YOlz4DhOBGd=_A;dUC1sQ8r zZ-DDut+Pg8tLlxRJC)kaQceiUhT2&7K4tM|#fSgKQh=viDp0ct1`Snv3C2zir!3IW03e>=h~<#cY(} z?QAvvrQd9%kmBOZr*S6cn2m6+j@UXFffFj=zpdPAC~R^$Wxs_Uee`N%(;dTJU*qjM z2<&rx5^V&o3Cdb!e@|k2l9kbH(r;6V+oj$b5Jf$Wo0?T(Qnx~w1@SjOK4_z7k(rA$ z3X_Qe87?aqZ3phMUaXEF>mJXSX}5vi?dEGn#xZXKta)=b1uJL&QK;?e2%0|qT=3~& zHJym)ZQ42wf=3V2E%t0b9iIhX7-&73rj`!3lP zUJmzX{J(=6xz7-Kk*ft&ic(7C2q{btd#uU5lCYgq5$n2Im?r*jtdUpC(?net^1Heh z{CxWl0q>gC1j>q{dP%VYLO zx1YIuWsefhaGg{ZZhwZixN`HI`jz>zU!UGnn3nfzI1cB#FscGMl@pT)8@%jF{JJ>c zl(6&yaYe3?NA`!sB_SHBilSB&2-ChMoH3@6+ej;h=m|gCF*`~YUx@Uxg(eZxKOeN1 zpfi#6AH}_guC+@h<4@ZRLaSFQAguPq=%a;AIF4P-;|t4@oyy~+D(6f`W_i1JB!o`I z4xJ|k`dw5Tk(qIGROx8gobZ05aH;FSwM{-Nztr8H zhnhw*4x=GLpfIX4qKoEuSYZiFZR4gz%8Pw;PQ8+HE;lI0V6m26;Y46r2S zKQ^W+X_HJA_E9d^MXt@SUKOI0O4YDQJju=~exGI`E%_Jon6bnqq8YU?I;_Eou-dG; z!=%Sw8ctYdsT%WLYU;PiQ58;QysVKvU9^hvUZYeCBzFnaS$K;YRAw94ocFBfw%egE zzcd{k(`H34Ec-Sf4EPZgc{zFGT{&8Y@3LT*wd~H6oQvh;xxJt4CB$71k6G23ak6{~ zCml5v`)%zgne}z-Pt3q&(BdVX)sBU~T}1m^1)!$5$G>)v+3@`k@ZUVU*I9grc20<~ zVUJQy*bW|7{)A1RS}7gXQ6rgq0$l=yk)qmc4PEs)&BCs^*5y(w2TWM^ugQxTQze9S zy|C|K!YUkbwiz*$h8Y_Kh8k-(GdB-f6i%0rXi9^q<&sryZm5X1_V%1PWE~@)#lul@ zSzHl?DkEOu5OQZgm4P|+22POL_UOc3<3spjO`-B#d~x@>(F-6S^wPysJ6Pf2BB{%@ z|BS-r71%b9lyg{JBeibIw%s5XNxPi0s7A~(j$zj9!A}@Ii1CkYbSMp~;g<&YFC#Rn z8=Z<@X`|h>=Oa1da81#AayJ#|e-&b<-k~@AI@KrsXZh$=%8!t>S;@6s>#2$4=jN?e z9kt_co&v-Iw)}Q5R|c?eP-8TIxK89q@f-q$8L7-k&Q+);Ehb!@LZoSb{QOAMO`x&q9z;GT2;AcG9wMN7~_cD=qM7i^~gIW9t>kAH@!jm;T z2YLHs1CWxOa?0zn#8oDRSy&;g@~#OG zOTDw-#Y^Y;Z|0v{Hrv!uN)rRL>YTcv$4%+sRS{@(;a7|ajH`_e`Q-R{>?&g$VI}@w zhtQ8NB+wzxFEn1bKA0L=K;DyYog+HLHuTRUB8l%+s50vr&=Twe7yrVs0dOOG45bMBB{ zzO0E%7lVW`(j8iX7L^@Qz{G|Zh`l}!TJ7Atr^qdAjZPzx5FTPVJvxqNe!T^<=sheK z|FW^v+I&YB=LSD{mK#tN~nm0<%%SX zjX4{VL@E`M zRC_E~pn2WYQ_IvDnBhPlSw3H6fF_&QY^B?;AUAfw$u)gvfw3P8!XQ5NAs9Qp{`8Im z=O7tqX*8(!gUAT630d7P(I5tM_+FUPi3{Jgu3t3zqF8V#X!Ql6vAq-5`{)DkHlH+d z-eQOQg&TkE?M>W6&|SwT0h`PIqT5Sz1dACKAK4&eoEhm?bd6NO1}T-)=Tc}5J89K# zBb08r%c^YEl(3i5CWzPnG!dt(h<>bFoU0*6oGlbyVnpaKk0L#-Ti3r``>tIN8K){7 z0s+qatJ?hBS9=)K_Ze$sxWlO4pG_eNi=ZeqD|u+&3Bl`!BPfu0&v^2|9YWM}_plBV zeY8FXrY*BP@Z#7jLVSuif(1{Q!WWBFcmeSs_mos>ZqzHHrG-SgqdBT#Rd-KS-wLg> znvmb2!73#Fa%iVdk%joTIOQXbI5YFzF^rTBpS+B^xy#J?##3~J`$`(WMar%A+kO#e z_tbBFa(*?%K=hJk@%MK9`p$m5wVo~F&Ae0TWh!>P zhlf|F5}(fo93wNug*{Y39$ci9E|QAEW|>gX(&-9u8KNp{7hEI|RcQ0M<;IAr+nF3r zK8P^V|2j)R5%jn(WH7Vtu*c80eKYQaQMRsRG*!sXPNfJE?EI;)g9n%T)7*t*?H7pn zlm^mgj2?v#ot)Zyc`V&Kw^Bnr2-HNBUNAiK143dWU_RT|Ix+5_WYp+b^ z&vDGXEQ^dp5|+bvE|e+gi}?7-5&jE%p7)`1i{g+Rw5Nx9zZTC-)efx6G6a}0epzi` zCXB{-E;AOOyC7!*o2#9hMRym-6tIR&2veY@NegCMI^iiH>rLNZHBQ?R5$sAam+{ro z^E8wWcGUczx(F_fo~x>it=nHJb}0Lk_n!#)REn+C{rnY%6UA2 zAI>mljbHZU0+i;(Zlhg*<>E;{MtBfH)`|&A1-7b%lHOeU5CH|5z%Bh3%%2x*&eT!z zElM(PjH9|zp=M%Ip|VXf@8llhZ5VV!{QuNVQFMOo$-wwO>my&^Fq4Q3Ha^OQLG|&A zC$`l_e(}2-OM3CM9LS0r7zn#HH6!BH!`tu(yfPnT83-~$^aSd;O1i$fXI(*{!C4om zyg@;QR@1?GNbvMVgiM*!lLr@B<&{*D9*SvP6w%ZS8v2AsH{gE@F()IZBFih002Yop zA=`kNuY@V|3eEQzZc#7^efh|^yc}o?O)A0&9H;$0j3{G7LNs+JrAZ`Hf98oao#q-H zySeaAKpra1v>gnrWSjLW-%}>2VtUY}_l?@Q` z=eEzF^@0x>ymR&B;5g>v8o*^H?8Uhy4F;Yq#{IXi87FP~al8z-HvfKde5CVDMRX`Z zW6Xp>TEfWxHpZm4BVvqNg_5itJDO5j%%eAfS1Y#C&S5EtiuNxtvKC5C8bhM8=nlgR zk^KI`0ulSId*;T!D8r{437`JBrw22A&8SI*=jxe>oxi4)LsD>u`Cu9fs9x@oRqqtG z<#hRaB^-ToaHtL}FX@C-s1^iXFF|fTyQM)*zK^|9&y3Y>A_g4m99-2zy;wjITK}_1 z9EMW4856iQj#8LS2+MF@*z{%w@-X`=S>W}cjxYGf*`2Ox`Z^eK0*Xe=$e{~i0ubuP z{-2by=g-o9zqZarvIA%+@b)N4+E+>vtY`@rpn;w+{H(VoW~>R(pSjp4<}B3VQa@R* z>HT!?@7}zeXQ~4Xq=2;N1QdBH{%T1vz@G|&-RC7UG}k({G3ikYnM_-$+U81 z3uRnt(<{eIx4XRFzqB|ekDqH6AWV@=YGFHk5D$Q9UrBcwkKg5y(qsJoTB)}~$z!m@ zos;*h+djN<9fioNLaPt%Lg5?~AFyk8}93oj4R6q!Li1=Ng z&90SEZ|hbjpC;1e@9a-#?;(s3d#EHA>TUV_Q2EeRZIlOxXcTihw-={QD?`x6W#Dte z<6t+D5PN8UvV?CT_}2)nGYa$ed{vvZqzg`Zm(Ln$UNfAOg!#~aL5ql`R*@hqxdd}*~{G<+OG>Q*9BG+sHTYp-n%>@Fu`4Uo7$-_bJj_D1g3NKRw?WM9slpj)MyKH)O|9` zcmHkXFh2e_OLtq0d^?hpeIc_Xg8YCL#@7ROI(hNEZv(D$!Mlw$A*yoKl}0hznK)+csG zWW`7S<6*IdM|<$-dTlY6->uswiOL)Wg7~)e&b7oYc?tNiF&=BKY(>T!t<)eFH%1zW1AVgL0)X^O*l=*s})zGOp}3q+30l zHK!9Keu)U-5Z&?~-}4w9+nz)zlJ3@PdICFBtlX(U30{rd4h(L9~R64$@Yy# z!E9a}+VP~P-wI%TD$Ta(#tKOVF8-9+nM8E<&m|F8llbq*jiz#*>ZD@pHh?Wtofs%UMFP6jG z?#;?hhXX^d+v~9duQyQ@0SjWHEKDbv?@ot;f2jYB#wg0qtc%H@jms8X7LV>XS35$s zuSL0C2X6GA7DzuW6f~rOGEO;>0&^Bx4`vKHZ&@)9*CZaEdTalwE_CTXl_VDzqI3-B zN0TFt{q68i6^;GQ{O;Pfi<^gR23)>j>+C8IKkuJa`QbS$`jEbzY2YNB15OsNCcMm_BQqh<=8i7u;S z7Q9kcu?~so^nVhO5&9{ag<*HUS=Vg%_KmK2$2)7SQ5e;E{K@fxe!HBu`{K(xz(5|V zG8wdzLPy`*8@oWJqXw!0k@SlLj$8Ib*_Y$(rg;7e&qSSJ+oUWT&aFntX#UkU9{RRk z@&H&y->`=#{&KgAgZr^Y7ZVh-$;BG)pO<{l>5B1`77@nS zitgjmX&0fI{vs)gG^3cxPzjbaK{`(qR|3x0KaCUz(&SZPPryy1 zKzj4NbA2(4y|WkUt0Q!}6m&XJI{|mhv<#ikg^)*=)9$y@Ki=j{B~@6UUb53!YT2~S zM(sEIch1Hm(P!oi*+vU2OYZ*H9=vwY&CkYRTxah&2tM=)D<#N?(dA;uuL&-K#=tve zTmqyAPN#rcC?Tk+Q<;cJsffrwi)CmgO;FQBg*Bb7+3wC3*{C&Uv9i`Id*w0Cy<}_s zne(3n=Z6y-Iflbn?})?l#H>5hSYzthd2kzgILEkmDA4oZja{gN!Zu8IjyH-4%royN zqs!=5O)z(tD?R&b9;n7Tz(-MQ9HeC_DoVp{Kr*=oXB%fGQW}TCOT~itTj;n7!v_&j z%m0Kf2lN&)iytlhW|M|nj(jBNJSD zZH^wR<}qT+VV3D3mRPE3%z^GT>rK}4)pK&!+(cbt+J!oYVOLFN#B!(H6Wur@WTKsa zvzqv_d@^NAmCt&~K^*0tv&YCH>+)t%&dqR(hF-F5A6h#2nn&O?EBezJf5lP7mPsvW z%L*Wz!JWGn&@c62S+{Qfd!urwQ%X&NPeAvV%Yum&m!#vS%r*5AM<#2IRHHVXTrIjZ ztX93as+N9T_t|LiFO@A5tI(2p8o6qMp(r#BB>jdKZ)3U-fAu(?W6Hlkt-s#2+4MFOp|R`c%&aBA;*xSgmA)Plvq^}3 zSO5Qddkd(lx~^>)L`syFmJUI>k(BOk5Tpg^Zlnb1?vPFa>F$)0<^YEd>F)Z@0qtLTT_ugx+Ij?!Gx#n(%ai`9s+c9XA3!QJ82H0lxy?{usuJKRruwulE znZMbi#|!)rhIRL}sj_$m()mO_e&tO2?P1r49Hq zsj1|1oaEMZYQ!JEZzi(%l=U3kyOk5V4Y>DM5fok4B`aMqhFyHIrn)v?86;Ipc(KP4 z+sKJ^P&l2@aRZs29Xsol8#-3gG(SRVS8EYo6<+d%lZjO^vbHE~GoIGWY%#=g_W!sfjpaNYjdTMBzO|&bfAJz#bV`xc zhb;(A%s?VPX_$Dd0U5}Co`I&nQBvM2zaC9KL>W-9Icx7^>#Rdm%w@y}c)V%(VMVGv z_C4-Yh_rHM2R-H92Bkri&FIHT`k_>$mW#JEqlSvx+NpT&vFrVNAeCAIYm+rctBb86 z0TXVHpSmFcpy!xOa1~+di#cuc$^4wFPVwKe<@K;X;Y&i2=zYTI1!yIn*`{`Tf~DrNyT`@#Q3D>X-u;?I_nZ&!)bOr`7YWG4|6ir%qpgke@uHHFzV^ zlSF!rxn1gsQv0JzM;^jzAT0E~cpE})QW5*HA>imf% z4W@L0$8A1mcF517wi|`IuWyG{J(Fk}+D0 zFn5+FBid3r;~s**P5}?u6!#(E{ns_VD=<8@nH4t#F0RKqr`5&4qotdR$ywf+ybR;2 zruCxRx$7N2)j3(C)JvjCHqpszszD7Z(cZ*9Jh`v_M3#0oU+W^$^Rdxp&5A+ee8MBoGz z$Il%fM0#`b1$CB84$VXx$?4p*E;qj)?!NgO!hE}$~F!5}bp#dob_4QOE#B5T+ z@BY6Cpd!bv2LhZ{Q^?SWlOa_Dz-M+NC74Eg#l_j8MS4Q0K_ov%gl<^Lft^ifO3}G3 zU~6R1RNYz?`6M)>^XXH4mF}l};9H#asY9~r-rfn7A zk+vHHsb6cIH6U?xrLFSp3JhC?{ScA^j_+qKzK&riYpRy=Ukr-SWUe>aAnm83m-Q?p zxhKTrr7_-4+$YHT^Lm1P1G-ap!L*SUA>N-~pex>n1x?Q!3z?rj#kh_l#blj+u_okE zUMN)`xmH;N@+CB_Mo|rmdJ~qc` zvtBM`)RLTvv$bmg$yBsQSEZF|&$lt4LYMoP7cSGxd0=%S1_xU4zl_#0)}3KbqJOsJ z!-T`eST@}ogeyEZ><*~sJy4yfhjLM+wJwQ>A@<*v>N^#}a>N)#9JgM`tm!P0AyK|= zs<7H;1AgVk^H2PA``G@63>70QW%kCGay(MeF(t*Zb@gyz{}{`%4>GLr#ELA>zp6LM8>jo>^}%cerhWGIf!W+s56tI@^gSg{{l7 z-q~5oSUHh&z>EqmR#z%Nn_=0acazF&D&UeLOTMrBmla$uy1KJ;aLj~d{F+Q*Wc)Z7 zVt3sz=p5>`nr>J-Jj|dZo$MKfSsfUqAZ}TUuGnFGEN0`e=n+m~!2LgE_&E9&b$z|5 z$9syP>SFg?aCp~G{Gu@QoRuQ&B9J-{P&*FXuKWsD99M#!VbD8O$r>1+zNbNOXeO(! zlXoPJw%N6Bwr&dwY@1-%iqn$z_>w8=%C zSEW!RyY$r}v))Ou-uC67JU4Th2zGC~N7VlE>&}6u#|aWfo~!Rbl~8SF;M{H`z^s^n z0LMnSw+BD|5KRv&!h6^{Og7jiI@77>B?H2bcIr2Y6%@i)+H4=<#|^ImyLL}|ej!tj z58IQ~L`I6aZ!ouhY}s-R@b@MHHos*9@SOE0TyI!l6#X;-8CM`!tru51JA|PS&z?Ax zsr^&jR2|>qXpa+r#AX2@7<*=rf3QWJHi>z&-jU#m$-zqF9P{ay5aFYh6c66f0Za&b zidY!-8uh|x^k`Ck7DKZD3c;^x((eZx-!7-iqcfkxMS2fEk;qa>c>IxFn)aH8qsE`^ zasUF^6LcHWWhyXqXQNWa-?d_PyVzWkf7!fFIz~;t=x5IIjF@cXhm<4eY`;>#UOHWy zg>Bzgp_x1;sY~j5oI+61#$>-S)R;hi&>)_&n8iHrtC2+BWISGm`DDe(wk%De$kr4fPMOt&g;@YY ziNA>VS1F^GCNNnN%GiKROM^)_5|_cQ3`V3kv*n#I&o{La>X%|qFfA@68K{IAs9>^I z2wQ5Z$Vb}n#v+0a0xUb&^Bk4K3Ry%ddh&Z-SxohcwPd`6yq}Lgqgv%+UDL>Y+l%cG z{%rZi{KMI3vzV?7jWk-F5LpJ0gYjY`pa?3Z+Z|0keERFQ+FUlpNj}Be&{Hw`Bh0Bo zUB@R=7gkwakUEH0Tc#T!XU!k?nO^g{uRdziDZocebyzL;_p^|xDYLEK&j zit&EzvbvgEC2p80wMATO&oc&ujuBJ;k^Y=U>gsNf``YB(${**N2BpHEE-^{8FM?-H z$zgGQjFZV^y0WW4C9+KRdY|aZZsfcs3NwTB*u1B2OKmfI;^HvPhkH9I-l?Vtl~r$N zkE6WK^x}LdhTWsS`G;ovaq>D}-=p4^DVikPH%avIyQ882b69fcI{nSJa@%1C?Phj_X2$(FsMH z6?Ch`h|>s7W@H9k&h&n&l0|K{Oij6yTfb&Us)YoaSf6G`S7@M(pQLpD>kydO5*J$x zd!%vmg-mS*oFshCbtEXPr3|bkaCVx%aL?9Pub@;bODA+qrcZYi5CdAaY~<%}w1%$A z2krk#Ppy1-ogy9*L3E3~hR>jMzF0)DIVfH+dsc1A2Mr7~3`;kadOuD)RjD3bG`G~f zHIpTp_vqUen)%9flj=L|U7^9gUU(Z08hpjuHc2=Ey3@aTWSf`&vI0&Q-eqLM@e)hz04 zuAoZ!SW6nMWB;MJA_tbzyB|p6_h{iQ^6_41c)5eovV>dmxc>Q(JTLimrhUMW)H5y` zk`$P5V)wsT(%N-g3t!1*^-6N+;1Pv7Bs~WY@zV6o_F|&Vv*Ax`Mv41 z25D>ElOi1=FsleYGvdb@>x}s{ry%GKHDrG9 z0eGgIiU}}aiV(UskO;R(1VFroRZ)=ai3`BG$Us-iT)O`I6oU|x>+sv=IPZcI3s6LGQ ztUWW!ya8rL6HsNxQTp8HenB7h?66P9TueeAJjQNFNZbP`Gi7YdP9788enN;(`qXPH zGX~>(gZva|S8;in3q*@Dw5R*QjOozSoW~0^0jH@_-Nk0ru4I4#@0 z*SNH#txYImE98FTq+S5(3PX$8=tF5g6r=cU15)3rfvU)2+{AU%tIz?jTkyDK_KWZ2 zAnus}-o&KmA$7p6jhFO~9%~}2FRn#OO5r!vl z_c{0kGf)6h?Qt^Zk%}OZj)xHX!Ho8cFM8Gk>ijY%MpE>gKc73}0ULP4ryMr~*!rZl zlInN9Ocz$rk`=YvTa}!3zQYtRz`;`uBpXXGtCFH(eEY0{D}6!+*^$=3b4fIz z1K|~=g3Gk@VM{u!J3&bB^wm|!7NMg&|Y*=~>e^Yw~3I~0QY*Wc7WXyz=^Si(dC*(2+J| zQCDY}vejmRzm|kkoBIXXYjtcVUr4{icMJA!mhBwufn#4e>kwZ*Cty_lVgAiFj;f!d z|3d4l#tycTvDg+&L{Q+(()IkXH9`3o)@TL(ueklh#dF(O3s2?%Op*Mi7(NK#Nr6LC zYqwJ4dfES$Pp_$qAsuXD%eU+>sUcAzNqe$ZWA!j`bPhSCh_(E@YSU{G5Bi|@|J3vN ze(%4*1yOG8TM}V9a>=sqoz>mEOenB!VmkbE9q|6gsh(f$D1u(j02CtPMcGA#S@D}NG&^y{LC*nZ03uMR^<=l^0ED-*mr zTslFUI)wn$Y+>ZuC*fnv@pI!J0TYAFS~b78l=jR?VGVR;{q z+?yb_&BAVV`3XCL>OvgiSJB8eyodv zEHw&9%e}%VcDuMJO#~ZTpC5sf4c?csY`FkK!C|g3xARXMT5i!1q&aG|`gItsbA2{_ z9>1uW&WCr~u{PgC{G^8Pi4OuVE_6}%*pbnV?IV7o*E>Gn%ICu3PS(=(^->JffjPlJ zC)Xpr5^*bSrNIf$(K}Mt4Z(GqmhFJx#fbCPBs`^in=~gq%3L z0gaqlco@|-YF=(oPR-mQ7T2%*>&S!1wPf?r2*p=({v7LI%OHi#aIhl&R>hH^%yfa% zX5g}{#Pm)xRDCFb6?_yu05m8au-QJV&*DeggdS_S;i4dS5ueTe(1~z61FW9^cFHgf z13rmSPtaAl&oNo)&riGO&h8KwW>2wrw&gkDap`!>oP%*4Toq}7H@zJpXy}Sj`wTqF z)oNmk{XBT{H}?Fz>5wKb(^z>jbiM?`egr+7BRIx9LGob=!$&202Y{JQ2zvA*KO*lP z%}-UmFVB8aznuL`@E~Nl5W2PJ&?Dcb2FlbGMD|^hzEEGf<)l!K#lKrj13uQ&856Gx8Tr2U}7WNir)cx2xC6YHKM?NU}hu~MO41imB~TPx0zyGoqXjAzt+crumuf1BS5`s`s|xf zNUD@p5tJ3B+x2++6$a?I#D{8nFN#tOJ5MbJZ6GlU9iGNNU&I?WZ6wA^X=*g6(=d|t1-}KsK<}5larLvW`Jkkb-<(A{kjxIQ~*f32McFwMS*;AL_+Q_N&j@k1@}I7={kSGZ?gjp(|T6{s3eGTR@p|xP0Pg1|xfeGGxsw zM>Ea7Puq=^X@i&4GOK*XO*9PM=vFU`OgRv`AA{qASINb*L9{3ge8vZ5JO#QBhwY$b znqUmLdwKNjJ4DcGAyw%dH+~Brs-6@W9CND8q=KZ)@C*)ZFNU(ODr8eF{3~9)#Bw}Q z2Ww(2dWX7&@Zz9T6LD;a9~L2lR$cmV!)uL`eB4AKM$S7dR{7FAZq|?c#}tYuZB0R! zk)~Uue5Aq|DlEs>g0^G=^CRduCkqgtfCtOEr}JO#=7M61VZWQDGPF|XIyHkd}tIq`gle%ZWB z%h42vc9fUq=&CoRnD+$3-l)rQf*|97$=NMchn;dUy|r=B&@<{C_?ksVhr3BG+s25! z!^g`TrapqZ9K_8SUYNI%Fj~rR^VOR86}kWSsO||RvguA<+kSeF$M;Oyx4`p=f>w>$ z-M7FBebe^c$SA(TWsYXQ4h?w9KUbSnetV=g)Dxzle-{ z6T#eD#~+y~kw?uKQ*ARL+;CF1-9Ee*3!$9>8nviE?Ea;}bDAKvOn>L(Z+q0#sCQ?pj!G{T;!Y=!>guGf zX?}dy#fJwStMfn_n5dNw_Pl49HgT zzDMaq-NEuwfha#TVF0L9jalg6mipU>J!;5b}taB!@|nE*eqquGH&u@esiwLD9PcwtI#*KPF;=$ zzVu|7cvK~`kl}pB*2qd?Aq}#r^5DLN!uJO_NBRt{ zzlI)z8D48te<;0gKvGvZN|Iu0az-t`llg?$`|%;kk>f}m_llg93s=dD9P`hgZ}enx zf+iIluqzaK2il@^#wiz-lZ|zZbdv5ox4{_Si6Khd{?<@8?aJr^=uYF6XtmJqqXlPz zY9`6`*GtdSO67gnXh_6aD2)RXFwAJ;k#Crg7{R-MFYpHkQ!h@EG4R%bpvEBaYa$)* zp7K9QN-g9aDiC!s6tjmP->S`F@@5cAE%3B5*(amDoDiwO#flXQWlNq9Zm(~_?^r{O ztu#9Y2q}4<=lItJ>v_icy4=@m0nkko7Bg-Qpm+BQvIOrW5b*74zGM9^w&moC49QAm zL|Je&8R)MG3!k!qQnnlrDLG#I?fqdT$_*K=C*bA%s1bAZ*UM(xdo_cGd+yt+|P&6Q*yF%RVutHj_#Xuk;Q=&_@itBXA?hzFCKV^FdB)6{n z7YfDY?d^>v1y78Zr?`|!Rk^99o-Q(xUUf|eT@EYd42RQCmtLc=JdvpiP%C)>u32cm z+YJj8Z+4kw>`ZUV0bdj)f?iXk}!xQ6_ zji7IWvXE5ouDnF9p^Lb|`M~|XKk2Sbt0E+*U|V*Pjzjo(f85KJ!%hpji)|^j#MV1Y zgSw$*Sc94-Y1vKMu?8EI4iC5~>fb%RpWK|Jtq?jN(LBHT%L=g8S3w|BMC@`bu<+lL ztH&llg9QEk=bseRz<28y5*8!td%J*V`0RN;KRjJ$g5Q1_Qk&vcfpHn}(wGH&4| z*i>sfhHu@h#9eMVpkE{(vtib_M2j&mu?@^(Q*{o^It4j{ z<@jhqtkKUi=iRT9dq^baPgq54TzGZXVI- zlvmwD^H+cEIpiK9aw%KeGE5UQ`)(byK#JJanI~$91Sv*Z|81pc>Jkxm)I)D(QkJYZ zqy8|ln!9Vs{^dg;=efGPZC?IiUyD-+?Am|yisBd|GB11a@mCD7tVs6oLYvcmN4tT5 zbgr%We(gV4U(p9tqd0nk8vfuPJ3`O0@owIhcJgWBQU?a!ImKSbwdp(bdR;b%^reszxEGM;Od)6EdK+P`?Y_7 z@?X3F+f@w?1qg=wvl;(?^?HZsU!i#PUqb<2`#Ti+GjN)V4is>cMy}| zdkQ?{yvV%t0XQIj{}LIcy8XXFrxkd6u6aGT;t7aO*!I{vXtVZT>T0|LFv1 z=sw=LW1r=(ywT>5>nU;1lbhSwovNCzIM3S7RNw)KWtWDyx4abP$&g~t$H*gK3{M); zq&HjITdZF0t)EVQPVN3~Q!)GF=vn!>uU@K#`69y4QAQ5(L3E$;w)saEHO=9~3cBB^ zl>DqzJ*zb5ML+fYf4p`3h4Ah2mq&B%3GP^u|7gd@hZzCAX0`2IfaGV&0>u}dZ=f5m znO{Gpwj}Rej^k259!7*h&=lnat;lYVQp!hM0&Bo|0fWIFX<#jxLJ4Q==Lt=l310Eb zd|6Km-e6Fxq<PawR|KlGRGie6grZe!kjqZ`B;dzO%=Ktqb zl<6gZp?@|~W30*lxiM>MN&erBR2XY`e{STcB{8!akjn%I41)kO(8h-Nx4UbrTUIv2 zLU+-`pi3z0>i_(Q!HHlQJswp-IZwU*{Qy22MTE|;D41E9gJpUBd!W)eTxODfv$Uh; zP7Vjh_yltovmdawD)_Ij)FHOynbaY_74tk${K6P)Pn zdwco7Td;iRZGK1K>efSuLGo{i2OmHTlJAf(_Skm*jrc)}e--0d{vErS z@Je=&Rp3Mca+YKM4~#+1a(ofw`iDI+y zNCGtmk6)0t4~+uL|9WfF{I|DY`FGqQAH*Fb|ArX$0mNYW7oi9+`Z<>WaP~h4Mf5=N z--HtQ17onW0)G(-@d2U0^1p=ot6MO}AT$0Y)LPgBi2o+kL!&_QZ*Tn`cng+)$KCqx zxZ{E3-w<~{fEXnILnyhSB$7Xz{ZB%H2LGSQ-~pi)|G*gRZ2Dh>@_*nhNd8TzKf48E z43d8nD&&7B)B~gN{>)G|?GL;K$-fDO@*wUY`8UKO4d$V$7=z^Bgp&SW z3H8t@u>5=Yv_9|_B>yH9{DZiIQd}Ki&C{rvKZ<|A$`xx2FH^JN>uily*H$LfOh6l=zQf z7xRD-fAjyrRwIeejsw3#_i$_PpK<-a+4!I?_`hjt^jD`RMX^yW1mbq_#F%8H7ct}F3Ks^lC&7_ojB}p zu6(WDPg{#1Ej@R{dP}gg`ntEb>hRdriQ{d(R*`#h(Zpe|gUAHvCF{C28|EIdhaE_4 zfq;8$|@j0%`%Ik^1HBP7ftCMutxAozHr}K+lT^kjt1*fNZ)A(jPbsPu4xu< z?ygk#fJELvF@krbG6w{_)f3v>_TD!>!dToxPqya+2Tg`j^spyttcb3Po=ax%@dRB9{0jI8b zqqhKHQmbXJ?Qhrwl*Bw08Kp~Ev8qjYi|=tT5G{h`zKjC1LejoA$Fl(mL*VpL=NzKg z0wXZ+T$jP+GPi5pW7$gBg{@SR;F?FHpKdkOHFNgXN`#;$t*gQ0;#$GwGDp?@O6`Pa zr0i<6&Gj3=Mf<1ksLO^nN<-6a;DsDr@W%>ss^U+$-S7?OJv%i{PM^=_4L60XdF`zEhnO5^S&LcHQ*d)9nXc6lTA${x4#=zQ{Hi9lV77t zr+r0zX)jW2B1OY>b7F5n;<1y%lMx4|^Di1-V+szuM>=%R7wS5W4q~?_nx+%g`-&${ zDMnq6tvS1nRR$Yf#(B4I7-OI|fWU?8NS8g&O%=MLS`p6FqS^ksI`ux<+QirA4yUh7 zSv*eNPnV7lOfEBa%-z+CCVI6UcwKlC8TYux48EH*ebMsQ)-)!MqYpA4axzQrry$VciO zqnq}~+u!i``zyapRml|Mk0Br?o4X<0!;C? z*u8qJwcf&-AGudbFr^%~h5-24Pudf)-5RW3RH!YQWAx!$RMqh8*A|HEb%cW>(;{`i zvA9EbcLyoQAkW*_+1A}Ng&wJ<(;!XfQ+3|zp4fBJ7FuyY_ta}R$hM56o@_|cN8wj! zd}0S1qiQ?677M(W0ep_9>9I_}tE^Rf7P0)t{VV)WgByktU!6yw9e%7ZcfJi|)v@`6 zW=rRCspi|hnO0Tn_QuPppjPZrOZj3?C~YppqChpevgBaUEa6fmRJjYg1DP+!7Odh} zP3fFERPl4Hsr9d}QNn<=ve8FL8WNkBBY}F^%9ClKSOXzg13u9bX1Y9dp>ea_zRaZs zWRHZ#k%BkA(s9(*onv@jp2N);5W=b%;9`Hfb#1>vQY(H9{FxQ;jsMEJ{VMTi4Ags0 zLzm;C4e$DksoV-Q%cm=wE@+Oz2xFp;{hZQLi1{XVCCQqP+7@Bs&@*dBC;;m=PxqE! zzX#%_cKV3%Qv-4-DG#2ezJ`l2FxQ8Er6*ek^*s!ziSw8Ow;zYQPtW8gZam$l@emYl+(34-W*q*^IWJLITQltVKs#eXnclEX; z1_p7k=9Qc1Yh-~|Hr%TM_OMYx4&T$4h;)-Az}v-)1}5E=2OLzCrqIN zWv#nQYDd+Yp&dt6?0jO48Kk^?@ExS$LOXf$OEFO>n9K{%gBglJE?LkdqZHDjif}5h z#P}mlA@RH1LLF`0HU|Q97iW-~ur5#MBt84SFGZ0J%4mzth6h+lBZa}am%3`BBNJR} zFNdsLd_fB9tz6bBArY*3+!jw6hvb8TM{^Mrj20t+Eg)YG*O3!%LCf(>Q2EV}h3ID# z&K>XNQA||-#SZ*5pV&B`Y7P$p!hIjPAc-crHt4xtG&msYVdGVCm#)S%lps1MalqcG ze<%|qymcz}+E5$YtImR`XirGZZ|`C2ajJqZ9ZVOv)Ww7)aD?};3nt@=cX_|gDi+Qt zn=0df7+1n4m5nxli!0f6k@_fo+SmcCSW(f5$={SC!JLOo{YZgU1bGA4sPK5yxyy3J zRy7THLaQ`fja@$DJ8sYB)PVHtLuRlS-IE2LTk_ABBW(NtOO{FCO7<<}-}y&5?5E;S zQ2u#I4*>y6LEx{9+t@mp8ra-@UtB{Yw15@)=9T{`J{&Tw5^5eU!ZPP=w;gK17kBk2a_q^8uk&Y*LlYu0Jj) zhB+?~CZtH*afM!Z>Vs(K1v9B*ijERz5Cb63S|Wz}Wm! zS=}Fal3k6wly6`2(tU#YM@J*aC80Z}T5}236L-cY_BY69A!~6dOy!!JQ&*~mZPaTd zs!*i`va?SOD#=Nuti@Zenu~z=B8jlW4m1;X+#_XvH`k~u)hOo_YsU;kV?XeJ=D%YU z7wD9Y={pOSkI3>XUA!=ewf0a}tHxCoxORPpPlX5nV@wf-T%*71Lef23!5}BirA#T( zLvf9gl>PG$3?V(B-A=G!g3M}(OL+sj8-y&A5lu>23L7%PAkvnI+#Wu({#!)S+dXrZ z95tWPd_6U1HD+v-a(#Z@wt|ZKcg)f3Q4BbN1#o_^5`6O4qD@>jtozx<0qR8njQ)C; z(smUFbUTSJOiKC&9qW?Mv?_=_vIFv;v8!wD5z-VF^RumiGZj4 z#Awy?HE<6z>${|tUbDJ)K{<}9vO)ote&T2}$uk1#rVe>Qi)HRK$58^p??p+ObN|jj|K=#VA9vQ--cv52Tn2x@i>JEJ4yCJB zf#&@#FX9~PlKDUneMDC7l*~VuwSNuied90{W7jo?4(pITS&HSvht=EJ_+EJbLPU*= zLzL?=Vc`!P9l|y29;7C`AKxw1)G(sD9)?aa~QNwkK{a zsm?{B8?90|gx;08bEu5lQe?cJo`gkB5oxV(_I^6!^@J@*nMtkYT(L6cWg%2m({nP& z0iisHX9X|hncyCE5j?$0GrRO$zeReslBB?CXV= z1#Q15n0dFh=d*3ER|Ysj#J6wR%BXW%E376|;#Fn4Ns{7ualOky<$hSfjj;B3n>Th( z8ZXVDnrJHvHRSl>!U26j%2cVMF_0oVUD@qAk^KkltYCyIhpJT+FOB(m_Yf9;-y#Xi zY`|z8H%47a@GAa&+4G*ohvLwi!UsOxP{^^P}pc?cwe!Qa*{Pr0!=W(HbK#wl!ozZ(=ow z=>++n`br~1z(eT5zbKJw4nie`pbj_r7-JS_4}~SkJ>7E0xu3U(KXTEz&zq9zvpx?`2*HzEl$=BV z?I@-qtaTX1O(E3?gxLKTi3$k133E!M_7EArbq5<3ZQu8R`Ghj(*D^uopRG> zL1u+yPHOs_crS(sNRl_pQ{5w87$N$8QyI3QxZc?bS5CIO9G-Hs{_*`Rt2dt1B*qvt zStMLaOn-#0nR?w%DOx3A_Erztq0)o}OT6s-ipuT_dm4+D?h=6Sk|4$c&vJnb!kFa? zvq)RO*d%~1R#CYbsffr3^xd(OxOZaeg^PyXKhB#l(uNsT~GS=a~Eo8P{z&YnQ~221lnZsX<#G^30mHPRmR# ztWV9J>DDm-2(?2B-JY}Q80L7+nGjosBscz(>)7{#)k)~=Y1--+^-^s)lxj}ty?#LD zo3hP1c=Jp&PG^}e7KR45D%AW2ei^F-WUW9Q#wUfJWz0VlEsX1ak%q@DQs0Z*1n?Fa z2`K1MJThS>T$D&DAh}%s64dDWI=D+>2TB@nhN#yt?g_bMB6Fv7E5Mp=X@z-P>MKJG<O2N7tb0j5Pfo1CFe>X zFvv`t!aST^wkmMD(&wHsx2W9IZs(}kYZv~pZMT=_Z(p+(a8(IFhts6tv<)DgM(va$g%;oP~Z3di{A38tnfQQ>B@Z-AvBf%3CsHZowq>6bk1KY1S%0el7e#TuM{LMcYlGhxa+D10t5G zWIHyLVD^Cc(=3ALA;EMmqCJXXX13`@+gRDJ3&IdFWVKe=ml#JYDAS&-3|IxW$MLC5 zLWGrBlP13nC&yWl`w_C`&(?Yt)&~Erc?%|TV+0HYL?_{WIRDY`5%L106jYVkzBe#4xL-2-Hw9(s z`R?165D=pxPQ<3gP0AJ8^N76 zV*9ONqn;w0W||JAg9_KYOHAtlk#)F8g+zo91Nk;f{=rNL9Fse42J>Y)k-v_!>4MLV zUGimq4%L}E8_M&kIXY1aWS%5F(#rMqFh8lwc#KPPrc|)Mv%>jKyD=#IKL&Z9#oA)%@+#Q_hUy(;=I}LCWLJ6 zY%K#=y=K2<^o#SsO}@3MRt6iU=9h+j9!$#6%e<1e#= ziuna|@o3D0fsnAHq%n{48zn_(HJ4JI;m~-;H0g=uJA#VXea1V#Vc0d?Y&~fr#y6T# zs4GbGWB0azmziJvZ`;q@erJ*$e6BYT|8L;xL=jKZph0mX{`3hA6gYQl24`~<8QUcSA*resl3?5w@k7Hd%n{A9B&=~b=m$V4x}Z_9H1{~YK4tFiCZsuGofjbxpb}F} zrzd+2*CCG?Zj`LlTCA^Ls2*d+!o_2u)v#eKs7DFK;WY7aaPAr+h6fC z=2W!&Vjw?eejH1j=@gPfKuZ20hzt!}RO(@$?+H6uYzNx9l+}FN;`piB z0i6Y4fZJb2HFvd|Sub<(Rv$>YeZhNFOZ5YE_VmNxJ?b)iU#W#mU;l~sSi5fS=KQt| zr?=j_l&MBhYVio3$e13*HY2BTS1@Fm5({RQ5_u_xeQUXa-z~IKB#|*@cFf_BveTh` z`$?MvmnNMUK#%|yElA!UN%%S3^^h^(EBc~78bU*p)#1>R|GDP1iM?hMxm5$Tpdv+_CRfn-LU4i!U~KN znvH{P3*=-V<@QGZ#zBC`IZsPv#4v#pL@CDJ${fG-{AFxy3ntUX<-ta3Va?`5D>h&f zEIvji$U+*q`eK9%Pv1~!1GOw!N9zY}K>;t0WnP!?=K=9n`OobxD?tZFw&XtF0xBKD zQmvh!PU_NISV&;0E%5`5$`*uNV-TJ&`8wvC23dwQ!-v?Wmc%?qowpNNisw#f2`$PJ z!@cLzCACwi_>vd#U>EzT?WCPL(v@@Pxa zHLzFG@jEb64e&8iZn~z+S7jn+l{WukEWrMg;a-GD&2?bjy{>`83FLqYckC;q8DtPNfVc{`TkZtLmVPBDAK>_v&h zepw1dxBifhNp>7{U#AB`PQZ*s{cn6Sn#*;Tb2uO!*Y;fu~zqvl{L+ z1ZXlfEl)LB>EtI+)D8(opPp##o-J) zUwbT)9*CrqASzBT1y>}gEAy*t$7I;>4N=#&k{OYiVwX)=Ey2BD#i6p0b*U{Fxgx^m zS1B3Uuh?+QahTMe&_g+KiP|F4oMfO?p%ult8o5#XOHlaN1Q z|DQ_cX6I<-WNu>O?8NZDU;is-r(KAkY7|fYs_yQCV)T-)A3^pAV9EAcckK{wah0z3 z^4xK?+eD0otZ1bRYa%o0;9@&(AwnhlrW9;Em-xHIp{|bGMhgiIoQf|D^78A=bWX(e z(y`q5>T~_tc?EwmLr+J=$qRqCyW%%DM~d=;p|0OFv^3*cr9l3PH7wEOKVja=WFc9< zml!gK`u!Bgt4ePS_16D90NrG*lvm5orKyzGgV&oaEGe$v-29#z-mP`MOU8}o49a!C zo|AeT(v)&6ta&qFXb`w^EAn|WvHZ#%sefPVVpjO@ zo^5_j;V)@x50JWBr8c?0?ohucVsAEL7kkdvb9`z$ep@d;51-~w_IQ@_>1yv8a#N$* ziE*S!_+I?{;!6|0J|beR>Ng;Ik;C67YnOqvT{a?mMZ?-AlZSIh(2jB#q2T8oU-L&z z=Z#vS<U$t7tF-_W`|riFh*_NjF$STefgbN{)GFkXj8Lna?n64hc6;J$A^;d zL$w)c((nAJMl#%{=)=m#mcB(5Z!E7oLdOaTsl(U*#ksq|^-0&S9!;;kWTU|)^FZ!! zCHunNoYZwKbe?U8$C8Z1W_@vywE@}(F2d(&-P|$na)|(-3D#L z1MT=o&br?&O z71f>3vQA^k?rh=y+8SAlC{fl(qV8zrprn%-O?pywOpnnI?%&^Jr=NtF-XF4aHe3j;7RlCf#!tIaVbhUThD!*^o zG4`XpIB(ak6E_#I8lon%7~&XFf#|>sdysFj=!X;V=9$4xRP{qUd{12(F>bM9^Gi{q z?&jFul8r9V&sVYHA_zWa{k7WyNmmBA(d`lWsdLz$ovwE}farTKH_V1%Z_L@0dtk{? zdUmmqXZrc*ymO5Fq)qqUY?OBlSPj!wRKz+L^y@O)AEfixjPn`5Ix$h3@J1(t>x`FP zdY@L$`2hoR<2eBl9Fbqt`}=WKQe+of)LX%ePn7pN^wTTM-c5_m2O+P#t!H-jk%!~_ z4XaL@_wSHCCqBN$3tpeRm&4+?=}p$0ml#{zr`M5vC$pJ97e4b-9>p0f|9!HhZ|Z3z z<0dXcn9pyQls&}zUA-{t+x64SzSHHL@D>GvhCweb1RJ#erSp%)Z(h?S%#(b43IuL6 zYsh)arRwC?0oe~vt~64CS62Ox1+@HSW9lZ1KEkQKv66MlXxS?A3kZm>0<4!}YLaQ2 zq>FZA*?#dRy8PHOeuXktibOIkuj}Gnm+<-RfXNVryp9N z=l#rONe6F7lzwk&W(3m8P9G7NytVwn3tV{_p47?hk;x}P4BVCv+CJ%*@W;6GVI*Q( zuA=JjcC%ysjr`Nk2f&Kk8dggX_I5xTptbx6^UB+?e!yte!sYv&XpcgJ5!(e_q=IOV z4a=b$kg$KJ{xG)35-PRzKvWX>%mL+HT9wK=2h8*y?@xVNV#GO#l zOY2K*36C$6Jh8AxRhvzV*V}Z!@uPWGe0P(-QNa02C*G%+o~b%Cw>U1siFyuwo*SqL z(z5qmQ)Y)OM)>~T!OLPzvn%t?A%6_$N+x}yPtYRa#mH38BzlGiceV9?g%=f$i z72LnIJ{mX@7u#uFADZGAP=>McJu(@VGsLc-PR5wq{Xu_8`MfL5`YYwDjP|)Wal_lP z0neolxiNVffp{I3Xqk3lcG!Pk`id;b}|ciuEo>5ZjSPttv4dcJr}_7EF>&22%hBQO zq&RsMnhC6$%|lL=8|TVn-SI)zAFqtomc1l9(qbBWlO`yOX(kbq#&Lo5qk@`ykqzc3 zWc?GT{wB>Zw2n|{)kI7b&LlVzOZR6pqa-jUD1QwZ$8m>=p0^mFfDGmTXGm0p=0bJL z4EAKn=gNa-UaJfP2@^81CHd7+FA*@|b{P_KvmIGdL_D0Z8fCp$Tof!$e7HOb z29X~``qLmc04YHIj3}bZTGFHtbv89UInf;XF1`NUKrf|Vg0TP6E}VMCVclPKqHB4{ zQ)D%)t2Ow=)8D+N4XC7cOcY+szG%=Be3S}a#hv$*VqHWD{MHguRSFM4Q;r&3Z>&oE za2=I~mA;fc39-p)*gq*h5Hoa4OdX_)LU8w{XRrH3t7S~i&N(g{?U)eb#G*mgj1`O` z4L)M_TM`_TK`Dik=gaTj2vRcxytXk#Tf@JIu=Px6J<>_Y5HW&ehqcPgC^Ud#pWR*d zlFi7$OYY_>r69%4+j{fS4Bh)x9>KEHJ)KZr8eVCO)9q~p*xzqU4~dUHq+!GLbixU_ zGhQKK!8yo_yipkT*p0kd7e)6FoD>@Q$;8;CiC=^QUr*LB5R3-%yH#nk*~$?AUj{Sz z!yMiLIO42gjM25jIO5oZ>}{(V0cQ5<_zT#ufs6h=7XhZIE6VQ%kD?GHiaG+Jd(+=g z7ZX5uA&ZYe9TN}RLlah~wBdFHveJd4$MK}qE0}_z33=)wo5H6Vi;+B0#xWWPlUSjz zq{b4*{g4!atCl3oXEHW=2bhE?hq5jNs`*eHkI;_O02mU=OcNyBp7=tByjrK8dY zUiH@_>NlhlsP{v*ACOW-Z>`Db5%%NZPbTX{P2*_<#xQdC;D*Qk6y=e=u^RdAuTj%a z;sbOgL)w~83gz~O=K$+FFU>k=ZU1~|BOhb27LvPk*(1T7cf_$i3#=W26~m>zCqqW` zeS8O6S*aH~uFc3=->msSG39=Fi??x*sLIEY1Wp~(WU4+EkDgYhg_%2s5lkqsBdJLbyXO)Z!UY@jlg0A+u+}HL3y|- zTn6NHwPM}r+zCY_Z-F(~l1#a_bfl}ES>5)Np`DzM^|}iQ?l=NGxd_d|& zgk%xAdha_W2ID-)L!~4X{zi3|;z+_;2>Hq-k^&dcgvTI)C7V(EtObeD_E=B}f5Gp; zC7YF{=UFiB=|c30hPFjzOh?fgBQIfRhQ2ZM>}b>8=I*!WUD@cos}K5j9$Az%_$XTO zJ4%%c#pG#VL9UMGY6_(irBV8y@jk-ldQak>-*!OuIt>+%{N;68n+BfX%_?90XE(+K z0@WUbxRI^~0vuz-!+IH6af}rRKxawWbpBvO*WeWa1y!4yR~UN z^e{0bww|bKc^y-|ax>)$)d1;=U521W)P6or2~ePWqCyI3aIr!K@yyFrPwFnM(o-Fx zD8`Bxs>He&VbTmi6KczX)o*RJp1p+9>0kRUleJTQrd(H8STELT?&t# zvR?Y|E1>vJ%Kmm!_=6b!mtWt>{zM6nigri8h!_?8rm%K6PxvWoZl}>G3+JN6xD#RX zf~xs2#3t`JxqG^c|uSg4aTFxtQKX3G{q?7i(*L}CWCeYHkl%8}#^_OYd)AT+a!?% zGM-^+2c;yRMgM5h)dqFBEUg;GTFL zJR!2z8c9KKh9Zw;T~{j{_ec`IPw*Wki7f9grQyoQlW_+5?w^>;u(C-R^<$PWS%iLB zI${1uwEI&fQ)Pnpafh{>U7d1~1D0T-8sVOy?zU)GPfL4Ov+vL-%v0H0meN>W^-?WJ zI-!Vy<^oTu_@qsMwweZtPIMS^_AjTajAD=R=xJ77sH2jyxU{=c({W-}WwwVdMi<`w z;54{72!LQrK8JC%&6->~XF%e9A0ANVpM#6?b26Mu3o?pPQT4vnhT+WGri}a>7kAfb z`IWfe;<;&PBC_tJ4y@`o_KIX0A&+Ijs44~4Q~kiFirTv!P%I#vt%TW=U&)$b6xpr3 zkF!*jM>|o}zKa&CUwu_wXhtsc$P@=EEu2NV`?pzAHL^$_pf;hK@T@~*_CIulv`%{6 zeq>(E?>H43hMMI-YUGn-+sJVrofNl!ezpQxw053O$dYVE{`~5 z)i^~Y*Fl^qjQG4P5RyKR;j2jO=L#{0AjhvrHir(V)as)Q{LD&66VW!Nl_{Vci)Tcg z<6#mAHvV@wei_tw&L#AC(BYm#+L)Qg?N_20!fBJAr9EgK#)PpJ0_ocmchp@wFpziI zGi=iXABtWfO`}l7qQuI0&Npl#_Lg?^e`h)=G~oc1os;?1ZGXC&9BGrV7exA%91vT;11J zUKIndNu9M_vt57j%s6;^YdJQ^DII%{oBYo3%)vnk56EYK@$ifU#N?C?Mjfw@K60w> z{B$)1nRO_LEJ5Q+x@48dKVM+2EGHJ}08Chd;&Om2#I>Z=8gMI&*@iqs(L7?vUYiCn z#_Tbiz{;YGgE99HsnqhQbD)sSfkL9>Q5_r2{Q8o$V3zJYn6Ysv>jq(>x4voDA^PN^ z>Fwbk@QnGxZ0IdN*)v#|^HY~+Wx?)-lj{ART1x+NccXJ)@4QAKUHxZ35E|u_KCg~wmcMw6u zF4MJ;to@9D35J8DoFb~5TF3espKyq{5)4-dx_nSL4kNr$(b!1nC%sWT>U3K%YK*1z zf(deS&nua%!!6$UxjT=DhL`5Rk4#`B-}5NbXGdHDFRJz^{gZQKt8H-?y;tfOH5UiH zQj5F5FKF#Z6(XWvX$u3Kv0VZIvs( zLe^hrI`2XM|65EAF!v>QcplPsc*>bh_2ErI9CGSUa;(bEgTk@7cKW9>F|TiY>Uj_G zUbiD~dn%3t(;KBv)P}%wh63BSQtsrt{45B%ed+BmR`>^mdK_WTp0G|z^mJ86dUG`e zjK>Q!a<1$7C@<#jx7wN}7d8z(qx}KZ0WFMimUX)bn3E}aqAF9s8qW&$hTEo%f;^-a zw?KlOk{ra@_*|FB^b+93y{uZ8ki|0;JG#86tY-g$o(yd}GQzx%B<(Y~2j%X9a)N)a zd-|~GH@CmnD|R-4%=24axDag5WBl?(;Ppx3@t3`;^`EO}5x5TT3 zy7r_$nVDyab?qG#5Dl<#SySuF_h?uP4dAH+4WTe!%aBM>=vxzh4$E?3VXXW^xT!qq zO4}0pieeOs#Scm+032?cY--ulTQ>pJHeowc6T2nN&&@MpWEc#aS%en$@S|GzrPGZj zwwyf>MNuTVc#SI8v6nk;8TH?tcek_Q#m@1&54k>7l zE?rq~`_9owA^m_#r@d4e5M0VP_3hRoY_B_Gm? z|C#k~Uo_e;`ONx|{>)llr--RU@N_vV!S_9D(OT|KbFNlggCX-%b85qD#1}Jzpc6e) z)ew!SXj8d7aF%j$?2`TRiJ5HLb?F5Yod#$*l=^BTHP(~Os%cMourKc2-cNhz^UX{n z5w05>?+u>$v&8n zU46&ilkQtX;NldLAGnv^yqw9Z^!xe`m#bZNKu&kU%i8moNuWrH?`nu`B?Ut^&kMy% zP7G4+W?IT3+FLx}Vp%+jhtmhfoIusNwMKPb9#QWx#OAFeB^ixJncPAb_|)CCU68lE zJ6gKF-R`zmw^ykJl}s=Hw)?Xp<=p{}6yTTfkuUAw4$mzdHPX3` zS+|^B)2#WRbWm9qt%%5>^jUig^Hxqz>GVNB=F=)>(<+ftBgU~XnXRCU(*g^2n!qG* z>VH5x+^5_fqj@}&({XyP4vI{u@(gL>S8p-Y=L@+un3XiEW$ z7U62gAfr4D-!OW}rI7UR2+jlvDxT*6RZkV8-J=aks|6=yS3hn!Dy}y=5z#X){emzX zei*`vzHlJa{H`J5s-D8$2EoHE_43<%Ra#q=)NQG5w7plg1k%|gh$ITdas0Z94_d7@ zZRWEUewnHjfb*sxA71r3%#DU=7>-bXl~BqFcHL(pELUO}#Vur)k6e0OAs4-zJbU@^24fD)xple?w9fW5M8#rG*IVsuZgi@LpGr0i zuTI6-=gwv?kUBJUs(6H1rsB_ZeM#=AHEKnkVZm)<;k?I(?3wn;x)i2xbYQ4q3bO}8 zPf}@MM7SHA8R8&Zr*KX6g7Bw#UgqYbC2wlhOI*JLGrlyXG?DhT!#}+1Oj&`X?fssy za~<=-6$ZMugL$*q4o3O7v8i6jVgTj?=D~dWl_ug9Ehe)>rh?G-Pn%}H1IYwzJN0oM zdQZsP!0jna>b(ywR= zH|p?mNHm*$NhgdU1f^oJ$GxE!sTC;yb9(kO$Z2nwyos0aB)qrQyLquLv6tQ3uAukB zJN3uV?0|dZ>W?JCAFW30s=9(6Fyy4A)D{z|Ll((QOKJhpHLr@+8R{O2-$?$!895;_ z^c;{Bs$!HFl1e33c>2Cb4q0hjHIPYBlWsGiWUQGj;68txFrA-Haan%yiE6?Qi7WR= zoPBtAXrLS6_vqxQ-?_F4@oG|$S6F?m)#8@OXNS!TT>o2j?=>O>HBB$+;Sa-Ro0K0R zV6YYodL%zvPEz_zYH&?D+UIj70$GQuFG@pFAbnB2`VB~uzckpSF~`AX(BYql4!Wwy zSl^46GNb;THy%m(Byq-S$|4JK@zz}Ot;@Rf#&xH=2*U>w>MMF#Q}#8;e=k5_L8_4R9e<}2Ct%=E&VLd6;y80?ztjl9X!#{SWf7RqS{3HoP=rBp(`|~zJ zN^Vis`ZsN!(x8gq8@3V8 z{Qg{^w4Q%r?&}y$O~;wnm{`_PtE^YgXiv7A{Vcz?#wLx*puz+eV>9he9bOkHnxy@NnGFtAr`0 zQstZ$_o>+(@qo_%G)!ChIp=FDORlnEu{POd!w7^#0$OH-Xs$yZv-U57(w3=M%?E^1 zbv-uoC~l;VPJ1{iDDwQBJ~k_H1nF4RoaHNp?V*U%PJj$^d64}na+6n^Fqu$(2Au)( z6y`Oz9nwdSlcMnLxsWaeL>?bn!2A-Am$4^$SzNR5RC;ChU5XMkfye8U;=v+a32Ovt zZRuRsB>RYANjr8l<}3mHHm#smnTk+Xl3wM<#n{Kkg6?b0 z$KC7ZS+AlWPt(Vk*)0D@$BjJvD?XU@OWyNE1I2V@10Z+zft7%nu1}$- z3m$_sS2qaaj>J9DUB*3Zz(SMAS}JnacEmf~Whw)$r@ZTD^^&SxpA(%~tg(#WY5s8|&AM z3N*2f`n{CHAgW!vlMyq?xR1?;-2nzahH||ap+9{^>=b$ReTolLANE=wWA#3}*baQ? znNjEicKAzF%KWA9-*|I##lfL?TeF}oqfcREmTpIRmKWKR@3u?jaQqS+_AQ~>1lNkNiD!8|ODz(3J&zFb+4%2*f|LIX370SrJGgTY6B;{lc6?!o) z9u}PPqMa{uc3J+U{z`|Qc>%$91A&=tKd(dA*mN)8P-A*}W-Sgtf^kv1&bDMEHWOlb z!%CFsJF*&e%eC48QXnn3Y<6zLh1YiiR2K^q-dRKUyZQ^OyVU{d56Cp*0utk6l*m(~ zDGcI*EX`|akWfv-5R*I2}6{VqoP4^l7KI#A_&Vt+@MYQy;F zR6S)M830?mw%D>^^bf|2LrQ4)tpoT?k4+=|yAj#t84dsWL;O(~a|~{nDaCC@7gAE^ z92$Hv?uNaT&mmO1OzlfWqj`}7W%Rw>^za;evzhc#4;WTh%q~M4bZV&nFqBuYL-ckL zU`$wWVD{_|n&_8_be=>0k%QtG9e-<6>|+9Y$7^~xXeCb~_O+7f7|oRE!X!RIH!0cx zm0#Z@BetSD!NUS0=OKM`MDR5b_xPinR^{S>=;FH47g{K3fbER>W50+`<*T#=Z*hZX z)BE70kIJL;I&5<`pZZ;v1-b-BJ^eiwO}}N$UmKQm3Uzr8rR3<%waL<()D7 zU<)gWiz?;9{EM1;hj^}JJ!JxEfLLu@?eMZh^6Fx{yMsbEzH90o>}+-Uh6Q@?YWs0~ zmcMq_+L^Exb_?*g8MB8(^N5qLzQTAR<@|9fZ=M#}df1+vOP(cX^=CK(orT-Za0?8T z{f$^JfqTMW*#=;!3^eE{a+W+ zoXsa6e<9TKax%#S$%7l;>SwA~Mh2`yc=mzFOrLuS=}@N|H2alf9QemHI_-Ir>4P%d zBUlk8xuXfG;YI&~rZb%k{;rw|z6clZ4~7Bva0ToWONjAYpl-s*kmvSeteU(XWqL{J zz lde-Op44O$$_i#&(VhV~rr3fY22TKETlBPtD*I5NSdsFO(OIdI!(NqdawDD;} zubbhpuzbBjcsk@wB4a-A)wa<@MP;h-CNm6 z4)zS*KyUx*W?6P$`C^zs(PnMsijk8mr=CGun!>S6=^R`p+#Ta$($(|+dhrzeKB+`v%*{SKW7!Ym4@}w_*+wQ(~2B3D!7^9S9w)#k5Tf~N3m&1 zhP(+&IpN3A5ChuJUw5ai||$j!v3Ai81iafDyBcL%U$ zUvi&n^)L@d=JS%c+qy2i1xD=dj+-0kX_97 z!n@KtSOKBa8LZDpDmK!*_{J_X85PZciwo!nrJcpY!&od;ie zr=>j6RI^v8ddye;at{}Sf&zNzVN>7jyPCByWHAuz02XdL;$%nd_<}E)1e$%}RI1dE zw-Zug-S*zi8pPF~JnzlHgT`36;|m37H{;CCuMyqRreEG9SA~o9Oc#NZ;rpZU6MjxT+XPtV2oNx4{WF(nw#R z1`~r?fQlsd(%~6W)}IlK3n521nZ;)I+1a9VT9m6dUmZA*jCb(HqAd{=|E?QWC@c`V ztSk}AhCll-nnYh`wZm+gqp>EoUyN*baxBO?&xpS0JR>+Pz^L0)Y0)HWDzb5>hIrjM z_TS6^hqoEV2tG&VXjOFGDQ+w&QP4PJu_rg!^L%Dyc3564xv-K>VH1VpZwZj7upV!T z{UPkqv?wS;YNV8aj3LtdT6`V}SC)5Z>STn)(E&TE63T(%H% zaTRf%i=vuN)rN$BF5?zl;ZPR}1<8*(B*cZ0J!dm9QZT$iT-a-pho9MvqEAY}_@^M@ z3wjL#VtJf@lSOLZ@Ig=$`~zZ84jI91H5EZ2F6l2DrF|7>#JO%aUo zUO}yl;kDIT`$A@UPfoh1q;iNLL=1!Zhbq|niKeu0&!d(SiiG7O?fkXS3 z@Fmdf+GPcYRyJJ9m=lk!q)l)zWGeYtWf`q~&4gb2mJ>cruUD8WqE0OqMconuZ zsaQum56%9peXrp%^A>#TfxlcJw|au-Cs`A_TDE2wtySCw9k1unx3Plm*a0lJ6l2V9R^!ZN!=b$)%q5w` z7W@d_ax20vVBg%C7f1Xa*A!jXKiaVZ;o|H3ci_gm29Mjke<^cF! z<`VgCEY)nDwz_QZO5h3I`0ZE&P8hYAiS5G0{5csNcBKHz7pobjN4z$>p1q^0S0bHai{*WHDM@NOymi-DP6Z68SG;AIg>akV(|tROr8x|E zd2e|sVzjW<>HY5gg#M~b?)r4Ut+{Jn1ea+7$KT}||8~+F15oedF@D*rC|6NY+!CZuY`LmE|vnAVDOvg($<+4Svg~}VoEgN{#AfKHn<>aSo!=TcD$kzP>=YC~=r6c<5t8Xq~&{tXUhA%T&%4k2zCmR$+T_z17uy08%(wG=4}mBkgB?UjZO;U=I@KR>s$tTU6rop zkrSAfH`MdzeV#Pqr60bg7ttFJDlUiaZxdOM*SC)~&DXKB#ArQU!zRd_-TKT9ycnlX z@vyeslhVrEwL1KAK1OL@h*a4M{;u9acqCU&^^{j+0AiK=O8bR+EHUn-EpXz`+B0BQ8onF#3h&y^G| z$%`{R3Lo zrco|fv)<=gxnhvJYJ1!*jz6sJ!VcO``h~S;fcOO;n)>PPUI1_#<;S$D3TWJUPN6KP z+LfLYC|^Oe@*`zwf;G86r6nApO0{@9_5N`OKiN0D^nmD8Y1UO1`*=1>&BruEY@1nP zuq6g&W`OYLFbh5Tsw>i?nbbQ*++ZK?=Jm0ZjNo6Ttd@*-{z#8^E@v8dQY?2KbV4!R zYWpcCofG=gzXDf;MP5|tAZIUPAL&x}3k$27TM6RqCI=e3ZwKf5w9Bp0PZE62_ z64V{MNjvZV2k<2Umwn;ES`LE{$;oy9A$Y$&e1=F3Y)?KX<2^WrE1xAmHo=2p7Uy3G z6~2&VwfV_raRQf@iJ8Zf3t!RWJW5=CRT!>W$0IG`$x9~$nnchu0Ibv1uXTID zTeSsFgFRh5i0bmz^1k*n$s}FFarW_fD?#+IXf2#gW4Qb;zoG3^yPJJCx%ubB*R6Kj zKTcRR5w4Ay2nWF;3`Y!NQDK;Of|&n^O$Uaz|0`t&u;gLwfmY$|Wy8bDcFK#17kQ_k z4RI&^FY2ZiX^g3DKyE$B1KUTHgS6}(3emOA)U}V9IUrdYBfB>Mg|s8Y=cpm$^xOEk zezh^)*(7tTNWCnMpO>o}`+e#KyW@A^fsswB=@k*V#0QErFg}=$%DG>wr+9 z{igz~@JiC+Yb(=&NUHWlXpGSWi3YqzzNC$-Ubu0Fs)G+~#0@bQ$scgUXmC73Z@;cl zZ+UELP3$E4rde)Z)RSp1(_&`ION~+N$>0CnW@ymJGO>kP$7u4(UArNsDL?Ao#c?yh z8kTzE9)HDXubCN4JRvl)&+Jr~f~#r-M!oxQXsXO1+eNIV+AYE*UHqVQioZvz-$|DT zJ6s=DZuO&|tXk!Ao5D4`)+cAB?kai)2pzWVX#LOH6&=VL@-u(oDEm{rj2@fR<{#@K z2E!+AN}rU_xd)w>cf1$Xv1{e*QI`b4c5NiDO8WE4oIBC}iN+pjh?tYvmaMS=q?hNA z`hoJ4=fILG{Ks#s{utH#4GXGqdf%hVZXdXhn~tORnK?LzTa7BP84+xtk0!o);o#%5 zL_?SU#Qu95qoEU62m1hkK^3C~bNjrXsr4bVpTqokp;%JjFo~QeGE0NmImPR6Hlc!}!Zc1yA zCqV7SQD{)k2Z{P_aYl&lhc5772?v+_yObdbK_z{F;1U%hbR-7!Y^D2&{mUYb>@{@R zMfi%v{5rL+&FECwv`E1@WQB6qawePQA_%JU;9uOvN4uZDlG){2RqLKT4>G)V!VyIoE zRazPFK9S?nQCeh8lE@KD2o=wNsOJ43J94m>Jz@f4|9N6aBvig1=6%axds4I`u38hd zk{%zPlOjSVxZaCdKm5wy*Qf(!ou5+#OTyVjpzc--r;`1s=1TqP4l#4&`chql`D3qtBrKdZ76->T@5b6GSd z0?cL=pv*iX{t}6C`Ku7Mf$VN#piSiuQ-7(1GB513fvF^N5Me>5NF;y=%b*WQmYM(= zZe#hX-+DWkHkz4;+NGG*wLejGwqN&gg~Wk{yP0I@}V`!mV- zO*UgcUU-20{D3X${T{mU>HGz^2Qk;+Z`r;d_fss`-!mG-EmHavOPuWLD*;I8n4aU+ zUvyX80}8B5uAoit3+nZb$;FoW)$b$zhxnJGNI#hSf}Kr&n7dt?722=wzM_*cx_aGPhI=}oU{7BbIKL$to~=w7E^>-hc>mr-UtvYP8eaF zTu#+>M%Ous=4v|0iJZIh{jb2#dt@Kq%GO!jnrs<4$|;bhTu6TLM>(#fxPhw#MT-eH ze5QAw_7zs^rDLF*&d74_>QefJr?@@vh9i@v03;Y8FvQLNH|311NAd1ofyA_9eD%1c zDUDMvwq4isdi%I#86RsHLHw1lE5&XkMI5@nncur2!?AIf#i0Y$+bjI>`>J#yKg_kN zxL!2KMw_brW{l7-J3+Qtps%mW!&xQ$2_k-vfz8-*^^enBXIg|y{?KyYD>qGGNj}U| zvu*!FiARHiUSf;k=Gf&Li$GG+Qn5`jk&w*Mb8@>GtuN9+xGktT7?2ie0jV%mpMmQM zeZ0t?YjUDPUq71Z!N!6HIOjcvzfNgvVbcf&mu~!1Lfbz~;_eG*E3q+|tejptm5TDie zUgxR1{7&-YV3DSDwUjhsP3aU#OEG(Vg=RM^@h-O;+?w2c2&*;gJktJEzsQlsE(0R? ziO+&wjdv2dWr=MSpM`Hjk8Y@1sR3;^i-*2B9$-Qwhe2U=SH{^dh%vl?#EiN}p*$GSTv<5wrzaZXoqkB43)xLpV z;Enl0jsk|yyeOVjVd%wCERLJl&-YWYYi9HmUqO`0rQ-r_zUIb=LtQTX-WW%hgrX?2 zr^-wKqk=e3o+3Q;ImH=s{^Rd6H|m>Nv%o`VRA0}QriE+2w62TwF6=e zg~QoSJALHLL+?b&F$Mo<4K=&adf3!FCENg%)0Q&{lJRKJ znd3e;iG(miSgR%$PJX+@-+OkbM}9;yV0BCa67t^Q4Y-f>K5GrskK>BOhUh3$aLeAP z-PlJ8I0v*EVOTd12^0mY_$lx+s&jz^CQ!%-5EPH}B|by;R1qE4cUf(_y-54&)Df3| zgmp>qYMIhT5lJc(5CLZ36VRZ*b`!}#K7VIWqjfn3RwIBD>!_R`4#!)==z*m zURmy6-o4Xqwb}UtfoE(zK!CoRXu0ZSjXsQuR{*=?hy6J@<+MLFc3F3Rwn4Qo%Go$` zr%2B-!0HlVN!puhfMwyC0@!ot_4ut%uovkuX(ON&2Irf>elRt*1aXMq)-bIMT1*&O zSiMGQs`PFd5Ls2=|AHH%Bp8maGMFTQ?U>;6n&O4Pa{h+Flj+;l;g@|5FqKgW7g!f? zCzD7})3E)GdAM3L5bdi-(B>kn0Lg-Ik#9&_QRVEV*5na8=zFQ(0dAsID|(ME6H zluK7wJF}G9$G2-POig0Q%2|0({X!X1-m@pT_dKWx^J$#z91^^%U! z3O#h7UbfT@HP>Pn*n!?8V&mO-_UlA~*+=8!K{36pa`Se=v7*jzf*m!cDwx7~ZX@ra z=UvtLyo_enm0hf|CBStSv-aA;r$e)d0Im3=>0sY43jFm)f*EwCmlby}D?Y#Pux+u1 zkA0m+hPZun5DSn@SnI9zTjau*J#(+?av75 zJzRggt>+9~*V**GKUC%OS##GHbZ6LxCXT@bix9%1{szg0Mk1}T=UJT+%&ZwSoPbG8 z-TrT$4j3Yvb#a%S1pt>@57X-j5$Q_TB<8yp+AWvrV#a0#y?o{^*$w9NrCs!WP76`X zg4`-svStj1Wm!l)Xn#q#;Kfant~>havgyynjIj{VWVs=nG!cRaB-fHdJJ@g(aPRe zJQ^{tX2m<3W^NZr2Tfhdgl-SFsUyOJjUtB(^@A}uSak#LxGyq3s7&lz*;PL;C?_KS zKc=oRysoZkH;rwb*tTspwr$%Ze)QWeeJY##%6*h)l4nF9KW3+DtVY=BvJJEBx?`(@` zsN+kz@iR*$oWbXS0X9qa{uH<%cKbbihEm@)$8WUACq7~9Y&wM7V)NyRqVArJSXRhu zPR}Vz;ye8I=ucZ;$Rn@Um9Pcc>yQkxwYTWvVdlxvgw@DX8enDf=4!f8mOJ67l)Ii_ zQvXd5MB3MjR&up3mKoV20S7|dQ#5#N>|a2B%p|3WtD&MP1(3+aDIOKl$9BXupm~qX zd{gzf5z;m7qHkGerwZ1?uujr4SGYAKIj44s@+>bPdbEesMQ!z$ zQ5`a!gjzIFZVi-IENIX8Wz-WCS-0h?Uc-XG({Lo2FuAmmfdm;7zrF`zM~yUSiAjQ& znUpzqQyVmT(J}+TUz6TADG6_$WO!LtFh!KM=VSjZ)j{xJJG^G}ugOR1#LMoK8qpz_Y+B zqBAYtA_Jxtk$;PH5>BEbf$NwQ8cffz%X{4zV$w3bIH2{wj_QWgD0aY^zGsAzPLnH9 zMvwVd6>|=s=s7w{=u@qt3wFWhbZ#og$%juQ22rhblbSQ;HzIz(w`89k{f>jVP{YpQ8=VOjS&smr^-|_na+UehFcs6nZwl}M%MnX zqJ2mtZJ%W$YX?@e*9;1WN-Y8>w>V4F-}r^md!EfYEDm6)ONzVS>vCq&lmL6f(e%jk z;$>;7a{#I{{pp0IqvRwJXt!nX4*45?YG0(EX-5F@;ulWpO^ti)dVA|dGUm4;Hh}I{ z*8I|COZAnVWb{!27u>oQVNDc+tM5!(e;T_opgi92 zjKo9S%zf)vxw3J;bJ_Vk&ar8cAH5)qF1Iiltzcc#2MugMb%^dRuvzC}PzwNv<9ZnP z(rHYoHAxp9jhWk_k_rCqIR>>_jgopI@m*aU5o=)|qM!4K z)+@R$uM#PzDG0YCsg=4ay5%buRD_H_7pWrD_-W(bXnGg+X7wB;zy^uYf~b~_C@y#M}KbNLCE)H^0oA#=)zXe-wga&mvSes@@uS2!-+0|HxkVgPlQSVnVC0)IbZ zGW}{Zm@FV1baxeYH0Bvzw;zIjZw4l8iL;4G*xVm9~99KG@(;-ECEvh!IM*M2XLu z9XX96lM>{lDH*i{w=lUHN(Uy7EXKwy=Z8fZ|7+T)^qm9~y}hs+m3`whfbn#VAqkD* zAuK|*qlIzslm?g7&jN0I~g;+r`~Qq)i=WM-eUu43BCVyFKGbHhBT&}8uEJ=>oX2{ZoazlGn*U{#g%XR$3PG5%lT*GFx-4@ zaIYRgVRtES!u$5S+iWKW9?flZ>L!Tt_$lhPS|>V=nFz3Em%Mal_t9nKumEY_5pBFo zsA=@)ou8U+Gdih48XupTVTQd~xZs2}!6HQY2X)H~xe#Rnb99<8ORSOanzW1WO;BokFh* z#kx>M94^gPI^~!PYb+1}Yz&8p!|rn)D<>}%nY++=ElMw7{pQ@H^dGLT7_@y=EHY-t zQw$) z6y~D)?hGJ|UHoL?QEtxTbiC%ohe5Ja5)fBg5kDlUWu|=^-THEtB zL~Ss9;EX^afRiwZ-y+~*>8(3TjOT`rO{8!Ncsv*q4{yI=>l7GA$lwvy(V2PzkbqIA z@C3oFDPe~zlw=KF3Rlc9$Y>;SA;a2Ixan-mnwVu&bbbS{dl9HGgo#+=u3_b~d}EPf zDP{OvaNkZ?Phu%EjZOh|ENWZcT2gUGbh$H2bXjQEiTyMoBQEA-f_TN2+s@6^$pIX4 z+*pO$J^1w&?tX)1qhHi|Uf%xAQ2Xt)_z+Cr-9PiCmsuj5H6FM~)fOGaYM75mbJen6 zLhmkWf^+v>w_iLrEE3D{e{OqA4vl>WbX!kR>wW$>#@EyRI5TyL6}HArr3%4fE~{$w zj?XCmn-eWuyS`&AcjJWan~rKauw6Y>h+lB64}6qbgGIT^k`gX{XcV!iPlVr_uL?Qy zkye=V3aekmXItCo7i#;yV1CeF(Y+ITYluUY?PGYAu2j(fk@)kj8bVK@w#JGEof^|& zlJxWQ4JKzdapg>>9c!A-*LO$x9Rgg+Lt2k%);}}OdCBw ze@Ev(ZQ#UL7DmYFYusPwe$a@s7$0iQg5Mc7JUyJB*L~S-c}>(~;k@VtjP5_Wnpj*w zjALTa<#hS9Ge);Du+&$R&iN{5&%2Y3+wvsW;}p}n;$Sz$gB9z~rs$^*c0JhsZZeg$Ih zWw>{-Xe@~}?9m~Zil{FH-=z|i_Eg>OMSm!Zd}lngyhF)-R{p1AOky6XvS`46asi&+ zd1oZ8byp;1SlKQ>Dh#C|=3V%yxqQV83-W5zg@B@DUmcDmE3#X!l595f-p5~2^ZTUT zD6m?71>EUdGt2M|QY!7~^~(i(CyuyrlR(QCA9tlQ2%@zze=E*PyarZ_; zo(4j1-=@_7)-LaGvg=~bj}_mnarT>10NbVW5Hm}v%E*43@XqwuGF?4qVeQsQDpSGPaia~y@6 zkDt%}(xaJ%xaLO|{TS=}u$g^&AzuSZ#ECq9#{KTZ2Fhl>l4QQ_;X+21Z%pfLZUiC! z8TS@yzUldgYV)&-^*(+8qd4Dt!{r>*MVQFex)0AaZMGXCI=k1;}QxNwS=_2~np{Zl*b|%WIgFf}j#d{!|Mz`tj~T6BJGBKY#?4;juQ* zzpDaST!SnZZsXi8kn^vT$bJWWxj_LqER^YmFWvyF7*0vabP-RAMjB$cxSBF`B877qYOF)nP3_0Ea=4IY zRBy*hi7(`ayK*lum11Ya)pF$vDxyiAAj8=Qm}%b+98mOQa-`CSpIlVVAF01SJn6%8 zdp<;(m9f!i+q^iucl~T!WB+3p?DrhcpK9DVLC&Hodd__7ei#TJqYFgwp)~CrquA`} zyl?&W9{b3~L|7IsFL19=$wV9q!w-~UcUgH$t9E@oYqu)-uZ(&UiWIU z3aFFA6vKPn*_>S!M4&qN(-gx_U;3S==?vuqE@!(XRY=$3F}u%vIWSH)z?gVD+5H$% zG1aq`@59JQ>dZe(0XJj-iJ$dsQTcD7pzx_8A&Aci>&LX zX-2{J{tMtGIn=;)b@V{x>KF!O6yPy?DEE9*@|0?GvWoRW zo#bjES~1)Yi&)d{;6?gVaOvQS#Q0xDWO6m;QN^+f`eOTCBo2t*%0c#?h^>@%kx(q+V_K#n5DZ&*l%-Hi-4 z-@skxZhL|M3;TsTtdE(_s*gB}04bq9{8GYV{7gotNG1FaTKSJu(ryce)a}ARYZc=XXd&Qm%!rHCJ*}!_}I~Z^+eH7cR84$RE&d#)su-+UUi?D5$NnMuBy3>WzxoLW#+ojm7-_TDqQvi??CIaYogfe0kbziP2#N;*ZTlR+?u4c;n*Rrr zqYLNJ6sJ_t6@lp)xA;JX1h<$~bgMwm3a8*}Bz3L?KKuwt^UAE5UmSrR)iF6Ss4@#z_%JE7582X&g-6nNNO#zr z_!jSoEYSJ%F(EZw-55{jFj$xdS8IP}2r8S&F=K4By<#lF$~G$^Nz^JhLdEo`0^^#! z_EKD9=|b;pUx`Nybfi=h<7|^ZB7J?fE|I@{oFGFc6OU>UshofM-YPb|-$RpZkWWc( zuoqnx*aAs#X(@yLI^7U-^a%}rKBQ@@&&=xe#PKw8 zhWEb{=h zgER8wlZ`6v`X?@Wt2;&<+>(q{rb#+xt34EohJBLYEILQw=f;b?_TT|jBW@5m$qFx* z6Hyc;hP7_I3dMOuO;U_3@Bjx4#eps?D&nJ^IsCsIB|3h-h;K@@m=9>3VAAMeD5T46TmYuBFTT;tvSD$*j2!XGSaYP*&PV z3rBjl{4MXl*cEAMpa0Htsd~qwVqIuc7%j0Pz9rTe0s^{{;G#QKWyk3QZ)}K9AgH}e zJ1NNj!&`C5(`hBLA^i=6V%>|c3r@gxsY#pg2!APPVj^p4lKz@$Rfw|In;{XGRBZB~ zsT^GKv;w)q;)mMSS%sl2Y}d6`ezCAXfEVtkLDgwG&hU4pbiqraSxRtpAMNHwzYYZb z;7v}7E1CTYdV;$OFN(H4Om#|qF4rZc?Rn#&S!gmbE@YAqm_gLcg`cWCYFR{k`R>0C z6M3pzxa^DNR0N$RnMwwfO)FLdHM`8?XFY%g;GG%gHtqOR~bI);$gI=e{B zGN28Va6u!+v5-;bu^A9h0`M!u7=9?=_0h!BCosA?s3Cs?sJ+iJgYv#2gR-L8QC$)% zu3fl7utiR=p!jE)F71aISi}i(FP{0K zeB$`Mu8#g8$`duBRgNT&F+C#Le)@hrrD9`J5)X5z=4UcFs? zQC+b*MmduazmVM!#_)bPb}s01JGMes%&rhRv@Gu_|41AFF`j|IvPLuHWAFG)A_d9ucoZYcgQN`KA9Wt8t$* z>4!o}N0wn^zoALEfkpLy2?(^bymq6qq82zPHmAO?Sb8keRX1%OF&ZN*#(Zm@T&QdD zGQsN)h>})$em^`hWTib}+KOA_qAa=rAZYOlhr&Qmen$jm6;5GO^udi*Uv2OLMkHmL2% z>)suLw#1!o=?-VGEX}v(B&6Ev)amPgNZ_g8`m9B%hQi_I8sZjewSDTcqH*!BXCkS4c|7h)ry+W zz0tN>y?@EuT0d(C_oLbViqO1OTDi8Afk$%ALMzxPZ10q;RAd85V|_0n8!cyFsXN}i z!g6Pj(f`7j8j9#9RuNt)5QrsWQ4eQ*zw6Snu9cDt#@;&QYI&fHf6dzHYH9Hi$U~Or zb*S!^n7++uj?uX-h^UNE1ggz#G1fdpD*MO>}f}SH@KjH1V{zp`P6-xqttjdOsa25uf?< zOl7vjE>8K5VpD zS!POkX*=n5Qx}_4AQ%n@b+=C*gV!XM0Md$Ao(1C;%nhbdtPfPciPzZ+E%yBMUkpyk z&(B|1o}HF0QBEnd39R$BeuT`BzSV+Q46S+NvXS^kpA<6V4NvVLK>qDQ{emSC8?#sO zCl<-A4KnU;Ly+ALx^jPR;MjcmnpU3aYv%{(sCX5w{1 zbukf@fSbDVk8+FVkk{|4C$A`0D~gtUHz$coNcy@j+S#FJz67U|> z&sdW~;w>P&xq8O+r()IRjldcfv&%wiZ>Cr?f|%DI+NG2OlW_E5dy`%Kj%n6o=Cn)9 z@sFM8%!}H+R1kAiutn-5bz4X41b;Plim0YN-$zC|SG!!F653c7__m}I9uKcxnc&VM z+_GxL_Gc(|o$4XSW&p*4)uu{fZ~PGF$Ph_Z?V_R5&Ldmd`-51kE%+02)4rNe_+Oj(-_PpZqQhT(o9Qc)k zL?*)_jtBF&M9(&c|FZ`Vee`}CV=QW4n@ow_o+macf6*}%;DT%v~G-zt%^j&(8vy-}rreAZXOqM9uc3;#Wf0S8gPW7I?Hy=+(Q zSsH&GPdAwt`j-x4B8SI3A``+vbo+(sm|54BJ^0`BWe#0lW5|&SKrvvUiy%*4NT{Uf zjKp|1oz@;;9<_p8A9JG1MKAuZa6aLdjUK9{7BAGoDWy>jLC!yC1;>dmU7z5n5R#j9 zssv|Bw4S@Q((+K!Y=x8zVt?sSTba$;viVLj*{7U3QHNU7B+>{NKD=E&=2()3KjOn1 zl@;K+YCO6yUtG|?j6{s2gW6xuvc8u!5O5Kb-7M=ZN#O@U@ICiQ*xEWHKwM6)+#(sp z9N9J=7@k<_aMU>;Vwmf2h0pYXs}bH0hM`06{@%%I5Z{;Nn7{GC0+Q-hcQ_2KB))gy z!q@>F@UKH?Tv9&spsH#CY)(x0F(sA~8- z0i`w*O=;;gum$6PG;e+GClofoH44Tu0z)SrpcbA12?WwY6WISx3r8_}DomoRVvOhv z`Put(sMn32kBVG*LN3qg?-I~vBO9=*_AP%1uBFRQhXL=2mCmoSl! zo^e+&>P(8dUp(2g`-6X&0sGpXArv<^4#^1;Wzm785kV%qEYpp)L)olB*m)U9;zBJ@ z^C9QN&E0%DrvHl8Ypaa0kRoIGVzosY?wbEPQseGQ?J*c8}3qtiOzag9ymPus?9z3;1chyN3 ze3l?2Rqh1)2*0y?8nb-K>Ec9@sGsRP*jJJfQ4*bAoH_m*>X6m*2H0L{l!9G^NZvt5=`nv72ZC5s4@b@;YNH2cl z!k;$Hf2x~ezM7O9hvp=Svf{vKhQ1N~x&e2eAx{(*;JKkkH-ymhgj%HKnqe;=!@Y6v zTNA8x?`x5~N$O+P7cqK9!NhkQ*IBrYC6d-zf-b!21Bo>+%&IWZ6|LkUdw+gyRYQ*= zUTxN3EzW|y$WA|1r^Q(ONxw9#Z2ibd7a~ogBkf>Woea^EEB@gTv$$BMI>zoMgZ?$0 zPqXKJT2X8F?%6!O%zCWHI>C;-%u1EnY7SeOz*{S>%(#B5SKRJKVmZk}lq>rk&|Axk z+7bH8DF{k)d_eCG7;F^xVgzG2C|S@GIh~B&7nkPUB;klYxwP=h@#W9Kq@w6(Sr-TN zmnh1=ij`9+Tkj*V=-4={fIXaw;vjUAtJ}ys9miB6ERTS1u$S`Yp4(YdW9FVk-)LS! zIIUF5_mg686)~q`acZt%dQ$A|B%am}ZACQpQZxyCAe(fhMc{vg=#WCk4={;HvVLBB zYSohexK__$ua_ma+YF0P>wU+g_ku%RDhMdiDIjBbdOF8kvOVre<#-Dv6CW8}sRV79 zsP)Qyrtvjc!m%EIyS6_kP;GDSPFa7M3`Gw+gZjMBpt^l-7gx<;UnQ5@(@-k$pzK5U zs{XyX-F@^MWQ;z%*EI|V&$GbU);9NN(7Ws1fXn=;`O|R$C-=^JFwD1`2(CnCZxo+c;Rqv@K!g18x*4`5hYqHwPK!T{( z4^TbtVR+QOVl--gmGxF*xicTI>a}qI(jX-%mg*9~l7_4lpz^Nx_+AAX0ZL&#-jbBO z9C5L^kvAw2xR=$s8e?bY@1Ot;TRx14cysgkeM zL0Bhq@N?~j?nQx)R|CJ-er zFk|=I&|-~Ge4`qj%9{F$!BUsBEO*u|t8^R`)utBK+U(&maeS=Xp2U-r1gejuCLT~kkLuJMW<6JfKN@2>JGF$&0ILjrR z>liyW+6D&e3lWs>y{`voY;xDpw(9MWJ}02|t95Px9|-*m(CpbmE#R1@>p(A9UvQ}J zEeWj@JFGdzVc=Pk*x2de!AgIyZ-0wTgQpmi;RCR&+Z4e4GQIO;D5@!lToO1$fsCyg z%8E2m4(byrj8S{)C-y=7?`HiG%zs0Zahw%RrlIr)=3AztBWYQL&yyUCGOh~P4+s$zd8Y}XUX*3K^Rv+>gJ@UPt6i z!Kb6n%tw%gY^j%Tbjw=X!hnE5@F@JAv1}G1Mr|1M<7eT*Z=1otMmX^i{a?qWj_e%UyC_xv%aHhqx3fcTFf^z%3h<_Ag!DuZ+FkERlM1-Yh7h{ zL+NMzrwR-*1c5u{@m_;=2{e+}ekmg5o|%2@UK=^6uaiI@`5EdgEIs!)`30KJe;6FF zjLKRAxtQ{ZmJ-foBLaH%>*s%g&}x~b;Gifs0t|$0ILx@`Ne9P$4sMqXd+J&VCt>SE z_++22bh*)eT<Q-m#x5o ze9TYavOmRk+PiblFF*>%u7(UEVX^`N1a+yra)gNtg|M zQP+GB7xyLRg31z#prMVUgiRd40B6m!(l8bzvxHko&Dmyw;~QpZ1JO+Bdyb=rGG!%M zDAqjb&`cqccooTl6aLRdKtbh5g8HI936(4j!E-X?CZ9G8d3{4)oxcXW^^g^}o}q`O zL5F$Bv<^+O;_M1}H>%9(ui2=@W9h)A%K6`hJX?@f_w6~J( zIYX^y+6^zZI<14_sAF{n=1;&O466y_YD2@XNMEk7x@BcOV8esB7Lqzy2T7083uT=1K~`X$Zi>5s-+Ymn6m1Y&HUK)8T_V!>S9f zvjW|t5^tKBbd_`I{7H3>%bIeEdd{JrV7r^jQjeg~o3d!bkhwbb4C^MS;@qvOUEaN^ zrbqR;)6aELK7}Oly+QZjD#m>OZg=)%OJ3J6f@bg7A|}PX4OqeOMm~Hcj)iXin&pA7 zQaf6h#JHZ%ALTpkhP1tB1N+a*+yLt+fB+On;2zy;E;CILk&*_$_A;`^SGr1uC3%U> z_jfV%&Gj9Mrn9(aNX==PB8pcKepInmS8wO))^_5JwMYzmO;P2EZJ6fs^uQHIx=pP)5<2_pt{#D`QfWUwy=6_JUaBsvK;}#Je zJ}SzP0busLe&#m1DJX9ycqmg%;;M~AwU-^Ug@z1!ENk9Ds2+gmygSV49VL}?eB)U+ zH=R8EUM^xOlFp&HP<_BK@0JUyRd=A_(TLoCn0e5`cU?>EVMC{d)-dMiyj3o>pP>58 zSLvRN`+1{2@{3T}4`Z+G``nIW?|IC?C;klh)!&*d`KHe>PR6NV>BAo{LSe&BrTn2F{~tg(%nN3Xd;u@f-%M^d3B2wg9#`h%pP-Z2vylsKR!P&Jz`0HDoPJm2QStI9;k0Hi2tgL1(#pNueb|-pb9H`tg7YXku zAPZcldyvy?#(${D_Vm+{4`P!eu3KXC&f3sy%EegonYl7t&E z@I`aD5rkW%<*E15xDc7to`(HQ&q)L6AIjyk8J#e^2=+$)X$gq)4XCohZY57MGikG7 zB~w_w78V9JvT7I;LMf*A7rDbu(*nghFDGBF?q<=#v<%Wac8s-ccz(sY9$D?1Ap2-dCOMC+*;qedbL*|ikEKvGb z7DGaZqUl*(hfah=KueR9?xXDx?i=P9nF|Iq@#bxZ^voJ9@qY9EW@Nc@QO;^qYzw?~ zXy2pRv|!7363{F_(l{P5orZU)i2JN^pOvf9uZ6SQgh2h9IfCNI7P=NlHBG7DU;|jz zMi#IOW1{gaNHZ&-GxtbqqmbfO?+bg&1Ipd7a5MSpqCink<*}4NhMV}|or}x|V zW4=yIM@ZcIBjW8RA>v_zk9IQ38)F=>&!?irIN(G6Ejl;YV}>KhuQ`=B%`7HP*pBZn|9O$E++em1}8eX75i)1cAPLzX!G-n&)kF{WiohS{z*g5$zhW|$gsKr}#ix++X?Tmo5Q2dL8mF*OP+FxXn05~vYN1%bY?Z1F_ zNo;K<$#PtJgIwU7uN{`>S}OR;JOXpa|xtc84qWIt_v_c7Yn(pJRI`3ICWPey^WNVVP90R7 zos5w?3yjYNDd36Cw8Wa@#7*VjRs+Ho8p0jhApS=B-Y9Duc{iz!v6T&PPS%H|Gyu|_ zNrsW^2gj?otAzywOlX|Po>($+4}nt%mm4}-wa7_quCiqR`0O6eI7m5C-?Fx24dvNfnPIm>!}c$uR~_l8hi=5=5OOOM-^d`gBvtQ z{(a$OLcE!qxq&XFCu5xorqIwBWH5c`04Khm4Voc)E#W!`C>AM)4X&TrbsV^Zx)aVVT8NG0rF-$nmv_V7 z7exE(UBU5|f+{{zgkuXU9#CAVq0DR!$`MwRR#JkV+@+8(+P#@DC>RH(KUE31q6rf_ zbQbPT^HpE`9L)KzwgkS4CY;#vUkIVfsqk5zm?ZAERA9%^G7!nrKWD#Zf224+l7D;t zIL;%i{PE$2>M@8teHPNVXP8zXv-fPf$^Nksi*~VY>V`9DG1UdGD7P`3E?j$nDz~SU zD#S`Fbi;HOaeSgqYV-WhZ*hxxJ8aV`sh&<}&DRPADSG*R_bs1CPsES=W% z#@q$n#zF@D*w}QKtzVgkgpg7<=p>|;Hos5Sz^tlrTUDq5L{3=nxDHz}cyVMEc7F9` zShBtjveJL8Y{x5f$kN5}jMm4(_Z%p0B%a@=PeTeegW6EIv*!C*klQFxDV7kG& zr59RCA(u^eUAe6->KUtzW182Rta#CkOg)m51v!^x8JXF5kQT?p4hyFiV~`+?N5+-r z;;V6UP4p0-pmIBuBkl4}yo;AXZYWuj?uR}`MAN97opTVqwM?*QSs=;ec7*>lO>7!W_ z+$0Ph!Y#?}2yjpAFlN^lpw|oq5;OMYdA{hazZag{)G6w|*lI z*ph1A99@ncNKV(R9tdIChZ)15wzSg`TJ2Mt8$<`yJ~@VEaAr;&cyF**h>mhS3se7S zFnDB)j#Y8;>)E~k>R}I9>XhEJcT@4OC+tCRRp6XJzz)`2y4-oELIt|BH$a zdZG>7$$M`M)HQ@F!a7>oltQniG_n#-qT09Pc2b1m3 z8qr^JwwVfOWd-rHz@Ha@NAe($PD04ASQ2?=9St}uOV81k4#@h(6(fAW)MyfPl+gKa zl_4A>(Lv(6eq1byWo$3q+b9|%6ynpqnRA7>QX#~g1dPZ&v(gCpIOLXIwVL4iyyLeu zVaj;t7XFLenyO93qtF`cHN1i0(AORQoG3{IyVd(^u5gp}x~XAGVy<{#Ln*F&UqVju zg3>)a_4uW_2MTX5OlU#_X@GsvuBalknO_`P>VFGs{5iprK;=vgn-hKl+S%8pljkGZ zk56>C?TYwmRaT?h30>3;UK}`f*Zs=cZEB9vo>Jdhe4M6_aoBhSLo9o_-Jcx6$CHgj z^+gcHmfRt*iQDFLU16o`!&$#IV9@8%UX`?#Lc@K;NH|B-dxQ6yd{eI0vteIs)!L{L zF{`WvL6PO{6U^K0YI#2)uis6&_qpSYu5&E+g8lnDo`K1adio^0=5CWhj;9mvf|--0 zGjRMBN*a<~Kt{f(y#IpS-Xg)g{sZLr3fdKmOwgf>PRsY5aJuwgMMDWDrbz=84W7r6 zChaUA4Km_!FZ9j|?;a0%!~>DPZ#$w1y}ylQhW;dQh5K~l=}k1=a!G7ZXy2}Em4DsC z@`HbBScWYOY3#(*3ORi?wuFL#vXt{a6pT&FC;C_{f7v`v;pGpWP}h%d3L~`%rQjgZ zB43}+em(Hd0db*udiMfVO6u#c4IIgnEo}^3d5abkaBRjAjI8-%+gc|EUBEqL}L`bS|-)7{r;eYLg?crFDn0|<8kn9WdylAVk`*v8jJ^g`Ti zmI8WNBJn`4-2<172YRii>^d?{CRhr4#Bm4kwecC?*Em3|0d~^Oj~+l^@CZOD`X4X= z7o;LEF$Y9rVq%7)SeO)zL1Vbe$gW__=uodK>^3KDUmP~rgWRxede3ouLPSSHs(nndN_rbIeS56R+^J^$Df0#X^2Hr)OuOH) zaO+NcC+E^~rHNYfK2jey%I0BdgSoyd|CuuBXjnOgI#8tP*0{r@IyJaf6C$LuN9C() zSRt=w<=dI$bB<~JOlbs@jnBce>woVX1Iw+*+teeom|0lxHO6%f!w{(I4G{a`kBZk6 z3)_(xun$m7&SNs}bj>t^b0n|g$TBTg$i;IEJsi!JYJA;ny4~`zP!_Zb$ZTeJjBSLe zY?*`d2qy|4AFa2^=u^kam>HN-loVw_*1$3|vMhQV2J!tbGg7rxx)10Gc$K$enpa7V zEV>mAoFc2M)Tzy*ioRl-QbHIB|G#6rf(&Q{KqEdxlav)!{_M~?45GA5#Eyhj^Kf|p zx3>-EtiS7MSg_PGW}a7&k{f z%8yxAx!RqLa1azy$y@G>z%xPIG@m5=x6DnPDM3doRR*>XRAlnZCG<_vOadpO<0nZA z;Q)Z->L!OS-&NyJHG$PR>eME^tm09j66_f)yjO2EbXjS+miBF1GBytDedB6zB{-&{ zsCsCM8brq4WcayooV$>wam5Cc5v?Nu!0fKm~wlwR%_+wf-v!zvrjK169pr-%kl(hsAlJQ1^NrUE0-29^34iQGW^R zOZnA0Pn=Hsc6Gumop_YMfMdTmFrW>%o`rn!Pf@zr@g zkhZ>@P;8Lb!IHrr$*ae$NAh-eBRHjOW69=|Ti!O?#(FU%%W^seTG}2jQ-? zM4);mAJN`kq29_6(EiY^rBHrbelVKS{XEddc#4${V_!;i2Ie&a*%N|+B@D?;USU=$ z@wf{~FgE$R#XPGQY+fhP6D5U}XB`eSOeV&w_0};4+9{iBiUd<@?v;Mvj5!X)q1<@BnMtlP~whhqon22j>83F<~lkV_Fjdz__*T?O{(Nfec3&ujN z0dF%4;?aTu&z}#V#snu*4R8lb3HN4`3K{lA=)H`<>TU*GUp5jtpeE$?#;3FE1S&){ zx)Bs?`SdpGmKA!@_H&j9fT^B?v6p`ljqs+M40xksw(9<|^^NUnee^?n?p*0uL=}hs zJ2cD0GJm{iQ8e=}$DNSlE`SGhA@_wN|M!EOgZ`cZKPX#ZA)fMK|JM zAGnM^?dCl%S4ON^y*KC898YvCJc(km!}Mb0+jsTmN?m(H_bRBq)tP8xG=p~_K}9my zv2M$Q*+VNViPPU&%46F`-+P&8c+0dQkj63{drIoII?0X?spr+)%^9H_aQ`8K zy~0nHdq<_DTt!iY>xeQf^Me(>^t1kZm9FybdJ7u#3$7AgWIeAzBbge{=1o5#+mwjA zg=%^YoPO7%YP#PaGu(?>gv9c1f^SUG&}iYcqpJuBEhU6=4QBe^;a>3nm+JCS{MqSx zB&yv8;=E38V`6zBxZYaIbm{crUYBJKb@l{2hvo%r2f!^c@zSnVcXm|V&g6-Zf$&hm z!50N30vf^ohrB8FX|}6pvD}Ou;SEd5IiexTPemXw^jJ3t_PNhgd5*3r07Xt2PYbzj zhbMO_dHIYU4ee8l<6WsPUsX6z$89r1be_|VN^7>!1IOwyaPV#Fl}RIaN5Binj}GPz z#J$KB69m1=vu!((Sxvi=6W7EhJ#ZgpB}_srZNg=0I_@84hRaen?)~RuH8;o7(HE>j zRIwx8!f%K+fFVh!)iT6X8lem@4Sf|j>0(G6V1jR$cvzTVsg0J73}pAmpByZQ87k5Q zCGg@I9)wMMBRZ2|KE{L&#Yf^DVLkbLtl+7L+ zBLRxf91w$Ba{eZ6iXB)=uj!#TaCibUZ6qH}KzR?U)Zu|-?A12!tM}$yLc+F&tL_C* zxk%8}DKgzZc+!QRg9ARy*$>)Vet2~CSbQU&0emPM#0hJ#v%gk^eL7%i{s1d;RNWy9 zik3?Oi3UyzS}vU_KvVfniSaOxB6$=d7UEgK>~q$?;ot5fi3XFbH_c@s z@oA+(@cHU1OWzWHIGj$LN@yAmeGwxL)zM0gf$R=dg)GRx7J&@xk!UirHyIqUS1U3^ zGZ9JnQDPu`$!H^YsWcug)vJ_3X4`js--*^NEUdK3PKS$6#s&-AZ1@-u>>05ji*prM zn+0tC7#daHBilAq6qYJhKOcG3f0wt2vYaWkm}MT55`3fYw%8f}rrt82;BnjGF&t@C zO)aAgChc1)2L_&=%GL@9+0*Sm+$qff`wm!N7|>otUW}S6rfK~- znCLWtEVbqP2ehyE_TzO&KR>so^;?)fJy+bxv}R+uTxhT_vqkV9wx_#Q9^Gs1%t$%s zP8ORC@V#MzT*a^ke*vPWuZ!fdc}K+4Y0wglyQo~O$<`djEO;HbLo3KT`)+g`m3@Ae z*5uMuk^(jyAGFq8M)jQnyT*#xs_ztGcXZOKZxtt}y?@?M9?WXvUEkM0C(9w78Abx zo&|eG4ZvxALSeVk&9{$-y&v$`DSOSbBG0oW7BjxJNkg9>^HLSZNFfH^Zr!h*tLJh0 zzu!TaUrxu9OZw$x`eiMLU=I!Gkok+2z(OPF3xp~R^nx9iJ9oK-&q-@tovR`-SMLtC z>5CM8iK$Gmv+O6G=n@5l{M{4^@@pQjnfh{!s$?@|&TrATB6_ZMn?cymvSw_tumWpL zl5QfmGshAGhD8T4IS#!Jn;bz`c_=g@~ifUSh6iX5ro*7K`A{mxs6T(|_MwD;`8^)jKW9b9rin>{h$1 zykKqc2~_Whq@zkz?MyD^=!1eQ`!-NI-crsWdUV9ORSw~Fi_9PcnE~Wo(Y;9HRGGGp z(JeE2OrH@4|BBUU@Bf9OPtDt~0}}ozZ=SktQudgJ zO(ULb+)wkim6QY6G#F9Gu|^(-o9gOhNt!(3?86fNFXl=$GRZG>CfY)MyjRnEn;(#A zM}5(+TZwAYM4S|9EmqE>61{^Q9;{R1*q<*Z1=Z882PMC}kXAtOwg@(%=*bEe@OHCi zd(gY?b8}GbV3<7zqQ#^zqaeL2tQ=Fi8WY{T)N1)5EW^EbdEjZ-x)e<9dUg3u;Fho2 z>U>u6s`&Fkw-u0Zr5TSP7>P@N=^O)jbB&EDBtAMxmRYT=l;Hj6Q@W!dq-i`f z@j%aIE-~)I41FkK_JrHfZqB9%sxpFSEEaOH+wN|k5IJNp@ydjr$HU<y)m$DU8F5(vuHg;---T%{ z=0%kH+xMyn!n^Z7cTFZ<7m1fDo{A1E;os)Ah!-!?Nm`q&^4F71SF=j|!lJ0}JimlP z;d#Si47^cElVeXBL|zwd9KD0wL1s|#wC={A@6(=jm|f?zcU?_GY1AmEBExRmK@erP z^RQNSSmWl@9mtDZ!|7)A(}!F|MD%1g0AI~3&KIP*elYL0;O8S^{IM*Np9yWCUcs-7 z%j^JO;Iw(KwSBQ>0`~STN5)y^UOviOLwx@91bWu#>}|yGzvb4-1+~N#b>+*LU$3C6~S)cp{kjHs_2b9YJ zdopy$(1Z&=Q2SHIeS68*qBD%n;(}kM0{TxL%`VN~?VPdnr>057onn%@FzWI=s5RDc zai5r7^q{vk1FP99F@Fjd(lTPDGOTx3u1h>xbe-%uhFpDjlhmGrM2Y4EyIm1KL|t zE_JFv(bmP$L=5LfE{qT#-hCn$mDer&Vu3&%sHg}>m3hudF*BbZh&_vk`c)>E; zBAG`0EHa|H)l-jUg4nht!zv0$fE>i2DA^vmMB2r5;LtJ%Syqrf`{@e#zf% z0Q_7@NWYoLHxj_xM~Rn7ar~l3GE|j#+lZmZgWYFeR(^53%E$fcf%l9c{yY&QzR&L+ zv2k>t?9EFw>O0XJ;n-q9flHg4s;W+*ir?8M;}$u&tiZhgiteNf23RK7m3b%Mm$}Rn z^YgkUIWJlfi8ojd_vW0+Hij&wYY=~KPn|46y}f=ZgGnu*bD?=_)Zk#N8KLw5fr5B7 zI%VHWa-?*88ink%oKTUu+t{rl*<+w1$!#DLu=qOdk zk~~c(@qMQ`zp2ke{iWKe%C7w*i3$n?lua!zC9{Zu6m8qcmFxCS#YPnB^gXeHW zuMfT0FNT`d5d9ElAKxvnn9Xx}FUE!V-kF*{fa=+oSb9dd{Y0(aM|do8nsx?!|v=<;k^a=xkkFgOQQx%d}p; zgPGjg?~&5^MyGDVyT>7#=vS8~|s0 z3glY(AiI2&>XK9WF+8R8U4knq24{-H?uQo)p1O>4JeFO(a!I=Oy!?c_;YkNuXv!~} zZD$er$yr6}_n#FfeAAAtT}r~QwhJHD<4BN8cDbaM+wobEs+|GNztBi#WbhY4D_k!- z4HC7nz&!0LWA8d%>KTU&u`TL4B*T9BfURqt>^9xmwaB-JZ>M;-?YPQY*T=c+B1uj8 ztfc*HiiJZSbpUb%0Yp1qF#P#`a8p?%{a_cKAvh*Vh=%C>1o!F9awUG+%)@dN_~2sB z{ITita_^nX4b`(cb4f@hfaoOo&E3d#VH&m28}=o2)zhp&Z+((sYwpk`Iw3~guij|q zubf2YVfSru`SNXfDwf_m9d>hmp&_U%G}Ietyk5Adr<}o*AI*0<6udg-kQ25^Z6qEj!kpx|)hMbX}0gIf23q zxpFX-=uEej4TVF>a@1$Q@q#>VtR$I^d%|1qmw4dDk!vN|?X>xa%O~|0h4ao^AT|!g zSl_xDZivHp*ScJH6I}q~ewmjvQld#dPht$A*j>wTgc)it$9^xB@@*qQ0G2iKKrfcv ztHb%m22WtA6*t@5cnEWQtb0m4VI?rjPxS`sdK}yAmu;sI8SY#%oN}@{0&GUh^*L zW#Ql&iE6{b+a=!3PkF()9W#aTR!_v?Qa&l38Y_M`6MxJKuDmNBvF0WGToCPr+T6PI zrESMVmEica1jUL`TEq>q8Z#=U78Sa2>)pm) z?R+Zf1l2mr;Qn24joOmxIS5F|)$^CfBbv5j6#Z^^!TBAxF(Gj#YNBe_edrwJ7B6a| z-<$V{+v2UMH*`#3mtpqoS<&nvf7LQgj0R1YG5*wj>ma9}&i7KP&VF5k zX+yh1l!drPr+mqXjRH7eDeMJH&>h(l8BlXc4{Q9`)$z1&?-le;124qxysUtu5a}?>yQE-hVY08G zpE|RU_)1yF;CRyBkcKx@NSIJLpCP5lR2jW=@MhW^HYSW#&PF6iQi*R~8bvH~8JxWW zp}qLf`er^k7u~9(t_raNs%xuiXn3Tk-d15n0ha!OvYzi+t>#lc*m|Yrps&WKbmg=V zld%$ z8`V$gm6Qkqav;gG3Wctpk0t-he^!pTnrPe3QD04gBs5(s5!HY^scitcQQr>0iqCA; zpbSS~z!6fA?loz{-Qa`=HJRe8`7DJeVEpw-)3o>fq}Xit)0rtUYu^F)K$`zkA&#-v zrjl8~b`iO^$w|wgFwsXXddIABR?rxq!pGBn{)PE;};e3#G=pnD%8FY8m%qS zo)~6iESq$cfgb_wB_uRbKI4BA|LPFMW1CFjGr(@OB}+7FTHYn?zG8@AYq6W$pU{1r zldZ6zRF`mp*`e3OB$<2`mZ&aO3`}~P4aSZ6z^I=$FH8Jq!O3s)Q8`mZF5zW~;T}`@ zN65@k3|xsvG{mfszwpJT_!(F8my`>wugMa>%3ER~FR61(0bh2~7!<1bEY9dHr(x*Ev^X5e0XX z8j4OVhmvr!_MEe2;AbQ75~5AkCMCt3FtM&X=MZdHfGMMeS$_)I!z?96yT34xcNA`o zE8|w($qgcGFqClgm6YU za|JQ7lBC1=v7UF3d2QrH#xT^OY)^K7VR^Nfr{4o~F5p)u`uEF5z`)88nuYTGLnV?I zQCg!yjc8fvYTp~OdXVFm)NvlPMf1~mT~>To9*(Kip8Y6C@kp@OeLOyM)F1ch4lD>A zIbtm~zA)w%Xv~u9_y1O4N@}G18V<x(n5R~n*qZ}J z@}MFA>La!AM1~nH87J}V$ugK*KRO3s(MVp$DYniB>Jy6BaHLGPq+q)jDP`cT=V;sI zv48Ig_iZP*%s!#z#jx@ig^8V5{%zPb0GXR>p3w$iv5Oq4R6m%=d6MUQL@{WBD8k+h z<5KwS1W0?946l2lz8wGwv{PDJQXEF8 zFn3+KsGx!g9MlP~fRd)V|8u=FV8#1CgL2Px!R{Jj@s*zJ zVPtBeNIbiwcK*`c&`iIjMePOcGa>6CN^mrj2%lbaj^IvH}o8K%eiIk?|SPhVM#xuh~NnhE^?bkB_CEU}9*MNY56 zx2R3@agP`=a5TWjT$T=~v5S^|3%GtI2?qT@leP_f!m*$HamLtzf?&vFFs|l|zl-u{ zkCP>+-3Ybsz)W9TW0Nu(fy%tY=j&B1B14|_&zMS*XySgen7wNr^;7I~$Dwy@<={Vv z@>P%m)@if#Gp^;k=Q*CA|L@}gJl75t&LXj|BALpmO3q6A$3oew$mrl zmlr36uz#1=UoNvS5vsos6WvP=ggotj>5;yItKIUxf$a+&vZtIb=7UfH{ ztanxuM+KV6Jbv!t_I?<0DJrp8g=@ zm9M@~Rw6d6Ig#tppo<|YlGyn#Z+!^gWXUJ(>>(lC0Z{&lPTc`AQ5(4WtvOKKP|~8= zh+|+b)ItJJ>5NH=O*)C8WrywGc`cYc5z6#I9BphH%Zmvr*Lpp;VN;H6WiA~ zhB-jwd{3Yv^wBmhdq+)0bT8sX=VrClrTKU_Pkvb5u9L)Ym{1^@4U21b3%{JRAg*r7 zum{gh5cHNCDK5>v=)`2M0>r|xY`0Me*SDu$1R(45BEPVLJGm7diUh&70s`++Jk^d2 zut+9CO`R$@VYmmu6_*;97N?{bHp&&es{Jdj58F3N-^M(r1HG18A4j@tcE41_^0GUh znynz91!VAx>4D6LnkvI$(u;8o%lPGX$)^=FB$#)D)vaYieGi=k+T25927Zt8CCGmy zN?@Mx)B4bgNFQhc*vP`eqcGdorx*9NiTRy})a0isgg+Pxjz_O;9zvT6%r#>?H!hU$ zQ8EO$2*l0`@SDv=5_!$`eT^`0@6*%>3}RlD7-5ma9Lb93u&aY?#zZ<-k>sawcI@de zrMiZXYZM{1?8p3-!fytfgOPmG7qUN#k2ntcz@#R6!FP%Oe zQ?(QroSLM!7|)CSD}O*VlYaMy>!V~)>0^KFTMduwfWv3n2#Y%I(wF$BqyCHt$)?<~ z3}E;Hyvf%zZFW8TH31TBXafJUB&48UiyysGa$N&)@1w%tyDg{QzDg-PkSEPm2S5LW z=@4{O{Fzk)OGy)t$^Dhg>dY&(Ct_=maht74F>BZ!2ZwqWx|u@_Zg(Zc1HB|^E6`1s*G_@X-reIpN^9Jq2L$jWfT{rsMev9jb2M=gFmQax_($m3}Wm(MVs^YXcOjehbX z^v;2W%l}Us#dGf&J?Y+~Zb$#QU#lfUGKwP{T0}eOwds{^lAUs`zLl<1)R~93{r&%m z-S-tq9#{f6c%jLgdm|ASW$q*zzDM0AQxDT$bOsOB4#=d(EK-H$DZHPiG`OeHmNUdr z%<)I7T>xztO^uINPclukHeDJEBzh|Hv9Mhl*`{!Bm0qe0dU3cWm#ZyYNp1(ys~$EK z3@_Uotr{s2ea+uKw7xg+8`ywEnf47-jWofQ53}}&*-q#4^>s6#t|*=S6i+>kn<0tS zghUzLP^EfcQRNGi8$Ck$Z+oU$KH8SgyNiGG+_vm=!f%~ zvPxdiiDT5s7(z;UcH6z$0c1}$OEpWa26GXYdobMwWVo-@Ll*d%kNVYPWcG;m{XS5Z zCH34-=a6#>=AXVo^pY1a^p=EGO@#*by4XEF)v`3a*`tL`p0T*TF|E#)bnviT?rhJK zlv{c%9$8qq^CDW3^Ze+Ncj7d%Qyso>#C-YIl>hzp+4x=z?7XPWFRgNI*3!_6uAwmm9`b7P>rXjq#%`1tw~qNEg$I(fZ5P_z0#8|1)J{y)IGK6=_%s_E`b08V@wBU6wg3QW;C>VsF#k0 zje)2ojp-kS!Pgjp`5_J-01lKFK z6Lcxj*-1S~-Ji;Uvk1Zr1+|6cuL`F_;O4x8CzOj{;7@!Y^6JG|zvJPfu=^P8VztTG z?^TP_Dq|V>?sbmTU*Lt_a6Yo2IoS13h5SfG8JFctY~%UKGcrs3fgN(zg;#bmw=SPd zm0oPJ)dKI}QaxNhzJErEA{3z-8W@ML6=l7s$AcyjVmXX5Qy=!z+!d-;9eoqa+lV#~ zyWc+GqhSGK2YHzVzSAbAaja;VIO_ICb(!m!C!4~Vd`F2R~3R3q!{#I)!Nsuw)yYN}@*^&5QXf1H355M5*ZeqRC#y z@!M9I>`>eGQl`-_I2lVQL*x$78Nkjdi4)L>e_caJc7|E2T{RQ2*O&MpKl6G=r8NkC zmM2Qsy|m-*03H!94VT1Z(mY)1v~-&WGUs%QHw3kl&r)H_juz6$rjUdz^NTJL#7>|X zC%(;sY51Ezr#H>th7W`ZG1`HmXK!rKc!HdAhksUphK9Wpdg>ror>V8gCv>z6wiEcz z1Q=-re0)bcf&$|H0n?;kpU+Sp43}I)n$N%wj%EszTcL;)NNHhkU5Wd#p0llT*<-|g zyy~dPFGE_~66URw zqcDh_Of$0my5*%Z+u+ZrTPH&S)}Pybiwrd~?$hd#^Hs&v@EDIwhoJv(K|Dl;hDf5( z7iNfbn9~XnmZQ`|ZidwYgGJ!n$8xopio{OIo9Zt^^Ge2Q4dNE6dZP7jGK^xXgxvt< zjHY%ceRBdXwfrUH@Q6vwcHTd)x{wVN#8`0{M@;SiPK02?((FyWdA;nG_Cjc@Fyrw> zc0Pq0K){Fgm?890b&a6qSuiYB63*(7lu46T37x+VgGQ+04I@QFI!co!cx7ux#QEaI z$2@L7?De^SefW+|KCQkOed-{Yyt&LV)`gM8S=e<}j;Fv-`oi}l1BHoX_1t4yPcJjR zE%{gcru>Wh#i-q{oduC@?5ZDlZMY^@JwCcP7hH!4zxCwqhy1uWr;P!Fv%KCQYS^K6 z3pW}z892^)BvY`SeAX2gQlz0>zi3$Lh5cpNY;8*5NH}XtS7+q{W1=a1}fZ zbIni20=Hv!2VBFI$0mRr}wp>J61Tyt98hs(`ovDfHEH3v%@@l=hiXUN} zuFT-(pY)z2j62^XORBuc9hdy@)jCgrQEK1M%WZ_%^dEOwOB77d|4iU%Z88(vbNb-% zQ*Z&dOZus>{8q7LX4aZ#^3xTyuw-TL=nbeb@IqqMs%Ns zTYpqJ-c?nRP~V3O|2p*LG2Puyi6{T#(un538-jdavG#(>IhGXEKWbuePQPIR7nr;< zcW|vrJYVG_B=s>`qkSyv$9MB1^`C;XN;%VOboE{y2DSg9ioFR98Q*wn8;BJS`l=@D_jgS9BS*j$7Uv&`4 z-&lDIt1zeOWB7HbCVK@Tk^>U#_v*uj9a`v~WWeQn>`e07U~z5MH-S3=h(W0}gnm1) z>P-VWvy%o9@2qzJdEh1UUg=$MypkXVuVRCGsauhkg&?inI-e+~B6`m0F0wr96h_b! zz2F1zNN0cxw%U65zFFhBQFrRh#r$#ic02zFP@l3?Hs~*n&&TT~2)ulo9=R(m)8#@6{8PlR+m9=nqHk1f1}1Ql6Re zfl8cFyBolkly<7(H-G5@k7b8BZmTjbFuUx@e|IIFrtdTEDdW|a&q1XNYgK5h5IW?P zGBANno-QUyx7{`0gZ3vpYeFVZ|CZ|b4xtB)1UOnn2dhZ8zMLH^HH#E<9FK8{J*N`G;|_1`M0-K3)Zt~REk^HqV~h9u*2R>oNtWtQavj27M=V*L zzLz>7T_`=q^_HEKQP0QFJ_^jTn(}6-FNE~2$B|YaT9X1}AD=v)K7!sX@z-ec)S@8p zTb7$%64+#SJ$p9;=NVr{v99huju7f^djP@wL0@85W!|A6-PY*xa&S6Sq#sTF7N7Vnz9 z3Rn$`9~QLfcbSC`dm+Yx1$R~5$?;e0t^kSoBx(h$o=#RMy-w(PP!mw=jfLU`Xy_y& zI(b#@`@Ecppw~kGkBi7taN_B-=GWQs`;fM-bs;U{z#im%J3p0Z;waD5jlbGzfX(|V zP?`Fn15W8?8Zu*fu`(ClCGCUofSh|Iy;8+ji+Z@(mrLUG43i1vkQf`K(NINsphKLrfNk+S_SU*XgTa# z!?)%XpGVDyVVk0K__)+#K2|+O4Mjt01E9OnlDfX~y&DjSHBTPNc0g~hr&8#Eb<@6p zg(15ans{k*j_SCS3+MATWN8ol9g`+SePu2Qf)e?~=l%O;?p+vR1*d2WAWTRX2)Djz zgioj3aa_WJ$_KCw{4b3P6O{>xCxGFPm|v400p$4qG*n%^Xc6|NC}Y6dFAUD z)To~r%X!YgRj91J8J)T$ab(aFKcLQcGfQu}uD4yF1hM}}Z8hPDFtQ%>83cA@-~vlf z>m1TKA>xHt2Knc%x8Gh9_Z8v+grPKI$PyqEm*V796?%gfP()-BFjuG$^PPStV3S>Y z6e6!PKZfE*^7!z1GLrF%a@&zIcRcq1dXK1yV8(3-gVmkM#Pj!OLJi-evX1nyRLl@d z{GXS&I@c+qAO8~ebb20#g80A>GZ(=|<+B+EPFYMf%Ia!onGr2CcCM(q~YEC4du;ig1tG zZ_+c*JWR=$1>q0t8{@mGrTGEr7+9w*se0<~=O_nN0lr4G6vEw+DCC;z$1<#XN$Eim zmK^`W5~}IWiyv?sPQNY6kmXuIu9%{_T~YHlMys**wyLIl>J(zyc{e#;{>JZRA>Ap6 z?FP0%gtDqz9H_gPy$rfM^C&L)x@ z$o&6`MVMn&&euji%8PNBW82X@5*6rYcFb`ltU5;&c%mJ(fnR-@9Gf+nSsZChU=WX3h_RmNfcci!?*0nqn8QciP(0@7knN<`0SG{@|Py50^!E6*6Ff#dLJ<$d{4& zKPRWqBEO-#rUye`8N`m-n7uA~_9TlY&ckBy3$~aKRMyWosX@tB^#>6%W$V`Wx<>`7 zU-!~i_OyvBa+JFEi1Jt!+sQe7lGwgzS2(hK`U75)1OtL=fd|30bpD2GDRMJ|Xtr<# z!^$HWy5pdwFg0dxgG{kd_UQ$D`j^0mImjeF^OKGOnLPykZ~T4m`VI2&QZYD7Km4;h zc$bg)qQiiAOCFqI=zjfkg}*`xn-QbIA<1w%sJK3J4Baf^3k0T+_m}~+wD->vf%<4< zf3HSaQt5)Mx=2`%$&7JQI{I+EO22$#WF<{%&7^|IIvn0x@<${4j}u0#b%wdG@izLUGtrCj*Tn?i#a;*qk4f%fMZ!blb7;cMkxOj=l1~gAX>4I z-$4s08a0DHX?N{gg4Lx-mz0H&%2+hDLjXSm{QgT2Bs&JX)3bI|7gzf74xsDb_HdmLQl0ss z#DliSjjKE}d5>YBYD!-e8Y2M+2|S5-4ALCAkNEVV7YXYHGxfW#WYE@V-l4K`uuTe` zn4J80uUBu~HuQ^ybXSGSQ{=kDGdOU30$#J4@$HXR+t(0o!6X|Duy7YJVuV|5EPHyV{OET^1XTad_{G2Y#ipDJH!}zU zENmfwyn|o-qTAuo#w5i4zq@h^Cl}K{e zZ7dTdpD#bbCoa*_Yws#_qi^3~9`jyc$<0VFt&|B%HgI2 zlyR!=doV+aeKB2uXR2?##GtD;{q?3Bj@1B&jd~u~imb@Bo~|!RcOX^L=4D$kA?GLNNi3sU=Z z#AE1PKfAgF&_gXD{@u5h0EsNMWm;J)x8H7=mmm?>PQ_d$@qlZ__#qs*Z?DDWk&@ic zu-`R5q*L2Wl0*zxqbM|5p#UyZdu;uv2y`9GsOoz zPWBrPHRJ*y@+)b$W8*7L$DCb5Zg6PI=X#lM*#l(einmk)=t|fhn`r|NM5Q;21iLUW9DrZD0Xvbzm&(Z z5b&Uae01o>S77Jy8WxF$IB?vd=3O>Zl z!134!5;a&r=C_Y!n)RosniOHf!H!Hz{9un?5!itE-pBHmgs$!=l+QkP!8S_2t(5Z_ z1RVK${9pWP?74}(Im_?N^;j%SH6}G{4mY9}-DmojERR#^r2&_E`>AD6hvxHngxqI) zRKulu{pJ}FDpB7*pa&A3G3)B1ebGL)Wc)D^akke#0>HTM{G-M|KS+Mw8!_~BPu%&= z{)2wddhRKt+B-+fIEGI0WB<)l2W5?DA?VTpOL`af|3LFtOW|1Laat)_0w9hsx`Q~P z&jijCcyb#`!(H@(tSMRTooOvMOB(y#Y=le(Kcq`?onl&n%+Yg6Cgtc-!TruAW}h>7 z{p)r<*4eHq?wga}qQV)xooYmyCWz31s5f!}nGj7Jp}EJjO)Ca!a|bv@8n~|k!|k8= znMCcvXCttwwJf>k2lZ&qr6|nK>z8uTtlS<9{02W*d=$cq17|G_ z!gb45wu2CJ`DwRvk7_(U7?aqzx<4#-ex5OPp9h^!P2{wvj+;)il|<*RG0Nyh$2Hl% zpTea$;^znBa0nY>qnTBwrB?CPD%~qbspP5^WSdiS-Y5Fe<@-8=^}u3PUqt>=Y-cUP zo`HdTzti~_92=SHQKBMI_TbRWz+ydbzPIXmfhPK(+b?S??$cnVN|=*Diz`P!<(c)K zq}ITpB0&*s-hSlvOhQDxeBU*!^h9Oa7>gh60&qx*cu2zCR}xR%me#xdLAm9CJ7b8c zi%0)d%g&doXH_(ch}jJSgMdiQD&LC}SY=_G9l=H6qU(BEneeQ7{dY^;LaPKzb1o{q zI6tAoVfTFbxCU{K>{}*C@hI8R578F$lVgVbEeIpx_qhLKZn)ywx^fiKEl?4p6lCUw zr!V*BnIGBDL_C&1;qa?p`yZ@W0Ds;V_6glkru3Bx_BTDw2gc33{l}nMq-t36Y^q#+p7DGdtO&t#|J%2ObrBd_^f^2rxB3 zdStBl0sO-Z1Y#ZPSKW}_`D0d?X&fxTQ8t;hnSw;Q>zGlp-} zxX+Eg8V;dL>9LX5WU?p$(s>zyN>u0rj^KKQmakArW4>ts#zG-r2|<iDL|t=2`LQ z;=PyoF3aT1UL$>7W*C!pYw0NY? z3l}uh(~_oQTW`RB$L>JkKv<6-OYZgfOFZvpHk>A;^MR-T9x)X`1Eez9kp0R*D%0z? zp}l~BY|r&LX?J3DlkafH&{BTp0U^*40A#PgHE$Erf_Q9t8JrZ%Le7upN<^PlLSA;7 z*xiuBR1@wr!!3=UR%WRi;07dnF?<*n#(jg_C0>Z-5Ev0lVv2-Kdol?@>-HmjYwB$-lE8R%v!hhlW zlh1$V&g{VK?78Q>C!X`X=ib-u#W7C$;V1U4%&QXH=n+Sy`JI|ke@L}g!&Jb2h3uUV zC+JP@Q1z0^*L~X>*I9>+$@24ziogyh*UZR!Quo89wIAU|u3orS^U@3xjAU0Y?sn>H z>&k{f@zxSKO2s8}+x1nfjW0+#-}r^CQ0A8jZqzV8qs5oSL$jvxRamT_Hm{i)3*YcAx!5PDfYPTE$pAz z^ou*kyBN})&5wdUhh>VQ1v;36M(|qLSs8OQatAvapi_Gd)|~29<2t3Usun98<<7b@ zmq`vMSe1rf*(+tN-_7icqqCcMUv3v}O!d#uKyK7gohRp(4jZ9m{pB0KxNEl7ss^|% z73PVeW#n92{q3EbEB~CRYQ$C!+$Kyn-09I@na6C$L@BZH&=218nwk@~>1W6pX&XFuSB_}j4b48c>2C``fEy!nzHzsS1VqD`=DnOu!e zj8cg(dRSI?*^++-WSxmc;P^!g8}}#%_*QeutYT_cw8~ur{K+ zB>m*3#$I}bCsjnAT&LO@Fp9idoQ`8=opTyW@|~wG0kR6uGT*OY1e=G}QmES?;T#<4uD~TN$88mw-VQ3cBpE)ob6Rp5OJF$;?!f7-i z(cB%~Z=rcE`@0(|y)eJ`Bk(IYbzK`M2gHNBuYOL_hr@^qp+Qu{2{#h*`0R>mY6m}-F)awd1(+Y8U+gmCZ z&Z0Iq8Wm}A@j6veS5BnU5%%E=w~NUdbCv?1Vtl4Lg-#qmSfP{RXQH#rIGn$y;`gqW zam2=G`%%BFdN(`1?Xkw*G?`i&AK`Iu^hk-hPOdADf)i>9R`acFMRn@Sq;ajW!N%_@ zZo^RvaZU5JXL49$Sn5Fs3Fgywb(Lq%dBzRwFO1fH6pp*!{#<#u@Acv{R}jyzi=HCH#m46CYiWe%1&hBNQm3pq z($s6+fg+S}Vc`R?C;pObDbY5*>9N(t3R`+=9b8LUqS}9u&09v8mRK5~vH}}cZ~U#@ z0_Pvg616544^m_tby=GaGe3Dt)me~Egie@Ffmu5r8rinNqUCkEbX;ve`MyzTL5CJY zY;heB4}(Z>9<;gJIdBl*sN+rRlneAfpRKuu&RXZQ@cyh(***$r(O8<x4WfsaHvz z(G)bijK8~T+`ZM__gbqHXZZ;u$$HhFriIpUH;K6 zx!=CMP{N7r-EhwUnPz8Xd^U%WWN$~|+I*`5fd_$EJ8MF0sev>xc_!SO)z&R#(iDg5 zLf`bQ=Y1qh=-AcNUGgR70Tk)0c$DeIDa;M1RD~$>2svwVM5!NlU3hFg8?7BH+O|!g zcIFWz-;8NI6RfyNCa+z9zIVsT13maa@HYr6$wJzk-)hgQ1ZuDqjg^djmGVXEpK6mu zeN^aT~c0`6l|2m7eC%jK{nAv;OSE9pAeJw=k@b%JIC^9a;eBn+i*a2v;y{lvy>3^Q86mHW0OFJDpzU0BKS@*7k zkRwEUc6l_ls!F><;9d;9^% zUjH*mJn%6Q@mOcaVuq)+;)hF5c~k`yAY;F0yHd&IkZL*n#WZsc-{v{A4Hu=wnPEY3 zrLlFgnO^r3L{}Lg>zk~CFSDQb{mq>6o@sXa8o@=HRJ+WKsIie5)|(AhUE6O) z$w4j^%lM7Kj_nlP9h`sb7F;SmX?m>VW?O8RvjK#`JZDo0lLTz6hB zZ4%XwBUNFYULwc6%gv`nOIDm;U;XBh4pp?x=^diN#|?l@=OD8a%O<5@JTsu3k<-sV z-E8MZb9G)u>2SU=cfQBRR&qi%xDz_R%;63Jrs=S45}x_EH6`rK$XMTBO@X!C*lyK^ z$ZnSq%USY9p~5mgsYKft+8 zILg^qBO3A@_@?TaQb-Zm=IquS(#HP+!RG%834b@@cbHYb=bIIrHy0m+AVONG-&EdM z&ReX353^{09Dm?->mXX3W-ZWKYGOY)uhg6s5$a!weEC(%S4LdfJ>y6IIdOTVM;#FS z+5xGK<27TJV5cGTnG;?@d8}?VULS0&Yo$7`JY#VpR}p>LhmI*$^7ZK_NY*9dYD$J! zr;R0#rD?SAt`zFwvCHIB3?8wl%mNRES}Y!=T5-yN?ZOF}N=aj~9Q053{KdqVG(q0Y zI}7_E1(WIc+~6Xer#23FDBrqtVJSl$(*z=e=y00So$*^?k<+BR z`JJq{0OR#V1>b5;#oa}Rw^4_dU`Yq@q}6?_*B97-%M7ams z`baeUtpF*_SQ@8|XqL+uT~ckp7|ca2|JZ2%@z>SrAZvnHD`IA-Q}LUmke&;s2#%%J zbo1q2rQAr($z`AKmC;W$i|RPR1-Z?aU`Q~#j@m7WGbXg@T1J23527DxT~TIw?cJ3O zAKUh1X~I~{+0<72S*a=MJifvZrS3vnK$}j&%57Y$$0{5r_uzY3H|&t^YN1ot@M(F;czu44X7desr3`-m)~n z+OQ;_0`24R9610y>I1l*<534PRX4OS8UR1!&zM^+)tuo+ ztv*ci1U-)Sf@Ea1!(?F4qt#Cqr{Jv=4yVYQ#m!1+VDh*AF!k?3y(DVm)yaop+lKDn zfAX{gFKiC?)gdm)pHTQ$FL72(xwjf|4;$$Ef{Pov{1SDO@E@~e7BvT*xH}|&SpfDp zC6)SEbr>G?s;!6CBlb#5aU5~K;peLv@*5iPxa+C|p*CfZpHsd1fB%-E7 z&VG7>b%GN1N>urKY6PS{o_{Es$JvCZi)R9_n+FB}nq%pu8)NAOD!+^HC_!9cA$QrA zahhr6g~FecWZ8Q?z4Vsu+Z!xIp>>; zrN5id3ok!+VTp3(uVL~~*VyeHG!$9dOE~{t2I@~HXC*4&DMqZC^(~ftD4p^(dL_VK zkcp&xx&$tD^&Zcg287>#l#Q9zVi@HbKZh1Et0&)#1QyHwe*zWKw?h@u|0ggnmfmY` zb|I;9@ly-+xy@UbbIBxs#DlcZZ0@#iZ%2`z=juhphM*C>Pg?VT2y}Kr8tw^rqVPdQ za4m(b%g{<*R2Z%0XbGEyntB4Od2Ic@o1jyy{wK7jDm^A1rFpF%^%hp8bNM5qazn61 zJ}qjUoimv=>^0rEolm4+??*;LQ?#s1RcTZ~4NV=KL%Db#6Y#xq;rdBX#Fup+;5L8I zSOZS3^}8?aN0K0;%vxzjj!+G7Wk^54kl5Qg1*#Lq6YIqSd{4iBK!2qZ^E#m&|5|*? zW7ZF{x>U3h_eulWOT1p?oI#ZKx##&yZl0fA-=+g$rw)M8W351~zuY>Dh{6h-6pPLP zI|+6c{BWHiuH-8qyM&-TlU8Xi?Bu&l0fw5gk(l}w-Lzm##wU|b6OpTJhmxzoOj>@? z3LgTpb@sP5vUa(cw{Bi7G;unh{rbvu8<}NIlznElOn}sze&3N}#l&blxiReYTs^tl zsdRb+E~A{JZ%%{8Dc$AS0EQxpg#xp)UO5m|yk3_NW`OjN=yJAhS?Ws~@DEuh%U%kw zvYU9(eJO5^Q4T{jg`y&EymvXU*8}@sO2RITxGXsBy`(AG7?SlQSrl!LkE0J>r=Dd8$Ans)(?r z*}a0DP^kH6(jdgd@kFPBq0thON0 z>!NvH7IHSM6sIZbs!YS5Vx}+j>d7zsKKjUB>-(U={Nj}$I)pp~;?<@D9Xj~nurnga zZ!slnDOl{yqrKoz_%W_taPphF#9?w-HiJNuIz(gy;BXq-e?0e_V>!UF&9S<9YX5uN z)z(-yXN}H5LIL(Nv+A3ftJ>NOQq-D&FK(wvLeS>r68C%}1fq2t0b9-m2NTu8h>x9t zyni^ZD^7>f)rqtHPvA3jAh)RS1z(B;2l5dpk`Nvhvm^tc#_1E%QGd?TbTVBsLJHOA zhu`$9P|FvE#DE-a^_kpbya?%f*)aZDJ{Cb=^hG|i_zMMg9V@bok1rH@&E5US(F$gW z3|e2o-d)MNq&K5Tbgp7))v)qsR0!^X)t5Y=Nky%L4N3An5*wpfdc2PHv_+9Ru>|xz zUz#h)Q4=sY@k4*-xGn-B!UHxP@yTG$Q13zVLR3J*-DuXk-fzGAdb6(S#qX&O==^T-`Sjle zj;X%flfDFgExujS0`%bG(Z1Do?VHJoIokBa*onkr|AD}(dP?~15$oI4TJA8T-)_UDq6bYx?RYkqL#uZijnd5HqCH}TBT zj0CZc_1AlVi6`IJaDDr^tulRRbK&H;H+0e1dsxw>%sPhe#8`8JD}CgWZKCb+Y-+XN zLNYb~{wKy6t>m?0e3cov_;@_;?+|#lkDno@-7L3^xp^tGE7G9o^*^tc(BSfIz6|}K z1xp3p$4^~*q>F4MT;p0&ay;I zhw4lR{juJ!D$i}2;x@d^(t4Y#_0Lo?jGV$Pm!a7Yzx@7USSqdf7&{7!d)rKux<3mK zm%d&Lu=V)EX1pkFwy+EC6iaiEHSyihwf0uVw>`DgP0U>$TwFId9b?@|2+P*Xr-JN6 z`7^Wwe@hIODV-p#p-J@KtcwK$@t>5ua+2p?ZhL)%U><16 zj{9axMQNS68%_7esZNO7?%jez$LdZb+1!80A>y}*MZkDD0e&|~VezYJIy zHhXuGqU2mOXvNFD`6Qf4T>g(4mV*Y38+LtoThNMSJKf7DX^*_8wT7{|O}M zgNF$u_=0p!9hs|1#i$Uk&xc7oK^d1e5ZB+d<3?RGc?b+c`q#8L9Mo9&BN;OXA}O+C z3&3E+Z{{m)xrW)bG&HA~DhaXm|$2;OZK>NSM!+hwX@`3x==NR zqcmGREOQll6U(?B%V;Olgv*Z^1PG9`c@;nQ!G-?mwHo$Y(i zV3dICno!z$3N$7#9{&HN^duQE_a!|_(S~Cwx%{D-(Y_tZ7jVQvA0(B5jPT>J;`0YQ zuSR)cNbo!=o^Q8Co40rei+_Ib^{8mHA>%FxEN1kknCjRa`Gw(=oAR;4{iw!!@uMi^ zog643raog3gOm+w5kx@fXtCTSo;>SlFMzd+`P?i~F5Hg(shFTA5_d!Noi1tAmNK7SirG*)ijhp2nUokHe5TetIY`x^9*rSxuve@nbl)GYfcXd43o;f z{Bw5waZGS*8$MVBmLu~ZQY7NI_e*>2`@^Z>2hdqmj#^%O6Q3||t%=iwjRLvfY$$_K zomw{P0EQQjb&+j&&@d@}08ynNs(6nQ_`XbZu<_tNY3o#QLV%(AQ$aH5jyD`QJosb> z+qs~4m>uF_cG#;msb&RT-REyQw6u)qQJa`8S_OAbUBPxZmIM2Ztwoq3BS}|Izj#NM<+`r`9 zBSR@b?am?)0PD$8GX@If*FReEs2Scem+-p}Sx5GF`Gf+1!u$j+bV>OClYmJhp0;L> z`5`Q?8rQYpm6y?A{y}VQrsy0JjU9Q6!02Gk8ExetfaO0CVwCz+?kxKLFcF~{1EKQk z-h4~E&R+59%PdKESs8YwZ}FtPzd!h<8^Q#s?6GU0Bv!uVn6u?*PCc*`YLvYgds?;| zB8ztrBMN&7+63u8w@-JcAsr*V3LPT_jr6#Y6X5?LENKNZ^KIbhA821$)m+Uo5}TnD zzjyRv>pWG|;IE#aeR;F$V@-Q7Wm{{4$4pY6I_lANV}1n)-W~P@{lH^PdPPa`&`W-K zmk7wdJ z)F@9~dd*~zGc1}i#D-UVU!U=|hWej*WGuM#rH=6oq>56CGmer8!itU$Q7Wu2p^Mti zZe}g)=_v=KkfPiLdNw z070^=-rTMfPMRHRoD)WhOB~z8AB;jlbI$sobBsHt-KD-ed&++W{7?80_Dl zbd00dTp`!eZ(xjVr@FS2G>%bT_+TzPp)+^~?hXeg)y=|b{?P0r&{YI>=@ap%kn46Io^F*0Df2eDS|8%bsExuiB zQx9=!8V`@)MsMI=SQ@!=Qgae)X?CyDw9EptgbBCJQ`aDL(>>A?#=QW^2)(#89|Z@$ zx%{dORy)kIu+$fJM$`R_Z%m^dFcaJ0Vc$W1LN+xKx^cI?x;Q1q<7JRFg`(s0PrE8* zj@C`=UnK?2Tar(c-Mk7-LWwmUJBtv{dZgYUi;F#G-}n9s(Qk7pxW9x@#YM0%}!S5;%LrN-do z23NRzXjLK145tj<2XSzj(WD!R8++%7z*an>d@pZV6TfQ7Hg4WRgh{riA`Tl`ECD-U0CFQ32+&a zbU+7%^dSMZo2*cRu3)}eUnfOV6G_^U>PQp%*?LKSB#=MIJ(Wc-_f;4N-f1+8ZU2ir z9_R$hn-S31zI2)ats7s{S@K3VRhKS zG8yN>5{uMM{6i~zQ}$i8Vb9!S49?;Iq55Flk9!h#`g=$)bjctP%bz`%`Xw(?goA%c z{nzAfOSd1fQ3@$ktd5j(PQQCF1l(~&Q`K+Jv1q)mQ3wSD|6VW?wXtafCdqzzp!3fN z3Y5}dz~@8ZDaGdd#F%_=B7o$`H<)P`A7Z$CZbURNok_;l@9>`sWQK3W-I_WKk_wJ` zfie>YFJ4{}g9jobU!!`dDtx#ddlk`2J2WNIKAeBh5Ga~?&3;#{IW)rDGJ*Q4WtQ|5 zv4)_&e`It~8yz^JSjbH^Ltpdt_sxM<65s8@CsECxpE`daqdf2)(SYg|s?2CaL$O+L zO0VbWIO`O!LE2eOx$tAOGRJ?bBBag~1_!^5e_BCHZpNY0QLE~+eCZXfmG z8KuIybi-*s`r-0u!kog_x<#}GjYVlI$IMzUhu9hV&8bXqfE#PIBxYE`cNh=;QoUDs zuPP*#PlY>?Peo$zlar^h8W#V^AaGz#v6peb^qV;~q_iiKH2eE!q^GDT4f`3hV)_|L zFMgAnkla8>mVA()uoVy8saP8c8u_O>n392_&QvA!6)^Ld=;Z{-q+hmzuO2$SG;IBI zb${i4ul)GoJBfsLLX$Lwy=nwO4DNeun$%C4bsHOv0=umDomFt%Bu^ zGA)w$lXQS01&l0l9U3i-l+u=#PXMOcV$m4b^LEvmND6}yei_Jqgio$g#sO%*Z8GK`J}cd<K{c;`7H2 z5<3ipgI`RCnCF`s_O|?IO&0y1utd{gQEkcTA%PgN@e{u1T4>_*|Kcy@($F7-BPT+S zm?{74#VOL6!y0zZg3d5Mps<`emil`{f6|aD&>dsGE&V*{XbJYd2m-o+*0q*Zk9lii z=@0VHwX(=Ubdlj6%O`)5FCE~e0tSvhN%Xqg0i{}L3-;nrT!2&L9vE-kw*ib<{HF1h z62_CR3&0$*kU|BFht;oiFDj(Gz*yhum!V>DuMqG&iEVnd(THQTcK}D` zDDw#|iIp`e6SMaq?V{0N>!rPhS7!kXr#%%}JMhf$2eL!b$qdo4po?!MhL%LMrXUB3 zU1%W)8O7{h{c>3P6h|qa+lo;1LD{YKk9w^s4l z{@p=*`4#);Dp@1rdykg;8Sw4ge4uvUm0 zFfK{=2`!BWh9M>#6T-h%9$4p~iqat;lHdmFsI(}WIiHD-_+1GkWiF?lmP^&N(C)K5 z7bFAgCk2GSp^gseCcS(JrP`+N0I6WTgcu*NDEUhJWbRQ(eAk-sdo|_r=2r(RT+AV5 zQgPnBwLO5>PiY(=v6I4&0 z%m>Vo7&QM$1)@&m7ZH2L(LL~$u+?h~Z8t&gYdi@xs{4slWrw`JzQ5ZBbu7Hd|6mPG z=g&{U+0ijR;?mWknwo{zQbS z6DyCI6%jz^+XT=#s?zG(bSGi@D0XVtLkH}wYLs@Gbae}=38QQ&;ym^OY zBs{1~1OHf9_>+*{v0y7=Ne4~(F~3`lp)Q~Oae%crTN_^=^}}^3(G-kyKP63VEc_HQ zjV3+*aWlHYu#jn?je1Q^Y8G9rhnCyC9}RlDv>CZ`vIkkIoI~FwGj?5D>~}jqx@^iW z;-6oU^HS0$^he%RWX3`9e{9dL5nqr~BM3{vAr64(Z_3uB9T9Hhl{-aYg9H0{cOBro zxt`38mL8%1)Fuu0i8>|}dQhA6r7$_D3A^F)$R#9ymT6}3_(NHs!hF>7h!Zzwv;9tk znKS2vK+Hyn+zENCx2=H+vPvnWMzwSuVs_r(_iG1IA>b#AEJ6jUZHz@O`1H6pG!pPG z21|*G`a^WB0)74u>LJNkgl`NCDw4C+T=a%2Yw_~j_$zuL|G~K?aU2O()DZuYwdy7~ z39OQZ%b@D0aVP0zL7GLI1f?6`Vz+$3EsRXXR^YTBf=fnQO7W?u+>v?zzDo|6EW%GzzLtMgJ zmbSPNYR5hIQ^5mLH1~Dc`x{R`ax8k3Mp8T^9iI%|IMWG= z?w5tt&8#S zH^g?&8?SS-E!vUmzG8l^H{+Qn6`CM?w=B5kp9(6S3ojm-pIw#YEW%QcLpH2c4(4D`ld`w*Qhp_LHZct!)77R%nkVbLe^sH{Eko_`wrOO zxm_;eV!sI}wv`pPm=vgu^kfxYs}v;bJ&)fDEm=3(hTv)H@x6HJI~>Jb#2r!j{9umi z2nY0(UmxY|A91?6kXXK4JzQ!(X@Nf>m=s}dqDq21)-^|@4Iurn2?#zj8`NLQx2={~ zuNXU0N5n^W^gP#3_Vxji zM3$b!vLBZmoKF%ByvF+BDu#_xuhTo#P)`UzpA+4(bp>8Lf)%MGND&}Y0n;N;8bmch ztxqFD1mvDm!~NK-G#HZbdMO3o(u-M7;6K5M;vO);0uO={;jSJ8_YY6+j-(`?1($DG zqRn$eQ9k_Qfm?7an4MeY^Ew^=serFQkpQU z-ni?U=euEQ4^~{=zkvgtE$p3Q>-R2w$jF3c)(Zp`jUEULCH}_j$K$>&GQdan2S@?~AzO5#U zHVz9zi)3Z}K6m6QYebyj*G~cD7*A5sNIsBFv6ErIq@tnu3l-T#HUz%^$o1nsw*%Bn zYIw5_HQ?~q!~AJ&5#}xboa{Cixld5{VK7uH{0N=)iiZ#G{*(P!iiVt8VOysQgjXfr zsApUt{92MqvChl5r0eq4Qz>f+`y07Kc=-yJZ(872NI~2kTEqGoR$2KYD(nuv#uQFS zNj%;^n+)Kr1&VzoFdiGPeqF2{34wljD#XNqdWq4HlKqk1517~#gKC9??F=izy#z^M zJ*=lZ4ebBB6%EgF54Grzir2J5A^x(=0&1GAxG43mg2AOb3AxlgYNz|tRH=Z40O5_7 zq|CT(!<+6m(EbKsW+Y7{=}nLawl16o$#)sk?JJC; zj3c3wTV+WJP7_s-D#@hkr~53(d7zSIQQBcvis6;bFXbWT2) zj;7lN^@JW6({R?*-H9I@^i0#Vd)@r~d(*LHo0?&HxZvN)j-0lrEQqz%mBB$jqRkL$I!J9r3F0y=rg1Zk5Fi$ce_Zg3}LYt`pebO+ESvqRl>1b0gdougD2ph8>@Ty0*U}egbl}{R%6g^lO`G-=?C_u#zYKOHydEB-=M{-i>;lyWOafbFWv8r$8M|MxE^JI0I7 zf6FmG`By>7{w0cknSUc$EE*g;yJ(a3N9@jii7ZRkW?A&lsFKvo%hFK2cGjzi2VTX5Y|A$0?t|8zSIyjQPW`HY6F-~9K~%UY)QeW70C&mj z_Uf;?;50P4W3LDG%B-9&k50X}gnmM4mVQGzkJ==;tR%;Lf?gK8W0Snd_ldMWx%zRU z`b_zUBop(CfG_lhP5rKAo&nB+lbjO)S^cR=0wi;F61@fqYKxA~bX8twr_|GGH~h=G40Cv19!{EK}W)8Wg#nS&Z(9}p^QVKOV{t=vvC>!jVisN z7k|?XS1YVyH!H076B#^unmocXw)M5n;}@ePR^!+5@%mYMQ(9JUZL5n{Rd(GY6ShIX`tp{n0trphNO|xRo8)-)U5t%ZNRBQZ2PRB{A!k z=GfOXWyAEHD@hGZ%n8fZ7%WfgztUj0*1$kUV@SOQU=L#@AA+4nWf4I+HNBve+fqJj z+X{47BSrza4xYMaq#R9-Y-jH3jkXQclXa545vDWraKRvw%>Mnboy~)+NC$IENP-MP z#X;t|Txq6}_1xvS9>WnU#m)&A&{Z*STxqIo@2qlauNS11+-IBi;|=4XkQIW|ztM3b z`S3X(1{)ykW{zd?c|;OU!Zn?TI$HK(oQlkj#>yu%)jb7J%}F7V_sy+>3y|rrH!A2( zoNY~v^TvHO!DmoQxE_liF1D!{gR_tKRF4!@!!6OSo$%WtMEle>2l`T8f zT;IAXdT?SwN$EHrPz2{{|Ih$YNSo+0%@kUoR|*-!F;XQ{hwVq#3AN+5$|=6>hwlSRQt zZS$K(odb^2BasnIF!UrpJD`3CuS$KtJp<~{urN!}GEsTMlJ8gCyChb2U)4nLO?rOs zs{>jyk$_j%d7VDzjaa!#jq1=c8+%1Z#|vRe1Clx4$!p$nNmSdVVGeVpmT-%5 zN_ojS8+GU|lq!M2y>ji+CbrG<2Tz{PM){r0?w7I*jG#qh{)zPqXMJlQ%@YOaS8T-; zVv|&Bvt!z-BSd?_lX~Dx7)k>#s?_JN?kB=h{JUJG-O|#su{Syi*ZU2UBs`AOMJcZ{ zBe5BP00NnNlXjVX>jCTMzSyg}-|72&ly4ayKf<1uCc%}BGlf*Q>S{KmxXD9+G%hOJ z8#SMlvkgf$@07RkU#L8_rYR6iU0j_Pl{xg;1(${xMKANKCz7&T7ejcy#qpu3I2lU9#Hy?FH1BWdj<_hrN9{r+}ibP_@!20SJ7Y4B24{)9c0W4naZ*Ep%fe zJ@TavX1f?rCT2Ku$rxBb)lj!iU{|f0(ZcWc{omt7jpqJ(y))k{Vb~B|7LI_iWPz=t zE*)U)1)evm(z_Zy#6Xc%i1c5S18~0dduWj`hGlx+aUeSO%Z;5&Xr3}AY7Mv)w<+|| z>xm`fHoquw*j#Hv98%t6M-2R$^}l+DK+q|2#QvMS1k3J#2oYUjoo1jca#K7-q($AS zfWfX*^!ys@KDlfFI0_Z!Be|x=f9v~5RlY{}s*i%!3(wUvUu&sULpTK7$NT0UFFBB8 zq%~_I0TweoSdI>6;evlkm&}wlbnOUSFq#@|2CkF5B(2Tb*3;KM(nL~aj(UUeR0owW zuh8wic|dm19-Bj4>x|d$MkaT`sJ7K)QlJJ(p+xMmc@kHSa7X2H!dJkLk2@Pq-NOoL zdMygWvg+bS8fVfyS{41)m?pyFEK*|edFd-J6TN%SSLcXvjHCZ1+GSr9tPv zz`#V`tMCmbeuPvn^z>=_dSsJTw$OO@(wi@P_C?@0=zgZ~>8637IlivGB zOtG>24EhyZ@nKIsJ_-TZ->Jy1Pv}svqPLA?G&p{MeN{zdpEZ|c%Cg>W3w9dUh@t?K zbjn!f^_lEjr>*JCfo@1Rj_hhrCmY&hGnEJk$2K6OrTLtuSS-1Q&|y0A3sN?ttVIIU zUZano#N5Q(3Il|{cv=A|NLE$JgE^Bc@PT&XomHh%fQ_9ckXmX!_1;;vCZYecxm>*tT?dKPr#Lztt4B1z#Ae3HyBtbY{ zCbip+3l_cmOT6fzM(6~#{JK~9%@iL^n}lV{xqs+eAuU&?_9^U8u04_)>)5}l8;ZFM zU{1jl%bdksW{cP#h9AHLCg6MxibcQ?pR)8;CqK4i0`X?Lq()_A5IN01NIyECX9&+i zJ>!!E3&MH{L-;J2oWW#;yXfy+MtWS~;_ZeQc6V7d^BZN_lv_GAMYY~luv^P zx)VUx-Y#S7(x0f4e%!Q6OU-UHdB11vEP9$_jWss*=b@evN{1PM6Zj+qc9l;Lgs*xctlc3@D9coK(d17eJk)=ld`UVJQgcj>E_r7yO;UYvVL< z_rAk|Nw`f~WiW@K)L&w@PsHk`0g5bfpuef>Rrseqg(WFW)e`)h7L_C^ggHSWP9_Ji!#GLm#q=9y@9oG zneaJkFmkmH>UCm!K1OXzNUV{(mi<@bWesSuhIvH94^02qqt@sq(3ATVlSY2@bSeza zCsw-4WPYo(qqpi!$B*Mc`_-#s@hyqfFf@P@ou+9t^{Dn(rTl_sJwnR2XlU76e`n_F zpP=}=%c8zN9*Xam_c)E0jXZA#y;gSRt_wv-GOwY#C*Z1P?_b_t>&S#hf*c!e^nbst z9-Y{-os1Oz*>$|#oMqS<`?mT1tHhCe6U)R}+g)15c9^i2hx_s?on@5H3}{M(AkWP@ z-`(C&ZqwDi^|9LGjMUZjnKWd0ftJSahF0JiBb|%j^~T5^Lyi95_=?z@h}&tEa-3E= zJC$=JPFGodemy$YX=+JB@Q}U2Rq-6Wf!9+po;$+aNYs3Bl1tyT5b=uD3)HmDf_k!# zu?rCy)r6*B;z}a|dOz}GDtJf$dS5-%#5o6p5N2}uwtK7Q`^l#*i&9wQWkEtE%_qdWZy9we?iHhq>G8N-C zU)2t$4n}2l0&Wc>IDX9P_T*ZyDiTjKC0{|eSG2rEBHt;|w@Y=O>JH*O#$9=ToT=}- z3I8lx2kdso+UX6!skHSabOT5cSEcSnm1n z<6crP?Fv9m{i)+UlFoQE1Km+99~$;*WO+SIzrAi#4P==g(cX_sX|r#;ESq*}ZJTe| z{T&&+9N6$|NGypbpQ3k2taI|+V^q`u9CxTP>kzGg%-6yo$?7s0gT9+uLyCPRm3Z56 z8a}y}CGTJCoeMNierg`xII>2#K%Ph zsE@;_gSS>B;}x{Obdm(3{F}?<;gsj`MVT-c3ItL6fBAv$^QFkHpWg$!m1~c)40w{f zv|*pJjpXC=DqxgB-~{nZdM%nQiQfMKn4AWc{#wPPb>*{Ta^<5C#WZp?Jf}iljgG0K zk7tyV94iE;IxJn>E-CMw{6`f>hUqq+5(0>ok=CPy(jw?DUL6fsEEBsE0F#}sy3o)Y zG{_@edA+?B$Y*q>(~}XlT@s06iAN04-OnCKaVC?qtG;vT9o1~wrJb|zSt##YdpKUo z<`j48^J~t{2C~3|AF9GH__wg<{P3HkG6NR!VIKy2AAH%AY{8CTWtQ2GF-OukWig6! z#h{Wx1tWsOfQt=H7#Q?RV)OeS7<91_P061j8!3{cLr17K265K_FHbtPVr~}gJTDzT z>D#e|@L$XkJQH&tE2t+rFaw(7Z`fP7GF!=Ip3fs;e+D`HlI?^ieDr~Iz?TG?U$XF! z_zSUq-c_pjZC7lF%$q>}n&GuVhLu_isr%U&oDM*O>x*QAAT1%m58L8m6fqJ zLy5Xcw>*e``pj14M+wAL;c_GZ%>1v|(rge`X>YTuF_&NsYJRE3Q$DEm_i9;GP_0NW@?J0-+`AyA_fA(XH5CK0#% zWj$`?g)%#_{EU1}WDv~&PIvd8{G&JJ&zh8!q}S!23w6UQaX$`z1$KgDQw+K>wnPYr zgb~N8DHw)pgH)w!-N+L2tII&(fyTdwld$J-o@jIZB+Tn5?H8U|^w}ubh=TI#OXi7X z9OxXmfA=?Hn_P4klkG2a=I8S+j6c&jnAGt8!VLsFn_#p5dinJ$`Eu#GI_!AmWV~M% za={n-Z+H5aA=<&2y?YE$_62099J9iS9@b{ldXVb(ntWZJ#~p`B`=p3ZEX2`@4*p?o z??N)DZ5L92c`q5}HCbv(RP#KCLU9}vlOmpOaHR>8I9l5;0(OIZc%MGXuMZDu7xtT{ z-ehy~xaJAC8XD7abSMCJh4}H#Wjc#qpgb@-a)6!RdH4SC8rP9$t4Zu>P@R^xUkA<{ zU*=SoJ8pLI3MO;3^FPhAVJ7Pajsfth8K#Xb2Ui5%x75m^=KQ%}7ypldzjX6A&YKZ} z5%6?6uW|@LO&6)FSgow3q#Ep+m~1@aW@xR+OJi0U(29m-Zy=l=6N=Q($0XJun>IWkQc9eJM0aFqQP}}rH zc3z4HdN)H8NRdQI3%>Kt&eieB&B-r@w=N#To31ABmZA^X5DUnQzGZp)5PbMwWE13L z5afe`=)bgJWXz&BJoi?KsA{}jtSXhYki2l!;q!hCdjaFyKFgiGpwXFyET$sK=@r}L>F{SfUrII} zdJAJo;}#Qmtx+e7^NQxBZxl#CCe>SO*<-x{MhQ9{o%j0C0)hfLwmxK1y_QeaR%o{Q*4}qI6L9i{Kpvr8GKn-CIZ~6BvEW7_v)$LB;f`MrG{OlB`AjrBqTMUF$>| z_h*M;1RpY`Xv6mrU$H-Rw&Mw4vBWsB#A*0qcCoJw$l!-Vf->ui@(glLNGPr~lrfTL zl$V*`x08t9g38SjB(ctNz8Ij)mwg}>E3yOJ?r`d38LjM<^So-MKMs|(xkop8%2PQu zqdl_$lsl;t-4*qhR)8&*?tUTI*fbb`Keg2?SiK_b9YIf9%||28qXqJWuI9IuCXVB% z_(XyfoV2Q)Q)%ZpQfl!k;Gxy5v{iXZ;@%)!5QcA(#!N!=IY0+ADw{GpCFb+z0LopC zJ?D|kBj;W173;c8lfY-Y+NVbwech={3?}-uo;29|uPx4_zH*qqUHoxYkX%OT3&%Dv z*G+gZdZyc%^m1`ki;ILlp%`?R{0FY`r-+WdfBVjTVdE&Ca94gMes+@huKe+wE4xlj z_gBVFUJetl%*HPBqHZcB+1UsI^X}{!c9*G;zGRBTiNh$c8GqvF6yP&(qdV}OjDE)u zGYanauQBvib_p;_!lmJ{%#;Sv=ks2!;Ra`Kn?m-NhD2w?%@ALK>zf1wucScA-KNxg z5vJ`s7hr_|hpL|hf^y;^j0dce?eoZT$9UPvFDp_!Cf&wif1R;|RgW)%GN;D%q^X-P zR?Q2i*W>+ZcN31QdzsYX@d#9(G$;s;DQ2&`lr_qimX1h&G@)cBq#lQ3p5sQA9WbPs z5x^syOdHQH&?s>?J$4c^+g#~^30D3v(H7&SZfmIwahc182b%3da>l#7Fdd~ zfv%6L_cWZ+$yWBtK2Moafq|XJ@{x3Kd|h1Ka+K8&9`xx7M=AH3D}jJk0DGMEfDP>@ z@}$r|bvKTPJNk^nJ%(WD3VW-f#e^nm+O=V!Ir@ZDsIlTVO3T7xllQy!m^=D!vdV7S z-D5bnt`Ed*NbpJE?p_~Q2}BG7B-jyuzqw2MGA|wheQeW;@4@FxpnM*j+ek6P7#sbm z`grzHONOmx#OxTX!K_DbWwf9AeiJIHrbGfBDiKe<&})p_eTx47dMeI`fISsu9fLsi z^n^Av0;=a#eb*I3;pmQa;D|Pk9Hwpg(MrWnQjD825_vQ;b7jOQ+D@>4N{Ai~6?23I1`YHcb3Xg{QQoq1 zJzCw1{TS)=#>_~bsm_0%>vEbZ$$muoKEr^S@QL?bi|;2SO4OrtUFp9CMVv_}1N3Au zNNJ*DZkWkOT>hp^y_Y=3mKiVwl*NMaCYs-{YnX=rq3ro+5DJi+!Lsqp0yprnr(M<= zpJjmq7aDA?ZT&c4#f&^Q``Hc1#hs3&4IlH_fd7*|aMo=gdMtnEyvI8w@@T@5gI(Sp zHj%ZO9l{ZBB3~)rL$T#C!!RK}dOzIi)H~#u;@8CiMM?@=>9|Sk_N?1DfD!5o$3fxC9`wIXK}<^2gib zUIAEv2cL|vS+ZEL+D*%(EVo(e>-bM5Rxg#!b5jE4-bG}dCM64a4AD9Xt}zRX zmWQ0&fN5T@uTMhr#rx;V;VWO9_fCwBf9!5ZuN)3s4%$(4Jt;Y)t0zO(##C?3liJUiei6wCA0MX ztKW`=(DO^!p8G6OB;F4}5Ji(cIP-k8>MnKT+$7YWL(ajWgj0W&aH5Z3fHXm?vWV5o zcxcw9K9wcf$ee3_tYn_Z)t3g1#(*We+Ytr*$0P5dH;ggpCnm#>t)b2p{pACV))OW| zsHe1cpjI>}823GFH<*`AK7s({4e>r=^O4@O;G>ivPwIQeK`Wh{yFVeZF*q$)8v`U) zch{^F?e5A~%oxp;=}*p|tv-=T7RhEg`|oIS^AFOIv}1HY>9Q#aT2cBFWq(O#T+IkS8o8;Khg-8+ z5%tjbHjQCAGDmX9j1=)q@iys{(cMAWlPRi>i*(HYon<7wQ;fk8F{@Ws9g10C<6;N)|%r{6Ay>gjd8qVa)@PVL$iti614~s6I1h1KjELD*e3^ z|8?Mq)inBs0QjdJxgygn4<9|$Ka+dZ#USaU7nlA?j;msZR7i2S#R#angeIZljsRA^ z?AxPx8^z*uk^c+NnSA6fEPj$JlH_^3H$yE+Q!{hd3}VlS2C4h`75W;r#T79u5qSIx zuoU3^7RjfMC@zEYb-m_$1QzOR>ptjFYgkTagInv>FlX3d7t7ev5!}sLrDZSqcAk0P z)f+Hg(E_WQa<=B%hq0$A#68H{-TKBU5$`0C_J!m6rfYYjuDcKq7Qc(y``yFT1(%}g zp;Xjq>#;OgI`tKY?fAxeVhaOhBe9|3iL*NM>Z+@Z_}}>#OAdN((Epv{#~}#*(sP%B$Szu(VM@eC!xTd*lbXpf+i7r{Iag=j#bYk;eIG8@~z@Jv{^*!lO zQM1P~&Yc3Vq3=VU-4Fwf;Pb4F0)`~apDt@w|D=zD3^Z{HHL}yi%%iR!`+^(6>BiKO z1wVcNn(5#{*%0<*Vs9@A^VXbsejoI4u$&J@E5uj}(@Vsm&vSz1#46*`T}mfoqq_Fy za!ph#Bv&?kSt?BwiWjRG^hLsbQ=U~!0*-qYL|mZqaC!&9tDQ_4Q<(5lUF*6QuB=}1 z^=u~a++px$kH;rm-QEa?#YvL@mFCU+bMZ>YYeZALmEeS0P&{hlD zXPap3H1dq|7$`=*JNlu}>_RsM;&;MyS}m!-HfBr>Oe)qUL$QQLH73s0D)Hl@n%Z1t zscGZ7rDpH47m{p*8PLnpaq7e)O4h~AniG+IGAh}F zK%s${lXCte8^hzHG57Fr+v9nXbB}bxON$!r$;@d2E7IU?(|r4r5cRFA-~F*&^HMvu zJdq`&i4|LB0w;GJj_asiP4VGsil4v0bLtOV=a*Es?x=*No+>xQSg~x1?fTpM)2-pv z>GA`g)=*v6KT{cB1=e4-rf*l?Hg0c8d@n^c>Wf)kzMLt5MzK_`C_A;wIOmdP+NgE* zUcmToGNdNJ=ZriAOq z=evw+k9eA!<*Zavl}l-t%@uX8{6jWlf_?VU|5$w#y@&jtR}y^VbgnnO1_ReN)gv^z zv(@sETxyev9t%QhBzdoQLf-r6Zv>EHP0;mB?Ijkb?zt=|_uFIz2l@0dweDnPx9Uw| znG{QAKyi;u#eQOV+?{#R(Wq2dd%8S+(J?VUTb}a-=)nej*p7+x5ySX1JU|b*;3u&p zUlhF@wxe9MN$Kene{$Y8nE~ISP`jSZvPgERPW6zy)zZ;M3o`Z%Q(s1{iR9J z<;_F*A!ViCc+a72W{cZRbMBo{CvEPR8DC^KP8`(Rg9$_V>!EAAeq-X{f~6DNev_j; zHcVr~B67N9YK+*wJ^^O0;fJsRR4`Jast92Jc@?FleQ&IGCF`h$@{QKqPEJutKW{b_ zJ?TGR(vV29;42pCr9&(?og54%JTs=$u=^?wHRN*zhjesJ-^um1X}g2iR=D->OPLEN z=fmSc5yGPZupLdT_BOuEsQpN}OR-#O=V0i^-c{r{7fddT;(Veey5!uS$g2r{iUqvD z;zLN8*iZwiQm@@gJwqAq*x+OuA9-%cuSQfx$V+O;xqs@l5>!T!Aw0*m;y5<+z#jmr zB~su~X{HA_%~j998 zg2@dPFGMTKj@Y+KB$J~`4AjV~aujJI8+g%myygBGXCAC<(w-^V*uuv>7Z)9%1Vje; zhyYqWzN+FXsPbs*>vIse?TD1Ls-`%MxN%M_T6+Yp@BAP)~z8F;N1ooYFUT0G-O-UYBT3uF5&bG4a+)Gx;cxBay# zG{ac|5fk14N$!lnBj%G-TYXCa=C761r6HMtiAXlP`&M5H_=AmxSLj~$KM_f~FGIw8 z0~~N~TSGOv*c?l>=+FpTxt`MFNuPZyk$9uol9p>CS@2%=H$h`J@v}vh>0-|~!O3Zh zEaCh%HGI0Kn`I4@cK^2L^l{e8eHCK>uP56fY=VUXB>*8wJwss8fa|99wTNfz<%?X` ziZOftirJ4D0CRb^a^~^C>B?wAbaj_6Gug+d-mWl6G;UUH`VElW-_;phl3#%Z-&{Ut zqEs0oKfb7?C9^m!kVwV}jp-{n*-|eSmHb@9C*^vh4#QgTD^Lx%GOW0A+J<^_eY|^f z5o3>ytt+n_>l@jqJ{Fb^8`l}mF6*ed4wjl0&7B;)d)zsFX6^h8i3U?AM?d;^T%s_0 z;J8HZcV(53(Up`cO2-^ul@w#*ll3?r1pC{9>}Ei)_0rxdb?vd^iPCc2u}04gvE{C{ zYLGBttB{n&sVlrr;R}X&O5rLr+Uq5bAY&hOtsm(Hl)gB_E4o{=x{nORs#PzX_)uj$5Z-({3)*eEC4L&46uvoliiIm`CL>JD`^*97J@njP$`{$1xQ?Tl?*oX zn7h3ymUO=Ze@n^>gue^97<>n=v}PpWzloyQ;jCc<%QVXFU;!_%;5mTvv}mO~D->YF zL5lflHLXaZUjXuAA|WY1i@#~RP&eUkSCvdsJ~@Mg95S_#PD$x{y1p3ZzOD95e5sV; z*aag+2`lAR*)7>21%m|0Tb+aqQ9@1&qXgfK2(?ty#%B>Ea4Ga_&WY#JS-agB;{`N3 z`|I9C49T%lcndRl=9GHNz_E`oIc>2Xi!gAV}xmgE~a?Y@Q zSC*bK{&uK}eD<^#&yj2&gKBLa=!>u;l8+Ke#SU$H?;I|F+N1|ML`}XVjtn2GTFxBr zv(}Y7G?l#U9&I^WKPPm-f}>rK41qJD{^17jStuAYBu1B9okTHO$u)r_zfLn{yYv{v zp3Fn%BjYbj>*rhX_@wNA6g46V$Z02MXB`mHpns5)1z*#k!^HQ6hA!Rn4&DSX2OX3E>|q94ML{85!&QE<6c$1%adOk>r94eEc)Ma95O2FhOX{H|ncA ziC&k{99c(%M_+WP(f76W*28gMcCfs4VcPHx19#&v9;?8my( zdsI8LQj~6BtQi=%;AB64sPB2GTjk@*tf@uk+xX#6@?cB1ET>yjNX!D@3F`9%F&O91sl}sr9J@Au%L)i*z0*5O5J(TqCb>~7l8q$j)$-_Gtab3ZE_Bv{P zwBKroIlV8ZH#R8vt`C=b+LxBJVl%gevr=X*_v@f6ePMq7o!Iz}nc6fGiOT)cbto8A zNM5uLT;uL4fOT_~N$ceUA~^+0xr}j4!mDuLRLEMJJ2G1<3C*eNJM;(^{B$@knkR7a zUgw8*(WoYLl3ScC3~E#8dtX0_SJl#`wTaq35VDM;>;2TP@8^#}CCN;Be}E$XJ*A?_ zri&7uJQMBe#(xUEsHQs~CsA45%vgu$fzZR~p>sNOAEzs!ou1`r;TjIKt{m-C>Ye_X zm^e97E<3#9N0*@VcH9siR*5lC=`{~?l>l$OWHWh-s`t3V{9<*&{;_D{lbG?|rJ^2V z;nk(2W@r$^Vd9y2wTaQ>dUAW<1Ue5huDP899~9L$O`rDtv5uou&AB$d1}1x{fanRlY$hKyKB6yg$OppkWV?@+uVKnNGFD>n<9L%D zlJZwW&7`=((ugp-$ju;oU@>p(F;<`NLRs-f(Dw0nf$O0GgZ=g5U#zKC2wg{)v_1`1 zW-Mu8dt>*7T}ktmW`1Nx?A1G*=)^_%)*A06 zM#C6ldZDGb=V(I2+qZ{p+CbwI8sfGl#i>T9zjQkrmJd58Jus;!(QN9O&jUD|zG%fZ z*ZHDEX*8Lv?dQ@Hd=)(}QW|O+k#Q3Z0R?%z5L}~}vm`qy7y41)c?!?) zt?+0#v33eSn~u@vySTvgGm=cj)Pt1#UH;FMEPSkC<)rKNZ-M(OGHQ`5>)sJ2 z*~A)$9UzggkX($Q>l-uFKSJmUr>~Kb-+xO=&=cw$zs+uuluG_ykB4*iIiG~~53`vL zF+uPas6g=wUczP#B)%qL(Xuk`gYWO+w#DmOB!{}W<3R`BOb++HYyBcHXYO;5#=jiR zN0M@`gf(5dp|DoqE_j4c$S1kQYveV{48@V*AM@oH_<}JFVgQyoNF`4xZ8ECc7Fron z6AE~*6@7xg-k#mzw2qVsJDiWWgyx{FS$@3n4On!FAs5`cn}?7a@PwJ24Bk6#)P`U}x& z@PL}cR=!D1URX)}Ad-qPZT;VDnJ|%X7N}5gfU`B$m#|5~iU1`S@>ncvE`eqs`R?fC zo@d%r1KYbUaC%+DfSs+fUt?!&zYeR7x289B zp1Fu)^}|#GL@p;&Q6j98ARNr$OyI2l>ROh~SE81<_ za~M~@v@RSYxVv3_rye+IxleyhYy%SrsKzWnN@E0Au!7=_0l{U*w;B_3)YuS$HMg`= zwEHuu?M@7RFn(8-#=D%_VYY9viEP+wBV3hJZE z0Dd6>?w5xnI%}PBzWucGxF23RU-q(niJ9C6PD0#GMmeb7$ONQc+=+T z;qKyU)daBr;wvl8qHN6QBJ6m;VP7SBJ`aV@Ad%kSE7|uLpE!n*mbfMoxGTLFOnA$z zN#sO3O?9*Uz(8WBeAZ$Eh^LG*Y&kQkvV4Lh+78FY_T9k>* zd)^o=*G>#hMI|qfvZ{ zh|O=O;{5amR6H^y#FPbtbtdpbi&#I(JC;_WX#R)q)hO16WaUGm7>}IczfuBy)k7$5 zg+cwj4n=mMiU-#FTAoLp*qpz#DxVV(x;Zpj)IG$WFK9?f^<#ZQl%ffT0>_Utv=AhJ z#~{i<#P|-8Hq)|%*baJ)dd9tqLW`U*CMu?K5{|0hqktP*1=r&D_cni}95b4iF=q}O zKkPXY$g>-&YTi+-m|L&Upv%>H)rG1M8BPOVlMrS^Mh_Da?aP)=D|f}kK|eTGo&r9 z=`FvE<*Mr&-x!o$g0w1thSPh%Z~edVtwQn5s|J8_%602S`K!H)g(uNdgd`4SDssgV z0XG_URxm90uR{4Z4DWfrr*>jGaF|6;>W<*u)wlaF z;0ygIhdRTbr0!T`@#qlU_Mld>`9tV7V(YQ&j#Jb-oCWGSHFChkBSB65Z}B7s`V+L# zQ-A+`0(B*{LDviUW+5FcBeb1;42+nZT-gHK&#O;E)^lu)U*%bZcP*M7xzP0^Fjt)W zIP3_?dU2^=7b{p9E5Qb3^}SNjR5PDz)=w*ED&Sg-z~cAVPkv}%+Nk7WA7OE%RvpAuK$O|#bT~R z!d-4g!d=sAVzJEd5KLkUUAA0eeS^5N{?>*C7Ri$j$C;Xu7Ob7YE6EU%i|HmK?pe7& zH*@ktu@9?RA*T1F;5Q5^s6#4!L@vJ|xRl(CVGgr+;Z05?i3U7GdoJy63`71ixhp~U zXWGg4^w-XdCtrdQ6aI@?$=vKW{89_&{bb{HR$}MT` zy40zMIQ343nwi@I1MH6#ob~U*$AkC%3V}g9z@@He#uo!-%<}Oo;#@qEdUcb2FyNzP z=xs?v?eFi3{<@8&7GS<#%VB+!9yl$v>d1qN2~_8tm5ZtoDnm+BaUZ4UEOtkLm)KgT z^Y@5#n%ir_-Isfy{^CNEwAN*x)59X-aZyvi-7^IS7A$mW2WK`VT}-mLZKnx(Vg|^4 z@2E*_`98D{*pz_A|FwKB;YILc?{Hcytl5^QcpuyQdFa_@%E)&nbsLh}ec}tb^GYY}{8k-^ z62@pqlCa;H;cOlhM+(qYrGX_A;z~n3hs_hkP&QJ01kbiwkFBr+<)@Gk+ezR%PNapC zFeL2~174Z?zi6tu0*PW1GYfdt5@$L7;BTJN3y=YNwx>-beM{ibR^lSjE4H}K;1+Wg z26HMvRXXeS+v+A&UMJ2PD;5y$1?rn`vWw?yb_ThZ)@tL2TUJi58{nL)JgST55ngya zv??`bS5NkC$|z=1_i3=mlqEBN7OPFAsPg@ZBc!&vLjqB#GQ3qOsMw%2+vpt+7m4&h zlI_XaY%^UQ<&}^wqp3g<$dv!Ng#{wrAtt)S)Rqq|>NIqC@v8-J>F$>4C$D2oRJpVoD(O-d9d{QmW+fIzAm(fZ&FTyA0l=42MUN>4q zb(mk=H?K^|4AY#w^9Oz&={Q#|?pL@LFbSD`Tu1?E{gF+MJ3nR&$G;{CG7Zp22^_!N1X zUsZlzQ5&y%nC}1J9+rhh-dBfI_|?~IA& zd%Qj#T~ISIT^TZ0qlberFbMz(Bb1FuFdV7D-Yqa#ZNM2W9h|b=@#?kTMnrDd(4jDW z&W5pM99Z~Puw#rtWo0#c1@lMyM&Jr{+|xYI;jUmt+cy#|?WgyF6JWAnn*+|nI8N#=_JxA*cwEpA=ETq|wH@9j+t+TXps7EQ;bp0l( zNVBmY^3I<8i1{#usDomPX6cYU(wzR^;8+v1FV%KQTtjK2#G2Zy$lYm@X!-|83=qxV z!>jieYa6t6Qv;3XtaLZXEP8)h3fVUwVvZgjC!8J|%5Nj|C30AoS@X0w;yF000F1Yi z7gK2-H#Ms1{vdxXYnsQo?M)9`B^|UQg^~M(_%HPdBDEM7KO;WX^Hw!v|NPZOn;Y=A zTt%s6ciY|Ap!o&01!t_Y%YrDP1=A)iA^k?-VJ$go!}1eYN9pEG`VzLJ#!owVnIW1| zd#6CSIB&=8cF547`&B7xJ@#9DEIcc{+3COQK?7T;?Vjd(4mTZ|c;}sI7h5tFHf9ng zAJbSX;zI}($}u2cKsQj#F{_Rt-J10`y9C6;>rGy&$AN0#v_U9i9O>KiK$@{^V(#B(Z6a(eMIce65;j0(f=nm8rXc)Z46Q&no7^^dl}BW zCMRctLE|vOxooTgZVd)h2=0WGu*&XU_a@~ibhk#6Wl`{nqc z?FYO&rXzTwY@VDL0Q$#CsuZY;yx4-(Hk-hlps==%S?|TrSrmtg3BLQJ-z&vRjsCFgdw?9c1ugwSMPZ(LS~0 z`J4f_O5wO(?=aRHc3~=D4u7KG#{Up**}TM=xkt2wJ0;tC|FFMf39y_@6qt46C#rSu z@|rI~9QHYGXM*tWdeF4nVwYAufZgl9!(JSBBh8S(LzP?^+b3(_n$g-lW7+ViK7}OO zwBo3XPKI+THT-M^HAX3aBcP0OIvKx3y$IRsEKLK5d`jb#D-A}_B|mc*BTsX1K<~5` z!1A{fHKgTgc){$Um2_8Nbn(Sn4vv;H>1w;I$MdSpv~pOG1@g8+A(YpG-{PS_0p0y$ zwvqX>J395H2BJ9CJjf}>`%LP_a*9oB+ZPK;vlAHc$O&>vQ4EC>>#iD7A#qHx5T zBtfCDG~LZ7^fy_*UqX8QgUh&$xV0 z6s|G!D&z91d9U?>?JMMlv>`G03}-Y9VwrUs?yFg7yYeVHkL-Z!>arXUOus&N)Csse z@H}+ULAkg9u2BD(m2n#9ub+QdYMfL9(m5BeuZpg6wb=ZuKU0Z1R;Ds*A9)@8bQ^F8 zlGTQJ!sdcIa=k?kMiJ0v^XjLM^dtb|bUryJ1+X@BmiRXysv@&J5-{DEN;f*Bt#!{i zcs%3zh#7A8lN%JPyPoC|Jzrd2bKY?Y`*tT(&R(|)DoC(}OxeGvU8NP*E`(d{zmzrS zyrS}4-TkOFm-rmfDBDky$?1$u4ik2#j5D7qo>Kco?xSP3N(D(M5wbG1e}7eqp;(Hc zUYfFP7*6!YPrNtoJEN?)sJ@`zRdVDW_uD9i>4<&;*c5pt{)9T<+ ze9+;Lsk$~@sPXmL< z3)3!p5)Z3W7x1G5{sxM3_6J>f7g*l)nT7NR@EVo)feo#mgmJZ~rwwB}t6C$HjInEg zqiDM59?0wYUBMV^tz?gCU$MY&K

;Kqyg*cdQ>d(k7tN*Vz3U#tYy@ovDY{<}YKw zjBEDXw14Z;Sq?eduyZ9v=E=QU;k+U*3BpeBL^3o==yhdg{y8E0<}KUr5iv8<@6fmv3-FR5 zEdn9Wd2g&gu-8jG2T|p9D4J7+{Ze1QC*L`s@R7Tc>*J7$w-Z1mA6?+gX5^8eo^ue` z5$E&4`FPPAe87hMT*2Alb5k-AfW`@X#RdG!bx-REy^5nzb382~mqK;%9hn@iU{sAm z$`g^Ru0^2Msy4?fdj)9b!_9FWMF*WzApa~lDvWyTT$Pcw+?ei-8v7+yT2D)gI`5iE zC18ogi%NdHj3W30GI!ID=dA>SzG4vRIS7cRx`;*KAN3Tv+3}_Ce*S811dk#2$A-wnt{9$;xU78fd9a08^{+gLvX7~D4eCAM2xrrgbDrSo03mL=R*miK79vS<1pQ~lqQ zEWHH$V$TW+T@Eq|h_+xBuCuX>kTj}6DgKXdN(7!vwG_p;LkBW@&cNa+$&O7tS1as$+ z4DGxGRq@gStiR)W1D8+ZNbdj`Nk@sCvIc>LID3~Oxz1U=dC{$)XfWIxOx@%h7W1DE6ao~?_hKJZ>DT+$P(NcdoIo?v6F}!&Jw;)7kk+rbV;Xe z@x|Dmhq+IXPSVg_1ln+Hp6fhpba9-lY(As!jx@6zb9iIIyh^Or-@31zxSJtVw0ps1 zgk~(FEfqGvmg>E}3w-vi*7Z_2+%3C~NQz#Bih5jn8>DJpg2lFP#$jXyD?yVKc zi33NJK}1ZsCpo7|pkE8kWgK4{0Q<@X@^6Zza$J16B?7MLsa$c{kf3ExVIX@RQ`Maa zs|@sP$w864Vsm8(&!k5WDjT?ZGrz7ISDOJ`%P%rptCtiSBFgagjMwHkAj{b(v3hTt8TSOVf>CLl z)3AADIy9;Q;lnHh!UBd>!4qfEEVOvkdJi9EKCvF^LOXE5kSuVp3LGj#SRz0+KIMAY z?U1RMnn7E zuA1s@&Kd~ltY~LREqPwm3Q=hVXoI6cF1@%PZbi_obVtZ=G&>Ek=J9%2IRCH<<3&~KUjJKUY zXM*5wgR_a<{=V;XAf3c1$Qee=Peg&va4vl{<>+|?sy2o1m;)`8M8guMO2Wmdh7TAq z?;;8QdASJmAq3Epa@fWQHoy%Gld#XH?_rPa>U-eOyQeY)>egTYd-_}YA9;|9qCx-3R9N}grkItJ{) zOyTKJ;OXM{`gezm2Xrg}YrPWHn;;?QB8H>PH*6eVOf*S8)6iQbHfVxU7aZn&3Ek31 z;3sduWqgsV8uAmhRhQL806{pGE%LMVMSznI!3hj(0sD>(*CKwss4W(eXGY|tr%(+O z#<^}+?68eT3)s5Brl3hHo)fti=t9VTKy4trwBSK2KK#1h$4&PrXq>JcUaZXHI0kit zCtw!L_o_SX1(NoeQItc1N%l&XEXhT?^LU6xR22;^o7zrHK2A=m5y=?OuH>7-)j#6Q zh(dViZ4ZqlIGGF%n1r+HnFX3(airl$tf7KP>RF-8luPrQXcpv=a;JB96G1|rvkf9$ zdCe#{3pCJ_?9*bGwrYoPTQabh04ugCUN~VjuhMwR2atA#GxvzJ>5(2O$e6(tq&i>M zU~Cx)Uf30hzEu?Vy;OZ6`sBpGck9^C3EjL_$`g#DQv_9voXh@vKeSfn)#_yBM`YVp zfwT;N2jX~VSNE-S#AAC5PLcY4vYCMgzkii>G+-%*X6ZP0S-hX&^fX0FsLr9@%RyJ> z8TZ5&^(URQt?;)ZRXO~K4>F7v4`%D8F)XB!ztfRREM1sMPd4%dGJ47VJ_3p*azU5d zLye%zxVQ+WGe@7NOa0PDHd~$)C;b}xqR}7t#3sov#P(Fcv*j?Ni>L|f9qs`r-JzQ; z|M1y$!lrvDkd%LAPe_V8sbvqy#p|2`Cm*Z0h&++TOyecg#8YRuE$y8MjoG}fNiD67 zyk|;dpIZeIs-;}6TNM#YD;c&T)Twu`MlBvHWzrJ&u|HJ~e)wT# z^BaHEn&=b`(Q#|=T2b8(4WBrP+#!%m$^;h0TyP$9VpXmwOw$$>C-H@+ou^9jh{d{6 z{A@8}hp+kN6Ot3-k#6mb3LMP|M#FOd%giS$U^8rG2T!tc)-p{&@fv`+78-94Wfz2A zZa^+`INQ|1+@G;wlcF5=!<;$^fI%;aA&?F9?_^wfq`doqnJ4zmORT+UXJpH&Os7Zd zqDN^?yGZu)I>sXj=BbkF?D=Qm2|nDV(5;U=(`%PHuiZ!oTBsQ(^H=vdhu_Dso`wJ9 z!+beFpA+x`2CS_i*H+PViepDl`@5V3OhvXSb=V8fheTy6ER!4hra6glATz~N&^|iG zPCBA&&R}kTH^j`2YtEm)_MxYhXZsvO6UYu9@m5DLYU<}3NcwK+C~Q=+>M0CqFFpF) zV76kp>4h@z@`?xF zMY?Ayr0;!~jH!5FLpdnwOv8J+zmxN>Tom>}2EExJOl41mHm%fz{<|G366z>eWIX3n zopk(kqoz4BRfwBO3~!b(c?F6IUP`xo;b>H{_cuu+qvNzD+(#T4jG5BWOaXOkUKN0x zpizJJ`p*&K>%&`L<1Suy$=Iy`(v&yE^hh|qwHffa7B@$QCyLHNpSH|0r2yl_9sw){ zp??ytp}i=)f$XK1Qb&S`yX~Oji7+r1=|>lg1(i!8Tj=9O+!WiZ6EG&Q%Luz| zh6Wa`G7TNNM)qB(l^0MTuo1( zs5Bx0q;GrC$=#G!Ef*c#9@)j-5t{7Vx~Rv)C|uzqhP7*jrs8y;+4fE{Yr5-LN~z}j z-f)_|(21?!vgJPKfb?Rw!^Daj>W-wSw-C zyYtjas{Z0due|99+OjB+82xbEe-(5+EN>sg20>R!^e;i6T(ME^y(9T)+ZNw;PQk@y z&x3K06;VT)0^|#y4Cppo-9($u7y;h|60<>?!gA-oPtgy8A9mWJH^I@Xu zAu1TA0>5~(6g!~8<3L&+fVA#`QfEsjaK6JJZSfiQEP>zH6SjvYKU}*h@c3jwD_>sP zJlkk+xJm(g2t`gf=2gMjgy$J2-N+L(@_d>ZXz-Z5OE9Nj?PB`+j!!e|rA8ZpE$K`{ znL;c3hhUezIwO?d0^CY{s_oops;j#d2q>yb))QJgogJUY)01`%vC$A*bh$O{hKDOu z8uo*R;V0j&)B@}G&c?HQq#P+d_-3Y+XJL7ZUW5ino06ucy8K$a;%aCOdB)i?o%p3< zDX5silN`Ph-f@kty@cJ#|ANg+Q6f@iu2g82Yuzi+1j(Y}6~r`{S@yQ+kEZcZ0f!6} zt`Y?7UEUf3L6wQo*H20;*2MbDf>qPr>%H1!Es9L%4pICvq?{n~rS|Y{Jbqq`An{!o zcltZnxr8P&!oo2tn*N*Ac3i-Fy7`-4FjYT@ve{go^xm)GzO)};)dc=rbnz}*wO?$xVG6{RcvS38R9RcpK!;lFa@}?)B1%EJeTin@)C`HgaK-ZUf zaG$_}HL)+8oI)Uh)2yd%=#v0e`edgD$RaV3S}EnTJgEprdti+2U> z^Wvqb+6A}SULr`gCvGfbz(G}9ro#v|A4#Tgba)C$Hao{_hMiXwM#El%}L*M z*>1M_Y{x_dt%$zrKt-9q|f-y-Z4|hUBS{^@L*V` z9#dCD>35`4h2akc{a7kOzb#b0HDm3|rL#{^JF@jtdB=781K|F3s)hUYaE;>rG2vB* z1@R?QpZw`{5e{ON`i>m(s=VWIw?X!L#8h(+XpL)FjBGo^H~WG`I>Ro`6KsWB#%bi0 z3zXImtw#xQvW4FEGtfEsO>?V})D;kf(anR$Qx-jxtfW4MZABO&2t^mE!e||<&hRTs z7bevIY7LER9uV6EeJRvmN$`Tru;@SLX|q-#iQoS9c!unFNc*}R*81r*(aE(PHn$a- zFE*C%gUkn=pv6Y~2*f^psZ7ihs2`Q84$Qw}nogz)RRNzkJz?x)rkOR#RI%2v4zY#e zyz@^+NB-2IqG{dG&@gRZsN}I?s6&0op(wG4epwQw#r>l^lZntMw^~dMNO`7#*kH722qjZEIprMra z1`1;7Qttwy%Ex9S1qMsVY(p<^(`muuWfX?S4b+Wm@jWcVrB2!GUNf3yp*!gUYSm>JHoAB z9{kwap8}Shh1umSAJlEhOh**{&I~#uy85o2+lr|Z`n3P^*C}EeAIdY)brM?Wu0=8- zMH1o&t^*TC)r49e18qN))qjwWF5>6xz`9`xgnV=wXlsS$u_%;kh4n6x7ki{c(B=Ig z!qzHH)iG{&tfj`)7~A(t%!tb|KajrskrDL^3&MHbY(dYGr!m7Rs~}UE2e2#F-q7mV zXz$t^Q&d+mC^b*tZ+?zQ$b;|uFEq&XYzT*}{iDhu&%c0 zx=9+_w(Z7AW4p1<#EXt#*b^g(c!|$4=#x+bvr+o7gdrMp^`(CQo08vP6B~1JrY{4| zdyAbk(NwC1zi^jnb+0>3gq&4j%I1XpW3u?<9Ak|YD1E-mtV8m+R7wdOwXZv?$g4GF z&+BL-Dt;NF*uEpiJ??SHtl9JZdXrC3lsTFCBYwp6#%YNKH#qE(0EdvxGphx@PGn?e z2EbH4@qdnDmCroy*#0~&7p7kRvj zwm3O_sRF!O)Ayv7rqcBnWfbT(YcH7ALK50&(UHFBHX%GtAgG}0rJ3~HaB zr#s+W9~Pi@aE&Vq=-7x0@>Out%iKOW5NBlmv!e$F{bGO}nE~wRL3dOpedX;irl?-$ z=tSjl{VTV{!zUt(RXt*J`x3!{v#Ph5HGe7rQlYrFRW0`=eMKfX@^ri%p|ZdcELoA? zREMK%UvkAn;16^5i*_ttQznmT!%|+5g?CaLeLdINi5%I(X zr6V_C)xz417F#KdzZKaC_W(#y6NA1YyojOip^)h-urqRHFjI5F4V>rQ#e4+T{`DMd z=ssrxB_M_hWkOGMt}m`j%6=t^-U>ghO*pjD+&shxp&rDd&fUw=K#4|oEg7cp$J5`| zqZnO9`@ay$zgwDmWY>emBdjxa%~J|f)_;dq%f%Y8bbVOjZ}W;ZR5hMXjKzH=mS?Ou z1EK;S6_Q`QZ|}G;YG3EKk`hV_v!xV0LeE8`OQ1w|Ut%l(iaeS0wW@U8nupgHE95Js(AvSyTj7n0*-s_vlx5nKCMn|5(F>l-CQkwC z&cbcY3bS7=g=+S-f4b)^@XahZf`FLgSMFG~8A>uq7$puz0ipO@TI_(VUk%J$OAig~ zu-w1r&Wd1|dwdBp2Rzp-38Snuv#tS;qD(_c+Lc``;8RwY`mcCJQDJ*6?#{VW#YI6` zqI43b!fliyv%QvFHN})aY^{b5BgzSkVg>_{K(z!G3hrdY<|<+&1!W|4H;+QiAmM%a z>RUf`>qGXy(ErKZ*oilfVYi-A3ScK(%>@k7XHqUrB-O%3Fg_D{chB!8BX3`{tAFf< zy5D?^e~RgsydVu-x3RvQ{?;Rp=b!#D0TVm5Quh-KufE zhM;q``%B;QEBXn0m>QDE0PTri03zGsyrbfdh)24#XY~Z|fP$?9;$JhSaSWgvGRY4I zoFd6QlrC*$Qo`}!u2xtZ$x2{M_1lqEDoUxWmqTF^7=G8)| zo1m{SY&H@WXDBZ${!26h#Wx!8?603YAQDN?_xMt13h=W;G?c=- zFL+;eUfsWyXe4g$f0P3Myf_MytxmMJzv=3Zn*}{YKvPA+y6Y{9wEa8X_?-XVh^D?~6ZGXj2CTcs!$E}T6U&%~DIdN7VZZuIQO zCk{uJMcnM2k^asKDVG*2TQ8ojRw$#r?!fI-91rh>CMM@GS*li@zg7n57 zw26h!P@0TUR{s*Ke(c=ztL0xsfW)f5UWiTlEU2M*7j}Mbays4u>C)3+u^1sp+$eh+ z-1TU!AwNEH+t4AWJBl*2#}n9sS3!E(#uS;^QP^Q`FrH|movqJ0o#mVuDg5)r`aD2}+m3aNT( z;)OMYs({2WWUKi1wb_diud(oAvjMVQ2eG7)Ri{*1rG0k`jGt*-hM0vN4oJ*1Drt2B7&cS`u#9qm)dYI*Q& zCn|h54AKU6#DOHs@E)c{%6zatEW)zv)n`L=`&-cw$e?EeYhvhc)x%HR9`0aA;7H8s zDi)RO-U*T!s}LigwUmN7E*yY|ie^eHunoew+4)NHw{o-M%>+yoU+*iX2!Emez2AAt z)uM7ceMM{hbT&@ol-hOU^vFuq>b|nYI1!x9!|9?XWa7wOYGUB_p8SV8vc&?zf6Tw6 zAb`8U2#aG0VoGG$tHD>&&P*D(JN5}kkWE!fVG=NtZ=WwWLp_Q2CS$kwhh{-c`mpi! zYJ!UJExD=!K}Al`94}v)$W?vEwO(1!O}tfIrHUbgG5QTl>S)*3I{37|%uW_G;Asf9 zfS?Y6g_^h5nZXZhW@)waj(nB_!Kw{Zl&^JC0mntiq&+tnvWC#xI^Ohl|M2?K>23W; zB4tzo%Dp#PY!T=Z*#q;5{8<96W>e0jW5;ZfXhh$(@iP=wA7@i=C;Qo!Ux@osLXGpU za6s=dVaAMcm7AsAX>O4yQR`~CE!MYe7asD8kKNnsS-I9NFO=0Q6z)H6?xFu~a%eCY zK8RPUi_%e>k#HZu%@YmmfDoGTfU_ij%h>@k=?*CT?@(_76viss?b`0dqo3vI~ zy3V@UAlXl_h4q++iBvS6`0TLyCIT!Uyxw%Sw2H_{8vi9kd*tzb_aJ#QY8afkA0@a( zFvUd&UaG~n_k+bCGWO#R#tsnAo z^IOE?OVEXSYrC5VbXNo)B8%c8=UDVz6qrYHhzV+~#RgB4Wv`jS+=Fi$tVIgS?`cP? z{^4~n8GACYG-k>80=PV%NBM);m_kr-|9RqwizojyrK}S|3$%;_p}*N&Gh-e{e7%{B z0el7bX-(!E^M>{XC(Ie|CH@fHIY%ZvpH8>^`D$2YVDGr&8^sSum%764 z#xQ@sC(So$e8|`>h(fcBUqKwTU=+X6#X_+fNN!94a+sLsZZz({Ht9pmb#oqlbn;e) zq5c-hNtl~bFB_IpsxV1KUxFNj#>At5Pn)BrNbS2mOD~7`U$d=WLnKelm=woyXE$q2 ziYWlZ9c!A#;e~!ROS2jrGyae_A5-L_w)_MO$9c0a?=z*&XPq#;s?EXXNH!yfCI|!E zQ_i$qww? zS}3SVh^Tv?r2d}%27#EDnInCQ<=$piP_-`=U_Y#`mptzZsrRtW+h$1YYW1+@idMg# zZ8sA#Z{Vaf&?-Tj#`kZ44iR#j}YsUGa^qh0neCA z>c}e1r0V|p%hKIAd)Mvil1g3+OoGB%NJ_xlznD!gBa}JvG67OU(e`(EnAxclANFFM z-f4?wMP&xJ{z@aGuZ*0$%2L2x0zvB$ExRqh7gVTG)YT*UiuouqTmP_B;t=*K9_^Wz~+PzP{frEJ!E<3}W$on6G;yZj1 zmn#vWaoYJY*_7;dWuYjkLjL!CIBljtr{#$tK_b;9^kKtXH_H&RBxl{T@ zs-I>;y5oC8x2H3X`uX+;Drz|#xWoBpD+RTg6$#ICnJR;4pU6_Q79x6FVa(Xvzytf; z0IAgOqi?cXLePMuKz4vFT3khyqJWwLsS*UK5mKjrpWZ*gJIWnFEJ#iT-9_+Z*vU<~ zxL5i!HNJe{&bPvuKSRpmBmkbeougo(iTK-hmDBvJJwQ+ZP*)iNe$zy=NLX#25HWP8 ze`zwuszwqxiPSU8#S`lYWf=8e!lD#mGk9yMIkVI+uA&!8leQu)OB6&qcKzG~EB_R| zYYbXP!q3ZQB{5k=RAc0dQZt#m+WauL3*}O2!&J|kbdfvOlD2{H(r?Q%hn!i*XQ2=O zn?ZjcjOy=X89&-LVe$9^7{vOXP?o<6%p8swo0KJ8@Sg&sB?+YgO8Bpwn%MoLY5FRU zoVWZX=6(tpPg<*IMv-&$;py;pYOd8@rtR*Gj9Qna!5raUAcq#b}Eq*((FCP zZWW3mrja$dzl|CKWDUZ$g@(1q$VfpB4VAUjG&7bVlqW7xUg~&4mYIH1vuki3n-DHJ z_ivFMF>0&s*0N;+Aavq}fN`m_9=9TD&RAgs)w#R7_q5gaH#u*)B(T|D)0nEfRl$|; zb2u`tffgI(36?d*A*0E#KTmGC>~N+0VN?i47akZvfBBk{Km+vzqcTuHvEzrrdY6|c zaq@Z8CUr*>?QfKXxfn7oF?CP}&?pudK_47X2 z!fFTZbaK0D$8j}u+rZ)Oxg+pqLitOy$ZxdDVY?=OVdTI^gvq8}VhY{++1jcV?Pzg+5n!aPGY)(*bx?^mF6HIc6Bq9(UNMgV*wo@>s zNnd29No=8=F(L3*U&}FK)sB`8lK}dvtS4@qx^h&spYETs%d600hOHwolH8MFpW*+k z37MGTHJ~|ng&E#`34nu}N@P z8d+7_FhCec$2oyi$mr+{Q*`(rsXI&bm#W(rPUGWV!>Odpl+sL2mjh;2oQ&RqNpETk zWohzn@-fCEzV!D$^L65vT=*KKS-+L+zi7Ruua+0QWZNSP&<4MBAR0PVESL{1?bzn$DI(96IkFU(7h0$by_l2trrEs>PiQHHR zEbZYLY$2a5!;X=sTY*4w3W4b%2Yg~{E-7;9oI#Y(l;l;(5P*xELD+Kw|5pepvLe6+ zQeR&7Nh$^R#|H4V8mxMze>~ZCzdu+>O5Wpt)a`d8d`f=b|9JfTq(C4(>H-yf=9^-j z(O(n`8NZcHw0olGEY-xYk~~sYpQo_VLR@0QF_yo_&_&w1{f2rL9Zpy|9yl^{Vd^<} zn@iT!cgvC6MO1H`H~n9c_=sAnl9pOd*78G`Bo9}$KdXwesD4L{_x$S3Bd{PBh{5QL^Ew8zl?-)5;;3Nk!6n!3LB1ut zb_pWkPjORA5C;R^{ZBF0M7LC&zC0QM6yrSUS90mPN>`f>qy~6``t+C%@0thd2hyS0 zu>;)s{FC2DuHL3-xcd<~XK&AKDOPZLv-2FXgjkO<7dF_Txx+&VpW?Vp)5I-_YFYgR z7L6eIf4d@n?&_)q`5UDI(NL?Y&h=G`V|?~Vs?3X+4lyPv;byx`#jX*^9_H@vW%?^P z=5|EYq)gbPR5ymyOj31Y^X3xK6N4pDi(^4;?$V0um&0sM!n?>p;5N)faZ^G?qKyMF??;dLW@Fn){o0o<;X?9b0fXS>AKidL!t)x&$ztDY1YxnVC zHVA;kz?5J{Ri^SXd8juBE&P7r7F+BMN!!!v#(oQ7Y0BCPF)Q#|NYBF3B`Spla3?i} zG*O)j-uhYF(^&sJ#v_FK_>Z6kDV`LVH6#t@#*^fkF)R^Q=}#1T4&FYXjGD^0ko+~k|viXUS>h`yFK0jdjk5N=o#3W=n*CRF~7_$*-F-vE&Vx!nTa76GfwF`+fGP> z4xivMPu)8I2=RbmncYUghqiV@{LoC>M8Lw}gtGxXA%DgYNr9tS9m$PYrZK+|^;ogj z+mU)uzT-cT2Np5aa{8ifa@@NIOta0Y*uG65O&1YNQt0kRy)aJ1&lG^N(bWDfV;tA| z&6pW=_1N3l%WC1I`YiAUPh$2WP}HUW1;Z}qt;y`(nmz+QKfaOeDTd$)IIe7y$@INv z;S9~;{kU4r^BT6m%J-wqrb_e)eVg98*jwFev!~pp+1q6QUB!xgWCOQ&Q7U^mG`({o zOcKxNWKgpQfPj_}5Bez)B&q=YP2lybC#gv2W&kYB49L9X(Fgq=9} zf2d%bWjHWmWWsD$geRpGoy7>;NzIsOY;;ly<&gwAU5q&u95YG`cFRor!EX7p4MdH2 z>uaX1&@ZfBtYX3c8qJldUB*yN`MLKez*ih6RB4lnd0m$+xZrP0Aioa#Td_0R26yIZ z4S{^^*@)mao>2of8f>TG|CU9i+&@1XnfQAF%A!TzN1szy#22ao9hYM%cvg7B*d$UN zzp5vxA0L3KvbPNo`nAuw7*N!~cUy$TGf<=U+|~1{K#EkSvyRsHLq|w&H)smi8mrgYy$%&E?05Wh&=B9wfc< z+$%s3z4!+L{1MabrAfaEkNM?87ZU~oP;3XD2g+NJX7J{x%tTqYbwxJQYJ3H$avL3 zqAPwDj44>vXuAXZSB4X&LLEjX$kqTE-c*oY8=F6Lt-sErBOHyt^>uuyVrRgaxihf= zcB5Vdrx2#jZ&`+iD({9aM#{Vr*6iIJbp6;reCXSmFZgmh-;5WQD%*}@jx2q?G(T>q zUgyqBdhyL)K2p#&<0Btv$ouWryqwn2qm--&p(Jf=`k?#IpBe+$TNqhKyF9Fw>i#Z& zD)r#isVrwL#4Y)ArxAY$72{qR9e{zB6W<&uQ~5TMD}qgllp&Hy;CCIm8-?nye2TAC z>$cZ$|GSj*n*1r=DA(h~&01_Nc!j`<{f7EsaMo4OTbYaV5`=M)KD>&1i;vae|ErYF;=dPzin=+TBj1m`4?8&9PND$%kIbkkp`=S4!G?N1!moIYz z{HT;?l0>>gGsRU&D~QDZSughj)C2sCG@y26vajMtpK7`}U=>F#`QNPx_2kxuvWE&5 zLwGXPaoNnDI+aqHLPoV3#x?)VQar;&Ic)FA4I?KOfkO$3o?Z*YJ%LHytM=os z_T#%p1`M?L;NchD1lgU7XJto%JoozvkKI$^w#Pm&r07PlY|n~=UguI`I~~y6P286r zV)yG(qSOm7wd{X}?gf>dfo@_YH0VfjhXoEs@if%5ChJ`zkT$!bXh6A!dY7cV&51ri z=Isi%+IL#;L-Oo42hyVfCXO!rnA{}l?&wUN8u({j(LqR5NUTuYZ6);S{b5*qWli@2 z3o63;s`HqriNCW{9jl&b$%(=Jzl}7`SE3vHnqohe{72iD`0a+Ax?#cIR-1tB6SuAP zg|+)YMwPgn$-(u)hN<8DT{^i3cH`T`BB4#RW01>vMINX9BGc!FNJ`k`wnxn+1a%Fh$4qj49P_;NYT zsiRBq&^LxWiX^_jm=J)d(`CX~DV7psrC$Fzj`Y|QNaB3^Z@NPdA=0&_X*UHpG5S)h z`;^P7*Bg(YuJA0>3Tq~32#B1Cg4s6m#4PE0o$cOfy6i2pC-v^^Pd(h%Bh^uxfuD9N z^#&(s%Fs3X%e>lOmj!b^lQPR)s5-O#5DadCLg``VA6p%Hz%t3Mh;2IdE(vf_hibhf&tNBLVfDPiF`H zHVqVKAI5j$%WoR&mMGS|ZGQe1Z3YXpbJGL&;zCys-U`ro1I0NdxmW(2jjuI)U#KMVWdPpqx z6;Fw@gyDh!i|>6&Z#ac#a$j7i&LjY`$(}IHfC=_Etabp@!M!-2sCu;`FiI*8eyz0@uUS0(f+P;rM@6EB#kdn~zI2=kF($k7 zSNV~}MP&9gy=DQ*AG)+1KjgGUzcIRtR4aS*z#>@JtFw%!Jo|%`onlQi;^8tbuapdKUq7yp_bou z9G zd;$I5YSy&#F=8EcyNQG8ZLb1Kx=KwC3+xG2uM-q4dT0SdVLXrCKuq{qC%`KsmZroa zE(&Vp$P+e9|KA;}#YMXgG*RXNcU)Y`O&M}(UCX}AoaTG{0-=m-N1Trn95VV#yqb^} zN-=e;_$GOz@Dtes#RK2&Vt-(a>Lxdytp2ynIsi;K1nCM51m~C*U-8R6A!xK9|K1?P z`#F#cT-+oDtcBSZLNcT}g0PFJLeVM(u`&dr_SC=lHYl_&^WXZQl;shIsX(qsp1on* zjt!=>Eg1tYAd^`I)X7w1hNVzNL{@U>d2@yW@+WAY@~Z8_d)e3@HYh%{=WZGl3^i8W z<)L}jAb7gBvrTAUxH9^W&yWLYBcsE!d6x2$9{*dX()hz9FR6KL4i}0sHyr*f%-fH_ zGu%4{`^wQt|Ni|uypBqLTlrg5Ej7iqtK-|Jnae#zK2L9>75q#3euHBiKcMP}7dNMZ zA~mVLxDWWs*#x0{Hz&7XpPj_NmpDe~K-50Uj8p*-k*7DNFnt#YF*Y9vinr-2EOG*< zo9F3wQgj;{@n_4VqA8WsFDLP+GB6IW*e)KWJbfgW9|S3syN|Y@B_TSjoQZCqgRBjn z2*#3Dw|7_HKjq7Y6=8}D9vc%gr;O)O0QO~JF7lSafDW(fbq1$;i6O%qJip3ReB!ov zNB&({9PicE`KFtYrS+ELZjw)X-mA z2Dl~~6xwPakXi%YxxC*|2;P%rU4B*zf|^V-gDIq5`2G0|*HDjM*cY4wg?)FeF?hB8 zoL>`Nno#Rw zFn+h}a&VF0xYto;@KbV;CzBI!b2G_pM~t<$>eo7XCZ|rt-fe}yd7C{IamzdxHXWcb z%C7W#u4-_)YPkJZWzU@N0^K88{uHjFuL{B!nz8bcOIF0SR(~Y2{EqRm14;N6d~atS zLOb|n<1}|wkeNxm(HXIweJH(@PX+yg6=$cZGmGdNgzt|-~`CNuuD3#2>9 z>?NLxuCKBqLg14|!q^JfzcpJ{e}#{+ykdekk>dgJ$0ALIX91@yh3~CkC7sU)Emcz% zmfsID%87&otX0zj`;n9PXQP5WCNbDgu5^CD`8h9Kh9GWv`={a1;N?2aM7=&dI=-{_ zq2FD(ffVIcA?i`=#@h~**mBOZkVL@URUFAVFaX${>MUuQwlNN1hFi?*HDYQ5L_45H z{C#~7kd+46LM%o`S_@VP1om_Q+xUxpK#`A97nZzp^Zr*JJxJ3mja>R*@!y}8f`l4a z*_g_JD>1ZgGTpqn7l^Cs;r#v;R4&p zUGD%haWb5{F9@DPfJGC=h&+NBLsCAUO7>56#nYn`cbEsd+*zNz>9iF+H?O|wR6S~= zfaQ2|b|&}9i_f9kj7h5X$Nh=e6->o<0P!IVNQziEQIVr^9L=31Qc|PnY!02+mI-Sm zb#yJof;$Y3)W5q%GXf)b*7phlctFv5;$&$nuzJX%Rs*H*Yo0J7(6w1R2r?_Q^R#J( zhI{V?K|g&b2x(k;LOZ_=&)y-AWJ?`S!xAE!i-ZxBh{Y(?;>*)d=zHE42Jd?P z&C`w3h}WjLupgKK#7$|*jj4I7q;EBB(H2Sps#?v`eKgh9yxoa7jBI*|#g{I;Wc0v< zI(|>H8~wf9b0e~oeha#IziWunXQ{dy_Eqy`?(ecoG?SPc+mCV3c7z{wpxjaGu3)EC zRi;`ljzYjg7&<+ogt=y^v0>G*oi8_P?X07Ay3hMjYf6aEYC z-Pf~{d2uRqDqJ#iS8w_}LQ+N|xcLhL&$^MimFZPj0`6zh=aFcSlm3g(U#5Fgdx)J$ zHoH2``e6-OfHPpZr|_)i)Dzj@PLhx+(%-E89r<+KqEMe(QRneBGb1Nm&Q?O6n-feM;7S){?5Y75yWY2ROn*& z_T0PB{XUbI6TXXk0B0t0vx+Z@k~Bsb#b9nROCMXc^_NBC# zL$mH%dN)4H`8C2^$0?X1tp-DsG`4N|ir%twp+4Z4k=2Pek;VBD6gH=b$v1C|$$)f# z8c9B~ksd0y(H`Ff@?YcZhbT?1_ZLY3JB#6r&)}1rB%4V^z^HqY;&$;5S3t|LAXu>v z%#NQ8Hv{pSm3RFU^85uzP`|J$K?vzUAjJ!C0z$LHF9;g1HN|2(N&c{4(L`G9oX@Pd z`&~iNj+J)G;y%ApWRST<+tqFkUN`Nk`MbmU7I=7B9LPK5NW*3L6~$S(7+ylP#`f7= z;`#742d~HjnoV;mq_cP4eLw00PeR|T4qk9yYrSbG0(!F>yg9ERC*gJ6KbI}vL_4RL zlWH^?=qr)(mOB#5SZ#xu3mX-kZ0uWsxxG`7NcdH&WT1e^A6{qQ$c2DOq$supWKG}Pk{Ybz7i zY|)MbHH&3@yNiehiT{fR2OOe31>Rp60Fy&|9JIdTid;(!xb^G)`(p$&R?Vnuv6fcw z($3_&y-O{4+QXS&XWm=n;2__jFi2LTp!P#qXD=_BuY`Hqez7rG8M7i z%_lZ;oLoK4xPKXXdQ)lo2nTT`-g-*|-(rad=?=c_>+40IkRx!v- z5@Dzg)#^&}@4b@P^ifgZi=5>Y4?PqCg*+J{7ZzYfLbbvT;!g_T&vj;C*ZxPlgfk9M zc{bTi1QhBVmH;E34-6tnwFOLoP3>*8IS8oDIws>wReTeuYYyFU=6F6CXozTB3&UQ_ z=NUfPXpWpE6pPH_l=hazN$fRCem|nG3ha{ww$V3m=fKL#@|r_H-Wl8{N~;+>fQvl> zS*QQ7FLbWbj(DS=D)CzK3ErCD^YXFqi^V)ageCmN5{`)FilYOpPGf0&Xto>R2$68< z%I>^?i^cvau51K_!iQzp{Jj5>{xK%;^b4e5`=IvO#50qNo$SowwLk1ab+-;Y882Tb zsw>yi=C`$9-EY>~r|-g9Q^#kR;KI_x!m=iw7E&m`X~GMyQc?*QcwB9$A~2t%o%hLo z4_(`kqjZ91j-_TlxeFMhm4r#=(9l6r;*^jmi4m}dON^DXiR0Y=1DtrA-mLfKn&MLM zxs9HH9!JSaozs4gXb|$wom3V5~0?kR~Ty&>Cq?~`&)L>N2isD1pZTGaw&L!KL zBkE0h{sG;yj93yy?bkAt&dnp^*UbR5SL``=QXGmq*sqiiUxib@@lyIDn1ek=6f~+_ z1p-5lCCs$Z#0CPxCHxDGRIq>w-ev|75~#&8jDvlj&=@jr zg6Of@n)~bcTTyIxR^|mGiCq$x>~J`hwZ^=8&FYag(62Zz>A3Er1wpWpH)M6vO@E2( zZ3XBHZf-dww#Q_HJrFqYyshGSMuLbhf1wpBzHhzGsfONn95`yyUG+ZBSQS)+Tsla( zhgw+npe4~9^&5Dt1{PYH^!q@U;W2AWUJK%I;ILZ3p#h{ed50>2$~by zYQV-%K*vYCu=|~0BWN}oDsBH{%!QFaH}>M6?UNK6d*E~2L(|qI`~f3s^H2R!BM~$| zEI%*K`;VroA+;1a?d~VSD4ySnVy&Z@M~QzZ;#)UBSc~a)gPdek+TmM&IjgxpO6Fdx zJ`0iX&qw3=c(A_ce&yR*42VA!Ts?|Dc(>tuoaaR!y01aMfF>q*NeU6ncu(dny(;s# zT+j7+)7;~1o}{J4;ytHDez-ada$gemsXYY$s}nzpIK68~abpTg^v^KCgF7sank(NsPq>i& z4mjsykMEK@Wzgv^MxAwEjG0=S878tweMo@quhp$a zxPA=!qKnlDorwt5ou|{gwGWD`&FR{-H@f% zro42$x!w2^Qd!dK5rPf)s!r_Q=?LvN%SkKY^RaU|%ao3&T>V84LU@j+rpM9pf%CLC zQ-aV;x2IoV0UsxB?T)5vx7trHCf&~F8`SzaC}5DA z&K@cY4%nU_L^mWa9BrWHZ{@R=lJXb6-*d5pVr2;Xrm3f2NP!WBzjy#cs&P(cM;#{g z`_6=SAp8gf1XJ(`%=A!dUmYh=(Jk0SG#|4>rFcRK}4+%usKRL z6ecnA06Sg_K}3L@bw9C}Cxl6if0m#X%(CjjyV?o(D*mYiLe99BcVEQ^B;#Ks04egx z#O6zn8GxigUQ+;|MmyBn>b7jEGKQvOzYgGf>gMO)^L7a>M*7rq248<1ehnF^LOufV z;)c^5bbcpel8WvwX$N_1?>6@d_&`_yUhaFrMw-+Z2?xbEekocV%QKq27-{!^)2c6r z&>Vu(>sliET+An(y+v8AFYW#32IbuG?*YO`Un7*hFKey8CLNB`>wIiFkLz@MJ>H!t zEoy=SZ6=DU?F}V6zq~YVgm1Z+==N|iM-L%FYbn%B1WKF(jUJN_IQEp~$&`OYcRF9# z?k?4NbVKhG8|3fdmD)IU`P!c z)Cyxde7B#0#aE&gVTc<n>L=gLw1h=>M-**} zr)Eo)J#}`NG86?0D8bI zMI1Tv*rxGftn`hif-S-AWxh^*!&&9Jgm|rjZ`mOB)R;Q)U71w9OgAL{1&98Q?*{_8 zr7WXZ)!UQ~q^)-4M=y@ah)qVVrIgn1ig9~qlVaP(#Bng_z zirI>fRGW8QWd6SIVV+D+O87&t>2=XHS95MJ zrMshM+ugb6!Ix))Zz6c@Lgx+9T%RSmrM=tKB1@0C)>AVTTHp>Pu_am--o7R~qw~#R z*@bYw`LBSP96!_*UDgU>HFdgiSRA&0x9^_IZ#@d$JE%GNF*TeNjohQR*#h{j9J|S< z_GLZn!n(XFVvYMl@j49l_v~jD3jZ~@X25e0GqHae z3*o2Leb9NX8X|%;9L_GvA}-jbjL1QD6A8&0m5%JHL-8p~qZaa?E;{*q8Tdr|S7N-* zz|#PUnYLmrjph;ak0-jzYOPV$7%nzWvzZDG#GYf4JpkW1eE&uNyvEwy#g}3cHg{=v zBL`vK?f!A4ufK9bmbJQx+6tQ)tFe>@IN0Qe%ID%tvU)502LI6~H&et&afWZO%wh-QB`{ zl?svQo9`tM!J=~;1{6XI6P42LB#;|G*?LMr#9R)qdTti-}7(Lrg zO{)3cFFV3zFRy|Jv%2iG63CFloLX48(T+_O>G0f$Yuq`i$+=?{AR7 z2oLhBpT9>bdLxC=D0D$EZ$|r17kApad;1~kQ_$9a(>F6pG=3ZXOc<3Ffnd*SGoB&Z z(6do!bI~5#*cvpiUTKBn1+^wpv`C$%$gpDdKKFepB~=06IWP}s`uOlGUqtPW&pIRQ zL?a%ZJ&_3-MpF?0zw7yYLC+6B?u;L%A(kCXGV|6?gyAsXe&#NWPrbQ0=dcu4&+FYB zz5@56+kbewvFJJT33 z)PG$Uq#_DYt7}(NM`CuNXh+NR z`1pXZyP1#wdge5&X+2=m*$?~a`vVPHY<6S9FE&&%flr_iBivjr$a+0Nj2}AQyL1Gpnzh@2H_YnFA0fVJ9 z0LQgPkiTwySlocZz=*;yoSHZ)lX}tCu@@=%p@&n=XsO4L$m5ikL{^Zw@_n;B`^vxo z^GA*+U&(rGZVh!)%C{$f0Qxls8!H?34Es`3GoT9G<3#rDTsZBT9)fy-wNTAX1>oyw_MnB(hp4HC;pzX#oxC-(~qGmP6-7PH=+ zGgOFExDIZAb(p|l_zw7(ci@ZD%)11-E&qca{t!vwdWA_#k2LL(tW#U)bc&s+3kc^} zSF(e`Kt=hIr*Z_9y*KyTDu@4A4eKC5>%EgKoXCrJZgYQz-GJ?wxTcAjF`Oq+E*Bf= zb$L_UCdu)gSB9-1Lsp#yffWV1gWsx;}re z`4#0?@^Jap+NW3Vywt{eD+0EE0mXlB1^cyd=@PkPi$1~~jx;miwPw^7gQDAQB``G?PPPv2<0(G@_3y+WWEFt-qMTB>y~7bsOfdl% z{;u|>;O%n1JD(grs=Wxet-vQEJn5%_l<^i1mD2i7!MuoxWZ4!=*qqb4GQEF!Y=RX3 zS^EvkJcUorDXD%S;DBukZtBH!p`Gr<=>be9^V(tcQ@9DA_v`jkIGoB6u>9sak7cmg zXqD_r?xtbJlH=&+3qrkC%*mM8|U-eSjwPT}w6`gN*LV@vx zO>&n;=H}ag?P+*PsGz)3Y1ZmqtU@e)v7RCPKAPT_zm}mU%BW|bPhQ`u3F~6EH?nWH z&s#EOao2t|zNz!^`fQjoc3G^*ySMmY%7+4ywYIvuy@q)aP)P|k`jZT^337;XigX;! z5c@?>figYUR9FC6v_N>W{lr~UHNxAOKcdzEJ>Yi z6WUb~&{jMd?&ae<)AbOVN}laT{wy}}B{!=2RWQMj{{^0zt7KVUL$2Zpg{r{FeryqA z>9WGBRIx?3erMn`0!%sT9U3$*-_OOgyG?NGvrRp5Wu*pNz~I>Go0!7?hnJ!!FsK?8 z%wlLK8Inn%YSRTu3luW}EIUH8$ZEfoh$g;mnXP`VYa$m3XQTxGUqCj&iL5~9#Y8#$ zvqx<>HgR|CZb9wbs8ilxtXGjF+{)r$@!`$kyDj^y@foa?10FHNse2P8x=7{{riB05 ze`4k2ZGsEx(+7hpuP2z8l?%&JXbd_28b&orMEIs|q+pblRkK{_pUd#qODv>*)w_z% zWvBxC!5Jlmp<=~!d>c%yvk80382eMUpTlP4-H5OZnp~ongL0tT9!oU%}PQfR_V;K@HUZVue(DGF_!t!djZY#ONHT7WWP#Ekt1sO zSFR*49MW_ijC-<(Sx(dAG`p&~*aq~_iE@M3&j|t3$xM(vhA{PP|I?PqQ${`O9rAiM zP1rTFTR2AR=ujh( zfy&dz)w=2N6qzSRuYDq4Fs{#^K^-cTZGO^YD#92<-6EoC7s;#*^!vS8;DxGO0u@ja z10YW~PpmjAIS4&ZY#1Xm1k-`YI=$h0x){ssqD4*y(qT|3ULzKiJpRwx3x6Q!eB{3u zh2h{Q-yzRO)`YDf#65znTHDjTeT^$yCeH~k={H`}`#RB{PQJeP!{+~(y2^m8o~NsV z64KpBH#~HMbc2)#(v5VNfOI#=Lw9#~cc+AOH%LprSN#9*{lXV6?B3bgGiT1s?%i2# zreDTY_);3c|EcNb_sK;ed#T6Ep6;fXGqX}X_FM4Uu0aAetVblB5sUfbHS_q{)t5XB zeG@z<=Bn8qc(`VjydOo;W{C$nM8)SIi3gj~!jwL_x__x9_d|a+j;ie| znl3p%big>KTug7(>)R7@%^PnOrO5ruo6(n>oF9=n5WL^2QZL8Pb6Zatoa*6(P~>I(y2LuJXf1@M?GgwjTpYYi zVUsG}(Z{Zu1f-=)bG_stTmUqhV*isob#Pl^f`DF5{Fq<9s3YaR2^1Pno;JM}!Y zEd@F16p=I2UfYj0&J$$1GOkD(_U&DSUVp>p$zb;85Qw)mXVjxb-Ocl_P02<$ApT@* zVbeI&HE>Ga`sKa#`l`zLO$8ZTsMLrg=HYoL6NsjfRVK;PIynV>Y#LtyCQ%9XjJB@Q zR(>1(91toHrifxGtC7d9r@h5dxWxUtCJ6UFp+1i;%%R&CTE{c<_E$J7L_@4rG7TF< zMkOzwwl1Ph2~oScP=^(KF~iyWkL7)O44Crhxx`XGKPsh|DS>~Z!@fw>E_r^pcz<$r zp;P@5&*IgI>@XmaSbQ&CpE3AVs&>)ivt{Dq@gl9o$~RdF3r%V7%GRCZOh;AnA^gr= z^w7>=#uP66-xKY}{71Oa4_9`CH6PJ(j(rF&j5=5{54`FVd3Y)Z^@E`l!`;0vYLPB~>GLxO(K7~O1`;7oDn>(qdJw6NTo62TlrT84uX;l+1&oG~t zTz5q#^9}GKNCwpbO(0Ar3DfaBF2(e$O`;tp(AdlW;JauL`~tr}+7qG1FIdBmWTZXz zRy&HyZk$@QtaCw)Fr@D8x3vxi-ni{(|fgMzlE;`+LMh7Um&XY z`FAL6t*hix8$T^Cns6tmFI|kO!kJV`L!R~DJCC7i2l=?3OYwR#i@bVD6XbsNS#i7l zj<&wfuPHrh33#Y2iTjhVnn{W&_^w?lrENP#OXV^u#u#FIxaS-8rDq{^k6 znuJSJC8UIQnvqJX`E+}t&gSSsZ2{8biZ0q;?7ZY~z||X_=6$26tzUV>>6iG1TSH%l(T{-_YR3cQ z+37aLe`vOTgqV}0x9$BhX+y%(1!ZW56g)10CE8nBK|Mr5mL++6#}UxG zE?#>5brd5W=%*yfl#i)kNagcH`u4U!iZ|UZWTps=H%2#;OjfR&dLcPxq(X6@0UB(O zQ|!Jx+l1+h#$rY_$p7X!G>uwC>CB|oHElIM9j1<~a7W|fdXRQ4fpZ?ydT0Gwa z84y*sTT$Ju)mE0aDS*?5d?`qNTZvu@@=6KAsS0q*rHpp9&A09ElsmpD*(Y{|4#fNt z`dN~tzNnnEg=Sw`U^*}buRBJHmF4xUl-*0eFWBgRhYl!ZN4=35YXiyIY>Aho(fUFV z3$x9aLaC$XCrbx9_N$wFp*(og7i(iGQ=>D88ZIo&aKCYj1^lw5&TLLJTHkSA5N^TW z9%;+FrSrTx)v-O8<{fs{9nh$>Xtgug*UI)nz`Y*JdidVpn#yT)poa6p;Vu1p54TG_mXYQ! z4L|%2Y0fMzEw)7saJ+I~k4R%ZrFd)xk{;1AjSx`d9z$LZ7B@-;sZ*FI@ejnyhM(a| zlBK@)dkz$m7g4YNfGqK~E66W+KW5IEodvhP;6BOHzJl|N)bp}!)f@dQIG;O3=DC1l zy7lyFSG45Ea)a#rvVs%tSd)!Qie*ck-g8H$ggFvJAu|Sr76g=!l}+QzGWQey#a}s= zjxP84?Yl3E7nbrm2fHJ_=4lb`)cdD=0bgZJz1VVHbVSwYN!LgEf)G4y5ftTcxiR#H4PIf z0)AME#|8dS#EUxq^97I3{NCkFw!8aVh5{w8vKzr|aze;tCW4+I)W{8Y^i85{_*YPA zScCr=ezz%Ag5s0rjXrI7@u~vs6dgUYdc8h}}J7jK;mz3(NMFO=s^>+EL!Y*Mqqu zU4&0j^ZT~sqX$$Gt5)D;Zy3PX5; z|LGWK4?djIsY7@btm@}2BvyT~x3UBcUwibv{Ungysn2arVKv)<`z1w~|0r8}Hq0Bv z7rml$V#YD-l>M;taPpN1!*W-5CfU8V`#5)KU~^0-1X~z`u*LPh2kz1Eb5sph5&2hk z*QhgDPiOJE1M%dSqEB*OqfaaGXYDu&=kI9Oki3Do87b0&>6ZJ*AOUB3w?#AbX@SX{ zNa%Y~40(J>BAQK@0SXK!XVlG84pIXWWf^6Q!fPX z-u<_iiBN47^zNE{(>&W1_u(zk_jAbaU#->3Kgfm=e5p#3-^tjr8MYb_EJPv0jouR4 z+x6WIHD0guXdmpp;%2S~y+u$wuXK;b_nk>`b8Q3>=Q#gl*n=@Tw3Q#T1#m<&!YYJ?W8r+x6V#lnj}VPA98C3kP@YLa*!FV#GmQ6Fof?ArF=qqIqSKXf*%dsv zN}6+m>HM^z1Q$8Cp5Qh*3#DQjAF>>&QzEC?vMuX5d9Q5I5md{OBc}sI|4aC=EHafN zb1{N3!!-`StKb>K6A8Cn8;b>iOuD!+uq%EM^w``Bt7kIK>fg!jk>=Wt1(ON3&UunU zf>SpL)+YF}m<9eO_4}z2amP2e5#UZ~Yy?}5Q8YU&qKx;ff^XcZJ4j`AKwcxn2RXfX z&&3DkNjZ+8^L{*X04yiDZNTdF9^k4DE&TTjh0IlbcRX{zw~mj0!21L#gn(@5Iuu=u ze2|}_`r|`v{P}~;qizJF!TX-oqz_}BUIA!i@2_aIAk$N?nZkB>+K;s0fV+GCr)ZuX zL+S%A#qzGnqhw!PExkQOpSMNxFr+c?4lIARg*l$5Xvsq2OG>8sZ(GEc z%x3rSi(|}Os$VTMt*{hAlPzrUjvP}Pl-3~1^~(&doom@xi*YNh@Y&G2G|i>IJ`%)K z+!A_6ED&eKbtm8?RhngjSGu9TV+U!?sat8e4F?(_$bG=7KcjZIg zmxdViy`2ENE{Fd7XD`V8g48WX9Ihy}oayo(MJ@yv zvlLUse;`a)l5oxP10;Hlmk{&_{@=X9P=(R5();!U);b2?oh2m5q8@0xe1rL4NrCGa zwgRRO%!{qAZ(28n&a-w{tnpIiD3kztIuyp=YJ|G)(7Ko+I&nFWDq|V!5wex6m4;{I zwk&a9JzvnmKE63~;c{iQQ}=RFf<;MYM%7LSE3DR)47uBB>84Wln=8mpJA#uWq>Qoq z9p~js_1$ztkbCOI%O8f0X9eq1f#hkeYL8;54bdK0<=-qE#vWt4eyO+^us-}s!&pz1 z`o1X0A3%*Qnqd+xEnNOZSb1OMTRpu%Em;S34Gw?j6!9|$S(nS}KIoq!2Da5Yw?eQw zC+v6zAI$)*nFZ=y$)(-qY8Ou8$@B zywA~t6IG}XWS8yeKFgA-v3Jy&UrVb$8|$XwySD`_uO8oz2koSLL}%j zZ1jzh0p^vY{Omow8Qgu^;E1N}r!g`*UZes(t4@`-;X2w`-pi-ll4c6NS=t_{ZG_aV(xCEH;BAa*zD9dtr*QKi8u7pbcS%%;A|$u3@#J_ zbtvM~vyXjg7s4r1CivCVK@cGJ_J8)SY%vw2GnC80_yeaJVN=8^N4Jaa=c&d9<}P3p zJD(G!)!Pe;R`>K7Y(t8Q&v7hhw&ohVJ0q5r(ZecGX_NEVQ<&zIZ;IU;kM><&WwE)q zR5A9QyPrf$7)OMyIkS9r7X5UeQ_#KNf9qDdeBikEF7^KM=5|}iuOU>T+^xa)M)Qb2 zfBjxG!{;1Zl%{?ZbtEgPUvd@<)D~TnT4Rc`@~0Z^i5qs9Trfnq-&OA8uKx%-IeV-@ zfT{eB-Ki#8uO+4BD6WI*Obq*F5tCJwmO4l)ZreG@)uD>Gv*=&gKrrc0Gn6y@6E+;g z!-{~g5vSq7Z~KC5^hLj7+uoIiZrVwazPeZHP4JCFEq5MKOR!p^3{w5;zpi^o(- zp~;fyOC3L}=;-Cvsl`Dgx+^;gedrGcdr2z3mmfhP{cd=eeMLj@y*^Kwft2&BaAzIs zX-8Z=YD!yN?;IAE9lSBWL3VpOtRF*IO3aq~JVAx(PS)>@7%R|KSL7d~x&#WF(uxm_ z7_or^!v6`8_H?L9%z9Ss*h$*Q>R>Luyx|5p0@GtH@M+xAJ>BOUSLfViH3bfs%6yj( ziI+e=S9EKMCUk41zHm&nz}j8R!LxG_gNMPqh_`*Pf1&G8ahs9Zlbgt^q2Gwv`MMHU z&0y{pkbi9u1LF8bcqpFys`-s9I8i5oNzZs73q}#!FE&7^6(e%UEi$_WO*uo%ogqk# zp+c*)4x z(e|oMy$*v``$Ie_CM88>z|O?Q(C*(=$+A@ZiH(`iH>;10@_EM;{Z=KOV~#^|Tl8FJ z2Njcp0qQ*PV}RLVlVf0>zQRj&`S|D2*VE{di3lrl(GE@f!7~E01I)E#!qCzHy^Q(? z*+kPv1EsLH11i?)zsqau_A|O3=v#N%&sI5#citUOt%)95T%JB$O2swi%xi-buSCwu z2&H*Uma(U=>6*Q;2mQso@ErZdC67>>r_eb%W1m!7hu2g`u%J0Gqkd*;jq>-t_j%Mo z7rGjv#HF3$T>`OCOcCxFo+U4$L!b501}_-kapA?xhF3WVH8k1-%o;BhZw|dBCb&b| z*I8zTHEwhfIQ)j|T@v6d%GM$yb~~wVO#SKE7Ee0!r5N?x4cN{vCE0Xq$smI|8rZhs ze`BbGqxvWMvxfdM{)~hgy^w3$KRq%;`qYw9Gg4N}Smi{oO1|M9qc1=wlEK4EWLceg zHvLwl*a*10+ksw4+Z2xOIdWEBK&lO4@f^w5818AC562jp4acyZC>u8hV-yGbyYhZa z9h&tOab=_rGT_f@Nt*%lC`31xWA->K{&cJ(O^0&P+cCVloyL0yK9f@{%(vtYJ#Cs( zp2FSneR*$-LZJrFFvp7*n2{E_^!4;+v+=dBg7Z#=4tTtg-|e8#*}6elfOgAbnT~9T zd&jx!=)igVEbJk~7DxOPjrvPc%vUM7DG#1SmrPTHNeUf@=-Wxnz38M}nZHGcG<>Hq5j&vR)dr51Vk9+Fv$CB~NT$%n_*J^+Pm~+xCeY&MErZZy9<6NS>pmqbyQy64434rfd$vbh5N_PjWb2v43S?a>68; zkGs}4j9sA)Xtfteyk$%A0blBK{jcB;^A%hC8J4SrQ`LT-&c^F$N4bjI4W)8JME{BH z^=hcw;1R}TFteSmMm3WhwH(6$$pCh26>&JFPEoFcBzLk){QVS7uid|pZ7RFdm6YC3 zU?2lbA_160g7mHjQmYHcM4Mr}oyD}{zFsZ42Pe#zv4a4ig;4gGM!WF)l!TObSJ}r6 z`IRXZy(wa48P_d@L$F%hY7SCfI&M}iEIYY(fD{!jWr1+;;-LFQoU@C>{?da_KsDSH$#cg22c0el$I*Z)wL6jcdigjFtPPpXb%TtcEV zz>MFoCzZJ5IlX$(nPSssE?rhRS_K{F;>G8HWVrq9SBg-I`JeNlcIj=^ z`C|}a@MHs*X<1QT8p}davtrE3Q~ut4wHi}5B8{FG;$E-0YT3wfmO5i|vX#5mossqV zGoehF`r`Kq_08A#kbd`d;Wr&&>PK+5?SCp0KgCw?COLa{ZQkUbsqxDam!hPX>hcnP z2<+314cze*ythD}QU`zioK3yqNI=W8ZOd*d4!^V&rn7 zdX}P?H8o<<94m5NE$C_{2^nx2-Ix}e!B)N9Uik{_z}4lB_adIKsH?a3i3t?GZJ{3E$L=bh63=yc2?-MsG*^Z7x*w4g47=VXy+&MnC zpPzn{ah(;D(#vPeZ9*e+w7jEg?y)}hmB;OO`lR7P<%NSdkM{i?a7$<7v`~e6@LRU7 zU$|FEac_8ye!~M*4zfgK#<}l$6?EHuHM4`KT)%{6kzF%*#6>n;%lj%gWTQVmdYJQH zjWEu=d6strP%G#>(B`(ZyK*7l>f`!`^u@Tc_e(!qhr%E~{s>iDpICRYH!$q{BL4Zj zwzx@=eCXJH$mNc`F&!k>Q;ivJI`RS=2=_2Q#&kkqv(3JeO>p&54j9s( zl1d22_T*!V)W^j0l8A=w{wwo3B#h}?XYPQYxEU`rYfxt>^(k@|reu4=2p19j3t1%L zF>uvcw>D!sLqTdAhhJb5t|sSaHhZ@nAap(jo33Uf_hU~3@~LRQA(6B$eAKWYT%a<$ zCqbkVNz{Ox$tdfjX%PoXVCk!TB`n}($W@In3EJnNj*$@Y={i%K7V0f8Ssvazr9M$k zQa|k3&yBcUF=RCw_#Uc+3g%F3TQ;pXQG2q7mQytkOy8Y99>(60TCkm3y&&(fL!Rl8 zBDcv221N1t%vk2}^N0(If+(nIFx77H^xHr1R8bryHEKuUO;$k$95 zOcKh}wm-UJ?NcrDW_1Z^|7*p%JfXOBMw?&PPNjfkUB~r3=ro`@6h)6liv8`Har(nS zUNN9OWiK7~l$U9q|9m_As&=5o7v$P$TL?05*9)Zr)Jo`$kf>qWh#G9NL{+SxqSSJ} zCdEFmHoQ7#_mWCFcmZmXs@cw)+wrXUV;{*4EYX9rX8KNWq%4!WWH{f3)9!fr zu)U;{;Ly)q0tag$2l(Id`!@X;v!zugFi+rS+<$NS?3$wlyQr8M* z33Y!2o`d|`CA*buwU#XQk{n^lSO%f(Pdp~m>aP4XAD7?eze#c>A+-m_4*FPw>2Aa zguvVvWr~N(P`?#Ef{JI0Uv??h8svJZhw8&s_8%#~rb+m{FaN>cyEO&LD$o+`6jQN8 z3o1T1K3BgQKg%u8@v4*9xMEj(!HM*0O!Ug4^#Rpy+L_(;(RLdo(>Y?DO=M*XI3Fie z212I3ErK^!mCTZh3~nH)=@;Zp6XF8(EkQD-;rSSPDYZ;efEOe~$V2^YrjEB=3$!iq z<|@1R{-sm}&(Y^_Zg^dkyKFN^sMWuD8P(U!qe;jAmf0NF&NSQmr=5{ll`IqMxhi2J zS_B&HM*l*77tP_(TW z@u|uw=hUxA4{E%%A;15x@0NL<40T=uDnxr<1EH^^c;BOw{cZh`wQ*M?|Ivlr@h_dL zvDYWJ)pyP|2~$Fdlg0xO9ojuLd`U^1VcF~1tuhE1F2gP?+@_25*LamI30`4a-dUZL zb8lG0xd6XZh1*Rln7Yyj184Evke#h*D{=yThdPA~m1C#ru*Tl)etX71)!i=D86x~y z7fz%4as;z_9j3b9KjHkGu^g`YRP|m>5lrC5X;!uT^eVUd-qZzou)E(I%;j}XCHPps zE+6EYsz3L2O5f!uiQ1z=Di@j-CbGL?Bh7$Nd#httnRIZA>V>8BR zRow6o=K?(!;1e)FLB62;jBs1dc1!3;ARW=o=m7$dNy&l{)6dr_Rlhm`Wrx`=L?$j` zBsBtiHzUo)Y7j$5HU8(pcnnXVL8sr4PCEEE7~=$6Ei3GNjb1tc83q-Z zHJ{;hT23UzNs_8`pl}vPK__qa3-I9kzXu75Skp!BXvT@vo8yW%#e=OjgKCzeHr{Xz z$i6S-PPD~Ilc(n!9Bxo;nkTrjk#EAcd>`KQ%OrG`D9p_>{MdtP_~OWITlN;}_6F!& znq)q5Ik`#>OfrtT28)_Ix&`>rhYd0BgXgw=1-;30RO`ZzIts=eb5x%~mNV`oEnkl6 zS3g4uW-i0Hc<3nVvB?=yw2F)KGSxw@k;Y8;##+YVSI^sI9=Oc56=k^NhwI#Y7|UCg zBMP;uc%c@J#xkorJAX6SJw<2(=X1aJn`i`pQ_ic?=$w!Vrmt*)giyq75hx(UN zOd;7;@XZ^fMxfVEtSlO2zoxg>wVfB81CtSO>Zp>RQujJuGbVcivs|lJ89hJmg1HfR z=${27Q1`l8QSAR%Kq71iM&*c*{MxM8SfE<bDc95%c@^Un1a?V@E=vs@LESIp0 zMLRv1WtO#yie9mJls7_75~wrN!}E?*K>-qgBwMQX&(7W||Isl56M`HQW%dl%$xjS^ zq#|AgJn8z;qyyoJW#xVv00Q0sfBE6*6b5suv@znNWEB)JWGY7mfqMONk2NGb-WE@M zNieJFTEs<_?7ej>x1B97s&=v5$%D;_)N$oSdM%DQtb%bj-6Au$gFJd8d%WSt$8_!h z_i-t`413-o-&@1+Y&}9-&^%p`4$={78$>)a>|dj#VZFvCO$5H~DEy`(|Beey25GNe zM^^#5w>knSK9Gjb=ag%upD@DyTb49bG+v>;i)bZW6=RMH6AYY-1p!d#OzY@>e zlTx)XujK1^9yJQGr-~|mO~xfjwmv$!GxT>oEC|p475H}-Y}z3qU`l*Etu8dH0KTft z`5-eaKd}~rwq#hh*lE30S9%0B%a87K%4(ZD=fkq!_T4Lv;HXhus8m+fe}jzg^p0xu zuHWqireU!s^E;qRCnTyn{lkrQ3@rk09KahR3P0p?A-Rj@&Z<(2Y-Q(12%vAvtFtmy zKoGxtBmA5&a@xHLfK+)UT<5~TJ%x<4I9$R zMD+@EZCBS~UJEbEU-wa?B9!?KX!!%Ykqzqs8gz#Y`Xz=XYCgFIeCYs`QP%1iA%Pdb zf)K?M)I?oyK%w>0kNY{oVWFmMNn( zH_4a3M-yEvn763t=Z3I1pZfj`nL}&d=OlE3sP z$ntcyg%d?P=3k^5CZ`m$B8&MGsfO|75lZmjjqlyp{MmbG35U_+gyL}gD)`J>Xe}ro zZ!U4aPLV_zv45zxwybR&J~A{v>Pu?QZ;s+iAHw8ak4fEh5#sg2mxKe6b-2BXqurAZ z1o{Ir^(!fJgkMPqLc)=uh}f$cxs1fmOkm0v`gih7k)$hGBPlb5B=or>VQNc4J_k?{ ziWqS#GD#m`S|a#V$Uvny{@n2)$+NAy69WHTQE!NBw7%T1_gvuk5_<1NvKr5P5&!tA zcU`*qh)5;h*MycN!!$w_e!8copuz6SQ9`Z9ujG!LbNyLv2^88gA<0&92nrSPHeoGY zLlWQOQ7P{^B-yl>h9od(_-IE$h`d`%j z%BdskMZ-t|L|wPtz9g&7q1Th+yr@PYSJI6kzNp<<+PHel_Z;MEEUG{K(DEEGbw+$l zDeNMd4PW8@@m~=vW*Cqm3J4qsx6UJeFP$g+8tsR0xUE1`kZ=K|gpHN~_G~~G_#c{L z%7CI*B*A~s6q8ezT)m#1yYt2IEjEeBDO=!ML^nMQ#4C8B2qE`%%g>|mXVQa13g*-7 zj0b~SvalesJb2+3 zb&c{NFT6XqXjpu&cd9}=m^)JW>$Ju1`pN(!y# zq8>@)tkRWEz;|jO7R7JVzWnUDV_L8zN9o=xKQl~m4sm_8Q$7}d^X(50Tx0y>kr?60 zQf%Ry=4lm5Stg?Gs+po2Et+Nq*2z^&;e|Zqma0DBn{WTMZ*7&sTp()(-mL5yWayR; z3u5RE$k0uveu_2^bFE);$Xag#=WdZ!RVOovy8%7xrTSC-M;$J#DczNN>p)j0(d@@hY28tlyBu4>d3mq-Z@0%cX@X zA5A9sCh$Q{WAI(58kc4zF1#)A^LmA_tqOP0SOd&7X&g@ixg^P+HoBAL!x8*%<0c0w z0WKWgq;U(V&`$-+?WL_vAm>bYzWN{ZlQ=RA?2>yPV+buUX+J{4&ohc|+{zbO-;v4% zm>?hN&|eP&Z23=)w8btR>;uMt!B*4fD9CZn)b#nGN?+0Ry~8q^9N`{3GH~GDSq1&f zM_Of!BY#O&L8~0&-rLu34@aV{4urOUv^@WiEyjG9)2N7*vg&eSx9TgGB=YF$5?}&K zRkQFP%yh8S5%w{CAhYBoAqI*klygnK$dLjS&cOo0e$0jfP?|0iJN|+nWvB}V&b--* zcbW!|=t2VCKle;bLn6bJ`UF^A=vs2F5t-HBfAc?x4Rrfbl7SD?zvuXZ>T-U=(LAwTYu1Z`$lLdzKo(n~)#3kyqfZJ~K3ahVjRL~NSr9^fr zPkkdHnXB$_tnKg*)*Z#bRr3~m$GTsChv^LI`!6(@ zPmkUmVi&7WeY#N2>~NoW8I2tnF+GlI_TqU%Z;D{H5p3XBk+~|-fi?=txjXNi!~(U7J~28Z0Yz7Wul7l}g$Q+P{*CNGZU&58<5hTdy0hN*(Q4Dh z?}3;yd`1v|=6v6E3&S=52ByR~DtSd;Y4;@HZ=tXLbB0pnIlkw@Z zgaUaSkD`R)rVN-(yA=-=<=LI#ScphFXpm6=$cNtu5VP7Ox4Ua0I2Iw0_4(>iKA5z^ zH!K1UU%_$i7a8$^eB!W}I)b_pX7swyfu3Y2K9T|AZ21uqsIbk(SJ8E{fiY!`(EsoM zt3Ut$1;aX$ckQwJP#LwR&XtS!luWFLw#)hJnvb^7{Up)+Ok2ox)eiRNgnrfz7g1z50(Kvcyia0$UnUAex8bQ;- zBR+q+@Fg*>-v3ds>$cS^LRbs>n?2&;ShzHz5 z$d0VTvoOv!oMg2vcHa?>+^A%@#C@l81Pq*J0kOn1p02v{#QxZOL8tx+>*P(RKE%w8 z)EirJ+^2*S8!j3inH-lm%&hN}JV=r1^j)zC+E#ua?lPw4he7g4h3ghKCQO}*e?zvD z>jOhpcmjJND!?4AVuplRy9^ihLe|wxCee2i=|kgXKKltt2*~QNMW5El=TECYSzfPS8`8btr)oDsUm?x7R7p|m)NFWAYm0jEP!6( z4kGJm4`QqJskf)qrBrDq%mxrA$_I7|vdK6exb*u1TSnZ|bb;)OLkRW>P!_z2d<81% z{XNn4nu;$tlme-Td3b5biu+jmI9S2WS zmW9B8q}A6?kuas>m!Qw8Z-6J}7fHYDiuWJbBnEc&f(K09oRNE?F8(vGKv2wYk9#$#wCwfWGD12>;B(ZKvNs)!R|n{fj1J;G)2E+2F>x zC68UwL4H_vkg+ipG}gw7b=!|^^c3v2C_x(^RFvXn-kyKh8bGpD2!#;h7rhtArt z3AQ(-hb$F~qa&8Dz%%b|j4t@`2g`$<=EHGBkK4d)b$?zUOYOuA>Bkn zlSZB_mSG}iz>6acMawhv4IJxp_^2F#{1Q+C$qEpTY3nYWI-6$u^GPrrN4@;*dOEK9 zd0JksV`BHoM}{m5$Hbi5W;{jML`*HXdK(YH*B8G(KIol{viEunHvvcHPj1eJ*P0vV z4_lMmjr=%os4gD-lSjEd5^O1$5QCC;;6(p|3Go{e08E76goqc=Do|Sp<7S5jc#&hO ze&1F8uElP>UdR#E7Kjz{Z$-Lbu#h!iLRR)RlXjp*0ef^7j63vbOr9@yVcC;l$Uuau zHpKqG`ckBTd(WA3^7u)d7jmg&Seb&eM+zr&flO(KkF#+Uq|na$<}#jH;pOK)4A}@P zAB!|`6f28ZZcW|SnV3mVK1G@Lpq~p-B&o|}{k8JE7jy!$DD{6kkn2j7M}T^bh6r7~ zIb?L!@MWs?rfA4Qh~2sLPm#l$EuGRF;NtvA-4jPLb~L^WkL#Lrjw(GLl3SmXCK#j3 zRW+zXRBq;{=%ac7@rUZ@rrP#1NsGkJZ0L~cW9`D|;gDu1n9wI=1?_+ElZcr=MAggr z7l7QzrA5AyO{95|@jZdjmxyy&o%vSw6e!t5RO-c7%uF7~*POqA7 zi)wmX`IUOSay3L7TR}?gtdAWQq6cuwPkECqmLIh)oN^bOk~~>OluVvK*<2Sf?7rGY z{i#SanM9PIwOa4xVhENH`g4H7WAg;wUjTUjq)xnY*b?<|dYtSde_oh|!X^HBp!`Dq zJ1FG`JbT)Mfjk~YDnDiPo|E+##!#hF<9(|L_m5)4^cW(olj9n5_(zf#gg;y74*lfc z9;uGSF3iSPehd9Wxmbr(yTFwJ*dxSp6M13EBo%cNnW{;qrP(@p{#9wG1`!`kU`3gS zRG3+pv^;Y3a%|Jq*9 z__Cnji|*VZK_|~ zKt0%I7@OgXSo|ZaE7qY)BVWNuOX;F8R_n@7Clj?DIPJfQEb<$WE}V83+&9Me7{qTO zV9n7eBPm)K_J&5Ob9SxV;7Xbw z<^z*$QxFFv)w1E{69_CZnm^RTm#d9B7Y4f{a0+o#8A@YA~fSm;aSPzJX^07|W5FyL#Rm1TapDX^N4=P(@Lgw zgWd=Q@+tZ@f?!beP)H5MBX|OYU=4_H;`gr&z-)rk@{|Q!`M9kTw(;}pon2ta|MD`E ztr8d*6sr+k1UGMXHg4(Hbm36&C~Evx>1L54Q8%2K!k(}eeZ9%wppx8S z@-x(r5fR97u!phF|4JwnwmF?L$V< z8~ew!$H~*gzLJf37sfFsknFU_a*IS!H8u+dCDya95dWI%kGgkv5#N zKU8R-i1Am$qA?h->RQxzlEh!Digsr8zMBi_i6C$

n?_e~)wefe#J<6tV z9QcYBoK)hk&yCmIK{-`51l70Sy3bcMJF>QZw6sUJltpwc#n${@v0=C^hHd_iwvXU?S? zK1ygHAD@KYQapD_JLU5gm4y0>v!kPT!}4uHzK#oT-nS|il^Ui-Bg?5+T9*CY)8~7e zBMF$>-tIp?QalF}ybfrmgqVyaR%BlB$0;rwk`{Lhl;eXn7uuhg7>b>Ayz41VzxA%) zqFh5N40SXS6cspflACBaHeathj6=w!I|=89$nHZ++R2}HVSTk8q2%BB&3l!cg- zB_JI{23e=^Uqf@*WLu_MNOgxV+eVk-i6I}nU6*=KSzAG0om<@{C^y_Poi*~dBaDNuLw#o%B|sKh3;9K(q)iT9b4HqvYul9o4o zOrc)2SJB+21G6hU56JrW6k>Wxs0cB|K(=8m;rS-i!XpNALGs+?&}vYWDXOMBLScWc zS9)$&hTmR?bZt9a7%I$uK7{CZ{BW^5)jwebolCKg5O>4cs@YT4F>!3Sv&a4_BJQCw zC>Izk{Bi0{#+x~3%4hp`VB5b+7|;Hx)M;@OCZw};_`sd25c1E+Ty@kLy>hVPg-U&k z1JTm1GoJpuN=VhLUD*-ua_94qK=T=JpWek3NWZ5h9Pi8?7tNrKD?u!!XX=~{7v{HR zj>8JGFhf0y?=$~NkIjla&desN8EIeopBh+AZG^1@>faRduG4c)H3K8hQ|(5KU2ZW2lNfA>T2JChIyv>78!m3zhU4z+UT0?s`5M zPwG&-{_l7f(|C>0v^rnm%I3gxeewSCW}0=z;^btwH?gPG5$|W0W3itk)a(!77!;$` zxko%-Y{5|Iqeqh_2h%YmAnU>|yeShU6i1qp%Tos|x@`Uwp}ub0a{Zt`R%Gzi!&_i{ zUSy^uhZlV*GyRb>mv;nsi)nMW;o93-lQMKa>3r?;3tMzr$sHtGLkDMAnVG@nTmdJe zaF~G)_9N``7_`KFGM==cwBi?wrCJ(PZ=OIbjb%ZDOsAE5e4yBf{$flm@EvC4M4T9w z|0h z(#|OgJzD^WU%vP;@lzNpu}?0eh|nI4r76+7CDaZoXT-M0+z1t zMG$?n!hXz2Ac|~{>vjsq3oBT^In&>e~zd12vNIeE2f>w-gd9P7?po?7?=mWgTa z`Yb+o6hp7Jk->AKC~(z1h2ZS`x_ME+XcU6`Hk|i$hC`U-5GBbr5R8Pv!vd8^ToF(5>XE1X&fWm}Jrb zBfXcndh-X_G-xQy8DgU7Ss}R$2$LT{@*Z+GeS*XWSg*$AK?CG-~e@&|eI> zS>i2vWc_3ZoUtp#>(3K!HPL_x`Z!mqu>i)}E{w;LZ z7$0)be_KAv{M27ePcTIcl8do;@^@M~9Xt4vWj;D~$X)HNS48(VZ=mk7P&qVcp-`PcJ#y*JH0+uREfeFg5HkNF9Sh&s(WJOw&`kW!_3O6(KuF z)I`*h?BDM0*7~&ksEm+&BSK^I)Hm*!BN*MZRQh!+32BDP7?t5o64W}p@>$zs*k25x z(g1@{)>N_wf|-AmD`c;k@OZ^Et=}Em>9^swR3e*WFo|3A34hH}^xV$#TvS-*;WDqL zZR{}~L4o|udULGw?ILuO*Dp*5*)BrXz42Tj^I^AV&#~W+b4?v(fJW2#wqmfZPa?tC zAvT3t?h$M(hUMOL;r^SFz|3z$^FIyhC-Z@5kO3rU@{BEf8|-$*VTwYMm0?9Z7IMB> z14A{0-mrUa;aN8?=qmlencJ%|%HazJat)hg<3=`k+&nD1v423Y(#`RDdmhlY;DAwB zceG>ay+p>jSbJ&c{E@o_KEH9W=yGZ=^bIMn*LD z-R7~;n`o^Gy-r?I_*ncgy#^yyiuU@V%nQh;$H~I!3$fvm=m32ts2?*=JW2krQ>O-a z#cjXybNufh1Ruu9TtOoPddkh1MJ9#(STgyhI}3M*dr%u?t2c{rXa2YR@xz4EA^Wcj zn+wapqJ2r%3bo_7%h!LaW|;$x1DXy4$d%Y76OzCb0o+t|lrN3}MEYH;WQuw#0ob7p3($d#OV)QXd7gwgkZZLk zF~TYfF0qULFKe`#f^i=Qh><~92O4T(d|euolKBzxjT=%qppAEjlf5;o_301%C!69K z;`f(yT|#`d;%KjUf!x*pe@9c4xStryGmK3Agw>2wQ%_Q}8OrKA*V>&yD<0T<^H!FK zw`7Up9Wr_zpXT4u@c%-*?ces?zl(LzAXp_?;Q;aH^g$MAp)(i*@%eT=9lmT=s4WZ! z%1e;wW;luw>n2 zEPHb`Mm2;qB-pIGrW`&(CCOi!()<(*M0l!Pxhl5=FNmO``%iJmRS8lE(A{`krYr+) z>K1I!M}iMsW|(}8?9Pa9V#M6jmWa^1JA?Dcl=e2Nr<(J9EJsVo&>e(lMBe*;<@IXT zBuv({h}1&ibL6i`^K%rNqzhP4E-9dR=4m!Zs){ivz~#W=#+$0+BDr&J2^9mh;G!Sd z@&Qx>%;(L0K%=e&KHUG}<>ez~vERjNuOYtPI_#jmNuD-5)|8M)>+ON5E4$Vu9h$me zt=*9~)wFFY#sCQBxWoQj5Y!J1@ABHt<+R*i&bktVTVPgWYv1|Wra71@1Z*!7a_g0Q zv@q@UkH4_obMpgd$6v({Lnir`Jb2bb{h*f_wJ6qpMi%gzR$ZGeNoUG5h^PC8;>B5> zxd1U_%(na?&XPPxCGrU%#NP@XW^~0nc6(2;F$rw2C13UY*;Iu;rQpQeaIb?l63?pu zjQ`H$4h-as9J2lpN@c0DESr11Ilr(!Y;W5a~u?51HAwGZ`tuwyxe+ zxQR@o+|-COWkG>Vi`WZZ%AaPYv-_6Nq`mV8lN%ZV*&@$@#XOd@cU6G9VxrBrVpm;@ z#^!U)W}Sx%dK;V45rh_n6ewE++}EX#$klWdD2huCc$(r5haks=JJ-jxvhrGl{!4fe z&e^TUNkhhsznx8LYtai9sw>5kjT{23`Dc~jxj_~?A?f=lD; zLwWH_Wmf=S1r(5OHmlTxu}z0c>sik5ZY1sFvF6K?6k0z0>Y?25X0HfS;f-~vxm5`* zD8%H`-Y5>(!TufQ`V0c1HGjW+U2LTR8@^{f9Ls~F?BSK3|iz13L3c+{nv_4-j zZ9tb%Wn12|7QMog)WWtp_lTh)X^_tLz0f*mw~sKjDw=|8(?iJv&vDs!354aOQ*CUw zufzcrx0I<1@1CXg-2rGKpTGf%g0CFwD!3U*T2uQE)UB_UHZcLK03e{04Gj^tO%BUX z;m03{(Jd9X684Q9b0KA3-ZGjcM@7J1m1PlxVF6k4h6!8_*uIP@B~#_nXj*hpW4;PW zy^eUelF+yRu&EGi9YO^w6W9venNUXhp4EI-6fpB=^X(wHoUCthIO^sjxJheW|Lp-# zE^TE3#)1IL6L{1_*m%_1Pj$ht6-5ut*-<1_KE;X({`@<(@66DSz0Q1GzMo;ETPSZN zoyBn%20j<4GVIitI+aTz-c?@|xWRX^Z~o}hA{4t^DJ)&}!i4HI6^A>pq z7wAnR&|jA~VF;TF^!*4hgIn@Zk~p%sul{WV)Bb>|v!X1bt%Yl9bQP8yrTLrqd-3+w zZ|JF`YtH5(yXkAQ_%Hb}VMVaF3HY-CWFJzHLrXPLq+#(%Bwc8c;$Q}eElnHb)CRQrmLHI&K%#ZIRXtc=fVqF^cTFPL;(chU-) zFeDTUcK=v{-p$U(*47ag%#5u(RGEM3ExKx_-)5zdivHhtNXM()aw`o8;tv_93-MB^ z68jhprI+qyRoqd9#Rzc(jOaQ@G2%Blx*AhG7tS~QUv{8> zFs3_K%!Lm@Snxx80`Nnp3&Y0F&G3Pr5uMvxJy+vzUGGwf>~Thvl&O*(;^ zh_REfFyd4Gg}5lZBE)9tFl9H2y-Ac^exD6Tbr3SX_D{YJ4*}wvskffND;EqfS|WSJa?vy;{tPR8^(>iMJ2qCN?CDWr%%N9ahl2%Zo?8nB*@l&Yn^>0#qpLcv*s}lkX z1U8m5ofpcJnb_{cl(`%>U*CMZ#4dn7MkFr5IDs-ysNYI?A`hD8bU@Ar(;1%6 zR(Pq#Fp~YM$%@>6azu3L(TOl1ln))DB_C6fe}w4IzXZ;n?<9vNZUd2rZc|;i=Oc|7 z*ddaTN4`fThPK!VJ6-J!!ywUIRQDXoe`3@H4)>dyIQ|u*G;XiI9x-?!B!R7hTR3dy z1}q&|SR)`@PJq8`#p^fk^1a(`Gl*zAzPmVv_@7e|xjN6)%sac~ zvfAGHu?_pMLw#JEJM-^UsM|F#MAKi2#!{}WC8JOTMSl=!Cn1wVrVI+IrV04i6vkaF zszG|@JR90#p+6Ea#&QK%lsf?WCmSmL7v*xtNr~kGW&b}Q%sunSO^%D8^i1Kw9dnyk zlh_zh^Rg-u{T+ePO^EV#y2(V`b_*Kwo%5_n^Dlk+>-SNwYZKpI`aL&=HY@FIQ70Wp zDzS+J8HCBpW_x_kgzL~BwvdYBu`a9N&)c-vbUH>KlwDxJIK=@#rNd?`eHv{VD zp60^O&dfx-Z;R-WA{THWs~9PLf&1SoMjh!!+W{JoRY;9M`5{)h_Beg>r6}0_vU8$` z80%}gA&#j)4@9t~!%~1)_Dfc;U?8up`a<+ypZ5IqbJ{9;haYkkc9Acw*&< zQAl*Sk!mtW>_bKE_vfgq(KIni5;$}j(R=#6+!tB62U$v-Fyy|jzI#WqRUY0Qn!@zz zI@e=)yIlh+0^k0ke#?ZDcxYzO0pH}QSUV#E^?zhYOagMDcWAHusH;-S-hf5l_Xlf~Zfq)?OUF`t7) zB;;_jvR5EaQzby|fB0)>BI-d5`9op)7)8)>WsjVis;q71_s|5Z=D^Ri5V^jE<~+sX zm%Zo+;I^lx3$IS8s4Vt^Oaq<$<9h;E6YBe!_N9Guv*hPa2|qh_Wv#g_W+YvcWL4^! zh9|Omn|$GI$)XRq1`pXHx-+FR;cdR}bE|u`lF|lsQnBPWqUz(*p=(P#b)i>&;o!*~ zc9bky2Jf=dfu26P{iw+4_hM-O%Ymk4Jg1YfCn-ErYVfACM#lf7v8C+C^5Pu|7n)n< z94{P=z|me`FKjfx+Z2Hl=HAo0i=jiW^p$V1oczu6xL*(GrBcWFA|7Qq!6*m&FwST~ z;Wk$2+R!+_f0r^$O#rBK`?5!-LRuy%;v4@r%Lq*%P={5>naX3$mRpWlC=n)wos~uI|Ma zD7%=OLeMMOt4lQX+Pr(1IV@dnZ6TwTFb9THZIkG?x1~;YXKr5ShDz+aosb> zk}G$@_Y}uE863{HMW#-M_Qij9Eh!{#>Pw|^Yn@gIclBWGrMuNGCyZM?lj86?LeVU6 zuq`=8ljq(&+u25b?ZFhC`2b{ zJCe};*91hn$4p++aa#2{v1__Fc)e9~vgRYyjYQ@jgnS zT}*l#zqugYyV86h-~V;*N((b~HiiuRK_|z2P!`Dw^1luFf(RLFvUwq0|L8ZkJB;PJ zuIvO%ryM=#H?IDok)ocM>81vYaPWnPFv?yjJC!4eyU+JIFzmOB?(7sp2SV}l#alAz zxmD@*FkcY2%doNl=GD{*D>jkMoFmN(|>`~T&Qg`+zg5jX#!$3d2-%?|QUj`%X0 z1{Ihb1hiaEu!$q{jNTuFA&FKqt83$(c|hjYOe;+^+7sFZ9c+~sP9OGsWKh$P{Q#$r z)aA@KFNWqh;5_{W;h7s#+Bt@fAuT8beVFezDeI0`p|!lQDZqpTNS?;UE=U0x>Yfw5 zLKh}EeE0v{Vyc zk#>0UGgt3$rzhc`c@`oa1!x#~JVJi+s~-<@GY0`64N4SAA~yYSyd~a{4@f^`$=#S@)FW%-JicmCsOCEX$!M4E zzfBSjI47KB%RQ2s_JV&t9!tj!D#i|{kl*NsjUh|7=t?%M>QtDH#|(_Rp!_}N690TW z(_g5@$)XJ0V0|zp8#sWOV7`;6CV;eo-9-e1-fSWAJ z`b)pD5cC3KC7a7&gRwrW=YjJUXF4s~xrDYm8S4_W_!Ydp)qmoSnCXOwyFBukZCSPr z&4DfdbXS0 zc{&VH-zHf}v=O{HZ>Ao^!sE8>ET)O&GcbwO)S%0Q^2O8M9fSs#V zKRaHk5z#<6KO5);AX|J;^{F&vc*Zg>u}4(?@X4-WGfT#W(IYXn-%owU&$YNXNsU`Ek`(`t;x=KlEQfxk!>F!(3IzJ&ioj`f znIA~oblnSVoY8^;m{B+tJ(xep%xsB;Y+9Y!mqWi8m)sN#(|uAqa-ryeTFoc8sn>FF z-R_nrHd4d#_g`-Q2 z8NX3%XO7b$%^nNSN|Am=os(@ieX{6JHx0Qc`+|NdO1Z=LeC;CqjL& zmEG-#`MzQ5tfYf0%zMh}RedD2dvAgwEw1)?6zzcg=*NXA+La$j%aR8?X4mCMv>QKG zOd0-^SnF!&K-^!+^@MCa)1b-`C)-7wUsK5rA_E=B(Y*Tznp@yBvPN&iY?p^8>Gf|JvLThzu&WI!+Hc|1e3cEjh%K^b(_Awu?bxXcn=c#G%6SvX zxWwwN&uF}Vl1z!lEL1Hs6&1Vtw$~up5`n41n0W;uH4mp z!K5VE6D;K_-H}Rmq{;Mndb(31;%60?mju&uS)sBGwub)0ou9;pw7#f!)X(Z=b_@M{ z%CCmE9laNUqrdPCf2_MF1-@ZmimRExSDB7flIO?R=ZiK(o@QtBew9Na3zv|fVZL65 z>Afb(?%iJ9TVhmqhQAm{+SsDpb!Cl|nA5&ma>S9poygB3clmahu=^oA^ZnSt628YO zInczFXK(~2edS?MQ|^lXvJvWwt@s_~nW(YIT=o?W_oyNsyX ze}K?$>xyhKg6|#-^qa@AXO_0N^jaY}`}}gVz`mFrf0>{ zudm%pC$W?{sDa1Ykk)V5GB!YWlqn*Ur9um=8HkZzi;OP(C7qlaX;qQ*k3~be9 z-M)97Jq(0+r#%TpaFRP>>Yv!J4!O3u;WcmWZnPN69?#0+1*gd-NcM7A_|daSDh)~n zAffSd=136Haa?YnR~8?Nk3gN1Dh*VqeKI!((V`QdlD1=?lj?dFcj{td9Cg@?*_Ta6 z)-4^G!vze8e+8{X1iE;eH+d9Y<%Z?lzejj%ga%C|Gis8dUJ4F9B5GAB9zqX!+u7@% zC2?NA+W4!$qiolhpN^l%P#wQ+LooZ_Fhz!;3#Te_%VBKI9 zQQaWMcw|o_REL6}!t*M!#WW$HU_!rM_htqY{|#6PR>lM}G_qRo zQ0M=cy6Uhdysxi_$x%W;y%oDv|;SFz=s4qjFXv6v2-;Lu`ivd0pMy=(}r*cY_1(B5J zoR5eeekU^s^n(HxDKS&fu@SGQ#p~GkqJMsX|Ma1ly}tve(he1FQD*r17f62+3!#I` zP<2koPE8e?CUU~^2bIsckL2WvxhngDmeJA@mY3&^Y*uCM?TJ6*yh##=E{zlo2QgX9 z7PNdO$dkha<#kB-wfw-cXg5db%?>@51u}3P4Jh4}%&SZ~;x#syEbs3U6~uCs`z@;> zc&hnmjSqMXmPV50i@Q_VZaG?M+V_UiepV5>3HAY84VV_4lfr}7Fb$Eeg;I+2Ql9Fb zo5I~s^Etq^$dx`lhyd8x4|8iAI85^W!x4*n-_#r6cQjBl0Q6H5&n*!{Md*|4gbEom zngmgAZV>$Cgdg;6E(wSrkoTT{Slqt6z6^o94d*Y?ei-_Fv^9LO7k4?YXn}Y^o~i55 zQlxLLTsLc5fAXUSmFbB0RGWuwJ&q}71KNwZ-o&B5M1>QE&_KxmkhP@xr$|1e#O^sA ze;IKSludf-rn%;jYRk0Qx%>y!B=@#)PEtwIfnQCc;}O5VCTnU>3^|{3#-4K(JbZ;Vz!Z5~3q6nTb<#*d%F;$ey2SYdEbWyfRBKAYiD zlrXa~xiZ_XQAxJB#hzDWP9mRM7|$d~CezSV;c^-bxdn!aZiOkD92Jz&SfHB!oNOJS z2H_%VI%-|#Y|6S(T)~@lhV@sk8ECEzdwP_IEWO@9RrA8WE0{uOu+TNH=S)4eP<&Zs za<5;)avw&61N}lzqWV%uucEo*agBoeZXQ4d+0X_$R3R0Rt_SO;G*vB)e+-oM{SgmOA~ZgNf32<<}>) z&pe!KwPAj-N4QA1It0Z0$)hA6{z_XM_yLXm0f6H{x6TER3*Jyb8Vh$*b>W7ZI2|BX zWlFGw=_1j~MzH$<@_h&imV6-o3-Q4Wg&B?J?MLWO@#93qyGXGqtUN=CJC|dXSuDWU z2Zhpc?sG!qCZ_#oi#vjcSA+72<|J!F?j9v(OD`>h6B))whRR1DrBIePgmF*)l{x*lg#6!hJD^NWKInxUb zXjpMCgYH<`3K~zt3SX-Tr`+e79lCGLd2JMAx%gMxY)sqA&T9|_dHWL0g*meQ-f5+s z2qg8g3CV223&{nIL=Fu1B$MO(j>i|cV)#1t@y+X43V*#AE0%&kFbR#soTlv2HbYbT zNtO7;dvBfK5{n$^HOZ++O~lh9n>g%T|0!ZAfD54sTz_KKKy2dj3&E+hU3U(Cz@_QY z&XD$e56AO>Nqugs-IXHO=<|`(wKQ~E=M6>!!B9O%7wiqj*MrLbSW*CS@S6I`s|$&= za%kR5JPSH2<)KZPx6>|bsA(|1gzS5F<}e(Tjh3E}y*v+X2CZNy3vQL!*gS`^C3bZN zMgTW6DHu*ChwH9Uqw#gn;&0Xl75^@aa!}DfAr*}Tk`>lPg<1W9pPZ?)09~BO%)M-? zTbU{Lc#|o?3Jm#=xgxX>1al$2R)&o$2az z&WZz=1Ia(ON`Q)j5_~jN(W~-s-4(@U#a@-NCN4b8usql|CB0Tau%Ufv&b{w zP1qU@@fQPND&07ggeG{C5KGjkysX8Y3Yt8-xZmejs^GMm2#0ew50R4%=Z&|0UAJmd z!#}zk)Ta)s%l*+*b`tBxaag-A7J4fRjDl7$5BOdrj*_(gRd;`2D;m2efa7NX#d(0} zq&Q6sHGNuSEFc`r%BPJkyulAeEDihtS9$F7;w4_zp0VJ?qJ zM>sYQSc^{Wvnifpqu0nnaA-~ccz5#1bC0t|Tvg(GugXKFOuT}xN{sNTHXE|K_QdB5 z1lw4Xx1j5r6NW2Si|HFIolKsogN2sDH}b!8ATS6qJ;P$(khjZwzTJx$#C{6X(L~(! zoHfBd(*TT@fA9UQ#)1nJs8V`hS4iMzaqA6TDnI=SkzEt~<)qp~#D$(p^5ia_vIdic z>s4t*fw^wpF-g#la3oJOuJjX=&_6C6=g%nNu}u4zi#urk4>R!B8*>?QWigm?A)?N^ zs3#~|QBZr&G~@Cja^--LdHER|+1<^VvR)U8mBhn_<;+7GvkfFkM5-XQboNBsb4HG6 zDOGN1sanPae^QIFc|L!Tvri`nytt*$!6ru|a!Pw$!`3;7dhdP?B?qNWy9ZGbnzGc0 zN4Xd(ZwkF&Nu{;)Kyvr+9S!@F7bMty36yHg z7%#U&Kl$|a$ONNX^Gm{~Nl7XPMGJ(vJK5y{L~n+*SfHDr!;Z&cRbi6D6{uLIh)^5X zRUzdMjtKfF)Zea|7UQh(6;oUqHGZN-xl@UGJ3n#8ztt;^2t4~Av~i@JrF94H9laV5 z;t)b1!?NPbdl*d#mHR2qS*(N#FJ7E_wlHzKzIRfZB|&u6W$n}4wsdexuuo-I5Wi4f z{|TaHoD@ot;}-&=?ELCx@oQ`F)16bY$n!IwmoL7 z@mNK2TuEigJBF{*6YX9f<|I9(PeH;zKAL(MM?K*IPFu?(iCn}6>mjcGf#(-~8aI8h zhcBX>?mBPgA=#LDYVRcS_AFFsld}!EC-K~G1Q00G@bc)*I0^m7u|J^85=b8mlEq_Z z43>{6UkzboQPM7r%=}WQAM)*D$4%>TuE@o{Mi(Rc{RE~Y8D&mEF+VafpL5%sYH=RQxC3vZ9u0x$O>v3}+1c^85iSW7U`UU+?Z+X%^Drl=A8xPtux z!l=FW&UX~8ww@z#=tqu7M`>Oz{aU!KGsFz>2uxv9`baitCLN1rqyue}U|+*=XQ z!XF}zBPKv$PM60%E$vB<-yiYd{V9e z{W_Ja>EW?BW*Cq%RouddZ0bsq$K8OtLX*K+^3d;3I@Jd%LAcmx_6kX@YmV@2*}(}a zJn&X-7E5-F1|x^kPFV@oUTz=_mes$R@bhX3`f{&+>LA78B$)x4aqs|#jdhTg60H{{ z&WgQ@hmfSaH(dp)@rcp(Dh$mY{B>Gv2&dINDM!SXDo6BywgBFvnmOv%{KoZdFu}ZN z2vi#Mpy>_C?&nOKsM;cK>|^1(IeI@rvoa9Pe9>+u=Cr!h3B!1BYeN) zoU=AFpm}~U{W~SE%@ML!Io#TH@l7F9^gQg;z^kh3y0#|WI+)$Rb7`U@6- zfgnRHa5t8}GQHY$KH?^a(a?%QbXF`+<)ML>YFgaoG#>Agfnvb>u!2n{3Owqf3Pa`J zi#(H_HF*2U0iC6(#D8s*k8sR#Bnt09t4c_s60{8u$(t&x0 z#NnShLV_~cQGUNpXeg3B$`)yok;<8)Onwsm2C#vh0=bX>kQP}RW@eS`Iw$*%O zwuYX!zlDgJmq|fV-PX5!0ALM|c^p5*iW>9+^r<5toJhdX3=Ik8Pu*$_j7HmoD>?WI zXj0(YQ%)VEFGi1^Aq+w@3jQ|P>9Q~a&=j^)-WS}H+X?U;e^K@$iAU28Rlu2`ec*)X?rauFOH4KH_VOXqU)Dt-j{N9f)}pDu=7X+Et9>kyo${|zgY5D3e8aqVqv=xLPOfa@&7t;|Ke^C??!+Id=>3Ks;8w;W^c#v0Hh$ zxnDAU_{m1Q!L|H={z>u3Ek;P~;$FVrrfdF~d;Ck^XFJ?rNPT}zuG#Kc5j*+O$DP9( zzFCDLU{SLZKg%4^-a|X|jU%?w7(Uupo4i6kN`e>zv=_DYBqwK;tFSs7fKGd~udtklhMS zE@yXfela)NTA)#w6q?Z|E0q7jD)MU~+v?l6*weL&zV_Eo^FIG$f9f?qiLz9ms*043 z5wX{hWanj)RlB?!FK4aDH^-LwrO%r!5>Tu<&RrcG>9aoAF5Hc?h8f~*-LMbK)ezba`35A5c~vy{g> zZC`ts>S^@3ZHM+}GlP}$P6DJCs;`nn%$SnCqG`I70=nrtI$`EnY{;%YngPc#7pJ0%dgFwtUvNm&l>iq%9 zQzno3%E!4)Mc0eh`BkIU*HbMrpI-G=G9m58?-zY{1&?-b6kB7Wo%bC+Q$DTZlJcA^ z95f(4Nu6XXoH}nvSBAO%>@jF1X?Pm>(#Qn8r$0&x{Aa)mi>1fXkj%yvLO~Cp@av|T z^uwj5hb!WUHOm+A7w^g4AinfZFbdy^X-in#WJ|&j4&ZvVQl4byRXR#l%(ePi2750p zsWpDIwTsg4Tc;!0-@h4*RIj$}imdfH%7t4lU+v=jxM;GmT3TURrz2L_@rz@ZXP0%W#r^EJa-r`Xigdz%#t9(r9TQhPDtr0X0GB^!B^^E5?b-)=9I zId`4fU#TvyuOu}xI^=ER$xqNnWZex3d2+y{7e$-kbuVePj%c`$0%N(B0^%j0fnMMxa{Lfb0>>5X6i=SOS)N&tx%?nkF8MuM&R8tNp(*F}Sb1of|0?F+IcP&bZn7a?5c;gWQAt4UbJ3@5 zS}~RWeyHMN6zSL_de`8}kv#=Jz<}qOWc}^$HHC3j=_Jn5wTr$Ds7<(c8izLdxh3pF ze1L~WSvQHYJSYpn_q)MBoE?lSkwqRw#d79BGu|dG+y5p$oN6(1iNCgu1(bEqa>Na0 z)FFMUG$DWVkSIcepb_PGEpw5gwu5KKfaeJ`w+%nX`Q2K58&d*V^Y+um$GkgcXjA89 zdqd^W-@+p6do%iz;MsaE?E){P>((3{%om9>-6G$;Z$4^J2p<|xj0#x1$ATw{K{+!& z@wMGtxdYW|d=d|#bh}sctySN)OJ5&;zC{w*8?qv3W?Qrxq91-~;_J}=L-}q%UW-BZ zQyu4FDCNO;XG;Laoy-c0dNWFj%qohUTf^WW15!l)r##24z?GOj)zuipN|uNtzA`nU z@H>4={75`$t(;KiZqGaAD`?vk$@he(wO_Y|7v;Of+OVxC5CU@j?bBo-+sl&D z2|OrYV`_6@i`_2HF5Q}Fu?zb(usb3)hiu3@&)bF80&F4b$;Ni4-c!px-FnRnVRPMY zDp3CFUMqsw)(ISaN5FPf|7GrEw48=N!X#s4LQ&eN=f!k+*^`{#aubI=ejM3}saGH4 z)D^6pPu{^M3W~{gwhl9|ixyU*i)_~edvrEd6i?0DSLp> zO4F`kJD32veDbt|xO}#5d76b5BlilWQ|?_fyR#gHS|7|cB=e=;PY!-;NVe3Nka>^X z;)`xd;+tWe-F)6WoRI<-cy-lXJnwlkLO*a_8)v$$F*;w0wt4D3l*48|7o-us(^NxA zA_EGjixr1Vfzm5g_9wXw&@<$Z%UtHZd06{icTel7Is(H{&G7Ii*I0Dd8J< znDAe1`!bZ4+@Wk+)v*i_vGt!?(=CSjS!D>#UoPxkY@Vej5V-3Uf3=m9ur)oF9RFhA zZ-2)2MT~c1XX$C1h12H=g;UxBTQ!qHP40@)LxoAZ`h`>qSI;kP6P2Y5R~jUjlCL zI-X;f@JtNWfPhQJf5=b&}N?Wp@C?_2ZkoL-qY!bxtM-i8oRt_{X*Gby`I(FImMHtG%iL z%7Nfx*O}CP%jzb9?}=it3vHNPk_5_O?*97CfdeaPhS6!uS+?z(!Sbt%9|47&wuy#| z99{%>gGqv{5aIT(S=HEu-{sG%oqs{fO?}`?)szPsQ?}40o=@@a=f@#=OxK$G@i%_A z6<2E+^ItiI1hX9dd{Tv=OE!nwbZzr(Hx=`qdWSwXnb$rod^ZdFXZmwaUb-z=+T#eoi-!Dha3+9CjUJC|KOtW04&L0rJeqQL)n(nPJGJa;S|J#F$K^Utn z)5o%Gns{fyhL?BOZklsvqbq&z=Ld)#k4H3S^Y3?NBi=WsmlICz3bj)6ThbvEj}osF z(znKXF>RXET^7jemPTaZ<%UXc79S*&jW%n`v9HCcr0%r1qU$PDob#qVmrLTW&S5f@ znUJddGpM2fZI-M@wx-T!+UE7FMG`(PatggIG4p}%?xDhcZ$92u^@zOB)E2ru>e{<> zx;=CCc)57!1fMyZX`_HhoiXTp4o-}gag&b{JHOWVpKHc5c{=4=S9+bzb52azqkkW9 z^gL;AxV>a=Vi6H1^sw^R^O<(LVi(;+n<(ho?Pz)guQrfN%stxY#@L69V;?g2U<-EY z(jf8sI8$RpN}BCm%zBNeI3~pcY{%4u$1!kjeBVAs^7@mtafsUlV4h+cDspg8zfTrv zdvdeBH_=ig&rex2Wv=&bgJNT%i*@U<6l2)cS}W4#_K@T?^EA}&BKf&@GXGjVQ;*$* z)XJYhHEbyl%Ue$BU~951!|3-$cd9gJA#!TtZp8GgJ`u1j;6AI+3j4Wm%5v$WKe>;Y+b|rDYK|^nthBqNt1K zHDXZyngq;nNMP#ZE%_LZSy5`#^+9{8;8Wu>fzlZ+6*4!+q_VcE@8i7-oA3jNYvz8K zfCLY!5CP^yA_ejOsAH(r#?WM9q5?Z-vT(@Vz+td=mhZmbR#XqypMsX9e4^myc5L}w zZA7`@;Jzq1npTN6z(`=S{ajSa`zjjce1>Gh^FQgB(GK%^$qvUOq_ewMnZh>n>e|le zTqA;##|tl-7je}`TJQ;FRq`urUeek*CG_+@0il+O!}dDn`4x?}TI}o1s}?bB>FdMG zxVb~Jce29!OsN@!PM#I;7jkMJxH+I3A@Y# zo+wZT+zsp-$s7rG5uefKpAmua%(B!RShl*A(_Ln7%i0sz?vo0rq5ox`Qt+iCBB{_6 zBsy6q-D17r`OUR^?riarBj&*t3PsJOm_Z7h`zWK_iVFI@73Q4;A2OzI5P?NXieKrD zf*If;3aH*C2U|PBi7z8P5N|vLngb?gac$@i7mksitB$0-d;7dG8=&4OG)`rmug}~y zecD37$&{_qTWmMg8fn@)Dl;i>V^c1DM}eyiO4>8d#O0&kBt4WPMp5xh1@!lTG;og$2JHyF;oG%;99(+1RR zvUa+yqRaZdV8n4x*Pgqb?yO+HU%a*zGFiS7I++t<@m4}aJR7756t>fcfv^jWnzoXJ zJW8LMM$8R4VtG4PP7cv0r@VrDZC&Q5VWq4?GZeX3EA_5E*EPRx4%$L|Zf;I|ScRK! zuc5#DeY`G?+PvZGuuaN#tB-ESa^;WBB+qa1Hp>H~*sBnsd*+d;F(PzZWoGLj+eC$e zzQlehLVujAdN?7pppTgl`JZ{Ph5_eJnMkw{=20Hd%Tc9+G_P5cmNg`0;fqbasH7gY zSN>>o;|e@R7n*&rYVjEIwklOeLS%`2CU9!zymkBdIZ}NSgMmV7$K*+J8uU!rz;dZ# zs1ztK6wktd1!bZ0ou(59=C-D}GS`xEXLLymm#0H^r{sv63F;E` z}STQv7OdL&YJ^!!aZAz|CA^= zLJIKn_IoX9SVl(HXZ-_mSq-h8?G{ZV^0p9@E4;SA*5ek5z(b``J8j*EbEidms2%zxft4=;EbFl(g^V zmd%(fz9}qAu#hy;p!Qp{)%%qdv)A_#TwH2R40(HA#7#Yl2BU9LzXT!ef$ACzSh&;Ecq;BionE}NExE?HV3rdXG+dfH;nfA9(_BRY<}??1 z7*nb9umXiMn}!XoM%80ihw8X%ArN5I|9dsN9!Df+J@T3sR@9Ikr zMQ*IK-3!32I!+76!C6arNP5Th^A2bE!0m*v zOrxv}Mb%i-taH5nC6XALGZQ-Flmcps|ue?^|7~FG=+HopoHgeut}#Z+NyLSzHEtvw{q zKOV85^qCS3h9P=pSg<&0rgR?5$WG_}8L5YN6Wu3%Yr#irlafYwZ1<4~Yk1c>UvU6h(6|@=neH z6oYC^QNqKy(HCyLB*%!oeU!cpa(R0MZ2_zf>Ve6DNAuXWMe<6J8du|}VF_H`$dG|N zma!htvzPxwp6bSsl8%Ob1?O(=s`Ka*@O%R~teElIOcl;-I-~CGcDhE7^2xXnoi~mV z-ue_*s8@cV@dMhz@ur3dYaLw$D4+FIAk6Cl*B4G={!2`$YGBSGJRmn6W!u9?fo{NE zhYKeQR47gu*kq>?_~lsDhNC=@SC77UcAgipgLD({FZ)|%v-?qw`jHs>)*ace12y30 ztImv>`m@E$1`+E+Q)p>nm$dqL(Y}`mqScWf$V-8B$W_*By`TK-Ld5km?Gx||XJ_mj zYQ*xN2Js`5jt^^RbW)46oUADCohHp-R6^Cd>Fci?eMxkRULM?2t>9uOs+|vi+u$5N zi#QIuyg{vlz1|O+h$P!(@8b2;`6f8%5?U7W4PvG;GD}&mzrwTrYQAw?uXLd$`?g!r zN@z+kiCHFi54&1h2&2XWLj}jWdsek<66rHyE7{h6Y_wtsf*Y0~y|l!s8m=kDOeijm zW=QA!XY~1n1CjCP^$bu;7k=(yFIY`Gh$jn39S;)zXeKE|%)*RVGcgCdUdM#~u z*E?s2)Y)KvW;K4yRs~han)kJjEDps&mvcTlIDW=Oy7jcnoVIA9M7uhAYj|igA-7Lw z%UoC*!HH5aznm_rxsB9++tQF9L?RY5R zvn;SNo18&21_{kRiv*b0Gtn{5+C3}}PLLxH#~=w2ts)`hAn-HhWbS&im6>XJJg5jBs_7kcIq zKo8q*+%}FULxag9oBO>BUkUr0>FgAFgsfz)_hFQjX1u!mDABt&#w%v!BHosop!9{| z#O7pwZ(G5Q!k@q?!iDy+KVCr~$ObVr2v!~7t0>8|I?ZdDO}TLnA}w5LWe>+Rx5}_J zTxT!bh4z1$N2M-D70jjLNgZrpAl7yk#RFz&H-1_^ZK*TS^88rQER`vGVE(2|ThAh% z^Kc6ZUTNWdxO`e@2o>1+{4??VIIXHWp~xzGA1xZ7I;C-Ibj-CW?EFJyFyOPW|4lE| zoG034glN^}mlYAi5haVzSECdkd5k1N(~AJ67I^|t!wc#kA{GB?h@J_bJ>Qex`q^Am z;lO_3ob&hiAHOZfo>zAM67|$+{%6`e{&nSBPxB$GdZHf^v$K`8Iu?MZf8yV?Z_PKV zxstD=H0lKmuA=f`(zu}&ih_~cdNft<%VLt^wMf(b3fq`{zraKz(qD5&YzFg^h4o?CvVQed*0F#)ERkGHeGiC3t~7``CT>4MvzLyEIYq ztL=Qzs@WepSHiP38Vb1{!YdvwRIkg=C3x&)BM0#dIp_!MZ39}b0&RFc-YY{Nn(R>- zaxQ{cT`+A-r|w11se;fKL);1oDKGzKRw+jqJ^Gf4qYv(dSNxn!O}Tt+{4FUo6qL~! z;FbwJN&yhwVFKaKppZ`h!U$2do%WF=IynigF`3Gml7KMtp{j8wM0XHPc^#4S0a@J@ z8ZGmizh?$0!*K}@WrHwg4ooQdj+qu+FpC_$+ZK|%#oO>Tlh2!v6=6?j9P4lMY+OK! z*=5p6Wm{TiahoWw54_I@@_)Zqq?P2vinY3q8SHwCLA*uJz~{$whtN{|3-NJO87QPu zCu=DKy`QNiZhcHn-;vRx5dyfWtHotvkg?SYpsO<62Wdr8Wrpvu1^8vK0Yyh+#fIIc z`K*vx@qGNJ>?&$ybPN5Q?%lnI45c)WobK8RnG^{#WgSR$!gmP>0bAgyFac5d@EMUTS2 zaH+t;-Ko(0eC3%AG@cdl7Nz~n_V6}&_?&k(vb9&|scG%Bmr^q6WzCyea@uUCr1bq4 z9W|)LJ-KDQiRXXgGrqjX`-JnKzVk6@jw2jhneFX%GRJF_@Dl=iek~F?Fk%h=jEU`2RX5ooWTw_^~z7SF|jgDra}^_ zDV)DK=PItptk}z}_Jvhp8Y8S;+VRqc$2cx!`tkcQnZq-$*1CWV(~dG8dZpH(bKRE) z&Ou<@1G0AVL{5xH2rwTtlmUEv1j1NlXAC+u(REj+vJ@FL>UzsVbCxap4Wy=*BB7wW z5Hb25`1oEw*|*RhAC>w0BJ`7|fEKM&PbyjWnM63xxcdSTf41PG=+d&OyhV!enRmQt z$JI}ak6nAFDW%@fU3vhG=2<_n;~pedtf#Q!-hsEcE?^Miqlk`IF(qnmW77)MWww3S zq;u3qgZeRJqfBtk9wvMSVYgyy0ocLjVpE z4FyuruSATPBF~lFn$Xl|Dmf=~fN{2LmazVJfsj|-T_65yz7muA5ade#%HQguN{sv= z;GjuDGtg=&zJ^qNb;mXP%x(#ObVNwLxQ(f_A3=XvBhqS9|3p%xq2R?_56SJFT9}ey z`5<5$57rF;8LY~i$iOUu#Os2+MsuY?nR#0%iqDiQ$ON-gmFIg_}6V z1}K-XeCh#x?cT~(Fq0Rv{W`q5%{cm zBx2;|%R(nWA^-Y6wihjK(Z2pH_cufc-kFq)z@F4qS2OW)xl=Fb;#q6M~Bp;%a2jLX4WJR7teKp;TGFdAr z>gNyVT1P@u})7#iL*a%MWIEnK$>=uaa zPUDNTvYTESe{M)&BvP3Ge{-p?F+mYbfb>l9&I;KgwFtgyS$7(1XV-+s zO$;&2$6YEYVDfq1RZscg`*x?d&f>wpG_%AT5OHiW5^tq!7dzT}{elEdXOYqZ2`n+G z&WfX=v{3}BuQQbMTC62R<6W(2Qmr=IojRZU{aftwxDDReoay`Vqw=U`N8_h4{DB0l4vbX=cfP==Ig zt>oX863)@qENB{&hWGfSw$c&Hg=~+e-YQwdJx}Hd3Opzmgl*&PMx}D z*a_GNBz#6M%`A6NB4U@O>fuZmFr|rqA{1j@fd{9)2ouUyoV$30dj;r4jYABh>IbwfSmX4!(j}K^QhcE z5kVOeNo$G-Z>CnjWnEsw9Qp6=%$oI6bU{n}-;=Zabm!Vc_|kWK6XPOt-<8{bv(5YJ zntuDxolU;XUI}7huq|JPXrV-Sc8X`3p7LeCup06Dm?y~n*&eMce@3<|D#WSf3x0FgxtM>ve!4<<&}7j_?55<@3JZB^hT>^wfz_yb z=AbIaf9jZzUBBR7U~sgzw)=H~8nsI63|YAIJvuS%;_i9s5#F62d(rtmIN}H|y+iKN z6kU}fGhjxPrju%v{H+@OYmHott}3;o#Wcjri|_wyqYRaNAM8Wl>~9tC5=jg0)a7*< z^Jsjh%HGzc@!L*ePAP^0R;oEKlIQ((@aZ=$G9+1Y)1|sz-CZ71(70rWBvX6XuLP2n ztZrdPQ%M6Zgh^eZancH#N_qy86i#rZnG_Y zO_@2jTj96-3Kj|O=aAZX5B|t=W%Zh{%TkdgdAbmoQNs0d+5?Zl#H$Z~pzsE}yw|UU ztDhu0*^1RYnie!sbh$rDz^oifN_FD}A!LaXCPaSpnDSotw)Eaw+zVk#!VQqblDF1x zzZnj?7=^kBOdBV6DVFiDZvQ%%@F~Hn^vq%9hSA#W5>FPp1ZzP<<=uqUG7N$Gd`)PRWf?}6eexJkk*>&3O+u8`+(*IRg%oqU z_bR?9${UZTrp1((bVK|e2ZZsgir+kUpwWS*j6IbB9PnG|Kf4BJERy^jd%qtSj+(tMBCj-jO8pbj;Sx<0jQBi=AvkT$B?1s(7DrTa4_?rEYGTihjhcd(+z~ zU&7Pu9db`KkS=)%#5yj=)5cyS-KMUvCMkqoJT9N3MISKJ?LzP#upc`I53~UME1GN~ z9?Pwfwx@rG2tnbuo7OI*WVi@V4EthzCh4l)#5-ZzB#^tZ9ibV)p!dF4%ULA<6OiGg z@JF7Apyk=LTbSAR)y}r%(smNST>)d2^^fl$vO}B=gm2nLXpIKOQ*gO|{9=+CRF#5g zEsCjGGC9-u0Jx`*Zx@amxhxxmHuK^Ca`O0kBzQg;R}at+cOD@ zm|t$Smo2d0HVW0bg&G%$`tR&Rf=bjMOS(MldET)6;!JSZ|8bZZyEM;*K_^YSzeGDO z5&X71Bb8aG=EN%!r3nW^#g5{#BZa4E@1Vo~zvH7GlKv9*^qsy|@y}PfdjhadD-1cD z6B?D|-uEMy_=s(1H=QCGSGF|o3Y2^Xaup|3``GgCB({WI(fK=}Hs<|AOPRyCa}c*3 z))H)UH(eEkE+ig$tCuvx8<`msOt1Shh{UHykRI)d35Zb|)cya%Cv`Lpc-kGc9*q|c z#?Kpe`2%lh7$Y`cv(B9EqHYj4eLzQl(JDv&g_HVkJb#t&1r0O4*C*IY#~?B5_Y-1P}c+y*T5p__qdZaXe(br|RgDco1Un>;IM@LHio9 z1nQ330hYjOFg0c62mkG$?`1!ROriOMlQqL$`Pc&R1!4N$bpB{U18iSR6rA}KKD0Z2 z*>*e?|G*dYVTEeECJ~hb(N8($K1zfd`^7{nm`f4P5@izWmNC-t^uH4|+LBMj?dh=* zqH+qQMd{GJ(14ZKFAaKbZ0-;3ok^CpS&ZzNmD^2jsPHF!I_FNXTYe3loOy|leFp^> z{m?%>z{h?l_R_y-c%xQrUPxUQDw_GNzkxtzM?KeCP3K_{_=q4E zLA%nfJ5ve_JJ;E@aoHOmPSCN;=HgO=9={ja>$j}^MD#*F?7bhj>SO3_R7Xl5${o%? z=`t2$o5Sjfd}5*TNts4sgCQ2pj|HH$?`C+QS@k(rEe#dLDZ%=_$(VgM$QrFooCgs& z)A0BlpDem?(HjyI6qTOOh7e))GG){a87Zx%qq^F%xcXDuO9Jn376~RTR*NwwkspY0 z-7I)BHVd0Z-#<3SeKFoR>$IvS&Sb~rBRLoi)cN2(+kLx&21YCQ2O$V?5s?vqh&)m= z0|o(D{kt+Jxsl3vPM^}1}0qdRFQXv2$Lk6k;2GC6Y|{PD0~h2C6Qd|^4@ zi*LoL>raxs5X)tZb}obFHUJXG*IM&fIMt<2s4(!0Jzirm-TQsSNn9p>Or*RG>z6*wK7+sjufyA#-^a=`qak5^bQ*?z{#SHy!Yr(P_4ltswDx9;|SZw#? z-&-QHA;=RW$b0ky^bE=;Mhpa}*qy!RFIv49_vTvZ@fEp=^oFh|0qSLDy3o4ukrS<2 zjjAC_NYdvyxc^6#7Y2I_W+@LP|G4yY&@irH3bnC)VC&DKb9_P*g%-7MjVYm3AWhicL@vc~6%hrg41l*T!KCxRh4pbY}t$2aWIfmPgO z5`vmS3<1MN`?=kiXW!V0EX!F@jW6&d$?k((GuLaf&gYp=bfAO$lw?GX`0+2ZSYK-n zz-=01p*#ytP>EupDlwDLUZ%oYaywg`bM9tbqbEAX4P=giq<0M0LKS;L9Z32b#d6C% zNnVZn$!?WwFvkm_$VrnODP^EXf9oi&VZp=uM2?@ffVvrPvb}ads~2FkT((=1o!-OJ z(N{Z9er~gwB_JWxtUZEV?@r?a)t%WNS%0H4>-o#DKlU1*x!}5fm9qLzPlq=D?|9auP2vKcoUu;^#V!0!hDB_VRXl%S3vTt5Icl4Q3DDKp_z z7JBqMfA7>_E`>9ef#RKlb2S3lWpOOYdyRPMfGp{+`G~dw!pFexi|~#x(vpF2&;U|&X|(AGaDoVOc3;0#l$m;w%^B$DNZ0IBXlv4_mG53EKKcw8o#Xl z)%-PIGb5&v&PPMI=z=6^>(1}~Y(LA?#c8pS{n0{dO#-~&N7A^IGv(4`%qPeh&Zn=-!+EDY*$)H4%hG{)U|Xtdg!r6%)iry;E96^cW`!)t@Q z|9rPFZ5~ZCo+`q3&-F$YE|+;sBtOQwboVc3t!&aHn{ep!_WxBVXGK?R>9P1!@yz49 zmvVAfMDO_9pEdpF7sP?g4L{jRO<#%;{!O$4Geh*M_`*Ii_rHy+!gj8w+m-egRS#xS zO)Hpq`8k?Owg|1n)S%!$`e51u1bsCGeZE0J@p73qSM|HXYi|YL;Ud?O^Yw`qnbs^R z7dU!B+aS^PTzo`-41ZcGOu%*N(Oi9#Soj&HiJpjhwoTUME~q` zxP>VEW$2b{%Hx?AYur36%iIS|)ZC%`BTX~PA0~;FCF~s+*)Gja8eeo>o@T=lPg~Mv zlJ(z|T(!UmvN_%tNC`xo3>q%dwgZfQ$Q#}1!x1pXo0KlJ7jY8WFE&w=xf~t2W3Ndh zI+GDz#KYyG6-QXPrx78M&~qOKj%I^;g382=>=9LLryuMHTo7@V8lPrE&KS|}u72?2 zv*7rQI1h=Id@0|W#6IJRes$nj2~V*f>G1Wug8vcbiyq9b&Tk~`e~S^cSO((2_8{Pc z>`yG>q`zY3ziHBh3Mr`-#>Y9$jrLT+B!TVsq$|hJ+JnlF4G^Sx9K}Hh(qt~i6L5&# zd6^oNQHfj?wE}07U#N~r;Ek%Ax|5*yLW+wMo7thpv)=AEpE8O^#0a%`{RdRZzg+J_ zSPL9rxG-3a1uxYGcSAnZ_?4L<(j6Xt$X*Em8`2sEg{Sr7YN=n-$XBbxxaeTm)o7aX zQa$6jcUo94X?U`p1IQ4_{2_VblY^$iki!Z>)GeI)rG8k^fgFQh5 ziZ>5)Sr-!7hFe7-w`iLv&b@*(W`qAoZXnK5A#o&pVvEH%&G%PxPI->T5gBN~G+5}# zA4BP8Ko!jX-;pt-&!C7c*#y*?7iO=d2K}JJLmyyibKM@B`AimCZSc!a=MxZDFt$G? zJPMj3gL@b54?5|j{bjxcQHyejU@*o86qw}o#*3<8Y6W~`EN&=j;qNmx9l^l|Yc*l zzzqd&jr2LJq?>IKS(9KxeuFWW+4x_sj)ArT;Bi_*X&g4?VEJA7!Q7zGbe zQP>(9cg2279*4J`(uf;wnR! zw>S_U1U&W2(^n>t9#gY;l@G6t9Umvo-X`8^0A2m7TUo5;1FitN=s*@KYX>(lj-Yz5n zm{UKHZF`InSK}{Ak2N?|Tck0mN`6?M{F~?cFkRUD{n_D8hF$3oSn+Q)XxI5vd5HJ# zYy7!2}uq35-%Ht_HnIHfTt^rvsAp_%6$>Cn)O(+Mgq9mGi;N^4F#LH-|X=1A}S z^~i%co_H!xY@6^mr??kRNwD|)cRz;?S10f4^A&`JmV`dNd~(3QmUTWF-`DV+Z{3^K zg;x@N#;gb?@ttQgkCY!u%z0_DVCzf1{VH+scWXX)6;|1l`&*C2mC~rlFZ5}aawX>k z;sOao=~6pkJBWP(z$q^^VuLoXO_Z5K_drV>Q)Eb1y_epGb)h975&J&Nu?tW5{7Y6I zVXV8XQU!j{&&?8Pjmp}OP#2>0ZTOSsT6Ff`m3(>WE~HkHTc-AY2mjOL9f>>P20eQ%^3M1eMqZ{bk|Q zOxK(Grr&RJFWWTrtWCjs8*QhnHNTZ3G*b^oxs7##%LeY=5@Hx`!;QuvWO|(9(GF-Jb4Gh zs220UqdF3CSJi2_1xed?+k(Tz#MjHo2hO1f=r~;6T>r<^Ge+0hblWsdW4m!qY&KS7 z+qUhbv2EM7ZL48pqYWE7xu@;-ruWxg>#XOjnc12>n|B@LlEyqUNc!=9k4QAvA(Ld_ ze_r2tdhvikGU4%T?B~|p>}cUbXAFAihhs+wcg$6pWDSy~-S>ub+q2YOl_GT}Bp(uw$3R zxbUxxrqRtJ>K6ixk|Q%$OlEb1h%1ukYEei4PD!`lPf5ld-bm7H+V9Y>tj7){2@9JZ z&Z=Y5s)N(Gpp{m-Oq3Nt781#!?#@Rdw=nw7o&d)Y_Q^Y7rx>6Q<4ET#VDL_8d=tws zg~)z1K=M(K&|*|hL{YdmzwdPBak;|p{Ga#aDEwE%o!H&S?=LA5CP<+EGlA9|+6i;zyYk9+EPBlXQrJe!~1G>j&$iLJmT9#O!|N zN#}4_Xusf`aW15~SZygL1tr#A!jArGJ?GzAFQ|X&`kS@XilL}rixmU?m+cdAKgdG1 z|CFty21_nmEafyd&>%U&)`dH5y)A<2Eahg=dIaZ!XjivXa$c4)Hitd&^&tKpszkO- zbmerZqvZz;mpX*`-Mi;^>Hu!IIT6Np5mpVrhy(}?A8NBeGFWG{D!)E=RlXd*o1Nhl zT7r(oKQ842XaHJ}DuG;@G8D70S=pwOsSDRY%+MDPmi1h)W|dZS<@*^ z@KBF9=K~{_M)Ws<$?lJT2#Tz$1L)}%>V1cW6JPcLbsI?+g~VZ!73JgT^|(W6O&SC! z)_(>t3CSlAtdRt7Sm0$M5ZV6G8HZsyEafn+MpTb#;V_J;dSI!0ic0tjvZif9Tb`n7 zOia4WyN!>H!)S>ZZC;wIjlj-~|FO^MRyWwso&5*5ao`^ur#;g30WY;%dKh8w%LU(B z(Vwcy`Tj6pxsW(}+MTxPdSL#wg?JQ#5w;@^1QOUj3((u6+4O@{v2Gx>*5l5p zXPa_Wr28hLgs#mL2=Jw*^Y?XtDMW`9u0sUloAXpUn#+!2Dj0Smx*t*-Yd_tuh$3uS zm^<9Ln5pyOA1#alAAq#*1=8YvJf?fI5V_JDFVVAW8fwA^HQ%R;AQx#2o$db#Fmz3&3;kH1wxhX}nU}-T?N+f+ck*j~3Hp&Z`DU{d*F@WR?k^oZ=nrFb<^Z}f zQQQUI*~oK*`Ev?x>ndT0mKLOs$l-2pif_@`-;GH53m5QF`^X;qJI);g)&`|FnA4Yk z{?%M^WiLtkm4MrvW1~LJd|xItUAC2ltMIv9j$>=W>Z(9{uL-@d-=2qlb-JUE5GX8Cotk#02tw)vd(60NtJaw@6SJ4*%CFgo* zmW_ce*2=0kLqb#F%1mSRUd$(>CSJ8hUR1a9R*oA^-5#m9M+r`pdfoo+Gti4l+vCZ9 zt{;1V(eGfHP$2!!+g>oswVzhehwtUMDN$kW=u~QY!vDpFu!O@!?T80|$A3L1o6m6M&=NN)D8K$*0teNcNQuwp2~sDP6h%_e}9jdn5Tju0L0} zI&z@i#O^D+;@I+adJ_0ySVCr)5{hU5!x^-M@}@L1#f2@z+=xF1067L53;h?i^BU<1 zc^svcf{bZ}aFlUex93B#7cXFPexGUo>FVYLEA=%c1s6xb+<7u+-zZ^K203Hr2R__Z zQqX)xDi@%#Ak7>1JGk0iisBIf=YgC0-O{C37SBQoWeaKN=IC6C=HJkR*q_jYa;A9W z$*ohE<~Oul2=Y2<(G(A%r&_K!rO+kR|F(#%9J!cqC3Xx2wBf{rT>{!pC8GkTNB7Y! zx#A>TUOSYpzOA(BY}ecN*nW=^=h$NRf}uuq)>`^KmGb z)EeAT_0f4KljNJB2XIUi&uyq1g81_DhTW+yMCqf7p`DR?E+0zH7E7 zc|JF2u{7rHt9B)#;2ba&_&IB~bD+aY6a-YSKft|J{G&sm#$O*Xf;Am0w(18W~F^vOSYoLNpNnZ$}`)@xUF80(Zo5I5-%9J#0vkvm~#6 zw#WYxrivM}zr@a2aMXL1b<-*iEXZFiKC!JLHP6%g)#bT3mHBhbm}j;~((867?KS!N z)`mMPL=}4C_z<1Z+RF1+-Rg8?Pqf>vmoFbtpjLB{FQ%`Y@gW$ngHpjeSZSVbvD0Gk zC{(bo9PZaATQ*&j zb9ZpJXqCVw(2_rUC;TC(&FTT}o4%r&Q%?Av=6BKcg(#OM%aU1GHdnIviWk=63EU_h zdX_%0K+9v8$-nK7^!Lry2X8NI+Ps*t_dmHi)BX@&x7<||VeH4mhIcnDdn%)>{{j|MR?q={I}!W?8r)=u#x17xu1%LN2A zjFOe2;ijo5vrOdtv+;`iBXq@%q$=VRf%1?kGvtK^xGbW3iUsv}Z6frNp#LTD z>SZBH#%YBVZY>+0>;%u+e4lQCe&003aOqe=6@+KzoD$JQJsCmAe z{izY>W4$SDDk90hv!Qhacm0wbG=?+J4ik71*#`rA%anwD5I+4^M6d@<|nINwP_rX%gwiZ@c?!GHRCg#Z*yLhiTL{9G;7k^#pjUhd^9UfEi@j zENl-I3M1pHzGiJEBjX?ZOt>Yd03*iN7)C;+Ek$~Qg1)983)Wv^?mJH(pXx8fs!9PH znd*cC<1lZ*p=+UW2{&S+K%lP31Tgk#8t;3a0B8B7-;5nUhbC$(uaV$WXU#lS;$mQ` zI6n?VN9W>r;94mcy7(OPsEqkpNIQpP$hoo(A1(kJ{bZb~elHvcXo7ysN-o;UypF}o zaQ*bBQ4DE3MhkFfhM2oTf;m@=qa+o*9F zKI5$Iv=*J_e)t%WJ{`Lzt-wN=pKc?1t@b00dmH|;*ok^t#y$}Im=35opb2x1oKfxF znXn{%0B?(0#6Dca2Bl#2|5O08@iZtc7Ak62+A8 zxkO&AaK!ASivdDxFA3P8kDF2A_-zAs)&j={%7jk94ZN}ua;!SSU*j$Pn4PL3j~Pdo z2iu~Y7if_$t=qo~4*>e>+PC!jh3p5d{;b9PiNu~kV&4EJ1zAb=Q<5$9Ol_qAYZL=P z83|&HT*;NMYhvL|I|e3+{oAu6{4=3_EoBTF(91H7J%WAO8uY1R^)TkgQgfZ!Nhv^< z!&1zwPIsDS591)?#C#Q3{E=Ne@Fy0Hodu8a!^hvP>69P0>X|SD^%y>ej^q-R?Wo+^ zr`+fyyF^6W5<@CX)RF;PP=F1lV1&L&T+IeV=t$*<0ieX)*!$}>A7yrXHYsQnQ$Niw zJRg#Tb=xGzZRrgJ+V30uJr?#PU!1NPv3_v^#rPpr0aY8{NeJC9071b)SarCf%G3^1 zE%!kXFiB~PuHk=4O7yG2Y9o~b6~HwD?emqIk0i(|xf1a3D4K8^%^Mh3oPmuQxNa+} zmD19y4P}O|TT0biT7D`iPafG;q|zYM{=y|uTddBxO?O56)99}wC?*L8K#S?uK9?{W zOGV~*ru1{Na;|HPQxQsAQL8vUT+x6hFh+M5>@7;=4%j7jN4U6nX*R7X6}NIXaLndG z53wYhXIWa zXiQ=32WDIX#d(76AXayhSf4fN8~hAOy798IU1eLd93kx7uYqjn z|J^{yX%VbR$9(BP#c(51yEi5H-eR!+oDqbyzW?G8~=^VY?ALn&9IBm+m24gSZfl|=cX)#N5HNg3D-&#BKsoObDW zu!dTdUAp65W6rktWPvE2ha)tgsMM7+i^Uenr$B7H@r}6`E&Ce{;PupT4Vr{!sJv*9 zbXW=_W-;%U($<{1(D7DkW2|{*;-zrsB-8v#mMh?vO^+~fj8v=*VIOG5Gi+ismR;@l zrT&O^1M9Sje{N5pE?dJtWPiNmVQ?qD`NxKi z%aN#DF|t+`31GSv3ef^N*E&`k)dQ9)|8>c>x)icDMoyplWW+Ba(!lyL#l=*3Muuwc*9)`u_N8yJMMFBZG`r_VB-NG#B$sS6{z zP3*Z@v@9o?`twCXl$?P=3NxNh<+Era#beEPpj`Cfi~9brjwPALZqZL97M$(a_INle z`~z$F7!E+0i3wXh_<_QH@%hN8yQa0@i`F>Hd4p_2Rvk=9hLq)AB<)~tHFgL#<6~|@ zf;BK7lXr~LXzjwKt1$^I?SrS4_(3@BzMQcBm;U@DjR;7@IAAeH9G^sQ3(QmTg`k}5 zUWdd0VZ@Pwf+teEuI9a#DUQhvtUB;R)p zmc7)e9*yJGr+naxY2G}V0h1{0JH}`}6+chpe!{Q3d^BCfNx{QMITxP;Fw>OM=9HC= zkL1Wy|24m_3IJ4b1vA{Iy@VYPDm!IyMUv}Q6+ND9J#W;0@7hS65onXg-~ui2QnEa| zx++iPPYDX*ylflcn(FBH2X=O?9EOPe-IQ6&cNkdG(B6*^s44FQCe?i@=||T^^8XSj zN+tHQNK%to_A|Kr=iqRi|B7l{$UnLMKwJ9MzdrPy;-uZQ8GS6mtK&j2sWgrx& zyygl#W-VplPN&=__EcHH=sQ|f(}X^crLb*Nu+*KL^X`mVD&jalejbzUSbMU;U{L%X zIH8?_tcE|Eqj_P}8~ltF@;^Ey9eeUuWdf!d2D&JKqss z%L}Ej&p(zTmS6C0)*D7FvDIgvDZ`hhSDYjWsbe=QIM~_0RwyaA2(oF;&p!6wzl+r& z8Hz0?C~z&pS;VEoqzQ|0-_Uu|xfY1W0AKPHVn<)P zHJ}9pEkMR`Q}noBw-fa&R4IYeMA??s$;FxeLpEtv9qpBRGuWo8q_)y|r4UKp%3eo6 z6zAw{p`@ENVZP^)@%zkNcW^B`_y`IHb$Mi(0kL$b_d7p|_jy@yM7GGWj4YQ>-|az- zBocG5K7SO7pYJI^NlFwlMZw6^0xG%amX%QnDm%sfxexd38bfX#RapCXF6Vv0E&xU* z-!b=q#(7A7Op`??cl+@w?W9R~L|t5b1Y6x3wD*EF%5i&|ecAXE6_?ft?3v?UiRE}q8} zN^DD;m>vL}xiG`^s1Ici)Bl&3ICF2+2 zlgTa-YSE>;yREZ&0K!e92qK9y)GIJFV#2x0rRpgoLvSswml_DlF~~ zYah)w#muL$yna-xK>M<@-SGq~_Y_a~h1ZLueQ_dESd{Xp$#L{tUX-$($DUf!kyA_! zhbV4`I$u$>H9UxlFoee*lG;@$w%1V^Q3vf_WL32Hm7~uA5 znEaMX>!-%82Bh>-WmD@=;$9&o*u_&$Yry^EjZpiCfiY?x7)AT@6m?@7Eh#9~ugZlx%=6ktI&wZyZ)6SZD0?%=u$i#zL%Z`8*>k|Vhlt*zHHU|cWP$yFw;__=D^2#() znk{ID6i`M?w@;Xm#-6;zSdT=ID!kkHP+W-zTT~2xKFOJRpCqTD_NgF-!+kEn9qq`W zlB4QFmBn}UHPg1tv-D@BNM=WJJPbgolH%wBjcMW%7wad(woCF`38B1iFXIhN^S~eW zwoT&A`SLU}r<)=4w(T>K>0wX?Qw$m9T$akonzbkGcGm*)WPi_-`6HIQnYf?!G6jh; zjxvwrPF1RaIIw#zs*F@T!1XMKo`gGV>T{qx%RrDPWr_+R++rfVaO-s?Q$O%5k<>nv z_Tj(`{K5fL2@1|zbn#(*GL>L~VuXjS+h78<)l?AI1JD$R$h5KjwlcM`c0BaB7_+cg zYXN;S#eZ3Hb>1&$wN9tle$9~>*|2T>kY? zus;gM&LV2bZYno}#=g8@WHz!RpT}rOP3?}33Ity(HmaJUmt~-_k||NAZK4RetNBMSf2_hMl+O0&~C3zg#kd?RSGPH$S zbd)JV+X_2(9hI}?N=S$k(WYZa+suu0Ksnmk&W#Mnl79DPPne_3O%|?xL_{1V%%WpW zN2sRTMhtW1i@29_=o@tL&6D~clWdE^JK9a<`O$=uF0AqvZI2K?(+?qwL$9$dx`EN} zE%|UPHu*EUQY^NQDoeohUUGl>kp2S-6II3PS^5Q3>d^7Y?|fZt?pjI!BKs{ zQAv06=+PMuID)F9IR4D}zGB&3vjVOKBtyE7s1<)~$e(u0m1Vaa&)sGqx$&_abrz`w zO(&9gR+rS7;dpnuI?f&S4+sP1;Db3`7_UazWg*jsXna|d7$^P0Lz;f68gJl}te)H> ziXN09W9lPLPD33rLza4_Lwd`}{Ug^zk3UgLC{FxAKawO7tre_(r}+gyJ7BKukLHo9 zHGZtPeHSw|j@WP4)+Z~}2Rl%vrR3qLqIBlmn|IPUTBa5blPonsNx7n2QF&PYi(*!< z$Jku@*L1f5oSDm5j#t%ownHDu>o)eB3`6+GR`z*4Jz1B{4NTqhaZ=eTsfML4R`B1$ zgvD%4P2+`LPHbgPU9sl`UmB(*NT1zBy~bY}>c8FJCe+8ebe-dP6-fD%AHtj$7mQfj zH1abEE7(t_@*_=`YL=<;9$`mW@X~qbX>bUNj7*^)E(B8+&5Hdvt6588t=QEPr2H8u z+1YPekaP8v*)tAr5+9~a5z$O%j1jvSh8eQDRPJDZ8VI&6p04z!mie{axYR~CqLfCVS55lywP))piK4qddy$<8{M2b0u72p#sNU`DSMxSMu2kmP1btwS z-DDMs_mPNOgIi6vO=}B2E{^>D#TXXmtHsyRPb0D`P_3U!k_GF3nK_38hc@kH1rx3t zn3=oG@}Znp<~BO?1(M|w^P^yj1x~yEL<5NeY@hSCueH$T2B#em1v8GC?0-BR=VZUN zG5bCE{IBZE6^UBDn9OUW2_^h|b7+9llFzeGrZ?dl@F6D8dLpL(MrG(mXu>hhs)6#m z*EAl_PBjukjIx<2y}WS>d)BRfaHoP5?y#S{TY0v%=Fuv}evj`7`8R@g7R;9mo4c_# zs6U`@i+1Y0muwaoy|~@BtL=MZbZA17bwqL_SBwu#S7K9Ni&uc3yy+7LSNNBUNxv={ zh8ENwcEbxGe|~N$0Q*|3V}JiM@b%1P3qhnX&Su>JX|hk0^^D>VfG6GJgoZq@&-%!H zDT*7!og*p&Io9j#BADF9huN&9N3zA4?*Dsq_Mba9Pi6+N)qW|`9QGw7!k7b7jOJ$) zTYP#@-_MHABCQuVk@y)+F2?3umUnraB3zzvesMWg_jjLJs^Q5s(vLd4J<1mDM@vl! z4Exkz5b|wIKDtp!YOzqf`ad|=Rgf;U$DvCxF~e=TDucM-0s*V{f$F>VZfQMSv~-kA zbVRjx?gxg9Nc)-U0-~|i(W#OVpe}EBp}`@p_dy2urlx@zmXPzzT+-E$g_$^X5KE(r z{HgQICg}pgq~-B^=mzvF_gvXFYP*Cs-zU&qs8ptH;&zag4!gz%mmGfI*uI$o+cP+= z^91N zHzH(+Nm0R((PE{S*|NxWMos$x1VMEnnE{e8;)kFU0%C`I{zCMmqUmA01B7@8V5uL5 ze}Ebz%f2Zlnd?P?v%Mt&^|&I?`FV@nih!!p#hA-m>y4QH_rUq3(owCky+Vo zGu)X4-*K)X7B@9~zktgJ6Xm-g78WVEDVJjPGZe=l=8)-rtvg5R7ei|8vnrma%e5qF zYdBJ`L4Ig^3$~)TPmJDLHCvV$-(|q9`WBvG{h9j4g|AYoG7)G$EVk`RRpLiB6jYPeE&?$+B)I~r5#k7+MAm|vO%Ma>{URV4BaN+pf z&@hk?3RuzX^B9UkAV_c(#3rD(TU0Rx8F_X=YWaNo{@<}A+~|PEqWgWUo?SDHnT1~3 z`Bo&qYw!hZ6Fuh9B37)W#-5lFDho`md(T5otLJ9hz;GN5(RuyFtF5x^b%2u_{a7t4H$R&o-#>D&V z!DB`Gq3Z?`(|z=UXB2+`{16HkbRh&8GVPP^hYRm^4Cd&?B1G~F{B&3Pu+^FLrvc!% zZ_4Dt6<+>I3s=6L*>(9qSwFN9&65k8)TQX6#uEiOLWAjUxBc|xd8g;6TS;zR`qD-t zP1j>_nmL}sXk#qb0)okIBMFkjGL~Ws5_c{-`S^MU6q#Eb$iNnL&}0Xc%p7c5dKhRZ z{|MbG_#!zO)OJ#x@3(hwG%jGoG`IZUCob_vqvyr3Wd#0HJb;6ncYH}UNZllC@u|#Wzs|btjVsU zrimQ#b^LRiRfu$!roa7|YXhpanxm&EuGXPrwK}vn033UKGL@8TMP=-~b<`U6RWroP z@Z|PpAqIfF)X*o_cm5&X?HbsCDinb1bjDI0kFTuR*1l%mcz9<#ji~yiI_+Ke4-iav zi6P345tqGRg?+`oAhECA1zGU1qWEdW(9^xr{bSrl^yxOCqOtda$zZZtg!i1B z=^1Y)?Tg;JT@-!YTM|`|Bjq0ye5MbCQHP#cIeZs`!PjSnPpdohQG(XrQ`lg_5}sl)k3d!c5OV14cubRzZ9IE2rzfJ#M)mj4c^u3J53{$Rf zL|d^fW4uy9frHdoJt3@64po4nyVHq%;#7?o(|=@INW%ND$&N37x9tgpL^Lw^v$UCg zg0pt$YUBJXxv+A=GL{>{MktJY(DAamRv3@frqk5t^rgzNQOZsc)f9n`+^8(}_j~K? z&UzMPovy4+m1RA>@LSEK09WQ4&G7Ml>VEGAx#UonxfkhrtihT}Mf)FVqvg3HzPzmNr8tppsz6q9Kj8Zzq0kLSP}EB({zSJ%mkuX`zq zK#u3%m>(~#2#}S7p3jzIg2I(0$Xh?|ZOd;-4@FU?XY> zzQp`Sxc|+EvGgBB+15?cu=RMeq^=!d;$Wy}etRxKk@8o5(f*qfUYKyoSJR&Q%HC}rmbTLrO#-+w6y zRo73erB1OwTk3@^*Rh7v6{2Y^9 z@5eanCu(=|a~`Uc>b?D=A9M9nAaWg>HNa(PhJP+TQl=5gkb+)9qJ9IU&|8( z9_ro^AxY|Lo@F+{+3w;dX6)gAB)hEujtT!Y^zdlos#MzSRB|GgO zDn_addF}Y~h2SN8&oa~5%VZ48Q`oYWCytr?IDRYH^%LVrNBg*NoY9m6|2mF zFkGiXH1Wk|WV6a|94hZ$x$b7HGF)9THf|r6)eWYtAJ*GCf-*ZjZz9%`^}aO19pnbtobyVQH0<5 z5yZDL7SAO{;~Uw+k$+(z%FBw%t9&~aO1)cg+3Q7d8BpB#j?Cuf-Q0EShG+s_LDN$? zB$fugb(Dr#Eowyvv4gLq^i5)No&?qfzC)hTj_{W6w)6U!2oF`%HdNOT@M6}Fy#OuX zecvO1{Vo?4jV(p%%9{vBlDZK4qJH&Mu?Z&krne0;_^U*-y)w7s3h&^Q#)9;oU5y~_ zOF+bi5%`l9v9qbp8D?&3zu(PQ_6;IeCxo@y4#?lwK!N>j=MWC*|=EqKT|OC<-rgPO2~8p`N&)~d-% zw=jOmxOqy`+C8&|ac#FUMt#GkV6h(@8Q&v_BHv}t*Y3DJ@+3rRqK#y> zr7sO`!c*}=eyw`sn6;ZDK64{ZC{vwCOTrF4kj@n`dT|dVXIxxG&W1-6fesGbn#2uCFM1mgo({93zhsl2@9 zYa6Z41z5A=*p{{=!MD7%21X78VYhh218wMlyRD) z;2Ggk3z_dR9?yeWvDXLo-Z6NWu>Fo=0Aa>!b7l${@t~t}D3RV7hxU-_&4qx>0HX;> zp?yj0H&ihw|D}If;u$(y@K31d+#JX~TwCXW+SA*XS<|fJ`M~;T);whEbpF$PX`omx zFLyl!7x~v48DWXcf|wsAjq*(h?~bz4(I1X0HO%RRVa30rxDj9_3`pr>^0qzK=#_G~ z^)!B0?=ZL!BgS)Yu)ejp7E9!rNwz49OBX@dU2yf{?4?S3IWTUyxwxKPYodu4Iqlr? zBahr=anl~HxTM@wTRLH37&wF-_vuF;Q3Y&=uv|W272RfxPEQbUq;k$f90XkX)~Wd< z&c|QX*4_!4_Irg%Rpo?!>eT>^1%C0SzrpHpFU7PoT^oP`m906^u4YXOy4+Ml z?7!8roIGt9KRdAYWN|WF!Zu)Vhy2H(juX(Ag%ZS50`?*? z%1VAg2I$PP{lc}6v@b{;QtMA@HMlk-j1BzejS#!VxKE#$FX%2VTfpdv}w=*giXIv*|rm6XbLviz`srrUrh>7TdG(CQzL78+Oe#t|rL?z@y8t{1-zn{RH+_dvr2Lv0UkbfuJ2 zAineYfeb5g%6q%Lv;w_|ggMSt@lPP30eP}aE?v0*O^cZZ>XQH`0k1g1Cu8~$O=qF@ z^gRM&Y#qqD3>z)fx4YwbZb$Lw*kviu{9E~HrZvCd+auL-FX*0_N9S^0*8nKOX2vWO z_#IGH5Z$TZL4zK63OS1~-vJIyW*OliIj_X64iAIn{NS&M4g9NG* z7!J6SCz|yU>#g}$Xvx!5F0Z`O&s;n{Gfv0;?ONdnM-#K3E~2hG#SQ#96WsITT84m6 zb&wwvr?M;-P`s?StiYRr5e8|{51&MJoBy076#>mAsku_wKrp^0HO}{ zHtK4xMOZyf`@U4pwJaLLf%yUWWY;<1Pw*B#Jm(2FLnH3y-y&TF-WzO9RZ)G2hy(&eBnQ>gpWzxX9X+er}xMn1SDR*2;B* zni=w7Zr|%xZd}jqgd&l5H?jU5h@=DtB9+w`?##$A11Ib7$C_CHknQy*s&ugevI70V zsc4m0Lbf`AE}-elZ(dP=_H}W`=3WVxdYqEBChV!I8eLQ-PoIkl%ujd7HFl*cluTco zmNcyt-1TVMwchgssn77CpfH4w79QV_>*jSB<^pewD+@{z`&ydb9jw2HzTHotg1E#d zD$l0RaUcnd;JgsoolPIq9c*9J_(a*=!t$m@YBi$Vp|vvI>zGX&R_A}DRRpZ>&!Th1 zxu0hHhTZRvwvXWGe4RBunvljcWv~wTvy4!$YuUSliucggio13ADSO0_e!j?`!XT9y z#O-2@1rdm~FpStPPJ3M`-%517-Hf5ffA5N$Us6@HJiLZMl3!6z@^Q}{8 z%o?T{*FnEyrs$wAr%hv5aiVrnz}WRQIvhS2t2c_uJEBA1HW$9y;&i_ATHk)x zK?p;p6fg~mI=y~vR&W0|Q|9FmM8t<$f9l zk6u%hH#A8Qh9y5vqg08!rJ@}uMJGLtFXP5*jwYBw1uWzdJ zb0SP{Fd~Z=-Tb>oNI)t6@aG{NwhW{VFLCudig+|v88=K_#tlGy^1VMjZrF(8X_6MV zK9lge0c*DJ+tJ{TKq!2epBIUOR4J#_u$_QMgR5h@Q0+`VRjg?ZM1KV4yA)v^K(8Dd zR^p~4@5oS!6{=q9D0XsGIe889EPF6ZBx?Cw(xoZCtNb1nYr57g`{)L{G?~G?!8He# zE_|dxf$UX(=qA$e!jV21#2mNKa&XOcoTA*)nX)v^N~r(%QL2NP6u|H&(tl`*9Rq12 zKvIp*0CYP(rC=maj?NG>g%QTm>DorM7%HHE+#=b3x_&2Y@D_O+p5+4mK?f3<%hGiI z@F%pp;Z1!(jCI2-x8+4p;W{t98Q3T#2Mz^2&eLklTC}i)YL%?hx;6CP*l9Go%=}bU z<$S^g*-@KACC%FDO3+I}EqOxtu`09?i~iRkWpkgdl zV^DD$CJOXzh-wqcgi~*9BPa2rIg)SqDPmbcy``&_hVv z9}@pfD8IRdhqB!}-VhB@Eil{w(l}Zu>!1@oNftW=CjgoJ?G6Cmt}#ezWqMK$a|tS= zd(R9Uqcak>@1IxIs}Cx2&A$Xt!zhG;~-J~7zWI6QrZ5jK1ga1@nn-8pGfF! z`^EuGP#*LEN;ca%BIwxs%{oFlEO1hpfBeYG^`5vs8znBno;c9XwQGE^hUpSFa;2{% z7yjBv+480u3k0+yN^wjLpS0_uJrT7@yX*DW`B56bV_>C5W%*j+$J8+DjrO#o)8vyN z0Ci*J_D=T*FZ6QS@8lqOaJ4VkCXm#;;wa-P`!(U?Px;=qI()I&!6LY%xReaeXuA7- zK4@<^X3&N=fu!XHCXH_-h>QV`oHjKh@mg`c<#XaG*5%XHPiyI}$HUcMg1Q1L-O)#4 zPx(g>%>e1@khWID^){59=+z7;eqHIZVq`@G>6(|p2lrG5wuvp7u1&Q4E&q?2vQg@g zwDrQS}S<74KU_1O1ve>RYHn z`bjS3R^*tQo>NQ#L#$N|+27NmVj92D#sQ+-SUa&rU; zGTI-R1d_1&TkMDsS}!4FEobI=x<3<0Z*PIWV1RJ{E2-{28vPgo)|Nlm8)BD=g;o5O z61Oa{G({CP7Le;As3hNAllhS4u5(NdRk27Bq$}`esJ%q>W&ua@zu==3QSLZN0bg@@)r>Vw!Hk}B>c-r-n-$` z47Vbx2HPD%9#Q?OBqUmh@TSQ&YWOmC!JwbsMAl@u7~Dia31wS@e_5>-^P)Br1J>01 z{knM;)^y}$4H^m3tFd=RsvCSm3`dT5bVk)78j=s0^`{Kx_WN$tM$eqdP?AfOzt$TS zP)Vt(F|eAGVLEw@#iCNdZGDIkH`#t9qRjIhx1-SVjRy}gpUgzx;{1mdwz4640VS&( zU}vVG+k*;?MYX!tqw)1*55pFW=#Z-R3jBM6m)(5IoA~)_=Q>FniC(8PtE1Bv&4 z?u-aueI&$4Q2{gw--l>}SfTz)D0-5sZH;!{)pYDQ35I?$RuZ4L>saWgE>aAtaPu&k zaxdb+&7cL!*uc(S$oirGXpMG_*Qj3P zk|dPh)_-%jIjbt-mVuxF0cG}Asxjkqffn?zd*#e%A_!0@*>p{o|9ja`>2HpwD%CkqHcwMsGRz$vXUHNRLRv# z0Qsh#E@a_jgUji91-V<1B3OYlD)CflxZCSGy;Fvj8{*GtSzj%T2rOVromz$- zD$r!%%&CJeGrtW!mrhD_Ic1%|+w{)Hg+xG*e$Fim{tXDz7lWz#11Ta#q2BL(gp7ca z+9oveuNg<*;Ze2xc5Iry_zzXmx4{v^VnQ0bKPlNFexs_sqBi=6qr74DH``xfOdrBI zCkh);EthK}@*W&Sl*%V=@;sg5)d@q74t%Lj$CvzSgbO z%|~4Fd6|$3jpRyqZLm7a%r>vDvYrJjuy52XwKP5v=)I#13p9AJ;q~OimN~{s$SNMImOIm} zUR}qPN*n!NduIioAl5byU^q>)3XQ;ObL1u*ov3Sb;F8}H{NB2g(0md)!fMYbqUkgX z&sQ3$Yc1h*JH~O2zhQRZQ`MN;a3*7|h%S-fhfY@a9p;v|OsUW+NU`23XX4w0)n0fH zyvT=^9p_&(8T?Z#VlXnB<851GF0XT2E*JHc&6`3}D%s28ld1cV+z`qkA3t42m6s?{ z<}ZX?J8$*77&GXhYz50Yp#A~=0HGLI`dq}KfHBcTLC74>l<4ws020Y+#=RDrD{*b1 zH$do(o+t$F!LkNm?lhs%%6dXTdB-N8Mt4TM$Piml*o$O$^no#>iiq%-a456G#6d$) zbM@A$hd%-zf`sQ#Q|Ko{L|lUUG6Bl-*|s^FZx~V1a(51Fbwc27*tu24vTaupNGB0<^k7F`F9;lTEsv+hACPF5m1r%Zy){uRA*-zB@ zNjPyrG4+knc{W|6 zO=H`3+Sqp*+iGkljn!CC1SL7J<0mUw7}N9&p@H=Uprq~+t*FI$X#tcJ^qRX z(lZvG592O|)!opLWr$Vm&vp6CL{_C1RkV;4j2TD<<4Y9QO!A%E&=zKQ=N%smaJ}4C zbhQ&^iGKVV=CusYR@Py9beE_oVe6o-L)7LWYYmhg{-sQ;1Hj4){_`jGrWex zx=Zu4(|+u2jETI?!DnQQIW@_v6@6SIcE%IYyoE2;!Vmb)fVf;{B(=oFPh*BvJAL(V zSXM&g9Ek{;RkUflrt5T|On8=v&X5VuBFx*swOyvtue3cHD99*%ox(>EU0Zf1G#*N+ z5D3g&_-MPMJA7+;c=G-^$RasapxC*F8NgB_2la#zCGvzfd@jqIO8f#(4k{+_+#Rka zb@7oeh75IcTn-L2hbxpDXMB8n=MHo8JL$XC(bGn-jJ4>}nO-#)vL^SOHDgGFd=_>y zoON1UX{>V~P5v>C<3&yV4yuB*OojTa!8r=TGcqE&)O>+B&l7U{H2FcNQW>)uSgjGH zqd#$vLGqDf#iyMXs#ut~`Z`ZO4^k}T*hPlJi%BH-Exs{Yr&-eGaK9YUdTpt&O~TZs z)U!7ghs($=W7vy95=+jH5m-!QD`g@FGKlG$+E2+6nnPq@rRloEp&f?$UtNOX2|+aW zB6k1Ku!o47v3;fzpESJW@JcO9lweyVC}{pKh`<3vRN}dLGiBK`SI9`m>l${}atZ-v z4OA04%ViFuk%1}lw@86HY95_IT4NaP6ghlM@?jtdNIMw9e4L+=i%19{tc3y1%Vg)v z45N(Jdju^y({;+oVi%A8auWME`Ps1Htd8CoQ;kjmd~)ks{Q%(_--2h?LhUGZa`0(fI=GAZmzJL~cF7_`jiytA{3n0MOIO}Hs;bYSGL-)pl*>MrVa)L$i*TcH! zk5e$?$wl3CCVS_n`O-kqUPq#Hrp5F>8S{<_uwzN*=~f+@{pvjMzbY2c%>2cg=jL+m z%nzsRYTOYEygqPXpmNpV2${&pgBX2SnkozkojVW*$b~T+?ld(EOB&uEZtez{YxR7) znCEa^46+$F&ne1OD2EBzXV`YX@nsbylDsNGM&3l+Y5naEe)kk%Idbirb3)6MJLQvPAL`k1n90WZ0Ch@6W_} zVMnd@5O{SO^~|Gp&4!@BUW$`8WfkuLLUiEJ_C8S>&7GY zIsxb~TWDu{+BJ7CvBtY47jnSe&sJ+tk|=!5yud8#FywC{rS^%iC zZ(8m5k?s7(3J6X{46gEt86RV26pHY{5~oJm#G`#@7VO%-KfR82*Gyd*KxQdVfUT$j zTYTPPkVGIRYxqD7VW%J!_VLH=L@Agr@Of5Fe@(Y~|MRfBr`V_b7b!Jpm9hguhO>PN zQ3jY8@E+aq>5-VA`8H<=z#?z7GI+PC zS6*qANkQ!l)1w%lm8-Mm#&`dEPnj zN@2p_5rtFQDLQl1bZn1u(LX5DB9Yat#&vc_x+b37$(!Sa7-A^OdA*MQ82faruh2U- zizHINFt4}(hD3XTY!g>onUh32#~n29_sh)LMVWr?@)@B%*g zFP0rwQ9-DZ;m(0}85G}u5>lqs9MX?!LnuDrfCX+}zjLB6=FTV8=5bS$SU)!c+h-E$ zY?{;tZBsZtXoT7KmLvHO2OSOruw4$j)g}mhKpy|_{ekHcRx6!xZ)SdL6vU?1PH)!b z_Eu-r*JC=@=gi`Ki>qApq`3Mwg%Hi3qUTfV@D5=Kuf>YuXLHb9nfb}*%x1*1*`orh zrnW*six%MPObex-4aXl$uS(z`aB5HQ+wR3-q8kXVCRulB-{5!bOV{U0$7oBO#9LLEXRt-p(4cDHj%FV8@N&wA= z<{$hn12a+7)tg6y@y^@kLY_qltLzT+Al&2~>nNA%Za$<=wLBS>Glp9TZ|--AQ3G() z<46~i=4qMGQ_{@^z5cjE+E3iw73hc?a*S$v7`sGDG#Gv`=&TAt{sbKn=eR)s%s*7R zJN}JeqL1&^S$`*YHNA^o^=aD8Fh)ke%{<+s1Es|+2HcIN|FgWj)Ykz;w^0ayiJAj#PZw*`jt6NWHSr(>)1;SDQPQjM48 z9?mwNsegSzZ+%p55v^@T!F#A$eu*=u5cK*-HypeNNt-?T3O+BI;fpjE>?{&IlmiUx zfhPfFzu&e5+qN4ii3zB95C5gPX0Lv>ZTV-l*)K3R_1Y2d;NViLcEZ5Z^!EGfPtc;x zwoo#0f)NyUc4Xk0jT}EHP$CQ)Sh?Mj}3ND6eb4Y@qXjYJL{229yBgOe+0c#nM z=Iq9KYeeYp8k^%cbcO>ejFJ4}M+@=t@^#0NeH`d@y@$GVm46a@W77KYDlj-#zhfDb0A(<=-MV)HKd^C zmwa#Yre0_(@YV4GpYf!9`3>M7r3Bm>J=)3o2MjD>z5yKo!F8?YL#h!BK0hH@3pV2h zwauK5kJatxmUb_`(P0v zkjnxBMAm1?4)dGxF~5V?$HOQ1qY0*X2jZ0H{WIdKSeuVSGrtvNQlxaV-ckawXJ{_a z5yIqbG=&;y*YAjCoz6xhG!=>H8>Qs62ob3?P=8hxcG?_|=owz`XN%4QokcD-N zBm)ai-o?i{7D6V$_0gVFpyw!pfw75HO6o*{vCg+3eO?ei`(MV4;NXwI0PLgy@Z6iI z?M^4&)nsYI286<=U~}@()g7C?y*;92FG`)`MSR`%M~tY>+2>!C3_i5#$;c&UTQ(KP zbV}V|EP+S-Yk1KmeR*kY$)o~r+4Q`1yyyfenX2iT@67Di$R-vNP;fi)40fO>g}k>M=jj-4#VTtN7&fqVCr_XdGv2qd}2aJ zs;$`TXAIp8!Ys39AuT`Zj^QTKFUxMhKuPz%qQ>OOpT{-Cv&E5U zSo>dMD0;FvV^TZ8j-!aXYI1at;@YKcpklfua)u2-g|qv9a6L**+nNo}@_aJCCrgi_ ziuz(AIDmg1omQH4c=`yYHj2~v_WH%Q+;aNGQf1fcIrdhKjrc_f2RYgnIdV#aG8odrvTzRFpd;OPp={~Dj-|n{mv!1fRyPC}2T=ETT>wX~ z3|Ln2%P)Z^{;yFBPQnesLv3lh_+}V_n_4`f=Vt;N1cXvBwrZ6*bTL>*w7D}0fS zXuWl3s?@a&t3zf)8W~;q-QSzEYeE{SZ(QmUeiL9~1l{LHHU)%wdFig|DUTnD@iJpE zb&7r>K14iFv`CeJUjM5i%q*%jJ@_X~J?Nq>?qn$PqX+1nef^l?_;JJol3ll4Y>v{~ zT~m^H(LjQ=2>QWmXynmHMzY|HqHNw(1 zOH>K7eS_q~2Y53@;1RVrlEq>YWxkV3keQkmQkRL5PZQeWjY1JXU>JI|twbm6K8iG> zA(>~7PXc9zu_Z(rg%=JQo+PqcTRA2Mf_OwR`g;|t{2uf>Ns6&=itj7OCxJ(oxL{lv zR^G&6U3X{MG}V2K|#?P$!_=`;SmPAE=tU~9$O zq?HJtvrsSrXk=4WsT4?0nGfOjzHBUVE~WGR9JGO0(9X^CtBu6`n5xF`SzE?GvS143 zt@AzrF;4x97=^V)J~^+L9q$!KaEO5OB0P5tgU(Ypc~y`}*keVs`UE^~OZZpG|LgT@ z#=mZUuAKUdsus(JGa74+g>jXxvpS{io0B5Z6_=2LSX#43OoX3H_BOZSlQWfHrKW4$ zJW}9!KxM!mw5J226Av7>^EIo3;Y#E;1|GojGy(C>Zz@L-GrN0|pQ&M78Lj$n1s==~ zaD#R3UZ_jopn4E#)r5YOePiGj)OS_Wz;M!VW)z$UR5eZGcI#?%)io84I|#*nj`tec z6@+jr&eJJv52+~@Ljn$3!K=%YwbT~_3#S_~quO#tiLZ2dBg6M+gn>?#5}#G3qOw(- zt2`FA`o5;2=m#_v#F{O;sSa;g<9WJy9p-1aqp~+X_p2Q3*KnqeD1uNGY!yi~zgl~3 zG&zl*9jY+Eq34W0Hn!>vxCfT4e6JB^r`;+;dG?AabFQD3J?+8Oy3%NFnExDD*tJY5 zkeuIH(BzI^UijzFjQ^AJchf&zqz67;=B)u?s4zCs!r|LpMVn5*uJAQpRfOGj6`L5( zrfq#I+ov=O+*TQco~mx??s^a&`T%-PD5t`Y0e6sUQsoOljKLC+?t4$i0%1;fryQ#X zESJ!N4y^5~BuBp`txQze(DC!jWEEA;+HxWDvP1_}cYOeh}I+4TjM zfln-?cwdK6N{`lT$Q#)qAaHzmNrYSQO_$wu=pgKweN<(22=r{@kUP31X+34;h>mJI z-jXT(U2To%MA}ddy)LkiwUbD6G_yPiC87lYTvkcOcJz_%0g)9uu(F^sqbW(-|C78gx%I%@y`MGdo<( zyIR`7mYSjaTI(O5s36hh2@h(LR+cUsVBDTNPiR+<6$h_N6IPmzZ$yk45+j~4$6n-3 zj{6GzbuVs9@v%KpTC~faiS?lk)dDq``%>k1uX)YYLS*lr!zX(xt7Y_@Rk|t$AxCwY z9E!7HW-mTscV*%IyiVmXIx4^;dXpR+-0csDF#~fL2y%i5V2;u~QXwK_7zPwEO)dyc zx#gy2Y;1!d8~?kDvMQDdAop4sAf090L<|<`s<9r6hd2$qN^Ut#x%v;<4w>`^d=A&} zIez@`YIfjJLNSJfJ+14EbOm#dGG*<$le;o}@RuKji`x6naeC+{K$VB!@%ee@ZZC8@??AbfhVwnfk5LY0xSVm_SZG{W^M|8+)`O}>u@7{ z&MkTzX*9OSx}{kyybRKUmB%1kEVRJCfERF~5x~Ev4%Hd-Xhk3b4!zk-#$reuoO~GL zN5QY^C$6~F%cTaKX<%vNgY)upG9obJwVh@8VN5*)_wT^U8;V*v54<9a|t|%3@1}FQp97MJrX3sMe!o;U-4=@RM z_sTMkY>iJ~?T!Ch#lN;YIjJ5WYB()T9dpB(P)C8|N3M4OWJfZA*Q>6dLp6WT7`Nqy z0*gavw*Zyvec~7OTBA36qfM9(l|NJHwi-P#PsuDy&yy<2rVXL zwI=LOr8{kb95RaJ!(P8$eV^WsBH~GxG(Y1Y=$uCWZhB`7COO1$I~}a?FF?ldruZFS zsbyS>awgvz7j!vigb?NMba25y%h_5FXvW{(IvVSWMND-SG<-JH1KM#HzLt8!0O#A_ zF~MbRVfd>>wizTG?!oc2$p#=ub^k!x>29FK+^yAwt&4Z|mn}#{;*IRqod^|-5uzdT zPKBHgvr})}8F2@0`Om#i|(6c%Oy7xQPn$EY?dW#q?P4iZT5^g4s8yQ7@ga`c@ zQcER;5r+q>at}>P%slCi+F2Tv5O=7>b?&=}*M(8r97CSz4(EDmG#^rYiBI{>+IRbB zaAjua2oBAAg2T(4|D=3jrs*58|W-X zl8^nEY2O*+8)aEvwKM&2b=qXcADLQM+4%v_$&u0mmE}VzrE;q7Q+qn|-ep=Z+uE9_ zDoT@~sgDw`Pcnq4-sB@NGKjWS9Rb|fSi>^|s1TPFIV5jC{*3`xexa+*gk?d+-Ilj9 zOHuwv0TCrHvLP^h**RfUis@W_Z_JVum_zaog<(0t=ZzMI&vroe^qrTBR)DC|ERx7C z2)9z}lHVXctz{bMT~1(Kjm#0=XY?#)Asr}9*Khv;4ap!m40C(HJ=+dtd+k>bPbp== z&9hxQ;0OKYz&8RHxY8KTY5am$dMU~oMRm<1%9qB(PDZgJNe~|GjO*6@px^!Xh7!>v zXL_k5ASUK5f!e%r#8H72Q{z;n$&A{9{Vdr%7QMNcE&hus9fck+FMQxp^b@UH0zj*O zIQofNI#>AL^d8{C#(H&-NtW={4XgJvi$DP(%FY81bSMp!1iQ~MOI5s$`hVp{#Zx)L z&6v5uz&NG_IWDc;phSYX0%Nx{P~PoC4Dy zP|B7~@(usmLf!efw8xGvWQ;MN@;zGHkGL-S5Ljqr(8~fRTi{h{5RcBrnVV3s@2I(N z4lH-34=ewRn%!8KLN$6{8p%M5g0&5^s!i!COj$64nO8NF$~$6ALSKcDvri4p^YL0k zpIxj_0}2)n{JF}V^IeEvG!ht&RCo<1*8PTjH=~%)wfSURdaiC)$ z*tGWCY~^)!7`B4H-3?tG(`qTX0ibCa=QLMgE0vVxw4bye&lqRTbf@F{s4Jr7a6(*a7BvIp7C=Y2eAKNndi)2G~EhpEFDm>*9HK?EI4fa z;Ev;7k0g1){y3Xf2M~_OYi;ZB^#PO?&Io}w+lCWIczCuI4(oCD6r^-FZHRFO+$*DVlw%|iK5M|VhzDwmIgz5toH0I$yT-Stur@TvT-!xD? zO#h{PRRS#InEGkmJma~wH2e4x+=Nd1Ql%s*9Q~4ywYpe8>8*h7y_j1a)WcvVCYtiTweU%2e&O)`x{D#9qlz65GIxXv}*#HNYsJ!Nr zc3l)(oJ(4NmA_4O`S)mW(zJH|_iDMr8z{Unfe`ntNTpHY#V!Nj91lkqB5(E!!Zy2n zFbl`>-}7Z8jg`edT&u>U8l{=Dt7&bg%)16=G@>RgFA-%#&}&(}^_P+!I@?k8y)H-{ z;2B@(KnTBj41lk}Ie(mkix-YeZ_>d4zWiaVvKbdq66=M@&FtpNl;eA246M!1=*7mT zO@=cm;!SkX+cAPG95wQT(Eo<(wjPEiPH?gGyVGZf1fO7Z@11&C>rVtZn;QMm!2wmQ z=FDlwuBq!5v!T25-kZu3CQRqK!_TW{ZVgd`h3HeLDmiPsy4Da(JJv9@1Jgxu+#!+Q zWr=uoYZuE2L7V0qgBC_IrHx6TR%(9brwq#rDT4!MMb+O4GV#aeiMr4N?DUDyD4Egs?4S zo?Y7WOBNz7o`s3<*O@I7h(n?Khhxp@%ufr#`MGxX%e@7WF zB-dR__~f-*{bE0OLM3BsO1xj|5!Ev+X!Dlsi~Lfyy6oY)$(0iG>W*`5@{Lnc#dc9T z*ZChfj)0!cO|(es9Ot>>w0oYwGARl+O^Kl;leq3_A@4K-WpJ1aJUtWj^)Kv;`^p*Bf1ni?*Ou!8qO)>p_=Sz z(4pk|*&@th&IGVh#LQDnDXr|x3z@KdB3PG#!? z-2oKb@t4J9S`*XbZw)WShi$qu;0=^hzof}sPSFu&)xHFpKsR&`gt8lx^!5c~X;7Z4 zEEy6&yfw|h2kyF^+v@k!AyG5)Tn_!P7ZAijJ-Fu>s05Hj?^3d41en#(Ri?do7UGAY$Oxh}A=Vt(V?vyV6UQ1;#29!%)jUqk+!(^Q%+kC( za}agPT{e)QG_r0G)L?tid*i>hlQF#XuX41(cBi*58F#gFX{%}}^r@Jr3LBJyRgdgb zOH7>0R(vunIM~Q=cqB9Xf7ZhZf&He&kLb%0OVfU{lh7~vtaa$mF7rKDY5f(~U{2G9 z1dwk?(elqr10toj4vCqE+92UPiVvKj-wZi=Sk@h7NAanOaD)r&;>uPZ;{WGeV|UmI z+twl)cr`5tAWljvt8cvA86g7AEVOzo*|7`w-TpRzEv^q3y5qT?(~e6jla-44ro}DY zLT!sn&Cwu;#Ra*n7ynWVHgvtP-2;FBw#BTkwmWQWmNGRDcPBjtjY1kz#_xir(uab1 zhlEf>Zid9yN-YFRx(g3#ix3sr(-?MA9~GG`1sxjmRkE?Q7Vg55Hcdo}=-&5{T`#9=x{nE38A64b|) ziwKAqaMS4sk3HVD(bzq1=XK3j*E3tXx?V}KQ}?KSsRm96Y}4Z%IHZ8UN&9$Fmi@y* zB~zy#R}9{+7;hMcifZDd8xv-Fu`%qk-*(i%*f7|BAd4^?EGinKaw7p|SCC&wurszD z%49x~+!<%^^6&^O^XTrT6w>?sB3w&=x}{McCrOeT-^GDGZxQT36McNOy|Z>9{?sUt zf|Of0aWotF0fNo6Y3>4kf^evqr>&flv3xdiz4_&4DE*5zOrmYSoIZlP!UNmGiiSzo zjHYLyKZ(zwV2>cjdLRs^mhoI#R{<;bHkl6bm;L%W<{l-(Yf`lJLg8;;Bk6X?lv-oA zy&Ch>?I9Yn7ICo!y`9i{KNq>}MTF(%^6(Qjo|ba@&R!o2^(9rU%LP`vD!tlK=G4^} zoYO7SF09B}IA4c%=4O!{t(#OD3#*W;vru2A;?u==<6uaZLvaBMV|cL_aaO)#`IU9n z0?|k4$0{%aOg~pjORgP~AI1$?h-gXLmh0sX z8t%LFz=L`BeY=7r-Q=)peu`rXX=*4?l9nFpOLo`r^craGd&?>a3f$A(&r^Mx-2c^- z(3E75SBy%ZqmuYIjwfS9gv{4cctNRzj_%ia|M}rTIAY|4AjuiMIaV+@^M3Mj8DZMp zHebc+Z zA1n)ME}O!%;`%%7qqVkr-SR6LaeYS*&Z}KbMm>*{*|`W{$M05fMNc$odeE#+ANX3^ zlBrc<0x9G^u%WT4)J%R`p3&xg?Peb}9ccPcc&yR(Y(m>Kr5r-n;>(}ks z?GlHkN01WhB##IFK3pege}qlbt|5>6(Ee+9`J~_bqrodo09-D_$#x|^0I6?xu z1pzc={6A`-8XSB6r@yRz-Xx|-cHU071>^A+x2jJ21ts>GOf6dU5kd+bhJ!gE$i8Y! z^TFHf!uq<-$*FDwOB_qh9~iR(3Pv@;Y^G?y-V; zdf-Nv8U^xv#?V#nm4?i4Z)M%o75XfiFdOLw-_(q^v5ttop>j>&Auc8RL6p)U7p+ff zUn!~J_}~(9`GJ++FN>fE9g|o2+0*%81+$#Yry1YoSG;|9)#u{%GOZrM4 zx6NNI-WSBG1YSf;P#`x>&TTa=E&jxnBv^&g#02#}qFlrvnl>Wcx6c+IHSP%(%Y;o% zQeE3xyd}W1*CGFuS1P>fL>$s>=r}b%d)`?*_l`>we@Pzy4akx#Bl&I#l-7#7)5Z9D z^Z`|kZK1aG2!8Y1>g|3K+8#AsGd*tu-k=LUIGrvrFj|;?G}y`{zv3VR3HuXL7Zj?| zk2(K~gUUA_RJ2ch{H2XjX2EeU(@PEfb!Vd{P4XPA>DyZ*Ro$OI3)v%=iOM)PxekD%1Fl`Hnx$OmExgVU0(=87ATh^FScj-}!9`|K3qQK;JO@3$M zlD2hD(FT`YEah>E;7uFjMLw_MZV(r?WlB}=KN^m#0>ChJYEtnYk9J$|B##7*eOup6 z6RBoUphu&udLMB?^>W>BVV31fAM90YmrA*rxvj79R7IhRH}%nvA9uLlAG6M3`uOU5 zE^8 zd1^@Wn$ZEhRqC(tCvOGAi`JynY-2H;Rdn^DBDGS+V0pcl_h*(%q|;^>i=YtDow9e1-5)VlQTcEZP@m-Z%V_x$%Lw z1!k>I%i|>Iq@QU2oLgfWH44i=6ZvNXGw^|iuCxG=6y*4rtEfI^%8&~=Y11a zMKiGDZwKJp^;-Lwez9fvMEK_La|ds}qV>HNz`r`d9@z1cm8SOTlYp@Xt0qTl4hO>= zP+FxW*)z)Fy^6kjg-0sEk&KT6|{!!P9%8JoOsZ!2z&$Jz$j*<)QI z#hiXBXExif%x1%XQ&_ScaVn<9SEY&(^4x~8S*dYX8Y~E+!$3^_v2HYzjUCUU;r03M z%gt67Ja7`4@1Rm3?)R?TpFV_ESQ2BWYK{B}_G9GGd12$&V`3;h$m02;uw$?}SO(;0 zUGV>5Pti3HcW(&as+`pb{_||Qb-5NoQLiqVmaIC~>1IU=5nwDj7sLDK9zvtF3n`{N zJ67Ni;>*mE7LMzPjIgtux9X8}{UsTIJTI_Ye=^mGKM67`=@N1SAHNa$X0yKG+Ghlzb{mFZDgJOw5a7MSZ$JElUSBF|OeSIA`EtEUwC>g+n=kzq zN8rk_hdNv~e{S^haEHGPAiQclmo2wmIzS0x2n`sCRzCTzlIqc7ts?u3Sw`ZmE9^8P z^a`=WHGHssG{`5XDqEvKjZ+?^9ttJ2#q?toajlpb_S`n^59^AhHzBTn3VSN0TK0ME zqiypvFM`&v{8bB5Rm@}ff}l>-DGI`Nammz2q1)wyDG-|kz9)LPU_&owTiuWobhS3O zAFfe2XhrEyAj;$c196Y5oJ>T?DQxjFJEwm~4viPxxdBHG`E2+-$uS{aG~hC@XGV)r zK#EH+vLsieZMh%|1rz$KMZk&K2oU_wwudMEHcqUI{WyZ|>z%`vC{#w}a1m)395ds27P=In(2t`r z7PLPq!19AWArg+ob_A&5^aFGY`YxG%6Y%CPY=xPRG72+hCcEnZaqrO6Tl8N(+xV5G zw_mq*X}oz&G`N-AM-+c87K+{O%tTX{YdtA=Edg{?$tPO~&FyZ8WC17Y@xSjd*qTlT z6o*fl`Oj9(+@2V8j=()zG{8N)7+w?HfqsAt9GdTd>eE@SF9W8gf6rk6yq=6?00aBq zaS&Urss8f(om8lor9`&kX+imkXU-UC{3zS~{69aKO#P?zhp(}&*S4`7G!$kSobYq4 znx1m-)bkx=bzjqBk3Dc|*pn3JtsDlaWA}C6!bR6G8GdZ-!OQIeM-&|NOHt@i@XTb@ zX^fp*2Pg?-(69!|BGE4F%2GqQ{#-@1!T|E_NKiixT+(tVq| z0MCL-2u>?ZUAcV|^D$X$Yo@J`H$T6(YjPX{;EJOX$^mAM*>&tr~~y_MHo{(bE6Yj%*pHZ0!Yu?E*>= z%)CG4PXtO-8AnFDlIVEKzHsV#1=q08LP2kHmwiA$Tq7g@*2xC7JN&KC<y`L(Qes*s#Y%<9kjDCiiMymF4OY7=15y!q$N(n9&BWaqn zk%0TF95yE=K1-*u{p{BFad;5PTZRge-+paeP-c*Ee_XL*%f9P#l)k#nbTE#*slMp~ z)=axoDkpl%cocF^-`UL`e^V*y+U;6Cx~utP%CN}GH(gd!l<2fcK9V`9~?dOE1g=eUYE!(J!CKv6kD@8veB%+ z6}fhr>gvCP$szI7rMAtV*(6tjvgNlwNq#M`NIeeSbdi63{YuZ;ic~AfT>S-4#`vpp z$<)#D+!3KkV4vlExpnQbWxb>C`o3{NuNG4hbF6=@i4~cO@4A$77_%BB+*gS)D~7azzf;4v>#M6JP<`Q(ij#B$TmR^?>#Hfc4C)Hm za<^O59jZRQey__5OeAaNi89*Ev-2q)0 zP8m+Grrc2TnLgGi<_-k2T=yG0`sn80$m<(!D+*#jB4d%40KdAyoo|NX@+ z!dmp!;Gz$G!>x$^RtUx1vSi%j=xsAOAf3Mk?DRHm9|G4Hd`xBig%3lKGoI+pCl#M6?DrqoNCQcYmb2(ZA8k0t*q~0)bwY4i zEuXVCLHzJiG-}+|*fvYI5JYQe$J9bF(X)mHajm*UF^UASkOGt_OCLcjXaqenFh62< zox>ywb5^xlAGc&&5W-UGL}V$Ab7p%OUlmvo%CF*JndJrpl3Z zjZ?UiL4N;IS-$ zm}+5A;b-LFub^%p=fOm&{)TQj=x9qOx+y{ZNE$x>k;x2MwTi>-fG&Lco!3Sw>4k=S z{Vj|62GsM{q|RQ6YSP%1LmOZirT|sHO9YjnnqqrjVwDm`u>OSr)&66dB*o0{iq=EB z{FBrin#Jb3HK~5m`P*OQ%qe z01rgcqXWiB{6tv(ShybydiVbWF%dKZ2x2DU`Vj6ubRpOJkh$ccfBOp$OqB|F1P8sr z9%vlmfyv=bwTagRepoY8p4N8++*qVt*VV{xc?o4@G8zEWhoB_%Jf{4**6NIPDWjin zH$f>NK6*`2L_iMP6a+f3p>N`2sTFEe*(kLjhN7nQjKu2hr-|?lMTo!GaNqCWN-1*= zd`4toiZ=0D)`pDv7k*m76K(rFZO8JNCRPUtTmGDuZQl@OFT@>cEf8%Ew-M7r%+e-1 zsrpXnV0dqg2divCH&y;D7jfqA5wW2t-=57;(Hx@1T!ic2mVE7_Lw5zLXQ}mhC+TQAvqTnxa6-qh^-pC@5*k()YD=u$}^)v zL322wTJMZEH?#l2K^)p~6GubAL9RA;P^Xqvsj&@DiJr1Ue$pE|b%S?0?WQynEwog! z#dmB^DE{{nA+b*F!RzTl7>(e5C6FA*5)(9wr34z3bOR$rl;HmZFK&lYomQi1<|5jewLydIw20 zw>>FGFPTCGIR*9rN^I}Mq>1rYVS+LkRjhVxxn$wupsyfm3}2I>+QM3fabmyX(Y)Uz zu}Lf+LMMtYx{(<7MJj_n%XX86NKSy>&#P2$Bg{-2Z)k@l>T>rKO9VOnU{csyh2NbC$P#LyX!J|` zf-3Q*uN^35sDQDlI26CHa?{#qm^{=i>J7{#0uZ7oY6P`n0 z_|$ShC*GOPP9mWQY`>jNP+p#ImziFBnRC=yo729X%k2p$`aG4SJFTcYHk{fKUsF!< z^UHCcbxJlOt<+UIz+0$=%+Utm&>K14I~=}cCXL4{Vf#cyewI_2FPwmukrF409cuWs z3U2LsFxE8p%gEH`%@XUU2*Upi3s%TGdDm%S4?kAxtw^BIu?A1PHv6OAiFzokP4e%$ z)~MC6H&L~vV{R0QaA3rICXnG2lP-fdnVFjU&_LZ{8aQg!PvEv<0V(OkM|yzGv(;~z z2WITakb(1E@MX5Dt}kclC_)QCl^LrwJO5xuZ~yG46GE-)M)@lH<7`#KiujM6RJXCL z9XhU~n~P8a9L?pgWKnAXjB9Fs&|v0pe>P()vROW#N!3p>2EW0=$z4!P;!mp-T|q)W zqknbomQ<#&-BR(VLZOLTV|nZNcvB@{F(Bdb+77Qo$YNIA75NuJL=Cmo5eN*3^sF%tH`eFS*+E6cD&{eQvSUYZA$~{1)c?ZTCpHExUX{ z`51ll&?LiVQwsaKBum>#Wbh5)2M&0jByE4ukVjQg(fO)EV27cYarYSuI3r)0X;a9n z#r-zn?Ty_K!+zIs&K^JFeyc2}iaI}wD}VYGvEr~RI|h;)6@^By19eRPb38uP+-g)MP~FT=5!Th| zXOss>e+X|1Q9cZ(G$Q)X;XQ~rr1<8UwvqA*P0&kIXLzOJ5}57S?Y2<=tBd zMg~oz`)%cBexgGD%a(U|Fw{h^Af%tq))vaRwdGlye78YImdx&~H-5<{v;+_sbVf0;L3NuzphAXjN2vtd@qVpul!IU;ex2>oIxffE zuRp}qcfykAvTkBe=PL8-s#^ZjjF95(VbKC832cnYHs>p;0W8JhX*+tY)8I}EE$NJs z0ml;p4T@*~Sc^|GmA}CTFq8{+&$IQ#L7;VE=?yiZMh&rp%7ZrJC~N&dc~e75UOL6u z6#rcXFE~*apZICDPRnp@Yk^1KV#+^p5>DdsT3L{0lh=o*ePVdCjuxQu+QSU1kcGYD z4y>wAQ-4+nM+wtg+#mP5 zismsF$6vdCaT{bdtUx7vF;II`U)R_XM%V*8%pZp~yie`bdZm=b;R^;ij<)WkFto{; z=$=S~FpO+y-X7Tb>nVkM^g^m)Q1&Mld59=gGe{<|Wi~$sII3ETV4Tu(&xA^yZYTP? zlGf|mI`|oc+1R(+()U2XjINBVHoL8MCS)hvQr7dR%C?VIvDCY_o0Z#2ia_Mxxadjy zaw>?t-NV&M1#|k0q-r#52{b0S*+k*y$W>CVnrbxh#b=d%_htaB3-yNz6JCiS+d-&z z2abmAXBfbtVq!CITXxpyF1s-M3v;3SA;L0I(@3eb$(1eb>o{l7IR8M)@+ZKlpr;XL z+J@BAKYQg9;JnLrBM`M)w%-MNkk3J6=~9)f@Q0BSe&v^96k-qh8yL3>g9udK|5z;! zFJFYpv;Y5T|0PhN4#C4W+{*8J{>86w zDvIv8y%qpWu54o(b5Pw7VmVs{Z<%zQ9raC7Z!1iP?HB*2uk_!=M}NS)iFS)0=x01g zMF2?t9aAU?a*quJt&u#Hg0f=pSPT(OCmBX^q$c^GE#F)I`^^n*X8E9ar}SfRO)Hh{9|qfeCtYV52p>DGQNaIU+faIefLvc zCJ#J+nH7A?GsS3R%V8OY=Q*nT!JR%>jsqU{Qk!zR#Jr_HJ`bqMjCLp-<&un+Kr3C~ zpK_m;rA};)rbychKi6|f9>)OL@f+Z!c3^2>KSiv z*am<~I9}WkC7_G)KcZ}cxObNM$fmhVO+ASxM%2~JVfq?Z+Cd@uR>jJ-UHfSk0>Df`qI;$&$^C! z8qgPS#;!)zDsGSIZ_fnc7msnJUrRp&x~t?fy_xxW+sB-cl(yHe*Dv>3HQN#L*M~4O zKX_t19`Lq;(VrO8zdYQKJ{?Zi7q(IixjhTDs^A4OMhbTd5p(Z6R_bSC@Lc*(A^j$F z&M@KK8MOWJ9~n1>Kj^NjZ2Q`UFq3_?`!pH_2+cR<4Pk9h>;K`M-+^QLQ-R$}6iMeQ zO0(=&?P}LvMSm3Du1Y?I*8gMbtD~aozQ5`2?vj!YfdQnuyE}&xL6Gk5?(P_n22rHD z5f~cjkP<0r-Vwh)p7*b_)?G9Ap1beP&yEu%JOPLL%sj=I%5_dK8aHLvP~LT+HzVJN zPJ2f!8W9qHl}4h}y84Ene7@;Pv$|(!C{0A$`dVSJi%eV>K?prMt&aX?lOsk#4?p$& z+UXuZHTcD0j-!O)xd$m~D916_bsTx%)KZhH%sRQ<`q4~(i$-~$*bOi z33xM>z&p4&I^%{eN*WT2VHF%N`gOV{s+U<%aK!l}%bj{#d%8`2J z+FjrG#@}xFp4LowmN#nanMHDBI+`@E{v2+JJaVAYL@>4hA2<|fY?PZ}wjV&mbQ=*M zHjCQb*Ql3eHdv`Fs53#sOf|lFLroVJ-k-ygonB;f`V+b=z)wr~O}S%i#m$G$(mc@z za}~6P)icTeR7G?|Y?Iam68w}JxYwj>NT0vQL!lRxBI@87lGW@pYV`_TnoHM_4i znOqSrEKz{JeFqxPR#^TfY~8UdRmsaf4ux^tNZYMAREvr|u6mI5YfeWXp6J`WF5D6u zQ0k-6y1hXl24M21u{3%b)5@vRRiABTN!3$wKyydN%*$zwQYn5)SeYy{w{PnAl>O&! z41DJ$Jxw6)-iHiw2JJ?FPjeu^eph+sBvzc!?!V^4RSVs%rGkE|QRGDRNvIJe^Yyt# zVMow!ILf#R%#KVpP)j)QXv2A><~v!C-5I<$aH5I!8QeNnN_~{}&hO>dh+jbk2j<8R zwOIXW^<<46989uepZde~bDo-crrK2PSSAKB)lv>ST@341ZD+BzW7LTX_r(^!6^7z! ztYVa9h+i85Cb1SfD5v<(1K$T{zrrj%m`WA7T$dg*rE1`RXKh{_rYJ)cB^n3N{XR2n zJRALrVt`*6B$WR4Xw13j8BFMv{0TfP;)a3mpL=>TG50@JQPF{s*7&;NdiGZE`0>NG z4d=R6Hf+Le#;tbCuRi4z4%+)WZy}-k7GkPPqiZw6*+fQSL*Cw^zFNIRdU({5G0S~? zKh>pLmQg1bf|osSf}x_vYs}ShH^H$fEQ?%B#@IXKv{StEHt(xEq9&It@ZyHl-?icu z=TPhY4NkudFcw{$_cI1H`aTkshG)Jb!?|nsxQ}l(w&oHEx8XkTn1f=Z0*Q$tJW+_jF|4=uMLcjE5Kf)k@aqrp93ryVRRSV<;7(-m!*3?> zOdSTL>hcP4&wKS1voYV7vOjA1TVsA`=jJY1eE9mhPrvp}`^_6&27#kKw-)|Skg}eo zw*h0SM3Nm4uanJP<#VvSsu>&Uu*fn@eC=e4a>JNC2mFeXt?DxO^32*6KmDkHW zY)#46SuS3AZ@`dEs0|sG13){Oo1M%XUyJWZC37nPhH7p_H;ksh@f^+w$*+613f$-2QWZ8+#2=k#^lYT`wvGF8E&_Pj*X8`T#xYIQ8 z3%{H92Dnb-#k!W+b&!$DDig<|OAfD*^eUf?6~QyMWtr8Nzv19>^Qqp9IgA#f1b@FR}=N~;K`LLO#pQ; zI$1?oN4Y{H60m^e8KDmhW%NCEvS?oX^l=kx_J*HBwSA5&9RtKacGRN0q zRkb?!SAm8V7{9{_s419P<=<|nWqUQJ9Wbk%b6>_jhW}{vTs&DJ(?q_RR=->wYs;=b z)iPPmoO&#*b#{$8-q}~U+vpF!5;18am14jAeBL{yTWcKKxqn3p>3GHVw-!ghp7a=q z!aDmfkU7bf&rqF&jcKXt-3;8@;>wYh{y!)`8A+%hu@P9DSeeBxV^hR|Us(D1cDnka z!=ira0QcgSwH#G+4^?Rx-{37O0~qhExFGkZ=NKk-%7Z}p)#88<+{XhtG5m8?B@jsU z%ZNrYsE7dj9OmS%VW>xvCc6gk@o$OQb6_l8Bj3*b5#`B`LMM^OkGB(@Yc{J*p(XQ2qkhKpID<@lGCs_sVwRfRUp$g>p8$jx6m z$GK~m>eca>93@OkEFrfAzAj7DH4?UJ4Y@;`rEGgP z0(kh4((0d6Df#Uo@0lEG%}ZzZez;2f=*_Sg)}5okqvZao z{gDd8f6jlI|K7G&PmXlq*6A@Klf1HwIr}NTSra|;+XH6fQ{np)TLy{n8S9xJh4VEy zY)kGs@l4QVemC;@b|iC7d;-|;kb|-4R+X}R{%qra;>hu;Oi$i>;y5?ZwAEbm*e#Kd z%kxc)eD&nlPD4QbM;`oo7Cw5q$THNVw3^9YFIu7$=PxMhtpDkfx}fIzOTiDq zdH$VCPa2n*d(+Szctgp~;HvYMx~`xL2F68&4)P9%PtgKyuNfEZY3JGCmHd|#TAazm z>IR&Xys*<12S$pqS16NGoyVedwbcyat$ymM@oLnAKQVSk{m+hl+UWW;DOH!mlf2cM zO{Luc7%P9g-#EVeDLRptdk$Dy;hN2K+c6b&55RkSx>(7N%~y29wCLsPx`$G;8T;2< zMA=-e7<;vRU;RS_ZYM@RECW1v=w7^MXW1$ue0qG(eql0Sd)BFZ=5(*r-UXQw0S}ap zKY#{R*rV6MVfyzL_pf$@y4Otzdc3=X3cbch5~-dkzyOEvXcyz!^fs}f z=;=0QXGMLY#w>Mr{+ApH`DTN4mKXhl&Ym8Taa(Fql7y=vjQi`;=<=FZ0YMy_yjC-b zb_@mdm(b-DEN@eZi_=n7|77_axSfq5l1E`m`cK4&fTF_dqC{rf=+A#aRiyA;{FBmO z2`T$>Og+LhmHacCuJ`zUQX(-J=V-h3yL^=*q5X|&T3ANk-U~oWcDzfADyS(6p;O!7 z>;%CxPZy{MGfpJ4j3hBN)8}yF8w4ZEUv2&?BtWMBO_lMMa8Y5-hku7(FNZ|fsQbdt zAnIJ$)6;?kgMY+~lca2A#$gvMx8;{cw!1Kk(C@4xolesmJc$krs&A!IdPC9r!52+za%o`K z$_FP%eWcYL0Ba_di(w%oYIcA3l4_`2Ac0atAo(AgLMb9ZpMD{-X|QI3!s)MslEw39 zx4%p_^V{u~#Of;f;E_UUYTXL|>+)!D5W_0u>D$Z~Lo-rG*qZdsx**aRkhObGrD=J% zk)5{Z8$!{2RZmO<|00mK5t*juQFoMb$xNqJb5^a{Z|2Q=<7k8 zezT#XTQWBXB3B^}J23>N+peUf%UoGl0X<5N**Nxj=E`}i?C)HOHr@jpulxM?E0&`^ z8{qXv4u9@JWUt}i{P7psM31rtp3r5BAvf_Q6f&Tw)dA%Bqwkw6SJ(qweoNsGkEEww zo(5Dd*s0#X4U@@bJ#kohy6|F&p zduUA)!!sGi!>04vExAd>yb-<)m25*Z2XR@AxCP-`4d|&4m&9>zSaEW7O4_Qt*a_Zj zkpiIyV6hOyVrIoMDQ3hnJucfu8yx#^Vtu2iM*U-N->fUayS-aCjcCohIF5$h7@N(> zMG6+5b?D#*NB(sm^6fCW};CTJO+q3qbOf?pj zc!>`$frxn%H0_=UDXk3HXVK;}_6JR8bEL|zRr)z|gMN$Wr(Rdf!9KTJH6}Boto*7t)fZr5Oz}M}PVs?uM=8F=dKX7&P_WEWo>0ZN|2907#4^Au zaVZEhYDSlWXR;Q`aV=hoHkc&-C}Hq7M|$ZrJC5mms7BZ?Q+e9UWFClQNAR1SLKrg`X8@O$bTeZeb3eCy za9?~{z{f7Wo5=w_$hO=L-nru5XlwB-!@4vXztcX(5O*=#IiLS7a~W|l^IBG}V@>>>BmrD*g8#RNpyw>*g`}G$1EKR##8k$e*_^nPLoZG9Hw& z^DhvGh(BYT!OmDC@y>|20m_MVfrMunH&%3d+vizU9a)|z6v*tu9;y}^N@P?2m4F~( zLXkf$LXks05k?34Bz4r}<3jb*MjdYH{l+ghZ_k7~_OoAKqq8YyBh>$dk7yl^c+poK zM|ta1c`~9&Ad2v(>mbbEur(bvC-1aJ!IECv>}|9y&WGc>ZVrO=w**YIm(GLDTA(Uq zVv)Bg2isR<@rhiSm(L@^ugV151;FI+_P;{xXW#!k3^sIE?EwVt9cBuNuD`*$Wd4Fj zm19fw9GD{@U!Znc zQ8XK>r$rko$eTfL@{&X_3D3(gUYdF>2mE#m!`~P9;Wn>Md}Yl0$GhGeO18^Tda8^= z2c=3Up+GZP^jLki;=X0Ep~Y@7@z(posVrVXbavEqu-gZSfb?z*qUc)sh^Z)n0X{*{ zDEx$GJ94{`jFxH{B`oJr0ijy>NUs%$73|L#AudZA05(MaU+A3%i!kKRix2^keAf3C z0YgCM+Uf%tp#|Z0BJVda0@9yuYiq4X42}&BG)aMb=&Z{oZ|y0|K1WtcZ#f&(uKsDd zl`9q`RjBtZtThkab4UJ&#l1C)b%}3yV4Yh@{Yz19G3VcQ)2$rqt`o+dHF3`g?Hne9%=sJN01-!U-sLY+u+>2dsLiLrr=-Hs)C_52{Z$ z1z7FvQA9NAc?dRD37MWX&Xz6_T0zbFVgVZjLaR@JKxn9yXEg=L1YGRc3|lQR;*?;; zHy7{|HiUn5DVaom@0ZbWR;?2(`|wMpxY;x%K>D)XkM|9VM*-f{isboR|57jsN9`$T7U&0sHt^ z1?dr>C8{}TjPJWUf*d*UDHLpDgLY=JDnn!sboJrCD%MXl^k{o8HwBgwUKyOksngv z&C(hwqNtqxcerbr6htaLvOe6YB|{;?yci)`ZOnkK^~C^D$b;&$>IUHz6Jsc?Z)LSgph9S_=K`a(D!?foI9E`;P z^|Y2+4mg0>--((3vZuxrSYh3b*kPLE>FtU<(Pw8nXUYq(ybQNb3{P0=5w9*szu+|m;}Rx1o*d|JZ{Kyq?R^dd$JK+5TsYT|@odbc=;gs^0WXh=?+qYWIF zo&yIYNd=aW%6Dy)-Sa5KQ-3L&cB4g2hf6vPwxWLy@9!NbL&&WSA-6tK0O_T$SBCq` zz`&5VJ=IE5!{h);I-(VXYPg-BX`=(&>N5+#4TlyZ3sa-NZ@thXo5hY67qQ4Je@k)3 zQq!QDRwPZo1aSV3G!qn9;SkblFQ0CCN9B<4AR;><@HCTS-Jt>brYj=Q`GqH~wmWed6C?|U@>5+c>@7_USmq9pK zpd!{Yq$AwRDfVj7N7^)qC*Fr08yeM;UJoxKsS;bh2gGrPt2fsWCDAtNq=@zMHGFux z;DUj@aFtoF^Hu1WjrdKXN<`?R%@T9RY^NJ-&T5Z-d zrkZ)L@w49t{bq`rp;fl*IgZhb;I@8omNsjkEeM23Eu_JUUk+Q~%r$=peqr&Q;qycp z9ITKwJWJsg4SO!SRoQ^ji-5JHhEDj+ShJnC)H zG%D6o33ZZQ_|cZb#PP54J;ijr@+zuY>wcMq0M!4^<@_gZC*)L88;#Ubn&TtR0{){BfZzC-G(Ppk8BWUJc96$@K*JDJvshaHt5Rja>2mY$`e zk(QO}j{fs6;t+t|e~CzX@&ulZ#zY>7R4I8GoN<7zC+qIq0{BQ*?p$o%Rk-g;2gLXq z;d&{w{={`A!5B%1ZCif>)JAybc;#NbOe~<4cu=ZbRUJqugTR``GV$OkgAwc>_AzI` z7=IwOY0Z{wvl{I`$L?L%NXX>Ch$_UfTZ*kl(|RP-Jq8sDj7vHtez)1#!dr8E;W8ZBE6exm4r-Pwctm_*oTe% zQt8xU`bJc;2q+;5c||t^%SI$v^_{jA$vyZUy=KBH)}wqa2HyeG&jj-JFHLJY z)R!i*w2&#J!9NMaNB~Or20wPwQ1g!-a9IZp(kOyBunQkr@{oWE|A|%_YzwUyZ%YU$ zbDwxPOl^R6q!ZSd^7^4y?W5O+&TwU=%Xp(s57ibQP2WPhZD`&~9sgvlWzL@Zwg-7f zh2_4D-t8|I!PrVY%F9v{Imk;H&xKDe^w<-bl5jxv50{BcunwqmZ+$30k@|&41lH3E zGj;3mo9sE<|HT9T=z!$?MF1|uFIfE%n}V$MDA9aiZTFzZMeKvQ`Kv_mWcS*t-;5vSS^SxpiL+tFFNqO1g_`m3LXl+*`D5e0ZtMeiwixkO zKqt6oX>;rAPDDbKp@AW*^gPm1Q*RWgQ76Fn8;OcYS1ei4;EnhOr8gDtkLqQ_#weDAiz$M!Bfhm8AwsUT#wJVHaz5rZ39(i6Qq$6j&~qmGuR>!?AV94M z7_3&2CD-_4s91I9GI6eb0rcYoX1F|M>ME6QS=L(RqIu+}uaW>JaiQNyp*d>U&)QBO zNk)o>3_lV{lXi$|SYNy9hHQJ7r8nbuz#YrbH-OSsLV4!Hf(wrtzDR~Sifl~m?4z179k*n{Od)iTi*x7OHPKx|5bx)vDZjikGWY{$CpXNM>FO5)^wKGpEl5U zs#k*-_G6G^NjMG+r^qeL;}A6)o>YifdNjWuDaO>}^5m^7E1sK8_tfLBx)e)J93el; z_NRzO2JDGENjPtuc`n6G8Z*xDx5t&$n(4Z8ELX{@i23mdO7+?|FFEzPS+m=|W5BTsFXwbma4S`P&{n$lV{j(mJI;*$m7uyi^{ETZcWZK$fSxQV?>PU|ct`;7o z@SfyAoigC!ap9UBO6G;1cdlmqID6_9dxi(8IbZPpc}(zo>M@ossNJQs&Rttnfuvp3 zcPg5*ELGw>qT6aE2=Q8)npX-TuW}Urlj6^4ttk0Z1WhfH;KcCkgWKMiw^B{_>np)SjxHgY!v8jsfn=qHAiOeQqauT~mGGZ60|22s`|uRk z_sNR%r}-ssq9+PRYWlU^Iezu4jhXgiwp66#&Nc43YNj<9AR=;AAQlC;ED#ThK3isI zC$d)q&M_HXoRS-Kl>riCnK62rmdIPwhAcFrS?Q&eVI2>&E-_pGUxP~ybR4z@>0R6a zHRJ^)>dDe$BvMzS&yaF{4Pt~*h1p7ed_2^X;esK6f9C_l&A0)9{=!*EJ;@_9Tpu31)U2nU~VC`|MSIgOY< z0W{3SAWi>5-rj)flh2JGKH1s2!(Qwz)pLT+&VgCSYQA!?-_O84B~Kn~t}PRqvN0Oe zzm=XBPUX-(IDGZUzCRl5rg8{+6NfbB;vx8`R=J=XldKdqvv^_v{(oH;oED;?eR#v` zMBEW}!x>`Kbm`^@S_A^iZhsD&vdQC2>+c2$MuWx>jatr5V6Q&j5&2)EWVw9VoXc#P{?;vgx35Lb z_xOivliTMF79_B|gAR)ug4n-ueO@xSNM|fsdeMXuly5Z3@&pVpY1*xm9@?`pI)(#Q zW63nl?8*ZGr2pR9nlyll6P_H96K+ zl9bQn+z6+@%{gaL=FX%a3c!*P{LkAkgl&3N=BVuahER>wmaXVs$_3j>(4}4DsaBBi z_A2sI&2O9u#{`oDcy|6R(tm*{PTc!GKnFJNHNqrL=53y-E#0~gn#XHprd=5=U1_~k zt4d!9fq~!XFRs?_X{fb`*BIU375LQ2Aibc*G$U@tUa0f6 z+we~SSn_{Qfm|RO-lc@u4~QP`r6N#-3p|J(DY4GHz!|X6(@MoNG>yguO#MCL^Izoi zNDM{JnYz;RU4-ugIpiUag=`hJ53iI5%LMB^V_lrQg6~n-0fU)q|0w0+cP6S%1!lWc*uCCU-C^es zXIkdp8+6md9B?>3S#ddC%QIYr!3ePG~kH4 zfIn%kkiWuC?rufYMb(O7HJ<6`y*8@OA=K4)?!|!T7~*N&QX(iB9a)SwOA0YW1QK2vl}y~Y@hhUhXBkyP_4jo3$~U*PQF_G;_=tQm@CTxHgTwL^G8 z{$SMSM>XSOu+aiq6R_5U7DcS;IQxob|76HAcTbC3>*Z+Hv0HwI{NRP7B6AVe#n0ZZ z!)USEmXmhDgQ^z|$OAzd?w?v3MWDa6h2p6-ep{pr6YANU+AQ%R+ zESG5nD`a6-Z5^PFCHSe&tXz@^l%J%ved9qwmYF8$ij+e^=ek_=3^}q+=FtCr^*2-mNqf`;kgqPdD$1g2H95Hd zaXL$7Q2J@!Zq&`b@M|#&nX3nuK>N22qqE_3Q$E5t?gXWtwDTN2glDWy02N3Kadil~ zxiX9(+#v4+N^DfbqnKf6S?|(Lq;msqu)w}Jo&ftUF51anE>&>S#MeNpf|09<>D;OC zUhIWmUk;j1D67L0gca?`yu-YRc8P&e(9fuSUiWK+SBq~YtP1zt^oSkkD!a+Iiz_61 zE+Xjwb((~UtK5M87k(SalS9OlxP6NUtHruQ47#VARJGdB3~d>OR*ybr2B21$g}EPu zAMX0mgQS7yjkiF&N^s?n~JbW>8WarN{$ zd^M4knWTCqCQAX`FHfX@B*sGfd5(qlkHd*78rJh~2;!)C?yeNqHV?H=x~1I)*B4+e z8D}{s#$cXhlRTIk_4Ncx30$KouQu@!MLnaeIz7%MyYCOAIMV)=yk@%oO!ya->^v5r zCz~IxR{)|TcY$pbO+A*ewYDrHY(u|w;nVvnxFTfaUKhWkP6njP4&fgq28xpY&Bir4 zQ>l{K&hlSACKVrHS zA;qPXv98y1QAh*O&@|2K#zuH~jo)KXX0rK+W{}qqa)Ip;O(STCM356Tpqk!Bue%2)t)v2MiIL{!^a8P65>Y&|xW1L}N8f!M-#ER>V^)X8jlS zGypA4dbcpae(3)mKSdq4)1{Kvu*-PoacGI;7RY8-cEXe|M{ zwBo~2T&J1BhO;|Ije>|Wc>fuBeppFrUkb@UP@3xmdIXGCi_3)fja7Z|SP(bTtcGeM z02b-F2$2UBgQ^4&kbnafw1{GrH(>~A&`d*?FH^z!IDBwq-3<-*LV37T=?y3HZ z(=JENPr!t_=YD-b`$~mpoH5Z8l%BQw9sWvOYm&D|PqO?)uY7%OGfSVm5O7&D0apqr zpRZN*HO*UhVZY|y(+gkh&o-6e2~XzX7CQE`xyQf;R` z@O_x+QVz;EmIAKKXv3!*YyTXW7%6`!O?(#-ST{3=Q6`)PiXX35eOlpb%dIw^^s`S{ z%huvC;KO=7M)O@7?2=-CIomSa>yB&hi=@#^%rwI_(Sb z4)vGqGcWBcMUkW~4JZXnt4D{!LWsy53jO5LwaaoA37%Cw0&&he&Lq|$EC&U(+t)gQ zA^k87s3|m7Oy5FSu1fQ@v?|2W8(N|ppC_6>0}y1E*8%S~XhY7F#KLM$J|uhr@y}67 zq=t~+hzy72%HZP;1|$o3)BG;`n14Ij`SCMx?x7vKz*oxI+71wYjC!0kS%9JE8^=FG zNwdsGb+qmSR?kYnMoy!?KS{bl_XEo!@6!y`y4aBV#vsetXhtMW5(~)pM21?$%Hh`^ z{)bk~N;y zL6{8hv7|hYUO&IafbfrXz?|fRvmuJ(geC5?{SPKp=5@|-*o0f8^&qCT(yrscf-gy~ z&{YHRD-VQH4sfAqI8wfM%5iwfC?>D-Qe^`osV>bv8TmC0Hj#?agYJKc_}^M$+Ddji z^7n6#Gkb3Z1^3ylsVjZBgA%E-?tDTU^t^;Gmf^_sbZ^Uy0Cx6MGJQrw(q5V_KMuw_ z-0Iz;t*D@?UnJMcP){`Xo~4*}hN@=QwD{#pBnWy6Mq<>2nmVLXVGizn&GgvRi1Xlf zP~38Tn&?C4V4Et4t4qdEcdZ0RFo?_&hpU@IRj2+ly!2N;i`)i^nF-VRpj6*xOt`I4 zxj41jFZr^1=aa))aRJ4n+4|Y{b1g(a0Z{lOI!n8Tw9aaKfK{aPXx2kJ z3Dbj8Je4t7jm2T9}`^KY^^1n^otkiiAIM~F0XMKSY351+^w2LDsUhp-=Fk|XA|j61RMibpJr z8KSzQf`~!P3is!?t%MvUPb>P8i`4?no-1k+xGLAPC;Ved?llLQxff?eo+srhza}UB zYV%fWGHT`<`!Nbsu8+!Pcm@}2n#u3%Vao4RbejQ@?F$rEf-U}7b`)3Mz@vNvi^(6& zxN!t6+PNJl9QKuEY>h15xese@oozov`f~aC;#?f>=_g{ha!3dH`IMa;SE7TXT!yF7 zrm0G#MjB|4G9sjsMl_xD7F9-^b6j2$a=4wC06t|HTb-K+>FQXf_?ukDxsSCX(Vtp% zjQL6TT?5cVCfqCLBbSybn)3m!htaFmcLiS;t}5U8{0v(tGVp_1bCd89GOJbgZv2Jh zr;~`pmY5Og4PAWU$ei44khwZA2>r7;QhSTd&H4y1vG6;aNHC7ujSP4M=w84tWS1}w ztH$7}k=_^U_J9n6thWDIu7?dIp0?kLA%AfWTRplKoN>b1M*8_^K5BZ7^-I?Oi8W3M ze|W1qaI56#wxqeLz4eOdu!CG8`|_?KrL8z`{&Tk9;lS6~+dv=Qx7CZiS$bf^czmaA zEkaQY%<;#eb+2(hck#=XW$V$~*j`7a6DKB0D8+?t-~pI~fCc|ChLS$UmoR=GVusay&PKvM^SBN4O zFM#HHpK|%@5A0%qJGucMhw463gmt4J`A#k}jeFy#w|?)g>i&FZJF%CkGVUBFwc%iD zO>n(N2ryf{j1KUkEz(E3WAf&)Xq`WVK2=@?N6r*2Wb_D?T@yBVNWhcnTy-FpM zVd4+e99f9pjL>0;D8gfdRngrI&%u9t`fZ85G=Bki;{#dc-+{5u`+sSPiNB&m0r6nwBokoHJ*(kZ+d@oZ7bKAuo#3U!Zr5FCL>A?MF zf*}s#na6~Zgy_hPTc)M3jNlZ08+%2N`cW4yG)s(1&y#T(%sL)ymyg}hwa*J)8S&X!t~g8@)?IQ^?ho$k`FDz}6^Fn3kn46a zg;9mBX{miQX-&>L(dk2Cdy>bpm-~n8R~|x`U~-^isn3%=BK@}p(tHm=pO0OcL}Vf# z9PY9s#5C&1uK=8YG#1?t)IrmzK7av~Kb4X&b=yh9fLKri3y4L^?bO-)B^Mw2E+0Lj zJ4W)Nre4Ts)M{B{2YXqgU--(~VCts(8!5q3;8D2n*-kzscr5ebk>20KuzT(*d(Hn5 zB>k&)DI~^eZhwA_z(S%&Jh)$V&PJ?xLVZ%vZnI!8qI<)Rclz^=)l>JHHYvXW-c#lL zZ>{9J$l)7bN{Z+Q&~&Z-TQ@c29!fGdlXoiPKha>ss6uG!e2^|Dy{aSsaP1~6d z-yp43F)!{i4l4qOh4gf=j#M-$u{7u{0c*|B*`@NsYWkG>BZyreXV0%~rS?MHPsDV; z48h2Q=%g*xi0-OFv}tp2&{1P*DMgT+*px>F1RZ?!cw4`$yq_Q4^rvQ3E8y$6ez!+j zEj>YaE{lQgP(gy*xu7-YXpUYd8t|bZTleq6m2)|YG*??OU37XM0Jcr6XH26QEurLQ zlX%_3f;!UG5udP8P5GjVJp8+Et=2*>i|whusWkYx{le|vUCr!-B%iX1r(BNybY?xY ziqD-gxTYYs!>+j}d1ahl&D6T(BcgJN3 z0kGn|&LY4YK2B#qPdu;wCyjJrOCKhv$EZK6JZnWZ%7crxI=rNo#h4^90sh?hMRUi- z5eV`0?*zgLE^W-hXm+EgoaK*hfA)8ufmg;gtF*JhYZus~U^D-vOYTIlbf+p|M0I%W z?{x{Ew*CFSOrjz4uwuQt;!T!c*8caQ=GpiM0u(_73dPB!Pefh?1rj6mBu2Vf1x)FIeYT<_Q_u z_9PR58wkVQi#&Ej|Gc0vaBv58y|HJiX4?4rL*SEc8a**Cm$C=7xUp0Z1=tDZzfRAh zrGT!n4%9%od2z|+D$~JewOEiCI$p{k@E0AeZpNqVGZ#KkP$2?`!7WiT*Xx{fyo4L% zGqO5fD78LO9vQUwnfrBkEq_q*fvO<6cm%Oq`W*jk?T<8moB05gO z6>R=F^aM;=fN2l7X@#!?Yb)aorwf7rH`)G}Bh2&SRKWczK$&8c>a-W)Frh`GOai}Y zKaH6Gq??X66C0qwb1L|6<3T-8`;d)KK{gHtUv!Tz7Fbaz=v$e*p!JFPGPW`oam|gw zXMW!z2DH{ZM|( zoVPaRb71D+?xcx7tqD9&8@FxdMv0Xh?(-6soJK6BpOvbGpuo&>mXr~x zTEc?;5l(@*uECs7P+9+l&mtEQORTPpWEH*=^c+dvFpnwE24uAB^1*M~7xhqT$+eZj z(`r^|n`q;+cy-|};Um)dLMQ3JZ@hS&t#AIpV$RSNk0?fFX@rLZow>+}ChQ5mzKb)~ zYIn@g8sL(-+V{L{j9E!@q+7$Mb{EW~ zXn`VYTqn2q#6z?B=YCx}J?}*?;saH?9K>NT`myh3;yOlrw3K77*?IV2(Kb@tfyzxT zP7@|LpULl%yA>W6JfLJ)Ub#T<#;L}IMX%)@HP}-3S`p56oTg?|D)9zBxr6WwbS2&m z>pj)=Mft_aK_-E%;l5)tWH3U-ep5rkzz&aI6vV%6JxJ6|=p3_fW(QJF{o(N8iwR7)6X z`87v_Hv6qJ(QwQ*!SHQVzI21J7s)Vv5^GXw&YjxGw>|~4GA%CZx5GFh^5(``YGa=g z$21)xEnEL@cqq>By%_BsMb069Gge{@3V%Q)i8UoU_ndk8yCx`V9Siuv zjSGp!$Dr!kB+R={{J@>g1dp|XcM`IcB;Sn^xk+k{F8{PR8XyW#~B{-sR&H1 zI#7xXPkR3F?Fe337T_#HA;`Xh>x?2Z%KD_R7O5=dIB|3FQ^Mcp2m@|uCRtpmt)|S^ zWF~nT^Xmb^*sm7<_oCBZv3e{y0u955+v(oO-aQuX|gI23h~Si*5YiJ3TdM%6pw6{2e!+t-8*y z8S$Wgu#cIfI=QxEd~C(g6iuT?q*>)I)bR|%gISkp7(?knj~TqKirv@Q z60f<^we^0}`{{8q>bE}Fhg#s>+kItXSB=^R1zTZnEJQF4xP|@9Q7)Li(0A|nF>al!h``wOamYxLkZ1%bc*_~yAhbjVhG7~=<_3Lr40 z9P%XD7l?oPVcY=E6m+-~`pd;Qq*_t3uc#zNu`ls9yxq>K! zz$kgp4R5DUDYag2k;!n=Amdl)E25A1DEBq(1&S`L2TEg_2+EJ0cW~QB0eA0Bji+k6 z9r}Ryg9TVC#!VKY2emSbX!^|K1w}O!R(fs@86l+MVuxd$DoH>*oGTEvz#J z;P9)frkNI_FP>*_k_+k#bnN!twu29MXQj&A4jtRxEm_3Y0-vVGoi5ttif(CI2HA|V z=yNY`q=hWVDHI*Ut;TZUxDIs5Ek>#;qu zx_J!gh2%Ma44sJ^T-~7je@tCtbe>JLZDZSw(HM>Gq_J(=wr$(CZ8lCC+jbf|_x;*? z+q+hNWF?E)gEZS^fx~l!0+!V+K^(qNeP2oCffL2d7@CPoVy#$z1 zT=S2a<-V!vyw>TwaLJC^n4bDGPiuaHpAf>WlIACaEgb5{FQ*ijk`xC}YNZQIydiXr-xMRxqKe z6MYhU`rl5;&`%@yKnOL5sEAw4eGh49O9G!9-P_jsA%$40flo0l8V!3|VO`McLzzWp zK~9MRyAl+!+vUe={MI%Wp#<&(quSoC+& zym;2L1jCGz#Ml+q6EUAVExzD+zZ)=*-@n~So`n0_*ck!#v;4Wr+h(Z)Zolc4e=m!J&tyi~Ksxt*heWAmOBr$WNvFnP+@ z3_706loFqSZwG_ON%ua_}(`~K1DLo@BE+bBur z8RZnB;QTquGCsiA=2CcU79n}&_8}*V>87X0niXXjI5HlypvUqNw9m4#)jJvXBn?DR z#4@_P=ijfTfwl1*2i<@D*J;CUgfFJuC|8R-6x^TgBp;pGeCbBvQwamnD{^EKNEHRCr#N=d2NiM3&Ng-irhfF|HMnGnoB z@flm08*qer>8&gWnS8SxzZF#K8Zf51i~t3hdU)?M1ryfSm5ivj^;t{5uR3PI5@OCQ z4I_p?h}#)e1(D&>scl)l?(N)+&Tic%iP5IpTYMxBI}zC>)D_E{mkAdpkehZhjDsoLeSft)XqFMh0Jq zx^}d|@``XA-<3M?lrX2Gx3+*3)*qqoL()=n(;9tczfnOMjeyMUliPXHO+ZynUrI3cT#!fUZsznehSbfCw9wrq}JBTT!rR#DV+qzdbUw>z^X-Ajz(wR@Wg0 zwWfjE&qM55&thtIlb;&G8N=Duh2+;?1>OmC$lMkQZSM<_RBl*l3p+k+)e^Jfu-n)m z9YD@Ogp5U8Mh~l_t_Qc}978g{b=?v@foi50KTdW~{?2#cMBY?!PqsgUT%HUzUb>Ht z^PQE-c9O~~f%F**#R=zyaH*m$?9CVHmFL@TpeFta(&dA9luMIn6ykUiow^A@pGAEg zoiMLgT7h-(jvZ=lUq2&S!(OIcyH_tm9^H|eT3MYlD4xh9=-wI*D`bvWpSUeM*f`l0 zySTiC?`9sj!UCq?iK7j3YM68&{he^P6is+9I_?Gwn!jq}f|$4S!f`0{%ULS5Wq!3= z>aQ~B4`{arDq_h|z9W(s$U`M=nl?tCQ`S>AeHH)kT;d1g%Tm(CcoE91Bi`~85(WJv ztX5k_Ghc#F6-QVHjKM9H_19Gt9ma?$exKMQR|LkS$DWoiTcbS}?9g8SLPCMnPSZwNt9yB9tImCvPMr}t%hgoMM}*<+Rqkwuu)7;UGOyvGbuOWj_q&JpX*0g2 zqlW93Cfd6PcIz$V9z85lt_QU$wtGxxkGP7`AmUgbyBrY+?X}qHIx|47o3?vM|0~x` z@Zmyl20PJt-skn$)`HPq+el}7CQ#;=NTVwrob>KjO~;37_TB!kbQ!BE0vjv`hZ1sx(urnOste4-D_^wE|6~}x z44M|kk@_A`{#Ga6x}4BRR?|KSG;2stHqcN-P?s>q z6bMf9pWt9Hc$42Jev$wL2aKI7UWWY%X1DynK@Gni0^Iyon)&l8%zkF0wshDjhvC*7 z`rfgLKR-{DkNCkH-kDa#3(x4g1f|CJMajpPv^yutaXqC~+6iNXTda~FW->uty@l~)tk%J{=oUORZ!#+^! z`0PL=c<(+8ij{DCxzQF93-!aszOW?QWJ-Zd!oE@OOm6K+&eHnEr#3nu<4oiQGn##y z$~k$Zol$XV`8vm7!mr6Ari$58pqDG%hhHHAb=RENFuEm!Z&;#4~}D%B`y8L+PGDcOkDaI<`s#hMZ7Ia&f z(F2oM8~Sn^(bDKPc+*cO77o(f=l~BtGB3_u=oix~D$JZ3gP#Py52DuH)9938pd6gf zBxVigU3m)1w}FEK#^_tnX~iM6=U$;ovOoLy zImJ77GJ)0z*vCwCVafbl)vN$hMPMb4VFnQo*cz_t98|JmFHlt{aJPj^3vs|bVQ3yJ z1upoIW=Qw8WI#imKQueX@NCN_|L}zg7dzC$sbLYJ6TC1{QhKqVsTsayHi%pmP@$A^ zAy=<8I1udZS^%_?r1Y1=ujZ{3zxUC4%(PclujB`z9SZ#+Z}TSo{{0Y1nd-U_0{MEZEN|?CGP>e9Yx-8mZ1-@5?3-LG^o;9NJ0Q5Si zp^zFFx1C*(xQVPur~oClntATGz-M5{N*;B7^OIh|+$jv-B!0>BE($f|75Z2Y*tnl^ z+t8Zls*t5iR+(a1NzN$b%JKOF;4w;~C}{HI^Tl8BvYNG>vPb$K-YHM!G`%$7m$Bnm z8r`&lrnN$IMyByW;{ihxlxW-tv3XJu5!13T#R9q-snBpH`1z6qP0YB6_{4bfVHZ+Q z7-se4#@J2>OjwO!Oj(OVI%5nGL*rQqbSKxFI133z>c~R;atds#Hc4-63#p)}ZA}6N z%&8f-GkoP1vMUpq?sWFB#S1G+GokW0$vpxd=0R0~8cXK0$!vaFbA@&+t^u#$8qi5+ z-<^+K{2+(FD4Yd_gsA)(FGT8`{^%F;Vw^t2Z8#s_GI;DbRF$*CxF3Wz#MNTcA+R6A zjkB>Nlo+aRFrk=^$or!eOrxLlAy@{l3YPiJf%Q%`+<$tS3dKO&Gic$%@l@V%j6ILR zB)*dZ5{Y(1WHcuW`i3mmR~-RuI;CCBH~pzK>&V8E{_hS5+I*RpvnwT;?{tXS#VzYf z*Nsbz-xBPzgcz-T9yU%YG!qkwI#+aS{p`TqQ)A)e1UR=p7Za6A$E;qErYbc{JC2|y z?+a%U=y6#wuLpU5Mt(1>U!zYnkEi8t4irJ7N$&U_o1PL$|9Fv$!0(;MHk#>r?4e&w zm7Oo++A5)h_@YU|Q8Ju1rl1-Nb*OE*1H1C0S7S{{Ctu zNp}&*7pjEe;!&Qjt4892?lXmI&EK>%%+J3xEZ|1+(?W6~74q@+QNTkQ^6|aaiS_k_ z=M(ZOS+^`;{nbbqm%QfZQwwV8Zgg1Hg$pZl7o^_L@iy@0xtGor@|Y#!p%aSV(5{@u%-TLYpBm6CI`QCPd`7a)}BYlllvn!VYc-Vs#pJ*!8L|?eev=V}4h=qj5 z(2+o%oG3oMM_FS+VlH)@wMm>SrGF_CLvNd-Mb8KDl~rB(FMRC9z^%oJat7aky-GKE z1imAWrg{<6uXLQFOBUx6Vh4y1OHLsl;+sRV{Z=$=C8sLL^T)e(mYevCQmueGFCpHw z0NWem!0*>(e&^Z;q-@TQltC@9EgE0`N;Tz!x9WT<$s8cnwC+NU)wv7LU0%?^m*?-< z?xEFt;Dx4%++Pl$}Fb`*ORvb4Rru3_*1@N?kTxz>@Idej@rA zR|b)SAnt7QB7GMwJYIFz$7xgVO|@Q$!%%hy?83W`G5WIhb?2H z#WuCZItEg?>(Z_2G;Rj=Y3*_*YTmP^FN;+n85sOV{u+%OE4A=AQJrz@=7#sG_xM+-rmX3zYvyA?08u3#T_Sbwr)vZB=OBR3BLj+1duv) zMVw|!T0>p1tDa{6)_r5y)urC=3>u^wpj<&&a9rW>F(jamVyY7Sw09zDPc*jm6fkd8 zP{0yW{^dFUltVk5!q0aL)CPcZXjd!Ckvw;E;yO09$sUUBnvKt#l?Tg&PQ5`ZnJ{ZM z>{z~bigD0yX%YAyA_GOE&di0IAy;8I_M5yECctcx_JX$Ri`X-d@+_jIiCyg4hEK`4d4GW+{$*Ikf0Aa0oUN9+kHDT#p@&DOb@K3WBRsZ67b6c(02z;Xwc>Bv20=+4^Xe(`3PUWiQ!SY$$ET(RCGF| zHZ8F_!h2CHgU=J|_`0$=hv*s;A%EBVXqaOJST81Ey-$O36DDS);ScP277xcYvP2L&UqU%!kwUmQTr1dAL?0UF_;7UhA|L6~pS5B^Lkf3hg#HqDy;9&~Jv#L^ zlapSP(xe$7`F7FLiz@D>Vevjm5zKIkb?SIR$C2o&1oNxyu}F)SK-bpgta!LmA87J1z z*vjN!V2OHigQmmReg?9lqDS8&_I$GulM1|2>t`Z03~GJKQU1ajQV2#Ntk)tj4{)c1 zRLW2y7rCqk-yd>hnko9nK1zY+FOQR?s|)SzZ@M_*=19vA>z}Q^yzB7`H}GV9VWZS$ zUjz^C?$!Lfy&oCkjx&BSF$-wwGovdL)}F+lg|GnU|7E+C&#gukd@{h2U4_WrD->Kb zZA65=}( zHsrnQmHbTOAec)6S7~EX8Tb{39)TUKJ}{~XHv&eF+<~zXm_*)q%QF#i0)!J=}{A^E6pyxOwhwNvL!GlmUPb{cOUX1Gt}N*282=v z#ky5pPpR5vH34QORrBv2!@)EdN?gHhsNm5aj2;oiFzbXcPIJ6aOaroPeNHVgv$yg) z7RJI8z_$()9>M;Hy#beNs1l6L3N;N=30$z%Ka z`QnRQb{t&<#mg=2UZMRgj1%*7=CszEqnIejEu`8FpBZ5xX(kG5vevv-v%{Ae0@9Qr zsj?^=m?}&rF0Ksy3e^1H+H*gJhcx&6#@rVM36@Jz+kBiBWeZR(jn5LqgZ5oT= zSPQ-{@(I^LPhd%TIuXgE^zvU+ZUO70WJErJD@A#>Zl!~9;?;gzU3hpEkDFF=V!Z%U zeQSqMQR~%{BDrW`b(O$h^pW_!BlY#+la(Bim6Cyh{66?Cc3?R@!0kIEGgtijhs96~ zHoMyL?P0jNNk*f2jlgE2sAlo1Ev4+uiHG9t;TkfE?!qh|41&gzH4NmU!c{i@9C!!! z8`f#UpPB1#7hb(ux2LIO@sQ_MN!3(4L2DPwVgYaCiAfhAic;PG0h_(9PDN<%5m}px zLE~*zJ+EdS5@ie^eFD9WK~OW8VSMH(PqN2~rhFRJP$D8v38{hPLids%~y_@|h{YSVPU6tjGzP?S+?~^r~l{!Yd=Zezk(La5g|P!i!#E zImyauBOC6^v6F&Yv?czUFO~?#3BwWZO+Tpi; zXnu^A=a=fsP3fYCOQ!6A(uhW%^o}QoN@6WwT`&mJHZioC4H@^29V-^XVLjVM5LCth z$FnH#+ST6Ahz~W?I_E!8JAKy3{nz!HJWC!Xn#zSJ+IQ+5seu)P;YFu-cC)PpcmRpV za#Ad{G1}=~fd3=PU8WEFL?$A@tuInx}EGAK71h$VZU&e9NT~^ zkf%5GKMI7I;<562I&bi#`zBEfxf&emeAfd4d;2Pn*OPkyJ!|BBG^3EwQWAI`yvZ|0 zy&C`IjX%>y`)mnrn>%}dp6&(ySWWTc)N?|)GNTH26Dau?ho8}j%J*L?-x+%}39}Rj zs$3sJR+03cC!&9B0vE!Xe@ertSLpiihZ&Q}*;Sit z50WFyeOravJR$Z#z!SN31yFH&;U=|?l{+~)+{)RZ3{!iWBR`SWylOut&wsC}}nn5n5xA+A}~YB?>V>4B^*D96O)ov!5?k5x<$v`u;^ z^Xi;cfsE^$sg2$M?JhX;>|wp1BI3|5=9%Z)k+W%R0=s|_Jdw=F!2YJ=-x zbjc?f8`Voj{HuQ@k2YAhz(&XSjHFr0q}z$JL#n@TlL+&SSjxvJl~KG?Eg?qEpq1?LR%=4_)TEy zghJfcTd3$6M+k|M4{#?!zwo*hQBjDZUAMN2Fz`^?O-YIwT>LQnf2xKayl&X0iE3u4 zUv;cuPB3l7lp63Buec7ECi|vp6voL=+wx*(CZFe0wzs+u9~LakB6(Vn$7D}MV%Q&V zq=rYJ^wEJ`>d9gJ9`qp|VlSXIu%^+74Y5L zN<(+Rcex5mzvFco*$J&x?V_(Zf_8^(6xohwnZ%qKQbqU0B@v72FA3g2#gTj_QH(jP z`l28dw5JDWJA(TUU&p=%v>DXP3;=u;QQx^0IhDOCRo0(}dcvI!_BRVUVv^-{pnii~ zhs@dtu$9a(4LFooQbP^?Pq(fvzc4A-uovoh5y#WLW2P=~?Zgt8t^ z`F5*Et$DR#)b&6lYH%(!B%U4?|b$dO!9(R}yvIxFpRwPXpzh_&!bVD1DS)~iC zn;K&7K~=22G)uV}^ibaAI;xN|Vc=cy8RvrpnhofYyz|fyvDk-6!segA&E+Ir*R*x8 zZU;vKxpc`;A2e+^3GLFh^-Vca3PNb2F%*I#L_Q|M5C?@HNWgz!hpLVp{QO1bCUO{z zf#O&_Ad{Mu>#zn=KNf_z6iqOpBrVgTVhzL9iNkXx7d;c>B6<{0H_0ETs3=AzK3V{i zTOg4~N~Tc}{Fg05nBgx#8;9RTaAlB?iT7reu741eEQ17&p-KWi$EP}mI{gcvwoeVW z?Sw#&OZxDYBf=SJuPKNLWj!$3G3Q{NM0@HA#*nL}iEwu8{_$T4)M?%-jEN*lEO*xL zr~q}AL?Lnhg9Gsm$R1PrurY&yp zZT~)5ctE_I4pkIc-ZL@?LisHBuP62Lh3r0WIgCpm-uQeRytMQp30UZHSi^Yc??Z^?83kXr&3S<0t zNzj0W)EL!cjR2QKRfS?k;{17Q@qG!yX(7QW@Ff=>ND(<e|^;b zF7NzuaKNFr825mxEiqwcaLplBJHOt{z^V__qG*-fIA8&Z`L`m$%8mX)KtmG_vr|Vn zLLPn{me4RNk}`lh5=Qn_@t`<0*@#A4?<5idJ^9~eiLgV)@|Jh#0h^8dDW_p%2EM>> ze9NhJuLj_xaoX^)5cK^wgc7-G53}LsgQLkt_i-E?x5`#SpV9X++ zr_#~4+bV{0#`Fkw;j-}J{e%dzx35$7Tr=W3^0X3?O%w4kX^1qE1OH+w!aQdz%;>ZZ zfGH*#am}RC%!<{gWUepRP;a-6j!^kQrLYESX8Cyx-CQrx`kl!y7|=`veP*!l%aE+| z2KPp`o;OZ4rZbm!A<%tp@Nf)EPC38m9moSU-wHg`c5p869R$JjoS``mPc^COPe((O zoa=nW^!2tDSvs~q196pzjC_=&u5F8Dx+QvBa$>tcWk{~b>*CrVs$qI9?xXPZF{1}~ z4o{SmqVqyPBxk33&Det&Q1b}*(n&;pe-`hAmFC08t4D(>nMGbF%qgz zRQ-WFsTNpBKQ<@DLcNJSi2V@TC%Srt!0!cmkTHurw=YJve@k?bmNcdE8lF7Kl4@@4E=-A?T_cT#VOtCGcL z(|w!&=mIUZz!oR{7@Yh2_XYMpsGUJ9@_Q)^c5pC2NNm;GcXgGE#i!1-Qv?yeBL1p7 z0!5qeib-dH2ZNsY54G%AA)|TAdGzw|;;LT4*-4k{_Fy@r!~z@(LN2v<9$UOD+0x%q zdB*w_VVnEiM9}>qBs-tBu;^!PCR3vugJ6F9#0NKJSasaZtfp-H^fPDH$4&3;F634G zc2G$qgcwOM0*2qU7bqAAHQ3QG3-o0^C>%Y9HK1b`v{HQBV-e9n*DlGRLPlp+8E9|> z{+`1%wwm!-I3Z`Ms3glL3JeB_ z8r4M&r`-M*WliPABiPcxX~?=FP6x z4efap+S%s2?$9Oz0?k|h#~b8zA#YsVHVWJr@V8CYAxmoHuf5rXyQj9^Voh`^$-`y! zd2$;yL?t$C!})u3UBs>1Z~GI`;oOyDfy2|6N3B50LaABElc)=6WDbmg2##G~ZlfXS zN$hzy*-&SjJPv6J(vTxTHi%!p$S`5H0UNBKg9_F+JiY$g3?Ir`nZM~K(g9!+B~JBF z!;{_~$SDk;BxH$m?%}n94_ga36#Bu-Ko_}-*x61Qx~Oy4n%1oj-Q=|l_>N>Z!A{=1{yToYpcI>Gz*J*5`;*o> zi}0z>g-d`%4pi;N+B~)SxF?J$++sVOv>b`hk7VG)F=ZgF0a%_K#t?cuXu?q2ZS=pg z{r2E{MVUqY3XmALd8dUar>e}Y;`Vz)=j6U95yi>Vo4e#u;G|A$QdCGerv zwIC%Uoo3mO_r3FVmtZ8M8pX+^-Y%?lo|A_;Jq>lEHe{-KRSRk=0r3CG@ceFH9R_;R zAegRdZ(rDfmrx)6R=owLVSq3r5#MpE@6?*l{xj#nHyWyccr{`{NE)mUGz8$)$e5g( zp;27{_yc2MI_)_IU7Di&_5F#q(x>f5pKn#LBNEnd0)%$r%>xe01oq^@Q(e~7Y()o1 z^*b)-W0#_jO+PtHueBnR|Dcr_lo?WsPuUD$c%~vHGUYId5;9#&QU0>7-Z@9_MJ;Pl-C)h*W zAy8zqo_V98RTUj-X`o>iJ=HsCuT74@m(oX?p&(X`b1e|7$Im0#m+$s+rv6dr_%{*| z00cJE=F-$KIp-e=L^bGGxxJ38u$54Fq|ifW8WE{8;GWaAqwISv0~rh z&q2>FO7uF>&rQ-IOsOhQTcjb~8Lpmxqqz--<>$e>U)NcrMr*esfQC40N38v|;ELcj z`y)8j$HPDBp zzvXPbX|fg`MR3@%b%))&k4aw!4wi~mUY44#qch++FE4(@%B(G|t~BYrcuMF{h6Q7S z8+3Y)#$tR=|6c5OB3A6~Mh~TG7P>~YQC_t{XyG$E&tnLwnfJd23kl?sNq83Z2X?=einYFx-E+SNk6~!Q>*w(qQvgung4|VKD|WJXE)x zKGiv$0dz{Osws-97^m{EKU&OS|Bv2bt;*BORFc#ynit{1Xk9aarw_BlB)}e>j zTcpCl7;V1FN@c9WsZ!rG@)CyFa`TwVW%D9=FJ6s2UXPH{|590<=zpu#!kb(#yG5?k zReq|8e!eI+V7=x6jfXajWWARccpsA?azCbmo4jy2A{;aPhO=LIrD(q#wii@(4yuiX z(r`n98>nAv3=d0nVVJ@xIAV!67{`yhgE#hkb*uCaH2o`Ytu;yQ2hT`|nnd>krZGY7 z!cp!nKnccaDhy#c$;Jd}{`fg-eh~U)P%9&DX$&7&atj&Dm4JMd^I@!HI7|dDGJT7X z?XN@AM*|$IL9b41e9}8WlSIfS-@fVQ|8A-5*E)K|vK@sx3y<*_{Zfg7SDGy}D=P`MHUoI6=E z(?^<82;HXNKfKJ6ePsNs^rNtRg8lJGVZ4gSO%1)hhd$q316h*&iP0OkoDaUT`X~Dmkg^)xPO@Nh262x7Dj4$ru|m(5l55# z?J$^=lptJ_e=GsXIc7>l8t|`w3ym4zeFH4?1F+E8fWqggxr;qI538m|dIQ~zVnH=n z?R9Y(?90z9+4v8EgR~hOU61%gndcMMEO^hALZ%-qr_!Srn|*-StRJ@^;G&MDRGTFP zkjF?72RA(nuyF(AZAx>G`7-T!Dh7joTZY2KMXE}6R3ryl;DF1nwiNtc)ZkD)+apIs zB~g&xSAuY$I3ppxFup`ZuJf%hfxigg=KvnmrB}BFWUvG|lEMV!+iAZqvG0wA!}Gvd ztd^aO<@M07O%>vD@Y@>N@R~p)?pB;Nvph#atIV;kQyw`~=iD4TOj(03Ke%ibJF8Th zfZd_-VtsmgRB1Mfn}(&ZoH7E=?Iq-+8K7HZQ0;5n$Xc>>QR&}w{W|u&zb9H<$}W8f zxtXg~G@$jrq?c;`PVUooNTGh*rSrOIeH%&VGf%It7=j+mAUuSyHnl68S zHr;OyxX{b-T^X@5bp=1H2-Ntj)UdCl$&wzmiy^|8n-|XQ%I8N(BN_daQEpJ#`a8x+ zy+8g_BW#LYlX3l~6)cNA zqUYin6GNAU75Mu(xmEQRru=0I0p?(G;|5JAvjEyu?6Ts{kq35 zj2Ij;a+ILusfJQSpBQ~e8!P@<;zG8{J7_Z)m|%O8Gs{U&VY7}FLfGM1M=(IZ#ix9gDc2@&>a*QG#hn-I7&6~R^8 za`?~FFI^G){$yBI!O_<3un{!mX+{_%c`0h(W!B*+qxW zlfX3#-g*C-rzCwXB4xeiP5h$+j#Ueh?z^5*J|zgQ$}Ni7Zw1p{E;Q88T?1q{F|%QK zN&!EFMAkx3NyPIAuO01=jpu8Vlxz~op?+tDe>B9wDHI)BB$n0&+bd#b*}75}r>ta} zC1PLXDELARgQa7G>SRNqt%U$9HyuwYz3hfa-O4tTia6s}FmCH5^PN#&UtV6|L%S0| zaSrG9;2w6dZEP@o7d34ig|0QVI^7u&2Gf3}uc+vK{1&0oe;Y7aBWzZA`ui@En5U?9 zA1N3#=c>@kEY3n((>Wk@s>h|Y#gu!Sd_h!12 z>Cz9kSD1A<06omQFOmyh5Ufgg!gC|6^^MB0e77^&4{G3z63H!~>!hh5=6t!?OFdZ?h z(@Coi5bl5qN%gHgKvwEy3o;rCDJobY;M>zwP5sk-V2nSFi|X%E0lM!67*L(F;gd!E z6PtQ0n3*`QvNcu~)nxD}sCusb+_%oE6k>Fvyoka}EEDVq4(?7kc#KrC+1Bc7W0Lf5 zBraTN$#b(Q88+J`?;FOG(1c0A=83RuCus?Ph7?);d>!<_h*@*;g{|8bpdu_TcxGT`@4LX zEo;;IWMhaN|2S~;m}y_zi{;x^B8;`57{)$YI#H2nL+umo7bP#vh^sQht$7}6xQ~^E zeV$F+_q(uaA>B{U?X&eLG>MFFpAJ<<)u=*$hq{yc#F2_y=)N&QAe&|lHH<>V6?*aY z@?07aW!X{qE``@Q z&0kTx6cFzO?HDeMiOH6&u!S>>-Nz5lTDSPD@Q}h&XxZle7uDWaf`Bs)h>8`3E(%H6wrZQjyr5QP^S&F%1zJI*$}q%%^NIRZ zM7)K#>7t$H)5>dH{PP+l?C~D}@y<7ZDV7pD zJ0|LN4BJJ+DH+SaSy8lnt(*{v?netSUSL3xkg!-%aaMLs2d~t+oQBiC^;me}w*%I5 z0a%aahMcpp*+Z?m>_Zt&BD?55f8m=T_0**hV}U|M2<#n)NH$en#lo!j(fp-Ulfmsz#4hIQh}Gmkgayo|Lq~Xo_2CW@C;fxGzhW-8 zqXxV{ZHPVi284Tx9MtuzK&yxt-)s)arqsUwsa+UNmo0v>PI$FkL`_Hu18=)SFD19E z2BXE*RRm?KZw|D&JWYNVcDyx0patVYOqA6^l(PQ}N!d*7irGr+#MMjzt@Mb|xxMo* zJH&4d{7a8ry#v549o~&gH5nUUtQ%27&5M%_RwcJHym(sc8d;nXlrg5Qv55 z%bx2{&PIEOJw?$gC41f9WO?SsI&d`FSc9@Qq*IL)QwvFc0sl~Dbv;5#dx`+@N;T%g z7E7 zRJxC)r_f%8$R`g~J!)t#0U)_hRv>nB3q2tDf8}RWqN==}~Pe*9? zfVH7w^`9V)r#@cxh}a<8{2C#3v^hvSNpLv6gYfQVidN(zzphH^2BFFMguq*?w`;8w zCMn4A*$Zbu4osT9Y-D^;FJj%cKh~V=33xjD1&XOUK&6Q()&tjPs}yR$`LjHo|5C*6 z7HAQKHMDF)d4PYN0*fMTt53UhzS4D8mx1u#G<9~~fs|y?=73c2+=_0_HY;p0n+i}S z$(k=h<7l?=t3MP#u73xAlpcJ9ii=onyO(Z227fie}-Y44MD=F9`rv_JZ?&!!r15!I!nIFrBVgcx8tPVhdFY8uhQ&Hj~fAd zy4{!oa(yrqNCqcZrlaL?Td_)pU;FfaJyK+xX9aRq#ieuF5y$fO{X{_Z>HBH1tQraVuQf7KUDPLHX%peRwaPxa;W)bCI}rc>Pttk;ByIT*Nn<|) zkTiw}*)bKFRHFl@**%$%u+{2%eTz-Y1E_U}L(zHooD4KXH1~x;F9s>8oNP2l_7bv1 z1~GDbvtkWwo2Hx_dCubmIkJxJb8^d?G77hFgsb2Y%c$1AE09Usz{Z?EWLV=@+A+8E zQzb5|Y|MqS_q38^P`L<$e^>%oEZOY$94S1=^(7+JPpW;UsQkq2*b1kvK+3WI?pGE@ ziAeo2g`7Nmk$)*5o;ZaZpyy$Pqo3H>VxIUwXdv~AE3F9FRTs8C#XG0?&)(T=n>ROFS4}s@#4*_8;=2VzpT>J|1E{6jV9o{sR>bhB$*! zf9=G)2aa{P4@r|r?{8d`+kP|S_+zeja@;zEE zt`J3O=VjzY)|dp#RbB_PWJ>twHkk?{r{=(>H`+>j_X=@>Cbq&(AfEIWe!o%SQrfol zc=ASq+W=^7$?j1$x4MO{KOR7qR(*(TvS_2U`%w2Mj@1IcIpLiKtgor)Uood_AgzpI zw%R}`?W@Be4Q1NsZtUX@wD{$^-b)Et9(Irj7&QFC{{}*bE%19MjKpmuxl)G5<$TS} zSRASiQtZk%XH1-B>?N+H9oeS|I|zL5;2zmHgz&7JBrjhaXy6YUxnxak5@v5c-tOPW zKHxjPiqt_{7W16E?0Qa>YSKik|H7|=Cc+O63X#mXki?sJQN;Fe9@phUZ=JOC6u(J} zb{`sW^{C&6X)lpVuSb7_TsEB*RjAwGSIMp?U4g@V@P& zVFR~1d3na)1;0HD9*dRa*=4)0Pa?|y?G(Lf2}D&aMSn~Z#-_ONxx<~Iy3-~S7`MQ% zF^t5R%C?vyA`91t1lS(Mj#G-s$+GCnBK@RaET){Y!Ti@VwB6|o!>)j*rXK#gRpli! zx6)Iuo5Ww+XO4q^%nqLL=)97Q@#-4E4`y-62rSYv`I?p_#ymJ6#*#G9fwgWMbo#;SP%V2%FEBd(mo6jpFYcBfelA*ptvNUbMLvctwL(u^ny=LjM~ zhR4M*hH3x}^5rm#qzVm>hly+b^-Dq>;fSl3Ek?=#ey*chn3m*u6<%7~8PIbN^2X0~ zE4@5-3IknwVXaVxfKw`}2cMH#8`yGFg_cw`N|oQG%H~DYr8=Gy$Eb^SQ3R1mOjLr? zxIl{TB1d0IMu2z-Wl{u=HSWM7%vJw>GWN6ah3FX6N0xC9AZ!2S3Xs8O(9v(Vc6Ou{ zA^T!g?Ae1uBNsxlTKex8H}$~tCwF&(>714 zqcy~b*y9hG3~+Yy2a@;mN>MMj{sUH&b42BY@z+kmaC>gw0IJG^{8?_pZrxiTv=i$O za%jn%Vip7jS}0Xs$Rm1@qhf9gS^Ay!+F}ZjBNY+H3S9#1zkR9v8$N*tC;Ss!8LBxv zhu3a!ZcdT+(V8xxDj(F3$R`!`Y`Av05z6U4uh5-Zp3t{M*Dk{<>28$W>bK9gQbO;( z?v=`$Ibl90LEZV_t*Z}3Nl=fvrr#Wo`dlxrl%&y1ie_CF50CnkW<#U@tDkNAANJll zpsJ;795z6@6a+y)LILSIq?D9&m!yE?A*7_Gq`L$J6Q|Z7LacE_Bq@u zir)9V&-;7okME!5aql&=V%DsfJu^JTkj~JQdw(m-BWi;SE#SDrR!SG!DuxCxItC?5 z<2moxDCydix4?r7naFYmMWC73MYT4BOyF-oo*u8c^9@OgNwvXbWs>gNP!>nyXPrV;{@3fBTs=(nG zF}pyMJF=OF`Q#Xi|LoOu-HXrn>nt3KjpM!$JK9@S=Iq?|XddGGh;Jh#x0SJmlBAFK zaEpo$wv|SGCT>yIO2YZA+A!{Nf4gN)|9ab?yL-jq){?JIy>{7_GWHv{>xSV(I^)DE z98T8-XA-Z8m(Wjkb3RIud=gV7*Lv@kdNe{Bs#=_?i8=z`l)`+)}- z5knjva7NKsL-G&@wo#A3C9+pIep$+brQ|A79~yarhnPlHGSIK7b8$~VY}l_bJg3g! z<-R2xL=^2wX!-S}^+} zTcO%inNYohuEill+MGRU7k2u}FmjO2`#3`U1Rt#W3ettLX?wV6;MK4~gA&L_ zVWRQ{;X_hR_B*Fff+8uLf9~h@wuf9?{)p!j4{X=rv5%0`=dohU)S%x4X*KTw+w8OAaam;Z;b?(a-kH zU06(Yas$@&Ydv~KGQ#m}sqU{oL+02b-PfdSH%RXhQGO(er}W0eC1h^5Mdi(@Ngq2( zYweDe0s)~B~l5t91j^p79y z4eUWpGH8`=Nl0WOcJI*25)Dsirf!2y5x=l&zka=5$s&unOLm33_&qMVLk}yWjmKsnR43{JlblXpqJ%la|%==unB8i78bS5qN#CMFzg_|`zldDc9onO zatnHqLL2kyy_h?cfv6I%{h}RT?1rlvBbEZnnuA=@_(NHo9K=>DniunmkWx#GGhVTm zAE4tpNYK$_A&$Sopbp_=MW4D(@f;BMkO-iHUa!4J8#;<3|CVuP`~~6QQ!lftTDgy)Z~ay|S+Vy8mZW2iP4|~W z8fCtEhh4kN2I3!Ot@F?8BOrwxUD{;3Z%SA4g?~-%^C0>9;3YCFzd~U~SGDy(pO&NL zCAHRDywB+vqY4loC_G0&X>OoU*Gxm`dF?HqR5H}Qnd^-jYW;o35Uu0o$s&%2PtCth z-lV-Zy{@6cQg)C$Hh^LEf%9$cO(|7|gZ8cVPD?{K&xGW}d#|6cNJff_hnJEk#oiy)J|*dn{Kt`HQSW61(k(rqpj~37(~*l%ab(Th3W~@L#b?^Yw((}GsAWW z&}F^t`@|BQa1|>jL+Xv}1`DIuSjltQcfhIoQA03AAs430)i5>#5)_5bz{3WwT5I~` zrFlctlX_;v{tDqKU_j2<0m9(C-og!XCkZlrO&5u8(H88X_Eh#H3g?}Tnr*Qr z5TVNz$_sZ2dy%b{WxwVh5WaaDFxN?V62;_Re#}^(Cw_7Fa}u$E%y6624z@N)z*v2t z=OZMidNX22T!gQaz#bDcUug%Q5|1)-0{AyF^KaS3liJ8n#85IW=p6;E^GrWJQJZBP z!GBxUlq5)dvzo8Hhv|;t7m?x~L?46$ksFl^I&9XM0^1_ic}(9I+a{lRs0=0K;Q>X` z_RF^l)aIrciv{lLqb`;E-&P(!{p#G^x%B}hYvcjWO9pY2AnpkP!~AecwJyJGdTJpe z1B`->NCMn%ivw~W+@CGdr8ap_MRF{UFeKPf#hDFKhnim`C`MB-FR4T;6Oe7tFl3yqwLNADQ*aL$kxEAg~x(95qme1Wi&O`wv6Q?*l0ATRNP{st>vod`V%l1gnppOicRKJBH{;Z z$#J}r%zUACjo_2rI|>MfljH)i5cBfr`}T6#Yx8S0dQ2Comi8`R|tLsO3}jZ z<@A^Q4{3n?FuL5pmec`TV1r_>`ie=Bo@;BP;vKXqb|9p8XxRXN&Uaw^kxvKJAkmEw z6KbQ!#1k4(@a^A{z4F9nQeuLHy*KX1t5a=xv7u0}*{FmSexqrfW~1z*Rg+L(eBvu@ z#?8lodbX1j%8Ko?S0bVZEM-FVvrt&eh(2ZQW)7H491r2{$ za?{KQAHIK$zNMKS314OJie7ZGk041b&Dw_sFW$>HQf^C%M-+4JO!u@sI_mZaMa%iV z7tntO-COzCTrV0Zm1oozv!#~VVr+QXcF47*o~LtT9ovAexM)%v5;k)s6kV4%-MaJG zW%RL?U4*3^)l63B)cZW~mv3&P+_WsyQ|-4Tv40{cWZK< z46t9e_=co)M3xrm`X(658Nt=>Hpf+_s7`E8j4TJ?hDhGnYYHjTwTc7Fq{|5t_grK2 zNC#2k-gz_FxtJwlbH|Hd-7E4q!S{7rAWL*4DCH1*f$OG@D`!I-k~S8WW`Pqv40fw$t!hMzJbJ`Rq2VA!G41X1+*2Zt;C*{Oo_gA~L1|A`^)y#a?n$DwYwF5(l$D>S zrIF}dHk9M!5Z}#J77Exe^y9^fE3{fb_^xf{_a3%Q$@Ga#Te@uGl3U(cW1n?xZ>HVd zM!AKp41QN8@rZ#!HqD00cAj6WfDbLbFUjM$p{ly7s?N#b2#;A)(^8l4D_3*b0MRK^ zR>^VCzb0)xt^vQwEnBK~i#I6B$hmtY$*-GeLih&N<45Pbl zWh=PGQ;`ndKBE*!Fn{%MxEcYV6j&HV_2QF%e?J?7f)C=n@5}2vck1t^0I1vD|00C2xuo9}X)Z!R~G-?c;v&NqWn6c~WfvL+ACH;mva0 z=C|n3oJ3Z7Gp@_|(=xv)x!fHY)<7+-FO zwUR|OGm^@e7f+qN{s!`uC(m`uUpDr6wekX~WS%4MMm5zzrM~TDi6@l_#U>U-BAWA*(b z#d{33oavXj@v5o_?ikh2Pjwqcqu}UsqIVlJ?z=2neMUp7uV0psKikvU= zXVmmr{)52^1hbR!#Ye6Hw_U_Va1mF)x|%DKZ*HWoI$M4P)4f!i>)^Z!0r){tkrSCcINYpaP?F*-G9=x53iyY&7mvejleLeEz;%{tj%}*`hl4eXy>tGg zFU*H`uJex~TNO#@V&_zvTzB-Ji=a&9L#g5sG>*f66Wr$goIxi`v?>Y9stEPFG?QK) zYPVm|t1tu7V9}-D1-2r{A}Yu{%%sA4mHSZq5`+3wDNqW`mA;Gi<-*-!^tvIVO}Ao_XX0S_iz3>(7Y)}kOQvli zrJj})jPUCQTYp$;!^arvP=AKzEmaX{I(^B^5r`nbqMY`2(c<*gf^L2bE~=Z zcEByrq~&jqtsUedysd*OUNVg+W|dM@9vtnIE8*(vYvF&cDVegMeS)FIJ$Rc#>X;6O|fuFI#$NjQCp7_LS|j7fK>|;3 zd7+2(I?=_9MQq>Agiw{jgF>urN2!uw2rBjbkPZ=Ar zhRYjl3_Kz+Er2V^w#M z++ikV*a5deC)qVQ*rrpW>Qh%O3+WwIBBE?CcS3{4wde3}Agr$KratQp9=4%z4IR>| z*lC>lRs`6FnMbc zDt8h$zU~m|zEzpt(yUcdaMHoUurj|LQx+R?m#;4mt8%qb3&UEP8spaZQpg>Hw<*w^ zl4^bDOa6|5uJptNE1w4>3U4V6`=i<6Arh|8_2s&5$lR&2*=~PM_Mv)Bk+3(owwR$% zW#ClXR!Ld8&etccPI4#+lrL2BY>w6k8Cj{16F6~?_I1AKiUXI7Ow&$vn-mS|tyuKp zeYEKb;++aA)|J@1NOJ3fwT^sk9%$X>{W6G$*RHb^hxVAP*RRPIxk_rT8CA#H+_B8t zg&!@*YwgVB-km!jsGPL|cGgv_9$W+xXWmRV!YkSm3WPpyB!w6yyk32{Z(#Dw4Da4d03*)#Y~<(Md4(<4vr)=0>Es_tu5i2ae&)SKj@avXVj-pre}Lv+-@b#y{k zpIQqyk-zeu{dikW_M<}y%STODb0a@m>hJ8MP@v;RO`0R710FF*H|rI!VdlyW&i#+w z$^B^WFseO8{5}q@={;N_wAi^DyD32DXsuBsARQvpm&uj-Sz5#@nA^}p86`EHdPA_v znQRCd#8<-RFB;UIFbzvkw22Fqjok#+BsvKObD zQopWCG2gyvVE3RID^xMYKYzQ0{#(%d68_P>+wCz{4r|$#0v}fL$a0m^%Plx131?!M=p2(?p}a9fjEO}~ERD$9GOu-LcC??BQ(D@M=CUIZuPXOf?ot2%?dtGYJOW0!o@R_j*}PH3sS)=Jr}`>LYv? z$0r+0H5E;p6O8%pv+nCu+Z&dF75E*op{rjmF0?NWV(~M+b%5_g679sS{Mc<<@!}(M zX$%*{3#bWVZayBQP^#}%w)s#vV&yP2Ff(a7KkWW2jwj=fQ*O2{mkp!3&pXr1w zH!CsEE-@lF67apzF`x(B7htv-!z~3II1yH#q(Z{x0YzN*uSasmm|DG8BO)R~#-PU* zjO?(GcRT3xj+2SO+_as=?Lf2}_r1d86R%z6l)FXdb!lFE1qXHuf+*Qbs`+Jne3mn- zIv_^A(L5|93Ru`l0uw6;BmSTAa^w?`F zZc$+7sm+F}H5T&lXH?PN>E_mV8ufl~Yb?fD%+eQg74 z?3gs<`|qhbScFm=Zqs2jhdDCu+(x}O^4at3PL3wfWkKLhjxNBN(T%8~5(48!BN#q( z1=r(s`lo$Gw#_Rt*CzrPOSAiiXd+U_*xlbNOi2_`8nkVuWQoYy(Ol0rRrL5eEc#_< z)my>opv5N~O4PJGp+RsuRSw*x^$aT9Ib-hH$+YlgylpclRTX)DMLCVzi_(f$potRW z0bvZu+7xB5M7?M4#oFcRZ1L|l_2}TTvH|BqJiw-Mmmg-6OD|ssUxv=VJ~^yU%lWpn zIyl;}(_TBoFd7&?rc7#zvE_*MwP}Hh@V3ZMn@dmf;xZ}z2dc@2S$Qr-h1FZF!dn9y zVkg;)aTf;Z;w`X@E}6YO-5eOF`}|RnWP35=ifNZ`BPpbmW#>8Sbas~Df@=sX*%(WT(-u< zPE@`9!+|0cOC5YW8}oFFXOY4vW8%eOCIpxc&Z5kC(@!_`uQH7iIO*!r>j}e-_0l8p zDmGDnb#1!12d%1&;I@;y)=)5TWb7SzSQLvWzWVAQ+HXHPfAe{0&h?hC#}!>0%`dNz z(d2O6)_Wrnf$xHItLgSF4f6LCwUg7?XIm@Hce@432-;QXfr(_a3tYT0@J)L8mI#`& zuAI7>@HH1BXJkiCli;^51#?&OLLOK)PU{8H4Y3J*^rSF*O9s2Zh>m`!Z(rot#kGD! zJXnu$m+R;*0_19vsh9Sb>715VMXStdaYO1W_oJ?P=wG~gMP9V0uhS1%@fo!br+?Wt z@g$+}nJr9Q#(2c`&ttDgKdDjQM_zLI>%bN%Cd<9; zyB;@tO3Lzj2-fkdvKKEs-kg0(>qW8>;4(ZG78DZZ$q+gI-Xqelg(Gsgw_Lp? zX@M(Sx6*Q>qv5C23}31$t9a5XtA+|cj-AxT{rXI*iDSPjD9kF)(4b4>d7P?T z=rsko=L{%Eo;LDvqLjXecIq)AaXGOn!j%J8zl(_7BVcx;eLw>+D@pMf4N1kC0%`o@ zEbj;kk1sTOTSn>xnf$a1v7f2xs8`~lhIi}Ha^BuSw%eAzyjQS;WMPB23l75;O;5P# z;?}w#V%T;M(LWPG8PaK@`hHx(JCIpAbUKKIws=7QbW@nZ<9X&zx(@D7^OA!8#^_ci zx;-XE7_s>BXbk;9=nCz*cZ-=muuh5cy?omhkXDCwcvZ~pt!Dk*O(SL;hW@jN-NzDU zDk_>XbDYBPVxzanuKFs?6=+=Qs7s^qW{|$|2@!d^F?Opsl7!Z4zG8Pq$Iu)GxaDCfPujHFsVy61S%w7$1(w zskUhp5l#m58^=8A@7ur07|`jY@I|{f2K_~mq{~NAYMsd(+z{aaw9SVdI1F;Z=$Dl1 za&v^@4c_GR1bGX_M815E@?a{;QE$>wKDQu;VDggk_o*jjciF?#AS$*lYH@a6S%-=6 zUVoxxfl&gM*7(iEh8o*Wbx~$QHOUeAAgN6hJK32_(qq0Gvr8F7H;OK`b6zatwmH^) zUEx5%FB@HxDpQmt$ip+Hv@}!EtYa*>8dq6w?J4kpe{S{jx~2ntuKDWHeGUS$I+Hj8 z5tKSIuaDWD>ON0HcjlhP=HE2xh~^s=Yt`mz@&U41!<_49y@gdUUVAD@} z>rS+~uh0g3qi3KFLHC@>{6-KAdFjnO<3a?*(-4FW+=sLlaG%d#Ko?MAj9#Nih(R{l?Skrdc>Mu%9ts;YGoMHpd4nXwJO4 z7Nsb*?Iqvih82ygRTn<*i+&NimK@W8&nFj`zcm}OuKrnr^V%(u*;M6ze^hbYu`T+@ zI!}i|2egbUcC?BN_qZKOm#;QRkboZ+m1SxOuB0Dj7Ku~xOWe*-8AGZh|9Y|f$@@pn zS6Lbo?+RR)4kjt*^jgSK?rRFhE9HKn$Ur>DvBs*UQ}19*Tg|)P2*v`|!fb16gszk0 zeB_)Uo_+Tz!z(y{RW@9x@(w>k8uQn@{@a8h0*kA<;j`y%3Wwi zM$kJ#jzX?2T+Yq=aStSn$YN%M_%d5$dZ3Gl?CynN+R$tyjsf$%n}}NFW4yiT7a@jK ztLqki*OnUf_s}=K(enm3+NRCf9mKDPmr3z88LoHJ#l6nj+8EP+`_;RCA8YIRTC9Nl z{&ZnfN>Z1#w2ML48!8jccNWp%mG2*2?TNVNgd6<^1C1Z6m|Rl-iyzY9o3qcMLZrr1 z6seG-bZd(aFYziJMhVeC{#EImyaCpF6lWO@g+AXYTqrTANy| zGwUh;m+LaOhaPBPVLqs*x!50qdvW1$NPoj{p4|Z+xkFKAa@uTmxv@P}xJ)hmUL>`L z0iMZ+k|(}e;80=8|bynpz?Zk&oT{(Jbx5MWSXd*F{_iYr)kWZkIk*}C7Pb@n2SaHZM znDDZwZ&VeaVjy8$sij3oAPK1+GtpB zs?PdJYo*v6p5fOeNq*s{&n|zTInb7;*q^b9ny+b#ht6Vlc1;7GCS6SN;6X!gexROG z8`F&@y7nEK9Y5d?8U`3ZAT1Tipp6Jh6^*(LoQ1?Sq?Yo@?&g3cRLyIVtey6H+-T>AS!lN5_)o znXyc7QS*!s&CrgGm%IzT0%mIDUI7wcYAoJdzgymG;zZiP^w^x(n5Aysk9k_% z;|_G-ta;^y z95F<2vZin;@tWK^%*gw?>Zs%<=TSPadE$2CZLGNIAatLIX$2BEZ{2-`zH)8SpA0=! zXrQ-nhf0$#tAUT$(CZEg=4)RZ(jys7yV16;K4^{DN~!;|-M5QmH$$K9KHzZqHa$*1 z?ruH)+AG47NC4p^Vh3aXVXN%@Q3gvWQNSv7pwSU%@jcaY> z$9bjbx$Wbwxi%4GG%TVU_hpe(x-y?kf1r^6aLeO526FqM=k9IE7prgOappS>9`TwZ zoTWVjCk)Fg@iU-eT8tAs^=Ye*qd|TJQUWV0$Y}4`p2+B;7E;V6l~c1fmr^T6)w|Ww zNFaU@UEOkOsw+xxlA!F=7K03AbK7Mz5}_>iA50j>v(v{%Kyyv{m1OoKSIJM@*=k>Y zalJ(SDd~%7rj9YA$)IheZD65OimO~f%&};1u1R+ko1t_L^hpGM3M4l2H8LJp_6bEF zqj5~B8MkJ&h+6F{u1tJ;w^WmXQe%nuVyLnrS8JeLciRJP?|^cuDx5`pQ;ARP#0+EP zx!RdG`p}x|y4lP$*ltU!_hx6k{34P$KSRkVBr*~?io9i3Pq`eA8Eb)~QgDR2C_?iS zzw6{mn{Y0cA6R(r-@X%JFYPN?ft(Zj0%7ZLgCqX2bRaa1#!Q1f8pb6cmPn?ta|BU} zn}T{z{({xQb-k^$Cvvhau7Ay{(eR)2JBtyw=oYg^nDKkL1KRd$`c@3aG7s8;V}4}FtqqQ6sO_|HlojLQW2fh!&8 z;&jk8j359H?eW*8A1Dr#n%<>y#96evvuG#UvrWkXa3KE2Fb=@mmOw=md!pF$;y(Z* z?F1)LdapHDu7LH=fjMpalLcwRNx&@#knn$E?~M5U-qX=5gR9^N1BMCu5zz1!Tn`H= zFfj}$ZsyoMKBqolBp9iP zo#MgGnRNjW{+zws`Hk8Czu*BTkU1Fl0MIr`{2va)?s3nr(@hE(qx1Is--O2tIN1WY zV!!*BrH^TV+Rx2PN5F4u17|Ke#GQ;`^EVDTLA4;?adrbs*iV;r=u%7r%Mhvx!$B`y zqc#B98q0fM@-~v_@(fLm-0OvQC}DzrK(k?uZf-ZUfIg|_YVTAE;rIisyhDkB^Jg^4 z4j5V+3@xAQ548LaB^mCY(R$%%qcF4%oO$1pTZfj`jXjP9!5D!gHSQBwDYIU;RrRon;mc@_@EDx}0&qr3QIg~VUKEhm}e zvPPF+522SoyIqK0?it-SDmBAv8<&uE(@$oDHToLP5T^aEeWxve#)I=Snl=ngGYE#3 z@F!X}pr>SK+<2m1a4lU9qP$IU9xzmgwy#aj{vY%WNEqCRl&)R!hNN zNbw+{@p>UbOruKSleh$$ui_YA#e2$o52f_PBFepp>&95~&Ua?R>O-96LHyv8eS9*| zpvS(jxxyK`71GxbLJ7X|u;HrOm4}TV0L2zk+-q;gwTJWa@1qHmX#`M*55OT@xuxUb zghSzJ?Yd}cm)dk`)v7-J$<&C68^Gj)kw(mkmAC;Oh08n!Q$k<>}4< z1~e3|0dNb>*o$id^ohjdQe&j?OJ|Q!c@)q9ZkO5kfd*;Iy1te>QcJ{HFrj}mHa#(? zc-W}Ic=`9ygvnG6OaoMa!_#R{OHuZ#slk{!Z)(?nvRjy`Edcr|gg1A7_7BKO-Gnf%!0^FWABBZ}CB3Sc(AI(0POg!zK zxB!QzKG#WXQTG>9gE4j9)QEq!Tfo$M0DbAfn{QwEK3V>EIUhn@YbmyV9(TY80axQm zrGqo7;v{|;P~Tq+ckwqybgna)W#9Xa5t00b5y6`O`)FptWIFF7n}0Di7*pr{mDA65 z3o|u9Urix>K=b8`-~ICcE@y?5uag+z&*KjGAjVk7IEfJ%AncwEXwQXT43`b&(a#yt zxz1qz>dJ47=<;6}5v=*YktR&0b3W4K*)OIBW9q!W!uZ*4VWuVvb4T#zm(Bn5%m2Ha z7IDv=#DIGG$3XiRvw-H;2#WX{-Cq2~yx|Sc4b(Z3-vxl-{$NADjympdv;kw|Tmb!z zYX3XFlraA(3CjME=!+XkdZ)=R^nA@Vp=WndDh0gW;Y9 z0^DEYKlyK58jOvfQxjOj^G5sM!GF>$EIsiCrrGH{G2|ZL>G@dz!2LK^eFWmMeSAVz zDbi^c3?yozzYYLQjpt(Qxz1pokqtH`=Vk!mud0Q!25K=b%XeKZn z{w|$^H9t$|{)U`ww%HD8D1U1XNdN4rV1DD;Zw&J1&fuQW^VfLC_G@Z&S`)yUpVb8a zYMQYA&&Sw1znU71sq?0W@XN$I^)ImIXS4W!m$Uuxr`Or`X*zDNSo(j+_o)=YjImsC zrT}*={eK2VkR8-Xtmg+T4#irE#M#Hd7y@O%BJqQf)50c?wVx-V{71L2NW1`4EVV%4 z)v2^9{^_)2(Mrr34=?@EeFN`+d;&lQ3Lt>eX+p8QB()Wi_LF0C660=f2ashq;FRFG z{DPcOwgV;jthlrR-t_=Ux)V@qB*Q43X6g6;9@XH#Co51P|1DV+{}xpi@ZxC+dp5a% zoU|5JqybK(UFi?U1uMK@_3#f>9L%%9%EWU?1-u?U>kO7IoBk$@vi~}_;7J9%`B_r& zucis>|9s)~^MV0vKL2xT{PS`eegX<^SP6S(zJC=IG=80_url%7Og+~bJYD`xQ20%~ zeHyP|yqpDve>F{5|L21OtR6mRYX8(4|Gb=Sr8y4p683B^|5ajS_p9N;%Ea?V1gnS7 zI)fXL*RMeVUYq`$Kb-~zSo5=>@UNx`>;HUE;QrOr{;4(oc{yWDbXMUd><{Dq7YjwO zdibZ1Fcj|e8zX|%!#{Ke^H*5E@mIgr+ouafu;yo(#lM>7f1<`eFDHF($~e4){UJd9 z#X=Fh9{$;IVP)cZBf9dd5y48fbN=c#_4a9I0c-w4X7OuH_)n$zpQ!QA%lQxr3<0cQ z`@wMkVix?Ss{M^_6@IPpVGYj@)H#yhSGr)hXX`}&>ZrRR5wDF62*y7b z8-JA#{aV$+%i(jSR{)^Fa~~FdQ^%bn3Co&JXD1BzED-#QtJ?nr|M1m3SOtHY@>|4( zY@L>{XWj)^r`Bcw;xSO;Kfe3Jg3Yf30522IEi}UG;j_+QOX$JBnE|4|x+*wpu;%|p zn!mA)e|e36UQU+8MPd_J344~t|J59T)x$ryDwyAZm5JwSf^(h0tULZUH36(PJvUWO z7aC!_oYe&XYMTFv8vmS}C2{2i*~AO6q?uA>KLq1erI9v68R)0--q%uPe+EYBzg6e4 zg8yDkYohx1YT5&Cptd&oakPMX7g$CI3Si)qDXe;iuM2bc!He`WLmCC%*#awF6ub-+VUhJNMzBAkJ;8mvrLw zUghiK-F>Wj=cA35oxSCnP)k0SwaIpe3Kxtv^`Y!*}25FW^6L-_Nlv*eqb_tN(D~da@Si?zS|l8kSTDD6ax!`7z?YvtDIS5Ib6YTb4=GJM^RZDwlR-A+a(_5f)Qq6&_CmfVk)OLoQ%WRrU)PR26a z#lCd4k1^_)Znp7XtUt;<84LYV@U8%BmGl|M$^Nu22mjIL!YT`?tc`X>R{jD1Ny|jq zp^^LA%Cye$+a1!A^$o1!L3cvvF5agN)u*@JeHiO)-JR^7>Bwv?e6!>~I+5M(#dkkB zo+ITu-p5gMBAF>@DL8T3Kh*w~OfE^v_xhyJbw9E0__&?Xy?3r&&24vWE_6%B zzD)Eas$i#2z#RTXkmIwkj;JfXl~bizl8r}wsWL_|0vnY4Y%FWU%Nh*e-DlS zXwt#`aI?hi>CU#Vd*;bb!ATu$^0D#mx2+LbqXW4*FrRzCC@HgYsPUNC;d;y5URZ~_ zxZ=IE9nu~ZtQ&{Ew*B`#Pr~Y)#5YM4R-%r zUZ*{+Q<>K}xJzZRbijTbJhFe^@{ppU$SufyW?;01-^OfZdZH?4wRhiPW$~c&II(7* zFVB50zfN`uc+B6Zanhl6bYlSamZt*twgdjw26)SQf_~tz($4?pIPqY=Bhh`XuFhs| zqN-qZbkAXBiO1o8d7M&bvpV6(bW*;#%G>9#a>RqRmFRrZao=@rynaJ&qH5=_9^YK# z!8%R^@EYrFnB3|195A;Mkxn{N>NY-4aP>Km9P;??cX+wa$xS$ZTm2C^clG8WPs@G> z&<_4nY-6t8eNJtHYu6!UD-me%`=3R1HUNtQ4k5>hK;!QE4FGN5fu!Btc+Y`kiAU_D zL*I37e!>yx^N1&OD>2o5?zBn21IZDO>{g=KT5>x8PdXG`=YZx)6OKTCaVLLg zKJ>+^PJIieVJdhtV~HpGay;g>>eP1mY*w9dV3KiAaGn!{6;%G!e_*I|b{oP0%B!k1 z4hhZ+f$)IJc>}hGhW4rV_4U!xjKidjXv-^WX~Khz!-KQJgXhD8X(ED+BZ9Lcg6AWG zX(EG-BZIRdgXbfIX`+ISqk^-dg6E@xX`+LTql2@egXg2AEs-#-ofYYcy6K4&8Hlh!k0gx><=7*@(K?h!ok0y4i^oK}6l4gvJiZ zscong2x1L_J^?{&Ku}u{#0~_t2SFS_(5E1XBM9mQf;fYqE+B|22106gEL3}|_KM=$p1PuT|0zuFq5F{7`4FN$yLC`P|Bpd{d06`)_&?pcj z8U&32L1IDB7a&L+2pSK9B!HkVL6AgHcSkAE*((qv1q6kFAgLf|8VHgOfrK^YwO!{HVj;x%li*DSI( zY`?7mnBAU%!3z9u0V5-^-vCP+#$SWMSUALAhyR8{{0-oD+`CWy{{}dx#?x)a(`)u$ z1)Y2IxVz1qot6It2h4y*MndH`KaINuK?b)Yj|kolPP|wd2UH}xeRa{y>g(+{%hC?3 z!UexVVky}3Kj7E7*!eQAg_Xo#U@iQ~@8OYxO1BwO@0jzy1Ac&0`JbR~hqm(QcIz*q-bHk1`!8TBl{*`j;v|_iloDFnx`{_4Qu^O`gN}IfcLB4Fc!( z{|*~%y8+eeRvR-qftj>Q@oPaZ7(NAR6G`DOixgl$1GgcAS4KpDpXGr8u&2bru&0>7 z(_RszZZoe1h}V2sV_iuE0BySkVO`DNf^}t!4eN^A@2?yEgXp}Wys*yn;T#mfIZ%Uf zV3G^tfNcOqn{Ww6JJ=3J`yHJ2FX)aWjoDfz$G<@rhQTo7(0`*Bt6C64~u`NM8-_a7CcP>W0AtlSEx_BoOQiGDZ?a z{YOSBf)!SG3??`w0J0O@aL5aT|3?=7L5}}v=&1`Z^>xG5XAI|^4X(a;xVEKX+75=o zv@O~T(>8z(=-Jo_3@{L{O$2{=<@@6aHnqQg`4?^e|HptH`*?070MHo@Yi^8Gh^VX@ znNJX?*QOS^ni*^*z1waN@2?>osSt}4ZN){+6<5+C033@>#7 z0)*#o+iq%rP_^;D3q9rrObmA*DG2eZjjcS=UA=8#xvvi+e*`2AJn_c_-w~kvaH&WE zsZtkU$wc>N3yjSNJW!Sh_mZ#R4g&x`SEFNqRSyraj*@Pa&@GLs-3|UsE);WhB zl>={fM(fr>Dr=7hfET+%mUXFhfuVo^Zlt6(K&~Lx`wvL8mFOzv9<=Cu@B*foMBq1M zPzJ6TDtI@MaK*I36=RSD8)O-%A)q#@5f%X5ybVxnF}>pEr`FPsfC7JlZjwO0Mz!&J z9?+>l_1}ORvoOpb;r=x2$uF>P*x7$1;g}N`&$xdUoMRCKxb20*4NW*Fe~0J4hqL>z z;AqihNY;IKEVQ8By`=W|+tCQA+y2y8!YbeKahvMNK`hqn@{YU9@oMO*`{7|d-;vDm z%25ljkh!*(%3tSrw48ude>mTZbU1dfL)uB|vb7|8SYgR`d^nB2%KzGRqq(JX!sTd3 z=Xm$Hxdm9^bvs-SB-L@>*E(Dtad+Q1VB~jw1FQ>Xy1Sn&=&i<(P8_cvE%CczKHqhz zX)8FMIr4P})=e$PT@IVwFUUz=M!>yr;R5mn)+a-14|AL&eE2S0(7bf{0tN8&sX3#A z&MK z5+C6x!ZGe`%t1`l`WO7=9Ad)%0UvnS)yO=yQ3o9(07S=^&&qucr2UblT( zGdlcMaKdu@k^fMCBr{5utu4KypHzBWHG3t*#j5X!vTRpkGNSBgbiYuTdw6N;Fj461en+WBOw*z={q4sW2EGr~)M@t^XM#bpd$#U8^sh>11O}0A=JT-6M9wW5;FzPz?Ob!2OQEJTE z@=0Xo>Nw5fK-7oh(N>?MR!e2aER@Wh)r;A=(zSU~SYlE-F+#Id#r9ViH5c)kc=vfP z9!}o7K&86v7~kj;Wl`)r$^>rWkXPh1p{bstPa0X?;yK zYQqz+PRsK9tkp(j7INm@RUU6FQp{OtEe*9-F3qlq8zAv57j*?@|H*AJK9CdzIZf;Ds$1g(%5k7mB+EW zCe&=;UblGQG1(GT*NncNDltK_`I1!jQnRMHfsXyKM58us+t&+GYFpJ|?5!_m4+$b` zX!>KJYRpS(5DfB-Gwm+N*&nyD>Y((+KQ`yXt# zIZLx?x+9byRebfpaB#Y8pG5BaEZJf4E7_}C>#4GA!lN-98u!{qrS38xQB{KtP+g$H zi?_dZHnoS^B!)VJx%GI|@dK9~Kkr!=ur?%U;C@?LY)bCEEXierkiUmhw1A9js!wR@ zTsJFI*&}B)Cuc&vTXbj7xMck98p4+rUiBi2C#VSgAExiEw$<5pkS1Wb`?t7Vtk<^F z^}UxZq|n76Vu(6iO4{I-=0?g-GBqIEyMX#$=|Ko1KeGr6ympe{He6jpX7f!Sh)R5j(d1_KUni%Rz`Isf@?x76j}!*$cHOnA;pzm3w?_ zn?unmTjvb|l}6Yg&q>D#6eEV|4tEA&-vm5f65bskwix0=B zW&p=c;fH#B8vW{{Y0Qc(rt+nP+dLPHK!o}qFz-bNw?v|EN_#L!3(WT{QC5+Tu79~) znR8D?C6j^CJA1=^gp#iKp<7zRUVM}0g@fGqy522QryFseco&?lwB$MWE}I>~ z#M+l@`Y)L`O4zD8wLz|9@-^>>`Av&L&0@Vzh^%a0a?OPYOWiYQsvh2~LC-Zp4{4l} z`@FXn?E38~6X^p9cN~qnKK=gqx*N#i;ZO}zf^nI&eRijVO0#e1j^ucTF%Ecr5s zXy0tWYTSR5+wj<`C=lx6@%Zjq#Hb#nl;;oz%r^WVZdDzaj7BNw0>;OfGcE@&cHupVqh-teM~XtisMzH zikvqu`Pd3;9c=HQabB{=Z@NgfuW>Sdd1e8hDFOG98?KRNE30EzHTkMzPlDoraODiO z9Ir`Rrdkg^+JJ!}wXEp+rCYo-ekD#}>@jGl7ar=ouVQVCWd2-UI~0$5;ZVG(WG=*R zwlrw#c{R>AjAOic(y{nD;@YH3osj}>sI8}t4;v!6`-%h66E8J{qP!f!c>K0J=9|++ z6(1CXQ93<54Ws{$tZxd=EZVkC2OTFJ+xlXg9ox2T+xcQ!9otsNwr$(??Q`${a_WED z54&ou+O_8#wbmG8&WT##8C_Td1rGIPfo!RX@16iuRBJ~WTUE-pBJ)KF38qkri*^;| z^R#=jwbA@Uqumy5tk;dVz(C~D5GpJQA7n-3p#;0SuQS~^9GGEcLgZ=dmx{X~MXYH+ z$9G4LPz&4>Lw(Yr6fuymnb7C0;!c^PS(4)!4RZ4MkwK5@_A-#j4W8pzbfGyCa!QGC z6HWwaUr1rznoF%xvy_czVmv67uc&j*5pOAR{Yn8u&08^t{ng)XSfrh-woW-_@f=RU zI%0tTFsGK+2aHQldkUxEg#zaqpbd;AU}K9Ukomngijw7Uc0XQQSX_jGC6}^ee*%+8 z`)0Z*$z<|{B4l_|2{I^%Ry9hn-)+vFHWoq!vzTNW$seK}{1Fz!ZbPj$Q+6KhK^oG= zcXt3~3$a(IzZt!7Y27N{m@rY>`ZkitNppC8KyN0FZm$pm7w&WxSi`3qfp~#{3P+7W z9{bzq1)QuZ@DO5J0cpP?_5uLnh_TYdfascSrO#S_%HRpdBjXn^IliKt)4M1pTS1;&O&zOf+|Yxn-N*3PDo<+Drjtpkau(h9EJaTj#FIVD;LXUw<#Z6r>IFu>+tD{!$m!q)nbU$OSA38+xOwZhY4 z>-^<|h&=UEc979HGiiaC<~I_CZ2t{4&rYTX@xK6cpFw#i7EelQ=oHl|2J1YkO|@!k zI2*AS>1XB>#lwn7%4pvp=Njr5s{GjMJ_1(d&Wt0?(fWcnQf*wVd3y$)ZT8L@Rw{aNDDi-ebl`$TJwYC0VkG>@-|?zM!{BZ_Je-R9+i9=`4j zz#9mk;Vy%G>CxDL>vuX?m)XF0z5TW9C{?Mc6U_f9C+=XzpuCKWQA8)b4(;bp0bW~; zX=yqnjp2unQEsm=Bv=_OqizM4J}mXQ1P4KjXk8@;HvJ3F8+|i8h(e*KXem{PI;3AP ze`gd`R>8Gq;jqOX8C!17eh&Ngh&MbUXSh$J7pF|>v>#%xBEZW6osCC5WN&A6fM>fR zQo^uH-~mx4#zqx1z9*1JI2~>5c&lG2U9Ua6+~hLpqt25*%TkuGHBe8ZFxwF>gk#%S zS+HGTtaCE9>F+31(n%=9m(8hi0T~g(-mYwP8>LW_S~Qf=>7$C!&t z3bEM-&+FBk&q7U2?qG(@$5O#ogV-HYEI(~0tL|O;Wwa{n`xA_M;wYl;XSAA>s{~a( zZ%sZ9L@I`vIMd(e^d0ERf5cP33&|{ZMl_|W*6J`OIml$pw9GJC_y8>Xrk`yYQK#HJYtUIm&4|uKD~b;Sb?}}* z)mas-<&}QWT5`apUi~>k?mWgFw2UpW8rr|SFqVlCY_5?ze{Exam7_>O=6T#@w>n$B zy+-n?8AeM+M>#J2^DY~jkf%#uM*=b7fI|G^&M0wVR(llpf)5#!zt0^z&9c)YN!iM8 zP(C!ZHc(LBz;Mj;#NRbvtv$dEodcT^HiaPdBWC9nY2X^_4*@s$TMZCc-vK9lJSC5Y z`MJc%&;GNc!EA|YA{j5Q1dki8$Vb9byI;}Xtj@0T($rh&^@0z>F;ZsB{NZE7Ktb!H zJB&*efkKnBEI2jq?b&GDsf)^*3&*t+=my)G9F#;f4>j zu_MtrqXzTro3Ct8_?Hj##kE9=33+OW%eO=hm9O^+OFP;JJsuW+{k`hQ3nSK8x=$ap zH1VOFmVXF*-L4?5iJmKH6a&M+88KtVh+sbM4t2QIpZw}J&N?y8@z6Nu?Fm_n>CY(ji+?^UPs497Oy!6<3b}l85xHYsa`ihui`9uG+bL zsc^op+`pcv)mV+8HW@EBXhP|S&|^&=$aEg$__dB@4(j1jdpbnK~OW<@uxhQ$~BdmNN|I0 zPBGqd(;Lg!l_vE-k+hwoY(444x3(E6jjOEo^01|#OtM;{zlp>@jm7;x07@UHLXO5W zL06hdZoO>Vb@pn_Ix>nyoYc4HlmphUUID!g_4na(w^vs0Oa?Z0`yyb~r3e|`IkzNi z^uv9z4Os(B^CCiEdt#a+;MrZ`vH}^*sO?)ezZ{qwYd<-=6?S1XB&0uHhI+enPgNpg zG;%enXYmi$Gng0Z__6>K!ycMOZA}q}L;X&&06`eWZXB*iOT`t>DfyK*eY)EL&>*>{ z5$TiggK;hf_`Y+sI6}<(2n3}k7VEHnVYH?~o+Brq=2F2?KexQlSYS_yQW>3)&-whZ zqgwt^l+9nGu;8aZ0LY`5yp;nO@E;+pe`V9O zr4i{E!gH)=`MT4BA0^#t4O;cSS3lqQFAJf3T@=CP-W1GozVGz*?DDp+Y1nOqKs^zy z3uhcvaMn+={t)`I?A!R@VI;Qm^~c;M&(?A_I|68+(DI1HrSlKOq;yY%jQ}>En!+EY zBUVVaMuf^ID(Hju3AOk-6^0p!%=0rIfWFi>;e)9U_HSmp^#bsIo?Rm zX|UAK4DSjTXSO?siB1Q4Eh_`cvLUKcpt>4;N%!kHFvhWP@F z3$=VrEQ~9;RqBoPQ_He}Yu~IA+aU8RJb7a_w4&E!VgdAJ4oci*yuV}ZlX9$pYwXCx zdZPC<16cO1B3>Jq#0^MrfUJH%z&N|uZEAw^SvG3kI2)!v80u1x5jZkB~>>zy{O32E$}9$ zQ1!{K#uweYl}KE-1c+XGZuEWhL$VhQvLZD!0j8@;8OsJX&ko=xr6I%DV12iiS{=xa)gHx%u`0w^f=NxjGLFl&Xt4{ z*m&sby-3g*l(5#iq5o_ivhYol`ms?YhnP=>Y0~6aFtGGMd$U<2Lp9>%wl_YF7^Bie zFFde|$%p&14ES5on2JrP?ntZ&4F|PzQnehI$kKNFn3czOZ^4kS)lz&u2405%Jevq@ zow9`GG6VE~Sc-p`PgD@y8Zp&`49GLTF2=por3r~MK3lm1g$H8?{(9!WD8#A>c_M!7 zN{eTy56p@a5O2KVi1U1`2uZHL1W<$=i>G~HisYrFaV~rMA#$bUw@3%?eB|bW7f0Wp z7f)01H#>k=Q(vZQKWDqqerVnN(&_lq~KVT;pO z+~XClO|Fpjdu%X%{~67Qj3(6la4~rr0 z!;ql~Peke9(r`dQ`FqKC*4rLl^YWkL8voSy#a8IItS%zPS7v3#cb)qeD=g3ceRB=^ z4G7;&zunS8gLYH4uHlJef(B<&cp;Z}jm9Y89^Z+-zP=}B#wzLo*yE797Gj6JGh#|< zmAu6AkdgP~H1|bTW{bECmz=8<7vgInK~=g8H<7_l%5P{CAl_EBggGX#XjEm#A<=cW(LuD;1f(04;kX$W9VD+|G(V{>q?P5lM zbd&JDP87{M@Nb^-$r~fncHXp_BPFZh9MhF!e4Z>%4skTewZ%4rR0G7pC0FT*^P3Vo z4*-|J?&gXH-%5-rLBV8Ha$396l%LoakuxvhO%wW7SgDh3R3f+jIEoQ$?3ev+vI35+ zd!2}e@64Ntn`fn=*d?@Y2ilQ>$;L2Ihz@%t$%zk;i(;xv#NXqe?1bK2{vO0!9PK?E zF!Dg8b2Swq$vef+zlGNl&FD|gQ+?;V#2%~fUv!eg^SyXA{wcJ;)+`&?9YEiw=k#j_ zetFQ`JkAW`AI-@Pi>2;GNw~nki0Zf<1pgBiKfL)IHhOZdw>?ZJSKJ;>;sG@)hr6Y5 zc$6}`+`id@IUtYFE8ppIlBu`ya} zbQ8NkjD<}$>Tv<95g2`BHBv0qbclJ@NI@&-H({8NJ1S!#Qk~gkdFt`;okg46a4N}@ z3t434vc;Kf^jO4*u2HXHIMdV<$8~`;~kK6Z=m`<)5Uv- zZbyuP&?2skKK6bep;H6?7hv)g7if?1`z#-f{CI!`Y66)rGlh!|HhX`^=%w!K@# zLHLy{Z{3r0B*AcSTFW;u&e0#U`{cGoRtUfh^Z%OZ3r6o zhC6L6JhIluI6eCV&Ir3AymDlf*{v87+F37CS{kUhF3-cce}$=Y>$LP47VTjqH&jif zbc)es7?S4rxxBoRiBU?Z!sAhbI0rB{@XX3Sw3$)6_ya9k$}Tn%T%ow$^Y2b46kD+* zR|s@!ymb36Td{^>@AYn!BucZyC!HXH7yL4Cm0u63HD*2c>&_88oo zvkEek6h>=S-D5tlB|~8g+``h9w$W-_->e+C{UdQTSv7Y`8%7aW{$xhzLLe%5AQSRr zQDphyOmW0pUBr)Mjo4w z0wy=|&6;1Bc{q1TPGqoicupKV00EpT-QVHXtCAlbphxO12u-3d?h&_ww z4Z|u;>jBkNt$@)8{J-4c=Px~I;tBh`u?pF^vAI9GnTpe*B-*Kgc_-fu=LGVyd2>*& z4wdmF3!l7D1esl0nEI2%=DXa-Y|wEzIj5_XQ4UxS4B1M;1Coc|Z7j9BHM!(WGv*D_ zk)I6-@88YhoVS%pje|dK^Mp6y_{V=%CG{`Jy3x^lMnWJgy@EM!QfzEhX251iA}BwK z_VZqM4SJM{D`&Ycw~U+`FY4}a`qz#3D0}$+{d=!CeW968W9eNt;lxp5?%7)o89)G0 zi;=Y(r&4^}@Cv!>+I!;nCMAnl6r+%HT1u!+C+O47qrOq6`fI^;Bub@Qb{Y%f+fZ4AtP; zq3(c2CH{3(E)6rzBydRI(E%2YqO~L$}(0I$;kysuBm5 z6xre4A)**%+ao9>K(}ho;OxVovWH4>`M_^bo7saf{135pk0I>m4(RRF!|!r}tyGrT zN4bjG;XK9`Uv2;CFn3B>N*|5Ttfu&$hog#pHY^5q^?7gLkS|7Ir&~)DFxoDH zz;07IEeY;Una~)7j-1>ynuXf9?x)-dDqIeajkF%Z7^@+U%Fv0oENxiL$wXnmpu2<0 zR>IrpxY^3sH}gAbM|jefs?wuh-u|P|THQVkV)VxScppzL&$tNVYXX@*8HEg?!pmDS zL@I0}8ITahIa_-jl!hY29nSGbV7FCrM-|Sb|Cxr+Zk7{1&3p;obE1xabb_u!w8u?l zt$oQ5t*0nS#SRlDJSXV0j!mu!q=%Qh{u+90VNfHViM=v-I7eeUt?3tXEo2M()|~r9 z_(r4Z0PAi99%KKeQ=?8R32ps|eCl3uV8KR0Q2rK`gPK%1$TfUqx#tp379B668l#MX>4s_9cGk9R-b1s^kiDSz?^)1 zjtBapzq;z1`vD5Odofw;dU&+dz_4gK+jtNNOfq{O>@p~7lX(g1Z0E4)szYA)MV~iF z*(zTSizltA3~td2b71oxvnQu1qPrC#^?u^Hc4v5iUfZgmCl7DyDUgPK^C=3?6@uqpG-t z>V5%52t~*{Ti1%N+%Yh_q5XSKDGek|NukC`!rqi`teW4*wuY}-z{IA& z(MK6w(=URWgI_tIg{7ku^W=#H&)9OsHc4ZUw?<}C*kD9W8=@iaW~g;Rj#Vm3EP2r=5G~h zWc;8lK?e)W`Z$9^ZOS+*bM`MtO|x(wZ20S_k{kksczp_K?fN^zCp@cp)ADdWp-T(u z!dP%Mb<`n(gYqxlp)gyOGC!P9?M0qvuwdrc;Y_9}p0!!P^uXfvSR4{=!e&{L+mt|> zF`)IBRnA5?R90NILDAYS8It&)A0O%&_#O>Xcf$j|Y*ZyFR<5mc(#|P&Df!8X;UqT_ zkjb-%Iy@qg0K3YUOZMzD>*zv1ANr7PMB!`0kaM;m{z?2;;Sr24N@lw@$E>v727p=w z?j4SG?tDa<5N7%qnxx>}O6RI$=wK=*EN=W|Yz(<3Pe_gy=c> zPC-K?)p8EWL78dcgi0qQC{Op}$Cku%{HIwbYAagZ+g?;KEimGiezPCwvXf|GCR3rU z(gh(!QoIziO%v>n6>eC{=vPZDnD<4ulGQ$ZOA?0i?r?%gSF9Q6aL25Hs!j@{Dvb0q zAb27c?$11CaPV;K2wsmByyWtq#kyBup8SV~j0{2sK~LadO!Jfyr@C)7r?pIKLR~^4 zf7Gdrp)*n6E^wqX34A!#{gs)G?RL;(Tsy|Ff-8$r82CPKst8V8?VI(D{FT)Kdo?k{UhhT6<^R7Tl|kOsJIt{Epd-^SlNvg7=B9qoO<3exHZl`xHlvt_8TjQ^3b84 zn8R%~w^!o$Bl?dwoOHDvt+azV$RL@@mSj}781>SwGulOQ1u9*B?bjWNGf4u4$1XMA z4Wn1hVY0u}y?={0ikFEP7vXV3!ub3cWy36sPn z`+wBkFM_%LoedsRL*@T#0s!}mVsVFEKtL9>>TM6e)IV0X^?1 zgiBm4idIQ=0A*_jDakwD%BfU1ALo7T#dLUmy=IO;jJ!}|EUXaEyVVSl-PIR zSmucyIB+~7ER$YdZScBYeTm1Jp^-{m_fR$ZE>b0qJ}zJQtD1)69)agmZN|4A7_hRQEggzekuSrqRx9Vi3oyO>Pw}slamMZA;KJvPltt9OML^?%B=qybG62Lg@%nr%suxH&Hs| zNJE2AFt{;ee%)g4A_?&^g-4;FaSNd1EbfU76od&6gnQ!=Vo%1~)&~79QS7_IP%8G* zg6N(0dutIMOw|H%-3^!2S*R54(%@yl63kd^>mSbe2q64$f;q(H%byn@{&)Kr+=-n& zlEh*NA6lIyWm!5f2e&CR^f9jIPsoG%ATi1lDp(MkLql!X2AGB_HpWcX(>qWr=M1Ut^8g)`ZX6W zyqNPk-e5v?;74$z5|Y~A6VB;cJ#g5Qm<|vYNMn%(-9wGL_pe=k7JV{Ftx|?}HS^HL z`=k{Le-sj@x8-#mm*@P%b#IVY;WOq@aL1y`%?V+*rL9|+%MiSw6_U9pVK1hZT3M#| z3$ItUO-?mix4d zPN27$k|_NeP&I%Vhuf^2DR~jE9TU_>rI}ylQB0~#r*_FOR) zojK&NbRG=(6T#4HbI3)WXohza!VGZTd$S{xI{HSPXcWxXscV$2Fy#$(X9K1fo;g6O z8JjE~Bdh`Tl(A%F9*Eb(hZyhDZoUEcz?J?*J+KEpHgjjB0ttG(Cgb$+I@Majd~qB>UL1PVSf_## z73o`SQ%}x^*LW89&eaq$3UR}^fpaI*3NSp#2@UMmm}iB0Y4nUq>VB^6dcRY!&Z_-{ zV&CzE(jSjaT^*xJhNiACCG&C+9oagyOJyzRTpWhwnLner-Q1)}4jQN)t}w^S`9pDY zRae*<&mu_EX|JV)KW(a#+=?4~2LP0f+KWSm1k0^@1?y8|lUIN1tH<$J(JPZyw}%Y9 z`g=X}ysu=mw72W#9R0vL4wDOR|Ez5GD!NC?PvTMUx_Ux^=ExLzRyMAeOy>SEhTpEX zT(#U+iB;JhKo#`}C*|>Vw#CSWUWHef;Z%;evMhIX5hIoM-MCaouWB-R>+=>xO3>ewqsGDE$IxJ}nr^r-hb=2rxYqkEgaE=nB)qKETIyE59h4{k zrVzY^sca)v{A-I5RfOM{ov&$ya7hNESRtT|;w`1n7EWZ!O>8@?mfVi%BW(-^wP=%Z zft|k@M(5Ey$iXrD9~8SWX5TZrMXTo3{5q9L5P!fEV!dA|CnIEBI*2u9-NX}WyBk`u zT`X5yXxL^{rjrw3#j!%@5WaQF>0MudN>p-#enc`Iz!Cnxq7lizW=i=h*nE+)XDdcD=D{vK`8x zt+aoaO=YfCp^Ic4h9wbszfQoK(2yZ04DTILvrZ<)73>Y^kwWB5QDPlm0Rcv?&ZjS% zgDfLC+3+R5_Y>}>U=MYqbv`&*43xHmK)Jm%%30`_2f+vQK%_L`CX+qO?rd}uWKC7M zc2OI<`e&>JvEiu6ZZNJLDjPe)+cc5|VvIq_W26ZU1^qVaSx8gO$kt?}rJe8o>2`C0 zC}}%EsQ8V4Qn?OGi<}QPNhM<%cNZoO>#I=`ay7zTl|pTykLPzT$>SXgQB)UI-vy<9 zu+>sksdL%+Y$j`Q_!6iPWnJ@yXw)WLZ{={)FEtkziC(LhIbQeAFz8jVW^+zU8hL^I zaFWkRjtjBK;-MU!kZYG`EgFjZjoL?OaAOSh&akt=0$nA4tsbs@ zy-nC*>e33CS)v)uogAz-jCyy{M2h4@4x^epPV_yHhrpZ8D~^mKR&LLcNm&JXjR~U$ ziRH0OI)_$BS!>GtjoE<1)lhRF6JT6KRb@H5j#~QO8>Wq%>T~9@u|x8aI6J65Mq0~ z1GYT)sf_4BwDV%8^8>NfxYGYRRiy8~S)pOe^IcM55%QPcdD(GUFuPOWPWSOfyv`g1 z49Ua2>398c)=8r{_l05ep$uLFXnNkp4!5e1?vngV|m@zzv#g; zeM@O}#EcLSQ;(dZxhV9)K5CUvPp`V^lP2ZxjoN47_?r+BNwCdfT3_lJ4OAx@VmR!3 zFs?@uT08=od4@Wp9b=r|eve7Ma6Hjn zEK9C&7z2*=@65(%+=R;X-PI3Q65c(S0sivHB7{zBm80|e|IlM>pSr&M-AhlNSsEhsGUJ^yy+^S&+ zY2$ho{o82VV3pAjEX@^YwIEDGJCaFkk%{=JSX{d_1+9O`%t-(0ByJ za;!)zWh8Afqspo3VXsizz>>;_9EJ%>Vn%aV!<@g7#cU%X&We@=k391Vg&+1mO_g}< zCfvN#{Tclo&ha7XDmDgR>v3lO*Q_+?0?Vd~3pGaF@k$A$U9U|k&rm@lRw@`JDR4j@%N+*V>@05ABTCLS z{e9tpm`vPrTAng3zaIZ&Celsrz@YnDu5WTo9_NJv%rpFP1ovTYaZxGnby0M+m;EseRHQm-14q(&1&MFUed?`$j9>>-KDslpI zX}M=8$rPT`p=MFrPjc)w3P(!gn`CaM=`hEZ?0=2;6>Mz&0fls^7WUCQy-S03QdF7% z=CXiT+Qm}zo885t2R$egj*W7?snboDolj{iVvubh8E{+j9tnMxUx=0w;RCNVhQD;h zX7#@Fkua&Ajix170B!~Jat@*O$cl0UATur*#oo@`_;!RW%I7t0xweilUJJ3Tepr6Z zCd2(A8OU}SIC3D&_hS8Bm4IgC4bWh}Z5|3e_hC16+7*sA6A%ph8nG*DTW zrX*^3AeOO(zhAU65Bl!o?N4wyGs&;JX-06}P|=3y3|S5Kuk-b>8!-(ANoP%m zbBOhwir7NHFSFK}C>&I9a^2>{9r=TUte9S4xvY0X-4XSLv-A%Egc}S+jm?#E*`jJR z`=&5Dzooam5UUz+;Yi) zGmF*j?}yh|zt8#52Mg3BC}!f(xG|czKR=icR*L9OBg??LPXVL_K9HzZ z5lc_9VFT0?22HK8fBSwk&#rtU*a+}r{`2#kg7wDQWIxE}uRXH$qhR+MCLFG`j~J>X z`ERpbopf2s$eBWKHz1Re-#`9YDpuyM7Yy7#9`zKm|A0~}#e4iFg?v;$MK56SBFD*o zb<|bKjU;|+2V-%6I~IY(SmGZ%(?cfVKVp$inIh;smtI~$2E$CMd6Th>aPVV<-#3z7 zV0X)@pJU?Vk6`7)F~%Ev6QB41C;*OeP7qVVY3z%Nm36lo5_o;d{j`pnMXwdwiKlp} z84vE4kHf0TZk|Ebo5pGts*1wuhVM-&o>f1Mimb{2{i5v;;NjoO;H-Wb zHS5Mfow;uu6=9bUS)qk?Ov%Q7IGYwJLf}?47H7=R7$MoU_%e$reU7CC%D_%`C!Kng z=?2BHg2$xnKpw%3mx_KvTRzodmONaC?Bv@4C#4!Oxjoz1nI_8o;e3f& zM7_YmFc@kfei?LDQ_YwAei&2+`vT#zdmc9-nHZeWP2PYaU?0A^C9L~ ztgUO`az|`z&Uj2-1dB{Fy1$U)s|5zoNH)HnGy> z03;~CsPo?&dDt(aD|r%0SsY6aNh=i%15|!0VVfQeiB~XGPlK8XX4FE17stk9+Qf@L z)fMkD4u|8P%$PO(>daRt?m7U)SHbf?$P{!Vh*T^A0+sNp@KgUla?9|G>^7)vK4BR^ zz^g5N_ZBjLYtI;chViZMTS&x<_a7FQok!0_0(4IdS2tPzt4C7)Efb;RJkmR|%X)iZm`!K63i<{8*e@AupNj|^l+uhulW z$GS;Kgz2rAG{f*~EVNlJAezJoC-{LO*8*gNv+pXGu;Xikt1Lph3e zeX&49xSCBiN?T}P#A0anDl*Z3e`XNi58%y^B0&G)4~(qrl>+%;RQ4VauBGD^jr_t%?r#p%6Rv zs$J)xdijZS(cXfbP}Dp-yw7F!5AxB{#s0y<^3_T(-{7->-F9we2wP_~5USprs}C-5 zWCTxrGI`#sKKE7^x%qo>{SS^gggN1Pmj^=Lj8XZ*w}``gbMvQ~+Zp%=|)DxE7&WzP_%s>zj63ZRGOOV3uSX zL{vYMD(eS%_VXmG$g7} z{OLX*Q`OGC{&t>N85x(~R%E+lZBf^S>UZ1$5tNLXQSg)AH~oKCv3o#Xi$sBefDFTc zfMEWARqX#;zs~fZ`t@j49jA4wU!T-bf4oSBB{pK~cu**0=D99A6JwvSq^QGx2EbHs zT-96$S}!KTy5d_03~<^bbimFhv&A<56nNSYH)$vowdOA@o3t`-<(;DiyeV4F+ZR@s zDXwGhgg~+~;l+w3Htq_NHI(^1=NPon?cmrEN?mPaGWyKnN#^+d|UZO3-SZxeEogu`%4VreH|+CWqn*qsA5VW*3UaPr&&-(p7RcJ{MZpX>w}=ov-YRkeNsJB{-~ptG!CehDfvu z$-MzA%XofuFvnrL=QnK6pg5GmRS zPEwVR*yR_Q6|Nc2tgRM4tZN)o?|=Hb^aT&*h#;bjS+xtGZd9Bq|K<$Q zOmvjw&Vh!>CDa*b%^m_G{4pR7G$`GnGfZr16+1PS=em{L9!@GgCJIR89lB{wCO(!b zA9J?BF`j87Dwpq~F*K%^E7KKdcY3y8Zmii*7StfmBTbn_GO0MN;q8iUf24J^C@ZUH zUDuUK6=$dx<5aPX7COHEtg%XG3sk*+rk2tkWzp96L&LtRZs7m#3^u`lAJ_p00imS? z0fGO&40dw%ur_h}PugB;YQ*kw{Q9E)2j`Bzk!wIKaG)>6I|}04)z+2;;MC7?Gt+d_ z^t$;35po4N1eptdxS(`sKl;$6B928lHW$3OL^IAeBSqiWb(zw9E;8H=VvGI$qLgr$ zAR8x*1RaW89UGa4gEXK^BDP#9KE+lLF!W)HV4tNiY-<*0W5hWxuEt87WeTsLvMQ~> z-r@+WeZrrq6wC29u``ao|lnny7rqu+~Q8?`W<>h-VqsFUd2s z_@|f5u$3nzx{Ek;zp%SKq17N)em=fhHZr?5so}!~KyEqP5%SSnZ!ASV<+c9W zFL!7g@mq$Q8T7$n`TfC{?~hc6`eEpcO&I(Uz|PRwJL7t3wQp31P@h$!&pOhj?ZKS1 ziXA7BMZq!>d%<<->)cA>v+Sy~%*<uhSj6SJ13zJjq{I_YMaIgF3S&4>T-#S56;TajCdkwzF%ozDm7T{xdHR zXyL}VxY^sW%zHD2eipDE^@91Iq4Xc2^xxCm-gzJJLdZ&2BpX!nCmsiAyW#GDGX@B2b9DERgfVqk1iLn&+ha&msU0L;V>Rsz3K+F7*TDW z1@KgijRwmKe%fg!T$ko+g5lBPx1wOA&8ZpOUYndsgsyMWvAUpt;g0#EN~OCWEQP#B zYMK-SFl$p>l2zfytF6$eJ+j-+#5)mPr6{D+WF@yyp6YkIB28YmW%_QG;pj(IQ(DIF z|KhE9#}zw2-l(R$J%2f7h?iE}r=`){FZC z*?U%BL9AC9YfLRR-R3+A+N&?{R@Gq!UlsP!@pv{uBkd0SV(xcdQynV~?H>hN{uHea zr#Kx$n=T^se96T;?q2pG`z$~|BPS4e!|`+f^{M1|-lo-(C3WNH*X=#MfqI3@LYU5; z?m4}weN&eOb9OAiE41!QWJ7#@ zEj8s8C@;EqMm>=?blrh!mNf9a;BO`QB~e75<ImYpqA=6a?-GA;a@=SiKRq?OaI)iNx#7g*n-$gxy$%@In_2HdhXz|Jh(F!(XfNgOy}U?6;d?iiO@2dpa1W; zyqO<$;A=&H?4bQqYB^DGb^t9v_?5$yUl1J|dmcof-T>!cpr9ZF$Xq+Q{zzovAnL>m zAhg3s`*2L)B_5GbMDnD8sA0OxA-IPT?EkEEq>i}3Ao0IIS#Tjy!=cxSK`o$&b4L`q zp&1aKn2oxpu@(_YDZat}8wy**&LevMK_EIP2ng)I=l?a~`QO$%*$Gm%pp0+=HOMA< z(q#jnjFl_3LSeA2;l~B(1Mx-!4^Po6J%r{+Qs006(AFUS&rBAS$rRsSnsdzHNX*SJ z)3pqnvNaRt6)uX&L#4d z@yEKuvy{D@qiz;97<>Oed*?jYm05GwuX*!lx#@>xXFh*bn6Sv*wLs^~#3er6WmDGM z&AYpA$>*iXNn0xJzxe<8!U_@FpZn(;EbY8>-IY@tODj-kka4yF(;v#dwRZ1!9!JsOw)kOzBbX>fj9N1hlCyA zU#FPN%lW>D>!Au)0V5oxZQz>3!wP-)9Qj-EQcmzZZ{GsIh8~?Jv{tc%~D5)_z`* zc|)~lB6e7jtAp_RrLk?ou>qYZQ18nYiwj!xFt5pB4^PjXw#)(7fuZ)(52sgM<- zw7`v7Y2Opes)uzJT8s7N{a$~Z^xI*1PEC7Z+y{q60tt&gJ$kg|;?dnVr{65H{cRha zcZsvSuaF&!fQ8+8 zOICmIJ@H%4XOeo>(YdlK-pX`de9;(m(`dIf!&F@<*TzzdGv-^rx_y+XW%ir8H%s7= z!JfwZ#wpX@%v>}>=AYA+(z{cCY-69P1YqWEIUP)?RNqk6UL27XzrN=PMRA5itx_oL6n+2ZOvUj}pS}t(Zax>;-j3KN#yt(kz{sRcFv1usk~@kuYR@1$&d-TC5zJEN-VQl zJ%LXwAnuvPW1}luH5YO{Jy+O$WQIfd4TcGui&W;uPE?aK>bbxBBpchT?k=9YO9Unc zdl&4!XE<%2b-xcw=b5R_^HgS5f8t!|zo+Td_D41kzfZWOC>(OwsP;^JvE9e}St%dq zyWMlj`2XwB_tho0eoSUGwb5D4AK=Z%B*Kh1jf~yVH>nXAk{f|o0El6r0T{{*3@Q1^ z0Y&)*#rlZ_1)#u1*Bz$rTfzlW2~2x}Fs(qkfpI;u?&SQURBYNey7Io6$p+M|2#HRZ z2@Q-dfQAAOMk~ok%}s@n;M361?ceR7wZXERiDBMU0dOxAZb0KE4)l}N5NE2Pn}U8K z8{8B|#VJh0oX>`CAbRH*ZeZi{OXvn7y2|LLpf}LrrZBF&1~vuJTu0Z6UZEkhZn@2b zT)m-dM6Vza8t2}DyBt1gg8a O8Lk48;@Ss5f&l=&U2f|GLU1Rz1$SwJySuwX(BSS4!MbsGcXxMpcYS@n`%cciKN zVkNrQ06E|;yl$dqSJWea#XHZm`YXJW5bX~M@rUkQt9jo*CS;D0Ef>A%Vy*D8qfENM zGef6b>7d?9Q%8L{K4p6c${*>+2@kZgo$btzD$;I4Qk+R3_P6hd-s3I|^8e2UUc#zi z5Fx>lLqR}b{NEceu(3D#X9s~XI#S(?*uCwNhaRcqr=bC5Xw-baVLJV`G{n#9^sj@- zrcRgBX3LgsHw?x&?_J~?YAdAi;mXHUZFAtVPG+-tv79r`1S^mY7@V^k#`Oio91PO8 zzVNN$YS6bm;4+S0BhtWYUUghz{5}zsHu-~%H09l_2POVX4+4hERhrpvd=WzSG3`TK zHQ9Zej>0yFu>sSr{#QT#rKI{|o}*ecO(gL&bwu)y7rL6)mONxumLQo3h8uV7cN$;m zElgZg+_}R+HwI$j=E9mB&To_yzstB3D)oDZn#aE$o4+9|ir%HY@#}|NAx>6(jmP;$ za{zM*ZF=O|`0IIMtm}32iQDH?qM6V6`osSVT%`!gNeV0&w=WP7SYY5>Eg2k5jjW9R z&rha*pgUF5h{9sW_AZ}!*B$jp_Mrdm8!OReg@@iOe|eC>L4Y;RQI(-Z8lc$uQ-@k9 zS4oHZwiHcC=?^K+Z9YFN!ps!OBum^fhn?;(7=RNN6-!;a!^>m(_I6x~1KwFa@+ZtM zRO6|M9(|SQgZgWQixp<8OXo^QxUq;PUL&resdMq-$6b%({M^Cgz<@u{zdXsuw+a#{ zS@|rMnS-op$1j)$buBwYLUF$LPMjfmLc9Mo_K5sh`%{_)$%q4{b{_5nA=VCOSroPH zB~MKjsD6xr{D}EsFn)wvpZso1|ITVEP}65;505he1M2|2x&Y?-{&AA8v5>Z>LXmNz zCVk6baesVK>Ptc0K;n*juL(Un-a%B0pe!<4qMrad?ChLEJNtBd$njj$thG~dIm8A> zkWw>j1}g*N-U6nnv&F<}v6H7tchb!>(Svfb4{J+%7aY-pHiPn5VkYR7!KGDVTu15`X?Y6RPatmv_X?24!fkS zX3ZN2O%6hu)Gw@`;vgdh$h*Rc;X|Dd7=L~KxE(Ha;LKCF|8SA!lnYrd!^E<=B+R~P1*z5z-NMlbvRjqv5e9s?Fpo9w z&>B-qL)x}4+jB@rVi^qD8|?iP-W+n7V|Hdb+PON2-<6fBD2gy?x~98f#Y08_pd{J; zDu}G_LOFZVBxTU~jfB!MIG3$JH11^jgAs0%@Xw3k8DVtI(naHYHggAKh4nANT$pt* z#^ebBX2vbQDG&=q`#6k@c2Jc=LUz^^dr~{|q2$mIwu_c26jBY#!iq)jsSWX~mt7XW z&&CK&#vnBMb25D8_Qd|i@rj6YnwH9dVHhKTQk1=cIdnG|~2c|R4AuD-$=W^tmHh96;G9xs7;POA`nw^)N5e3R2+z`lVsx!1Q} zCH5i7mJTq-m8tbCqzKgJAN>uAX9S(2kRNgRnx|`fSbEh$d)Y?kMcoG+H{)3frjBWe z&5GkgJ*QJ8G?S?K66c5z=DMhDq#RmgMegc6kPXk;{E^)(2*gkN>qhyEdpmhg?~t%ppG{Y0eeVYvFKhFa8p&FuOsntZ%`$_odg=KuscQc8yT7nxho2TxedVsA z^dsB(<&DM_CYq!BxMP;yaq4M~!j9e0Am#^RD3ZLxT6Zxt?RYj_E=jZd@rKr< zoI3>>mP}d0U0DV{jfyFPhUtSEfe>ISA3h+PZ@;!Q5<=4<~;^Tg{G6 zYqUQ14%4_+go%j4)jKyn?h#pgh2b!M4#23TlVHWX*;(O&S$LKfI2XH@_~B0-YnWGq zP+QLsdo^N2V;R6j+efnH{g-^MGW*Z#(V4o8PZX-?@dY63%C!2~v~xGY60uS(AXC^} zUz&}#Egot6hlJw*Dozi1XEe!6)5}czM1;^a5$DFj3E_zXr*#Akft^4=Z*lOdlg!}fT=b<&H-dtca_BfvQ;#LfIVm%I*Xb4#TC z_|v%vf39x+vr_r|1<|Q_{${;rgRIy>LFH%RTSDLogVI!}Jj#e>z8_ z#2!j5Fguu}V54aMYrob{9khm`j<)9vM?+hN^b_yn_&d`7>tu`*`1V%1P!K;M(IN2v zkCVCB*jqT58W}k{F#PY=|Lp9f6)A36G;#k~$(Fa-ib{}bGse}a-d!-!kce&>TFH5Q zB_%mo93lkMDpvP{;o|PX!nijJ78+)WgX`xCHx~+hefJ&U6H6T2=l91h2D!J#dEi_A zBiZiSlU4N^n@@?3&!t)W`s?K^i2R+5J=aa`bVu3DNXe#0`&E6t9XMp4Fzlk_y)bb4 zmSC~m2~scX^;WVGOPiRcL~lq>_;^lM+Y7<|}#q%3I45g+{*2Ih5E z4%;~-fvC^7<}?WlAK8ci{NCT@XUogmZQBmsFYKJ&&1~K-ju?E_LOk3k?)gs@A#aaC zWqa)}jjF{+riwGlbi?yHEp~4Wj+%vZhT1pv2`{yrkBjDfO6}f1%R|p+mO;nW?G<;V z&2bhf=SF&K=l8&+m0kVPt%#F29iIujR_phob9ZH>_5kuiC?*!gT>()MEtBdz;< zqQ^**20rzWX{9aaga$e4kijZ#l{sz(qU$7YQ;)I0`*Q|A7pIGBE}plk&AWW51JFe? z^~*K&%xZ?J$b=FGPcf-G0hjYhpyMY!6){(BG5lzwyfRDZ7Jipk##DQn?XuVhiEq>V zsQqW{ig$5n3G_UkU$Z>FJ?=zx9k$1e#g+dtXb<ppBxAB(do1P0ag%gemK zI%awbY>&eiyoYkhwdZAFNx!o?WqS6Ldvd(GjAUF6Hg!`FxdJ>Wv}RHlBjiUVJ?j)gH z@wGdxsKfF35ZKJVQlA4j{ouM?2U%p}`*dv%;;wA=D&0v4^?Xk%7pZ=)#C>E)JR&V+ zZznM~YkeiV)|mqtzwfJf+-5!n3MK2*-X1a(0Bx4nMCn?316(pX#slv&HnNa(47%7? zdmr+e4+UJN1J4RvHm%*eKV2`eyV-xy(d*KXcHP%YibPmlFJlw8-aOeeLm}4) zfprmq3#bZ1zcQ?p8KAuEP_JGtf`aWWh20i+>!0e$`eV{XcruE)oXx!JXL1Oke5XgQ zpG(!?@hmFUD=WdHe~HSoSoQ(C;$-UrNw(Bm;#2Ynj1Y-}VEjv)g4emZhVqZac1$BB zytbvXy89oKXj+r_R8KN=&RHe90&^2yPm$EGKd(?J@4Pfdswd^hRlcHRZ=eZx*5jD^ z!rXeh^C8De72AVGQE3~<5WSy`HBD!vg|*~9wzM$XhArJezGtr5sJPEruSx*+vr3|_ z1Q_r%Ey;g#wQGl1)@tMA`lg1ABg321|E6wZwQ0wDJVJZlu|Jp707WNS%pS3iKTlh? z4v83?3e%Oell-YoTK1@{Mb*&50U4`Usc2mQXO=>@@hWfmmsQG@D$OZo8C7b(R!!C( zB}56)Ws{p>?;PU$|9%^FM^n2eI=SUnOtj9FbW(y*ywISH{)59~A}chd^z`TbWdh-{ z@nTin^~rjLD$v%jv#O$oU|+8@mj^2xiFmo~rkeID8#lLft~Tpt{%@L?^?7=KU!sJI z&$uoA<iJ6wXDQ_`OCKValss0P2?}Feo4^+wo8<`Jtk(V=|SXN+#hMNMkUPz_d5? zP({;CdgovDTMb`iC=BCXExq^KuvOHu-2rZlflygElZt*96qbUtDpc1%g8OPjUB34$ z|4Nc#ep19^;}?OkKS!?BAP`*f-cp}*yNZUMrK53+T*j|@5vRQ+tYM`jI`+t&83)5~ zak&HCyl+#ErnC};Bh^|ur$5(khkkBH;AHdfh@2%^_XV6bhU3-s2Sj6povzTVuHf>( zJ$ILBceoc-{Yb!8N{nW%%VHVy9-})EQyR=WY3(>5v@EDbGDYBarNrItloKG9DN#cwV9 zm@BTU|Hhj$SRS^fky7(fnQc192G+B(QW~7o7}?v&XT_!(y_X@+C@V^BKP*j^Bfi(r z-F(!B;{|Gqu|V50fS#LBq%<&6-`YslvjLzVD_k`+&Wz_%qfofgQ&cQzFmP75A8XWX z>DiIo^nx=>MF*VKxWY~J2J~~(5mY#gRI%F}4d5*Qd8Q*C2Kc9_Dj?pjdPCM6cSYkn zl5oCo^+n2;U!za}G2o~9qQq?FjEnOj$G`<5(E05AiNMU#y%5qx7uWZvVU>aPnfs=* z3+E@h3|s#c(0(Fw;?n<|y5 z6J9Ns9k(s0xwA_|dS-GEGL~=jPK7dNEVjLOaJ3gRa zteC4zGxhdQ%TlqPQ%>;seejaB70Ik??IO}CA1f>$!3wdK8*#7HF~zJNPyvW#iB}Uk z+iF+&qGs)Utk<*R)IPvn|KUwA5p;UwXk^J7x&>$#zwI`^YPIQ~(l85JY*L7~Lj^IdlcN=ZRcO>n5e?1F+7h41ncBcE$E%g-PFu5ED^ zM!%mXp9IcWkrDZ6UqXSdcABj)%W%05^X8r{^=rkbn3e>;r(9@QuaxE#g;vg%msI(^ zT}(ps^Jo`OEUxibMc5o}Zil2>W-IC~a3gKra)|_v&%GR)`n(isZ+i!kdD)%3E)`fS zdpGYj57^~pt(TMy^J|*;PMRv6=@sJxO}{cpK`$R|8q&3D;c|FzyZUbAML^hrE+GB* zn{hh)B)E)>X*TjoeWU82-gcFo*<>qWW%D-Sqzo@3W%@WDa1y@;eOPfx~lD_2mlx{lP_*aam855iBx}_yAR#6w|kdqgi#7#5x9c zP)k`VaHV|&B=cOa!d>}3(_)TX)7f*mSC#wB*Xq|1_h!$S1RO8tnsHaU@=03x+CX^bo{UDnsHuRoUyN2B0^$g>E|eqC0GGRc!IUpr`LI_y zA+-y@Hatu3qT$?B64ud!pw}adIa%5z4JLPshGw+MzTdwQZNj@2BQXA_LqvJ#r)S+h zx(=1f?A*uatV{AO-gV`3v*lIZbL^PoGF~$C;+~HmEg^pYXuNr0rtvaHI%Fm`q7UoV zL=p8Izvfjl4E!)IAXo$WpGtjTM38r&BsO>c@I%qF5%M$QGzx^1n(l{emF=*ER7yt& zU$R-rVv~>3)}u?E3-7$FKS2nAPh~0n!ABxbzuIo4Rf$+lOqce(6})y;o~MUy!sf|d%O*}f2wOETx7Uk!wm3^{&le{`w6W5Z`E%1Q=);s3UN3 z8`EbPNv3_73V|Zni$rs_rbG#){{M|&yRLi-oCj>s$ z%yAKym{+G8n_LE?hA#|DVo(W>AnW-*#H%)R)vgt4tVB74(AC>knw`_`I_m3(a9^J0 z>f^@;MFiG;``;wzIy4-!K(bK!#ExgEQ#=ndpA|~?zI%+arF;%*F3M_UGe5H&Y$s9X zzA$)9eNvr>iR4bhB5vP36z^{h!YV*qH~%xOGdBG=q6#_pIhPiGg;Y0iJ1P7*ayTG! zrUyWPo$uIM0fB*lmmdxIs|-7GxzSpFoEhsoSU5V?SH(rY$+IZS^k7l24sh>Qn~!8` zPn&BGDEX(A_rz>KAz@~n_X*yl2(&*>mU_cWR*65?Z+pQ|Sg|g&b)GT}!T(GOVn?VZ z&;yrUYY;{OqK|Q0#izCi=~e?eMIw)h=I>-H^x61TQn~~A2K`f1yotefeXfVLxQ&5^ z0(<*q$DAz{Un{hJFc~VUWlM%qONkTIBgHWqCP66f*CVOq3>c~kcmIeTIpt9_=Mi9Q zR1NdC_`$6RFi0K>Z$RGs18Y^#yzclgW&Tw?Re-?<6rVmqNQd=H=n#KV&0z4ouQhKbBUNn=+kgB`$UIS;t_@s!M#edP8 z#Hm^&ZT#A=H&MBq14r*6icPXtck?0|p%L90t-BrQH?Jt}y3I<|BI+-(V$op%)&)Wa zsI@k)?b~MJr8<=OB8$t1EQ{)jxpysgp~P#qQgk~RXWe~)kG6ZwDdVnxQb_@#1Ytab zEcL%VqxyAe0-z56ikNjEIpiU|2=Tae;O|g|@jA-fS5gPbgt@p<2hSPgoRRP5?e3<_ zALH~S#;ZpX%RK-ZQHicRrqIHU$0}9C4EBe&)haG?uT4WEg6Y}^7%4@w4I`H0m=qd9 z9yOncLvxBaoa|gJ*wS#s{s~^y4tQZzs6iQdhRM-{yxoOR9qpEK%uMguxg{SYEnKyc zVj{&b)ENZXJNX|08Kt`>S2Z>d6nm41ffc|@wsT=Q`d!@3ylTr7Js_h3n?`9H2_a|a-Wqb6%~dSJrVEg*<>gP(o2Xp7ik-WT-R@m@D#PvE9_z5;&h>>f*{lH_xkx0^DI|f=c zT7S)2Sffpe^*uhcPBsXbk^jJfm4+Hw)qvasg9C>nym|i=Lu=}Jq@|Krx1Yo5SWMuk zv)Y*@NHUr24WwmqZeDb&!x=?71|L3q#`g|+ zZWZNi6A5ZqxE4RNh}~3q>)-0nzPxcSzEqVv&sDSgc-+5ab&`MBoi7f1mwZ8HC#b%3 z`rjUO3K6Ge`U8pWQ?n=ILWd~o{gKI5w}s`0E||_&%IxCQXwV6x1$p-1CBYbc?p;Pl_NS2Pa98+p(BD)c69E~T0d9wk{5PE2D|D*l zRpBBj@LdxL-e;X?4)X9MfA@4cO$NW-iW49Q-ji3Z{gk#g-51F$-B7Mz(e@T5buL~t z2>{)=XkqQoE4*fPzJnY0Rjh0V-MG9KUbp(n#UaZT;)ri{<(;R`=2_MrhY3CdW1Q8a zMe-zF<;>h>&`)g!CJKau81~k0cc!w^(;f%fjy~d{^Pnw}=j&C5;Q3eLX1qkiizKGZ zG81{wtAV-pOGctj5yP*6xvGichuy=lX2MNZBrommY54xMT&FIoJ2R#E`e}GZRT6wb%jd(_HhKC9n#2!d zo%xFvaW7zmc^oyFP>+k&IoB5_R;=tsvbjcY2R;8k`g=l8kPWRg;~0TCQh8f|sAJt) zJatZ@OddBx&SEyYv0@S>ml^kq?)IToR>S;ijFgVm9sa|jLS7}=8f$~C&gpbwlS*b} zL?7bK??t+of$2wR-d%bPndK@4TjS=K?E%_5CC!gAGSwV8hLF|tY+G+&H$aYtA%JodbTc$zdvRaPoL%U?stCYQEiVi|r`WcA3P z<0x+$>2aqviGH(6OBF{cKU%WXwM6xp4eXdMu$%dsrI3ZOH@%3=Kq$4P)qQa{3&ke_ zxmPShZZityvn> zL{m8$H%oc(5pMJBazvyr+@eSB0v!%_UC+^If%T*+<~iX}T{*7pH%R}zUS~|L0_}Ss z5g&W`O<`VJn3L1OZF@Siu`$;le$?vTT28}NVwKi=C6qB4+I=9QGI920wWm*=c%UzRa!^2@-IKa}!1#4x{ ztbB>j(;9tKR`jTqkNr|c%`?Mu!V`s7!0laElc%;+#xF#l<};b^RN3tfw*tn%IIcx1 za+e_r`voLsyXU0fso5DVLA;gLMMqY!{AdZO+|NQ~V5iP4eWlc2M-xmFiHlZZ&vK%&K>VzW)XqX4?`IqIX~ zD6vo*AqweuJ$E>q-uv4(M#SeU{{t6hT=Hq>=KWhkc*nvc*fhR)TXKF>OFIj;jqtu$*LjFBui78eVvK!RF~LU?siQf? z3VCC_dhdWd*>bVw3fY2)S-q@cJls7cRUvkuBs=$=iPdT@JsWDE1}={-b~b$Hia0T%V&32Dl!O#$MUQ$YU~y>3hYv+tJ=qpe(lY6|5D_hrW^eO* zI1!mYQXDMq_eLW7!w%n(Qc7W^i^pI2KXy4`qVP}(Ra#tq?NKjSTwwjD_WiZMd8fmY z;2Xz}uT7)`Ml|Rf*=P>#hY#Hy?>W-4dP3gWf5*3&M)%Pc@S3#Jt>TNh{IclUh-gV4 zBKIS{GOHixMJqUO(6Zy#82Qbi_N=&nwn7tu; zv6Qc}Bvyt6QM~CqYp&%IbQ=O9VNqG>B{x%3NSvu(W>I!?co|QHeI||Ye~ymHk|=YK zDbOsFTq(Jj0!63l;T|t`vJ-0~FHBmioS5Z3Yk<-wil8hq0nFZ^ivo*=L6J(QqoB=W zrRqi}@G+n{NaGv?v!sblaSxxq5~5GF)nTOlvB%xdxWL@+G57ZgrOS0}_wg*HY~;V} z-mcTdls#KTq$s3r3nxPl3`z8*EQOPGFHuYunp2c3?6hS4Q|#z1<~lHg_bd7;*GqHh z)8LG%{s?op^B;Bn)i{)FH9%_GOM1oSq-8Qu#J9_`UyaY^kmb3ix2kSWL1j0VF(KiP zJmL5*UFjmS1q7sG*qXSJv>l}+#G%T6)4c$Sn=n6DHf2@1G%D8)RQ{RI?OBv4q|ZM| zZ+}n3ldyW@bB4a%wx|?Uwfvij!|@>2DYoL-e=#-ZNN2TtNvOX*a8a6TjE;OsTcbwo z)166HoegRlL4I9vSf9t*;sV=0)$eZwW`T7ifE}x-)Bvf|3&2bPFWKi-CWn6ql?W49 z4!bXS+q!}9l{j=M_g@|kjCx|458DJTDd6ZhvM4=Nr4>)D-+9JVeP>?tE_V5Ox;xGl zcOK{2Ey8U+hhS(}4^Mq3$gt{<`Z3ty=*QLG*Hx-4neE(4vKK&qn)aeQK5noO4Y=E3?xK?cyHR11-Qb_kNI|g+fvI8iSP97I1y4xo{PRJlMOqp zub!s#OXZ(7sgHMa+wiQcVOeXQ8oAWizDLpB38iYa-Yb+4IdGU&Gl%`IAOh?qh7&q$ zTkhdTeA}F7tp8|a%{jDU@7L&LuuPW=9%d9AQV~Bt^|boI(Br9@Cg~|dXM_LgKmW5% z?^(IhV5$dq#jCD3c2Wt%O+u}d`JPGVM*X8~?j4J}pw$feyX4s%{}Pv13F!V9Q@Ha` zK}V0YC?br?HryI2#LZX|4CCoVbb3OmuJT{DoQRwDc(qgsAl8w9?W=H3YgNWGW5_Vx zc_VFX9Pd42HElmnEU`z?zg4yDh`Bys)5{LdK;5B|>sO_x<)74TI;mE&bH*-D(saA4 zqvjUG&6}XXQ}0AGr<2=7Y>nf|A!)Afw|Ob?b=z94v|bDP+uHE}GJd|1u4)XC?}-6A z{*?CEfE~)*0R-Wge$q%ub^~ViN94Td-jz$W&mXy~Pf0JlF3dQ^Fhu?aqTz~}J75z? z`A;AhO1`8@PmWs%JerV^iSp%BDSTDtXlFW;u=D*h-zk(F%TGNmyoXWuiiX83zRoRF z;KSeyq9L*zTgqenlM3I^k1#l#Vxy7}j;LsX+c@csU33IdnqvXwZ&a@X_blt9`lx7O z0AJL?dKeEy>%#rf3|HgWy^(Cf zk#V^$D|NtTf`(V>EYPQGnE|>UZakTy%KiLMz{GxjbXe9Bq;4s!vQ`2p#@uot^G6di z<2~Zb8Se39D+`8=yRfk3jofly5hH@|v!dxDWw@d>cE;#8*DmoM3K&Qp5aO?y)uj&a zG}4c(vik2d2SHwG^`dM^1h#V64eF|hmI9AmK`-VN^J*?`;!S}v&oMG;h>L2v(}LlXv{dDq%c6fRXufn&k!GS40E+1rxD%VyNzbakbu#U*OufDnliS$! zm(T@1z1GPTkNE1(z?STKY4m&77HijVCll|SpE9NNJO0wJM9ihX_E(Zml$w&Y~lMXRj2JrN6vw_*3>Jn<*Pd&_BuPV2boJ z_z2U_0T~G+at70Q&b$nm#?VfT?Nx{$xivg%c;ab-g6`))jLi90%NkHpp(8Ifei?u% zw44pMY2Hp@+rD>LxMTL0?H{Ro2+K-j5)vv1&%)&1E^! zVV33r$FZ$k3zf=&x6DU1hlq-6{Y73pqAAXmfuBeLd?Eb68m+EFHzAxIz4VVk)zMv% zVlp9ZO{lP-XjlF2M|EH!aCQFJs|`!cIt&m;`Ijl8G6DPu3fDF;#Q+=~OVWWN`m7Og zoO5E_-|0(n0{m?Ftk4s7qVK;c;J1%CZyDY4qAB3tEJsklj#%Eg@?@T+-k|dK*F>vczyV>3mX4?DS)Y4iR4O%ivbjVNcLwrZ_+#7aFNW9Ble(CKAg?GwZC z9bBs#>O$%M!Kr&*==v_t8!fzAXbbvi+A2;}cKfEDzA_tqzKNVYQ3j$YZJVYJaJ+o$)x2mb0Nkuzq@!Fs6pA8?9Qsj0gv6z%ZQMdkD@y>4J2MH(1l4v(81r`AV32ya)0}E8F;H9&c=vx4*PW&yV0Lc(3}he@00O` ze*Wvx3rTV4!tcuPq~PX3N83f6N6B*tWyA^%ucl=WfF?dlVlUo2IP!Ia7{R)7J^B1Vo z2Qt*zcAQ{IFi@Wgb4i!%fDa#QU{c3ll1wx`<2~}vzBFB(jKk_o>SDeVUd)Phs*u3w zctLsYYE%6od8Wn89Bv@$mxiu1bUtk4yl*ro+t|g#_7q9@cb0t2h~Rl^1Jeff80$|( zMZf1Z?Jv^=>21GWt=CA+6Xsyk-^Og0PFf=3p^#se=h%A1cijRI=P4*P)3~Q_MS8kM z0HpwQ2l5kI#dq=fq^aE;Ex%F>$<4oDHL#`%Z$8!M+JaBr^`eT3!WP1<_dcvEy<(MW zM+!_Uy;(A&|3hk~Bub&0Pjd7Lnw6-(5|0ZoGNe!_7pm1+#ep{x5;`#Zp5^xCKrcS^ zZ}64D6oBft(jqnB)-Z8FE-8;R_B($^v+sw9_u~#cl3tBsjZl||>PuyCtJ)50a|>vh z6}wc<>d@dNM(Q8`wAcL2WW_-rcNw^Nk-Na4uM^QM>1qentMRuPT2Ynm(sxqD$KUNr9sFEWFb34J=PPPPBI(ByQi7KS{{Ypq! z)kO+?x~4%@qdB6bSj6Xa+Od`{XRQY}tkA*#0HR6`7<{VlG6bJI90v_Gg$;h-oU2e* z1`PH}uGlQEvyM!bO0JLyYaM)`0XiE`B>#Gk?}Mx%4=q&K+@4F1DE!~buI4&)x-!^u zpTJ|Vitq*lxGtlz@Ne5?11XfDzBt4#P$@}O7rYaxl$n1=F<&jfx<0d^>`JY~q$dM> zFbc|O0cvo?4WP0{p3X!o&J=y|U#y@al*ZKjkajoA$7)#4!@8piseI}{)o{8@8}8Q8 zFhLb+Ku|H_oI!hIKkm}0=inp8gO>Rm81!-xJF{A-`ae#$@$C2s{>f& z8|N~-qgxVe3Ev?^aEcdf*GG+UCUs*s2$h+BsP#e^;e7B@3Sa%a;ik(%EE#3T@BCde zy|U=ymGR;Of$(P#es&2dkXHViNW!;2;a=<^O32o|)CxF1+nT9;NR`}UPi5oI<(!ES zKP!CMv`&-x3yGh-fe$7b*&lA5-+QB`5ahqdHaWP07}Fwz{U!V?76u@U zzJ5Tn!V%9LO|;vCrHyv(Y#8~9`?#W4cf4CiH`F!Wu`dNVRQ;brDkb++!_;pr7KIio zZ*t{EP`~}W4|max4W@s%X_yX+2qHH_0>CdgQBsJC1T|Z;QGmS|dfrwaawr6bk^&b! zUG*@4`QDOsZ8wMTjXI6#OI7-=tXh0*ut;XN7t>J4-<1}e;y5Zdl+*E*E_>lv4HX0S z2c{$DpPvq=Rf`d*r_<^h{a9k&yO6(^&imYa-6&93NgUX{P|kGzOptl!RY}U$#)Hju>^UFr#)!@6$$h?9)OHss0z^U>rVZLpdA=tg93{35U@w z1$`Z;ZLbs&9_H8h@t%JL+BXyXHAb58@wudZr5r>F zg8!sKz8FFz9|}7G5nhp+wk5abHk=KYcpHdkM5@y6o=@`Ry!jaD_=6_52>UOIN;wb` z5Um3x!FF4>y0_=Ya@G_pB67$yfBlJ=(>fUm?*>;A_rJYr#0}(b zC>vsc_iCdhh70J8s7FS5X||u&v$$>kjFLW`ab+x;+dhQMhJ$z*onugtI(m>@2_|v4 zEV$CC<0lDdAj(t>NiSwAn66xNxM+vA>Xx4}q7~(-n z&e(l&6UC+`Y5X>P&3OO9;j#*K7AqeP`>#uho*_`^ecvo)Bm|FCc4Nbjt9**KUWbgd zmD)>gI#+v*YiH#!0@s#uRk)qu)XqmsB(3L3&!eZ;oI0Fw9M~!>Md1?J-~i>+5py=m zqXmSbG2MW$=B6Q|=?n|xMHkO6g?IV%7_~MWL`?$z5?vPAX>Ch|cc%%3cb{lF{DWzK zcT;YR3^u?jiVTi$Nm}l^p(A}kB3Vht&7DB`o8D7ygeC+Vm{oZkos*Y=BKT|BQQ87c z)fsylZ?<8ILW|U3XC_A!=KWHX+44DSy1LVQEk~lM5w>~t@{*IK51q$?=g|Z}5@Nhm zwVbO{^68yl3aMVr!`l3A-$8lgAcJ~jBz2-)_krhNWQ*=aRWvX!wEb@bDCe+pRprEW zd5sPqGuNDt9*p`L!0)jQub7Zt1>#|Af9AO;szdK}m;ZNadvYS7D(6a55)4c}N-mcY z6vgq;IOf%FuCr*>v04@jttxXWq&gPm&r#7PerYNutTvLlZ@Xe|RWe+FTEB10)6d2L z>;#A6E^`x(k$X?5#$FI^Q3!`*p?~uh^m`c0i{{QRo#bjY-4@PFRW}|=(xyFSys4t} zkNAzr|DSSik!?}5;9LrU+m5i-$orhob_Qjwd$%Uu=@C{EnejqRa^^=5pFJ}=B351N z8Q;Z*Dn*omCC5KNmiXnTiu0fbV9it580*h{{kT#f8;YsgY#J8Z4}S1~(ZcfQd`|>1X6aN(wfzIE zSM2PrN{ZV3G4;Gh_8P2oKzW@C_Mz zf()*koKNQLuiu+Io->HuKuI>Jg(+pop}Kt^tQ2(}eEo!G=(^MV7dOzs7ODLKHIR}6 zJ9k4~+*e2eyK%orjRntnuwiYP;4#1Z<7S|>^>r@o#vTMr@ZVIge3XU??$Y=rq}Z$I zVEc(n80WqC@a65^-(E+#zV$r1dw%D7_4d%SK7x6P*!{-^pRgV=HPnh$wI1>JWU?06 zJp@29g|J>`w6EKWs)=2=6syv#guBDINemI^NQ4zXvKIrQfvt)0?=GIdnRT8gO9p3l z1e{s74o|HvGT=ici1%EcWwNNeZ0{=mNw!vEz|K}G;tV0~9`Q7A*&9hc{Cuq8LMBJ&33u8-$myU;XdsaOXN#*_n`S~c@s zJe1t>eO~ZVR+SzZ?8|vTcs1GrIuZBV6{5;yP@?kzCM;s$*IHds9A;FII53PN`w%NK z$)GYXb9FPbn!}fQ3`y@D`d)KKhA6AUkVoV{=8j2bEH^ z45GBz*SRN366GtEiQsv3F+*t||A%ZBLniE>>}npft~ICgvanS)Ypu=GoGr?)oj6=J z7j>&fQ#-fj>_@gT%s;l(Zd3322(G(0pe0#i=6~_BWT3Es&(f_|J!(E8323cQu92S; zcvS3FoP0;@uEhC+2UW>V!gt#Yq`)GNS+Os#fbcI;qM2djF_M#H3WwFaVoDy94u;Yd z`vdw#`!|ykd*TDcdW?N6L2;vPT5PMt^%}TdnX3_fUmV%p-o(XN8sKE;)4#!;D!}Xp zH!(F268@aum@olZwecO?s$JCatMod=skSgcrnq?$$&N~|es*ji8Z}M>>x8!3k+I_A z1dZG(kFu{7dE2MnMvH2WIqm`jcEc2dXWCH5xmbl)2Dttz3`F|>>~=J+Bi|IW;pWl0 z4OWBHKyXDG=fmntwn-kBSAJ#b{_7xw=%e;HiO8|(_R8Ca5X(JuiFt_`s>n;OjQ?VK z6r%Ldd`J^naDu$B zU%_t~g*D*Z?qJ0Ge72f)bH;f<9Z!)<+WTC)_yYs1HhR(%I)GiFfGI%?5hR?lqj|$l zC=`MV(&>~Ro?}pAO@fl+_q_09Pke%AU;Zw;3@i+MN!t9TBhwYgx2`hZA!sQ5yZpEQ zdI;ZjRn^$ClN06I0jts~-mR!)Xw7QJ3bIFsI{J_DC}Jd#n!eY%pT~HWdZHF?ODPsX6h!i9EXszKQ zWfP0zLIk0zxZbdQjZyOSe|wg`yVRau;kbt6@%nkzL&t$+bPtT)w+lJhlb1tT;A27p zh`4YCyZg2CLTI)l`%;(s-p|VBE3z$_XgU9*GR;;+j7cp z?FW&I)WE$k=PjcqCI@kwB;;CN&W3!&o8okuM)o>rt=~{oJFgvme${T+-xJBYqGSId z27I6lDHI!(=km2%a&@}HY|h|-QRTMiP>8Hqk}Uld#My-W0`$MK(np>SohBTo8#m6r z$y$U!fTb@8#OIh@Qh5qVazj==q);ndhMy(5xA$1j3|@A(i7UO+Qm7LxpH{iG8?Ll# z$n;~~PQaY7r*sw6hBaz;0aN-CxH{j&akO!GR|N6aT*|D4j z>HbkiJphDX7%~}%cj}Kq2%a#D2ENpK4`FFlu0B{ zs~{y~_saJTO|yp^9b&hIC+`80$rTjai`daQ0mew&(;SGV3fMvd|K8HXNNh{sOL`I^ z2Lclp668c-(&A}@csMP_FyY(ZWwO-PJxfrB3=?kaZ{S{c8V}fnirVC5AW$&$Z##Yi zOF2)z_e>ROJ383ocHpI%gPNw?)2BXodh(*a&lK+jevyqZx&8`vsdAoE8nCF8^VDvt zLe^avp>(rzy6MJU7Y4S5Z)W&gre*-X(%b!oMM4OAamy}rP%THqgB^&)vjyS_PG(0HpW z-xV$2apwP3CbEck#I{kEG1`{hNyaqPmOT`VZ=|E|=S9^R2WkY4LTS5)i`9)+@m!=( zFzbw3SoNc9@DUj4{O#aQmLyW_x0bUR6l>!x_B$CAE9>DZ=|nY$B|-_~F!w9)BF20m z8$B!}k9Jk;e4;7DN@-Rrt(xh)J__>}FE9t&@k%I|xvxcWZSJ@(yjrgE*({cfP@T=C zMY)W3Y7TD?6F(+3MJ+_TvuXPG#oi$5>R^{0;&ik@Yi`47_l5DynA8JPtm0v4?|3>9 z#TF{Det+JuEez{o{oC)=os%_?x1neXDS6oSCV^#^0nFmd!v-mdMb1(spZdi6stQd1 z(G!x=#QMo{Q;)&z*b3(>JEBVyzFG+yBdy($GAc%?9?6fHu!kf)b35^#sAWHUDT{>G zSVw@>0-wM|E-LUz@ew^QTUOea>({pElK}FxoPNBHL#qOG$ z`lzQK(y7RtLBol-NC;&usz>j z7@XJ0#wglQ_Q5bLx?OXST=A+HJ1)a_=`G;jbNGLfKM!_J2Gt*+5v7IFo9uXGq<2fM z-6C7~lvMwJOkHJIT+6aO5Zs;Mf#B}$?(XjH?j*QFAh-p0g1fuBI}Gmb@+LX=B=7g^ z`MSG$)v8+6yL!9azs4L&44qNL=mxH<+LS~aneJ;IF&*`uCwPFZM3vm@1iQw2LtZ~h z9c$!{ls;CMRr!9jhLcweYwmi8bYm?Jgoy7YFAk(6F#N6@4y{NL$&5!xvZ$d znWIe@chV_UObZwP`;SOu4-$1V&NK!=BMHOr41x)W48tG$z>Lt)t4CD`hP4YXKDxmq z^|_{0O(FzE<_|W)`}+c)_?sQ^#(&IxV2wmpIW>76HHs`Uv{RWdP6)ACP^k-iWY2mW zs;8Lg$$-<4TfAZIDmjd1k!rDk>|UAc|0j_1^T3d(=%gLFzOc@Rb-gjt$X`hs2wVt? zXdCFq=ueR_6Hz1d(dvoEYheni^jpW^E81hE9QWRkvfkLafq&Cocs5`*Whe9zxM0>* z?)Fg1yY@p?L6gcC6aKJpein?|0lI^iFRy4rMgjecMrEjFPS# z*)Z&oZiDvtXN`UmI=qWmz(7&$x~6SV*Z)e?U4Mn!}=~xFn?82gV2`A>28FP_=WFH$w#1#UX5e?=P4#k)pbOqXo4z8wEKLzv2l9$XmynfVF z5l!F|UdIIt0uIcstG&fnDGFK|fx}Vx_)Wa)>a>qXsjH06%E{TGjvHTJQJ-FZ`mB=q ztrUA~s%DWDJMq>9$Qh7$vNt6>C(S?CD6uQ2%;zK)G~Yr<_KXk=Efo&wwJ;acaULGO zE$&LvP2omc6+BVnYxLlBj#v1eSRMuEwCz~`fCO5HcyN|{hDkiO7`jBPF=sG+)hOt= z*ud&XOtSN9I`nuxYOk*b+NNk_yW!+4`9i?|ra2qGh!31*@>6OrD{z{{hqJ6^h}bPP zcFkreW=k?5Uym#-MVRVOqXTi%Z3wYYZ_!Y&j_R@2QzvlOa&QrSCgeB9Nj)y?;{^P@ zBf7Z*z#bDjJ@N)gCYVCd83B=2NOZ$(ak~gfipIJ~UYpJ}KR@2kz}##qhD%Awb6%ek z7Y($YkhZr$90Pa8Tk8As8B|r~^ud$1>C9S`w-;jv_nE1MaEn?Q$6+)V0%E($9NdU2 zY^y10nU2!2lBL$PYKZ*d+pE%C5jLe&F6i`-*2=2`=wX2ZMrf-ECd5XK!zb=cxxJ>5UwEY>B^0VZ* zg~K zcnCkXGH3RaCZ^fmue1+?I0D;FF=HkaEgPS`r}#F!voZ6^cnQ~YZ%l$C3=3Cw#MzSP<5C@_U;FnrNn%V_w@?zHrE@IcopQQf#7#jX9{B zrTc%|!%9c!cI)M3sY;tge09~md?KCFLZ*qaO0Mo^=VeUVn!KJ{U2bNOuUukm<&8sI zQ8BH#)3Cb%5)jbU3@`}rD8@#hc;VOFR5_naZIKRyNS#=g;XQ@|?YGNrwu$b(sZe~! z>&^$K&2Ov)%V)xo0}UM=u{8u(ArWy>j`j<4tWCHcw-Rh%qplYhSCq8~@jiXf*9N6UMSes5RzL^}NK+*~mMU(``!O{qdVtU&)fnib{RrCw2!{ zyZ+3q5t@`ZC!Ux%sQ@q!e3K*y=qqjkI)}^-?cGCWjfjl%PHLI-tl0eZ+n%j z4!vE8rZ>ylnI6B~b)y_d4er)kAuo1tiwH2-r94LfY2-BqY>IY%UAY^dLIhTF>P$0TK(#?Y1?a=Dc2%@2E7 zIff4!HQLHZ95W1elW%9Z-Hx`|AnB}O<3Vpg=h!`@-{6+CE99cj39Q>Xo}tea@X}{< zY~gvoyY9tnnsX0*5@_$2pn)W-!}XuN62W&`a7iJ<%P8rqO8Ci>CK4Umgz7jj;2jmO zS@fTK>>XR=B|3dpj3~K3PB=*afa674B9hp1SDcw=zf^0b!TD_0l3mMg4Qmih${C&5 zvQw~B9R z5-Q(zD+3-h;S>oLD+)7Q*3Qrt)vPoc=D9eI50WeLkN2_X5ZUsvAr_vzEv%@VT>LcS z1b-Sed^VmUWj`y2T|qG`7^D)i;mAr6?D^%FB;(SzD8^F$DU>;(D+-5Ilkh4HgV&*b z0;I_}OBFq@i>~hf{Q8sppJ13clT5KMI*O)3XEKs9iKc;2n?F9XHXV7oCGOecR)5duIy;|7WhGqm zv+Kn6e1g{2dO5`+7KrYGzAiFI$SnE8o=*Y=B%Oss;Zka%gs?s0W;=V}z;}zpqF%Vk zMNZ5d{-HzUV1Edd{4YT$$bjJGU<1u6@(jBPaMn(?Dt0uVPLQO#u!iknITTt=@KAkp zP+b1@(bNCoXDQ}5;}-H9bb~ z50}-*0&>%FE)|s9@-)m)6pfq6OjUH_>kd`jRQ5T1DqGIzR(dmXz?th!sY^YjZquy2 z)?I0vZLhKFNar)kS2Nuj$YLC^eYV!zn~vwKth{0o6J&FhKehPbrYGf8Jop>zUn~B` zd2pWx1>}A{u7A>z0SpheD$^WyxCYw3KZl9@Lnh!jC{q^0qsSrT?k8+ZkPVN^om?Crx(3Lz>9mg)Zi}6`_b=JqS zrDU~TT<=1{k!3NF{asjR6N(4sbQn?Pcs?w2W<_$ z&}}qf#)?u`FP5bj9Stcto;ti3Gr_LJz^XR~W1|*i0YHqve!SRkAG7Tl%GLE>6^#|+ zG3mUymfx+PG!TS{YpOpFv_(1^$gW(mzk>Q>fmPNhZXg-rE8L>Q2$;o*DK`<^LWclA zb_cmQsfre*?$#`yBRr$J&=E?cO7AQ|7fs71ShhFtIh>fuP8ia!vbS3&^T!6fe=l4* z*oe0cEG4qj+cWdaVMx4X<6$%PmGb_cNc3q-W_gxOH)#(8!G8C(TvziE^Hb#6b zj(XptaWn7V%G(3wU!TJVAFtU+Ze$` zz@6@3oXqL>GFL<6IcR0~8o^R}a!28TjhG&1z(&mBBtZfn3^7LX>c)$1P~X%o;NSj` ze3Juq3Sd2SH2a8Tl^u07d)TEI^jRs|*lBf;M_158XG>87B*d=Yfr5bB>a=Y zoTc}lHnMHI7I_vAU>a*D^MyIe+j+#n55aNtz1E}S_^b;W@gR`vl(%#lPA*zH zDd4*Ch6e=4!=dajOu9793G^SSUXSz``bnE ze=M5fh;0d2hpGcwRE7h!j&S6w6!R%%gte1)7Gqh=-aSSn77x;D9nzzNnz+JlNVJI! zHHV=V-5F|EL4MZ0S$coA?I1YcM4`iP+rC83u+z!{8quOq`@rvox(wMyvF^8H`+@-U zD=J%%g5m=L!8Pnrf6eQgDGF$0%W(igcW6%@n^9h$FM>;wF7~AFf+^X!cQEfQT`86aaPaUO5{~wzYw<1y1GBZ*5{vb0Y|e#^>IV_T)Sg-;Rg4oz3q4k7|I1DNrNfojfei8e zhrOfEVnL*KK}^Sd;Vc(*ja0}k5n}jVrHpYc@R2`DH=VXXi}v~q6H<~ye<%$DG;@lw zjzGJr?(}g_<=dRXe){wEI7nTdG8?&t# z9f>vM*@WvVJmz$uf>PUFl%*4>$g93~-XEh8(r`*~C54@)Ssr>W`1v zsB(r3@INId*_C|F;=;S_)++1&8uKEqgUXwDyLZj~D^!653j_5(*hfcdkO)rh(Tv!T zvccCc4qWoVaCjA>b-udnrxbxd2zk=?1^$FlAz6S&E6ydia@#Bs4Hl-U1f`W6&4AHJ z#-bz-2{XpA2WWh&S)B?~_t;RW+pQ$Lo7*W2rSq5Gn*M< zY41Pq87i}4B0@v=z`!zHDiJ)Tr<*83dt?9W=dB{D0f?>-gQ}~ba zI^6raH4TSyz*g&fzi{hgzxGO2N2R&av(DQ1j3)Vdq*6G-@9 zrGRPnJHXarjF>*30EPp_tA7GF^+&geWD$kDf-G6xhoH|sv`A8bMZ`bUpy7#q2Uvr8 z22ukJ59%}FNHzt;_k}T`@%hq1+A}sRw~V4A``cvKH5n>7#V$*PY~>ASmTr|-+XE{m z*Cr_JYqWfxfZfVdY}gqVHA{YLMSo{EtUD?M#BXYmPcFRNfxj724Hy52Wbh{#HyWfb zbsM|>H=0|H`w{{Sj}r#Ii=J-RnrdN25ifS`zqy%j1_Yu9n}0}=r$oniV921OdBs7y z98cz#Ja~>E1o+WNV6DRVa6oi-*a!RaT}@Y^?3YyNaJB03P3O>cRq-zNFO zPQJ7CBUbE-AjrfC(H%P~zM9eIB)mFlPck~N(?0V86#p|suK?kHp_Y?rlUaVS1({rU zP72$elw3H$YsEuS)6D%ONa-IhS^ek9yX+_2P1cpfB^QsIwf2&}w%U@j`+G#m_q*8J z*HiZ~%sUd<7kM>T0|#^7%ilz1ES>&vX}>-2IW&tJDTSPSjv&0-Y<0v5V_@1q1Px5! z;L+ghbA%B4rWSbac3j)1scF;+}O9s(T(bqA>KxoZW$krX(7GrT{&O&+7nm3 zMBwNw-t&;4+-UtPt;7kiM{R~%YD7D-o#82YeCsFQ;OkG7*N6mb9G{i6H}5VbTqNJb z?X5{f7a#LX5If%Me-SR5{&;D>H}E+*iyg}2Y{Xy0x1d>uPxTCrNA5Pmb`Oeev>WM= z)nO0v58G_P)s9#+{{0yvFX5?gj-hHQ|R;d^~&W>Be>DS7zf37sj30W_g}* zq_N2Ja?2*juehn|_JO~@6<`$~h(HzHX%m3#y$1RGn`z7dU%rKW5XA@i7`8Z+r{pPp zZl&;Au}ST8-ED0>R876GqNxvj2Kf(mIlQp-ch;cjfod>=2bF1t8^b`i?W%~um1sxNj;~IpB z`B%jVb^9L$IssDRe{%3q48QFk1-e!kJ8ZI3$E1_jh!lSVUkqgD{|i&nbOJj{O#pZ?x;~$H3$A<9Lr4Ac z@l*EXS*h3+X!_!i81-~aT7W`&RT&iHUOIPZ&{}kW#D4*S*_A5`g7gyStAujf_m!bW zq=xuiUO;E(&^|m%;m3G}LPGK~xzkjYg0ujDK(<*Ew(K+~H_lrqp8jkWWC@p-MwaYU zK515cPB6iAwB5+y#VlSA{KS5M+`p78_M4J@sd=L2(G@*c?~`La-AeZRsJ9jRrFqda zWc%DU8CVCp{^ssXFU%KV8&KZB?Skh+^(Gow8@%ZGyn5PHGq5s2(9+?ncUZ;t9qs0I zi6wH4gR2TTD@NqEhH63`$YGBbaR7}7*V&knh*T#uWO=yj_76+ZXEDs3Ff4lNEug?q;ol$=wny=HGqmf#L@K!=$6m; z&In=gxdML6#SZm(in31WUvthn!9Prd{P>;mz(oql6CZCZ-(6&cMtla+0HGG@XUD>b50avI{Rr(61!OST+3%kUY!4Kz0Ke z(G-xGw8YaK4lQdWlTv7QJ;gj|H+490$$tEeK4mjdHwli+OQ1KIye&;jze1KI3fg$~1t&%OK;Ja!JbsfI%p_NwEILp1_rL_39Lhl3Unk{8L?};Cmgh7diS*jc_(XPA4}9-VhrXzo9@kSdmb1RCWvfzee&10 zv&#KCo*!OIJBHg}6vD?!{o-%iJ#X2H{d^y|aGM>f z4;pDWNua>#Cw+#u$hr3JQzt*m@$4f3=t`6@6kqW!J5IY&dGphVpuKXI zXQ_d1xzwv5TcpZ{LWBi!P3`GqeYkOM=ezo6h&~C@t9gB9!Yo9_>@8r?;t>@x#S{99 z421Ev5@jax13++JJM7xONg;iRXpnjPpJ(9jfAN+z!%yn_IX0{$>1tm(I*jsOX$F6{ z5F(|Vqvgfuz8X6td!?3j`b5FTG@;4#*@ZKqDP%O}GY*$6t4#0yjPP$eB=%V3==xKO z<#QZ`5*AQ=U?JM&jR+dm*zu@Z!CMB^LMROTZ$Jxc4nJ&}osCdZAdygu1qZ1|Q!coL zRqzUE?(mQnc|7<+G*OzY@hU67&pUp{z7R<}KQL=rDlg^JjDDSd*`OkmuaP8k)#DVH zeK**Akh45F29e>2_A!>ca@Ak^!AI~Q@T=N&K}_lMk+?J72zt?Exjch$41*qDEUqso zG=+nhVn0(9mS66P{o-%D&P<1Rd0+zt#%l_>@g1Kc$3n<0R}a>5yLlDT`6EN&Hwmtr zS39n`Bo>0w9$f?u_Br!8Ya@n{aqUQ0WtfJq@OA55_*f;BrMS#K4e-VELk=CxeFTl z=2F@)e{a{`>~&keZ2d-xaQs?&zN=f7@KvwkNk#iOAN=R`6FY;j&OP|TI9c%TVYMSr zg?MG*9>Ex9l?0?`pe$3d(K%U)lxtMkMq6I)DyG)>8SEVjYVr2$seZPMrc#bXF+AUm3e9S7`cKY;%?PVjpLe(3shi+|zg zIhn!7?_z3GRt}9!x&GW-dtV9Zfb@45ZgzOED?2by;4t{<5}*pZl}57#k5wB(raY@* zr?5`#nsrlVJSh@~dDkaCxKG)J9hlZd|s_O<=Nz(6)Z))(JuYB(F8xIo|JA@>v$ z>A`NZJ^C=(B%Tv)+^4@%V_zn~_XS6Q56B1Crhp%8V=PYVaRMr+10X3ws zKgT;2k9S}~o(?5K3T?SejX8#L%awxadluI;PefWU$5zFSA;M<(XK#O`sJuMVBVo$| zl|Gik$H4)EPg(w7InBQuilsd<=co6HP^T;*Rx|`SVXng+0qBwba6^g%Hr&nz6hzKZ z{-z5f?P!#6)4f)_mlAW2fJq@_RkDTAJJ?l_$;US7Th|^C)Y~Cxr$Nlcb5ajQbZZ{m zy=?!1a<;79-{`N#AHRBF9|53J%Qe^tR~GHi0z^I@DkVDJ%5~TXfBGz+zWaCm$1+A9 zFE~{|sg-wY+Rd%pG*PYVyTu)5RJA-TP5IsO3+hq9L~8jE=q>0JU(ysGTJxml9mQZp zve>pbk_(PK>I9kpzlt{!Re)C(>=6uk)`qNV4rzWqhObAPj3i=d$Q8vH1cS`~KN2_` z?VSnz^e!rlq(W!0og$8;Ld$~FHtypE3Ic7iKIhOShG-?my5ekxS;6|Gt-rK095dh9 zX9s`GgnJL_g;?lQbl`A4R_OD4*w&C4U@6WcCda3H5%+26rZ_8dAag`m`v{~g{_q-R z4i|MC<^WLpS2TIpVV?pvLhpd0sf`WwK6_Z^fPW%#QHIVXTDuL9=Nqd-x@JiSw`cSu z!xA>CwkAL?mlURtxc!3Yg5C(Z58(SK2*uV`B5xn*3q2x2J2C}g9Z(0kh8i;}=BI>0vr5&Yj^gdXA#iVFh+MK0d# zf&UC{rcgmp8Cca*t-V+V=g4=FtNz6M@`a=``_tbk9y5~zr-%le;*$$0x^Tj=YnV@L zOyXC^C#9L?^t3wDYs+FLGhSV0>xSGio}XSno;kZ4`0mu;6JeWX2FmN?j9dYa_EA6l zV?O_bTu&DbslfJ6!?`!-zlyS*9S?2OS)PAV;8i1(lOYUW@wnH=1iuRP2k)2Dh#7(Z zcFoyz!@^nK{xfH2NmA{(Gxvt+_J);;AXlc{1AJvD+%(8>w@`TU^v5ib> z+$icMj-9O0+riD9>vwFN4J7XOUPUL;v+NS1GfDLo@&-|mt zZ}>Qc--^@?C3_>$>e?vhnW$n4s16^F&8 zzN{Yg&7p$T-1Bi(eJLbMk*jWzZX2FZheZ6$P!(k*>qG#;{V8j6{K5g7<@G<^8r&an zEpu!^Y&RdJQGe6gSBClEGF#*XwjZR#F2Zg`8t@}SW64n zQO%7B_#BRXNn__6xBiEn*`saQg{P9ExKJTZ0(?Dz7SQvYL z%1{3kXZGqpN&GxYy+t12bop@up-iCh(hWlK2VG8g%>0y%$e%>!q&U4uKZyYA1JMNu z`R9G$Za-Pd)p4(KLA`Lb-&I+Lm*sm;zeS%8;rQ{D-T13@^!prImuyYV(T9_(K9U&} zKqTR7fwOywtR=zLXCmtT7CTGWAwNNJ+hL#{O3av&eM3hZQN^fHm)-}~pC1~dsH}3{ z!z&TpzHPFgzP?pKKI41FjdH9H^}2fQjT&M`fRiY!Wjbj2kZ{FkcDz-ID-;+f9u~xV zoqxb!XJ?wpl2E8VR;qeXQITc7D^v^N3d+GJ2O5&p%{bQfIAn%Ff%x^;gTUnGOgH_buWM5{ai<=~Xsv zG8oO7eNZXZI19%4jigj{=GEWt0y?*t!?LwCp?9ZiUqGF{_Mj~oXHTMpsIu3x3No#< zOUEbplF206=$6`WSyo#E){BJ~$G!G2K5!1nHg+d>)vQs=B&MnKaoU;(Y<=z3kR-Mk z&>Qi3Bid_mI!DJ1xV&#>2eWF^iBKn^ovdCP#*%VYGtWNOh>RUVaR^HEmrgWSGG`G` zRHfeesnXxjH)|G1>LFWAgaF`#o1qpHTxt}A{bM+dZ4;RC8!n1kpy6ny6tYcl*aEAw zL=+&ul~K+`BQfDWSNX1S*DHDLbm)=KfVmJe(`k}ql~&6LWqa#9eRk0-5n6Bg`waAcRn+U;&a7Ix%xmXckFiZ<)C`KIC_06%{fKWD^Su+N1AVl+Fg$DSU+La7?L4QLFt8gC z7S7wAqwP$V-UY3(F)f#}U=#~!oG>l3M>NREyGh@hPWgG)lS$v~=BE&!UzOhV*4x(@ zmrvKZOIV5Q9%zN$PEU=r2p;b5Rek(cHQuCN{A3Q|i_*aP9Is~U^s+Xv=Pzd5ok%^a zLiw{S6aj;awtk`pm?;TtD)~?BZ82sthmVPQ zku#ynCK{?7<=r{-`!8mVop66(n(|}<&->T`_&}@po@O|4=(*QAp6d?%GAEQ1WrstW9 znJ3A*TwA-Ys#rPR&*R>BOWR6Na(Xv}l{g-SbxB?_ zo}C`SrcB>F&7T*N)F3utCv}{%M^~>yE*EaNj~Z6wE)dW5(riAexi8^&W8t_ax&Q0Y z!46?+!BVY^5xo)l0_mh4GDqw~`tNvgM4>Q>dj?1kgdHJh9#-2Zbbk@slO)kveNKD{ zM66RR9=h(lgZWR+QxOU;0T>$$X1JoI)uZ}y;0v#ssSf1`15|HV4zAim#JgLJ!^&)2 zwpctOuCtBWBd%FyWwSaJK^0~Uf}~V^yP87r{ zR|nO$rNx7WC?+~g4fb2{Jg-BcO^~!(<*Ycx8-uZ2OjyeOfSvv+F$qT%gb$>zjy&## zhHjxoQ6r7kh$oRvEhCMSx727m%^m%~Mv97?VQNXb#9n6VAI~5Gt1z06d7~ww?)N2<7(XHi4#lo+<8B&$8PzE3K?fF0-~816X6XV$0`h z&hPfzj@Uvob&jd!u4PNF3>@1y>P!`9)oUkMR<3GpKunMi&ZRnlB>PLxTO)rFvCu~I z9Tu0!UT_{Kr-&~iQcF;0=6&p}7o1FruUs;P9SUw}~k$24uhbS(ObZlzHo&m%_@ z-`n14d}eZfGY{n%+{U`0`ut;S1tG{2`6Sxmx9ZeE%>JYK^iKA+>|%zMOk_{_U0PJ3 z-|kHVkYof;v0lm{ma6^~20KLr(i}d=(c2!Ly5fi>LIOMTg(#Z2f>`LkB^T7E>lF}> zbi~Jvvi|H#EFTfHUSd6i(b_Y0)4E)!p@zDUApUgi*QCTE{G(fLMWQ9B7LpgQXzGTT zJhx6ZiMvYmSgEs&#cjd=7cmY_Y0mXRSgFKzX%+o7^_jV5eq_h+(Jd|l7-lp|bG1iV5z6ZL>Xfq=zR>C= z7f%nMTt%?zxF9u!pdvnzKPZYRO`3nTZL^e)n2xC$?JB`l^U@%Iu&h0^q;uwg1#iNp z(QTp{5K(Uu2~;80P$;DE>%&-e1W=np$xy*8pXP|iEyqyRw4?)w{$D_;O$w{LIw$@W zP?$8ukP~fI-54~p(bo>2O_pGlYe7Y%(UPn*?C@9=+?p_&(}VoAWzc?(CjhpKSBWx9 zwsUA5$*=L}K*DnA3BN-ShK+phtIOI8Qy{soNnJG0X>^AP`Zv))ZIk9s@FTnYZljwP z#%Wn-4R{kcFJ8{V9=_o}({I_;QkEAOb1Re|MH%;45m;eJC*$!#XWN8-DV{<2YTCy7 zD30hEQ5>!ty1R`+b&M)Nv!G)TL~EA)No}N0M4f}Sdzgl(tl3aRRhYytP4#70^U9A3 zR5dPEMPT%!jE3QO;IIQS#$VH~jtHwiiV&4?6+OG3ukrHSnvLByv-;I$_q~-;e z4ZAfY3pVg6aGW5p2)^I$I3RNgq>qz>(B)<8R(h?AK?Sxn{+y@U^Yh1xwe8cE`|ap{ z#UT6fH{Zv*^R!n!gaS%z0@ICy??dT9rcEuAa5@u$0u{=^R#T4J5s6y0<`x+>QYa5Hn*B1%f#B6m19j$qTrzT)b|z;R(_)G?zxo)=ynaiSvL-TQm?TZ7 zqtM7?a;8P8Ps}x^pq-osEJ4V5?a&>p;G^t|N}jc>xOJIPx9ggKGNOveh?i)Hl4)N0@xmTTK!0j|qSTC;O& z{7v+$&16@$guKtCYeSsIFKuHoH^CjVyH#u(*3d#9MM|*)_;Ep+3v7pbm~begBtgFr z!8tO4Uh;4t(GseQc_3a@wSi=P^&Ar@jdHDOaTrMI#*6YivPh-?OKM)izruoXNNWB~ zcL{>_#ahu)YmO1K9(mef>2A0?;ENIPmD1q({yYHm#~ zLyeK|Fcxe1ew#g2glUr9FvYRWM;dw1BlL2L%k-#q$hJwbH6A_ps~OsIWLe1>Pfl;q zhX1{fq#+}7j@lK8T0539N+t?|R@2`}*qT-mC9uTcvt6)vHPF?3!&~bdny~*Mo2hAJ z$MR9cu}(_nj58|L23VH12848zks{){wp{S;17BzA_@;xO+i{s>O=4A0`P>s5de^UY z;kM30;OFH=)gMNgn`81=dkMVp-LCcq$wzRGIKxF}1v)F!4)h_5)r2hJ;5j<+#*NxP zbY#hT0uWi(GP3kL=2@OLrppMBS~UzVRrkh}(qBm&i9v@2a1)6LqQ;SFU{9AwzK&`W z6AtWJ|H0kpGF^PlF6Ph@ZQb25vo#QRRt=GUX5n{sW+vZ6J2Z+EL!{bQ>O+>Fxz=j< z4r`VU?3Yq(G|VE$b=-n0ez|{ckBb=$BUXlp8%8DL_%SgVvJv_gEp-E1$BhJDqOVR( z(IwRmdc^U#ym^=q6|N>ucJUN?(&2b`1hAroongZmF|`!D5;@NLMsPKo>akBfhC7UX zlW9Nh>TX@w7jB$>Y$4@F+48{yM|OdYL3(9+Di|ZEr5jFXTu>m|wV0H3G2b7~l_Lnw zFo7BY^sWE1$?`05^aD=S=8BBsj>q&Qsi}g&d;msc_uu?+Y1ag%W}7HzDc{v2qimFQ z)iNpZvg6LW_J`4+sHUOTu;(35DCfO>+3O%@J8VL#oW~ZyvT9xaj7_57rb4Ntx=S?_ zR&VyY`wRF<-KK15;}pC$Otb9`pf1tPEtC*Y!nD%1ZMWF1mVD4_)y$3_b0sBok)5e%fxVt+hd9gpsRm6h%^Uz!?s_xD0cYqDldLozyR$gG zcFw)jzl3_>B-zIjo~PpDtnwTyIx&>wrPudYYSi#pA2IMm(wQyzW|I}(EAPZABMN0G zBVX@bL$l(e3>^)OA>6&y;CZjeVRmp;(&ZqMJ;V56=x{%T2bQ^d>zeZRka*T_bYk&3 zEgbyo)Dsot#r;`)@7S*QMr*=%w-zhWDyUQj5P5}id1|B=ckibwLTXj-%M83dp8@MR z4=n~Zd{JyRM9LB3^s+)76<3j!MB@_LRp~np$#JBH6jDcJWlm1%KRQMH|3E!bo(>fn zqdwf&Rj{pEV;`J~9`#7%sy`c+bUMtpU`-)&oIi_zt))jz7No<*)#cgjUG(LZ2f#OL z_HlC!fywcFe;}H-ns4O{u`d&`?AW-zM8CcMSxrIN!|_n^&8w|xpQ{k1Q7aQV6PIv( z@IyfPrxh`FzVA9=!gVfPYEbA~sX{9=TtXseIYQ1nz;r?Jn@Md>&hyyYmOKmu3SUe^ zC%y9v_L#DNDF$qW<+mD)WlTW>HK;~7G!FgDx^W0YWsfM zY2%l^t>J0AX*|TEN>zwE8`?b=@8OOlc8IvXub1feA#968>KM`6YcGsdG|iSfOR| zQylgl(X(cO-)pW$uE3$TU(+|3f}aVji6F9^hsS8N zMfxN5z73f)cXb!c)x;0E7Lo7Pi$|Q9IIho#x*+m83!1%H)0mS%Gi?n7`CeK-gFGri{n>yg$_ujZj=gAoJCeG8rURZWg0#$ zip}B`eY*c=-Zd{V6%SmlvO0}Wv^Ou+vA`WWXym1&cA09Ra06DRKU&aErOMQv&(>J~ z(Dqf~JH=+^%;}xn)2i19UWea<#Vg=$rrhlwZfDQO)F|PO4ZpYFMCWt>MUnGnY!S~I zm9M5`mx*`7UFW^E^ub$4tNta0$B8o-ssR!i?i+pKeU6d>#TF43n$EOYw6;j{bYd%w`LO{68A0^v=m_)$}ny0fr$bYSeAifwY^>C^yYI?eLC#Q5oGTOjz)}IY%Y3Zs&Hq^5l|c zUT5?G&4C`8jqCT7A#TQOnRg7SkcH6;(na{^;Q^U<@qFIQcMx4d%aL#-Qd-YCpEI+-s2#*NteXs3Ib-3{5saoW7#9$*BEz@wrJu_ONNrbK|)S7IwcDFGd6S4if`! zBc)95qgv%cUS6RYG+cdrlXvZ3_hZ%l4!SzX@|rljK`0H?K7s8f%FXLWz)l&&d@2vJ zRU*_8kJ#(zm`hLEvy5``umQ?OvadcjERb`7JM4zgIHrKaz!R%xG)%VW06TfQZlpsS`vWfu*ZD zHqZkr(IFOtnd#n##{QA%Pb$Z7HrXNmM$PM*;Gkv3Znv65-D$i!??7NYE7jM{FX?=; zSkh5M$G~I<9#^`7G;H67HL6 zVdb<8D~9%gzBC@gFTa|QsLL|2ps_=hDv;HyQxZ}iWD`tYG&-1gxz8Jl>t-#N_2B!V9pmak zS%!1C9Ugik_^i?CLE2K)=0`kTaWnizm#wtIZdU)k0TEVOFn4&|4{OG_U=9)o%>Y@7 zQi(O?RlBg^+Q=wQ5|*lO#`5qS|0{?PJADh*_CAq}Ybp^xB!Q)mkF>#!|LKD~zW4Ky zr_}YdzAcGbpbap!yJK#Nk*zXdQ$0+0Z`15r7#=3W6C_Z`>^#aD75rf6<=9)lj@-|5_`wW4O zdK+RvYNmx1h#n$AI(#dN1ipVQHy)R7UV!)91d)VPk|4M{fu3XlTR| z+rh9$52x5E(-((DDMv^S|F5`{yBtBh3v>v@QbqG2R`N98#u}Yh-uV$=?N%Q93HFA>PV=3_@VeodN!wCMC9t zx6tvrl1S<1uXPxMm?qY$UClAaD^|Ft=CFY+I3Q2vRsY=k0$*X&;>CSn(cYc!&)nj1 zt4p|z%NSwTyYw1i3OJxwFWxjMxVAO-^N&PTL-*Yt3u{@Fg;vIFlw#DOK5tc70JReu zzs8ei_X~aBF^2enk?wLvd4{Lgh{lAP>*#)r8Oc;tgNv{CD}G47(Cl15kQVq8xmmv# zx~HKudsU1i*{msuyudN;a1~Y&unO>(lo%5ul!i`LN=PIK?itFC5HnG7%=L;E2%}&A z??jKmq+n{RuG;Mwj+N6nzD;XjD7Q++Y)udqUgV;U{dbiZ`2=QGCgZRy=G)NUB;yOi@Y-B!$tU+~Cv z$D8cXx!g;ZCE<%+pW*}G8pa3A2;c9pPe})_BGi#bhi0(?avSoAiDg6vso=!4c|d%#4_G&poBM6B_XGEu)l|cEmHiUq939Ls!_4#I#KH1F*mz z5qc$58HRBPa~u3_7!!b5s_^)k_LZ^y5+d_uFazcsvN^v+GLoW?{EX3dcd2?c=UT9Vjax+B&o>PtC#5S|x>_7|_f0vcx|I&nMY?|e+Gne%p6QTGw-;dVh- zeD(31l(Bo@-(9I|dCLF!ysY_=?(OKTP;aYa^uQQnC(`#RAdSA^v>}wyZ8Nj*>#u^X z*j|0qTg-P=K3?z-DRP7XY3aKr%3>g4{-b0LtATmaN0E6F{5?5gr6mmWRVt`ygSdaC zSd%L&x^@P>VOp2yUi2Yhy+Z>}OA=a_gjV_tV$=zT2g`~pT_ETGG4+jMnSbBcgKC=W zCfk^7Ot!6QvT?`BlPBA@ZQC~Pnrz$k+~4N+Z=M&us_W`}&e>Rd?REB<{GGLH^~d`$ z02aKOUYbsWJ+)g$i`aDQSPXmD2Gk;{Ik!saem^TAe%8C@LE7XX(*3hCF2q3#25W3K zo*&|C2q_@E=e^iDIUzuy*QYX{P-j^mfRZhSnsC$hKDEU2jn{+WoQ8SWkA?xluyi>{ z4wQ#9DbdEbn^QOS+oLr0<87MwIfXeA1$9WP*QIVd3>9CDoS+DLyO58xdAC;LAL=PO zWO7bH<9;yxbQZP(-*q<};A0E}<0V5zd6n!6bw+Wj34ahJu+Ymr_wf}&nqSb^a!11t z^sm-Mil}p+Vvrs849!ExoIq0V;V305DJ=h+xgtLXF8l9tiD?Rd-(qY`cNYGNmikEG zhGs~zlF9@F&_9)ge=9wNX)1(iRPt;=HZK>X$Kh{*{c^@#*;YuCgi%YHu)Cw}`T zD&2#1Vl>gao|+n?93S=7(p)dsq;RY@Y|K_B{U@&-5fXZjQ};0B&s^^##Esz9)V*J? zD-ym%8$ei@+UTev{2-w$sKmfaAtB7)mM?~l&a?8+gE3Ia1rjPiP7bRYYfG7DlWjd^#XBSxTLI5}gJ;jTh-^}G$ubNpQE&T0YX!S|q7B3n?3p?_@$!Yl zA4mTTFORX7IMYfg&gctoR%uFY)-a=5iJzEWM|`U_HXm-d!2XgHeW*^5ipygq_Ycpu{dfmtO2+_6+K>@o;_OFc<#+mYO5!s z2f|-?r>^f%{*uqP1T(j5rW0)z5LmoyfzK8jmURMAomCH>-iHZ|Q3UfM`NO>R(2pu4 zEpcdz5Q7uvhlft*tdyY_c`ZGDLFO{1?pIhLg`qTXW@@dUY!%~4q&FO}%J45Pn8{V( zlOb8UdXFDd24D&2lZIgpV2d^b1xtNY59ihTUDCB^D#sEt3SV+ftps@oLZggwVuVXt zW=|dS3rfV}mwqaqP`?Y!wI*T}*Q(9oWU2mvsjluG&l65YzC!A)-?by17Vz`KDr@Kw z24z1>*0QqbMyTs80ig_YLWMFh>1#UG%savxd%TMIaW zvs0;?6v;AjWt!kU60!seRzUD%QDo98!H`P?jmqHILgo;7R_kF)`Aj$z9%j`dqKCDw zxg&CPMSU^XhLtut7K8b_qAHj$=e6_4cG58;`XcfC&q;hjeRNi$-)(N_OCuTdt6pJ8j$-x1dzaOYIDA7%HCiBk;Kh0IAF2i9>c(H8Kp<4 zGv?N<1GI5<3d9+#kRAyjom89ce|ni7eDA!_<^L0WY1dj1UGc9-^2 z=)ay6k;H=V%R@zUqrpcBsf;P1Dh}x(!a-3)!QgK9@Tg32fk+V{K?&YLRU`~G%5J5W zxAg|+FezF6tSOuW#ep1brIuO%^i|Rt(82Q7NT4Zm@x8L>0_H;udsDwKfAl$r%Lh0< z?+nK^)vumB@-cU(uI5ulqgL_Tw}jQ+&|wy1XD~dr{v(dJ-L=zHMGF;6%fYgO;`A|1?dZw-xCP#N z^L*OEc?;Nl{}=|37eSqYpmMp0JA}dL5O2rluA_ zSU?fbIT6RV<2wT{ms!Tev@v)mZ4oN8kSf5&WfL7Iqn*#dmMVrwCiT;;lx}*_rPa1N$JTLOVfL-fc87F+as>*~+EG9LP-y|-D zPD25pSl9Vk8OZY%5SdC#!2s62zR@&U1X8zH-)SCeMt)=wh^&=aEV<}xQbuz)lj{Yf zx8f)wS{FAs$=kD$3VB@8#+}Q8Nej3mp0DWD*~yLTcJU7KUgj)QPV`zXW#%hguHRmf zZ-j@8#qj2gN`ToepAPisSkE}%eDu%HHRWZ(W1QwdyYf}^+hT$lJ~0{UC6<_AcLPV~*oA0$kR4(vgNiIs(f zYAHR$qX)^dyw_r>eSCxUJ1U#Kep#lvL{;mH2LDSr@k&#){wij17L4=pGjdJlSU1O& z${QMizCO~S1;0FCFN;v)*+?A&PylLMj_Uj&O&&L&PMs5%0Mv;;$57r%bb)3fx|iY_pKgC!gLh zQ0GyUcNL+|*J7Ac@8q}FhCGZ@DU~xhq(|wE&a;OihCp6X0?GvW#7dyHLUd$`o*iz! z@yWq(0_WN#^{#@KlbfXXD(K1(E2?U}HG4MZ4;NdnO-1#|B)pdQfYKMEdwhIr! z9-_f%tAcl@ZPec@ef?lRHrecimYX zC_magy$oLSS5t(gDT}r4wKz_gPt%zVm)K0`J}yX{yY!WOJsDAas5g&K;9y$wgrgh0 z<}EM|n=|oQ{H#fzW$9wC0-#JS_DW%u|5kUN!kiR%r*4j^n7(H?d=gD0{Sgo0I#p!= zi!_!dILA;$m9V)5R7SJeI>Q3?xVKt6BrB>|1&eCOC)`LOd9+5wU=IOqFF$!-sC^YF z3-6yNjux!zFA-0@p9-FLujAS6vl2PscRruC6Rh*X4qhzqHn$*)L9}(HM(}!?3i!`n zoCZi6birY@P3Z+-(QvA`y6qr8vFc8g*O&p&KcaI2-G3RQ-;Zk@{`HB{?w(O720)I` zVKTV=)`ODNdOl=B(EGs*LR!&X75C1`!7w_E_p}cG_Fc0eAf>CQXS5b$6p)iOzThsV z#-rCdmafq{6pORydn)sV<`%8wX8){w*(%-A_mR$V3pgik!WKRI{uv9(H!wWR@>owF zvTovt7}bO_Ve^F$4r27YBUqth2`|I0d0qnsD*JQSBmo+8Ds?i&ZCBcStT^Tw&l2{H zYkSEeqK~P?SLFwBl%Op|(gnL=rJ3$8W$d0sg0itNle#VeXGc^mLgg8w@H;V)h zS+~?5ee$wRX!?%*8Vfa*S2g{hYxBZ8PKK(A10sL>h#`i@Z;=dSap4!AZshCOuYUTy z;tyT>1{o;ggc5&nHma9fq`VJJ9>*UCpJSa&uvj`WL3AE}U!5$kesTd{cj8Ag6<^>q zO~2dP{a$*>Z~7GLXbPct*EyoHQ6!&6`rhDRn;H!EbVc(y)Wq7 zxCv~Xgkd*fE+0ZlIr`gJdL3p`Fp8a_FnmIpVfQ1gHunofMK$}_Gr}FUtjB!srPN6Z z)UXiNJ{Y}K5r#8~?d*-}tL7eT=Ush^SSEyT%L~dQ{>(Vcenfq?b?uO_y8^Pnmn~!S( zh9y0VVk~69;Rn*Mf4)~*HQm~!tf{o9j>;Ex4|*^nB$|jS<&(Fzlb>8G_rR|%RFtVH zT}})DSCN&;nBoj*h(qXB<5yLrla+n2?g*R)$(T&km6;=VFxH?<-@ZYZI?;=xQJv2s zWsR$X4JzMaqq;kwsflEMKl{)VveD)v@AYl#^2E`FyTa9f-lx$zb9&1Z)K%*l!VO#$hkm4Ft#x{fg}lOW*t+F`fPUPNHovs62nLeav(-C+r~d z%`g%yOdB_MO|>fR{Vro7@7Ftv8k~!^24g_ zjKJf?9uSeRCa(=_9E(qAnniz=!5Ch1SGVSsZ6&wGs;O8w!=00PtW2~x3rv}|-F+B@ z!@zS&&83Og9<3*2t0eczqRXKEj4VG%4pGKS!lXm++55LLHPsNl;CIj;e0jqnh`(|n zLrayxK&=&-ccETCfb|~QAKHZqYVFeq-Z?5!{->l*X{LBd@@lQK&-+?^4AF{QWv~%A z-JdB+qngnD$SPjRx z$Yx`LUw+)R{VCybyM35+x$38EM7|qH{@`%fTEe1Ed~)LW$N()Xd7h9Svy!JGzn<)MVl|k6clhitTrdWS^dm4^~jRw{w zDmUk~E($;*C#o&Nbm%*pp==DcfB9DQdmZMhgy&7f(!^>vfYFz6EtY^+&2Qee2AW6D zUJ2b~Qoy`3&sr=Z-sSDKe*TMA~qbB1^IL4n-EY8DK|;drkR)4&?5H^WKfp^-9nmH zV=G}^CBIfp8!z;uPV`Dg&bgNrYErPi`p17Qt*hn^W86NVt$#I)qPul33GjsBIl_7$ zLq4$-79TW<6);qat?eW-;{GHybW}rITgD7Xbj^R|!Nm+%+{BER!~x9C$ef(530585 zoDH5XzBrsQ3zBBPQPVyK5kTequdG+pnk3CjQdn2+e1dwkko-*SdmpOZQlTi~grA_0 zVjSv7C8cmM80fG6uli6R3ScJDcCCpVJsU98Pfd>G?hy-)eg+6-Rfc~P_fXr)-b zYA|G6=5)lWcCSP_c=j5_IxA#(>(^^kVp3Sjykw&^#+{elqC1HIFH#H@yf!^zIRIswK1T{jn_M^cNwiHv1R{ zL$B%vy$kILZc5e>r;P1>q|wODrk;w7hJ}r+98H3uz`@@5!1fl-4a*bX(YC6;GXkZg z4i2c*;tiH?+PtHA_gjOUYqKK+j|h3T@D5L3heK_6to%ZJo~kdMxwwbaYuZ$Dmd5?q z`hSXgj+V{1`R&v_w=cg~uh2`W7&U@Nq;reSeYkaB!&H>uNEGQ3TGMnJ zXNyomqQvKbvBp>mmcgL;)%d|8IfKEm1^-oOPyjOr-CO^iu67qZDiiV}-ucJCB{G0Q zM*-nZ6>+c$f7Emt!^MPd@B#Q+Sj31iaqhS^ZAk}(MaAuW^y-kRlS1~o1Pd_qhXq>a zUg4!4_t#ymiGZv_)RafpAhu_^2%?nILjng`XuGa_IXS6`GP-;CB$oxk3wGS}n-MZ% zO%U6k%|vp5Y}}$-PTmLyG)IAd&K*Gvfmfcb?{KUwv(F3i^myS?cKt^`PmX|ZWSbvu z-o`^A&oOZ2=ZX3P)#+xA3z4(dT(~IFHN*{0lfOO!NI01dK+<3*tVENSLJsjC0d zU>CG`wSHh%n8RWNR#*qdAp^M@vy}1hIXwP}at`&lMUTfgx8h-1$Qj_W@>(SHXrd-6= z1jyx2LFj==fIOxK=I1^R#+SfMJZQF?7yk{LP(nKF|`wq{*dmqYQa|y(MITXnDdV0nK%##-D5w zPyEdH9nW34oCESkX6HO1rH^HB10H{gwdg(kI!tq-S2^+ev9uB&OWMLBK zm%Fh-HtpgzId#OH||AA{Pwj~J>4j&V-O`2iF=6c46p0@s3R@%SB_A%vtkr#1U{yCpkJh8#UlzL} z*gfJQBRbrC5aFw-4AMqq(>!5=0!ANLC6d^1WH<^*h@iS|YB@qA(#Wu<#PPpgfUR+4 z)2-=1iUkCfEnDC*NR>aT<+c1BTY{f_^EBTSo&Rc6pee75@BNXF`wR+A!GbyOnKs^jth`pknE zu@eqo1#_8ksE`9J#BQ$ZxiNU?7gAvg!1SA(mJSim+rd2)`tgIlRK|!!DS@x#F!8LU zgMH46_&rHZ!B2fa(F^YJ7QutLm^whYW_66kJBACJ#G@8~SMZ6!?f1s#LIkgyGpjV- zrKils9b*#X9#XK)hWl22Kc;T#N{5HX-wI%uLc{i_ygy1U4z953_d}J6{Z&bk2)nO* zYc&L+!F!L-`Cs`5faC}1npNv2rh_}6M;hA z_09jpf{FT>1JF@LTfQI?fz+u3Dwxy+r*7>}<9Jn&^AEo%feDy|K+C>AVpV#@G#?n^ zE|I4dt6Ehzpxq8}GFldUFk8#pQ24mUjVN7%kgo9u?|yE$$u54(waLo4{`M1x28Gw) z4;_dAhFewaEXQkLM`Ptyfk17fD;zbMJo#C7ujF9O!do8UOm4$P|I|skr1wB8XGIK9 z5zG9qqKa^t?uIy)3-@%%1^o>A&GIQnk_NjW`5Oor%kE?cB-QIuOL-5vazw0Biv6>1 z?nH5h26Yk>kbQH9a)<%zH5lzBzi*9I9>va+{n~{J{RG4{`)X_Va`nuh;1<(sE}PSk z`$YZ6`eCmR>%_zQU~9Xj41ubrCStZpxMW%jGvL)|sai6>XOP(3)gumccg1FGu8=$J z<5zu|3^f28(U`NWavo|U1&Uga80t=$=Tcuz;S)bNAcn6?Ov z9n4Ap%z}q$#L%Y3a0+A=JlIM}wE)WR6wF``uwTaTz_Fll*nbT z)wJB{Zy>Xya*jvH>6~{jI~-WmiUt_ZgKgWBX3mTE*zVP^KRPL1^jMc*65&PC#58&M zaEc7<27Pzwe~o;~2Q-}RvVzIv)epnngzdp<2wQyN2;|=1)_=*%gQ-b&R{ze*9ms(4 zN{F+5Px>#OlSuta(4=Vx1O&#v$Ea7+>C0E;@u%XEgs2LXza74GRX zc>ZMFH|@TOvo#s5{!P-zucbZ215FSEu9U+mYxhT%tA%8A3HJqdQ7>GZ4WkE?Tm|vKZPqj%I7eo*VmB z!Y_x;=Q|JgJa>aYUo2k@(S|PaGtbA2viySfjA%}$nXB5uE)puTPHjcwC zFL(YoOZ%7bVJVpYK`>>#RZ}t?tx}v$sqWah+7p3Ew|M4kCNpEIYpz=d+Yz(g&eiMH z6PR;Z+)*kQ(5?{;bdEtcWr#=}2I;j{Tf@+cTAu=6O%?4fmKiIIGw~Bg3AM!TaRaS( ztwo1#T7b~4nvjz4&>)%GJCe9{E)pliGmi_k@K5%M#1U$q5v!g5-+t;Qo`UxC)+A|7 zGHeK%){>O&fCO-od?9E5&R|=WCD%}0Q+`tePnE)8qfgm}knO(v8cV8|g3X5$vmI{? zSMUkX05K?os%}#p&>4?^@wkGPk`BgaAP*WMDk+7Z<`Y*E}1WV}7`GM};DyXb5z3qB7{IvAiNbeg1(v4_@^b ze%N(AZcNYp$E~JB6RealJCz$$H~DNZE9a9Lk$XnBr{0h2lP+_!ro&^3=V9A0;;^rtF)5D=lLE-Iy>`(6YP4Ssd( z4GCw(m&6j|#cS4G{(S39Jz)DxtVFsNmQdZ&dcFA5wwz~PA`puGv1?t>>9iMtqjRgI z_ET^ZLqSt3>TB)bdP(yD7-J?4JD2#?{b*InDE2YAjGA!nhw+FMQvN1l6)~ZcoKp6r zx^2=O6neuywxD%Vuyk*RPz4C1+-if;u-NN{5TV8ryYh>Bsv7EajvIJ&uN~Y(Cdd8yperK#~Cr5;UpJ7li7}gPG zV4wALEN#WwYRJ0jhVo9;2XIX@O}_xg*+PDgWrrFEvkcf+z@7?`A^94))ugPf6N|_0 z7MYm!DeVM)i_w?yE3tISy1Y7YE*RG@?^s;@HReWc*U3(%qTz)X_dCGb^|hg;a3|ci zAU(T))4E|Otv3RvGn-)jrT4OZ-{{8IfvAz0iVndk;Bx# zvOPNlIF+>+0pDp7pkJ)?ySlZ|0-c zhG4CWnM#my6I?6Fl;eVTmy4XbXFcrmfe#urjU%fVN!&FdN<)9*j~}p23p29XAea%% z&mQdf+7hWS46DysBZD;|bS5`#t1Do!7*%9n%p*KQ3Y6~V?zFG375V9>wq#%bTEH8` zLO+byPX2s%v(=8bc(EiS{>Q<8S^5ZPPY(JI^6{r5ye~J&wXzWCJp7K#o~xa)JY62g zEHdkO=Qo0zao3W#7)N(?V4Ty>7GeWaK>RR5TkyWL-afrdvLJmnjK-SCFOkvfbTp!f z%&-GBmL-PHog`iVz+fuVfVFdt{yYc_rec$H)dJEo9tG?T{naMuud@lY1g=ESI`#HL zM8Y&kOLi5cc0RewM+B#hNkQC9zIaC6@xc-}T6hZ(n~v1zev}Psq3I<_oj}Q{w_dnz z9}SOavcY(DFnu4YI0emyWcBDF3}R6MXFI692|$!Bw2ZNopxj;GdC zpv_aE0`*2+d4x%Z(T>TrYD17q{!o?+DrBhW5VLxN$xi-4d64>ZBT4%54U^9*-_)ks zl|Zp@0*cNfAhM#1GDmAtWDiHSzZU_J!^|gI6)BY6& zb;ar$-d~;#eZ8P%D-1#N^BLZz^t9Q5FByUO#R+S%$50FJ^>u`$gOyd=BmA==A>JpI zb#%jO&$M136ChAXG#PG0Lrfqjx*PR{SABjX$W;`WWWGT2`)(EAV zwcKlr-~F2G{vH7FCC&Z>+!;!ThzF=73C=)OHuKdRZuW-GRtWmW0q3f&;>xQSN57Lo zX9+1)6o31<$TXHj35kL6Wc7o|o7?wtCVt~+QO5^0SIl=(p-ZiDafaARwjLbv%Vqaa z3kh%ry!A=$(NhLA`8(FS)_T&pmb;><8Q;=|eJPL!A~v*mdZLTVmD1BxXqg5a?*Y)IE$$06N-Vhc~9q z(zd(4tj^(NaQD0HvhtihGy(DiMLnY9v8?THQ`j|Lx*FH=t^P{w=0mvPMhz0pUOQ0#w-luHU3JXE5Ph>*PW^xLx4*vz;=KQ66{SrB=lT|5x%% zQ2o9W6ozh%8lu;>zaoxZX=bVR1h8} zWJfP<@8_rmv<<4$lTHMq6(Ab1h*~Q}M!3J5_O9k9RuL`JkMA>ongW+DUa56Z%u8-K zh@SY5c`$x7)fJdlnuM(EOu% zA-l6IT(ED}Xxc)i2^dCh)YF7>+wBm$?cC8{B8{gl$I>xTq`f6Qw9Q-l@>%J|WF0IB zb8d`{Xj)7#6EibaE+vXfFFIRJ)=*6fSv_&49;38Z=Bi^s_@PDQ4{Zbym^qw8xH$8=iaq4@BbW9 zH-83g$pJWCm`$O!kh#lVmc^D5>PH?v?B%>OeC6CXeA@QDZ)vH2< z6X^5%PHS!CrZJcecDtWHjdy{1-6wAobPlMMMrRVCbiRI0e*SSYjxvszFvto7;BMTIuXT&RQsc|bXiXYQ*4SKCDwxI!IVCap8Xc<&AL(wckLV;YxqMFR_ z2eNXBKRfbG|nJ0_vrnEAUR*NwCSkVqkf#rg_He33g;&M9bi*hpJ@f9%QkT=8)iy6h&w(0&>-Yj#A#9Iunm4#di=M|L-RfV7?iSY zMJsieH91T72XC;$A0p$9M68bt4JRyFm@Nj=#YDTmY&=8|lQNY-$yYJJcLv9x+F&NG zE&jW_C=8Y8z}TeT1gdt#p+XlyeJ}V-1|$!;(1HG}cuj2Z{*>MyBdp%twnd;9ibe=2 zo;#pSY11NCe3K=EqFgh8Qb71lBz?6?`RGFRqJ4P}eUX^mjn#SVEz8DVzGWRn@F|c3 zFiQIM5=_bErvL z;lP2UOVTsf8*Bna#~ezpn%T)hgG+Yxr^Fs_VO$~3MPW!!RTl~^;&?6t!bbQ$Jk_W8-GvZxUS#xbz}xK zJue;NDSnCfILgLqy^dqot_NeO68&+|Y`jlcCiaECm553&ZJbb_80w(%_at$L>5)-A z*uVcx?@#JEQX1P1>Qqt*HLczo{wWXEfW5b4@%frPdDZRnayIm}sLru+$p6py#);k7 zbN1MuI0SJa9i@jIsJb1e(XTJNR&~5^M+g~f{x|s2L)Z8$0`(u~vKNoH_j${sUmWLe*DVu}*nU&ELl&F-Qs>kK_j{h$>YgTA3gx^8eti=~#!Dxdli zYZGFo!Ap4$7yp7*eB*~OsEj|%9GZF-T0j)>u93^tgaUu5oIX#b%mp5|9}y+T=Mz#e z|GE0YUs6u*Oij?@Fz=HLrpnDhde~n?S3n2^;DK!h7Y2JamzF+;Umfm_x^OANBV4at zIKsXVTunM*ut<^hI0)UX?wAm)w=M^c4p{X35YkT1s|Y5+AyaD6>|8bS@U!qAt&ROS2P21;Qh)GYn)sXmNRIgV03H7GAP?r#d8}zSO(w?=J zms4b%Ib=pPR@$_Xi8M5e zFeqzMQl`G}pX75=p|rsHq6j36#h@1N0_l16$$)I4BtJL7+THW|BJC4>ZH=;!O!#hq zwLY6BC7025`|0m9i^(`3-M+je*dCzo<48NDZ}U>n)TD&OGBJytZ@WyxH5$B(9)k5a zQ0mfZ)SAtRh72>fQ6d{waMLBL**H?r|3^MxC-kr^R;d3$m!{ebpeGN%$vlm2l>1mD zN${~qFu+(?A{~n+;E4%e2<+&KF|q&wBm(jmHIlxop?~03iRsD4y~cfk#rw$o6g2t5 zq=(@+YF?%j@dCG`x19#X{rmbaQ)PSwV8sV?3I{s0NmpD>)w#;{8AU_=R&V$!&UpD> zTifI04#%|0!f_xu2h~SSa%FdYD`(I!c8@t5vMY;tAwGn7T~6MRBIbk&AsZN_gmhaj z&)GBLTmg-*s(LO2(`>A|?x%UvJUcvy zwf>g+s^g?ia*xTkk+jE*UBjXB%Xfz^I~TU@uxo?pI4gK;(oxy+olS7sI%y zh`JuVIth}N{%;0iuVJDcdz*TrIjA3D7&>VHthc4?4Vj($VdLizyaG4cUnKL=?8a?G zgcx-!^uk4;#>FdC(s;<1S#^WBD4p{3c&H1SV%RqZE54`q4Se?eTN=$p;I(7)*EI)D zr*|&ON4K!c@ECae7v7@ZN|vf5J-W~Vyy1VOv2DYG>$nZQhoLV6&XM~f*>vAMvbKeD z*+(1LZi5AnlhRJqKBqhQk1FMG^lkW zKS3hFJAk7;oq*zn({v4_0}$XYszlRSgOPOTLR2IfDmH_BC>4Ds9a(h?^sk~nPz z042&ObL*=ayzLaJH@qHhFLxdQOK|75h$iuts4i>sd;1GEzkWq#$E{Kp?^Z>4(35Ff zQ=@yQkc&jb$2?~(F4BoxhATl=uz5w}YB)R@kgY9zdIsK{?9~`b%X4FWw-8WhBGt0A zAr8N>h>FZ6`P${gLB?8%E()9V zvUvZpbS3HZSQ*+rNXb=%`d_BxuMLjMV3QIpSK_uORi?7j@@}hHeIy{!*;3Z;lv8BO zq-Hd`*nY z+up1%<*M5q^vBF+_vF_h_LJ9PkB0I#{60Pez3-DigF6?K^?za*#-KU7t-F~<8xVU& zHY}%NiRH*6rZVt5pTSw^W6;cMhIwCTzXJ{X^8TOMqh+J2t&L0oaAY<1gceiezd%v6 zrA>gz%IY9jc2}UjRD3ZExN@|V^MGf5hWa3NE2=pYy{Wd2y!#CtHh-Ux@6T@iJ=WWP zEY#&bkCrKWfa1eqUDh)Yq_U3-flE?geOa+=b=;+N}=C0*pVL8qyot$A*-F_ zKUi0tZ4g?$`KIAxVn1h_`lba4_dbRaS^?{UU2x5oPRG?aNQMnTaK1QA^tP9>h41!a zmy60jC)b!^y}WJ^=H`PWnRFel{rtSIUuDSbv$d zxA;{0fiC7ZJ!mQxIN@vs%9S!{&T(0O1pME4pKCDZrsZW8}m zR7lv(VAeiGTU|L#1BP(muIrO5Vg1e+Ed8q9fuC?qDp3Cz2W8>o4^oM6;N5e(G@&4Q zswCS7)+6u-HP;%GGiwFeb0l$_dZ?mpSrWp#v(H7B6L0)m2EfYil~L z`W5=4=f$6Xqk?X!VRLl$EH!ea(Q`d4Z# zO=~wIt@+-BO2xF66;<{DZJYvq^0^E+f=wOJU_piv!J-xzv%rr#XphllV~?z3A%#}3 zGXXD~b4p^yy6?ys7vgMo#Yjd=3R>kNchvoYR{BrL)6Sl9Junl^dAj(5#JkG;p1$NY z2HLBBzT87jrVBkg|Iux{Mb$*G(<{6Q9Ct!?_V{zOjH-{%msO1xM-z zz5V$ti%zb{$e~aMJH{gs$ncX~lX{w_$|dpF1SFEDV7 zGmZAlU>bo0N_*{cYvx#voYms&CdTkRG<0=(#kRQ-y{it`&O{mU&4@yDE)HYa$0M@M z8zDDcXq!XZA8>V{S~sN{_6(cIArHUw!xErqem8gdWdzxy_5E*-u@ z%6AQe`IPl7J&ZD02Gb49|5b%wbP;$S6pA;wLM=%V2G3hSyy2eIU5Xk$!>;=+SP z&Cr^5-^zag@q{VE98e=W3(^t#56h98Vbx7SnRuE@b0})ThSZ1Aw1#0dqfS??*_{EZ zuo3}Nh3mxlk7ROtDl-PzQGSX1wpBSUl)Q{!u?Fu{*(KLMxbCPF^53&=P%NSadJnw( zgoicbndF^UwR|}-N0%PQGwI3L!3sMnV*TS^l8?2V8p|Bj<5W$vfx90)AX1*BxP4tM zb?_)Tl00)(+*4NrOj=%mufE?nwbRVkSwB+rvL1f)Clu2=8t}}aVZApH@bI_ttLlw2 zQ9!KkKAl|i_|n82#x2e6YxQd%e$}k*N%(6RE6m)?6y3mXK+*z^iV)Df%4mLB3oYao z&N;l`RvKUNlgLcsepc04iE=9n+zZt1hn|{&(xlK*jh>W?5u^zD@>yI~zLJYbNL~(! zxR`c>TGDH`&N;288EE{52O?NHT%{f^uRv1E%Mw8ER7N6KDN(pT6fU+Sffyw%g`E5}| zuu|??nlx>-qt<_9>`=6Uy=&2c$_C`d!<11RJdM`ACr`@^Xu&+jfqL{3B@w2Grn~RS zqCXuUclvo>63*~;MqRF+k1q~b(|=?-mp1E$sl0qqHHloUQFR)rMSYsr{@7shL8|1U z5{jG>k#u@KC2zyb(H9&prq_%C?zd$V`W0>3;&OZx133j7da53mrl#dX>*%fM@xIM# zAd>%sx^J@(xY@1X<;o==xPqNu;&2rDTdlYIInHbZTGQ;iYW244O~5$~{lGpO5da%J zTeK+o+gctQg+%PVZ^E8+3H#f}>TyV!eb+2ut{b&Z-NTOAt_4t493gW}S3Hz#Ry-Wz zA4uGoN|E)Um06xVKPPh1r5!)>DAuF0-=vr?6$YAmKP$k1dpz0oLPNFTxRLW=XS%Ys zRg36^TsCu(vL2d>xD+emhpP7a;)B{H0~TSIFc=L~1AiS|ScQCGEILfF6Ob`5f0#Dl zHiw(~eb;R5{ER|BJPdw@@H4jXyN^P|VQSwpxgaCypjN3nhriXk{+kOxA5Mz*wKO&i zgm^5+vB5WM0T<$tO3?Jr0Y+KPpSpxif0qumM5CF_1p=^4!?Ba*kJOh%6qK08uSutp z5|F&Nc+T7snlS&~fN8e&#nj}$nyKZU_WAlKhAZIUssfRGTDyarw_ErQr(vbi{b7!4 zY*THzebt;H8S`j_dwO~#39^&$i;5-W`z^KrBIR(xAsYf58E>YKYxN2E)*b(FJi+gN zUZ~!+l`HEEa}uFijXG9T9~kUokqH+^B2PttmE9 zlH<~8M4=;cxN$B&H%*BxUO;&*5G62#=rx$pkH;9x_SAc625dw1+_ps+G5l!`Fr*$l z$1gi)fTfHi`)scD=o3vr)=DR}L97EnRuN|ROq>^G%&)}$-`fU>pP3UIl+`R#*0g{p z1!4K;8=V+@?ZHBj%}fIOIW3r0b^&zb7jE$hoLr{!V38APl-t z$1$ci(MG@vPJ_w@B#4pal`F(7RGvoNgMY;Ep34bs%+~*=^x>UQbb%xx6VX1Os=fI; z!eg0e#Btn}is=C5`ES!Q#WMQur-qYKJ9ry|SOS0)_C%6_rduU#P|0E`Ip??kjiWG_ zETRIuV9`+&MyK&XiQ6)y7+|>t{nABtKZGDGHis3c{|JXNWstzm>t+5xv=S zlv^c?syHmHCCzS2hSZ-KxW6H%44|yl$cBUKCt3?$35j|-%NpUd{^|cP_32n~Aka4x z$}>Algk`*6HbDdC^jmS2(>+q#f{M&bk`+$I{N9E_8T8Sewsh4Z0*b^k{6v{-n5 ztN==5tRnM@_?ZRH4y0bXs+9RAq+)UC-!ZHhBHfrGnpDblW7fy{`;iAp7@Z8q-ltmW z&>1R3{%2ig&;MNv0K%UfTf&TnDhDS#e2`BoXpH|{_YH%a(?TbADNpZWk&gzs22*goP34NpVLJKN>^28^?&`aXRRF0yilNRiCoY{Y_UV zm?BHo zBW?=R$&@Ij=3%$-N@*J^qiB~_H>8y?#mM5u2|*cvyY&>Jcu!H}qb)Kwg| zakh$^d;TjnicoXvQ8Os#Kr`S*0$G@$p`Yc?O}ZTaC`p|cp9idf-h#}N+o)PH7s?+* z_5Z&|Pt@dc)h22vRSsZcIkMu4+s(ye0U`>Gy#J4=YYMEh>DEod#%P@E*tQ$nwr$(C zZ8d1rG`7@%$jF$uwZ%A+FG0CXHin`FqV{Tsr#bjSW29g z?^}VT48s3DZA3L}MF>?$f^V+#u)=a5U3**Bi^Tv z>C$k?(EoU=NX4w!szPa&-ECoEqriXE)IAepDqLb-NBG5|@wF70Qh-+ssh7XVYtA`~ z0mqaE?=N=XO1j`6lYfonO6a85PkeHQ)*CafUFFKo_s+wX0tITa2d{=)rI5;zC@D@7a*T#Pp>adFPH=1~Y#@jLSYwPuxvY0&dm~obz zMMJJ$-OLQ0v~LDoc5>+cpj@C0z);aY;Oiv|r*M%hL z?=jxGVT`H}NA(2Ap+~R~*Ws5h-#Mbm<+T3%%-N!!X#T&NLs&)e<~MRocLp<~a{;q; zqy;7oM^d5}b1UBrz!QcHOS!~8PZo!Rj8<%q%Wn0$`7(BKWZ#WW#&qucW(9#V0@Gruys?CxWQsQ|5{^t8Q~_5QM(GVUk=>BZ%$utE;E} z_{9Y2ObajnZxA3i_>^}BVZ(C))<SDb^cNM$V_{0gCfn1Q7+cY(!I=yDjt zqz;jCs4PsSJRl*U*&rjCFW!k4c}pDxmCg*%M9Y}85d=+1WB1=+)J$9bHs>|Iy^AKOSyAz$%P? zrih85N@4I>z_1fP3KbB(m7c12y2r%Es7V)NmG}QJjK8^!gS#^@>IGuLgUkW@_Njnt zM6drQUvugl-ZCmXzQZ?`VTX3yWTC~m2dbnO6WDjQQAXv)c5q}OdR1^6RJ(FRMx_CA zQ*c@($ufx)2GLMWo|^C|g31qu>2=%Wex|lna<8 z=iNmO-eky}_^r{z=M>WI^wxRaiRp(4S6f8OUIO@~tL*9q;G2ZMbDL9&;oVJ(Wx22} zwOm;x+s3z5JXKF6~i1TzlF0UYi*{qFEs>__wJ48KmF1$;N2EZJ$m|zQ2_t(*MNOv zV>2k!l7JgI#|U%Gum>dA+sW_1m*T#Wmfib?-M*XOn>JdVck3L|+l7gCM;OxYa)XIF zvBaxe-@IZABS!Q($a<^;z;6W?d;YeqJ32`ZKLlH}Wz%f`Lt}?3*Nu7nQ})9ref^}w zfIWsg%uy?(*dRg1{}r1PG2f4G16Bsqh8Z|a;RTCB1(+^DJ%Y+p;Z3(;0~ zMye(4tCFNkf_I z%1oNA4PLJJ)6xc>gQBR>TYq&gJYxt4!OPUu64vB0o?k1QmB4E1 z@cIe&`v68KF jf-Y$x@+)YvTu4zE$d{b)IHxzp=TF|o@FI8pzt7ud^v4g3 zYCEUcucLy)Na})5=KOjWS2y4BzI0%s^M%5X#C{pcHRi}6yZJ14TkBuFy{KPStiw~$ zW-$DfzEp4idmUkG$k%f~`)fWzMn?5eW=spvx>}l-A++G@Pe)F*^1l|}fJ-LoK(d&S(6^4DPI8!6I^>mAFQJwS!iQ^Gh!2%O?5U$%@Gd!b-o$=>>&ngct$t}CIjql>=a0Gv%(g`vcB%T? znlWut{mup&7OWGN^3Jjq%z{;C!H%TX(1xfjyytZ8?zLTGktooJ z9B{c&_XJd*lz4S`zXAlVQSK|KtlsS`241mI(QFMA=q0=w@qTHbZ@Cc+xlD_mL5AKT1$#NixH+Zeg|#XHv^XnvR3M4co>% z#FCLyg(LRkrmd#g`as@5O3G!t3IR6JzG=xzyZVMN8O7|$&fLP|R0t{wtQIX*P&zN?UisDvO+dnvl~mV$hyv2@q=5XF*WS}C&|?;B#Km2ebY)A`bt_U; zy1NN>qf@ndDL+!}Vqt8zo8x88FoNTnSc&yFO_(q8Pt)BE7ke2b|7j?3p3$jRjM_S& zh9Z#;qPCuIM*$SBtn)zA>RkzAy>@+lXbE!v*?sN$EZ+pCE^gEsdRYEaHZx2$B=o&# z*(n}iq1Gb?n~#_u1^r2B@r*Ib{0vfNMWU<~* z*L~Y_??@~A*%w?hJ>zPKT8d2Ob6X7GFFcaOO( zLp)2p_MQD!#qB^bWqMq3(p=fJG#gvXASJbM7h|wQG@Yu*WqX*>wSCe2$t}FubNS=N zSYwRNq@VH}>s~uWgIkDmL_^XM-CC!oubhyZy&5S0?icnc3s2PhWmC?{2$w%@X;rVo z4Gi>RY}p(hJ&OZERtB}tE#rhgQN7?n)6()py8){FW~)A**(p;G;};@1-pNc7aA}j> ztpPyHOu@Scwzp4EzuGTW34~3KA)$h0>*Y@lbW0>Xfm0q9gX%Ru~yyR@9rv8D0n_R`f(`nYIbi# zG>-3G=G1dn?1MP1^KG(vhS}$^+fGQ0?CNW_oNVN|8Wbzr#0gUOs&YEXpaAQ(!jy25 zW#!z^7MNPATJC{yz;$IGv+bO^AAb#4^5_I%BY| zbxnE0!lThQ@3rGWFF_v~ydAWfZuAJ-f-8Uv+nA63La)DWwKL!b=G93K?POd_66Gb} zXrQaemx7gb6oiCGYl7V2w`A`g#>- zz(s!})t++^)%6=Y5Oes~(S9=}b*9ULO60fw*R+Kliv(wYYhfM6fRM|6O>MM?y zhpiO>?@imz*9;%l)=yc|^*qeO#RWh(W_B$qy%Dm`y3}VAPwK3zj9SB}Z>LnYdaLV6 zUV~)$9=zF*G+KyL6u{_3N=!FChMxYA*69fuc&sI!xC#K1CnOA{AB7qTF8>fGbhez) z4i+=;Z%(QE8$VwA-70_()G;6g03iq}Vldd2ZpZFAmJ?KT7XYe;UHPa;knN>NTRj+8 z;Ec-yCFsR+V~eo5qb^{(kL$tG+TxXSTumR)hrteQ>4|<{P{x}bEd0bYKc#eL&!0Z| zb}6ikM`qy-BVX?7^Xa%B@$e#mej+*yPlVvOze^=*(S2Qr<~?BIhy}5rY><2%;+mg{1$n-~a!Qwff zEZqnV&bVkpZ@IUE_xM4b;C0!G9_@ivvf%6+XPh(yH05`k6Fm97elnB)AhF}l@o9_- z&1YM56%ghH9xgD4IBC|PQcod*r>av#Gq28PK_edWrR)Wxo^^Px+IZSUDg{1RlMhR* zWNPB!;c5-hH;AaP;V$y2@SupuX7(iq&#|^45sU zQYeM!Lh1SFE8-?av13DC5Vw3BXBYHuA~*^N1UGadVt zB|po!8}^IbFZ9~pJgVQ#puxkz!Tj1CbR(6V(y;h#IEru>ab7j^vN~`n+OTp!?C3K5 zgxyH#u@H|AWIJCyp*J7BUdsb)qCrNy!OVq_UCF|mt`sGGJgMNXSB28-M`4|a+%0nx zv&VHGN-a3SM!&KD($Y)=cspiQW%Uy6>wIf5RKLRgN}<0CM*JlvT2I?Cge1gP34TnJO|mFt z>69_u|Mb@1B(kcd!dujMCMGY;DB$CO_&+l$ zcx|WfW{~yAj3O`~k=1LHrHbhtIKl=qC8L#=^DMFBRBXy(GG)0?(ix5*mJj@pTO!&} z;l+g!Zv7+d<(&{{WqX(_8(%?Hie4)mT0g@V;h?C|WqPjX?aMI=!Es-$bL041BMH3V z6WAY<2<0gF3sUNT&hY*SAMuZsvitr8ul;$YKvsUyCnUFMt>V4IaLCwtWS$V~K)UE` zCLVqm|Mol4kseR}n_6Q;V{^BCcv@>n8jkp(*5itG@eiV* zu3r;~011%fa1qIjD`I2NVzM)I8NGM}BtvJ%a!rM)D$+=lU zow&uD`>$`RNJP$(44W$gEy(v>k!|=g>F^|=E@(gc3OPu0;yi;|h9c-~S%}2bL^-tW zvE0Orf)tDY1-#(qv5ZCNihtCRM>jBxzYb_P3K_zVozp18!U?$ssi>XF>^&VRQSjOn zA*I41RioD9DH^>!q}CZHTAG@cIy@cOVAfHn2o)Kq$fO-wJ)hP8*{Bm)_&Qh1? zqHOHRo%LLb0;iyR#x`D7@qk{O&;yrq4>OT9|Mq%1oe3gU5@}oY&^`3hcgTBh(`v$z zP;7L63fVDoYsz29#hIP^cfp0$j9VX#%LfrxlgmvDrf9!c z8^VPuPdE?YL)_K4a8z2;T&x?%wo3ytHcqExdyZX|SFDB1MHQ^`(;aBTdV09ixz?W{QEh12<3 zb-ciE@`eYUubIpwrP5d4*VB6evY^ztKLSEi-ySM00r*tXPRzC}ZuUguTef>Gu2T>CxT zhbHc|M(o{&+Nszj4S}YU6fCKEAFVW8$nmY;IS|>llLzdy{}~UsHb3@$eKiYz{i{(J zCOX3)k~l&NaxMMzji}G!fSww}=!ib6bavRt_uN>@Vxa!F;JGY|^b`~86!Yd~;Kz}o zn%r|Xu51_tDO8@9_7O`V0EOxyAp_lRR4}l?R|T8Y3gLCWj)|C~h%fhYt29;6FbjHe z>Hv}Ezo@D(7Mm!hS^=h~1v-*Yq9Ck^7QcdumjE-`utq}b5Q4h+bu{ZVa1)B^-R5H& zBIp;PDcP4XXk^r57VbEdGiX%tHg{4*LDz)+$gb{afU<;lj`Za3kU%Ge;N#=YXb_-M zJ0d{%rj-|GLXk1tx816n8Jstm_Gf*!Rp-DFGr~os8$)xj3xq+~D z0UhOl{Z>4S82o&96pmbTa?t7V@2~f2lm@TQ?aCe$Wz)k|Om?XARm$jgn|& z8h!86IEG*GsF^L)SQemp3UO{b+$nb-^x4lEmQELWZTh6jes|4|AGzl8cG%}gDf9Bi zv@q5+eN!XNjxqkv0`+fz|D+ffR)9fQuU@p+eaiZ5!yR}*PyETyj+HwqGOBqdGd;3W zAuIA8AA3xJGDP7MlSqsC`(RHrR$}w`Il32Up&v+*Jnm1qCXGq%+U0v1c0D00d zz_Be*CRIoAbL{SF=?)LyF$W@31hZvK^1R({-YTAb%gi$j&>V6A-(j%$UpnvL!eDO*b3M%W{lrx=3Rt_9}7oBRhQLCV^4?L3@C!TKuq0MD_CS zW{&rGwx$EXCQ9Qr^)P2@K4{`?de>{^oig%PLOZ^`oOTj!=a@Af{oh}6kT!8_ewdfz z>?p}Zr-nA{YA_+lXC@aren*m87wQJV;+-c8ZvXJZ_zUUF2p+=8uEAYo=3ZVeEE~KO+AyBX-LT+RyoDFjzgU~l3 zesM>M3lOEATd7nNo7n7TN}_|Yiv|6E7b2u{py3~3)Ezp))v;!w~HgK_G3m$?nlm#nWRQz#jsBpONeVC+`isIbq!2+ ze<11N$NI;fZh#odLP9Z*Ad6!Ct$F^VmGmM6CpK-tIp==tBDD3qtID7!%Yv%qD=NKq zZS%TaQ&9~*>M&5|MNR~7?M8>D1C$}R*3S3(`ZR2(ug_q#ODmRZf;RY<4}lY1$KD;?cFX98cnzWnT5R7gf0 zk!Fn;DqrCX=Vg{DQ<(SiCqIX@$t>YFP3|8oV(%_MQAmh9`VuCWD@sfykQ$Ve`=H;2 z%*IIP2F4!!Zx=#jp-}!KHWESSm1y_=$wkVQlqn&)A*JBJ^F z$)gaCUiB)GLD=KlAghH+2klOHgh4oHlRm}`j7yFjoe#!CekD# z$!lq9^xwAQKbzK0h?q;jn~$bR7`n_j3r_H=d;0Wzl7ck)h!gjT_Tyh-$46QX!nnDl zV3&%_>nO;8d##lq92HLtW6oa4ER%*Q4r9j$@otr~_z>bgSrHG7WOWIP_l+Noh?D7= zcV|F}?e6|Mfb;u^;lD}l0dqf{RlH_VEYAmgAtE<+l|gu zYCflVGF@vaA>(|{ua(u9uFqfBy0BLt@Fbll=m7~m5|_R0#MV9gd^rvG{D$Q4txM8>yP6Gt3El3CVz7Hp>!tSV zZ5)=dV<`fx^Wd1RYFj1bt=A?&%iZsv8hf1z^*29bB+@cpmbRgLx}Aimx{xZ@3ICE0 zqIDm!3s|;%lAf~M#J7PbfY$moN_aKLl_?@6)l8^p@45Qz5CZgq`X z_NLlLhbiFKy{2U>=+e*2(i6&abh7r`Mbkwa+hVOEM#BLlxl`m&T8MF z_TwkFEkp9dE>0Dq1l~K)VNryz}cX{rnSjN zdxc%v+`!F<1-p1o?eMkkl)dBED}=}I%IqX;4&~q9qWB6mdw2om*|b+QL@^%|K3`f$-ZM1_1 z5=*ps!3RdPj7~c`=7`*fY0T^h>S~e`8pPfb`ffUCD?(3$S+`G&X^#uM^!~sernZir z14BKQ+kY{AabM7d@UuD9mQ&R(JM*HgNA3sF#+AFv!2nC7@hyLzTETlp2P|#PVeD=! zVU}fIR$<9ds6m`(wKuB;YSOH6>=1Ta44uBeWV21*YyAT`o@F={|09xJ zsXJhce*q@lQFq>kI@IoB$8iBx*B=(p)z<031_TMiv~ug2J1jL8S^!_(t6zB}N;*i) z>~V|BCrV7&<7l~vRy01k)Y&ZCoPIJv;Lh$1(v5$$ff4SrNO$k_CRbE)B$DSE+m2GM zbxez>3z?3eLlo8Mjg0$41aZvaXv8en$rwUwuY(~!NksOLgr|;)rFq&Qk%;#QTrCy@ zTm9n(+jZRBId$B%)ta3=!NwnMuxZ8FOVdP0fVg)WE@DL*(>D1>;9B(e@#PVYT`7+l zJ6E2XeeMj!FXBWt!jx}*fEH$xfHL){ZDch%I3r=p>ejI-TF97#oT=OzwAmJ~>*&yay^IX7-kn}+cMV~KP%lFAt_Yq)ETd`_SUESb>4H+w`_TWj63gGSrT!m3h+wK z_G^fB{!884AgdOH<2V)O=Upu@eFy0nHZq$J#+d{wj~X6}Hy0`{p&$f`J>SgFdk)s^ z!vY63g#Qu(ct9xHIlGoTUXwsgfew7X1c&&hR+9wU1K-&%V!j@79B$xl?Ef~fR2M;G zd&>g`8s@00E)C8X=6dL~7R6^4~0+k5LwVs9XoXekZbAC{8(JnsR3`{g$_CJIBz)?FF=J6kVcitz% zO^sSxFKG(^R$GhY=zKe8`fO~8VA6ga?8Uhitfynf*@?6H?BIs{3%L;>AsGAUAWn>_$TMFF0`QkC*gK=%b%{>t09~l+PO5dKdfTu5XP~mg>mL@Qa}jnylJi);O^^l_aN;$#mCU_T+T^CGB$gxNxgz0V)Q7+ zWR+PdsjdXMoO54tTp(3?e_HF{_)9SF!>rPe@|#kVwqtj?Na}!GkI$##BGS%7*vajN z@b3-{^SJM(L*N)-R(sF~%S!I76UMcZRPd}6k zZyQ-wnV0MP(weWEBYWJp=Y9&XUoLlekU9G+tq2Z87F!hyiT8{n%5m_A)=4E6QB}~l z^+uF)HvOe=SfeRCsQYjwpzXb$@NiFrd8%wyj8-`NxDp{0ka<4*@`%1HRC#V5Ldf6q z`gVNwTigLcm^DICpzZI8A)^JJJhnEgYZ&fg>! zh9(sQs7~^`Ii7~BI_9LJ2<7O`*eoLCR5x?a1zYDGx0dIhtap^QR!r2}w4=7^HF_UO zsS)eS0ijp3jE5LbO5l~k zZ*w*Wpe=4jvV^g8X4LFkuYMj-C9zU!3y9OARp?=z&}+?SdEHHRVt(=rZs^)Wz~+6( z;Hek2)2Xx2Kd5kzziEVXJYG3bwmL)O*op6X<=$w!-&b$S8#uPBslnpVf+tI85yx}b?eq_cAs{zpz6gkSV(QsNy6Q2!hbE2wjjy57h=AYB+wE^B1HP$FND?= z6GS2OL%CoAH+*<*5c7D?2R__F%P2bu%y*Al%P>|Urb>chNu##uXC#HOCXDIX>R@u> z_)d1aC=n4p1Bd}Q7-Jwigo(uWT+dy%9?dp>uY-dUrl%>q32)>*U};Ln6`W|6@2l+A z(f0!{wQh!Sx4Mr6&3V+TSr#sC7SEMe%}$K=m~GI?znf{EM*7QN_ByU=`QRHMNBUtZ zYF1vqDMU`rs*tepKI7UzWZt)T%AVN)i)~sf`8|Vye`z7P7paoKivw#YAF@B2PSlX|0MbNS+Np5EJNm}P7B z3vX0cHn_L&z|JkGcVklcFF}G26-8s$5=;c!rx0*gi>o;2Mn(;mY`20qPg>O7vSWYO zs}Dy29Dp_|d}F=I#XNfNMgv;KVkj*5P7$4jwwv>y1Do{zhz=RKu+}l&eo#L7_&>D7(*~1t7UKLU=M4GnbwiU{Y23j{t|Xj zfI5cVm;-WN8q~HZk(Dq{f*@7_doDZ8N4Ol$z1QT=Gyr>~9U12@$a8>@i3nsqom2n4Ba*@uoQ{cc%yRkhXf z+=Uh_sVM?Ss5k}gRFaC{U2tenJK`PDj&y)(zOIi;Pd%w03JYNEa z^$f7-8msHZuN#BDux)Lh-U0e7D5XLcaL z$&t$4-UI)oWTG1iy7R7gw~svd+?|y3mgh41=e1#zmNeLRj($61Hfv91Tz8QD>BpTHu*?M$4 zkTsyOaG<&{XG6u>5puVL{Utr&=Ys-4ma7RL{DjHryb{2fatCLmzeM|WGI}CqL5aRQ zM|4v}J%#1S8$jnsXWM{qd9EiNDN*YjL|s~s?--Rt^W?$b6@YheHU+v(e}9KDc7;D>2Angd7_pgMVj6JmI?h zHtOd*s#;(JmUq!pcZ{t7Dkv4;@~U0+8`W0^Ck_~EK5^&=8VIR)-~02v1)j`v?Xlp* z@_f!WPp4^DFGBN}4Z%Eyx6u<;gFmk(B`|n(F)ed9Y*4`_)9J?TYYRQn1aP2}%R=Y# z&nNQpUjKG)O$PsLdKY$LnX=^3wkSS+X!mpLnlS~M6Te_T4|ckz)?-5Sd$V@vm-Yx! zj#T|CP;Tj9K3iB{Mh;o7F7&tMNOr5}y@EO)ipia$13UMi-W{Nd`9qN4Q$^95v>c1U z$QcE`aS>tOpdj~Aj}r(hh7c!5+cn|5!+6;Mfi|`ZI`xkt?vLDX(1gLuRBoMA+KZdU z9gjNP9@AVsJy#80HB>!9c2{+xW1^r z2oiPfMOv}@nL8=Tf;WTZ;+gO!k|xmsftE+nD$CZT@(t8(mIyM}fk{I_VGy#7BwYyp zv8d&B?g1*=c4;=vi)?z{GO1$Bohm%YgG{w*-A;RU6PYpF4~po9V6B$4xXf&5kHL^etBTiZhOYn4VI=;F7&!^6k3t z-uaYeiEs|&(>;(+?DLTzzLqcp^`k-HHx#nQ!os%pi^swzNxroDhWiErkpCc4)c}@*FM)pODp9;XHpo4^K z0}zMXf=Iyc62bD7?ET({47Vb*40^v+{_(kCPNp>+7+(!bFKDn!f2-=tl7_GK?#y=` zW)(YNY7YD!a|ln9+rEvlDylgzyY)=j5U;O7pAvbq4t?VU{$%9_XepD(%B`xV z*j&e^La67CyK7nz)=XC zkEkR>Clip{&6EYBkuXR}_x|Us{QL0>BPv0Wc;>8B2DurE7eCo?W8bZYPl@QjfNIee z&}ux7_dB%}1*ej6E1(ostOP0~f@AK$cqR^I#9W$}cgL=MsleNchFLhV47X2bP1k~C={U*YFn8uz?)ekqYM%-6Yr9AouKH!g z+n^((P<^b%BapY${uz3XG5{Jt7ZnC*=>g}RI<^&Fm|b~#B&X@)a{Oy z+uwpVX-KIPlhLMX!y}*Jswn$FZ?i}fmgY)|bqLq^!&p5jsdeFX$6W`ZsbuhI~ujgmWBgTGuyR?j( zy)c@P8P9LkU+1comCtUg0kgZPshTjYH7Y)eLcTi<&e^M@SGGpq2Yi{Di5N#4zcE&# zw>4Taq>0_JspVNxhYqNeTRj5hhq0OZ#Ivm&R94?5U2*8fjk6iBwe8`B^p`{>9{mW` zG8JCmb5BA!MU$gSW$1avC!{U%^1?^>(mj-r=0hVHML$Mjr6Enz9;Z%Dgc(ay2SsEkO6aJ;ljv1_RRP?%T zbHF+QI7z}3jWtHIMJ!L+grU8u1cnu&>S{H}FPoW-F<}|-C3<;VY}KkIQ{o-p4|h{v zGVmhA@Q`;0H;F0Z;Tb_PGJvoj=N@3c!qM&fOSVQGt@LvoJ1!F!Zp2jN7?>`vqUciw zf_7{Y&Z#A}OumGoZH@km=O3~Fz@H|&11EmLfzCA1fcB+MIfV21Tz(u?sfINj(9&r^ z^c`id;2pRQaWULrXNj z*id`((3GJc@wGO)U>WwVzLm%FlM+8La2del^RY0xzOL&Gsa)^?0 z5%)^QNm@pC+v>+}U#a+hu$>SfZfj_sU1u~Mrrke%_S|UL!EDsZ2Dd3OUx94JZSu(_ zn6u3E3329nLD&!Yy^dF)CsRb0aajiw#bDVnt&Rl$a@@Xu%CJoZ^32zxdC7i@)?st5 zpTaWh@jYN-0}fKT?+g>?)*Ss;6nGh8CohYwJ9oB1ti1$JN7!HTlj3GU;M~xHhnSW`nvpe#e`?92#N|wmA&NPL_db{%{PD8#4 z%WGVDE{xLY;RKJvH;9V^c4nKS`S9>%Co`PCc#Vb${b`7U6-)EWP3tprn45s#HUaav z0dnhU6tHR?Jjd3D%d|gj{`J)4@ypFi+3b%K*F+og)0!rWxoRtHbKxgqZ4dsM>>MDQ zzWm@9!`~Yx8L05M1ME&Xnt6s}9sB{FslNy>^fD5V*yuh^?11>unbh{=8@@{dV>!SH zM;Db72ndGq$b3Udn1*Om7G~#UvfsF&mA`QY=ls4Oyuk9rd~F`4(8)&}k7{_aX*`+CP_)n3)ng-*EAOXUtp_w8Z#jW4m) zV`2$seX+xzsBk~=PQ_)RIJeVgy6Ua#QsSv59>bGz09$s?E%XlOu{@GpXQg^bcLV1P zxZ!DvK^z6iFICeQsu9CXK)p_Dul;>6g4~d4p6Q7yYwO=hF5lTLH$#}zhYkyuaf8-G zV}J_@wa}OI=h*tRqYR!o%#$C#kE_Oe+?JB`OuEyOU*IFLdbf?X z^&6L1*H%}nILg^<5lm=JCK_SCl)Xy+)(UUz@zIw|tjyG$BqnmNPcbeohx>MCDHHVl z8&c|<{WWZF+{eVzugtR$_F}9ZPzm+gmAd6#?uGL$l_PD-%WGx)!af%nn!Vbd_$YI%h93^gRI8)X$d;Yc(hp?kSOVzjPKQj zrq!NIu_7Bh;5}7NW}Mue;2{XPVqMU7Tuv%xhpH^N^CG}?XC=kx0$OnRgOR_Y}Z z#`&p(5s{nj?k8oJ@b6$Bb(v@a>D*`^U0o^D?_TO*hXY=zWRfpxbWf$_&nh(apFSIU z;>hMWm`Eq5mLclMvvS}U@J_6)MTwoU`hQ)tp$|JppsLYSOSB@M!~U? zqSiAMQ~l(KBBG*`fRX_QE^Y=$;Fee>Hmy}ogEVRF?iP7Rc}*r@Ax({`uj7}^xEVri z<`u>W3en`^qRocZ4uDnmwHdv3UW&8`Z7claX$T4{YVc|3-uLZdWeT0p(Lgh-pELGv zuf^V)T{ZFGpFQFN7LgfPPyQPd$tJy)0}^cNI=xmvuU$BJ2ndU!ga=K^+Ih`$)U$M*2t(ku(8%N zs9BNAc3Dlzd6AT2-I2>`Kh7%CsJ+Z`L6e1<+)>i+K)kA$R3UjVtn4rsjWM8kMr0{= zhk*b2FlwOKYtzyVS{=JV`m?2tN3}Oy;OXf$rREiu0%2KJ1m8uKBT|+m+k&N79X?K` z27D0jTz)(V%mCZK(5^aUOnbVv zGdeG4&-SfVt8LC#Z%rGXY*M+4%qCpbwqX-IAJVsjV z3JE)I#Ji6wC>;wgUD0f*%RZAe31FSc0uRl>v9O{E!-wUDZz^FxIzRu;lX zBwKY%Sv|$;dHPm=iMeu+oY`QP({UKrx%DHV8823SGP-u^K|AgMJ%rw;=g$P{y|U7! zXbnh#$J9sOE_X(j_AEM=Otmy#&>KeZULUVlc5O%A2H&<$LtkpmZ*D@Xwn!Zt{8F*@ zNf~s*2jxfC#IjJ6f_!p}sbd2cgb77)+WsB5aXj@;4QJswf*E^=x}|q)(2A(^Ry!*t z67(KauCyCm{Jb6z5yh3%+a`bD(}4=&r@<0GG`l|iGGX*25@JP}#&|sEtd9}|SN-%Y zu?=_PzJn!`S)|1K@3>jaaY7|&dp4|8bve_h{LR)htw%#*6J5iD+hEc^`awmS^OL7y zlJo`)Y5{(XELZTM+1g#gzsFgyouaEGb5Uh<%+El?!>)y#WOt!c&v!g8w_ydu&O7ui zTXj;+GwOp!{hB)8prW%XD>E(-W(hnv%ov(rWSFS&ZD*0jzdN;^H!w-(-LqVM`)NzS z|C4EQ$f`MT^n)EVV)7qdYQCPP>wvUt+WM$aLhxE=03qsfoRgFZc@bCLX!Mxy@{6Z% z$Wg7jr)MXLk&Qq;cV?7b@UamJ>tw4}o{Zaf!oILI1Cp);)aaLWc9HG@-fM@!IjzrJ;GCw!u6eTCyvaj6+-u@AgdTpdiQ47RKM648jeq;S^aJ}`5 z3w8_t&Mie%LSmDm86EZibP@4P`=L(TA2sHH`If!+#L7kT_51RvUQ27a-^ZZII$J<= z0|Ki3n`bjc8QmBrsFi0r2HYj2{oC$sWXtvK1_ufOa66M@=sx88FfP&-HTp&O?(26J zUGD)_;jzxJ>dSE6J%lITyh&dqH28W=s3pW#< z@I|k;MmD?1GACW7&PscbH4|BP8d&u+Wfmra-y+(%gA840QaTf4$YxS#Mw7^bDC8zl z1C!~hdYKkt)?AHEmmK-HhP28OMYV@cYA7`G3Kua`*S|!2uwC0sPYTt|0&h8au;ED0 zBn-8x{}K`>4Y3zV!;6#)AY~A5+C!R8H8NmzjQ?EtDTeglE{N+W#+!mLXN+1pwb@;wcaA%?)mo95h#-0)O|M~@DSIQKU8Of)k zm?L*KXECcXH3KNGTsHWMMb*=&p49UvYN65nG`}e)n3Rec<;&}#@UBbWJf=07KNFJh zyP|Iuyp=Y3qxAmKCQJ-%e;AdXc5}$&qTbryxf&}3P!GWqa&l4oL@#~WYRbjB6K_Pn zgYW7t0Gcp~Pr!Ujlu$`1;+7N|oI6Rb_j8ATrMf%G{{8Gl(n=16ZfZDpIS+8r7~V9*pXLHJQK5vlw9q{X$)avJz-u_YO;Ct1q6gAi8tV!X zl9GkYHFn=kH|C4jCM*zY?M8~yf|nHJ1pv>zyB?wO(hjZZ7OLF%s> zK4*xv>3L=(f1L{8M^Q>~#-|7smxLiHD|d)q>WTDJq!#22YUju(qmJriVsf)AQTME- zpR+c9E=|kTA*cTD()2wKQ!}lGyNYL8I#4l;_Bkwu%F~)*76T8GD~uGgSOI&%!1`Y= z7#V+h$zZNdlrk~s?ztS*78XWCQk(L(I%d!xjTPrlWM9vLq~bJT;{QSaJ~c*^-%N=| z2KuJ;q3J{J9H6PZ8I}DWhS7=4MKvEwzY>q`suMn0`*(s+yJYrC$U3u9{(g3})+%|R z$|8S}q1+^T`w3|DjkjbytYwtYl3hbh1|wF#BJ1b~Hr~oU7Hh>C|74kQ=>w|D?5n)D z)tOj7W^C^`RGy&?GF-F)bo`22J|;;{PbsPT?Oq-cCsI}88+&Y^A%{Q&U8;*QvW0!R zW4}u53!KHTrQ(Zcd>^(0IR6By7CHqN5JRX^0>c%l-dZC2nVQ zvg2RWf1y5HG@QR+~VAv7?W~5Ql1|G;M`gS|wrF9Ti*H0S5<7QUtUo zd2$L8l8SK9(qVJrq=7YYlI}UE;$ROMeP7`zu_AK&>SE{_$~D8qaYqkEA%YVmo9eoX zKBuOLm>bE-Pvlie(q_*BOynB8%y`qvV0@}|AXzkax{IqiJk3W@FoIY-eNJ zdAEJOzxMs>p1pSWnsXn`IcLs%=E}8ov~wp;;_dcQnn7N5!2!F0+TC^uU(>fdqR`qq zANRZ^x~OQ|r7l(4t1V3L0?xH(EcB!CPWak^DwL2zB;Tq+Ei$YtB{ z+hf@lFH8AF7x;~32Vw#aqbzmOXmW_)=xcOC_%wG@!uB-q6t)fP;nJS#VMgt8ug#3p zAyk8L>I3V$;pdPChk;DRzTEMW)Aq`F&J?zQ)+4-tmpsEc-i<82FKu6IoLP{JCMn?| z9mQvW@EIl=Na79-hYB((Al$`D20%c9l}soSwCYBOVoz^JxCcFyC;vUB(+pciSLW78_pJ&>#O!fvEE zg0%ZQ+Kt)9)c~v5g|Z;rE%5geAl6!~%kRtW!K8WjCcM~S^VU*!b^bQ@OqP!PF8L89 z;$d@T1NS-{c)vTgoI6#jS&`$(w1q^E7MWR*T^1V04zZ&p_K@m2Gbcg+974Jr*58;( zt}%4ANkhVJ!V-yft@dc?v)sb8gn7$`o8;+{sNX~e0Ld29UdvsHV45A5HKsD>x5a)0 z4w|rXX&cHEacW=IPLoav(%jAul&VZL<|-Ufb3*QT6ecLrpf#di$ht{)R#35%zQ2HWO+M@@i9>AF4NeW(PfC*U_EmtwzPbdEXEch}4uaA6O!&&!fvF z@d$AM!*lGer}pO4Bjkwd^){2m^DH4JL`YClUJApX>P)>Kq9k&(-L+ zT^E}ZFcF|E*dkXBvdWm=&gG=89;TwB7RVhL(-!xU=xHI=RvXz*In|We?K3x)7cRQ` zz2l)maAun}u5{W<)U>7TPRk$n{E(!>cYCzQP3d!XAmrCpKJw2I;jZSES($ZT`Q}c{ z)|C|0SlMPFH*s|a%ea3^JEC>;8*UHNuhF%=PmEOqWk0fOMVm9}b!Wkf8zbwn?qlC} zNwCh%x7hWJV+!cv$x5+9|6RNv3TdOG=Azq4)g@Js{0AgseKMtdmUvhUj8JrTw8Ho4 zDyOC;HrU^0lbXLgKH6>EQ;_H=CvJ^%g!L*HyGX7bI-vi~y;W>4zToM;dKB;;FNTos zUcNa>eq@fH1)Sk9i)C~=(Z3|>(NcyJehr5FCTYZ|{S5;_ByBvRuV|o7r^PUzc>4u| z=D(Bmq9>OcXNiwx!1>`X>E1?+!scmmtaK|Ii(KkvKJ@x9N*kMJbG}0OF$D-zn-iUu zxe3Z)Scakv%?;lHq!6>Mmid`3ZEZ{UZkqK{^-K_4c{atmK9hR~!`+drQ*)NCXVEC# zJT))Gzqx?7elVR&l0!M|RP<-9dTr(M4Ee)QbBC*u_OLc5$E%V4VcG=|y+`5rXJ9#9 z6}<(E=GX2%7gJ*HVI|CVN52ixHoyEby@nF;h4*4Qh_&$Z zqpD0tqo3FDVEP=>;Qr(eT#jj@?O}UPz(>C&!-9yju+<)4EbJzcv0;1^${rMoBY0Xh zog;WBQ`LIY+#q3|~ zO}EiJ92S@DosD+A)fOMmygjgRtkHJ{GD2n4Wzg=R>v6@-H3~-9I6RP!r^-CfzVXMt z{46B~HS}gdQObIo5}TST^^T*uEx*l3P4B zZ;J`8xt7R2aYI;tKL)hXzKtmVanJJ{HkC378bP+UrkZ4%lC|r=WkD!8;pNhyV>bjS^_V8Zg5uJ5>i4hWYMpaK{?Dja@~xZsR?dwf zy52b?HKZqP>U&@}_G=vjV4vh8q+E1gZ{^)xHak}NPguEw;w5ARSPwj%Tc-zPuJ!`w zv`NmcfS6G*@Y<`pkODDs9$e5{5I=Y`1H`m5tu2p;g3;m_6ogtZ!C18VrN2qyfHnjv z2|B}E=V64`1|O?d?+HUw68$aNS|A^x#GNI=3<1pyl6bTr+iL416Dg6~_1ZHTYx~H) zfP8pWx^%tO3FJP`)>a!lr^(dXT=VgDMa^aoTp0@6tck)fo zbUd^sQ2)KcYgd~J5mumX{n`!q!isZG;ntkwBAWIR#345l(SGSQ#p@tsN$Qr2;(p$< zYC7}-W~kjX~oVDdQUL_hevUu^DW%fJ4J!0x*Ix>rM3u?v|t_ z0=Hr~EIVXNmaR;_ng@}|e%Gg_vO~ZfP5u-_jLZY+XIYEXx>$&{vEpTj`BlfVLWm>q z=-#Q}XNvp^PUH&PELFY%Bnig*oW3fP)P<3yAq(lg1jU-=4=Ph^yAc|IFAZwBzEX&- zD%1DuZQQ%z2c;I}3)>T6`dy%(R9o^7^ta(V1HgZriG!5bE$(7D963|rZ>Z!`*v>ut zDEp{yB0jV(M#eM*VgNF~rvmYgfIkcW4^--xOB;dDp)O7baLPUxn`9EGyA$`55gQn| zgP(9#Be3CWyF(i6JiJcX_KT{LgVCxVZx@`*GL!4^jMZ54+PiKuTd%x_^!vO(9giZJ zRSGQwe_qYnMe=z}4rGK(>4Yi@FlhkUvF<{FZtGfE5WZK6%aKx+1i#0V08d*(z}QB0 zEwwd3oJ*VhZ4r(y9z(plH)V>8r5BC>QRiPa-Fz1ydp^M@U^0?0HtJclaliK%E1mmp>PSVsa3J}wQpDy+@~brr8c3lWn)w|cTy3%n!@5Tb z$^sNe&Jb99`Dz&1R+O{AXoOk-JP^U?UmJSilJQ*|Evq+>z|=y(^kkgzHC7fl+qDgc zk}Mqc*y_6P8(_~QgGwupgMRap3Hn*ydOz94@p-fgu0B~EykMs4itqEjmIjY_@!{_1 zpmJlVS*U2hx(hV&Z&8()g_=uUJBUoyB6~FtYIrJ%k-5OZhC}ejkD1{NTlBs3nX~e+ zW|Levh#>t96vrwh4?Hy}Zhi-fyrTt_l42{iKQGUH2BL z9g}xGMvBjRwQW$8d&9~+9(*{bx3rtusaf~dO~J^+G=+`-*9f_mo_3DGhRRpvG^h{y z%-j{KnDiY=rfVP1{O$$XC?%|>=iwhxe z)?LJ4OUFc9{C8~4@)iX5d?a8TXxxRS%{M$wi*wJ+u?3B{XjG(2e0POB^1%K`ZM?>d(szL4Lc)6eB{T>!~^tK8uB_zmv2ga zXAXrQ{`el?puaWData~+1kwES*Xc|CTM4c}e10%*uV8?mgp>P#2fE|pFV+?OiMqeU z@0Roz}`NhKpHosZ>>SO z1^o_ZEjTU8fakF5aDinsyE>EV^js6oN*m5*7@I~Enb$a`g?njD6X9wn(nVX=<>=U6 z@_(B^ocv9Foh&-Q8B^94H{(^@jN2=I2;Jc>%IuuhS=G`U53buS9#5Y8dplD#EUZ`Q z<5p>CSg`WpFs5M{uS>wY0+KMwb#((pJm_;+!gxYCJt!$mCbwnAXdLN)te~>uGS?)J zDR{s#q;4pi9PcA$wR7lcaN<=de5QS930~81MnxnH)$@V7$#b8CIk^qT(N~HCx|`-D zETFToxlOet2-W*%U3=cYBK=Jd06^87R4cKzbgL?bORZV;QJ+fjZWt1Z-@ zW)DdHl~!VkRW9$z)2U0#uR6T`K4Asp|HZ#}#pPqowrRRfS#jK#GMY$>mW1OsKoOThN$|SdOMVg zn9f-jbucvxiOD?O%W`P9*GqNOEX40QJ9HA&PK2f>+ZmXOqw#2$92i-8y^5l6}cSG^myu1$R zU*-AqGh_2P{zP78A^99{;>FRYNAE4)5TJnfrw!$EzQdgGqkg;$VA5;qgS$4`^M-FA z7?+3);`^sFb^LLIoh(DnK%JRV0Qa;>-XdKIXO_Qm>_K#1rzloyUe6jaQwqj9$ga@o zwf&i1kH+J|eo)bRmi`T-;`T1n)Uih>SRaF{gSL4?I*FQ`ud5#(Pwn|TjH^gaUe3uwY_0u?^F zr!|DB52$;`z8fL{cxRuJ?BiX0rE9dkIw#b!X_dwhcug1-7_Uy3xtK9jD5F&?#FzpLYN^?~-6jl0=e z+UBw}5zpzYYgfHDp#|@%wJfEwD^QJfwh!%MX85P{mknLP!$Z=k$e+> z_!he(DG)>Wi1|X52C$3kgBd18deCO3pD;5@I+>!o$|sU-OHEC_cYJ~VyO>ASg#!Oz zw;v*5WjSv3Bk5QXyX2HRs)$Cdw3{Eky-db*Re3j)4NiZTdSqkaV;JRc%=GR$eNZ)5; zkW{9KopMUOtU5trmN1-7yPtf%(Y~+<8WdZWxMWr(NaP$jdYC?P*R*8*QUP9)@!H8} zR>1eAKj&f5fZ9T%Q7U(v9A0#@wkeeEq5#t2Ix2SiCjM4=fwxbts8;?DD2`R3hEaN< z8crS;5J@WFyJCO!(T9XxJym2Geg(}WX6Al)5>99neDGSzE>Oz9NI*A0u?*aDjjhH37(4JyaK^4-$nOUvvSZO zf&Ta@>_^*4#q}kOl7FhN$(rDo`Elm)q}W=Cc|l~W#~Ep||F9}w%H|$+^c$@mY2#t+ zGtfMFNcIt^;U2utvWCw*BNIgmxDv(aRpXB@EfV_#w89VRl%z?}13rsN6PO5}g=96d zfMcN-#s6DEKyQl4ywtz7*Ww4zzfM|088klygIDWtJAj-jRe)J?r!3GkDuQDOZPa^a zuP6?G?r#gc(LS0Duo2O`dFeI0Y@*IIr*a~e@WruXyXYnD%>(rX1C0cCI2pdnpxnMa zR7L;O1l1Bmn}};8OYAl-bw+uj0`0*BUTn^nC_m6w7pirX;~*q z^y88eLCo#Et7@aTQf&P0-!iio+p9ebX8%DT_Pf>?^!;|muN0B~DLOJO^vP{HtxF=w zF~ZQse{6j5zQE)!tK3-Hv$q^KdIPFyO6Mu{*ay9s9sg!cgv0_DafQ}`D!}_hja$Z0 zjR45UeZ~Fy|Lk#@aj(9v-r7hOzQG#>z_}~i>`fF)`!$7Q!de-w3NT^u=~t?v=JsRo zo&Y%vy_pGzvvE==-PX`o=6+B5zY555N>C*}SqkgXV7cPNkjY^?I!7tDa)*A(LRj+* zQE+QwP#nW*cYIY6+}6gjGkxsxHj}Qh=VX9vb& z2n;Mgp)VffB5zW1PiRzdJI$5H7_^MrQm`NqJ9_^FitW{e)lPF}YCXPcvJ%BpX*jC@w~4fm(5&-V-9=-Ri(kl^AXBm8`^o7jh%Q~b8zn`}^< zLLI}>LjRN&YR6QRmA6dG7x*!rH4}2a zUlL!OSYTx4&ct|d3)O`XpEJFdN#)9Bv27w7dt$AZg83Zhv#e0uOBw)P)oVbUF~U8b zBR!6qgYX&G2Ejv^eNOx;(LWd(`=L9opIIJB;q>77YOa8G~(F)N^)VKj9uLq-DGX{N;UEHm-V^1Q2g_ZO*F^m)~9v3E0qHX zYhDFp;D}4>_0b#v37=5|i=^5Rx7MEk%k&tI>5@?*=6$Wp2+tJ!J12vK2B@ykB?BI~ zu-^#m;YoI_Pd>7YTrV()0~MDfV8?PKDPmltuO^VVgffs5R4I=rNXGFGOwB`U0VaOC zsFRW4$(0s**38 zy#<8au(bztT74gDOvfI9X&1(WMx9?;Tej)H@GYS3(t}&57&0_7b9IGWkR*4((IiT+1mi+6dudw(h zn44(!Ev&~;*%zHga~XP_a%CKH<*`rt4;-V0`6nx@jS^wOh(>? z+v`v3X`4H)CkyXNG&8|W-~ZI0c5qZ0k}DHi^FZwEG9?^3>p^%I_0n-DG^0rjY`Bbz z`f4ZxiM#7i>@SyUh6ysUbrKco>dkOsZC#8QH91xaPwxsMtYs5x9W@&3HB6_eT)#B= zBMHGOitkqIxu^7%c?#Iie#-ZL#C4>?MBJCPJT0~Vf6 z)nLN%082}vh7U8yMob32fsi4*nyF)U6*U;9nX8n=#5k7wzye!?=~GM8ev4c?pfy< zHBBh~__=Hw-2@RA8RYis4V|dj-aaHR$Lc=bnZ4&;3k{vGsr*j+yszIHaW56=3od*g zmeIT$4aGqxT3?6!d8*qs)}&wWBs-cn_`3ik>&xwDvYZo~jT>!`8)xr_dP1G7z*cZ6 z`^t<*^AaEDCMdd>a@mHZ@IrlDy9fK@HT@3fwu9)VA5`hO&6b2st-mhrU#6ZUWmoB_ z^GJwbOmd3Ev%Yx%Du*J(d)OhjfcKxYGI86Hd1mQ{P}btARhUY72o_e@D8`oBtxAy; zf4W~BKUviTfi_VdC#!*}`H@h6YTkJP4S@sFyQL-NcE7lEl1~oEMuCrWiCvgn%l}ci zhKT%o8z)+poWV9@x)1a-go%#|Sp3nc^2NJf0^E_N+DgqsRvd(r?7JQeyF4Rk+Y zd!IOc@$q!5d-Juj?7>bG?a(f5xMSDHsaRV4k>K_l;lO#x%DvZ6nEAjr(Ie7~rFc3? z#HmYkiO)xA;q#Ln_1I@r@^RxodEtxEa61T`WdgR@RQi?ygf_PN#|c z>9U?7G^T0I^f}J&*|`US#}wBM6rd(^C|GXW(RDF*P;W}zN&t|4Ebp9swRjl3&e|Ol zJqBBi-pYUDHlHOZA!DT!4e{A*Wu!m9HN%a(i(OJ}r}>W4TB;oxTH z(2MrNMN8n%!est%d$AHN(p=7Ng!NN9N@%pI^KAKW(W0)|`Z4wAOlb@3@TR*~+-VC@ z3ExZx7zQqPukEkZ;h^3PSO_!hy=9BndK-b)i^sT;P|%}oOz@ctwB*f8nBr@MctoxJ$Sj_ogTms@dUH-f!?J*46#f3hC{nMwQ0g_f-&L-eP66 zMc#_M#q_hxy+(!E(5>(~;IW-%()i$Ed6}-7>MKoLa%t5^c>?h>Fff=2_q^$k$uc_2 zTm|8iwGR`!g+7#XxPa@hy{1Xhk8f<3s?%GVF-JbgKSmyfR=GM~4%NukLcI&(H>Jqg zb8y~&;+2REs$g4|yk9uJ3oAusJBYb}_*dlJDNp9=vD~2_DQ@_D$*%rL#fU0i=S z?GutUW$Zp781|CN6N=CwSYB$ChzK=?UXRDt2@YOKfv&&QCNexM*qtlV^j@EYhp!ZE zicvh08{DYW;0=j|{w7Zr#vxgR=$rondARQ{zH+8bhXtOJH%0fAEeNkRF=E^$%9&Q( z`_XI(#%CGg{fi%h_zFGs#ji0hH%DwGz}ziLgT$bN@#BE@87pHLnBH@s4n65Q43x}2 zGv(D1vUF0(NjS27dyBM^*OOAghtH*PAmUx#KY+k?H@_!U-|)YcXFS>}cU?iG-k0=~ z3ynQ#Bn*N5TJ@N(^XRgNtiC_^#WYTWgPqO|MygXR+W-CSbcIpf-jq_?&wmri=hop% zkXd4=XE-y`7 zev|dg6z96PE?WGPr0cQ3cWH+Qw8Z%))$Qp4YI&QLFM>dzo@`b7U|SVw2I&=wT9aj$ zp}1T`1%61Cb@whUa0;s`Wxei7@fSKQ;3ZFpdigb)ycxaLzOmq^>^V;3MRLyO_@Q-J zMnzqpu={SBOgZ^?0=tg3h!zPTj4rv8UNC53@Srr15H_o2Tp6nhQ2i+hV}Xlf?;6uAz!+$oe2Zs#@4a9MZ9} z>8OtJmr?NRMrz;FYf6EP>Q*U;opOfD%ax87{JCW&mDGQKFB+IG4Vn?YRMy<7M7+Pv zHMZ>l^0d=xukLqdzDP|Klm7{P(EI|xMZ=TPBPBcjBw-qhmBt=e-*Ka4!bOem&~zVL zP2mF$Dxv7zTv?{COX_^YUR9NrWyo7|n$nK;YW-|u#uj(nneEB%ERe6Ly_o=6NCZ9C zshv8xdmnmsQ*0olHUiTJ#?)f#9JeC|-8I!6?R5w)I8PXy2Gw6x_I`Z*exG>$TJ?V0 zum8#x_wE6B_wKoRf3UtdCwL)!ai4sTU67d&zWXlsc78mmUqulrvwuGY?v#CqtnUYH zDxXs<4I(a|*A{~ldmK>GLLmwOZ`>J3HB}zIHNmpbD?d)4l>e-y zWH3c5pWVrq0x=F$D5YTeRz}|T;V1}M!~Jok9cBo?gL31nBC~P!a;V!dM?k`y5wf*dP7@ER+;KTDj+T#>#G`^RxEsb<9&wyF(4? zDF=fHye*Hkh1+kO&_CiU82%{GdorV9Gx2+4ds^a4u$GnoHF>J!g$g$QNs1G{nx>3q zpkn&Fo$=tI`Coo9yG8mb*vSa0v@74R&b_S=u3nm{wl=C0QymlO=|11Dov|&8p98Oh zFbEuXkg2+AM1;wFmW`+2ovjU~=g63Nzj(td;yA_s!oAr=5YO3V*xHnw?sPLZuc z{)yM;tULCd_CCMm?YwdP*QD{niYxtWdyX9f!(dZ3;nvzOi|b49m>00ylO}zsWYOsZ z4_H$A8#vWt?oJ23i&KI;x`|u*fCTeFJ1L~46YoU(&wi_=d$)-6wuS_gTf_tLq$I}0 z!Tlms7APUELsx88DduWDPF`W?Mc@C4Q&iK%$xDSN^(gwYwbH3Fp>W;vgqkH}jE`8w zw5VJSA1tl*n4TRQ`e4Ipg8Z@8yW~{)TURXYqtNp`VZ$kkjHz19A+m^nfVweO{ydSB zKW&#dNfyXpW(lPj($fr}j`fe_;)5#i;trc;LSURk2Adm_YOaRGi3^{KcDIC?`fV48 zR%$f5ZmTl=by}K5;vb4Q3%-=BOC6If=g&*mJqPjF{^EUi#=-LAaT86MMiFYcPJHmB z_YZI2m(%0N8|{c5t$w*9F;is73Ug%rcNduyq#Gvb2;Gt0&|BC`sqy)BVih6`;mJBgxNSF zsbGM+mQ7z_^uMSp#_=;pzvWUwj%mn+C;p&7Sw4lC@~6h~tDY2g0;Jl*ZCc6rCo zn18+K*jS$FO!{;U(2J&id)SLg#%E8xj?eQ5 z_tbEVSXPvHvZ`!nmPYiH5jiY_;v0RQWv$i?yQ@L}wpElp!njceLe%7U0zmC+@vHtM zNveQh?o%?D?N~ZWtpA5zo;h6M4$*jvvOak0K08`MIM64RjB|OI4yD{D zA=q&udbXgpUnJwWf)$?{^}8PR{t|l$hq;lyo^TE%_62O}<1O4Q>&Zz)?-1^R;L?W@ zKSuf+EP;d{+loaJXZ zeu|!Q#1*2+m#)l3p8iyozXUo`U^=I*CvXD^%z&Bt=t?2hdfwz}#?@j7;qCuvY1yk) zVKl$gp>b`LP#GzL?b7wX(?knEXBqcP%Y(W{N z0{odIBo-7|;;P(`;JHS!1!Q0QW-#reicqX@GFs&y9d~7XSLy+36`^QOyl_fzy~T&? z867*5Z9enFi;s}Z6Uf`E5CYrA4yveswazChM5d5aoV;Wmny@w@;m5}w1+xaPac-0h z8dui!I4(^3O$!Bzpolv*Dfk(+)AYz}#~(k$SHWUb<2MM7Fq23V|CHqHO=Pbh7ma8)YAAWRn`mJ@RbTIpA zQD0e*c2=Jrit|sDbX4W^f`_|LGdO+gt*(bXm&Le%-9fp4Ej^@#K_PNx+(U)pxI9ud zd@AQq`Ip(znbKyCiA(a$GNp}=?2vOGZ^?H>R|$7<;gU~T&0(RWDysuW%H3Xwbzm-KOE_7p6Gts6qhU=uAL?j+hqmycR)=y$TCnnOFfk zLt;~%qYN69p&^jApE9MKG)+lXiWDNmgo8LH&w*ts2#3UHhOm+z(aImmKWN0<6UK&~ zcB~6HHH)RlT4ftnZ}U3cJhV$S;AQ=n^rWIy=*P|K<@)> zwWQK41v`8tGvG!-Q*T z0-iJ6_fIh|O=dm^PB!elKj%)w7is36&bLGzz1T?)=C;l#4IDg1Nw_-3Hy=1AoWEyJ z;}<7w-O&793m=ps^~UXFsy?-UJ1$5rOd%&6Y}SjPfE;^!?R-)G{0eFp@d#M$)w-A^ z7)lnsoxzN7)6|neJNM_deLmgfe&~41X;UN@RIHo`pU8&VrgKD0@|wjNtj-7$|C5Ir z6McT?#{&nQ%L?ySRM2p$+6sJgo|*pg0C`F|xA3m#`*!L0{#eSJ!}!hK{QW^d5Y6*y zf!86JBm7~1CIC(5k&@d~fAmTp(VcdU`>ImmXwv1u-{!tdBinx*fcN^ic65C&`CvknumUV80 zQ`djDl23OdPTq1-jvwYI^_wX}##hIOGMxlLo7kftve{zxfR@TVZ(T+AZRgyXY(*z? zcm+hG57v)kDcAkXR#%q4uFC-E?0-DBFQbC8d1HRDEfk+m0Y4-jTYlB*5ueRgDR z=%J>fk1)j^YLhD!A>U~yXq-P0vjFvg zFKRcK{};tl-XSvRNEARsC8jynTKhwqnDgp;jqUo7{S!2X;t8J9PCOO3?2-RZTfL3c z4X9~U*xIh+UEbH#Zkc09f(7`c%ZaZ z=#4y`Z{y(aw{wr3U%@o&2<3e)ZONwjq`1&ru}5$9Nw8yI0{Z25iu_Vk<+m%}m`Ns^OHP^Z6vPGYO8jIN5WLcB=er1iUwsVq3?N zD*fZrn4LFwVsuOq)AXnFCnK6?K=h%`RN39Kjz3ZCP}K)Vpo_*qi(I&p`! z&Ov?GKEOYZB^UJj#k;DIjJL*b?8^D8s%Q&VT_t~S7U`0NYeT`8fmP3hdo$(_-x#lq zx?TZ#5JjuN1?b?2Xy}^9O7nAn9M58z7QrC1>=%w=5tM%E0|t()tpwh`^7255bego2 zX$Hy*mp#IX(cj@2F)tI=&rvtD2Z5>q2bUZyzA{e$-z#ym3>TE9Wz50XC83|4(_v>WxwAMwa|0L7Rl*L;|^&viiC|Rc!*7 zb3u94Mf;9&v3Y!hfXmISssaK1{q!g%U>O@lk$_$6RTk;$k3Y#GmK0G-tO0O3rsNsXp> z%i%mF$xhD6sS0)87=hhY8albp*rqd!P<=8N6C4|xSdqLW+(Fm^ZX%)97I6HYn1FNF$89w-hYg8+#9|lg0;HpU>p2;Qj zV4sUQ_OFIzb&>2{r=wo0+Fx%ut6DGP@FAr%!XaPScGgzzOX|3B^53yhrn{FZt8ts| zwg>p*F<>BNxW?XP?wmgvpa-Qj(Bt)tun%IDo%h8t8HCM!V8EY_p;GNUB!Y70Jn5w~ z)8{9_8x$CZ^l5x;0`QD?30DS%T9purw}%K5Dri5-oG_6O5?#3ON($DhY9SWn|EV&| zzwYGT;Dt^*gUL*`NttpR$L&RlTPD`D!Gb~JL=golQ=|=@7CKPj|25dvgbxM#oFUUC z>%}L>s@}`W%G{Y-53^+OOhtIT+q=W1BOF)gNYj0)81-9Kw6FUj3{Gc)c;0F~r*A~I zFwAy%bVXlzjaNszo&Mw%AMXVT=q5#1n_zx4!}2G(MhPFlM84!0X{7|ie}WR;BMRel z#N~`(`?vNuYD+o$sr&$D#cXHEPUEUj4h=-|58jqDP9*_-rKewc(GMXcP{{T+U7nS> zgNP3gOoe&HE#9B5&CRL$TtNAt3R83XaBUFg5rne`s9Fd1P=|0KqcX zO=zCtP<{%}p2e#}n-MISy+nm7f<4R@jSUh@tXp!&?`@wpIgHC5roYIZEv`Pqt&iyP~I=pJ;v zwL|lHtP||u$FA_tf4i{iO5PBH8akb=D=1xmHN$9#q5k3|Ct}&1W`M945G8R=27mDA%0k%wl z7%-B`p+S1m%k~1g2qJlqVPAu;FJ}A-M33(rewps&Dm$A%b_ZG_LDqNwDo4$=9c3Y-0kJehdM7grMQBU#gCF>l8 zv~NoDYDLICGU@xz|7r)_=#9c)vh7;T+067+#ZSqz_rk3~i-Ds@{R}VHPYM+ge({3r zhE@J}xBd)_c=Lu6ECTu22m5CAcl)Oup0#MFC{JAFdanmB5Z^rDZU+qDjcy)w2l5FN z`Ogjv4ajL0G%xh^Hw0;F>24MEEB4AId-V%2ZQZJN6n*Mud%Odoya(N z?DpoWzSZNv$Uf`oEa2?uIAFqT)s`!8@5mD^*ihSBpT*!zIBI_UXK0-tWPyfOP_j;S z|Ncom?WijdZB>_inB`|5Mw3%B-OAamZzfy%S+-#e6UKC?)xirUZKBVU#DxV3IY%glIh8^prJ!JRy&_>BC9L z_i5w9C;oJj zxTVmAzGXYZAYSbqeScS`>{?%-e2^`BFH4TeCj{P~)}=%`Mbmp1peCxJ9QTlkGLmBVLbYX%Ky1EBYhC%jiXs)#WVgSJkB8DjC#F{pEUMp zRF})uG(#Vg_Os5(D>Opsw{aZi|3-z;e4;11n#K?JE1r-wjh>T297TNKuWUnl$_29- zg^QTa-D)mnR^AgU^b7b^9e($x$Fd2*Fs<7(?W^2@9{I-GMTkZth`M-R-2_F&1MCW} ziozhN%{V+&S4`uw!H!r|M@<>P2^9^0m@)*}yf(Vy?3=f`;h-IQxl}+m>Gu=ME|(fA zXZ|RUV4bLGk_L42eaA(m{AI!8)&#Hfe-%qdoDKksT{y@0c4da05D(U+ZceKftjUP1 z+2cUF+nfbhH-bFH4#(iyDyX;F?o4CG1r)G$=M27{MGQKzbhX}sED-VZ=(<_7m)@zp z>)K{M&_E7KX}u4AV_NiiapHzYwdL}ksnAgiY*7Jv$F2OJ5ga>zBYsL~Iz@o!7lqXq1!jC?6HOx1Xnds|YRp}Du-YSZDs=e5NZ z|2w0b$1$@`TJy5ySU z2^6);$e)eh2MN97Lc+fTMS}i1#pYT@IwQ;i#R5uzfOO)_u7d4%POQMJr zU}m7THr=K5FzRx0gHNRx^}ii;_r9d_CUQl&JBbIxc!{iQd{q)a(62-0IcB2O&Wba4 z-2#oXYXwti9|C$ruWK?<7h!WrWcbL?T>s|egIns|S3MzHg0iF>nP`wfu-99r4$Z_; z7AnCRrv2ReGVj9@1t*7Tt=pHTQ*97Kyn5CN-0cCtUqZ@Mz^1MCs21P64H2vmRZTdnbif%i7N{V) zB(T%l|J$Jn4+o&y!%WAwqcD8ybJ*7*nR;--&WrexItt6oe14x%7IEUMQFdi1B#Eac zKwXyfwB+tLd5^aVXM;hu@bU$h54kD!30wn%N}<<~M*YgSO`R2v*B$w8cWN*u=s~q( zPmt8lm^mO4>96J6(l3_r&HQEAL)#ZrhWEKE?G5AIr8v78ZU860GxKi4?r6Ig2;mRUm&L*Vre-0USsaf3i8cdqwhLae4c|~vf4a8 z3^`HCKQ0u_H44IiNW3*W@*0KA`r2#ztzND5^Jl8gUvv0e49%M#Q4@l&ju9zV#+U@& znrao@ko^ODdTtgX?AkGVdmet5&2O=&=zNmwK;Y8Jca13ppDKio=N5O5I{X=9BrS1X zv5b&}EKB?t?135S8<{`}4Za~@8sA)~V71Uj5ow2Ma`Xux%}7GW5j?6Ex-Ikz z04}3HO~`hHh&hw|hcs6xDqqi}H|Ddh-4_kA*Na!b&z3Y-pjI2!M*4N->{1s<=Wb>(9c|j9U`u_%9lyTY$n@Ler!092RdR!)8kfRxSv6{U+4ras4W!7p| z){lKweKn}s&?K3u@v zqm~#vcl^dtm)0&A+Yn{cAnO&(u6fKOgg^IwI3iHJM6wNd+#VoEUyXgh$a?s1uW+9*i44Q!pSQP0 zI2Xwe_k6)`nbg)j}-AKo!ySp2tJ1$6ii7zGnb+cDl3=NB)}1PeAc_%EI$qIilgr(Rn%%vSjMC|j zYN-zX!Bl$b)68<0GU>_1^TWeshxcW^A3y=_A9p6DWVC#Ad#|MkX|HaC0e|8r_L;e!(Gof&v;}~(_Z4DkPKa>20oBQsj zDAw`u;qS3}d!yp)I1dkg!96IMeHW{TpFb{?3@x6X7Kp=cxvc;XTi>giw5ax79alPO zUD4V++nyHZly1)*deeiQjQHhiXs=b1Ey*x{N&EJD>ecW^^)!x&ADJK1Vv|_@e9dOf z6iliPo)mt8;fe@@!i9+n*&?YXp+Ty68T;bA8A<+OtgiB8jB6UdPu}1vi=Vs9r?$4Yi|M88}W<$sNEaqr;1MWSWrcvh3R4*-_skC+;2hoxy=g4D(U2%?`+>*K^a&&pM0OR$ zeln{Z89H#B;|y$!_TssTK`8;-+&n+ln2)j2jxAUkhYYALPcn zIlkC$ayjbt76EturKnL0CM%B_Y~T&_diKhtx|gsnxo1ISp&ecAI$WB^r4}Wf4fWO( z7!k722q}F`=^$j0dMVH6O5QMK3%5GfkN6KI`z1!&nV)=%QtzHv*OIGU`OJ+RJb}c_ zb0T{9c{Tj;@$4;!R*RC}7w=K#ZQ_|{R7TcxTdCMXSAEA@3oOcPO`*7l@xUAzav_}W zvXDiQCEb_PpFRCn&N;?=7+p6B1!K1VrL^8Pl|Ih}+JbWgSmjc6+3rr_n{}e%2Se$7 zPWkg*P~{fKsD)BuO+S}6-MFJy)qF(+V>1;W$h;0ts)Md-NyHutH5giW;nl(~XIlj0 z8WJq=`KJ5yn>#>qe=#wdXrNMr*rwo{XiE{zNM5w42AMJP3KZ=h=fVzbUq*4r;U%^u znSBWHU$GmEpt>C3bHOBFj=;K-xvRgp-yh0NZ{eWtAwrd^MTG(L0=7;%K>z+ylQqjb zvvya6kaq+wH$9anm{zu-Y@L>ya~e-iZ`}EBNd9BeY}j(h+!o5}h?5_&bl6gaV25$o zbEKqkT!;GSqbueBx!n>EgAZZtzua1{M%ebbAcqsY0b6E~vf_T;7~jGkCf-|q(Psi} z?YFRloqWgykhfnQ{crXQ`5ptG$rP%SN7S&KhC`Q9d4KXeG@_<_sy4Rh^=^ggZ$`$n zEG!<#V4d7P{hOR3V}=$!Vsa}(N|xspDe5Y*2!(I$fM^6a{d8HGQ3Ew~tusRhcL+n{ zUr$}H@O#`}9duFhmy-Cu<($k)&UmJvI!)rrVB3z*OeboU{9H{Ne1zoL;kShz>Gu|ztBOO-%UHLIa8? z;&`~(%|4vV#-9j6cuIU!8#AX_k14>`2cFx=7q=P2PQ-^aE{zgIAcqn(a zu7laYvnhg64S-LtmDw+nT_&{uNyI5>l0oa%)XTBMNP!5S3rcKwX%a-PN_ z`Y(XR4o@f#h}EM^dZSTmPyZ!dW;4OIzfwkrsymrVX6vVjL5RZE%6Axm#OGHhjcu)B z)}=tl2Cge+n3Y_%3XF3bKHgQ{?>?zG%&qvq++ISoKOVM5`TQVuvFtlFGNp3x?g?k! zH?};q=Q#^`L6W=?oxFR1-#>L$ofjd8SV4_6EoDgT(q`&0IHXVSblNw>b@%#wxN8YwOcG;C-rSwsZs&zg>>?m2%(e360${)R=wTg^9b zv_o7+*_my%Gq+eHZG=qt;cYbwTV*{Dy~&-8s-XZMLSCg{Ve>|_OW_Rz*qNn&TbLlA zpThlG`YGe%*7qs@yY@xL*k$8Ov;E*A4EeVjn>U=R0)u;Q6S-8YE}3VtyT4l~NmkLL z%s+|g%?7RO4Q@|jzi8)sjL`Z(xCZ$^A#u%85=ZO2e1|QYn^|Tt|a6XeQ|z4jVcR+ayw4} zffn@j#@;@6=l(V^chO!=>^Wqexdop-rKe9`WQdzFA_wa`!a~M``8KV@)C`+_b8R6f zv=My`&$Y}%6uK00sY|%KvDzwy`5#&8KpZzVE7=@h9fLD9^-_@96`?)ZE_nv({76up zX^>Zb@0IYTXqMYt6>&V-tTNvJkZBVVeX<|PJtV8Sy2N$UESL56k7>jMrG6D`N?X2i zHbHn%HNVeRkM6Ws@7ByTh2wPM(zz5#%Ul!k84+CIvdZ7VG+7e}IhYCwU!eff{wbSb zKY2}H#upuMT%1Ct`@9Fc9szrsY)9*Vy6f9KY!?lHtBaXzA5a-9Jwic^^VbzNp6cmw z6H0vBCN7e3%FsIqSnx?5){lW2?Z40nXKGypd6&mrCL`$edWXS|PcLevDwJPy=66 zq|@|R5r=r~JN|3MsL>=+1JPl)M5PVA9Q?(3{ACY!e!z@w=7rD1`?nLP--j7dE>o5E zRmJ5`Bzm8C$*?m~l(fvHKCni!^m{lRG%|E>E)3E$}i$Xfzf5>kR zTWNJTx7lfRGCN&4WSmW?D3Ar-cB=VGaWx|*lNd1+TIGcx zi|_q?G7!2aqdO2>H6aG`kR4QtQAm#sdEswI_U?cXe)}k$+1=NQ7epNggFZt_ID8)v zQZ7EdfWNhdGgX^V3)0U-0UaEW{vflH+p6p5TE3^_F?wks)`zUS?uAbm)L0Pt9%PXo zYBh`j1du{-87v4M$1R(1qM+%26bmIwmGpH5It8#w&!Ct2dpvtL1m!IhyULWJTjXME zrexHf)oW=rhH}dH%vs+(@U-ev9clcT1~NRW-S=Kd-Yez(`5eTsESS2TqL|tI2!`n{XKGpzekx{qRb@!c)9CsJd?@qV)ge~-|e5av4RC|iT(1og6p zcZ%e|_5OTPz!9^+A)dH-r!DK&nsaCFj;N)FMu@xiHvZ(KkCtTD+uCb2qRrNG~Tv3n*wcCtKxxCF0oIJF^SKZ+xQsahL4 z2J;ktrboD2WliJOcw@Rq{9WkGCPr#ZpXXa=_j1X2Ha^MM*t=hzHV(Pr0+{8xA_p5jO8v;E4d6kb$sMd z)NF^tPUx(oVN>PXxis{9PBbMn>x}=L zjMwt6H(^bj_cDCU7;X5U8+DFKx~RtJpmPV!vV;Bo&k0STL5(KL={ zndKs+SsIkR+-Su-N_lk5@y)wND!{{qKP=$x#-jE1oEGM#s#lH(wuVFgJ31ju*ue0+@iuAl@Q0 zAC^F*{0-SfmV@rVeuD>D)n$CoE>#ju~ zjqQ$*@Kdc>a#Zd2G^Bc)x9JA{JKR5$iogIx*=h|3H@DbQR;@d$g*K*Q1ZL#Q9G+mc z!Zk&6PTEn~5bT=vow$*Hc&lY}o3(2^AnKtH&G`rK!jM=y;3ZnS@DuqELY_Y67O4>P zZDK}9Ep+-&>>6>AIBnreQyB;@_vYJz8>8-VvW%^imSq zPxUCbJZ(`29l2xg>ajk+h!Q04{^)j^YSRHJ(@Gk#P*TD}2@x263R-aM%LqLpP8Od5 zo#r{?DKQ*JMFiy}7)m%eYRsqGsgu;l319yl=mP%GORyGM232g`$*g|l)=N04CO94= zD>(YHH;v!4sI}2WHcP|3$&dmY`d9v1D~tf~3Ol9!dM7v}R);@0?NXW|9{SSKy&>X$ zq|;mz+Vj+LiBz&W*c`}m=e*?`ywZW429D&to1*_zwoV&Jwyv-#TC`GBYo_kKRELHf zYQlSYo73B`K;2)Q%vV`ay%hR{o7jP8^FTan+@R0Hb38aowCu#{PG(2Vc~S1LwWe;- zlJX=zm)p4NiWT}16LmpFhob6pBxCC-_{$A7=|Jj{Amz!I)-ZWC!sH<*Iht;ijUw6e z2yR9sp5TDKz%$;V)VPc+N}1_N)MW{FG5$k{S98F)jKBxyi0>wRDXGglMcnX_e#O|k zqMj$#nMB`_WSiqDjRL~B(h}&g2CTLMS0wQ^e3#1z)b*O#n_fgS!U#3f1%as${?#&dlF=zP+BWTmtK53< zV%eJXdhhf_IC#r?W^*P)=BbTNmh&}_Gy-XiH6hys$9^w0P4(vy{UW_2y&=SZAA0pt zJhuu4a~JJ>da@RtoXeZHsJZ`&jaF?X}2aP{U^WMBL0 zia!8_w)gUORar}lbWP8Cglg zSc4+4N!s0es5noeklPm1F6S*diN$%!5uyoLY>C-Nzvz=u+s8;{UETgh_p+NYoC#mT zkjC40>L&Q#oT;${OPv7}o5sV9IO3zI=lzj^v~d~s4YwQWedDTk1RnTddZM+w zuS8Yf*q1A8bIAU=fe_&@?{s~=IGO^q7zyW45$j<{?k-NW0!FvFN!nw)MN0X zC_1k1{rJ(pRBc^n$?&6^L+pMu8~;}x2aj1bpYvAF^8PB4m_Fj$HdjJ}Ge2oX3(@lX zQl1NXj4{gj1>PC1P?MBY6dqY?zMlT%2B)(*(k5gI&{m#c3SOR};`!fjzUYi{1YL1n z0?HVtS4Y(x*t^v&QAum>n=G+pses9?vJ91bLM9oF;r0(on8h~6Sx&6X^U8}#w~8U) zOf&TK?g-s3eR#hw3xtd~vePKGIIb^knX55=8SyTVZlGdo@@qWdNv}oZ0Cbu>yBr6Wvo}dM}&`b zhzJHp`9DR(52_dKZQYNZ&snz;uT^GAM$_Vs5w84T{bmO^uFoy+avXi|ttFaUSB&36$X(61a>!)xl;N*{bw_<;DX6Nr3jhgbT(dKx0aw ziyj<23y1%3fsqyXob||oewH$WU2S$l zLqxhgGN2gCJu$-pLz~ztjOfR(AX^)DO~D`EPMQ-{XwmcI%Gr9l&OuZurCuxhpT{qF=%vzsaSIzNuTu zyi-9yPWUPML?F zKkLLHN^|Vd_)%Mar8MQaCQmNlKRxGK47M43$Lj*F6~{o#|q6{#XfW#Ll1ZZ6h-b04wxDbSH|TYF!=`xe3YDECMg=F2;M$^o)a z^>-zvLa5Qla}|euD1leSrUHK%NX?rurnFh%LEmi2w}xo*1H!9OddPXtLe)-}`p)!Q zH}@97*kg{&p?D^zF!YK;p{o261Mvd^Pm(&(!+~-2teV{pT4Am%M)@DFliY=pQu~D8 z9)s?zr*!F*EhqHA`HM$KpF|S-FC4HsC+JG&nWYGge&2TmkQzw7g%ZH3*zQ0(rTf)k zh;_j?nlBZbYG@^z90KYrD~X1f%XFD}RM&TgE-t~PpsXOd z_J1PXrQT~v;$`4Yc8{Eq&srf;ym##e7-DXE zsK~EL7-v}Oqz^ELt>4haMfzoN&|T1H&3fvF^T#eL;toXqi>Bc9JXCztT50=>k{k!Q z(_Om7XHM!-#qj>LN#YR)OWG9j9Zyw1ld7Zt*=cS2w)Re>bqvsni%67klyf(`?2&}cI4ZqtGr79SI z-SUpC(2}S=R{vAF(qyDv&|^kl|MmAJq2D}Nt~)CVhKg7=YwI=(`iqZ4KIyaWlFW5i zTHfp2H*mK}eK2g~TVv{{%TLWoG%4C6e@G5dp-x@;Gr(A}OI#)!D|=v ziN=15i;Gb6-_oWvAM$SsD&Nf!7~72)Q_ut-%1rG{UeDG*2r|7uI*Cq%z&WRT0KJF07Q&-sN7x#^K8Qsqwb-4UIw{&A*< ze}M?u#}OlN4mc`#BiG}GZ$}K={S|MJp2zXe8V|BQyjfdWSpPkv-At^@hRI~1g5|~d z&bYr3G_LJ{#pJe#9V7Uvl~wjs*msFbn7;VeTnh^-jvSU;>Wd8>f^MOub|*dnc~9n+ z?Q2MuZ}35-Zq8Ek1JTnt=_s>AW0hfvwz5?l)b4vY3^`m|t$psOgwDArI3$aYJ$r*> zKQPKANHx}PKS~kRbYn#hhq0M41dnaZ*l>T7!E?qvj#(VYtgQatwdgX2l)+BPQzCne zcPrvRs)cI6PU&t>ilnGCNZ(XuB(M!U9 zUS~-@!4fLBa_uwl$b^o1#|UrjP@&Vg)1dqLGU9Jk=W-_8ZB#d+eqOr_4?_f(rB}6D z==}7e%B#v}YHtmH@s9jh_I2fTLv=RZ{-$ElcjgiDOk>sly3l9>&ko&oAV7E@Xz|^b2QBOcBCz!r@ziX4 z!&l54y$8Q`YJQDw!ErY7oG7>YG!|$2)MemB(G}klEQ|s>PxS$q0L3U<9ks2n&x+^< zqzHwNA^bN2qe^ek*ja5W4$PExqsPNGImG3-#7cjPiv8@XkA@wW@Jh&E~MO9f7W zjAU@tycb^-0uv`MQYnq&4>2Ah2lvy*%ftCLLYlf;)MB^nGu zDzR6zNUvVGdaHmI4_qG}!PMk*50uCal(lNKkS2eJxrUT;u}&F&E$X_iTakjJ7h&su%s%Jxg05#5w`v>vH|1tfuSp) zEEu9*cPiMGupx>jPM1~AwBK{4QrS<%IHMsN4xRhcTfNtCas!6(149#CrNpJ=H_dP9 z{$mG1*~H6=pS)ta;D7H<5iOU+B$V{;zw<0DGB2tIas&jrUKf$=$c=4ibv&OvF7L1U z`E=a*Ypy=tJYDh>SB*#Tw&i;TH|J8zCW;lH{#vom1Jp|hY(+&g4gB4sO&;KvIb}-p zJF}D`56uRV&aaK1M`Cmp7c@ZCIpq>qnx49d?zKjN2?np5G|9vMm9&(2_|+>Tl)m`K z{2t8|5|^7*SS%6jw*p=P1!9GE$;B1OEINek*y3JlNm zk$lf|w%cqh#F_bBjZOvgkdMmwOU~Hqam%QY1JW;ppT^Zt*xIwwz;z{?g z^oV89BT*qzJjjE&%d}uF--E-HjMoc4QqjTznK9y@qrYJ!7Z^#10e`57__Q!f@OP;c zpF5E&NE`38{16GI0U8mk!_k3ZICdHtk-1vAmh*`MyFPfCn#nkswLx|ar=55be zFf}~?B{Q)iRuW7ifsB(ScFaEYR<-n98Zx}WAJU0E#4CDBIn=QZJiOQY{A zR|DgUH_m85w}w5I)3HQ+fbL2qE;Q803**^~iTPt^L8KR(T_3qCE(i2rpjvzHLeuvl zvxi)JPrY(F9x+q4++~(+z`h00`Y!{mx9!r~Q&@iw?(K35zhVzXQCF)p!m;=CO|RTd zh*m0eBld0Ji!P9pQmd2&7C|q4Hn_sKS;<;&R0VB*&9dpIPjS)z`_5(gtMnq&H0dOC z_GH*i;@ZJoWdxOsa6CbY9dTzrM{IiOfx`%|AX8Z=g1{~@|94Qlz`x3}BrF5=<43Zfp0 z(O*cS`&3?!E=DRJ3f!*en)Ji4dt?4u2b1Hy9oF_ZtCAkGZ7YlTzCj^?_@At?E!I`` z6wYYD-5cFSUp|F}2%O;Y@_74>x%)7u1eF%fX~o*SEfkIRn~2@OdHOgmd%MMyRZ2f8 z)-A8$FOT)-zKA<*#|f^Amk{)|U$7=iA4TymE_3MQMBmp{oCr}^J$U`VHJ+9&HGTNN zZ^17uKpi-Wm`8dIXQBV6y?&by!0&f> zS2k=O=z##@q!6hqP-y9<4$-dp>M8chLuXpn~e!Z?gF8yPMeeT{3it7h5?#UZVIqnV zvwm3%E7kNEmlSp~8a~&)TQ^7OHtP++L;6#tjP2npUV@^AT+vTuLWrG#iKgSPNIC(x z=9G4`LMU`>q%`Cy3%N#*u9t{ri$+A*#C;ju*+$(63cS%zBTwqZyhQZHle_*Q%-F-6 z+@(hK1E{4F19vIe6)Sqr20r&%fba($rYOy;gNPl6Kg}dt$<~(^bt%s`2m8AYEk=)? zEsiUP;@*dfQb6rCHq(W5wl6i~wOC(K|M*n9*oN== zaObeS9KCvQd29NC5T#6VqsekU?U>Xz_V8iulHte~qZcdhjm=peUHpq!VBxAjA--XjwVgZJu(awR@u0r4!AY3we?wN= zizU5RNoYEOWheaj@7x^J2{#-TE=W**#Tfk`O30ew1dLMUQm&= zO?my#>_EJ(-ZW)rm|r8>iNNe_`z+R^8@O{~sx?$z-ECgAMrKfEkQ3 zc=p09GdRsMtb0ecuVO?(O|iTgEOw<=%L8Wy!-IClqCX4#-yB3aG(i%9^o}rVD+t9H zwwLACnS0HEA7Z>V@DdDAM*o^r@CBxxfTk#joiEfHmshyK(>1gcrpeoez3NQZ(tWC0 z$Kv1dz&F2=mWFgY_1)AyfZaQb&R0(3YVm`HHrbyKdSgfAFeybYYF8g&XLcyfOR{`v zT$oHu00dIePW`>fJ;0Y2$H__)Hi+O9ZWN!i> z4E>)bQBzxV0e>m11HiCxZ`hCEaP+e0oQ508lX{-B8PY2q*mq8-*j1IPdg?>%%WD;W&7O zNKM)RgHi$yQI|}xw|}h*_(IA$sgdL-AHRhnu=b&oGnRPvI-}Dt#x9b=iK4tAcR1)1 z5qvdwRfdRLBMu1XU~~6Fu9o_Hiq+$L^+u8pg4V4Gl@9k2XU^phW(tY)rcc|W2;_N6 zj~oa~^tzGeDMc-)cO|OO;S+_igHE6ruO&QhgYlWas$dArV(Rg1j#}H3uf%>!_(`IS zM9w>ej$8hm1<^U@&C*rG#m9dkb_KRl%5q|1o)^Vol9j?d!xX-S9!u`jgB$e1VE83H z8TbRCIp|!EB%KhW+0Scm1e~LIe0njJf0r6}3Vz>%ULPeqKe|j8#DI?tZ9Q5|`O}?a zPC2LB-V)IL&#|~!klFoGK<5JMz_?*>W&BASw75pmANq~TeI)@xNP%vBtK=L}msK=R zB;zp`1;6bnPd+=zWWaq{ZoMw|}&9TrXs+FLg!ZrM7IB<1HDGH6c^m zNpOpBiOs?WFz}l^LESa=ataIW0t)UUrk}BlcnZEG)LyutUG^^{J!t&dO*h6)v!moq zmKOX<3=K3gh!^jjP3|$-4e2teMXJE z8C_{>Vqu+hX^F^qKJeRXP#TTQ-Vj&vP#}#px7cc|T88y`jYGC1f4KgH3D>gvH(yw& z#@P|tW`U>}O5RUHtzq{39TD{ws|Mtl0p4nneO4!e(Uc&Sm-AdJ0?rX&qPHr$sC$(LKuzCNU7Un$*eFq&bIDeccox0PTitr7>EYHQy zuK0Y)=;fr#sI@BHFWz>ulue&>I1wd5utyb{qCfYxO>g4c`7qEf{DG_TQ-TjqT`bJ87FZY!thQS@pHKs@U-ysRdj!Im`l>F*N!5D8P;218x zIbsI~%QcO8*?r#E?=kM{y&~>ct*~+P?)E5$s|jTImxigZ@kcdgMvg~>Io}$yx2#r1 zMT1H}th=;n-6#Ublv}*7(u~GJ; z5~hStv%Fi`!-S*Talzfo9+=8`SN;!H5(hjpz6!T|x#! z^rmQOv(I(-Kvo=GDhm9gfA0?W{R2%0-ILg*Bnh(UFOZt=8A^L##AnMzOfo%`ezbF&1*ARoh^swXJOv88AxK|_p6K=x7Pw3iTZW^wjOn!hkgm$Ekb&jB%RZ+-n6J2 z(x%f6ZmpntI5WrVb*VE6)Bt3w=_?MnJ{H=H0_UOs7uiIQ(w{L^B0k(7jYb^W|M>p< zN25->{gJmDKXY9AATLk!QOGc?vxu?+`nv5VL8^+Yw^f}0&D+4#vY8w^0`52Lc0QEkB~Q74F)!wXKBIej9eso zmm7^;7np_`Y`lgx26xE@EAKv$c~hKICmdPcDpzynSXnyMG(qx*f}&l27G)oX;?SbXzDSWUmk@p~Uj72>y|nr$o2WWqC_z-HDRhPteWK={DnPGCL_ zs$l(oh;+0~<7|n_w|;54GJFY}@h>AK@Zb8ctEsQfLBLfB=SZBy~Fu7^93H;f0(?RsyMbSCuVu@UWL+QILn9O{P3@2INBed9$T z+D+Sr`=f0y;I!_c#;^Ccj?Qro7h<`1&Nu8k4XNpWw{e?0JF4THMj|riL`$LL=_Fu8 z#fYHWMK4sW{R518oN`PESPJrjW$~bF^FLYK_9fp6M5fDD19Hq%^E~%puaFp&8SovZ(I6;95Gd;ttMwLiV#VG8+Q3Gi!`om3fuMlEuth zb@jGH1|M_hxt(@TxTF(7WF%Joq&NxeH~-BPuYZEyz9 z-}zpgHrU!4@$R;%dD8IELEfz|h!|Xj=TO%ny_Dzj@11Om$JmIv%4mxXUB^LsOd~(J@xPIe1&H^r}u8 zu1Vx?Gs**PLwhtd8rH)wuydu_7s(m|6Q-h$?C9>k>N0V1VEVF7tBQ$D{Z|6yfb<>u zvgGKQT1AT;t?$qsZw^5jRg}SR+uew+$Ta)$kOO>s*WYpLCRSO&%kwlt4G$>9TEADe5313n1y9J47$o<)EO?lrR1i}9X z7azgrYk`kr7MvGV%p$dPX+%DJg-)+awuWme8;?;qVFh9f-)I9}ihrD0qL+P{C42l<;nRJ>ILYv2o0hUM9I2=@_2`6?WoeHlj*G-Ap4|5 z{fvsZZNa3p|D#m*+HZWI3*$9EV&y~RKXXLNQhr3YXu#yl#rJbToBj-Lpd1(j}ZYCTh!>Q6OyIQ6I4$vsVRpiXz+ee@jlF`J1cKf%wmW=e;z830xRJ{JB8r zG@6tM&&(=%wD)q=q+<-s7Y9Gm!WY5%2);r(P{wWA%{!(;xf3AY0w+W5_%)c@bm8*W5sA^Q!VWr zc!C38ym>|s874`nvJZl&OtrW}pD8v6Ps)roeii?)uXUiYt|u`ng}W>p`0RrrQ|SL| z?HbcTi|{vv3)zpYZOTVOm{Tqz5jxL=q%cmYJ0V_Ecm8sAbsiClF`wotOs*9}QwO)K zrxCww@wtb3mc??^j>qor((FCP7$l(zK9F2z-NUFG)D{|Fw44*LcfQN&HK|3GFj{*g zhUOBeT>!2^?8{kAyT&^hV04&12?{*60T-}J0b-wEC>0#yE>+sdQ8PFwA8=iBE9LJP zxtM$2<1!^w$rTL6V>gT``Ws9}0mb_U(6O?G)#KR&5`RaoTwb*g*DQS1x&sy2% z`J)NGt|^1&+JWm;-?|MN^YJluB(y?}BAQgz&h18ozbP2nfQApD))~CM#4$X9kPP{c zqHUWMakOKMYW^z^hG(NKiQ_dWk^zl>hXmrieqRS`x#*=7-kPdzh~4kjtNYIE#_FD) zy~br!6`|NgnPa%p$;$hf@qu+rXZ_z;-OgNpqb$vk8al!8f*Z_?X()xHuqbojdm8rD z3EbGA^r0c9brphdo?+Tp;|2d3%`|lE!0NySR)^}6d@F=Gv~Ck-y$0h0cV?VuG5O4C zCWbkor<>(Jb`s^%B#K<(1@w6$jmyfvoCt@?=_7uSaQrcOx64)N1?Mn-bQ7dI)Gg`` zx8Nd$8l7!tSKTW%F&aE_i}SaV%sAeGJ7iu1_53b`{H%oE#9E`&uIbHYt96=_R~@~W=~EfaW#a5R=JW-oX>b*`j7C7 z6_Z0oh1CTo$o!C2Ly)U-&Vv+F;$)EV-!Ak~U<)MCnI1E-QJmCVEUmWqW-x`%}udTrv?|#T)ij94X ztopCHHi9a2B2xGQjeJa(k3bDgyF<(8x1?n8^8CEk-z+SQxB3|QIPXgkX2u!cE3nRO(f11%$Jkruwbhw&-e}JS&fal76 zzjXY=pEjt}*dZnTG`D5sgw2HFWb6<`5=QbDhWs|9j2Lo?g8Evm`xO#n%6O*;+D{Gx)F-TBu(octd zkmrc^#EiN>H#=4S@bW(#m-~&$v>2T(jnD1paD81}&qwUFQuH&hd3Uw`@#e>Ogv>~1 zTi#aH>=6h~qEWMDmr=C0JhSZjr#V7#e|G}Q8i!#*N<;Yx6jcgeKr4s6dl%+oJvq&2 z9*@6EEi;}V-#j%9{*kh-Npa`&Fr5NF0K&PO;VqB4cW*P=FCr_Eh=E^xTqI+W6FJ!15pz>WsMeI`V$!{HBFo7<{=xRezsXjkOBH z#Ds=2EHh_xpArK^C6oVH{EH~w1zRS~Wqfyd;JEAw4TJCXaY4MKZruzReCpnbYQEt_ z``t=2+bZUDf(_Hl&4qFzn)_Jh7NgFF9%09Np6MOQO7QjSHu!yjk+w6k`C4tQ;ejwk}V8_y~-XyoWj9 zv(3r5h)^~6q-k#mVyLCO%ozLoGVUw+9k-ev+KW&pH8}pyD#V7(N5M^4C1N;-TN7oS zPmJHUY-vWzw1>=T0`-b*h%+c^tiMd)DVb(|axt`t;my{PF&tClw#7DafPP&t6J|-) z!`vanCblwxxlYsopgnhjI-$7ljR)IybGCWSd{pxEq`hy0;5`z4gxYd><<^!_C%Zqq z>gMelDmZ76cfBjf&=KJ{XZ|RM7DdF`Cn_)mO>$?-SSf_aaC?Vl%Bbml8`r75WBdgQ zh+WNA^0uG-GP_k#PLqlpm5sGRd`r-dz$EH*Lsh7GZ~EUE;F;zwv>b|6a}S2jhU6`C zW_UNN_H?XH%n$!Rrmh00s_*NHAR!&nof1leGzfxpmvl>acXxMpH%LCZ8z~>%9S@|N z?}>l;eKU7v4|m>hdhK=g-Rm5Shb_0FR#i(RuE24#OH4qyIds~B5)qPm=5h8oY{W{0 z1z!Y!=alS1Xf`sMZ|U_P6e%P!??&SLHn`SbeSV!GI+Uy6hXX$)b0h2bj@Cf2RxBt< zS+z*$%EQsG3H@dGJ@BolCgPjWOL)2>+os{{*VLLC-du$B+l?`@0??OKJ6#-B%1h#K zd2G30VoCK2Cum^rE%-V=VPgbmya^Ek8;192s99grH_hEsB_uA%wilZN{-z7{L_?A>g@9%rZyxoqz^1%wxRhSXYZzdfM@zTB?iAE^?^(-O_WdX zvn``+nYax3t;S%fs;@@QQlns zS)}56C=^}9VnSZ;72|phavkf>gdeCz(GuQprY4sS$0%FlS~D#65Wjt?u{bh+-0l$Z zTX2nywb1;Vt7fTvODc0OfxqJtK0kUyEu7(yZaC!MySD=2Q;3j7F7h*5jZK}0$gPLa zX1}3l)JoZTHfs6iBA^C{7cFa9W%8*%&zQ_8<8PgJHWVUhr>`-Ag=&wwpr1HSf-C4{g7z^Hlt)#xPT!@s3@G8m%ijF6Ku#J=B_lo=(v7<>Eq;;p!DLT`@Y zj9bQOO$AtTy!hCe1ozVNCj^Gr-JvA78NzCnb@62GwJu)Zt%pNl+o0itHS>T4SIVz& zw6248%X6hxQ_d#~o1NbLhWYKQxmmDrXnHDgry4uI;B>3%bzlpu6 zC4ZiKDG0UXsD`4XJ``|YVtzqHsxU;xO_em^p61IA#F%Al1*iD4W^J1KsiM8CHcGrI z@`-p=H1KNEZ=-{=*J*!!+E}nD?EsO7o3{s0Bl^|Ab4fIE;jmc$Z3VAItB45GGpIjx zMT^&)06HoFCe~T>uyOl0k`)Md}jjM`)!mviK0%*k4Rh|8P&3_)bRtEa(`WH zQIcGB%y1D@eojC%cSvfIb*H^BxokBP5~LE9Ku0N41@jMXAL@56wG$?gp_z!Meh02y zQCr+wdlE6Bhg+wgRIMUxOIHiXiiyWdbq`t2)q;1WES5w0CYxt;ZmfKnd8zn<_O7V0 zG}BY+Cpmn@e+L_ju~?TP5erU^B4Wq5cQ`Eg$6y@Rfe>Vp_pQ9rmMZSZPCP)!z)$q0 z_&&`|NI8G4WQ9MN_yvrKq0|15^d*&>&gM2zi}g%;lIGdcM7;YWX*11p_72lpwM$D$ zj`jCL4(+@@Dh+qaujHKr1l8&^^695yME6xe3*pmQVUM7c5pj*RxD3}haYlgU)qxG! z()ZzO4iRWdKCT}E;}3(Fv+4fv+z+OB4%a|2q^Agq{;Y-sx&7Z3$>SH)r!@LaQYmT% z_Ic>kgU%q$vb7{L?@2WAHwjAMJMLB>=DI2+>Sc~lA1^4>2H%;FI|wIvBZ>1iwa0@bzcVTnMr!vrw@BH z93%X4$G@vnh?SaKI6K$1<3iG7RVe)3k#MKS`WG<4FYxtP(>hEhxls(#%C+`E!LCM!{gTXhZ*}IOSzf{S8JIMyb|LO%}0T#*r$VQ@Z*_Y-b;UY zpL>$m8u)>NKo2+zQ6|+9&1srop;pC7V3eolj5cI49vac$Ptkk*Ul-g#Lm_zLLfCrp z9b6)8emUTwM~0tEw53n|B2k_*ouumAsrS@<>&0$Th*K_0@RKPB6 zzCTS7K0rU@6|2g@(gzqUmt!ow9oNj5^sbM`ExkmSVzoMwMnN|IBtsIVXA$6{ndFjq zr^j5y1$OM;F!h-6^_bH-42Rywd86Dm%Aqh;M79~JlBp&sk&c{Zt&t>&>YDvmRRfq= za8=pPgob(PN#N(OCToNs3onQb-leWK@7l)lj4U4^KdeiAaHu@jg5fI=`C;;kYazH? z2S#E&xYgR`TqFoU)Cc$vI>4@<h?kSc4zjja!-Vf51)O$^k*TP^ZFoHaK$K7 zm+KMy!^DxR*#BFaO}stAVraU;v1Suq9^Q|HN3^l&L|z-B+#PHni7OIJ<>L>eXCk}Z z{R6502NKnHg6JU`%6P+-*9L9ER+KeW`qtRfXEh;1R)o!?fyM+cfU=GElk?vA#~AwP zRSW4?eXXx&sECd7@^*NS<{SgH@BF$4L+d!2LqgZkdX z%es?%5Mr^)c+$uS^p4R*rX=wH1S*&zBy|63ai-H2;AV4ud)jZR?TD##dO_G{TDEyg z=nWLA9`L29z`?T5>5FhK?u$4JP~2tyf>@A)W z`n;=*l(&ZWw=Oa04Wq?pI~p*P7TDP&M40oVnOT45yhTzL7>F&P1ju5`N_J{=b0#hx zhB)<1JbqQNh;QeN^|pNM{Emvw^3Mx}A7LWHrd%6CjZPg3vkK3KAHo~3pFXZjEopvt zlRRGDE5Cen0%>p^M7-X|_%Nk7?s5+S+q%R4u~>!(0LAd2)A69QQ@_&aOLiyg9ypv( z&G!lt@P{Ejm~|uFsSfJ2S8uA+mkCBwSodzLVla>ShQ%AC?XkvkqwFiH2!ld&7@@Ua zT0Cp{s-s65Qaj^2Uk>Athl1AEJJ~Bwv-WTf3Qu~Z9e=dDN^rCy*gbpMlF?9kpkMH~ zVK!6aZ_BllG=docX!3_*3W1Wu9P(r$70Z^z+Cxf=vDv3eDio4Q0QO0}k&6HL;jEWN zaAscx_k^~PUR-BUTNHFIu9c0U=k09n`z{5Aq6NOanJ9};ZA0ddGe^n2ghw5wx)NtA z+w?r9l%CNuzkf0s@5ei~qfRB}Eu>-FW@jMK|LA#4f`6t1pq?c0Fvi5B4)qd+#M2T; zHlP)}rOBwLFiGjQL6?E%Xz6Tv7Ij||{0jkbL}Ez1HclEwU%F{Q`wX7Kj&fm=nZ>rB zD)6U!Qp1>}TZWa(4f?PRvYQ<{bsy>emV?<%CmyDnkfg0Dq;SeR8R0X=`g77|Kds5>=S!6BvA_bv3@|Tl8>OY1po$@=S^KALD6aRl0UI)rEwU*3_~9>pVuc+@|M-g;>JmSC zlD-GS<>ZSUeC?AQ6N;kUFqG|K8qIrSuQ=w*5G%0DyMUpW^RhDuwuTWBcazNVHwj|` z*#={lcxOuQC3145ixlDN3P|ls6J;=KKixSknX5>&${>d(+T3Sj{qdk~4?- zhr+-~O54-VgR=FtKa>$ax-{+>RfCCXWCmJufwP-pMlcaA0shH7R>- zq~#Oa_jJ!Dj3hJ3%dI9Tlt!6( ziy@4BBmQH75;RHZwlT3TAvw1d6-f}|CS*QE!ZQky&ms_KUZ+GM&tRjPWei`-Ag1+0 z7v`$w`l?c;s4KzLR?&@N+Q1N>2569^R<+^hh)|Co?qzrT0OKX+CdnUc5?1wO zdqZ9VaU}c+MTQM8Z)vg#c`=N0Zn)yh-gm2JhQj5WLeMMeTOaXizDAa|o!Qv&*NJA` zAEkAzjOjQWQffGdQok`|6a;5f!q8Rvc=a0NDraL@t2dV__hPI2yzrhuh(-)8boCru zGVU97i(s=XuF1NUb5#U8`$?_|#9qY4A6N_h&LSfj7Us)#pwrjW=6u&n;v9_%6*IPv zOA=*Qc!;va#sWGtp_Xjs%C_p3dV?NW9u;Qn%ZR2&ao*QW7xf8O&6EYy^Cn}z%&toK z02bkbnQ!>$(FiXldmq1-FsFfRKO$~R6#ih-gO)+LmRAD|ZZ0cht=+82mP_Nff zM(APzs<^m~3r%xxoP~)d2hgB=NrTJSKiw4gHEn>tb2dca%P{)p-|&5crhrVLZK53g z!s@^Q9j%eAi!$SN%lr23SA~B@Dl$(ccixBgi39KW6vKvhK^)WOb|Z}DhXCQt-1KI1 zE|qd_BXJjS;@4cQ`9fgc6o0`mg^o>qQO9}CcSo1l2aw0qwdNhc6pxWNi{EVI<||!4l8I#g5mo$6|kf$6Z@=vOi_% zJw$~7V&H;(m)a~ad?(%8u>Zv8P(5%z#ixIxRN_3*-9WT*pVcSC*&57N?;aq#rDAN8 zc_{5qKxlY+by1Fwao-i6sm7}L4cHy$VS;bi9~ZG(czY^pVd;<5G$SiciIUEbHWRjA z?a~aeSvq=UZoVwVDnsLVpy5a?isjOP-rHF&;B-1Fop8;Z4rj<2YsC1+ppV#5LQUZS zZ8iNBdu)6IioG$0r};zPnBc!F(upJd($tM^$eI0b@8DMmF_o+yyO)Pc)-`1tEmZ;$ zxwJA$Oj5|DDI0k>wlp`o+w2#5VW!h;>qN}?iZnO`lL$!3YkwfJbO2T^0*1&XBN#1+ek#_pV>^wqM5;7JKgaqQGh(I*J_R*sTXVy4{QeR3AAsH@}+KsVMW|| zez!ELY|uT++NRUy7xb#VT)zmoZ=H>7=4fpS+ zwO9sM33mPp#Z+X09urCufW^^_Y5cvaU$ne5yoWsnc=bhd!4EQ=3LbnM0#jR&Y39>H zUqE*I18^3WV{!A$^V0WU@AC64;`BYqJRi=B8ptXTF4B$Yp<&Xp>EB zOWdQ*L6OxA)}s6|aKifNucK$Mr7+*5DGH#NzNa!Ijq@=^>IcOFy77he|C=pM5TvQ< z=+XJ$*|KPhs#*epv2DV^P$aER2D&RiHd*?)fw3;!=ZUe@+%fg0R_7ka{*sTvZ|{g! z5@K%4sdal%59)Tcqq(lOnJT+!I?#~>bY0s7XJ{L1RQ<=Gk8D#yrIt>lvaIL7<*2@m z{7J2`U!#-KTJ3rPYV@5`f7!QK8+B|`0`+Z+`+^$J)Y%eER+qHP?Q`WxXKGt#XXW&_ z28CQSdI+?G@LKjN5`7hyrVynX@JBrrvfcw11~nBMu6SdID|@O_=N+au*9+r49N*1jxqyS-j}ba~DPivC zQ8tCpd?L;ZIivRLQ>`f8_oAD>CHql#Rmp42XWw}<1al|gQw93|EQ4Zh#TaqIm?;aB zA3L9n(3}evTa%)R*G9v6K^!RDsDVLNQGGDtyyi(1D!{$g+#NCH%#HiKlvBk&%8?#^ zI&bYtsc&{aJI)KQ(ee4|YdN<{I+Z>=#c}?HqiYpHF9(o)2SjPNkbH!Fsi&;d=Yw{FVO)s7BL+4WjrY_vsb?z`bbYht~N$ zUEl3c&^0D$bKLcOx8PAQpA2u?&b8txUDhJop-a4WmKz<1CPf`X=#xa{BQr0sGDh7` zqLOHTtGoH*63i$XLY&~guQ(p@d5~G$t&}oStPVGdpB?;N;$;v&LDw2)+-!Ez*+ceg zU)uQ=A{*K_A1%3@)Yqic7|4Al4IaMCWjUS-QwyZxtwki1}i$gwNwo4axKtW|MdIz!Axa1 z>TBIsR`tVqK^T;K(o1)JW^v=(;v;HKNtr>NsAhFQHJ%dZK2rvCDwqAi+(P}5`@_Am zJ0&s0b%BfIL-HvG^VVK%(jP-@I3({wP4D|NuU(t-$$u;#zqA8Iv;cYN!1k0We6e^$ ze&oM?gF}EU0C$_b6ss^)zz)+E7zEpPaa8%%EsxJnw3<2z-nPW_IqcdiE2uZLvzcCS zzKu^+dhqhbh7Pqk>I>ulL1Dz4%D+JyKrfA#!~Ihb!;$|azfs;ZgsT_B@s{q{giwRx zvKoEK+2FwEM+J2{Q9~*j+V`AOy92m(kzkY71711^1scQAMKUB6+(EG8`HjWU%l5I3 zJjV^&@Lprz5Ri8~< zR$}jiJJ!SW50e!_$Nf9TJHFZ#-UEr(fq||Zcc7=Swk9=Y6NzcIKxLDWi}I9DgAWZ$ zFi+vPIyV5^rsQ|LtO)YC^>dE3ST3jeQ)vSar9{6Lq*EVOE|OCm?&uo=`8*3fTe z8LTZIj#|Cd1j{z##bIx{e1bc9vx`J%7r&Q*f$c$Q_<UU;yac53#1q3nwzF{q`>#N#%X&{HdA9wZ!@^(IbFe?88F*f@f#+pU*N*On0wmGxQie+_0p;mWywCL&52;(y z#KLIiw627AL(7-gZHLFdkSjkTm7Kd<8X`Yb*RGAFKL#?h&0nT{k4!)KNnTIMGH3iN zRMIg>$t)62XRnZO?OW=G!?q#4*64Dwg!p#YkR;aWArH|?@j=3*Kkt!l*BUY1{1T(% z`|~$5@}4q0y;&}|bk8P4;3DqT%*C2odXL{89p(1nhhZC%WL|gE$d0Csx6m^$PPQi= zq9{WXU7-+{Y<3wHU<8*864u3h8C>Ss2URjt6#zV`h^^G6kRi=*xuSggmFVou6M^4t(*v!O z+ht4XjHmE5854)-ZMnUB*L8)+#N}1Lz%Rv&QC@KBu($R`sw~Gvf3JL4XyJI*vw=c? zJm$N&7kwJrR8u9iv;;0JII6X_X$P2v&mOirtbXB+@NY_5E--2dfQxMXit zSW$nW{ZNuw+V(TmU@{I`QAf6y;CJ9`yFxnmu5G8hrf67H?H3(~S(XOh&2WUSiQFMJc^KL!h5u7tdEn_+HP9 zdzcf|Icb(DM*~k_Q22I-!#NUn@Nop6&LbT?ZyK-9L7BbdM7;O5zq=2PR~~F{t{nLu z&W`!o?#`)D99x)O3m=Iu!F6jqqeEF>I}G8%?jaP9Xq_wioJ+Gq!#t%|Fko8X6$ZV08oHb6D zbX9X~hgFU7_?SfE5x(8-0Tcy^7TA%sGLl_2Dam`P(mY%rGIXk5$XswQjJBg7sENO9qI`@!<)^#Pb3;SWw`H*cp|JhbG*pW#EDyx@S(8up=-gA$<6FQn9d$t?=S5bhy4$acX{&U8ED-1mmd3WPb^!&Hhe78ShNPAQ{ia(%u_~Pj5>qt2@?}`o)uuq%?QUR4|RKe*VV-t!KSDM>Bd>W01(cW#bF0OL2xZ5{AVM zU;Z@UnH_Z3QXL{+V4{X#cdskjFJd17%v{UI;59U%T-{_GuD-Fou`T-htr_072&aFW zG;54kQ88;+Oi@c-iKbhI>ZNJ6h*@KYqB2y*A9LOfsrPK}hVdQhcNV>UV7c%$%ytJ5 zlAkRhCKoA3YGsrl8y+4CXE$%{0X7)Yb`jZaOD%4`S(e*Zc|CZGiW@#G9i|>V9yR`Q z=P4QAR4SP`HO{O`Whw37!yM!UX|t7Nvl0Ui`yE2emRxSek1g=W*%#T$7i`Z649SrV z_gjyc-?nj;WMaDKrP1x!Gt4#c$Qyc8H|*GbUa~lrMKrdv>UBSEUi5^sU@JDIK4xEw#)tfp4k5rL@nn2K?(>@$s#g$mhMwGUPIo0RU>Si}I zVjdYYgyO>6G$1>>{n3Y#{tMfOsq6yR_mwF^Qo8>O?Q4TMG!y0z<15y>^SF$~<=!<@ ziN~dNOPHzT^o-?-Kp&O0zNc=r7O`3%YDd~1LO3kZxCvaNLBN?gI)u~Uke1ikcBou@ zG9x__Kw|$bg;Su;9;LBfd~_Q+&GymZ)WW?*KKeWz>HG?Cq1l%5U{>;7F%yuCVpb~1 zaen%FMiEM>GJyAJinv+~OG3hM=A&C0Eu5qDw7KSD`ITcARJJXl0uT1$+f+@nbKHHV zw;Ah(>`_1R*(Ht%S0?<5K!=UVi|K44M+^ELk5V6JT$=$OR}b2T07|Vi(3z+~wy?48 z(jKxWq@jFu@P9rGStfN)TO_P9h@e!7;u~5Qopqcz7eC62B>Bi`Cd?}c-X@Ni7jjHTr%vs?uZ=8X$ATlh8crLDh(b+

Uu5eS;}Q$kjsUHZA4$6nx;#dz&rDzUQrI|oONcQ?AMIHyAGxZkrJQCGuiN`%wV z;owV(QyzMMr0snBzId%?HR~VAR4~nh+k%=L! zweXPbF}{5tybH%qlteg|pTfR$t&E%p(0hAvle=FqPwYT4eZh0H(9R%yCSs}M3H}C% zsEOS=%HWcUx@)fb#<<`$Mrbd$tR71=)4O_7Oc|`Q$4Bz^PXbqEDI zL5dB@s5jh0ayY&uaFjwXWUkSLKgbX&>#DATG9_32A#S-*L()5?n`AJzF1{agITKS= z3Nj8J8nh!@X-JguvoQsOpkc?YWl5v0tYOAFH`s$Yn#25&cMZhu{+150*>Tt~2ZL+o z)~R(+^Kn{=&&r-TmA&{bF%M#qm+PnTtd}jk;%?>>)Cj?V?;JJ7;Bit9ju# z8}?Xndos?xvBx~c!_;utLciOgyhk>Vuq)L$cg651w@TuIU8qmN`hMGdIiUT#yTGYtj1aWq=X0rxWI%l&O`dur*cMrq4_e z;~`~lV`=DBF+$|14vJM(i$(P^f{8;6F!FJ*zw0=?43YKMF_;rGsaNr#ms5w8{ikS# zf~*35YgFeQIDW+knzU2y(VR|u#&F+o<}2;XVc)TU7R(a?4Qdw0q+{^5WeZVO?r;Xc zu}<+qVBZ6tbNC_Wx2VAf5~b&4k#a*k2bEDVq|$JTz?qUPsT{Mh6gpYk6ggGNO$s9e zVgvQU8*bVq#ReOM>K9K?J^xB~l$zlTPKhift4#Q+!<==!+1SCS;;le?ykQ^Yj{A=b zhjPuXy4}a4z$u)YGon#);YU)(c-6|KQuaJ^;YZEEJ9(uyTvroUbBGq!noN6`=76qu zM}=oM2@7Wf*%S1)-)8AHjJ_-vUvANVOKn+ob-Ki0LtxnPSlbSI4_@&_*Z!$@=oQZ% zMHoV&aXZOs6t0UkB$XUVzi(ThXs&_MK=oZAT`)6_!60{Huq}KAf@vii< zLAxD93O$7P)PFcnId=4x*t#i!& z(JI5x0bN8Bm$*m7p8N~)AmRTk()ivemz73g5Pnqcc5(I4b^qe1lj9 zQ$|sP+DD-w9~Q|*35rO6z*E35tYOy2gCdw`> zg|-TnbsEZr*WBxiR~PRB7FLh>S_zqCgxHrQn;9L_*+rA?V*Q>+dLAj(kAo7<)`uL! zfN(RKH+NQnW5YhnEYScWbdoYbl(kaK>KkJ}Imy3)Mqfbu+I26g`iaNviaYP*0I*e0 zFd?DkUA!;-W{P3e_@mJ&4NihpD5l{OQcoD(&B#gX&Uj-d=uc`c|48FjlJziLpJdJdTK5?#E06GqvcMOk? zc(gCvA3SO*oC5fk4qkr&(4R{GinrWK+;VR>si_qeq|s11v4*p><=3KuQ?tAcBdGMe z&E{)9rmMeuxIMX1@mSy!cBE?1VVwQqE{vs_{HTrfoB$BftF0W-S&{Y%U^540Ps)tx z&t%9Q7j0uEQ%yH8#6L1jgVX_q>Z|b*7s2NO|J3LHx5MEXY-Qzf!a{Xosx{Z8b$qpl zucuMk+%enZf_1r8oV#X)Eu+PjWNiI$VeaX1ItyN0=E6g3nK>szx}*J%+O>L`g1RE) z9UsL9;}6elq&&p<18q~8*u*z(GyzH*rI~EprESITp&tk;CEF=F`2C`@UZNBQbuS;o zRP6apx1@)5c64TTbkwv~J~V(2)2^bOfxmQO`mTlG-0XU-3Ia`cT+bX%eX{^Cp%bhu zm0vA7l5L32D+H=8Y4&0xU#MWU>_`57P7XLw4EwDzxTW}ZBRZyElw3vL2z5iYLbFsA zr-r;NwmBsA6YP>mjBVKOm*k976HY!o?%VMvLQRT=)4MawlnJ`#lRcEEYyRQ z&2B8~MSKe>1N}|I%Vuf0{Bt5ih$31O+Ls(M^RJbxgJU4cpsO_IN!kT{4k4b=6=w%p5 z%GJtE(~RZSY5Ry!l*Wib+tUbXa`r>j>xiUvzVJRHAAz)NSW@>E^~6xuZ+6a@V?vsb zQajL&Fc>wBjc_P|m&&zf7y0FOH{qag^Lxe-ZCAZqDzyM-v7;uY)48qZe!&1a3(UA>n zA(@Gj@M#$>82uL6+^W=SPk*3r+hD6u?zISi&6c`BPXJehe(cyJ#ED&fgxPaxbUL14 z#YF7~>J=_*pKf{73^_8!+RKv0Y&pw7w_ieS-hp zjhEc@NA1Dx!LPqh-n0(mEpah?2(iH(AEqqYRl|Tzhltxc^3gZXp`vynApJKasr+Ak zOYAi&;yTP5I(LnG;%|4N;Wc;D>Y!Jjv%e(1hP6Hl{Mf&JD~?5LM>q_6Wp8S`0=jEX za5rz1ybIk$m;IjF?tGWKARiS+3b5;xUoOG`{gEkT_!Lcx+Bk>s=ab^}T9bb&tznrw z)=#h2#1S8zE$tYYJ?lB54ieM(w{!cALF5$jI=*d8emtjOV3__}NaJPfn2|0zA+|y; zeGDT$a6gxApQz*l)OQ2^U`wBVkWKnS%m(q_4^5Z*Eo3R`2gpp{N#LrFm38YQL( zYgD^Divjv03BmN61=mG2s-s~2{kVQkU#C5Gv5xfz$OI9Cju;w+*g17cLv$m;ZwpmZ zJ}9YO|I5T=AXJI!aA=$K8TZK_7=Ef={&i$|HwQjK4@<5$dwlP^xdwE4qkdJB-M4`H z9kbr;llL65%7b>MiNk5Yb{U{T-@!Kj(dc=S^-~Fcnav9Khe-4)*3Fs$H(qIqt zS503--->DRh4zus7rIHRKhi&GML~H!f+w7}eckHQHn;5xm5hAsWV#1jBAzoaeUf=5 z5U6(XaVbS{x3i>)y2ttZMd-p2_kdpXQrjxGB{BTfpG^530pbJlrZf=<)#8Eu6nM^(ZRe${&g#JbHKDF}4Sgq6h(^GggS`1OeN|EEF2Z6<P#A zw`m|R!a4LOb^xwj=pSxOGqC9!KS*#Q2H-@hc49@Co+Qz(kFcuiN#pF)}*ou)nU z2|q0x+VLCQU4wysd%qXWz8CjiG76}4t$DRaL5<`geoN8;N-<_GQI00o(q44 z$?BbA-^--u{GJ0Id}n}wVy`Nkl032ROF^>=on8WOGobET9vAxI3;70xVd1bJ|4WAuzeQw z9|-rT_|MGQ9L$_&N5qg)!zqB-wVy(KDZ#e`!kO2mY$?*I;+zyIJks7Q2H(yFXt4SI z17+P>2p@Fra!g7c<{VTL_=rQOQ=B);=XT30%dPI^wzhLVWDz|? zfea{u_OPx4nSp<^5CxM0;TVw7QMkikYnv*3dQY7xaHQ8$;_I`d6@PIL3SKR%c{%?l zi6X>3Vd$J1l0YLQ#Z`6Cqp5;A2>?NzqA0Fa^FdI89G6_dm&wg0xvd#aXtw&qS+i{i zf<_2aJ^(k^kP8HgGPKXGyNRFKZ3;{`F+_mC>(|h5v2^15R%1it#nbTbKO_g8dF?gR zB#)%1gr6^NcQX8^PB}x+j#?F+!J|Ioru9Wyg4rZkZ(ioYV>HEUI$*LnpyIIB?rJgP z^>8}6d|SXhKJ#b>}i#WQE z)>vNbC9A0_r*1rEJzk{FJu&{AuLp(Tf0uH&TsrK11a6dee*-D#`Ktg|S`_${OM`D+ z)Cdd@Znw|7BX+L&9oP^}2#auV;I|czm(@>V-f$-Yxra9BU_iaI|7kX^kg8%=MdL}R zuXrQbNbbBA#npiTWukKK5;$O+)~S>F&%%Y?HcM0aUy@HUQ`uP$aA6l4LopWZdO3dk zv>xoY=oHVLcT0dy0YNGD+UI?-55w?Kk#2C1d|zpSF2~N|bUBJF!S7G6W0@u5Uf78> z(Ca;1M%?cJ8{io~S`D(LhYcW<{3}Ab+aa3sp*?Ha-O_F7Ez@$Em`@XW9&m~~qA-MU z$e7?=PN*gh(OuqzF zb;{hRFL#8s4jdSv9k8#x{v!0O#Va=`=^-bNbxmdW#x`pH8?hU}rs}Ao9IEp;h6O;KyAfC4mr3@pe+DT-@ z+7XoSrA)CD!zE4H>hC>+8I(MSHiX_r&%A@7XGXC7uLEXYZNp~7^#$0xQ*A>8gf#Qn zyt7WXj>mmUM(f*NQXnd=ZJ552GeQS(3{;?`&bph{cXOI1mzY~1>y-KKzq^d$oB3OE zAj1r*b_p4A5t62ez5H9&!6ADvw|<-SwI+qtp1E?WYE2Y&St4oQ>)#q(&xV*mmHE^Y z%PquWGblLy5FJ>gHve{cy@l2xcbVSs)wTQY+GKD7R^HnCDxyV1li$1OwW%Pe^o$*G zfbq5i7BolE<2sL#(;)hxzd*#QDsdoKb4!n46PDk9r9j4&E~!-|*BUxaOCuiNx*wo; zCUn9iwNnFi*+mTVvTboi|qqnmeNzANH%zrNhaZgotBgTz-jJ}Di_T=9C=Du^eoRK*O7L$#wO z7{A|E9o*(lV%D628{Tp5+2kG+QfJkn=^P^7X8%Xgab2nLPw>`QuMtb4BQMWur=;|; zywZyfZv8t!a3M;g`Gn0AODogU#trc>00!&Q$6B5w{b0((Dot(>t+h#%$$5cIv&mv? zbZL>)y0XIVxal)dH>O>v>Q+*^MV^1Ha@=sF<60l#>nA!JO_W|mp$2fWlabaZCsK=Ox4tyb+fQg@gc3if@YAr>Y>7%} zg}zoAw}yTV@ZGL;{dcM5jj`-kCL=$dEU>XH6c>SH)Oh%Pl1ZU`N4u0ImyJAbg?)zW zYngaWtvqfXI^R6ta)5g&bM1?SkKFL;M)-VDnPQVr&EyICq-aecREh&)$zqt$qUv8v z^5}8drEqnHVP0Z(+&B!JYpmD=C8(qsPH3E)_6=P2S{EObR%W{;cHL|!brB%@41bA) zSZGh?$4_v74hJ6$YO`W}fAYotv!?>gA3#_+@s>?T$>k*R-VaiMk}QZ7NT~a{gAcx? zKHP;%Ss*IUSlxfJ)dx>k;icH%K8xzauGmtYd z&|tH;(pLCSdEyFPBmpiaz{JlAdFD-3qO``9g;sF6OFDi5S9)0BlR|(N66OPiB-R!l@*<)|%Dq~hvn9Y28wAoGoyt5xqJ-V>74r>o9 z2&ZR}m?yGZs&~v!5pv@qd~)YfH?}e2fn$UeELv7Gs3@aC%V1HB+v-X`C+|T(cvUld?)uYX9@m3(uBF9dhreAdG8A-N-QGr4LS8WqdxcnXEbmoeidSiG%HFn7g*0SZJ z`rodQ>QYtRKee1MVw>>`jH#|TyG6@b3(D>v> z8&gky6*40{*ovS`tu@PFp+lN#4%?28BPKBqQpJ6NjSAciJR;Sui)!Bo81zBpAndd8<#=C+jqE(PV2;rFM7hT4B({w$H^vpR&d93#vLge$c} z288V4`l1>zVWGs}04O^h?6z!za`RZ!0yk=b=s$E%NiyP(6#{07f_wGMX_9=}o+pfr zZjZTWaE5Urb)%ditx3oGW7j z>TszS;X}h(N+d4gzmy+0XnAh!+3j2F6ZjQdyA^3Ba#IT$+>skOH-zBqDM~aPF`h%b zYymDIcgdQe&jnaN&n~0iW>u(t8baGAKM>In|8CbPO|QA{15Y1t(Lt!lir490#j#6-6D}sCA&h?aL+Mei_BiozUqLFDiJ4{gI@&4IaEmp&6 zM>EB=Z;BPjC@eV>;<2yi?My2C<0X~SbJt(6Q!0^4lnFsqlXeLQ6uTG?F^FI6Id;~( z|FxP|mdZl!oX~V&_a#Z?Wr)`^A*#_dd{we>N$xk27yO%%+Ibh2iY&Z6Tp!O9ftDlQ z$VMhtj*+~`9QNz@LgCuzVqG@nBfGe59?G zh=aI23{MHF8$D+RWy>F*J~XZ7kDct)6ZFabH>MU|`9i=Bu(O9y ze8$sU<)Wt?@I&7#3RI0p{lsWjE5I zGI(J~o|O0=)qtZ?T#34!VfiFvOO?$?7JW2T-LH;r2|?8_8S5W1_F=9=Zu@KbI%nfH znUU1McYL0$-6SgE`pLIQf^~MXGw}orX?(24Nw3(R``1KFH`uQxkK}swF(Q2!F(CB@YYL* zSAfy>eTuI)OPO{)4y+x~o~LD{1_gFIaZ?R^Zf-obcks-N(|Wp|H_VKGw_V`BxjPsCq&yjA>r+)pqw zu(F8WhmbXRU!u#(jSMT>wOX1c#3NmVKR9S~jRCK&R-ObmQUO$3h?_}USuQr6+>dlH z&ls`YNe9zU2ScS2QBuY%>+b`nsuTu)QJ4nwd1F5(WS@T~3YfCC8L@fcJ&faCTdP2A zjw0drXHH%C)Asv!h02?waOP?zg$sGhpa>Y(vAfDl-gmk0+?r;JYdG0l^rVXS6DJP) zkFoe3$0zRg+#c~7cn610hRnqgLZUJe=NGmg(_sG|71NUjOQjukV06}!G<0^hW>u+M z`q)b_O%Ezm`m%O(G^`5f7Ufw2rk%O6>DE3CZOQJ-PpC%uNth;xY3}RmGNOydGp0ii z7Pwi%kca(uq72+uNTC2N$mnd`?6>1F>HMg{jTSZCUq|@O3tZE0dec^lrcvhbm#sul zB?e?3non%5MD(A*8j%b;dJX(Qk;W$EluR)h&2Wd!4D(bb2OUKDTc^hlX#O?ViX-1rL&-0Q%K(?)zULk2<3imb!DSYSaZW5bvXl zTd_syuyfH02$-;vM_7(w{9#hAhC6a5?i2DSblE;t^&RJL@v?+M*$da$lP|cVdk>M< zT?w%VCa&-@8Bs{iz>kg+S5TH7>fCE_4_Pd8k17twawpwfwjB3*h35S0><5+U>ukZyp`2_+=? z&Pi+p=6mno^St-Ge=!+1Yp-(cwbr%v$>Gx8xv4T+9i#5-HsHGhgYY36?yJul6R9WB zH_|eAAX4|{-khy#ydBA`qUb_@yP)g&9?e*@nFVA<`I;xs3>jjdBM&6MD*hz@{Av7Y z$nLCzb!&NkH*R;nWsfq=`N=oe+^rhbsV%?(#+`l6vMaR8%33Yr+ zPl>Ec%^xyOaIR?y{QHqF-<0@z(-`i==eLH0tO5jA4O3nge|oiN-G`zz)u(py{rEoN zu0MKK?b`-h&G$<1<@4Z=I)7jL%cv#jPA<`|Bq=Il?j)+h`QDL-YA?Gg-lJ(23Er(X zpY|lb&uR>}%jK7!(P*4_p?LQwe5Ri`TH+~zNF#O9k;sW@A*Dnn6x;_YWY|(z{ zv#4qEM}C~FRR92hU~siyY1Nd)c330@YB-1Ag2YEa#@`1HQ#juz!_`Av-PTb#e6 zKssz0@S{@hbbKdR(Q+f;jn*kqj|Qzqm-MQyF-f6+qI=?+=WbGa{93~U)+!#jDzhGW z>IB_J0fCJ+g9-%)t=~PME5y1U9hQX(RfH=&Uf+JI_KcbF0~M*Jf`=2Q)?MY2GrRJ% z>OfG4*lAME1%GSNA31K5&}Xd)#haqZ!PVIpvv@wj8jaLYF^La9sfcj#_#|kNuWz)) zC!XRz34v`VQ6Gs1EVRI2O{Z#%ZHeyj`gBEaAr3_*UB89MH?_%H zx6={zRA{DWd%t~2)b94{>O+_Ex0j$5hxkxiqiPvVBP8REb4@&@hQu|!Lmn!B`_QWX zQqCX!q^{BN#=+@p*4fB4AC*J-Yw(c|r%mB!J_O!vuhx^F@%+sD8P%9D>(^5+(_74y zp{BX`h4Onxt!$~wLm8K+Go(>P=3lt%~^UT4`G3T&T$#)o;R>QgULXU z%7iTcQq0RFlpp=N!xCazkk$SB@13DAwTA(fj6DYaNAu?NSwD9A*dAV+b+XAzSVFS* zfOks7A3+gc9MgYy7p%J6eELa&9>r`!*3s{mK{83)oXni_x$A@>UnqbC_rc$d>-bL0AD(Z&M&R>G@vS{wAe#QrQD zsEgk4AVP7TKzv^o;Uq~_Iy(c;+9i=P>fQM{^wuWj>${GmjuGqQ8YzF(cwWH!AOg)$ zUwFU=f?zzRU!-*2u9duT;M0J9gfeu^mDgN%oa#aV_x8HhR zrEcoDO>*zYDR+JhutxI7QGPD??&5^v4asD_PZwizwz(L=B{N}N_7tHMW4Ky&M-sfh zGqa#RVz^ooGG(WxzJJ=SVlwBqVX9C98hC4yo9{e9msN!XHxYEN-WCXaftHhW3clHq z)L3?^343CANPd&?TPR~>`Xxa%v<(EZ81#+Vb7AQUQX_P6OGdXC}ku8D}wzvqxhseF5w3H6beYJuigye2#NQZ<_TWJnBB zFz{SsT41utB|(E`dUsJq--|cge$(X_`&ON`xFRR*UisNHje5>#F`8}B5?*8uHGS%j$Sf(JG6?)R!=->lC1xi5eNxGi{W&4m( zIqkJ{pzLqYFlh||@}~YYmB%|9MZYLJ_TbgugYSY9kh3idd}0#MeDS1P73+y*yve4I z7!M=IOE&H$k%`B)uHv3gu%Xr;?o5Pvs8&c_4(o8a))DZiw>w*U@1Eh46QQl0pXk*Y zenyQFh7(74dXDJvon0#%dm?1LqRowC&H5GY`(HPdh(z9S-tgUq(<6c}%&HVW9|lH= zuI_iu8eOQhtzBJFN?{4ho>d>H=Y0bqSTVs z{c_7o?Q^4zi1l|LbcX68O-6co53^h+(#-p$#Vf;lRvgbSU23SXfz|egAzGwJEqNa{zJm& z=56UIdC&Tj&*8Na-3hr{pf4nM28>t0K^zW$CmoxAb*8tsPbGepn1Px>1s zWF4<2UU}}DnqK`vs`p9a>2%A(r$hAaT7_WrZfvOu`?33@)vHSn7IMLWd|bXtx75EV zy^G5+P>@S=Y!gyM(Y!hSvRX#P(6$#CDqj&faP7|Hq9U6se@AWD$Qs{X`}=Ut8nc`0 z@4U3g+)ySPq6&9OQdU3q9PiRhDp(&P{!m_^Fl&r?L&#N?$L!{L_M0}XHp=Go3GNgG z28;)F*98=%Bbpu6Xt?3om^;E&e-Lie@HmynT?qXf88+5;Q_e8oqiJjL#lzlOnj3S1 zA>Lf9o16ey@8>rb5AGe8f4Mj8Kxzck;tgWhEP)|umUOe=)XC50g|x+McPHe3qzWa$ zFIH8G>UBPPBb9uBX zw%p~WogO9j>S*s#GgEwB&!jzjeL?Zd;>iHf=}~{{QJRrwF}Cfon!8g*r~*JR6=oJXR_@Pb)DFSB7ZbbVMC&I%R$Vg}7N;iKp;PZOtfsgQB-u!(oAm#K}>{ z`1l9oHx;n!Mud&(!w!8U-XJUmYea`>2feAR3QQcaB*KTU;<3CQr<&}!jWi)8!`!e= z=a}6{C>;`@89jwXBH{MJs1T%6M)OQ{n0$a46>>O&Uwwk>M*N5Q*Ih_unwHE-uU-#4 zat}7wU7sg5VSRPvli@|>JCV2I4yPQG>?!Db^pUj3@vfxS54Qz-{dHKp<;Bh1*4}gEySKdjF9c;>=yX>p!-f@cR3+c*|cm zfi2xePk+AHQt~pyb*R5jEwk;RiR$~3L!`cg0f$N-QbZQ6J$m^!@OO--9JkEK#JsdS zK8jdvc`IqKP_}i}>K5x!WTeWCgyu8pg@@laep2`A^{9)`IrJvfw;w8IQT5@#I-esu zRI^_Y?}R7)cv8LR-KtAbhCWI0g8H4q7aIorhNv$juADWpve|eb|51QP*+aT**K>?? zP?eEyaZ=c^CT8tZ_hbc>P&`UA9OZ3t(ZY7qZEEGFb(TC9BSgG!XR=+=E9`<^sMq;H z;gQ&_2hW*MpD%9s((n}G$$C^ggD&f7vpm3BPc)u5h`;-G zgZq{%0kjv6cga`2yQq?SmV5e^$3~B5x9(+$w5`7Z87fk4RvTi_)u4kCasnO;Wg;2F zGQ%Ygw#!^gnjN|1dcIOaaNcj|U^Fd`@!|lOH)0uC8`Tyq_WNQhLwq&`T@=>dXL{w? z*OsUSUFneU`!ClRkare^Y0ZsXgSbB05czf(8)1jy$ks|wbtB)AF$~68trGu_I(w|6hSLl(v|(dy6ZQE$|me}J-lkPYEN~_5xhRB z#-`FNIIB3lY1?_NTkT;MN1qm@m?iG)`0*e`PtU4?Fyqx7uLbuSjXWB?(9-6^jTN5Z z`kJ(v`tF!(NnbfH>KZ%<8)a*Yj691xc8f?Q3peem7cOgvh*SPxq3u$?pp!At{(z)Y z{#In(@h^#mGH=!iQspc2w!Rm0>V?zk(5uA_;!iUp851Y0`q!!WxyY3(Jj{}F68Y`S zVO8!QQ|w2poux~-RJ9e4sn&0eeVy)U6B6sHVvC->N|NGr$xyI}(>y%%_ml{p*)i5u z(nwQC4+9>`4lfXeY`=L5)x++qkDK;LSCku_*^Ia&ow3Er>0DOIylMEltB>95lEohq zRN-4<6YPOSKZ@w1z1-zS9vgdr&RQW(!b#f*VSU!rE?eyJ>DXlIQ(^n@q3GzLOBp3H z9t02O(=8;)%BeTp??TU@)OlH`z?-PcRJa+R`QkoxBYhy?=!ZD}0e@~e6N~5fp_MQD zPVa1V=}G?_W2(;k0~do_ZpI!P)q`%`n~s)vp>3pXzd9LZ49Dg)xykD1B0O^3RXY>7 z6GuaH?1N0+1P#ej!yyE2R@K1C62in=&DI>bl6YG1s>z22bK#)?SED0P2mbLRP?uWl zk@ODXvM<|y+=T^ge3vvW_+?wuI`Uy%=f_3%7hnHXsO24;aJ!4HWgG9h{=$jusLqJg zD>FLw6*9N8-ZjLE``cqp1|AQoQ==eGYgyZN$vQntXoat7-Llr@z`Z~91rt3?aZciA z6jS|Qt5#b)Z#g>Dc~$pt>+e5;319toe+gIXF~wsGwOj38rhBIFRTyFFvya4-zc+8^ zUqGp0FLOuj8O>{|ekFLFoai}l<7q1;-pI1vzG*s4CpvjvTLaSQD_(o6#wZE*w4s$K zwwpnwwfSAJ;O!sEyWV0KHZ&nLQ*i|`Pxh2BnX#X|VHR}}y*+w#o*=^lVEZRo1G%LycCy14eWEersF5c@?0`h!Vexcfo|Pg#qvqOLb>5Zbs@F za{g&XUnze7Jl2>w{+>KLv0K|aQPpQvLk;>Z>&}=k4vdSt)B4=*2LjJb^JH zWeSp;YonVoPrWW`K3&tn^-0#`#~Z84|62V)9K&S-jDZ9{hQ587POG=)YwtKV6okIq z=z1TI2yLz$7_YF9Lm9HKXW=&t#mfqyT3_T`B=SA7lPQ-vjW z90k6oeeuqnU*y^p9R!m38iZmCHn@;@Z*4PiIHyr=hzgF9R;~=2S?7QF*(QUjP|^nY zjf4`xXCv))%6ppD2g>B;L?G>F-ywE7ycGVORwv@Xz8eHSSIK?};rrWh2PO1wTC7gIV<@#AvkxaKV5aTwefOFc7`T<8Mp14W(&{nLlvI zqWO4g=8uUx52DAmaATv}j=h2WDIwfWN{w-GxlXKg%-P?q`b1&q?<%R{&|5nTozT$z z5WbkX-m@)^2K+8>=Z}2C?6=P+byu`;VfcvP3E<*DjtpaKT8xXHeHi(z) zglgT8y>hTe&i^?7sXBoj9((s^9Ov(MuNcmOX0@NQu-fVKBPgahtGECQeSn|@3_N;& zzQw5g1{Y?`G7KJ_n=Bu$c?d4m`;bULk6p;k+ptv@_{K)b;`*H|x=p#iKHUGEVS4f5 zZk-;(7D{u1x_f-7`;gy@O37QXCNF5|HRS|Usjk>X%q0a_XU7Z8zykrjN7f7RKR1-C z>%G^%KSTfd?cm8&=oSUu%0}MrSu^yB+zan4oAZ#%qUNV2;=F<98->Sab~ulz)msh>yuCTW^IQ{BUht-4(4+Cp+=;9NMhzk-%_G0O!!7 zHgs-p2C?JO8TuSxO7t-Gbg?P7-ubZ?8o5wGT{F_Tj!M##%$V?*)|B3$lY zwU3TYal5l~6Yx28npsCIDIrE3v?@PKVzg#=_HRoTJ8@Od@a+@r^}W^tnd()S_{%Mx zRGLV}uOY1VKk$=Y$*jICiQ!5$XnsYzN$0nJLHefwTg;Cb>BAm=|4zqy#L2t1!#j< z*tw8C``#NLemohI={UKnI~3+K4rD(6zQ|E?d1`WJr~E zCbF;jLRsWMK^mp~S=-Bzi${{{&o*seXiahSFW$Pl#rqn{`jCY$%-}Ly^I;nX4xtjG zcZ}tdoFY*(;`25)I?3C zV(9&yvUwQ;98vtc*b42(+;9>_lN8WRR%|8=Pxo#MEsppckM<-+`DW-x@isrL49?=SqOaXn__69vDcQ?gfTy zqkk|})8HN4nxr-a&)if?FL!z`1jT3(VN!0P7R%{wMep?T^_UYGkP_p%INH9sx<&7z zPsSZYqs0nkwGLy=)AuuQGtT7ey{D58>0Y$c7EcP)u5KY>=3Q^2@?pCmF6k|ybkn@> zj&q4AGnVdZm@eYhtp>4i$J!6OC)~K0*Bo*>nIdxdv?5jPwGHLN>EuiteQ_qf>uBdl zkj+=G_!qdusoaSNDZ6*=s2kp=9%h_~93Jk6O?93%^tCxV1)2FOwLN8c(p}6;BR%n~ z-VVH|ox8BLnp{wh=4kOI->2YSm6}ZmWkUK;W(yzw&u`H((5~`tpaz9s5cCYGcX96aZ}{44oKYESyt{9h5XLZm z3U}2a)ndxgkdxH6g`)>{djgC28Um~2*M??of4V`$j`^_rb*6-X(a{~7L;^HN`^USz z9yXIsXd1iU=rSt)LY?1R7(W%}J9@S*ECYv4;Z02M$!S=qaKVhFyNy>9rpmf7@OtB6 z|Iu*Ss4Y1=cI%1-Fn%v+De~I49u_!EZcxN+Jx$!6Q5Z~)F5MU7e81AM)@6nafH$J6 zZgkV|eDSdSh$4=la!O4czYY4S*-$Pfn=YE*R2ka`_r+m+oeo)L6!IiGRSF|Y5BK9* zt~kw3+Zvr8R7>a2?^lV+4BO*+C5*TI%dn${QIW0NXG=A?b5p3k6o#1xq{|g?!JWR3 ziD$MdQ_Zkt)CKC>>z%vBqsp8$^*i8j30f4U!aO%7?J6ybNVm1P{N`^l@#5BKQMbq9e;;&KlbrS1v!)nBlo_pVIR&$p)c9UT7F5U!Pz4IuQ5nrdK zkt_J)>Si*~k!cx`p7$&av`uZ+)osq4{J0rU_lA%N5StVBVsHElQKJ+4l|GDj;E7Q{sTtQSwV`dLpqmQ@{w1&JJ;MN>)k zP77VViV_)Agl}(qp{EC8X3k*|ji$=*l6Gtni47Vik5idQ&0P>;sb=SOgV!KnLL_DN%Ft)LRE8M1-TA;9PmYvG`7#&07F&1o%6JdQE)dFkTYTpd zA)~r77)*l~B&8mnlB$1q!nRvyyCV}wIcBeb-ZsY$K$Fwas{+Dz@Bqd^nN zn>ttZu5;nb{tzwHZq-1;fxDJSVx5Nu z0X z{OKLio2F)*HPIcq$|+M845}}NGV$AO4|y~xV^fQ(WFsWAFwbGcmz6_vbD_=6BC=HZ z1)zWpXJw-6aWR6;EtPRxpSjtznH{@7coYSOWj-K_lZ{>xL{I3{nYx{9#Q zt{@qmE~I+m4inUD0n^!ScAiY`t;WW|UOEq|Bf^Y^b?<3vRwTlBnKSdwSmVg-OYm znK|QaBfl`}Vx^Y>4$b@WX=4(a(iu4QA5S)PhJqR76OIFHVtieN63b@e5DjY^nXtWs2} z%786K2jZ~1(lwDK^nPdKPeusO_XH7l#0-(4@T{rj3Ta|~LK{*d8HRVdmT0A7zY7Le zar21mN-r{apgC*jc-!Lfal}wtw=-W)N(S0K&~HG!k-0d1U)sDKhDer5fazZKd6_=4 z8-;mP;_zm8`rTRO%p;9Wg!rgyyM`W{?+*0`2rsNlc!1DPH&=~uQIGS^}dE zy#3f9t%8*6u44-vC+ce7B6h#zof=BPiO4o80?{M}RX-@w5*dW?BqieE85_JxRiP;A z-~@AV(xF31Olr1R!<}?*(GzjeV3uze@3iB9&Gh!kJB$iZ*y3$N-7x6`yXGI8A4<-| zB-z1tL^V-fVv@?~=8h$iyCEmK4oMJdYilPN_9aH0NAKJZz5FfB@HdI;Uq-zXYXVNR zbaJ(Ll9q@bec>}@YiJ4?8w+>UY@?k!J!61vHlFRIrOTHxJvt_g=wuw0x!6yhcMG2% zos*;uj<+E6DhSny_AMTBw`o4^yW>Z4ON^{VWrVm7=>!!!Cv|&W0W?&M&Hyyb4Ni)u z&^-#Tb?Hb9S1hDsVyYdPx$Pqo!(`LL0F67BkNB+D-MEFo?i%9r&OL7zk3=oaewM;aH@r(99F^Lpe3=a)J{jaJVT(j#bsSMjYYN#~Pcqkp?qG zm|^KYcux#m`;JJE$a@`^iC)Igm~IfwEplc)Spr2T;uC{zGbg4eh7-$ld2wBH6US-J zh`B+g4Rbu++ap~h7FN0~(ME7Ln(5V2kH_nho*4$>UE8sixRk-+=xFa|3Sr{S47GY< z-K_IFLDUd)fru}&YF|`Dh#1T&(*}DXBDx}Hg3w_Yt8B>OQlxyBtx#pBRi_eEM&uZ) zZF3-ghGb^ieXVL$D&B8%-VM_+qMRSvmW=Ufuk})D>pIvHN~95+Obf4_8$3IF_p=?d zyg6^xx2%`9SKwHrcgyAm>w{mC=RHL8H=BtbB~cKV?Kj~fTEe?wcW0C_yO48OZ0D#Z zZQ70I$h7f5L}2LF2v5~%4fMTPk3EYHT`-=0uMW?z=}yjuk94~p^nDfS1a zk;eqv1U;u^V5MH(^MlyM{$3O2;@t5CqxXqZOj>nfA|?Z8hQm4|V$kYd3yTw<&%M=I zn4K9{S1Ij6@WOO@9YYCrV#W;9;^(syVL3`qMCDC~=?rgGwNwdZ;;7ufY)Y9q0jU~6 zva=%APFs3-TE%vD0jcgzpTJ=;u=iAYQsv(|jj=2*g|Aj|o!?(_XP5hQE7wKHt~|{| z0u!x^JC2J#yg>t{Iy)1@i>4+vFMci=wLiWM<;(C&r4Q1FV@?ahiugv$n$QeN283CN zmhp6VLT>WJxK~MyiB|++bu_s7x@OWxVtxmoQea3|8CAbAkdC+gH z98Gc^o|7^>hbqu)C)=qQDfSg~Ye;ANj%xWp4CkjZyXGl0=K?jOo-7(;Un#_q*hW&J zbh~x5)W)JToYmsHd-f+D8<;jQ$DUZ2#E8rYesC(zKrR?Wm#L~#v7Z=+=daY*>dK_j zvJ;Uv5WV$ShF52jdLS0~OG(=%S_T&5#)?QE9Cx_P&g7xd5W4^1puNcWTy58r!LoVr z9#6LkqtGUcztjTGW{A0Z^u>E_6h0QsNZ(tYsf}V9_r_zM;!Lu-y3PfnHDY1nB%@*p z^yutczb||^^2dk0q!I7Jf(Sba(*1*h=#1HvD#k(quC+#qMx=PJj^kh zguain-4X16L_%23TP9~<ArzbGOo|{Te#7u&@>yLO?l7U86f} z)KJQ;8LivW?ml$Dr&mf%GmpkqBsBy>`4ZOakTRyviI)YbmBe-#XN=7)W@0}KF(_-j zC($mkQM62T=EL+)N1XE;H0a{6AWV%6JbhE6T`-eM2wH3BB~$Xb!_s4Z+tAa*^NCoS zKU_xYdxg62G#PC1q6Kr7@Eoyji0pnlb}mBQIiT^l@_YGt2d_c2$ZSwPck8~XFT>8} z<1VV$!ctiJ)zFIC>4KA;()<7gFO0Dr7%np@DKQ|WkH~CEP@jAJ&B=bz8%hBukI&HZ zKAM@m@$gfh{F-@a^6Q3?mzeem@{0`O*VtQiqglAF^pW0>l1CD{l#Du5Zc*>&d~~s{ zZyNp6s17f=^Z<%x9}~D*L|4zV6C16p&_&2|B_`Rw>7Sr>dtG;JzQ-UBieT2yDWl?0 z0g0;z?RSoLlksIzLrRs*OyoBXCQWtra9Jox_RtHTA7b{h9KgZyIc$#VKohO zX-{oDenDyb>JZeP7r<(xIU@OstsN!Kjk%hgbR---lGGX8c}L5Tr;%*wacW2413 z-WbtukwY%~dJ||Ie3~6#3@1W-fXV^w>b=U#wV(%!1C!kn;chKk1+IiBvF4i02 z(9z02p;pm%u=)}dV(7B_%4FML^ltARlSFG}#+*mkJpwtZDrS(TCgTi)G8P;V9pYFu z1exis4xIyD1-VG+ZYnfYB_ZOaQablz+Ioe8u@4ZRU$>#At0}zH%87;uCb?gpc`0@t z%}9>`UNwSZ=1n*sdeqxIVac3yP;=ishZ0ZGfanv;f^mhEflyL z9^}Qr=**qAGf*ve-X04=f3f*vB0IVp!&`ddKV3N>QP=o`PzH~@{GHj&SN@-BHA@J#>{s=-d~UC&uF9X zA@ph&>LcBX>2ovrgxLi8>)wd9^D?gLrv3=uJmYzHA8)efMCAKk>y)WQvfVx0@vpo= zgG_G~qc69Z-E&So+<7v(r1wsUH8cgoe(J3P124quxqQrLNK6m3GjQ(Ed%~3+QxucA z*v08bHgh&S#M$6`br=PVv3`8)QHH~v|fgnYMFDN^Mk1Q z0n2RTPAHW?1o&^e5yHk3sX^8;5APD@A6^SJ)}43eirXD(^@q3xaT-`pM#R*OBZ&Nx15-&Zx{l{Hq{UUF|0_*y!1P z?premmXd=CQ`X7Q@Mtk8 z>C}3Q;*LhqZllz4FOp;$XKv^vW-Yc%=}@MH3r2_E)x9TIE7fE&7Mdf*6pd>*E3ngkbrb&l86?j_n97BYCUp zcTjjkYbg}htYQOOdp+f0%5+`vPHTWoxJKh&9A%X+wb7SrwVOuGn2x>FVMZ_EZ0DuF4!uH&ct#-? z_u~=1o|=mgT98N(q%gw(t?P3zNF)&3$0!y!V|ltrZODs)(d#hZogbDsJJ?aMXvO?H zA4|^g8{O=}oa-P~NE~bJY^kE{I?{Ts(?SukEAGNlw@w z?$S{v29&tXJr!r;xx`34yYFd28zQD*+Q`ppBuR@O-&&^456mI9?7-s~HL+7Vz#r!1 z=amiQUMQ2unQ9U%Iy|O3N1y!|l#8H~oC)OKa)tt_F~}xz^;I-puM*?2=y8O!b0O+@ zbg~L^@b-dcp<1L$muxA<)N^*G4nM{$f$&U{hPPuzi!77Rz(qY74NQeK+h=F!xVTb5 zwGuNR>kv!To_@_cjNY`H8iuj0D;Xe*UO~j3P*>ZhGNNjPqfXb3lh1y6Y5RIAb!g%; znHbpCKX|c(9syT6lilSaeT7+Gsg)#Q_ImnxDLrDA&|gb2QHrtU^#eF3vLM2?CCUZi zyHG*0&ASf2F?6$X@Z$GdfqP1s3uXq?nWmM;g z^tu(P;OWt$>(GW;5}nbcPT2{?NSyKZu_3E4^n?%V5+J$9Phr+PEjf6rgJp|y^%aEV z-*h8HVphMiT3ZL)GIYkv9n+C&Z*M6?JLV~`xr+N6he2+* zp?f)fC~iqK-=x;Xjcs zKoR7Iu7!koXP93iOeExJZX!+>Mo{Wi`0S{vF)(vtCM+?CbXpb#$6CO9|1stv=*cQlhP1S_CQ0YPsINfLS0W4Hc1J zA^okI6LB_~grUF%9qiTFW_9(_O#!i;)AYnBUjnb&>D5En-bL5OCQUIRqW_n@ZT%9A znz?dx+nDM^BFfZe@O|PyO{Gq4VT|-FfjC@M6tzy@b}Wb+ctantib5gXE{Vy|Q_god zRhc-zo&-x0-Nk_4VH8{f2Jp9R2PbHCwF1CfXHujF%2M+)hG|~Mqup8p?A;bEP^EuG zmK@cv`(slE^DSbBXhy1fZ4Ao&s}6CPtGRBgL|1xmy;0?G+utPd?!~m`LRZFQBdKW6 zCAq}LHArZ-TP0S9KIz5iLXR2a&(jB{NbYZyNq=gn$0CA&P6Iw%Z9U+Cigb2&pL5Wh zM!Kn&zRAcZSK|jLFnsPKtM{E$*xJQ1&uJ6`C1;MXtStRMt;}2Z}rnBa+RtHSC|{`_|4(+7}vi zeW(hS*WCUc(fmhLwp&qgF^}b`m(2{mbRnecTFa{49Go@nX|8P=Sfx(b2yvqoq?=;Z z<%d5MZscvhs#Lgz5bx(JBM0eqXSRJTW>TpR%0`qiaYUkDO&4rTf@ZcWlP4?d9@2NeeA|efCdhMte>VF`9hS5N(b8RZ6Z?> zoAJ+r65mAggh|jIzm<<1OvAx6f$28RkFCKSucK1}y1(JI#Q&Zp*3MXZAT>O z_Q^cfiE1&JPVvwR!0^^=9zmb%RK+GZ@po_$G9Qcdq>vLkpRH${8WrImcPV{I-3i zy8uk_*p=}FXs_uCar~{Q6E-&M+dB$(()=w(CvTYIe7m)72g0|^tHkgf4kFBV;@h?C z=McX4ZHRz%-Yv&y$gOvotvq+`D^YjJ`0@^3_+tO%4N=?W9Pn2H!j7mYqY=8y=>=q? zSFG2`xuIhpo)nr`&v=SCV7RpQT)Ku=>A^PTmc{vQg~wgH^Mq&Pu$sul zTs6-$?7NQY;WA@?o3#~wzLTnBTziFKGEao_cP7G}0=4U~#oj(xEK)UnQSHbilIB{h zKVmkvO=P}K20dN|-mf|2&g$BxQe*v_7|;E8PtJI28g$l)4-r!Oyz2AMu{qcBKAJN4dz+8_hq zuq4GXl)9ISk>8@i!0dc=St8+NS|Iv5&urMMkp%r%bfCy(yz;gp4fvi>VNLb6UO_nE z<<0JYI*cGT^Gr;>{EG$59s79K)&c)hQ*N7^Q+9aT^A=#BIO&}DB5JtGQi-UWFh$N$ zvsrvwgv|q&?qkzQgNIe;zeJ1Mc$*#wKa=n{$?{gXVI2G-0}UM$)km#**dAN6&Rv0< zb?vb(v_4t|smR=V>HTH7D^SHtWqtef`6kWZMN6!H0xq1#AXziDeb7=Ony{lBa(Fv* z|D}q{@`_ODknMX>5RJjH#9-D+A;i zAiRpbyQlQ`m4lH4gdpe2c)7uh%j}hB`M$5*7IDddvDBd3`dy*h_g)}|3hZs6oC2?B zPlh*AoNir0{o*4rsbkVko>}|EZh6Xy_NnrN4(ik@I5pI|_KNwEo%!}Q&`xRHJ7uSP z_1-sF?1QT2t$il7WZCw;2sNHjSC)Q-F)S`|@IzdTzJr?2W!Y!Y?U!mBWeZPTz1LB9 zups6rYgbpUZ((t@d{5bM@ze@= z5o`110nID{v3tO0Gx$v!Sn_{@0Wj3wiXZsrT#X36+iE`Gy_^2M(`wmYT)C2N9EdoO z5Se6hJ2-V+Axqars=3xj%7ze-LGp=HYVHyR;_fDyCx_okcu;jRYhNE*SJ1h@&TQwd zs95ZGiEI|}55AZ-Klzcp35&Fr1UN+G$e#s_{>99Po5@Hq(PMFW5>m&$aa&NckmZ_H z0bblX;06@0;t60iw7O8I>0A+DAcOUxAD+gB1~e&Qj3jFaDHysTh4F4HV^1z<0g zr4Jx5yJxw}wgVwq>M|&B+B)h$iR|hI0vr6q5v8ju02`Fg0c=25PGCP?4j)ig4){nd zg(3(aP*;uBX*qmW z0Cw#XD6-%K>dJBAmMiuRK7hnu;IrHp>?i@7u%iSNfYa>}8<(1S;^DMr2;W`+8Qb^% z63nvYnsqPNj6)Wf>>ez4nbLBXX|QYsB(ghkR>lV9F9miRP+d5I4a(=p*r2W)z!q8# zA5d2gVB0P~aiFf8rDVBcZ1{i@f5KwIb(t|HOR}-870^wZ0*#Bn-aL8MQ${C`oZVOM z`d|rYGh-eBb%X*1dY0BYSys=|t^Q~;Q6S-0(3ZQ30}W@MJkYb4s+F;O7C*6LwpQUk z6{~u@nHT|dRIPQ>=2{Oa8(33sKI#8Rv4S)Ikz%UF2(jg z6o5<1Pq5_j6U-qCM0LXQb0Ysw*Z?K|Ji*{6jsoy>IUGUx9Oneom7@SeEI%ipuAJxO z)3S5I(v{5*jlkWxK$l3M?fu&~tLjkBdH|7 zR#1$cT0n_E;j`Qq>?nbod@lflr`6;Kmzenv1)yf>ApwCsu!3ewWq}1C0_Z$A3qbTT zm$3@~DDh_j06%d6+i3-0FYjzXT{(eWw;Vp8t{lKtSqeoEKA^4~1z-im*zf@){sN!n zzFNkwY{7aL)L)^q`5%*H4r0h+ ze9JTT!4-hLoQwWHAjxd_fYyKOSC;t|r1$J7J^vmh;3_`_nAj{Ow!q|POcdb2xj?MG z&D_9d@al44gEWq#$Z^Q}PH8!F!T*sM0u!tpc~JhZ-Oqo_ML}ITGB%5ZbHHbXQu040 z$!z!l5`UTgEcGks3wD&iO}W{N zf67JwACP4BTmiKH=k#Xvy|BW!}JFvo}4TPsN$T!UMlN5rR6Mg z|3_lT8f*TKx#<4`lFWt=VEzB^zyNN+fM!Z;xw=m3 z{*@26Oaf$;0llavK^4um)z)oO6aD78D9gtc!5pspOAt^|Dh_nrzV)E%^b-g<+L4ci z*QfpB6sb!&vp)I}uX5{ap!Ke7pIEnxo;w+IZ^^bvUxO1~X&Ipj7ypAe4|)0RYysZ@pg>`5vBbxK{7dzsFLQxV02;AF zL11sO1Slti6t-(@xh_;&2WrH^)4wCGBm(dU%j6g~0wSp_jhEo_fJawr8V%5;-UGr=B2x2dTUr2sm%Ob%tQ7|w%4zM^<Vg(l70c*i6IIWEUV&4uR4-m*cwEv2@q1qZC z`k+3PZ^sP4JE-w5c$Wv@G-GKAL>RJiq16TS*)nDu94*P?10983%6hO9o{f9YX*;c0f`AG-4+ez*=w%4r^SHIt&SgNh05#^w7D>urL_i(cfX{;Nunx-EywrO@ z7{<7>kO_M4Uozr^hnvg1vTbKwd`aD>c|GX zMMOFPy+cdA2ZW)M*V5u~vzEO4$zNj2zk;#v{q?_-1y%Y$4<4N zKEJe~pvD}jmYvK%9oc}_Pax)KxBq7p!)}Gx=B;4u)fJp4wSx0j5XXiJDBx$^1GnI; z1O@UXfDfl%$Ir{6KELx2`)n=Wz7Q_nb{sB{3$vehSzEm3Sv9UpN!sC)@TC1+0o%&|~= zsJ8B@rVFgg~ zuMPqBlLXSl?5UDA&^$KnQnm&qFL5!jAHW4hgFUiA^Vk&F{y%b@T+DK+{7+;LWY0@% z{l89a*@qV7W0Ny!<8{nMe8`=9&Rum$4<4N zK0i|}sPU5C5-8g2WCrT^o$SR>PuXxl?;ptCf1lcZgUZq&C&)~fbfLig05~e(AbV*X zryCr=H?L4w{`=zCsTS1d7qZ7O+yHMc*vSmk@jKaz0>~Z*RsM(jB#=sS##U(sYyTJ2 zmJJn9z|Xn|Zt-iM2i84sRKQsYR-m>ye9H%6|AIJnss;7=nQA$Q8{q8)JDCAGeoJO@ zB%tNupvwP5G5-71mJOA>A5a1BlUVGTgJQ5o1soJ(C2E_tLSX^P_+JDGtxvXU8*2(@ZC9n?tYw)pfb=7S}PwD6Kua>6u9(ebKphPSqvuO zNQfFwFYKh{?m$x1_IXtGF=5FMqVF~fUFT6V9m~8gX1Y`H!E>t-U2K5Z9^NS3+6PE^ z(IfHpL+0y;!md0^HP@DEn>gc|6%wOqNjTi^9_MSTnxG!!jIPB!9SlC=i3y3R%}zAC z)f+ykzQrm-FRSd?$j$v~##K63vj{lW+UY0fz_p{<^Q<*+y{v3^sxuV1>r$+C&&bRf z*MgAUY34YowyHC(3*oG_!dYZsZ39wCgtdlp##IR)8))rs_G#)=bcu1*CcUiJ&qmz# ztLazih-9)eW=}4%a$D-Gv`zw@9^hpK;9z*_~l7A=O4UW3Bc0 zm;kPwZS!KS$(L$tQ~&?Cd&{UeqDEVgput^&26uODf(CbYceh{-2@b*C-QA&acL?rI za18{P*L-j8TlbrL@65be?|W<3{HfJv*FO8~+EraueY#E^Z@wbVDB3AHNQI}o8+#{j%=znnBDf!ba6owk2|EGQF4T7_znAEQ}4WVD2mUeHC z%d9Xhj{fiRr0MS#)-A68!P%%XwYWY#N+JHA-THV|yIlcgom9!*{}A%TAXfdG*SNV! z_;ULD4o!J6qWrgA$u~*fnCM9{{-1c$*pFQq6~HieAg+5zsTwCYy8TB2217RwXG0MY zXWI|A&+{G!+0E&@W94T96ZPp4cWpgq%#)9ci_1P<9<3c~K73t#8*9(sI@k4qkC&&n z)dpPr+WLg+B$yX(_YcQA%eNPcxXgF2&Q5M_UTt@$kNeIpF0C(5=Pw?5wpGmblg;Vt zi*8qoQwJK}QyVYOuQ%&s9sI;yn;o|Y<<}bCL)q0E2Kst>?W<4c4=>bR-mib>{jT(U zvNtJ*JRUA4ZkIQi?3p$VUgI6+Uf(_?aM3AAnA~;SCK-AD3ghEF@8_lfY;NaCe}QVbe|X&Axplv5 zHuYN(ZL_lkPvv_SEjiTnI5B_Q-1SiNa+Zwxx{C{kxzR(sVMMZN&S$A$KfS+3D%&Bhk7~>(9-oUh#bIV>|Mp<@YumNg>XJh` zuB}Or-9}9$a@da|v_h}}kABxAGZ1lPjazToOo{e*W@tws8stux`2 z_wDnz{X<$b}YrTTvmv)_qA7rc7}gY5@+ z-nX7pthcAvSth5;2ZBTIoTyrh>^s7La0atXHe7xR4!skjJg0bX39qwMI@zbZCu^scHs$hgxrnc}@@-ILsEKfw2%^qk_n z1#@iPIg9@XC+(fXdC@wUWwYTz;$7uA<$Kz?FL+mbkaoBBTNm8I{}~+0dTKuqx?MXE zWHy;1l0PiyM=5rlF%F66TW&-tb^|#$8W;1!6}#)*qR5{oU9lWHdNu#VW^e^^tJieH zZ?F+dA#!y744Hw9WOm+1h-5a|eJ@8c|GH=6>J;8}7GV5!-?MZN8A2=Q+K6H-6P1v@gC3!-3p$@~3Y3~>bW-+}$x+?Lpq+0ClvZP^RnA1L;YeiqHPa75 zcC^Y{hi&JW^@KUp?_c##q1w0em&N?cWmpvEO&~lg)`(nUWxN2p#GzyZWuMm4_<@Jf zl?oPw+r}ka9HviDGb{4+<6OK3`OwOE3HF{t$rcKj#?$mcSdL=VKZh#G&R-F8g3GX^ za5CV_9oY&j7ALD6)X%h%rVo;Gx~mWcRCRX3%9yKM!lhyM1T}O0&B%t&R(j3bS!EpR9fNu2l z9qkU++qYJJJ$d#tUhPHcAL?Hm6{ZLLtL;SnpZ`U@f_Kd6jqh{~G!LX4(1MsAO}%EEctJbvM#hAv@ZI+d%22@2o)l z3n1fnc}=i9*#cNTloQi3nA4zD(G<=?Yo0;B&*W zsu!AiwtS(a(ccGEFFf^Z#lj(@zn|2+KCAcR-+!%W2uB^Te!sSG9QJ6|TK>wfHJ%2y zugL*!ALreYIM~wvm!YJ0tCa6n!@yQ`-mU&uP$3S?Vv;u2I|+I*iOC1Lim}%6hm8zF z+SUq21XW8@e;)k*TBvpKUAh)5Emi@RMz;aC*8i`C7S$jZld3Af+oq=jud4$BVYD>4 z`cgXD32GU^gBCfHET^gU%)*j^_GwZYWY*;xVS*22}(_`el$ce49o)Aru1o^JZq3e&qC+(mGv5nxZN z1C8)iXYa=T1C8;WhSSn?lGgcN>)(nIHi+-FVBTv%zSsH=7H{eXi|hRVo2Dmbys^DBU+jQ-kbWTivPF7*NMg{60SDizw3V=LL#^ixJj4*>q2dy zZ(Y8v&2QNr{4NjMyD#A1_b1GLD`!vH+^c8%Lr>8{`WanqEv-+M8dpyf=1-SB*VW9= z#Sv!*Cl=}HV-X6g%w6@zzc>Ewn|r$eTi3naeLJ7%UR@ueBa*$_s$X~Q%l&NK)Afk- z4K`kgYXW$dUWDInw4TNmbk6j+(Q+1WC^m(P4{;&)pTe;XWGii6+uMW0xG zo_TasV!6tSX>{>zJ?n+VfDjE{>W~5+=ZkdV<6m!Ph|U|3qPhBUkqP-JQ|{Y_ph68cF&ocFTNV3DGnTCh4S+xvMV@cwoyJ#b-@m0E_y<~Z|j?89m6mX=c}?oZ@6%O^wnF?QvCo0LV_ov7kw}`t-`b){J`+#{#-Xowv+X z0S3=Q%#md>seW(ke&zr_gEtHJ>lcp^0DaQ~e=k=sWoMc){Hl6lDFNi}8Go;4gJ*s@ zVNR(Rl-~-1Uhl5-LYK7%8S%Q6of zWsfZbO<&GlRzg3LEa!qdBX<=fUFn5u65IN1FQe3SYEv=40gXebx!EugQ^zoh%pPT3 zTWB^euk>>3kk`WNCi{DMWhw^=fJjG6&a!f?bLCC98g8u>g?7hWc3V*F5kpa0;pUMI z#!7VIYHOGI@;Z%ZCR;LkP?rJZElr<4j?v3~ z0_^{2aDk%2+LHRN)`kpId^+Z8}%I$hvI$HIS};^f2y*V&cK6qCSE| zSUxrm;=!p>nX3ccKbjwbjoq%EMflFhf?kF~KmFs75Ma>F9g?3~Gk#Tu(8vY&e3DoH z&5uAu23aRzHUBD8B{?WC_q$O}FVS=8@^WejBYemDd3HwHg${7-6y(M#6KB2tCttgo1p#q3ke$dcl>o{4^Sx4C zGLo1@e9*6Kf)Dc{5FV*Eb+!C|ehVR{(CcixY4=&LxdgGv6lOg6X5c zPx#c)p6G=RQ!(|??kCobO;0PD=jW77naf@D(q#T-(T3kDR!xQXk7|2^ez=@?&xhN* zbl*dI&^U5xI;ey1aX607eXj;_S@zmI(3>T+@G3Fh4suM9cd&c{7HB=cEoLTBpc{o zB7*v(J&4i^nEF2nsyy?|v1&do|L7=&yN0m{8u96bd^HlFjMay;Kn=Y-7 z8N2F^Mk0batOTenni_9G0VG_W<=1*^(Uj3x00^i2(+gMz-djWJ!Q>8N$|iTXz~?<| z=`rH_t2h%GN1FA4AiRh(-Q`sqqvO(-Q@EWVBgIH-#y6i6IJX{b$%C;w$!0_;B^Sg&5wQf#8B7^3XGk`mb&@-K>UEJ7K{ z9BOGCQ(bE8XHZYsrN&?Ybc)t$qBh`?ZOB9}dn6C7RXl4>x1MGvu;OE>l?w81`jvjcoY+wk|0BkCjd^!%v&J@2{6+bCrn?nLXB&RKT zJre|5Z&mYXtkI%UJs7&3qjYGLYGfQ~F@;6(PkDag1122M1;dL@Uw-A<>pf(uvv!l{ z-IM%Q#lHTGr?}?2Xp@6BIU7dIMrvmbLv?PUy>A|rM=BS{eHom~^Z?J_zWZF1M2~?Z zI(^k)H6XQ$1^EiRq!tt1l?!0k!)N4H>!pY5s#y}iWcqEeV0$m+x;wsTp9&Fl3Oox*6MQ1 zI*%_DNFKQ+ijx=NnNamWvL~~5+9sV}&3U;bU(SPz$?{T$fEs60!ngy+4?i)6FEn+f zfNE-9nzGCHk$z)8qQLPsT4%ss%UDmHDXDdt%I|5n81Vc%ngn6yOP}IddW+Gz_Fwr7 zA<8;{wG-Z@(Qs9S{>+8H^K?F1EvW{%=LGLJ9{#r(gtChzo%*;f@M_>PA?9-pfOk1i#P)ec$&F#KJlQGgaLJPne~ zUa`&rXp+=*C(?aKiODSfgkVS_x0zJRIPI;<16p;GSSx*@Yzd>6Aee2& zE;08~11;ML@Y%*ChXH$ZxKH(g;p7~2dC{E7&Qf6V!t(a_l1TFmUv3MpOjf~RP#0$= zzC|FK5Au_=IC)+Tfa-h>Q7OdHP8&~VXIIjuh#j^-r>B~!l3zqX00RrK!Iqi_O>~oa zbgnv{KY(J7Hwp;Jqo^I2fNjbq{nTj?KTR;)s5$;!che#JHT(+wPV6~p0l!f#ChgfH zptuD#i!1d0C0l)GXW7f3}bE%I7sovaq& zi)B4<6Ngw;zXKzYWP<-pIT)|#%TeP4LH04W*d-Q*b*Qs3D{%80Yd*qvV{j_wmx!a| zi=>~lkFJ7qWpBQyjn)_%`4+WG2irpUefcUA7Q3b^$Nm`fkmMMW)^uvk$5KUzCCztw z8M5vWboVg`pt>sola#mnRcQCmtrO5MfGz1@C^Q$MF&^e(CaieMiz}kpNhKX8ioA_0 zc<)pLGgk=9F+j%7&p!$YJ`l_dQ)>SvI@^H=*m zKS1s#=4RYbJQzXa>Etet3iMR;xkg;AeoeTbf!N3NeEyR~ht-z8{J_iktDZsBsP?1E z_r$@Q9=UbOPi;OXYL?}v`eGXvrjH*|*=j5{u8_n_Hyt@I$<3VT%u+|^M;mLba4DBp ze+TEPyUjIiXoR&)e(K_&dU*(W$X-(ePiljLx}AvHrK9p1!BFO>m*KStiL0pHJYal- z?tFTW-b`DrWI$))`zUxylJW=-OY=-sY05l-T>0N!Fiizw%1B#+uH7+QLwF-z-(56>iKW6j_Wa7{*} znxoT^`D1HVlHe;}G)}2(=TA9Mr4?+w^i;pB<)=4Yqp;_pB)cy57qzW5jlwb2+jtEdkj4fvpR;4yHMg4~fL)K4%J zvY@1SnSj*3E|-$&lT-dn5TMfbd^T(Fc14o?dROfC{C6t*^|cs0nV>=34U@Ml35mn+ zKk^%;Pqw)@5g|`)B=vBdQ|Cz@VW5uI){%Y3hu5q9-HCODJ8qI$EKcKdVw|zn-yv=) zdtEu>##KP|!uyNO;j1kfDtWj@QJ!XlE#U7V4}|pkxXh;P>sLew_mEL4J<<~4Y0#GG z*hHR;&{5)*uiX8?njVA%e8lrMu4x<~nyL3qsWBQ47f48@$;ToQa?*Q%L-|Eo%FKxL z+v$10B`*eh0NH~Dg*|ZP8I|k!xn7|O!%rg#JWZu|*bhFRu9wmoTth<(J=fTtRGp=B zy$-eX?zCYKCQglRAZ+%~dL*;@4o zL@Zn2NpKFD6GE4ttwD1`TqHaKI{e1ryg+kRu@gLXNf9Q}&lf9DI8ZQ&1*NAj_ad(_8Skq_> zdQ8O%FLWZo@VpSu#tPr3sfS5qQ%^B{48Q%Y3U`zl|3s%w(qtCl>N@plRNmWbK?cLs ztXwqD2XgRE2uGCY$3{_fHKK1nUIIn2z@vOy6-hAt7<0T_UgH3D^)Y(S1Vw(qWml6%Na(ZJ`Jgjwuld4`*4CE3Xkps~VkP?eGlek&1GKtIQU9q1H(F6?Y%qOM2y-v3W9}hS_ zE_fLg!lFe}d|H#0W;5{wat<8Hpp{89B*w#j5EbmR|A_a6e-0UbMkV+AafPZu4QB)y zjMYJfX{o}`-r9Y`5Vb6$U+Oal5cvaEZEkm<;?i-r3&ZaQ6;)^hmWoP<{?r;mii|%skj(jlloQnToyE8azCL? zPc?;Wb>{dmsZ=8atI+WvaojbEY+B3$gq!X}S~PyS6g&o!J6rP9R&KP_DEe2$XwqOg zXEL7lq(JlZO9#NObcjLz7VDn$Dl6A^_|>uOsc`svBHEvb!T|?VZXx4h#h9`6q%@zE zJ`sGEW|sXzH#^sW9?+v??#(y#s(GAgO4O|niVz!)j(7XWYOpNdJIEBkd)sbI(_|(bbQ0a%G^@>+A^9Dg)+5!=N{r{gic!|81? z^G9N%4|WEw?6U35^g3hOW+|kiy}OfERE;hHNmntPZ1HwQ>92bUP9kwG!F=n~>b@aJ z=CiQ$WBfllV0K)x%$J0bzs0&*DILoc2Ap9h!;dJ9csp=xZFCXhP*?Bn(XFFpE2^Oy0k+)S~xOyTX8@GW(uf%ZFw&kobMnx+m5yz|cSX}W9#BS_2-F_Ios3( z&Td!A{0_0k8JR~<{dT_mXJ>%C1PUhgtp{7jN>GRIF^={JoT?z_AN_iAqNJ#;bebbk zlBKpLOuWRXDOe{52Az>L;mO;^ecK! zJES_R(ObYx^$syHd@-WY1eP6SbtRaBB=`-a@Fqo)K`NVB4~ybfBI_yq+AJSaW=5cq z8ix!lMp_;VMoT{vGbA2K$e^GD21o2e@6k2fMf;H79 zf!#KwCs!>v1FV?GFrUXRieg#?{=rN&!^4H9CqoPn7TK4CMYZ>1I2PXaxGTAM-L8tc zyhm?^`X-ODEn*i@PTL1)z8hC(8YpQV!8#k?`5}G=V~YmR1nR}RIdj~jS1Ng`IVLVz z2lcVhnS@&Ba9Ggr187NxRyfmJkjk|=c}%DpP}XFhfjj#l57pb-KEZYz5)MOnVNV~k z6uxc5=J!Sy@nZLB7c1b%U*U}XeT4fSb;kTOIh_~|yK83lbLu21clae&?fdL%is?Mr zR#XHmchIgCg*0%^)=`G4qsVEhm7I2vQMB^0YC2M-RQ>PkwNsiFhjg&mu}&%R1{+p} zUsI}|Hz(x-du$P!svdnR_euXq$*NF2x|Jx22ho$LT?YC$Z%*-trR#Yp_jdFq1&6b^ zoO{+hlY$#1BM6Zu0jLeyN1;KnhFa z>hs1~B4L&8Dk>Hdw?{Z<%#XewBv84&e`dWh;RqRmR%}#Nt63#9vZnxd>g+G~ERm8e zdPnuxek$lT&nMt1sfePnS3jX_jbv3V11wh1B?+^r<^y6akW^7mT}}lsSE6{?8=z!& z_9PQTt{Wf*$2bS42mtsTx4DGJCjI2QLqRAB(1Vv>1)lGxS~qH@XZxeaPvzokmf}%7 zbzQ%1C*?Xn|FZR(A_`($amJ#subEAg*>Ja51wtNbwx#q>MgJ8@#=7Z*y0_cSAaaPE zK&j%1y%jq0#PB)c7oR1}&ZT)-8jBVu(&4?w?KhVv+mZCqH+eHI!S}PxE0R@9u6edo zX^tYCs2EGs1ew{aikE)H8Iu;wLJ+Im^1HeoiAL+dVFLyps@0hnFKgjaajoggxn{|5 z{bi(&e6%rD*{s7TJ;;>v9a9{8b$tt4s*KGIehKr5)u*rdLFq4&%bpF>uog+xHk&L; z$2a*o7WlaSaTFmp_)lQbUT+L%l5$3HD1HnNnY&W|b zrCF>fKy-GK^2!4aQ0I}tz*X9LM!1rvDP7A|19DQEwMikldrFe(Zm!rnGT<(~PD=dx zQp&hK0C7e$pJ&jr%X6o{i-N%m5RxP^uW{cl&)D$(slCW3O8c}pe9>-3qx2ST)!K}d zxC@^pScc%Nza=D7#+vwD#|765Cb2L)ehp++$mRE?&hys=%Dq#$vH{(<9!Q(K>qorN zX^Yfa`BBkUr1Y1AX?yJ8-Ww&%G;D)-XQ-R6aUUP1^R8CX1->-FNyu8y;j(z4V7!@M zYA>Q8{?_GahY<>H`U9!nq+FQdlRl>C9&%AcMnqe2bHG1~rvxqjI>l&C%UwszCXj&F zwJR*)@Mi}(ESu!_v52S9>WZKJfHE+vunr5<{3M3Wu?o^7x`ou_RJPp`oy-gFb38gP zr82#Xhw6)om7Dp)u?Ao6X7aRK*@o7E$d*u6tl}s7L%*%Ys#5U7p|Z4#-r*o$YC5J& zsfN1Xt4IIFlau%ZGi68|DZEd$=t#692ETImnw<#v__vMYOG8Zku`UU@D~YE7rQ)V| z8iV*vUIbjq$4I@K@tXc{h9T|>lRfUpVT{87V0sANdO+{zhMtNhlE*Y?qp;jw`&0&z zzlmM+$ci_arBzvTGWb#OY{_T|(Z67DX}3Fbpi{gi-N_c?e8!A*50;{~$Mh41U|-e; zEvu_H-vGK07nd&^sC~g79C-7eL$N0_?Zs@`)0?f#G} zJSqM>0cm3$4Moqd;zxT~({5sVf5iv zX4cm=nmzkh_J$(7beT?y8Fwz&f&Kffn&)`O5!wB0v!6P653PPsI-*l z_yrz9KwtHFWj(QKcHQU8-(SnXPEMb0TG#eUcunXp@bYq46P|>SkzIxqADv<1rRr&e z%QoX_q8`Z*T{Tx#6YCbJj?_=k&xC6gFRv3?hQ-=UXb?9Pn2O*mQu-CRRy*6$bnm3O zYm8b9F1(;9{0Iv^0$r4$bzTbM75rXFt~3frYiKM=OX)Fwc^i_aCY8@DNfh5eU*&(Q zK0awNDf#7VICMX1xkMPyNdqzx6}S9|5l{0l9hc0z4UW&P3kw}U_eVqw$qZEbt9-of z)lf*Wxf|Ea)aw_KXyo}zWZ^0gK`XvAow;vX3|^Of?{CSk`l>#>N;ns~HR_caokmD6 z<}||{fH$a$Edg+c?gqRFH<`rjMO3cPU9<2=G)%`2bLg-%X3mvSwxgf)q%zqiIy2sE z;0ve(hZkYu#J3?uy(hD8_ewdq+eRfmFR)LrqR1y#4Dt=BUbIx;K1864wUu$r7oFM? z@GFQip&R`;q&6XDmu!`OH(}*Z#pQP=&$X0h&Sm9Dw!~+bKdx|NkQqq0;OrprwB-rf zBh430RqirMm)e|o72ha7*4Uzdi-ALLimTx^s~k(}#?`fxgci4;`TBB7+~)yi8$bk; z)Ovov16J%m7;0LHdQj=r`Dgm-eXY3_=p<{b0ce(|#dyw`SV4% z=dmS31A7Gi?6Md4xQ+%PrXt+$i0GW=9}qaUXzVD9SF{j52zI);0F3QAI}@(ffE8|?aOyenxPWz@%Cr;f}8U@b&# zu>XM)id%!j4H)-BMm=D^$&cEIs$)4PZ%J`lj?eE+BXX0orbZ^tzq1Uko7k-K^wu#; zY2o$SZE)N2*t5La)yR;HAo+em#;6l^HhKJVuseEw$RA2#7J)$jh{2j18~4-jDM{>d z_@bEU?;*2N;U@Ttl3rXKQXPW$)~~<$RDs*v1r{ zJDJA&PAtc3RaO-KNWYGR6Jg-}ZC9!KT%s-|Lso(F; zQsnJTVUxV0bR-0QaR749mSdj2+m*V#@-~JS<4CrVv(GHakURwncX^a}W{uAI{gVxx zm+OU*bi>{rJ7WiMLuE6#WIK*G1}Fily`O2>u+wujuj5z3ki$2q=+%0q@Yk;&!3X`d z6-%DhVv&`zcExT~F5fk2Rm94V4b}uBAT333+8A?ifAmN@9tHs6+W0GY-;owD-IeV^8eE%G%(vw!+42^rxtG6ga4l(fjsXDYtehC&wjlT1ZsJfpm$ z3yw%8vspH9%cnXAx+wDcL}H3glyZ;UQO{~>4|LIPv%N_O6L^ITKJ7E?-H#{9V?2CL zOz$5Gi^D4W+HO;)IWKiMHBIZ+s7~qM#s;#L=-~hA|NK$f@4$0YUqobUNJ5`c@<(F# z)il%;Cs#Gae%wV~h5!;w=u`U$rG%fZl!<*jR(BdCSKL~G0^&90%FvLa$GvI$iA%ZO zH?9GglYM8YGMEikRf2N}Cg=K(QvCU_623d8+3Xi@S^VTUGsmi@zJY|0z=YtB(Q?H#Zf7*bk6oSfZ5{#3~ zlG=7savVj#_vXM`N8{e+QP)|~Kb|=EqUI_0kyfFQOIZXk)qAUE8D){g$*>!`$!d;*|CU_kpHn!9=-> zct^ z+>+u{Yh!vDvaPDOqlUa&FOhJ;HYR3ywmUy2K<5`{1cs1Nve;-AKC$Z$C zHJJ!9i`}Lam-xbk8zXB=x@5LZO6-X|SsWVN&Jh!txARW)F{x=ir<88J!dolV8^;sq zq16L*Rdg2`Ql zYLgnRw)ZHJuVeHO>^yjr9WHVSD1RszkmfoW%ePA%0}(r8k$8AVGw_Hml!Qpp32=>C zEGWe%y>kLcdYj>}O;oAjk};!y3$`q!Vn+s+>G=;VI($+>S@aIpK6`2?XC6b*U>0!0 zL#WFhH#}^Jtc>5P-a_53=KXjXd}7SOFBbNRJFF5SvD z31vZi5hfgZC`L@7=b_a_#ycZprUcR=oeL8zHxB zg|htG!?(C#dk%d5UfaUTHEH_=Ji)wLC*z9Z$sA5w4g*mxy$Z%5#bQBg&qouScxX9m zXL@D5N;SEu-M0hV+6+0|9m$&>Rv`QW1o}-I#KBmHE%cco46Z2s5S&N@KH)NO% z&D;?aXVSERRi{`hgP>mGFKpp+xZ{a8qh7W9g(6+4AN-PA)Xj>&;YRolmdH zY(?$Fbdq>-EtfU^LH)dYgDil!g5$Akf@w^;_018*n^$p*57V<*(oa#5)l*1@gwmao4LvT`q9 z&}I9I*jgyF*UWKAnp1aLvZt2SDF)B^m+fCCI7C4m6KPa9$-rE-WTt5uO!gQL~x;w^WCjc3$^ zIFkvEB;KDGGPEHic6KI!k5BF@W&3eId4uuqOmssEg2t8?6^S*+>~T7AZBvXKSd%>tZht<6wR2<}G2Mx96eL*=&E9EQkUmvd0 z$&EwfWpndRq9k2YDu$*ShG}iFZD8Lc1MNPWV#~;CFJhBD5V$l z>VJbgp98^+mFGA)odTv#BH@IL^4Kbr6s?p1wbpV1hRMglmW zo8NyTh#{7kzXB32wm@3282YH&ID4CwmL=N=9q-!ajxfQO2E1@FA9 z@N7q)8`LI|m0N`9{r+nC{B6d`QdEOc?^vP@DU~v3U?LTAM6u|NXZQ$RYR%F`;7u{q~@hTdfSz9saaV5M;d0V`( zEW0vCs~yl+7&mlt!4;B*H2ZHjF2gY!?H{axJ_j|~bGbpmatCJ67G{NqsGG`T1yjt2 z^c#o~jSi(3D_bKrCRtcSU$;v}x)!aZ8TPHRb$5N!Gi`lowyD238w&vu?vC@GOIHkq zF%zq87#vhNi5o`S9G>Q$k?d8PfdO#I{gYv6a>)*C*45|iZIal=T*;PNplnR1WPQ1W z&B|rLlL>kFJo zB(^vGOy;A$?(GdhNTG60ybjTI2xX-!d*3$7xJq) zrmX||1SL=9REiowUAY9Ic(s=gANe1kcv&;2G0IqiLoE2<{W0}ELEP^^*&=X_XyV@6 z)NxV2D5E0H@1VNGMC*cnJ-l=)(hErlA{A*aKhxLPrfguJFH_dZXWNCQLw5=r9~|_4 zF_f3r?7r0thXnG5{lHwsQ>-ZC5>st+R>b&7jlh}~C9$xiJ*Ao#XrTWoUIq3PO7zR^ zHWfVb97t%S$)O~;a`)*vF>pAB3;GY{@kE|^c>cztiy`<4P01*F3>W}g?PmWs;rR}c zA3H-7ldJ_C4wmivH8G%!K=y&S?vhQBJGi1FyYlK(&hq3jcyj}0Bc2skEq zom)^~VJ#v`dF~VQl<{R7p-gil0g|D5MQ}y!_e${B%C~b-dwUyI;r&!}$N zJaF(V&6e zmpqfAq97n-WWYnNAf{G|P;d0ETl&vp-?EK-;udi{`N8)Ap0elY#sf{-Hx$hMmPwKQ zLyRi#L;wboLilbI&QC5w5JlSBh8?lrIvb40__V+~Xi-?$-nSG)d9`cW$OglfL*Zhsv6~Gl} zg*xAe$P5$dj%Lab^s8X6F99Qda#pKD;4Li=wH+FSw{5pkb@pi8{r}P7Ls) z^USe|-<)A>B?8<5AlDx;3@g2fC1$O8v+O+9`;cW(<**Le@B#S@_Dkp9;#rETA|l%( zWLYpl)REtEuez1SZm|`w@{yii6D{a`1Rdvc&jgGh4iHDkcn~Iy2lG9+aYw6ybW@T{ zp$K8jseg2Xpz%BHPicJ1+b9r%yfTHORpq=FcOs>@bxblf{ia>l;=J@+PUw|P^%ChRwmV;rq^vG>c>7@~BM-6Ay zT1|#;F)M%YM61U?Xw*7h$nDLYXkHBmUvozxcaao;upPOcCyc3{OmHoxK%`K&weWco z0q5+i-qa(a7UPi^Qt)GCs5LDhzAJ;&qFWq$hK5f;dTrZ#WAaxuc1}h5v~!$LI}>O`?iqa30!KcIUO83XZx=&LEdu$UrFt33Bacl%azG->A&V0D;X4SVr#bhPE%yaG z#BI(S=fN{Hq~BlWVb!kH8z*~3-!P4lyw&+~LV_|7Rk(Xe%viSx)km{tq0#)<%;;Rc zG>`u!Exx+k!8p7lEq&uSxLnzABO_{4)sKxBb z`jF3zhpF=cxv2P5M{c*XVKQNZ0qJSJF)vk-qQ?cf==UiXc4F(*JLvL0q2QP23=CmA zXS0s*MsK5g31^;r^qgr&*Pia}xWmK)DbwecUmuqXzOkqHQjh`LEdwn%BtaN5nyF<) zC*35~MXwK|zVWa3B(c8n#Gk?giL(cp)~18j%;9`tMfLs`z8rzkP*r!D1;oOam6vQR>osieoYGk*!9~zU zQ;-{6I_-J`{PW1I0ReuQd?*MAI7A2ty#FwA>mOsb*xtu%MXFCbuX3S1VrR;?ajdQzYVKtTB?%~xN1NU)Sc{0b!ffY#Qc!-SGzmjGnr%rj$- zjG>aTwpm5Bvi^flz+zD*E@dEH2!21qyqdLkq~bS4@|i134mpA?w$!QTCGH7lwJi-x z78&BT;S{0LNd%@?p|mP1VTWXzIVzdS_?K?MYU>lYnTLuX1d?AuP0%^^Ad{>qgpC{y zU8$nl@wkD9khW6E`%ivOYbgO-E=QG#Ue1{c;z>Vs6KGhPqaY9e{#>LH`)`e0XHZky z77h{6P(v?^V`^q+wi6zhxtW z8n>M=)^e+jIJrLq7=FuwRNC)!z`(;O z_Le|5HD^JrWi%y95aOW{_JD;baeY>7i?8iT)w)I12 zzeYdXP{{Nb)Jo%frYOqm2F)%<#}KM6bt6%|gyT*u11BHtU*fkOF%FRH?|)t#!NeLbSAWaRJ2C zQ7${e{9$%s*f=eWo@U_|hoep)o|@wxy_DdJwDrnUMyXefA?TORMK2jpV7N0CyjNE{ zk|IM?$S(}Z3whvR{^5*IJoi1seIZoQCQl3$p#nv4g-MU!hQ;ZZwANXFTuQTC8Eb$O zETfcj{F@ifI>Kk-(pcSZybC}$QS%rYKqnJfftt01H-V-)$j6JmaHE)cbt)izLP`z= zPerdQ^Z6hsZ6YCzb@rWB6YaPAl?6#X4#xBk{S;UdpSAGuC=ET+@PEi~v2<*dfVsI8 zSCOwZVD@Bd*Lq-1FmYa?m^tj2ch#+C7rx^KU-t-8oH7+qm2F81(!y;YAeYvsbnV)3MMt(nb({z?NEqXxPm z?^NO93D>cz20eQJ(d~xc4cm!>9zRA207#wz0O)@jwhuDU-O1;>H80uPJep7jABdZb z_#-r!O8_n>K}*oOoVZ%6fj)IQ>jlW;6uXqG4QiSUPc@Y_<#Q-}S?Vrt21_L~zI%wM z%K7FSE!$JY6un+n|EI+MXPGquw~ofa8C~xV;dUW3umw$g*V;pO+(9Z)(6v8rj@v~2 zTCiM{(npDFFRP$uWlt{T6>}wgltbaf+zN2qBgzj-w|KkC)aXT1oiA202x|I2AHgW1 z!%wHSDD!k|I$0bTDwalNkJ-vYaDQ{# zwL;#n(h3q6sM#z9I6i{(PKWz~QupL@S-z0*h6MF>8rps}Zx9m-V3x_2#v zn?HOnOiAW-Qd2@5!6d0?B+T)jFb*B*t7^RGTP0XS2<@Nh++6+ao8!`k>TQ08XOcW(&4l-1PQd zI1s6rgn#ilsIc>ko2rGMYpoJoaa(`8Fg8{h4~N9~`g?gQ^aRO9?&l~@HysO|XK9{h zXSOUJQUbGwWHmu0<4Qs=R_?nro+L+xoBzg&=QdyGetw}yoy zrQ6D3b=hf7H*#=TO3|170P-%BRX;W0OYi+%w5?N~C}%0gH_4K|z1WRSJTRkn9{QTm zPhZ3!#Yk_2WvhI=9__R}YWQZQk50PH5>ws2{)(qRC^ipCIw_1(ezP`s(I4L?+P~nk zAarU}Ij!I4B4B>tj}M$S59A)PUD=hU?N)l_gnd!fo=fd2f<(0E`RvpK%>hB^2Xh{PPv z7esgAk5|Ek%A`?AxRH?mg$s5~b1Nsd>CzcGGddgRR!VoQjgBD^IXr4T+VGhNA&6I< zZw3+I#oDV$pl5O%!t!R(iMBR4)a}T!gG)ouo`Gb{b_7g&VqUx>t7W;4)j1J=_$ky) z??4wTo$g(^);qXt+{QNCCOTxPqF|gnB_=%(A6D4?(rJF+;tBeo_O-~E$x}VmX{fe+ ze$+cx@M9M})JT$Mse`TxdtVl0sucHWW0mUd+!v&XWAqmiySt-9A3Qb)Y3QgsxNJ5{DGlxTdgQ z`cSPsBw=Sd3CsQZ0l-v%4G)E$(2$6wF2HW67xI-|RU48PrsUemzob?;)oiP`oO?rT zl%M@6p$|rhZ)Xbp(C? z6b4LHH#89_01OgEf`LE)o>_J5X(*F06ksj*2_X5FX_8KkGCvS~LI5Uom-T^N-+jnb zl#-0ym=FRI4u}H-6(Gl1QJ_IVpvwutr>!OpAQ^@&dB=uMuFs4@B8SI*cZJnD3sH?^ z7sw6-0LW<$;AcJhk1F(xczq9`ES-7@v(r_BXLz7&VSlOC1KJwYOin63&Jn+{72V&+ ze}hT?Ff&uKgi+zCAH-)6>)s-Rzf81LECQ6fow3jK&bAg))K{0xQi$!^><3FsuM4+I zHhc6|8~E($ZqURn)cRC7`O~m&QhY0JPCKQiWlQu9mDfLfKh#O{DJ`RnTj!FO#711M0opIIL@jf;K6f4Kc&#E}boOw)tAO?Vc0+~?7S-K%33S@Cbern; zg(7A#uK5%IfEYQUWBlp!zn9@(^YnE4k;9n|dJM|Y?Xwx5=*s_$@&_^FsUz6ov~+cq zP+nSM_9?+yPUb85`#ZXR87iEx4c&9O0RaKIhR(xT6b!#h&DU&?uz!-hXdHS)?MKT+tk1pNJl zOoUSCZQZbm9yvQ9y93np)S_0nqN?%!Q@hh8C-?+9ATa$caWSC(dr-Z~;Mp5nuhYh~ zRm*Zn$a5?`gZ{!T>0n$P!U}iOBD2F8EaY zm|*=Em0RN>%3?Xvd`1ha@w@8z?m>~>b}Q=HVEgQ~iHVAjggRm}5pjO^JlvxjP#T@mg3G+9MaYV%WONYY;Eu zO32_TSc0HF&W4#1Ilgkov>`c`vzQY_l*l}UT#lh%A>{k13OEiB}oCE*-KbdxyqDD4C+0U7cFgrw*5$0@A&o+hTcWP6dFbzu+?j1b=C;rI zy-{q-iyZ-P*VZ<{6fZv5Ji345!NfgN>$77D@4!tyScW#2iO~uRljNe2yS5!Oq~~;* zjb=vYBdsO-U<(=8#b=W@6`D8%!!E_0k7=~SfmOBL^b9Xs-M$)Z)^>qS$e)4J-2l&Z z>|)*rJvuBOTTHa{ZD^Z$>`i30^AcyCDlV3R9cDMJJSq37@=O-Z)CX@gK1JQC9}xQj zA(U|??liC5!_m4nYU(s}6y0zxIL=Jpt8PRVQ~$>!14>j!l2)cr>g_d9mhr2*^VJjQ z#!0aQ0xagua={%}ebiP*U9Yb`(H_yfak%q_ghLK|OQ29ZCxK&x=~Dn%kNs-Q@#Zce zJAu5DZR7zakH4-^@-71a*F7C!2v08`X$LQ_@0)uRy@xKRqWS(NS@)R!f|8%16ixp` zJ9;9V{taGsiGDGanv53sDbBwbLMe90q~snU$Qw>Koqo(0)Ow3V{C%Z%2Vg1H>=jS2FOwU0ePN7e~QIJ<%`lo992k|HCgG j~qgP z`{3TlN`Qc(e){wY^3ycolxnwcUv@0;uOZ-r2z(4}3}gW|w)XUTwzhOGR+dr`BhX(M zVTHZ(M%Rr!HU*A<7D`OTzf{F?2Gmnp`9D86f#SEMy0eSTlFIe=qSsKY2eev=>^FWM zbQ9VzQL`)TmA(GHz_{iUR)vj_i;oA=lWn!|Gk_76eRSJdZ>C5qZ2UNbHsIXQFQ| zC#3&vfPoFb=#K>f(K-@645)n_;z#Z&xo5@x5s8*X!Q|kxZYhq|TME z$X+rYq`kC|ud1t(h52Ea&@@i^$=sVyW}i1kB0p zZY$aY!kWSIE=j>J*|-W$^(y_o;gv|@6Z3aiMUnf|cV7MA9|4C_qT(VF%8D4hD8Gw# z_Q1~txnP`wPA*>S$O9b{m(1opRGGn z(}+Z2L-ned{m>nAPjaXG^)p7S+X@4*MfU12ogE8hg1tIji^yNGOF@T9DO*X0>aGky zNhy~I?JkcO9BOtNf9hN83cH=I515=I3gx%@4*S=qw4I&UWP6PBJXl<0LduDh1o!?b z#3B9lf~88cwdD(?WAqqk6VFi>k(BwkA1B>U6TDnO6UF|ypgtaC6WjUm6f8UzD@=jb zG!vJML%Noo!XaqPeUs-f9-wXt#_kacbqbQ-V2s$o>J}hCuu*n7$|I?4uefV7OB%-M z$&Q&GhvG)L^vUkG_3y2w12nyN_c1u)kx&j1Yx2Qv9-gLnnhI!oD-{_gYtyz3mJTMC zBnb2C2NQPP`b_B9Fb*SI1*BmS5`6g)!RO}XJJ@DAf=}j~=d2xzDn4zp2P(CIr?b#Q z?=K>oI$2Dv6*+pS^d#QC;5;fPd9$>3bVJ}gYSXJPRf49h1>!tbu9-SJylp}2taUD= zDU%nPJ${K}NC{`1lvcgV=`&A^`fQRIb}52+Yrg)qU0^BiN9vHtF}q#jc8liiCrx&2 z>J&m2+}O_%{AAr>c#t7ZhYUUhUw6VJ4xP9Q4jwO4z5TY!FX?zBY{lH>(MH0{({N&{ zejCiymj6^P0d>7PUAhU9$>e=~d&&`=z<=k=bXPb>9uG8XQsMQynLyCV?(lxOn%l7% zb5ZN>c-<>W^nQKfyc5s4TZ>JU$!vXmKk4xDvi#Wq%0tofU?xt|ED|v(mC^kL4kZfY z$_e=eDnA8O`jgowC#CGq6;h1fww8t1wyZv@^?X>N``+ zoi>` zsL!P-vwRE`8?R{dlo?4|B+sbt=gcvcT=&uOUQyQO4!FI3`yF;xL`lq5P2o$j>*IyM z87h*c`?PD8)_LY(4#$St*eL2-LSHC;kIWrNxuzeOl~#f$&b*I2Okq)So(-Ft+tSK= z;<(n=BaPT;K8Ikmn2jI8%5qXRuPk$ya2z@>n*ik>FufB?A(bC{2}ff7e)XeqT&&6z zQ+0N2p{i0s+s6-j>-EVMa}<;Rkl*FOo_A~)WBt3GjLoQ5KIwKdHrv}W&>?eTa*0Y3qHVU@)4ztxj zhc}hWIcs~1w|@A@W-GHP+>FiEr{j{VBF5#HSXZSs%%xtqVwZ}RX%#bu&iALUTrd$PEu1@PnF-N^%A-LNu=b=*|2#nqINlx}`o?3}5go=M| zC{f-<(cI^t&R4x;9Znr#-wA@6rW{5AT_~{y(7Z#dW@XGWd-63G;t4nX?VR z!rs)#$ibfepSOR~S!^Gbcn`-_qbr^Q6>325-6q!Vu$vzXQyGa6b$dh(6V0oV_L z2z9kvGSY_g0^Y{YF~~-mUj#Kw#!9UR5p(;^&?KW&*=xEK@Xi_S@tQohV z$y?qxG_-m>Dq9wBe7wiMC_RMAoTN^0-GwfEJg(q&AT8)W+@#YGd^|OmJ>h#(FICl-wxrTVUzrGo32RLzepySA$3Kgwi zOcXb_(LIXPvnAuc-H1L<;=DHs}-Uypbi~A8j-{ zUa17lD-7*qwupEY;FZ0maoF^(nBQ!i03OuZk5r^7l|4F^aJ>@mJ6;su-rG#^Rd1;j zZ4?w!Mcx*kv^rMf9Z_G5Ro3eFj`S|@4(;7^I2umMp2uiEa@>zajlN&RC;D4sx)PT5 zT2Wsui?@o#=gwDqY0UG|rh->=yX?1^tarR1@@t6Nst4h>0{oVmA}5uQ>XrNplm-j9 zszVCPh};x~uc@3&ittxXeywnB&v0%Js+k$5T&J@N)|owO^~ zhr5t{Qy=rZM|g=DG*=Y89CER4N6vT-v_g5SReX$ycx7kyTC5orSzqFATzS8im3ujx zQ_)fv;FlNTsj)_NsJ`uBv@eD3e>~5>tenj8zB^TvnCd*WdF8#TidMY7@5Wacy}hLl z2FiUL4HYc#Hnc08VPE#oz(s9*dOEpF0IxdHqTQ>rd^*S9xH5iF7z^F_$|1yQ^S-*! z?fRmI+F><6c5YMQeEt0>!1G(j+}#w0!hFMAWVC<750?e#uA<9!v~GnhE)vZ;e6p|H zQX99--)ClSC%C0Ly!G3?Vny+HHAq^8ySeZ^9e`_;g#BbNlX$Xhp8dO$WiSsfLUHgt zb#6Dy+RqDg2#UX-;)~n9TikBgwA+W+>)>d;PaSx|czwXXzJGswbGCZH`##Zm%Plx_ z11mW(b36RB!wQ>W|1sGPHwW`3ijV#Jp8oE6dno9)p>wq1?nma0lgy)O`fQu8GLGM1 zb-9)O-Xpx(g7fcN=lO(p0){OG;EmbdzpDntU*zWdtw3l}34dgvz&2pjE+_@aAB6MP$ z+)ic%%%lZMB7LLGwSB!*LOZ27nBFp~sHIZzs?F^Mmwx`^3155j!|^1p`zlTSedOW8 ztw9Z=)$ZJ7EZzGepax|Hr`_>h<2>$UzkIoTrGG>ohg?c0e_ZFbgsocDk$jg~<(@b@ zOWo|iK*wGok=bTA#RGh1rD-IsHYZ|j>TtV zT%SQz@(1H70Y+}?@pj39Q^k^MX(ZF3Vu;nuGAgA>PhB+OZA^A1WPeuuP$eJ~?4Blo z)f9WNcG8$G$yiIQ7oWhnkw`TJhG{iA>zRlnF?v7h9|wwDPEcqD>L)tL*Lpf#YA4zj$Jw&cazA% z6)DN>3eZois^|h<5#Dx0;4M9FrYX${(=^)GZs2Gk0%i)8Zkx@&R>j*d4>!fv-*$Jf zS`kh;22M;r#jPnv)V^ye%`6V>nUU?|RUGhy&u^3YeqH z3(<$K>I5r7KALIG;AFz_6lKbeaBPW-Q`Ol*OHI|^+wpmR^H=D)I@nS;MLVCZeK8+x zRU&hOp*uy_T%>J0XbH$p>wA|Rk1{EVAMxdmP#ZR)-?DQ?OEjWron`rFT~zf?aq##& zF)SyT^+M~e7NG{+qSE+RC{O>^Z1z!l|?rt49{g^WyWq%Y=@!`wh=revqZc=J2+4yo)VVtq&)j z8NzuQ1ts4viH9pc{GOwY1kqSawRD_K0=lWT8KUf*zr_8Z>>R@kl_YqekwTsW1oBHl zdA3lB_Bc#0)x-!lllq#Uvgq&^DlEkWG9yz*@3^@)3Dq_EqP}CDMUtF3TF2MYATLkF zXN9p~NdV6^Z3j{vtDc;aW7E1g25bCR-#yS4=JSjW{Pwv{-2@R`zbq8amM&R?{W7L0 zT^{Bn1i1Z7HdSQkXz|1a?RV~yaf}cJi6@A?`mdB zK|in@Sai*9-2`!3@Rx2fEI8w$o!BT46~b9BdAYSAGe@zRgH+G5gn9%(`|>G!lgzkJ zBv}K5N=E&5{7ubQ1|v!i$YZ!NfM<>-jTc&jbE;SWDtyOg`kj9VYRR3GXY03mtlDiK zZIS`KrpNW8rd#DgGuAn(ft5OQ3Kk1bdeKd9EqX8Jd$`Z1I5ZOoZ(-3+O>hAUnqSXebJLe?Xe?&7e^*B9Fv$RHz4ONK`5-7f=0NN;7ya&F>g~BQyCx zEkX8T3rH&-OQ-Q|>xTAt9n%1pj0;o|MH3#b`uN$vR|=E9mSM#%E)B5E-Z2pyjX7WL zCM;`l=Nn6tOA&Zt*v2PdnH7HeslLK`0ieIGSh7}<-RwDbl=s|ms*K@6n<64Tzu+;` znxF(wR!l{YFuL<1R&|v5W^~muRZLh*C10-IXcmGcmwuz1Y$_tLb?#F<;B?J*VZMZK zZKFLBp~gcBXVk%pE9`8=_Q=V7VUZE&ihLDAD#j2i*k0>!+}EC_KyH_0&!*q*xL&QikDFSYaBZy5DbYb_02=VNTF?pkPREzE*7Zl+t)arqO8_J+gBT2SXWY~q9I!Z)L^_$`DF z%Fz6eM(=W>;=PDe5g)1hZ-`8ckV&;shccT?YL!9D0^oXx*3ip=&vx(kc?#uwoy+IQV>O8p zi)axF?sw*RYcNj zwVO3civA*hR{c=pBlR1e&V_|zhW-I4`!tz|Wh&&@$;XN~z{;w&;kr^Pk%f`e^cC>+ z>Y_~(<>0Q_yuo2FCDO*)>~O2W;;E!K{r5S`s%MX&ZFXjc6sHkLKS8R|34$Y5rCN0rx6pLPvLyRUQ$!;rw zCL){Ses7rpQa*>2Fdp=;6366Bk}QOL@k}NaRfM21qcqb2rm?d&zPD%SJ%R>IXb zil}oWwyV9H4HjDL*02#%cIz_$mnb8}8R=bq+-y(R#+1b2W|EKY)=xc?KXE_iN8LEh;o~WhSVVnK<1xr5azUhzmD;m zu{!sB8`c}ol1a32R$&qSh5g1-AKpx;IRk-o`&~n2z?=MT(t&Y_VxN2GynAbGuKJ00 z_RjP}8jXJyuuQhPKd@8({f z15ea8!e33VUw#lv$!vY?_rYksSsZ?^pIW278wiqzn-Nu=H*69b=23qEa>&L^{!^j8i z`@?b1dsnU4OP0l*feu3afK6I+ldXzZH*!^sy;xJNftWTp&2=dEf$&$dayz;s{@(~x zFolM)YAJD96{4R#GvYH|m~9BU!gO=idPh9BLrT4_%g zc9gY8D|~6IxgKuPE>XenAlqOwM=mH(aU=T1V8a`o9V|3(o`ite!RUr_?IhcDO$Opv zIo|Yu`g>gYv8bm7U3K9Nn;ypNlAz^4ZL#f_J)^yFuM2V<4Wix3iY7lK#Du!fB$$7oal_5>^O*`zax20l=5&ZDYV@+fJb_y4~l47l(iGFle;m z)v#{5sT{FX3_$?$!&~W2!ckxDq-KPRCL zmjTEslKL%y3i8U_b08UKf1eKo5>KI~Yb@4x)q_=c=o}O3*V%Q!ce%alh_gpH4IAE> za6NS$>=wj9P&ah4N(W&?TQ(!Pq+z;V8Nq%Pqfvc&v726m9tNh*Z1~>?K?RIH$HP)d z#4?=^)}-Rv>Wh^fZ|Y%uM4n0 z-s+1HCSr>|$e5M~fHlec+8yw<%j^?dGrX^_?7xz!#RiRfTdKI8*klcqOvi*6;3L1S zB6sTSW-lG&_nY*pJjSnRdHnmm*bJ7iO#g>_8*Rx(Dw3eJhGYbCpUKnv*vW?D)Iugc zfP>2fusjZ^LMyq8K+2#nfn7=UmQUhtr?t3hNpoHg4cfkWXDhzt&7I2&bqcddeiY;} zdD3_Crnbn!zuni>uv0lIE>?TVki4V0W1H3M3=R&Fnkws#s<=hv-$`gM(G zM(@Iu`+)~@0nb~QGiJ6CtnDK-=#q=_3e4{`Ics_rE|d>+(o0>+as_9T0wCJN4P@J(dOW zGIKV-(vDfFA67Nve5I;j1qe)yfoNMsI$`EvR#tjr+{k^-CCCEoN#zshrQ2UnqUM%e z{@PjcD!4opCHs(czw=8g!gYcP!}%Ole@jzq^cB7QhhNkle^NEUl|e#<{6`((%s%@~MP+c|VDtnYX%Hoc7_2D8~F@0cqRwt&71< z5i5l`J>kFK_yRO)l`F0!J$39k;}&g-B;CKL7CSqo4_~EQAN6U4mzr!Gjr3ue+e54&TKLi%K277dp$J{D$Tml9kocuZ_D^6p$^H}A7{~l{ zvwoU|CR+lbNf=F#@(Bk-F*DcIhTK}Nk|cIt$@$~rvX+jcU;_TN!1PW|v+$u+^AKpk z94)EO9Bp2CiIk(mkB!v&?>wiX8#qTwUnbt)Guc`?#J%5Z-{<&vClx`Mq1&axKo1(u-c8ZmrqD${_}1BmW+BKXu&;*ca<{g-;FT z>V7%|wycVGtF|#CqRw_84becE8yX`EJn@B_yTzda)P!}LQ z-==*yvt>-{ATe_MDvMixSiBlpgnlTc;iF-JDGwE0UOlS_`Ze>I6E0#A{drZ!(-HCx_q_>~Gm8 zm$OO#;ks49IQLmpP5g_f+6F>qZv9sb+#GRHEgcKioaoGIwJU*H&g0Op%MOjbWAA|p z-sT$nF7PetALdTzhLyhodosqAy6N^Gl(5PwWnF4f!Pm5sigLR~*adhw0r)Vx(~)*f zw+5Q!ugZWe(G#AW8UmF60I208QGB>27Xks8sEM~f*;>^mun?q7F62YE%K=44RLdrG z(5!f!;?35xaal=`%8*K>CA@mK{ivb{Ej0mW5h^6~ar^3fb;Nr4k+gNq`jM1)orzk! zl+HtaNvlo56?<>cE~;Yr>(DMLP*r&Y(yj?P_5=aL4N(dKsV%}-Zlh>=onOxL!V2XQ-8?mjSiE&SXrbDJj@-P zN5f0bZx|jH`rW_p=@|{DV|3VJ3;NXPzA_bRKE>+c0)yEby3~OBm4-jsWAN<}{hS;U zuysIZqTQN(nN1m<-lXfGQKUKMk>MiJIu*2v@b|}KBeuO>5B9u(KQ3ubDaJuy|77wp zmP9@B-fog#IM!q!U^bVH2tXyZK_Mxn$1l7{pDFD-)1qCLm}_n6dp$mlH+@RQO_#Th z$O*V6*TXU(1-M5fp_{s zA*$|C=Un=qE))Zd(ZE{J7 zKUj01`P*=RY$6Ss2k8f8wi5Cq5p&KJkD=}Ff4g8#2UNcuUV1-Z;k_v8TiQv}nRnX-9ZGyQfA1x{d9>Ei zy01csw&2>~OYy4If-~oN!;yNq$>YbiynJG&_HnMe|I-N7ecwTXK(_HYo10lj*>JJz z-s>t);Di7Vxucz$GIiob_N0vYTt4UuJ5E*GlEP~)E3#V?{rugIs{Gpw=aZrzq*GA- zu`mSveO~+Yj7ZmTNw{m-ry+_zWFMmVhwNBJ)Rq^_Hq=kfao_d48&a+MqyuQ>tE7dj z&WQ<~SrlPcAgd1KNI*nVy#S>0fi!l)g-&nRwWzfRCa1s!e-)xK@@t>g)5M5YcoF<< zbdK*{`USBSlu+dJU?eA!&vM_&S!4?uhmTr`u9L_&fm7%|TswvS!!=*6CFscXuG>V~ zmtg3Ywx+eJz-!eCX9QzWfoh9FZfoU+o^g5J5LLu}Jc(A1K4pGPu%}YVw@ys)(I7*N ze*+Li6g+3JeA9KPoN+E0*NmE@J9?gq)eYt1@W=5KKNj4pC=!`_PCIu5&kw<4lXpHB z?>W2zD`!Viw0Ou%%{Oz)0u`1sq?FfdRweuQj4J4#)zR@q7LYi&MKRE)d$7M^lGcK) zikguQ`g-J~)=F?V4OCSeGuJPz?rW}kbss?^xxN-^g2g7&sUC2%KeKu_V%g1~0oFt$P$v_)?);r|^ zk~X?U+YlUQc%#Wj`WsgcADeYf_}T+JbMxz*9p`3L735oIW10FBY#-|tlu&9~LlN5v znRq@83xQAKs8qt6a*zSB^_H`#I0uKHi5h@oNF|136hFstzXDr*tvc{T0cp!ZOl$hM zEFDxku|gxFwjp5giusKVRz9P^`Y|ymP=E;Y)xAPiird*=|JPGe4qDw zP-?SxTY>?>+S;60&0Mwfjz?XN0ZY1IX_nw^#k-h=mo(df^J#Sq4ilN~#>D&-yn>h3Gd#Lm_-ZJZ<%cQw?R;jegVaLtg z_){=jN1Gct>+4nkSL#@Mz9o`4#jN;dygjLtO-hi})pm!eIgLp_o04OVTr}&)$%)E1 zLM_|mpqD>S@hKH{TjXUp^q2sC8ln%YrD)YgA%g22?f1|$wv>#W@q=RJf*`7J?0{13 zvIeX2>70W~4p(Lb(Zb2H#xnDej79Az64t}Vz+6kyIo>|jkL&i|;}?xWFXXwZOm3b+ zxK?u+1?Te*qCr`J@oW&shAlKx>Lgk9^*6alo*U`|lP5M5Z`AF>ZPo=Y3C>lP?~Q+o zzx&)@crCLM-5O7S%(mfh(^3BO!NMC$K8s=JLJXOp1%2AT-v-% zjSs1+A;@x82gNZ#X-V$zrJ--jz*f+&N2Z24Rq)~@% z&Vw$6r14Ko>7NZbL11Q<qH zPmDMKE9P6Mdc~H57k|b)$4uFay;1RZYbY6l05R4wDVzrWGWL9u3YfL0#P_*=4Gr;p)+3Mpg( z&?H3^^wMuODNW5)%Ch`^a+~RHiE$YQOcim!Ompi6pNuD|>>H6hhQN=7fx?r+qPcZ&1oy`f7u}w(P=*%2x{PJ-Q4_ zQRX=iGJGAu5l>(V=CM>O$5kJ#k@`qOWAyuce~Hp;m5)plz~wNB?^HANTfz{`|J}$* z!JNwRP1mY%U=4{N6|!XP-N93nRNIXNl9gD8`YaqCpfm&K&a+QaKbONL&B^@=Q};|a zUx)4J$Wq-td6!;t*MMpsj6W9tO(!CoDhf6{<6zuWk>Hcpumz?kjG4k8`88AcM}DoA zl`Jl4g*ZT9hKIh(x!IjpO-m7>muik9)8DFUC*=J?#v`dh@`WTA{tsP4jw}$J+#hrs z>f#wVFQqn|=j9i7cP%|+tM#*7wQpzZk~Ta;Vn-9HT5t_*VPt-nG_ITW2 z@2ABqNwCvNJ^}r4o;p!N*5lBb*00Uq#;@7YM?-~V16L=6^;&Nb`LI#`9Rp+yiA*JR z-ApF|BZsUej@yJuV(P(dBelWV8A@Z-qWw}1oFrTfKNz(0GaPH zD}S9L5a5LjrpJyTQlL&XXzKW||2#8NqwoWayp9nLA0f;^v(ApkD0CsyOZ_mXF{Ltd zXLo@-RUow(#=*SV;l^w6*yn>l8&k3$<{!4Y=mFah@2EE%D)0|ieIyC<3?EE^iosJFj4XtTo>^#y~6{)G+LReo5KPJ~6zvk4P#vr%1_YwO<1JI=V_jS{6E-4o^fk&Xkz#~v%;1Q_d%)>N+ zG)h8?b+@lj`I*Zg2s#=Of*%2-)>cXws(>Z@Ur$Ag=-F@G=-UH5C6a;)JtjY#hPIQA zUC?fK-V{>e{Yfwaywdt@z5rStY1T07Gy2Tg=HzS*6RF-s#8(QjvHA_utw6?V>{hE( z8Es;e{!%SMlA}MU$d3L&MWO{M){GeAkQIuX#}e{sA`;x$v=(=M;-K3rdYHY2pTYEF)Br8wPJo*SB@J`0wX z5LEk*@!;D37~d%Y>63`~g+2?+a**L8xH!if#bPuoq^PThc+cNYQ`oF_8 zD;8)Ms7wqOECt-kcsLgh18Rw>3l1yebG!{4S<0~70LiP7^}&EWlOr|`m$!Yyc=3}F zmOchgc5v;yn_Y1Quo)-m3(rGl@s<3MbaPgMT%$i=@{RrhQ!5E+mW(*flogP0Bt4In z4$H)eW7v9WuiW^JZd-M->-W^psD%GI!%n$c$;Z~(QJ@n(1D$|1d7oeF&~i{WZqqoO z=)QbH_BP1Mpjo8j{bex;4zvobP%|L53Js{P9?VR$;C)VnO?N3?Ca~ibL;MzGHf20)+(=oQ=2=lQ!Jh)}vOwZXY?-ov?R}68p@U@r z{d^JMyGbEteTsVj -PG`U{Nou-p&lA$)D-Osq0*j#9XAAixFDvDh3Zrxn-0x6w7 z44jA5%iDOZv9*W_HD2rD--6u2i_i(ZkB}*F;xLE3zY#T$MU~%!0Ef)L zSsP~!#ohl#WE`C+N2SvyBY3L_OUi)m_4Txv95aNXX+CJbGdLWVQ~E+p;aEaEAZOg5dkv^PimJ+A z*dy1t6!97gbD%KO^{NTb33sv`k}=TsMjzO5^-@-G_=O<<#;dz1p}^D)kpR%R^K^g6 zCGoAQ^HGWdL~gS|f!Zr4$KTB_j^BRBOKMJ~FF#rNWQ3z|dfVY?a~_*7Shua=i;7L6 zXhKgGeA%^3)7^jVGj)Od0P05y><3UkrW7{uHMT;r@Un%Y!Dx?NKt&*mX)bsCuT(t)_oeYm1!JzBc~ZXQaZgY6)LMsZ2ly1mzdqIAoqc zo@0gj;c?}PmAWX=_6vhdzubG)1~Ih}m$~Cr&C-M1UD$bGDWYO|_E0GzkhI?e(5lhi z1)LigOM!Q=$Tq4Ha1GlEOqIJW?S2spqkk>xA;iQzA7)I?J_N`xIJU&nIhSkhTBQ_!Kt275sb}i^Z7bq zP-JC&y2yj9x3mlAWTS;dm6d??R(EG9E)CCB<8~{9L}qui6fawz)`YcAX-AN2mgg=j zO7xDUl_WW4WC#9N0#=M%J;beCT>lHZ%9NokG^;Tl;r)@0>=PnC6;-vYoE^Kwba!eM zb9y|@kG7<}a~eZ2;WW{mix!g0<%H zk#L`LOdJ@+G>688#;MJv&hbzqQgR!%q^o2k1t#F>=m6odaSC<*`)9zl4^r$${FD!3 zc(oS=bDA`Gfv(0rl78kpSUdt!ZZ;7Nni6#8%`{qAHD4tkDy2jYg}&?8{u+WG95Tit zAOimj%x55&slu=@9c#WnXnq3GfGme32Pv%Y2XbTIaw^n=pCYRr5qP!~PgXJRkr$?6 z@V2_gYT@MI2t_4U*P%vQ#M)6UCb|0mD)i>x69iQ&8tfKF%Of9Pk*lU~HVCndV&KRI zqX7gA1YGt^vQ@wmQvV(AOe*K77MUu>^wKxPhkI~ZP-~?AETif3VsDSSc2YPSVRNVn z3(OuDytK+gJzCu?%Z|=OW)1N zx*=0>b}Semcb!AJw0}HJQi8jy6@DGYi}^)jlqbQzX25F_JRsPgquR@jW|V}}BQ6p( z{9n$jkW-Xqreax7Tp2+(I4EtiwEA*ijd~Ir>ap)|mfTA0nFF9x951lhXq^kKFs>LU z*!wl_b^LPDGLen`!ORJv&sjge8EwYY2ZHnM0@crvAbW-q{6rNIm(I955~j;Pao8;L zWS{0iFcK~8hFjX6O)4z0mFU;uU%juC=7ydMrVSerI$13KZh>o&Iyzs4_TqDoN?DI; z1xr;DN3>w#8Mm8fO+ojw*?#&^X%+;jpmimNUCPHI!j>CY3nyBR`Durcqi|I+-blNi zk`{U##tmp=Q-Ra(1*bl1cTFor50l2-B1gtz-Q*}yWP8LP6kRoo!TMnR6&!7Bu+iQe zrcTeMM4GvbhnO;{PKkO+hXL&vdln;dT=JY2t5qFvjZ$xk`HnE z)>(#nmGj(M$M_nxjdEuzZNlxr1^og`GY7(5!_oBG=FoI6g#wjuqdg^3jk#~do7J6 z3kb}=UcWzYUM_!Ld~G?3SflQ2X*zvz{W7QaxZ%ldLBYmhsY#h~ZWdP(H`q?=xa_G% zI(Q0zs9og+YuGeo3iA(?1V2V=eaQG;^g=_W{1UY$XjLJ#WIyHz)r{-7;9mnrR1wG% zVXgy+RR1xhNlsSG1FNuC`K&;YLN4bhUyrn2e*mUZ#8N2B`r8p7&KZ-WP8aIH(5JD; z-(!w5@J^yW(Tcjn`ymwn5-ACeL%>G$gT`~LFIPWhZb(r*(A+`0DO%NSvZt^KK(<^MSpX{Zzf)1c*obV|?GagudUFg;C`veT zkyz;++0wqwF14AAG)E-x^$&iz{S=uwZDFZ5(wAuX3`fgBR^mKxfwTw=xhFN2D_YSh zjV9xnV1Bl7m4-QG_&i4w?>D;snG?)w;(3I?G)^phAFJd6M0}s&Ak1yzDlmK`*VFMv z{2C&9P4v<3C{iOVri^DKnQLx3<^3w;ZQ{S~vSNqE52p8vTr93zvc=}pr!}t4dJT4> zyKCPIHi8#j4v(;&D&jldOgk$Z5=KN}$dQvXa(UQUZ>tTXpw_=Ju(g{VWwLXJI_|uV#1fB88K&EtVEUeXAe1I|>~wwFdyn(;{za3U+pATL*Q$~}+OyqyUMww`DU20^&hqrI z_RjuMgJ11@dxEf2iHpANrC%DNEatF6ed8y54biJxe+lg0aL1i2C!ZuMbo3*7{$on74A(cmY4p)Ale%~JkR&`aYo_;VX2V@j!S?wvx>^42 z#u*oMc`!Z50#IT)cDUfmtI)XCJvcSxW1Pm#Io7Ru!zt36x{aL>BKEBg(Sj7q+$56H zJRtMm0}5ExNXw|xmz=x}H#aG6BR8t00(JabF{nGD7NY2Y&sHh9uNTko;c8Uj zD@K(mDQ!3<#*3%GHi&^a6c5&9%-ME#?e&tUJ+h~IzgFi_f_j!BeCDuWIsjQ=0*dVo z!2wWg50;Qk9D`2)>5X(wLBS`}t7(mNfoXqF@jwnpbJ#O?nbIQ5mTSgq>W5CbPu$Dr zPV2YOgR(fz^}tqg)*rOAeXngRieLhsyd+$;4=y+Z>(JSlOO?m(1~RL2V$LWLtOQPO zNx*pho6EqA(6_yn$*=O~e!eDe(-CBL0JNDEwaXKQ!~69VOc*@E2GV`bKKG#6FeNMc zh9^4@@2r2K!spzxvtdw#O~gdWCU)s=rFfvIuAO)^CmYav8h}>tR5Uz>L;gYacM@<4 zClW0_Wb}hnqwc`n&n!2lY!Sht&WW4kW%=g{eh6o_76mS=y=_a+A^sqy8ZQ*4Wb9BF zlH~}uPZ*LS4@nfGI8B(Ge25a^fb4z~>VmXMmgXK!MxSP`?|~0Txx*JM;=kH|kJX1s zny43MIhWBe!Q4NnEZJwGl8iJfn+J76oc*I<;J93>2B<2zi2wnvliU=@XL6JpdpQ8A>DXI`fP^}#Es+G_kI2eZ{hLt%C zY>S2yO#AOC0h|r`*wTaGw(r307-D9KTN!T;TThYbn` ziY8c2!;<^fr+gp5dVMR!J9`x*80=E@w0aGCd2EL^V=kI&ya9UetC4|<7UVy-qgEc} za~^Dv2jSH4AyNR+`+>l+5NbE@_cfug{FoI4nQRM9mteSZJC>h*X6? zNWV=z(axBThew5E*dgGuo`FZF+fn^BSY?!pfiw5zp;;p#_V~09Y(_`z_fe{ zgVGj>w(Xgw4=<_(F8N!C)J{+^kT=05831ke%-7?n*XP9?z;h`th`j2>cLsPiI1aOX zKJrX3MBDP9cB)8wNX$zM0N3aXCGKCkqT>l4ktAk0{Gsb5v&ew*DTJ4s=Hu^)!8Sj4=y zxEpq!?3BFeeO|TVn<|iQylGBENp;7h`u&mpBEc-dRinH?km0_s)w!1{rM4i1F6W{}HrmtznEwr&Bt*N|hm3T;0)3;!3D*y-)VeTV zby8}k1eZGVL{GYV;Nk*LUbM!hWLK)~_YV}M7))CzOOz`OW0$vZaV4Y*O;6u7S*inv zvrtJ;ZIm|5cJ>J|x4G&e0t=>MpK$+&sBll|K%%a6U$_)qf|1TTpkzbFB-I$A4}`h9 zCV}f|Uv~~(kVI|#mx0dZUZnw8UIWT!uFf($&X#?*RJWcO*_)4xnV;sHm#5+yWUwZK zm?)Z-8QmVro6ik`4(en{I6Jj)u;n@fL5_f_CNx$ zaS}q1%Hj9k@~HRK58QyRe9a_pA6$QBGiuC3iRKZr@~)Lj4eC!^bKQ|xW(72Vazq$^ zuzB%LK4pLXI^b06DPTI_z{L3nQ`~@)|8S7BtK~qJex<=ts2cL)XlPCh*k@efam{AN z>g!cS&{Y z!7WBuVc-tGSR3o}$79ewxP=}+2rFaNf2P+`Tr&mB?+YU(mP`wbYwYOuu{+Or>=hVc zV?RX5L!SN(H|8@6UGg^A%0J;|R`8jtUY|Lz-n}AoooYmDgtWMD#RFUGJhd5y2QZ2t zdB38!qH+(rVy>`Oi=z_W-Z&Ns=;^?$AJ@cRP%U51I6s(|Zn8cvrZp;MWrC(8@wY^P zeH^!G`61T4STg!};_!hZGocSInhJ`xKGX>bWM&x>VM8 zmQJQ$M9d!cNsy zy5_h#+_$}jWxHkD%eHN8*|xE4+bwhXQw7UJm7eO9h--HxDG*&rbN7vtai`T1Ezo zrbm42Y8X)p`3P*Uq3!Z#{6E_9Nw+P?q=W>B>4i}Qd!W{agcF1*s*!}+<+BAgA-&0w zAK4u_HM}7Tl;finwzVPkZ9|@6WuB^()^5;EAq;NKnNZlu+Mt_d(Zn7KJq5!cp=u%L zgPB&<6q=5xMBBa&&_7U z{Yu9KxWnaq$V;WRI&e15^^DDnPn#wm)n{%?VnxV>g#QGzI;x;>rhauXI1yF6<8CO4 zv0a8d$zhIR3H5xEgt{;_@V*arDw`dF@V{it%O}XYWnOTWwnE^wtq(W|Nw8r6e;8 zmKE`~Pu%^79E5X?{wG3nX5ui!p8X}`j$4bP~U?y3oo;n<+^M6z=q3me$1KvlsXJWIjyQI z!?WBVUXzc}v4o0aw6KZiO4r>|na1m9LBA?bEM8;7Ho9pXb#l5$Tnz~=yMvkn)}ysJ zc{W*G zBr^m*l&JfT_g%^ZNops3N)kQjNy_&n zzNracm_o1GkDx7jFE(fY>~+FZAgp0y1Zqm6?4YTzes!7hqEK0O>TLh%p{NeMf_5+} z_?wuq6n4pdd=lJ=u^9_zt}=L0GaM0Lo1y*30B`rf9afmzY1~I<&gul~aGgF8k`y+W z)rD|<&MKA`ID0;I%`cQcrlu$|o2*cOXo%R-^`^UF{=!F~?kOXRRixwDZ8`(S z@o^!z1@kk6)5{LfnMBQnpfKN^mUJ?gogAoN_s7l4`a9vj@F0FLiGVox=rP=dUP8q_ z>w?&MKpKBW;6E)zwyr^t!4$2{=FEd$Q0qG>L*EDZ%+&15ban6|@uk&#O2zUTx5u_R zLC?%ALDrKEx>td|CFCp%WP3p?P}_vkq}5R$Oe-?fUz0@^moKZu-+$4e7K>2C;F;e< zv}+It&U(BxS=u^)LWVwd#njKtpX83HDneZ$fEqnuDmla6qaZY7h@1Agi3Lx~5$)qD zq#ZVmk-8>!0Sa4`p!v)&-Bw>w0CG(uG+-dsyWJ5g_1fTw zHPc08x~0(%Mxd69(9z)8*JOnwwWaGM^)7BO6R{1bDi`g!OmHn@o~?T4aLPsTwZ`$2 zH7Yuz0K2h^;Nu4=nEx&55+!K+d&#k)-OHLrn1^Y_F&0fcaA-v(S?}6eeIY1t?ET#R z4f6-Imzn`yayV>FDbHL2w3_;z&K7}6$$p=i zS^($oZqCbvH(8XIYofej2h%rx2tG^o)cI_|*?Jo?%l$vr9E-lPRRbZ5$rVKs-+gdn zH21oxUeML-xS50cdBQ-T3y|@ypK^GWh0-mnsl?`kjW+BWznNbFtdvx~psD;Vgg0ukjD|$Z$LCdH-qDgVGq{&%omH7a3$h z|I;;ev2T;*G|(1Xs|~$YhQ!=**S$8>qkZuRDe6Ppt)rdo=UAn<8<~&ZZPpr>>3BDD z2zv@?alEG2lQYf?2X|I25%1%T{U5sBSxY;mw7^`V>c^Km+ReG-Ypped0FZ zr_!$~#2m3BP8s`7(_1BCE|~Sk)sLGIUqfS&0Htq=vRt z2rc`8_D@8~#ns}lV2N(T=VPZ={+6*l<8rMjlYba;Yy~EX2E|VrWHpCsolovHGi+0q zmCcoPgKeXd$>RA_Y}ka8IXQFes`C$OijQ11rR>|$az|&BqFdwil+$#FfY*v+GdY8D zl);5h&1&3^1odzuB%uEX^UE1+#zNYtTthstr@xvo_B2dGi1*@_kfVS!zX>-l(Jz*3ns_4 zS5Qu2mX?O@zpHRs(=>uY5Bqfh?aTHD6mI$d%Ei46PS>_>$j0|si<@=fpnlcU*w_1@ zDa1NT{oQ%TqU403sHf#tRg+ke)pf69@$5>R^3iY7+mxmF(R>GD`bsJNEM0r>B={}m!yqZPSJ6sM1CuLz;iJ@hfn?*b~VLtgy z1?w_tEcrhRyCFj&C0U~NkixVw8A-$q>=tPy=pBSHY;;cj{@Q<~b!xjB|4wirx}F}Vg_Pa3jT=_>l4}!p*cC&XHHx^|33j#g^6d+$i1Vvk;?+Dv{{5C zW$cd(7`98nC>igjh!{>yu2S7&7}e<&?a+6Hl>A%stF|`??*z|dfP#G{?-l|IX6V3H zh=&XrOQ>c6aK@|ounL2pVO4LDKMBX?Ry7+HW8045S^H$kNr@OXC{W;J++dd< zXhWnhESop)49$tDSXrJ^>gMP&82>hM#O`;}h9^WxSP5TLV6B7a*;r=oO`K8seD~y0 z;?ptSa^c*xZ*faX=53jMJhC_8xCPN*vL;1lpubfVFWpy%$miDMp!;agy<;>0(m|n~ z2A!NJfhzJHzfS~`HJIVz4NWFe*4VfDTM#b{%I1xwEn0jTt#&KtcNo!Rqgbu(!cr}w zZhcD8dQEwxX?96&PHR06*v1G?`9E&nyu{~(jC3pD2jRi))*bsi{E==D(e93rk!+G@wY`${kUgsvmp5jOrx>?|$=2B=N@7XWFDjke1 z-0dzL?9$zBaYv2*C=5=;f5V#K2mWnmP!T>!^BFn|-wuD5f!0Hv{*R>;4h@Jbj^i|#|?`3caTh*fz zY-w+v5rjov@T_0%)9;BEeiKybkoQCgpu$<;1cwBKN%wf*byr|g#PdcXzqgaBAT=1$ z5kZCDGCsu?hkr*0lAvbR;?t&Zz<}nMr68JEzydg+THB&MXI#dXQxE)3EzKJ z#2+S1j!!$Tf@_WpP=5ld(SV^OUfR0RR|40wXDaVnJ?0z7@GynR>7+pU;t8g-|67Wm zYP&y3#eH$qM5E&nW*9`+C+ww*ejt|MRCaEQ6^ND!nq@*@@ejI;k z-MifM)M~`g=MpREGy`X0AU#T?>o@lA$VP~`VTNDQs4E`^@`5w!lgjPxEJsWAg?E~` zA)ys$^-;==>h*C)hzPtMvxn`(@xeh(B2sKp~Z)*%nTD4tpPIxX88tk+rG|eLW;kdMi5dU2+3!G`(OH- zq7Rs{Y!8MZm&zX#BaxR65T8D|9oRW+eXrEd_hSSD|4TyjH|!9B5~DVNyy`0Dd-7OZ_>6Qdn0fJ-)*LLVqmrSnu^U!#ks=I+GF3Oke*$ zjJ7<*_mbiLt_CCp8#<%hP{L?a%6EQOL)A@2r-BUY1dJ6=>i!>KsBeZg#uejt!ywAB zyvgcFG_XPgZZN$Zm@#jz9cT?d+t+?%gfn{LH(6oF4gUN8BQb*yN#Z}!vZK;U|Crdf zR3YK*)rb|9wvWc8mF}7dwWD}TwiR~x;7hsyp~XX%_Y_Xa!2X=%!QI{6lnSwJzj z+sqTRIN^L&bs4?`w?ZJ1K=K})N-+T{tE%0~cbakP?I;{?)C|aP7@UNN}o%OW`A5tOj^$9W7 z?KZfQsE8K$XNy)Y_<&1#FhL;jxVaEP7*VsSo9k8;!0?6U#jTG8({&65A@8IAo;UuC z$KW06c0A?eq~d7sLu9*VTx2_nm=HkD_n8@HDiVK0a?^3p@_ zFTG!IAebI7KvIE(>la6?K~3TlV6x=b4vA8FZ6u#Faj5|Os_1gaLcV4N6^#B9WyVks z%_TYQM^0-dnH{;J&@Uc)ZH6^Cg`u2-h8$Wc`AL}i!dL@XW{5Qj;r^uU+3r?T=(W2H zGGK3Xd$(^=_$APkNUM!?SSBFUa<`dqG9PxT^(TYC)@BRZjytKjS24w_R=9v^XENv7 zWYyNKwUXC%Q?1(Jt8PoIwn}r!-B4uQDF#o!kFtSU^kPEF{dZn?c34>m?=KEOX)Z}V zczeSBx<}tATIMq9L9Zr|0h5x-VoD?_f%FuF8OiGD{Kq%5a3Fr&V}N)A)#v7jz5AZX zB^$8Zx9C{OsxroQ`Qv-4!^QVFB&|+zGUtWV2g7NC9Ls*>fBKP=i z06TQtwJoO7gOolLYfZCz$C2-6r&-xp2>2q zsgo|8++fSU+l6T$$ue*qXzUbP4WcE6^aB^*$54+?%tJ&*BJUwc$&A`0e9PnvUU)oU z^dbPGm&1#Q%aHo6*8}iD_|>eXajc(hUAMzqYjy3V`!0R;C|bXtZK|_sZk4X`YUq7S zQwnB{*C}&lrY!7VeAbkPeMrH)r0tOx182-b+F|-cNy$IE!w{(ANJg=`0DfwT+ zJs(9J^a}<_sKMQ;G7}PZap;CJL-ce0BwLRP`sYu(C%UU^{sr%wKW2B(VCF^(5G)t5 zZ+9IKApU8}@OlVhfPY&D0dcC1mc>KbsZ&wD%qaPVWVPT?3&9BaFE$|h{rF!3`3Zor zfgnrbXSpknU2o@oY+b`~H}CnRxT{uXO*tR0nGiK(!e_ZL;TE5Z@56Zw`p1e_4A;{V zWcwO9+1%0FSVnO)GlO&gQJ@Sq_{R%+uxB6z;;9_e8a2?|=m~a$ z8cEO(*{4g8Y~%c(BbRR-pMIMijhroE60qZ&bw|;|(*n@f=-QEG_vEUd>`yz+xf8jRaMbI6Na#rL>MGz^|R= z;T+DoXCuVfrmcn>Q5^rrDvn_V4H$R ztZ}qK#=vbtb$`*e@E@DI;cN@P?+XQik)07dBh6>oxb4HkGNiBtAko}ie z{r#K5U4gbh%vFt++W}&3)EIT+td;DYh$(0Tx>jHgK54N01MH{X+M*o4es9m$e)8vT zuCUw|ts~mC#J%{in?8lIN!I)xy$-bks4!Y9#PA-uLk2diFT(m5$pry36`d9}ea6XK+;- zIH?8q7pJu&*>8LxW-W{bZc=J_b4L8_baxpeP`_YOR(Fc)l%t4#$5Q8?e7Bp|Y$(>+ z{(vmwt4H#N{xp2>qR@0;#6a}d^d^clq-{KKy>H$R0G;3*3jyJz6z?r?ld6Z%0)5RGE`RIgK*D*Q&GfG#; z=G*qWw0u{1zWs^LBr#t&?o6}4lYq_?Ga%LUqm@>|U<;hgrQ;F?J!brs@?;EZPzd!_ zBtWAL()?iZv(B za91$cP9ot#DcY1)k9U)GWtwP9wr9Y7y_9B-TAaaDDJ_~~j6d79hd)p(=XcfVGvLPj zCBKW9F+hoGX?>N&^cgr05`~xx*b688y3Z86sviR1Q~qbNpfULV_llc=?6>6O+3wLUMzNm4A+ZF~Lcla;HJ$I8CF(v6tf zGfkd0Mm9hbJAu%F-h8~r1@a}`&@``_Kg9LgrO765-|z_pdBfYP3glg&b)WtsNKRo#rb z)_OUh!oGJ|u8w;DakZr}_;{y|A&EYz_RK(P>RtzqSPG}3>`>>lH+w9+J`7S9*QWDe zBu;BTt4x|3IE`_sMX5nx+;4$oj5G3JH)-X`9Q~qQ^-hZtPzqneY4tDk6nPOE1}>p z&}yM5P_)2FH1(4JxRZRc%BK@?k3KKnIX>V^x)aftPf~hm6j42sG|erZYk^kgpu70B z_~&t5)wx12vQguxvJiED`6|JOI$(_!fXPvDujP&ii|GYG?mm8U#LBKf-Xr%`50Fsa zA?R@qc~ARa7|GJG!%sldgP8&|&x%%SIgrMb(gn{G_N=D|&Y!25)grI-<(V<17z2zvkWC`EGrRvf zXCS2;nlTVflY*v^W+kQtJiRyfi=Vg}4V3m+SRTa>_M2@AHV7x+SHRz>bZozZ`eq;n zjaFNdMeUq1A^!4^)wSq!e{VGX@@nyB(Bv0Wt7t3vzN;7CP|Nvpo4a(@vMp8HRkc?3 z(kSzIn=;y8&&#iNFLDg&9LF)?u^>Ecjw`8;Rsd_|F?Gq6rFNg~l^J_V>X*+OX0Yaq z+0Y@==&}&?K%SEcW`O2XZr)9v@7EW`5ZRUotFGW)sm(I3 zpERVxqBTkTOz=6;+pJw0N#7LqKahz(HNs&**M-EcowYd9C1Wy}v+rLG&(J<jpG^qv*bo{IqpxJdA8N-*Mc8D zt4dAq9NFs^TC!D6ubKym0aq7A*-l^?wBTOKooQHS(2Q$F7MH1jC&zY}1|Xv=1aR%O z2#&Y}qPJ7iD<(sDQwGn(Da`@=F9J?!`f5$lFsx%8u4qdTuXNseOm=IWbu`_OGhmPD zv?AO-ta^GO)62^W_~kO@!xP%Jq!Xgpp(L?;jpBwh#CT`mE!Hw>?^>Kz)i3rT297-| zjhe}U9KSF7$5rvG_Z9JTbjDsfPXrYGvJm_B=0OO?UrOH>qDG#|Z7I+yyz@aJC7~R) zJ7sPiPfCZ+$ZZR7Iuf5v2$D}G+WHSs&e?l_h_VGl6jp&OaaWDuE^Q|<(1J1Wk_8$` zO!+XSc`K^6is$X_a{S&+SHjQvV^J_(5&*CCvC^XoN6{Z$Vc6T64dZTo1=Du4f0}RY zFuMv_Ccuopg&pv@Jd&NdxuO$m8?@?~tDVjx(!bB_?B#G0_SOF<1$HwFcCdvAMt41s zd}^Cpq1%=Kk!_nx>LlkOf1wS~;?S;jr-lZ=L7#UQ=YC&;DC_2(QjmC6I69h7HIu$! z&Q0qUZd?BeFMhW5my?`9Elt@$rSp}{_;57aS#ulLRge3<@(1Te9tO)hQ_jBMfcGu* z=%`X(D0)I72v3g!tM7ziLsxPU0c^Emqc>vLZu9#$8b!W{?uGPJvlz&D-8Uy*LvD*# z{S^F`T%oHK&46@WlO#0xq4+C7dg`e-Yz=Y36cM;i%TFR@ynQ2|886e0qs+7+PfT1r zrr}$&u>~j2)IW=tIQO2b25eRge6Xqb{n7|WdSc1AzweWkr0M4#Bdk%uc{YfdFoxED zkfPJyr8OD2K?|&wEwYA<<+~Bi&rxhG5of&kQ5laF2Q}#|T3((zPd|1;Ol+A8TP*Q! zBhrheb%5J`vcQW)u)ZRg@4{)`rQm~`afX8pbL^(cf|?=41C7`T#rp|r^9mh1J@|1IUw_E`Wbh<862L7K7MSUbN*G-q^%4_4uWrC zGhRu4=n9O2>K;r4(q2#bI3%vJ$TTA(a0*Q>bHhY7NF*I6f*wZ`vC1H>5(YLzrAk(J zmzXp)3^?2G9@c>;n@S=1m%GE;;x#`7Nr1VVo=om<*kCVrUQ@T4E(kx)NzfU62y*$_ zzqWkN9z|ki;3J~GaoW5&WPOp|+PhSI5Uta;%p6y^_k+Eok5GcFjHL|uNW8?v{L6hK z7cn12+>m^6G4>f2!>`ANB0M7|2}(RsQC=j%S347n5dOgI=1FH5GX#51`TU#soRzt- z@UDR(U(F*&TFmB*z`#OHYC4Q?JAk_MKyNpZ^fou0Mp`mB%)UaOs{$zvGSRLs!}!#U z4j4t>u0BOwPc9mKMdrkSCVhN(uTPA2L|SsqT&O*xIgYx8hk1!))q9$3m!kkHv^|3HI+ESm0K(I2~dW;7K`TWevTfyYo>IvoiUTT-#CP->B zVRelJLnEAFHA^yDHtE)|i>8g7)v+21s(n4brr{=~oe8w@J>_9h~ZhO3a`(Ss^Xl!79|Q}sQuRZN#~TSZ~GdAaIT;}=I+7# z`MT-$JFxEIi($GUyIaWAm!UaHTsnGzbS8SaB}w7o)%w~2XedPGHHaE<-~i8b^vm6} zVIQNcfmC{EdQ|^@B6|}-pke;0t#SHWZ6YLeoXo?>GWBHq6J4~cRkuKaoKkq zUBMNnO&kN8Cr%j+qQA-pB2%z5)v2YDULQQ#m(Hxply^DR3vYRv{YbWXer!19K!>KaGYu57AZMxB8{SdB5V0?ps(9dp zLkFNwrG-Ly2kb8}h_gdNM6aW5C9*n@ijs3+PVLA810z$fq#a{Kn4F31Peb^*P8Z4HAq|cS zJt?tYF?LAJ2FVuBj!)tluqBn6E|uo zP&KzEpo8aRO%0Qi2lL{>4Hc4?cAYdS>}kL0AfphhR;j23bK;XcpRIQ6$>m$XMq1Q_ zQKnYv3(o&en4@kLX{btlNl3K#eezgHH?q65%UO&MBAu>eE}5~2x|)R==o~&c>r0`T zbAe?k^8fQj<*>5!pa@l=RK*eJ0W#1V&2+_l1$Sxtcb?+Fch|($E$S1w-Ndb1dTzvb zGV|%%4(v%BIe>QlB&8jduwnl#AdXms`zoy1kdWTsAi@~nD7ueE-TiHZ87VnSe8o6) zI9A>?REQc!lPfn?LzhfUk}i%|$2@7?EM}lS##lnyxAmHiX-a37_9cawUz3QAjK~JP zzUM%n=+7$k!rIaa8~S+xh$x}#v_k-jochqZo>uA96&O_-iER#gW?p)Sp68xk;eSYk zOpk&>iV+%0SKo7lD!ij9F7>T)9G@-5*C4FapQ&mB{Xu;kZ#PN-LkhRwXm}HJqt<=> zXNCS9)B_OJoLdYq8jZHP3C&MTzkEui!}$wG!##mQP;@wwkei4zTyopRU#?g})G^&D zhp#9CCuH{Q9zaGxT`JxEVS@i@YotqtBT0u0uVbD%UlIt^Hc3L~b%v=?46Pz^exc)b zJxm9M@UkN0$Y)?#XgzHDhVQ36I(nM9N7D;=*9{+3?rVwvR24T8(?M9!WkrfD87-ZD zckmvOi1tIO)@%I6BmTdL@kl=Ki3`8xOI})Y%EJdn%!vXDdp(a&GxO{Kfa>M*oR2+u zmm?+ZZH1W-`>fvl(evc(k`Lrh3>J^2%ZsvEtHvgZkmg$Ei>!lEfbPExx5?U~q6u!dN^dvwu$Rm}C0w9j& zShA^04o);Lh)t&=XQnNqauZ{7*Lt)%-!Um>20J9-rBR25aVtN}W#BcP$n(?vx7J=w zHRN51JW#pEn*w-A3TU+?k}zgoSaqeh?9}l@V<@qzST1Z=;Tz)9D_W?C%E$k9dDE#7ukLfG}AG;K7eFnkS^FuiPLNe$1v?RO6QCYIFtXY9au=F-&RH(nmq&!>gji#v`k@jx z#}LI~lc=LBo2%pXvA&!=o}g;7*Hu$)8V~ zMr~2LQfPI7muQQknSM9|RDm^ps%%G-l5Sqo4xlPIP``63c6{2dWx!!mmQ36Z@DKL&gNAoB4=jf2iw7Z%n^Y@AWZngZH6zH^W2MC&;9njG)4QCa zzOzqs7u^JI*W)K-2{z*NXcrANO&u^*q9)rFs0}tLYWF2>F;ynS*r}Ld8KNmG%Ee*o zgW?TCj~gh&2?x@a z+mpnIvR$ql3ky7t7FQ=#ozlDQIjhbdqYmkoqys|Oi$LQ(Hd+>Wi(Os=a2Dc*3F;2b^P_ASGo2z8NXfUc~~m|p3KEax(Mb_QCmJ)m$X>QPCzFN_(@Qne5)9> zB&9ZI2#BL@gEj0o8aP+28{Rmosa(K2gZ`Xvcqt5#40Sj)k2<3ekK|}ukrkD;A?DiQ zKhUR|sl4>=Bl0`Wm@I*IwB9|6O}_+#dwzPRgFVQtrR_rIvHZwWP15D0uA9%$(mSsrn7)D9gPa~GI)n? z4mB8&b}*Z&GoNI$HllDja491KMdp;_RlHLBS~2Qw6(TDB=V+Lk4bVU>hwG+rD8mir*nm9Y+7fg z5NM>Oy9tR--^i)Uyv5POgUmoG=5B@k}+rU z2UMb&DWZ6yo_tTQm>x{qEd*5j%1>{gYY)h&Vpw+g$(W;^InGzUHvIZ3JDu=2Jx=sW zu_Jo)@VpvqQ$P+bV%fQO!c)8^G69Z0_BEi?b{d;c6qo0<0iY&3FW})L7rfd&Y;^4O zl)ysVRvtO%aNNpv6v`Q*P`MkdaA&8qr2%7@Q+X9^lPhD|{@p5upu6A^>Z)~-g>$_O zsXx=?Yzoprra~uKR;{V9sryr#uaP7i`6_*qD6VbQWF8Z zK%zSl-hK)QjE%erQ4q&Cs1h4?#hO&Phda*ud)PoALlHKXum4&y2=s_rF_ z@8uD&NPQ1#RyRKdgV`op&dVMXz0+>s0@fD|#`bPQQlGreuD zl5*0V!_xwGmB-e%WX>b~Qgh3UfP*C)f@Uxtx_ebFF8dY({ID@fQ!x$k=Hs81)GoYv zeqs6ftzc_6?j65k(-@L&D~{PN8}Yr>S0i3np$)kh*uXK zyUx$^KtGIBBEv3+;=-B|LV&{OPFwi5Qoyywpk-nBEl}vMU}X5U58z#LVKMvw|MA9x zL*CP)z?xK1ViuASW1eevF?@R8=Ueb|@f3B4xbms%Jkwcyh4zDNh@3;*9)R}~9Qu=- z9vk}?P^WkvG~bEFNq+vI-ol3Ep74O7nIBw264Qx8Se43Sm5Nj*O^O^pfS+=eKS(Gb z2LKH7#b5B@XWfQc^>Zj|1VPzIHzkeU5J^}fnKH3u@#F)7Qww1%ex6n49TuJB%+2QGV=5izpraaQ?c_|PW=ljce*QE8;j};j z`5JCX!4G;QAw=LDF3Ir2wmPhDiAhv6?6|mSaaaRPO#5clWEq)rHTZ(N9P1RO!QLV0 zz^KH~Z&-NFV!P1=NzS*Ox&6?d-xBsTa9mu&aaq>TPhn}yMSzdNAMM&5CZtt7=e-j*Bl9PqxZo*-J(g0b-~139%ev!3JpWAL z96Z(c)FL%f_eFr1VSzd~FsYR4`7xj3-g=sM?!@kE1g>kTOQbHgxTcMi z-d2Qtvge>(300SoN-LrzYP8cGE#^(|q~*Y8UAOzTjasgI;0bHyuuYd)&s{Aif%z&# zq!~p%kGc$gRvq2!&CADQDmSm7;Ui{k-E5@G$Gn|GSpP0UFqr-Gq`{_f0#&Hop_-A^ zL3b>=DzUdt!X|Zi=VsAj=%{2cq;aJF(%l>+7^a-HGP$L*2ONja*2QmF=L^Ngnx#8E zQ;Vs#mAeC!(V!Znh|Jjzn&XB;(UJ*_yf*jUkK%qXJjYDc*W8Am)|=;7>X&}ivopLa zi;g!wL1nMCWizi>l`rGAH$I}pulu1@@Y0wWDb*8Sd8q{kuuzG7Il%(OW8t_eU;asE z>6H4&=OJ^$_X(>@b-whq1S-N_sQuWd{TVi0{D+cZg^c-@iqcvA<0i%$_LP!dOP4Ny zxH6WrZv1oY5PK?lwh9KdrI8!<74QP{@IKgs)}D@flcs5lNyg(gEzKDy4Rz&g9Z;GnKadc{ zg=(l7NHrA^JQ=>N(R}Dt*E8+2uX0tMP$*vZ*_u;D9`P_(Ceuc1Saerom2qw+O(R^y zbt}IPBvA5Kit2B2V>_Z3Uq3zFyfnM7Wp)R#utlTzsXs0j`>q1yB)OAi0?_jI%%n>d2zS|=E3uByq3+UrtQX$l3ZL8H;9D9R}Vi!wOI68POlhK z*lYQbq@|J^TWF;`l-Inl>{2UN%9JFz2bi=pt#WfGZKDZw5QkBeUNn&Q@ZL8bEU9_6 zY_{}q9VL{~C0%YrX;DW`K0yE$RY7ZJXQ-oxHfv1mNrqS9Jr7M>_ z=WxFAW^E%p1noyoQQvvkgdh6TK%^4AhUHdxzYFAK6ps#d$q+8gy`+n*_VNL-^Pt>M9PG(I=E|aSMFg zblSBz{XQX>^JjKr@-tpL^M%4r@YB=i>B}@c2>Q@u*?ogoYK!Pv6j}-61ZFiuv|!SH z`YTXOjSX0%&l;b5f zrw@?sG^C45vlFjiVUJyRvrEWZg-17x{?T-$Wy-nZ%udEhrei8&MEKy?Yf8jLibPav zjT6d}!o5$pj)!TH1Y+fD#qpRSAnGYSSi>SX%md%*Mxj=&{lo6;{u?nOwP};Aso{I@ zxC2C6<>&*yVd#Tkv{}kMVV7t^@my^8N8e-u4-gi7yNn+w*$70arx(TfT>H78PaNi$ zY3Zx#j8M*e4y2~WQJh-{U!GQc40y!=!aP3f$EdBkxl#RLJxlH z0aLaMi+`aYrgo_%vzz40VFIt0b?EUOb>(J``BvV8QtaGa*X9reg6pLBdVN)7bBfOA z`8Yls{ki?u{?_txhxg<7u3UEe>v(qi)Af&RM9DPG8=c4uNr_^bRY4_6sKf%7nD97A zjb=1sMtQ?(h7IuTJZP-zsPAypD+vKZQ~z8;szW06+clESqDitq*O2J@p9NA;m7+vQ z4@)L`)}lPGL0Rts3{M3Sl|JH67R*=|OiC3M*U|2rHa3f)9y@JuAn$C?SOlq=W=291iQ~XfoBWGh^E}-sCgc;Jl63 zpD_koXZv->AFE>BrlklgvQs*BP~CDc?n~K($JS1h$N4g9KW{Er58&N1pV58Lp>nF< zRz#BIl&JipO0?#|Xb!3HZSNM?3p1KWwdnvvm@(j;s9{8b#^p@x6S; zU57a%zVbfv#YaeG%jSV_4?VIy$My4m?}_eu&5-JIo`j!0m|ybHwcs)&-xZ@T3o1dq zo7D$;?;QngLrKqYjx*WU!_1Z%Wds)jc*{f!UA2aHzIY$# z4Ik(dJ?DyN6fj{9@n^s00QNZ>1|43)-Q&+#KX1lhM>Vhk4}Bu9jcyR#Vpp`@PWCbc zLN##WubY~MiP{d_DF^Nl&@Fwc_zHf#L=cf=yI@AW-A~ZRZjd={FV1?jP_Tr@+VEIi z8ed)3aeEYS^a!(3=gWBW)OVp*KDbicf=}b^g813W?#j8!O{Q{SZ~JI}w@^WP8~AHw za2XexWENu=H^5!3#JZ44$-(=xvvr%@Xv4cx*F!oVjI-UVxiK9ujumDiJ(U%dF#Or%$rI`u{rID7= zI-Q8tKnqb9Hi}Cwsipp!xiFYkoPhJcetJ&Yqg+A)_)APA#snJix_;@O=oOp4D!5o7 z9*VW|%{%mF-C#!j0-4e_+vl@!HhQKutQ+n)vW8^%;%s4@z?C>YWrNf)H_AsN!W&XJ zX~G}2cDUD(zz?~aGAM&+8p9F{d`+cZ6A+t324RDi&ufonU>#+}zFULX-laU9Jy_%t zWJ6Zg^w$P9A(Kfqr)*EbLY1bX&)jREk>{rtj#naKSKz>X$^^tv8fuN>U{V-2QuVz= zEEL`DVIs+WiM^5HMij0GkXhyJzk69d7#h*^6cx;)7(KArY^($ug)r{#t(yt@ZhoZO zR+nlFYnGKJTtU{Lvak8F2T3-|(|ap{EudfF4#L%g#MrzZ5x}*kZ)rSz*`P~3%yO4h z@>Aomf{=K3SO*5L+WxBdu)ml*oHU2mqlyE=_$iVz%HP1dAkweFX-W%aIr7?Nqb@tW z;X`ToDoVE3uf1iipNed}7;(|6+0qzcWh)6^C1UvE*E_L>QfWf_{_LX-36M_W?&!mo z#sQL*?a&M(ASAlG6P{>bTEj&All=yOzbj~h`NsvSGcd4J?HFLYwvZ=9m^mi%KUfk5fHXE6dATA zE2kgBP>2K54bpxu)t%X0wraC1p%@e^%iQ7_HCximUZ0(-}UDXPC{&kD;cX#*ZBv* zV^=gByPXIx&`3{BzId1%et3JiI_YpD;<*~bwwMXdeW0Lin!eD&^>HVr5qGEkwRW{P zI{rPY>9$Z9R@WGw%pj8{PSb0FKiJx3X9dO{yQp7WIo?mvF#Nlv>TK~qJ3mxwP8I7J zJSCOIs$khZq{)hU{6kK@{Pg_QPes|l=-Nzih~($Ft@m)_*h7%LUCorirQc&^^;J{a z<}hY{*A^sL4l7Dq@D)_W;jL``N& zo8*4d@iTNhpriUp>z=uARPk7sMw^8Wc&vJMcvw0*JjTH`yKdUOG(H)|yaV}aEZx{N z&>6ZlC$St|lt*2#*lP|LUemDG1{ANM0B?ajU|VXz`6%HrS9>DSHV!UZ0rwMnYE;M* zXCCC9;YPD_DFAAr|C9y-HvzcrvJgALCxr7ix-;K!sb}xj{#nC80(D~gSQ12 zSoDYleJ)~nU_AkEh0dCXxNH)_LSd_QXHcR)FjDy<)0r=c9T8eJ?Qcmu{M$HV zf2o`1R*2frytFf4hfh|u+$73+;75&wnenw~$GzSuN(Me5u1#G(HGUPlrD4kqrv=qm zGIfnf*4K)s-<3@w$cF^*q7{nVrC-cqq-jl;2unVKXSDQ>0~@p@Zxov^K*of1sx2n) z;3@Kz9RkXz6Pq67E&EJJ8+PIJ_35tykZ}@*dqMA`PY>K?$As7?PlGDJ18mmL549|G zudjykkj-7_01gmjsctW36zI39!~|f#Z;%+w;mr?x7@cN{IaC1&@)MM+3cVGN?>Lve zF>>e=-$e(%Mw2zYV^xuhSuOVq#$1}Gye?Qt&uyw*nF(w%mqSV-$QQk<0o*!t2R>(? zCrE=y7$6sY32T~8k{&XE{@qlzkEMy%y0>)dSjk6gy7eeJjvjsuPkjE}B>i#*ny?B| zt|ot|z#}fLQ3NaeXlY%#_xHJ zaQoNqVYZ?UXN&OdY|=Y?n^M*nRv66xXbmC@99FIYe@#h=+{P50(eJvcxnce0@ryDS3j>mV7 zy2vE2ZxAuZf{F?ADRc@Ww4yjyPC&w&$C=cxx}9YpkPWS)Iy0V$2G}v2v>ETX72BHEOb_j?)pqx3w>JsGqAwt zOb^ZVVcD=g$>nNLOxEnH%W#N6Wgu0`F)es`@-@tq9S%fvq7rQAQ(PrIfNvx=uCx?x z&l|!yHPC`PGO#3H_KlvzUMfs1PZb-RK!u2shvfHJ=i9WmRrxH1>MB_txGv~DIMK7Q z-QxHQ9qA;HBrCdnmTZzAo1rCax(H7fRvNML%Rwz~#b}#ETz~Jk=cD~cBe4}S^8q4* zoy8>$^tl}68phvhy+@tVTU(Y{dMn{OL1k$ee*z?sQX|}%jV=|x<*-vKpcSK?@~>!$ zK|q@LP@@bb-yjoPH~Z@k+#6%gho85%?zI`b9G8|JG3Bib%Qd;w02o1|OJljF5>jW8 zk?*x*duZd+f;lOxUOQeAPuWLaDU4RKboM=L`Vupj*#j!dMpXLhg?mk_5ULNT7=AYK zksxy%2!~`zi%K{rc`ma|ALPeCYktiHMePjVP-d7UE4(hv_yAb=elA@dU>?oIjxFXH zBc%@)f^M!rSm1!)za=!j{NBDi#i;YTgv{jqenr-qqBus_r~$-ihTbUk&vQc;bJtx^_eORXAE`(GE^Gs8X>Lz6kqS^8m=* zeB4RK6YQ3WKQsJ@J-F z1Kjp+1SX%SNK8zie5C1=y<(+{tO@UXnmh1guj5_7ctCw(_6TX#3;E*mT^91YKTW%8 z7w*#l3dLwd>0L?E?EsYd(scUj5Zof>Am8BvI`aSl&W&(Vr6Z~zelmMB&opc@bCps< z?u7eROpiTBtYUt)t~YBI*DZsaFYc@lS;CvF`B5fxT7&8YP%kv+bHaBrx6M(6R`|aE@n>F*6w)MdX@# z%d`;F25+K`Nnm`BqwV_b)VG8~@p=|LK!RgsJQYbvjLnHx!Pd7&QASJzWf7A)>f8+1 zHMvE*Q25p&I_!dlJus_3L6^5MgW|=xn?Oyl82nVRAK!O-TsNpyHBnQ0nEj0(oShPvKgNK~d zSeJBdJ)z3jScwmDpvHBQVZpXXwlifI+Kh9O;U8GT7YZMYac+JmXm3ug+7YayD+@ zHmUV2;kf@OsliNE*xg{X*?(vgb*vA=`=k04y@A7Fm&FwG&{JQY#K`@30V=|k*!-`{|;{_6mF3?n=hBh^B)$uTm7 zBz$xy&BlQM&uXv)h3PM!f8&=*5%Oh7+kdgY8#1iwa4j+MDF#Dht-NRkJv2*f@rf)= zE4XgO44%#1+U<5dII7!7KPg(3rvd7O|7d2*$%J0eZ%#n#D-<7IG~*$H6Tj17h<5R> zS$F$7w+VFW?FmC&3_4!hyi&9z45i1M|D$N7++8i6)$19_-n!GlA)Y3SSUj$qBQ+U- z+K2tbv4sJgBgD}&wNya`ApWdC$@g~?sl!N`r5sri^_K&;1_n;&p>|XTE2p$87$#xI zE3Zm}vb{i;=j`F%cqo_&1jmt_4Jk8$D={{ZgBwqEit*5Dw0vH!ixxH-2PGf6KLYa_ zQiqi8Sz*(}Be`!04*0fEdgI11(i_eVa)x!(HrFkWpPxTHCVs>p^hvFGaKeSSQtM1| zb-{%ABUWZ)Ww>tvM$|>_=-&!xLP?KvQG!Q8YBCz?DBsaU_WN~3_dJ!tg=X6*$zPo{ zBK!m9+f9uKFZ+!MuYos6v8^w&VWDPS@tHrSh9hhyT8XH_MC~MgQ|O~L%A@nOb~3^~ z<1jV_s0?o;od_#f_3rWz_OC$kd}c8H-GP3c%SJD6rACvU30G`J>E@CogBh1(JHn!uS3r>X4p4#zRxx>!@le@!7Kcxsi$GgUjoQ*r9)Ti;Zh~Fxcu18_gotYcE-tI%1ShbekwXq z30JblsXUIRR_j|~6TT7Wx zj((%|x3DHxFAnr^*T5{4blquiTqub|2uUfJqVq+Nf3((5<}iqXbM5p^KHM&me*ee< z^~|@(uGz~|zf~$wmtm4IV`A9y!7~ikoZ?v8Er!eAh}9)dvz$Yxpf_tRGf_Wyf;0<=x940^xwzui|QCpVDU*o-`pebhAT>iy{&6P(YJ z&t^0Rd92Ww;$Cu3vv^TC4(Ev5g~(#?gX3Pp-7QrR%zr0~BBGvh_>+ZDt1V`sa2Qkj zWh&$!pV0T45iz~}#7)4}q65Rum99RR!-X}NVMqqwVFtMI&}ok$MSS{s*~n&%6?}8{ z2=!)_h&Ufz3o(eJ#XH$MGY=kfHJ8j}(eX)c2;3N8QQLz!#K8T2WfqTjhz$H#q7hS! zqV_!IW~l8$zGdDGOnzx7rOts{ipA?HCUIP+WH-xdAbu20 z7p(9zVlTn>3<&nLi+U&*^AEa%Qi$2+km2ole?ZZ z@g*cIViRRozLPfp`o?^7SH#U>%B9RR z4KhVMbxpuojyt?h`c)r{9>XH@T|Aq5%|B93w;I|BPF9D!*EgOTEks4&Gmgi=Zippbud#1cZXa^`v4G2NJSuGbw)f88;LJ^^PQ7OC1^hV6@W$#gl0C0ZU; z>wARB=Ya69he;RtQICECIa%kjEuHo2__f^Y_YV6|)~>1LmVc{_D}t44=ho(XVv0zy zmUUV6pOo7u$D-d7^5eCGGaz(O^Q|N1J^?7+#%Ds;v$3(zN&|gGIFzobloSQsPlft6 z;Gl1R%lzJjW;9D6CHakNjf<*3P|k!#@$m z()m)ezVi-?7uxTZoz5xB)wXRLi18~b)aR@{w%G%9JFlmy9iEC6d3D|JExJ0vxzB8^ zs&A8$z1O{i*9}b;=MIC*8uFIPhKa24KV{(IAR_%5o*B4jA`RN5_u53|o^IS=ZLs-- z?>J$3YVnD}J?`Yum9n_J1I{IB=+OIHy4tTfj4OXLmcqagzc7@TcKhZ@Jzn(h>3~bY zKfT0+dtbliidH#LF)NY6>lwohE_k#AXK(GbMR66yP9AYzn$wq#m0ZKPKMH2i{#iEvaBZienvd$QCzxp9r!)d|VmfX^S3^uQV>R zyx4wdaliNZ4hsp&PIRF$9CWJB#ro497`l!8T=a~)3=Y^vgki9h>oTT1_tBT_Q`r^v z+49a{h|cv$3bi2^isnWFYzw}{7tJ{O1(Z^#^Q%)~CQ)wZb-Odtwny41p!*w1#{J^D z18lU5PLYRtO#N2UG6z+%s&|Dq%ls(dXXnX8Aw9sOG)GW;IP~8Jl)#;sg z?D=Z&gd|mPq;7`-Wd!|&v&o^|=3HyvV7gbUj=R=fQ9b|Jtz@g;Dsn}o`aEs!9dVpr zs8x|+n6O5EsMXki=VIccgT|ENZj7#!UKnxP{ae26+T~r44m47IR>9N%3_oBt{G0wX zSM5_R;~5tf__35Eg4G(`TaadFrJu5bRBy$HzK)FwtkJO?=P=rQ6g%RID;JPa`v`=< zGqp%J!;jz_%kan%ai;_;Am*jKJNab~qB8mwO&CvjuWDIlq&H(Odq|~f|L78Dy$e{K z&iK7U7E))ixw%gdDohdb`levhK!_X302vN+Cr;5}M*tsioeu%@$yKw-;Gl;z+bt}` z>WWJzBL?aRv)G?278W1&gpCjkwaZuOM@zZ03dnaNghb1>823^$y-+I?pAqD#cWq;;M@MGrd z_uq1*Rx%?tDT|EIi7#<;f~z;Y^??wRSPqR7J4&htCJ`ViHGjUNsFd5_QJ;=+9rzVB z+Q)!#TH)*A3P~Q(r$HsCu5^c=AQOAM^7Ov3MQ`@bu0I`gc1z{8Z+TTN{LQ?gcrkOX zJKP1{%rs>?!arWhQVn_-INb;JnUC4+7<@gu87&UfzDHv6C()1sOfCtRFH4l*j;nY$ zRo)NtU_lQc68A(mB@T5kOJPfI`}kvIRC1M4VFt~PJTixg=Q3FbQUCnM?*^_u%&twr znY{vyEpn=#Mb;UrC2-T-NOm@ZIGjBU#q8QGVv8SvGQXAl&%1vWRC_kKu4YmOq#dbg z=a;*5TS#aY(Dqkry28s^)uBv)sX+JgT?Rs*sMcjI?H`>Exc=y9Nk?*t*1#dJ!W$2_ zA(Rdc@PeNcKgM@mPy1NPjJ}FB9k2ew$=Z~J^=h5paNp5K{=_be=@0sos|f7A{f1n? z!moFD)=o#}`HN%#oic-TlY?EvhN^08g}Wod+<_wTm!adsz34?((|5c+@Flg~~P z+^K-VzxlDU4YHaTP>2Z2XTB|*r<4bo;tFi#2R!-ENI-6IRctSoIN>xLXas^XG2f&% zNs`hsA2n$U^9AEmh0nNQ#AoLI+mG5vZa zVk`~)XlqAH(+eF*6Q)7pCv}&ILLq5QpH!>;756{!o$lF4nP@v6JS_B_8M5cfSueCj zT8;#CR7ZLd9wJ`}*Y*q+eO$1bOQmQ94-9&tr=&A{xqOx)!+8XA6}p26L1g7#SwjyW z3SjxzGNBioqUlh6e?LrdZ#kK*W2&?PfC4z=dw3Z=+*tkB4gK%nVI3M4XCP>nowRc} zSPApOS@t)5uiKukmklL6)AmTHGwHf60TH7Q3Kr)-{#s{$azpg-kBTR{3ag8bD&8)3#p)0%8*Pi6Vdme0FmmfV>kg}1E z461g7&{-HNnQE5p(j|*G{&Hjkbkz;3jcGL}p>%r>x$1M?PEJ<*TnY6*KAaRY;gdyNU&`V3FM*}0`D(!2KBN;Y!jf0dIY{8`-;UaFMfOE zQU4kK*8K&QQp_S%V4B4;wML^8KqME=@ zXYGZ~8jI^O@xTm0ovfH=w%}QRgqX+^>*y6gkx!lRCofMeYks>cZJ@*7XdnM1FRXlc z_G~?pIR*s3n>n5Z0IZN;y={Ru6@yzs(UhJ;c&n1b`Guf8Rv z@X~q;t5@^bVwqBF_k-^ZOj0|F*GR=(h#sFeN6sm}BiE`ns4gsO95!1>_>cd-VQ0I; z)!>I#bPQ~C6|}wbthFa*6}Oy3ZN}qKv+}r6)IFbhyuy}U@)6I|ylDzvl<+QzFDkGh zCuPzo3oHNcc&NfzvVF{vb<{KF&4`3>HnfIs)#`3;ZimiGtCQ?(x`||yJvw}OCK4>9 zJ!KOFodgNFkA#($bOw*zSc-O zw8i)y`#$14@rZ4%8>ivz_i>8@*)jTAZhKh9+lGS2L$PSidmHuN-w@pQ6mAV0r)oe_ z>RO|@R2-T72F$`Ea1#YvX2C401GEzSG$MB3Vaq%_Vq@CKaD82gcRoXig_VQ@xXPP$ z?;gxIb^r6#Q-jYiWhZ;4?C}-)V;@o!ea`zn|*$N>k&>5G=@J;WGaUt z;4ipAzeUB0Cj6BOP3-i<1-G ze)p3t>^rPHxdWbW?fN-MPl zXRtwwpMBkv@f}AbTx-gB)EcCfv(|Q`h-`+|ilN9QX|Y-NjOsPf|3h2oD|?f>F9|1h z56pN8yncAmT)d&N$_i!xbG-h-xUijO3avv~X5>)k==-FJ^H2YK3WKJlU_7i`(KzPS z>mP$jBuy6K)~&Q#sfeH*-(Np-$)n#op z7$bsIDTc%j?7ERJg2vEZ8LC(FrhOzjgCUgC9 z1}={8Z(3H(|DN*4F(VU3ufby^D$VDb$lz)R#!g~62D~pAApdWY-n%v_P@(dOQBXT5 zY6;La-SSgwBO2}4PfJ;{`eh&x#PZZC&OQ8Xo9wkS&jzoe2>iT3@;R2#Ps%L#zbDAw zP@8UTx-wI}YN_b3Rr(V7K1-4H3va`d{2ZcEt(?{(jzdbh#owy;f}~U{1gd8tnJlx8 z-WJsKm#8L%-Ei(cj~h`T`rT+h)g`glPc|fnQ!lb^>J6%5 ztBv3DLxi2`ai2WD{^`jUGhr>>WjG~dnMpL^++tisUQB2aEuwa!;O!9vDm*yadXW8v zfui2$$h5Ti@WZt7vG-=tVyAw9csulfwrIz?+pPc|@Haf%tlRYc-~pfbtzd_IvKh;< zM|A68`*i_Btl>Wr6?KZK2J?>%_)!5Mfj1n!y@0MRqy!ImO(ZEN0z+gh7Hj2O7P>@= zNV{Lq)O&?BuEL@vl+LpbUPnX4(W_$3FiPiweld|0I&u(Wsd@U!Uwg`Y^xsz~M?vaq zo|1m%?-a2jBYaz2#+dXNx_Z?<;bE&~5pt@#LhGK~t79kiuFEWJV|h=E_WK`-y`Sb~ zf4^V6`?kc>$0}bmkmu0?dibusz%fI$TK)^}5iO;s84hJ}zC*G33zo|RYw@I+?WcQ+ z+ujsJC2%?EwXiX%MDXlC2961V#@6|pf>8D`M27|Alu9>&-R-2;%8CLEC5*g7jm#+n zL%$Y`tg{IISva3A^J-z?e-;{1z+DwucMO)qPB-@#K`5aPpG%-#>P&yJ!}!8NDnV_X z*neVlRzSi_iB4`vZ5J-v&nkp~iM1swy&Bdgg|+o}mD<+H1U{+1!$JjPLxtP3xo4mj z_|RW#Mo`HWX`7(57<$fFhL&q*^tFzg|GGMmOa-) z$kYv5C6bSV;%i@_pfTrzUO3D$i+%0~+x;XBe^&Z=Viqq(_2GS}WDQ+tsC|MNGloo_ z&}()7C3RpD^wu*BR`PCDaQ)4YSI?ih0LM3Xky=l{=S#$4}4z`5;H==yNMdP?i@`d z917Azc|(P=D$;b=8f93dhHTRM=vO|IY%WT)bwlQ#K(mqcyEq?{0N3CCQ1XwW)*su* z?7#I^7o{5t;sw&2qP6i$`_Z8D^{(d*Zfg!sfcPJ6)#U=;P>5MBMNw#Z!esPo!ix@$ z;jl^dSfbW=;3MO6+qR0BOZOCXghX9ksx;2(^zP%?%IEJp$?q|~X{L&NxOS{Wu0F%J9}Eqd)xXz57UuYLq5DAq)OH11mOj|6vkCbDd@ziraU60qLRZR_@Vg4 zRJS7VZP|jJeAH?x@L!gLE5sm6kom0@iq^XsW;xzeCN5TuiJ(77f-CSd$;&byApH|W zfNjNjBUh1fRKlnMl>1uI$=7g#~uI z+95R;?hb=wO2{9vahm$Dw-~6p7Ik^z59`E&gDy+7l$Pyf##2z;11kLI6DqFK3fNk- zRJjI3W$xLfQMd)4E_2XL_pC)4Jn4tu(d`$MNn-BKBiL_q7grR13)TW|IBNu>rbcVU zed`cqUrLJ{Z;xgt(j=H}6|)gXrk_n_gibz=XUYy-_@1&A6&%Ak$t7(I)PwcF+Qb!7XJQ3UW^ z=h(V?C+2fM4OPxh5u)1Bp%0+1$ZuZFASj)QrA0fMV?dOon=KHD&H8X;{cv)GPS>gR zdqhEiE_=l(9_+vkj z+;mV8cSR9vPNtJ~lQ}XF*Hz;5ApAyCp(M%BXGd00)y0J+j6qu(^cFvU%S5QQm!yto zQ!$(-P%-S}A;+(Gq{IW-EGi<%h(FjkRaL`hxtwP$+uF*se$3Od7Zev`n3rzcOL{<* zXh^)EY|$+kp$si!qZKwNiALNP@8I)NoGKnHMD1&|w}k@K<)lLm<4j;U{^^7E<8&I$ z!;cwD_Vf#wsEs%BT1XF4KrNuhinZ3H^b8RYBdeccq5JTrlnoZ=_HF|5k_Qk&utafT z*^sjbdw!?us-OOg_TC(d+t3QkM_Hz*O$OO>;qZrcL!ya5w)AW`GN+U0>!*SSLbIDx zO<2`x*!RvBo?2Poa7{2Z8rhuQ;c;BzhBLkFrTm_wPZ@)EhCT0OQjzNbE*aU@NPRFNfOo7{`5)>Qss@rp>r!jMO&yx_@8uPYEvFwLV zHH|hbqc$lusCFowHIM~CKM%%RMt2Z&auA*vWRzZion164lKIi0G0WiRbeNgw@z4Uvu)5dQ9S{E+LoZ5JccfcY-8h?g7@8-|NND{!&?JCDCq> z7-POdjB}SbU7yNUpe^RTa~DV{zZ9IRkQ8;I@X=8pgFRxK8j?7f*D z%pq#BSeC*8RdH^({I6n>#RaE>q05Z$Y+k?Yd!vwelru zntI4pi%2oV^iyAhP?=pl^IucSE<;@W1vbyEb7F#r5{MI5C|ym6DzV2S?5&Sz&AzO1 znrVFqX=O=a$eRoE=Z$RggS5u2j8Y;Vh#AxaCPSjq)m<7z5s{bA{lhhvV-sfGN~T|m za76BZ6wc>%&pG8yqa3ov;Mpao!SY7n%6ml;d0O7se@aV>F3en_F7}2iw4&$mYq06D zq#ET%^81+QB?3Jo8^!u`TR1Em5OYdi%%;cDal&H-gV2wS_zbYAqjbMvr z;!_Vs?%UV*_PWB2-~L4fkZ? ztlA%XB1#s@h_ahQk>1xYALmlQlQ;ft;K=zr$us%zDl}iQgukt*&DS${>iuXeMSJPU z5U%WJ!g{6s;F+x5(<>gOM!+;-wsMl}F~5Q50JIW5@*2E+y7Vmza;j+v3;xWW!~3NN z9D*v)bxBL&`60Vp&7!#zGGlVat-B)$a4YZ!JG8(41=D5>jrbN}o9CvaQI`)*Om$th z%Lzrev{x+B)w<1{5O!zXNBYgtMZ`s=Pm|PXZ*vVYuLZD5Tl>T(*+_GBv!jvi!J~zZ z`%^UDGn%I9=i`nQ+nuQ(9t7~T5*@HTCMw^7Gcyl4*u_UsNj5k3WpyF z{&@K;es~s5T2R4s+%5#Ce*Us5zZ#2mx1B|aV)~Jp))aY2LG@^FMI=d4S|drlto*eM zF5hC&w3@4QvfXXS|9bCzGeOV`03zMy6e}y5Rg3ZuI4m91qjMgvzT?849ZVVlbTz{b3kdDpK02IpJ+Vo&tot*cdBWI^&-3c}U&OC`iEL!vALAbvI#QQD zNovH=S}hs&uTyh#3yp#Sfaf)1JVK^P%y|ES*Hod621DH&5!>F#)B}vou7C?Hb2T(% z3I_gL6$ruh3*BKfWHErh@!&X3)Jrlv-BmwZ2v{xHr#AnLH~$IhbZH;iG+Coy=}00- z#8O|B)ZQesK2blHwSK2>p!6mGLlY>szm_LReV{wCY*WGNQuL6O8>e6$WzXoHC)Wtk z{!3w~@{jVxWa=qMXjw(tS*r_hz<#a;ZoD4pgkaj=2^+GLU#6OhL40V^!^JoY&Z0g-wUw-Upf#T+`=AC&6K!YAi+Y zIy1RW!`9^2ntf`X_8#_uRQ}Do6lAzkSJ3d7>XPN{^NW+@_ zC`C0@>D8=mTpcVl-qNXn4GF!YoyzZ&O7<&OLAhccGWGTv*HckupTl99EYw-VxJ#J2 zxi!9o{DH6Cl3^ZWU$zPPxqcbe$+NRN>OfyLeAcRoZnH0e%~C@YmyVCr&(pHT6tZEB z?Rve%0C#voj8ukadI$irz<3LdU*giW$?9clc?Lvt`q>uo%>XkRILd1ex;=2r%-$TH z@*aa<9vxfd2D3st@GJ4=Z5cG5+fqEPx8YwBTHIN|*Y|JAX^(zb)@^5`XN(7ZL(+s} zQP*NH95n52^|yqv zS`8WV8%d$dGik~RrB}*y+IA1bRXSG~G^V`%>+>7QTn|s*X0B7U6&w0`-YqcnndNvl z-i_KFj^0uOP^+{tLf%{(NO8KYmSWbP;);(Q&D*Jtn?@GETBCRs{>jPpW@Cv018>>q zi#a8v=P_!>{lG#w>BwEILYm)-{&>w(b>eV}?^TR3jTL?(`>Oj~av*`GzL|_dqBK&qZGft94kP&CCo?si;-#u>!yOz} z-M_$S-VaufEfFlAL?G3Y{80Bg!71u3-R-w*O*dACysd4Tt$u1@a}-Q~SswDZceoaf zjHZzhjqnNtzZxYnEPx-l^kH-B&dP+C(XW$P>Q2dMcIO0e!=c7Vk*}M9^h9es!Fk;u zq+HY@7Mg1NdZ@xGE3zW`rVlTDR!2sG>P&W@!VPUDSb5?bjS?(PH2hUOH!nr6@wji@ zTzfOvQ=N6JP1ME2-G^>5v+Vx#<1clpj<3@^xh;V;T83eb z$<5u9G9rxAxk+XYp-^$1oR*Q0ayw{AvASH<;3kN$Fp4`k>chbE=-^RpZ4x`lqO)KM2A zWSmEJ2GJdd9k6O>{_P;sIQTazKMj$Bp9JA2WfwuL3YQ5AulVH4qA zPs3IV=6iF7DrCj|L{Lc(^0{k*I(|hDd9R}3|GVz-6+OtUZJHF(vw-)BqgS_2vY|`= zR%1MZ4PLp2olf(@zJ{sHxNCO$>3u#1xa^#ov$?bIo8bQj^U3-6;_R@DGZz;o-i-Zr zize}dE%=<&)r63}tee7Bs$Y?$t4*~~TupC|3W=N;D(pA`F(x+D9p6>ygn7e>BuFXI4RHKgw^mA+EG^1fC_MY&` zRrg-p)gaQR_FT;e-{gU3=Wwqn5z4#4XJe(IXCs?}pAj#~qKw9mG;cJL=~Xb@HLh8! z$jZGIqw}wvOB+iwrfSmSysD*l_k1we_JVP5xZ^x2hY#uDm%Gxzf3eM9RX}`b)Pwl!hrwz|Z1!QE*s1L<`gs>Mi~;;uxRoi^v5To*OQyskVUS^t7@Lmw zZjDI2PJ(-lNweE-kMU0dUb|cNE zN8#YNK28s11_CVN6ya=2K{SkLy2VCc_}qWL>Xq)Fj@8c{ z52HM7TC=uItiJSb;^kCWU?EkZ$SThiB^w*OZ(y=mV6J3Sdat)A;MEhce=nOLPV+)ql=N#3I}{1XuR$ukPbjy|li=Ca!Jg z-<;{L6_FrD6|QtcO48-|ukgr{kdp}&tq5&KsfR&5wu-@}Vc9kWnBEPI-(H{iwR$9=^-KlgYY4#{&goznq54hPE;Yqh1+~yjce9< z^lzo$cXhfPTa)T%iJ`B8Y~*nMMb?HAk}dntsF3DLk*E1f!8%g%6*VcJ$%`}+%I~Tb zZL2czcHxB6cq;`bVC2+m#g|T!5-;qQ0Dru5e#dm*AvOFcXV&1BJ; z1ScyD3^NYp3ZXwPFL;#(sgX-mjNojstXtBW1@LCfx?egjYm;jDYh7ygq$sw2RVH{) z*900;Rznqp_lvngqAP&CH5COhajZ_)M8#HcwQT-hKUYs`U`=rbjsMSlK0| zX*E%3J5q0EXY2}~Fqg1q#(<2L=T3*wvd3)GX~25Qneh01ZWJEkysyrr{F(KO+7>-? z`=yOHr|E$@1zD?7PxZ5M`A_bIn2&L_4DrWtu;#6Pmp!aQhwf#WH!t-|FLg_CFD@-F z7p`?P3Dj$o->jJk%bW6=Cz%FWHQYk~;K9Mf)pS^Zog{1)^~l8!C6%_{lXS|;3IyW5 zREFLez(y)=;_TTWe$eRuU_Tk@-DFK#yI1U|Vw61^kLw8F?Cq`n$^nNIM2>*rekk#5 zbjA@6qqM!0Mtd_)3y1R0f|Qs1_=zQUhgx z9D2?uaWuXCvymVygI}C$>|MbB;mW(NRO6Q>7_VH}_!1qMJIVGNRO~#noGhZl&@d5k zNYr(AeY{YvS~`@@9!%ySR6zMvs<}bH!n=gCNR9IXEWP~rFM(BSlv#4_lPwVajW(pr zX>rhBi#GZYlXxU-b+rAe{PX~xQ{5B?LGr`Y5eD;jPmt*4^~#S(3utN=WPu#e-(YhL z|MY}~fs!fftLRD&qzx%0m)Y$u7azSD`deJ+xN~!#^6Lq67|RNF@J@}V0US$c)g`n| z)X`ek1>Z4!jm%!r;^~7%*>d+#Qd#%m0Hu9CYO8Ei3-F)={%GK2Xs_Ft@hW8@qs6l% z!fGq-9B}!)iLFnmd1wfKK9sFkfG}LoHm>0clEwzH@_e)~Dy)d) zlLm=xJ4wMZrT?qWW>2hO?_F2@luMO#Ra3Nd>3m_qy!g6z&oFT?bh-xsH^+1i$&t-M z75^Cws!HsM%}RAB|3Kl-5G-1;Xl%#m3TxQInei#0yB)Q1?EA;zg&XN?*_L7r;va>Z z<`!RvwsU1%bCBTh`3uAmeMqQs8g*mDz%dmsVz%^|4bK)+l=O+=2(v~JuzLRCV7Q}T zy~>iVUy}%ve8-T~R`Qe#$1kzg%LwSP9^@xjQ#A$?)n$MACtQUJz0!dHb*8iX>#fN7 zz~!mdqkH>G&!0Nlch!~MZbx)B&4&|K4A8{hv=gONl~vz8h&Cf=kaxlio3*{QwpCDs zQ58*jJIH?iLvHLYXtReVur%x)Dxc>eXB;n}7%cQJ_uBpFs>ZK6{a&s+kV|eH>j#8e zvU;@cG#~pj47J=TG5mo?gw%`aJ?t&#IlL<#Uye|+)_M;4(h`pN%mS>S%SH2!@4|!` zG-CgE z;MVwe4-GXrq;J-ooQWQjw)`NDj{tYf({q8HILfLE)Thb{-2;rKbzndvjkG@@m|XQ< zGA*-b&y~5)pH_M|SU?9V$*?N8nC55xT8!*}PoE`acwZa>Ax@Q$GCw3=R+&qBhF{}K z*%kJa0kD|oVQe_-RB!bc_Rih1_&0Q*yTqL?1L^bTe{;x>Z!=RvpR3K;Q{;9YW_x2JiORip(jGJ?-0`HkvjybC{{61}S ztA_KbQa(0LzMm@mYGBy|r~ZAeO-1CQ?m$~(A57_6QuG57Px!I6$otNrHQB>GUHw1x zMBfX(t3PsGV<01L?Zjj+xA`Wv^@2;uZ0BUjM8iNrBqECn-7dm#lq20Ak6%<2hmmsN zduUR_5OyNoKbx42MI$Op$a-FFTGr3r{DBL-BhQPY_IP*A`9$K-3Y{r2i*PEfL!lP+SnK0jQsc#o&ZCr@!p=s60F}U$dVgb5{%-+(fFkp-bW?W zMk%v-GjRS;B8)S8UgMYyKe=uSu6`aK5wE1LVbX>V!`B4K^#HApm6!&SW5S_4sCjIe zs>+3r3|M^GuczEt<^01B-d1QeZVgUvpOb6jr-TyrUr?)|A-k-U(YDaP-Eyw+vJ$p) z)u!=EuaX2N%RH1$S=BkuPE0^1*GEavn~e-)hx1m;r)tn@ zDk4Zn2s#`W}U~3oJz-L2sDJ*xFzq`$je2n(exC{I7 zECg6zj#`$&w{;AwpQgTE{~NAHPYGkNz|+Ze@TKdEoq4G}g<4j9Y#pfNPEtrzBw@=7FIg>E z)5@-feoL$``!FJ>pYNGZo5?=ghxS`$ujX{IJH zX+lj5^Fm<)%occP8wNSoYZLxipWr(dh=+t9gh+M8(X%{LFT4B?!cBYP{`c4U8gUY^ zSI)A76C?&chN$oxqk2h7ai!}Q5(1*F1B**3Bpv?uZ}rhD#`jLP5c#D!B4!U~*tiQ& z*BlzvXU*|p1|7}JTsqBrib^B#tQIqdw~CZzrC5S30#5i|%+raVH-$%Ds*0Mex8pZB!a}M~?#jwYoE53E@LyDw%_~5jbS{z>66}Q!VW{e@!&YUa|h)1@G5K zH-`_ZSFG&d#w!z-E1Mu`EmjT*_t8E_vAf%N)2@x%|HsrdrT%M#TaHX+W3 z=;zzAh_E`3?VT9w_Th)`3SM;$cz?uDc;qNrt-f=Vl2{`fA~{Dw00Ck|ba^l*5);h8 z<2NiXOrd^$+5-RjZ|S#z*=L4y=ad%2(Z16 zBsx=8xpZj}+(YRAzOlYIOObCVCtIsgMM7NZ**OaNkb70KfhnI({e?e3@iQ@|!G{Px zwjb|me<*pwA|mWgnoM$rI?P}IeFt7EsGKpbe;w#Nu?h6v{pw}EV&gekfVik1RzAp& zwjanXNDO>qJ?fG#RejfE`}R5dv2}G}i$q3aq|+Z8cyd2Yhg~?c<_xR(teO{HBXjY~ za8Ior>oirC^tWVPOg-5yX3Wy_VNE<=S@S1F5sH!RM4n!nM2eBy|9bC_&{UJC%;{!e z!pq$x52xDMDGQv#I#M*9dl1(JQOLj(Y>4i!x;ymbt|K&jp{ZNY-ua<;REVG+8})at z1FF8bKwFDOto)>XHe>N{{IEk6J!o%nl9Xt>+Ev|n#AQJY)?2H>sYZ|O%(%KY{oq?G zw9rno#a%|KBxo+?ps#!6aEY9qLpUMrM9#`nwam$8ZJm1GiD9t+v$MPU#I3`OU>aq{ zr2P-$ncoQYM2YH}VbC=Gf}R0l18KDS8e}D`NVNLkZd(Jb%59ItO-fnLwH1-qPph%z zpz{Z!XQJ!1kYPLgVaz8w&w5mw2g&cdH-n1YCr-;JgvZXh>g^Vsnq92x-(1@wyL}|;Z6($EFqoWDj_ECtXX^_#r4Uctq7<%3BZB zj_usON_|>g8fPx$^mxa^spOU2M|!SB;}|R9fK%5YBQ_V5&zMnB)$_(dTG@^jiNU_~ zTV4@5E{nV|%UIEpX zB3uiwT+Yl28}dzG=96W4Xe^P38JL?3CY{XVCHGwMT@^(gJjg;mUT@DjTtN{P+3DX#;1{D#-08n{--S+>rN$bHWRe{{tH?rC zj|Cr+!Ox1;*hjzWN=F=1b^ya(OqE;AVMb!}OX%>!$p6ks{gvDD!{th z>#>_wEJ?YX*7Cd8+}wwP3eM}}+x%1taFylE33J0mjH`2v2==oNW!FIgq0RjEmF-)) z6j$sk#A)U%X)(CIXVy7t)KacB=k##(&JEqmvpKytbsovX}n3hUS+d2aF6 ztPN*&-&|$)fgV{j$4qdKl6_1;xikgqbrG<%&9Dcm3`~oVsQq_Is4X-RmN)AghA$jF z-I9j0anHpgW`NPM%g_-supXbQXi_EEjBW|>j1g}KD^i|oGftKBj$nBSYNUI0q}L-U z6kxBsy<0y-1qQ+8Q28?f+p4nmwG;*wyTpR){%#xM-9&Rx-E+UFc3o&a(jxlFsVN^& z--u!wVlmUTw29-xreMmgAmeZNAq%qo%?D61-N1OcY=Yl;j(V|SVro1xyfy9kc=~B; zSMjpe9NxD9BUP?Ay6$Q6>F#}{sku0O`Iob|@N-_1FSPg059{Fy%);F}$w7pl&5aE^ zv%U4oJEo4Ubl9>o2X$CaNR-lipfW_vPtqDK33AF>3wQ}DpX?6LB$ciatDikvgpg*Z z&OE6_xFw&(5())xOb4g?0tG8>Cx4Gi&$(k`V)*MiC&oPHR?n@>b0>f3f&dEnRj;0C zxO#R}wN_?_D0(Wb44?E8?fR{jtQL$<6R5|jfRTBo`F zUGYKU)8BUH#fDG~P$P+di%rnRi@InCebi3Wct3rJ+nSicZhyxC|37~cA41W6&6Hx8 zD3E!BP8CsI=E`lBNq>^W_{GF&@TO94%cpl<8Oqp(O{N>OQbB?pqy0`KOL|OjG^e2B zS&GCrGh=ZSImg%Q3ipHjN=!1>(b+jN0UaVl$8LXxb~BLhfsU9L0b6gxNv!C=K0b!Dbkdd*ZtC~%4+S!HYKP42au0b6* z>PKw%sRg+6YXH~rODj2#L&^;9zdi5SjCRl?Va>GTIIoAF`73AR=7A|6nc@~B|Hn65+n9KUP3z^}(?KDOdS zlgQLlLEjr$UgjJ@-+8kZ0LzW8ehY{k1pQQE4gY*^6{{ru=z5v=!J+hW^?Z&E$z*$P zm8J6|7u}LcF@#IsH1azVGCdi^&S^GNc72(cnE#Hwsq=Wp;^1YxBzF}%PWcmA`)X6@ zgT=j0i`PoY_LhE=G;}EHH(`=d(v5oNizjYaZ|+EYHWWr8sXQno4DJSJQ8MVd?XBnj za|a-dqd%vLuwo;gMM8zn!WNM`=fD?x`ogwVm(G;B>!nK5l^A^TK~mR@x$7x;OvDOs zUmBy3K4E^UF2;;1XsJ*(t{>_KEy9RZS<%+3gw~WWKGm@#&5i)*%-`lz;Ksjzx3rGk zsO?wPTil6K$&g}oGH%ulZga|qL~9Z#K_6FINZu!H(ZfqjoU@N7IrE<-ehAw76z~md zi@M=k9ztpyjb zVPNsRX=HEF3d>CIdmW$8(M_r@#fK+a@biS;G$#QfEGM;C?}7NQjJuM9|H<9cLX3RH zT)9P1-8D4uQ<3>AoS)z`T*RcUID-g=VW})Vgp9Lc&?WOWM)DfvTvrIV%@9jgtZamijGNYSjU8L~hW@OwTz@F0OK! zEJ*{f5SP3j2lsaOm*Ij(F%17SAMQ11Y5$E;uk2@(Uh4r`dsD|ln~<-a?R1q28>+)J zTFI=g1Huz600Ry=9))rX3rn zbJpW1@!92!#uE5#3cf7pFJm!Y6y$zeN_)#8(lZrul(1s~uX+#ryqIgcqC-&l?fV z-T$TN%sy?ltAS`vJg2=XBwl?3dNSOeMoq|CTRpYS>wGLsiWJEem8mD}!ECY5^0drk zC_bE<+V~FuF;oF{PdNk(xf4I+Er{6P*(P8T9-e#P^|xqw!}47FclhmTC)My?o9H`+ ziGdP;NCHZXhvZVk|NVjBReJ6owDJe6ND$b?5CIgDfNIBrwChknlnLu?=B|ug-%Q`< z+uf~)NiHOdLD>O%@3)nc?0~T(-H%ZQnJLU{Co{F~b|shr9kTkOiH&8(51!ZP>%XA( zhFqquFi&;l0!_adcq3nTHO!d+IVhug)+%ucN;@Af@7gsx6I9N39CV*fYH-{oL^Yif zeO6r8br4n(;pI#achL2uxd5A_ZU@Uk^*EgR+kd^1-l7YB4BxW}a_dlpa=L|8X1`T- z9e0d3CdgrEgf;nDlMoK|&H-2QUjoz6Vi7@PhL$K}R~0XmU7 zt66f9BPcELv@R_G8CrPwy5H<)8BBkaTH3ow58cB3ip60%iw;*D8TDt!r`qHPkq%ko zdfP(cOnjTepO|TEG&B*lG?jtdVe(ZNJ<9AZ=>4BGiN8s7z8+Fj{ghI!7Oh#iEBlEy z$^(xw*G`xHhLZDGAJM~J)ntk99XAEeL?qy(SFLkw6SId~Uzq&{0|%>D416)&=c)go zE-1olCBi=W5QVqXqCZ3DU2A3%|JqQp8=#)Pl7E*&BzsNs+%gmGlW&A2DTduT}*FnR?UGY-LX07iG^u#X;-En9jH>{>RnQ z!Q0dIU?jcG%N+~gWvJJw;SFk~-Xt6qtu{5Hgiz8^{zhj3r!Z4H6JZZU0sq(6)75=Q z`rZ#O3xt`DptPngb4_V4K^y!oIxbCos`=P=r#qxlJO-(AjYAB8u^2$JC|Q#b+ObT5Fj5OB+`k$)wNHpXX_b5rQhpdTKTu$Z6NJM5(?Nng9EePRcBOi75Y2B2flOg z%|1LGOM|D<7M2$r?46%9V{Zx{>5 z#klV>7h6pqnRAza%TGhJSx~USXQkgErwuD~aGa&*?tM{pD{|z5%ld0`d~fn}t;6>Q z-FUg>Aiy)5tw})N#s7~1G(Gjr2Ds%nA1TnKokj0?h@|X>6SY-hrP{tHneWiKkEhxL z!LoLXYiqGh9Qv81VX4Q%(oHI@&PB>`zDo83JaoGb)qs96*E6@`KP;}p%Lt^VpS#Zla#A{55>Qglc!lGj;C6p#hqwdaKYSpxHrA6i^ z8$>6&3ujaxTOC!pFn-=|*9>diAVoU3o6uTzMuqu9LKHpJZJb9gyeCHkx5uUSqOdk0 z;^I*Jf*cNZIFz*2iZ~+0$qETz2oc0j232&5jbgCb7~hDzx-FBYcf=e05GY_r@|6l+ z_}9a=)I5GltXHYTV~3EmiLm^8EO%u$0TbgH48p%|!?>k~tPg{bB=7f-gh7f*GE01D zJbPlP=?XGk3cFRZh7sk+&`#9zM_$)-xT@d6e*vE>Kc2g7(9R>6Ce zq7*bW^dJ)J2=A$%L>Ie3Z&Y`8aN(R2d+jg@RdANW8@x@>r|fIQpT(ZU201hQS#U8f zM%50i1A~;bB@b@S-diS90fR{9Gr5XO@h}^nSA7nZ(lbc8*QNv> zZP>C;g2^f;4RBR<&uC#wYV4(HY4(^2rMJRNneyp7Vm6`3{L+yhqv5Ho6SY~!gGn*p z;(@+<$S$@`p!PE%0NPRN9P1FMP;P^K+3YUh zWWfr}_nttO2_fwa$i$0=N`%foUi&V_`&0k;+lwSAyXJD;;Rc(a2K!|6t1GWw zUrBD8wh=gj32?yTLBJ9XZb6|X4^s9?OEw~e8<0S&4eR~xKo~+FHN%P|`duLAXkbGW zJYo0$AU7$x94v+beGusvZY4@|GiCL59lw)0n`vi)(1Q}m&*gX-p3ZoZoi+U*tWS|y)lVz)E?6xe6IgR&hqqZ7EbdaoP z?UHArq*MKqmEqtiH@)A!O%~ygtd)1+Wyy-yJ7SZQf&7ElI}X8`($pQs*_11Z#Y~HQ z7V#*EqaGhvrD;;B;7n_s_mUADg2A&R|CcWGFZvD7q~RVfkZBPRe$NP8mD*RUNVjXQ zwWQP*_?|tC|6`s$l-Ppj=0u{=UtX884qZC;&=pd0@_23d2lr~ z5Q)4dq;xPp!ctTRW#Q55ZYDIgdI0K&(YJ$XsjGD${$!vJJoQ5>Wb?MefQv%sam{%I zU1CpeK$gCh1R|o`hJe?T7*c+c8#RnVYFl1!8lELBjDX64tAi)k(0apja(!E*Qbeb=*q89Hmo^oA}n|PH_4c8rR z8C>f!tyftVfYzV4G4L?79opc(2t2&GVYi`GkfnN;pH?=B3JBa*WHctPU-<>@iT15l zM`E?Hk=3!WU2p#>-IF4VGHcf=_nvRg2kll@v;|@QTxESIjUjViN6?uc%zr4V%TwUi z)RzYz1b!!YwMLX=Cx4vaFN&;#eM@}fu^852?x6RDJ^~nbMt!4gknDpq=YvhGZ6>Ps zCQK9opVr=TKPV&#LmT4TFXOkwi@n+-o;^=lNfM0@i3F;TQfJ%`Y(f=$5}g}3$9+TV zQyR`b@9i<{#ZqzRtr~mzkSkJfKO8uS&ouh}VVjl>>W3CMm4aDD_xh&`Oyy6hRZ&}p z{bXPKPIt8>ZL^n*`oKMQ+`>94dh1LLpdk8D6u(N~Fo*Si2)JOLSk0S2WmFb_4J>3$ z?;@u9AtdTTFC_U@vZdESinRJwx;%q!8aA4HbCQhu0S~=3>?n%2`e{k)|u8`RFbh535YE( zpShz9v{cI@;vL^w2#j>%E4QnJj{g+x3>vYywqVFliefg~Y~C&(Ac(MRQ$_oONL%-D zgUu1ShAHd^C6*@`j*$|ZCkx2+%z1(oLo=XSVS`KyzA1@eQdmKR+n}dx`{3-5%nCRW z(Mz?Aq5X4J!wK4wSflh{CZ{$n9!~)}$uf;P@w@43_3OnlyM;`|JjAGAiz)8La!Wu{ zr-*-mR5xraSGCbl4L8s{_#weETN4zYDf(Ru2LsJ=G$$EvW))d_Q~|AJF46OrjhsdQ zF#HduA$Jh5n(OX{3@le56Sc#ACqkVH#JR{ja{h3SGwP1dA{70|jnG>hwNf4jtC^Ai zYW2EW)-%718)?8+-}JSVqiD%{Wh}k7tc+G+=u=Szs4!z~^($$44aVE$54;>*OE_gn z(}^q_vP|t;1mF5JpK_|7&CFfdKc+U0dYqm!5E|v=)9u`Eaht-w4MwA~RYQ z89;Sir&U=>{Gl=jEs`Vv{UIOq#%F3ZljdACwf@QMLHw3NPEztl(u#mK88Xa!nX!D@ z?Woiq6J;Tm-{-s|0&cesL2}kA|AVPvJoGYl&b5UpM;rW3@=3F*$7=*iKF#$+W5~AG zBJAh$Z%NU1sPNl8p;nl=ytJ(OgU&*qbVM|8oJ`?Db#WCF8 z+K)E#7QuuGend30pyO_G7kKDs+sPu-hf;ywMjwQT@^U%fcIlvH*fd0|qmU{TkQa zYs0>buD9jwLr++~|V^D3CF$;_x#egF6+X?;@5RKKhq_&kYos)WlmJ`m5H zcZt#{4J>0b(r9a{n3x=ly&M`fTU;PMShp}OiT z)?OEnq-zFWRsKJToSM}eruu1hz!L2Wsz}H+2BQD?&T~{7_Y+!!pR!VDdpNMp0QmD~ zmjLS4sG%lBQ)N}0Q-!NZCN!+d{7Ay;(axUIDWA(o=w18i_WJp%_f5%NdB$SwdRJ=K z*xu&M;3?*PgwW%q+S#H4dJAW=r=@xZuEKnA{-400pr_{us`-Z3+EfXM*X=r)G!xM^ zhOmDgey&iFYP6;3MEHSOsn>lVbRBza3@1y7=jj0ea751Nc|yymvKq($-;jj!w7S&4 zV~qW`q?DTN+Nu6?E%1`)SyTwYo9su!qP`{%JE4C8W3`{+^yW)JW#=gYmS?f8hA-R`l z^XN$V&>#CP-k3o?yBFL6Z0OC}Tcm2Q-(VsaVMh&mhf5y{MmfrzcX(~2D~poy-0t}$PovK{@E4sS)r!P6Fyo*d=hF8c zAMcQ1i8c~c4xTo>*!5W=kp9bwdpRrgTY`%0P=T@@gNj(FXpAHTqA^*cbt8$)Ky3^O zWkliasKLBJaZHK$-{||n>Yqe=D8OZ||CeQ!mae5BiDpWPOAyGUD5P3hmyuR)-)sSR zcm^!H-W~GxOlwQdhL{bz>CIz@P8#;$9F}* zPSBh*hQAm>D#jK?N|SOU9{pJpC}D+JOAqwkrLw}D7lE`OP%I8}$fEs+$byU1qM7E( zz%pAzg!2M`tL=-Z0zI-?mH9Z=4ygYv3 z9EWm2b^z}hiQVHoT%e?=KVg0^Dtc8xA8AShdzY4uESRWBP|C`cxt{Kj z*9B}7$X+j=$VVroB_F)^ap<=9fLlM(bn~iw{$fwN1cMaY<1$&YaV&vZr^KDNh>f)+ zIUUh9Oh%6T7AcX9@C5^5FxtU^=IZtri7daq?q6duJrlPpBMm{-PCC54R$w@pKPLOd zRPj0CcPQpjbam{_p99B;e7u`{H14d=IHw>hZP)m);K}Xk0uOh;V zLWZ7Fn?YjF1AZm#Q$^>7VfAD%vvJ#ubix<&OB@o_C8)*mG=WY0=+^m z3eWlNaEz~7=#xCjR}M->MgQb6K?l_&2poq|g53Mm<J5W#bj!515PRb=MV zv?@XxaB>1(9>UStU5b}ylf}btAQxOopJnTTxF3F$&$Ef7n(#Ol8_ZYHF5*a0f6L3u zRSbuJx+ZJ9d<4*!%nCP!Mn9363RnxC?uDcfFg%`PZrLJRvl#*HlT>PkF_Tv*P;`HE zM&;1Y_^X@u9wO%RGtw{B(^3b`#^7na&J_0F>$Olc(*}Y@*uh=w#Q}W*E$~{~dx%>i zTebXU)3ny&A7H{Pg39Ip;Q}azWGk=Qkt8rKKu}aqQ#}qD##6f1Sz zxwD+yu_;MGhfAqdVI*V*AatfT=qJ&u?zUt@+MPOLW(>|Bf=^Mb8|C{+RJ$*Jl>rLW zid7SvjOYSZ6osm#PE3m&9QK;eRWxm4RVDTyX5V6|Oc*>bw|_Q7>~k)@-POUDIf3bV zDqmQy_6RPd33qs+ziRxsw(9)!H?lg;1Fq_Su2rT>70)orOd>UTNjeC5%PYSi^2aXO zOW4U%TNkWUw=k74RFK6=h)`%(P8e&5iVpKnZml?t>Kp5+ME(!iOU|0pSZ_sQG@2ss zmD%Ozr&yQ#`uH`pF|`*rV*lE;T|Q>13@4lMiFn*+{nJArwHW!afHQo_T!<>U+7aJF zBIDObR2?Uw@>kgCMq>;w-986+e~Z*r#k_%J~;I+P%`g`)jI3dzjK*>MnGw? z6mw%kn|dZ|q4=aos$&h8{m3IXFJ&BosQx)-8mG#XVH%Wh$O~%(ZN3mWUODo4xm|Ve zjU_ddqgyv%Nf&8Euj|-Z5Sdo~jvLxm3RiPiRmmenw3yE6PZ~d2^ta9?OI2hvoWAV= zz$ep!r+k|DtrUq_k){}26f2^dRi}SwCecQl*1zDVDu;!q)-%3`LoUE@?iE-1a(&iXYGJdhpSV#++^=T&B43U zR6Hv7*Vi;Tt~A-(?V>o2xupH}27G6kY!!qX7f)oJkiaj|-U3w2 zW?}0Tt|=8fWK}0_@?}!Nmod;u(6Zu z$zUEnk?}K`D=j~stK)%KQDpL0h`0Jx)W4)d)trka1OKwR`pns!`KLRvvJAq$Pw} zc2x02>hXbymlR#h$bhlZ+k z3mbA}-kr{S^;RTq#u)aelvRJK?rOW(jioz86V=8FB^~XIVnY?CxS|JY5vIV=&5VtX zbf7u}e-)~#5PQvGTr?-Sz$MH6_Sp4}ABnN{9(XJ(;pXsNs1&?<0hzn>mK!*U>fY-- zU69)hVpwfM=K4H4OW^)tSUL|-5e<2b8M)>>i-d)#>%na69QZ7DdfF){BdqI@=e*~l z15QINs=?q#-b*IgdlntC?u>DeTi~ny*SuA{mF`GgP#mtnOaqf@no8y5SI(;stDHoR z_vDDGd?AjeD61X%0u^(cu0?dSA1;UtvNHDiKTVD{mIf_ZoO->}qW>K|(Lkx*sGRH9 zwWlFPAF_YSRnA9F;vIm{SGp&#wWWj=miLF7VCWH};Hmm!dOQ3mJiuZ&C>ZsXSBgb} zWW14uZA~SjaL@>4iL94wdo0tt-1A7Q{dV(|`zb&j)^uWU$KVz1iN8--p=$-ML>@#F zhYTAtop+Vva7X5sM;AGD9aiQ8Qd2six_(eC)u5r&BU>x{_(WuZ->Dw`%bb$%RwrjY zTyX`6Mo-ZDp^`U0w_9^{D5Yrm^9#3UHVKuyh8M*QhT)$S^avc*wlThAj|0K)o!X@C zS~3#n#TC$8?gD9{-{>fssDXK=H}ogSNa3h#xk3Nn>Ce(d%Wn(@BQ{-ov}VJH zwXXWf{nNul?XdW;T{cJ~!KIBwL$23poAOxT7um80M*iok8-%x37R~$YKz+jIrg%L{ z^EN*TIvmS_AV=Psp+bjgi3PVgj}q-`Vf-Oie46cv&39%~^MPC72x0g%D#;yRp28qMYug4ogwz072`-cAEVFPX=o&z>jlJ=GBD30%POi?E{JB+Px;ahRb zcC7o93b($`kngtUz^_+c$=O$en=JkxZpQVrwtAW_w|**Jo514*;c_|G6{$i?%kdvU zbGGT)ZCBgQB#&_nMrUQa&X-5uL!eRmlkHTulq_yg!-Oabyb&BPo@w;^qjbxC^}`Zf zPllg#+_-Lra?salg>2!!qQ(+=Y`tK4oF!|qib;pH2zxg3&rLK!$|eJdBcDpcfo%@U z;5Y3^uNZP@fT7>W6VOir!ZX@R#0XU%y@_c<;1#Gh@jY9ueO{!~4wHqIlt>U#1_Tx>AE8gx9tbbMkk8(~Es+D!mhQzH*b zIw0%{An})H1Z62|()=a<{(AaF+|=A92)Wl($z!+ZuxUT@`$?R6CwQy8QNx423sOeb z@tS&Ma#SeJ5RZ($Z(>X8Vo@>&!%R!BHy6p0$T#2BiwNOs{9fxsLVIJRXX`dvUtQ&T3=0V_-qXlqG5?jAMvwmEY~ha*4UR?suN^xna%&4$a_&56~`RVL&Hp14hQCf-a*ko2))AR+E=Sc5S~;exYB1>qBYp!-$>j%{s#_MHkF%rcWUVG+t{+z$Ume(uDIMFtI{<3H52 z+$qmYcw&luC zSJ@D=m5JT0K1`~B@7^f+%f3hL&KUxX-i6tRQHx6Rf`8NwTpYahiYiA}6V0NAh^NuRVoYHz2|IiJzRT;!g zIS`_34K}cF;Jlz5`yS@LiY{yNOw%mHoSYxBRGGozMh3HS{PRGd}V4&!8_O7j4^qugzgWw<{_PRM<#*!*&x$s$c zK9RZEI|;TW$%@O7Xw0cRz`Hw^Hod`|P$t$bS?D|wOqgF4U_QGtc=ogyoUCYCEy=mf z`r65n+OakygsA@QbfX+fr+LE#aeGz&Jcn&z?ew%z=*htL(~V(n>t*vblie@#>&@{< z&6krGsTYW&?;Tm4%C=R*kM*Jk_@{62glvY`nc98!TQ-EMZ@PW?5T-Tj;0l8c?Al;X z@OZl>PluTpZbmy455Mko#SzNrC)3+JhH&sF&tg-l1eku8cYq>)HFDJ4B0sQ^`xSaV zsQ7r$WvPxT_=|t>iuL=Tl)a6={(SrcaDOllC%X#MO1neVy9GtCMm-N@f6hH2WY@+P8Ngw^mk=e-TdWiuOIVDn+q_TdB-uSQY*JjK(*hPS3C7A>=F=*{f0 zo97TL+g5_u0Y{guxSd%!=W4YhMz094f4vK za7f(qo|_>x;fmK@#eUOAW=9^?pZxea@B229dRSv|Lo{-HN_SQ!$oy zeok-IEa%cJ7)4mwK5%v8M3J|ud*oEhSE~`Gkze(t%Zr1KXa@pTTLdxv+maP#|C;-; zv(LVG=X<3>Kpflfg(*$BnH= zky7lOT8RdzE)A6jYNt}U5cxbo&zJYvHMrC%u!(zh?~?86QpSjJ0>V4wcOs;~!%;Ir zg1auG(PU(cPS=bk>^HzowEqu+)CN(kj8)OD6nYkD83P>?tzi)et?p5bt&%Xi>C|C= zS@SW9@i@jNeam=3svDQt18R%76f)GBZ0>&0i|(MWz&l}M3WG4X^S?|%b?t%r|B|JODY@+Jz}%#R#l~$}dd(@n+|5pgfNt zr(;#NguI?_&#sONj!gSMH$TQqo*>msRh<8Z^}bnJsnRC$`Ggt^KkuV@x)UYEq5t?- z1DBzZLTq}EX{ei%I_@r+B_!nsrN$}*w^3iT2OgR2jN{c+KrJ_>ta^{(ubHYQyKtfU z@(3ZY3tlcx&`W4iFduFJk?4o;E?oVR_m~Noz%|WpiakfuVA!K=cQ#O4bO#_H8-*+n?F4xuy&z+!KSB}j_RnY5}IvD6<}sXto32^Wf*@L971#JkUHy17pINq%BFrohA~(>QGym zOWthcQ1w?kBH=vn)k(#F*VO?X0d)XCuAZOabGKbkQ$NUui5BfwDMmLlmaD#vm%f=8 zIs&bHwg$P?bKCko-yT1tsbr@SD?)_KoC5>yvj=Qm2q!2v5zkTIL6gKCl$t8$EtB% zVOw}L=-gWvBjCIVasVj`a5VlbZxYSS+^OcIBu+h)UeV=2|3=Y!wTUMrqB!XA#CE4% z+Rmx}67`3Z{;gK%$=Of6s<7n-l)Xn>>0zZU%g(fF79eO+S*h_iFx?XNk|HJoB~# zpVJSbc?mOVyNhvS(7%@*$s>CyFy*?Sz!&=Zu~JbMwhO9*d$)r`ePVIcmc^&{J-P9$~q>AX`C<<|GpQ>4#NnG3Y^(!~&p0~6@xNt`b!4{1Pi>gAyM99mP_@F^D zI#X(%4S*XRM&YSa{AYe4HM7Ha0MIbl{HjG7rFa4?Z#v7T-`n1W$rgoTn|XZDX!;th zXGu-43j(2mI4A zF9X2d2LNCO;aO#gf0^YCclA|nNA%oTPj%P`^;}f_MpnQgp4PfD%UHvPo>V2w>!B7$%w5571&|WTos@vz;N%VPuv3 zlRT5_(wLivtMVcIsV*YzoLJ>Z5D4jk39=fgqh``J2UIz!K`~DKyD|sXkhk3dDB9FN z2bC)|JcpcqBwA3wG;La>YF%Gt2=PF=Z%t_2(BE!8x(w@lR^Yz0wJxk0#wz0j;`6Q91_qz zso~$O4~Q<@tDSsGBOFH~@=8_^ll0f5gZF2}UtdTV*e5BN#LM)?g*7apt@3cTgE6fP z9<0*ZJl@XVyoMT7CawFmN8r5ykShQyY>t{qd9tP{6$z5_2hk!_Syv+FJ;JH1>e-+e zcxR&-5a#RNEkg5Zy>4SRu~B=cl4= z)>itzN&|4sq*J;fz)AK>G7fGEmjXS1^=4&>4L_4Ppi>BFYsc5FINAxcZ(bTAnnFUc z+V##$T}{-3RYNMKgQ&;SVQJhy?}>J$-zZS~EEaRL2l)=`U>Zb*7I+aKvneb?frWm) zHGYIW?)L+s%AUd({uk#j=U}=&@=lKmsc)p0a1WxW4in4w$g&6ASutX(Ty0IQS+q6c^>P6kwx^NdqPo;`Yey+Fqp#qGr;%u<6BdXJQhk2M*`v zr$L7s@s@czZR1GE>I7ke;qBdVUIQ~2-u`j%4fYf=I}N;CyR~`^!eO+X^lCVW*oEvL z<7WMKNUzC7#H}#IRcL{I3J5Kw|0>NazoP-bRtErE9lSM=X96Lq^xVI?(FNQ=-bZUc zO3r(PTo<`hBOF$}Xg4`QFh&E-s}oI!*e-!(9}z)+UGk;hLP#Y>>efnFZW4LoG z$XQj651x5M-^mQ*H@wI0qVkR+->!I%PBPD8loZBow>`g2iLR&ly4BF8XdY7f6puGo zLqSK!6|o{s11&*5Vat^rwf2ihjDy_N-t}m z7RV8pR`*Bo<@qjS|X)8t?Hy6cEDW{MS^KblE-{oqRiS?dyL)VMJ- z@606)IhZoFrJbPT)_UvF zek1J5D}P_A?-j%pwntA4(`8Owx=xo$E^Gjqy0vPdCH{Rbe4*7PTn4SIKL@>QS-Qde0Q^)=1T!?tx!sV@<%c0RAxxymF;uPFh&;D67F(IBVpn~9-C z)tBj@bF!+oH6meLndIf<`sR&<%DSE>kNSI`z)zP~^HYbG7lpd8I!TqDJ^2XoD#afU z^AgczZ>f09a(d2%nz-0jc^oxM4kn#%Un)53Q<=Ip9AkVO*uI>3Aa@_zJ#B)5Y{@P9 z{kO4Z2{Jt1b53c$TmD61TcD{x5V4^4<<}=qNx zY?Hu)z`l?)r zt>J6h{NG(QS=LTg93DmB8xZhH%iG%NDzt<_LAEFWfx!Zbx(vgLPC?^(>UAT1eOe2?cl&>}JrOt9TLo&WutD+Q4$39f5T$kcrK7Lgf z(8FkwUOm{u;4Y_OsKBn-nz#ujE9u}tv1sMc=KFr!_-BS~D?hgo@_M4<4EkPm8PNH1 zg8%wZ^IA${yR&P$8D>Kgv&-L;Qrx5Z;2omNeF2IwSD*EuC;vO7_9g6Ke)v~06yE=e z&qXLPM06Cuq;G_+>`=zdGATHd(^zn|hxHsytK~dC<8u`!EgaGODmxAJ*^opfR#A+X zLU1L<&q{!IwEHefSDEwjopK`uu;>F21wYf4@n6_+G4 zI~!+`0di80Nt-E6cMCh~e)YKZ!i&vHbsZ1L0FMgMB56RJ@Jl#3_7dc+VVcZ;w$w_l(!0vuP(jV=G(l$spp<)T;aj34L|57ykM=JeV@-kQV-uSzqmw ziin(SFERge)jZ;N6cN|oWD|7~KxnMY@pb=SD?r<>hOhf8z}Fq<@y!+QVpYnWIJ(8+ z?~mP-LN>>L|XlCPj<$Z3N$oVI7A_y zPYW&TAOAcAO{o5*RX*O8I>_dWKOQTdiI_Yac4;b{IqskI1X*eB5TP9rv&6?{4a%df z)bH=fpBg<0)H59=RGDk%-RvlHaXRZ_1m4Pc{ST!CUcBBL=h+pgqnTx*ceWY}En^55 z&r{aKOaM+E$H4js0s~Qy8J7V3&HHKe%eVZ^$j8_3{cWzSn5amh_cN1#FE9$qZXtud z?4xRl{m`(21Q$)>u?&uZ`)QFGl0Rs6<^DGc$EP6qwi1wB}+WO%m zuw3o;`P0{=mB>b(@rm7WOIamp?0e}hz9oZxP?MEBsiQkhn{fTyLM70&s;NC-xwy6? zG-!*e*3W`(i^$}&l^R3c%g#p(619~C$PEUBMxY(qJY`MNOjQY9wkn^m`4wrfu5PMg zRrJ$7@lt@iCVE_(XeJ!wI=;E}1ts2XR4ao*2fW1MlWn3#90t+5;X-C9HEnPp5ZK{F zK5`U?LsAM&RR6V%n~tCqJgT4J|IjCvJ`H?3F~d?p@sYaZ;GZAp>2i1PQN>s7G7<^5Zj`rD@qVGxXGDj$wSjK z{GDlJ)-8#8E(JuDtQJS~OP~)aLV9yZT>|JY=OJ>R_Q;>f41~t0ClcVs<#L8Ubpi5Y2#=@^Rb9Cg`>)W1dvm6arf=6CRjfgFKDVn~a= zYwUo}9?Qqdm|0x9`2T|VtvcW|AEkgAAn#$P4Tvk?{BcR9r6M1)ebc5%qZcOaNb*qk zr-eI|ra82t%&I_`Bc}c2YJ0-w9)eLo6Gy@eci-%nqtV|A$VJ`IB_d*pc6G+A9ChuI zL;8|4KWE5lP?58Kx~I!SVOJr(;jGlEXF`!@Aa#>LxJwJ-J9gB_sB^g#bS8DZ5CiQ&g1y4Q&8QUd&8@1RGOMJZ zG-IV+l7B8(w2kUOG#3ZtbwGd3|>Zk7dwP(JV+h zLJgkdr0|kNGC27e!@&IPi2iXgWh9HlJU@A1Uk);!za2dNi|;|M@f+IZ!vU^szGCk# z;KeigON-0}|9CXQtI7XlfuSTeGQz$^8+N2vA;H~DWCx1_s=4?d(!}eDrTLYLrtzUeruT0`GG zg`6%J|7*R#UcZ~wzFDuSU9#cPt|*RDL9`kwNzX(UG0*^k+&Zz`WeX2B)b%Ojcl)Ui zBC&|4skA70Ej%1re8Y?`ySZy^j;Z_$QN=TQFy-n+sjCnfr#aa`F+Z9Y3&z%pf#rgU z>BZ5C;jMso@t#i`7jJ!W{l`y;AgR=_#Y@%ofP(b%%jBKh61CXJYD_l9TU?ixzz=f} zdH*(y#bjtKuCD_Yb%FU)EzsG_1_yv2Q9N@Rak-T>1c16Pl1GOL^(Uddz}WKGecca<_!7>q?x>_0e@+yd zEPe!`wldYFbw|^6-S@7refWu)>`j2oWMEkpf_#KWBv-NEh(^w|0l?}jyLZ}3#ge@H z>7G~ttOo%*Bo`1u9r-OpkQ^tz&2?%@9AD9Gp9p`oA}CGF7LWL_1kyUK*OrM6_(F9y z%kccurB-8D5t4&lOqr`g=L83-huz%dN^VYkw-7j(*(rK%Q#rs*ePskA!WFhus(zMS zVuQ%PbRy@>edY2TKKY0By{^Vfwu@pbaH=apxu7EX+D9K4B+_~Q^YRR;6clW%wy1;)2f(aX^ zL(_7VN{8{6Ebr**@9Dno>lp}Wv)L)tfv(ezDA!y$<_&w+Rv$R6pZ}3vC(D=AXtTrS zjWk&*{*5P;aMm@`hya!dhgn=`povhJ7W%uoiCuz7a1V1Adf~gO3GycPFgF2u;(?`< zgz{N#ksiSVkv!P~bPCErt$N9Ozr0;%r2PxvH>QqcIgw^OyJnNN!-NlXTOLr}%*4S5 z6&;*?!f%iid!6!AE^B8@5(;vNviI8fkGXnMnR`>9Ar{Js%LY?VJaW+V5xFx`AWg#m zB}qlQrh*|kFo=Mw_=)=5}G4 zsLy7QE4Lw=!;u@E>$0WDs9cF=e2%^jS3(v<9(<8~J8=b(ctw#%MlBg%@gM0mx^LGx zD!ffC@WU?oEeWzD2>ZSTw~eH-$4P&KZzi9rGE~#*4_8rIjZaUCu@ymrY>IxD5B`9( z&Od)cDIj0bX79ky+%u84c%bNt@m1EtIj#?~AATu}U5`EUBW3g%-j=^@%LM8_i-OA0 z?RdNn2KsEk{t;z^!1)6A;RA_Yu#~%}OAoxWSj*+|S02ffIqj9N_$w`us*1DNqhI7| z*)N~_Zb!1=meX>HE3p1M5Y|;_c^gXTdB6j~7VS3eu>7?|iVYBGgy{j{4%O=CNN!%u z+bKHJTTVQWu0Y6K>{;}53w{cK?d`k89x8^mb3#67$8>YAG`Qcjo>re1Br4z(+ zB9S_qPP`F1nW)s!$WH7%nUT!Hs~^@a>fej_$Sh2^ZAR?M=?L}qKKP2DT+5WZA;w7+o>h)TTN>*|!`&e1FN2q1Y z>urSC_k_uO>}CIZepx%D<@7`Ys{kRFZSH7N+G}L66`2>BUx!<=mg-hM(S#UnLDX}= zRiTrn?Cet7o%{4D0--9q=E3;ML@~oDu20sT&FrO(Ju%B`N z_%6U)nzgi$M#Lyb)0+`ODb?B3mF|(XPwm~(h4;5=gQZ91-oNkBy!1&T@yburkjb6g zC>z8J0eB^G3w)&oRMr9AfeNv6?^*w@^DB62>1+}FFv~7(^T5?Bs6_a#`Y%!o{JGC- z6TaIi*Ptb5v`~j+7Y^McWItMpsWs`#Q}*`YWwyA-_ZPsA~ z%v|1L7A1S`xqz5pY0RX)V?i<>hzL{TQg6Flv&zY{IZx!8f+s(3RK4^QvGeb}8o%8t z?9d0qT484=q(YP*gE87;jzk8X&JdlEh84=`f$_-m1uIQuNCPt0n zs?=2z2x%V^W7vTtMkU^OMbanq-v~s*szg)nHh^jRVFdHMgyELr7N3u^#^TYhr`-T? z=R9t-OCNiAqB*a6d7Q}z=|u<1hH@i+S*bBgfic*|@(p=w^L!IatCmFEH)XPdmnp>C z6gY}TQg>&W?5Vj@`{~aSX1`kXrNTZ@tg|z8Q`Nto%S0#`w*0@e@^9K4r|(KREWos~ zMUrTF$pB}hXL&E3`aQS6E2gR{Jnm4o%OM8XMJ{62>a$}W{T<;H8O=c^;D^HM&cICb z#KvGd4@A5Z6Y1&}Bg1d2>?Y?_w>BmSPA%@gZU#hXSWzz;o2)>%rjT3$bEd8r%5Xo2 zjK{!pouM`XSVY|vHDXLZ2c7VLfeL7S-_V9q|B#|hzK=GENFmN`2*sUME8p)S%_9%S zlVhg&sP?^6DpjKzMK~OO#|KI7Ki7Kuv$>QXD)3lrFGapOLQA&iRq`ys^Qn;QHOimk z?5HoFuN*DxB^bcW`K^?+H6+X{%d$B%{J#Cc+$gKgzhXkU4)JnU50(?h4!4%%C39=l z&SK!7-&H!E;jw~Cn>O*M6&nTdygq|C^Wcls-_$IDW}y`k<~b6`KC|R=3rxNV(qp>N zC&U82QxRI^Or2eps41-T9=ngs?{#R%QRF`mDye?}L!FR46lmtzJ4CGkarDfN#jZXt z=IyMG*W(5(&2-5QPDfDSG%4)A=LG_j5_iam!GD`AJeKxiB>Y|*MNEYgc`9rI6(hk5 z%hd~Krn)sxYW$>(-Kgam3)v#ICyO>^FZSt{+Y;J}&N~>u}o) zO~k;5dy?lgi1v0XRLBn4i#tOc7MCr3lpi`WQ=S)Lix0e}@PCze*y#m%5fy;E0yk3l zQxx*gvv)kS-*Tb_Tu3~>NDRyD2s$yf>Rd+b*OaPkdf9fXLYJ;hwm!Nmd@DwsI7Qex zMfU3psF=B2=QUu~ItYF9TQNdtv`7gXMX5mnrm2c#=y3y-o�VYM*)n$;Gx+_>}^k zwzbQIn?m8JQMIG00?` zKER>-%iv8Tu_^#kIQK1F%T2%dgRgu+z)ua_uA z9i((0073&`6K4^t=d&pmGzhK$S;;3giFnx$a;{x$Tw2I0LCtk$h$zNM(z(3ONVjIg zQ@?)9U>@c`EXUVA!xBZ22t$T-J-(vcA`p{=oOe-N|>lA<1p-LM1(5>KEd$aD` z!cW*y_T8J*!ve&6lV!qq%9^*PLM(rkhtt1rP%WM;A?w{4IM(VU8 zq!N1Tlfb%0>?DpHr37@bUNrFj%YQ=qfV!38&1C@IEh{Y@BAU?N1M60dFb3 z5teEI4C_srtXf=q+q9`IT|1PL3y9k@Z~veJ#pjl2w%*~Z_;5Hq$iJ(uX(8C5ee6M& zO2-164hXD5@okb{95UE_kp>@EwCpv1z1#IR$G_HaYG%qN?h%qgCN>9ro2*2Qsb)r+ zT0;P{M1GuFi>#e8%y&{irZX3Kuau*%5tRC+BqRlNKhd?+i84Ks#iemPoHJ$2t4jki zlr@szc%{Hy8Ll~k>b=ey?aARSufEG?NRU#pxGUm#*IOrg9_6nhMtd)j#KRl@=Ed(_ z98of>oJ3CTMpu|gYI94eYk>=&2>ko|INN?d4qm6UR1Us*5z zT>=r7%EFaZ{ui^40YZ%~rBW&gS6JXyJ(WnLgR^2Ypy`Yk2Zv;TRo*`L+Ga}kW0TVERJ6oScxohM$4@&`^@y$N)0PYSBG0FCZl|!;IF+#44B9oIvI3V^ zqs&F)Iz=Qp*-ky*rQM}{lX=B%|vbwC-x;L>HrQ5TTHJqnYT(T;OS zbR~){uMJNy(`MrPJY59`Lg3)i@&{@T@P4R}(KXcT_W|lGzVaM0ivO=&`LF!%X$wT}~d zcoVm!<2p89!8FnmijF^|4`jIEVVy+S!)vtfZZDyeP3?=f94|T@xgAGDD+ zH7$w=B?qMkdis5--lpKgW79PB`JOBF`vSu$>@agFI=K=AqEqcy|EHb0R=p2ihX`GS zVP_e;Tx~~P9>a}cRt){q*FWCqEz|ZwgF%EkpBF9=Z*#C0hT+v|gR@uH_SfenwP;?Z zr_6_*)E}3e=tSb@0vP8l`f4DQU|vYS_0aw-y9^@tHHo9XV|DU`yxD+?k{K}QloY9Z zxw_|K>y|r-*O@Yfu9c0PJtwnjI-W&8?G7qwUXF!lGft+nq`ehHGrNzL%KyE%dOS@x4IcGl!o0vpzt0Jfn|GvL#VOpP%us- zwbaX>heHHss{H9GW2Exww=}p}BhDW((<2u^!WBTHX;P1Nf$3;L2-XTMe{guTl$3R0{~lB+1)-D9AwFrZ1t_!Mq(8iI*w@E-L1>az%` z-YN~P272`&Nv09fZGv2?YIqJN>0{ZV&%Nh2(2|3>IzN`LSd5*nUWaF8vs#p{OSDW> zZh@_lZoQ8MTXdZbX%&e$>8q7qJA7d(L)+n_?Im;e#`c+Xw{PW|z~V}AXx>Rn8Fm*k zeN71hRP_rugwc&+ZlAo1;!vgm0|G`Tb%Y&_tufDZ^ey%OH_;kaLV`d?NkaNs_$T-; zoC4U~l|d&Jrv*CW`JEc-gxdE0eM8&&pF25|3{g)ewQfij88D^X--N3Kzi#jRyyLgh zJ)G#HO2f1rjuuCv=te)7!R6{Dn?^qXa+f@go5ioCK3?vrL|{jJFLU(9*hp_W6x1Xto1eZ3Y&Vh5JE{h>6p<>_sSlF_#j>RV**FCS?;1*E$tn(#vw zL^VHzGs$oemd*@Jx~bM-8pj%Y?oYKZiX80Ehph(~q2iS*+iBv#1=LUB{tHcRSZsNUsw>PK~JR&^&8Dy_32jEJSH-BH?f$Wf9xVV0Yk z**mMapSzy`uc#Z4++Y0M5KZp%+)N?f;O7EZIs+n(|4E0g3?&Mb4hhg`qcUPHS3#7Tr^#RUC}wG$ z@EzG6*Mh$`q1Y-p3Y~As=LbBV=Ye}>kQMBP9s11A$>iIsE||Yo;tUpqCO&t8wsGE6 zq9yAkWij4ZXHjR~d~zms%xXsvs=wAeE9Y_ZCgxrlAEw=Nla52#7ImV+Nyb)_XLQGA zq+K=lVl}WC^WJQHv#LTBZI*+kmqK4DF@PU+z%|6*aPWID)Vqf(mw--!qQfHS4-6}x z@)y5pF|ny3!>=`_tpEab$c`l&Ta^Zr&D%l5+K56I0e}Va556H)GFDt$*DL0rbidds zpRzRvw!*pcHi`BPi%1$(s4b;f0Sz>w*^k#9q!Z>wUp^PdU8Y=RU5U8>FA1kxI$eHx zt+}m`vc_F#+11(jt}nfWERKCUda$1?D`9Ul(2$lro0NR{`6HRQV{Ndxw&7^C_tQ4G z7)Y^4v#J`m$wbgXb?@hca!E2(kIRQ`^+V|;@~NHTozo5!9fTa-W*X0e*Bzw!%z^}u z$B|Yo1V*N%INr~Abb<5MS1KK#wL~8DWaOs-WO`&56|}0$M$}Xiv9%=T8i@%~>P1rV zLNQ!xf}v*tU(EsvU?ePxn2*$jZw01WS7CF^^Lk?CcI@T^(C}gpnD-)L8LhuC6=j|l zJIxk9G7$Qm+63Zty0mM@I$S@dU?k8Je@mO~Uj3@~yQ-K&C|(pTLfxsJE_p;qgKQsjjXhd7 zz9b7ex52|ig5V2#CRJH~zK7{%OR`*^fV~))H{KF58N+KR|(0?9|w6K2FU(R{})9nkL$+`&|S5qIJ>tNTdOwha`$9fV-O#rq7R%{Y^{swV!n+lo(a7%N z@OV9&7Iv1s;2J-nD`v-&iel!CP*MS*Un&p699v@oOM3mv`Y67(h1lAALtDPRbgMhh z1G@pHOU>h5n2}eTFERVeSiV+%D8RiZtj_X+8>5-a!#ogLjjFs#QP1oo-Z&E%xn@BN zS`ENzjv7rJCFKH2#s%New2aS+m=y&IbMEnKGgNBO@EZB7(0M{g0c|tGUWFM&?Iyv; z?w~k|TYFHnsd5m{5#)fE+#XrGXnBwM17L*ZR-kJe}bC9>*zB|TG%pT;FQH|1+v?MoD`X1YYt z1_`cVY|F|VG97eeXZvG2b@q`gA#u}<_QIiUwa$B=O3sfT}uYai+(};=bbwMG_@kBb{9KhBJ80%~qMRSPNDMGeIr8 zq$BFIr|-_T_4pX0HW)hh>)fM1XkJ6sSg(Iyeb{Qf4f8sWf|0UjL=&xl4n2R$`TDjb z5kcQ@O_G;Jp{y&V#8<)i2e!%Bbj4QU%V^_#>#L!@kB#O_bZuiexWBJRINRn;O{=}T zqE-BP@aFvY8I88@%iJbg^YBahGEaJS_*$2}Na7=L4}R?u#dPLQ9^-c>iusgdeR*a@8nQ51n{e8Qqlsa7dW0*lIwT z==Y&TGOM`4h)sqMg#-Th?<=AZ1=V_7;g1ho5%XMjRu*h+*UKt}X_b2|=9Eo;@rK%8 zC8^CzDmEBt%74li(lh&#LwuSUL_``81EPkX7&+(Dfxy@vppavNeS_iSpCFalkg>0t zItVXOQ>DjE1Dl9$_UV;RD(t7{$1lC2Snr=}6A@i?Tp^03glmT<7+>*lQfN0wN2&7- z!Bt1_a^Vy@1u(N{GZ|%^w#)A&MK~TJL!)IlgtR#x2D+^~6a|Q)}IBDIz3p`F1vgt59y}C-mKa|WAFw_)8 z%HX!5$;}4TkjXhl1?8R1P%a9c_T0x9RKW|-6RBy-Gp5F}Nvo(^X;g(~g|XtPJjb(V zERugsA|b!>S}DdK_v#l_goz&Q!xDuyaF&49=?S@FU{WNeI-eA#RLl8IcOvi^#u+aV zetBu&gXa#xraG*z7!!TQruw^4z#q^wONuebT6L4I{w9XKWHk`OGYWT6>zfLs3=ysU za?*7}Yn+|^FX*M%_kA^TG0HApgi=5$s7yim#ZFj#1$y5_v*zk;3)Ns^M!t5&4G~nf z{V;*LE{oRRhAh;3$S`Gwxg*I4FF=uGU`C>^J(%*CsSwyr{4Zt{uHAcpA?&z-2Nf?? zc<+@=sdQX!Td1Duun&g)GMvEUOa6hm=PB8tw1BVvD}9C|TU?yf%c7yEm&`vf!h*On zUO808BhJ=cl6Y}&Xwh~{N`$)E2w(qSh!d-zQJr))iP1(~>x1G(IleJbDB z9<4wnhN*qT^;w)+Uqr6nQP*NCxC%{Y#Kjtt)4C&j%KjIF*F%SIPC_Q}+-;r9N{*Tk z_K&F3tTVU*i>$XnR=N&AiRvi>t?c2Jw!tjp`s~sj<#Od2OG5Nfz7Wi&7szD_tEG_f zuOo;g8O%fc3+O34B2`jeD)ST~ngi|^{BvzV=FhKf9W440 z=r*d;k=&utc%hO-uh8xMEEB5<-&7N+l(}451sBTjbCQ2G*Er)36#d9qDCSPEx~mND zzB;8O+Oypydp`dfcKn7MR=#t`W~SuhtpFvz&E)8r8DCrbA};OC@|9KRq{B^<*WJQw z>wryoyJH=3X7kPn-iH!5%~rW|ZjDCW+pmhsZ=; zYAU)BRnocHKrhws?0Mu;50;|uzZ+`2fm|HFhOU@vPWt;q@W6tuh@dT|A!Z=f3mgBa z_?IGlya(InkyC6L+rv$%TCl@;ek{TRmFD=!z9WP$q=#3{DTlmTn{CW(X7JltC~1&;bZNj-G0mV0 z`u${m7WtvzrP37wh`=%h{u{vlXnJY-@6p*}9L@0LkU2zucX)xf90J9ja z32CL;R7+|a57Z-nS07{CZt;8I?R)^%9?O?16s0R8VUb!Xcj*vy=)hN}H1MEB0_E;n~ zYYeGp!qUA$IT5Fus0?h8!ehwZKlL{*vDm#<3>kp+P@PT5t10fpnXoW6`wH|~@G0Y_ zDE199@$Ix@+UEUzSmfY>WGB{a9)ldZOs-9ShZb4ADoK4uut6uiDrus5U@o_+smmj99A{Nri0b6Iel+>DdS8`t zA*MV^=-(4<3|FB&j6ch1jRG;NoIPn8D3+hD5DMN{EwM(2R!=`Wi-=7vfD{8C*(g}K7$ZyvbBS1T1gY27eVN;;pK2u4jhk((YUNvO zIbbI>=4=PV{(Qdio9&#kmLC&n4FdgZfQ`Gu1&gW{r1i`vI%%wa-_Cx*{WX%~P#AAC z*nbS#WJNHw=g|bp8e5iARhk+DWnmBH!Er3)Eo+=7lZXy;0^X7&iA8Log&M8=0w%dx zZbQnpAs41pVt`$@!>wCGR~P2LYf;-_3g&_C0^U))SZtR`{Th|E?1|o=0uR~Q@)+H# zJUGrWcggZw%%pB7PE&s`9DVI&tLSWivLBKK(R({=1NOE+hg+QTLPD3Vmh3wXU;8EU z%Q1hDkjvr$F84!VHb>58k@EFOUc05jO6zpBcf7=hh4Poaoh0v~y_;QdM{Ri($3Y35 z;@U#^IgG3Bt7rnhxhG7AdGM*0gUj9C1G~I0*83`TF@@c*LyN8sXuY_2krdhymg@?Y z3VhC#)vx&1eps$~UZW}x{NB6pZ`R%`n(FzYkDHYU-`(RoH_Cx4O!zE1m@?Z}QRuKd zZUZrmnKEnN_y{60m*15j22SsYz}bzgtg?(=nrBYR#ZMiGz7J*-se64($x$zt5qv0d zL-Bhc&-BjP;d}bL_m^)>Ge;cPm_rSBlj9X9-b%NnUdzYQof)L_AdLn@(QX+u*0+!# zdjD8@r$?Hp+Enm)vDc|&><>3mSy6kgArJ2SU`iiiiE^0=;rePVijzal`+lk1zM z3DFLR`X*QrR3RU43M0UV;|cs5A~QWganPQI;>p*?7#I2KeXJ!lJtR%^A|iC|S9tNj zd_%`fHzB&|Id>RTLva3R7NKYse)%e@QU{J74fv&T!uYXH{BhfA*afH2IN%gR?_QLv zxnMN93;7T*u9cAsVUki^?dQ9%zNhWFfkZD8C-*Yz(^sCWosXh^&X_QGsXJ><3Ep~g zJY_`b)m9{}yjvi=@jdw`W}U2*Rx-P+oOfE`*kyX0eRAtE#L6=S_lbokQyWpt|BzU$ z`cbnV1}nz!bY&PM&+vWm+qeaWLtAqV6|M4@*y=8z@jNniK%|uFr?*P9*{<#qUq3JKU|`mZtb84 zfPDwmW?@AYI~70}Ac7gQpFxWWQy_*{{{WKqSxBN|%_3X~y|O142Ka&%Mh!(fLYJP5 z!=sujx-B0wL_HH8%A5y*czcUuAonhG#~djwposjNmb5v}b<7#6=Jy}y+9#Hh z;pZK(!F!io3+di_KIC$2Nxgc={5Is~8EbT!g*e5Hem<+!$8MxP7pXvqODf55O$S~cakm4F(LRYUIQW$Vus!@H(-K;oPNA|P+0IKmWeTxrr zmC`c$JkTr)(8%|{j-`2LWG-iXxF+~Usk=I;cx7ytZp89CXb4y8b15yZh`U_XK^9z} z$FSPdiH_IHmGL>B*Gt`|Sfc^7{6@gQdcE=~lu((ahe-Awj`>1jl(gwctvsP`T+ z19DL3q@F~os0lG61AG>_fWA2-pM~hnIHrnNzM?6c@-ypSSW&LA(XcYj)Y6 zX_}v;e;Ts_NKuWnM@n2XneOLO`(1G^I5(Z3L?=L|jsIOdsb}p-)7p!QI&7d^oeBj$ zYr{bx9lbo?r6E>n+6I{_Wr`7s9*YBCOy|S)9KrnMw&nF5m>0lJki!DM3&LQ;@QkWB zWF6?$4%+Z||FX#%s79UfHI}a1mr$#n){RRZ60CT(Zel6nlj$G?k0LB0Nq8NbrR;V| z1zEtsF`OEt*0!!Z)f)|&1Wt0f9{%%^61vNvDbQ@E^XTj#V zpC3i5)4#Y7itm}9fakfb==L&}XhI^jlwKm5PP(v!m7Vhb*D?^>JJgbgHHq zH4tFx(syC9j1lmL>Ux*@2YagtAw3qtx;rK}m=>b&-RlDwR~J6;(C+pY-*#?ldGo^k zgW5W0o5`l+fsNuIt2HL_lH(4lxyGFJsRu(L(x3M@+)}r0=mH!6gDV#>n*^7DMj%|B zq3l#za>@!Ncx%<|T(0=zXMOf?YrkN>TADU&azs!O~G5VBP_QMkHRz zRb?a;5HSy(ADZ_u!7a!E1B%7^dG*Y4Gq6{oa|sTfgff>i^z6Hc_g!nMFrnmnPTmKu zKjg;kLj!qN2nBqH;A#I*G$*!Hl_-9yv*7AbN*k1U*2^?aI@BM#u?*EoO;``d2z#H3Aq3)I7Nsl?E5>w3ON<%7T9ZdK(i`a; zK6%}rP6(Z}f%xjcQ;D+rYIy$GPpMXIxpH%|>G!3ouD!kv%Qxrf<(O)wU_#!Vv7?28W`t2i5%wjKOltf) z5(cgGMWN~C7gKdMWi9IHRCJ$65hYvVmKt(QbIqVqT$9RqkLGP#}5Lwa*!W(d*z-Z*SUEVSC#QAIGS zM2H;efdNHU)&y99p%HR|GZwG~A}0)~pd)r=1^9@;A>`X?@wIO*~y*u&`9plu^$$ zYt>V%mF@`C?i+gzUY2g|248P%pSDPzCeD?fVxBtAiGB@#NEv|`if!2`3*S-|qLNWm zu3?8>`7|URj{5F(Vxv#3`=SE))@&4sELu6KqYEk{VXo5B6`pyrY}6vH#Ia!$B23bG z4yXvS9@>R}WJw$ftjWSjc|#mD6>V3UCL%gFW^Q7fnDru zL}yDpz(Y6v!z;i;?}cU|LYo}ir(08S=%%C|Y5GWN2^t+zQ*V*jq#$_b=MvTjTzdRe zKDMP#{Fk`C4J5r?MRg>#AYGP-r&yNYaVI@-UM%?8hwU ztawUvKhjPiAv5U3*YRk)MQ%}gf;pb({R`Teeza70hm=X@v6pJy&yjUbZDjlEBpuUh z8gPPg+3SAI1Sxg-R56-b9JAL6=mXocN{l+h0-wkGVz*u7*uT3fiD&%}H^CYtxvXZt zkgmIVtYlx9n^c{@PE6BUqs#dxCe%G1eS&{c`M8e5aPxne3DziK)=o-Pk>A4e=~Pnl z>27fwHRgE>-nhtGJLhpn#kB#mHRf~PDVYV5mZcDm2G6jnCf9N*x^#QLHQ-N)icKa*O!nHXN&w5H^|QpuSv=YU(0( z@GMXgTCm;!Ns<^LlGskk0F*>EkqVeyqIy2h?qzvh{bPsXH(KtHcH>wYIIcFN$n-EV zpsC9^G!XN-O`p+*9ij0b;~mD&eoEU+E8JzriUh7O)CAKZU&E>NsV=QSE@=ym@w5TU zf2-}S_*{7>8x<0uay1J+C)mv5C`Lq6;+6|^tlCU-+3i;S zwCB3P(ey4zPL-$W#CZ_O;!A$C=W<`Hbcp&hti5{-IavY08u)?W{*z{PHJeY+n^}(_ z_HjwnWTk-Ob}#WO87-xSHmJ~dfhnZ3EqT;vE6?DkugH?L>BzbcRKA#oq zLN3pPsU5xe*R`Q8V(7j5+gFJQ-<07rfM^Xk96ss8eNWqLBXvp(aZhX@Wf_{;z(`$K zF4gX#Z}3t((su8^JlXE5<@Tz(uLn>Hcc2u&hfp!_@#AjXZidzo0U@LIO+sfRgg8Fq zYmG^PwQv@~rN(+*emzx-;IucZNWw$x-RvLaT9?#^S+t=Wky&d}R6KSgsy6fKW+t6V`i> z&FYgmqiR}|-DA6UxLe%<@kx>DV@7b;Bt1EyJBvg{PX)Esc%jm{pyKbUf{0r~kZjAy zw4n3Iiqzv&g;a?P`U)%}txDRv4EU$7s@Y@5 zeFdPb8agGi*-L*`=@pwxC_@sOI3(J0CB0~|?(Sd~1SatQm;c3K!XsAN(2Ai3=6?tB z#Vz2v&BOuukqu|kSSESnmAjtm7PQW8b7e_z@u#;1Zhb;Q(i;=<%>`Wyc)SrFr;o`y4XZX)Ch7{3N z{I0?Pbd3KH$vyb(_fGDKbr@*#PqL!bAfc%6Xq43C4VoBC?Q{e~ zLXD7&^IG+ozeiJfuJ{RV)Iy@aR_(MBYYyYRI6;i~txg}UHLRsU z3D7%`6vhm#K|AL1g@e8M;i!z^X!=;6$aM4Bw_N+;e4Vr?w@s75%Esc-!P}($XhWv! zoV9Zs(77^#_5P2kuMCT-``&(3TDp;z4(Sd@TBN&Ey1PS=9J-P2?ixCzyQRB32BhH~ z@&Cj3(-yA-XU94#?zQf<$*G^y*gr7DnB-kla3R>N&3n1qMvUN}3FESsv!Cgbg13r? zUBW%xwS`+}V{moed-IOPJYJw%j6h67TGxeq&|Yq2M#4E?@PxFRJX`I%_pa^rt4JHn z*5_PSNj-$K?aGH2i^ywROdM(z;% z+Tg9nr+B~a>1ap2K@;4#1`AejLu~0gSg;`Jw!fe+4lufIXrD`0je1izz6)P3epiJM^0oF*+^3f;k5LcWBgQh;Q>Gc&&~Ex;B>kOsT{Aa=an<*=MVV2Q{2wWh z1WXsNPur^QWMdw^B3(5pydnBUoet=g18hDt~B<`E6#8JSUx z{O8}0 zk`*96(nuf2I?X|?rp1YN5KX_Ar7HZ|vPl;P?!~Rf6GN1BQGp363S%OZy9MI)M>Dcy z1CQ?qtLdSue2+xG@*4Ao`_j22qHVBD-Dxss0~r3U5|5eTD@6hxyk=gQpth*o;6%U< zLf=M7kW0^c&ENs`;m=0<@B5@ZhA*-44_m)MKj&^kNJ5lVK6fiL0ssdh46Xv$v9|8H zD4Th(_BU@zI;3E@=xUG5g_~RQwG#grIiizniX>)Q3_A_29Ap2ZJpr9c_HcQb+cPKdRw4`jX zM^~3M5I#C*t4YEid1;5c08far>6L!9L<|K7XQz$%H!nK*rL|(=A0i%c0m5PCHUn1KVD7$1z!9sb1fVU|@IxH;U#; zQo2PqgU*Y;3f_YI7JQ7*4moGrnEvyb8`+{7!SRtrqdUY?0(}k+&*HYKI|<43SM2Vy zyXKL%D?L{wPD@7L0D%PqU*9>Lefa#}MUSlcJ&B^!8u4(DJ5P#Yp5KYl74uzjLM~b8 zR3xM}!^}Ge=1Phm@Z^g{= zZ(g+3G+7R1BYdH&%7@-LB*@$h+y=|)i|zX1u?z*Hw8H|HpmphTz#^GZa<639r=W3Aq+TXz&lg4*hwFH z=&4d7v%;dD=W;d~x!(>r-{O9Czt85;z1I$u#p+2n`3SVdDaup{-5za%q~akJ1Z+c1 z!imnoaLW`0-zod5V;!|pP}X|CHyTzJWY?p)s=^+>jY8YjdXZ2(%dRG2&NBu^rgw70 zrffz0V>8>D^KI)N{l$)Eim;_Dbgd4EGu2 zkqSIZgxg?7^XWZpMgo$rme3^mQDg=EK+wq;ftqYabwnr6U2wpS_@{^)(TFgX{Cb<) z9m)r(#6Yk~;ncfqOI%kAcFwbW9(8-xx9Wtvhv|ln_;p;<xo;EynC|1l3%4BL4 zY=tMNzu&`pUhIS49u@?%6&|BAov)SCo}nLg=|tBKD6v{k=|B5|DWV=y;zVg(jm7)t z!T+<~>7o~3957nWUjtfzI;0wJmV~h!tmJ9G+1r`@-kXd7YvKnEHZ-Gy3cRZA?|@T&{PWjqh}&ocQLIU}Ivt0f)U`C^kUP5FN6ttZT3IYU!EqWM=)E;`J_eGP*c68H{*X<0U+|y#D-=3yH(BuS<7x zko0@^qvqQ`jz$^`WW9(+6oDOi(Hp)(c>b(~_Ay=Z34MK68L$NRIt@}sTf}}Z=7PRH7IIB+OSf#{ zaLiHUo?>6oRg3yip@Kc=fXP{qouGUtgVm~n5JqNQ#fOR+Mn)eotqaN}8etEVvt2^- zCeG)}V}9gQuYN-!U3K2u{gIZm5N4OxFRIar?3BEf)kSbxY<2{PHxr?C=lj_hBG=`P_3MgL`+1yG(@7&L93QOW9hU#y10zwQGGo_5aFW(+Q z)V4U8sv?wKktzptG1+)!Nzi!}GO%KAF{=KnWZKIaR8Ix*1)oT!$zIB7kQ=yX6bAWv z1FRGywG8nI>Bpqs{Yi`jYq=*H8aQZGE`|KAF&}o2pD&H4`0?f3TpE3h#wC;#vuId_ zZwDpw`FlU$M$GKO6%3|iTma2Qe3VqZ#=%5fur!8swK=(%)(L z0@P=zkiYVA!oC$1K}mL$xb3tQhHRSFdt5 zV!t9L|6BYV97pg8VzTVzL&aLB!O#(l&M!aO>%)CItfz-z-(vdBteX;{CS2_sQ$`}r zd@;+(;UDfqq91Kdu9X9$WkshrVMcb~cKX2c(^NMV+vL9~r)mq`l3=Zxs0TR>8?M_H zIeLN+F1aDGIUwux-`Jcv3;nAw1tn^nx=mC*?S{?57yMqio_%S^Rc%f0tvAS}_J=IL zh8Fyr;~AV>@JVO^26|QR9<38}T`IKIodnK>&E(awsa} zy@`l)FAvZvmF3QFm^b?B{%+stU@m%<{yM58Jxcna#a&Qk?`Qlh6Aj_bFCA(vFdUbt zj11qMNdWWs*FTpiG zy2EiP-Z`a@cjHQvE^^udUh3q zE)ycIcyCnnIG|tr#9~p4FCNAm{zVaXag0fVSc)_Hj1nNdy(fhR z+Fp(Ud>G^%d@|G~dl`k#*$RcIbUJBNi4n$S5x)PWQL|pWnrKs}^i6K>#e`K~V%793 za;Kvn)ze|Y5q@Ha<{Z-Hu6Ui>{|GtuLT(KnHx$3O5Fpmbet2Sig2o*sHhFgVW?XPh zDx(KopvL5d^&;bF!-bQ(=*5$Ru(VXG*l}vb)s$b?E@WjbcM`b|vu6)JBr+pq!$`9mFLAf+ z5*wE$Ux%A<5uKrXk3s)QO~`D>Iai%ULW|UCP>M znKS*cZr`?Y&w#{`-$2Q>#u^d5*iL6l&?jLb-jz{j81MP~ULF!`Pv}?xR6(Xy0@ko{-myDrZ+$-=vQRFVfS+ zl%QJGuyuSwez8L+;onj=M?N7d5mzz_bHJ)cuG=DqcZ%_!nqF+H>66END&*Jt4g8kP zWF^GD2h6^=#ebG%LVw$2s0|Kyp9Q~E>Ukbo`QM%8%)%N}SEqz62^f1QR~bA{7{%3WdQ7FL3DRIBo~d+lDFp^;Xih#ZalI^Fd-nb+A@^k za*pNrwx`9AfV+Nht#5Ok_IH;OsxKR>HD;8Rp zC0GylWj&DMF{b`hJ=~&?b|GB}0htKMub_tS?ki5V%sqB5kJ^qt#q5&~Fw9XB5fEaG zP-a@i=y3#?ZN&v=00{ny?jRFEj4l@?>1rY$k^~x#UB5DBt%F)h1R@<&v9gJHjb-ja&X#Q05*u=iBjF{Dodsr#bY3ucGVsEV8 zlSQYWiwM&hbWZ0x%FpJY7Gql(66j)dl(Jby@6%PgD#OtCD`0(NEx;1ff{{|@5I8m( zMjtADd13WrkcRm2P^s)Cn$vl%GQ=8bJ*=G{(zhizje)!$E)q@-%O2Mhi!Bgf2ZIU2 z?}m@{s&y{pS@x`l)s}4GYUc{U4Wkp~_wH&IxKJI7XbSXG$(m=GfS$kB5rw%&pCSPT zK9nM;ie54#XxbLPDkt)ZW}(?gs%NlbRiN|hmEi)^SNi`UH&UL7;Y{%tBe-vsRvd|= zO9ejWAV^EkSRC$&NC)W|Ck*EPwyNeoCj3}Eu5nmdmu7S9=E!Yh?;6lZ#zjcD zKlQiJbCCUa=s z(=?7YDGa5)>63ZUKhF21-`^x9h6g(L<-EkoBQF(O}kZE zurcoqvd0-d@1p?QpR3Rb5P>AefR!_xj4yqrm$&WrgfE-o$gTB=X zK|rddIg><^&#Vn`ZPvRg{NPT7o?@yv%vb!M1i|!qm9g7SgQ- zr_RgG?~=kt-KSqIJWeqz*WQbZl|Sl@5_gwBJnC3Ud`0!Y{amIxPb~a5=$gP47H1BM zMko1#fn&N<7;{t=^VA;_ij@g8qMUD(PGXC|U|Q-TL3o+5M8v1qixCn8$c#;O(EVvu zk8%aJX5?-T9FQeQy?B93TgXvPO^T0|+yzL(GQBbP6O7AOrCegsTw?HtrSOb$R71pR z9ILcKz%}%uOO?ePl!U(???=Rh99#x*_06;%gZbXC$drnB(` zT~VKzHUByLo@DjpEv%XlXTNbYfdOLm>U07+jt|x!&hM^>r=ZbTooff2T*pu!M z)Qel?Et)9qW<2Cq6fsMGmMdvR&DEt2peNemR67A!iH%!Q4K|8@a=E-Jgj{x<_Xr3TJ)KPO z|8_b|H~M0P30{dxROD9Wf*sK#afG+@QEs5NTxiyCW&xe%fbap2`C zq`o(c@B5xL)8*hSNWMzUyjK{H6(NEV*pQa{p)dd9K^NjwqZLLk{ZP!@Z#ovKV($x4 z?1;kIQaP{U}d)q-VJV|bf}@g^pnkSAmGz90LK zzt8tzPUmzz^9A`ynxZ!cge6#TW2FVNkL`+4DGxnt3FJ`ri4~S@gzX$WhSdIz^jP7+JC+!_N`Z{6_dU-R!uoCy`k!@xvApYh<3AO6gD+w@T zOPe)%R7H9YHRC%~r2;CGLfg&GSvDOtrszkf+o{)OwU+4cPK0NGd|%AgL@QWBr(afC zy$Dy_e;hguS!F!f->ks5$8JFcG#8?Cqr9WLDr6zh(tNKp6=MB#a~ya=c~@R0;ZYrX z@QwlQ&@L=DMvgS98c$=zHfp9U<~XqV zsTVA0pruuh@!2@>+dr4D7422bl5qQd1At-ZhflG}6RX-=TY*&CG9vG95l^4upK4s0 zG#KyZMvB9GZl+Fh&BKjAHFJgL$lFfB&Q_O(qHYf{*IecUQ@YEs65BEje^nooWP?GX zT|f1JKS(?Z3L3+XNkKdUy(f26bvQfAJelFc_nsrjGcOxqKO1D%Z^wtE?aH8umZU>oX=t8oF2y?X{AUiA!c5lP``VjKonBQ3Kd|sie-O8#`Nr3 zC%q+O!V}eHdF_LyHV+i^qdy)9ppaUsVxfD_opjc?CKvCJYyRUtrgYYnA+-I|U&`SS zyP$4WGAizbW_d`tAQsi|TN{a?uZw`K^HHh4TY$%0-&#Ja)oEcH!2iE7R=xqEDBw;{Z(tHajuJI#7uC zZQb~i_g!VGJBK~g-BpA&!3h;WYEGYhbd^VHikl{xCvyn_V|A(r{n{lOFdUd>hi#+z zBzkkT?LEZ!+oxC}(Jb4%o+&RTqo~5F;wZ1bGhuajeYRNX(dlA7#Ou?Mar)RAfta+X zGlMvZ0<(FrKO>yXd-#)?}<(jP&cg?pToO^N1)_(Xl zvsIl1WV~xDl*9``nWl2~mYz`2h|?8olysq%u*ltA#6MGL-^(k zMfi31A(rmjB6G9O6frR-*Th9WLZsf`k4YCqpON-B$Y3f9aN3P7b}Ifx24ve6C7Uc{ z9eR#x3)_Zi)l8xK@eZ`scJi1dbe+P;Q6lKDx^dsR>HkFr1h%SpKKIv2Q3dfVWLWos zEM#(zo^1-rFz)>Qzl^_h8ZDxFNN54J#P&W~S-9|bS0QV?H)@DVhh?|^9WXUT2M6M1 zP7-NBbIJ$&_`7so<{yR>3A}}hs+u+8D$exO>z_neBh=*LKZIlj1)BbBB8N5ZNgR4P zqWuvMVWTam(TzRnBK4oCinar(iZ?RJ;$y^C$_oRA4_-5j*V`HBdx@w!59_vIk~VYA zRE^Y?hYe{4k}X=D)E&>e}+F;!!yT!?@$k}k>*k7pq3w8BlQ8<{Xpw6_t2MB$c?8P`t?jN5%YCVKE39^fK zbcb#wGl(rwzekoRk z&@@{Hto6&S?6wZBixb$P>Z1!bytl#;VJiDL{X5eEfqx}5AwR|)yfs~yPQ zwf;Z81(Xa8Mh3G;tCOztNi9Zx4gdc>B2j!>)f*|eNhwix!jQ|Vfd8^xb6ak=CvA{= zB6%#I!rs9K;v#a)+w*3q;XE4I4RNVK>a&($#w1pN_@x|Tt&SR)ogABY0wK569MAa* zbyQUtj!n&>Ykrf{pQEuq ztGv@3a%{SCS>X{86Gju(%Z?=Kh=UxYZv(vStWFL^!Ts4D?D@z zad(A%mkJNa2PQJ~UH|iP9_F3$L^6-F2>%&f0z|n_-txQmca$#;l@md zZ^%`;2)O)c+r}aJ%&`wy=|20*$%YdNmQcSi536m&?{$e4o7&{4(tDIz{X+Y}&!_)0# z-rQAStG#Clv9UF0ZK-p8?jrI2-&my%cOL?x)@+A1$L)rUrBF3Zh2_OCX7>0-f`eU zQt{g49Mq=b4w7)l8?RAHtvj_W&ZhSCOq+CF^Gds)G`2c{>KCa>s^fGM{TSlPMVPB3 z#|_W9(PWiGutbHlu&08j-ConTsLO3FaWcHH)!SA+HUj#7WB68lUzap zGm3_lwL1#u(AK(QxE9CNUBw_>FGsB_A9U1E-#`(+1x>+PcdzQ3;Pxj?_n)WlPNIHP#RM?J&Na$j#qK>IKn3PfX4Fsdd9 z^PnZ^8jeHJ@3?A;p~<-HBfnA7_4r4FEf>3%7dT~Rytq6-r7YswGS9m9z5{g9-*4!+ zW0(mrkfJ>Gu8TeLo%*U#a@ff=s(iO;!HQU>vBS*!e;xtE0W4Y`sm?p?W|G2Ru z_@rN;vDEeqN8AbXgt78d#4tI*>S8%bYH-*fM<#n={wtv4eJ0uSVoSegX1^8^gMLN0 zWtbW-LZ>>DlUo!11v{PXL_z7Ud;#wkMnoc1xammuvRG$Y%0RaM(0b;d_b(bl6z zFwSGfit_8wS|4$GfB{p&?nldVLB`93f@Zsien#1&neM{YQ&>$U)AyemS_0Nci)vMx zw`EZNiYmJ#3RWT!Eu0&5aZIE6MtotIRBhp0h2UdCFy-LSf>kq}$s@=!FIEdYA4Ei3 zkjTXdoYR)q#G_bUmN-B>@mJ?4 z;!e;o)~*-)I>Ek^<*rIebtN{43*OGrcKPEx<~--jTg!gtgv4oe9y>++ecuB^f^N z@^r3m&v{9hE2zYgP2}eM=f9vOq9jreq?K*}(gWL?X_Pfsypkpqf$;g!8+HNIF@97uboh>C*dZy? zme^JFzymG`SG?`x(opn`_y5Cthb6gwiVP%IefL}yE0eZ}czEpb$5vw8>cin2v>Zx) zvq0T?(4`@wZYo4{D6-z+4nvMFNcVUOa_-6GWZ&2*!Bbdp#h}Oq$o&Oaj+o@+^|Nxw zgV41T^zg)x=yBQb*thEj?1UN?>i#|LH^!B*BJkN8JE_~-luOc$ScuxoVm zs(4qsc$KmxC1qBmL?e^3xK;Ki+vw*0#YBT(*MDz=Avh!7k~-7pL%imx`tvsYQ#baI z6(Z2n!)X`(S-!PmAA|+`zO}N9po|G=A&jy#S0GEvbrt1S`_#6Y@Kc;K;K@LyNQpKu z(A3M!@xwm2@X^aoZNO4h5-6KK9!ENvj`>%FD-$tkm}%tEb3W5FRtyVwtbZ+4gVZfLWfR$Klh5}Rj=?RcE1NFgfm@+qk~`o+g`LZ_Zp>>rTC zBtS$!sp#F|7w-175g4TyEl(Mf{mN1OCu*u5YaH)|0(YQU&z;(>7oa7H4HHC=-&tZ+ zt{?C3R!XORX{`3_?_SaxseKu$iiH~d>Hm3xe!IjxB$2|FCU80{Tot=kZDDs1>GeBRbhs&xFMnjy*SE+d&Cx9X2|iRDx$fM{o2FedBfS6G=%rkJf&wTo4{nlpbW8ns z#C0Iuj;C04|P7wco_;tyzv zP-QtC%;xf48Rh4IZDClis;J9ANjy?X?H!hBY`>BW`qVj~R@V^!EjFe&`j%SqR4K2A zP;fu(%ZI1xa=^f+1PcZs`uzUNl zfZHGGKfQqi3}1U3$9iF|g*oKz#EURwjv}PTDTztv{T$6+hPxt4fSI?v4XYZyRb7(w zkb{+xsDTjC{^RFgUQ+;DtHA}4T$If=i*Td8-v;Wn)>~rU(j{(Qmz-rN-S^vDZTrjj zvw(r5Au4;eJGQDg^_5vJ450zgAXS$9F*4!g3^>1XC22V6D2~MLxb>~Q)s*$qfcjXv z{r5j5YasB?l;k+gRGf~6X{kh6v$4*l8u; zceYj(9eOP_U^l`8Cx{TF&LA;oUsxfW4p!fc@j*I7l`ItIM(v~ac*eVzn40_SUAYv1*&S8phU8tJdT#zB5@LJLKGE z?5x?FC;>OMjRRbcXHa&e?w7!Vus8jEWg60hDHx@5IL?a{F)OCC6bI2>S}cEf5MEm6 z4eL8v=W1@t6r<$5dG6!FY6`#T!|T7;X@N?tHnS?}U2yZ?hl77|k5^&wHX6K;OtkE{ z_M@#OX9Kf0qLpNqn3i5UQ+cq;xgNdl&|_`nv)OJMfsZyAol5TWpmb^Zm_&3d5$7-R zl*szCuf$WKTuurWpQSOQe44}*Qs-MNFmX=bP$C)?FEwjqi&jzAx0#d|ue@QHTET<) z-V)40ZDt&;sZlv;7FpBvw;i9_hj(gWz$M4;)7sEV%M-6b)4RG_C~i&8sy!A`k&(TV z<5pyQpFx^t%}KS9TxfzY~yJvaf?g`R2?Qc4{NsM!YV9 z2IGV0YS>eP?;QetTs?Xq_cV+RHo&B(d%eW~=$KZ&TE0L^uoCJWfO^A_!{3i`Iq>Zu z%zgd2LBQKji(vW&w^y&PLMIs{gybqnLeb-c7>q??w&^9_qT#5?0*CrF7J#WO|8?Lry z9f^-MWmcGoJWPq@)be{2=;9c9V^e%#+c|90B(4pvSzs#UamxSeBj(fJ=cAZWj!$q+ zD-Vvxt|$B)t1&Ick6wHdq?w^p;<#&mGmZCC6j1ag==)D{^;%QFm}aMmXZXD%k<=E; z?=Fz8%lCGQIpxC-*30Oef6B3~1(qSl)GTru&xa_|X}(vgu4UA>xvOjkfhb3-g*V@e zH(-Q8*c>g;t`dKn68->9M1cxqwK-i5luWihe6Vp3p?0nYQDRK&WT(_DPny%^!P@K8FSYEvIbvMD z-qFX5B`qr2ZzY&Zr56ZyY28rT$PqPw&w!y;sa z!r=%PtUviUfi;>pl+*It+S2O=OiSn3+8)XBYGXX@le^tTwLEJ8*}wgb593_lwB&Y2 zaD0e8=-44(r8JIpBU=vD8=bzQ9FA>j^39y;)A=1IQo-pP{HJ8k+8Y{e2*P_RFOW4W z)jSk!*0q%rrSBh%w-urB7f6^EPjHljulq^j8~i^FRnj&f_Ao7VgJOMDt_`gl-QE8P zq<$iECN2qE88I@LL#lMzA~rhvB!Jyr&ciuXpU*?(jMmhW7Ld|%2jV~3jG*^g=PjFP zxeOux{cv1=J=W<8V}Q^PYSq`YEC-cC&bPnXmp5r8|YlW21D;?b0X=b-z88#oz3}E4+92&H#g|7 zjbAr#VpdT4eNeQ=wB9_mpl%!Pl=fagvgA6VM83`0uV0zUFR$XXA>>8kHBgZTEf5A1jD~Q!bW_6>Ns)K>Jy>F zc{C*Oqu&!A9^gP!OJcVqa@0!>8d;M0162QM zq1-PPwh6zrSk^RSS;z2AD;)vfaEmD{9ajv8XAbQx0=k27{}!EZ#z7-xgu-%FSy^s5 zkVM}R-8r;4W~*5|iR8@&Bl+$NW$c!g0L_6^V6VAPMbXf&ykI@Hyzks>=P-o8fgrn7 zK$Un3u8`zPtU8l2a4;YlF%Ttxn9K6!I}qk^Z;67W&jQ1G76F&{JS>=d0?r31vG~w?Alk8jLtb z_p3n%)w7BqwIAoPSf*(r&8C|U9FFQdT~Pm8AV@^Om7M1NXAe@pb)?6JgmY|ij}Keh ztJhYkTx=f23_X(h4J}F0$PnK2k<8IL<2|+4*2tJswXsa<7XG|+!i6I?OxaJBS1P11 zWrB#B{!lhpKpvX;8r@3NFu@Nwg|8hsu%-nTfc00^HK7C_5%!e{A-?Ao;oJ$ed9Td8-o(>hK}WqM=5W;~6CtO(K)j%^2nz4js%f&X~#wkJGaB!ViC%1xd7&udl)u!Mp*@rX2Ht05M%I% zf<2EVBu5&MCHNX>))e5JdSQ&eY1 zot&h=_@KdpD;FZKrQ_EpGT9qS{tCx3SsYhQ4G8g9{xS>3RTQD68$1@fAu;X+!BnLSR-i|$Js|DNAg3_kE=_HRBy$ve;Y zWYl0D=*wq}K$vFnY?8071P})WOCSWDlK z%+NUUn40LduB3L3Q?b>4JIot$U1|f>nvj~9Qr@tT(%CsrJp|-0&)tiEd4^HfpHkW# zZXbuN&z3psfaEM@8X1cMj63*`n5%wF5fF@%kK`-T%Kq*QF8+^=QZhXS#{)bI(qAC^ zSUQL7p9|gY5omH2p|X%y!CM_>O`Z5F#kUv`{vX@i$iXmMR2%yumG_tfJ>cnP>5lWQ zml@|dm}8P}t_k=R>{PR0+qyAVM9q6FqvEBWeltVIX#1!c*zoI!xKPT*o2yV_En)TR z@#8Rl^4o{X2Gp( z|Hq*I)e%yxCKq3pc4;wldLUnsbYzKMJE{6hNrpi5?#7f*fYmh6S zN^5Z~`jDwCgAlGVml4Q?-rl!tLO^f#J%;%mPAfuKHC9tf=y-kM#r+SV#&lUjRGf(s zwI1LfMBK5FI2CE`$RM=mMe^;>;lkcp3vO6Bu|R{goX;&2A<;Mny9a9ED3MV-z_xo} zCVg*2*3J@?-@;~BHJ&NRURe4|!!2#FN2=WT$xME1zEZ1g5Z}J^1V_zkp-nEzxNekz zqMx{ItGWBI^00TXaR>Z%VdYe!S@u%Ftxgi zsOrWY6`ebR8Q1g{oQImZVZHm4$se~BC|HBl)W{@B3MruB$$7h=h{+uyOiM-fK3+?8 zmQ9kvd`FxxPw&59q=|xl|2y@0e-SbS=Eh*b=GwQ}W=+ffOTXgHwQ!ZbUl|zi9>Axh z;$2=4-^3LLF`wlYyMAQnJ`x3-9iE?|T3oX}4KPk7sO8(14PJhMWpX`b+1rIPH@*>PLd{&8E$+?`QL{WR=m3sp?4+?2bn4|E4?#+G9S zrbz`Bk|UUmb^0p3uU=fC4cyA`ajBAxVM16DI_(oKs||*7M*?A_G<#zFU%*|?GQj;) zI@AMWGL)Ro8$Nj8{oVxJWbSzJ?w;gUS+w^e{y7wy~GE6M4_ zMraBC+iVEy55@nCe1kw7x=T*QX3+`U?hFJjF-Ql-4763qsxUfwQ}I6)yyt@4l1(#H zvK$%64jE#bDAavYk0EK5as>y_F1`ln9=89@ zPztloRV|)RV)4(jFRjWik;tyu8{xfL8mu!;rw=?kElG}RTi39Bo`!zyiuQ6AflL^{ zK-g1K%M>I1DPfTXaB|DojkJYKB^HWV^aKFI%u6-~HdDr2>OOva-!ic(bTk@8F!1vp zk_PL=tGmpNf)zya7A>1gm6%NWZGtSfcH)uRrw;Oz9S-@*7KV?v!GL}3laOmIoLm-h zRo~B?m**1W;`$>EMI%0g)4c^${$Y_ZOf6JY$SOo64n*yu7LJTfo?fw@!3ZbEw4T|_ zqK~V#ejOXTO3wq__g=JDM8;a^bY+o_;!_pmj8JqTqE2yq5m+rTu{4RIdZ)Pm%eSei zaKDboZu0F_v=mmkF*{8xS~Di~Y+O0Sc{&5NDWxydUl?S~9j-_w=F0mIUKyk$;y@rgjQC0$rDJ|sBhx~#Onl|xJhpdlQISHr5-Y_+ z)-)gmQn4As2X_UAg;7}A)Do zp8@XsDB7!!bUYQ7=p$L53S1PWhV~1FAU6)`rHIzPwpdI>g-L%oN=HGmQ|?B(YsqO* z2f=cf^!|5sJ8Ch<0oW_jhoz54O`Mb}r{YIlh?@)I$d8ug=qK+!UXLZ`w3(IfEL?ee zUO`GKMrhQvW1o)VVbb?-TXOl?zRm-?K~0Zxq@1(~+TL7V#!)0led#*k zOl<@ZzTclg&x`y0wW0qhmcJ&ula%~`_UDnn{d!Y1%wJk*u(p))SC#61H-;~;SIbzC zPWbTvqe3lO%UJP^VNn3_*1#TDP6_YtCv;x^MQ8llgAxmUBi!wtN!#qhhrOlzlMzlN z#IJN-te~74ttHR5ZV-@9YD_WKPdNklTSV(IkOwS#e(k3SGyVl zCV2Dj<)9a(yG>=XZ-pAPp#{QXK&aZa)zh)y3fK?G84{+V*ZY*R0@oGGlTn z(9oT!qwyRtU^||IZF%I_xi+yH{j^!fIQ?Y~zCcR8T6p&AynG*}Q*AW4yYum4it%>G zwtb6FFnrUjM)@w;?7QylW&L9Luj+7dp-Zz4^0QxBk6(+&AgB8+F7<(KL3ZJC4PGw>=1!y$@u9~baUat#^TC)@4MkX zgD>QCLZpx@kVjtMbxJNg0{h8xgFHOn3l_B1l^Z+NOi>8Y&kDl%)EkjmLNfd$DD`|}EiPs5sn(92cQTTh~T^%tKU5e&@_zj7a zlp3nZeHQGnfkyzf^3{xWXvzLdN(urnVmLm}hP94~Saln-$y<*{ms5qZZciLvuw@gr z0@G$Xr@p8&C?VsjqQ6iG;qJf>ye)<@0KJ6W+c#jeX+t4Q?g-=2$AYZo!Oz=N&RWUb zqQ%K6=)TnH?}nk=KyBYg;Sic*7s?8DovtLjuJQ_4H{VS@pJbP8h;^1*>0>lXn|AKi zGMV0Gn9XCjss3rCI!Uv&#vkZ)^8U*l$Dv&qS1w;HLEtG`gy-H{m>lFc%7KQ4@2Z(X zT-CeKzVTSi1St#@)U@XkB*aUb?!N0J$|d+nlPg*4G|!$klb}!*Wwv%WiQi&xXX9#| zKE8_=ss7&{!EPrOPDyMTk=wS*PmN}~JNfm!#nuaOgA7ZP+qma(g(${RhzezPkC9W8 zx2!cHORpIqhck9MnROUByGLiVwZy0!VIX?m;{-Ge^YK4J{Kp2swHgVm<+~Obec`Js zDV2l0ksSYzUMMr)h3=QHCf`a2S^>j;kT~a(HV&UCpL`*Xg4`L|Q;w|A_eehL;tr;l z{UDf+R;*HV(7WNCtfBq=$M0qfmw@ut6ZMD5#*L~*yYtSJwBIw#Bb;ozDC_0o<{kHr zT!hHP%l50~ogu3>3l*I@8vSeKffF0<>L$^z_`B=<=Fyc36#aReb!Cx!xP7H6z=+AjzlE;nbc{6yt?|MLy=Lu*7~#-E}k!7PH+N_8Rhl5 z?B^4I%0?8h?xl#i3=f?ikNc<4TfBMc@c+aneA7;JB1~A4^Wj(mxL_+}E>K_`)h6*y zQH|R>Lva5LLMg9M;9(Z4QV^*rVQ$6~3tZd3d=`q0C;B95mEh01`f}czRc?qb*Ext> z)9==*7>wHcu^XqaxM392Y^-}5sE6FO2`r>A0@_weMJo-rosMIL6cfDb<|g`n8=LJL zbne8?yke+|HKLM>AI8=slFT@KtyVffY;48Xnz%ufekopVOgz(>7wg`%bnx@rH#`q4 z7%$qZg%1|jG&=|j?hEdfRxlwBeFU#_V(A?zcdXW7@cnqAty!DoPF(}Ex|eR0Ub+#Gl9Fza?(QxL>F%YLZlwF&pT2+m^z6c1JM+w(xX*pg z%rI^>);h_O3(bHhdZ@N0ie}#kIkQA5)Y)5Fa;$}XTK$0yVbaCSz6w?xWf%n%@Zj-t zBi6kwx#(-(w@JK1mW^L@u6JO+29>9Ja2Mh(M&>gN2DnYztOK@;CvW#(6N5cvNV#H*91rxBy5%C+m32a$LAy>m~A@%EyFYHx4K*s!Tx)Duw1y)-=G1>_*+B%Jbs3rekbW> zu>19@(^yx7l#Yzal-F5x0CTNkSs#|FTlur!M;=Co^vQv+i;&Y(nNa&;j_xpBxv#1W zX*?#A_<|&xhu7Pfgsv*EEbqzW3rumBqw8MtXIuutwbtkF>wZHx?t8o>{`1`e<($BX&_ z9HUB6GviA0waH6wjjK~E*G(I(Erh77l_Cc6(N>3oJ3=2lxLW*A=QRxKd0BOWi+k0B z<)GduL7gId;>F7_f{J;3U0G+^9dzh=L%HnXq0GvxvAE8JVro*7khf_BTdMu#A~0;5ibVM z;yLmy^8%Tknl#TVIWodx9+b0}=BCzvzYQLOn413{Vg!t62#w1Q`N-6)eN87K91GzR zMbaOoC)7w}%pm{#C&vx*0Yg1hfkO~EZg6AKRj50yDr*VIw?W_mk(y6a+O@}m5PVe^ z*j#FulsT8ux3Vu-i;WHNaS+a8eC*xJXsG8;pR8{d-MUPgSyVwu5ke*n zmV!wFhm0}L+R3s_aM(Ze2n9jVI%d#oDLS8v7ttExkbgtj$xuZH_#~IRnr)plgOVHy zrsj0wN{8G_LcbmrJg=@TPxBkz6EMt-;RE|MY8t$yT_vjKkduRjhZyJ%w$U z5h~+2g$P_f*kd=M!vVlB>^T}ZPGKxusdpWb1Y=X`B+jpd9N{fFWg^}LPeDDug@5P? zd-dN#jNlXvp;Jiuftg|Q%WXRjb2*%Af(&W$&X86k?0B6p_atng;cv<|9WY@#$6`Axs!7c9&>SnPziI6cg#gh_ z$x2L<%xq;jenR=EX|Jh7e*9R#?tm%qMaWC#OQvOnJthv!gBnr+&5U;0!UglvHU3qu zbwHfp6x9u-n(L?A4V~^&K@~lri1XB@hz#>G_R<*vziBLODWvUVT=r%TuUD8RPTWtd z2udEA$52^HOYTc%2IHz699+u?Nc5jpovBky{d^i$lhb>BlDid4niJ(49GTDd5p%)TH`fdW_G-QsT}@A-lc{ru!hBSkT;DoN6&2_fMyrB zyZ)h=@`FOjgLFH_fg9=pEnEM>a%ugItki02;?kO84O;gP$$nllSEb-G9)g6+MfaaT zG3i{(s)-MU09+9d&|vp(5GtUgp%kwsH>h%8=2S0Pb8=pMiw<+htwxt6__2_&qES$LzO25_u6SW}zuYn159jM#^Bnj@E;9uA+$Kft zApS628yS1@5e9oVg?hbegfTT@fLDWZF3+1dbH7uyQEyw#AzhJbjz^*VJZ!)@GWLJ~ z@IrCiZT@g-Te9JUf|1akknfP5S;E*mv(*!|7ZZl!O zoPR$pmiX|0CRhXVs(M^M)i`7{&~1^f%Q+@6wGThzY!I>3-(oJ%cp3E;)XaYJ-PTC4 z1aMo80B2J$OPw_e0P2*lk$OZ~iQZ&}k`w_{Oj*y7_U1^9A#EaF^gUt5r0h1fdKLoD z&Gd$~RT+dGd}>O7bEPA##E}6PBsV^1YH*g{dPz{1IOhEhHF%kQT%dHtjfGHM4I9?wV3unso&3p5u zr$&Pz6ZAckZUViupC2Ygu!U7)Kb`Llv-Kxi_@JK;1GkgG!)#PZJ1VnA33pI*kTZ8B zjR4G~gK?pgW2}I8$xO?@PXrbj|6K3RMUur+?l2n!5I8cLXB1%zI;jVt-mI7D(&4U(X6m3RVy*3) zWv-P+sy_2xu>qUUNP}6^RhV`GQE5XR2i9NrprLz&64EGE)2!xSnp ze_H3|J+fn4`5ydyLyfN=V-n00DI%xUp{S}C*^q58;M^*t3eBIhv~;vRwP;Imq3!2UfE()2J-f++L=n3ItJ@1Gk7?~8yRWU_#ejv5(*`XC?ou2Uv2k&ZN;K>5Lzq$-7r%L^{E-`TG&#l z{qFmC?8Z3o-_~6iT>9H;S zvH!54;`DnJ5tkk-oIByBj+#9=WLoEiRbnA^f_7kGX~Fo z?-4Nd^XU7a_YVOh6Tt*bRNO1vgI~k5ImHX#6Ng%-;1cL$&m63+27NpfhAsW zzV8g!ji<}Z$JSP3>ktG=uWqiWesC_sZnD*sV88fG!TYNBsATjwcu6_>)md}Tu(=*5 zOL}p^=Mz&3pNWIrF3H_Rt&xb8L#%lEYf!OUWuEpg#-U50Yq~f1HWnT@unJk1M!Nxm zI8Uwid=$tEkK%$Tw%?`zfLgx)R!Sl*zAk3y9fAfYJqEf6U}gY`KYz9!>fHd1Rx(AE zTpJnWl-yQ~egNRbQnL0E(G4M}oq4H#z{{39JM?Lkk8b1-CfPM02u6cR4Y0{On#I-( z7WbOnU7I(gD|yVv;O&BsYwNFL>v*WLqBIr^w&c9w!>g6Z!iTG$#U)ed?> zmFb#FqevusXwO<}3$=9PEI0JsNIwQjC)2~AV=KqyR;9k*;%52wKl>Rpi*p$=5n^~S zS}#~k+I=^A55QWlQ(&5?Gl_957p*HB|r(Dqn!$s9&=tbE1$ z_QulXgm?9kdw+2JXTGSzgp)Mt(de?QsyuS=CK*9Y*c)j^6fdE8v!A9|bK!}=LDq~L zIc$B3YPB1QT|xa&duh}c4U;Q{|0Mz2<=h^Mj=~W6D-Fcy;v%)oDGB8g3?i&qzZ6+v zIyUUzYneG_y6;BTW|%ij90NpzpX}JJ_$sN&##Z&G6<*gsHBG&`G_SP9{0ZdUCp|sd z_{6Ia{3r6^3;{c#M@~t=DkPqggj%9k$$1o2cZpYb4;gQl&{!nRPDb&&?oYny-&1-C zzu-K%^_;M~^L_44#g=F=RXSEKWxdPLYKS+F8_e$yEFHm|ve{;n)S(ALMIshl_v7q3 z4azE}tFnni3`RK92|KrY=ZS*S6Sd?qqD+s&_&h71@Cc;>5!)q^4Y0{n4UWLu_Gz0o zH-UR)2C`@B-b$yUNQLF&lV*<3G$eyXbX};S(OdaVCxC~t`9t~bl&9Fn2x9PnU^LUg z*E7YP#qlSI6wKTJ%Ne?x>O#MBR)#p;u>=jkl z>l9E6=bTWaEf;&~uRVsGy|uTCnN9Kec-X+pInZ(W;~baWtco>PMO44CnWNRy(MbBd zx6NwpTM-7x{dC3}&O)VJk@&v8Ze+upW4!N{k}?ldS8VKtaZ1qorsWQB0LSJfgYU`> zU^2Kom-uKsK~K%TZRicBLFSrF9fv>jF_!j;ue*j07KS=H?qPjBIIQ=_W57*g zMsbp4=Gotg&bW_og;bi zLT0bF^|bK874LMcvi{CMxyIG>LTf}FlDQX(K&~fSE`J=k-alsL5lh;9!6OiU)9DdzNiu|7S$6fApqF29>8X$uv9ddjB z(~n6D&l~}4$!(nA8sORVmEaR{pe=1FIp>7Y`eHWLTL?w+a0pC3m-&Mav^^P}}UG90=MGBB+4^k>k8dp>>Qe8$G)yjz>71k=m0UoVmcX0strFk! z=STILJ>Lk>+Ln*kOdga-*M2CcGsMCYg1cRp=!JRYm{EQidg@4Tw8irq-!0KpE;FAR z(iJ|p`hmPLUs=komZIq1Ub|+ltvY4nsiN#^sa{s@ROFxJ2}d5T0Z{EW7yGzfm^ok> zL=lMFBwmpoi@LuW$oAs0UIVr$Rmy>IRs_T$#~sV@`9Pyx$;?LTI2jyPy*eW8P+YJk zt*T|LYCP`f70cHYRt5cv5{zCQ3Pl)o8g+7;T8G^s8;xteyQSpj?&Xamz(@Iv-Yj+#CdXo@W}N4Bb=rj5M-<%a^~z9B>1I>NC8zZ%8-MG?G+O0n04s!_%9QyC9v00ioB6~a_t#I(bixJxF^Wb*y(y*MC zu{~rJOg?oM9vd6W)DP~7(;wumi z4_N%yy_d%i7cULC37OHI?BV?B8CWt|Jyg14mZKsnxt__PN}zEyj2JyeZl-TiXs`e? z!N!0c8fT@U-Qh^$!bmgC1!bxNpKb`lrg3}l8tCf%q$#F0DJE0eZa&e;SIkrer@yfT zCV9Ef3Ws{Q7?=erV(3H3L$0)z7AzE)41@loX}35no&MJhWK~z?^!LGi|3r@X;>X#| z!Vh4vSvRq6P}8$GI7%vsr&gpl=ojAsuY!{lELZvVuRRQl*??y z-eM#}S%I_rSf~$|3u^aQXwUo3sGwi?sBI)MufuJ z>UG}`z~9eQiX|d4O-nI!Y)iGeW39J0F|l=a!I-M43-( zO~<#0Mv+S9Vw5Dkfy+ZZrWI2w;{?xbzBEnbwEmo50e2NVNLGWA7Fsi^i|Iv4hPo)m z_uL%{K4Myi=KO>PQh)I6l&`keqmDeWVi_*xdpE#YHR6N6`{#W&B1(=SQ(amrCC#jG zexkFVHh0``kuQKUf3>F*Y|+zMln_b-3%r!#R(4+Eb6%aPGz=w5wy~@pscIeU9B^iz zm#m$u@xAqZ7=Df&9rL74Ma6IStrMC`K3=qbGCG}g@Mf*>>7oQwY8_lTQ5b$qd@kb) zd?r~ka2)|1?t@kZTkm{98PEm8Mg3AA#d@bm9sh&}m+yYg)D|?_&)yu z>A5`kN27aK;)46+2UQoe49gr7JgbnumyNfihh|kQ4KBgm&G0l~>wnIn`+W4{O6BuD zwvaY4;3Qa1$KF2Oqk$@ceyYp)FV2wsIkPjWgZjpC^>rPxi_(maKHK9_Exc4d@(=TOT7omu#B^%Xt2T@R{{*P?( zqYnPHi-0QOgY%o{9^TJ&o&%S`LIGZ7K1kVGL;FJtho;XxdSMO)v!z@|2T%Rw&J59* z#BhLf5aCLh=Oj!m{G(gR%v=fL{TDnp*CQPmdo(N>)PbGp44hLTcmkG={2BiScVy_Vc)$bo%*mqI5S>RJ@!|LK77@&f`;A`hNt|d7S3> z2k_8^x@j~dfL2zlj9BV5&6l#m&xnKRa{&Aso_hNaxg=S`qRxMx0`3kMoIF*j;S+QDM zRMdE}#;?A|*Mm-`rTxkx?57hRvX#!$6c)4ptf>3Of?3%nt0HtjglSngGxqR#cgk6} zB0xLQvaY)%u7tD_8PRny;(fp2%lnV>#}dJ%^5esOtb52wp(&G#cvax1GKUE#tM|07 z^s8%A)-F|^Vx%2m+9lx5*i-MD+)2L=78 z*^r$hzvMj;m@4|dIK{7G`ef}of7aKV=hH{|%&4;W>wIrV?Fy_!`}b&jlt1R9sAaY^ z->?|)^1+3%&v2xt?Edh@Ix@)BI%(ft%73*W^V>(j=O<%<+FbnYb5xxgA+EsV(!#US z^Qp6ihT_rFm4>yZ@4$k&ug*YO5#my@&YlCgW`%ig&*|gdjRB!993$M*%6&|^lwLbz ze~ZGRqQLab?vtHGyFM<;58k>j-0~e2et5qbH$kw1v=6N|xdZUa+{;2#@ zTy$~dT8g~qP;KMffsPc6>Cr7~0Sa>`D6TWa@?CTF9_lvSl~l=RkJLlT{i3~*M6I5_E8Gp8eW= zJ9MgT8ob8Vzh}?1m=1{(wW%`7c}Pze3({2NGg#Vj<#79}-t^GSb+kDRH|am!ceJ$z z_}(ZNugbUF%LsH1`TD-55pvmw+n+3A=yZSe;1AC?5=^Aulka#^1&Sr!pnL11MI}O5 zEa8xAF8p~Ifc-0kLRmRjM(>^QLL>Tjb< zF~wr~*XOvoMecun<<~)aGL`co0Uj+cKPBw(SjsSN1(htv!>Y%;gKiq0?vZA=10@C8 z4(zSNjdfWIAoFkDU5*qNRo3Ii`LPHZ<^{aG96L>$+qDj7c ziCq85sf`~Y+G>&K>f(SgD$#+%RcZU~dwD6RFSVvsfEyHd`@+z@6ota6xD@qJ=*AqBnb4*T)x^I<6piGML(Nv~=W757E@+wq1>a}`ryXE*(* zAy)pJiN8d)Y+EhzU<$d;IQPZBDSkhsU_5Q1!vM`NTUr>uAxHKXvoN-qfNhA_80NS&%c{xR8{qgOJ!Ah zh%>?bC>r8Bw4g)#eExNzslF;m2_8qwI!ZQZUqe2O#LsdHJiQZ{A16 zU`yCCC*2+9z(i(~+VLEx5(vfA&dMca{obOas9%s}R3W(JZ=4eXY~+=(C#U?PwTkI4 zm2K{W9LVkd3!o9qLbpMy!e*Z(sqJbL2@7xhV)+L`JcX@)TMN_Aup0eLgsPg}@~zVS zUTtcs^5|h+(%Wz^Rpi<7ZRUHWgv))3F_qypAq#(6GDQcJ(`nl1@Lz`mS|2Wr*L9I% zt`X5TRmq2<^Jg_0gnmsoNN)zD0P_xhO_UhGz_Bp@*XgmxFr?Gr|2lO|WU1LSd91cm z)Yj8PceSH!x<+iec7eWx`g#1l8oQgMw|RzwZz+BSM?Cy3mB}xk97*o<@V`_o`OjZk zbWP#kNlXHUk&0{SlMP-S{;YX}IH^vL+DMI2q415?1)o%*@5Rhzq2~**a(Z*JCRpCq zqN`|PN=obbynisvlu6cUiX{Xsc9&KUJ$lToc1++4dN#Gy@H|9Kji6Rx#qVZ^MX~tJ z5A4^D8dbp0%J?WIIpdU3P#{n4%B5~% z$NZ+fGL(gHp^Zfx;c_qZ@@rpAIj8vLI7=)|C4E4og|dbXnk99yt7u ztF*2SZps@AYEovvd6YpiUYtu?QazBQX_l;gUMz$q`c5uRCeF z9SCbqFmh#l9P2I9$yd6h$eO>rA6+M~J`P;|rL*)KJ!&g+M3R9<3{a>Huw8OlFWq#y zL62f-?H6I9@h{{?^hi>_vrfXAVO>XL3@8m5vglYXf39o8%=1FREz)jkOJr)su&jBs zfx0B@^_Zhrdu^hRkFVOddc;}c-mSk#dq_36lHV5jlbe&xg|Cu3@tPO65N|7j?(@Zk zk>Q<{p1gitl@5q=jxuRi|H(*JlF0GYrqVgcqtl00Bp{K%E6V2+;p#l3D)#uGyr>@j zd4@C4!(%=*_**So`lCj@-kr{w$F_?A_lkt~9F^{vQ!CQZ7$mKrhZgCY$GsAd;ijn@ zZ=@>;1-bKXd(D{vKq)ceuaw~PN_~-*YbAce4d+FZnlgx1;sx4m10oSCt*GjK8B{{kJ6-5{g2Og?vNzZmX8f^M9D@g}Hrkg-hvO|#&+X{pF z{?Q-EUf)y=rhBrDLiU{Yk^ba47;p;ORnqQc5%%fiRM9muOf%L8+gT`}Lgpa_CT&@gxi#b+VXL18t|K`#Abua?ub7BaaBn62hCV_w+rSW(;P zN4mT9Y&m+BSzi)pzmWyv=)F1P!Yz|ek<~gvSOcdoLG>NfMW=7>UKtubms<)cI%0q6 z`Lx+0ItHEJ^XU)Lux#QEH_xN`Rk<`&>}k?Y#XEC+ByhkwdzEc#=S-=9>9q7bgwtdN zj~iZYp>qQ{;z9p%@kXj6!Z&=;t&PL?i#>-_YZ@AqV?fXhn5eq*89X*p{t;`jj%(1+ z6J%GENmfk!-IdO#gV#r{AXK{vyi!;}U8tITS8Z4nt}302TT^>#mEh*A;ijA(SH~A^ z{!Ps9pU{hVDjD8cE0I8iUWBRCKvD167f#yYM)Rk^#xlvRxsoqWI==WH8pJo$F+js% z#OaMKb39qRe(%hKBrP99_jd#u#J-x!$ev*)?rxNPZmy93Q6NDsDVL31hYO7&#amM@ zvR7f1s=qzB+QJej*tZ|1-=9<_!Z>~)e#O>r%}X8P@*lsq{R!VCDJPy_n>&tZRrR!3 z7EEiZtcS#5olilxF>hi<)ApgXm0c8@2p1Lc#YIK)TnR&Z5f*`91p=nhC` ztvjyS%>n!FC@<;h&3sIszf0l3y`G5ve${tw^X4RlKv5|+;4T?Ul)+O}$VeoKB3zT8 z*ilXJytw)TOe-HVO^6u3UQ7K?Yfgw5QUvfBWFcB(S8Nb>pI@HopWBGd@O-%thg_gq z)DU7vX)$%C_J^_{G_>dE=sBAX?^JcyLc%pe|0waEnaC6u6G)k?87%UPyxc3mlkP*$ znc9ndIUow~b9i#{$6F@bBdT>!7uet3Sp=#sw}U%qunxZ3Yb4ywDspG-mD2yoGVzk8 z#gEu)aFS~QqV6X#)dyp`H5I5wxiR&l3!h^}KA3f4R=Ds%8vRRIQ%#$g)mWIA6(t~0 ziC=~}h)#o^hm2@(Q5#gy!i;Gboa(XurYdnPblB2tM&8tO3{^9qO@+^Je4rYH?)p~x zZdkE|{mU~}R?C1_P)*s3B$+k~)I-Kz4;eeN9%OR%R3!GF&v~$RYB!z*4Jmp^)%No; z-mesh75-H}a{D(NJ*3m&UzEf$5QJ#Gv0rmo@L#YcxDV=l{fw;+$TipDs6P85R`}Ax zCb`F3%PZ@*v=CV(FZ59s+z9^=pok3G60)U_N4> z#6fO2+jvn^Tuw%5+yR?Zr$*FyKI7HJR83aeN+PTfX`h7k;@A0w(ac9OP|WkR^D$6j z1#-MzIk$nleyX5o(gAB&eBs~ZECCxA!faj#65_Ev+Fc$#5oE5_OB0ag5v_fdPzaX( ziz>;0A?!V*li^>a5903i>7lU)Ej>&Z$-F}@FX-rcALZ?Z_a8Sh;t)>kzn+W#LqOKx{aiC+INJC_noi05N%3cpts9q|Faekg~xIR3Ml*^gN_V0W^#e~3h$92-*v zKdu`ic?}9*ICA3uDo?_PPjD9;f&QjLxzT!(h%s}%s(QF{^H&C~ox{7YQPR7njr;Eg zi$-5jyocn1aeu&qMI3lwVtCI@HDFo7@-$f(hvM?kuaj}U=Iw+we?#1Xinf{GLsr^H z{{IaaY;Qb9*P061s?8>Gb^Fqz=bo3-M~J?x_k3BZxNx7;e6^|_DofHAG^uO4s_=fv zGzID8KVKYylGlV9Gc^AurQ`||5R{QJ{abtl81KwN`Yk5jM{g#EN*zE(&Lr!&{=Y0q zbXA~$i6>)9nDy$l+&>)#I$><||r0tS9Xjq)) z#KnP)aTj*)49U#b@_UM`0V+YG z&R7}h);}dahH+ncr5R!JtKl2~xxlnaUIwJTp<-j)L>8oddIiLRt5jYzS?eAJ7)crG z|F3U_8}@{I(Eadkfz_xJ#|$NxxMap!bn_8GORf@kL|qtV5tXww+Av{J*L9?9o_`}L zuBn{!NI{G2ycA_YxjzV-n*)&9?oj+XTR0X%dXONp6Mjg1jUlY65~zOEWyyg_3bq_J z%~tb8IiL=0r46UuqyK1!@A6;6^}pq+)t!YFeq*oMqZu%<-Ehan^`AwsEzO#W8&KuO z-;TeMsi3{2V}mKelR{4wg(A5l{Z7K^y{;B3dP@wcl%a`x=88^^O;p9!1cdU^7^ka?C`(LKB{Rq7QY4NZU=oHpyS}D zDZwzJNeT&kV<{vX+ntO(%6V8z5trNbcjt@gN13sNjIdl%9ZKsx*2th%2>&a$iaFj*O?|xo#!W0&5ez%w;$${)R^jJb-hgf{t2F4^+-+e@8{q2+PTQeC5zG zMMv2L2&?W9F00~!mUKebT|kv}s`sqY;}C9IEni&PW>)7{!);yS%(HHRZnrIwn0Wu2 zR8i~5lpXGm_?KZzm_Wqe5`jG*a>lBR$>@VW3_Go5euE@y1wB~q4M1YFka?+c%2Jsf z?*A2S#$2Gpn~^=pI{E!RBaF$w!TnZ5aoKW+!9}FBud9PyJ;$8F!;)6!-NB(P1Lrmu zW3x0fp+e~nvMp>~hxW#W*F4U~KW)WkY$m9^ z#X3Ztj(Kt0yZ!)~0Lk^#fKAp<(CtMB%!s7JQ&Ic=KvLC&8MB|_c%jVY-CAEq9n9*D z3Pf^FQT}e}5DU2SJdJp^K1G>fDus$Wv`X{a?Xw@V{-d6=9~XiMuPi8n zA5rr9uj!}0-q*n|;~)0id@f9g2xRSNj@6I(DxuwYG}hll@B$O6JBSj&LimYdbzUCA z6!#JUV&G%HynVn~Q>9RPw#c6t za0>Dl;(||J{@F!S10`;{HN3?beMmw^uN6O1#!Rb9jp4i|gBu&ay6o zkA5IttSoM#8Gr_ltaJ3&?>s2A9p8LD<^OoN`?+~^9$JR$WW=kv?&Ie1l`C_b25|@I zx<>M|gK*SSzNRhH7qGzeN51vf`Cx&+faA4&Yk&V4QD&!SZsFj#CY>>3YYH$VPcCQC zqWw+mj|(?-%@CZYPSP@=6pHg-8{X&DP zv#sXVj;pM?BHha38N4egmXi{`d@~h||F@WumZ0ejxY%{&yrYiwrH0x}C!+%nu6u=~!hA4ZxAg@8ITkWqyPWiOntchrUZ`?1oe?o;b_eb2jFnDOM5D7XWq?#KY8=|Z(@Ri zsJAz;o0v1K;W=dH%7}G%7=R+Ex>CSqf0lM@P*Je(e=UBzc+9dZ65{6t5@N`xG?>16 z6(0CHF3a&&t2kU&+%s(&b9{ux?pYos@7(5H z1x9|K=eBokRJ@lSS7sbb4cOU@Itb^vbBi`fXbqOj8f@+%hJG$x)}7Z zsN@Kep!wxk=)UG+&#i0pvEAIE2}oYD;6g;zQaTI}x(ZIXDtOY+5j?UE7j zA%%?K1CV2jMA0D9jaWc{g=#Pg10(2HCTEF`7XO1P!!#es=0~BgBTZeLEq9O#LCt#D znNz2cBd&rA0*r!>H*@hk>1<1Hk68M4Zkjt&MMN)08leN0mn)`wgmz2A0=0>7`w@IT z3Um+q9?{5mV7GZ^5md0&V9^KYk2$#UPqek`AhZrs|2$daBfY#WUKTMn$4u}IIpj!9 z+@_I4n>c9)bnP)2dA{-67m`TqF)<;Qu=a@Bc(CpNMY--b@}oM757rwX5|JJ&gg>>* zfsAAsGI=m&Yxu=;*929M#Qp|pVG!ng?U4Vi!YQF)K%Xh~+qTVcWtd>-$FLv5`}^lo zD0=QvtfaK{n%L9Ts~Rm8hxOP4Z~e%F#eSjt;7+46`G->|!2|@81rb~zSicElMFMln zE<3eFkq5uTKco{4Gj5(%)7GfG0q&+55YbMr@yfqO+m_R z$701RqREoX9<>);tmrJTFz&G8O|0iLEt|0@`(F2R^O$eee5sR?V_3x3+FAs}WYDXj zadHv9=efWzo*sF7c}RXr+<)aV=qtVw4Qje9V`_z$s?#e_w;4}mxGkO$En%L5BL+^Q@JCl`P zEcwNNNE9y0sIlbO?*TQ{0s&TMj`iqYsbVwbWucz%1xR&(Fb?{2Vn99XLbl_|8qKic zM@Q;__=b#n?V*)=k7tvM`U`#~oJVdFM&4+NlEvkHnT})01~UXl-?n%JAK6>wh};yd zzRNO)Q+!V!x67^c6ckh;m6VPCe9~0*(d(kBc)FU?oa+h85})xgd2;X`I5TSm*S|Zk zZ7IT6ocRbxeY?U=?+nMBPB!j?R>p?8kn8#>Cc@cMGP0`RTH}zn7)j?#qQFCudJdPR zw#~2W#vtoYuj@%AaOnhFUr*icuFJ#s=-8tZ%jO+1UELCZ7nK}-o_%AE6j!Sj7tY4{rAqmY)<2F(MgyKz9^=|v?Mu!4KanoK)H+^$ zc{C|a%8~M8qh_CN3(%FlwO1T>;%}W?U4EpM3C7JmmmiE=@u$!n&*|W&-Bl8b5?wI2 z?;(Ecz9~Jvh(`?#;!F3SelC00WQSxeHnHUsb z9tWE_dV~0VzRZyK3(?vu4}0`43VPn{c5xjgClc=cqO~P4$wsOpS7^uR#cJeB7f_MS z@UZ(CLCPwUmfwh}?k-eluL-bd!X)DJ(-K+fmq|pv`EI!_eO+)A1~YYkbHeHiJR_|5nkag{M2h%pOdkN-v1eN7@VOSX8&*OLRV(eX zAR(Hr@Jlq7xq_toW)xAEd#u19E+now<@esttrNw=^j(zHmL4*%_jYKphA0jxHu#r4 zDrIRI&Ui8BCAboOeCT+vGf@4}*9FkC-7cyf*7a{!=dCMCyMMAZbEydqBwso2i>Qsc zGGhg`T_2o9sy0NS-fQSh$lSwi-&VGud1xXMy}9Zl>em`sce5vV1#PB!Ra}|Q$CGO; z;sErTLAOEVy&<^@eq$#0V=DywApao49*sK_;}$~qSUY!u$nqj!RH(YRXL zbM9IqLTNg1tOD9Eu4%s8L{E)@uNF?^Bi6-Ky4`IXbQi4HDr}MJYQ$GQHh$BUaw4XvN*$lDKO|vi~#$%hO1<3t%L><1Ue1 zq!?W2*r1bJoPcQ?9c~3}{o|qdn*NEFQ;%bfc!t2ndsqoZ|Da&(1QdxFg`aKf(=Axg zkMcJuq*1JH+}ks($mZI2|0)XqUv2`t z*NgJnq8BCIf?r%U?(A)%YM&S!9suljlrEIQh@e*I-#c&QpGA4skCjq11DABo;Pd2t zSAU#Eyqlj-hft0!jXmcCt>Gb290V*RnrY1ECVtKy)4gzK9X2=gAGdZD)l5k7zJ1yO zw8uA;JRV&h29(w^6dM^_b}oO0F;j0bG;-7Bn_V)C0pU&A9bO(%L8&67rz`l+%NP8> zO`9+n z^-Tp%aOeY0xF_VU*%(TCFjR#kUc^%^+84j+Als%@ytZdtRG3d)-~?dCa=sla z6S?-(D7LO)Qw;;ozwLW8|IRICcNtg72X>Kj!!s||qzby*Ll^qXAga6JZNEb6LEL#p+we>QBT{VA3R*hNt}=N(NukqBn?}kGw@M6 z_H)+zzv+0R8egq_I-4=N3Fd==t5!iuT4JQnmpE~4&?|}`NlzJlvx!-$5d;`6Zqjf) zc1c;UX&8AdhA&^|6Xd}3?k>hETQC|%_=%L8I zTGXYaxo4Z20VHIwDS^sls;vC%@Gqe`T$KJNg;S?29yQhJH6Xwm)x8Np6~{(%)*2R4 zzVCg)K5yiXjuO={*m105-8fz@?D7mm!x0~YyR=@kHQTK;aTwUmhU%h7Qe~()YPFi3 zG#8lVTN`X5Uiw6oNAFwP&Sq%0N>j#Z?&c*BFt=#At@LR!PY;w-#H1FnbUfs9E!FCc zW91m)&kz+z*Z~w5iY(R4H?SKfdD_23b^-I***rN4v;@v_a#8kTU+89%hi5iw&p22? zi;vj)5j_*+uGWpX+<)R&cAnTS)+0XIa_NlC@%7)E5b8-q6*!fc5Q1zlhwl>u20>0$ z>0`YJ<1TuymaR5*J#6tgpTL1qm8m$Jo+f&2;1yc0$p2i87#hKqD6qQ#sW&TyjGx(= zXWg%8NQi(^%6#Q&{;(btc|Dq}_ypcX4X9&sc3gJr-m7~3N76s>*Bb?&Y5g+d7u!1% zs8P}Ip{Lcj{XFb;gg`kx*Cn1{My4Q<{^2xyqLMvC8QJ%pnHCX3 z$iB7Om+Z@6iX?kAS;r7Uj2Zhd#*E)}&2$&T{dnBp&*SlaKYo9_|9SUzyRLK2>paiv zyv}*OF4y%=zO%Z<#I{yLvUb4nI_-@H(2fW7wX-v?n4xZ_sxAf0u}Msw-Dbx9@Z~86 zhMsgrVUzcm$?0(1KQEkPq9Dn<~yq=VtXp^+*`3rp4mAC+vd%^?X&mW#U z*K5n!E`M{lMBBgcbbfw(eEz04c0=z_fm-tKLM+aN1cGOW86O^4Ff%$TN*vkVa99IX zwo^{$z4!&uqg$EZT$?F;p@^rgG7L)SQ|BaljqF_|dDrZ*2m~ z@D_-pr>w0K+72cEd1q^Wu1z&kG^M}Xc5B<@Wx@gUmpy4OJ!xYU^zfQ|a(4(u+Sx4N zx3k)pRKSR{byM_pK|f@1`+Quxyzl&r0>bbF1Uln>$~M;}zWY?-!Ir+(+#ZvKJa@rz z?T}$JZQx~!3c5Kx7%MH{FTKW>rcCRdeU8Z{aNInSH<2yHTzM0=jZf*of48X-_@ojt)Vw*zMH#yTeDXn_6+u+?_iaPy?Mz=F8iYR!-0s@`(#D=ylmZsc1QT! z-N(stX+-JqPoMe%s|RllxqM}$9`oTiRmh4Q^SgF@&6|60Qn)6fj#u@7C^o`8(V3O_ zh0T;@=J*9x3+eHIzt41)JKE2aYi6(cF?YDKe^((4ki+b-FCv~K2vw18EoX$tS153V zyX=4a(ng`)*PEH#{#v^Ggc|mQa$|_hsWB_tt~NvqgXV4x1-UcL8Ufv(z(3e*pKyp3 zes5ax*h=*uzclbyaiYU!r8Y_g0nHgh5`xmGT$%w-F1 z4$x!KD7;F3zpZdg>=5liOcsX1htkcg`@{^B{xT15y#M+&{{gnf>I-`_Am&$v9$w6f z;CsN%Q26}UCY1L4&5|jh*pPw~FT%BSlrY?dCkD?LTH;E?chtC?i+gE{Ip5Cy$Q|co zk$d=)J4u<_^AM^heHYWAn#1v$xAPnh#kbBqqdtDTXFxqH>c;5{V)B(cvnuvlg-2~o zoIW`h_Xri#u8q^abY)ihtn#tMv0qt=@6foo{D8hXqd72D(rg}8K%nQp3UfX@!f>b6 zo!I8ZdF<_zrNXy%PTS;y?&_V89}?_5mcFlp_=PLJJZIOIBMRYUdB+hs&aSi6ZQa?L zdwT@Sn}h#2{k2&{$6D}R(7qQ3F2o<7&9u_-%KxVH)T7{R^R8{De?8dqsnUb7>zl=< zLw=rDLlVVAXDE+6uXbh>cZeswZ201Ka^D_*&eCb_uM#$*yDl~`5*E&DHB?%56pCh| z5K<;?ElH?Yf1?8jnA>Gt(g#t*J=BLsi;e=1ghgk6fAjkJ_pVOSh_fD+@8s~_PhN{d z<6<7FdpVwXQNXZotdIS>H1giBa4h*cB(^nAD;47S&+5H_2JY_#%KULR1Hc4(*zkCBa>N8W^`^ZcGPUDB@rODK{0iRh3SKvM!gq>1wDNP{ zX3p5Zl-npHeb$w;*37xRJ3DLdA*aXPpVgEi52@K#Ra!o;ZqJd84IE0`*y~ZW(&t{@_$K%CbJmWi661s&-x0QjNJQTwLr>qd5p^88`c~Oh7&r71#P;ySjqm$F60HC<#tYiTT%wZl=ubdw!Hjxf5_Goz~J;4+qZrfN~yr#GE`iq*hrn; z*Y!l0pxTZuCKbnD)$jVlaC&g}?)G42H%ZR>GH6{mzrv`Xh>NW@ z<$f>#RLGY1;Q79GvE=#)_bN000D}VZyRm~2lDLP)L1P|Wu#5`Xd9~9IZn}Of_BfS3 zU4+iH<6(A=p)j$JJEZ&jF#fnA#hH1Idd9cq{quu@<-4EUwc06~eS%3>NLBDzHtO+f zZEdlBwanvzl03I=-w!;0>NkM9^63D8>i~cQ-!A0(S7OCJE%)qi>&8BPx$S&*@9Vhv z9k0t`Qj7Fm_LO|g{abLUu3q-~d}rjAn=>WWjBR-CGc=iACB z&L7A%x0DX52+cmYlB&O7_c`gTT#e_!-@Z=c(qxw3stHCJ>O!)AMX1o``EwmkTjrB& zHW#0-VJ^je`?|ZG#YZeCRZEiA!pTXWVkVYN?>%`bu0bf%x?wPLhMf&o^F<;vZqnN{ zK8jax^Lr16_&-;dRgo7o&qZDd+515<{MhqcQrrn41{n%L%FJ4o^Nfy}-JzNRrkP7` zw6C2^;-ukXuIUc{LF{7UuW-DrR3Ye`@TugyvT?#-+Z=Nvoe-k`*+M8qP_f}EiuoT4%Yh^Z9ja`YEJiM~;b)NSl{*O}_m= zdguGblL&kfvs)V?OR)0s?6)XexXjD3?fDsRv+GH%51xUKq-3hS^?dT^u0nFh(Xy-8 zue##D9coGW;q@Z5$vi?e`qj}`JIZ=#tXNzEUM)+K&okp-mtA zM7=-Sb>;K9jzKiuDa5!>u=O~*BYMeZ_&{XJiz-tSs~G{z+OS!=H# zFk-TLGfvScfH9@T4fwqL+%mYsj=dY^&fOdRKvM8JL_@FD1-g~`%&71-3mx7>{lM)| zrN#&g$14RALMKj<=62~ExzuuBPgz1lakx#fbog8I&fjIHMwmVjt@_|ZwcssOH0sQe z;vD+PmpPA9{TyT5d!COjJ;$FKWoDMN-ym%7kCnA>?d7M@)t4Rm$8#tnRA^dnH z!%H!NIPRI)=}bSlgmX0)20M%Af*XUMT;0xp^>%$N3$S5yir z-{U}XLfyzMoR9qMGeypndJ`B6ky2=r&X9EIY_7(_gev(B+F0K`!E?3TG2@A!~xXVoqy5~JTh3>-H$?CQ;9Co;_b@dKVEtA#PXS&&nGP&^9Qzlkzmd~ zZq@1wnU^2aIL18i$L?Q4j(6?da&s{4kDKYr8VRSmx4zHL!1ke+6FVz1YwkWA!(C+P zZtY&Vjy!X^|4oWcDc;Gd7R{iZG|tpm`5qO=MyuppfJ*L5&i4cC;0sOt^N;V$JE4~` z@o+jmMo3L7?4j$A_PFgQ^vl=_4p#2yZo2~^~Pp9y$7^kJU#}!r1SN$N>shy6t7NW zkq9#+9QNI~woaOG|5wFGK-C%#roA;zSKdyFdsMZzvjv7US`oB4*H|ig_#7hs+ebEL ztku|2jQH?eiwUwap&Yl%!YsZ1JHUmkCe!MAS6`SQ{@!wSp7REPGr@`yw`je1LQ=)sc_NfxhTU(QVS2`Rkrp$?N#RG zRsuiDvplU&pn5QBS8guAh26LGy|=ZIwo{zvG+C%aIWp7I!)Xqw!1KL5+Y@W^nETmw zSePdMX?1RxCHrFV)4;c*mMqSBsuHEe1Jc`m0o6BT9DS6sdGy&qo=l!6zHggDUR>1a zfI=s$6Oc&%92LE*!8w<@hv_k_DJRrl1am~;&|wte&_)U8MFJt z$AeF>m>-UPqSR1!1>Wd!G}eU0RWIs^W=~S6z?k|VCpNiTA`0@QN z`My8#dZfO*|IzOD?b;sE6Mv3`Kf)^WKYqXSE3_h@S@aC-<#nywoRtFvUTL25^Vs*_ z6gb0a<(|}iJ_+&AkMIBFjokktJA(JtYqkqk4s9ony*P36-1Ryo_Gz)KCvm_PzZVMO z`Mq(A0(;prnXDXAK7PE?+1>2ZnB3<}nN=^5E!>B>Zq-#izEvv6La9{QC@O?BA^$;u zt$_4nQI^w*7WuXBcw%A?>nD3GV@_d5q{?xOZx5A|a=Iy2x8m;_EEVbnUlu4efnku> zN*_9LjibpOGYMZ`vhZeHxOOqxJltTPg@OgIx=e7UkXj>e^Rk%3AqC(g&cE8*frZ0K zivou^Gnve`Sn<9B%ChgF;+j*G03!QULe-bsxN5Om8GV~el!Ts4@8@?)*GN8~nZ_(b zd(?*2fwx{YclzmJr~A)DZtr9f+=&-Y{upnbJef6JblitYDg4o{QvHDo48OuOPCM*l zV9NcEV5+s^4L@(RP#AC7hm$gjmN36Iv%po6%G_6S_U=V0TwUak$~&bqF;Lk)=go(*<~%&q)pFWoWzQ^UK5R=5{tA3$JR})UoO&a=rHPlD zF@cdEb?*>0HJ%g#QsWySONVuYjJzY{S;-Xkq9$9Joifp9pN>dw`^&m?J~h{3 zkZm#WUO-o%;ig;pD`|EK83}}OiAPoiLYoSObI5@DTJ~eizW=%Vhepm;a0MSJ&LSA33>^$J_E>DWgA6 zj2maqzq=pLl67wL{R>}_{#+8$Lq$x)*z|{&(?V#QLNyLO$KP4L^m`WaHS^@4(vy6} zmf!=74{tsc)zb0L5GoW49eRKH&{1hyzh9}Hwc}+-MB1|uVC~9NZ4kLhP{Oo#bvg#7 z3ynJ4-@4Ly+$bXuCmwV=*&VBG8mf8s4=@#Fa#l^E0Pac@4 z1lm4>p19aTP_}Vl-6UM%U9Phw?|4ZT&ZhJF;MJ7ot1hxx?R=DD9azHr#I3Aj%T{+q zbxyx4t1u>f`(`J8v!f%m8C6^CBqbYZbdCRPHCOR7NS6E;?JTt#hQyw%PRV)sw_9BD z3>IL?kR^#w@2OAIl;F}s4xNQ1`chNp(w8@B?6c~tQ77bfX9pEed{S@cj6^lQ|Kr?o zn*{?z9&z3#|G_h-=>T$HJHPAviR`qnK3lYnx_*ii()PLLl(4Zou@_zCh?*j(*m8P# zENhQ{!Dr=odbI3L|IpzU*X2xBOi`J0KYiouTmBh~0JE13E>DEtoh$jyOa151ZQc8J z-rl9w7Ch+ZIE-vpeW;>7bzCb{ZihKiY7c1q75nW^j$d( z#Y-)Nnd>__=?;w}sp;5?W}guzn8yNYLN-4Vcp;irdRg~m5EPjK^D4u-nKWmr zrj4OpgN5hOr_el`D<(?>5~E+7c@$=aG8Levy;A}l(FGArueR%D3I!kkE@9dmcJ!-G zy55PxCrYO2e?ponPdX*+XHfecQJ3a#W_%a8DUiw3`0Ch~YhPWHE(N-|7UuKm6!#ps zRj!R}?8q-SeT=0%Ng<|=sqB#N%a^lxTY=k?mXh9=a-cR9rAf>84$@>G-@jv;(>h^( z%G`~gIPOm1O>dvCM&RZ*Q{lrC;%z&&)tueH$d18@}Mqg@6JdXAzD@ z+j`2F88O^Uz${ft8ylYz3LVvQEbRuq(OXI&J>MD@%EKAES?i>LtlQC-x9SWZhql<> z9_ex&{?^qyn8}ppMl>NddAx z=xt2Nq36$tZB4y%&28_c)S;l#*w6&@$L4e28^_Ax>bpBDcGY@(nVsltdZXo}k7#cx z@L6aYUeU>#?2`{2JtLa(v@&t0Z`E?Vd@A<|8G^-S!t2SM2M=07k=BlQXYyWVd>HqS zo-K@w;w+Mpsw>#HvuWKapD~_r!N|m;Mc5i?v@zaj_d$+5zJ%Wh^pdH(C6Gaoe zdz;XQNA%AZw5CAj$T{2+-qo*qzSa?9{vgjxWqrO((tCUBPGSFHu3fp@=W8+3Ta3Jg zzKIvzum2PjCthUcZJeWnb%tZc(Ud)5?Jp|F@+uHjCU|@dda$x2x4M7Nq0_poVb6I$ zG$jQQ;zfhPA3lwomMAR9b{23 zG{GB?xg37E*E5UV6YdY1ek@H(QoYgisJ?9{7eo;Hp)HjBqzN-#Bt6-dMZqlL24{5Z z%;1&%91HcszE^uvxCK3ycaOc@AN%4`w}k44wxH4j5HLCABoMF0E~9 zf0+zz2+hk?<+YQ%K9%0p%f=?^kjKqZO9qCGxZ!aW(-4GQ zDZN6{^c7#3Yl{?CfFY_90~b-;)e3S|)3ZbNDU`ZNc=a-lu}xuI|s+QfVmZ#fGJ!CXbS2vC7qUXn+!^z}g$ZM~~#EF?XjN!_Z zd%yhTL>4!y$)sv&KpnoYFxldcq+F`D!7p%YAW0YmjAM4# z1K6Yxljoj)dKx&V(urX?68?LQiQdBp6qp%wW%FvRcP3cL35uJ@$_Q(Ia6lTQgxe3V~vy0A17uI zPB2%zWBVI75tEf+nQWxOXB3Nu4rH5P~C z@xD?sF7|Cr`w+{i3aMEloPUWWPr$ronwG!9kKL+NFoJW2%$l^Nz?K$2nOIVY3Kz+S z&tmeNVKQ5NIXbY5#lx8&w43=J7eZ9!#wua=ncV9cU2rExc6@MZ$?||YOjZgtB5d_V zG!~@N>Y(1eqK&ArnSE20)s+*1LBn45{hWyJ@8o}G^(<-jUcr7d2YWld!mP!{&sF91 zd${Em^ZJ*h&ek6?#b92Ol zC2&;X_>lP?dB|%c)-O#DuSUwObmpy0jCR*MuPB7fAF&p_m|T`X&iHn}5;n*{_0Rq9 zfrtoxd}CZ7!W`}$W$TF2EHE(^&2_7uqKq+euF#ZmgdC3Ci?k#!miE3te4nl?x4&z0 z-58P_K#ixCX%FLuAK+nY(gE>vrpJA*sNIEUU#&`u2?R~jlfx< z#?|(-9w`}#n68`={xAzHdWex+j!(d%H-WwzgQQFmM*|R@{E_aADNBVd(?ho8h79s0 z1MiUOEB(C;vj-8dR7UEk4-Nr;p4(<^19ccL>c{E2XJO2c2>p5cq6H}iSv%II7PsQb zNn$CcuiN_ZwzR(;pMTpS(xd3X^DiE#-JK;OV^){zK|1MAfU&OGL{^sRfC514L8+@tPg~p55*bT>xPyz z%je=%_9NwdCQRz)*&ID8z7X$uj-$V5B5W<8l~R(zw6z-`(m z8idApelC4RnkVC+NdGjYWY{@sUHK);+@Mz-B?>I}wM{N=e3DHrF#ZYiGo&)Ow+~F2 zv^HM~0H53hQm zyu|GwUaoc*u2FxzpKMRY_*W}XAl%iIVT^sn_zHz2!YxJ0ndmIVwmW*?n2VGSZpoJu zwJR;f*3H0-dUGZ_$%jK-|2%NohGSFg&lPx6bOY13J%2esr6j!nEVKK=g5bC^v;4sf z?pxM5c~zlTLBU53?pwX=v9jNXIE={7njLB?KC+Sraf26h$})5{<99PWQIMbM*&4=t z8gSJ&#~SD>6Uam895zozJwtfOorNs{fg4s|aDf*}+lG!* zi-|}g!n=zdF=fpYLlsT>?@?t?co1=5bhduf`quLDK>N*RR1yPsGG%yHu=2LJym6~) zwVV%3fd?n*kXFU`##v8a;*h7iNRakQ>-{Rc!`p{H*UJj@5iEYsUpD~9Bk;M09DoB+((>%AM^{tM z75D_?$ehbgcNm3{G~YWkyQ^ZXA7UcC=sxLx=($@=)Z+X=6C%L9ZNbuaaS_*UxUXYd zgfZ?d%Jm^KQ8X>wq**hyb>+g+F8K0t%wfLlGU1d7Hyb6~F~PC6!*Nr+t;EuNXK$aKdp#;u&&Do@R5wy-BHTEiigd%^ z31uhjG~5?PSg`(k66&{dl$!2T|NLsA?9JuSUG`#jfOE&6!

3_vI!O#rgK;DacZA z=G*bLqfOO5Ty_RN3JlKnqm;;xgoAZ~vE5bQPC3tC*gY8v^h>86FpKl)TSK9|&{7%U zusUd|bY9Sq8Or2ViCk_cng6&O7Kd^2z9EbQulyTovxvT=y%-Y+b@U7Nm>HBituF~l za#DbKE)2!kL*y&D*nGl{cO3xVwTxJ{NWVJ7GdW@l;pjayom@x9tZT~DS0OZcI*p9Wm5$TuuJvyLucp?q!bQFX zpZad@hPnYO2Cf1STHhcZ`yI28=1w#=DIWK{H=h#CjeqRC?6^Fc^3Be+o1x0sSXbk% zocvVJ@Iz)XVB%CdY=*vC(XdzVVslhT;!*$>86tUDYH}vnK}NH@ven~Y1-!cDeLrQ= zMC6E5f#_$s*^v*;VMBIEjGcQHscziO+1TbZ8uOwOlgL^JbMCbVa#N`BwxO?#C|bdL zUNxNKTHnoa3&6^Nr`S{&lzXAJG-b);lL{8K+^zOD&8cDWj}?1lm3Nt(38Wg4?I+q+ znkiddsZqVm06POGHxU!amnb%q#@r?&)usoIdU$;+u4hYJWdG4Kv`b_8@ojnEHudF+ zCF|svdh%eko{{m@KGxB?{4#_-hiFd08)5V2mgo&Y>HAGvLIf-*HWJ$AxEQggf(LJCN38dZ)8tsitL zl@ZZNn77OC?$2c#&g~VAMx%#ehzj|XwyBvvRHA6dvh+*4GWA2<35;-%)$h0*^V1hL@10xX&rWj#}BJ^$4YM z{T$W=it^TaXUD=aqudUux|uSJPz$3P1GOcm9RAso19uocrZn5$b~87US&{_069EB4 zN$YUY2n9Wg`eYUKu* zyFqj3n90(W?>(j5B*tKZNgl+|dr_hfM?Met1fE62*A6e^5iwZ;KE%11{0a9MRI?_x z0(ZTwQFSZaySjB+i?lG;eHRf{FY1e15M?x3@li;IiTA%xB0UeRZJpQBR!hz_pq!`u zJ9E9=37TnD*vpEYCzk1PYhvqCk@>YaSe3DmI~p-RjVJirGAVHCdgIwOka6M_(9AV5 z$TnPWpAk;Y1c-Tel{;lx;T>a6^&p*HJT;Kn0VGQ9lqhQHgYP#KKMA&JWezuUA3L)G zS#IK9na51e1d(P@TdS8W<{^|ZQcP3aoc*6E%?oKpCC+&%gLzfmrumhyh@A^y{ckXI zDf6i2HDQZm86p-5 zl?#Jd2Xn-%7w}5a3_YXHHa==(8yU%k6@B-7HQX%sg);NqRbkRS7?)dVWD`nqa_q&o z1*3>ACL;FsI$5$FmW{I)e>P7#x)NbUKEa-^z>+gpFdzabIdAw7^O50$0eSrzG4pdx zh_E&_yi+LAXY2{=a}qbaB2lE;z>S=xYyA!QLLG5lu>$yZ7+4ckb116?L-&EL>8AfaKpZzy`$^X=HtTsX3Ca8 zy^sCT$o{&!zUoE@f7O|fr2%=hRmV-_+2^I2C}NKV=TnyabQ9#fPnJpz#{F0t;OpfE zmVUuU0b$W{K1GS_3I~HeDfN#DoyOuE9fhQ_l;8^u2xmu>?is?)!2!OX{e|Fhb_Ij# zx~b1V)2RC?s#c{i%v)|{(I=>*{{pOX=50RG;~gf3u|YTq3H#Ci-Dla2Xhfd+sx6mO zWa^0FBnfgY4-Yg2to-O#^3IT4a;~va{bcMS7k-ko=UZXNJoBY8SzsfglSA`}@IvJX zG}YNZ$mKKJ!I)E>ooU!1%lvA?q*l^=#iZoKsd|*mPZ%9HB$5h!g2xieLzaol#JPd; z=)%t4D3pwIn0K}KaD9xnv)7`T(G?4dm1B3OXO$Jy?VOyp5#-JT64*U=Pd#fnyK=sN z9QkUY)(FlP6(cnRY#vqJf-J~Cm2w}&5L}G+j}Cj~my1ra)}v9-d_i3VW}1L6>xq*R z_G2~&De)dsuxwEsXjWBe$UfWMBNadS1ON&BQD_x^#)P3pkKkDiyyDm^e5 z2MpY-!s(F(-VqgWtJ=u;J{N?Ol-4o~KbR*&#Cx1E>1Z7rK)9zsZct`W)6?fy{NIO} zh+xN-mnLCnOpMXha(%{zlCraDj{9y_9_^d$^z?D}@d{fRj+9CvC6Qg0ho2)&Iv1V2 z7lK_GBV%^-rovqfJ*CP4G@d zG^DUHN_ctzy|m!>FeOo}{KJ8IAU0ZyJ?EJBl`MgsIh2K3BZ_ccS+MBnLlYKrA} z+_#)(yiEPKj#)h`ZbvF^y7GptU0Cq^hzqjICKxwJz`K-6$CRec<8UpQv5wp-9l3XY zG{;Q5iBK2I=`*_zPSAiTLH^hgu7%nFSoBEK@ZG5aCmW(%&S;ZCS6^@MtF-Uj0Wj>a zv!`TdlW#RVXTEiGSg*YwMwn@QtFSb6G-9NhQ!d5C2-5t3+NE!u5o-$y@YIp4mBYR$ zE0>uJ4IUyw%e#6xbc1Iogc((0rF`E+E4szb+=SP%u2$~v+;vl;xzH=vG#SiYZv_K9 zN4U}y=9hZq`(cYSCq2Y&yjj|uyV3@)mb1QGdLOTu6J|0S(=!+ES*IoEEZb~7vBbkg z-Nm$i9N+=OKw&)lpg?Ke5`F|$+J)I4qx%Be1m_GxpzFq9{rz6gEA{(&wm1uN4bs}n zYb75dc#?rgody@;5F?rQz(OqMb7pyfh2mz z7_A~PD%Z^y=-`U$B^8|ex93%1ReT(%+ivn))B4ko+N_}ONA0`|fzNg#>VVH5-LQ#9 z;9eXL8?CcLD)jgF_V+8W`_euf1HP2(h!cN80)(AqNx!-oWt1YM=rXzU^;+`<;g}jl+w$Nm@ z;1h=&B3?JvI2;4CvShr^`PX~H$bZ*Eh7Db9r7L264 zQZabhwadTW2fA<&8;VV%4Nl}h@{E4V z5SULzwRZs@Ifha@)F~SC0BfJ(HY63?FE`mZNrF)D2=_eq`6O5;6ra`!ukeC<%cM>; zQa%U+wdRZ7Tst;$eU^O_+V*PVgj#C0$KJn}XYr%#eg;)_hra?&4HM91P;8OMcS@;x z$-MPxW#I3ZH4W_Sj+C1`jR0T`lMcs1Zi4LgH zk^5R4&puv(ESJrTL6hp7%E#@YWoY4`_7=OVz{l0x7qCMkF1O&v-0IF7{hUUj+znSc z$A$eXz*1?s%qiU(?>O-KiPz%TeAK;^JO)XhrP&!NIMG4o^bx@YqQ{KWc48^zye(PH zLGJTtTwb~ScV;qHrJ5STA}6?r2R|BImyEoQow3uJz_*ewAH}mJBw)s8c$bQdgo4p% z9NE&uPV>sm=_4#ZSAV4_^=m+KiLe5aOYnH(rOfjBa^PsIEwG_|&P2hUuxvW1d$e7& z*1+47pg>5PCYLrb_api#(-7F=($uh1JP|XjO<U3)hM*6KuH z$CfbW1Y4?yTP7;>LwevbxcV&fQ>DR`*&Us2qEuUM=+yd$n4fx*pKTmD zU*J@DqOFuvXQh3^SSNQO#=N)+VQ8~ZnlLotrY|H#FpB7qL;g(1Hu^_r)v%?pCg1{H zP~il##5?ARD1PnSPsZj$C~QXCAP_X!YyaZx@X;N6_;9>d@llkwOaLT~g z>)sXO)HFJ6c7a=@e|nS~5r87XSK8_sO%eh`TLMJGOtR9f4;q!M_;h|wsg|45bt<>P zjS)}Dn)p_?HlR8yyvq`c`+Tbs2NaUtgqqAFmx%#mr);a+$W0wXxap?h6$qs2cvYn_ z@HsoA*$vbuO-Yh7YrQ`<;E4kqIAh>CRj-`6ICE0XLu5R!U z&J9_HK%#9+5-?6x#Uk4=z?o#&9yvch>VaTB54)lPYH#C$I*V4z_t=A}(G6j9Sx;9O zQy2L3k$+skoQ3+y)!hfL)%R=I-xLq!sJ6(AwK`V+RjgPYc0^E-D_?K+(bj8HPuO`F zFHyTHR#S;1`KiF)>8`yHmIiB?{L1ILC5~yv8+Q>rFjI=H?5s|8zfFJTd5;$R?X)Wm zEB?OnH6nFkJN=cxPE|wO11s(|Zzpn|q_!)(>V4-7QQmv|CAHO0Mc%TCH8=)|VBtY- zEf^_1`-FPs<=uZ@`CdJh~%4bzdK`wz@{A zTEuBv0q>FVza;p+pI`+~;EYwuE@gJ@DRx_) z=SRHT>0aDn&^u1D4`}|rBwIM(_E&~kW*moB?NwsqfKh`mR#I``rzCSWwZ<;&gB8&t)c9%#!-k8lRL(9ynto}u0UWa? z+U=;~=_w7bqeQa|lt|mG1)Tx@MCXiXz*lt6pfjI^r<7_d7`Uq`0YO4f3HUWVrKa_i zKwIf3ZD810DtAC4?Xi-7@Wo%$Py>|E79U^+sP)8gt{vuuM{}?ve2Ty@1r>i*SzyS9 zt`FIIz*unF0r%6ALy@HHdP<;pI!Y5je9}>(Sq4b_xh#Sq3(BVp*`f8$pfeu~S9mg9VO6KdP?gJlLS%_O(N}FLn(GcUjR7;NCnoOhXLbls^ePT&oPYD!HN6C9VC7NY`M4DyP!~*<87qSx@gzQ@L zsc8VTl`drE*9I9#3AB}t5@9_h&{ld%>kZpYO;w;o+5=2r#BSgVYLW$&P>+7bT>X^3 zwC-Q4^B>aB)^+x)zgzFv|LaxF)aeUaLOYWJlkCp*knXSd*#9rCq6UuuFj0OdA3Cps zvxB-sXaTF?-@zY!NmgrZT2%JCIH@ARdtn?%2N!+|d%6}8DD3F^tnz=pie?yK$?w<~ z00NyZL#eJ0#Q$GhMa`V4-`)QDoh<0Q3N8)Q38LQccYZZi((6;lsju|!CQ-4k+k;v`&Nv3POVPm0O!22F3S|k;1EU3pQ!46Ru9^rPc5~j~&CMyXP zawU>LiDV{QODmDEN5DH)FXVgCaX_7vpTz$0@m@4L_&8D{Z|@QCjy1`rtM&11rAN4C zV7>2Zr9L{zI&eA=ykm7C1=s|XxHc9*mG|DwpH}?1Ujpw~RbhZO0fi%A9Mx6hAF%hWSs$&&axv)!(4_iC<3%6i-+DSg)rZyJ}Ny zgY>^azxTi1mu`cRuqyrkulEI3*T1(k|IdB&|9an_=L&Wf|NRd6|JeJMRhGw%$E88e zKB_rkS}ew&&D61THj;cs&2*BVa+g zpd6LPiT8^$#7im7xnyiOgcNV9?F=8ywQnGX>Q)1kl4_yp5MgY(z+kbVR}xl zNVv@<2^tg?`bJexxOs=QUvbUyZD^_MIoBLC%@KnDc11%X z0TaoR@ks)#XKU`ixnr0-CepIs@UUsr8-rNpj_uYDiJ)D3;sFy$&puD6=QHhN^;1I6 zs4rNi>h0Q*<=0-5_(oYzuvrtZYyJ~x;@%LbMG#B)o5Mmq(G~`;;>c z321dwrfIc|g9g=w(~b4;Wk4p&7jUe+JHWB(r#2O-7zA){ht3iDgz;_Gu4)jsn*cLhiQ5`?KFQsuu~o4a^t&0v+niuTLzGmwf;%J>of ziRu%}jm15P10-1rcpWKvKpSj4fvRE+3Kp6Q3^0lpDvC5>mNXSdvsp*{PSqHg!T?yG zsTOwtzB>U3r26i^Bkm>?Fbs4m?l3JpH+IU&*f_u+(ZCpFsd1;Dngy^3{8ub;F05xE zxB&~*4Or}3&tfBSG!{qKumDxivjA1lvjA1lu>e)jv-mHFqp<*-x{AdHPNA{TS;Ybi zun7KlEH;=I)*G-e*nkD=1}ruZM`Izph6SjCo&~6ao&~6ao&}(Sp2dGb9E}Cw)Kx4t za0-n@$0`;HMJhdy{uK+`4d%t64Ol2|z=CN#i;cw5Sn#c30ji*90ji*90ji*50ji*9 z@m~-}WdS;M6^jj=LSu1y6$>=L;@_04eu+Z3m1@n3q8;PT_;9tW6 zR6)-IR6)-IR6)lAR6##4{tM!0EY_|U8#sl=!fh1`62Ri$trxfr0@-^57RDQ}VB3Jj z2I6QeMAxtYRnW5lRnW5lRnW88U|#$e#L-x+T`x9p3XKI}6$_;vJ{I7|)ups~5CJA3 zs8wWlQc`PGarqD^NLO_sVELJ`cfF74r9n@4y;5B7yX$m|6j0gXBPtvIGi2SvcZH-S?H+ta$Xi~#t_3nz#+3MXt8@(}!mZ#oFN>&kr zruOoMK%tHDUv9bq|2Lo3nQO-jEL^l%)900|9BgTR>iz27gnGG(8LctHp47sJcdeOX zPGKkG4gt-283){aGBybu9(C8C=;FV- zO#RRT{#A_&;h19 zJ&TRRQCZ{w8F>{8Pz5~;Pz4nSZv@F8Vj%!|C>b;;UZlR z`cEu?Z!6L-+LmB%OwWR@90OT&Y`|h8aWocd=LM*Oo&~6ajs>WKo&~6ap2dG&9E}C& z)Kx4ta0-nD*optmB9d_N5OCY7eEd%=LN;Il_QrH9=-YRY#pw-LY$T4#!glSv09DYj zpsJu_0ji*90ji*9@t+q*V*xt#H;av&LSq4T;(xP9AY3&3cPw%?U;*~V^ei^0D@rzC zv5`0$i?#CtR6)-IR6)lAR6)-IR6)<;KQE5P0(9ys78^K)#scib|7HD zr>+?0+#cxm^ErG#p|Hf#*aLA7&O)vYLkGw(LPV0Tv3#2ilo=oO3w)js=fA7Ds- zd+cPYZK8^m;OxcNb)zX1ubV(}6?Dg%5tbAH2~fCRLtpl7i`j|k*wERFw&q+r3S$Jj zKdZV`MkHn5&eJJC1ps3QWKnl}9ZepsSj48yWvWwYwh&1ka! zBAM8-I6Y{$ZDyXNX$P@^FQv?8X_Ay6le&FmThhEe#e?V?$zAPAneEJ3utM~|>R<6( zksN%r{JI}w<+3394Vy*DvYtTM zA=u_~lX6}Z)5c`=XQoNXw~PPv-LdI-1M%<7#KVjE>)cQq^4&9j5pfmZT<;R_^86b4 zYDcuWW^FfUm!+?3q8^)zF8TFCz==X<;S$0YwMBY7<@zB?fW0x4lO?bx%a=LNre_zR5S{?LVZ8yM& zx4jLqv2LEAYpmJfyj&iPUTyz@FKv69Y-8OrVbxf3zS8=rJYuV11kAbN2T@;B~of!t0^NEdBA!cnat;l;!h9eElLmcubK3m=6Somg}ax zqHD~u9|?@71TT38fgGn_K+Yk~7l-A6;5N(njOUB!H10K7bC~*=ag*S&;S?<})P6|d z740#_^Tl!c;vD`PC*v{0c#7weXDG{Q!zoJOu>BCvYtmzivaQ==%IA#7keY^)>Ktka zE5Y?=tz|V`q6^(J_UI_)8G`h~m3_0~uBnQBx1up5WGDfLnu7hb;%>6aw0l&#lF%-P ztu$oRW6gDLP)yA=(pL#7YV2V?=bBMmb=sX6|MI_icw*(;$hkJL_RiVusJVv3(;pnf zHuuKG*Z*@Z7X9O2H35Su|F@cnR8Y45a_Ep;21VgP z_}z1&y@*E^M%z$N>@)V@zG?2wp#R8!D(IJ-{-v<+_zDaC!HCtC1$FV$9mCb2>aym`-DOmq)*x!=1e_>k;Yj$g z3qL~<$1QjIpv*ZyjldhyU}`|MWy6-cD;8bka9Xh`IAhDg(eS4ieug8SS?=^hxpM>< zfp?@y)PU;C7B6>KQK?yjXrR+`qLhbY;iD{KWyXbG3`8QLSb+^fMR1@RgAb;~)&v;K zjxU4MQkh$mXrgm){wasW$Jbcwk3wX&0vm!#Asn7X<-BK{te>kumqYWKvV2D zkfB%zWF%VrH=&fZumUKZvi6>{0Tu}sZlw9%Gp(KJBQRj3=9DJ$uX{Nh@(U;x6BJ#fn zWtedQ8LU7j$I1nu1J;)*1~iQnff^d~|38FCfic>I0b|7fiZSFX#(zP@Vm%ExSdd>x z4-j$rA`$A~dzLUYbN1&VRU+0D2U&^GpKPt5MDqTxL9w@AI;dqpo&GPK8lcWz`q8bF9l4G4uT^fbh+ z&^j|2{Z}yQ|4!(?q|-%&lSeyv9?XZk?pet#OB;c2;1Wg3buBRaUJZ&pEF=jN?d66V(bB zVE~hsys+h}8zO6}twgELsj!MzsR!^``+F`|m+D=0Fzx7c27X zlyZTN|C7+{5O{!sFqlbTFn5yDTPw3>3_y@r@(bJmf-t$E(H(;eykr_SzwIjnyIoLU2B z$>)giKi}y8)(|4Uvhu%l2(rRXTTbLDJvn%S7tNl4y z<@wf%n9gd?S5yDN@qbACJXtAvj9l-0x_EheA2_{De@r2^%hu6tUljmwzfH9zwRnGS zuV%Zgo=*9#RJ~?5wXHt@cV+Tv=JxY)aC%(m+;LkyzxaqO(${+e?yWArB;UxDf=%p} z?H9Um8+3X;adGhG=mxx<_x}9$;rtvEc?kU~|7qAY4`_THsEn>;y7XmQrs8}hd|4va zlJ{HLc)NOD`s{epSC9sWzyJXOfdQE%ozW1A;i4Jg00Gg91p^@mqVCpAZg!4VPUa>i z&Q47FjwaSlO#d=i7~O5G8NcjxAB%+D=A?7|V{@@7E)2RP?WOeN<6`qw7Ied@rxtLfM1AHUixaePvbS$C=?)nCfwS-P9ptVp?D)vy1E8V8I-jV51iZkn9m@pXPa`lb6G zy7_H#(C*_;cvd*wLnk~Ym9~-VXV`3~uP7~LcYa=6)~**%`c(v9G9+1_x+P6&8&9-) zrKHm)=)b6$VCjuCZ4-m)7w=1@w5~EVde&jy2%WI%gzLXzD|a(}>>kQBG|+c_UH~Gq zJMBK}nqNNJ&ayFAZx9XBd(re|Dt?})57rX~T)!Y1mcP`_$-+*nyn^_x!0Gnwes8Q* zHp&|>Oqx(TyvjlRfC77&zz?)_bLq5^t>~gr9F~I%&u-i?kboI)vV(E5OR~R2)up?R ziIiHb?r6+qBjYM$aE?OXEZy`n;e&fw#}Dib3=+MIigf{9vN1D2`Ed;5@)D4-@8zn1 znscGDv7I1W1)tPXuv((kn?15UwykygDRWSHz^4e>9uM|P&R6YW@gh9j%l;&0v_2{& zkoJJ?-9+!I30qfs8ns$bC#=~~68tmeEi8uN)2cRfN>iimPvo#?z9R4KHHXm~IeT&czQoA_(<2_w`eHoF}nT8?C6rgAd`~ zm(}wy*T%tX-@}MK_Be&#iVp_)x9rNDk~j+IpBek$k+lSrG@cxW66y#!CkZ|@=%nkh zx5O#sa78v!$u}`SaG1{-g9@JiNH-`3`xj`qnO{T?i7y_(r5tP7ZOvim_>NzLT(pMf z5q|!pKkq3snoH}fAq!n?j%-9*d4svJIQrzzchG=jg}z;4OjFAdDrQ*5QtL*>R+0hG z|8&Q4)4Iv~4Skve64}!t+RjAc;-!6)7tH2WqiU6^yxcf&S4&tZm>^~t45neg_{#DJ zIjB&P(Nc^l7ES(bG&5xO2rfLnw8)Wxu(dvieKQkr*d|(xlYMNxUn8 z(c1C7*6P1`I(>pr-(l&cmO~E=u(8ywEI6^&HS;RW9AuXwR(ew2ju!d@k~}Vfi}v;c zc41nYl$M`n82lR53Ky$A*)kf&TMV@qw!KN2*V2gQr!sZ^X1|frSNdvvpb;@*Yu|GF z@X2(3!Vt;0Pb&uX#$;^6lxt=B)!KVLV) zow5*XzPxQ4SoDt<&KUG1(*#(0*$)f%p!>E(yX1Dq;j=3y zrRk>`l3t0&;fj-&?>|X4o72JIe~Q7yyqVsjZoXoFvT~rj6;F)|W+r67n!;fNOxbwu zzzbjrI>FeWQR14&0Ypyjf*^n~RdD

g-{!l?-=Nlq@ zfH;pQdVgO$Sbxk#d+(ylSnLJC??N8F1&(r`)rO8dQTWpvl11Bz6<<}lh?b2TazK%> zEdG=JjrC2QP!+_P61#a`n@yLadxm`9=VMBYA2#vlW|ig=ZIYoVFK?PfQ#S(u%302S z1+o>XvK0keGqXE}(uZ#Et$1Fu#^zE}=wX@CJ>2%0r6{3aQ4mM>kNS@SD+-?11{!n4 z7;vG5KUaDD@~ozAdSIcyev5Gky7oJ!dh~aJ-@wc(+70)o^Z8;N?}1>fjH==WvADDK z;rH*V@m#Ft2J5Bp1>`Roi>uL}KJ~MhSaLr(lqK{T1}q*LfZ!;Phlm!pn*XXi2BY`Q zI2jp0COMRl^nYtsWoQc^-QATa#45a0E39%bE3?7``-LIsn^j0n&Af7_YcW-GddYpw zv~2C^C8tDjlYm2xB<_BIaI1!yDx>2D@Y4P)y1miAmX5`Bc1!;rKeg1YE@n$B=H1ip)*NNMMSr=}zU#wRB&MpMC` zyCyGzZ|X>u0BwTBeA$iV-Vn~OHssq?Ml%Xax&)$bn(?m!hFj11cGDG@n3jf>9on%r|`f- z*x<9NJP|JcvZfVnZ_8lSLh7ae@pPC9Un8iT`lkJ!@46%OU_uRLE1kRB@1RGx9+UAj zLE4%#sidJThe!{HMV)*r#n~T|F+7GUBiIAqy-awOY{~tepOCJ3sucVp2}e!cdDFi( z(z$9>AY0BGSX8*6ucY+myVtLcMEY`P=%BX07L!ptDk-t+8{agVa6ho`p`M5k+qNCe)b{|bR-JF^R z+imnLbi{0@g5XB-1RTFTS-;lByXxli#Z;tUQY|Id<0HB`Ai=*#?|)ybam(}yWXQs6 zz-SP=J7uxp7ON3zsAjHE>__=+O?V8h{j})cBJgg1o(hvMPjZgF2|nbL)2mwWh=2#K zNqochTeO{k`dTrlg}5SiUSl14gW@RZAc2b^ZB?D_Jf8ksc;SlAfR?2cQ%O_uPkT5D z=)4bZa4Z+-3i7Cnz~aL2Y=s&rzHHB~tTENwq>B9q(;z%Pq&1>Hl_`|Z){rG!Lx?Uq zP0<+k5X9+o!SPz}=k=T!PR%0XDUSx9IY z9H=3QN}Q#)PRHR;MEU3|RuC_nNez@!TB4I%Tq;id9}DN%wA#mSTfy-Lp7jRuIr9oR zL?CU~4e;M++0`#Soc{D+SSYjzcW16V7}%+@Gy2vKjZ(qydtWK^^T{&1l)Uxpn)*3ld%XduKq5t$ z0iaIK;-rH>l}e#oje9Xg?oXbhotkMKkk)^_Yz^mC!rw}O?~A(lChRnsRz2}9W4%sQ zXpC)2+S{eymU~97fGle2w_fPF;yPx%w@?oS5WoMfGL<2*Ka?>a$&YABhU@tCJd<7J z+~rs#JWyIoq<&|u7>jfAeTsBjhLDv%=6a^m$*`$=dEG~n5+t$H??KkA^;$SVD=v1s&NKrA1jL%WRv)j}ys{64wpnPz*}56w2*uvtz#EH6{v_uiGp>^gL6hmt>)+Y2-#rg?Kp!zgWwOQ5|?_ z#|R9H^c{-a!<~uSghmoH7>Fe>R3%?tRud)QkY1G2ZH&m4(XNBbX@^12ni>~NzSCAe z)ll=663$sk*uQbl&2>PNJHT-rX*D%EHSHEF=gM_Lw9_Kl(aB0Z>+e3Zt%^$a`Ji^xf*Rt2McOTb=y8v5mI>jN}M+zpPFs~$l z&b151X+w*3qS;&a=6dHRv$8l@IFty(Y2Be~d=9@Kc&i+u8g6`E_mt569Zj<`w}*{W zkyNF~{f{|a8JBV433wU$&Zu5b7Q&No$MPVJ;?T9kM`#86i7@OG!BXVuk8uKdut_(D$y}m5X`G3B{q8H${o>uTV6L z1QqAHpi5dik*NjeVAr>Dht3E(}k@tKoLUTbMeQ9ptq zhNcqkBetGUD>uF70$NT#C6P{Qlv)O7+hjQLh`XoMAzNvnGU<^K^*%fndV|m9nH5>( ztIu#PwUHBoD?Bq#WtNtcuy7K+zEybbEe!OR#qcQVultND{C>%xS-i83bxE6@z!Z5t zp5C$g1E?HguT+6`_CHy17*H^JG5=^Bw~5-wV;dF2jgZc+6Qp*A3@RHDV6DQ5kjq9@ zl|{Rn==^Y6nM)7*)BMurO$J0HIQyN^Y1Co4?)k>BQQ{oc=uI`LUL(EJ9I zPWMQi{?McViqN)oM@V~(^1Z9Ki5|OExQNuXU1A}t%cua7Fo~C$P%(*ggye$wxCsw{ z7i1xzEDdr{D4KOV>%&@&t8i48km?BY`b%z<_XiEAEQT8|<9XW5;`2rM4R=W3bXA<; zhyuz>dTJv!dQ?buB_D-0rX^nL&N_eogWSEk`sMWd&E!1fTVU&zi$sX+mFs{4>B}El z6P@a6!CS{tn0+P~3rX4d$Yaqi=1sH_t7i=U)}VWilznRv6|hf`3TkxkbsX(>NPV(>bW6Y)h%j-4J3wud>Q0?x5GaeXjZ`TJ;1sL=2f)DA$}<|JX%ozFis0o?_PHIZ={NAg1zfdY4)r^bXVvJT2N8zh3b(VcMSbwvOCLb z=r&Jh)1Kps+{A*_B$yWSWEOt4Y6}vL8gP?TUxBPjcA}WPKb1M+_hR@=?S}agwX{vz zesjTPb>bJNdRtYde5th!HoDrWB`YW#O$gZGG~+mNGA@_z3VrXhc*Mt1PrQ5#?+AbS zEgd4fl5>6Y2ON)@Euoq_{`YZwPV|Gt58w^vn>;UXbpE-^K@>45K7K))I2du^?zVUb z(y#6gUw*x`&D*GIkpvnZhw@#Tnjy(>)sIq?1R|Os=M;FV`qE{o6Kh>om2qFG!f{F^ z0T5{^y}CE<*$?aQr%YIgucE%#1M`{oyniT0rCIW&5Fx`FdP;@3%WdsyPJTZ1tXYgm zC&naWC$#%sIP1vdz5E5F5?e^fLsRx#?;^^p>&E*(p@w2prZQ>5O8GVTFWwl<&e|ui z_YH2%Gy1(hE&06-4Sl{m#dLi*4jMI?`vN|%E2had)-*R0L=;C9YV1@^ri;+$DPx{tFy_{Ll0jb%1lq~Z7;b1;- zdDuqtaTG$gd19L&?9^&^^wZ$vGAd=-tchhGE3uo+A@@g0q9WCEG%8E^JTcJO8tRrbF}xm%dLLguH=DmM=YRnBGvDTAs(PP@FV zoWdJvCf&(VNYEKcAS_4EQt&wbQ6_Yu{U^{4n@w*P!6BOV@9Xk*GL5su&9$54%X&`? z5m9$KT?NUC4o7D3BHC@IOG@JXgp~Lz#B|{TGM<+vhVfyDB*>qcBpelWiS{>~?H*lC z92suBIY%Yz^8uBHslT&HcBlX;d_;Kl!DKqQ1N*@j$-TEH0+-aDmEfvg8P+b2IFx79 zMs$=ZCvV63zkks) zwDxsq62_h;%GBh`cB`jxPEP_jT=pcLSa2_@D);Jt&`f5s=ZM`?mJ$0CNurSgwAgjM z>Zpewy2D1IUJ$-d303xk=|yhTt1YVaX>S>u(^XZgXO<3}tzKOqS@I$tOBfdKoGU(2 zyjkSME2i4LL>pYt=fbl4#huW%{V0BxHP_OtN$z5D)PxsU_6eF?5RJxFi^9mkz$3!+ zJijPmWEUcZ4k0B^Ken`LM(13$MOj6;7QSH|R^xpuu`WTOI#t&TLN(*1>PXTkv&`%t z4llrf6u}z$j9&HvRMLDF>?yEP1lYOIJfq4kUESg}_TzJuUg#q3S>}cO zC~E{m;0~*P{>rK5*&i3&hMzk&mQeRpI&6x*dtB=VyCj zhsk;k{M|lJ;p&^XUoTDyK`9~g#yvL1a!t;}CNuehsK;wv{e5S9NMCLWb(*y;RoB5$ zkK(&8{Q>*;%~zMr%ZQuf7)NotoHz3cCvWb##NeJ0A%iZ{Vi>`6Q$U>+GYj5d8%cJA z5n1J-;M8Du3RCw!2YrJR%k^iHAMWtL{8s%2%izZ~~bcgYv&v&LB2Q{w|dz4G!$sg>Vo7aDk*^hl$5`6_WOgQgTh1iOqKhYiIo(a4+{ zcO&)ePo|$W&EZ3XEyYdL)dl&|&$pBjK>vz$CYh9+MAi0|i`lKycGu<=s@x(Uv`%>O zO8EG&R9r8~SCQr1kjodz<#(e|tCycl`_@EGe6Kz`|zm zFsz1h)>$f|k>)&oz8K}6$unP=URla7H)sTjrEVQ`n9`K_mUg9I?x3Wv4EQ4evttqg z@R5k7S5Z#OJX+bv<$ls=rdzEnEI|`txg*tS{OIW3(){}@dhGt#AW(tg?8DM?3!%e! zT2vK(Sr;jp=7&fR>`h5}cwKgO65sq_nd#%mJ&1fOwZQ#Xe9<+8(C-bwbU!Fru6OaF zUp)(IBx8idCF6MyIYeM@`@(y@Glm$FwaYYY`P&bElI5d}wN2}*X}kyLt0IVvBOjp2 z(=$J*M2`Q=lISc4pCf7ag@g@cslw5kL_k-a|1mUR6%xO5RR(=(4Z`tYK9r(d!YI;l zHFwBLn|Qp!xxpeT>?NHD?lh!u-~^r^S@$h^XM2t&`h}j(SwozogT8Xn!c)f?qa5Rn zpK_9I28T8RIU(}62a@VK}8im?5Zq*%zZxF`Qdu%lkOve9Rh2gjLSv@ z%oE-^f7($QfAu&ci^P|G*TshrL99c+OY)9GWd8!2cUz;xsSAnBS7omt?1=@1_Kr5v zh&vT|p5aRDcN&p1OU1=q6s2uO=Grex%t%sM2^oFr?Hh6mCfd#nDSsqJjWSNTP3BLn1=2xpfdqaVGLTrJe6DfECqn@#}*tHKljT{}+w|PR!q6tG5e}5q? zH0Xzf5<`0868Sxpcaq&40|$`+&0i#gxtd3{B{xkSaE zSSHSfnnZR7@rPAM{p=_?(rtw3+_L0Dqu~`1I;k0wI_S$Ti5Oo(SSZX!4#{c1gYUjF z=3oNp3!g}+@58(mRdZRgRhjrpkzUz{rFa^?MSZuDZ0FO1kk8jkJ-jb)S56>PPM zB2e5H;8G&)CrS5iO7oW=AmA;a^F-|v_>9_I(_}{TcgmX>tXVT1N;*+eCgVwSdM6k+ zFp5e98E*?t9(o^r#np(W(%YO*ENa_&&RE0G)m#|_7mmiSW6rFW(y+GA`j6<$35TR9 zt`y_ceWBS@d=q(y)+pU?zmxPUd2`O}=uqM!OY!wIYbpr;Q||XIgW@=XAnYFVYBqNY zB43#z_F9m!j(&!`On`JYm2dsNh0nHlOGxHo_l73UGTz~{AtR){Og53IH1nwCeh?bp zTvNB(5@!j?%&K*sCAVaPm!3Y` zyqO^4cjwhbXWicAsAU)^$x!4cbfY{oYCDb1p;-aowt?2e$p5ygIuu+&o!~TY}$O1 zdqFC;XvEY~N+q?+mtbTno#}Ce$^7wOLT2mB^04l~0RfsncMb@_y zu7RU8=e>12j2c`iR!R(4Avr7d5Y4m`v=rwucsPjR2_lp2pI#TgG$hNMY93J?VV)H6 z$oM&@iu~V?gpvv!6j_$)6>MCMJZt8yk}hwQ7=%GIFpU;YYe_EcLjwD2XNi ztM0Kc`2W1&F50Z?WfQb}wS<)4g5P{MmF*Z-T|MRqVKn=lB=TFLwC^z_=@;uI%Og1* z{25HgfP@_k0d%SEQz2-yb#kqmg{+7jjwOKlTtEKg!M;xcmKRdR(6dj0z!RC= zR5?IZl-zLYCVCQU*#+?;I1XfpmZ$tL329wXfH*01(;q7=O7C9A@I(O){-b0O;7{w- zomfY4K0lce1ml*@B!PGS?AffW)ip&8->XldnRmYuS{sJm?Xg`yu8jvcW>_SoRYl&; zxL_8wUpwNV#f1=DkpQEzi5vOSM$y?MnWy0RkM?1w!ag2j>jj5Jd^{I{N!4NMtLfaR za0{yfS5#yW9mR0dNOSabOfU>#&Gx&0yR${j2c>32_dm)D)V7RNN$;u+{a9W>zw?=0 z`=m^?7jm15)@Gm|-5nL8a&8`oS|!Pz-Z0Vds1N$n^DmmV(ue&M^2Wnwu8H>1(Q3j` zq12T2+M#)$NWHxjSj1c$?Rl;>Hi9BEHD@HuUobVi`;y}h>`jUnI_29!YR~NN$CX2K zNM1(}LW*syGa>xI{b2kig#5X5uoH5GvUH1~=a$8WyH}(^NkhX0KB2(jVnkQ(g9lBI z4Rre%6)3nvC_IrSr!uuy=JpchRJm8{e|Iay3JiFcdWt(yf%4H~7aYfYfD~JmXWQ2l9o}sDO70 zxaYMtT+TYP8!S(3dH=ZwGNW~@+YFPZl$t+*t(>*<$*~nREmgvhk%@%J&!n&q4D`2$ zoONtL*S}MvBj7E3)CCFQM@RZ;MQx7ul4b-@paLgCQ@v&|tXb_UP>N zrkOx6q(!4(s{N_V&7S=j8oR(KLCTz77CM2Y>t4DrI?`_3kisW%MF>ftbdd^Mqlw1H z#L1!CsjPZi5pU8o5rXB_n~e5)*PJcVwAR*=dex;}=f$jUKw~1bgl;nsgc)V{&EqGp zOtg9pgrPim0o7hi?5L+q>xif-R?<#wpY?NA-p1;S?h6U+G`(eKOT5BrO zipEv&-jO{So5r^o$_WS25cW!k9bH!G;h&%R5_wrkv!6Ax!`F4qAXJh~L88;b56jn7 zSs9Emag3TRCdJi$MhoIUnA15mG{xb)GXCjsmL-}${0_ZJC;9P|oJ0HhVcy;0CrB@M zceFPF&q=|o*)*(*%6YEhpF$={ULX6bQ1&3dc{Zn#Y>?gYvYaCxBQXPpV)}?p*u4H0H@gll( zyNVpfxAKeQZKs_RDE5>HZ@$dfR z3ZC>M7xeCedetj$YMBhz%j8KPH`G5W9bHK&d7KJ`iu|Zw1HCe&p+XlvXY=WC+<@dRxOslA_kR7N(x7H<00Cihw>V@6`NW>;9ZoX9Nh|YYjiK z6d2Rp4>yo1V(P-MF-kJ2_|}`I!CuyVCQ4((7#xcPSRMIn3e{7X@r=okj)F}~t4o*L#X3w2^=q{fr zRu1Ij=O7bCl3a-P?GL%jrRm-D9Dxx^(3!ay8G!lq#Ck{PggQ`2?7iX4Bz!M2uBla; zQ{msnGmFZkF$8ffv=hk)BmngtKi-4s|FG4wMYcOq9X|*Ru)w6vO6CiopoOr=cu@4- z@x+VY?TJyzBtR~ck_lf1zNj=v(XsP0solNzWiz+UoAaGQ*tfhadEEeYYd1%4@NOLr zGHp6ftE``$Q!Q{8RvE{~n6Ocqw+}EVW&4I}cJrZkpxn787j>Dz$CB@2^FGY7Ek2W# z;e`=){_C?S-zs zo=IHiIZGqBlioYiy@Evmc_@J>aJt)&^sSma)&^~f2Vi?2zkp&3xjdpcAyeOxkee@w zEwXTB{g z@M8=)OuEdZC1~_(&{oFMW4FP<@RYnFcW1&yn-9@GMMD=2+zcTA@g=yT1ox*d(7Rk? zoLLeKei*}6Orxl2*H+UyVK3+=H~d8vyS0I){zl~;o|FHQF!v5tJFZ~;Zsoa#Ygr25 zsH-#P=W%sqak*Q9Xi3#)RH5cLZ#AGv@Ey$LBbtNp_#g{^V~A^(g;Lm_I$Wi3i2c#X zjG+K9cGWj8V4hb5fb-)~vgH7}^!e7gpP94NvA8vRIX{x0G|~nhB7$xkpVow|D;No6 zL;;p(TIG&q$2)>*Y3Ef2P3`vV8)$8O8gNx;rG_*IAM+>>g6UHCIHk?v`@Q0tW{R{F zFzlFenx63~61}_Phl3!p!?s~)U_!V*%9(Jjm?cu*npbP+wXDYOf}cZ*wOFZq5zdy` z2SChUbgqq+hwRS}F_9*T$LV!c3a@YxpF*$eMN0|a0Kf-6#xl+w!I7RtF9J9bO~hhH zQ9=ui&Tyn6`wzQryW|;2q>`X>#ocS@KGKR!d?C5#yE9y*<>Be$gd!sk>NHYq#xxVY z)|jo|kt@e=D+hkq+XbaSJmcq6cb;YU55#2Tt1*Cv*HC?ms?DvlBwDE>r~Uz<@}C%7 zgc+g$NLatYj6tL)oH;157pxhQnyai33#qp*s_Khv5{IV{1AcE2VlwBoE;>|H47|O_ z6b%nK96|BBAvCN$hL8=jM8P)IfY)=ObUc1NK3?PJ*wu3~=#nzuW~%bkb*=2F`lhO& z?ZEVFQvwlMQiGmWY{uu~hbm!+l8M#V3&7b+)@I%oY(174V&1i2XPD`mY{N zwE2S6X*#Zqk6k|s&WuiD8ZbX^ymU2Hyh){8{MTnz1UCee9W#tk3!ZQ}@NklxYEzkn zzx^ogGjbg566WP2GY~6U0q2*0@(q2JWj$psf}>Ns*>w6;zH856Ad6 zQ_efLD)lDc!LT{Ef`B|(ReKPM7DImE%@gOnHMn7;%K)ORtWAD0DA+7rMC?4U8u1i`vqwaRNwatM&QadS$`%NosEMaAC&p^DrQ(eAJys zy9w!j-=Yo_9*gwp>E<=#*hJJQF=fk$Q){d2utybdr*I9%hG)7VK#mQiQ~a<&uqiag zf^Ov9)A$e&ntqpU4w% zj?CQs5qHlb;-2QX0+}bVxe921?lWtnWKI*3FNHDja%##gKC?>(-(gu)yU)sZMhaex z&N-}a=AJ_ew4THQS<}p5!Go9g=&#nz2x9r&olWpZ)THu|4;AUh^@}x z69!ND76eZ=U&zZ$4HZJ+*Z`q@%(uAPZX<-HNfhp8V;b}*bl3JzXxI?y0S9gAaXj&a z)izn(idq7upH9Me4IdryXLk-m3hy3i$DHzB(t3&f;gjE1$<|ycXtN+p^R2UT_ZkXg znGV4uQ$F`llG2ER$0gmg_{T41s)$nxFyD-={^V*J*M{49)>LKsQ-`VO;<8DBe%Q##zLJu-KUvH%0>FN!$97jjcQDI@H(V3ubn zB$r-2>3#zVEvlZHIK!2$Hrw)mK&fknX?s#vo?$ChoH(pjYA*Zn?c;O>Mx8NMvAB?( z@9oTq-(w{c3*IAk~0~U$i0eaLvmL_R|ctB zw;1Lujp>OAMY42F;I%?evypu9xFQqOFb`QI_bz(Hb&k6g5HXxFqYhekN<@F(n+H{J9=)?6YU@sra90XT8P!;G znn&`%)IpF8sX7fmoit-=`n!C_uEqI2dQkDOgT+$ES2DFLAVN7)SF#`=;-LWD8|lH9 z<`sSIH>I$9i<{v1?W3A@;vln(=3FaiwYN=c+l_wHO#QNM-{qls;aQDerBj(qL(xYQ zhT*1yMT2Kc+R9;(hG|GZL{l!K82IKKD8g$=liWAZPJ7g*;43^&o;g>TMzG9uHSF!2 zPgvNHcL5QHNej|LIMsxA#blJpmabG<>P(Ow`9fh##v`?`iW*p}DC#EnXz0hR9QT8O z1x0gsZC&V1F?mG!Tz}~brZzRW&|uM?gl`#SReI;6cH0!}S^3)(OphUq;SojHI||ZV z=03Z${38%8_fr6ctM)ZE3ZNY+-qWhtF(QDkiBfRRCNSVnNkXD@ws#fqeGboLv@w zi}m-^+cMXLqw1ErIkPm;+Hk61$s`0cJbu5DK7!MhObPgkLP3c;WF)y&xz4TdYS)Rs#c z+>#~oOh)^&BOeAFJ_iu>x6t0-C(d1ywQ`+|Ejoi3<%JlQCn5ZosQs4=YLs~E4<=xb z1d@vt4~B>1o)fkPJxBiTz8`|D51~7Ay-yh?YX^Y7ox{Fmr!FbMsyZORUcbUVnZ>G# zZy*_}+bLzAnK({pn{AE4Msg8(sks?$i_8Slpu@ z3Ofjqk?e{|_~MWQ$ov3sN|Wwi%@MqU85b&`cT%*8pcCf-pms$!|{actMWA z6yX*3gwYcJM>X-?^^moPW;mch2+N`ycm>)rMn*LKTMt z5i#Zkjg>ZSv&q);Lp4aMb%a(XzJ6N61vwFu%;(|y#vhAf7d>SGAC2V$8dgwW1)M#J zdo<&Vw2YcEU;}bJOw42vE$%`?j|IUwW2vEhpWhhOaelpBk{j1?@if;xKQ-RiCk$E3#$TO{Db6wKwffKMhE4CJWbBk$J~Y|^Yg1{&QoLcCH^lBRGI0T& z0GEjr9J}%GO9y=Kmm^=2>1;SE=_1hll2B?Jd-rBZQ`s|gFtON9PWIm0>I)sxd?nLu z`Eqg3jV4yMdP*$ZENj61-bvE=Bj};h8Z$2Z;9AX}hK<_CMH$)!04N*=0Jwe{whu1A z1LgDGnrH27?~iCfw&czX;IYS{1pqe@&@8+%Gp6D~Z?^&1W*YV=(J|4fM$eG@v7wfs zY9@;>Z>9Z8@R5YQZ|-4BGr#&qDtDCfL@pIo|0TcKskBHHK6!lWu&H;8bh8u@*g&Mc zY3u;+zIY^765W$MDSXD@Qm{&dW}Ez_zf0j7$|BR*`9crdR0w2Q_gu2@fY#l@)%~qS zdR#I|S5B00OB&*z4#cYyZyii(&=PG~L7m?^rCu13F=W>h0Z+O7ybGaJ7Lt_Hs_``T zp}(W;FJq}=bL zs7rlE#{9|hJ+`Zex%|4T#48ok4l;Ke_9i_d{1`BGuQ-*YcvHwJ1nflrP>3 zqt+3m9KM;UK3>NfGR0dz&Rf4EzpxneNjD;lE+f8y6<@2%>C|m9Oo`)d?xLT6$U`+h zxUBlzu6cKS7WB|Xc>=`>9(EqO8$CYTDLl34tldSk+YjEiQXW`DMJn@Mr5lKzzwAPN zlF5#-doY)qVaF<}u)mylUt;@(iwkq8Nz?GYk4Myf1-4*sLio&+{6BTw-XPkcvSkDd z<9*|-xtjCc`Q-vqE2iKt_xhP1vPiTv8{l1iK3q*itqq=fHQxxZqrf+2DOrVd`VP)c3WM^M&g+ zmaI5zrl?+r33B4@b!^r9SAAH>OodY%=!wccX;rJpSUX!XAuzmX%eWuj(VGyzb_ZcH zG9}lN-Y{3mcO{mx{UOBNY|E6SnBrZs*wr_8x{3c|lT5$0w%X~0F) zPwe3eYF-SF8a>camP}~c6eqkvLms)A5eDK63on{#3v{Q$#tO+FmKWGwPkzE3a*6yz z=kkl1JMO8e@#xfCYdtZMu&ujlqm)ywjVVXpO{lx`yzH!27kNV88?F)KP`WNV?%wwF z+Ln=2Ke19ev^a$ittFy7_N}9FIukc}Br1 zyK(}Edn6E2VSINTyKlqBA~cm8horEuTYwk{Pz|=5j{xeE1iI~!eB5}Z2BgHjs_Ihn zUZ``g)S+$GKV4zj$?1q%h6@w`0sxFOhmpX3?{ELn)t>sm+!Lq_HYk9ioGhMDfXaD2 zg+_Nd%Lx;iNt75D%JOPtPp!BskNI|5nnJ-|wa0!ipFWaDgA&D_X084V@Z9~dbDDRC zjjX!4fkL`kbn8kFM1Fipx>2Ftv#ZR)=bPy=N6d7EPcaJ5!MDQlHNQUjfSHjU%{xTZ zeEV(xdyWsusRem6-*VLFvs;!{#G^A#8hgnv$7ER${bCFB(mqyaEs^4I{#mE4d`vH1 zjfRz|T%W}rBqaMLubYL9Z?$VU8$K(w^xIUr4nNihC%|#MZSNTs#Nwe=a(4 zdpY)no^>rWl3iWzW+N>{+OhXbgHBNCo$?BD%6Zu<#PmY8lQx?P)kMR&fXR&(?{Jfz zBUk43*@_40gge~#lYx)RBj4($VKqYnO+!aIR2-!ow+Q27Ge)=6bxv~1lLg}6f~vLqG+b9-CJ&kD6lKzJy1X5IcWOLB`tx5J+^TS>Ddm#d*6B0Z(vQ;=a0I+*?B4LS=jWmvlk@j9YJOGDPU3k^9%d_ zlquN}d!(2l%SeXu3jdVpPyPL;WPj)~^}#8Qn@SLq0w@-6^6F$pF4?nRKoNrbR!6zj z5<4|3SAj?;dS;R5Pc?4rw|H;}O-&WeorMwFK8K#AsZ<^X#3=|Hhx%%@XqK#)EWmvU`1;#7`^JRS&o%4)xmVJ# zh>aLSf1Me53om1@NF$6V4&{k+Iv3!D@^SdC!_;%lmi0=IZ*h&?vVN1Htmtd$_UXH? z*GfHVh;Ul;G+(ECKh zowC0W=oD<#q|Yyf=N9y^pa`*^$bM%ACW-M!MJfiuo6bdF#bsQX70lKlM{^4x9LKdr zRX&s)PUjeV=S`#}8eHfBM8CjFr8>kM+^=$Pu(FArJ((B*{+I=cu`>6n98iw0K6>9` z7ojE2C`~FUa1oS#x+-j{Y(#gM9^EU!d#+w3xW&mwZ($I9dEq}M1BR~K>#yi!T<_P1 zEb6-QWJYnv0_0=e8T9cgjGFO~agt4p1!1gTR|w;j0f5UG7X%jL<)e7f%j^5$GNY3! za8exK-(=_>&o3zB8NyQcPqYgLi~2Wskuldy5<3Ge@l%|?7(!Uq8KjJvBRE&oRn*V> zk3l2M-@gS1t(rLj0WK_%AI0f!f>6pH=Ak7!<4TxWn1`MGW??zu3jBXYpD+_L*UY~O zLoL&o33n=JW)|iI{WlBCp^P6aJLx(zlsTa7Kvi;p{|s-;K;{6k0~E>q{pY{J1v8l0 u6YYTKp8Np+55L6B!))a{Jbh1r|7P diff --git a/spreadsheet/macrofree/waf_checklist.ja.xlsx b/spreadsheet/macrofree/waf_checklist.ja.xlsx index bf84a59b912825976d2795d233e048039333bb93..469d571cca3fc4e5a463a0cce1eebf0facd030da 100644 GIT binary patch literal 193031 zcmY(q1CS+Kur}JZZM%Egwr$(CZEM=Lrfu7pwr$(?>+|1u=iD2yt8!!2j&y#Rt4dx9 z7z70X0006&-grg5KX9lZ@#oX%&w=oB7~2`iJKEVh(HYp=)4JPO%fyUB0WrXc`2CsK zGWFgOJo7J=noWMMOXLh`rnCuudv*oE@5uCGmslWG7#u`vpx6rOv=KdO1^nwNyltl8 zP&z1o$Ft0^84z8E1z&`Z2Ru+`tJm#!jHWoA z-Q-%EYNav2Yo^rg^TBg37V~(JU9+zQYhjG&T=QC|4F$!VjI#C!c{kCtXuDs~?BkD7 zRS{Yb0``d!RzuRJ#3|8=K3xYu;(!JKpqy{gj6rf60JHAcz{$)cu6%lmh8-qEIS&nq z1NqicTgtf4n&7pe#WOXb$Z&4-wePLDNo=euWPZ~fL?*lCiY+aEV3tN-uzmUsA|0Yqjm4lur$o;|??KKi+&Th3=Vyn! z4?MbkttGnpTpWS_U&Ymlz+R+-{pgJl008+%aqiZ1&gLdICjWD0_(ye@8d|Z)Y$(1p z3*Y*aUTI#m;rd6 zz#tdq@MoD4*V!HP13(pAkSUp(dz?OAv-bBB)1A<-{=ncO5mHWPq<9V2A&eSsm8{lU zY_46aoS`K^nfXk(i)Jh(iJ$ksPV;evO_v83fdqJyP45*aQ?T$_tuuz&(oEkljOttW zibSF^56xUbdxLl?nR>-2H7Q9mL7T9HHZ6k#V<8`KRL4@;-*PwRR|vYli8xw^JD4k=?BMt(WTQ|tp&;048?w_-86S|{@jJq+w5J=QYA07cmYbH z&-l$cBdh*cIAoa`2WXZWeIttTV7Z0UEx7teJag3SjNKu1uS5F*K${(lI)jh}HxV#K zfUG|n4V248F5k!JYoXXQ{ugJim(mr|RH#Xt8lTVoG`wCxkKg<4;=bLayT)+O$6-aP z-^VNGqh#UZW@4&bZs*I_d5^EJwSNl;FU7#Kg(OM4Xv~aEPCpPVavbojE7Ch;aR!Ji zfCYf7N&#Sv3s4~%KDr1a>b+=XK#dyKlc*wRO4mx5kZxm8? zTx^bc8cHL&al~K>QMOjbgq=6I(e)khEE|_+8_9)rn{%zWfC<2aSm|I3DTM0l5lU=* zL&YtmvJ@SyK&-+-9!$&pE+L2ku~s>Vc9+%QV zO;!rg|i?uF!$_Z{Z3dhsb*Wk&Mkjx?Yf43-)VS=b&rj8p33 z%7aW8gHVMU9!r!F12AL=m&R@NS0gje7qjG2wFh1wXv}K3(qX_zRJA-+WiT=+8DhH0 z+3jv1C8XC)xQO zAYY)$rgT5K(437+u8xpYTwz<6*|L~%~6;U(`1 zFL`Tzo8y=Q8M!6m+Ey|nJX7ql4XGt?5TYAk_Vu$ zl*DCVb%W<+f4cZS^+V))IO@w;!8JF+!}7j>tQmTDPo(D@_gaLnK>yFXO3m^O_NC>Y z-4@T}y!mQ1EQKbWQ{_Um z%GpJiSK>i)Jl&hhnWd2pr7gbdX{>}U9HNhL9!O`r01(&^#P z8*~zg1b}$Zo7n`}U}9IEGf5;6ft}O{;Ul{5m-~U&k@5F(&$W;9fz8iD_+vhwyRXyJ zTX;6M)IFa^!Vd4R8}&`8)!W?CCoRzXHFPuZMy6lB2LpzVBOx_x$#%oUbnmyEwnC#$VsB zv4;}fy&_MZPSr6#|AhKA0Ek>^Yf1YyQug-B_;NjY_&G4Gmo0b5c6WRCSs=$Mr{Sx$ zsWPOb!aDta9To=PBH~K^o+%u}*HfYQCi|%#>-lwaW3+kDT$vd^ZH`s;o-pd?Tdu3- zc6X*$=l$oq$`jph?zy|$>1De;@j4?v`8wS!_3UwAlTYq&-s^Qnj@86vBIi2iZF}yj z_X3T z0sI;1jzfa|DA2wZaf4NGP4sVR{DK#q&GnzBF3R_;5yT<2oEp8rCL8(=*fHJ_n)WBC zcE~N(zDu%$6EIf7HL}6dh=Y3!G0NYcHiI_Ub(^9zozG;KT@m}Q(Kqanm}8ALB)BX{ zUmW&DrC*sHm>d}iG%rf}JjA!=l6xoj!A@ie{xt!Q2ZM#Hl$p1*vDKJ7e7EL- z#mJn6B@}qmvy|Dh^C+=L>b)bgPSF!D^+oUXfn=5>wkXCd^e<#yV_zR5_XE?JPChNx zonNsvXRZfb(qHx;_k8so$7gqbJ`!KbP_ss5xR5{cHD(ZPom?%A4Mr{ zO**%b%WraCgN5kiihg@P+A3*hvYvg-zITK9`T>7@p}l*m-6~~|*k+-KJ_l^Vh^dSCo z_JeI~0QLP={nRaNq8J%FL!?-VB9#$gL!K+idW3lh{El|je zr1x>f2Vs)sw+jR=hwK7Qs}H^HVAKga@N_d68>3wLXmR3X^nQ+kzS zjXP@Q?_+dLbt550^|qWJ)!6y78zJ(-bQO|3H@N$nsMy<6O%*{C=r%^+?YyvReXs~* zd3hQEno=ku8g!Bw2}jCMe2K!YAj%?5gy)Q#UI%Qu zfM83-w@W3?*Rx*mjGlzvYt%?ht8kH6f0U3|s1}=J<*$5S>v4Doh+GG6gl_o~00gqZ z?zM>(f44K%CMVB+ORWdP08#N%nsp_ySdU0RQ!fS92cuizNp+ic0hE9OjBsll2msM^ zRq_WpJ7(1ZAfW{L=XL5rPzFL*QPdxfHxE=tM5jQ76d3&XjwsR2OPUEit_UHHKM zMJO;xNFPArQuBdW!e`Nt;+6#|khGhXTc7cjN0W*Fms>(n)tcEb)%gw~D%usqIITJM z+_*2;)C-m}Sg3Z^tx+_&lKpG1qKh=k89#ihg{}7zWveMxK%2X=L)VxIR z^Q>O-Q=;NCxhFl;HZRFqsyni*RLg(kai~#bReo~qn8UCe7O2iwZE4nlz+r z$_!$9yWD1r^W5$Pp=VDO`0GrdkWk74jVO8P=0(6lgVlDZ8^J|(rEiGsm9s0TjT_p`Co6%7AVCrPfE@Rm8AUKrwRV4yT+bKvKQzawYi&bG2(fgu7qi`XkA=skJ7e(Dvw&OJoy5#x?YhT*)g z+E#0ndq9_stNEhI*m^B9;TG5-1HYp2AUqW@v6<(We8wIMD&~|##9{E1cFIwUO$XdQ zUeX2sC|(kdHqw0WhyWOGH?K&y$IGs=wJr~@Zgp<;>l$SJZP5E3^KBOoMxb&9qM~I$ ziZWr#_63+Mzl{STq_lNjuXxK=S+l)Xlwy?~m12Gz?P7|iC6LTAd2#ofT zGQ@|15W;FeT5w;25X#u=Wr^=!3UskfPKGr}099F9rU_+xENE@=cdVJROqSn<`mLG9 zkY%+Hm#xnZw=}051*TusuCdN=GSk9%L4@;sMeL5?)q_3p>ufY9q^}6^Ul0;JA;3Q+ zIiQewLKoa7#3xuci z2Zt1l3nC?mHZpOc`Tn-lua!XcC#4CQ|J+-{D<$ET^g zM-<;%R)juMrdbvitEr8`#0lIuz2l`$R&T$6{;lsLWR6BRSTDcM=8u5^1_bUtz<&lOH+M)38Jh&zw2cWQ$06FQBV&3h#x@x!3=2gKnGu-sD z{F#kH7@wjlxdmPrXEEDF^|w(3w_-b$P9wg@xkvhOpfQTX(u0|F|QfaO3SDs>>r zpb-DOalloU;%GMs!7SiN;pz?4Pa4q(ozwn1tvVuX9D)4LqBvu4$)~)7orJVJEbsu! zPO?%@ENGy`JUAWTMM_xf(05)6RhQuC&G;U;^s}WdOi;ey3Bokc>u1Bu8bV??r zfEWwjuIRpbE%&M~(V?G5uhjrB*3r#yxUZKonF}!&9ZvlWT-3nQd=Pv6j?U4xZDzKa5+B%Ji>di6U zg%ew0apnw!tViIb49t$$v!+CGJlqKL zFL^76?80>EiAOuc`)Fyy(*3w5VVyMA--a!0U-$yTOAqIesDzXDz<>{@BHFeEV%Oht zD_fkpzwZ{UT$mJkiw%b(5LTkK3(8E&*^QVY~#jhGJ9S_)MViQl5qiY1M_eZDV0 zA{gb#bHX9M$^C`Qn=lI(z4(U0-jv*M9Oqo0R-6+f3?dXqcZr7tOWTsC*O`?^zN4Ihag79P&Lnnlesl*i}8Sf zZ7>wvyiSgU-0&T63UvK(PoeMCC>m3IHGAsvZSS3tsI zE=nOq6uC!SBRq9yB(X`@u3tBFw{F%BRjdwb~iCbJcV0 z`+7tZCBnqUqlTaVSg3O%$*|aLCFj)uo%tYUsZxVdaYib7x_Tf4l(Y@qm368g6{)I` zYUFl&8feO2buQfE&HkH83U0=BRY?=IdLGwFQ^DXC%vJ?1JfQ#uxJ0i7>fbXu&z=IqCQ4(LAK6^x$H6(}zfR ze7Q?D=aJe7YV+;RN!h@!hgB6CJwl&^%6MLh-Uo?#5}ySB(?k&IT#}pz2~nmTV~c>Z zY0X68B#KFo=&@1+7Y!gslBov?pklee|ImQD{2R$_(Spo?y`8TvKq$D&309~V*KL&H z%ZH6huh)l{*5kF!Vo!_8x0p@E2Lfhyl_qg=x_{Y(u>=(ppi(+y+L$zV*+gRka)K!e zYDAv6A+nGLEj!U43VOaViEOA6Nid~!fq%h}ilaOg)2(r_tkUS0wPBAW+}R9E^2Oy~ zRF)q6sciMgS#w_}+H!9EzMNE4>|nZ%{$?u zvOm4jFF`2iBWQi57s0N@`U68V)iu0H9=fJ@;~<{#DCZ z7Dph`Oyp8?6Od`9vc1esdlF2?jzcOeR;m)>(drt8NeSG71q7|p^URaMOp{su7Dsvi zRvvczBvaYIgeoD2tz4Ijk=LK%GvMLZ-x1SA=&)9JezM^1s2g`Z8lw-ew$gv6r=vl@ z_$Y{OO_hI!%)a`W*xtde>H$x(_)g#kW~t|06d?2J*=f^3%{FIIX0@?ctD^~Q^;r-0 z7i{f(^D*Yx8?koj^ov-&S=&L1Ujuu8a=YAz2Ykds0SwSh>^;kVYV!DGVWanH?b#So zDMbj~`*Ja5k~spo$;RqBw*}J!)20G!u%Wc6B&B6@Id^13WWf6>1LtT+5cm9gp2m1W zxZ@+7h4>I+89I4KxKB6(YQSZ7?rz+UG|yV731vBgW|?~Af=+_Sbj>5~^YC}`Es=-+ zYCV_-DBvjdU!*%IpaeC9xXwWLztn^Avz)0|xR{g(QHfB0BnT%{Xo_8iQKj0vyr2@) z{Qvc}j9&r=sKzpPPkHd=qVQqlnJawSQ#X!&rQHqA$;_@v zsFX-HPZV90nnW5Cn#cUpp~l_r=Us<35?qr73&=Cgt1jJu!RI;ZDy$E>TBW_Sw3R*u zsUK?3qn>6i{`Fcx%EA6cM8=S15P%XQ5aLvV+(kq#NA?=EF!813(3hwvha|rdhdEMS z(v~^IWKF;mBL9<*s)Ilgv7W3fyrz!8q$NptaJg4}Rp;<*)mu}KPp8d#qeNlgj+w4S z=d@-Xeuf!bovn0Qq(lBa2i@TQ^!!@a=lzKZe)|uoOcZi*2`b#JToXE`Zs+g~>o-ez zP+X&uh)j;{ff$FH5{1n7)8wTL-?qSA+!YRgMdIL#&lH=IrDbc?r%H;DmpMJVxB04s zZqKW2I3R;9hHz=4NY-E-Aoz?cB-8Yl6KDZ^J=iQbUy$-4`Fi=6$5+xWj@Zx22 z0u=fGC-DNH01AS!3>3tV#GLw+pusf(c#Yn93)l`dktOqTi${~E+NgJ<_-wh&Jw1@i zShmcMrGVS|ou0@K-WA%E@?!PiRP!U6el(z2I({{9IyM`uVHE1~0G56#cAZq<#yBk@ zIgLh+phhc@!PGMxaV#e|6EPS7t-(_QZ07*{aZ`Os>>r9QoJ@35!m$bw7&RW(;-d)F zrM;~b?pYm1V*H%o^8Y{Rg8?WKaE5c1;ROGI2>=*BFahAiN-dqmZzW9h5GymT-UIOtjG`;YW z{yX)w_@sTuH5=yqsAiWhw(Dmm9iE+2=aZ#6@6?_=$N+0B*5uKUMM&WcGG8M6d1m~P zV%BdgF@0a+Jm|`{`T(blD^Yh-^je~x*3&sG&;x%iN*BYz0tRq2VXZfMQ^T9Aug{6j z5ROY~*s42mXM52WP^tD#Fx@6|0+lN5ob_XaM_sXmIbXSCzUb& z1?z;HSwN$wr?$b%$iLfq*D^hh%)QDBe*};Jc2`&J3kgecC_tu&u{x8f9thVf+yb2Y zOM;;*4EtRu*qRvlLkZYV^*f0bAf+WDLMJkf+QBXcG%tO&NrXijIL#FDA+i^r6OiiV zPp)7W2m-jpV*OtB>XP{o>$_8{o$Zls!j1cl;|k*SY|YT`$3vomAeu^KSuc=As*oT_ z9C(N8PI5n1t{xOID6)4pJ$LCty^t?l&Q`aaqHO_3l=fhpkiY{96cVv~JjWzX4?Hz? zAs0^ka^yF8O%k9*;^c$CO z83_T8?19@zG>ZY&4)-%Oga%YOMv#4p09}&@3)Bg zeXiDn#A(*yG|aI@vSBw0na|5wp5}HQ9@RK1iQnhRCi2I_Oj4*#@dBK0iy7ZOLrtoW zBJqT5Ou!KH)sa_PR@(`vT?KCAKpF)?Pu6!8jNhP-HoP zEH{tu5p6sw-yhq3pQ;4=IIc=&7>XZhOMPM#4b*#LXN;^(n#{8#%`$ALZwO~uUg9YJ zh6$(M5GusMM+AC{FARhgL88fLXGf`%N+zWS=e5!>5PK+-A9GH!#=%4WH>t9Q-V-XY zx+8qWf@WM#xg!i=xw#zplxSw4EPV{wcMcn5K(p$j$XDTW_wF`$y`9V{0~?01E>^@* z9)AUe`Bf5t+Hb*9=pHcYm0z(Yu=TXv+nII+Chz(=ek~;^i2`Qg3D1$vdk&PCJUz<_ z$70f9BkU@w$o%1W_AKYTKOD~Kiq=`=4JSYO{xYAl-n z`?4v5h5kc|l)t4$pi)@CkhDEmJtA;W5`{#y0MC$Araa&bMO7IcM07PCQF*}yIFYEF zNj8pQq{`bW#5qOM{emp z`v3{R(0LdPL{*@!j1XK>21jXezuxLtr&iOq|;ju5w^=>?$KLqdy1rq2Q_ymAD0s5 zY3{*%2~@6>h&Z5q1#rS3NLsU(mQ*<wtaaFU@vjNG51njJeFbG z?~3-3p^SX;O2`KuWrJUm*t<80TWnzW&i-^xM7;8sdvJ6F~!DTJYU9MknB|C5dvOv0+7-W?n8!?vo9Z6fGw{JanlePn) zF&mo2EsQb4ug-+!v!Y_GFX5z(B-f%VPTu@inLMA0F360o@9-9e>e=bm!yd_^a7mIl z!3%k)@u$Ibs(c2;_hnr!kiH#YT$+!ZBf;QPTZ_g~jpnItXGZ?gA;PEd^OFm8EmI@3 z&ayyk{2;2OQ6wO?&B_5zK*$a0(U$;{VdhcfK>8R6LlM=y#xW|CT}fp~VpQ@gV5PWT z*nd;}0H=Wfh^@5@5Ze!=T9Qx?t5zrP2BQIrNIIP?8n%JY6cOhDO2tH4tFeXOwvPXp zMd$g@qQR9F#<8|h{w@q|;Sl>h%5-COVzfR8Dhl^K5?zI|^&odr1&a@@F;31nmIB1X zAgUcLEc553_M}uOt<0&qA>Cms%i`~`W#Z%Ctn;~`gKHpt^Wj|XaDzjmm1j zVv_nDmgYUql=Vy0G|gJ~!A#+P&8ZE-zz7Pf=&^6f#6pVu%A$ydL2O`&wEtpRCXoP%teFfl@h6t& zjVXU%MhU!-v0N2qi>5amYvmAQ(HP1D&?LZFYPfdZ zG;8&~^6?bE#%oPqrOub%zsA*S*gg*uhiylEvwazUZ97+5cYA?@LtA(IdA+mgcP8w* zd!V28KHgo~z2{~6Cn)WsuHcnCVP(TJ*YCr4Dhd-sXc;oM?Ke%eHi1feg2X)$Z8GE6 z`jk3;&5|63Vy^TLrnzlk5w3^M#S<>+j%j$O{ng0l=0G{GmAm)FU#=c+Rxrpxfi_*2 zp!%x+lvIpL(`^xv&pSH2nK0LX0Y)A8XrJ=inOGv|F(i0J)e`g_;=iK?OVDG0e^pU+ z)I@Ozpwb==H_-@X95V_&yy6*844-FoSX2I4{9oObK^68LS|aJWV?i@k`bGLfXV#UW z1OANMeqOo0^Q~*+Ta9z9P}%5qeGUJecr=PT1jh`C0KH7zVhp$csbApG&)_wEzkyv{ z##8L~>Ep1&0yfwu27V{vB{tIR;V5LNg~!7bMh}Xi99tysb@q#$fkDJ!ga4bBkO=}? z9ab_n*nc7cz>tzHrU%*6s({SPZnND8m9@rgds`L)H>t`kh7%VNaInX5C2n>!bp!~VMA{`4zs`k`rTi{8epp`g4mScDI&%Z9I45ym)o zDdnE8Vxu z=>R`1W^=GqXn-~&%t3+y9&LI7=h$=rfa&7Lyt%%av5siHsk-C zA5{S%6-FyjYIs>aj!1Ki6nQ2>A?^KDt@GMy`2>$9k${B9{sBfA{d&=}IK2p>{MdMCPhh0Xu zrXPylV|l06kRS|ItKVRVAC4N#QJn!k4E5K1>0heANFoV@0cOz%_Tkd-NNz4wAf~=7 zGP=J8|D|M$J1__JIu?#f@86*5ol+c?AK4f<%V!^npqjh@&mY?UtZ*F?D1qzgMxI>1 zbmCGeca*|9T$XoCfI8Yuq}yjPqnn;c*$`(_fy8Q41%l zxb){EYyPbGua7r}+%qw>x?}voyn!iyI;DS_*sK6fR7vi5&+&Y~0$dODo3j3V1K3cM z+6t}aU_ueLbAPZn!l9&S{L=eqh3tw@_4I_bkrZO>Bu7D&PFWQvLEyh}K>t=5NLT?F zN^6-=l%EPYQ=3FMv<bjZX+GHGPgD`88gXXS7r*{W!UE$Nhl zRcL((1VWs9tmJmAt(V;}@+=C%|NW~b%)o6_=QrKS2CMt(hhJvywwfamua9>ntKZxF z(KEj6(ChAbBc6cMd*Y#r=F)`v+go^wkxfZ*}VO7e@~l zY7Nxt%i;64-R8mkYulT(JADvwlPk9fI%KiBPmQNwsN8-xSOTZ|T+E!pQUBWfbOu~e zjSBrOw*_c9Y%|zm=qjSn<*T7BuVW23r~iDmN`M995~gOS){@=EZssx#t#7MZ z-vd#FKkY*qZ>r!`@|-Z5`H;uIK$xd7hPgWyTD*(y(%r;hW+Dt;D$Oxv*AiP0$E7)8 zTu&o-xb)iLh80-lGtSloktdmv>q4;?00Gfw9Wa3&`|H8DgR@$3e zA=#Z%7mOBZ`^fDSw2+`C;cL)NDKPdpJ&@fcaD)1<`V7PE$?oDk1x8@4kB1=S)d_hX zEUXArQq$^iM2a=bC0A{8!Cnhl4QMU`3HUvmTsw z<}MmGJu_x|brA2{eF)`0tb$FCyBzTv@ZgFL0aUk#Z!M$ZwGuY%TW-rax$ zW|>wX?7Kr3ou}#bQF+ZrBDFXUr3+@u1eKB9m5zc%KGd$j&=V*lWQXtR685A$V8t zmE%F~aJ9W`KPcJWP8JIKpJr5RRC)qfgOUAjLLUzerV1Wg)-Q@FdNCMu921TT1gezX~!-c@_7 zDpg{mmp^2Wu#w=OEB8ZNuRs|s^ozr@^ip=gGK9ivD!HtvP-#Ie#b5@qa zk6fqkRdgFeHExgH5Bjaz6GAK-UC?eZ9K-8eEx_B8gO|OEaT8dyD-Z|<9Z{@iY8 z8y5HOEw{@ge!C34?>M!%XSE41;LXc~AWSiFSaMMWC} zCyPKrKsf#=Jb^|m`j~VKI=+B;l>QL)kHg*;OHdZUe;ama#t7sP&kW|BYj(PNELdHQ zNUhXRqr?W)F!&_mlV{9~pV_V%X#&o~H5G4hZFSyfsXg2qJbc-BS9F zjUGolPaQIzi3Mj0ZK)Vo_3p{omW635W4nbZ7@Y0=!(*5H-mXw)%@bQ&<&y7!IbAcn zkY{6AtKi)!H*~>RSGhTG;`C5qfy^oL*ypj3!lGm<$0qg*jz0Xm53z=A`4^ny+e@EY zV4z;mJov>~3f=C*?dHcn_vhb*WoC9zac%o;jToZAYLBAvDnFYneO#Ta>2Zit4e}HT&S}Pu5k)8@ z*Mrm*NXiqX@^Q{dD*sdw#$8!xU=q~-=828;f#M;pVMhaY2Ep|El{N-1T$exJy+p#$ zV3f|-$v#hiubDTlf80Ck@qSo~O~N`zUt3r1m{b*Nb{3QufcBBpD^}^zPgGs)XG+pG z#yY-o+vxI)x6RTNOm;Xu<-fh|eh}*m#xW}ZstTKL2OiDecGgrCioLt~(9D6lWd^+X z%giW<(?jjJmq=ATx$t%Pu5iveN~=Gg|1S7eH{)(&qb0Q+5%WZa7mmK4>LDYi$YEjk z{)z8bBsl!-NzL02dr!~rEVj2|jeWKz-qCi6Yh@e)NQCD&0Ex}s3g%z&1eL-xT&fg9 zCXrM)W+r`!6tcu6djJyt{|m8-A^coGGX9Pl#<#xZm$Q2vtc3W2|4UJ2t&0hsP;8MU z(-mSJ!RrtMuIijC6eU(pZQmYQ=DuaKcR@zn(AI7(&A|eZS~a^`oqG`YB2+g@HEW?S z78oR`#Y&z(!LE|sWxQh>*N83YJ#UVwMxjta2?pKaUm^%!iG1l=EKmAD$-spv@sCu57z3TK%}3p9!a< zC&~Xb<_w!O?HZ&yum`)W7fbmd_@`Fni7EfkOLMcfhU3X* zl?Di4JQ$te)|f|!bSK*38p_kUFW*Ls0i9}vV;uVyr2Ki?zS$xGmOC996*K&1c#8BIK>XOZqE69nql_ zMzc4Y92C>p?|^5;s(fpJhm)5)qL?%K@Q$#`&Qkp%2?sHP<5WrqVOBE|$uS}!hyIxG z2*Et&ei&4d$oW7iqXK&|)}SoCe;pR1IS69!0}0O&v*vQgieS(c;v{(7^@b1Y+06DW zd=8FcSk*Q1$>ikks{aLwORg6iY64rnfgOhb2U5CdBI8J?26JZ1wq8EvTylbqa#@t8I62ZSru{LIU@) z)ZNjmVm@?RUM}9Xf~$as>c`8+3dQ-Z$;qwv8>Lq{UPXCz&WYmGo6E@9Y7#r^lLiX9 z0t&IWH1VK$asf@ErKb3MWCVA-{4U7>3PBh8fAHB6uHYF7j~BhiQ8!?gIuBX)@WRho z%T4s^B%D)g2{VlcH5T(`uB7Rt!Rda&d+^f?fs6xZb^uHDENn&az||?wXG|yPmxX>q zS-eqdTG*SD993~{$nPMKEpI-+c^fn-cOxv(7d~1*&``j0P4SE;PJg;Z$a4bh1V6AP z>(~R%%9_4FkbfkuC4h_rmGGw#?;i+MPRLqvMHyqL4l+$79ut;EkZ??3qM4&{WekLf z1O0E)5m`M*JuWzmc^JNu8UY{FxgWA}ODs&Yw3^r)w$zoTi>qhm$+Su)y0$e4m*70m zd4su5EFvrCQ_`=zSmvX7vlM(s@6Nxe?;u`J(~CJXr}NdZVXB1H0$bOXt$-)w^Y%u6 zx$evAltl!8VnIO$D&+jSnws_!l3+fL2v{|O^ z{FY_6;WB^t8zDi8HSYM@5XWEzO6uGFIC1$3>ZxSWUx}%vN=nYW9YrKR zRQx9x`Uh~76x-VGjG{p#7zc$lN{)v}sbWJmJZH2ICem}r`HwLE!}H>BhB1gz=|BR5+qP{@ zZ132%ar6E6oS9R#D^LS|+I-zgS6{6{YpkYguXRm7lp>n-O zF_{TPp$NIuW{41&6Yvkw9H4*6j0QeXY<)`KplV;joJ^6BZST9EyR$1EF9>Ep<~Ouv zXk8mk8+*A%Yab4d>DtY^mPOmteN>QUx@;B>3z?R55km>E)Uv;p;AT=CO$+v7;$7K` zIBHP~{2)`bylAxifq~C|9my|=yu#Ro!9;crjRiSO7ASh^U^ z!1`TJ;a7;}ZyaL3fcJJ0@p+;|tB%SFkT{eh2-zp1DMD{iulG_Gw*|z|*yDXbM~461 zW@)Ye6Wf4154;WtAGSL_LGb5{!buPnHpc}dC$3Gpw1kjlZC~;)rc&kh7Y&gz^;Z;X zW}%Cs4>coRGts5ej%L;hUdu%mvF2>*a3NUe}=LeoXBbPg%8(S2u4@Pc~lWk6rmJ z#g^`T${5>vj$)>$XswEQwTSHca(%K*5G#PV>}(UTnu zLebDk14pRi_P$QsNXdYnY6I%pVpT z1;j^?oc$j^hkxFF$iBr*x9>jV9S#4knSfA>)q^n|+2g`zJ~Vdv_2$wJ09Zd92CpKh zGLmodWIJ@pS`obGe@#2qjTuuX_E^ONl$IjnunN$Z5*V4rGnYOBgV+NcR?T32GBAKb z4p_k#w>rMHx1dR|{q$g+Vg|1hme^F0;bjft9KGO8dL|`c7IoJX#~mNOagQMxDxtW6 zrk9sZh|T{MSQ1JZPjgty=&0n=fbkc^Q${&L9{6brJFl1#3n~t0w4bcorG2Yodc5&V z0L5AzYNAL#J)?E~Cp2xYFM3AW1koUnG7s$q6FGmgt|d}yL{@l9`l64pc`$RlI==@g zVT*)O=KfTiM33ZazQ&z_n#vY47ao@}c^_`>RK7#$0h=NpJF0~`mdxX94LlxYuElWO z*t0JPB;qH>IGxRp-oRUk*2tj-+8coMQSH930mlGe9;{UD3*2sh-p}0k5t`w8;yo_^ zB)#1GWXJ#M{jP)cq7!|i13-GtmQva4zU5Hhjp$Oqdy#n|9~c38W|s{0&)!W@BCduO z6pTQUs25klAD|hHFB26PU%$>LNyQB%$ZbIwBeJlCmw%qo~@R=D9bD)Mf&||!ZOY(eb|2J%)`Yo43~tPq++4m%l( z2AR^Av@EZaYn8NCS2dFatnhr$w5{-}`2v8PY;k@P^<4ova(-pa+p1-0m5ueZR(s#N zUTKBNMfa%Ery&RH(|{T)jmCxuMX1s`f4aueClqziQfM0!J7+l$6S9K;ebpj;*qxz} zWIKZ=Y)JWt+ZK9{=2ZB7AgF1V-LqYAR)-YV3X6EHh^ylJ*wtKZtHSUEVXI!&-54$( zD+L0#;)9PkEWWlVEk#1O$Db}uHMG8am*C@55!%DWg&u+nOD0Z1^%bS zv#w@4iu^}C3$}p7M(pbY=HKHx#~T`0JjF67r6B;ywC?o|%PwuL_( z-uH~T8lX~L;F^u!%N2ZJApgC8uHRRBp&U>D=+QBS9-kcBBf>0V7nMxOL$IO`Yt&RR zC(MNZ;$dGle%)-yN0RBEk{e4RqDXZlgbpqJios%x4ka(R?AEf}^iW?D$aaJv-NxKp zLaC*UX8uUU8Pq|1B0~85iDRWlnrqc`Kr`L`WSzj7BqgMahdi~2J+L_fm^&Cdqiz4W z`VFXketZv^CZAFaA~WSt|3#6|YE&SODN6Iig;J)CW$}bNOV*s*e04DPsCajTskV;O zudAM#y~oaRo(9DSZO`V!GD6IR^Z9H#g3vCirawZ7qrfH90gTf9y<{6F-qw=m+?u}l z`dsJpV+C||?K=D<1<6rcWH0^1N6zz|NjeI%fE0R~+pFFjj*7S@e9Z+4E%x$Y6M4=R zHjZQv->!g0+D=_Qf+C7!U^zA?Bbgo<*MyY2E|1NwxDYIk(fy_UBl{c`_F zi(Gc3pZR*fUD+bc*2GM1R?gMN@%=~mE1@;;Hr$FKhqUz5(QY@;L>#k2X-W@|1L$Iu zDYo)oh%DjMiT-zr%9zUoF+^nnlu;ZZGH>BWgvXLrf z(k0E)MXb8xx^6oHMO4wvO=}{DDn_iRg8<}GzWm77FqpD;Hf#8o{?5?LOPRc314m_5SzkI|0w2=egszy9_`sg4(rqlc{Qb{1rg~a~OAnFj#oF zA08#gP6!EmEOY{$b}mz~T*g=^)p~<4y{N^%hNjR@z6RlId3BO6kw5W9FH#g-LYE)9 zTn4!`heYND-=b+I@)$?6=Vo&g&CSxLomUjAu{LjZV875H=b=SML4^rmDhRyU+ap|8 z;rpm7-SCeipRWdzOtEB_l^iZ&u&bH9UgA)n=N^t2WpvOa>cYWZ=f$;1#ElkuyE77<=pGCrFZEAT%v%V{ zN?j-y625339BZ`s=%*=;dQo3b%w-Py0z^EfrS}AdCcTe+S&(&w_v*h&#pm?@GBv9BZwd@aeT$3P`dMl>8(oB~~W`Ix(>n zx{*)U&Tzv2Y4&nIrvsk%65$WGUMu(!ZB+N=@UV_Bmn@YKL9F#@8v$0F0B3|>Ua;y2z#4Y0@0Q;qbMH8orvHsUh49JYSt7$maA{5){Bn0IulTs~e76NI z9+OM{KsS#Yx;`i<7cd$kX2CuRI=aIoV5FHK6kxAR-UpRHC;<1@U6ad#)6Wk`V3~gr zf1rJ?AneclL;aBQtB^n}l@jLRUuCa+W`azMOd96lS{1xT`)MjeH)Rc3&bdA*At7-+ zuZpcgREo&1{E7pS;@FSWK4f6yn!cR35vuvKl3F>f$C7D7o^wTT+|RlPWg=#nZX2_2 zOto@$D1nX4zhA>E{IcgAf*O<9ht_d<80*tXx#Y8@tn$v*z2cgd9BXxH8l7+e7Xw0~ zY*|47Yh$}-#(N_ddm15qW0Mk2yVsXfGvXF{Ev)=VWJ!4~{`Lvg=oGWyh@|3+>L@ve zsFf|FX|E-*F}qvJb7Lcd54FcQ78MDJcFqU=di2YVL3RjDR8c{xg#64WFC(6taFQn&vL}b>i@6Yd?H5@6kxi>f7tM{b;HQ#^@OrIxgN?B@a|X>ykZq z_Z1MfXaP#i$h*2F95LSiykcyW^`fm0xcop0vWTwzU>R|BchCmGAd;(IEE+=KV6nuG%?Ysx&OGNQzZHOsrPO_JiKSHYXZm8$ENcAN zUo}FK_@s!~KM8D@91?cpEfk0tYMy2BbP1%x(1WB!6}q7#fRO|rT)cmh89^PGiKW>; z`XY=0lDBLeZ_)UcQ6!oAdi3A4BvLWc6g?}H)?(z`kK7b(cAJP+%TqDS(}&s^1YX;> zAFk6wh^{;R^RO*&&&px?W~J6HA|;+AVG*QrD&CxdP^J;AEf68TVpDR75D*X6PxAqw z7f-z96C(JL@Q4GpGFb;MyMem0UuwRA4KJ$NJFplj_?gSl$PoWVX7nu(ZGY7zu=Onc zLTs8OfxqH)gHMd;B+^ubpV&%qUr^~Ya{*@2>1KeA5qgmYZ(b9sm|JuhwKczcAPbdC zs11&MJ$Hax?83#W-I5_nnennqgDi(Ff4nM%LGtf>!?~zCTNAH&0P3kO^uS$<&az)? zfOFgA`ZbBtW4%AGrR(I>Lj?n`F1k1}3*O!)m1Jo4YW;EVfSD4P=^|fO9v8}0NH0!b zi5PCEQ1@@B%`rv#&q4O^Qo{0VhUFJRh+Aq)H+|07xiWk4 z5fcZAe47D3c2|HK`o?g{h0ivc8H-Y~_J}v{p1^meEKeTNcj5_opv63|IxM_<`Uoc1 z9OWvl4z>!hNB#@0DbQ;RbX)}?%`rEpOL&9h%X8I{{?=kWy=wEJ+ztJ1^hVKAqCX_3 zh-*Lal|Cd5Lq@fY!)5dfPiT`vlf;7f+r2Hgkdtt2Xg1pN1qHI1$qX0m=P&SEuVw2V zncP+z8@x(~!?(xsjqW}&-JdV#tl4lE_Rp|fEY9hWJnRZI^BEBp3VnP=GSqDY)_SP< zg7ZoHMFwt}bA4-;KXLUgC}ajBTd^gU)|gytFvigytHYs|+l43D{&!@Pb?4h^ z6IuV2ozU+ZTs&a`O0K^0+Qy=3*l44aVsdET3&zVCc4F5kL5;)x|F&oId&@St)G=wS zf2qga)EN3BpvVG>$$~&b4%vw^Ag%xW;UTh=vg!a`A$HcmXUprbW9oI?y+U{&BZCa( z!|OZ7)Yn|j&F=r1f_F9Ds`rr{&(XRvm;g*EpEf}DZ(mI zs0n7)J^Z?}@q)%D{Xlv-Qt%Yi6AL;ST-0@&U!4^aIAbZRHAi+{3c$GD5J|oz^qSq( zQL44I>$3T}oJ)yu2HoGRuZp5@3hL9mhC;D1lIY@<9mV&L^j>LsQ(oUQuq5*&gv{m> zJ>1H=U+EkRR1N^4V$S^fQ)3Rx2;po}~7G`WL%9S8y<=51&ohwWze_N$P8tljK znR7ct1y4W2+FNMr{9N_QINt^R0}VVMwkfIZU-9jK-cNa}-PJtl{Pm1SfYAHf0jBs7#E@5tP1qf|?R41+77lsysPGxN1OLfS%kRIOjA}X$h!;@Ba!<4GDfn zP;rHKpkETEDRjL9CGu3MIgmyQD8I60?U5hW)K9ny-hHt+z&#Ek@K)5RM700xoV>w<|Vqhu=7wz ztVW?fTs;!#z3YdC7i@ZRrc*zhfA? zb?K|s;7{DT1)u^1t7qLpVTbUNuw!7j;1?2)`~ZU)eKAd`Y|{QPMgMRGYAniskNgdO zU=2n6?W*SrTfc0VKZYm=h1L-A*c~H)MR(2S`DICW%oI*d3r!~Ycfd;g|Fjuwb5FH$O>BQtk(T~I_oMc)5{T0+Ve)x zoThu#UB2F`Bt~kkmN!dz3U7rWfP~}mPy9M0B?}9+T}VMFG{JX24I(x(@6QKg6UpB( zVLe5|NasvTC(u0y&*Syh0iwQYvEYP=4#XOkq#xIFx^oUv@!g=jTAl?)wEq3*6BeJ)cKj>H-h- zJXyogG(s?>K{B1j8FAEInY)s)Y%GRJ0y~1D!_q*ap)a02uc$2E_hEEEO4X_@zUdPD zaHrUvOUzr)R4Q#Pq&NbkR;(TTBa283Uq7xJZUBZyc<8aBCdP~Gf zgrk*0NzT@5iU_U#C9;baVe%qHlV^pWuuW_D@xTP3>?hZkzOq;5+`I;ZBRG2odneBR z>cdA{-i&vh{hQQa-9hJ$q+zv{V;q@ii}Xr^oxEOpEE4&6Pjwi42tPOg*3 zrE8BWGbb&PB}!4M7&lR{D5IdUH&HpY0^Hg-GK%tJM+LJ>lNmWwO}6}1g&4(ef87qs zw%?EVm)jv)=aL56w5q%+g8IGHG3qiM(M8Yg5?bgTD_@&5O z^~(smSTUr70stCKDa!oqFCvFF@+pEG%a;Lt@j6w`X!9QLwdPGwGF_Hm@MOv{ks8DleS?_BwLPXgX$LvSnwOqBV%|NE=B_5&-_$35!;o zb#=PqnQ^bj<9zbvWIoNXS`@K*GMuDqs64qNibG{W#~@!xNzgh2?$ZoH zaB}&gEWy!+QFiKj*Iae5(@P+-q zEVYS^L^s_vkCofvo$R*^>g12wM&t1^XhQK}MC9R8$q_OUst&-5Y&th4Sn^F&xWyUdJMFze`mC^DTwL*P6ZWzcF!-cX9(B7FZD}3R&Ckm6zn|f+r=8(`HP~o%3U^WePg^&YSWnq(z;3nv z8;r^my&>jh7`W|-Q)d*H%Q8gDQ^Fp$C7x+Um9B(3X#ckn#Z(FxjI4tt`NwSf20A~g zi72aP+MN65#lr2}>%{f;85=odc@WmoHUSvE#+|vrXU-okkQcPZotoRbTCl5nkoOeN zfI9bhZX;h(gQZr{*V7CdQ*MYzsZfUN<$*MC0Yuo;tX_&`rY21A?G5WjQ+z}xxaim# zl*rs^WOh|P!Hg?;T)Ct$V6pckF&as>zCW>KQh~dqwtBhN%RoUjrV!x|HAh>hYCf0= z!poXXh=}jU96&y7KjZ02ULA*2>N~(qK#&i?$uoiMFVG;2sRKJc1JIg zhLO-Wui0cXSQ#^bIt%w0cDrs87zaP9VfA|x+aZGsSl%5(vXV}xQr zCGlhMYxcCMjw7>0%FuM>ey)TXtYeaPGEIm)t4j5$(aaKz3oO32!IU-&8B?ZLl2U@n z%NXfUZSam4;3nhIX1hkrCp%S%T4cWU+1)D$Qzd9ybjKn-F>yIGH4K@{fTz zH2EU_w(X%gp9`5)k7dxsaFFf{SSrT)7)Xo=I3nXwrv{Bu)nr%%3HfY-V?9qilwxH` zH*;(apyHl}??2MQzgFGON$>Sh%B0B+Qnlt21EZmt%wCLvjoQcNzoqD9CI6v!S_)l+ zyJ)1lVi}_Df%dQ~ETSQM6iKFJtWc!b6qj zpjU6rp`qCDzunEn7C^6b59mk>)^` z4&zVKk4R`c<4!t5OHCF)W18hA5Dk$;hCRJA#sdLBC8wfJgUL;R+B-c&_X(KPh)_0LHZ53}B3&aAJYfJn|3)K$;jJS4*sq{?> z3apn)XL{$kRU3kZAc{w3kNA$=CyZd2U!b8phyXSgcRm-+=1XWQco*DY_N)BDx_xOH zB;{}y=gQ#+RqXK9>~!Aa$gLg4a_W%1h=aC)m{pkK)T1#WV@!R-5(7xf=l)oR|IEUI zmLjsE)p9#cgD94!0Ox`kWBPsVFlcpKOIc)Gi<~S;s+L!)sX)jAUzaR`xr+sAA`O`X zxg?rIPY0IH@XolK8D;ufPW^xjNv_i-0!P9nQ;qQe}MvLY*t+VJW}fwjw1fELF( zP-lH6#jTcq5$9&|TOYd>%W7D|R$P=2*FG;MuyZNEK+!d}>rt_$F*A{uRHUG;GBp90 z_?YFYGhrwyOTl(}mrX_=a^&yH8#<%8v3vOn6dqc-U7h}x&TWKk1%GYGN>X7<^; zQ4i+~ez4Ly?WZ{SZ}GFs2$zg7#tDLwEKZ+`D=A&J$}8HkKMBdr3z}IcfGF_m&A_9d z>&^61*2&UR{A_5oBpP+SEzt(vKPZd?cSu4;rc5xv6B6;qu^TqEYQcrVut*8PniC8l2+eIjrR?AWV}%}Op?Jh#F__Lm!%2|-yK;rT@C=x8*n^NJ^>9`^fV zzo(-D3zIiRd|rAKgerfv@8Bd=69BU1YAJrdSd2n$0yS7QiZMY5*?TM@IRnjB3iWVE zhi(D^{akkjA001)7{=S*?mcY`eW#k0^?>ZkS=&ul)kFoD9gM2~b=XK*1KLi?Ca-x> zd79Y9Bbfyc`%+mTWwD>b^w1>I!uD-aslK2b!T7m*5nokm#rhSBsCWs60L=OF3xn=n z)9&$K^DQ_qhpWgVG)YHGzsu)8v|qPtaQZ@70-^8R`O`N{Onl0^9mzO~-6Pm}%NnaRAf_;xgyL4H{6M2DV}C;|XX7)=nh6^Cxs6sz z`L?bODVgps#QA@WeV(6<#u5Ifbmnd26|p)+&YJWO)cKVKNvre~&p&!$wAlrG1oF}# zF}qDS^wLxj@{gT$F{6SyA`NRi%0kU~X|kUP)NaOmL*mKf)(UGkHF$9;y^-(`MP#!b#nfw) zL{0I3u{%i|ddzMxyk67uM@NKsS}NM5qvN>yQwKe_nWvAp0ug2w)!m(|9CnKD}R4 zsi(mT{ROLSA~z>D0r*qQmF5$zFWb)-$9FC&oXTD$-0KRso0!t;gIxn!a16s2GmpIWJ!AYzShNC!tof`ITQt}S&q{69Wb^eEy zrbC%N`z!@AxZv{`k3};SF77gD!SD=5x=c400PudU_ie>?eh)`nG--N`p^zi=pp80| za3_2UT)D(nR-KjT{u{Fakb6x7g$d32l1Pv^uPoGU>@@|I3qWGfxcq}5O$U{@VD;5< z5WIC%fsp?=I_)C}8xP+qSbt)rI65gfzHnn_u>Yi`(|$t7Q`3ElNvw1g$|v|-VB%0& z$40)yn_V(wW1yTg(619rKY-_w9DxACaYcV-Wp(@3qYnz zN`abk*w7pzDT+xo^AycBF*XGWY6s9Sp3%9rr5Tp(ev{6Cd-4J@zNdn!|DX0?L@!o= zu8_!Eh_lw0Q;N#stU4p8x!Pi^XQ9jbZ7XV@iS3i!iy3;tQ>NLAD$6Nm3+5eA)G@aK zFu{v&{POTHS zIuB~+^>Wg!gVy}GlF!GFs%Uu8{8BgMzI>dygv)y_>R_^t!z^-mEP{u7Dpe0Qy8wW| zjE%ArB5U8QuH9LNg0xqzQ{a+;YJAswDmOT(j+ZV&yKj zvt`v_U`ZCQ^~U6tRkLa`((&1WDU$g#EUtjNdv!RZUAJkoYK|pge|hl$h(HxC6&nN0 z43g7NQKI%#B|C#&?XReX)@hK=skgLbIX-MuRLsB+B~(={0`q4y1us5W9P2C4{(Q^+tiP8~_Id~MV?Au* z;RThr`*vf1NDEzv0NwNry5QlsNtWZS$g{hIb#v3>a~}s}Zq;N>lJW)5akJCl04u%K zV09nml;3hfId?O%HYx^C=an3#r*DntU^!XyneM5qNKi-MsFmAuOmEdprlWPC&k}YN zj6E!&k|f%ra!(89Xgy%t{aaD$kCMaMtY%QhjZOHmxKoyxju~-CsX*rzgAqZEcpT&Z zguhS-6PHo#0={WtjAxqw@TR%_+Nr=+zJkh5oMwt-;);}uxs(`OpcN9AF!~urm9Zsn zBkdai%2tl`R~QnB!A8uxgK869=qLSaA$NR%)=E5#5-XoqxdtYVPFuVU_P^n zK_D4($~kdOM(uvR$~p2AzFVx}3pDj837&5k$8n244BnfW~%O3N)@0;z{NUj!!RQb^PFG1RnOYnastgUUOwy$ z*0OUKZwb%0wgV+#Qhm%)FuiCpYvM`D3zGc*^MsNL0<33r%nc)YU&E}|jJIq%{AszO z()n$m*kly(Lo8IIT;Iul&ib{B%|KD&whKPn*zAvdTo^C$x@00T3*A+ta0I{6 zx`ey?3(Wp>P4xBmDN41S*|k~1mgLixwC@~37d^M2|0!%z5wMGP;?(Mn7xO7#)dd{% zuoXeeN6htMiYAme#9|gxSqUOiPYE6M2-@dQ)1M3q7%*Lxwu|4RXhr%c%o zP$A`3NHU<#P(|*t#hy-PqVjLy+Wy1s3WPDF@8R|X|KaxH)Hu>3pxEbnE%4n@z>`qS&x zY1Y-V)F&YC=}EJ*9VX?nc-@7B%GT2B$+d+RSz86kb+m^EdlUh{p-?5 z!jB#**K^(9|52vzG$R&|sA<{G=HBvb7q1IxvvXf7Ueiv_lP>D_t>%1xH?U%@s-iJ2=AY(#EyIn3Kdzed zr-NO!m;(1Lt?Hi4L2Z4ZGTv{M^}=1CPv%wR9lp7DV~wD*@F742*;)BRWeM~@p0LEG z>i!sdAeSj*f)C^M1dIrpeEvt>92 zn*L1M@xCac$%yitWN2kgP7Nwl*5Tuq*U$1=+u;DC2p}TRgH}^V%-;*SDCh(v!WKeR z%PQy>?AJO|6Q*DS|HCbyKqP^f!2!fCX$S*Nkj7mBmXJ8-@#7|V>x*|h4|x>mC86!i zqypERS{nl@$7k3}*#IAg3}0k$bx}ft@py5SPq$Lr^g0m|H{Glu_cfV4OLo_pM9}bv zV=-%%GCPN}R^n`O}MQbCgH}2|G@)2@f$}()r43S1mDs^x=}u6%g{buUzg-mPg9Z&{s<&KT&-> z5LJuw;_r>IqdMA#$V-!gqO?g>mw}qv+*~7+^ zGz}87r}MWko+lUA8k5`o@{>6;wf^<2u`u4YPjwbu{bfJD=xQr?`gzl!z22ZY$DQ&WLw~r7G$5V)^5I~c zmgsU`EY~YFL)P<^^;EEzt)%{hi&iNS{l$;6nX0}A4Ye;8%Zc+UIz9#^Nl6pFN84J- zl$IEx4Yz|+Ytx$|t?}0_!}=fA{K>a;@0?~S?m>z8r_X&iH#RMq9Xn@k7~97Y85!ql z-jAi*_+Q=^44>J7D5+hS-bEJ3S8O<>aJy~d)3Jw8`h{-<+D2GmwoZm>6D{E8jfl%D z-(b(Trt#tNGKegYA?;ZR!!zMLet@Q;f;sfVU3mF&#{Mw~$2}+djS${-8|EFF@pwxE z-{uCAk3zsqrt!**FVgCzo!)Z3sKaWuIifWG%X34U1ODv1xww4!jdb)ddgrZ_Jn2_3 znL$vHH1bmst!JI9)^*X{p94;%mjWV?qxf{OyqwgRu%mLl@8wRd3RwM5Go0-=KbvuV zJHG=59R%!;P~oF~!3GtR^NmKnyoa;l+_-;tSTMwV_C|;}b=_{(rEW0{geynC)={xj5Q0T&V}@yzUnTbke`0T#m(z1~!xkS>ehYbtOr@ zX7Y~rUMKYXq{#ru1D&b&(g&zBxd%IF@>TT%diI_uUGQ>x~%T$g;FjxulPlTy# z?6_A&ue6u#sN*5n$o4EUu$3cD85W1!i!4Eb^ zTd-<#QYmXdT4zpM7P*1GiBqz`ZRc58e(Ug(h)ZJzv5?gF68dRzX+xl_=z3XYR(SHm z^cKy@>I-Goq;yM|O}!DM64-l^CHj&pj6Npe)u#kxl^}{H?2I2>+G?xmRV-`Tlw<%{ zLo{qWPH8{`p}FQ;+G}QNy#17D`*GP4j)((e?&4=FI@3Y9(Il(|Hl9xkrWL^ zKFH=myfOI400GatLe9;zU1!b>&685jj=;UNW@23_`~+HmS^8EQ8P^bmZCbo~SAe** zdGQsA2<|N~o{;vSEn00{TRE=m^3(sLz)6sdJUQW!2p&Hg{v3#Zrw0N!PQiN_xlw!% zX{4q}+s90AnWN_9=pZX%R_|u4Q|)6g#$`R6i>d<8Qe6%YW*;|Yb?7q&0*W5^js8o8 z9_E{St5R-j3{nW47E~w^XG@ zCfKttb(&Ulu89z9_namWZ2t43w-T4Ah$bu4v}OecaYW1e zdWCaG^lsGQu$mS7c*)U2Sy>4T(zy!mwL}#8z0FjsPXGXejES5hVCf|CqIG-CYtmku z--@bN?KZXqOHef&^wv^rU2!+=qqV^E&$i%ZD(qrRmrZZtXl`+Lfc^xTk?SY&z63W$+}W+Bns! zM@_Q^T3Y%bor@><=~k%-#8f!(_Hc)wtFZXMD2Xr@H+o3i+ekDTI0pTm_yE&Rq(pC+BN2`c0L<%jg>_H^22d1`9y!1_uxQi&rYiQMUJ31826 zMSeB+oSVPnVQK%xYs14Ha4Fs@eIZZb+V4Yd^stL}H`ZqOTyr?^C{e*UQ~x03$z7eb ziNZ`66DdNvNk4KVi1i+r^6~fIsv|+mR3~;{0Wew`Obb2i*Or8IH-}9l!C8YO1qVYU z0oYqyv;^gl10{a_D7CDX&M?Y~SMa}w241HFuxeGjJ~Y+gk1A@I6t2v+{|2`macbLu`@WS6@~)MO=57B?5~wuz;cOuO(i~QXd3LTG zc#tQTQ^pp+sm49(tzETa`Kpy6)E?~^>+2M3u{w!ffmMV*aaFrB3`}4k7>F41hcm)O z`Je<@C`gPd3^_+dUX>9x$jQbOAsBu#1}t1JO|MOr@ytR`OEseu?Ln&;L^UVuSFz>q zZ;kUUJ;`Pnr?KT&8fYMa0=0qQ{S-$dbE{#h?iM1cXhxZ89Q0+H^oucYl-39a<~@OP zT@xt+Ag558Rl`=pQqr-=VX$Z8y_vfUr`_*&guKe8rxuvR)O!v$nU0!} z8~hi!n_6hTN&GxG>ef*Y9nSo5ebhuX6M8!a2xlY6o{Da)Bt;(HE#+Ep6LGc% zJ_VGDTuPf^so2^IGKl1c;N?T3DdFal_RZ8%35n&bgD$rF|79ur8WW#gm{pVqCXw_$128624h4)X8yL|^VPxj@pFB%jG_~q%ELb~&|-a^d7o10wk z!ljiKnESQ;=-$Dzx&_fLBFCOpxTq3G533Ce`!kDbELtf`DMYpxkyPlv{Abuy2VH)nbN4i#^%Xii1%eZS)=$Av#q}O!1o-Q5#`la` z%g3=yOOy2#`cR|#d@-8OvWlEjd8=+oxN{8A(Xlw3dSZ;2tG&70xEyQ(5YB#Gs)||DA&Y4c=NLV-$4}Watvk97TB>5b_eoQl+mDkDTqCvh9r`-800uMFr z;Jk@n<_Sy9lsZp-F3SE;Mn+R4$`gHCvepuuSeEAvautA7GspTy(~zg{at9|2Z%y`| znLs=0##-(a&Dg)#E8aZ=av8~vCvQo;t(QMLyI!i;<;g@6uKzkyqOo~VQNnOe8u?;( zHZ-XuoFgZf0(mf;Pb~4D06@T zo=FehzT|$nxakR%7@dz^b(Op#&s=ej;&xetybh|&${gv9ih5>h+H-1rXzcUz_d%#s z0*%4n-~PK8V`Hzbatuf)j{1Wa5ZKab6mQEZ!!?fZ$v2sIRgn*qAY79wu4+@o1W1h3 z@lQ}{S=)*z3QA%cTS98P?Sl{cWrKeRPyGpVi>VvV4gQ7j0xsuozl(-_y6c(3kYO@T z1s3oNtU36CtZY~qB`uudOeSmziNrDhVZHAdg+UMVRP-1Ys>k>5Z}M+ch1w1EHr zSYvsyK|<9+-`@)9Yw69rbR8RK5muj^CZSUV6qS5deoIJH#0-~FgN=-3%@5$eTDUlX zZXDi&zDE3{4vCBh;n2@52j;>MQS!ZZRh+q5HF%-p{`q6soGlXjN?8u;h1*2`2k5I= zU7_-_MI3zfZc9B>ekr@edY-ZA9@)EOC78q<;=+R>X5}fe6?!%ccZ(C*cs&2R_PWna zY$b?I{mWyi#@Z8xxu<)J6iHnddWO3%2hXpXLoy4m_|3~KVqFc$&vH(qFx5eP;Qv{j zG*VW%NfP)w#UaEUv7i>5!)z*%KR0E{aJ=6f+xHtGA>z`<&V0~(&8jsyt+^apGugRY zz#Pb#7|>tW&&(a*Dql00h1!L#9-tL!fjzDD$b@{w2xy^OmaWV=!>E})L$Mpc=?Li(cjH#Q($EFpsFODZIS5f5IX2 zaO;r0#U|)SXqi}SK6W~8rw!xf(KZXkWe~Y>8HZfIQ2eaKEIYL-6#D`bTZdijGx&eU z3$)O?K(wso45$utvaIaPW}GAIa|UE^$)9tW3~fTV9D7mW6KaeN%zB#!tUlZLG+Ev*%{{;P@>+iUe@tC-bX{MtZeyphZL@J>+qTWd4IA6GZQHgR zo6SvQC-45+_uBVY?pir(oqcA{%>L#Z?7OGoAGc*|K3YeNO7jm2p;PXzf_m0BVs=R~ zgTKmxl6>W9MAiX_cX8oU;vUMrt957g9eu5{1kMY`v}C9)N|ak`hq2C!C{Hr-MFEVj zv6x@8IG5WKdPNbvOS09&O4a6k{5hRby&^z(+MVWvB)Ea z>z0COtFzrn8u#Rz@1-ApzD45EKdt3?2YtB|F}|swIxo-?;>0&{0d3V%%Fc}cHFtjJ zFJ-;`0ft8%J89_93z`5{Nv}H6A%8K|+?M>iG)>vcdz-smEO5A@nJ@1$Em>}4#Kj38 zdt8TRYS7?U-L!?qQSEl8%2(=ZwdgX5%Asu2n(QzFv*LaB@`o}Y?^HIk{xalryO6nm z_V}2~;6l$QfA(Saa_4bbHN!E9Gx}w_pwnb!Gtm8~PM)GNI4^lfc!4l21^5_DMjox? zFQzD%3}t>cu(kGoF{p`k)^ena*I8*l=ko?fRzI{=DzybGDGZ$z#Zc;^9^TC`>l&5S{$zP~$K#1q45O`# zIqcH-$N8t^)%bX)z`TC)e2O1aA{#;xT!329CH$?I*(g;X^SoX1%TiBu9W<22c~%O~ zV_5UlY2#mAHD4I_Wuo%|$AWkX>M(NWY3)yoy=7&I@do=Il;;(Ely@?AaynG)b4-n? zD7*R){FwKZMczJ1^S5uhoGtfGGs@fWW3!BTDa%5UjuBqtx~dE_l_Co(Q}hV}wv zCXO}-#+k>)z@W2+#k&SE4_Yc_V#QiRl*Y>Q9L>Jec%uA2-9tIt96)bpf7E;+77oOj zfpLk=vF>`1gA>`uCHfxz> zTDc5#$JJ|ly2UChXCzi#Hkdf&icr_Zf?Y*5__~Mn^8w_q!wWPsh+?p=-2?7D+p>ly z8vFd^pzFq2Gar17VKq|%T&>LD=8H1P*9=7H3zzDn*v>ow_hF5`Dwpukv6ms~eBL9r zDx5z3Wz_e2c)uDIZKXeaQ2?F2jKy0~#%C44qM1>VPMB6-wRaM13C|sc4%rIsEGg9| z8k(p&)~HVmj10tSYVL5Px;3xRe}#uGANV7?X7G-p3!N8HezHO8(sgNxYbWcO-MZ22 zi@){eOGE2x>LG3+LlpKckBf|J!)J>G+W?%kn@6>&rYlK0Rp;`YE7DWT>!M@UQdY{->!}O`YR7(6CAY2kelFQFgMe_p zGt-O3TuYBoPZNreX8bB|maA9sOaB_-x> zH^n;vPmc$WJC7R@+C>xTr$^j}GAyibA47YXP!jSr?*sO0h;DZp_(|ieG}4S4e~xn6 z4b@D7{@t3T4lL8_PYg}&zZyR^a01o(p69r=3Vim0OA6Q#-)J$ySnwJ%jRcjkifs_O8(V&@2N-LK(1SW zbSxgCH@*JyNjhUJc0p4C{^i%90)HInclAP)*YzU+TUq-ot_w4iTP{V;Beg8VZ$1uV za@n5QoZX2&j};!ypUr83!Rce;a8u5ho3Kb$9_wTZm?b#|2Zw|Ly4q;$kwhv5;Ixa$ zTI<7KLjYeeXac`9Tmu0n(D}d2H}$w?_A9IQD!-1uk%vvD&x>?f9C$h`?flS@Y@Tw8 zBzZ*|)+eQFJd5UdV2`h8k9Vo(lBk&y$>GSmJ8aAxL0AV%UaZmtwOR18@H|R7L5P4! zJV=*4>YQ`Y)=-~xNwOR)uq`McL%Bx_6A~ZWt}bKWIMplg=}Bpq;ofCJG^*{DfosPA zgUg1V@1q8Q{~;YUp}sP>G2rWZ)Y{%^>jF04OuDyTZ?3nxf4n|iH}k!HbLHGn;1s^* zh|b@?zo?Ez1Xz4%q6qnN2gZ3QL8~4B6Dt-n2rlx-RCp{dqJmprRsc4#Y~Ts4Zg9#*$Y8kzqDwisDgqwx=l zqK^fok`07UB7dU`$o(mO4Z7vbI3`%C0aa!zc&Y%lI+UW?rRfj?9Y?dRW~%32f4D6u z_=*n2av%1zr<)kOddFKJ*Z$pKRZG;ChW^N!4|Zk(QbXkXVRHo%ga+5%Ox~ zlZs;s?T+?Tu+%GFUzty10q+fa^u6RVfYB6TLi`;&7w3S7J&K@llAmw)BR{W@)T&A2 zD--yUsG4$)UDfe(NS3F>weWs)omQzC!2cVMT2;ZsuMCHi-F2b&9hRlWxo}6HsZ6swRjB+fwXtyzQc% z6Zv?ZnZwECW8SS;Z_7G+NM~+K8vDGutPM%KX#&# znOk2cy6)5w$}@cD)%na@M!s8&xU!&A5&u)44T@*E|Mc=hM>^wjbsj$Ce@t+z(`(x4 zGYfd{LqsM9EJ?;Lr+ISUA}#O@CjmQ_LZ z3xdXC8!ENdsM8^^45)wH1b&4ZwPLGuikhJfVG51~5;~-;B0S{K$SD+H;dN!yJ5yr% z7VLl5pvsF(ejbG()$ThJt1|dLl>Cd^;I$=18i2lO+bTj^5{Os?K5eokzcCH*9G}$fti`= z+*PTw{XX@08~p=GewGIZ?E7o>Z)K-HeSY0MuFDDegnI*9O^0otrJ-Ge!^>W*QA-=> zYj(|J1_Q70r?;)R@Ac9>i+nQ+DyDZQy?*>c{dCt0l>%%H_bq=g_ya3Ze>puE@O1Hn zh!Ht;B)d3@bkGhS_*YHqK)4|tMHf5f%^JXI84uux!)Xq&?kE##F93`33n`qQ z1gii>+HG{qhAYINf3=*30j_=|1VhXCL6ecl;DmQk+A1O@yYvV%JnXpR@hP}jXDGkv zZBaLQ^h8CeXqrZo9kr|)OPD${L#wFjvBQQ~<$DM40-M@7+dGMxRR9y7)%iR`bM7$A zX5C>tORXzBXtWy|DB>SP)Cvp7LyN50obyKLR}Z26W-ovoFn(PsA8xZ@U_%b*iy|-` zF_1xp6=XapK`kBF06|H>n^*L|U{aLiWB>2p|1uRVIEN2N3@$Ig6RrtA`(%5ky$Za9 zkMCNN-U9zYi3&n-8KX0jQijC2X^pO82Ivf8p~*i#Sb!Dy>L_Lc~?UguKp8)Sw7a9Hr}Ycnvq)Uz0lQNC{}| zCk@{)0H)?9!+{Bfsqi-jy{4gKOz9nNrzO=`cSiMl{p-`)wP%Ll$x(u>O}mC`LtLzO zK?ALgvx=hAe6GqvF?R41pT&)yez!DC7#k%owMl_IM0;NMNK_{%4$*VdLGU*sZFBHj%ml4ps1kZJbjw^Tz57l zfteaF)2#Yd^csV);J^Z#z(c{GAYw@_;0nAvJ|&;3v-C7Y0jYdp*t!?=g>Jh?^VbJ} zK0Uy|!A^G5_)>8ZzdzU^g@Ude0U2t0EjpVGlh7WZyb-)?L+evMv6y?BX{48we|!U* zor4jb_3HnF`;7)gbfbpz=)iP~;kmR^a!htBkJE)5TU#G5>!|1R0K#pNO7;z)DuoO? zO;yu zP%Ia8QsD(Wn85u}S692Z?|7$GMgC=N95nft*68-h3H8V4QdD^A?u_hr2ak$+qsP#? zFB`Vk#_Xc~QPiQs3L>dy5)o5|1NJV!mBTUDBk0#${=4}SIb#Yh` z_-JsIgR1E>#nbWn?cOVl&@A+!^F9~lC;Zj2#YJ4bZ|<8d6}Fj`o%I|?=V08hrGKHU z0kpN*9)Ts%c!G+x_3vN;K-$tXbjYq%)Z@Y)It+j?Gf^dN5!S$6))G{R2oshaBbC_a z$M`uS$sWn)cW(PPo~SG8VQfz~uHA^N4&=Is9I-b)%UU&E-3a)qm(3iMd4fYTn93|vt*@LqunoEGFUXnqGW zZI*2tkh?f8UrT&f6_Bh3V|HrrW*c*|EPfIR>}I%2`h&uh*u>8S@G5jy>aDs-H761$F6h zxjbOTbQcpf$bOgTE5QL6P~g3{6M)>8a~%8rw`%Pcy+wgy4D!w+al>z*7ydq|W}#=< zWro-XADbp6c$zqAiFu~g{mU?iLqwoOU)(0-HAYqV$>V7~z$g)GY!LqXL-dj0ABUvj zHcmh!I{R+Ax)bpAz4(01?xO4U@Er9XwwSX!{t&H0lx0~{XGmg=^ZU(>)gX3s9ouHM z@QEoc=`{8{j$oYn!HejMoE4r#@dNk+J})I}wfimf2ysh{A6sZ0QM)6mvq|GdlRwZPOm(r_6K zpe)W0r&vucb(SxWy^m|_1%mlH-!5-Wslnh#aPNl$NcO_I99cdeF5J#ptw0cNbAlBt zmyf&y%b!)u0U>fbNQmR-DADV0ZV6I#1tsz-_-9CRVMPF@JkCO8+;Wm|zZdkRwSQTr z$Opz&uR3+x3t-eTFr6^#SV1-$TYBh`llEv72dh#^?#&6QT68*xBCx!}@)q&F> zjKHE|kcf-6sf;{Mtr=B{`DOIaFwR_g>bWp)mi64%SGmrnv=1T`>8>e!Q@)_@LTNFs z1?9&$z*1Hfb8^~}AiSC!K?HS1p{Nd$@==@w62%bY+BkbgXKpf0bXu5E0A2a*k z&#fRLAa|0&7+?QJ_brQvPYH0?ZrdQFk^L#=4z8lPH#-i+nm29>3PnFK`5juOH$Vkd z_s=GyKt({;R8ZfJl!ZlvkVZvOO2or3WvEh4YXnA-6_Q1#Qr5OB%fO76{c~81MAE8> z^hqi}I*%uXQAzip-4-~bzZfxk2uWo6MaCJbCb&7S(B-5LaR_3lIT zpe#4igl+!9Cjww*+jQ~EYpvsn=4}q1p~iIRy#|yGZ%&1k1z1?=Wex`S{xP`gLWq9i z*RedMl$2s38FFX|Rw|N^hVl?4kp|I`-4qH4EuKCe%s>BQ8gL>%H^_ym2YWuzj*P{U z({5YwYdH-Z7lBFLi+6#s#?@32_Y?mBQWkTM@h{&kP9hWaK-52pUnK|#M4y!K%%_$W zcVr_)e3QJG1qyTy5fNQuN-BFrv=kHsTl$5#XILEGy3&Qdg!jhMx-JQ@GrjgMBn_XUB z_mgMY6l#@EG86c#&e3^azizW85_&wtTDO{;zcmi2!b@Y`cH1k>IHC1X{?4q4O!t8J zN9PSs6(5zitcxfJGq>UnEks5$uCdW7r9|2>SjDvGN3lF4b= zQ_=v0`tP2iLj@qo&kuqDdq>Xvd!+L$N2ayODqBs!8F6W;u6+*?qw;*S2jLx7mu3$a zqt{;VhMyVi`r#%#Zo4s*^i9#0XnueDqzRAO_g1(eg@pKhfR-yYD2wT2jL|cvY<|Zs z6<3l)U*vMD7SDB;B&+!>uC`#T*q#Di|1 z`9)3hb+EU${*x2srS2Ex4kx3qpSvTdaEPV8ZP1qOgT&3grl}|feJ`^R(hmfyU@0T2 zJLSMuuCf{F6nS`VeZfFnMuQ;SUCs%ozHrO~hXfMU0jjaMJtQ=wYA_l5*bl|BSQBdh z_S!#`u?x78>QgJC5nSRN9Kg;+YZXy`sn@cLwJeJ%9?k*+MCEyRB;E{^SyFo5)znFN zNx6yeSsI6ndrWvvcV<@Eksia4=5Wr^a|~(6OqR`$x2Nyli%#V@dNOlfU=h zFg4k4u5x76e5q>2u-%=J5$<=KW~{Bgz6EfW!5-mo%GAs^T;Srj$K3!>R$98osqjQH z6ZnP}BtT7hAmMhP6I)xkN*jUPuG*0% z>vyWf)L_NP`cpUBXw*@RN@3bO&Rq%3JjsOAoQ_R-P*buLMfktG>t~ukg|hm=1WO?A zT0bWp_Er4e<^jI(L`9sdDfjZnOG6{%8jC=@YH76tBt2;lo=vxpH5H&CFJEJ|fu>#H z>$qc@BC^(UePS#@O06fTo{dqB)R~>uTpG12dw=qJ zR=;-Rr-Ourb!cpbei8i5E_H1#vhSg{ANRiYE!4x*;{O3bU;GM{=m~T!{RO%wsj>k0 ze7S&X*KVFK?@xqft{{toBkf(5`t?|0Sp(G=Dfe-`FRv5*ThVpeT>%_|7E{oMj-df= zDhZU5WeN4-vWn)en6ZqbHl5bl41Ys$Gbv@5 zLia`0IeyZAuKI-gPD%&u*Ad)si>T6{xG66 z=J#eQVmN%Aej?ufEh+Gp?4v%aLSs+B4cQOsC*p+X{iB&TwoMkN*;&=Wjt95$-2(oF0bydYTG(6 z5D^WaAW7<&K&h7a&jKvG#?8AFO>oUGpq_DTM0fmH>n*MyKZtDI33MUcryoS$^-!_hMifRC&7I{h)E6wU!s6sB$0%C0O=q@K{>g4 zEWV)X@VLq#v3Hl~FU+9bMnFL{2_F;!vbDaRMU*41I(pD{8K={AyzoZTuG|j=8%+Hb zYXWCvd`lqW=UZ@J6j2*izzti>_#c)(Gh(;~FUAhppFSv!bHB@S^DpKB`*bK{BAU9mXIr6j( z1Mz*ouWK;qhRE3^dy%ge~ zje-VIE!GW6eg@ho%eFLl+C>|BFdn)Fdl5xB?jW6l&Dx7xUS)UPV=m_m&;3tOydDqo z?~*59BI8&(36)XoYR0ha)$}n=c^XqC=PQ2&g?6y~$?n`ulRb1M>QR ztuNdZGkls`7PQPvr;tOc!c%_sYKsj7Tg>oBz-|0&)}5jv#d3RdG!EYI7Rzdf$oA}I zqz7+&yU>F@vR8bV#bH2a_@O|WV?$FU9O^eaPcg$!XDDAtIeYl+cAZjh*0d@^8JGGy zctomL&j=Gk6mhjYt{ReIML|eCZhi-?y#S3gw0>50FNo;h&9AUvk?u*MLuY)_gi2>K zgF*3HZe+agd}w&2dH-df+4NQ3*C@GH>55cJV_}g~l6bYxbq?LcY{L&C6phf?)50br z4k{W8*EYxRHsme%Q(SI!o)Fk?rTnnh>Ve$TkWh)OH?`{_(4AFvp%6cmuQxz(Q|ql! z^bvtJX@bXaRB>NKBpgJb<*}gqez*C55@tN z^n+Ou)ZF`lrYZJKwFP$MfNHB=jA5czS-VA6)7^b8dW99c zUMk!zqCpA?TXmO(uE%Xk1vc~*q|92|sgJ+T{u)>Q@uQg~1+;iV=_>utWV+h7y!{Oa zE~!N<@-#|;g{nCW-Z zK}3w%N&h2Tnw&kh>|&Xqn!_bv?Rk2v_9vnv0e_{i{Z*z?sd{qCQHNef?CUU49y4_( z*nbL)6=Y#sKbWQkRN(j>X}ZeyaSPmfh#9obVJ`Pd3!%x8QRTu3Ehz47$Wh`Ye4>(r z){C|ol%JviNCq6-`nKKf!m&zzyblqGXSWQern|H7_LKbQ(uLw60}oxgHYqFPvC`?G zXm*x7EUq8$%W?ASl20I^YTP)t=`ufzl!qk$j;QDfJ*(cbb&7hfELd0p?6Fj-lp;a) zexce$+i)g4rclLj!&rsG{vV%-YrbLs#YHHo*Nl%}yVQBlt%#sfLECnO4}BS2m$LEM z#3h8={I)>Q&XeG%g%+-r)B*fURd zvdWaAygLmmTyfjGX<4h)>Z7SuIwrbF9|x5%`@!N*{m05#I7G`+8-4 zL(^dYU7HCezqKgv;i<3sg26ShCE-XZH*Qs+ICyhWu#@6VIZWcA)Vl$cZ*rz(%|EGt zs|ZdZV<03kfkZb13P>c2C#cazuMg#NR?z$_UGAG^)N$`pR|5cB#re!m$AsG6!3nqC z1Uh5W*>@@RC>%C%v!~PTvdfZz#L#D2tj|+bwpS(*)7(=ok#u0brv<2n=g>5fPGwJ^ zw1-aZ@*PjQjo~aAtZd{uA2S(CbZm&9HA=Xt=T+;+>}uFe!go-@u~`)f>7PC}>m|QA z+;p_OHEhgDG@J#u*a+*UJ0n0Ul#h?d7*H8?+V=9=WS5#T4(D*fd(;vcV{40)AOL3? z2s#z_^5=S-d+Nw(6J!B7<-4z#TbX=3izvip7Gf_42Rq75^Ee*fg3I^2Rox#{@HB~L ziO@VMz~W{OI_{R2@^`DYj}K&beFyl}9=9)^arV=gzvQ`286zh$wXT*}R-cnj%In6G z>^dk8L06{?c-<#Jhi~@&Uok>m(FEhHXP5d7P-NC)8B`wkI*`)gTMHGf-jE*G1XqBZ zbCjpYh4cKaBt5EBOqa2KF1l?xI^3^ZGirieseADqsr{#obJD}jxJjbV*``nCG0*Kc)RyIiwzpqr+Z=pCpI4hE;zIdGcq*RPk43bPD3qi{u#8)8; z+r_0ZEy8Kn?_~XpYS3K*PYSOGJuHBRw(?nt;r!iE>}eIH)5be}^oro7EuK`?p}d%k zV-(VNt>Z^m*H%Z_#o?=7lU`W{p!lMTNfq=#X)>G);(z|)h~%}GVg1( zL{NG06XsTzBcp+gTlaix;D@|uH67(98mg4CPN|XP5`Jz}NS#G9G+jA369#CE|GqyZ zxYYN0kXj%3{rbF0;6LB5n0~me#1D~|pm=~1NpDm~DK}HDrxT&r)-DaGXOdSRrbd38 z^2_r0wdC5ae}VB-+G+yGpJ3Hao?gAS?+8?B{#dR55Np&G_JsZ$mhRf-Jl*;1k1z#) z?r0V3FJFl+F%2XX6%OR+rOJ~?Td0UhL){J1QSblf{lMD|us6Te1}!fOV*Z?3`1Mrf z(3nWM&G`d7y1^5H?FevoH?j1e;(lXT;goEG5q&CC zK&&D4A$FMrYDlOeVH9kH@l%WeetnwI4g|A$81!Fn3vO(nIPt9(bsqS>n8^ggr>e7? zSLV#IwY{V_%%aU6<;_XD3@;Zwj69$GcByU!xrstH`3*c(EOMj1K))M5V%&rKig?Mi zJ6um- z~mTbLgSgMh&6d?^rgmw4)xP@>U(DXM+nL z%QC#vrjI&jH7O;K(fgnD4nD2xiopFhXhqP;!Bd9G+ST5Y+NTX|zIFS6bs{LSrd15O z+&rd)+?z1T6waig4~oJ9U2R|ens+?~p2pyxPhsSihE8Wt?E@m5{-3Fm>RZls-VfEe z9+S~NUK_=uVTri`SMHlEL)aDK&x4S&7))dIN?oL3Ugj3EYu)p-3d$sO%!YLEm$&-j44zP$xc9fcM2uv<1-939o1SX# zdRW{qW8xxiLZ9owMsGifxQ{X?plZ|Km)DUewe%vXiu(WULhv(6VP@8=h`4F|1QErO z7~6G5t0i(Ds-Jyb+E}Uh)acBEs)aL5#d0Y=8?u-ca_#Y+64ad ze;Sd%L(?f8)Q2atn&1J{V;}ifHtAA(FD|-L8qx4*(Kjs^S*)@si6C`aYUKoCu}CE8 zb5No175KxN6y(340dztFm9)s3w+U*ZlPuz*Xg29l-pMtz8%ZT~`^FaWaRP?3PC+4NH3w!97kh#=aq2UX|ylH=w~tGir28KvcuOV?ap=4Kx4 zXwseNZsfL*stew2v58q~)Q6Y;jxgpCe6GzI@yQIEvyqRwbD*@f;-Y(t;_&C1nun*{ zMqkwg^wcD)%S7GKE9yMPtfu6M!u8bZ;Y&Yni_CUIwG$t13D&3axHLA; zLiqKn6htm`ARjhuHGS&!Hc*+K3Yb{I}Lb6haEL&5k` zS}`_<3N#^l>7uG5`TUpVFq4z{=*kxO>Co>&^v_S%krWP9It9ta3C*@m|F& z6jf&7-8jOaYm(i4%v>I-`8d45Z|<4lUlwav)Idxs{tgq%1#%a5_Pvw%=X&R^%QB{RS5-_hn%K57_;$F9EBoTntA? zPc4(o_NSAXPt6{y0|=HKl`-K(j z7To&(^usI-;1^ul@;2EU>Iv-O0mo(z09vd1hmMNpZ(BFyD}CgBIP~ouijBU8*X*H? zEfY^J$XOAh9b+79eqJgzif5@vq9N^_tSdG>5hXwVQNEvE?$pw`Gaye_&3t{YrA4}# z#sa_|m)K0wjj69pgMHQKJ$s`)E#|_TnG423Py$Fmq2>j{_30ZJ&#%D5BTy_)(kzCL1)J&WCo`vRFQtTTbvxun z%>dJe_F_sok|E{2tcs!reNA@`SIvVq3P8u6hhROlvy5g0+sAdv*Mn}9De$|8HOVN8y;V zw#SvS4?D>_5FdnNRG+ML->!BBBN4rU6(^C_i9$b zr?@tjWb3n=sbmf{@0;XaLov{&@``(;*+OVX9qm zG3ZlTStp9dwq3t9^3%l{Ks$sGS%ag_FGKZPh96){P=R%FJ#jrfAY-hRGY{M-E)$$n zoLq4o!nDye3H8hZCTV*e`?E|`e)UZ9MbN>2yA5eegYfYme;D8V8vg+@LsBAtSQ*j3 z1{;Z+YwBTsv8igX`fOskUn(+|;|JuP1C44X*XA4Py>ynO66Jc)Dk9G_La}7KRh8CE z!$$X}ti@Nq>Un1bf_$Qk3J|)NF$ezuLKY1?czhKxefcMI(HuX>>;4KW!o8$UvdXEG zM#5+jw1^|6iky$DU5Dq-IsAn1e@*zXzRd8xJlNHvANH3cz(2$k$NGLjl7pq4V-qw- zz5OO6m6?|aKNIDG;tYl`cjuv-Hz+Knb-*$j+3B6i*bIr~UKCd_^nyw;8QZR_U#s$^ zN!6c}IEd@$uFmwkB~hVv6T1v~E3)#Tl((c0Hp04KdqGO{0sE#W%nvp@AIidr8hMlVqBQn zH|Zm^f()-c*{iRPT}g@}bwMmoFO-9=94F_m4K{GQweF4b%_vBsAu>L)TXIqOizx{-SW`V@d3epm6mm=+)IIKT~ z>vf7%+ET4NSL35p$=!99{9|aOz!1>Uz1`qQ>1lUJ7Gi;3Qru5XQeqvwfIRj96+_;> zt%{iA$Gsb&L<(O?GB)WU;^_`Aj!W~+BeL%2Cbmxn=@;S!Mc^p~zY1~o_`fjzaUZxP zS3uRr#3;FXy-m1C^Ya7r=(4NVA|F5Dm3Tx+0T303B@^M4^PvmdM&sJ%fnr4zON<0>o& zy&g%AYV&*hEBAC}j8N2fQ?Fk20)|lSx9`+dj_ermqm5zLsSWKe9XW%(x` z2P6L~ltwD>1P!AnteBafO^iN{{8STxHz=*-J zt-%cg*QE6o${+f z@wa0XQ;!V6C`Iy8V+a(x9DsGNu71Je`qGJUG~c-NxrGTii6|}Cfq{k=bB{wzB10-7 zp_+Ghm|CRt+h};ikV6JXIA&>3CMNXwr`|uaH(*IZgJSUoCXFL*lC|M_#N|lj?@n7I z)ClA-MD8kVe!M?@_ukB1>Q}H`G(=d#TF!0SXu{Vb4*Eg%A>-xbh87OCwC6uTew5UA zN7W^bR)pt9U}B;b?!zZiMB52T=n!_s4@j8^kf&!MQXUl+AK@vH{k|@QgHG)C7qG+I zl)>9XOB-Cx+>PN21~nBUnVUl=n{7jPzRxTn7Y}E_-bhO-NIQUsQ4oymvj*Oi zxV#gshk3p=IB}zeUmllWg=yb9%Ulv*aXOMWEVh068dggdT&MDrnnv{|la$3ajEfVe z2)}&)+i3^Y6;&(3#I{UAD*HM2SyAfs2=y5GFW4sFKoR`hUpydI!8Kyss7KlZ5~_r< zEUCnGJVLF6U#J@Kz3;Si~4l7t2};M;lNBuSQNjyq{iU7=)m5bGpZ z)#fYJvY*41`r>It`kjs`mm7|_-unrIo>lp?ZR2M3m_!~b9CVE4?!*gSRD3+=by`O? z!JETThJTv8)%7=TV3WZ^v1>QU*225SH;=Bb?~gY1S@Um%-Dd|oV6>-QjalWXCw*L$ z9bpJCFaE&BZ4pWc5>#5h@c=sKq`+vk_k z{%FY(i`?H+M?f9dtHit92iq1LXE<$keQnDet?6o7qwSe01VH{f_5yPetzv!=!^d5m ze#nydQOtQYyI9a>Kna>;z30WMaPGseRKiYH-=`G~oUlV0HxCOl8jBSlFUSkbz~r<~ z`e2p$PtJtovxKH50`b+Ij3KEM=2tpJ>yS1%y)1!&U}BYIp-xI~TkNKWc~0(-UAn*S zx>Tc^g!+mMVXAzhCtUPj=YlK=6pZ&T>3nH3wM9PMSHE9(wMI9P)scs4s($VywU}ee zB0c@Nq#iZOwz_))r=*kvPAk;TV$DfZlE6IMOedbTe^|%(GJ(Eib9ccXErGFwj1F2+;751Z__ ztHDgD5rt-$qcl*@4={*CzB5m7Q%oSE05=qC-85*SmKQh}nb-?6G0`;TgpdX3NB-OF zrJMy;NjHDhp-l*}3q`e7^$a(JDJk1|5~EXK?Pi#k7`mgw3ZCl7-PicLAOCZ^{gQjR zdx`GHU3Yy!DxVNv&v&K)vj-P~6DfmB4cDhC>S@h#UVyHeu?&cD1N!%i-qs%v!>b%8 zh%&<7`><~hS1R?FE8b0&%>c-OF_{oNSp4r1)rj0$PK`$miawJuR#)*hc9hwnkz4Zthynv}Zd#KvNS zyFCVh1DM#}U4`DSi_eq$FD26pif1o!&LUp$u+t6^nS;nN+bE3D%2*!2fm1m+SylR@ za!UoHaxH>zU-kgUA1_&Bv7TZVhmqBDX!AL%Im#!&GKAuLUX1>(qawHTGJ16E#YoT7 zKxlp*ik0Uw6y0Efd9+41&PiG%yHY!ksEvWAhn#m*uV zEZX(a@4y9;jlftx>ACLMkjx=vvO=aJw3_C)J(&EU(|RWpMU5>L^^alj_~nlBk=)gE`mVYA0T6u5hMX>qPxU65J9Zg&WJ((VL~D7BG)*P z8`-VJvlMZZ6e>v`X@wye0oVy7iD)cC5#1w}K>kLaE-ujovw=zuLPjOje*(i}Euz#& zr8)%)3=b%<9W~t%$hYwE!UGw80_{UV0Y&>t0OfZ0NAU)m+dhu75fA*8r?wGy=k}rl z<0f}#GQ7szq?3wGK6dK91jXMb&o7dqD2c8h2`x=U##or(MplR?jty z__=4BdY-`IJr9J{`qCyl@P={OApa+H9nneyG;5bVV*1uCRZj>KOlxJ+WWMu$*I2N zYLgM-e`fLH4ADRCg0A!>WQ2^R-6edg>Ix*B+ydx6+`blazaB2`ok(=Wn0b5gx`y~# zo=gOn^COF-DVdv7fhysL249IQN?#L`K#l)|t1T;$r+-j*Qz9LXP(T9BV+T>f|0lE= z{(K&w(4v7tn;{(W-~0~o7R52U9ps#S@?cA&UEc*?RwlMz8VW{I?M|jSKfcQ`uzYTM z3Rd+1yz!VE(ksXBPCI#h-KuuF`llzW^;;7ht7JNvShM?@_cWgz!;s_*^&qz|Rn2@Q z)VYpkkxQ)T_PP}YU2W5mDjc@>pv!Vd6y zb1XM_v9z(Da}F8+SQ6`O#E&l`O8CC#evH-AaeHm9LPm39CN{;DX|D zT(zt8B-*2F61Ro>RMaS08Ue~fwi_Sce~52yJIzx+$AiwPYE&i9+WSpT(&P_I&f8`k z4%C`3Y;Co+1?~{hSGjL&f=_~KZFsvjeT*;vjnIkKd`B0Jky=+>8~N7c3wb;dX>LfX zBIh0U@TsTx9X~2HhX%LN>4__P&g4FEfY;WADFlhEXB4Bllbz0^y8idTKat15Mz+bQ z7TG?p!b;KeM1qlFyhTOChcmI2cYcXW3FYUuDmjIw8*7JTklum#4J>+Lm0CuLVVW;a zXA1k|1Jx>_X7<{LY1%@r`X9f(f<@@3kl6+e;VGGAQWi`2t7jl5#O{Vf(aNeLsc@Ru zHamjU5Bz(*Xw48Z1x@{c*Lh&%HephW85rb4;(e(+-y+NPmirkYt7NNYX-i|HPx#CB zp>rUfMMSioH7H`TLPD%EzX=ao=8Y-0)vK&#GZ1<1% z!3sE=3UBkQ5|(lRE%cMK)eSO7TX5_9Zxdjg?Ope&3wf@_cEM8w{sguT%VHlDN|S;~ zmP<|vau87-DZgP%=PRRX&rD3dQZU{V{IxwN^gQhQ?5c@Z;3>xn`-lyl8u)@o#2L9z z6%)8gIAA=b0j;TcS7E?DMgxOS1iXA8JNQcel9YXa%Dg*p3E&!C>|a6UE?VDVrm^L3 ziEI*z@c8xvwX3^w2QJ^HumJZ=pX$QS)P}6GWoLIl@w$+u2K7IWa-a_5-3uK4VpwXq z;#Ww$-=oN~AETtkL^s}07O0deEI)-*>=0%@;i$XMQKWJ>pa>KG`5*YJQAV+vNgTum z+GNeby!fXi5AHmd!vpn*bQw7n38r2hgN`od{L-H#*W6;nB=76G*+rN=99GgxurGXR zk2*A)QJPGykcyxjjrt|jv!iz*UDFk(oJ*xX&Ec!Iz2j(pwuWJL4{g|d;(5CBx^rq1 zw$=5vDT!%5*LG7Ik@%R44g%9J%J@0xLe%rga?Z>pNkpgZ6RW!2!SK2rahiX7^yIs%FT}8dG~O-qd}#Z*O;By^i_l++MF3&QGRlNvhMcPtP3Fj2#gRpT>998OSv-lH}PN z7X?s0XWxs-H-T)p9Y-Y-FYz8xzrq>B?y?U6yVZ%PY@gLU>EPQx-cf6xNXFfDjxW$L zaqd{GKK5>}bQ&Og6z#dfIm0XPEbWo1!oV&;%}%@JM&d(qx!nE_Q{Na}SKGDQv@sj2 zL1Wu!8r#~jZQHhOr?G9@X5+?A8lU~7=WE}886#_rvDZC$T@yDyp(0*Jv6gxl`*LmRh2p&AnG&<0*CWlv>7tMCHYDGM;*q~Z}&E;h63Xo4``Q2xq` zd8QvnRq-1Un9zSv_Ij>i1vopkbiBzhsr5@r`D|RdCjGW`QfLOFpgn(h0BcY0-#P3h zY>9v7ZGs7s11v)Zo;I+A7CAEc@rsrz1!^?_bhyHC_r zKqUr7k#aIaq<7?hnvn!l{@EvtBdz8|}L8~d%eQzVJ z>K9Cj?qhLkm8`!gqaHJL(dntIbGe5bHLj!kSqa!TA|W_SAcy~Usjj|}PE+r7ot25# z5937&jy-Vv;FqIk8-E7B^UMFU{N1G6Eh192GS4@wj+iJ>gGP$YA#c&4Mg(L^=`l@v z#FYEbKc!O(twCNOH#)r&Qr=y}ht?{FI2t)aIY5f2jseLn8Djz&$UK)J(YbXfL-T?F zG0kY|p!#g`dKC;M<3CrZtt@W{{InF{r)e+F1|vA~)8J`0YKhfV-0gfdNc^anH5;g} z|GHYiY((pFQodk$$T<>}b9?xqmqf8e8o6~QQ!m;+&2D~^KiBx$^!_C&uyM|suq@ZT z3$5?MYKMqnIM#8z&^VO;qvgg@hey!l8G1Ww7D3dsgieu_8Bx9#_96}zkEo;pC24uu zEk?sV&HL3uhJsJ3^#JOukL#al^mkYORqshrUch&NB{tn;HJTz_eI70>WOAMaNmg-ji5L-Pl2vqCjChhXm}^ zrc2CSIv%vQzuYKgM^M>lWJJy01i#oQw$p2^nEJ7|viGV?gLQUd;aX9?Y2!5G)CyL?ur;o38Q}d>*}yVKPVZioo7M?_t|U^(O;(}09K$z1 z|Ab96LLwhERYVjU)&Q|?U!m`{4t09PX1v4gQt z4IOX~xscgp~wpEP;lxk4Jw>3ua5SNyr6NF005Fl))7Q zqX3MUNV)V8G%msf^r!#B^Go?5?1v+|Qb03U+BMlVq`|=7R%b?kzAv;lG@HnIdZYYY zOGUb3n($(%T5H+%c3AGI?=qXR!X2nX{^cElhU);Jh0#T~6nZP@Va2z`qV>2*uQd|) zF)8RKK955CI*(zBiOKeb4?~bwxxx0zvHd-iG5Rqk@-J#C&qqcB0RozPKj8r zKOji7;I>=JIG(2Ih(GJ zc8uEm-0+w$(+mk_gur`arCq{x)dvLoKsj|;^%A>h82|oOs*{;~BXfhp6rcc4u7CoZ zMfPfLx<>GVcvNkAK@+cZFh*6QS7NpmuIH9R4rU^ep2aoWB8V8P=M}Dy6_)$-qmbJ; zD%VjjUpcmZ1r&61ofno#nG5DNWvN~H4h_L|6WTKz zexkrN`>Ii31ty7ksaF1gl>B0m8YCR#%+HZFlB~9QP!g*DS`+z@BkCrUNXmh@fFD_! zkafCm)kn2`=n;O7IgRykrn}*`4s-gfE@)`EjaqVqAuew;7>YR$iRfEpDQIlA6c?hM zT|DPUMcVpE)p<5imC2k;XfnF{KV-uPuzlQG!8JW_yC}>tZbRI&>TQzT)Gop#ITN26 zXd^OqUCmBRX0JiG_c#8Q<7Al5=+#o(PJrlM#(ix^&3pT_t1IDn(9*I5%54^!-H^3X z%lSdme52#yns#M+Zm4{Mk%4#dR3HO?YmN_B+%0zuQi513Bc?dUDi!;NJxZ6Yw4_E# z(eI>E=aOF1xL4QnXCh(M@X{VFs5g^$?@@-h~!xDOHC zgu-+?8e2tM=zp63YK+5;8yE;zfR4Dv8LK&j3Z(8AU6C~GY!T;VIN2$S7L#5gJyNqB zKC`Y_Wc}WGr!(cJ{olU-$*CtekiEkkaWJX-ix#+@drHtwsj+AAej)yVu`gR83b7*M zpm6%a9LoKF&;8RBLe-t$H3{q;z??y-E^5ckOaKBE=16s^&2t+8*i&<*Tl33c zjGCecD>s^^_T{$0Dh)?KbQCsxMLvTpZ~gI;y;UC)eK=mW6RXm`PfEQVlAfY=&!vyD zRp-MfKEPPQ-Bi+=a@#`EXn;FCl7Vjej|^qNNw8`K1@t!Oa}0MQ4x7IJY5hci~ItJ*#sk@i~*y8lv)ZCL)zC)piVng>b!KY+9$|6VMmBcAG{PWZv%e739;XpM? z#Z+eTOd?sX`Y&cO@(6bIP&-#?cHiUphsr%A@oIxx*KORyM9qd6qMgb@$wzil0oZ~b z8p_$*GFsph%+6N0G!W%0u;0ZO&{da*0t=r;S1|(-(ckx}04B@@c27ii8 zHp!i1XqQPI%3j|vf|jSpdLxyn_!VZ8^(j*KgV8bas3=7+?UZVh*XZDD^ZqBdQ`Zx& zO<11(FSlEpg#_K%IA6e@+rs4jpk%f^V zglkpupj%#qZHBK>W56#_VYMx$_hqA&kB_FxA&)YfiEu0K*4O&$2+MK`V?35e^tJxu zFvo!$=3LvRhSg$2pQnME*o<0cT4RH)s`T1K3u#EP0~)+$kk!B`p?S1?5ho?*`C#M1 z3!N~F1c+g&jCVKf5^%mf=Ct|oT5=lLw+0*WlppL|Y}kdL7>Z#dt0NFw6H5zU2}NhQ z<_$IQS1VJR5Y0e$oDF=dE8FqcE|@?541BAZH`Lx6Gc3yqH1Aw?3h`>h48$4^CKnA= zb*G|oHu;=q66j3vR$6`W1IHcd z%yBJL=Og{U`U{H*=(e-LN8pd7GrwZ`s3ZTqIkZ4g`zifXNmumozN+hlew-;dYLQP0 z(v#|Wc=ubWe4^9Sic4myf3v~72ly0r7cH}=?uF;8!XY2*tj`~>zo^Y&-4+ag(&|c3 z;XrIFEqxySJi^$iK8ZI{8vfxYIAf$9!Vci_gY5WeOo+0EeH^k6mRIIV=0Whf+8X^B z+yBgHvPRf^af57GJ;-A9dXzEuMEY;Qj5YIty<>fJA@PUxPD&@9<@am#`$s|^?u+dk z>lV+IXW*>^O?BTi@@$vy5?SV1O;1xl=vaOWR8vlE+@naxUe9n^8k(+K=DG_;x3u=P zwPRd4CqV3V-|{XpKcV1U>9oR90ZG<2v}p@g`O-VKjbVs3h-*ksYm+cV#Wz?+Go^-t zy6w^};}Z~E$`n=8Q~o1V$MAm+)zo-wdx^gfju(z6h3y0L^NV#};6V%CTzV~L4NU9Q zG@Fj>?I)pIVUC8&V*K!aqLTr;)Orly^7qV;APhRDW%!@bC*Rnxt-Bpx&fyolv3!v} zJ(ZEMp7WD6q>2w$T!c@^&V9bha6U7Z7$N35VuS1!v2?j_avVHHZ}ebVCu9oORCewI z@sEtSy<4|8u|-u*Q`y1~Y+iruE`g6S@u=*OYi@Q!0tCSQnE)mQNruDiHNRNu1qV)s zhExy95LtcJ-A>Le3zv`YOUYJ2+9R-GY|~AKga6y#%M4`R|D5{>{G}`x^v-Y~47OzM!;_RCQY|oX#(qE^ zOL^rVqEMCGO6{ea-1$F)i%ZO}jwd;sL9mWI2AtYePfuI8CmXa{98IgWRNR914N0Xn zD2d~fRxH1DYV5mup)sCIr%L`b8vhJ>Nz+UI{lzVKa6AgVPnu-CDylG)i-L$zBHc>iS5du9w&#DzP+2lzBO z@SlMP;+-BXnHp)gR=zE(*s4EbGC+*fr4At4!)w{E6s5B6nIl&D-#Vxm#OrP$LxNXY zd|;dB-b!PWn$MW%EsI$3S)7OYq3AOf*E&Fj# zqLaA*mO`FIU4RQ!KaU~ip$Z9V?vZgP3a1O^i>Mrd6DJ4!6DOD$77XVdT@tCUT=3@Q zQTFb`40blk)Orf!mV`FP`bn1b`G(dek5^OhPkFC&e+wE;~9U3}?+E97Mob31`leYP$W`5J)Z}t0%`Rk9@cbLgrowdkl z)Wa0+Chs#+Avh&E5RS#spE$>&`3n>c1c>Gli3dSP1xI6sBzQjy&=aE$n|v)^9i;TZ z9RFuUOF8tZ$Otgb1dhL7f?It>h(?mH=N|`Fhu}^ibC~W2Yfb%>GDhrC>tNAuICx}i z9JoqXp%5GZ$=iu!%eCq;=AMth$)Pm0^5T{wlA?<{!vL5R6miTFzS*5nTRQng6_Syc zt=baJor;5bt~QoIxPy&ATol#-{d0p4WlQ!nw44UKV% z&hvj-rQejc760ov?#pv-$*pbT@?uN+$lc-AmK$j0(eg1j26SJM6j!s}eHS0XM$I2URgl)xnebgRBu#vN|w&D z%Jzifj_4CvWKiUKlD5659~4g$3tJq9MIVnzVv5yBRL+8&W|uOu#uC|Z>^RMx!mGCZ z;G82twANi7x@6s3*Ix{iDI;aBuTcJ2+y7!E0l8Mug9h>5`D%UKyn@geH8~#yVbhHK z=Ij!!6#(tYo`7UHi6>pqlr2w857?$|@pO&JvdyCz6PM;{vzHKX9b*iQgo-dNLP%Ls zQuMuIpxKtwl!~-`@&Vm1_-8*k6$8K*xaLEOv9(!Gg*AXcMP~8o7K`Kt{;K6uT;5OZ zOt1po=$v| zHjZDO=(vxqP|ej5@vCft)mFFKs9SCV8pFt~Cp~j{Gobrn5aH=it?;E6{qLh~XG}kv zIhc+;ccq^*FurT~qHGtWL*VZQ4gU%W3ZDoiqIDKT+-oao=Zm=zAKL2!U%h*VXdMGv(a(`jlsgi=!lu`l&Q@UPIH@{Ix_#-$I zJ{!>vQwTV}`}{Ed%+g-umH#fc3A6y!I+ehqeNq7Bkqa(~Z)4s>Hj-j*wD-XiA59?eJYu_8Q z@vbW)Egd>*9ETjKIK)&JD=s(s+`sz{KfVTG)bwZulp(ywK#*ZO2R3|im@g@3?$O7` zFpt2?4x(_QzI?|6Ku0_0e_+#fAx@GHKJX_{k_)s|5)|2Q#iT{fgz?@KLi2d>Cl}SuXU)$elO-mlquW!q4*oMs(MB+D< za}!}z`EYrH(fE-5{MD1|ruTD^rzJI9XThhZtliQNQd;Y!#cDO>k&!Q_2>4J)A7a3w z!Io>0k)Ng)xCK8ybEJsu4vz&2H1eTFRVG(CF{p1 zl1xIQp3)8MNd^DR(KUq_C?z$dOD{S5J1Z5i|BY$=Rlo`$0B{2fpI2 z1*`u0F`!g&v-eh;OGy+j76ghpH_taGu;odw|B=}prWEy~<`k+swqW^(3CGIpa(6eo z42S;4>(tx9sQCve!qqHb5oRze>v28h4)!w*RYW$fiN9(x!66R;0hdT$07MAG)_1fX zulTdPG;19bP)Ho@Uy%Hyr22>zBoW!N1&AHfJ&;bdbKOov_zp5-*}hkHIGB`QMUSKD ze^ST}i~Z>4&kCrPhZwH^`Iemjdwi!iBl~&%1QJ@<_Vxrk-L3~`Z8;&^&ZGFz>Ny(tDwj1ZksiFDzlz5@Lf zUAaYiOT_VZ&C_G-hLu1ISKiYS$=f9*{~KN?YBrnO$1ky+TR+CYJQTNmInKl;RslOh zOpEfq<`s8kg$)Zw1#O9Vg=Y$hB=*tdY7R$VB>7mBC>VHzW>3I=Y4?n4qHx2qt+x9% zq;dlg^6-<0uYT!RuM?x1i75~zNDP?z6B8H&0eW55=fjhzKX-ZG(&5{C=MchXq(>Ws zFmc01lmuNypc#g+9IHJS4Q8s}Q>LVYkP8)R)KXwJt@cZ0(xk2Q%Ei^K!JXDHoi-}u z51L0H2z*;pQOBeln6YJ(ghfV6l`o*63-4dJ0#(z85wg}{k9y+`6tK=4a_LezL#<25 zwY04KOp5eTJV?Troqs}v+}tU`-)m|lwUc~18G5jd%2?A@y>5vbC%4KT(jT7A-ajV} znc=W%DxY6a;V{~&4xi%&?&ECExk!|rWs78cjWbkl$m6mZG0PBE2ue|j&tUwJypYR*VIVy z>ya3W(WKQJ$t{4rlo&uWP0ypCq(f3-8O$eim~AF6^G22UduD<d(1di- zP$fW$Ncs7N+CLj~7S5RNm7IHQ==zS(u1#%rpAda3cdoYa&dR&7ptBJVI=v#0-K(}t z`DwSgg6@diSk?TP(TX4-!g1K-U>w*Lv1suvj{oihGuAcx2*qb+=I1)lC&w@&X&V2L z?d^062~y_HkF!(1d7@DRNkW5R(oZ#c)!-!U5tA0~51{Hh)mN_5-2>v);4p9ivj%*l zE-Ws7YBO>~jYx<(l7Y?>9CIiEfJ7yUGoqFV__D)~IiFy0bbjsnQ|0BEw1gI?(rg;* z2n{k0A#65OkO)-rPe_4t7fCG5HP&9#u(?_aV~(A+lWWPZvM>@xJKn5TPc|@mMg!;< z$@e*l49S&7=Y-OaW^1?ovn1OW=7e^}QuFrYpwP&Vl@Y=~VK~g$4DF4F46UA<%UU>V zI$njy<;y;PAMxLJ#ox?q<&481X(<)9x%l~^%g3?}&IF=9qWSntfdod<+1v7=NtzK< z5tKlVv8u`#plssPNj}Z#b++-qFutzu1dRfmf>m#e6xY7HbTx;n8IR9LZd!hGY)a8u z&sfbGeR{I#mA3H4{EDE{Cp1IV5SvOG0c2@)MP23#f2^(8Embp#2C4S>>vXvKUULXF z#^s=z`BwtnxYiN7eBat`3IqIv&i+Ut$vzU)ccBr__%F|3JvrPO3LQn+6(x0u4k?Q^H731Ps$k)J3p#kGy zd=MBMJyXL_Dkv2{nnR0C|C3r~gVE>Yo_3=s#8}KvIJGbpC8z+eA_4Z`{Tk1bOI@4f z#xlR{CL3zHarISjhY2X;_e!)Ln2lAt_vbBT$ zuuukoeBkwJM#dD%0{{N|$Wbiy<-3mRd-62RW)l+>RS0#E>5=frglm4I9WmGA>_}=T zSbF-+oBcKDeydd1^57E9>j<=c@y9u{m68ofdysL9oB8tQ^P&I~r^h1bL6i1rfvrFq zK17D(=2bK`46OBWdqTqE-ZzF4jv9VMh3&oGtq=rckJ+MYx0&=s4wouunxD6qNr+^* z#hZV8V9HM#POvf&O0Lkl7Su{TdBx(Al#8~bIspT<`QRer;Z!76gX6Or`L0l=e-W8P zGDb;2G5+y()cD854uuAP&btc?|RAZAj ziWj{qnDS=|_>>^ZB^ui(FgDD9t(g{H1Q#l}%oMHjIP$zLh1L#UN2G zw%-X{tK#+2;J$dK`6KK3jQ3fdchGKi{Uz6D#bl%~M#=7Zn8(r9%addFVzF{Hs4)p| zZ|nU0oMzJD*Y$dB(xm1y*qcKO$fLgIY36O#&_zJoVT{o=d!McGR3! zRe!05YTM@^CMRiNm;a@2(I=eAYqN9you+Nc>D}NRrKV&_jjsz^@D2uF$-Wi&FVv?E z=@el9%LJMW?J099*4^_kN7-da8`LA3p*HOp*vbww3=&D(r%1;oe<-Ri&cz{qNbpwa zY?(xcsZtFjyY5m5Rsy3<&@-hSss}R3SC)r&y5-4PsE|sWOo!T2R?96|<=LteX*3cU~W z1)D}NA5_!7>TAHu6rhTzn6r;9snsfcytKr8((d1v>tgTc*=NCdXvm0Q5`- z9maA@1wWG+%oQsZTDNdev&gz!s$j?c6Kjzj87-VgWFsiIm>1y$VV&3s6e+};8!%~o zBs~Fv;Q!~SQql*RFtNfY_<{CSce#rVx=Z)AT=`VfScEq&@Y`fIy`ouvD+ikrkX|54 zpLmtB-DIkxw+|~pJqJ^;B*Uy7Vw0|NtK$|gY;cvD((xE;xU9+7e7&VvF9#NRn(@T7 zy>4f76Si)bKJ+$C1?(f+?w0%9SfJKkVA#!D; z`N4IKPoS>h{QAL0q?%HkeRkYEJFS?aYIEdf2EgkM5Qh!)LdwKsgvp3eE!n=(d|hKT z)lMq^7iQH84&hW3+H&&k;$6mUzYHvk6 zW!WsJ-kD1bEs0C+9wS)1hQ4z$qop4a*OZD)Ti^`6{sqcvlT;Qo z#o2vq>hPro(-l7WHKY?NBo;OgHXE0gRC94+(xI3BP7FfM-FjK~*FI=HiB9Dn{iw83 z3X>HN-#W_YW6Q*z;ladT_aw$ov*TS=wp2fvugpLIDE%1k?uWq&nz2&2_O_HG?NRFB z7w5>jphfA;=GtJST6W>}A-BjTR(q${^8>_=k=9+VflI+=7Ec}R8qry^n*;AL1+Bb- zl0_(;CANYiu~3Nf@+cO}YUT$bc*>3MzdrB_V{ov44eMj>#||rT25MQn$ToIg+IEAX zclE?&iS@d0pf|r-@^r>Gn6oriujf2FFRR$^#j(TAj+IV_6XAf}!lH5lqBJs| zg2T^_J^Cjm>1bjOI+(1&Ar0%STCZC_%5SmH=wcVu+Q!!>gNDR7m>;Ub7_d7(9dIWp z;hg)`8*nI1b%`2ISY7gg(tg#ZSL-6J(}hA5ocoi^1j3@#(*x!PxN;i`B~#PUF-x%J z2xsy!5}@=TjRcb#>qs09BAplkbARndg{nMc1)w0C2Gp0tyLz(gnmVHo5u^-z3PDP7 z^+=>ABZiByu}+hXX%H_|G_`bLX<8@h*KLBb?S`~=F;?xxh$i@mHj{DTEQ5sWD3n7hD-&0qzIvQ1}N4o6V zTEr1Io0+x%a$ptzV!k<8QD20%Eyj>wkjhz2(_QCvgiL@UX*VVF^;?Y5itKqT`IOvC!Lk zCbKymZZk_B>*JnP$?*S&9%`1Pk!P!mbvb|u(#ZiPC_Fku@Gqq&1=sUDAM=wLifE$# zlCCo%YAuazSb3ITn=>0QuVNsF~@K2KRUP$-$jFP+D#}U8>paV~3ohm{A!|XJNRr zEhO|G?nMpqd{_8`RRbH&@q(aJvd-tYA7&ped!ICWt`)M*H^i-J`)QrVRmPB~PBEs> zUW?90#9#87x)1Iwo<`5!Jnr7O2Z!HYH#?soXyh(=CNH(fw!L12ACm-LrSFnJ-);pF z?4ZIXRi58yGuxL`VtyZT_4=>*SWos&a-`?nN$8vUeCqf2l2Jx5Zwk$g!iCfU~?l-2}q6|duC zJJ9XDL1pM%`nDf#M+f{lJ**t)Bv{EcGduh2WlPTjF!8aVZ)kg#%_?Wl*L$y|-(WDd z*M(!eeE(ClQlGYFr%g$4+qj+^o=zVo=~u~zn?_MD)90IO6|bWz@5imI_ICGbWUY+R z-zzK&4Bh*f+*k6O$m2CN=2wY1sWoVbYbe3;s`%aBsE4*GImxZ%xKun~fAh`KqG4$j zg@+$jbyZ(7%WG!5YvnUjPU{uF8_)BoOS544*>ols^xWD;g95aIB@W--XF{MBDT6;m?NH= z209@*hfhFE#j_n0$;iX}o8)0UU`sCdX`*y`0VD0eJ=(ZvX??&>48tZKW1ZV;fikF{ z_1+p$E9?0#^MUKKG%cs%DZW&*sTaGNz@Jr7AQJ7>w?FB1(N!{51m%+WJ=KuA9^W3t zF2+>SNS(4(ZK`xjq9dZ*g7Gv2O;Az#s)|a5spi=F1Nd*>|3gkB%yyCv!+9k%9(iDb z7ao4!6|f!2N06Dy`bJ)*x>0a^VuMt~2{aD9WSmF}GAQ zEj~kN8Zca2VoRW1p!qXmMiC%^z6W5EYaEY=VVZ-hGv1QkgxKe^En824q`_)9`Rj|h zMpje=oQ%PsvwbE97kDYguR*cupUJF5d~0Hhg7qB&oq4f{X59cPv$2gKakFe?6aN5) z)a;xKR|&@?>k6q2s|P6<`xLFxPQI0Ex`D~JbLKnH>*v;nTiC7ht_GF{s=+U%%!wNhiHq^y*wax^Pv0M+6mMc7hk zo79&Imb>7muNZJbj1ob2vTY)3=$KM@RTool6%YcVE+|`H|DXcnG9?G>#BHtsmleX* zJbs5p*x@n`fz;gZ;TO=i5dyP?aiR{EnSlmwf78wW*;Ml=;e=BlB2f!<1Ap*%AYwgS zTf??z-+?TxbH%1aVNWFsQlRl=aOT-t!Agt;<61y9J0_E3c+V#bNC093I^>x5BEu_a zNe-EM3UMUD{tGxIeUw3|`C~_1CIFCKb{l}$zc@ISBRcG?Kn}!?bo&>uwh8RMG{Q!a zg3RmQBj>G2^XJnd;Kw#oOo?V7cvW3b(y#qoXy^mf4z~K=uMf-b2 z`}59#OZg?$nT!gm!!tM2I%>)dB@|Sq^3OUhVE{D-|LdBuv=WIDa7gkV2HJlx3?RAR zpEuG5Bu44WjG}qG9um?t{Al({uk)NOGb?vnPqvE~xvi-`bD@$bj zlM2YDn^JnpLt)Ws`)y4#h*}j`wxVtMDhKbT=aooe5y2DwFDUnsBsC3F`$wTxdMTttq2sZXZ@a5&^$iE7z$+Q0Vz+e5%m63Gs&kL<|&jTCg z_3-OL!OD*5_LBZHazNnwz_26*rt*fl?Y zp|?^UzH!PPFr20Qb~D68-n)8KU#uRonxReHH@)6r)Yw>Es|h($4P7R=i#c}xY+9_F z<9L;vdhcvCNYL$ygayTxb)3@7B!gyhk_GA^Rgp`Cg6pu6Tt+xG|nbW}b?zR1A$#mep!2N0XZ=9L*7m;Y& z(ryqw;k;eT{Xz5hq)4E#SF}GHP-8`0E75nJTNYdGVJp%7(&dK+>OFeKH~a5Av+j=} zZp8;~zl$n&VIyT`Pa~lD9DFxP@@=?EKlp|1 z%7`$s;^@r#1aI?U*$0UM#`a`&uMN$UH!QRxnxK$;+koV?bXRnGA@(YL29&uf?&LcZ z=KrUUYs8sr!pOf~N1`F|U%+pZ(!Ws+TuB>pj%4&(nov0B6cwNxmkJNP*hXrdAva*krzANOt?ycRmT+bavK3Qjs``>yX9GK9hd-L zdl%7O&y%xKii?(jxdYg2i=O9KJP_1d-j8qN+)Nd0thgK}8MR$O##?(llCrP9yI#Z{ zKs`8;-_#Q!W>yYXbiG%cm{JA-Z6DYP$?2&p)OY1-ET(H0e#62=ARDN|7anf;ib*bL z`w0uN8EkwP&3>ZUbZxIJEFav_l`9(q`40)5I2dPwD=k4^=)|=Cajm1RwR%yv%e-HB zt(Gq}(&8R+f??-))0R249ji84Uy+?q+(ar+*3oLEK4n;;vnxr>%_@S!ZV!V<{g|`C z?V9$@mEUPty4f2vA@8fS16am@Ok_{(IuN>LxJJG*|C%G@&&anZr4;SNLCVg`{6WZE zzZ~qb8FlOBIO*y7c42<+4DLlBRpdoINphI%+$-FjMw9Zi8YFv9^7H(B^dzl6SBK zbg{nN_jP8KG*S;C@6}=-4jqjDD=RXX3NV_|JM?T!6SV# zOSvLwP;DjGR~amH1OdQ*Cq0NyS2z1JUVje|#g^D_dsa+q?+{~Bh>K32*=JgA#64B;#`ClB~okDwogT*1uVtz??P zE?lUpVKfJea@xr9iSxZr(ya$sf~I)|f=j@?QDE=@nG);;-;7L7#@c1v+A6{s&2hzXc6%5N>Jk-rer>_D0vP+dcP; zXW2AjTcK7tKV55FA6@;nXNRGf!R`--39|~CjT{ksZf)HUFeh5T#{4;SZ{e2MiEQ+E zFML=lOlM#^63KYXh_rAtZ(fayx4(&<^dhEtd*BGe!p!G2*^x=LJ{#n8K61Ujx%zNl zxslMxmGye7tL%Z|*AkI+(Cw5@?JOofx1d6!gj6R;+)X}`29C~_r^qkgc=@S*mF{nq z@wwRWS=Y3&Jukol(iQv?yVDyy+p~9T5@J=mk>m$DevTeL-zRZ{)Fp-|UHMfP;5u`| zb)8v9(BSCaJbC)QA)wjkY+D7_PiZ&h{VEEDw$rAR7gkHfm;nnaXr zts7B|oh`G+#*)E-=l{RzRA8W4AW0#|8mB4%f3OIi$Md)W`>O{p|3@-4`9P&b?uWI(}fPsHW_HV>$Y7x>il8!H>2-* zAQr}Y(|h9(^K|&~32O)Y!&g`RskAU_=^Xq;v_PC+54;1u6;?)^y4DCLfMx`Hs;q06jgzZl_ljs;s{qRK?)%!^Z zX4`EO|MTXPH2mdbZdWQfXSy{dtAj1PGTVJD+X3Q1OMW7UAiy^%ho`OM43ay>*0|_w z>>44yk5dX8^q3v<3*Hr^A3LrvqLtr&E}C%gDe^V{OJ&8#)=g@(AE=#>$t=BslLSiv zEqh4`iy)Jg8Pzj+WV6~tu+AyVUurETyKsF#wtlr^+E>oW-Oo9X#0(q~rXVmW5EtV> zbvq

J~5iccu@CcxZ4HCVuj0M9(tg$l-b{V!j|??1DGz%LgJ)&z8(lOYi`LEfCr) zo&#{<7(c&v!q4vY&eqz&g68#Rs2gVNC{!P;1Su8&633?IxdW>Uedyv66PPs{PeY_jZnYf5m&# z_Y0uAJlSq1Z0P6Ln2@NJ?ltbYH9zJ6ZGlL$11g>tOFSIUz#*LV;_{%z0ukgD3JVa^+yHSQPh-i+&)*JUuyDh0ifmHw~m*@bt3B zl_&7ZJ{}$nq%L2!iEI6~;KPy`vp<*;6 zUE{h{ZODJgC4fYn({}Nd6p&mB?6*wtdo*fayO4V_79ftID(M2`MAjFa)q8rs2(18g zMD6I6l|97{v zwEcnPLxE~a0c#JFZ*+_06f(6v06>4c@k1Ae5^Lbvyme}5uI)P&q?Fpy%zt#sbc-h^ zsq$81r3n{1@?t1TY`t5F|6}b_tXT8n*UC-y%A&jHS&env$ta$6=FyM z?+lw8oqwaEf0=51FDPgfZxY(gb^dMZp}5tZ7~;bW{|TW}R{QB{YNz$S`|k}(#Y))W zN7~?gKp6~1uZUwnjHHhK1A1eGUw`UfylJq*R80~|v2X)yhuN`2HLJkvQrMEFx3S}q z6|^H&UbCFwrUqa83R3`^p<8Y~A(F)?t+YgbFUGr~#ijn)&yi+}dz4+S)?oGCl>#rY zKjT%|Fyb(r;Ox)$&a%UwkbU+hKXGvr@N!6UpdL4yt9S5)oD}a{DHKXaYi@GVP-XdE z_Yv*oUuA~UB$wxl;>`iDGLvA5di?;7vF^i)N1@YHPer+Ch$NpTMDjK!+M9B~zoFTq z|FiaD_W;Kp%ukp{g6@=<(-pIHYJohfScxF8-V4M^{=1SO$~fLT^@F4cf}9|1-N;V( zd$>eGcO=gZ^H%=Nf~$Q7XKG7&d&-GtIKeO5fBm^JdMh8`erGYL7X-RJ>6Z2IRMTSR za1MA8N*j3YofgNV@%YByX-oI*(r6^|30Z45B;tv6 zvZ%A|)ixq5<``wmXVmNE_4FyTKL1*?1IOLtbmphlElvBk5|=?Z;V-y?noG)iFY=W0 zuTIhkcxUI8&yQd~o81hu*@ll(b85`R1y;}qmC%VP(iEI;1efOvS_d!!4YL0Ul8_mb zERy2WEl`kzRtZiOm_G|)`^O#TbG9!s6F=%D!b-U%X;`7LVbRI+V`kUST}z%Mdk$Q= zyDN;$AS`2vF0eMC+z+3z!Y_m|VGZ&hM)upcQ&58~nPJ?+Ui>77lrO3gRWh?GHzy+0 zBFz(JK)Ee)Ictg(X};(MRj{bX4toQj=h6Ti$jM@L_}z?uly!dJ2NP08{_YVUn*+%z z8Eo5~P5Q0m*U%KJNlRC-^xA1pcgf0!8W`)X++ve=K5-tn!V(6eR9({8WrD=0X*d6S zd=fbU*yv|clQ8F5gZNk~VB2^XY@lMrzt0wCPN0k|vHkC}g}MEHpZ*F3>587B(ddgM zLQVU`KV%3z4AqM>Q!j?dE#zO1zNX$BAu!T{xBnz#Mz+EPzhs z8tc4!&V)J3sh)uqw~ub%YSDz{B2CH~v5X3rkpz6l;ELpCpAVpC&^udg?~ZXf%{ zd@7(x0Xst7Bmf7+T40Z*L#Kwt^nP`(>8W zr#sIHip54d#z!qa$<@X%>cHn8kOyKFYqgc$i=-k?N$z3Y($hE;+aNMZ851m_## z61CW`1Z5<;IH#WnpvXDIoM&`c5qo-M|57vre3ERbLa33CLf9SKLzqV$agQN({U2IA zckF*&(Ni^9#ag zcGvH{=}pY6v)!F8V9)P|@V8_KFsn2oUXxhGp3WWiZHq;VICV#wc^;Eo&p^i^w+e8ZF%hio8AZ!Y;N1tQ4l8&lP#a?-MO z1ascX;Z;_JWRd;|mVUF0$X!d*)7|x9ZXq^sP@SCL22jDgw~IB`T=}0e=$(#Q)j>r0!sCGveAAlhJ*` zTFk|0V+@rLQ>(ajN=0ISWM)3d#>T5gl%PJdWl|XGncEfbC?fwf1J%E!hH91xN=U8o zFWlx>I0C59uf-kfDwdTg7nblAwUCyLGs=42wBhZhPR>B9>RY{N6xeJDoNmDCK*s71 zJgApCwGY*`KJ3+zCjgx0#d_58>3$S_JK>IymJdw69YE-LF6JgFwIZPoYz$qs#n*j= zo^>h05Uoyr3myET)Mn0YITwJkdFutO=W+$F-suiUNQO@edHnt!lpTTvYIP1R}g^SbiZHDFV+)fLmas87tNR$yXyBZH}#wTO%bu*XSILgPWS~ z$VpH&^Dj;Mf+%^IBBbd0C{yC)|gSd=os<4m!WB>6HhaNa=&^bgXg1Z6_^0oTCj1>PuR(9(% zTTV^g4Q?;X)C0U4Xiq(t5zSWU10C*{P|L48^*>S75ppyWR!;=*_;{L zLT>eFEDtBArno1J25^ZrZt#EAeoDyGE3&@E=i>pKZEr5Gr_7z6#kMICle!@uxsHXlmz#(*yCQYYl!9-vjy7>aeU7waDxa7W zP=R9xd7S2J5%~ufnnu`2x@Y~=R>_Ruwe;iOp4X^kv0ULyi@|1=l^*X=YJnKj87i(= zge6Pi@YLEj-t7dF6Xcslf4UP{ctISP)r?2PI{)(ZtM`4 zAFo<&1fVpd_6Br#CEu6Po0hL+@4I;uuI1}a*^C2y71aVFkZFWS#y{tnsWDSma=b^b zq$qRw_o`9_6x!28p{k%#ec~w7praJ315X?ad*+g}Gv2D@52#YG9Ln_{n({^c<2|m5 z)S5dH*x;p?Pw=Gvxj99be>((nbsaN(y|5x<$EIm(GTNxw=-X|>=FD)7FEsfh;z$Q9 zgE-F@q42n@02BcBOJ@pHFe&*IP^V*d zBQ>JEfZ|8EXOj4FmyO+GOm?MURqzA*5gcXhryQo;WgCNAw4MN`ZR!_CHrFTb7zAI3 z<(LTxPQB-Av0#GERKC|s$nS&X>U@6=G+!J}$*{E|9*g|qVylUU?lDNp{dLTM3E9|n zh1WwHnYgVJztVf*5=fbnW!#IUM zm>q3wyJ2lRWo&txQuf0a1fQK%Q9FUA?yU8sDv1W#M;h;yP}cM2U>mqxi`!cIjEgZ} z3m6j?txUhin#}r-23N8@Gx-Vo>41B95)_b!*8ZQjnnpi{Z5 zGj4k~@4VJ=0kBE0c-c6wajyW_#^=wMGe&}Pnb*YG?7A=Zl|a|&OmFjvIcsknUI`)Y zm+QW;U!ku+UeDXMs&!|%%^6P`VU`1t*N2zF!LU#Mq%>yYWwH?mjOJA?{b!pq59H`=cZ}ORg=Ce1|OK6p%2KTAJ92k;_X>s)l6Crt0|I`KWOwYia)a426Zci_F$yCm%Wa7~wk_e@ah z`YZ?4t0o#l4@6HeQYFgVQCqF9mrZWr6^0ne5%|A`tC9N|!$~z|wOZ@iE*P;ykw;m# z6*bu8^Fs%d0_51axgP{}bGN^>%v8)+p+9+AI47C9sS%5D2->5mp-k6Kj|ZA(98@WB z&nshVZcFFa{jjxI+Vg?MO;@J79@r?>>^nq%N8NqHH-KVRsfLWe`lpkDQ(NiRt zKOJx!IKIF%d&S`v*L6~BLa$4A3VmjZfmEC@5tN>mE+4COgu&2&3kd3P- zKp`|rAe>T04(YIoN9p!}vW{`a=>$E1^%iwD%1(QmC|s|BqE4`chW(D7ih<3FpQidR zeWyl}<>@lc1*?R)l|MhIBB(rn_k!U0{8dnUnD8iWhOdGWY- z$g{Jznodr=Cizd8jiv`F(YE9Y!0Wu$=TCZ;Mxri$^G4?g{g=b{xY?w;tCXKcP_=;q z*0;#sn-YV3o;^aUUut)-;z-qbA^#BS;(~S64{)F=j9>*E3sCIYSshlq$Wc zX&66?qd6)d0|Y~8zpduzU*oj$K_Em}Ot`Y)J{GrX@C<0mTuNq7647Ed57?N;I~V{H zuvBR}1lqrWC%q);!LA7-X#Y)-taajuG67LiT$N)alxoUK=p|diiMmJN0Ip*QNF&>+ z+pcLWr{+H}%0mA|dF_+RF>1&U3TbNuv3S6!T)J{;DDJsGXfvg!{yPG5tnJn6G@Imj)~P* z-pmn%l$)0QqBh2azx?TFl5r=oMv5`{ivXW1`gN z@XOV=p81B#`+nc=`SoC;Mz+qkzvk$=l|K_PzZ`3qG|LGE&@<37u?F>0N?LA5i3U6z z6}B>1j$9D-#~}g?tz2?84GldMrB6OKnHMaGlYN{>D4q+nztQk9cr{6$hwtGGlcHn6nET2gl!70%Q1yfsYW{BV!T{ks?RwN5zaF zG&sukgB8z3OZaDfS;{~g!4Tl(lnS*ohe%#GhJ;NFtLx#5mEJwh8@BOk5RO}mDZ1cV zGgau&SR1PFYH0U+T~^`p1aP7VWgD}MIEtXHA125B7IKWM`Cua|f+?nOUg{`kf~JTt zIP+tILYhJ3+r#xot}nZ=te*#86F(|*5h>((|8?s8AgBJGVo-pebQ>T4+>3-{{L6rA zg!rnha)C^sT`H@HkcA?O6#>q-0Ef4LM}$8$I#L*A>RvQViofCWsmCYi0RhP^ayf_* zx$5fgLqSGil-{sGE25jW@Mb=frBW&Isu~CTXBj1?)uM|yq1Q|Wn(W&JD(q!{UQ0LG>+L`%8G-emEl+N^VBp$$7gibK zuaj2X$>xef{ArT8=91YsLmuBF%k=P)Z7#D+Lp`qXznJ6ks0(c^sd=6$tktwiZ#lyr0Nv1R+- z)$9{(f+K6H;PC!0DmTTDHno}JJtsafan!EyXDKS+7R&4Zn7~}BpcM~L2tCUoIhFnh zMt0)&R%!fhChs!dr%*r1Q>kvamTb-dwab1G8b(j7P5O%sazOQ{yklVtO1U`Ri z0VZ9X9|d*CFY;Qp3Q$ow$coI4P-7}edgCPB*BHT$SN%dsZvxc;q)-_qwEI68*oVRE~Sp8r=w4Odgb3J{4Y8sX>c3~j<%&@&e ze*duwnxru!%2)u`S(AN#2rij3^I?JUPN-{`+0)$sEgEt4VeCLgvO$!kV_e`&a%awd zT7P28w)69=YYMylQXvd|%Fl( zEiouTrlV+D<&;goI(u9#KXtw7Sd`?<`sj>m*Hi5ASdqE2HdDEG^ExkTouLoG($8L*m|ZacEWWeEd-Sa!pL`j(7O8;$D+0MDi15(=~7{m z%%j8Y&HJ&y!uTxTGJE`vk#_8YmR+cCBIvzD-O*atc9dKttY!SfTQ!P0A~9b}=hs_D zY@z%GbrB%m?4}x)jK4rmC_SkAP7P}UzXtio((p%d{)*W}CiEE%AEP1#=aGvcsb6d< z6eylDz>c(n{PSxj_|Nbfw2e9Z`Ja+YJ{k9)=|cHmUVT_iLqSF-k;D5tEB4d=s&dQD zed^_VNy{r))uEL<#m)+q^Ul)Ij(II5b4_9x$CG^Fa{^`jQl@uv=@K6=^BLY5?gJ7h z)WSl?!*Us={cYYXL%Z8Lv>J6ich*SMtJ7Li79`jHY^fHZ)C_lK+6^`I@pvI!mL^B6 zjyoP61tOtKjxcqMc~>BVGD@pJV^L_CBsg>k9y)WcJu8RqY|T5vduz<1PR7o;x=U)((0}FGi$>3JwNPez(32rvE74Pt zM!9WTyzeI9M~fT?L}ySrtI^=0Z=tgw@~`5i@DWjIq){-G{A0up>s=yW9G6jnUyKCd z2n;mh%Pc>a)a0R9u&EHO=3_IYt1u=iH)K#bT}NOpm?7#3AbY~fqPU4lQ% zrXDSE1-lu6`~dMY?r9!*B>u-lp`Zn&x4c4+3%7Aik@0!RFr4d6@fa1GOaH4Wm=oaz zIVJHQ0KJXIQe}{(F7OHvwzoi#`LQGAaz8q8N~hDhnBO-HmD>JkF5l=Ea=G-jETiyn zfoS+JH`w_DD~5zrwg`QXrOl1o3X5AdiDZ0OSLqT`32|YQK#UR8LNImebyPyN$7qHClU;7-L|ZLve4|EDst-e z?*T12uE+|1-Crsc5INC3UWZCLpavn=`9Y;WsWVdXP<3sn4N~l^^2gm{lIQKPs@p5c zGkFj8jDD!xvx0ui9l1A>!}8<#z;jGx7OlW1mU7}7McGrS6_{(kR*rcAKbQtb*QfI* zbXMr|tfYa5bFbuwl_uB@jfjV9oBn~z!=uCj4^`e)%Lr1SHSNy5<0HP;V~N+(Z=0s0 zOpA&0*`HnxWNRNCTXc9H&o1${%b8w&u0dbY*;QQ7l~m8oOd$fm6tZKLK6Gh65@h zaFx3xdLE=V1nv;;AvubulGUo+hnI6y+^`lbe43znX%&0HfF33gyQ42-Jf4(TIf760)=}*DEw6WDKOSZKMZY>eJx*(=DjnN;S@$nZP3$!sMU;Qi zIC)vv1oO#{-1~m6?jhYuT0~KT9g`y=FL9}v`0H?rL1)rZO;3d5pN&KH@OD`_C{GwSsyi#Eib)=&h-X$W7m8w_UbATnbbA! zl@1#~~4#TO*ywYrHPiQtefsnfV(Ebx8kSA35uj!q)%FN|U zISIOcZ4!Ic88&oIIg~Xl;redo=i+BSW70AW>dk1fhqMR2{&Rt-qSLQ?3fHe7z)T%( z^5ti@OXSg|9>H#-dL2=o$KdIs{Vzx7>r>De>&w^u@rOMV5ym-) zcTfT0DMpKDtP8=V4xB1Em{f8!b37{fh`-jol7SUoYza}=Hu`1_-DXI%+FyPzmS>NV zi@^K|EfZLI#Mbb!6rb*`ih7B7U3>&K^dXxHfr8U@n-Xj^-NdC|x@twS*}y5Kv?mz= zOJmtK)gRx0hQ53`P!P8c=xfbfZY!qq+B237I%9}yyoPB5OeH8G&Nw+AUa#Mz*H6Kq zK}O;b1R^}CwNUWsIrTY?GLzf29TtBCk$Jd3RTY0*zlt_A#F8(cYMl7V_@J-dv-bxE zvL;u+ul2sLS-T(~M^Ei0NSS@G>NyNC-Q)eV0a!06bF7L%U=1gZ>vYm=Ek1o0P@0BG#%@p*$I7XzrT@YSX_sHTbOv#pI(#Em=4+icJZ^oATdB; z7d;ebDp^Cn7;`<&nKMyfqSwYFHT&iF;Ebm{xE~A+XJ1>_kPYJ;?~t?!%Y++2(bqv{ z+`Z!Jiy_J2-Kx2j*P6;|0fpMrKmNzuFUM@<442mAJj-)xqR3u#_h9eh{clyh6!+7Z zCZzOwkpYZhPRbG5II!wkvoAZ2+B7tITeuSVGeysOYvUUXJBK z=2y(QpX%73GA41zOqR0J*(Fguz3HvAl;VHw#6P<~g?g)$w+Q7~BI|vitP7+2Y(b*j zZS9wdIQ_~c2SKyGoEi0@PqeB- zhPv^TK6hyY(;uOmr&v1!#}0P&XZ)GeDOMvTT?)U8_YAv9O;pgxCS=c2BWTzXx@&Y_ z-ErkrSfdC(LHrqgg9>Otr5qIbjvGUZHW%)X07P(#+M&)=c9$z^xB;k7^mD*9AMaX zv{-b0u3^$VPV=7JhP9FiBPT_UNoNV(;}FtPLf)LM1VSM@g_NIN=KTpZNH~KfeXp&ng#^W};YSKG>m2T7eK{lg1=Co_fzw!O(K!6iH04?O#PS zCa~Z(SK->LeKN3;{sK4dERTNZqgIP~MyUtj?fT&6OQt}w_L1)8kvO)KI;T+80C?sXie9o^mGIV1oGU*y-qEQ zCaOr#|LV37x2<_q%8_n)b`*WgW5ZyRt=qxtIU;2vpY<)tR%J`-^!)`4n0?${r{{f;*3S})@cc27hhz2xLUJYHW7(%0OSp;BzUY2@)dVe3 z-#g8H5hEcjqA6FnoA%(Q${M#FzOT_ttB(jUC<$7=8;MI|#Ajg+s2m&#-mYAQ^!iCbYo3HEkeH$UQ41}Ma; z5YPG->a*G~NkfI{6^X%2f6<c~ z=$HVQEl@$_t49uM^jGdr73bsF3?w_g6b-%9+*SKm27o10GI&D1``rV%xeox8fu56$<-T2!|yQjF-o&BN=+I!a~AY|T{&p4M|FW+Il@C#o7chs*oW<~6Tae37w zRCLjPbZEScjBGqtJ?R?I%-skzZAqq?wfdfWK}o7#>ThiBStTbto+7&)LT!W_UKf%h7yAP1>|1eMBYK!orj5i z{8`0FlLkek$&8F}u997oOEG*D8_inCedcq*1^oE#&Eq`fguF9VM(_cFPp@+ry9k|b zcUGC0C?lB0y^wsvStaRGcq%pSnr(QhNWY+Gw0nTS!f#-0V+lm zVrbd?TZdK#yZ{Md1}=+9^5Uz%mqOTvvdvdhcv~W0Zn~^YLnT*|8&VkYTqhrxpPSRe zVfLd2k*G1`vuysS|AWKQgp{?)4}|8FZ6GEn!V6ftfMBrkGt&sRV=EcQP$+Yc9D=YC zmi7T<=+H>S8-aslLnT%)Wj{17$SHMcE1aYqi4HZ^26WA%4=HSG*_l3jh_XB)@tRJ5 z+(#ZROO>A+@^&^Zl6s~R=D13|b2l>6#s`H!my|Ec$oVj$v90FIUAbW6|6da7aMG?Z ztcYV7q0tqJXriQ*u?~6u$?%a|;mLC^o*XokzR#M5qdgBYzWR zL+ia4V6xP7+#x%gM5E$Kh`kJnr5wHrDJmqx(}Z#qXg7?uY_SyUy>@TGjXonyb!%`c z@DyZ9hCsDh1IE|;0l3Z-m!9iZvm!j(L{jB5^7KhTv*cOMuqD^!d9dE^c@!QS;YS@v zvN0<}ON0Qxo&F{($(_>u`tnBa5FLm>);_Aes~8!kXo^Dhv=haK*QN7PZ9`gQ=+mb^ z&JD`I20!6tOu<-!x%py{SNLKDIrPPxP9 zH1#MSG^=8?;;o_TZJcRUiLCi#htNhA+9~6>D7>L=S8#W;LXo^D=?Z5XOL?V3=>&-Q&w6W7I&>QvGeAXado{%aqI+1RWZpo~2|o@_*~pSOY_ zSa$Lql7=XCze#T(3~rMQh=g$w!&rrhC+!B$n|;HKtuHGXZXSeY6Y2uPcoR>bTm~N` z-XKUk19Fgf=)>+_G_i~c*z~1ec7HuM1w7cw=kH29TQDT4^%xn8<2lP*eyj~}GCo?& zKXc%riaRdMZ%$H@DYR*Y2d_?NYC5?a%L+uOupG4-RD^bV)WuQg#Om-Z&)pCC>rKn` zcog0rg+N7R7U=>~H>pKXVqn+J6u-wZW0-T!p{PlO6*v|4p;l$S5!}^?1E!Hs6t0Cq zRz%#fC3DdGWi3`2pcyV>s8?Zl0#!D@doWmzzC7a(tq4TlccPfYcf8tE(k|?~V0*Mn_M7vZktsYrb#wuhp{hd)x zW5!0?L@PD1mdHxdFG2WUF~}@6wkWuS_`e9rY$-wblV31X?UFcvEf6!r=92_G0OVE)H9 zU$mTG93NUlNdjV}02iiBKIA$8p3lfQ2_#i|S2)3SUSF^*D%wyUWP6{I%AI7w?>(O0 zg6LWTHd4Vw;F1t}4qWDs;oDw ziuuf2{Y#TzE_+Ji*Bf^%E45eZyc5sC6TWxsV$!l^_G>^z5-uc zu{-(h8Vy}np~Z*&6*6z_!>ozILK?_MyhF|RU%~-4?CwRdIFW@~{f$^x%qJ#aa9f0^ zda5sPMji(ml)SC(*NV*6*7&^QwVGELw1L@< zZiu4`8`~!4NQ1EjJwU@_s3|dBxcUi2_K3r-O318h?0k2s<>p5^ z7vHHD@0ynS)t!99Vd%K!uWaX?o&gjryXslt&3o9bv0q`Lya}=P&_u;hzisVhOgQ1E zxz!jA)y4(Ca%v|Hi=$Jvg|ji`+j|Tz(`#xtvoGMM&~@lVKdtpa`Ss=$Vf^VUp2WY8 zgj+GCp16+Mgsr4g5yK^RUyrYWJd1OmSI|o7Axw!jn6J)fDQBo0Ql zl%W_0sx^MthMALo!1i-pzV?YtaojS-WDKUGiRtih%{l4jo*(nmGB zU@W@5^sv=nXXV}%fjIJtmKk}tzG__t1M78b!*skFxuLL#WVYDy?*#iEFM>cs6sIRa z8@bD4mr{LXOkbG`geF!gKFwvVd6xqzU;KwAGEsJOe!tFW^)5aoyRno~{y4lwKca=Z zUZN*G1UpZ_Vp)q0KNKB4?*voaTj_^Jt$66TXX&R3^+EXqVj`0E_T{%6Z%>~+sph4{ z>wJaIR@+;$dEIwUFA%CUt3(rBnQL-+BeJP!$O&Of_x@IQMDB2&l1+)@P6w67@Ke=C!W_L`gB6X zCs;*>obt!A!lCtZZ2V_$>{H>AL}oYslbm_)XzSxo&7TS0t`(}PeAO)_R5(H^#LF|F zP6D!5B%AGV15AB-@@3JX*Nbw!pX9^;qbHM}n9NEP&^y7pG+i@4Cz*lNBhLpAVD}XW zp%fcQ>L$(PWpj_MWPCy|^Zdtx05Mx@OCG=o(BG1yHz+K zuektYS@!i?i&CZ^@rkEpOIO?^pbO>wxw5f-Rp#hx@BB{{WFCw^Z3k0{d#0~ow<`vh z8||KMYEcSV#jczWt}fL+bu?uv2Do*L0;}piz`bkNs6LP+e zCIm@%vg`^DCV!nKyUi;x#7IxF7%r=dXK8e}I{_gTldW1x2y2=7VIJMccELv=?mtqE z`0Sw`pt5VSb*-EbWM-Up{zva5{1(=wR@m&;*uKJvz%{yhRbxr|q;O8AJJF~C^Kw-%8>#AHMIn_ftG@?cR$`A4Zq>xk*}uB zjHm$BT`Ws4iVEiaE7*(2nwO=ZTPvzB4lF&Ojq0lGKZetDj41FKEetkuJK6&d(;p^Lrw8(?@Lz(PV z=hEBjc?GLYt*A`r*BVE62$#4^#LzMfgw()OQS{$lGg#bul|)gq6^OsA$xJ8RytO*Ir}L zB8MgSuUKnJikaMLi}r)XjvMl*CUjX+KAV)6?VMBCja(2#;ib>%~;AY9<&h{9o8iF48R7*6!&cREh18+^HYNQMG_{+-D1aH-nkB@fi8ZS~3 zL~icd)tA#j9(`vL(5uvKl#qx55nl(Rg8HUFq_?&*YQ4FXVIT$z+bruZK95g97+|*& z8s?oo#hv0r@{n)*HgW`%xeb5GsIbO4Vj{qWeS16qkziAOd|Uv`HkPGs_+X5| zngl^ElEY3<6052W#z`0aA8Jl*NbSI6N{O<5eia$a{HSyncZw6$?*<8bg;omYFE*4P zie|W{zm4En^?Bw7U!M|Y>C)JbbTiB9R)Vtx&2aB&!l!b&-n!K~TAgw^dT3CzrsR$~ zX(Q;S6qI*G2x7oN8$GS{U=BwR#=rjq<%R>e+H8S+-8_`231fbFuaUu5>r@9_VTFp2 zuWin2EAh~!z_&LDvtvPljw;bV2ay?(&)ZK?DJ)i%;tk4(&}vz=WxgAPsfP*kpk3Lr zsQc<?){d-ZtUx&GVwVhgr7F-?e``$9!Lqm67 zMEQvIQlwN4ftt5tJpVMu9L>YC5pPzJ`?(8aQ0F^p$6*5!!c~VI@?$rU>(pieT1vqv zCOa<=dJ6w?Q=ZSM>3}|M!_3tqc^;tsc1XEB({@dpXW}}J=cZA(2wkJR12$+EsagAgkG@BmsQTm3d z?Eq;JOHH*rMGbo5-?so~&iD{jV*eYIqyx(oz(@Vu5<5`y>$$y^4)0Jwk0tMCo42>O zDm;gSHznQ4#Ew`{Q1s?EQbQVM6huV^?-u%nSZ$|W_$SVCSKH{FA^Bo^b0O3zC{=qZ zR2jti7L+RW?$?=lYTBG4lE1(Qs9X0jXclofH&J)9+a}50p97)S*EMpuR$M-r^cHE^G)3;ff+BRT z7VCrW+m+){@JTC2VkD8`d!h39O=D?pqT5>qGQu01R|u#P#3%CMC8FGx=VtFcZIvpA z+xscwe;p&ZQd%?(U|2gyiouW4dLNBJ;nE0>pUb2CNN$!P?XhhON>a>(aojI%9#R6x z{21P_L0Z2IL}H;g){B9<4OT|4JZeRe)lrLuh~bQTM*jif zXi1`iyt$Q!j1PJU>iKyHK0LM1G@8{V&6=tyigaE^pRjGbG=5VJ9_Q*IA=!K9aW|9a5jse3T znc`z|jAgpwnr%k{ILdbab(wh0&R}zwr1r3>19`JeqP@*PaX&fVatqW@2V85mS-9hl z)N$Sc1vVREY+XC^HKYoOtJ|)uVWBxL@BXV5 z%~fKnaFY*SC%7ZSyZVN~?R^Z{DLXC{;@G6#DWX|~Q5yB{vb_!8soH%1R$ytjlR59q zrNjlLLOpjf1-Nxw<)yNgYNUf$rb0a#%gfr^MWxE>ly!(sQ87~=&wvWeLr8TyO{dW5 zO1VsX5g4HgrN;dF6c)8o;?vAnR1<2?I(u^wNBed$P|kG{lgv?lPjg%{Rl$VoS~?rd zA_xjTe`!;?38BCR(0;D~Gw8Cw4LAOXAO`M+)I* zl|0+s*HkyWZ=zNnFP?~Z=a0SGTb>%-jW_ACPF77{S36KU`1oGjHFTUF&Thu`Km$fJ zYjrKEEuYRojLXlDTPr=M*3R%_rH}P3++K~fdn@)Vw`89EEvl7Hi|Ma(UQZHUg>;Xv z9a%>%r(CwY9Cv$j)Y`|rH6u@PUN0+SNG=b*PqkdzA6xRw9WVKU^VdtYXkKsc!?dm$ z3}sK~l5W2L@+^#O2TcI{9h}X=`p|Lbk>p{OdDQ2CB~PK61i>Dm$=8kqJz0bIbnlY- zU(<}o&CNw0T!&3-sE+$u10#a0atdj%eJqh83(2Nh;t<@KzkxK9Z_1Kr&oK6zb*-8t zPD$Xn=-B#YdS*(%y2v#Mz`~&qpq_AttukNBA7B$RFZ@s^cS7Apv-WU~s-+FK6Q#-t zNgbNo{Ix;IkR6;yx=^p=!n^^AwJ$gft4jP-fz=^YJ-`2+6oI5JiL}B=;&4q(n|OCT zvzdXC$Fn@5ZWUssKd`m5i?tr_*cc0X0<*#ms=rw8^j_Qk^wP+9n3+d`)_x?|&;2^kXrEDP`xF+1Q z4%SQ(q2`R7+~SGcSZ28s{f9LKMv_hPhZ+@_nY_00%md3IJvb#)>Q|-3u!ham$~)@LX7mo?>l_Fn&UfGuMg%&GiH%&6_jP4 ztQfV0L&W%iANxO$;DQ!-xMcSl_-cml#kdq5hKoCq2>2(UpGPvyBwZ%~o+<1(eav;q zw!R_4|Bw7VJjpy9O=)ujhbH`-+s_4^4nHFcA&0~3Ff1#XBzJ+jmJhlwv=kqjv?7HMRsnC7{ohgv!l8c09z@dTv_e!evLZFd&rfRmQ-O3 zEANDGA+A~_3Ud$6{ofvo8VK@^WPCIWmu<8XIO^C3B{iAUTuL(FTzIh&I0glu;}6gS zKL1x6pq|6WwCIi3aS?+yfStg{o%?Jy!cdX3tC*K-BS~^3^HtwSth5&`pC>~yy#x?C zd*r2Vd&N7H^K0*+_Jj(9&0rE>u9ZST@?&H|mWv6_v2;j7<$$V1I1zoX9>Fw8Azj!->{3 zvDa#bu8B3p={vyLPT4?+e1^Y!Eo#s?=g~O}nEScZ(S_V0&gmWa(PF{R7GO9I0Mz|B zsXpO4A-W-7Zyw7EaL-G0Du2zfv7z+i^Nb^j2%>T=ZqRO>Z9>X$@&GJ5QC|F3Hp({y z>Y8-5ZHIsG9w(uOqoWXZ9cpgmK@NKfuI{7cVF=xP`0uWi|Mv^&phzn2FL>J2b`_M^ zKJYKaQob%}O1+n|yFT$X^*(9L0>9v4{%?ay4C$;mQ^D~7NKP{lZ%?%G{-m)?r=tfW zox$wwS4+8%oD#lY0xiGIJgl0eM5}btNAm&>xKr1^w=(xZ;Ykb?rC27pK0A=8mzx;G zD)qKgKkFh4LdLg}n^JLniv?u@W8%avazaz_Q|dy*gX{%lr^@5>-4g9mY7a=snn3c<-=`dd`Z9K#D7orh?a{-|55Z8`6n4{AxOddE@Y*G-1o*{TuX4K#(A zMOc-hw9<=^K8nh>;oe`0oU==h{ZsM<%c@51#pceba``p0q*;cyTb2A^+|+F-#q6fi$Rh72TKZA|n+}?Hp*!AuyhiC*m$=SJ6gb$L zfkBTxm)-0glzDLzz8R&%LV|W}q1iwi_-Cbpi+rWz>A??EcJdGwv4ttI@}&J9Vmd4v zhi;9O7KaVm25FxG#`3pU=VWD)SfyDijRfEy(hT8S`*Y z;w9Sz>^|Ydl;jm{iv&EZh8TP>Zusx-f2>a8O~&E|=7p`f0T@#nwMy@mI@PTcXP&;2 zjbDtI zt}H~-Mp+>QR2;mxfSn>c;0zgYCQjZj&BLHAL_gH16AW}^IW)6|q;ux-$k+p1T;@Dq zsbA2aWeMQEmt#%mwn2u3_%Ex$8XJVUAb<;H7aau2F({;>nRuPJllYm?aYSBi1NnM# zNI~(G7#>E7{$H@o%?t?1+*Kq9)H%3M^1pI2&xgY98`=+dYfqC<=lCY zKaUiO3Z!;QYxSMN-$vo3uB6q!*d(%ikBX8@@``HyZ@&0!@skkSsZ1m!85FQ-y(8$Q z2Jsmm;WL;D^?DjIG`b44F0k5%Cp17<5|A&Sa3u&JEb_GvSHN?@2G_Lm^+AFD7h!)% z)qgJrp#HBm^BGk9fF#VO>8}*~q9Se$^_-$cY7uP6{+b#)B_&Xl;bw3h6f7=S)!Fr$ zE+|eOTJ`=V>pq)B`#%ui)*M(%V;w4Vi)mtuHLiUvA zvaz;d3(`z$s~$^k+N45#(o6#iQ=@-rIEvSq?O_U240KXm$7{+gp_N%{Mg3V{`P|Re zh#M>|!@LsO3#~*H6Lb+ex{egv6!R7i&<4ip)3@8~50#;a1zaP=rrnrmxMWwFv!1`n z_{!u|f5H#S*j~NB+v`o8jezjh)%yUnuwE><>K6Ykd04_6Zst?0o5Jz=M7PN2yXTjS zWOHJsfzshogYtX^KweDd*KP-tGoQg3v*QftY%+k)x0!j_*%c@sZb-LI2~U*moYxpgd$@fpUeqJL4Hj1H2^|I5-HmBq_ILe`-!`oj^xRcla&c# zLsPhtgpYrNRRKc5338!R>YC#DbAw?>be)$d{svl@eMB_dj@ep@--Ld3SdpNEMV7o_ zIctUq@Vh!^1RLo{&t%g9hVsza>jc1SvvVNiCiPl;VIlniON}Atf?`}XMj2~c)u8c- z#s~|@7^yeJ9x2{mT}wqdN^JhI0lJiPL_tmEBg;*n>1UQ+ey-vwLu`L1dgacayq{ga zGR1~(0Z6v0=cX1&rv{0>B0b-GqtvVM!{We$0OgJfw~}$(RK~ z&25pk3NiuBQFv$t8zntr$t#EF=H^x1v*AAmkl^0J050XK^tdG_wn+{h#mWw__xgESFcA^ z8T}u;8lh5?99Io=_EU$>XvSnIyt9xgeRwWlDKUVndeA~kICXL3ij8+E9OV4QO60X# z=@wc$u!_E{!F48+p~|qsHK9eKdx|FC8E(YpZGuPnO+N{N!<_glQh$Ecb|g9zz9!L3nPB3JGJfsg>P0{d;z_M0&rUaDhSgF_E1oB8 zLf!sUHW?Q2bY)TyUnZP@I+ruav;k#csY7JW%t@K7K3nP&huFbP^2@YV)kr zql`m4$%-)WGa8*RIb{9(C@Ko@QYwi59vNT}#s8fhZ{;hNog{mhY4VNkq(k>eOnZu` z3WA(p+X|;C#dFuD8CY1MgfO>Oq7$<+qtJ5g(VixA5woLT?Npf}z>*Sm6*RQxg86nc zuGkRe;)21PNT2(zYay@DrtLdi8}4abu}C}f(tq=p=$%@>4CJsR8O=1vHfqt56}B$u zJ44&kJ+^dIId+5gkzG|&Q%5dhgGZ^EbK)8Z0FEKj3qxzUIQ1LeX$(ue()kTN;o0hZ zP(p9te6CyB=cQvJYl%>P&%TGO)b(OODt2eoK{w4KyVJ2(*5oD20yWB7Rm;nZxHrmL zDt-)Fzll@pQ2&kO=40YQTyXDdJ8b$8)DpW!y$TLNG@&F>NLpD}LRU^j56DVXfBKFC zgF;^mFSrW2?+bCs^q#9<<6?*Tl2%Jk$oy|2)p{x)miD7~IH~d-u415!yFSlIW%Jo& zU3IS#)Qom`Jf1Ewl%IcX{$(SJSU*Jo_YM5{T!S$PR|Vnb@A2|UjT-MA9EQ3 zUJQD8SKo7elv83mGptydY4b#bfzbT96&hA#M(>m|_2sA0!sJ8iV`puB(8vax+LsnS z4^MWFMix-P{$Myhs3!_(GbEEy#?Pn$$pwKpa)C@4>%n=|Gh<597b>e+(q?^bmGaQN zDhXsK^O1m_a=O<%Aw_3Ro|oZOVZRo6-}jpPDacBN3yav$*k>dWrZ+}(9=iV%cu3q+ zjxh8v#Q|~Fr0}OiUQEaG@@!BR9;@|g00zm$HQ(!`l*=}8=`{8CXH=bzp_4ftp_D*{ z-K#jAf{9oToYb_9hJu6n&d^#-&n8#x<+LcaEWR5_HopA-N7PkDRn@Fv3F(mT?v(D5 z?oN>g>6R{$?(P!l?k?#D;lQCmy1V-x@yfTBKX9{IGxO&2*6fWh?40k<&uV9T1Fgo; zP1h3{;YJ*}Y4p-e`~qEKaS2;V44m|?0dF)qzdhf;vr|ES6gxq_a^C-*m;M(136}nb z3Z=7SU_P%xz0e?6{Av|DzJyjpS>_|^kCZKz5v|JKM6W`f&W`#J7tH8EX)30+Op}gb zPTr?=DsZ6`{itWV-XlnW4`W5`c*vnXW{UA_J@gg6rdLljjlW-<2(!-zsPgLQ3FJvI>yrY^$~Z>VOg^2M;IH&Pof!}oA`LxE zdBB+VDLB!{jluSzxPb}OAzur8zDQ>J$OcZ!vcp??IJv2|2i+Ye{5ITC)1RmV%(3s5 zmeljb9TIF;!mNDAwkJec9d6xdDn_)R&0MgTr&X;k7KcnqQN_VPgf>R2g!zv?>z?FY zR46D{Bld(zU#P;*CCQ=&C}Z*8+Ado!6A0|3wTyZ=J_F=TIO5d8G*~PLN~a3SG^n(| zJCoxEqZJB*%jM;4iPyHBT^k>jjNcKSR(1(Iacza)sKsBs(1B;oAg|3&m`vbDEfxh` zS}L%RzsDTejyCt;St1`594&8wHT@(wDBS$=(pnA z=*&0uu2**y!nmn(tq;-NjHWEO-dy^*E>LbfcXi09Z z*yny0biGP~^Ss;_u(yPr9@js0NB}9%%G-OMb4lgxg!pVgM5Y9k zFkp9l$fm$|``YbDi1^du^Bp-mYrymfx;iT$I8`fYQ6O2IxOhJNaB+&dqVWU8=i1r_ z#cKM4-vyPaIIrT$#-z*&$n_s##+4lS)|y&QI&T!rsLaD%=+eabNlnoDUIJn6mfitn z(ABB)AWH7>QQHWsy^cNbh8tp8XWPN($8(_4=wr(ep=U#C0J)t@JW?=;X7 zrq#NYGS#4%J1tdd{jA@`XsBr|43islz73e}_(%PLoUoX?B+5Mb$O*B~EobX2Ezk#w zt$SEl_Z6;dVyTc4-%|~rV6UAHMX1IALOTx+qOe6TF~Hla=P3rU1Ihz>O;mJ~=CwRYuZl$Lh)RI$A)aJ8OZ>{IWr#4btfkvA1-|uzLp}ph(k;qhU>o)6>qh}zw!9l zpU!`fM69t{zmSQn(|z~`Q6_|1eM0+N+ak!rgPzF1?K7B*+G-j6P?e%1XG;oJlM8U@ z!(N-!m$ST2Rn$KR18RT!hgobNqAn8IXcp|P9x6y`!ml^6F2csdFw2T#08ku&vAnpBf z=L|=`ChMw$CS0x7llDS?>93Wpab0V2xG1)h(r_NO)Um0KJ(8m_eb$uI2;1o@6o|-a zMKtuw|4|4mvIj&VZO8C8>+Vu9F*O3*vR|t*g}@XyJOsTN<(yo(uJ()d8B^f3OVH@} z?H?#-)(L?2-Ho3CKG%40(%Enmno`eWewIbON)dcgNS`%Ek#>a|u_?)_8Iw(lZ%0|>zZG2!s)tC%M zeIKE>mO2FK9dZe|mITSXIS0*>7gW*l4YZ_17UN7~W4I7PDk)4VrwG{)(j^LisO(Og#g~lVZ~n z#YygguM&@SC7DP2iebhU! zI4Ve?CJ(Qm{`*4$fR`EP{*)^I9ekylf7XlGaBb;y`!XMY|CyX6>}#~BjG9q|YH|gK zQexqIMqe;sENrgJE}D9h4eu9_^-3MQbFx(`ZIK%s%MDH%xA7c)-#*Vt4D_Idw7n#i zfMG#T#?i+N?$jVH>4=MD;&dc}`5S_I&Ie6{Sd4Jva0*&3Z2Bu%SH)d`fVS8L>=GOjI6iQEU<`i9kjJo|EO^v>&?@a^PXd# zBl>Lc{YVC*t=!|?<>^yRic33w%Uid+6c&zZrNwtWFxecxnBfxgydYS$%$I*NO?R%T zzdC-UCCSAh;Jb!CT&bMqfFIL0QG)Gsw-&8(aB9;5SIkgPXV)sRw*aiR7RS63fzg!r z1&=smDd{etFRAO9rg0skVZ%G@mLZ=rlqSl#YJWaCq%GEZK?9rGn(V`*le1JOWt)S~ zECj1dX+hoF_d}juJ~t1$n;B1Ly57|!SKa%}N#0B@{TwIGo;=oT7kTEq)@akK=S!z` z?Hw~650}72FRrJPhp998uO~srR^I2UH=9sF4lSN&ZFE06KjBzJ=kqk6e?n2kHGkLn zO=F6Y%L%O>hgp*e;WhM!BZLi{!~M3ZNoJ1Ts`v)~`LrL$xyIixC@!}%|JeFHXi`J? z^D;9=T>ZsZe6dPzCjurk6<>nC+9vIq{$B*krHMbHZ_gAK>{mC{sN{^3l2m6i+K#$e zT=hXCpk=7L$6p~8n;r@3pWR*NA`0=F!(ICgT65hqn~Upd-9BKrX)2GibteAFDzn4w zeyP{(F09}XpH)*d{Y3S%KU+y~$lo}lwcF6J@AoNT%#njGOSWU6Y9dWfZA@W&V0NsO zZm4vE6Aoiezy2=cKeagPyO(Sp21Xx&n22{=mHB3}?Ix;#cD|457eJYG8$EA*H+iyj zc&N89d28DRu8D77AxL#E6jFVWa&ZHv+XZ8j;U%$vq^IdNtiQ<+Ms4e+tDf(4jFZRO zV-~lt`*Hq_PT@xwhJ?ay0RbpF+YkT3W=>CuA?^CWGY+8S{7J+mWNJBDe8VrO&Wn?2 zhKHq2=D}bYJHB)XH@FA;kAUr^5QQZ9ieU*!`y`Hvl9&sNBkbO zz+mp|+WIu*+$mS{bTky0aC<*%)@{qn1O_-!~Q?^q#hDg2zzlRfJOn#n_ ziQ2;RW(tk(Sr9^E{Hu$LVi%89t`E#*14`mr(#Oa5`FM^^*e=#~zy=U+*Q`AG=(xx4 z;0)8-j^|LAzZXf*Zd@;9<2)9|H-z{Gct61?a>~tmT6w+tF6;Hi8y7J3>H0VOLs78k*YdLFs9X8${X`A`s@(H z+OKTtmm+hc(-v9AwIq*-!yM8^^Y)Bsb*iSZzr*icix2*~F`4(^#kMNh@NqubNG%J> zQDbwuJo>IHM>LX*@P?dJVAkN!qH8GyCAjp5&f7mock%uj)x*t?56@S2 zGmGi5C3_2_3*G$+Sy5ZLevXFM(J{{s_c0DbZbWGfq0 zTjYsoZBZIi%iN}zhI_xv3rKF6U(D)TU-)oTZKo*?yut?tP%h?P&?Hp+fd6~iRp@lOpj7|-M`y{)f~s}$cEjwY7dP>IoJf{KySf-%xC+%*nTWsH8xexTPGXt zw`*9_hY?68xfF8%nm{97=Nxb#B*p`d~Y z$Y4)IFvHRqHhFDoq44KMI$~Q9KN2;pTL(a5D*riJouvcM0ftRx0ZZ(&TyRELPz*j0 znR0Oohh%`3NBBi$@~|}}2FMIMooFZzWG9>y-m~tKPdb@vP^oDfE7gl(ru+h@kz*QC zpkWtX&Yyw-z?M4xw}XuEFOi;z8AhNT@Msk}f_Bg$CMo4%QMs#pyU5N-)C@zB_8GpV zkZFtKiSmf!8!OPH*G`K&-!K$;E4bJLaIDJ*8Wy?iPviaiNq@qyiy`v^V@WXPi%E?K zJs}Me3*#gGIF-vRIuG;n9mN8qGHYtgB7p(>C)kKj)?%%1%Z%=L3v@^_eNVx9p=S-|9Rq|sXjnfEo?-a z2(O$SnphXnXdfa?gD2|0Djq*o&47r^q^S<`&o{M#al~Sru^R_eiBCe!3Tqi0cw{ED z%0aL9VGQm{0TswI3Cjg}Hl6Nw7@yPeZO;UYX=RtlVWKQGNwGWbY2csK$iMxKJ2DMI zh=VA;@lm1}N9cSVgfkd|G<2HAd?H4ztGmbb8|GR6=?^Od`JaepN}zsd4-{nriKweC zHA?uiE7ynXO5|%ZRS&o1Bjt|*`NKHHe$HvZyKnvG<@vLY6srd@Df_qk3YN~m#A=7DJ9H#-N9nP?`-r^%7>GLwieY4*x& z(w0TlsTRZ+LF}%tz5?%>43SVz#19J;a4)`}`c2_!i~%)(P!%w-r6>il@(96!6JGzOeP4}w-!301E%f~XlGK54~_W>r9XBd{(ySn zNqa1&!r69}4v*-M3+lyQC_j;4N!n~yihDF4dt_22nN$>g#$ zMF4-!&-Q-mg5u$(b%GDLdR1_7l^|fk;J9V95Q#R^9J``{H&7|fv^sAY%#YQ?9qFd?04w>A(VWo|dqP!#Jbz?O zNVgCv-0S!~r_1H)cF-vIWR}KAiwqJGDFmj@uFuW-y%fXoW^Vyx>6T36J?y$020PJ9 z{1j=bIZ6e?muWP_Wpx~!h%p(j+#@>}-PcpT6p@WMXr92iiqY~l!T!G^j+2?BYl`6f zIU?VC)xKUIeB|B@9%e=goP86zN6n*F`lIkjCd`3TX03PygnDz-=Br;PKzz;x`P}wBYVocwF^e>EC8~mAG9jrn=b~hIo$-JGrlH2FR*1A3ZLT#N z=ra83k6Q-rUlVLz_mLA6GbvY^{Uwb3EG>R5eIirn;@$o7%tAvAYS(ztb#${NQPy_W z6r`p|2f=H=eCc_a}yqjY06H{vD3x*%LbpK`8~yRV|a0uG8Wm-j z&-_4Og{9Yg`!5(Gj0=Y>F+}VHfi5;mEo#k(=bLYEY^5u*0%2+dL>mAoaYLZWH_c_G zC=>kqBwha_OuQkAp}~&Dhuf{E8?6_i2m{r`t$0u@daX$u zyJnK&0?Cn}wD5J8D&=uxVr8F1l<+Lc&0{bRVShTo3VJKG=gjk`xfc0U*@UJDf52&a2uJ^<*Gs6Dc!XE#1Jc|MqGcH^05?ABD|!p{N&?XVO^R~ zW=bcVW!uC`UF?4t+U*njB>XV@MOT%$`jTzr74}+fE}f1e#jK8VBPz-!K>yHlpfEoh zI6&dmM=(5}MUr8|j1`BPCpsjLp8^5j?g*1u|AycUDa0IRV58AB&gijzHg4ZG3G}U5 z#pWSsR_6hV(xk`^XPT*&P+i;?h*^XMl#$VV&p_sGKDPsfMy8a=8mdV~tvrH?Q^Y<< zr@RJNSVd{j#`cPvf~|6s5-oS~j3P>9jNzT8%{6eTstXFsJi))gl#o$YQZAU&(6NY# zFAA|l_MXJyfv$@I0AW6zQ(z@zIQ8af?0a< zXc!l4%Fz^2DoXhzH|9ePjj;y7?hm$m0OxO&U8)b4Wz8chEW;VZ2NR*GSl8uA?9rv# z-{Q_wOqcEJcom#l9;516Q`eHQE)Wwv8nCbPf0C$i3M?E?9)01&=P@1OD#KFiv9^TM zbOJsu3|=krPWX5m$^}d8VBv6X+vtcg_-ndhiBl0Ao6i4)Nzr|$c4Quz#nI}2Q=m6{ zGYICvq5!9%+c>lOtyUiMmvsSa-VX&ViL>29$*t6O37dE1ew8 z0|fH0bP*1D!Uc|{vVyMgF`7JfX)^9je}9U06OgPX5(E++J+6nYSHyl^DtxO_zE%}m z*)J_HXhdNUmEg~>&azeYLoLys1f>RyzdDXwBK34p{3;gL+`?B(bClE|3gcCDNbh6% zrOQ{VLfK=T8EbwSVLYF*j?1oR#dih32EfL-hOMc0EQQR(kOZy;!hagX%^8mcj^o?|N?WyBBk!a2TumL(P5!)K1wkW6S4 zuCwFCFlo#U^*_{mb=5{?F^@9k2G5`!)Du;*!;lpDx!>e;1`qBepXf`+R}G&v-v5`<;vK9p9HNYXM|L&h%b z$`mJ={@`WWWhZ*EYdkGP*op+xSqg&IW>$f)Z-!&FR|o7bn4LYCLQ# z!d>%lZS*2Wpv(;Zy!3j;9KV<(iSpIW5YQR%wRSc`o?Z3p5tGC3+X%TIe^(;nM9u~= z3yOSkcMB!q7qfKMJ;-GUwIgD6OPd0yL>3mb9xm$1&dDr$5;e_G4fqInp2@d&@q?;K@d#e7{q$^tR9|#CYk1)pY+1Mt`jmlO zhyT)t*PW47#_&p(uOfk{FRl;2^x>4K-w&IRvfQ_@63dC3louLn+x~7gQ8bxZWpCE1 z+2iRj?U++NE&r3^@6Yad1wAqPP@xihCCOiZ zz9g2I^wFaIg#A&N!PL|SX;@L2>1DM~o5hDV(CwuezMk``@X2CV!os{7U4Ld4ut9cN zAy9+{W0Va`eF!(-Ju)~*h|-#djsg0*u3Asz8emK0D8r18XQ05^DAtLx`=~KXKfS4D zLSS(D-Bb^0{w!Be1k-5&3zd*&FAT&B_*f_4=;ESgTP737HjynC+xMhdz>xRYi`4)p zYbj>Bim{+)Ar|@?!Ss(jW<1N&128#2rmh}bsrlycD@g3)QzD{4BLCs84LD#>B&u*< z3ScEfv5{!Zi?Eo4!l`4+4#OtUFXMJ-l+)*V?|nu4<9V9a$FLGHp{H#wSc0|LdlGq3 zXU6-4<{v2n?XU*DSyo**VIO-NAYPo7=q4`Gy9B?d-S!N7RSTcJ8ta=3^8 z)tFEVt`wwQ*P}Q-=NFH3`x%Whw&>dXoX6=Lb{wX*Ndl6drb%S7>UF9!xbV^LvjvHK zxE5C)mZlcgc)hMW`C5~u7AD}3KN*ZU$^a8v4w+aa7ciJ6^VKno60%J+BXjlpQD04w zna75vvL#odVMOl4l`xg^Lw~lJi`I1DZn=v^XoP6quQ-e+I1X%z#X^65M+`rd7h^L? zWyPe7f;EA*Q**zEUks=6nawJr_eXY@V;T%tpR}Q>n%XvtL@l}rUYSLF5}!yudH#r* zjwQ-fCf%(0+kbX}4;-JnYzkMt1ccQf8-JN&+-D9O%oD!3%J&m6b7D?6VGTods2>!H zg&LoqI$PED@=zg2qy(NoMlotTg(E#mvP*~AQH1-Oa*{QF63at;5w;7Ml3F#<&__Cc zZ?ravgcw9~I;fb%CqYU&-!Il|lRwPS)tqQVZ)!z59h_cE0~70#<>kQWl73KWpg+Lj za`t*&n*Z8m%Zw1XUFp4hP;LHe7h0U=R>F8@=E1d<<7CTCqNPIqS}^^+Was?R4TKcz zTa5{4zn6O9Oy|4}28vxpODqy9Q8d?%KGEKLR;;p^u+`$kgdy1CeN>l#en%RI7BdXe z3O1EMFpr2zT!L36%wcefZ9{aa83!ZXx+X#JNXL? z`-PuVhYVB9S2?lHwW}K=*=$f{@bGVC(4?|ar*q921Eqn^Wi~G4@WWqFM4alnP(yvHRx< zoO)qNu&_>p^jPTBfTYOB2~3GA1vsfCCI)sJRYLiI9Q^>ESCQd!JLAzE@fXKC?Iz*sXA0Up}s$7bLmd<+$DM+BJH) z@-IK%=pRK|&x3~khP|KH6$Ty-RXpOI?`{fvgU0hBm>Mqk*H>3veH^b>Z+Fr39*m#w z+PjzAl5JL!qp~79_+0d?I-hxFvG%#`%GP^TI=b90Rj$u2pVL46(Ak45uU=?#(;%9E zOwV~-99^}U+B}~Q61Z72nVB23-g{)o>BT(q<`NxFgf zIi_)vQ=w;@S*NW%E?jfOInluJ-f}b-U6S3uE~T9=}cj zbZAiBj#L0Wj&5u}JiDGnMth!E;$u7oDF$Wob~D2WYCi025cofHlg}0tuD-f?q z1~~82^_JyhhW_$It(C0)gCE+AVp%I`1i9r)Ml9;nW*(_6U+dCDf8NQRESBoTLG^{S zi{l%JXH^dZ$wm};a1Mq=2Zxb#l^;)(}anS@`ElNFCm1lb$QTW_|2YXQ|oEM00?`DM&y_HSL(l}*c87Yvgx`hVM1=#VN z?-z3Hj`cwI06?1f1U40O7m2>Ld{|eY4JcHfxcTeNlsa*r@qstnC=r7BZV3x>rI#ei zJ;A>Ur?euAp&YfgBS6dzfdk(Bw{D?0?z1OigwLOKr-c=SKAQS^j_B%YR06;(h2X%h z<|Y`&hCeZ9$Y#==$bZY(&^gT%h`%TwXF&HQHOh`pAhL-JQZPbv`aLE12*WU9SXn~y zgstKXRJUh;ky@It&hkKfXZ8&g4Us@rWgPlwW;PK7JYVTN7?yNwN|@Iq!7To_- z#gI%xq&={N1jGzYt894Eyc&(+l64H?VIHiXUGp@}hG|!9guF>LHTRYpEnwdOUOS;`X`$ zQg79p|D%Mexb(FrVx9+x6467#CZ4S|&dC#iur!m|LF4@Cvp~g8sez6EOShv zB`mlDr+XTVw%X|PgfN8&1ARH~2k(MkqqM1>FRGJ=rx|zr{oRtN|2X=LvZW5`ph=5K zk3+6Z3)6b7dXth{go)-va(9>Mf4F8;@+Q54#50oJfuLE7IzG~c;}b$<7*D!glft)X zkBOjko8RelP&}JCNqh$GBS4M$Y#b->L!n)g;LP^><|V7WlIVsJAgegXv~x>&bNrk& zR>ytwJ^4|6&RE(?l>}7j`M1jr*q8!zY*7T>t1j#B8M&C-BH~$#RJ`{&S3w2q6iD>Lzf=`%^=k|9-t^PBG$l1iIw-xs2X z8gBciPQU!|-JC(Gi04ORhj0!DM2GNeKH12SjErUuDBK;RBFk97ZAtdqPiB=KNo<4% zuo`$#{_+ugZk64CtlXSF5pFyF0mOxZUP>Xa+;}+=lzV^ z;9X7 zEYK+pjgS~xaRpK2-=v2FF`0wrhZO?r4W5lk*%gAv%;E0{V$^W~&PtzTUX`r&jp*p1X!x|%ouq^%=r9g$DRwDfV z&R3LtNWM2{zQ&Zd0x#UbsPM4>MVw}mkUt0(GM>8oUte96&}^`fdNj2JUK5fpeH=BF zlQYZ$1XcfIqZ2H(RqgX)@6&omJ68o%v&T(;_tI!pgKuB}yERQJ;5pODA(N^UaICY{ zt?!Vk;xbT$*VNR;pjsG5Jg~VCOe9die>%&|H{i8SRt{vEvDa^yF?#m0=np}o88r5Z zH=R-U9rI53HHY4%Ei!rFWFqaV5W|Ly7zBeH&*lN*)mbdO4r_pBK5kDqIdws4nIW;X zoT|EpT&1(GC6}b@_gtL+k29Ry1fQr!vq|8Y_p1WU&9c3E8cs8XATh_4+Nn>qTY`XF zr}MI)8)xng=|cF$PivwDr+@s`*<||~vhvmcv^DSy>*!B8yq~r3f#CZu*GOugwrLNVyFQ`e6OMmB!wUR2jkB&5-ggc+v|>g!1FN4%gtH)8qC>Wy~Q$3)@j4{`Y*0uX=S!Tdh~ zgf>7te77Y2!b7yBd?z5R>?f!Wdxmuz;`^ z{w>kM;GkK&7a5L+6pA@`^XNBb(H*e7cW1Xf+2@^IlGYH^!mBc;b~dQ6fN?MP?3oo_ zhm>R=mVPa6BSFEv{f#X+euTKMQOIr3B9|NxTciwQwhxUC^`Cs*Oac+T_Vp-{BE*(lm$6hfd3-54cR z^hrCJ&wV$6d#By_XIy~-^n_RFna5yxb-laDSctsYk;p??5laQzvTQHZ+;~ORH<_Mh zNQ@C>iy|>Sz7JcU9iBGa;Qu{Qzv3-UB@M!76tVkpo8YF!J&+Wwl}(8zwyl;iefG$> z-t$8{53=-q*{h)#yzK#NCJs;4?euS3!{QVP3(`Qre3|ed32O?3px^o~#Kj)K=mXH| zRBCZD>824;oCCJ@#=_7z0AOOE`?&%Gn*XJT2JqI&vKe(n3h^vAc#J%=6*&(>SG-#? z>Y{lTeB`N|hWXR6=CBl2BZuU(9I1ShILJ+5I~M61hKH@0hbW|&j+}=A+dGZpuvrW= z-{AYOZ$*#Mg6qH38z~4h--H{0F-5|Bt*Rf7-G|!@f7dhb-aKE3kWh9kYA}j}^m!Ik zgqDKFeB<|b-XvyB@=f^6yEh;bAnnqlzoByCkc0)0&Zg;P83;F7pe@r{%qm~g87sv7 zq#H?RI1RbysG^hEIkB@}&}bP=p(iSu{=ioh>te%H=qWSxy zh3-?{oP9lUFiSfBy#S@LW!zTbZ!O!qXTR$!@Q5xO+kSX+%Zm=-pQ&}hq_8TLl1lYg zk`o9@#YP%P@dQ%ra*;}zCeukrh^x+^SJg{8($I)$o`iyi9JLyAV=TG2lzzs3dG|7D z*cxI;F4b=-IcXH}$@GUNwN#YesfLf+*||0-$wBYZ6qj(lce#E%H$UBa zY_M%#35Qs>Ku-Vj_QUX zIu^r(?1swrs3MqyVwZx^)NrnS67$*p_@;=Hk4oz3DN}sw(u4lR;c3t)sCN~xsM=iS zcvoqTbe*P0@9hqJ{Op=+@DpJH_P7&2P)jTk=_NOX05LqtOfS=qqSajM8_TRr%y@>% z%;1>Y#8$}R6t~VomJ5D$p|AB{CItI4xlF(1z#sYs8DI|0s_@{=LHaZJyR4m4SU_)IO=(?(AAbJN_E#2QO*5N(6t>p34zC>0H7gt6h19 z_nL#NWmooIXOCY26)a-*EC017we=%#jlKu%3NOuKrsD}V=ANTpT#gkq>9fJehvr?9CGf*^sG=_4z zBsxHZkaU>rVd(`^^n3)(F2sMi3cew1sm4=W)FVx@edRvkUFWXrL~gC|!LQ$_=7s9; zA0*wU%*z2BKp8R`O$GuVVc2{wyH6uzRGJJCS-FYMh(QCpdLJ09I{@Qi@N+Z{D4}bi z)KZER4#V;kqcQ5zq@!;coyxRy!NCwq-CsL-Rh&u5rdhQ_F7Yjm)tp1Gu=NXEskSMe zZyr~lwvG??Jz8jxE~$~+`4FV}Of#;WyVzi{VhNFA)Z#~9RB?a{l*U-+qON305l-ru zGmAK{W~Q#-mM9%d)=5@H*yO5UW0Z>UH70~q=lD<3@T1~KjS)>8OJkh+Pld%CTjTtx zvAAFaQf7|k3l%aGpZk5Ps z-v%^IJ}36#<+;Og^HL+@D8941?3#35u=m-1m(IOV0ne{O9+oFeDyya#wT*Mg#PK+) z!EIRjEUHS+Owo<=Pk0_aG7;1zcs-44g{6CNDXpdETA$T)0u|t3=(GNtrySvk9gkz* zIIj{1X3Sv@ZN>4xMozS=xC!9Yc&Fq@#0{S$X(dL~pB57Lj3UZAQ4?jH++`ENO6bq*>LMON_IDD&==x@1%Ar>;W zNy_eElhp66G<5e0<*Wt=PO)}l_MjL3MPbnrCS<;xS|Yy*ERA(&wW$x}ZJU2`7w zxH0&l%=cUbQ(D$%t~s6h;Xs#uS?&?E_*AF_0$U_hfSP0zTv}qnh%fcSQZSi9So&;A z6j-M*jIwHR;uxAx?7HW?I%=h*f%-kC%vBaEc#=y0|0ZTjnPU~>*vY3rv@nSXnB4V0 z9%WQ{ObaUx^o|@iAjt{lQn)x2mUDxu6QJeMkk|;Ju!@sjRgQHEjOUPeN`S!BG$Qa( zQZ6*bux5X$UnnD&mQhyLr;652ClGM{P{$}1O&|+=D?vL01uG>N$1dmRNUZN$H~ngy zax!D;Q%keUBH61MFX^XL`+1w_*>8+YGev{|OMNc+HcP1a%MVW{cAk=nDkJdHnM3%M z;k>JuluZ4!EH;0;g^)D+0GfEQkS>BI!tqpNw=PI0;*`_)g?PkxnYnz|v zr$^WKLS~mNReA>}tJ4Q4#KV)YH`C(_M=>X|;kXX+F+WH)W$Q55)A5*KKoHqI?Hyc6**eURd*Y zowFw&x1Fz%!Lm)Yps#0vd--$Il(Ii{b8lRnk3npKVUaZ(b=$C~+b8AcapJm2HH-I$ zi?pYjGXkD0?!Pb^4HHMp_br_7S7cHj^p-~PZE8gIE}BO@!)lE-&+Es{nA9v`98(RV z2BDYhdY&O;y*?Urp;QKasn_*9du*6YSNe6yw}d z4&b(j{P8KH!YiW6RB@4feS?qk9&v63##Uh{LsGfFs1moo420j@1R4^7hb;ya8piI2 z7TO49oJoU5Id1Ro*H@Pr4WTVSKRt3D5!oUm6Co$n3F^w88y5BB?}-KjA}J_vGAUuh z&yf#Sg9U@RhxXK3@&7_Kk;k*ukuMw3-z~Yw4I@g2L?#F!_|Q8hE9AA6j-y`s!otx)<9nxm)LoEk-i}6( zRFs%6q9kaWWFmcRrlUR@?N1vgYJn%_(DXPz)L1XkdR{bkx1}mY^WpqliKNpz4)zC> z1(dGiB2`BEftRud2=j)8Z{)`pE|Cj`OAqt37QaiP0F?H?v7#Ciz}<8Imr&#(6NJ|3 z9!CKgLZH^pwq(m>yiPQS`dsVnHHP^vO232xZ@2Xst1UVG@3BXGExo0!lwosv9dks9 zIM+KaNcc}!#Oe3vt5@d|=L=~qcUwo@M96iwL_QOo{S`>pdP|Ff_$!1*g!K65r&%F( z=c6vWyXC8CThL`Eee>()GFAib?nyK#zF(Htn~3Xe@x2_-MH@j7rn0 z-{wks;`dMfyz_cg&bkN$0=Cg#r@H{_EWR)2V~fiV#z#JLo|chhPdH+z zhJts~kE=(GZZ2H@lNs$Yt$5qwt*Wz8R9x5?wFec91~w!ZQ`Zdb(=!n4IRgn87~W zt09*3FxJU72PRPD5?u2rinp}dhrZRTX*fOdx~skYNHjWrm&63$-y!%(b7gFcs@m;2 zNRU6<1`|DpVL(s9;JsAWV+M1&#%cUt4%kI{-h(S{&!ojf9+cxzSBMMVXM2Dy zF`pAXXOE5Gf4I3NU#fO7JAX)7D7fEO*q9q0t?6jJEq;8j0D0AzPv@+Yu2SBJ$wAGI z(=|IK$%&gY(k{|m4KPUr<9%Pb1oeu2WjU)CezCQTqUMKb)1f9aP7ZKF>)3ji*k0;j z$W}fxo`Sx&j6lV@-L~RGu;D%4)$kQMtRSVpMlNrQ;L{;!&Mvg{S0`1 z-pqJZ&_eh4)>BhXE>^)6;oZ#kTo}`msQVDYrrexeyt&9b6^ai{rB>-C{agk4jFt$c zfd*lSuk_#fY+RLXj+sXB1?}31{FhvA3}kZ(pexrKK&*d3&?c|P^WdfWtGwcg+nCx} z+ct+(DUN~HOs2Zz#jdwCoTSl z{IHm@=T@+O!vYH)y|*VEuui0K`Wv`Hu}x1Geam~CDNplx)E)H;Mh)uUc>~#vg&FN% z;v;;k$@Yd}q4cI6*OT4bliqgP3jqhGCmpg4&eM0iKLZpQ{bK*G5<|r!b()w9J5P0}8Gr9gwFr)Ni;k5<-S;Ohu zo#uLe59%X1$MXi2?Qa^)%@XA(9;5FMgBFer!usc(vnXJ**a0>z?~$U)@BOTI^35r6 z+!QjnT`X@#v7U^My|?i|1@aq_1(N$8`1i*hi+moJ2faSOpFIt<951j%@*9MVI-2;s zZ{3aNPV9&t%4YC7wlrrsS(xAvy9Hqvko1Y^$*fbtDBG6zX@d z=0|G=R}?H&GzMKIr7$AOf2$1JO~qe`xBMCxRL+CFuEUG8-eZ)`*OD^d(nWaM)LZs+ z@>WHM2YU5jd~Bcc9+PS0sT-@i?k@}OKF-XdKRvCMQl+L!-CH@VBxAlSU+-k5(dpe| zALgwSS*SzqpvrcczqB{X0=S}G8|^=rv>(Mit@J}vWU zthzVe@AhZOZk0I6ebr}M;eeaTt2&pN`S?=b~^G$GEJUfxJ9tGYZTg)RcpeHGwMyQ*T+Bk7jPK6Q6p{@dJWUp&OW5~ceM_OyIecGx$KTWArwEy+ z!hVs`#O8cM=^s#a)Z5jCzP*k1IdwU`L-~^%aLk?JhUNOY$YH1Sni7y1Ri6;cIdSh6 z+~NsoWDmM$0Xpf?ecDV%4A zDI*@7zur^}x>XQGUT2l$h`qTBh^SJbChqOhvau6UqFDI0jrdtIW}aB-Ec9KdRz?xi zV^^Q%s|HUT4`9mx!mDI>vfW!k=;tx2jeCd&l$RAT z$#9^n?edlr_kKYJzuvP1nAoxX`2{m`x&2v2*9v7 zo3F0?iAbAAjlxXHSzD&3V`6|AXx;fAKI*bEhW~6{|NAXHz9n}^K+aNFrCryx-vV4) z@|#L^l*QgAMq*3OB>V_*dJR@2Qok?UZQo&a`fP6ynvF}a?Os}Cq8W`=+HrOMN7OZj z*V#1TMr~}fjcv2BZQFLzIE~qy*tXd?jg7{(ZJprD+kS7}U;A9=>~%f+%+BuIbI;Cf zGu7kX@0~RS*WK(~AupdwpNFH91L}e2Hj;L@jDC;m@F5|UP%Zi%@j)cTgeRw5iM%3x zl47(%YJ^Mt?~#N5j%i@4EruaEA1gNTTxXdYQ}?MKJG8NSvf{KWl4ViCd0~GHKK-E2 zs6^+MA^LFlI26BYB!q!-p_#Hk{3*y~#hgF2wwfoy{l>dS*sdChv3lF3pL1*YSQhTr zR{l1962JFYrGicoR%?405cQ7&xbs||9MMj!7(<}%EAH1AitMr^4CTj& zQ7P5}OoB@6q_scdX#MBP#t?m{YDwv2nRUPx<{hm{dAVWY;KipAsevV~l@5`fOfLor zKe5Q;-P5xffZQO|(mgBGO3-FCzW)WjsXIlEF=o_aG#_(9M@7hi+rH<2cX~-?dOtjX z>yl5}`p7ikiKa^VXX^&IZ!f8mI?mq@5%#Gr{?O7lz_`6twuHf&cjistpmfieBQ15O z?Ortgh@<=8=yr*=-bQ!vHo8SlzR7{RyJmBnl2HO#iUSal%(*`5CDma8Fh4Hs8cB@% zkfi=Wvj9bkNZB+MXv0k8jsivO;}K~$kj>=y18zE!y^5Wu+kbkBqV?NICWb% zHV3DkwDdR8srMkp>+RZ9ZjPrXt+vY}@Zlq5vW~AkJ)}$CFPeARtrn_aO#*{W;^baR zLJW>_QaGP4U!fIQj)`U5I=7OG7bxKk{(jKmz|SqE=LH{l9MsEXyG&HEgCq();%^Z5O%n<=O&j*0O}t>$t5%bV}QcmKXH z)7n{`Fa^o=R;?}|T?yGP`)fN2o@rW<{PwP;rYMpn*`u-%B#9zwR<1B(D*6L1ZepKOdL2+&rm3&cgOQa-<*J)X;=3O|8X=;~Fvf`*RF1Jrwu z{vK|OHQZh*K1xcB&a@d7b#%oY4?!s6X=?45`YEOw@9u`VE3KChu(CtFNjq+rZ#<*d zLt+}jppdJONTQIBu7KQ4g{@*hKd=2?O&)cJZCX=R$HaaOnN$*@$exC!*bZKysoI8e zw%1u1Z#*7n_m8jEC?-a1Z88wUrS6HC$M;cu!EuoQ<+RnmXASA?)Fm1Q!r`{h%op$S z8!Cs#3vlJ-935@FXMg_8gukU@Gud?EeLhLFU9yNNWQ=(xXt+5_eKfvXJM(#ZS~Pxi zZ>q+7vOkQlakaIH>Od_-@R{nOW80NU{8`}bGcC&WVz-vVfq&BId2jGkoru%Y<96Il z!%Z9SemFSb%ze;*g!0%c4d<0Lan~O_mrms#=5)GUjrOQiFtrK@R^%D&$Ur3>=Sm;^ z{v71~Ci5Lqk0$=>-igJ9>*sG~_5kIBhwXwk@7tEs%yCZj;j5_?_vf-kHogUlKHgbV zIvpunC)ZEi1_=X}1=5nBl%gb~;5FgY5tj`*_SQ*+L9FVrf$7w+tnB|WnunNJX$v#3 zV{gh-5G6)bT}*UvD9{32$+lKIatLD*C+%BO+Ag@jIC%hCp*EmbiyfXc!^m$@VHTw(eS$bH_I*f%DQ;ngjMZ2s5aimTO8q}fBj%A-(<_DTWhf8-?a&{UuNhXQfidP#`v*wvq z%jANlI)#%t39NSpQPx@WdKK` zY{8X*dARlB-GT79*SZbuTnx~6QFnJ#P3^!-nc~ZoUaYa~a-_mLcZSLPImKo_RAfSt z=k4X_YN`r9p6Qu9?vH2bif=V16FU0o>C^MMN3Lx&AL?CjP2l(Tx3lU5_8#C3M+uOx z!18Lmi;9<<-Hs)`C%fYYaC}~$r=m047aLaBOumF&?>X(3=iebns-b~)~Vuy}|nyb22 z)9z0a?C6Ybp2Au#2u%}k1u>zuJRiWcG+<|XF2Wa|+C>m=a~&>vSl}1MX<@sFaFO5< z)-APG{Vettj*m{*mzq^ai1_Go_h+kK1z{ZMz?&i*k)hA`}&JjK3oK$XGR z{~uC9-)I9HUI-l?n%b>EPOq~&a3qOwz)o@|!U%K+ZLes%z@(K_IX*C*1(%iJ9b-n< ziS7z|vs~$y?I>e#R}+NC02yNmUmUK0Z}&z7ewNiyBtGDx9U+rJs8s;){-)p?8#<;) z9%ZTj#h98rObpM3yk)E2#TZ(-DfG8s5aahFy~_{`yV0BO&7I$+gO3Au0NFW=*9+>Z zUv9UVuNTLPz~Hly*SiI7+>W0Z=f`}yb;%*ox1Wwx6B{Nn_8SD<98}n^&y78-*qe{_ z@(4V@v8O};L4-4QIHy#da$|6!fJC@>Y4sFFt>&n17pZsnDUD6UMcR>q$29Apkw;)o ztfOzN0<)#a9W6*f_H3@h%J9fxef!`veqxp>A>e#>w#2qJ-r&-lyy*qpv0sNHQ$FgxNw_{sKbTA!A3t>1ogkIVMv`OZpUL$!)lkwl@CKqx=n|d zxg?RoGFO9p>G2NVnh!GpB9dQ3B?&6ko88o(;J9eFZ1tdBD>obePRD5hy{jlsG|cAN z;Z^s=c{Q)+v@CmO5-TIw2fkI_i0<8zXOAhy*yNrSZH6v)T`RigqogK+PP=QK6(Ev(C8-E~&*cWH0neYdt!ZUv z*!Lc~Z-%XHfMjRim36x#$FnXAe^ zcQ(hi?v2^AjtXp1w|*CgE^%0Q68x^>a60k{M{P^cc+BOIQbgs?iG*~J4TVPB+r-O| z4%E`+eJw;I!GP8kERK^HvmWPiM&+0i{S78Lc%bAvc0q990IGI5frt?TPV7Ey4c^?9SogZE8MAit0;>b&@&;G*esML z9*CKMrqE~=xT!WbGCe=7pUD%97x15N&>8dnhwdmprX@$@r_9~YQZ3Ev_8WI=7#Q8p z*K>CuB3QQloOnT{44VSe2eaLbD#S@Q{@0xVzF3l_H6HEWyr~Muir?X00F)Vbh!18W zWHQ$eY+rPMLuiOeVLY^xA4g0?=k1cu7so=-RT*^t>@F0NU44?YdI=FpJ9Y&uTh07x zAs-o37~OS3YENHI;&}j8k7r}`U00`8QIdt<&jIed99s}cg3h#+zs6eczsrO+tJv@Q z{YePP{58f6&voV2lPs!~jFSsVDNYh&j2<~esVX)t!puFVKIZ4eKcDYQW8l#EWH9Snly}pHmp#{%df(DN|G}kd=9OxPzqM`Ga<~hvMm3c zX>OVPP)h!Dx(iY0fkcs6snLD@#B6DJh1(L}uHD$s{^m;8g z|5}7gNJAsnE!EnVH-kVFQMfQaSwTx*VW_U7RZ>FhNF0Og3IfAb9kSym1G5-yODNQj z07#qfUC_)#-w){LIVKC|`w?f~5ta%2CrI(nFOG6%%l#78g9=Nga)eSwk(d+^Llj>^ zD3z}OamF(rN^Iv#-ctn&wsa!OI5#a+($$8=w|Hm8jFtO$ast(bgrDRM5j-^F!avn36OOc4@`MUF(SqcWcVHcfna75xOCk33 z&C`8PsNS`gs3yisSnI76)|*lcWSB^bw>0a0$OZL8B){cOl*?#lK{-`xBuWG~2_44U zZXpuL;#tHHjFTev;uUc^=z-8w-n3PMwl6nO{+rLZ>0eF>+TDXzEvHAyQotf86#J1u z7;|#@r6Y)HOj2ejEl^blv_bAYjuhP}f(~uZ0wY|u!@T)TL%1}6w=ryrXr}a=QR&Vi zb^%0F{O%{iAIq+QbYcuI1(L9S!XlR$w=VO(z6=Y1qP>MIC2RZVMOsN&+@w!DeYDMW z&j-ju?)^4?-rqu#rZ|uqyop=M5Bd!Z&|o0{_^u8_Rv<{=yL}V@oSN$Ow z-gZcoOXg9T7rHCrBnL9C4jhK~NUvgxGEEi0Fw9%GU@3|Z$ z6SoJwsW_lu$Jf#03Pxis-))k4IU7Z(6YWzm1q1$gKHw zamKI3*U{~~MkAynA+<->fO?!PSrWQ=BEjW?Yw$Vh`qNNKe^8H?)wDM!LM9a|@0ic? zbCsW+X*oVJK5$SxSR&An38Z~sW$Te;M0RrR`>&}rRhe0aVjPn#hvkd5%qjAOo@p;{ zF@tZ9X#j29Ra1DZQ4ccG^jV4yZf9&>*`_6$jN4C)vf$9UBk8t!jzXXyBT2R@45EMI z2cBT5MBr9Yh)9kBMO2iOGIA!ihz8PzayCxiAz9EG804)Ft2hLH?Lxlei%~Wr$AHEZ z4#GD!!SjmQQK%ImHycaFN5m|Vd!S;W5K1OfOQ)Ht*9@zCNdOZ*fiV8XgjA(%zhjN= zr)if~Lx_5B`O^zf*!DzepttfNA<_Pn z`R3_ZapodOxdJ)dR8Tq2(sc~+8>Ct?g1>m7--ji?J0SX{VmCLWK20Q9_DVia8?Ov8 z>auV0f;TS~vurH-N)5vzminy0!117uY<(V2;M5bjX4gIOrDh!U_r=-nL&vL!=A5&h z?kTH-*5|pkK%~-ct2!D|W0+vi#4!m5nv6ZjwvH?qOOY(QU&fqSr)%bY%l83H?fMfb z+l(SnC(n7vt-6Sv9FOFxu`i>UhXpdcE!l ztQRxCu6|i2#ZO_jqH`^(e41OskMi27Yv-x_u{LZkxs?OD)gwZ1vzC#`=R!$shcZTh z>LHXTFQTtVXdGZcihDpAPfTo?8Fr&xMB5aeV^axSWMzRx1Z_#YuNWi;%%hH*2>fx_i^ zN*hub$hTg8@23Eeu^!sDXFPS^Y&vO-+MPk{!13@^caLswS4UVNL1w*vu0|K47@r-W z6m#}ZB+BVF2+k6jwQMj%Kk~N-PKIM1Gf7Acx2VSUM`Jh=w5<_jTeoq!t{|5G1a>-5 zMOta17XBu%#(xCndb`uv2_#%Oul%;5d(-tAd=yA>3?{Yii={Y5$@}#$z;w_f$O`cC zW!wZC!DLOYKm(98C`JunO{!CzyfOvg7_P0BLCJDdAt1hoUlhj%K9N`Mf<@G)vF`LV zW28DDhp|0VV!kNTFWZwHpGdkTZ~5ytg%u+F!2ld6x7XtHQ)EOLyuio#n}i|xsk+cP z#~k@&Rcw7_s>v5!apNQ=eOZEc2*U2TeGsd9b^QiGwnpA$mB#U=WNaemn=x$hdv*a?g28Iv+<*5chWWeV(H4L{~Z8S!}i6tn6yEGhH9>LPm=i zRYLj$vjq2b5vf(S-2GgSfT|=lu|9@&7Yx&PVpaPozdu(2hH`8+oZgoc(O^ufjLxVuhGkQDwMs=QR$Cfou?W}7 zEbVDO<$)zuX5S%4Lqs}G6vlS#?Sw}O%9h*ci8QhVTI!P&r|~b|()*JnL9EjIvcIuQ zM!n4V0528B&033NsTe3}M205*h<)gTX7r*0SQtf?f?Z}Qtg3P7_nC}ixKtl3eJC@a z(G6zIP?;oK-Ls?@p~u^deoJ*DeG*qMes`hjQHBnCj-+GiA)x36z( zk!2!YY-U-ePYVpsVHav%QBU@S<>%xX?dT|u(JYR_1@!;6^ zNa>CCN8#~~s&sq#v#aqhO3C|hR_Bp2RKbZzi3K%~quh*@GAJ^z0D=9S$EqNIsj1i3 z1rH27aT_YlYgOcreF?sT&gV!-c{qLiEt)ls*8^hl)Hr*7{M`Ben#z$S04qG)W!sJm z!dRozbR!`Vi42cVTjtJlB}R<+TFb<9i#P$x)wDDnVXeu!B-5ADec#RiNW_nVKmfCdUngn7ANT<(%G5;asmwxkZ#R^n#Sur$i7U8BYjoCp3I+1Z z?fVKsz~k``5Sb4n5Zdm3f~xn#0klu@A)h+&1&N{`uQ|~89rk;Uk03JOkd*uu*x&HU zNxsOnAM4EzHlP<=e+djJ)%}H-dXF)&ddgCl@Wt-czvmf-ab0)cY;~6V0KB;wBR`O<(_Yw2tjb!MAc3c zPjzZF;8q>NzKxLSaMf@q#}KX<&4E0IB?2ihVWL?_;vDt!F@cBX4Hh$x2*H#N9tqc7 zc{YdFWI?)|YxronP9=IQD+{W@!eduqD0(0yl?oL|Oj{D|#(;6YPMY(r?xzP_`3}F9 z5}mz#8*IoS&TkdQVTZ}VX2KjB>>Qy~q}gKX${>p{WL~hu#v=Sccy^`r38VmS{5qkV zOOu>OxnX;5H*NcLJA%jjuu0xT_YjM6y$&-Dy05HA31oXCJe!x^?a9!5QAUqGwKy>_ z6`av-i!cMmC^sC7OKm~30GJBi#KuRhkJEeZ-Kn%#to=%Z;vEI2-^-d`$<8LZrLi+u zX#xi!R5Nq`6_qG$!lTxzlo!4QN0e5DQf4q$HTQr-6Kl^BKVlVH+`!zNU8oFNe}P_9 z7zdtm$D(7So(stB=sd+?8BO~1s)I%sNn;L&r!LWC&wzB?h#B1-w#M+6Mu7UJgb9`$ zW1{*ji8c{bsU$zRAx(^Qzqn6o(U0fua>`vfcq6Mi*YFm>59McZC z!CJ*e@Ln&K);sKsGUh3}9K2VP!yq1#6{5nGi>mD%+|ex>dt6}#~uEOfRdjFLd%i0zz%?~xgd5;}=_BSQdZ=6H9AxxOEb zDH!ka Vjy)>~{eUrbCeLg4K^#h;Jm2`Ih!TB8**Cd-&_7rd*ErOSRsPzQVQm*?u z^4zG%aybN*pR`l0neE#bbFtg6l=V2*GG?VpKVHnuD2o6}@MT7gR}mCvW17b-GfGmb zKPLCuuTVqd*%kfDCW3VTJ~cTylzLzyNF!Sboc+Y8I?EJt=(H>Rv?yvsYQZH>RJc&* zW4}m>H#WP*%lq=&uB}8Yy2mG8d~Ks(@B&AmN#y!__ky?**PaRZ|%1|?F; z4JbzG^{?&VaQ|)u7pMnoLTC|>mbnRy%WmOLWDJO5U-HHh#`s|=M2*l+QzaLpWd~(( zZPOC!CDK5YL@_PY2!T(yly>`&0{9Q=IeP9)@^(c#jRV^fF}95;-07&~tv+}4r2Ue( z27MLd5LXt)4sdQd{5%O(#={4#eG4kT{h~UYagrI<$off^IJrz$TvV2gU5bY;{AFYy z(swM{zfP_9dSzYV(3{%m1AwMCkB&!pNAw(ncyMHMpQ6jK0GxN(V$uDlS-0{Qn1M_7`H#9~R~b(=^i1^fov zGQqxFj4=?lQx(_5~jkY00N;N7i}J*1!FyL zV(%tl%A9Ty&i@HESp)vq6orwH-}b3M1Jb646Q6GcihLdu)*(41A_dZiMw+oamR46Q zYf-%L26QI!rbkO`95VfhS*}@b4RyQ530ed=??U++*KF#dwa+X^YB<=1IqFpf-yz)U zb^)VSADV`Ja-t(h2mV6_qW}UyWLdA)7j%d#%%M(jNwB0 zZz+ay9R_g)IJHKom9D#5cAW*7Nk7S>(#lRm@miC=izu z1NXS)xD{(T5A*EKrRWBa$*;q1d%4l+V6uSWyWlMGc3`JYv#wuV<%SOmy@t$R0mH>T za}*5MPff{U^^&H8PQI3V-CK@>PF0~U`2T#MWg(arSEb!aE410(QcZF2=!5r6hLaHN zV64%iyntjzEhm!n+~+BfigeL`w;x;1s=BK~lf?(Q;U$?*sust&oJUhv>LEvg35qpd z860C=86<=3oR68ZrdSrMr;5d+Ac-?r=kxtHn;S=(jJIsR!*l;JlPCZD0zDUA>Z_Ah zoSg?a6r%`s@M4h-H3A?P0C@Xkn?}&mK8SC8vq$Azm-7=8MZD~5&&N<@n+gxsh|;{& zNe~xN1HPI3<{C$exBbO!$=LhKZNMs#T7EQ9+Z{AU%EfXOEJ!Zq(4;uy96`E3Ivf zRy39tU&yDyLOw#78A>1)n0XdROo;b)WTVh3e^*)jdUXqDXQujZMLX;kEehrMk54Nr z7>ex;2VVg-Ryw@WseA3MMlKhl6z%oayPodOqk{(lx+=l<&9jP_MUDu*W4v1TytaMP zYX}=DOLUdHV{CNkWys9QN@RxF#!2mVex5zRI^T9yq@h3Zqw(4ha1VspQT|Gv>0(VF zsfs1OBln%hHkDVTlnXE!G3;Fs4@DTK+9>y*?R=~WxI8owc$+%=Yv+79-p#8jFm{1k z)*cPl=$o~r#PkB+6}!fZu%<=0*k|2fuO^h=NzBwkk#S>$xVaNk4;6LdSQ@Z>LY$34 zyqgPw<5V-G$nJHCZ-zV{Qj4(CF0>U|Y`cXKCEg6XYbpgPCL}G+Spy}8ReNTT(wwr< zEVql~@_nJm2av?5$|FCFdwUl3>t8zqr@Vj&NyuGIIXB+K1S)*=B-DpvOj0lm$qkVq zBa)z5&rQ#69l%Y!%7I2!UxbpA4^+Z$II z)d0nE4ANzTn2k1FtpS3Ih;9d(`cPkjKU-!o7{)o3)~`xX&==l$K)M*JzI8HUXK6y5 zxC)XAWv?a4Fk_|O;V+1%|Hd0kvaTu*`a*sPNfsHE6(zjFUqmDjU`xpc5gsJx@iZFMd$(J7`QoL%($V4b;C{!4Pq1jZhbu2ll@QJWa3Oe}-FBE%t_&W^Sa`Bk zh4b(>5tX+6l>{}qRxrnUa1^bd(n)fKbS4NsYDF0TcmGW3%)f+A94hryYFA>6VHOvg zS|cEA_Kc8Y6jAZaeW5>cO2|VHtu~O& zW)eJ_*m8SN_*N~!>+yW*d1|X0;iP-`G?&da)4LTI`pHG1)w7XF`~XjvR(p8RoQyU7 z<27pjHEvKp3w`!F<4Fh^K9Z6Z;grZ914P(qyol`|Li~9O-90(ZcP#+^=2;cE-nB1Yf_B5ke(h)wzzA&VE}JXTz(fN=gl~ zkpkaZaZa@}SdI9+5fP~+&F=OO3KV58*l_G(nBdrOL;PGkfOS>~Ex}p*IFL^xnFEMI z*0Gm&ZUR_?JqkE=f7n=m$D{1iglXh$PN*B;H;D`Z|4i~m02eaP{N7iA(80tRI&W@{ z$UPhmw!P{(n`8^?h}0X_J&`E)rZ^*;{)y&gHv^%o>2G0Pt1FF5E}bf4YK-myfi-OT z4|cbwA}%18E<7DtDP{DI76nZ|_z6u{rP*6A>ZZA@9vL!I(@SbDBwO!`?=G8KTe82p zTUmj<2ty3L0osnDuM1xhUq6Bm5mEq=)R+Ks;*vdbzS1U<#BYh%Bq=Gsp|v;;gZTgH z{(nsWVvPPO0u`5g&nB|fQl03ge}~i_WwE6VoYFU85PSIvoO&M4^eM}6$?kW&{s~mI zU0dkjbp#~9WuJya_~p3XMxk0?NXGZjQnumjIgAGR?^jpDHGV`BvNWTa%knn^(3LHR!dq$wDfnqj#om&zX{#M9`px-PS_bkHs|U*K>C^E3|}N3Yx4@Y|Zgm zi~jxuN1@m+)K7IujI``7VT)I?pKrjL+2ROnML759$=~29Ek-O+&nFQwHLx&Lab$ax z&ECn^bZ=jZ2d9No)IPYaNwi;AZR`W zdq30S0d~ch2cN73C1R8UNVQc$X^)aXVKnxGIv+5VFSh=g=v_no(SCW#m-z?wv`}sX zUU;Z8!K;f+Du*Pt1~K97RyOo-ffTLcbcjObWj8smF+t7bcsV+edo0U5zR( zIN#lz4qs+JRd{{d;dp#rm{@buIW5;!MfmMOqNT7rfkV&Q078+o`T?$-M0grU?{f$$ z*s5(UD2>&;V}7CUo{0- zQ|;)_y*Vff*0)3ddP4Abk+iCRt~K!^?+`wwuJQvTo)@!253%>j;u=f@Q`~nfB|NHc;%F^( z?7s^VM(^um#at^A6%@4WXFL2&kI38(h96l`>X?xLcTiG7u*RtWM$r=)$KL3B(Hs&B z=5SBv`U(Eum07(XE5E=q4hz9s!9a--L4$bwk0537sk&B43*x7*&)Dq$qWws14feA@K>>Gb~AOUU|TY~~>X zq(P$Wz8p8=X|WK|u5?UvlGP?um4TaWkignuGv(@ZTFxGfN1K<6i;Lb#=33r7DO?3; zn_?WxK6AsFHQKhMAyC!NzdTy0vnQ25_Pr&zRN$SSYC*ZKUurdtiNn_gYC&vE-HqC_ zGd(HLgmmtcj-mWvZMJ1r=zpbSgEmeDj&;-?9M&9ttFcn!?b9pUlUev7HC=b$mYm3v zl%dQ9Yftv>#4nq3$eMkHf33iy(eItwlD!+hi$>_qn&YjOq;3v`Bbgp}xkz34Ecs1! zxsw`Ond)=ep{eU#ZzuMRCK<5$HvRHyB|e-&`$DO_G3v9wV)pe{zj}gRJPf2Wf%yXw zHhYb%w&gd)SzDKZ3FD$M`(-Y#N?od^3{YU1`5_vCJXqsBT6kDiUX17tW`a5e_ucb5 z7meIse!{dg`bE~S9GGYr6lywewI#Y2Lv3w;Is11+&2?{wvsefYs%!f7p2w01bMpVPnO zY*`dZ6N?uXWtmez$m&&M^gd&}LraDqI~`ddNaq?K7rR1{EQklbZpb{n5<35ICDLMq zT+4-IoELhE{6pCo`G$8;(7qIaT>PY75^+)%1$f8He#2fDqMSkOQxjK|cX=iTj|HK9 z`HwGxrM_T;3(=hebfPn!%MtN2h9KU)sGer2rIPicO(V&2`OCA)%jEu%Uhevkc^Flp z`B#pWIPpZgRX`B@&_R@`P<;O9`T--wc%^H)4gJNmrNl1!QD9Oy{;=Gm#o69~*9v%eozhU1d^1s|)O7&Y!2Z@gZ0C&_3VsK2Qt!!aB$4FI6?v9Y2Pu$~omb*@T8x z=&XV~dl?l{kSo+sLs+tFoSZD<5t(wq`}WIQ&jT*sSnFp(gB_-#b=`rBV&ll9-~R{y#nBp)O~MoYd&A=||T% z(u?*#MmmOI5oVE|k8Od$Q8as?ZVF~@BjCwIUHaL{GPLnRlibVpoANJNz}{0ogzev_ z|Fu*~J)XRz(xKWKp<3>+x2E+>xAk6C}9Mt|3$j zH`D;FH};m|Jo>TKJ**esn@C{B8o?t{_{-3LI_G@&i!j0v2z;}1?u+8N=0 zDUxVT>SEgPp&@)pJWWWa?>x{7{hN|Cq-b|6&mik7DbrKYabe4?f> zFVKK}EdK))T~|R07x9D#eB5^~LQl&X+dh-1;6_@h@Xsr_{OxBbx|Iv5vp7%Ox;Yo2 zCqJF!WX`@FXA+zQB;0&YoDm$-S0n1Po1u7r2hqGjdQA~{TQ!jzOu2cLXeScx+ON^W z;gc){$#$_7AJ$dZY)*fZQRD9BKkzetb6?JvVb_iBrK#t zU&uKvhO?OQcL`_l6#6cjmPgpXvc<1dd+VP6Gh!#6rsnpe2kLfw)jb0SiYX*#LU8Tw z>n~ED37olC-l}D_lnWPBUyi2L_0A}&uS7Oo{+;cips0W7wohCYAB-D8;~-G8cI1+& zPZ$A(HK(6iEJ7^I#Zy|xN?PO7DXHA5wxH$SJ^7C<`5%lmDZdIv_QKs-qGch$>6s&t zT_BWHOyjue^u9%-t<;>M@Xk{a4gv_?4$~=?K%Q0et|rY=rxm;`nnY2IDT)OdKx^q^ zc|#>kjF3u5{;}ctSX$T-sDbZb@s9Y|tyb#lUOyZ|DjWSib9|(P3$&h`&lh z))*GEK`DYR$Doq4gJ-FrP|zJJ68lp~rHsgVv51wmw4kE&zFH$^RA|7me|YpE>d2S5 z+pF3TGQ7?&o+un|Zw?l`S9UOYgNR?SLD_o(KOhBIH6Eq_Lb%6+B84TCcu*6Euj)*! zlMCWMa0F~Qn7q$Ddk=u=ie_gdyKj?yTZ6+hVGh>MEE~j%V=ic1+La&IQi&_~WU1x4j;uxIr)Tux0s(Csjtj6uDdHQ>Axj#3I z4~bk0QHn3^mSx5_e$F3IRESq{k)Fw?EZ%^E!dQAo2W(%|4LsWO=Xs~qmIIv1=XrB5 z@DryLOGIm-8`vQIJgamb5T75IY9p#=Wt1ZenzSPOhB{zd(AvNe2-t*;tVI45ldgZq=_y!20Fx7_dxtRaw9GF7DkY9qZQq^LBg zNQx0)Y^@q$4f3zfaDS_}g7K7G5-6%>|JF9!fOr~+4m`YR;E0@fV;09O z*B!Cj4%`x)RXy@Y4>}UZtgS%~lrg}aJ;SA(RRY{NGS9C!M}W0f>{ye04@4d!Pc8EpWZZpPI8NqbC)w~?5rOx~0`!|@`Uy9GfKhd?p_pk7`CNX4y zVP`z8{JfoUb2YaB`8LV31Eq0wzdlGWr3^#bEsgsX*Y(3i>7T}a8Kegc{n|4ZgLq$ye$I}l2|Jrg}#yZ@uo|2#BimDq2&ow^D3DI#EX5hsX z%!YiNobZ@2mYVzlV}7s!MQfGNbq!|vcFf7hUcuiCn7ym}^K($9v|a-@2%4?$;DAhm z*T!a{u3XcDA23|4Lc=v7ZH|Z;i!A5M474y;!^{+f65gYY&QO)tgH3?jQbw6fINOT3 zE6i_h<3Qpnr{PrawUj9xbVuEbW$)4;+>H`3z}(b)TdEv?nnuH@Pq>cV8g;s%(36!y zOoWg5!t(ed0@JRTKV|e!6eY8A9!E!eExE=r|N3k;dJ~osHE*EQ>I@I z0+yaZ%8Cm^fKus7(A!XqEG-E7^R~YkUkt-SK7WAm#v)IO^K<(W{FGd3_aR9GUmzOa@qd zU%YF4f{`di5N>=PM^SV-P(nDKDGYm&L}7(OK;G|_^+frn!M*dl^hIE{MwYKlL1DqJ zdsHTgVKEN44VPG~qzEP<;SSv3{m(8J&<}qa`g!g5W)4%kDsKFOJnV6P7pQ0Ny!eGX zI@N0hV%uwCkd!nmcscHrv!RH&(l&SI+%{`=I4NW@LrDypBWpV@eQ{5#Uu%wm61J2o zveA{z&;Vz8eNv6pp-Zpt!oLbpw?xro=(p~DqWsg~{zSX-EmyO30Ej5RF$9$2%4{SX z%9M*?^~(OE8ja2IsQpTIyoDe$_%UGTFZpKe0xa-yYw~%(%Gk-tIM7`A_A1oT;^Xc9 z$nlvGzOgRp=b(5D7ml*rbz-JXHpkHM?`&Bsikl#>JEZBBP>9qmbSv-pKTVWomHRLM zm7*FS5;d73D@-KmDLTxz8*!M&m6lABb4UnV`)KChU19l3bCZ&?IT*oL-N*-@IsfyAAsCd7SR9KHVhBlyPdYVF1=vlB*)Rwkb^u zC-$`Q^{!62a}<42tC}=9%H-Q5r*855h@s2X9!+R%SkV-%&rm;3&y^J8k>l5P$hJf_ zycMQF6yTnx1}UsMFdz6_6sLFUnuGh~gt#Bynr~BPO$MQJ`9$bq_8GLJ&hdWFww>aa zt0heBQ*Y4t*lR09sJ(IFDK;z~+>f%4H0OvsyJHRf&&NmKaAsaP5?YLIST&QD(8<|Y zFI-!+9ZbhdpH`an&2D?1S7@DH(!XnpJ5Y*An{&D)Dk#)65P#PeryAH;K)G}M&t!OL zyx6qocW}L#jAQrm4iA2?(og$zOsRcIZ9Y3#C%PNEk*^=G!g@r|_xRQnbnWpgv=?!i z>-kVJ8W%&Z;u(&?>EV5+U=JvW@Hh@TCQ<8+BN^I5xzqVim0b!u3x^I zukBLrBz7V-HlRid;LaFae{CkpfZ=$W~OA3EM-IfomnTx z#8^fJJwlQC2G;YEXY4o6yF^#rrD2@}qsL`FXIjxD4XY?7N=Ckg%Ev?Ss7jeN?ls$5 zk*is|DA7@LHcyw=>6cv3S9}(MV{CpEz1L@xcnIxQ?>KN7lBJ8rr*$2N!lmiz@}=0d=C}^eIuIV zA{Sv9Lzu+)elzDuIPwQ=Rc$awsFG-Ph^~jyy&vC7%_#4|Fc|K^cw27;dzL7=0UrG0 zEP9;!?ehJdX&#gx4tJpgl%04JkCy#zGcr8e=%_j0(rPt^_6^a|k}AOxBV{@mLUH>L zd~SAA-O+ERcXxNqNS#Q$>?}e9ulSc^)Xh+^nmZb@N4*SMy!3tU+&PCr;wPaQ$a1H^ zOLS2Z@+g^H;nSv_Bow@?ObQFq=nP))P;l+>j@SbWg5K&lRk8?3*RI|$Kh?U%$*zK0 zjuRdhT+d0gLBUn4X5<7P>}ci~28yJ$8yC(C@$LRvpB)4(c%pWx@%=iW-^$h1w5}#S znlG8b)vj^@%^_b729qA8Y@RUv2|GNhx-z_z*Poo2Th1vUtT6)l>|Q`sTib&w_dq;d z=a5UfXc1(j-@5gsTcj4pludoyI&JLHfYn+v`3zj)Y|~Un{G#VpItw<3Nd62jt0?v@#>3*@ur%U#FDpYDC^T^Z#p{=vM147ei>S z76Y)u!`UiFEm3~ML>Im&+I%XPa&m0iYVLkkqFfQYO_lz(3-ha0zhgble#t9O_a?oY zsAIT^J!=XD-7p913|CFCgmf-u%n}2l-Q%ze$A~Ai4+Zz0!Ov@7@^-D zHL~gsHL}~^N53>-@i7r)Tr4Adp$UZ_fN%gT)N1h4sWa6^Eb3d||FFbiodbF(jU#&C zo6X>?996H&0x7K10HmWkwsf>VP=51LZ)c7H&WMb`T%%i{8S^m#O7}fEbT>58QS2iwBZ_n@b>rS%Q+&>*i zKH}cBpxC)lGz# zqI3bF83l#GpxA6)e{|e#N2H9PkMCBnX+T1ds6k2)<;|s{ZDxg&7NTR!kX~G<%Ov0J zA}&Po-~_+2n)!Yj@7-lpe?-Va$$itKTiHe}aEtd6NPAM7L{|MZphkQa(a#hPN!1t* z$!!)9NeoWG`~IApXT9+D;iA9rrFZptZH2G>?6t|`;X$wk*!@}yTtT?IncBKCyt^Fa zTRfb(dX@w}m3VvZpLPJXUx!clbQgn7RQX;e=wybyFCKzdLtAkL66bvOGjIBz_fmj+iNN4TW7oAOwk!Sh$971ap7mNxiLM{nq_9Zl zBq5YI{2y}zRhqk&L-yF-S4K2W`4g$Z@Du6V-qd)p_||^>7(Sogl7BXB>e7vnG|u`A zP5u}tFv)aD;AIbS3;|izKdB5{~(tg%| z%_h6keHGkanAjeD6D@m3$9Km2c(uajN}$OWLU@1xOr-CQmKkA9>kvoLPPpsZZFers zu|EDEQ(qYsSJ$&$910YN;_g=5t+-R%-QC@aySo;5DDDoWxD4*@?#?&u^WOCP!(z>x zwN55G$&Oq}Uei&BOd2+SjCiw2@zNT^&qd2r;nt<}NeAfCFkYz%7jDkBx_1s~-rbK_ zs}_=tC^J|DNHZ2fa~p&;Q5l4FF%^dJt0$OQznZ3Gyq!atn!m27{@l##T)Xpm-9Ttv zyHR*PbB>nfdV+eZu(=uVd9}W~7}$V$eo9V87!MA<<9pjcpqJ%qfGs-hnt^+b&vE^P zS-OXq6PKo_wiwgxo6BU=1DwgY4e>5SB})>QL=94x$Uq@F>|h;~Y{Do4tN;{qix8z7 zS69Q5AU`w!q?0fzz3tP6je5(+dw7)q0PYZtc#A3y|HY`SD^v zAM>QD5-@lAJ`_>PyO_KY@`XHVyMYam0Y(T{mXFj}3EYK|k;j?e&7ovtUjT{^)N zQX|JHGuM89qtIo6Lmzm8$jVE*wg)`T^L@(Sez|_aSmpWx%A34Hr{iW5>nv&+=PbHz z=F+ER<^rDe_g^7`ld%{*cM2z=Aazj#KQkhwg*d|gy0Hxy*&x?N-1i8aOpy8{YM${# z=5MsKSjV-Yt?Dg&s9rh>*+$n=C@VIi7vUww9TSkAzwHQ$EcVgXirj^vT~pM{pWAil ztGG0ku~*`&qJd=K32JW?9F-E_LO5-lbeqf#T^0?WQjUsu2r^~D#U_c%q}l!n={Ne1 z$ar&!RBl-}elsXqgE`sgCs~^pRJXLW;{tWfL#rn@7!Dye%*<)1IBBk?m*azS^m?hN z8WIST&a$-}Qkxc!(UC`~3$wew)yDRM3`Q`c zC?{%}Fg9$NWOX$j;!F*UbW#ap1~#Lgccav7X$xA4=9~o?MOGG6AgmGeysS<97?R|e z!f$RIHz{NeIE({GoP=X;H$Ms_D`-(RLZp#5nzZcqip!8U_JeXbKFS7cef2HZcV>$f z7?2jqqLi;!6A6MViVL@ovFr7WChvK-8Odh~)JQTdMnoBM2H!mKkH3YS3BtpPeyu(6 z%>B92>JshJx>rS4Rc?WRmru&iY@%EFg$IF^dhmA`M)cP{wolqCr3@G)e znAJnc?;%HoS5@A%IWDojh_umhA`@Em+V-uWBH>O}TVr2ReTzo@>}2fj;@RB@h{b^f zkBleA#0m;cDyswRiY!Re1se3jphtfUhHL4-Gj z4uRC%f99&!3x^x>A&Se01H$^RF)}2^mIUq*M8GJsT%g{KhiTVPYrJ);3;DFFCbO;8 zYNj06+A3fBvuelM4d8+gFZ-2uH&^`fK$U`FNs=>N<&*tW8YA-gGQQK>TWxai{Z9Ev zW%r1~4QI{dip}fe0sh(Tn&%^azfQ;fCf}`2#{;0~&F=mdQ1!O8RK@$U%N8!gTQvP; zKK`;#Y)-lgV|A{W{9}6&Y;qEkpjWqHjktUys%&YjcA_G2f4q6Vt9&GLjG`b{-*18y za=&C2$|aeY8gnypY+j1HjX`kP((nJJzgG?QNoT|wrAm>2W{|O&wM3)|qgQvRO`sgA z%4Hwq-Y`>qho&}hESG1}bE;}$U3^>RY&%qZ3?L&z*&V>4Tb)c>OJ80=7kJFzZIBLb z<5WV%l6Av98*6euqs^a{p06Z!QTOpc$qY@NyW(qDk&+mg8JgpFHb$Hl#8?Rt)I@kp zwxit)*e`CIW@zuO39&47#n%=i^*}iTyKOfs^}rDA496aTaZ`TOUJMbItp^w7o!C~w zH4@n{f6;0^-%9<>MsIEMvo<|+(=d|z9947<*H}DdeOiiTx8N^RQHS-FPhsj`;n`9X z0H?din)1^m9}=lVokOpuJ~W@~a`P(kdN7a&ttCQaG>LQip~{NJXeUMy^aGIcT{-=j zW1@UZYjE>*4JZ6!1>i*za>J&LbyGLO#xQpfa(I}u#YzRhC9<0HLX2sBV{->3fJ#EJU+rr}y1E6O2unCotd@Z`=sYE9 zUz}98jeoPUVKjx3&2<`^ABv>6?2d^bK*$pPJk=X5i>XbPr*8Plg7MXZ;)1CUeGp_y zIu0z~)!z5Ibo&Ek77jswJXn6t_6NbNdqT-)Ii^%NrFij$;;;z$LXKu~Zl?7?katF> zW0r4!FjKVmwds5oU3l9&y?BY1%%jWe^3|(W?q61bq&F=XV zHU?p$wCOP3)qxNC#ciM5G}!|9g!U=CqX^?$lwdYC^k%j%NOrCA&m@z8DRpE4BVj}Q zggDLuacWm_qtNnMJ22k&($KR3<~e`@?Dga8LQgpUG0rc(Zx}4_B0iF1PVicsaBE)R zYdF-ZKMrWHQJFnnE+7~(@fzH_J+n}pr115b6447iFn(BBo;K{1haHFy9^dqTeubCK z)3$G~#gyANQ7!bX;5g$(_isjU;Pyek+ND$Nve_I57G>EG`@T0laE{u3f@4p;Vva2} z7VjjJ#Uer-78j0B5KAp|o4t7}(<9Xj<4S$c{%`RQ4`zsPq^j7iqZjV#?tS?L=XqMx zc+xBRlrL(+H%;3jRwPV;4}Dw+HbZlZ>~+a2jz+Eo_;Hlgse_*>cX08uNJmTy>$>(C zbJHHSJp;pT(B3!kfC_?3ia*5&n4X^_BfDShQw_Vdw;>2|wVg8!YZU?bTGW}jsj=3P zx{YrCyjKu1QWGiV9t}QOuMuLDD{8VpeHYoyYRx>e1Pe!q3rjr$c;`>VSzUX^n;f!h z4q>b~Md17*g`QEXsZ-Qd%Q3z#``>LiPIwz~-(@8A6% z`=)|#pBm8|s{7D&bW=+e zd#?&{NUW6JM3vcuSeuCoN*~z@quKMnLW4I-<@|@hlq5(sN*&6D;~a(|nYKp#4$c*f zD7NnaY=nyRRO3xpOHDBt3L_{=W{_1hzV#djh2*Pklxp+U!%5y_;r9vk)iY$I*{SeQ z$*{xsR!2Gtw?tV3UmR}#?t2mS6)5eW&*&UiFA~_~8{}hycF~YHszMBnB!*~guH@^1 zJ!EQTjLWG1OtfpG6p~s3g-^fhS`R+bF%IjhU_;1(y?4vg7c!IkibNBKu{9hzs)N*~ zU!xOMZ}+<=Ldfo-$}LcH#ur~6&y+3gZ^H>)X$<_%$Mv&>o^i6Qh;&5%$TM@Hot1l# z1)$cKwcRp4Y0pVgz3@@^LjhWe>yVgMl2Kw=7!?e5CZlHhJL-2erJ?RXErHdmKV|i6 zAs&#JLa=NmgEMz63@gV3#yapM`I{9Dmap?(;3buSU z)>Nc~Sn7Kj0Wjbw!axO^$3Xl|hHMQiUV;gL`vGBhn%S8U*9%6ZC7b@B)n#Z%(y|0b zbSOQwbXK*cWmH1pDI1TL@1g_UH)Ue-?eQ25ye3eQ3n)7LxpYIv`0G%O$t&Z=$La+P z6`GvblL<-$3RQxdHx8Ue_J9GzjGfi$`UhUwr#SHQ^RP&qLbGa0CkVsh``_bWnSnJXnd-25)Yr@R0fQjI9Xwf4V0E9$*f2* z4QmV$hi)f7R)pr)NDSp;Db{?+TR&8NKfTZW@&m?f@&iGOnV*H8oE)(##pYb-5RKJJ z3bm%yDxGeYPnd6x3!=_@X~ryf22KG!-md1^*`40c7e*pEjN)tPI^Q!GgSa}If3u2+ z*dtfbi6?{3)Vvn-;%WZE@-}DSZV2^6JK0&~mz(z=R$vpgdre20@5!9MTN=&T7S$}z8R&?x|WeJb)OxHQCwWfgmS|ukxV*SE{Twk zvQqIMwughZz}}g-z#jObFMAS34pJswp?`>Awy@53g#a(GECZ`g=3)cZ zLm``OB=EE-!nKUU;K-hv>Q?`qoINFTW8LCIWZhzpbKWNj|4cy&hSS_IU`pfirQ~gNG1n4c)k`C4tpx9NX*r+xA&(x~l7zq%%Dd7qW3y2gA1yZ(3 zZ_X7WHopI9bfO2IwCe|zvb`pC9)#iGuU;~}Q@5{jY@xi$G#OZoCj>b=~) zWi#(aYYRlOB5O^o0?(W+3QDxz?DS^Iazs=lEx+*BJSe>6O7YN;#%9aNzW+rsc#;}PzRw~_zH+U0H0@K! zh>y#MIH1UeC2mq%91vX)sibT5BoD97vG~c|#8}C5!P$aRZS|pTcz?{pgxIg08!SH& zdwy;D^oFvhFX3MnZHY{KLnKOVIbCeQioL5O{@D)eZV}L5M&4)*0w?%Go-3MwM+{#c+0*r65YhHVi!( zfyE~jx8;)*IH@b;qTwb2`*sdp|I^M(XrR&G0~-C{#Yp0WMDx4zWQBsl2kzLxgqz@< zkQ1w)-85pf+j6~|ahd012=&C!gcxMZePL!9DCzF)Py0*sERp&P!(S~vYmVc2(=k}2 zNM9fSm3dQ$x!S#^EFOgY1%=cZG=+pZmeCLjGeN_w`g{dkw7T;27GY;%TOO|WP@+!% zVBre;U_tQY*W{3dm;1g$cG5WgcGbyM8;|9XrYTQ^_LwV+m(-;58OF%RuT?IN)gOyg z$LoCBuo?5cz-TpDIU0kYI4f(TT%}+)L!=#N|C(7y?#kLRyG$p%3AMe_&Ss^Rn9^(* zF}}WFEL5ehi#3BaNrmt>>sag@m9_7d)}~8?^XOTG^9U%uVBQ7R?kmEPlftJe`H|WF zHz~8R-*NRa0-`!raJ8RfTN}%f8`-Ee$iJ>BG>cI-W0A^%F(RoHYNT+90DdY;v*=AIe&exWY2)^O0JPZkcnsx;OvO8)nYH^ zib`a7Mog09Pd-j!vC!py8_C$bIzyd&7D<~aiLdUUK$jt=#pgYbM?$42>*NhHo3 z6kJkndpBpA2V`Jbq3$f*-7fEb!u7A{KArbkkDSXP``MkXy z3wdHBT&~HQrlqa0%H?d8XZ7S%dnmZj)7-g}B@oLkO~dR-7e0>+!S&{ICamNp=ShfY zwXU2^?%dy)mbuujy`k@Bk@3geuBM}O5k<)pn>_{8uvltA#I{-IJUS6@$@Nh%N#)!> zQI*qhw{jzHcLrKMfp+;S+^ZckP6(W={0FI02l27SR#dnQ<~co>uG75DQ5`;Q5>!zz zJb3jRykH-1r@KbAcx&(Ly~bV92He|Rw@=2Xni@D46zE@u$QJegMgb9i7U86ov`HXV z3^uMyoo^XGxh+Bv{SPT}1bKaJ9I(2yT(;y8cU%#Z92@MAXP@w4LT& zm%mBk{tjldX=bOE0pDXlCMF%J7l zLmgUttxbb zS3{~@YCZw>1DO1xG!nqJKl`Nv+h%MGX9aIF$Z0j6X-#=`%5=<}bI6g+4emrqmA!1% zD7J92<;D>+u8KD+LZ9|NmKCJ48_=L-Awc9`gG^{A-3a`U@y7vr?wG|w)tsW1JW&g8 zpL|<%*KBczI%6Q{g|Q460*ZxfDq|1@aHBSsu`Sn(N&f>gb0B$+Jh1G`T#f zqrjW!b<83Bw#;OoBE0GdK3-_RLbW@N&@)L`1;vsYuW4~A9$TQnjJ;jB2qvnLrCR$I z)VhVyYP0Iq;&2=OXr`w&c{Hr=n8H4g&e5u}S3&#BM5gYv(6jyN;B++QH)cC>rfb)- z1|NX8_AH~!Of&@*qgJ%-4Q37n(pi~;4XGLk*2jj{m(%Q{vqNfy3z;`soO-QL$u|$e zN>%zAdi>Z~Qg>3riqvLgE3FwCKL4)g26B>pbT%aVf841b)WXLb^au=N5F!gCR~fhE zSKg>*90~k*QO47x8*WydsqX9=$A$4toIIOmqUZf&hmL>E zp6B;60BNO6GKiD=phCYrm3Vr+&-fie9?=C9n%6BzNLuhz52ss+?MP|mi*9n6084@-1stDXeHfdw=I#_$A?lL7`qE#+b~xJQZE4@mg#njn+wR>L z-l{v<9IB1~*Oh?SboUB9x-sIf%1)|Bj$r7~;557|5SRVVO&FIXF`+qun#ZqM75(l> zL8!ZX0rlIvcm+_KeGggKmFWHwLJ!pt6QI`gBfLXM=6lq%-4JT_wIcDpkQ%qw%jBGm zNcOrMs;j)zr}}1I?HcY@qf5dR6k870zEL$%gmgV4(c6`5)Dhk(bN`;!#!<{gHfK~FY4JW(>^20 zotH0Pc(9!6_BoZmE5F!Dh1lTm0L8@>b73q#$zvnva+bAOi}$;DVehA{$>#jzXVQ{z;|^U3g=A-ib^h9?dTe2;?lHoAg? zAKHIR>_LL=_XiTVf5WvflDX9Uq{JgEh&pOd1mHZ9NK~fsZ}dc~)O*EbLwa-cfngwU)9YC;8g%~;m zV3R}5Y$7EKBqJkU3VBe*6%!A@Sh#jdS3B@-Q{{{J1jwb6Q{)3}cLuCVxjH&>X!LAI0tDVkfA5aoT*e zefR&00aL+c*ay9WC#yl6Du;u>^lz~PYn0YdhMDo5AsC)c!1B8s`2@ewHM_EB@-UH1!w=hWDH}fJKC+8XAG-)=Of-!p+ z8B6a&S2*#W?GVY8-l}V4`(>fS|Iv$MSJK*3a7snsG#59m*Pj;eJyRN@=p=5M%<}SE z8tNOmR8-S6?z_KYUzdM+C?bC+*J|)`}=C0MUUgVIUI<=d=2;xbD%5n%}KI7Djq zb|L`Mt@IjC?Kezg?&D+B2y#GU^f>)wKaN}^c>`yE|JjC%E=;;5k@w%!TOV1|y_O(i zI(XlidWSe0+4irvAhfn<_Y#1o;jF>m+f`4GT6vRh`m;Cde! zf=FK?y}kKY^w}Yj!>KjtDnae-XiZ7{!%FrNGU94R)qCO+c4>y8kWfY_n>2CW86i`> zy?H2Ne<9cUZLU&*%ltiXKiH{%OqsubTD(#g)5^I&o;sja&RkELnkz zl9|Pyp1z2=tp9o9od?+WNkeKYVmmnIE{kaV;7=`!kkVs?UsDK_OLKZN!H00DY{H4Y zo!VYEkp28vcjdXt6u8{&O8igDikJl)M)^g~0zsAp`7~~VkikAZQ2w31?av?Q zc;7?80ivW^AZ1TD=4^DHswH09F5dugo67=|Z=3zh1ZAF&AWR+gK+tEaN>c~h<^~Nk zI_uvrf7x*?MWon6o|WJQ^ZvfR=~6Ftsqs4d0huHO zn$4Rq^W=PY+VOn4aq+Ozv6_f5dK!GYQ}TB7G;r3@>T_>BrvvTk_Qh%aaOE56D03JPT2^+T=yD72>_ zmX$eN**I(b5uw`({Bz#lm4NiTj1j$dvdW!s=5rdn(sq~f7z$E9%j(o>j;mP?M>(5D zCtHHihO)p+S9g9IHj02G%f?&x8M`%&9N01p?>L6Se%<_i%&o`YcOutHaVo)T9HkzI z8O5)ds!WW|Oe;|1)Ula|VuG z&=(Z0f%FT3M;pX~CTfTgQ!W+BcN0e)wjgR63N@!7g(({*qaIF@w;j#Lh71Khw)wwS z{g6ntK4dQW;e(LKMR{KQKLc{&LjF-yfN3 zC-ZVfPLiS~7ic!}^wU?ZK`v$Uk96vzE9#jOgs6dj1T+{?71a?*`z(bP57+3Z?}RBT z4i=V^DB&ok07pI;3!oML-^d5!4fNV&5j`wRwkWk(N-5%w<>H!a4$3(0!xlaF>e=wM zu0h^>qA?TW6*sa0OXi3v=D2#IqZ0SK38PT>#5@B7?4RJJI4p>L$i?>4{D_j^33>I0 zhrH{>Vu{1~(R?*g#SJ>DPD%xfg+4y=vAs0ksYLDm8-8T~qgUN$m5|r%yrrt2Y45lr z%%R|FdPkIN-W+TFp)f(S%B_twZ;X#yoaHf*%yM(m0;vL>Z^_XPFqDrHY>m1GGn|`A9lZpL%N# zTeV502UN-xULH*bhoS|z{ic>!$oxI@v0Tw+a`DkKZ}kuZ*gRNQUb&tP@}P82fa z3Exq?mTaiAE;di|t_)Ozn*nV8SB)FcZ|>J`oCH8FWr}RflItE_H&Wa9^>QpOvK7?d z+^RdV(k4k~u;9pFgbp)f(oBrZU(C5B8nt&h_CHk;Rgo7=!hV@pa>EK}6eO&4o=X^C zQ;FVDxN7roTdt3nD_Wk3_7_2FBjn@eUGC)Og^$a83Vwxnc-_GyBTziRzF6!Fkkz2@ zy!calK|&}!XF(L=1_?aFA*7UN>!p&Jp)IKii)$+(k$kfFL0c0YLFM@_k;HgrNaI$h z9o^10g4{=_-9WMhxv4XxTccOeeHLE+pa2;k*l;P~%Y}*{b`W*O@MqsV zjpNs23!5VzJ3dDRxWOyYinb*(v^4~(W1azhOT?-ib0aW;Hgq{^lSEXjbk=+nH$iX< z)L40W`N?8U-dA>a~w>aBOiTMTX1FBK>H16{Sb*^)&6?AjzFVvOI0$2ntIhwCEnoY{1<))wqM;uwAq`%#PY*EbVMD;KcPKarQ| z(&aR5|BI*Ts!7(aMdHrnS{paw664NnO~z%>q?Pr!pQcxaw-g>$G_TZPn{Sk#GVZTN z1ocZ%EgBf=Z+Txzyj&lyq7#dB(nyfMW<)<8bnX=h(7P%kUSaVo6WVw0%rUrdxvOMa z6LtPgMhG!BJ*RD6T42TKsHmwW!k_gf)QE?!J4q*)Q<@nj8F9#7aR$1~P||h&ixv!N z9$4CApE;*bt;CEAG`X&uA1-}bp3c3>=CHF=lp^xJ-{q~)i6E`YWD7!=!1FBbUbfe9GtbjwAETsBJQK5t`%i)hAW(a|tb>Fn$7uT{{($A91sF>*)uoRg~6h2y@19_mQFg8A3acfdT zW7Glc$Sq_|?nsq!+_G5c<FKk-PVqguN~Z<%=92GYyJDTW*}z~-@DGGH2>~i)HUlER($Yghc#x6C zrpJE)LP!1d*|o?aFhFSBSV}a1nAj_4@-4~l75b|DkUIYy7i>)_;^q_)v3p z@7g8@CByX>b|#v(jqAY`Xi?T?o9^g=>sJdjPv}19BTA~eul@a38yFUYADvK;c>dN1 z!+M0TQ86X~z9HJMJE7Z_#pvDYxr`Fxv?b+nHQ0*fUxYV^-2ZckE-8kPCjr=@`+p*= zT;;ISJkD0;Z{3geKlYGn6kjWs$nE@j`2+wgMp_(g(aAaN_94;B|{|WdKNEm4&Gf`;xncgMz*TYYNaU8|`N6WlPq+w5tv@5lE9INlgvm)NLDh1eiu1qUi!-#c zpzX2bgupXa^(qJ^JSBrOV}%O7w$)wa4YWTKEtq)jM-kkgsc$gL>Mzp%)p6k<$2qoy z+jq)4#r8Pm1u#eUYJY6Gri<{>QO%Npp*1YcL~2L_Clg=3MD(stj@c$lg8G|RBnj2P zqp)`S0Wu6mz0}~7!$G-3c!04Nb`4t>76B6+?Ac2xti0E>^RELku8s!bS|lkLc(#Ot ziAljuY#Vd>&8ggDOz58!nf-NSPW>T5y$Sl)=xN2fD-bv4%wQO-^h5doxYeus2Yg=-pDGOpP?Gjek2W2 z4)DH^qNYVUvhJx8kgCObP>ge?IXA3`*%Lfedp4Jt&BEO@T-3_3VF2r8CR`EK|0HV* zF{;DM?4LMHjm|-TU`A!^oJ*M06A8cJVgVy*rEmL}s6P3oZUI3=NeH-4FTK)2Z#^;c z&iY^2x4j4wCFNDr2Hj?UGJ+hj1E+H&^}v7nzv&!FHE^G9RH?hOWm>tR@Dg>_ca@rmGra!bcRE0zkbtNYg!faV0`skv1sd0bjb;%j@vKLHGHmDwz9oMn4n4!#A!Kx4cGXD=gzF7|=@{>|3-+M;~umHt4Z z3o5o$jx|LePxy8jvnGkCH0Kx5tXLZ`$QX>K1IGsPK1N!UKMBTn?>6k1?y!Y1GNrzR4YXnu2^ycA|xvEy*{ zd*6`tq4@rkt0Z_%>6D*O4;`fkhh6$qWUT0U0Hz+$zSZl+`%~gz-i8_}xk|wCa!VHt z*tEgRu&X!g=Jt3$xNom-2B}gk+J>Wd1-B%W`nQ%JqHSx$*_(Jk^FwOx(19@o6Np4; z11@9{dkZOR7%UYSh6cb^O8v`RYSS2Tw#G8@05g~E<%(&+oti4Lx+S>^M$HfBgBeA6;eA-YW;f&xapT1AJaV@R!#9u>7_&^)~}c{+FW=#ZJ0T zT@iZ(<|v|Al_gSpb?_u%H5r}4sGKd;6`C+v!Jcf}T zMG_)uy`_51FG>x%sa)^K+WHDT0~&U44G6ES+I`n%^1xZbq%K4Ti~x(BpIr;S za6IoMkGC8bd^-lY^~sFr&xknb@VpvmRk6YMx!+j29Jr&e>af%qx;r~Nl0ChFSvZZy zwf`DKo!&d{0b^yAYxzH?Pot>@Sb?&FNElUbmx9b8Kq{~d3e%<)S5KOASTRUxur>Ne zL7fq0`a)#FD3AhEivl1VXlK~;fU5Z%vFh3WA}0zE)XUiJ;Nu-nH6^{+=w zYD`0vD9M{0Ft(Wt}3RXwiNnT{4 z9)gAK{Z>=Vmd4ap964H;oMCB=i)mxVrQ^%GPzd8Bb6Qz?`3XQmHxuP*Lu6`?68b-I zR$3n^5S(SoNHCcdc`DwCECtD+sEtsMhguzRdJcj!K)U#DttazICwJN6OoM@dI_b&; z$6zklX`)qMGFd32UW%_7)fy;;NG_0fNjUKAa)c&RDe0gen^&o?`m$4(zSRo46jFpt zdpl@8;d;j~0D(KV*ni3;h&CIGHc=LxZemZFWnrZo%N21i=HKi@Bxc|xMbvNXR)3B{ zV3ck&-Tn*CR%`0ko<$b_24@wC>KC>qHvJmaWqfoCb?!KQE5@p_WzBXoqA0|O6QLp3 ztDJGSSPL_LSFU%RES2gUl5qvh{uaM_?|6cYStrB(mL+pBHL1t!D%cTB`%TC#CDUFD z2wwVP5JJ%*Ff)HTE>|7urghhE{^LVL0ooqhRM;OrjFwL)1#@{&r!m|VA@3v_A*ZgQ zX0rv>MNI;Dv`dA}y`s-Dn9>z7q}rB-C47pV46ZdXGboj(V#U z;5@8ztAI0wffAb4)RDFI=#DorH-5Vo1V?HZ@;U5xLdMPTNc;;1>%N_)&c8~Zhx((t zH?bEG!?g5sPlCrA2!MILI$ALcxlq)wk`fWA{mw!;U1E}x8vN>cJP#!@wDfsc-l7;m z>IhPs$tClIOW=WQ!&@5L`m5CHre5#KOenZVO}vb_K-!)H6d6-Z$4@;FZt za?RHzV%>`Dz`b~g8aoWqbj+N&?Xdp$nZ6l6O7tOh$jISQGAYl=?tvDUN*&{oGN5Bv z=ErVr9k1~3?KYfSRbHvIrdOWlp@EoPvKE)W8kiq?vCAW|QxMQ15{~rCAcM-(`Cg~KvE{MM$@3J-VznVC~O@qQaXZ@J26>n$(URz+vmqnr6p-;TRvopVUjFU zlQxVLomH;`t;gt}qyYy$C|sa_0hW&gC(uB|KA*1Wgj?8POm0F*&If6wk|0%QH+Ba| z;Fs^BJJtE~7ZmYR9UV z(;eI8sHOAyVfTdO(0c7CFa*wSgwWk_iH?p6UX`9P$a1y`Ew4HAHo6d^PJQp`%m*{1xCjr;Cf zZ&42K6IdHMLf3P3H*(*vRBY3goM;f6YSgMf)O!PxX9>^)9TGGg0wi2p80 zw`J1>n!ZR&^c?5LonMK!VYcLRwt0;Z&6CP`Vr!WWo`_(m{n7~(GYl>K4GjeLmVDN|5|vUPrD1=ugxdrK&3xQnM%wS=x|5{Nxz zaLGJa6tQwT%fO=&=uzSp=}Qsw_9?14XTkCnk4nb}uJ(&HA53SGq^c_l_Q$`O4fJ1D z6j*+$?7D)JaaN4bbfKTaq7?-%kf@nJG_SVZVKCMgOi zwN}H=Ztx3XG!svi5Wn=MB*gkvquE1#4tfVH*#F?6O<_f7cy zjnnvS1;e}GX^C`A%~a(J)H37R%oT_XCB#!5STWu`cf>cv;E*|%k zadqPEyv3_ZDCYeL$!{5@+u5MD5YlpE&jD=LMC>*|f&E5Bdtv2oeddc~g zf$hrU(JRB`H(LmRaqXA$`RDr%FK;D2UdOw&8^Pp+HS(%^YF8DoxUTUym92#-0u8yO|25X%|b&8|RY}eZ@^uL%%38hJdtx(t(cU z?yfeu-bvAz2vAhd0OgI9ZRa|=RJjioJ)a}%Km=Y=zy(ZIT}8dmH#wdUuMaaX2>7dw zd_Yh;s~J!HZ8kk{#MDDpg3}5wAGWz*2pn5k6XH*$*{P`E7GfBBQlto_{6ignd6k*B z;gxn4;7TO3mRD*!CdLC$s!g~Ex(202O1M!(aM|`&_ij zsU9nPB1Q;w@~M2k0Xrj0DY~n8k#E(V>fJjd*0t$9I!lXIoA5dT(awxe+>6Tbj^BR|rC$X;`S_B7X0&K&0mw(WbBYyX9i%)3dF6S(HE>9|hd$fvsuIC;U1Lx#y~gO7U1R0^9K~!%KSk_U7*Ta&fhn{P+^wJJ+AS z$dSag!mP|b3;((El=ZY_3-rpy!oV1-k}fYN?fclM;((xYg$9eL8O!4VSqpF_l3f5AzZ2q{m1&?DB49vl;4ZgZR$Unt1XsL)DLzxBN9GV_qW&2q5YE-RJbX!srb2 zH6bSGYB-yw(3gaFx4~DxKzglrtN>c;Mo(JarBWG?)XnW|zz4;!3!_Rf2Cp_c3_li0X)~$lQTvsd2&KvBSuAC2E*UxJ8J~v#lQZQ7Z{hw~k&KsAbg>(Yczc6EkU`X{b!IEuGN9TFYyQku3Lr!`*cUZ)o$@=fJ!Zil#9wFEs48fAcuu9=7(8sZa zU;!UKtJBp#bxMZMMWFLddE1f25!!3y?u$}PZ9;)QwTjmP*yF@S9F2O-4SO~36`NsJ;X$rR;ZOivSDy_xZx=iqhfOz z+Zkxc5P~hwWqoXt2A^gI+RQ=BdZ!s~h}5=Xs?7;sWy;WZwOtn2uh&ZhA9P-`IX`&~ z=byH5T`e7vmYHf!S?gp&cAMpMWSa}DmpQE^m#j;7t~luzuvTwbr=RhCcYmV3(EdQL zt9rhm{>7Ka2m}nzsBC`{Bm%z)>8i!g)mTdaujqkSTn44&nK>+z>_F5;%(>T%&^&A4 z!W->m-8^9q?LXQ1z%+{nlpU?VveSj9sq#m5&hWd&Ko&ba@9S`RpLf0-zdjk7o_-5Y zrlq;(r~O=?RbvSfU88ipUz~XH|9JcIcqrHY|8wfJ3hl^NQBpC=zRoEL*(yaPB(h}R zcXNtpu@p+yIYnewmdPH9WQ)nZOd3psF&JZvF*CpWp3zfgoafc+`+CmrPuE=Yx!%|N z`n*5ObfI{ng?3JRQ- zaF|y%!@~_{Cp0&h(z%Kk&&ZG0$DBCUQ9d(j1arA9dz4X=+idm>CoAJ(>Rbxz@vE`GXol52 z6u9o29r-kFACsXp?57ysrmfK$$qSfd0)#RJH;yU|O)Bj!Pr?}tJ-3{X`qo#ha9Tp? z%C7Spkd@N)I|s(cFIsp><)sNUWD(5sgIWh(&C8sw95lQTb!m=g%0+o_$0>o$>97&2 zLr>`x{F~G`l^5E=Q6(4WzC8Tf>=N(xotxBaV?*}sYY~A7CqojVQ@t0hge#8{MIZ{+ z4GxI=1PkGN>L+Uhm%fLg?cr)Pt8>D1LG{|`4SQ4qwVqN$T(mB^6e;PN#hatL?fHnY zkH`dhxiQ{h>>2wG@6m?t7U9p{)zbdt>BS7(G;z8PPopgcLhQCXS;1kLDL&nljt`NV z{eYiK4V#fd{0C#=%}AYI#U?MbCk3M{{K|^7-5})^PlMgXcTmTk9`#-G7P%p&6uM?Z%sNeFdHt6f2}%X=zCy^3FJpZN_d1O^ zs9x1}d@pUb@P>QQ3sy6+up{JNS)fB_#jE9Qsvj0dJIpW0lJ+2JGvhkR5;e>O~L zn6Wj{h>A2EP)Tti_#8*7sJ$ycG?aG|?;#PJ)IB0lkqc{m6jeSb$Je0}HZ~KI*zjmM z3h48-pc|i$%_!Gr9!MO51|}r{TqPyYPq^079aY z&Kt5qk5_izzA`5`jw#HA1_sa7lAy zb=P)X<~C}|LDVDgXal2uGvv@-gIU|*g|`wP2nQ-`*3ZNmSpfxFdn)=5#D1}X`$^43 z`)#zRgu|o=&ld`yrW;2~<&)GZhh_@;F}-Txqz&YAH#Q;mi!3L>B&jQpVl;9;c!%$x z@A5Bcqis{rZ+8Bi{A~+5SAJ9mwy}Ayw@UHM1tST?d%o@p&9xWZ+|QT~3Cbd$u2(nu zBI58sMPA0m7%2J+tj4Ef^RB6U1hA;D@m?o3uq&zAV_n0Ht8iL>Zrs7T)(4>jq>^$e zqP}#f`jhwl>aX=i_uVSL{r$j1c};5?pXYs14h`vzY(bI+M(_QOxy+mN)qTUAjD={g zYsDRnPLYIQ;KyN>2ypYD4EWei(IA)7=Vwi(Q=GqC&HrskkVc+G3?sPn$IQI6-LN+| z)n_PZQKa=y!C2XlQg1x@Te^X7f!F*Sub3oB-_L>v{rSygKdA_mxOq=4l~-Er^*!S) z$;b+~LdxBDOttD+m$@65i!|OWNBIQ>R25dB)(t&;q1gttQbq}vV8m`Wt=;5}*}qKY z-eYC%F&cxV-djWq^a7HynD^){cc#t89quYD78g%W&GBY<((DRXp`^ z?@6A8Zq6#>bFut|u>?Y7hRM|F_8Yrn@|?U+MH~1zIVI;eMaR&@TXGqm2aa46O`el( z$qiGPMyeQ8E<8=L=C-RMy;jhxnB?6;u`D~orL2H0E#0-8JjE*82NI6nbgD$B!BK~O zYqX)>XMH-_mcCqZtfHL{44@vbC~7jGyJo+0*%cZ`$q;`ZeDmaW+4%R}LF5^fp7Hr? zewjG_?PEK{F|A%xVy0&wDqj!Dn0x#cEWA`FO7kx~^5|-tdt4ue#0oiXaE{C8GK)>7 zX?iWfhU~VWFpX1h`h@nK{!(?GS-Q%oP8g=<%LKZaV+STAlqPJr@3$_JQIgQq=89u3 z1P4UtNUu}3O>TS~{!_l|po&tX7->JXDd~i&j^pH`>M9y>pXQ03m!krbOjT5QMG^gGrR+bSFsLLi169~`CycBIjE|s!qG*+PkVP7+3PX6 zJhfsyWR!MpxuQ;9JWaP<9HF(Bc2gubeVr7(rT#uTwX@$sFXqp|J$WW&L;6G+9|}H0 z@x-+fzN3yaN}PA&p6%oC_{tk0VMY=P7nIJDxR^Sz^PpKS%>%ViEAfKhJf@0nGQ4tz z8FwKA=M&s??3B9CCs;N5YTxFWBn-denj2WI14v8v>Z576qMvS`^&MIBJM9vyKRO)b>#{h0w?ILiwqhqQmUu=CO=3d{8 zjI8EwaGpqmjk6A`ZqSF{7;OTbNiZs-r(A2*T*(ARUZwy zua`nU)zGiCwC_&pbFrzX-hxy9)r!n2qcqk_ z^*xvkkUl&D+|s7x}J zyT!YA$RPSdf3@kwQObw@slrc9=uQ_EDji4%*+GU=+#1Z*xa*qbTv)on6nClduM?I~M694bz9u~IGR?#1?2etq*uFwx&4+FeFt|@?Bw+E3h1A>xLN)LZ{|)rFa|Uk{g9;~fLVC)mS@Rp)r9-h?eLBaxVU#Ag zSn8?g(dj;m+m&veX=xWNJ*vkMfJz7n=l;DYg_?ywWS+OVut~32A?l# zCfhoh#&<0x&IrRDHm9ck$XaYDO=)rN&wt=$Om>P=(J$@xtU8UvoNcP>H1so_IRsQg zT*d zFOHaXmv;Nly^9OW)bziOi8>w*2_CgO{cOz_jf~e$1@Yzm$@OvXsTq9beQC#}PYZXF zm7IKPIgh({n-2W0OjjF_4)#4Gc9fyWeHLRGFyBDx5)nq5t_!Q19z_eoE^1=s;JDykc&|*7+6y~gMk)7Oqh8(pv}g9|c0T11 zQ5lypAX<;lX;7nh=5bm{ApM9u3ZJ)GBG zj?Toz&FwDZFxgzcD}HQ2)hx&?N?X%-ye6RgW%&LayU~N_{(y6MUexOhkJD%{wF#g; zb8w&&_ge%cM!V?oIudMqoGKNd&c_jfCYv9>F!L$fs~fFy=5=tz&co~W!(_mQ^Bq1W!T_9^tbYO1w*?*UXtoO?H7Oh8`w zn*nBfTV*-s8|9p3aFtMn$^p^)sMg_$+3>wHC_j(dqn{f1&Bso4qd7XiyhxdPWYTTw z?))iGM|Q4aQ&)gaGDmlJREFRd%Lk*C!3Rj@ZLsJmzN7FCSOi1h1tYYHa7un*Jk1`K zh>LN!TOq0ljSyAxzRvACawkk(NTYpRCibIX6d%d_dm&mNvzT8f2ABdc*UYxlCJsOq zdW}fYe}={T(TJYEX%{wWT#VJ|@+#U{VKrb^@kJsYzwu*AhebGeuP_&Y=0b-nhZn|k zp${qMbp-PIg`rEa5GB%jK|-@m$KYWD?-{lJ#>=ktg7wQ4xe_Xz3q9E=Snr;Xm<;eQ zs`H^C=sbUj``M58-q;w|SUcJnhABTww%R_6GYugHdAqNjxqTeMtDe%Kz*y8{%W(a0 zIDc4Se7yzCGrZ7hmrq0IG1BwE1V7(BTg-&S8b%6~);DgJba~^-yPTRV@3t!>sg}C> zOc5n_4BOl(iIU@O6CSnXIZ5K;gCJryR)*FZKeM5ZBC)Cvs440B*u-KgK+z99r z4c#<@s}58$3&PLL!Ip?Xp^LACgjK^yt%Jg9u!Xrc_j{wq?kGRTpg#HMZAj^O70x&h zhvCT4aOEe3@sXo*bBanKmnS(dm#9WaSd5HfGL*$mM8hR_Myo%m>!}rN`rfXXgh!47 zObEZG~V)AQ1M>;XwUOz-e1!4AHGaC(mu zhhyY2{m9g6+7blj6Cb{PQBk>z5ShDn>B-|q_3!E{qK~6HoBiZJzevibziB*iVC<}S zV#$YN&Tq;F)*JELtGXR{FHy&#=I_15#lTLmKGhMpUVH00;ZmPl*Q+}*eOOCB?!#r5 zK!E_SMPahqpkKMw2dcv*TBb7n1^+XNGK@qs3_%Y^@juP*peV=4Y)0<; zP_dU&zYeu^vI1v;AbHho)hwU9kbGilP4k;ue9Jyt2XB81`0OoTpq%1_Madm(qkBoW zo^R3~6}vMa&0UeyC(XV2&8gFu^SbVu3A=d&VqLY0c{2s$GIVRTf6Px*a! zX=hC9is0263oT$l&F&9xnC-;r8{5!sPR}|ft)~pjOmWYuUE!0TW#*moD~-oC#@s;?n{<2^8pa65Xj+Glp4^al+oVm* z%e-R~Mt+k9u<3THlbcgbGJWHqw7%+#bv%req3~YfjUwX9n6$*3a;XQ126y$#K|rl6 zqf^lgg(iF{KslwFCWSr31e|7W`J;SqDWg%&FI;S0Ez2c>z3s-$S| zc-goZy!F9Y!-grPWXPZ@y3VjnpV&eE@-oEHO=@QjD*AUkV}oG89*=!tPj&HzkmsvKECcvQgIFZ{(RW;q<43V z+%#poE+6s9J2plV=O>ujF0<;w2IYr$4{%+xhJ2u$p zp{{oce`Oa}jQ?I6lelm0H)MZUaEn=9Qq|jt;<7mLTV$0J7{k5KIa0qRH`%@I(zGW#knXXsXc!v=K>dBKA2XU)HWHI z8yswwmEpoT;bc0FUW_4(desTq6Cw1sgI4Lva#OYjm*t+gm}74rM;&{j@*;mH!xJvm z2EI@vJsy(|d{Of-%^$j1mF{tGOryNh?lnC0mUr2oO|znB3ejiG?!w*8zpq%o9ca&C z%=VmLM+kQWSTV!Uxp)ydhJr1X`ctxl)Fy){vos6p=x^nltn;zrS08T z6E|*UXa7Z~x%qo|&2qn7K%B;6Q?V zoUI!2z@CO|4<1KpXRWASyKg;WnBrqJEUd}P_sL>*r(|3h*VOj!P2ML9fNq1S?O>Cq z-jHhgoKQ`j8w~6PZj|z(j(u()zLCDoROpG&AFelB1#XYb_8{Lz3CM3BiPUkgencRC z9$g%FyKf$ZH>WQZDsFC(!1-J8KSxDyd&@ahT%{Z4udmX-X4LiMAhx*l0#pmzLRfN) zGO^U0x+;6;N=x>5^f}c7e>yjA-{_o6qvS*$x2#V0Pt?qSKfu0Jpg)SoD>T77WbQMb z%gBtRpVR2DRY1z@ndA$dE$66MTFNOhE#YqKcM&#HOsgD_xxai{-TujT zPYZlNMv3Itbh=J6@iYcj4lD0}r2pW;gYtIx3oJQl!9MlbJfOdbdO;mHBcNyM6v~I~BWs^2K zMYf{y?fBGGle5ddoX2lrRiVAqhHr6Sn?`HTtJ66 z^?dLgSZFERkV_bAsvJ{zaxh?LcvyxA@Vj9j-nG~Ip_<#TH=2|!T*2YqSNVSa0%j7q zo8Ne<1Z8CgBlqmyMByEw6%5*#K=j%QW7NOF5t@ya!#)aA+;&?Xxxe05Bi7cwtXZb< zT%G*s2#nXq)~cb`=g>8+-Mzv~q`LX{OVPrR!=FW(b1nv+%x@}Ao%8G5sb@?abhzv6 zOy8blEJ3G45ruc-y^qHqwnaDFert|byOUN0(nF4*ANSG3ncu+@ zFC)R%G5JscarrPeF#qE+;#&u$)+fZ%>c1jUz<);yq({{?wS^5gO~p;@C7fS!>!ISg z@zrPg=a*zCSvn=2<&;k&&uqptnm4HMOHABKc6#Y*HETIX$K@@CJ07mod}Trb9Wl(fm@ou;|+ zE&)M1z2PyB26m{)tA98^THO47m`{1jwJWzGvUQoyo0a<2(GGB|f55Z@tTsKxxSqzh>v)KEmXoY$&=vBu*74UdjvOvTr zM&@d>$Gdb2AtjtLpi?+0qh)n&ac}6Xn+L87fcH=NOY}vz-`aJk>p9VUmB) z?rehHM8tEdq}qBD=Sz2P@!*V~$!`g3ZZa;P=AATBFA7%NQbIhwd{KS&e#8m8bSRXE^o*;`@2!F5QUJk}Dqy6eQg>3Jy!yc9}b&z{z&Q@C~W*`PU&B z=Mty{RLEVdq-m{G9=C~F%iRl-miSr^L77Q2LHiwN1XOTev;wy7$G>zbT!*}&;pt}Q zxdnK_12+(SH&eXpT+2Hrgv)V+Lz&~P3lVFPr1uUw;qj}{@Q6tu=E`yPiD)(?R-FFj-dymCCEWU!7@q}r-0Ch>?-Har0~EB9p^1qVKgX(`X&g4st`u+4(bZJws`tu$8IW; z)MlOqr)Tk7##M;S7DPqhIa>en52f13R1p{-W0-$6V;Unf*(OsJR*oc|eX?%Ir6(D_ zXPbsuknU?F&s*&EFD?U4q}c?2V(nM({mf_dlNt2|P-Mr_mjY=2p-QWsYQm=x3)neJ zx_R}M1~g@mn1>%g@-+`_^m}Q-Yi=EqQ6p~ZH+~&WzD**e7?SuRFah9QtAVM5O1Efo znREo^a)81}2BBNIez^6)YveA<{8q})KE+dYThkjXMV+QH%q{`{5MU;W@u?a8!Dal>Y-QS}^!}d1jWSC~kACE&FDldLFq)5E- z*V6GAWxTA6THL}YERZ_a-Wzt@tF9sHvFnV6tXB<0(Rp`BX4|*h7=|!pEO{yp+S#UH zZyO*sz;>m@^JJ70x*G4{Z-l9TyMf^}Ml{q(3a$6Gt(WvkU;Z3bOX)G0wxYxNbh0}g za|b;W&`r2K<8#iK)_<;1ede~>f@|tNqQhpG-*|p~%q}nSr+I^=W}bRZz8`E3%!fl1 zru`4pK3;LF{A_R*<{Ufk)_ekFr&ECw6jRgIN_cbm-WCSRM9Vgt3Wj zYweIL6M&4Wa$u_W0NjqV3O$+RpQ&Mk8F9yP zgQ#|gZ49%(3s)fHlYHA1%Rj`3&UAd@_RhYTl-6#fawpJfGJn9F{5ciH9T^{rA%`^<}uOs^H2mF~;NLlwxUQvBol`IbaW zK1bau%6s{~D#<_L(&qyepJQ!FQ1T*K8+~b?bCNMTsEYv_(^ z!$XBz@t?X0!37ZR3fkf<&A7C&vTzt?~{c;3x39 zwpz(JP#%;>1zp?dce-hwx+ic9n1a`^M`xOL%BoF9EELRWv>TEOSd2rE7Zy(NthmKRY z^@WZS`x~B@1+TldZbt@;G>d3lo4C}ZpA|)# z9zv~Gt?bQ`r=G`IWpV1I$Y1EjXS;J>%Q>-kf?yUmLtX4e8=GB5K6PTIF19&Z+2 zAJo)1Wqcy#eH{Hlw>HU)K0vAH-q3CEjTWqXFSy${AnhNvd_`+t{+f z(Zqk78A+)EJ63tQOsaQm=8A+RzV1}+*R%fOSuX;lP5IPF6_N{|2aa7;dx6=-@J*LS z)qG%dQCc;>Zg}f^Z3Ul(z}iiG2MF8We~r+iJnc2|ewaoMV)y>B`f?sWgLh=J05G*ff^73sc7 zoASzo-+4RjhSHzJ5l8>Tha-mata1bScPyIVb~$oa*3~=vweC^7f_7cx$h(|6R0ebM zFcu6{D9h%mzXY@C^*1xCe*DD2#hbh%PGapVZtRkE9tvL-u(*g-kT6N92z)n}j^=<~ zC*FQGycC%=ICV%r;0(H?Eux<$FY81Zc!P6C1CiiOV3t{mU`!=Ka6SVM_kjAS?{um( zeXYDe@!*}6(CsdDwC6taKa_!famBuX&Mst1}Gdm@GFZOwy zPUHz*&aX{}p6&N2hL#i$kBr_^Kk?GKWi%HbME);d@7c*2xv zrg7zi7FJW{0STMlqm7y&Nc>-6YTLYQ2AK8p{#kj6pHV6_imUu>8>+;(`&?jK zDm~nr)2l2$Zi@{^RTdDNp{lW1W1_t5Y#VhBlAjN+rnLzNEx7Pj1uUWS#|sG!gBj)! zIzl*zT13ay4Nq{xp<9G2N!3BL=@R2C`AMMqp799uSon%l3mmA1;y)+`Oosv&NW=;5 z+E*1wSelIdQxiq0Et*gT`6Hw4H4h>iYnoaqjq4~XAEd#LmCpLNh| zgF7+#>x;+i$jBY$LG*4Y-C_PTN89N{>QFU4)wQbWCe(iK9HblgmBw$gs=m39uJV+7 zzT~eyij^B6w0`%L&+Ct5WQ}tofH?5CuoBvw>x)WEqZl+Fe(Ea`m{xmvi{XL!w`gJ0uU0=Bngr=l|p#vb}Gwa^>69$?D<< z6MFL^#9IjtA4NIajBrNde^lfgY?L$?cNJ>M4}2_kt?g>z9rrNG!Rr;)P4skG6L)B3 z!2WsS(xLWX`7QoH@Uf+SIe`gXYwl`@S6g?TPo6&9We zAvaFQP0mVbU%$ByJSiGr3>@cHSFCY-C=gq z?d#GgGQ*fqu4T??mY)Lrw;Aaf`%^H@@n^jPXM}8%F43w6Yxd!13X#~_7u6PACrK{LE$ ze3UQPPpJ7j{yq1k+1$yTRt{^JX`i#5k}%>fQ!-c4bu#%RV(TO)P9E z+S5%v6DMBpXuuNoTtZ|E6h>7q%~{S|*S+JEqV7R>v$gYL*4WqHBEr7dJr=Mf*Qv`o zQ-Yz@qmZ2#V~#4pCvEw+GmgGY7V5AH+7*Dj-B$`vftv>knZd}5bpVh(INz%G$sC?Km7e-C#~sH9skiQ(&Y{v#BhvMOXY`wG(?gc013;nU7K}oup!-T+HuV(Hk;-7Eo zzjhzx;g>k35dJsr+f>tS4Uv|SceP@C*4}Wfn1-j7)b#2~`s`x=^zaSU$sk{ohIvYL zE?p`}N#FC0$31L>9(D;z_n&xg7Bs{u+?x2TGDsHcylC~t?0&p~+f^f^PP6ZnNn%pY zgFSI6QnxdGeYR$E&-7P(q}G@#MP_>6bPH6V+ub$l67?IiD=Ra^;hyV6gfu;G#8dcW z>qDFR{iM&B!)1aN7cVpj)b)?6HFlytDtf0yO{H)TA=PZVTby?X<%EbyLH3N~O-w~h zTGrV7nbHb%Cq4KgUT*$J1w~_8uiU(uIyd{~g5I~vHuE7m8u(~CirZf{hK}*HhE+Y| zB=`*3i9GGK6A@^o*u7JR2zr@7lupIVJCI)S;O6auws2ie_=w0^J7l+ZIfW2>EHfgm zwM*`78k-^T|9SLjLtDj%0hJ&cZ;rpp2_Z8fmq%F{8?;GvIhO}LxX2~&$W{>{C(cCZ zJS8UAU;V7?UxWJo>2aIn%~QNl=c+I|-2#`8O@9ey@@E_-R~)?G-jCwbxLH5)!FZ$z zexTui=v}V|DT~jWbMrkLx~q#1Am7Z*RtzV?%2AcY29-3KKGUn`wqxTGmg*)N$kxi2 ziP;eerY7Gyr;gtme^P`PfUEH|(eT{V^c(RNWtDtp`Ehejug8O}aHZM&D*60DVKJ(1 zxE)qxVh(KwuIV_%Z+_E6=797A8x^#S&qq0x-<|7r1R&*9z%X^%b%Cx1Q=lGpRt^ZP zCR7OlzdS^pn)Xb(P(dRQe!uc%&Cs;i)81(@4zvePLup)EhPK8|Vf~l{pG4org0|O( z`UFqfMsfSp2`@hgX%P$Ogx%KgA3vIC&GVOzX%hXjJRl`CZWUR2c$Z29q%V20wm)OSufGHrcSZ<@eV~m*01+b4YwK z)5X6u*sff8=aKwK_G2EdcC`V)=fMBO@#o!8k5Rq(rSvzxZ>mHk0s(T)BzDwUWSnYH6;wZ{)NuEz1o^C3HsW5cYm2Jgk+0K@DV;|T ztM}`nE~zR<9CV(X^sJ=DU$n=}<;s_KbSq0{Jj3HCB8?aSDs~yIg9XR5^~#Z33^gp_ zC&Z%@r^3|&YbHicsG4hq8FX!-U$|_4;6;#lkBgMqpi{CRiL6qUX;I*3PvSN{@_6>> zrIW7YHcHvSdj7IFgJj`sALC>@BmajdH8RF+nSrf%H`T~)rphAq63!}A@=17nV*Wc&RwW}b%%Q8X-^q_yY9i)B#4En3Xztc zpVI_6+BXYm>Jl8)#iGo4J4qL>Um(;(pMwB(r zrf%z>5^k@9kG+6O1dQcI4JpV5QtBHoST3RUB-#eXK-p&e?(Dt?kZlGaTbT$xZ;J)D zg+(j^QXWj2K*0iuLq_XUsw9V%qrJ~_T6>)rGzzogIq)iO6yunPc9`I_C?nOXM9f#= zH&7(z(g^xl%a76)BW1kKbMAIDDw|ZEqkK-5n+w$Et$eXRg^6sW*k2~!_1W>*rbu%e$3q-1Obr#A{XddrfH(>!KzwZ#m zV!DTcr>U=DWbz>JRgZp(HJ$e{A@fCY4Df##4iv|wMtd*#WG38EHk$s3Cf}&0y(vvD z)}TduU~yX``my6rjyScaSA~ozRlei-1bgu6kA+zjq_Gzp7@po3x%4V=YThEqL=ttb zbNm9l|ENdJ)}p`h=cFyZ1-pS&5Qq|{E_(^<_)|x8p>>c)&G^;M-(>`86 zoR!h3RN4GIaI2`@>18CcAhcxQbZU~cNglfdG@e(Pt1hOIf0Yp*?A7e^0q z79p%Ldq4lF{-)#P3uWn$+=x!nAClqz?I;0`s;y&v#dff2zjjJdKmsLpa3k|VWgTDC zx(dZFu^|z`#{CMt@9)V^qLDHr8S&}Ymb-oIc=2D4_BsXY2E9D{HgWCuPkkMglH0H) z1)=z5Ku3a~qsr0!E!lGG$+OwQ0S=HcPS;8!MYsqbXp)iZ7-)J z@}TOKHd2xjelz50hxN%@8Om=fmV%ZJ=^tD|d7pUaq4!oeJaTZ9plRqKB#&mZ>H$+nQiCA}=(}JAnNNGY_yd@R4W`Zop?~GrfIt9df zz5dv|4JX4@S*icf>K1vMlAyI$>0To4!MH}Q;LV4wb3J|bvo?@FG1U&cul}WW1M?pH zOjj%!RYZ91XJOaT=r5wL-NWySX$Y=1@x}Tc(2o^1h%b5AFj#>FxffMy-GgaHlD)7($Z+u4ba0HsC$R zDP~XL=^^BOChsW<2HpiwuMZ}&-(8=})}fPE%{jZiH13MrhNY6+J(#EyrbQDE6j8>B zJ(-CcW)wE|2H(~vhI2^!?moqTpi?JuCXz5M-mf$aUel{`2dZ)VX1{Q;&VCW#-9u?C zAk7Co@o9IJ^{KO4B7`F4zdW?6JEk|fd+H(L%E{%MR9{<%;+-9GywGF2bPpK5zaTBE zo130^m<~zzPDtbat^LZQODBg0*D$Ws&)7~nZR>bG1b@0YJv#GxR{WlHqnHaPp93?u zZ_nLz@4(2NaxL)dc^6Mw4m)WzSqEJ|{Paxv{Y>kdPp{~m-*j)tF8YjCk&)<=huyV% z!HYnnO%cUX`()ke?=DC^*4<^;@>!}FG**ceef-ciSL^6L#7)MHAu!Ph_prSiJgs>DtB`?`2aIPZ2W0xZ)W;<$_cE^?jz659kZEyKR{OxnSjof0{)b)n-)(pE z-*X=Pa`NL(wgw!T;@`y5Z)aL%J-wM8n%N1g>L0yR`+(?`BinU8m})HVCN=v|nu){D z6dlYA2?#TI1Z*B$J0OY+Bq-sD)bXiyjo63OpSKgTeLt|B*sXTCT8H;7r=2slryRE3 zIl^Kw33n<9x0gYr$NFW))1;h4eLJNj6U-L8@@j?B&qdOQtR?PN_NO;r5&zH!7HeCV+=9Q1j&~M zei8QYvqy|K{qP51vrIexGiV^%4$!sqZ61OTCI10hD!>?Xx6Egz{{Za}xLbxv#uui6 zW032Je+q2pr-O~%3ViSSS%{Xs#`#UlH+Cui=K`K7ymVC@_r9VEjfj&jh%O)3ah}9?mb!Z@3Rwc7T zV=5WkE%QnFKd{D>3uuxd7rQI9pS5hxuXNqBC)2zWfRL2COZ&j`_bwPdIm+&nz!0lX zYO~7)9AcFV%bK7A0YP=d;~;2~`Q_;YG9AGG>RusH(1E}qR-gR0p@C>wmCO!}sbp}s zKPj0V8dENyNrqfHibCQawOXxoT_6nMWi}l+b>&F(nY%yvWIel20z+&*$sWREfFV}7 zu&fD&aAuqYO)`I2;*4#YG~Y^zf^q?eSbg%}h6bW#Rq`s(m`VnB%lv9GsAP6%Ou2w2 z8FERp+vF~i+_=(pfiN^=w;iD0Nc8d6pL{Zj-6z2zR-eSM%LN!>l?%(7U@Bn7Nzf$o z(f;F4S~hMgB?`&~9Afp!e;XQzmQ~5CKw~Ny-0cq~vqNLb1vJT&OU(AM>|@D_bo|+q zKh;|vCMSV9(@Ez8a15~zzZ;y3*nVB9Zbg}LT`3i)eA13rkIhPSNRiH5< zFGv70@&XmAR7d<@D?`mcRH&O2*eXWuYF+;Z@>_1 zc>A}ZF&JWvyzJ1JDHq)Bj|z1aXw1k967ao31=1f_aR1a?{X>Pi!;Q@+!68XZLEG!QL|l6BdkF;gzM+aF3^1sYQ>pvmtQ z>IW^G{VQGfpDNU^>^=z$vHIjacDaB@f^q?eSbg%}h6bW#Rq`s(7!@jGw?CB34vi@n(B$_Db%#i@_Da|NrwTQM-6z2z zR-YVZmkTh&Di@YDe^jWT$sZN!_LUL^@<&;bwo;;?T)-h# zpZvF>foNG1-zw0Uy(YNZA4*;Y8ndATO)}(?exNzr;~;v4>jI6kUxqf2nXdphQ9t?Q zadw{shgf|woLw&95UX5Pt_faNFyka>@<&fef)Kc@=2PiU-{7 z4<)YxjVTwB|NDF(%ld6Ixu9q+cW^(1}RhJF7I0&qm`Yz$Ri*&*z!*HjfM%nk% z^%lu>e!Y_k>#g;U)wo_7F6gj$Tz4}}mdjpqhy8u+R@>`($C}y?cJD+Agn4pJ+$gl) zlOX$EtHI(<-I=h9T-kzM3ORy$IpU|4Q}4;XchO9|Y8dV<(509Y*OF&v)wNSvC~Ozk z5kVux9Is300xy|Y=}(E_2fKD6g&f`Vj^V!peFXpwWCOau015+v{`O%R=s^JJIyY9J zcAr3?+#LYW9s8DnCICP$eP9JzuMPtJOA7>g_d8JQuAT1t*?{sy06=$$fIy|)mKiMt zfJU+b{YwU9^dSgzYa;__PQs#fQFM$ZwgDiO_-CiXG*;~yS5%5l4dE2y`?0S7Or7=8Q|V2{B9 z|MKzw`qZ0yo+_UI!ix2RVUc&LwycJUJs^aisM@K(dZ-|)>sF&`4L~v*RcUX5-LO){ zzC1`(nr;q2{bm8h?S0>Mny?B|a4G{8E34o;*;xfqm9VmU3pipnRvDyh` ziU70)_-c;$&s2S5JyZr&;BMHcTGathu0|Ex@;@9<+ymg|CkI@0>Uj_q8>`?u*;xfp z^|7*gXH{0grC4J{+NafG1p_2&tk?;XvLaOdh!qSLzDH{7$X}eAo&G3ZM1vJ8ASi$N z1VCHGa<9^Vrs@&vp@OWQA6bnmx7Db+52}QfDz@brVU_8C9{_HCa=_K6f~eS71>eaQ zfyF^oY^*A-#wxfJTUgz{YODa4Vv7|ZDQsbt87mkp{1hvGZE8+JJ#ehQoUGon9x8*? zSF2Igvno|yt5LDF>@SW@t7(~U!>f~yyGDu;K757(-6%3H9 zVHG5WEvzz=l{m=4PqE?`r`}8elGRsMtpAj(VpmO82UeqM`>IsETa7BV<$olrGc3t! z)u{|rtgM3XWKUKgDz;>GZ#7mKq_Blm*VSSL10-v#07?0$WCgPDQ>^&KsabYF4Fc9q zD?H#IlNDIyvB^4iwPbZ>RR=u38dYq||CFr2TJ0wXTy^Ss5EUD%;5*rp6^M#00>1!Q z#nB z@>2Obj2HSi9sY~CvP6Hw9>zL@Z$WcNy>dUz@oSpVUBR5!M0);^3zi7;m47@xCWTM$ z$ODW%_F8LFBZq30&-G5@0wAmQ{3dr>@0xUv+f&ez5`fs$o8Y`zIl5?<0|6I+WHZMA z7A&aU=P6H5FA&lGZ|0^L)PU>A7yJ**{g2W8qB*P+cyJ)8|D8M5&3YhpDn(3x@hmt1 zfAA~#-QkbKx7G!tQY3&`@U5(_f?Wd~jF7``{51y)_#70QD*->^S>?>i-bRY%Zs31= zx?q#TdJ`^p;6OVD2LR{vxCNZt50?UdokM$~W_`gnhc$^cPwM_NgY|6xKfqhJihx#w zC;uOAet7aK@CIAHbHh-Eygzd6S>L0orCVj0B|i~Znpq+rrYPSD5M7>G!r!yGgzQyi zXNbCh*Xmnw9)6mAEtQ!=kEX^LuQ9c&9%xu8Vz+|8aX~u(p`T`1A`E)=3^SR?Z);FuAY zG5JTRS_Pap7@iqBVFu40moz*octs8tpbjjGr*lNmE(Z~ zg5W0L&!4KKe~M0L*cpyp%}r|97(Rb{l}-G?&MRe>H*q>)=3^SS$Edz%dyHC;wOGm?10{+zCVd`tlOQ z$P2%iBvz?aS1a;1vopMFl}#LGXPCJOaPp5$WUi7VR?EZxIyjIe)+DhCI3~l4$v@)j zD&Uyv|53dU76Ba`*mV9vYyz9kpBlpdw3e)u6N|a;ttG2FtzvGua{7;-F#5~?yE(8U zW{d0pzBy*)1g`T#*uSt@eR-1usK{O_A%UVs4W{FLo}VY5g*2$9j`{>oXb)?Tg_D^_VQf3-Ph z$hHFvdp}%iwdQ=a!1(_G-v9dUfTcN~)T>i376~M;^)z(+DNeZ?Iy!T?J7obKp0}an zcVg13fL^y~g*J$hML-W&DFTQCd@c7{qBABjbP;H;J66Oqpi2dc0N~((D=FZ$lG~0| z$nEp|{vyC9zX-6e>leHIykA_{Z2XtH z_%b^~ycXxmtP5NZ4hf6_LCX_3!Vafv%pDUWKd+Kb*8-K(1aNHuM0=2Fsvpu>jlQ(7 zpi&VSM4{q`XtPT)mHxm8wlkwa*gUd7sJytE=9!|lG(ANgM1~>o85st!0Ls$RRGmS- z8oj@po4?$-ff993n2wDjMdhc^(P*@HKAkv2rHm3LjD?|<{)=-{WT;scH4fpkxUhi5 z5s*!&Zge$ucAh$63|%5OjE3ROV2x;Db6Q_@1&l(S08Bxv{OPoruI|}67)6z@el|v@mlL35+8@-GQv@n`OqgZ@qrRjsKBG;b z)YO7ps&6?D2n)l8!&-_1${!P=;)TtE_R?s$j74WiAbGmrM`W6jU{oSB0%=agQ83l?es~IcAZXmIEZnS!D&%^FkZXoF$U&vbG(ea%%f z+T|H+zc&QGU`KvNUbGxr+7>r1a+|WvoaS2w)0%^(WvYpig|}yMH`2o1jjP|M@5@|# z*hPPMHBbu!)5=sE`3loAsU8TX9~<+eVjRawj!PT3h->9(9AS%h`04l5sqZ4__0NLP z^{|n%|Bt)346fsO)`Mj+S{5HMGc)VhVrFJ$W|n0!Gcz+YGg=liGc&Uy|Eg~4{a5ar zN^T{$l6>j&Yz|h z4bFKRz^hB-9X8}ghQV84kI#W>m)_;Su=Csm{*g`nBfH(;O!;8?)R?=#d2^Az!xsL? zP@@G(O?TMn9~l}q6V4wQE6)gFALCYUfdf7Vjqi4?}Pb&rQ@$8qyNhJZ*?Tz#w$L?lb$oUKQid=xLvl3{(RDR zZk^-Ltbi_^$ypW87oH^>)i)bY@?A3I-q)|PKv{C{=T}{A(O2;29-f#-%3FaqVT>z> z!=UFFx^40)#5-y&#lqyQxiDF`;*Dz}`MsR?FK$RR*RoxYLha3FMPaUX3Njd1+l5(l z+XGTRym*^lT3YIa*jh^Ju@d2?>1rsqca)S1?;4=|Sqb}TDH*{^M2J0O z5D`2)h^j`+RLdwe9~^BdnZQa!ialc#5j-*&uSRTN%V;$poNbw_g*?lrzpgE4WB^-% zq_#wIb5BHrtzaJ^`g^cmlX$z9k#!-s-BNObm52db!7)N~Y>-8Zn5d3XX(4#bvUbgG zmd9vaJKxw~xe}>nDY?}`(3-9A0t+cUg0fwh#KZur3Tf);PKR0BE8f*(=2ryt#Nezh z@pK&{?_%(yWvJHFESKrJHn^!lX*Ckeax$Hzpg&t7Ja$Zu&WDisoJdF$JH%2js+FVw z8<8-!LQKT))S#mw@vnMD(xqS$EA=+LQoH%~(&6dBdVS*Fdd7yuU=}M$I5r|_Yz4oF z;hDi(U1HD%Mxn)EK`TiVHX`}7@ygEaGwzqt?K3G%HX%E$o@lh~S06S$*Q`yA$$4W&8qfz25c? z(Z#AP9+kflDr7|rFX~>`ArWFr`mhlh`N2#I*IP0`EC(keko~}xtLtGgCAMcvhPD!% zfK@ZFSiAJ0sZAL15ae;xm?gTnt9L)F5TTKG?fcN#ut7d}c|PYdr~Rqs}OWV)b~-yn5w?vI;5 z(kdg4*}tr8(3W{)SHHd09|< z|5*5+f&*so5$Tz<^2uk9C`cl#Gzu=wK=dz!E3sVa-QTf)`>S% zt+Z1UpT8}s8h5yC7|I&*zYp#&{NtmQ?XM4uzwZ8%;GciIS^o9*AAntu(TB_b{lazs zD1`mB{{J3)wwL}4>-pC|G*g7g0)1c;P)u;m__Lsu_LlOR=h@X^AD@|y@_#c)36CwIPHDml+$^R&P*|YlZ6c%!{ zV${+Q{A>OH38?%Tg@?P+m5|n1S!kuz*~90!YS9&yYoYPtg{rlZ>P-I$XU;#hES5Wh zE3N9hV6KF;rP?s28Y;{lh*}$2&$I;>8VlFL4wvWaJ&^vb$jgqzzZLmc<=G@AwlnQn z4CY3iKdN4w1}}Hva~Ld*I#a4%Vg@g)5px)hfgs_h+b%Y(;Z z*eg}mG_8#dIvcA0zU_anBLAPd|7%75$Ca7?hUolHh~xi+nDVz(xc{+i^0!saB>%QY z#y{=x?p#US4wpaeQMWcSpRI@fHPZCIj(ujM_44OkFRSZg zZKw&ztG(g;e&TxB}nRxhkeZ9Rp@o|6Z{P;a{b2Ec~;d6Vl zvx1KY^m@umB7eU+I&%B)v+;g|`?%S;p~u(Z^>TlB+KeWf4VD+ z`do#edw*K<;q!iY-n)1|NQ!!%C`v-~0D5{p>}|X{i6tfZWPjZ2sBgR;9nIi(zQetD ze$dNGfPtfefPg@Q$QmxHjtC8~jIe@$Xh(yB5Px!AE$Lls>@6Hjjf@-}=ymLkEFI|o zxnQJowX&r9dwu3*;jqIId!}<_Ds;h)`n#4^W^HXfGBh(~F(SEz+r|CfdyyXH8;qD~ z9C#SPp8VT$8q806-t_3b+G!;A+%_7y*_}-{rWm*DjrU6XB~yjvh{{t$ov`+L;77Ar z>ah=Lh!lHi^u1q+B1~1eq}DKG=KM*1>`|U(nc@4@4pGTa*457Ede9@Y&*M;~JY$xr zGId5NFtwgmaS7*X(-166@u1c7^(x3`*u4VlqXzvmfk!PJ5S6PUg0*a4z&uniA-5sq zb$%WeDEhl#+^G&5h%PbXh<~pV*K_eYvmiWIFy`~R1+2^RDgR(@d%6npCnkE_>n(MM z+t|dT*T^s_MK7ULP-4whws^!!Ik7o^fsS`5q{upI!t5M^OedOARtJHYP^eS7lRlJ3 zwOT(sk8EH%QCCjGokDF2Pwi#rx1Q%htNrz$p;hTXilsDKiv;ahHizQqE;pi%G<>c~ ztPo*Jef1|E)}6-Uw`Agx^l-(j+rr6X?pr~O#7mtO$*P=5oxE2-$RvfTYo>_L1m;_9 zK&BEyy52Ket0mIeRSBVvj6=F2EUTEla=_xQ>&%9K(?E%e_=@hot`^+z{s-Z5{ZJ6wJs!q zc#Zk*SuaQa@6TYwqRItU5fTsb2}gy|cLq&vVsOMrke>S33Sd#+)+%y6LViAlAW241 z5{PYz>y6^6DxFkV#>*NhV*=u4nVfE7aG8=7q^KR_h8=gfDkiJrwu3@hlIDAfl&LM2 zxs+^WV2V$?Em9F4QWFlbgbGW{h?jq%JaH}m_O>@RhggFv=Ju=(t-5U`b=k$1ZnuE7 zO-Un_lyODc+=CTn&^~%e03D1HLhAl0N9$1A^(a?7Qynedoye3Lj>_eYN(rf@IdMfy z=OH0xJw0TtcemASS z&@@j1=w&0Un+g~Y7NB7x&Io3QyLvJ?Z(lB)<7rt58A1lDGv#_G;)X#WtKR0Oei z?Y7?~R^gA)!h_JMBL2@_uu2Otr9RKROiUVr~Z5e~nU zRUV7V_YJYah_rk}1792Y=v&uL|2EHOf)A@eZO|_4&pevrMu)Q0X+8o_LViG)lrl<4 zqO_6xhCe_FsZaB|GrdPjh6_` zO&$=8|Byn|>&=z#gtr~1Rj|g0bbCqc>(moQoSD+%*v{Kb$wq5r~Gl?p?_BBJE>M#=;5ZxnNQ09~CVEs!hj|G*^K|e27Tywiaj{ zV6Fp#!tU0ZefE55biB2baL%rXL*?|+tE-Hr$pW_S*YS#wa|S{y^MF!XmY-vP)DMv{ z8IPVlHqU=M@vf0lhx_(cMYo(C$rqjFSgbT3L7&h^7Z|fkCuVow?1k>l?g+c$tRV{4|snw7Vl<&-^g7sBQk6RwUV7 z89OOrmrcnN*VV>YK`r36s0#la=#5-birvwRt2QOh`|2ra@^D%n<%c$dJt<<&K>O1i z+nbolFFYAF7isA)*DMGXwk>nC9^J~otrR$Z0 zt`@*~zAbtbcCWQ0XfY8+*(wjI&&SLG@cm8(A9fV`CIsJyh^!2|c->$|g!^9ORQs#U zuIu~l*I@KD=o;OPFEy#Z8Y(0hRK+}zP^{lZN`DV_OR};&duk*zZ3s1i0VAEJ5kt(- z+rV9n`$O&G4E%_WZkjinB9J2oTG?nZ?_NR(k+^aFAL<#uYr9AC>+Kvgxbs@Rn$9Q9 zv*@lr18atyvp5(F_-tyODdVUFf&>qyzYcHi=_ImhF22IAkti%jfAmMu-)R-hh+L4) zkdpC%+1S%V;C_W&Y*?IPv^lbP5wqdD-Vr`XSB!9hP#Yv=-0<8L2}oq}vMlqx*Byi^ zErEsM`5DjoF&ur412>#lLOZ4Af85C-Yw&!G%a}~O;~=Pb3F0)#Ph@vvKx2ZFF_;;* z;n|Mv#@X1c+#t;u56`DMHxIMM(yS6o@K_U%<6g9sJYTw)-<=kf&JijyrHok`53Z&E z04A%AJw~*oOEAZEI1+TyyJ5rqpcCBqZ1#S#g=N&e064x4mfr$I2` zS6j_TX1xFx1i!V+GMCUhBpc$fZ1BAW?e%!NWU`!x2N@N(&U8dX6ROLdhl>wK?-#Wp zs=p(m$DbMF+B*Q5m_<0+fge``H#|quAc8kP@paZF>m!hy=se_+w!$gk*z&v7ds~l| zCYX$cc>%IwxYWB0wVla_Q=U9k(^gFThV;UBj6+(%sYt%H zRPdpwmd|-y5)~p6#M(0waPDym0KbW;0XoUfc`b>t80QM(I3*fR?e8Q!0 z&5E0Zeo0#@>2g5Qv1U8F(#aEf9hkFtpO)OHGP4tyRhiK*(B81BAQGk_BQJ0b{a@T;`27mv79l#}4k0d~sk3AQJAd_`xiC$!< zkcQq!+{WnWBoyers%C77aqf41(Qz zk-V&7kb`;5Nqm$T${ZTQa5 z?dIymD!%n@#?$z`yngN-7&`cPd&=^8`F-H?`qcIQzChCP8*e%&NTa1S&gGa-qjb;S z&gUV>GG~8j?U+ukiJhH&35RY2xa#RI^z^=OkeZ7%wx-|Gs^zuFBJ>UyO0j=zq7?e^ z9$|^tX}EoxU8ug&Pvm{Wv2BZ zWK+l9uzTC?JYf{FiC$Xz%yS#Wn0LFA`(O zk}G=X)z|hne433r417z{_Z*s*do8JSF44}1-&s^%ppdGr=ZARrtG&)Hcgj|v21FYz zlbT;nFx&A}J~Mkan9c_DP{+9@5R}tBp9W(sgB0Es(FyNuooA+xsl?^;>2^Qh1IKMB zTWZtF%%m0W=A$Y1A2a1(D-2X|VK{?+YDyVCXRBEA(em-?+EZNlJ+&wh?FgpBe|C6R zLdX_TWEPhxa$tohjWLbo6 zxvW;VjL>m*c%>3VxQYR;R!nmV5BGTqWJj|yfoxCE!3P5$zqaX$2UMuprEBr*Ia+Ad!EA0@g)gVbp+0b>cmeS z4X%k)SX#xECq*LRGweMCAR5@2oM4jEMan8D1;)%@ACXE?(oU*NU^Ne6LE`Fo`U*U-GDW@^6pQeFPc3ea%maAq$Y@i7v&qTP3S+@7zVqg9 zSbvIG;Nz(m_OQXA?Ccd6Ugi$`3L1d>owP9^104LpkzbGYAt?~N4mssKD`aKBOC~vR z4gI|$Jg^GOn#c8z$033z2&CWcl7is<(41lM#&__m&%yC_VjCM>vlL z+qhLzK@jD)O(E}J%gC_;8pdkSHD3v71(44DTA>)Yny@T94F$x)rjW!6;HFNdqg|h3 zh7aIO&$_TiF`(l~ZCW`xDIT_8c`02`EEZ*#`#GD8l`72d3g!TF7GC0UfG#!YDSMtqBgU)oNCABVMP+`t$$;|>aQbSz*0u_$;vNuM#$ zpQx{454}2pDfW0W`sd1XGs^l&!$uWBiFlwN@P_wd%elvLnblX84_2P^2?ixQ zM{dV1AGmXw=8c$&-l)PB(Hbncf^NEX{gHC;QC{*LS}*-RK~>XvS?BGyp~NNe4-^k4nOYk44fk=` zO3(TiD0>uWuP?%gWXp2N0P_TVYn1PE@&W39M3S*#qVXHtuJlfAi55H}dn_?~X^rz> zaER1IP}$4wLNx~gqZvSQ=x-7Pm1NdOB1F{g?%~yFYJJf|SsT;0$~u zbe$WIQ`t3$d)3F1JWSr2hXixp@KODJQ6D@-U1)1kuft>7>;bVZ-8siRQK>@3S&CB)GBvwpo`2#&`R;&@La5WY zEct6g^cAt-GK>BUU0atvaZhk+hL*YQxa`9VNBvf`f*)Z?M(Z@}q&|Ku!4qS_4gon- z7G^{kzKZ+XxIyul7Y+$1zd|f{e^hq6IQ%=y{LLx@Wg!2$O$=m-il z7FC0OWXWLi2tx4l5;)3k|4v5($#oy}CI46GwX^_oW zhMCf%E6zg(xvFBQD+^NLv+u9w@<$6|l*!DB>OKwM>;m~uf+SkQD5~?iE4()&^NjE1 zE5vqRA8{H|dKLqsdi~A2SYp0CAvLOmpm(KGysUsfG0&=!yWUd_O=eJ%CMmCE)X8fC ziJgqss3^@5BCn(|jcd1Fy~%SH;aggNj$ z;>d^ZyMx6do?(S2egLlEwNFSS&DGQqnz~mem9=|^l}l0MWE`HpTHmZG=M(Rlhn`HN z3jwAL15PFFnfkA%5D4B0jn+b=Pg$7*SGT(x{5MJ zU*0u{;saHJvDVf~@<4f&0w?EJkN)*Hj@;LvSgDa{@Xm$8T@j8DG)mobbV6hTAe)%g zp8(08b7J2s;_xEh60XCKepEnO7x~)LLZtW*WywRO{j$NnS?BCh%w0En;AbcL7FBaUR`!jcP5UwfJ`eaUb&d((Q)% zFLnuPZixBftnYc-KvD8y{{#y5MXxI6y#jskj;3WT67&wummUR%ZQ(vgpejr-9A0$n zj`iKPXyL>euo(O(w~CoBf$F>DhMexpUPNT3G;lw1y=4TANhlSH3+GGFw4cKSN79#F zJM!ghhbh2`m>%PE#Gk-(W!#Tue==DW#J!!)IcWZ=6|;fL(&vcID8NoRDAmlX91*Xd zj{ueAF12U%GAKQ%FF-7@!3<67VrdWcAC2P4SdIaez|pEH{qZs|J}=X#6)T(KP;eyJ z{iY&W+l)xoOCtyx1nissj%e#Gcv4$P@a2YByU66$J|V_6d8R@F!wDG(ly;64ZM$2d zR)zdBkCI4doEY7mGE?hiic*FS!9z?%x6Y(UF@zKLy-MU%y}X+!-1g>^gXbgf#>e5L zG#>`RouY)Dj=JUx4-uVn==w18vME{>N1ciluveGEWJ-Ecm|ub{@OJgyYW)`4mjnj0kpQOVcG!Jby_L#K#HwQM!*uoUotC>}pY-DSOoe|0Arl+X#JoX@;4B?c@MRJ0oe``>3$Kn+IbM4w}E#ThHW z3$>CLaU7S?OzK%FD2=M8~k^PoiJB)e?10PxcFzWGSI>^1;K)Y+?b zn{_^x-kyO7^59*Zl)uQ|isL4Hp75{O^9dO!OiD_qktaQLiBl3!rWb{a9HFlAFsn{Z zbScKXbcY_tOjU9G)EQg#1cXgFNXX=_^GGqcwg9CjI-$Y%Xf3EnKuCVvj!~Ku_I)rX zI8Qm@K&UmQ*+1(#s;vQaF(-rt`tw0BAy+3Pn%@4qxx2r`GJcIiSj;USVGmB)1R}4# zyaBsm#~n;|wk5x{A~B|VH^H+ucR`7J(;T9)5L3*;leV^Xdc_(|W2*2c@(nhUEEoo2 ztr-aB4arS~H^I*}(D(I4focT?;eT-tbMm9V>CsL%WxkV_B%$zr-JhN8?}M}&s7*9# zwL_kLpCa)DlQg*Tr)nwybR=0qbmk8_osm3%^Y&)EYR(;WevbM~sV0QuKkKNMcLrsx zo?Gl*{pF9BTg4?i;`!h;!0~o}_*amWOR1gYl3qe2tswoF!i1IYYSw?E6=*nu>%Jsr z!}z&1WKIXt7c%Wgrd8{o;H4m1eb3WL)KJZ*T9z8){vwI4PgmWVM|p!QjyC&~E6h2U zDL$$*8~^DlWk#24ueU%F!qYZ~R(bChf@781E{6zyAcy|&yEKnbl9~l}Q41n{AG`n% z%k%v8Ud(!qr+J%3U%_3AjpFT0Gd#s|_tE`OOvMJWGtk*rBvK%$< zr4s+a`cMd!N4rM=Wi1O{D6>et6JWBC;BP-b>`B1nO&k(|U&0xPU}9K-MdPh6?lakn zz(t_lt^RM1fRj;Nt++;ds~WZpJJsYG0j%7|;@UE!1Hx5P@J4AmnlDxqC-A`eCa_ze zr)`3TWvQBm5ull~)lQx35~{Z0@rru9Vj!y9iJVpj`FF4>)%i+2qtgIXTwayf;*9kxdVmUC9cuVfKGRBL2s*SMg-n}Q()^n5Zhu!CIbq`l%NTZ z&#iCxMHY-}ko9hPR%L@1M%W~Tw&VtwccAQqwP=?(CheP}fBmUMmRK>)>>lW_4ZNgmkOXmE;$VZq z57?>{QQ@Zy<<$r@`&yVE&!t_7Y@!f=|#Bomu1OO#B;C@nH7XiZRe_H-(Kie zsn?90D(#YUqi~yLB0_(c&W}Q%sF9LnZtDZ^2*w+@Z{e@lNt~tQO}RXWYM8M}Z;a#M zg~lxD7_nC0aJXtt&dvGzt;f!L{Ea*^{AY-L^`~Emm(AL7kXDrUlotvespr#kLtRwj zs5*)E%SteGP?*Uf8`%Sx7bToH<6}?SL=R#O2roY5anr`AkocIO69EX@8EHnu;(S}AaF-9^qXP7ZpRi&Z| zEie~PDqO5vc4g5?gxJDSK3P2e@;9}Cs8$enAphV*ze&*RcapBYcX570QEbqs8g2rI zL&xAF%E0&dr0&fj;z&ys5?F6T{SOY)?{gjezqW@+G7Ut{*0~f!HR41VgUdpY@r#88 zqGn5Lnw9fZ=FC}kbms(yp3yTViuZN!69!^ zv#_T(rdVr3MD=eCZAhz3T!~80vKBT#jsdA)S6G(lOT+ zmbUxF7;yMhM?GJ$nh8LN|w6bpT^a?$#>+;Wl^~v3P z>ls;+!me-kFjI-o5@q}WGRRE8T7^0HuyF#vA=OmoYDaNEJ+}!{rCNiYU9dPnQf3-$x($x#|aBy>LWrlAR z%yCLBKR}c3=EhfGQSBwqJ-w>>}#AjO3BJS=qLy-JlhtS?zfi0cM$T*ieC$D5;aD54Ci98gTb5;$FIP36XgE6v*b z1!OdRQzS0gl?l?M^4XL{a=3(e5L2de^XDO`AJekAmIT*)W{&qU38R`<0)#t3t7M2_ zN$qle)S3<>$qXVD!7azG2w{7T2C8ZAvAqS}NTors$#T?>Q#8rtnAXfYj9T?+UjTf7 z)Mv-{CiLMH82{-<r|jdx`e#~Cp~vB1EPt)U{*2nE=knLWFtL$0Xu+_q?ow~{ zl2obh%5Z7Vj8V45Gj+N4pm5taRj~xf84(``{1|_hHA2tEg+G8w@W##Uuq`d^u2mJ9 zqgqeDEYtTZ;6Ct=&spWVr=!a7{niK*m)c}72VNjk(cAR7bcPirbsJ+o?ttvlY|P>) zOCKQw%r9yUXcJVrj#$th*$$TV+=#oZ>S^XTYXZ#caG2pKc^~jXaE3OUTUVpQB-bS* zR)ME!KXD?Z3fMLDT$EaFfrsE6!=vARJ*r1>k&)v+S?5Pn8>N-Ll@i5V=6}QZt!k@C z?uDiaFBUj)ax|C`rClkq*TwbQm;_{1#JSDSBJ^;b8I_(lO?{1dmfVS;T|OtTDY$BjjiwxbB<6e zBP27Fr#bCC*4|#T2`N06dhVsRH!Q9!S2s+#~tSgY5=?1M#M=*DLcMiGeY>TYmt@1-;*pjVLP&m$bpr1BscaH z81)5_{O6dZcAfll3m$=3852Fn?J_~kad@%tlp`^OoE4W9zm;gM6q@J)4faoQ>X84C zG5xs8%n3X=>TR%iq<7zCQatpeHH2^Z6BFZ3lYr}|Fj+FG)CM&gr?-byn>ooV5HR7c z__2D@L2L5FdM4k*6omEbMK5A)@ z+25n&>jt`eJ|W9@`zQNz#%?lKiHO{v!v=+rgulaS<~~v}g(+-9>lC74EGlvOH8|bD z#S{jXQ^0Q8Btm*f-^kZ}zY+C-)fPG@$GSz5uDb9(*=jgA7R)^kkQLcW!N44d+iGqrcdz}ixivym5z z6m>JzqE+z-7wHVZ=XaW;VOSpE3)HgCJjyQ?03Si|2hAoFi_fpy;5H(z=LVDEE-b9u zkH2#KPsFmdqnDA80F9_jfyk9flFNm-QfkQDK;ye|InRFffC^uufEu)P;<+HHu~rL- zxHE?4#!&17_&r^EOawiuZgIMmb|j~;l3$@@TJTPKIysn$g)@KwoqcsbYZ&j{)7ZpA zntEH7!_@DrH87(O@J`0`W(cTZ+Xi0*7$&(73o(lVTGOF|bYP5*6+y@%lZ35T&C|FO-aUz!KJL@U}xd zXp{dIi!bPqEZoDWXGo6XdEJ`V7d2yw>=$0%bNB?Otdpe?HasuqL0QKK&*-|NJxNyi znM$}ost%K}RlPLf;Ta6E-HVX^3Y4F)I$75Ir`qXDy|NDv;p-if;(8RAo{+9A;!Ly) z1vR!gI#p9vCVS3{RW!D>!A7sVS2Y}AXLndZIW$+8U<0{vSb9Xy?{(Qy;-)AnLs90N5&f#Xeb#rxr43PqxHk##xbbWbaJF6h~0&&QS(q!-n5>nnW;B z_!-z=P5B)KRK71+U=lXdo!QMLj<4pcSbDFXsiIaixV?6JiYU@zp#UMB%hOuHCLcSu zhYBONmZPXoGk^d!4r+*hC?n608N*$wS#iA(v0U!LF%qyIWU(Mc-k zo4uk19~X9(t_$=JSb%WAT)|3ezBN2)YEXrZpsE1|W+2g@s+jmex$383iqo)XRh+P? z&2=dHD>Qb9X%tDa{RK6s{|mamn3}-8cfahdpuxk{Sv7R#sOf<@h z+gIJ91Zd*vq<2 zDDtII+`1f`2Lk5CF%24xN{}~Mbr3FO8R7*;sS=M!rrDio*d7>t^1~q)No`IE_`n?R zyAm%m@EE~?5RnX==3LsTYQYhh1D%1czDH6qNPtj@^sOt#FSx@{1rf4r6g- zvi6Cx!AY?WR^0pR%To2{mTC=x;G z*<%vHDw+29BVtPYn&#B&2esc5rHKLd1HZThAb)=-Sz1_kR96n_<@AXsxs&_dS*LL)Svj#9y#RFBQE^PT~TXE8FSKCX^&!`5rT_qwnV2| z5|QOwrD8n5;TgMci%N)(FvaNLrN~`#$9aW2QLtsF&%N;lkG#+U+U62O|F%~&F{pna zR37uUC*i`m~*194-{`I4Vrm++GAB@N|u`#xXzb zGySKqNlYJ22LlJeh9S=sJ|AfLyb>B`Z*v46)(d2i6AV9P8?=uKwT>4x*m zC`=mcI2oU>V-s#O>yZ_CO(^xE0fYu->7@?a>-z^+?>HiS5tb+??3Gn-mjE5YiIUtF zAy%rACD2)dMi_(;V7(d{DPVOwfuvSVL?#aGslT2g(&)CPIwASE@*)vR59RHPr{Ky)1K?6AU_37H?h6{AxsM7E>>5-j! zQTm7N;1l(i&9quOo#zhbA=BX)w%F}{3R~97n&xg=IQ*89L-3$&0Ipl6UU|j2)Bz9C@bC?-+J}v>_Qzsl zFS7wM8W8X9br*aGM7YplFkA-1boR zG}|_rSSraLP>v7gsHx^4sj(um)*;~Na!OtF_OmUU(0eH&i4o|x9hzZ_$YO@Yt^bHX!0dto6s?52PWN;9wSm#5!RZ_>p-OW*A{6bLdUZTVmacV~ z6D{+ew0pbfeh(TfiA2f;##B@aNbRX20*fWJ+d25en*V zWgNlEwb)+aNfkm#*Jj2Tlp5*T^`^uW_YbDXntwV9E=p^+c*;A`EQ!4I>XU19pfw8? zcQ22aMoY}9<>hVg;9y8i=CU886#}-^Z@byFD9lXnw1HLpI4t~JTMEsBT56PZ@V6*;^(JSkBUed^5fT%LnYdbau`moRe25$l} zKP&qX@)uZ#^IrVqwhsH<)6*ICNVG57NVq^McdRwvLC^AsAf-JJ*gaW2hIB4y73`K+ zX>YfRvDU;n;i9eNUz!MNXlU8pE4VbV4U~86dtlS~Ro2dv6eQ-}Ja;U|gzJt#{6BMS zpFK?C^i?(>334LpcP3<1kfo{|=n_gTjbBb^i=Y1wd=^z{$$39o=X;6FTcj@>#!9#v z2ZlYRAm8D$`>ck7wBL53f7D?-?o_z7RYctXvIZ1=KRPh-fQfv#*CK*cH@A zD2D=yUykEu1DR0qR1?r$+xT{ey4FEif$wuBi6lSnC^@xiLi~rK^biOWp+Nb6R^Q}) zCyrkH+(3lHraN39lqb{82HNdzGXl~&SwOd(tB_56b-klO+@8VR_Ing5hs63pvPzOO-E(DKZmwjyC;_AK;d%4!tEc7%6JU>~A(VI2HwzUw2Os&c zuZ|frXTa!#jAdcZ@~crk<@!fcjmSG94mGM|K2e4TjPo7kWT(DrlPqg*P>h_bz?!ci z{Nnq|2iU)!1S`WZc;E&H0Resm0Rj9sC&B(X1IG0C3|NJVmctGi>KirI*;prQ?Bv7X zy(C|%G5gB6bgfxdO}HhNSn<#8{H{)nXjE>YMiUdAa5`JWRgbR=3@c3UBy9eo2L+W_ zj4tf*jafW0sMzubc7y8E-J&C|5v0kUXCa9w?bFgudxRS@?N~E|T4RnI?B}SKLhs$I zDQ$?QP(9yH427^k{c_7J#&qb#1{xjMZG$2`TGvI_wrGuMwd0_O@HK2fW=>)->d-30 zh$$>^q(@skkUU!@>Vq<`$VoM7ZqAA?6T^8acW%tjpUsoUylr_tn zekb6BSFnu_gSwXFNT_0#0Zl)?30=RtPA==OML{1bBaT#2jb+_wWUY#7UXP2loks2d zB7`o3h9+OM>el{Y?)!2Fz1l!H6r-rzzwP7D|G`bkhETScimXB8&At7O#(wg(-s+}< zm-2;xUe0!z>dT63XF67QnZk4^hi$UNv;LP>Zbnov;?`>)20T%RS#qqq5Hb*;H}nn3 z^~C3oEP(ug&6lW-+y@zyR4$uP{aAxH0yqy2YfN+*u+s1pUV?u7Q(`cz z5=tO;dH`z}kgcfT50*XD zU9QpkyK{#@DX9w~Nw#$f~UPOrSYU3ndalqdn3=|JZJ-hMRg%FXA z@jIl)O70K?hjU#R2g#8w{|u}t(!CEt1xE<$=YjPH@^Psu5=oh|NtwoqP*Dtr;H!nC zYrl!e%#Op1-Y%;}-@f;JukZPx=H1yANeBWxs$g{BmU>q8QRkoY@WdQo_qZ#w_ZWiv zO_T?Emx+&`2|V!m`^BA_OAq|ZEIz7oi<-z(tO7*aboI0K+VYL;APWbKEZX}TEtzZ> zeUGOLxkiHLMQem*N3ZUBf;SDsyI@CR=HKkq<4v`V@Ed#hF2T;>H*1*r&xGV+my>A` z@yMzFH1dKKJL&f%Eiv`TETIR_w9Z*@``0oRNr=1=a)ir|joI2RNgGbqJ?K;L{#qbT z``$EFxb^!@n_cR^1;>e<9y>u297$0Cfc}@@cq0PboxFdj4BpBzdP)hjFK#^M2R{!k z2Dot3;&p3sVymwX4QK!@mLSiP?UL>5)ifD0HI+2wawvS5Yiu@xPA4&bcml7;`R)@b z(^J6|xmH?tQ(~`AdbOGB;`x11J+BU-c0m+n3kvt4wFgLj?R30=>tNmjm$An6AlV4T z&l1<)ROp_O;aW4~KB2)6a&J@Hy_1E^Q|E}n_$yy99+}qf4EtB&t zzY2*B&}=#lpdLfO_|&A_NBU8lSyiCv0+NPP7z}((XG<(X_Y;bB_?v+(Lbz&}9_?kpG)*51atcKA~#m?fb{A`-M5Us2Evz; z4fV&EH(yQGp`5nHFTeXX0F-JoPpoWTtK}ICjLAa~xrH!F?^cH|_+i^b2A5ox1W%4D zr4D*u04xrj{lsDUST>r~c1P-Xw_>dm`gKKn{@l(A3(RYxgxYu0+fyTX0^q!}^*~ieZZxppLiGK$U>ZK)u<9Gvs>St?% z3YCcClGcWTe(LIWjSJsswt#62o#~wo3*Sn%Eexp;@Ejhs9v$oX$M@j1o$rR>pyg`& z1lkv}>_T!Tk?~fRnDDz{rTf|=x;;ZliCdviovB6fj;t0!4U2O;_MjK(roXR;mP+#~ zU+o_z7`3sEwuy|GE6W=t&5B74#RV63zj0a|x-(E zGOWt=aZ+RGtI8`%{g`=mFWob-wiVlAb8ept?(Ay`j-YCkImID`Rj$cw+Mg2k>_Kwx+qGI452e%w8+E~WoGUPk;+i|!P!L6(VCH| z0Dj6q5d?^m5`YD(Ok^UNgmeKG0=)pq_e|43*(3P@C>nmKU$s$8>EBf+XhFgjyw=Jo+mydGG42 z)5R`TdzU%+(Xnh$d@pKBJ*lr{h4Vtn8612Z>7?sTO)oB7-pyC|me;Yi!55Q#QQK2u zJvR3e$~V4PEn~DUcMa`$z0807%fVXLbCz>k_36^+@a_R^+EcKSt)qWyKKx6fYd!@4 zAVviMF#gi~ALRzF!(eVdR6p{{u*a}8aF5l9rYpZM+>aKFJr>GleH>U*u6yD*F8icF zH3!%>e{WmQH(i+nx~`|1>+kQMd)aw3t86m{QZ9QB4?h*2>XW*yA2PS!ea1oaWrd+P zT^HWOdcdNw{G}CrXt%rCL7ECQt&2;lbj97_?(rlT#B)*z;GzI^i3(+XW{i_cGBs~t zEaG=2g7?0n8{*0au@0!Nt^4#$r=q`|jJp-lrUYmR?@D%1`VGth7l3@~E4wu>WmSj2--R8OfHBB-Q^5ied1%|dzPV!mB&-8pe7PS~|Mo##0o z68`y1@D-eF%~?PKsTNhRk5Y$X`G(F4B#6o|;jJrZO1d_9T<%8Va!PhGWM8w)XEfn^ z$!z;XgMGudin@HZShPqyEXIU3XRPH&JJV4)%ZOTibSFla?t7(ipmap1yg-J0ci!tc zt%KQ)dl}!i~3%J;Iozp`&AEvZK6Baiq_PsfX^$Om9X65 z|9*9K14QxqlV$XyTaTw6T(LMaA^!o?=#6G*bD0`1Gc!(lITm8oF;6T2W;B=>o(r>( z9DpvRqnBSy-aK2^Y0Pazwlkh1PX!ahzy`IOQ<|3TEf>wAoBia4!X|569R$R@h6|?K#-2JM z`((VP?bxwYR0MD|7Zht^;8`;!lUR2)`qGi`js&d?!IZnJv{^>AA&Zq$s*}W+A%14l zCfT44dvCRsan~Cw|Ir!Kymhesj)*}FeSb=!peli3gc?v#vQQlsAbA%;`e#I1$u?30 zk=pMENm^w9;0DYQ3Ws@mOI`Ey{IR&?=$jKu&2&HBB>5iGZzyR*QZ)V(?FfTA{TsYg zn|?Xv7zxe)%bdR%kQCb_Qc^7x#4V@WPQQAYeBKP6en3CYj$e+Yx~C&&p8Pxj<2iw8ypaRR1H>T^xb)}Ce}@ZlFu4*Pf+v=Lg8zpuk@Jx6@J+W+>JXOZfUX^7TXb`We|8$~oBDInwFd+0nXLTS-TcK>;zq z2>TR{ZBb!l^+;DtEboq>aZ3$XaW4? zA+%|#ZeKDWcf+&9uJtSE?O3dGhmH(1nq6o>cH) zt(lX7EU$`#BL#ovY0?voOm8>iv#ON)s3b>9Iok&_l=qY?o!tMo0pOW$dr*L1D+dAq zK>WWOFtl|r{4l15@R{HEFv27P*cLtDaDYvZ9nlKzKHI_E_d z&fkWU9FOhfYYG@-4MD2quxgwB5pZRvxX32Rmz``dhU5=9Es}zH@CPcIgI;bcxU5>9 z*SK4Wu|U*US`Jg!kfGyJk>mv^OtYS=HXvetxxk>EuBl`wx^;LJ4nA;^lbPHtE;6wF zu`tW2&`}g0CAu3!Hzns;hn>DHRE2tdK#wabQ!4^WAx)jM*GW1ur#_&u@@jo=Gd*Oy zT$juJhPNoHl;V^`D23(0Xf&F&Zx^=%8soaY5@Rl_AEM)klnB~vB&N)!%P-+>U`oa< zTEkh@XyP5emxK^y8DFWzU3j?gZ5eU!zHi9E$#m!(YdOQoErtV?xY39qbN zK!kc<$Oi^FKZ`%Zl(5QfujdCU?~F{z)YR?x_MEx9n~>&+eo+X6i$q8{m7e@#s1{+w zV54}s#(aI{Quzce9?H~f+)X5XF;VQa?|F)kD`cuHumHr*lWc0ID2alF*K(CH*oJ26 zieW_0sz*2+m3eUb0@@SAL($|%v|^*86ce;DJ80t)I4~CS9!FISmEARWLw0%dBpula zE4*iSli8p|~x>FdGRPc`diu1@dUP`c|qOPMO< zCFV~+iS+4FtkW`T_xXbsDY1a2DUnwq7PB!RhiiFwK;|h z4OPA>x0c(lOAZLh17BIhTl8p8s%Jp&I#eAv zCZ#Zq1RsnH7DTp(UFVu#m`(Jqk6`p=rz?p-&X{fJZCP`ZV9HbA?-C2b7`Rd_oV7_B z_LAaLIECb~7KtRB%>f&uwFxO+jm--oXjLwoJhECinkZ}%hHxS^ftrvd1)7_5gpxxQ ziwvTbKfoEDfKUz!7uUemK#`=u|#>YqnnoA;7 zT@F)X>lr9)AeAO-Yx-m5=ks7%opA@d^jt8fTQwQ>YKtxa!c zB7&r{zzHxcofmY8fq6#bZJ%o#U>Z~pA7q_a67l%uw4KOQGxDKxM_mdWB`Z$6$1)Ju?;jXOr2y?Cg}G7 z1=}>+`6%pzMrXq8S=8W^#xk;ZX5C=`DmS_AiIpVfDd;5Ynomu|@s_wtK##bC#zLkF z%ja;J$*K--rLl}<+MLEg{sLq9%^)q`HDyD=u*VxyPULwhB{5eWg+IxjpEo>bgh;O5 z^PYKT&$*`sEE`Hoi>QA&U5Ug45_d4=xJp6E0mea~b71{gblZZvRWXQmv+1&&R>7s-ySQ3kmYq6F|@mezswfXg> z+8Rk6zW}K1w`X^ZaSVYY0k=m-zKK2b4IX=0Tc)BetErj}5j%sQi(-j=(&X|`{UC7h z_ZP?y&iVQ-jiv?i#LD0V7e-^iYw; z$e?71?jmQmy@HJ0kbDt6@|7Nth6#qUw6W>oO|meb;6*Lm(owhnrajS|_kd*5D9nIO z?&h7BnD7jvvqpEExF}Drt(#=cxZPXhid1}&5wsY8kPKYV#1i4v^1W+dl&u~rs+~=t3tF=yNn@XaVW#q+YX(m8#w7S zkdotvoD00fwb}Jghh)g`4Plqo;%TAjBIiv=O@X~2`N7hVb%`x-nL@m#HwkJOuV(Bv znc{OEfcz2?=l@atW+dQ%+=$FVRZE9qFQFV$B-?TsX&uEDs9}u4yw4sjvX1*dmxv|-^8rjsY`7Uu{ zPuBh6iyjLSM(Rs6JW?u=G{%%q>Q5lVZ3(D0RsV4{w*7Q_{QYOP>Zew+IffMVg`kkvwo>p`pSKD8PdTq9o~qgJ$)6PXH`P9ls^0!d$5)}x3B$lx}RX5B0g6(pCA3LFIxvOK5p@sx9x9lOXSXeFNe}|H~62i z=L^7@O4X{v9ZxT8)mN9Usar33Cz3v^huxVTKDt@FINq&17xmpGtL2B#-u0Ygd$iqC zbB;fiA72l*uk2Dre=KZL9KGKT-{fAN!jH+z!i8jyku9k&N4AMBh%KX+emtdik6bP^ z>js^~eb}zIU$JRlj#0n*EM>hlVQJiFhH>xP!ae$InjXTR6m_c`yAx(#POY2Tzb?1; z({1ig_=Z)xIcMD2`ILQhzZ8COs#q6H72j^>wszs1-4@?)jM%EczYd=yfIq|YoOD`3 zK8Fk8I0~@;hOogRlqNQs7dz`nW?h=yZe(~34*?uRzo^FdXR)r)$4>MLQnx!sbVBYh z_lM7r%RgNXG)qUwC(ElA#2H|AYDQ$W4(w+Y-0ontsEVR_Gz|=io01!nCcZ8~{LBUh ze<_3#;VXOHd5FU4j30k3?soWLUez_QtQriyK^Zs$(+l#7U|A*yYnAH z=FHcX=k^vYb`t3>a=VLme`9~aC02c_D|j~sjXH^IDJ3lT?`^)J`Fsl5-A-Ak?a*M+ z`Pgr=64f4?2Oq@$B)iPMo%_5^f7>p4+QsKxlxE(1tNJMNsMuiZ#`e4wY24fpa;_MV z%@e7{ZAMda2G@ye13rP3!@tCrBzJM;rMlI*e|sCY-9LVtlP}_{PK?m%d^x;j(CvJV zE#}+2ls)8I%Us|Yqib6C)NWSoN-gUg_P~(r$NqKI#88vFoiWrC5^PJ@Z+%O@h9PZ% zEp31;?V-;WZF4o={e+b5V_I)tAGE-s{+^M zi8Fo|zwv1YE{e-D%gbxIt?F^%Qc;)pU5Bmj)Fx2253uKl^<4Li8{?{*!|I>wN>?l1 zV=u;`%e2nzNrcngbkCvf>D1s+uHV$xJ#1!wsqevV?ZK|ewrbdm2~Va0p4>MCnAeB; z&-D||%oNu10*K zcb+Son`8O=J8aPrmp8kjjZd8Fv|gtzciKPk@aFx=%h4>7!Mg03uUPpChu@Ly?wcon z`i#fC-ja_MHdjeb-Mm@-*t^u?Q@rnK!Z$x}xd{ol>3kjD(QAE}indIG-sHQ$-_)di z?`mZRqwVAwEru^&cl2(En$y)%{d9g`bXbPJH)aO#NmCNWN{04v(t0}3%L2e&dLO;7 z*>9^nZF}!exbMr_?Yq=TL&u~?WcjJ)=}c%BVd3e!S^pUG>aft&Hnz|3UgMGCL(>dR z+ZUKWLFX+Qz>YxI{q!w2@-~IFCiV9>Y%}(Bf^s_V2*{|sl!a{jcXINI52l=nZt;8a zUHe;}ijRU!@Rkpp+Zzsgo5A~GW|$0<@2m7)hTMjHa`vAfwR!?x@U&Len|(`2y>{-EADE>YnS)KNT>&r6 zRj??!zzWj&#G7wkhM^(B-59~w>lm~J1Mb1`H4q4f`oVe3aiQX9;M|AeNb=Y(^AquU zDA4@DutvWHgR=(pq;7tj#t&!f$8)XRrR^cN8)xiAlO366?6K`L=j5dc=Dh)->eIZS z(*yv4I4ax|NB19a2(G+g>I#Km2!bEliuwbjJmwf@m(e0&smTMSD=NwXog8xh^h06@ z{4=hN6CvtTBZwm8F@&M8iH77e2S6o&NB!AJ)B}OBB?b^A{;efPsCD=#IP69F5Y5@Wnvb}@5-S^m0ttS;trjabMAEB-OG zhBGTP)_&ilep>6qKH z&lCG}J1Zxz@p1dbsi6K3cKD&fkfM`Ejr){xk{)|Akw9ys)7NljIDvtK$BgU^91Can zcPN(c3m=KndgW&Vx1suTw2Pl$H~?U{zK%ps!$lbWN8-@{CnsM}9YfF`{TWxrqOm3d zV!(}ou;D<&$$^C7g*VVbJ4EA*Kg-k1oIx<0Kw^!7HJWmaP3u#mecd>KZa8rK^5yA7 z>1z#DM7J)$;i+;6xzP^Jy16q#_}2ifL(oK?!rXb=ALEgwExA^84oDEx%J|ROtK?ZyrFh9-9 z7DeQRV#nvyzJXwTw)(c+WIM02z2V+mnNNZ~k-1C;eMGUH zFUDm>)r-oiyklc-yu6*pg`;K{pr^#;LTU*w@+tP6BTM9{?lSvPGW#cMGwDNewPM8` zG5!OUBZQLu&p6)az`5p*Sr8HdEv7Vx(-?zI9B;$uEvIiNRM_D%j~ zw!BPpfMcTLnCcbHab`Ae2`77&>I}!VVs^6`9K&wy_v!~XJ?|1BfVC@Y#%X{D zR-MN;ETNYl$)MV(D@UFFHQk5P(B|nMu9l834#oqF=R0em9Joh?hGnI|${!o3N(hK) znuX{5Ll1r@1_i&Zx|fyAynS1u&r3p`Dk{K??hog-?UkDs@8V%SWSt6zt6wp_mR4Z~ zEFLrMZCmO{>9J1!I9J#V%zzn~0dsrgjDGyCZy@51e%a!(f*#5~hp_y(@lO=@(ZU7; zW?%-ay1$;4--<5ch>r4evV3CB{j=uNG|7FR-&E9b{|r*hmEJk~ z`$RSNSd!y!`&ztJ3lMO_SEse&*WpLD;kN>?3KNI*-#1H6o8Rnu==%L4-H{;Eaw!b_ zpq5dP21p7lmQjPaDm%zaP5y_6AV~d{#8a(=-W2(@0PB3C`xY~|dp8o))0mGEs zxPsp-{g6FXfMCHI6fq$L@jvwFcaq|xvqm=O^aiq^&w~*~u_yWamqQ#v1TKw!yW&ZN zbe_n%QCLdK_S!fCW;kjS%Vgjl{K~FzDp=oXSEym%0UFj5=sss4kjEZ} z2}>G}sS2IN3>!CYA1p{HB<7yVh^G1VSQ_{@?CCntZ(JFJLPXUa?q}n2*}*~=neJ>z z94mI0zU)|f0=BCGV1Cnp{;g-*oE@bJIsPpiKMvF`t>BXR0-`MOAjWRY5^0KnOf{PE zk84UL1pA4~9vuUE*k9owE142PMc`wMC!i`vHAC*vYD3N6>bgO_*7J{0iJ1dQ^eRjs z<%WL59CXj^IX>y|Y2403J;9zSODm_U9Z*^xvE{R&Ek-C?oaMP&8x;?u0N}sxi=DOR-%jQw@aNa%dYvDaA`{{a51jk%hfPPtBY9GQ>@;oSH5cqx!$Utam1ilqTt0@&a{!1?=< z6VEhHtILim54paUp$0{ylY7=tDOs0uA8m`WC-3O6Vx@$#jps*`!k|aIId4r4O(REy zt(2+$fMD!C8VnZMpdbM`#1tWDE3FH>SD6;CN69R$1Q4sl!{g)rhr{#p@xe30SWI!f z=eQil{81v_&x*u{%X?rA13GYc@j#kwcQis;;wlwCs)uk&X*n5^WD+UC-t%Hv0>por zfuj6SM5It=X0~{3N;yaN@3DnorUwUC0}QqM6t4afe%l%tcJAD;`lxd7`gQD2N&|fn z9xpi$`Ks&_8i6dn0$jfrtxXDMbC7~{2S)r7X>|-EpoSKFXKY=sVaRG?>W~5(j0e1$ zkP8D(k&i;yvvJ*Gc$b|0WSU+UpbXsv4lUxPL98?H=lzswUfiEkQ{p;+>vT7n-cNJG z)%e}3@2)SK&6|8aby?0F!(3u70bxIZt#}!aWF~9p4i4)DmivDi% zAR*BIw>RY84hYGC5$N<_J)5$4>|Pw}-_8B&t}d4{Y(|(Y}JMI4HxHv*2Bg7UAR&S$iHW6w zv!jcN(0r#k#FQxcg)nJ=B&@bWQjf=i5Gw(q!J1MBN0Xd_iM6_dcCKX`D<~|HN z6U};|WL4_zPA${kiagO!GrlD57SP@y3fw%z4kBU-Ci6H68)6QnmQDTOS}?Q<>(LIh zCVjPk0aJ1pQMoL8f9aC2h95sS@!s`oPWISqBYRsm?9C;?xb#3ZFNH^U9u~1@`hK>YkneA#|Jtee>^o8B?><|cj)z40m8l=8y#@|3Gg^eL4^ zO%Ha?AKVU2|B=TSz{!_4Gd+)4DX-OwNScU&9heM^vnn3v7&ZH>V#RXxYSXF%|lo0O%2KEHRPmS8xfK?7Vz(bDO# zpXwz^kUaIpQX!B(EEN+1Awfip6%xWBA;KHWjGz#R7ojpUvJc$JLV`f zvk0V2&>O}MA)}9U%ZAkeg`K`b(U^%>Xr(n4tInXhK;Bgp858e?mD2 zU5P^jAb(QEBFcPk>SQ)Cq76`(LY@M+%lE~)NjV$f8nVz5eGx!@we0-{ho*@%*nz?e zq_EQ-L_>={Wj+<}-gLeCeDTT_QMOkDa|XLBXob}O6rk@vY$>FwB6yG@R}6zTbZ3t3 zKDFM3zhSn)vYqN+i6s%il_~vF%p8u)7Yb?%6=oI^N0dkmDg9-Z$DQAR&+V&3`Iod( z71wzZamJ+zRR{lg-*__Zmie);Hx8~9^bicb*!_C{~7tT1N0(v zIy0BR19Dow_w0m*3HdK?#&5~DgmDGtlog{;jVK1}l5&CzC{gZ1dCXGz7^_pS{13=x zf6I`wI|IHr<7L?|EKQ2Pyx+xR&3z?Jhw|Ds6VzpA#(BIq6`%t@RUTf$rngQl;Q&2V zUiQFf{?z2#E%dk@+c&h!lthm~ZlQfVN&_t+F$t{P$U(#@NXllh%0CnSWl$A2$4T2V zDHC?CEQd_pTGsP3Z|fIyP38wPfRn!o-jQP`vr-=1pDT`vb`Rz?S~nsy<~}={FQh(7 zl?-0m>Po6T3GsjGsI({EyJo`;*LQUD#uXC9<-EQbdix~cIl5PI&f+}oi~W>&eT>;h zE#}LDn;K^Rd@(~2;=bP#uy+6OMshf)UInN9gIQ$;ke1%9B_}zT4jUI3tu-caig_&w zB=aF_$r^(&4LpbheT~7& z|Mo8&qdkmS=Zu*$v?tsrtt2>gx%f~TeKj`Kjh4CrI^%%Q;r zBm8>NiZEz;!6U+WOY0r{F|maGK!lQuWReG90A90gH0DnoG@WEw=sh&m}bEfIF{ zXbA^z6%Zwn0SSv7Jvgd=E0J>B&zUuLl>1sq?^m(*)%8Zc2YRzYj&VP|@RL6K6%o2& ztZ2{w6PO?r9ujGnox}opEScO;CM7T(uMn0+iNaigM8aZv=e@pg(Sja>#axcC1d3{qePgwSwSdS8MYp*I&vjn-pvMd2&`3|En$mVP`D~nk_ zNlg!k(y%s5ip1Z0u;e5IRC2m=I+YixSMUf=lKt@Igz(2p-Nc(J(j|O;B8kFY*X5r) z%fi$Ysaz7ct@-9y!l^-kNCK%u!E-1h1n3auEY^v}7U$WT&Ou*Op#CO*9QU0LqQ`Zu z`Clqk)TN4cv|oBz*}9qWf`K48SUH-if{%@KB$Ct|I4ON-^4lR-qzqM}=S<`)E~fml z0m;yv<5-TWil7q^zh9n6;Pzo>89reA@td#g@rq(9#1I&^gye`j+p%D)fU^rsg+q^# z)R{yv9$}6>45E)p<~xlfBg$c&+~>G3B15_(*Icy!Na8=<*K8$8iKj>xIeqaSI-1o} zuXi1mnnnu&omu%L1Z1_uI^bj${ko=MOAcR`Y5xV)lV<+1=&HYndWc8CbE!W6VC$G$)7#0ji|usiUxdg^ltD&tjs-?NP|BACfnhgE91a%x@gFiEp(t38#zw zwy<114c33)7h47U1HbudRm8gfa6jRXF4bD0@}eNTTSwASt>cUX(I1I`WI-8dV>%XM zVwBM#qxI+mvyu4_haH@r;yW~SF*+6UV5ul@f4P8Z>_!?iXPnUY#p zk@=AfVyEwXMB|}3F8FOb-(epY)nUj&0+Kb`gdEs^zok!#!?|jowY&Z1<6d9Vgz$*+ z#oOS^oS~G>{&R5gsswgBB|X-n`4WgSs01k^~SeT+7r)G#;VwOip%R!I(GA%J|-VrRj5%S0&3Dq_?f_3qggeFA0 ziZ?E0E*T&=qo-K-``!1~sqRMe!WQrScI_Lg@0a^A4e2e;J>O}wuO=R&d5lzC zy6>DM?`A!=Y$q4HhJn8|TS2M-e(irkAN9y&m|SCp(M7b#*z^17u97ek2UNXOD=`g3 zIH|Hvf<3}P*tofoF)DqmGQeNFkE1)(K&{kO{Jzpd*FCfTVO)-O0RyZf*nGgq05xRw zb>xN>tGU>7yK2Q}h?#cWYiB$7B;Pv2OVslvj8*Q(-{eBd+pJiF)+-OB<75IPFTXEc z%CDXl+t?x(?|&MsiAu9{&FH0=_jY1Xm-sUyOgoGv=lJFp9)Ix`2c@qj6$_5ASty?!WQ4Yt&z!}%vU(@r_&uD}F=?R44q zQY=(weVzrp<4fVwo5X#CoMrRM=HmsdT)O&jI*O^U_w}}_Eo2)=drwcnfLS3HH{TZ9 zu4jk}cooc;#2TfJ33{nc=t@Sf&d8^Oa_Ea5grp_vjpablyp1`F!qKyHm1t zwg@0j+JdEEbq!@NAD?$y*ZDdprmAJK@#fG!i`RUf-X|tr`?ue{lwXfNJv3Xf8}{|y{-a8Hh6ehPS_!-@(Oh?jt1O* zycneBv3}^Z7g#k_tf2Z&ev5|rR(Mc(x@2x`fci}<;3lVG5u1HI|nkTSaQ6&v5VIu5W*=(ySuQPKPdbJxy>fc;kT<^7-#o!!p9v z^{1I{bfA}BQ!2AqeMDI>y%PdVgkekX)TG&M?|$2DTFA;m?;FA%V&iK!^j7m`^v$-p zPd{H<3Z<+SQDPu@4G_lsouyw6d!`p-Kyfo1O8jVDCGHSbPZHGDri7d4KKAmxLe2S} z?~i+|y`}3}k77G{#Fn1>0tk39wB&5hN?a>F5S+dEN@S1^S_gmmH#^S8O2F&Z=K5C5+x z{x&h*?sq)vj5)Hu0`k?;OfayISJlN;v$obe(A#dSu?p+L=IO*l&)Z{-!G;|o^IDKK zT7NzSrbexco0W-1v!9`2sZ(UKi+RlrFA0PS9qXo#IfbS(FayOm2rCJvPgWUfVUiQ& zOc|RqK?g^@)rW6DJ-Q7@ew_P}B3MG&8Kk`L8p|SPZ;}sB?V~@mrNrl;(@I|4A%<|G z`{}qUO#*Tc)`Sq@f8@{Nc0ip2m3hY!EMgP$>krc^*LN>obgOV?(kn_$R2E%$9PuwU z)ikt`#FoMQF}0HMA5(utwXX`9Z z(2emo8=oU}zm8b0do%cw9omtZp&+Wdi`5vH`}A2|3z-?e3i0oe)?PD%Ei)=SE(oje zV|vFOj^u!kjFusO0~&wqK(P3q9Spt!hc&{GEHZ-EvW`>A2&WPv7J?cGLZOI9%8wh+ zG9rekTT}w|^Ba7fA^q<`lFZ^c&azOWETO+ zyW8-ny+`x`Jqa6h`rKs2EJ?x<1Bn6ZCp&JVJ!!Zuro zyT4vk`AoaZGp@3xO_*NDntWL}h2X2=sD8$Y&$4mhPHQygPLqx>E-fa~MH@ntppQm~ zK=LO^feB-lWj8zlAFs7$bc{6u|C_6Dq;-n9c&f)|m2*^&cq$*`J!avyk3|hBVt1b2 zqnZ~hOoiP(Fl&K=Qg5b&ymk&A~aSMyzi+qk*aK(ckCONVpyYZWO+`D7KM(!yQ4$CPodULQ^8CS<3k={`uX%YS%98&O+UfAp z+-+VDHdjYsL60=lesxs}CSgV_O+i#@9JW}40CrrSCOJL|sG#L2<}HTz_qZ+CFIlJn z5Bh%ZPFVE{ti6d|LLXOmoH9uWosPqX6g)&WB^Sz-Qz_?~Frai;0xFmi7w8ZcvacO^ z?Kix{W}6hy0r&^;E!eMQ>ltSQ0NfoIXAjm6+}4+Af7sz?9(O+oL!1dko=~1Yd4ZTP zj_7Q9^QgcEz+dShGjqQNd#dXI{F7|$o9!Z*xvzOAinFt;vnBXCEeN63>wUd~N8*gD z4|B`)N^n>R`-Uk4h~+k|DR5rZ9_=+`kgwVcl?wOOTY5%1zWSYcdK#rN_nl%Q|G0j@j+!y5p-a0n{6u86s7) z-{>-usC#%YraV#hQD#WQ#68eh1t!dU`=M=~By93PM@)7QSytGR*aRZvn&lR4GUaW9 zRI8!kD#tW0{%hszEbJGM3CmaM&?Th8^vBF276*DNOyKqDt;FT(s>eIUY^ z(XkXYG@GG}@V~-ozGnPGrq0cn<<_`9{Yz{JBdE)tf$G?8H%T`e6WCePA}SSv(>uyl zWf|XNt1o`;T_0}vEs8NuF$fEA*yT=T*|GcP0Coyf6Qox3GK$O~=uuHM$bYrR7KI%u z2Ot-8zpENymCryi=vA?pweCyqX?$tobEcLh+<}H8{ZcxYL!~noAr(`sTv|Y&kpyz$ z4*!9EY6_&7N+_UX^j~{Y=dKWI>sXSj{@)>El|372>NDWx-#~H^vh(6QLVhbI`K_9?C6*G{C z`-LwYrLAQ^^e#A7t#M`N2veoD6a3KeMX(4Gm>{G#>=yQ zIoHOmnY?*97Wu7QffF3Lpp{ra<8UXJ5gn{H(Uby>y*ysu4S~d%DiU?P2gLkuD3PMS zm54nUBNJ=?(qE>p-dkzw?Ie`30bW?NnMw zGr4`?a=V0H69vs8w37Jw#hQ9|j81LQgiCvE0J5- zdXM5Aj#SLAQ2mUQHuImMm{y#xP5T|`FIO7WSSKx z2{8ZDK%|Qk`D!2@IL>}G5R*X(Q$?&atPVGwT?nb_UFS0mLB!L8#bU*#> zm<|3S8p%Q4F&jEqXFgDM;CYZ)4*QzvxY@e4TG3dakNE& z+X1KB0599qOVZi(Q18s%#SoIuHz+VxsYcX_VdeepfCRmr_CrfXlW!7(UuvvHl(QZ_ zDUCTah(nZdik^sQVjh}!Ob83x7lPjTUrQC4ze6Equ MOGp6r%I1w9l_Q>wzG0fu zRJR53H?sBnG@lgVhJ}jzKv@v#gBlxkFrU(mw;@}=+Bf#NRwU%FT9=TyKgJ%qc^( z*S#;t7luu6{0RkO2^k}kTCv^8ma%1zlaA?jD}n5Mw3Mr7#+~Eq4!-5&)PZi&UW*Bm_55xDz3S|;1Sj2FX#O2!cta@EwoE5+j| zdk7S2$@x{jZUc=Q|D%i$NA;h{A6_Y@uX88b-YY3dsMV z)a@tj^}XmHia6Ei;D(jo&4#dOn5ktN76wneZbLEFz+81=tefu?=%nIubIA~CQUr9W zy4<-Bhl_W+IBo*EBgnZ+1&>SO_~!J;#zRqM0$k`%0URX!cv#%0M$W#)px$pNCU zA?=m0EON0;n|l;HGeVy7yEAq(;y&X$Or_|{Oo2x{t2N8v+DIZl-fw9%%UfzDsu`( zG$R!fOh5&YzJK-9!-_85*N$XS_U^Y$vhS+l>)o%DT3qzLuDS^~>lyK>yWcOZ0X57e z&I^^YSh9Q%0dSPg_#|y&Ru<4dH6m&oOM55uTQsbX`Y%g^G&Nxty4q_@Np&1FD+gq> zFKHmkwDP^}8L;mxDbA_*2WQ;c+b*#@Pm2O}%Yajp@AW_U*IinzaZ)JnJf2-`Roa#A zw3JTcTS^o;#e|~d5=-!(j2j2pr#l|SIp*e|eu6#FLwRtu(~qcYiNrW?Q5{s%ui0Qg zaXEuBmN$#0Fyq9AE>x3QfLE;oKSCrI!fO;2i=voDq3|=tVD~uVA$%J?E!+^S6@ihQ z_UWmr8pL^t0XXIZD)@u|ea&pSfA)?J4c10@qP29g@V}_}S7!n+qpJAzoMZ~QPQ^lexdf(RVuJYQ%? zfhG2~+4Jk2K#Z?1pN%$)E_6ppgc?Vk7wNC*0=SIb&|=G8DlJ(k>eF~EZ9_j_y{F|C z{u0Ls!$Y>z4}`hWyDw`VKK+i-X%W&qJn@F}xRJ1tKV$2F4y^l3?d&+?$nQHxa;eND zX5h?q2Z^|c)Sy~ZZpjexK*hgO4q#s0C-5UlUP1_qJQOL7U?>5Gv@}#6N4%oYqXLmc z><8%I3_Fsb)2zC0kio0b+31Zutg1zoK{J)99~5%5UL!!twYZY72%YjlS_h9&HBR>V zs<{8%G40VwqtosF;6g^V_e4CuoX-61WCw$|;AHA%`yhKvQ+uqEkukUZ%0jI}Ybi45 zHgKp{iUaP7J`mWnG-AMFAzHG(V7hbT**ax+4u8|5g;NEpX7=#JIqD?DVv>x0`T6Q0 zkl+e-jljC)*ICGh{L(p0#M~o^_Q~mK*7eIHb-iwshb3G}wB~+umypf-p!;P2leXqORM4S$2@(V6*Xso|Kds`lT z3+n#)mcU92wkJ9J6KUvyp6ZeT+{~Kub>Ugtt^5W4W6Y&39^CS+mv`I9=e3g$MMCIU zGgu+&T7H73;J5kBw__(a-lFHFVXeliSUwZwlXC0LogaV>GeH3nReARWlKBYx3=s&D zw-CY>FZuolM2G6BMsZ1^r2Mp;|2!>ldr%l14yu`}&(5KT?|b0(MFUHpoz@~?(s{)- z-Rtn7PXmjQiq9sWNr-N+x}z7)9Ce0%ugCXpCyJ{DuFJPba~os)%>#=(FNL|o4v+ha zjVMl^x7B>lUt@bJ1c5aXy|3Jt)1onp=PznTIjz5|aLyV0c#Co(f!H@*W(8i`vaR_5 zCI*|#8r(Z|DB5D2hv*(h4+cV><79?`Z&ueG9sGCI{So0^oWC8=?`Wf24&QqFd|YKJ zeH5kdvK8{holDv};}9ILH>g3hsQ5dX;ulHvL?%zse z&fYCK)E&SXmm=g(^3g(rIMEu*}e{&O5WY@swONM4!ew)>SQR5==qtK z4P8B+Fzpr~NPHB!G?t;sk@UM<6VP8PB7bxkQ45Bw1Ym!x38LCOIlA^i`QQmZI7QBm z`oT+ZKNrhvd55*N`5zK&8=U~wd@s#Iop0%gsd#iA@9WHm`}#P&0|iZxI=-ze8K_fa zj(!&M{Q9Y8s2m};C@1E z19FX@;V%1aeAf4|wAvM339dfs>-)no&-V8xAL!4=4J+JLcbcl_Vcw4?!>W_OKZ9m# z?vCf^ljOST23l&pyUP>%9JHI;>}>Wjlc9}Qq%^pje@xbsFt>5`HU-tlmudUBaeH}4 z^`2yx?-FtpgcLuV-mhA%O4)S}<~v|{@NwXEbav`Cx^Ldy;azkbCADvqT-=_cWQKj* zox^pec~A6xINgjfEb*nX904l_aeFo;gkjU>@`1S6<4(@tJ7}Ld`>Ihp?Zp(|tkJvk zma@u_Cw?`*zuf-)8F}UF1nzL(9enhG+?{F)HD=<}YT+D0z&UR^S0)i6T6sPzFVxW= zV+4tWV>h%I5`LE7%WSC@PQaPyFW<)1<|VTzoRle@hw^NAh+Jt-E&^H5oV8r!`Ff{N zk2oM5pQKC3YeS_AFcPEiYV{(=e_~E|*X^9o?VFEZ2J%Hsb(;#pje31(e$h~iwg#AX}uE_wTW)U95Jxv+<5Xl7oJri}^z zwq}oGDZAl+y^R=YkzGDq!m603wp2`iSOHOS*5YoP&B6&l+PX%;sV`{;iAYydergvT znsT}$ZZ4uteeWnAdRKeo-0mA&-zxRhCaXXm11yyVHOwVe3$5TYfD{2F77hAX-=R_0x z0}ZTb{iU*O0Xzi<&|5_Mh#2b|BwwhIL!}WIj=8ZA2Nh@KQtsq&Eqt zeM_YiRR)J6>lX(n$=L-1ZQ>>v@2t=j)Pp|T;mjod`fBSb{{Ip6&Czv!&)1C`+qP}n zwrw6Y$m2Scb@Nh!**r<-cdMGhzfAazC*_YP)EolTZ-zri zo{)w@(P=;siln60FfAyz0r{7Q=&{pOWvGozeeL|$!itE+SwvXcVwRE=FC-=@c)KSn zz-%x@;#IHGAw5$VLGpk}YJHHW!YGZCxSSjY-SjD)Vw(MpHFa^&o)?g0gQz|FLXsRm zU|TcHVKH7{HiW|WQoKMI4x7aDHT>zo3@V zyI0_c&_*80=x+77iutmj`$Ya`jaHxmo8OWT`(S4EIk0cNydV(X#HAW!j}P%~49-Jn z&#_#!RgoEchxHs3``c$KSUECD)I-62q{)0-Q0im z69|wX;_Ru%s;^^^IfDE>ay?#X52zGSP4Fnv)Z|+o$wO3WI+%7LQcq%nIe4WJp+<`iDV5+#gkamKbyoo?aEXI^q0 zBAvj81@T?#*8zV5%469v{5WmS1mJ(cMc&j-o9kGK_}!K*zK!YmdY5N>+Vg|H%O-g( z>RFwKJ16%obUL`GUYGd9QE-Z96nFA<2XW-a(VIe2^lMm=o%iBL3c_Y^w!PGmT;y1*W_jBBo|n<; zPe;2HokqhSg)@}BP6!ILwhKq4oa*{$(B#Le**=|%qNWSE@;`!EQVtDEktO-bzehEV z{wk0Z-(&+fnb)4=uX+$Tygd3ll)B5Fv^>21AZhDfn=V<`j<< zgY^TE#x6zhgVYkD5@M2MGZ2Q)Nd^YkVaOwwMnj(IjQdt9@h@x5ElDaBVpCP_o%caa z)hVLbZZDV3PVT=uK@j6{NHin>*wRdxb8M+Jo$ zZ?s#R^L%gL-CmiS-kr}ER^@OR36?((-@2aDwifWn2}H*j&SygyBwjD+O@7$@>3(l9 zKcl9ZasYdC_;$oS_RbDBpGt%R{_spwr^NZlDfqnV4q2CSq0@Dqq;NSx5Y{ROYEyRa z3|$DeZ_C47II_)!VnV&G-|IlDz9soCsFA@Um1;Bxs4wVJ*&iW}YUKN5G=CO#tWH60QhY4^u*J!F>Oy#p zTFz;;Krh~w3B=M(fE{PMi&CYtNFcV~rMuqIqWQj9`quS8{c!a=KS)V%?aG;!NPB#D z5C$QUq#X@$F7~A>hFZ7<>uZv1*x31_T5m*e>wMR6dlm2|fCC4e-9UC(z+vWoJqZkf zZC$lKpb&g%;A`a0y5gkusSZ)?`^-t}uH|4`aM58=QQ!4ixu@t48MTL#Yb;LrSq7Zg z5K#V9GExkP7(5gqDB|SrNJi>P@!sJDPKfk?%G&?HoKc)qD#@feKQQl;gxDc7KTveZ z3=^piZdkJ>eiBw0ca_s@J$Y?!4c3(N+tS9D%Uqo?lb2bG77QlT%`cR&U_Si!J?&U&S+x&wo*&~4Dz+T&7#{p!* z_4MY=?gy1@S%W>GOG*1AEf}$Ch=!K^#1vgq+e4OlvZqi{MbEclw{2gu3q3vXamecM zQ?tl}z|$Q|e*ks2!ZZ2P!v;3X;4=`_E--RB5%bi&keGM^aR^@p zc?d-jhV7h$Rt(=-)W2Os$rCG*4+N={9$z#bRo5l;*lsqIWhZ*pR!@rmS%C3>+?~SYzW`6+T*o<)%W?zYTWUGAuuajJqeopS7nXk|H zSbK)P+5UQPUMOB>gZ0%^I>)xm)HfzLPqW#18^0T3AX+Eh;eh)Jgg0X{2 zff&0%VZo526k=Y}abB6XyY)NEK={XADngscF+TI6Z)|vWm#>QV?e+E)`1MVTc5bwm z^!wwItMqlck2E8;=PybnVM`O!Z}%IcCySKfwe3u^XRoK8QK2t3?U1I>R(#ZGu;ngb zERtqDUz>rbL;ctM%jc;KJs)}MZ+v0@@aQ162>JM65Cir^u^BvJ_9Ox7$9cK9evCmM z1*U%(*N;d-l4ep38=Uu1MRUkN`X#&h=~?4>pBoX}X(cQ6M&C(E#xTdV@MKDZ!KY}D%26SPFLM8Y`UcrGGh`S zvfs5ObqqSK+a#NGtbLLheV0szF);JJLahOFwjXnStSY-|9cHxjy1Q+cpD+8s>#NuP zC;2fi-I2wl^XPdmud_nz1afh|`yQM7N{Q=3x@ju&*foSI!#^|fCkW-R$?b~?hv_8D zMCfzbpx_Ka_`xRyh}aT|Xw*_s)-cR{PsIMYC?+w9LxD*Zd-%&m`A!)ev9AkP)-Ajd z$4lah&q3$V`P}X$fh))?JnhRF1ZYiTjr=nnn%MJRBn(B_MaaE;+W1kp^U(T|M-aaM zEtF&6*RJhXjgTs*z)o>b@6N@Qd*YtosgCq|2Qdc-5h8D{% z4L=+fEl=etalX2i?F09Bb0V>D1OG1U021(p)tm(?63-|CQWhej`mI8IZ4ZTV4XBJ+zpqAHa zyKJ$Qki~R2sqmSWQ|?3^1b!)1O%G}h2e!V`mBYNeKjc(A!G>Wycjcj8d4tCg{s}?9 zV@`L>TkV5~3_d%#`rev(Gqd)&-J_4e=5yi4WqQ5k7Rl_7Fbb%o6jkJuwtNWh2@1#z zxJ2y){OROrORG;YgtIH*|5^6oaf~7C;PmUuvh7c&RuLZ0s+yP7^){Z3@z}hht)IRX z5=r$#%q>|N1hZ>2spnLO>Z&f@Zu6UUAtBCO9HeA-F;e%-S#1w+mpcGQ*;1LZYPn6$ z+hcX};T-2J%i-x~_3MkjGMv2+f1{-T)S>2g=*6^l26!(s1AnLdW6(!}wR5>f1vLun z;Z$lE8l_OW0#ZQBjjdalyaJN3gse<25w&Z~sw!Ld0@C02E)2e%New%&kZ!@ay0Kj} zmu|7)4oEDan?mI(mbvFg>9g%JiLX4u=TH`4tu%aQ3C=5MZxnAS{H>FexLY_vb5N)1 zX_j#y9h@|A{lx8AdP7>FD9yay!VS}A(4u0>N3TMOAunmC_|@zcD}>|F|Eo(<4B?I88YZb#Rs8KB_uX8I zL99A2coldp_`Am;6E2*?jnqc1`SbT}3XA6h%QDVj?LP8;#kwEK&w>xzv+sznsJfv^ z(SrbOt&xXfyUjGtNnu>WMQIO6w+F|rPeUI$T-!feX%nzUW+xR>c}I3X^gtxuwG6YF zsCO%og(?jE@c7ibmFls?e2vf~;{(kTLD}@xiLCh0{Slb|@s#hFSRQdQq4?{33nYF~ ze6HEXlR9XLA_|Ib*RSyaP0Wdx3_4^m)k2&*8ue60y#*x^{j8LU^D-CIfB;Z}tE%jj zT0y?n)T3CRUn0%A%YwP8#nC-5UafFHtU6>Q}c~C759U~07wCuWWMxGH? zUC(Uxvo@*p=se^~XM*;N>9VATr>5}Ac@1it#f=Utdlf(u29Y1dsNL`W<0yqS8DVTf z=*Fj1Uz2jr9H$X8qc!_{glXr34d(Au`WMSeye$9Fj{ps?YG4!BL5&sk-AqOpXo@-@f zOc_8`$OQ*B;bTQrC?;q@ZnuPYv*yo_R7$JQC;v#ml6mh5uA+3e#*(oG!=CAy^&MJY zm`9H3tw|3b6n_a0oVc~~fke3(fIshY{M8K&W=3BOkJ!d!V4qkdu0GC1HQE_l%qNc^ z*{_fp&=OWlAYKjwJQo7+x3b`fH#h1#mJsrVfqlNpxRC4P*Y(zt$1O<)^zH7Q)v|20 zW<*){@L3(chL^0qJQYQJ{=omvW|i7!|~56#4_HWSt0ta*Kb5D?Gw?`4p)@A^4KW5Z|LqM;k0K7{Xw+Cm<>te}rtzM?@@33u>q4Jg+T1 z*ae61Ja=@IVn|}0E$Uw7rLnAIE?%W1<6!ys0^rbQW3DB_!TcwB4!?sn(|ja>gY{?I z@}0rKh$)C8V(pQUK}05xDH17CDa{SVLP@3@XsFd7Bf)(8>!p4b+HD`#N?V^Y09vaK z8MbcEQ_Fm#Ajn?z`zfejEvnk&=@O)R_v@5-fa=+>#J26l z-5h2@+Z}Qmy6zUgK#u2I?>tT4*oG8ni(;ThdbseUvMI|6;$X(m?VONoaiVgVd77lb zWd*dT9$yCqJwDN~$)GKy<<|uJFJ?_GeDzC6qej!?aH8!7ZV|wui}Gs_h1dm_%fktg zZ4prr^_WYYXG1Uy{_Ec1pAVu z!FmJg>Tw|981}T%S#nv8V+(T}kOzNhvxkmU_XaW9?pHbK8f&EabjMqp3p#ed5KNtm zN~r&aNSJ<-NFhfg5<$WsJ{W#DmJ8BVZxa!4c;{aPow^i8i8_oO`0^*dPN3zl+`dDL=b#1Ho>lF5_vkGtEG zi=S*Gk1c{A7r97vejNbXva`2$yW5e*?evsnS~Cc`=v{)Ewjr?9KgU#0hu#FmJ83+W ztH>Q=b5iJL67y?cu=dj}NmoZ{tz)Z%byKuB)#GY6-Xh(1?FNIO#QYwTwJ-Vth{dM< zkQ1T)bO(JOS>`?>d5@ZJr{SxR!1#R^4OKq~IEt{pmW_`-PmLN~AqVA_D{qD(1l7Oa z@*jk3wuRdx4-u-q40a1Y4O#q>83adtyQN)bM<|d#xQ#lp_^m<_G%PAyqpUX?L^p&C@!;?!&IST9@yF6EUlHZ@pfk~zrWqatm& z_b&AC;}LjN+m}Ga>)wcb-L*!s#$hqYL9J5=__#$N#l+q44{mpDc7C$g9!f2C6rweNVi#4k@inJ3~QGDT3H{fY#{av9zA zY76sB<3^c!kZ@4*5HLdZ??Fc4KcZgYrNj~11%gfLi~e7M$R~r zcx1ergU{uU!kFrp-O({YukYYy!{KMj)?Ax-56fJn^%sRtbt3QlLFZ&QHxZzsh0dqW zIK&fuoDcNZ_3ZDtQzr9WT5C&VmOG&?_BGNfZ%ro3s@7<5lu<#2Z#+OyMHkslsTy|~ zoV|eJh{G|5d?8*0i2CqE%cB7#)a3C}!(+F{g-|p)vaFYOKJ;cmS$^oxPFP?x^U-dH zo>($!ZvoCA@~l_4@g0tPOwG%9ntW&qhMFv&w)^X6y70YVMG9ZJ-RG*hsP68$dN0?n zc}5R$m9Zv3pZ(%gmRIy~VA$+${gJy$%vKBxptot_?(cS_^=O!__2ZuAo!X?$Vxu5d zOc#yItrErflEmKWYV?9C1?{7KxDYo<$7;cR-783*+Tl$Q#(~dV5xm4lPIsqtfT9Yu>W4wOX~h}46F$wWtsGA`SOeG3Cj>x1TiV4H#|qdXxmIb*+GkNP zU)<4nqY?OACK-W#F$y^XyMXV~)nmqJp-ZW@d6p5%*Lih@_8w2XxYxDg3jivi5Vetz)|PxkNvTq?q^JwU=}K5b+I|h`{{qn0 zwPZQh>yaAHI7S1At>gA$|D201tpTY9+%vbFZBPSXXwZyX#f7aPg{PDEow0?4W2WAtOG-d9?4slF~1RBd};sj`y=k#enE6SllLvi^MjoyEJN zXjY$-L`}dn58T;_n>*uqyX|yOb0EJg)=Ut?6Di-|n*-};2uxw1R!*XGV^$77!e{nJ zn<>b>Bv-~Y*=nr%ijC*vL&b(X#`_VC?+eYuEQKe_jzX60EQ!+*bYBim3MZlQ@+|jj zPJ#y2JcqS^J|Tjr(*ZmD&*%#0<$i8Xv1xE(5JKPEw`aZ2Q;q_KkJfe>KxZig7qxlHpa%tj6e zxvg*iAFyl=v@!l)fX!%0Grrg!`?_}Fs@d%^Rgk`s=X8kqXBenPM8~s2hlD=g?N=uT zTrI-jSvZ}5jthhl1@Dycq-+V494`Tt$$SfjHQsT0`#|l+rEylX&+NybTI=$+g##-L zy~a$=6eiWxP;Ic6@hJTRg$kW|`5hMuxhG+Y9Q!W7*4@$axQUWBRGSRubVMB>$HrbzVrb(L zPn#Acn1Tc^7u@N)BIlWR+6=K+=6vec_;%+`)=yP!FqEt+7baA2bIp=Sq$~o#!e&X?yf$zBV^oOeo__uJP+QVEzM~=F%=eAyre9LzYxKtk~%~@vd?*uiK(I8e5fzgSYF1iVaLul(LoyRnJ!~wp>F`aHWi=lR8EH9*hJ}y3(LzHd%Ao z*H^}E)fy)HV)X6is!DjErdOc0-!2R!u^=k;1E8kr#` zn9nbW33$1E28u0tIRP&S9=g4@wGq{o+tJg*;00IoB{9JlW&d@nu!~1#lbriC!cHL+ zYvQag{$;Bte*)0|+1jZi0rq8UZdKasxo_uUD7LHCW1nt2TQ>6DLfcst$BZS&U=_~( zd(kZqcLfF2VvQ~{19G#?<$enr7H<9i{jIpuuA>HVmWs{o?8m#|XKIFf)}-is`ZSye z;|Pt#BRB=fCW^J`A`Oit^yUw$e(4b)sbBKfn?RuCpFEdC!0}pscd(Dn6<@1p^u5ZL z|KPpbXc_XrSE^b{j&Bq&=)W7Zl(>>b=tF0Pw6g%N@qTv%OJn}u+l%P{zkSgSepnpg zfj|G0?Fna5nlGP6=w}-*)?-Ge)ARJ^t&!8~;=S?S6Fu)|heCMqVoIX)>cgqA$LAm# zP;IZL*EKj=9WXD}|9qW1$q$b!Y7i6Fe`DCnOTN3y?(H3KiXA_E*Z!$i7{;nOUPuTSMz+mx7?3BVpi&tG63ayzqDL{yC53Q5vNR357u)xj7JR(40&e#WDMyDi z#pk|Wi*_U2m9MZb+M!-}%d>~5Sw3EpQ#{)nm723;A}@6;p4MiFh&dHxo7|k`zV(y7 z!}irNr0K>Cg8D=w{?O^UZ21VtOyYh%DCX$~Ur+SQ{tePnYJFaNvRr9z#}+-13tX-G zfy`MKE@HD2o@F{_HdPjUua=Z1jo%naUB+=WnL|e;TTx@y(nd^IvGMmS-G_2pa$D_%utT(8u#(ONm$clO{)xJqXccep!pSb7RD8A$EV z%_>(opdr=%r-5+_pcBz@#%>T2Ck{DH<<8>0;xv}R%Om6N^UFFb9}6~ z-xmn+LAPh*qY+`>=zV|5G!Pa|p4OM2%8@L{OWKPQgSG_+r}*F$v-I@Q_I?NUXtS11 zEP&9dHKIG~G%R~_OW*4dT)E zwNot~(utz>VQHUjed#xenS8wvQt`?+Gq^mWSb$tNtgky)j(cOGvw|Ro zJ`bvYASK8r`MGq`o z)gJqcV^@Bj@@$z)a<*+H>Lxm!X_g&b+{o@T=~%NcnzEkFm%uuY@JClhGf~n9%aaJA zlA7PjBQvxZtYH(TPXNiKACFZE(jW0b2V*Sd`|E-+HeM0r%<*FThAr0JN+YF~N=&2j z2MD){%T9VGQMYebk=%}b?%|kC_AwJrxXR3P7AFtF?SR<9%{wRzBSe*!Si2BO?xz~#PS$8h(%8OiW|la# z4f*~pdN?+Zz+Bn^h@gKQwL>0!jbvh}52i^8jhJ$q&zC}F&@bRCpKk9Prq;pE76wF~ zf-S4xi1LqXT=#~S+sjte|8dQoSaY=KH4X(=FyUgk#ZaXuiSk%B0CMmJj?tKXWkRXk zGVhiC=rBL1TZ=NP$plb_y0-!F4}R<*%GXv>t=RUrnD?nvDJcl#QXL9+I)$={;K3yz zLfvA8h0SO~Dli*&kj5+l|Gyk$+aI#*t#gyEM0vA4kMC8F-n`utTAvSu(`uSE<=J&1%%~U~=BBO)R}jxm^SeG|o5#W!4;}w<=N*AHwK& ziq%o9{TY1YB516iXYV5VO~=gtOtpMWuMsw&18Ci{LbSr0BRWljNmcax&lkhr!G83y55jJhd*a5)A^O+wk_s`+e z5mmy(hj|?A0}%JEQ{br1@3e4d|LwH*M|8AseeHZ_TOjrz5o~0{1UqDW zf7W-R<$IXp@PoAkE2gZAO>R{Sgv}9#gbSw7G#28I`hi#=ZRaR5{j+N)F|)+sDRX{p1#pk$ zzUb+=_qITvMBIXydqeTytKMZX1!V__2 zt2DImGa^Ut$vx_7xTQ#I%kCCiGdoCO&9qOAQ{9VT?40*iNqWM5D*bF3;W&1YB{UpS7CoHNsvJ86zg zrckWYK;7vAbhj(RZqngns0TDb{Be*7A>8Tx>w;0Z2o}-IH&irIeP6S9ThOH1v$^zX%%?If9$M6m-m4Ba2hl@50M>m1)jPSn)6$CuWqSXr#Nh>DQ8_u`_`dyGEq)7Do%S<^PE% z#Kp~(nIZyzW-biHnb`|&ctnGDJ)WCCO&d7f`=ulNQ}IdsCbb zCROYqa(_pOXOvFNUlxib!$Yf)08(oywI4^$OE2q@ovl|gsmsOkEy>F^2m1d>p4>zf zhlGius5bRaocOj_i<1i~VxnUC$OZ~rWb0z&UA-P-eO)Sef<}ZSHOa_u`;;5>Y}I9+l2jqG7j62rT3~B0QS-%R4igdp|++4?OY9*xM#Eo0c z2SSkVFx0GQXC(D*aP6W$>raR&0*~M%tA!Zkp3(-mcB!Bxu{k(DdiQw$E(++=sptn` z-LQ8h3J>gujyTHQ$(aD2s=vhNi{1W`2(&h3?oq)#o;f^QXLuRRFV!-h+)FQPtk{OZ zK!MI`WF_;_6zGSpL>#pW9Nsn30G1A(TY1~ppXVr{UOIJp#x9Q19=l5@?5EYZn=M3~8?ekJmEc(M#PrUkXO!aL8hxLcjYfjZ@*fp$$ zXY??n&iBFzcrYg!%8XnEIJla0L?qH!l`tRpN%0aevqu3sCm5z5db21j=jDaIs5f~N zG0Su8s*qVjklNx6wxs`@{Vmfc~w$>XJuQlguZ?zw9aMH&AJZ z&Luf5`XV?V!*~2w!s*WcXUv?l*13-29H6dtORUA|f$Qv#ZKh4SMq7+&c*id9r7VD_ zpir-V{<~R)isJ9HX!JV3WE1qNd@=?3TqMySsJ@|I{}8ve8g(RUg7~iWg}A5AShS=0 zWyq_hnHRKOLI8RclpHg^KS+~v&;C2wauTN-P3Wdl-7#n(2^_Oc&K3|B4T;I; zLokJ>Q0tlDLIo^(kU|8k)A}d2nu&N5DO1Mnof@v(v}O{@)m%)ux6T2vH%7|gu~j_v z%a+#_LnvJYfh#U>W6Zv#i4a>H$^=1VzlZ{NRi?S#?=}UwfONR2j`c>`(#bBoE56{Z z5xl8Y|CgnsY@5sxIHtGooKc3(n|Kfn%bMOfQr)Xa(k}!bzTSQucdn_q>0a2%u6!Y+ ztzUQznH?M$M*bKRJ`P0C4$V+Wh<=|T&LZX;R#$Jo_CE?worzh#>BnzzgL}@Z!zHzN?7%H$>MxeDt(VzzJY={G(T@|IP+N6g1AMdnz z&+6m?P9C~6OL$do5JGbwdGTF2BEh1gIdYZ{$9el7qY5saNBXm;I~hin@p^>X11idf`n!+VOA$t}Qv~+F_bKF} z1w+BZGio5omq1!SiqqXA{o}jrOb7WS;|XTU1M|`$=o%px@$uow~!a4?UvN zg-C!*thS(OqH^>s>o01W9>14PAl={x)f#$__AGKsFu~~T7Iq(RziNT_WB((B>sLTh zs1*wqlP1&d&{i(+W0>mX{e5Osbytna`Ut^RvNSk?2L6=rbU&kX9`j8~!zpho9(jZyU%9&J3$!c*KH_C7 zMz?J+GZfGvM8XPq7!3O^#I(^$r>60P=!t6iv2a_Cm?RZ`|Cd7>y=b3^Y82FomsO%z zRBO5Nj^?eZ@OFrqVyBZdLC~j=s9T-19$#9r3PoJ{r#(0wrdr8KgxY3b`5i*2KrwoQ z1NE)(#tvBo(e(ZT`R{y>vPP2Cs)y!B?bpRiwPzmD5kbJB5H&_2Xp<1}NP&E4!A!7_ z$Vz(;M2--O^8cu;mxPO)Fj1J>s&S>k=<3)PDU8DkyJBR0+iW9q$8HQeuob_sc#H{S zOUbl)N+xtM?tvKWsE*{RmVG^{xKgAoaD10`@a#wP)BE+}UK40G)dMy`;g0d7lXGZ{ zo@Fu8e3W!SdAYPepb5jU0`C>?C4)04rp0lph5h}bs*zzFcW<(_GWzh8{zpRrj&_BC zO2ZT^b7T^Y6nvEKJUjA<17T#Fli_-Ns<6wiv4Tm$$E0MI+S`Pi1f*PO?^6I8#07xt zsI&t~{aD5fVS8t7&;5xlF!Mw#(VJ_xB*uZscxZ&{dZ_r1zZIMU|NEONNop~aGv%v|Ig7Z zuJs%y$PUbLus7#)v5F|%sVP9+r>I(eI@cdI__pghAUHm4wkub-%IVvKT0WyXT+U-u+jzJR@ca#w#df2(GJxDg~TufTIS*l+z(2oS14qIDGqf^#1an7Q6=K^EJ z=wss*_Lm*#aGkleV{(gE5qtEwWSftm8V*#8_NQu0f~U5!(yepoBo{xofW&|ukrQdy zMk`pT167;ni2|Q%=lYVy)xt(g^~jWEq3Hd{CBP$N;+5lT>m}wb_Xk;%X(3actIc84 zU}WL~ZS;StyEE!8unOD~muH%&|4xEVv4R9*PG_o~LEhe~`Q0vHrENW{Pk<)y?CyPs zkK#CUaGBm@Os#cP8Bxb7&{>uB9y}y#YJS#Sj{pf14e_mj5(tc_s6v1kd-P%5ze1ou z1E>cVrO75mTJGVvt!TG5vvbk$(}A+05a+xws>WvX8rRzIMYYW@Hv+T3LQy}$`7+b~ z!d|#>!|T%>2ByLLSNWoy2qnhjPsLs89F@~UFWA9Zj~tux`L;ch#TcP6tptB;or*)c z&jc}%M@u=31@*y36~FJkvsD?7ka`>^2^Rev_uA`Ix!9=g9~SzYXE_U({40HZj7=!H zbOmcs1r93qWpblE%hnC%=EVT4b_H}zY3|MIZdi6Xy>j_Fd95HA#AJ#+EEFSLq{Or{ zer>|jctTq}2zRQ>& zOTW1QjQcax*1L_j@nB*CwJcoVil$dbTQC<5u0uDMx!;O zawax)X2tf~%G@o1iknrjQ<$qt5-EtxnXin;PW-*(f9~eeVWsGUwtRA?_>Yy*4gax# zoWUb9Gr{mxc!czB|9aM3K`WSt8P|fHb`(@`xg>aGLSn7{NrbqBp}(0-j-nQ!CO}x6 zc(-++X_dKK$$6^YU)p2I(KeN85l+Ooh*fdflaMRQQccVlwq@7zTy~;%s(S=<*q-Vg`dMQ|a<--P#=&%Vw z5;J{YB`vYHQVi1tRJ=VvA%iEuzI z!?2u?F~*QxZYL)zc|b3g-9NL+VRu7j)7W=9;WNQbQSJM`ma6;d;CkEDjq3-+z4tvd z8}Ej<#YV$2r5{gJLg95YrbcjZx|(oZFH~HxMs2E^8ZL7s94og8KHH_tC3%>$5o*N8P89FjDqmvGrtfvvWC! zI4-YH$!jow*}Ko!`}_RP#J=qdc-QEV!{_)(tArkLLnVhZUj5XrQci*|QgsLHs|Yih z6)vdtrHbCKkKsSr7DGy6ocN?1P)kLyW)i7NThu&wUM3cleQ3ShZ|&QwqU`b|z1#9z zNLVaL!ep-1O4a!}CEN*3gTk4Snz1H+Ym2~%RuD+a{`7sK+LT{d64Iv-+iIn+(0|q_5LkZ&@Xq81z~=W!L6vfeE--#J z2tfe1zEtu>jQBpcdAIYT==y2Vv?pUiGi){Fbe9|p5%eyh)ki^ddA`1Ana`Ze(XI0| zokJ4GHZGToL3!tRO>(4&Z7jevTJj)qB`4Pp6Ivt+h$2en_p98EPJPs1T zTD(0h&wi{Q%@I^Jz&Hj*WoVdnt;oJ~78Pnj;E%ViBT*4-dp{nQ8-LYLzL~bo7ZzNc zfYOH^*ksg7J1d+{hf~prWt_xk&=$!K6gaC#$==Mp;5Ie?>SRa)y7?}6)!HYvt{cGm zF03{zmuefDib9wX*|7@H(+ihv4wm*%eZ0k_4nrn|=C?rwwT-#$hBYOC558&FQ7xE( zzx*STwr%GUJ zHDe~YNGr*ZGr0K+A;#`R%~ax$%g<|wrpEMggyr>8z@-TR;W%IDbe*ZEj26~PhdA}h zOPxJ4DNn!Wi~v$?s{8YP;##8YJBCl)y2Y%**V(Ct2l3Yc$DC!l>b0WWoX_N!DyO&IM_ z-q^%RM#XHyVH=mAtP5Mt-1@=;?fbc13ro}kVAcJKMFWdUSpz-tVotmYvIX$!jzSK# zlO>M4ng;;Wx!x=e%a>4_ZK$C;2XU@@@Usapwfg}u>)hHHJ-o4YH?eQLKF8Q2+qfgsIVynl4k=Sn+MXm&{}^M)J0|@olPZjV!|s*~(El3KlaB zh=uJ1{NAdz`1~?meVtdOtW+EBM|V>uNwwRf=CMMuP04oH8|@X8YQM^K(H|THR*J!% z756WYfOV#kh=Pk$z-vz*_3zf_x0W4oW;FbIabif^WoTs#bJ(-2&070Go; z$rN{bjqeKZ<1ndr;C}T-LVEVaTV|+l!9Z;PhAP8;>WcHhMrjNi0rP5&U=%&81GxyyUODtS8Kq}E}h7)|H@}x(vXs0@|X+-x2a}*zF+g_Ubg-I z6g?Iy?7B-jwg<#92AWpVN&-|?r+}lJ`y3r1;>RLImOKfw%vOc;Pk`o|g<(0@pY1WP zP3KFl1^D{$uWnX>XfgS2rnRjL(q=?tuEyWf);AB;N2^s&xbU|;lRMd`taQuQ(=^K? zi>^rf?p-X5=L@*3ls0=77TMl5wAjHX=PpCxYj1erLz6dm1vFH?ERu!D7`p_%HYW?D zX{yEx^*qZzi!`&C2EG{{nxM!}31tzyxc@eqr*PpgNak@rRQedA7S%fs^^tWLv^PSA zhWKC9e_J?0+WfK1A zI5_-e-&0ku0_5i!mI&Q0NmXirVY6@P=U;pEOB|;AlI+NQ=0zRY+$U%TClz18&sOiZ8KjoU3R%PI6@c4fY$Ae5 zF$8#}#Y(~;dO`9eq=MKoP8}qtfC3&+<6N#C(yUyQ4XaP`zg{P z-#g+#ji@*Eoj^)nK{0u2gkWs8p+eB&>(`ZaEY!;k@qG(=tD#LogqVJl7gr|Na{G`D zERILTssNP6rKe<8nI=BumPxNr7UtjbspL(U?93^H=ZXwewQPnSr@w~PmzBDA*a{tj zi{9!|@b~HE0DY1&3^A4yIDVUOE|Zqz?n@N_TNZTw+{Z;gjyfDgM<7it1rkt zeL)t}s~@X&jez$ey4dk%UO!qcBof} zi>f5TS&)cj(x#pW~;+M97NU@c40iC^139iJg;fm3+4=|4*Ohojnm4NH7 z6GBmzCx?aTuc6b%{TtOFb9#?n&P-Z6Z33!)_yyj1Y})C=d)` zpQ}~FzbfusIMW|hbl8%Qd&0|*%-}a&A7mi;@shn6V(qW#r^x|W6hSM*lzemHJ$V4^ zUnaNlKXqDLA@0U%EQbV>t~ACUg<`QvX|q zD*A}@ZX-)zkw9opuYX5(HVLri?U|ZKMnCO<7OK@lgSg4?;gp=Elvts7TT>a9!rtUq zsFohtMMipEm`KI#Crv z4SDPgb{`ERIixLF$(bubMRnJ8J9%(Nt2T5q-{-qLtT+NU)-&ofTIex_@grpkgno+( z0vZc3CNZ%)I3oc$+`Lb*lZL4WrosL}VO}ztPF4?>>%n%9sT)l#1+`piG+<3`FIkRq zB$;?wIYmvpRx=?)G8pV%#fU5)aJ{uW&gHuKU9x8lTb^pK>y@;GCs^f8$HQbWAZ57< zzF3)&P`>Pz&Ce%LUUbu=a31vZK{5F3wf%Yyu;jg-y@021)uxCWCG6teowb1_#{vd4 zQcOswo?j61@Oa+2vtDt#9P)caN49z(ko8ue`oRY)6%l?TL>ty0ArEK`2t+gX$|61M zfC3*{MpRI2051q-NQj$SEd12qg|%0kG($ps;1eZ+4Bh2 zDwJQq-H6B1d1PO0^N$ZP$LZvJn|b1CdxG8&w$Ts7O!L=0Ro zLatL*8`!dHTB%3+1*krN-w?MidOvw9oN3h&9%pr{W@>E4sCCPrNoTsmBweJNpq{WB zMo3X0B(<&|Pb?fJkwTi>&p?}fBazGq_1B-^;am}nV>Sm+uOe#5C_sg$0m7ShhTkBK z;3Fg(S-)votZa=UP25k-M<@-*_2!fXg7%P^jm}C4muIX@8wiV&Cdx$6s75dk1R*u0 z(KB!L>TjB82m;-LYn2Y2_m8I%NF$+_GJ-ipqE>l*Z0|o=>nQfvbCzFsJbs^-y~v=k zOkLxw%2pzco|iCk+!u7;R#26ne(0E8J?xeFJZ92pzKUyA)MvGLYi(IwtZy30E%&dY z?R>$9VZvb)T$taGQIEmd$yS#a&aL-!>^-p`vE`URLl9_w&XscBe>pJivTGdy<|fp+ z_J4?Q4XhI22K!HX2406<9$8+GcpD#eWom>CWk_EiDI^>v8y~ijx|QO{;##VU6P2B) zVOe(OF|tgfo`gtC%{rFGqqOh21u8`dz?bDB>=Q>thuA751X6v6OS4VB{Fl`rrv+TE zKac-(`P$VETkWZ>yX)8KCEzaKb(vv5bxYi~;2d7td>$EmbSG4|ll<$}zT)i?^j=c1 zJb_HqFN&RAAa{=8s3C_sIwqBfE*x51N9uqVk*Shb5t9nc`*mCWy5Jxk5_9E3@zC!H zP&MhoWRjsm@$qgFAgZ*bZGee=OpgDAk`+u|&TX3cQ762gnH#{YtzpGsGwF?|$=ZcApuTJ69As6V8}cZUADv59|w+g{SF6M^9-jGzv{NLF` z?*yF$V^_+|*_Wi>SqVfk+qBE;2>C5WwanQk|5a@vN%nh*J-TM8+H`ikh*xL;D`RvP z0S)XoPg6O9^ddo6X_YHMA4++~1gk_G;3?aZQeB1$tHAoh@>guDyF27&WSzJ6lFpnZ^et@dAd3lW<4vj zQ*1M2ZB&Uc!-b(;Cn9c@2}=+VO=ivID|SDjSh~C-VlbCOVh{w%x|#IARTH8q@Yy}x zzR(UFys+d(!LrpfbARkqb@z4&O`&(@y(pWR^0`2aqsrK{8yvn)yDSY7H9K}e=Pk+1 z@7?<|f>BR|efqkTB(+ro0ZMPFuFR1JvJ@lDRaqcuFIW)}&EQ0V-vFYx-n>3tZIkIWmmT|Fm z?U5NS6XMAlyIa&Rp zrD;$t$=$ZsmH?Yyb4Xs5WD*&kJm6_TubviA@}sEdiw>oju2+_)oiX`XX3u4N6WA`g z2K0u>?YVN}k4whc$4k49Vr1TooOfW(E&lpX z0=z&4@?Spk%@by(V1vU_30OvRb;0G*x0$%g~M&Ef2Q{#Bqsg?>Va=zJWuzPPUW zu-y*yXvLq@%1%>?~}y+ zg`47qxM4W6%W36HVRj|_0`C!ub1OZGQiz!#@wmiu4ImVLFJm>hfWB_k$`T@Bk74;t6#Qo}b@ z5v@UU)xw*`k$)#f$Vqri`z^&E+qLzSG84AX9axcLq)@AzTVD^goWXjdC7P4Sbdp1z znlj8W?0%mLBrMyns0W~W{N0=e!TSf6w3RMpz1TDZa+TC0l$VH;)^tpn=o>1POfg=wFs0if;gi_G|(P`yUzPOs5hL zlV)Y%U$TZPZ;hCFnIQH6nl@#_}ak#De`)8eRe>@WKS_)j(*}D2>UMKw{i`5`j+;Ck{eZCFisT;yM)V$5Ox64F8GQ%=FLybQo zm7S5fI&S(M`LkBalZSQW$I3eqWmfDj`9DVD4Y`QPMi4K zN}bS|C!Jqey#WnLH1=!|aMp83gI_ zkNr9XcX7{m3UqnH5VH{LPazm)-jQ!=ph-PBc!zv&A5>e*JAAEyqj>A4nIl%rxae60TX`pM@EpA>LR$8?^s2X*RWF|DmQ_mRS*VJ;h+wvB-WE z1**L0KHC~5s4_1NY{CIpP!pd(%_Z*HYHBDC>Uy)8j1)FeKR?!L3+%@6A98mWg~7#< z0uphg3<+}S1~mwN*2^^WT%dh_hW!V{9~6Rzv%}JN<-JIGkrn6@r7z{@_qaDZe%nek zQ1S&>>Arn$eoZ$aEVPZry>&hzUHdstm+wTnqEa;3>F^^}%_Fy2fnB}JkR0^x6Ua{h zDmCaIG!FYwBr%*Oh(o7F;^jbI5eDB-B48e8)R)&JQtF|qNHG^)kicSZgiogi_OB)g zb~bPz-!f@N0|H5)GyJZU*I?8qA8{Psl~;4JC?2v~Zb>QuR8?Z}rCo;_a)TUc+j%}v$naI zm82)g>eK9-6tC&0ke*-$bbR-U32^ft4%w^&?AP6BA@zF5nJy_*a!p20KZ2Xn0O^EV z)cJdyxzrk<5#0B=Mq*Nc3X-G$Q5w65c}SIS$6u>{&7hY>%Z^?QXNTY)4HgdqU)C0P z&)VfMNQK^vb4NjQq%aS$SVLFJMl9thCMSv0994>&t*2~U4>BfrCp4Z-QpN(CH1@hV zgw!2ea;*Z-n?8ti9+PbbNL9)Th7g~GIz3+x6qzsu>b34n*4&>y#HJIryI)8@^{rg;PJAQAZ~O8uKqdb|3J}5G~I9-Y0)@1S64mI(GTzF2kM++<=>?71IW=}D=;R~ z1Nl;vq&X&4yusO2=F$OPvBk{1ty+ik_Ej~7{H4q(3eu;qq|uM*8q=$JvH*Dh z!3G!%@mV?DW&aa}^o{tXIm?`=4#v}y6}HvfJR$LiqG|WZ`b?J(^J^1^l_`ZEnav}< zJ|XoJi;irl&Pg^th7a&Fc{Ngt^H%mYX>5pf9YKO-Pa-sa5BC7&Tn6@lo#FkDAPIL~ zl;!8?2_vpoTRYG0S_yrgmpNJ+`F);#54K)kMwiL6?NZ0|o%3sdUTa+ip_3=#y@H^g zfJmkjYL+4GbCXll?8i`5`R1OK2uUu`hBS))J_*hKOzvRzb-ezzK};Oq6vW|NK={?53B^^1Hb|JZ!UyF-YQk?`RR!hG*+pFsRYnvfzG8HFt+Ym%?t^BN7~GE* zBu*!oY@g!+k6EJ>yqX$rt)QET^VMDDJf}tR!w2d2^hf9yQw@ZDojQ=8XG+we^4Z`) z64Rh!gBP5WmEaE-_=T-J;yR0G2(=5>G_qr9JBzm>Q6lfp#Hu!Hdw0Y+`|Xa{dl7$U zd^XRY`@FRdeQnN^6YkQweX1|RNl)bTBIC@n92%%b(MXKcxP5A(Ed1>~5|uHJh6Ta8 z2i~!O!(fIv!25Sa1UZ=YY>$SRX#VaNX+)P+$4VU$?r zN=VK*THlquywD5b@P3r&5sDFEai9-*lVa<;mUEhSIju7L?>G5=y?c>vJJ;Ltj{Y)O z%X7(i*|DzMHW|dp%BzvEK@T8y3;eGmG=1?!Hh^PM5?p+!Ue$REE-5C4(v=rXxm9+? zsfVSgFj6{NL{xN@j7@bnt(EW@#0w!QYCxi+R{v-Mvg~ zPcAB?#^ZRq;coqseqN_n@Y(R1@<9Nv^MQeO7TL)<#541#Is}v|xil63Ao$g)8WMP; zlc(HUK)t2u;fWugrox?0U6cEBgUl03=!E(C?5jYEZrwr{c&#`oi@%QwX$bgF!N_a! zdn3T})!|{tz8O66YP>Paal|99WVO1!7^aSSi7BaB%EHuXp{j#H#aH(40P-BzXU?dn zhmW6C+wb_z9(nI(uscO<>y=N-mb0ig&g>K$v!h7x=OJD25aXNd*0v#UmnNPq9Vgko zC#2jewxuQ`B7w@D8wL4+>N4{}M5_Jl{o8CJ&N)92ogIylzq`s;VO~={)>Z^yTzQEl z4>Ex9j?U~GF)JS^tb>bdo23=03Bt>XijnuYkMkx=Mk?ukfpOH>vv8iY-~2WdX7Cl^ zUno>GG0BjSc4(0Fas3wiJy{i?l$yNBBb+jjx^r>SvxYV_KfBLN(?L!Y$SAC9u}GB7(-a zVS*z6$%ew4Ibht>Ma@B`S!i-re-ln)i#c8u zo9QC^EAEtOH0zw{5rze+)k-GOu77W<%fh*_Ml49wFM=0#(}6$kkROsYuUM49aonw9e^2JdXQ!77b=@9VpU6!t_5fw zF?DDP5L^>FDZtM_&_C^Dq$?=Cl(&&7Uq0DniaWR;3Ts^e*=R2}FM)BYcBm&W=M-!} z=vTfYCg;gknE~=}=?|m>RAQx6Xeu1-M!b`SVM>j9L30NGCj&4{;g<2L?$@cKfcNE>W#_zJ?z#b>B86ukwWA`K?Vf)OEFU%9LmY_3MGf8iZ(Ri#|jCp*C9jKlbTW zIW^2{G9u<4x;+G}WfSo8jcb$kgfrI2Ulv*#MjaW}E@3GpGJQprWdhhTR9OzMbf5sd zK>sE1SHTA1jF;o#j2)<&P1>{^jS4svU*dDU5xf-JN(UtJORAB6T4t%6EV4m)l#=~8tg!7_|6jXmKsv92T=U-HxEVe3?z|m z4WK$BhxeB#$kChz)NFW}eXG@FD%7qDkJdRZ4> z$T8oOM_(geFIr8nP`MU>okT6Q&1t@)1@Xb2er;<&Q@tMYA0EP6_KIk2rHg8Lkyb=B z!1wD2F`T+BnP4D54vkJ}*eFcFP$Q$@{B;)FJKo=+6R@6e%j z-hFloYWIKTKG$(zXTs~$YKg2%;$R=;Y#)y=whGWn>M>NG7xu0A@vHWCsKAn@t2?CRgC|9-Au)G!?l&}Y}T&vcT&xM z@{k86BHK@8;qwv%TFJ$Hv2!YQ%XZjD<4|155A7nGfUN81lUq-NWI*{R3d`knL~_XM zg|xccq)_+)VS}%Vw8fuETOqm?*EnXS%*a7>Xg9C?7T~|z9)g#=G?k-YRFJp+q;7h7 zs1z`hUqC`70(M%{%B5%jryh|>Q*W`25VAL^lCo$khe zF2OL{BYr~^jZ(ITOqgamj*8qkV1x`{39)-@23hfHa7*@nAWTup@KJYY@C|baMMzmz zzG9WpJw!jf-d`M^uU=_zw(}Ivw;);g@8kyGZMy|BL*~sWO@4P6JMQtzkI2+mSd-V~ zmp>h?>5n3`k7hrDe|@<;WPN%mbbDOhy;sa){54p7O|*lL6XpGy3Yl-y6q@ApeC`9Y zQk|Cr{-++@^ihS(%u2Z-7KYpY=$8D;)Lp6RwQy`diMOkkt7y0e5i5>PHbsDZ5U)l; zKT%aRAY7>u3=Q+kPdF-fKV!#t5ES?2*&YXFdZ_eXiyVtG6<~$eKl^oLYQ$JI z$kT17`RnwH0bdHpNoq}FOE>|---PzZYS%2mJ!AXu?kR5`o#YrgK{4~z(MR!$9gJP~ z3V=R!Lc9Ti@}A8TUT+@VzfOMY8Url4v82rh z?cNQk@Swd|(NESrU+qNKn^SQ=18oLNZMxf|$Zkll7u*`bugL!`4}7N^-}mi^1&To| z+cZ3Kge1-QuWcg6igS9r!|5G^VMU2b8cCSjXZP&>hrj=QfQFtI_Uh;6RGagU#3vDY z68U!ou5Cl($QFVsu0OEVaJ3cdtY7gPP>EET#oMp*^1~DYykImY&BU9)u)Erv-bm9> zp~%WFX8ty^sr0ci^ckAW)3WM@%9P?&9$u)*QAQ)s$n8;cOO(z9sLe2k`w-!nu<+jD z6{DwVV|ZNKZXKr5^QHiN-$evD<;O=6Fa}o`w5rpoAIS#BjLxdkjPW*N=qA=hu)Mu3 z0+q%jcUg$&9!UjQEHgnDEdt=zUN13xWJl`3>+pYK6*Qy^1U$h49l4a9*f@i-P=vfP zAL*N@1RwA+DiIp1Z?MDRBZy2)r61luM88L(VR*bi6Ub12Gr>zXb!>Cnhnv_M)N`kH z{wPr_*+#XGqPagFKTE{Ct7I|C%G@2XhaR)N;Vte_!}M-@cw z<;kEhP*-^>7f{g}M{bFPXM~{@_vnbkb+K{0qlo)f9NhLH?^ehu!{8uY2&{6=9@0<^;L4DbdiDnW|iP;?#d_%Kt|CI3T_I&emG4FuZ zcbgevF}ty-&}FmdBdI_0sW0nEL8FYu_=6LdNd&IJMR4)Y2PN(MW!?<9y>QThs9p?ZskL4SC zC*R3$Dlcnb|Dc|6zV_nWx&Csoz25Pw{pE7Gk$+9+%jM?fp_h260y24c>HSOS=%AGuviEGl=4(3!Hx^0F@_V@zUnl@KFl6<`T0c`U||gV-k!H%hTRmOkFGBg~AZ|v_(AG$!UYFQQ+ng z)~dzK?72a#42l8!w$sjW$}uTG@o(~z<&Ox#KSIDmNWggIg(ZqAIqQI}%<;KruBd1j zvwk;4l*Y`+c^&lI6q>Pyq(Zz%fqwi4)accF7`62GU9@F{3$RXG)3!ePXrStakWz(C z=soCtEjze%+oP{M`Pm8%aiivhMrV$q+&|KN4r=H=dkG;{Qms@G(zNwdHo6bd>`~g* z!Ozb;O-?(OraF&C5HGnIE}l#*73^c;ep|&>`Arf4A~>w`CrXE^oF)ZE3xdmoJ(KR zd7$9{rSiZb1G{PpAPdDscHS08rSh`IY5Nrtu`<-k*{q|AA?E%fm{|6L=&7s=76(xT ziw|7Ax1~9M-4VB3p>xGW91F#dz<74lRZl+Rsd`O(`z^a*nX8C?zns3^TT@c~jF-{O zEa}3_0^2K0m17$q*Qnl4pQFB~o#J<_`hskYBvYYO4fls8F#xMllil=~n^msX+@vGd zm{1(a$Ee8|q(W5!?O8AdJCc*qY+XGiWvqTU@yG zxWl{k9}Uhh88TmTMUq#Q^tgq!!dvf8j4qPXBs8j;@uSTG|GbGKXOt9f`X|PZ*lf<2 z;%~EuR*Q>kZK_|HJ%`pfdc<5mN#9*7z8>jD^pMY$78l@B8mnSriXMs5qC}X5v!G&? zB#M%l11M)fsv(k9-o-!eh2P_kZua6W)?o~E%?-Xf4c%DZBPJcrNpL6SUJgIkw?i-U z3D#9Ov<=`}5c@Cv{QayfX&!^4-I?uibeB)2%19iokYNJB+#n*Pk%~oyW}HzY0jbXG%0txT^RC4k1r44% zFXmV{e-eXn6o5azY#+qo`EJh5P=mY>vCvhi21x6xeyb#xuYr%MqJvEFr;$r(bANTw zmzAvWu{Guhzou*Ur^)tB!~F)JyDBA9<6a-xr2iF zTWki4j?|RW2#KLZo}<-#SY4HnBUShj7^2=~A|R)8DQ@xd`2)@L+L^I|k0c1Ts0t$! zv5#a6TqndIQJ05WNA}&$0z7ywR^kS35;2(EzNO7wX)k!85`RB*(i~rX>^xlL zBImXE-K_ALR1=&rCF#ji^Ps0EcW`Eq)U!kUK9~(8QshF8gitTi zAkaG@rP%YP4)is)Sv@juTmav?@r7hMb8p3H&TS&0C1}AlM{lGPEUv3R_F2pCF3JPn zYSKx93MU9|UCDb)d;>dnbFgg~pOruqc_~-nM(4c~;TN|Nf(iLwlApD4n~TRAk^2v& zXJ}2Xw+0v1J2IS24l1V60PHTSWCxzsO5`T1wqrO@zXd8;c6C1;-YZ!ri-nTa^lIJ}L}L8%r+!^CZ>u(~56 zBr?ZBA$e2^6WjG?TPawgVunag%@PJhz{?%}C(HZ>jbKz($iX@X9KL&3FajHp1ViE> ztF3CHEXVKvq-4$Wj9h!#S?fMyWtR1L6v*s%n}on!KnS`r5SIHCZmA`jpMZlnE}~;} zqN|g5Ad~l#$4;H>;5UTMcFb-nuMRwz$<>N%sKNT|Sg|e2^qr7JQo3m?j2hIOPj;0E zu^?Y@4&va?v^u@9qrz05$I(Nu{D(MBYYz6Owwh|_S|1C2BD$o0e)sJzP<9 zhqIWx2m)nN-T;jB-{3=*RnAqzmaTkT5|(eGQMTBHi#8q7*S0lNo+6%WAE=+4d{Y~p zru>W=yJv35A~a@ixzJFpH?`_ze`z%43N}F%FeJ|}QGdOt59ozto9~bIr`RCAC%rL= zO$UX_`p^0V8hLl10W$N=YVO`4KAH9L*6qPBjfvoeq%&voc9aF$?y)=zEZW$i?~r9& zI&Ghd#-f(2QaZ+1PN6c4()gQV7WW*>Z5L9P|3A74EQ6@_%XQsH&_Vfdc#sTZvLU~O zm@V!SP@VMZLl3obw*>igp9X=AkzRyS3my+VG>r6f*Y#)PZLkK0c~wE)x22U}HY0H! zN29Y5o;-SC3z8gO>wfm}fpzq98?9>ko7=+*qWPc29qD^EmcE1*J&y-_mT|eS#0Wrc zd@Fsga3N;+C@zP=O!ug)6QXsvu|fRjLiV8y8VZ$iCc{ZGz1MSI!Kw>4dZpSCPe=Mg z_2n&sny@I%bagcY@(FZwrLH6EacU*w&zlh1X_NGBz(qKbHE^ap`URG(V%46VzGY(Z zI+yxY{di!T#0kjI8fDA05mJ&YxC(?A#3*gZFVU)lBU8$#OT4NW%W$6X&@X0%;A;Gz zCvq1dkh5`o(#9#oN7KxYRePWik&|mT5y?Sq~Z=GJ(kJTPtA$M)CMK z%6VsH<;fLL&IJxJaYjcDl#0e~h#kz~(Q$oR5EcpD`JzI<6RyYXRvFO4nQ!LYws}G< z8bc79c<2o>-LO(D6DZL*d$5J76B+KPeBaSi1s~b|=V~H$MDcEU_!TvDV!8!Ibj_ma zG&G#~QXC3V+LE*yx(eq3wC(gZDgd2>o$=(cq}8J#u3pda z8hSOVIaLPvPUYO;<`~nceS7G&cB)C&6Te;ZYEW(65A}6urq4b>fUxi!-|q-YDRvG2 zLRc|;?DO%wZA z0g0+(DE$GXfGGsy=17!DN6EbUFXlTKNORykm*_i5z5f$``#@ceq-U>&Wz$}a05{pd zq~D=0AQse5}pgVBiZe+V4K@3tTmqt8) z_FXAUiH}g98Tgjw)~&nq2h&A!E0Gp33WG$K2LF?~#IpklEzhKNA`at(&0tkrHUpwH zC(s4G`n-5&U!~IB3PuQ3+W?Y9l_|?lo(@0n_gtf-{I7HN<_0 zRe~y^e*^?JOtB@p$GQvA$1}Z`SN$%b&u2G>xh`QP3_K%QS!Xe#$7@sD;4NOUt}mb^ zCsT04NTpMQN+ggv6Gpz)pJ>jm5cpQ9@f5HREC`>IU!j_{i$ZU*m@!4jWh&W6G%dCI zV5Ov$aw8)GA}YSX-K{d9lePE$E4Q1+h^9S(`&?%auHY`#yh*2MpRd#`~Yy7_wPF%1NQNfVv>@;98tiaT>h<9`kNe_Di6b`RIOtsUbPSA_R1 zbyRX~yEABX)1Vvd)s5A!_3n!6u@aDF|rPY$rjr z4sWe4xvU_&VL@Oh$%xn^g5=nF`K@G^E(j2Cj12$^RDP~F)^~>J2Hxu2N`g9OmJXji zS#-6O=^oR*R9~)_6$zl=tBPnPh(|L7JxKfhVqm(f@tf1356=_fl~ZM-5s9u9BKFV` zsy>EX)kmuJGx+CK>f$9J{#~h}cMf9^)*gBE(eBDz^fK0MfWiUY0}@Kc;T$`QMq7r4#E>OzQ#Vv3X6-3h)KWP`oR# z!7sQ@Qf~j*PQn2kQ`Fgnl>$nI#%U8;3pu$hcwo#L5{a95q?n{+oZA&uA$Iwg5@kXE z0zs(UDG1QWLfK9llsm_=S8&%99bFBUU%!ff=qh{UmH$oChWYrHvHH+`sY3IA%GsDeqfzaP@V;efl|LKTzPqtmU2QaxF)1ukM(=C4yZb zjZ8gTL-$iOmgsPLA0Sw33<4M2H1|p3+XWraNibVkC0R??@&kJ$m@iSse$3hj^NWrq z#UMaWw;-Sv4O8ZYKg2kkMUIpVeITVzs1g;fQ4dlh`TPHOT&DV9iU;cTb12h#lR`Yq z0UOXS7DG3LgkqnZmRx0GO@FYls;N!=bszM@jy%3Ysu)waj!WA^S@|Jl@6Mdj=Yx8aSqBRg=ab$p zh#m0xN|o;aP@0(YDO$HS)x6ferD2kKGF+ppg7FvVSkbWJ@6{xVycTTm8cqW$19CC- zK3GOc)dfRNf1KWv|HBIC6IcVb(y2>2P<#B`i6Q4)SB^Q}KG#RNKh2bX-k94(Nz2VD z@-78{!`OF55^e8>&6ld!1~5F;4P~9Ko0Htw=kGWj6aFsV-ajEZW?=7(1i#?4V3Kh( z7#F4_pa^=jSbsE7-B9P_RKtm$lVAer$q;#?MF;aMw?q9i0BVr6F3}T@@{DlgL7)Zp zmS3(mp7KGVSY6Eb^Li5D+s_3L-XVCUx7SVv4WC!x%9w1fr1K|B7vh}I_!8Q21)XXC z*^!XEdVN?l_o5GH#)@iAO{geEWbXwyF%b^&#(0}Bu>OQ;igi8UnLwj=vhBb9nXVgd zL7=ltF1#RQM8Jyf{Du$Nl1nEgZ08Y6OL)J!(zvR zvd-hKE|t<+8C024AkXG?G2Fw5RvdGwYd|AdRs^?!jeG>8a=7qz0DF%Ss_pc33$YE( z7WGe=72rx_TLWqV-*yeuWV!zF)G00Cnj$A}51za(R4{aUw!O__AvXRz+220AqHYx@ zWDPz-hMQUqLsZ7B2`!_VTaGtP%&kR(HPrq_#rP#0H#JGqICyU*YLQ75^_?EBIfSXP z-6MSzgAqOn_7Zs;9!#C8L8yE@+h)Iu^wf6(ml%x3P9t6lFUila0}&VB&WT!|j1gvf zVcfuh+L)rb;s4uc7q*;wyP{}TeLE}E$(+A~WQowV)=lDH<))Qg+@`mME^wYy0dLB|FVp?XJtu|Nhl4Va8H0pj zZ&lUvbp0d|^Kze-e0F%g&;Z_DiW4hW9%p|p{%E4y_^s7!zxGGiOKkcNOQO^56=dk6 zJkH{ntJ+3pra_1}hCqJS;+2t8+w+Dr=fU}}!;lBfpdAZhceTL#km7#DJCu#LU3|LW zN4#dxwe?`{v%y$|L|#K4V3M4T*(1hjRF%lv_zyhT)LU}XFIAlG&MiO}&bfGpq$_px z-t++i5Hox=p=YUm8dB=rD4URi2*sEq5}3Iv81~&XrMkNMzo2IL-sc63^8D*yUGW z-4jtvyUn>89aoOI&SLt>O+*{-s%bFZoNcLXX;hXQZcxl`tr;*!nbnv+S! z?cMuwwPv`}Zfo)hNT6J=!E1~IyBr{1UYxoF%g?6Xg5EuARHm88ee{uXuI}2S^a;$o zLU{tgWUle9CywK_TJ0A^U>xu%EmNOZ;>LB)b#+X8w-H<2JaQ9L7Hr9R+H?RbI>Dk# z>>m{vRC##$4H;YbImVSKuf>^rz+}lAi~UO%KnV>vrBSMdx}pA%kOccsaKDpI-1k*A zOQsxzZm%w0nQ14dI@ahW!RzX3LNhY~q9blud0`1HBJ|}7d08b6`~eA4Vg)pQXrEFt z-+A_3cd-+z6XG8}Z}+e2RzQVlCP%+B^p5T4<@U-?zNz3yRBr4x{1{zxKU5Q+J{jn> zN_VWaJ^66NSK85i2@nzVtn_GzWi~!O8Ayx1N#&6{r;X2FOle3iHnJ>C6GcN(zq<|V zX42r^P=y%^trUuf`jg6DEFkh)gRQ4)gKXzg&G1e%QIT(@i#rrtUg>@JLsrTgp^y|LCOWuki&*pH8rCX(r}C zjX&np^RRMn;G9e~J_(Feq^U<55Ibww4Ed){fHI1M>{RqP{r#%g zgsxcd>qyxIaEB4j@c1?n5=JINcM-*SW7v4eVY3PM44B3x?hyBZ_pV4R>lTg?GCw1p z!?Q>y$PjE+)JKPB$1v*6d?sT&lcq)lYo9nda=EAMG|NgR7{w_7R&U3v!A!xYbZ7i1 z5}OKsd{x6p2fqR<26)k ztsvN&e%c&w)g-EnO}8bS^?1I_)$Op=ZS%N09UV74+U(Gx#xwYkcno%F5aX*|EIEgq z4r5W$iC{dQ;yU9O>lb<&ic$+_jq=|K@b|6szgLr8{a#<1%q?>J1kTP6N#8u7S9_EPl4ws1vD0&*OOz%4aqj) zp?Y_JRk_$?Yv_yZt5e(agR%|N#k5QJwswwH$FDW-Ymet^Bp0?&o3bP>vNfy<;g)!I z&;8j&G^P*#xxF;pUMcxWF=YS-+x~wtR_$)4sxB+eErZ_v5xxtWa?e?@uRTfXdAw4P zJr=4$2|yWm^DjFHlV1OSmCoi!7@~N42?SC}!>8c37#Uu?+s<`ZXoxe=$v0(V~_WEmT}T3_ZOyrLPS z`@?5H5~JS>he#^*3CE9IVH77~l&pO&<)Pc5l17U()3&D$FBww4!wu{rqy9Hx70B)) z@gxKuV_V3-)}3iLgtPd#?m|yK?m4=&O7vCBe}69W20segD<@p5FP=sVMIr4MY9T;XF8`P;R+7apA9dM=qX?#q_AGBNH(Lw$ z>92`Q2r7^md=CZ%S)3>dlOb3Jg*<-2;-`ur6oW!Q0-mX&t{nm$zkW2xKW^>Amq<>q zK4q9zY?kMjKrkXB;4;Q;W{xTtat<{eBI8h%9UOv{qT^G1!mQEwxXR}Kco-G8Y9`7c z28rLj8I#qzN`^iHSk3IJ3V|G{JZUW4!c(rI6d3p7~LHp!$F z710_*q$1#U?V}a7_h2_O;FVB;|3*Ik4juZeH0Bh7pSt0@2DFTDz}V|3_n|)ewo`6< zXPQ3|yU_5G$u6PQs#GWJRr!91%h(4GZIw%dOMLFT-J3r$ZJsYyuNKywEugQbwZ^69 z(c-bD8bXHb-OevW5PT&sEHDw&r*FI&lNc6;z8`a{ozv+2K+J7jL)mGcba2g2{n<8B zbeEzu!IwFZ7GFyK$;YbHZ1i)89He0NqATbWN>>C~d7?RblT13$d?CBRVhxsTjxL}2 z!^6W|=_}fwh5IHn|Lr48N)W6v?Gyr=xF_WzVkd;B9rb0XQmbQ_Susv2KhYw z#(Cd&MVGQb&f~TPdQ!5}yD3B4p!+!IP;QpjIWArftsss|R#;2GGGCra^5Ai({(P)Q zGqR@=TZa~vw=l==xx4)N19VcMnm=yin}VVznk)#FHc_*5fn0E`_{lJ$jeSL@;>a8O zq#3${p4#!F>1QuirMnI+N0M9BveCcIX{DaI-K8BNDS2miJj|40$?))$u(Wdgd|ss# zNp*s9%A{flnk~Qb(f4u0I;iN#@%9g}#!YLrJmX0mavfq8+~9EqQJp5YdGl=>Asw`^ z!9JsrKBqxXB*yPepvjPwAI}zi8AFoEz3EcDs=st!Uf74CY&uwd+Y1V^Eyrm8Ylc<` zh*)bFhLp<6bIoO-21YYlfF<7;T0SqmGKQLHa6;G)bHr*61XlZdmn{GdAG2Lq{^5#O z;VSAkUCs^Fd`!}Av>VV0v7rXiTnG(HmnFpsckI4+e*d`P)xF--DH|3x6uau+TbCtR)OE*J3crNvhn$*^&G6|p4{fQWBpHaHBhc`5Pn z1#HQ)I`m?jBaZ)on(hQ!HESlP>_q=WJ)bhdHkNjAlaG%;QOB8}tvBRHh;Ts*t7=&z zR)bD*KCb3mzBNoGYGt#<&9Uriv#q0bqOP%UifMZlJ+CN5CAn1u^)0y(t{TAHujEN{ zjya@x4R;`-dMr>M&;0rLQTz7y<&Tr5gq|^mN(_dTyH0Y@xmu^B0PnxGlCOWIiZ+SN z`1)B^?PzGtYrG9e*yoNnH$mC!^6lM-R(rT$F3{OtScMpEz)^!B^Q2?YXnT@ z80LNRaU45gx-r;y|3kncDy1J((kis@39hV)SD?24Vh%eEfyT2g+UyBDWUxU&X{=)Y zP3nc2UHuodyBm7QvvG zmE)p{Q6#8CoNN!f3zya{L)__a=z`GBL8l+;g>IgSO^e&!La1{y65tIqk zpVi5yjs&hw$uZvx40;A%AttvAchQ(t^ATb{k&d$OkUP)O!{jzhun}*|nL*9ET5i3x zGb;IZ<{+-e(ucarli%E`45yB%%f)?;M(JWL0}SEb<)L}v>!cRO^9f=~YVB}dn*i!y zSV~a6iO7mxnjrMQy=*9(gJ9<97Jd`tU!Gik9bnYJn?I2ShLGztNDC3S+SJoQ5vOP8#%biCFm^%A_l}}64mqqiD9a}Tpw@P&q z9g}L(~7Y?Db{)yKDiOd%FczUydnm%}~_ z2V&E7AN&w=1z9Ijo1#B3d@at`;;Sxr`O-?mU54W4bvhzT2Thj3vE>^^OnahwPxALu zVr>+XI6zA!b)-~6d9r68A0vJEbU)|Bs6yo+kBQ|Hu){^GYnJU|j3^1A(ozXi(~=f! zt&-7-e3Qx@8{q>(1UH99k@rgXeS7Ipey70Qnw>{*JN3A zKb=Fieyt4etkHJBJ8~lmKZ;e@lu?JC6?l^iXLO64PTML<5#O0vVZLSgt52_JiKuSl z$S3<69(k!{p+0;1%y2|1>|DTaw0xzpe3tx7LGX@R%(V<5W+}iB)m@vj2UCh{C!Ib)u0yp zSB;ooM12S`jNpP>i=bv0oOHN;bc+uxO9Qa&s7ps7Sbb;Wo|d>-rJCrp*Zz>ogViDk zb=(SKZmw?RKS+H#TfjV3=58`S@eykRFlAE>-AJo5K_BPqjbCBRA;y*((a5AlyaAc% z-&p<~^RJq14cLeoTs9bg+?4j=j_&%sur2&>f86{lGma9(&cGrFr~*=Clu^XzCjs2m zN~=PAErBC4!sMUd%>M}d8R9*TH=;{Wom4G?Z0ni2bYz?_@L?73J-9Sil~o;etqrRx zm!~+Q8l@~WaaPVoE4eC!cbb?#9wYka2zMVzRrzvDeRpuZb4|cw_bYa%ZD|&@jxGK0 z(_5O~mC*y)xyo`=JfYr}_V_46%5ECKSXj!G5gl%Cc1*TJ&+44TOdkE+CqhyW8b{i# zsj7O_!m{xYv;O#-m$lv6A#6-Mx?1(5;Dcqhl#r8>Fc!nXcGYYf@J+%Q9r+e9QB9m? z#|S$NOy%q%%ye<&LSd@Eg@QgcT|Gbcy1^dhfQ|F?gJDeJ&3^v_V&*bug7I| zd9B3x;57t)kQk@F!HJo)PhOfTjdmAs5)C(_TVaY0cmcDr0SRmt1(pBIJ8xKS7x6cs zV%?*Wplg+~V$KPnPNr3F4=QvgBfO9k7mjHi1ye%13sx|rj90&g&Nl~xIVR3vlkOUG znPAe6!1*zybVK}83ql%@LZNFVb?;rn# zXMSwW_01h{r{BKSKLDD$WtDkvoLIlSYhOTKW1G4GzrKWpgr1zkRe)ImkNCV>usWZc z3dW(^xG96Q6zCm7#-wo8zaTTPoT9TFw-{hS?1ZV7Mgc!6i6gTHcQ0VVnWieC{dd`a zR>*DrZOQ?#bTZ?fpG31lwrC4_ExHc7G8pzYos!!6;wAl$Dn7}n* zt+UWgRBztUypxtz1G!zo7BLvO3Q1LDUTN4Bk>4R z9Y1ZCoJsD$T1J@LinENph)1I3{S~VGmB79 z+okHw$omoWqbf&sC71w#!vFt-(@hw}0D#;d7*0xJmxy4!^)Y_PysSJ~J9)Bps(-zBH*OYlbVVkHIvC=c4M+=)D~kzLiQT;v znYTCWUl@^*R9=0Ow&V5;=;by!p%linQ~}o94Tla?Nfaha z5DFxcFwnA7imy@64(zd@`Iiqu;@7k+msUS9o$N+YnvaJ-MYFZ@6SrM_^~ zhs6;u>L6v8-ZXAen!UTqVC|firvs z&#$~yDdyB-HGRdfvvY zjEFjn&3PAlTfqm3oN2lC$(78n>)rRR^YLmH` zCZ(u*M1(rSw4j-&E-N9a*)%=s2DLfr7Lp$p>daNn{yK)X&!^~!!#Z56Q#^|!yV%iag8Y+F8hKxYM_-JZxEh{NyB)2 zUfZW5{BK+djUfWV)B+%!3dAvkYpLTPXDhyI9M)ZZm?-l?zg2-EKFFowxb>LjQlsg4 zSWQM9ImV}q+bg&yESryU%^;bkA2iAZHbH)KqBb$zHroVJrmnL$2VJaPz$<-J4Zz#V zZ}}l4Mpq@274q<`HFzhTdZb4DG4j&tAxt6L0Y6voiON?cxu&oW13{ zo*ytrx_C>fY#3iG9W3sbnpQ+w9{t`%F7W4h8%(`p7p^Y8?jA9zsxE5PJ&$->pS(W4 zNuFtUCBa|N;-B(6yrdO6>>CB6H+*L8i|9eL5cX*)nR?TU7e*mv$@pVw3S zoXo8;KTV56`f~DieTUCN1uwD`QJ^zq!;+)sxC@|1`xi z$8QQULLZ1eGI~2seI3(jfSoxfm?2loXlH7ZfP=Z7;XdL(U(=<<3wcxx(dqd1O)bc4 zY!Pq>c4xNiYi%?}Oq2bSBv$&=e-sBsu;x03R8>S`zc`(kV-JBG_uK%X&D!r2wtLda+k z`h0v|DVo`I7&h`0Li% z`9$hW`idTLk*P&nzH6KKCw=J;nUt94hu}~9bVy>RltN?jniA!RGdm(v!aO%`Si^_j zazu9jWOeLMLq9o6N<(KWeP_IeB(l=5@8~-EEzs$`&n5Ce2;o?zp#&+{)>emjfh1NRimcBSO{(*!EQ+aK_ligC^rl4$z~_i`gJvtM!NVO{k;!k zg}+LZ_#mpBN%-AeO7fR~i<;QnIWkjg@B2EeV)Ijt(5^dj{p+!?PBJ^%CDvoh2M^Ri zj6X3@3;JtSP~BY`c-n5pB#l$KGrEX+fww*Wnx#)_Ptkq$)#B0X>uwbS!FmwVX_gNc$Cr#{y_{XX$14&Z$w3)M9}cZ??k}kR@o%YcJbuZ z$@5~1=!Jwvp!>yr<eixlbA2@{p5#MW9=&hWc+&Fj5p==MZTJFhTsjqvhj7JiG3&b?v6_ z3^%vm97IDZfwe6!8s9HScqbqp4;?NicPTjVgGzZT0ee8V73ZJoL!*xDJOHifK(Io& zZ_vBRbz;-k-n zBVtp?o{`0dA7&_=)w&<1_1irukwPu>+~?mT1v{G)nm?>&7PskABHf1_90}B@odeA} z82f`kI{o8O&00wvH2KOvun?%f*ZW{#8n{T=i8WZ>m8gO*e zcWI*HhZP7de98Huq+JutQjE$bx1rF4PYYL~HXZ|WcNqCh!Q;f(NDjBqpnLg9a?D}U zu74wa%<-0cVuZ9=6Zr{8gXjA)g~8jJ@Kzje2Jj9yGfF0K?vQ6;&{E2aJ&}}I=6jRA zL0eju*Er1pgrlF#b;rx|!Ta0B`wfW5`{Db`TbHfmytmemcLcK6sdtih#D({qcf{>? zkCo)P)p8!=yLauk^Zmim{`*5y(miQ^cRZd7&ilgqvrX zI>N+%ZJ6keMNjcq8ZN$NLY-M9*ngD)>!hFg$vP}Bu70~^I{sIInNhAkqVi7uTictn z9v*rWr^mcok0migw)P_Gdc?hw`j7+i?*0HS8gfNzl96vQ>QPpH-Jwq8`N)4!_7ZDGIoj%!zg@zcaA<7*)llPc6%$in)AkfD1w7$<9R8&PpV=)DYIwS zUK>)QS?02QACnsweXpPr~d9Lbx0TLu&<<{Fib`Y&V_~vbjd=6~`EsO2Xh$GVn9pE(l6t-_R`?@19SvsZwdV*{`^+Q|4DkUD!0{d2-+aYDGHfs=Pl$f;oCt^XRoz6Xe>^5vtgw-IRZ zJ@=nM1T3cujzp&~krN3Tz|g6F;-Kd`sW-@m`OR54f9r*=k2wwBXcQuLA+ z!3_H>#lVt4fwzM(Mq8l9e)*mL2-RX^ebka(xymsLGADVw+O~5OOd6{Etng@KwVGBM z6e+#&4TA3TIk*Y%k##$;Y|{}!!MgY_!Z4w;$qB_Y7h<&n1|{L^$>4Q2|BgGIW&b2{ zS?!HS9=A;MF*|v%k5{eQXlmh5JQB}OW|j{(I}oZ?Z|RyWZKRKv=Y2J;8t?;^x0DS0 zMul#+;(3jUtb|4t_=4^!!vw_2-`2?@+t7$+*alBY=xrRzKwp3ibAKT z*wE;V>3=X^S{H-@nnV8(iLSbpxnJmT+}J!-LaA~J1l!|L=;d|tZDMjj!^qB4ms_?G z4sQQtZa}7Ej#O#?_EFd!kL@-c#lJ6GVhM6O1je~rl+IKqSUA2>j6Wv1Cc$WAd-|aAg9D-@rRNmE4zA6GV4QE99J&>wZJ+kkuX|Am4$BLAL*HoJC!V;#mz43d!g8Z;{h%+nx^){MwugLHy)QC%A zuZb!vy0k&aY`U=MY<@PX7_#L01S^>2@c-B6e?cUWC>I~T1}3GCnf!di_xQ&1STp^_ zxS=)zum(r`3J`vt(JM`RHBQbBLpeO0ri-?duwJ-nkB#vyE|JBrSv9yUh3PHnxd~QU zUrh*H}yNtXJ*=pP`d|58n3#ocfh=vi}IHeI-+neLQBz4hx@D z5~&2OD(1h-BobakK5D3#tHxHbC`Abcjsre!_)kcWUMot5Xp7XR_gtB#j@kv2yL}=J0|IulbSg{^-QDOrQXtGvJsgtskJOFa`w zUvE4vS8g43ZK(d0W7U`N?gG3y7{eqEr zyd4S0-d#ZDJFWXguYOB}0n~fK^MqboDVkA|s9Y5@G>miGhP|_ewr0{0xRVpzbY1$K zYD&O3Rhv0o^442SELjZ7E_lIMy*tqA^^{YnLLJheezt^#gk3Y$zz)rX%#?$tHS!oq zsrd+68k=BcoLq5EXu#@-zS-tnM@A^ z_c*YbIG;K$3X`G^xlf#p$*6mD;3V}t#?+b4$a32U$hF}V?JuSl2+J5hsNZ5;j%0`+{ZX^}EGda%V6|uq zMhvT*&oH!Tz+3X8rOcm;>AcZbpFP>j@#krAC49L%TfG+4&YDe22!-)^UzljiE7z2g zj%;zzXrXMeH%?$dmeFQWBH2cki4 zGIY1g6cNiWTZZyUb+!_+w6>m3H-uHlkuUBU4cPV%>gku%P@sZMrp~- z-ZOOd#L~QcUWv|*0gG|+spF_2BO`!ob@PS}jO@o3g#ZUl=~ImkH-n^? z?WtMAgl~m#;)8v&r^2~$pU#&f<_9yd*oRDGBHIcj*7Eq&;BM#SX1q=}D<$({XIj3l zQDD`x#Pr=sflVkuk!fvvRoDb3z}4MFbTsnjtd`-SC)jGqdfo^q!2>eTBMj3NuFpNp zl{Q)nS<|YUmeM{}TQ%8tvGjc8kUjA2j-hx%){C=q0RBmRNp zWs_F0W-nJ~%PJv{#+|QtDn2zOXLv=n79OwemBMw(3TUzA6vhVR)FX7Gz-pHTCglYE z!Oi-jLd>`l$FF$$DH3<{t&dl0M)R5-J-XU%ez(Lbd+y69@czFD*ja(X-jTMSG$Q5+ zmF1d-*waSxht~%I+>(+BlAq7I(UC5HO3d7w5OM%J}? zq+3}(dV9}tm+M~P!)M_R_W0Cs?3XKYTW5jxDZ!tGDRV*# zX)D#}!kdUEhXzYRebFERn`a=;K3;2<$R+sNZ8@)#LHE}?!cz;8Cw))+Yi5Ytg%yNI z#lo%h9WBSiJkUx_KjzK+$O$9Xu%foGH{be3_36^^P0hiAW_z4VR(Do7u7%2b!3elq z!=oo(Ix+Y#P%b&ro~n$x0z~R1eEyu6rriFQiwKvKq3=;zk18H&{nB#x(*ad_r)m@1 z#KgCotAk_2*e9Nit$0dE8Y$)YKeQI$(hCl1!fhnSLfK~A?=Y()+SmD zDLR3|;Q%8<3A0JeuzyXdU3K1o>kAK+Y#@g6FIPUXwnVBCM{AQ60Fvi~9@s!sV*2O(M|B#Lp-s z?t;B-K0ni*+uG=j-G4kJq;>tUV%?u1)BvaZhb_q!8WZzR9g2>k0G?wf{S5|p#dwuDMZrXm#5 zm}0AmMoiMDEQVIQ5avz%N1)$`VKXwK4PThfoX`~8A|ei&2!dgKv3aAwvzxcOZ+e`T zD^yRwM31iNa|nzXq%1N#Ys${JKGRZ-=^!$A-82an`3A@Ito&!#Kn-f)P9Bc^HK^OJ zTm?4=@ka6zt8+Yf+Rg`FS|`E$J*eqslxq_bRB>^WbmiXE>fk+YOHq-z%80M4g&A!T z4&Y7Mp4pzd3lg!kMJSS75MpiA*@leeL=;-& z+&LipR#|Ftn<~62MxYRc?$ac$D(Q~bPPY`~u_>W_y8Kz;*Zzdx%W}QFws!7R`*WdC zZyAh5wJ1N))DMd&=vDKW%0w=0>lmGlIw*EuiE;@QbQs}$sc-$yigCF+%!p(5t5?n9 z*P|Qs)P9arUmSdMkOC*AhxG)d?$f~*xb^b_3t=?n-%uod{}x7SlD zVVAC~TM*bs$I2)KN|e|k)bVK3$P@^z1Ui14{!y0VWywS@pGCYaz3Tf*ztNde^v14lL|g5^+n&# z{Kj8N4a+%w;};I5xjE_7@1|u+kaDu6l(r~Z4Ay41d7!FckiO@biZrR#VxDm;*uDfv zy(GL)a4!3fgZABT8Y)m6gM*VG?1K3tQ1TBz$%pQfKj7@RN3q0NX=$UXFd7CiTJ0B3 zPHuxAY9Spm?8qn0%NIdPT&~^+B`x80lFGxKt!KDC`oy|GnE6G2vpcG4$IIazfASjTjZo~ObR%>1XZEwVEf(V1sQHzg!n672#g|3UYR&uM?ByHa|EEec zD6`cwu3{%_>H8qQ*?ow9c=X^-+JJ=~>je(Ua2=As6GA{3yDCm=9lV_F|6r$rm_lTC z5xyxruoXTbiwJ&*gpNHF6IW602h8T1;zJ-%sjx$qsvw+n#F&}XWo&Qra_^9Iu%2;zU)nia`k}FF&x5JqgpY$8 zybQWzcCJbrLfMhyxX)fcePu8NDuvkKkgO4NT5SPus{CG`N+zjLpZ^23DGH5@vn%AK~Cd}eze)C5`W9syK#UvCcUM0)886mrT$R|36+bikz z9A0j2tJyKF;XGxz!J2XX44@z-OqR{&yZe2VXH>yU~?2lmCd8r;l*hrV0VX69elSk0I1Ok@Tng36n8p z680+;}VCld!p{V8-r1N0=0hd}C%~^kGMqvn6rNI8hi*{rdzL6}%PiRM-rOC;= zu2YwQM!ujDC5Z6Jlivdi56;88W$qV`Ifwne*C|%Zd)ZV*G+rfSTB;5lGN-DNXE=K6tI1m3JQpONM z9))KxAJx}%^&srbH^dwAZR?#%8O|38ZfwgVFi!7kpeZ8~7de<0+vDJ(?5T0CL;nuj z5^D^el-9HTb|1EHwCAB;n@szSmeu(zZLQKfR-X$;%j>Y+?|Ziw+f^J_jqQ8lBWx0@ zMx`yiT?QeS&0`gB`!ij2qQhpHb6!=ICe}+?Pr;H1^F{M^a9`dq%yVh0=g<7r_k*kR z-Lta*?Jf{5XGL)FynItTd4Q&n%aU9ytEy0GB2*Ml*;Aq262_P=CfVPUYmra#X~J)m z59pZ|dkxo<)SomGa+=#JITUg5Ov&jCM`T%=f4bFmk9<$T5{IuS$h6iQy4~dxD-e33rwhbGlVr- zbf%HB6dgQ%rZH*jbd#PtZR-FkAXZ$PZTRQwe^3DvhSOfuY8Z$z4Ji}PNtO{)z-4&8 z&;aDrbuvo2W4_5Vo0RLg%PtLFTpxw<-xIkyBcRZN#t*1mHqmlI!3J%}QwRU>O#q@X zlvs>}0du4w3>h2$@;t+~0;=7f;!+qnOC1up<-)9o>$N-aa_Rs#w&QK^RPM$H%OJ4J z78}Gw2!Wc4Z7t8&DHaP@^HksGS5EL}lI)36BAo;9iP=lSc!;?y)#U5iiG>hn$jf=TTwE)2B9Fft}6sf@vQ-t~GvLGg0ovb8?td-yIz_`ZG5748Uc zug9ROPLBqg?6O{{g=V>GD1hcddA_OohPASKy{iR$;T#R zSryaJE+=&irr=qW|8fI&%-a)|o+U=Ia#rS?yPr>yfO=`Y*k6tkE^$Wr($}GTVrk5( zr~uF1MG4gEO_aZw23vY86_)L$V8O%--l1e2Iwjzm9v;=31jyQOeJzL$_o&bI5$Ag4 zz?2M>p;YS7&(0xZsFNLAWxTH%w@X3L-7X$d_pgcy`_e1-Cr$6&(qdEV?wtWaj08^g zg^6g#6z_)b)XP)Ix2@w5s0wtYkrIRm`@-8^8x9=IZTFb_${~;no=h7^njG>dhp6r+u(xEB=hi!*B#d-;p@2A4yZVpEgV+hr>rbH5R4&G{0Q zfyvnx2wZ|3wu#bOfom!TXk)`kVEW>g_q*rg)0wU+N@$nxU?T^>ooLr|F|0?IUW1#b zXR^b`1=o$I`GDhc8PDrNGzDRRDfQt)%4>jPhQ$wfK9fQ>)Nw2G*~d1-3JyXPe==kaz=w zj~Zpp9mDl)kNfT9sH)Bj;=SqxbR|VR=iE}jIwJXQ5We@Nn46@`+9)-`8lXGo(|k-h zewd+8v|{##jaR4r+FMa|XK*)xoNAeEIPkO$Clp?)$xOLybvBstoG9*-e|D`Zly|x5 zsLy2T0JX<;8w*NhOtGymt*p3WJBo;*0lf`L&h68xI~O5@*ImzhN~UC0iNi{og<7q& z?AOa$j^Jk!@TUYpY*C~1NcbAt8wr_vD@ma>hQ=@W3o_Qyk3ya~JSJzr@8{*TaKsv- zPeSHj| zd(_riA~Q#JV`UqA4dd2(JD$lQBpOwN>jGtSynO@@g$=+(Ymi@xe-R5?)rBpGmd*i} zm(_RVn&&2FZIX2>P%4+Z2Rnb>(Sx;vgV!$t%D=s4|Fx_wS!>|AIZNvW8KRx3FvK!S9RDc>G<-NeZ@L!xftqf`Ny(oJ$P zO~b|Dssn*C<{;>D8+{pep(KAQ=3!U68w~OY?of(Fe|w{H=XYo|i}2&gvUXg=1D5vePBq9fTz+@lKpUH$LpDoe{OA^nkMIYTFRG4X?lUT8HYlQE; zwISwX{%G^QBqRTU5?0Nam8^9=3$hJmbS-!ICYVk&Ai`KvngYu{wwA*DCZC)w+l5+Z zfbuV1Q>7HTQ2SD70a1bqlVR9U;=qx+j+qR<^_~@f>!J=i4J4Q1N1c{z@!;gHD+X%i zwREKKg6o6d)pqfh6RtlxCR52M%H9ghGq|ZIU76HM#7^F92Anear&LR)Fqt8*-sPiL zRb1A@CC)pdBKC;MEjh>yx*iyjsCi=MP@(73A9l2WvHBGU9ZX}lO_5h`gk#E>c1LaWdR?sc$Z-i z=q|*4^smFju6#ei@V!HD2)%XTVH1M$(~yd}{14wnVs5(4L(_A%0tvIc+>T0%b~hB9 zpC>#y(TpBz+n(zqNM^#0LP;*-G+ZnysEX4Dm`Bz~2mo^^o|*vWi}V5Tg>JZ1|G(}c zB_BcZtrTo#=EVdFbB{sF4RXi}ES1Ykwev2w@vwkWR_D+*%j1Z`zZx#{KdT;x_BsR< zuVyAy8gLFrMX}yH*Kyt5UntiXBv`htqoa2ux0>WNULeaiQIoct+Q%MhO2nqm#tSo- zrPv=ze*T$HEt?DRhujfTm&~h(M&fp0;$0O0Z;@0V?%@r0T!G{Dx}u(iUFV&3PPXfq zXoWN4l4H)b8#<9#1aLv*2hOC?acbTLFVtb$!4`9Z(>syzx*d zt=odK+8|Dwyo>P)2r}QEP8ReAyi4)Ap0!ji(?o1fa?o;9Z%e&jFBKeDzFiFzq#Mvi zrjLrX;*-lt&tA!Hy>oG6R7ZQVC%SoSRPG#HLFjUAwtKX8b-Wk2yF8NNgpy8>Kce4% z=+j5KKhoA}e=0i4(*A7kakRO`>&P31$-VJ@Ta!6D3NJl&J;|m`zEOlpdb^^_)$=4Y zTNv1>5V-|cl_XcIr6s@Q<;}Yubibgj9m$w1zKAU&l~wdqms-=VaXfY0H}MSi?N#cK z&)VwgZT}M5@q(Aj6YKO5{ywLms{XXetMKhjJS+H#*7e8jsHweuTUOu2W_wH>PMKTj zR+P7T$LQD!!Xa`_6~&~TmLMkiH5+lSj+{Ke^IIreNF2{aDw*?QknAVU3>jIp&wp&c z?=hHqgDH;|5y_IeU0rK(o1c^ch{Cj%cAiWSm|b;a5uAL&>!h3r9SE~QP;YA!oI53C zA4ODa9WG5S%y42+IyKmpzLHn4b%@bVSj?1BUrYYP;$|b?!Gt4nXos4n{~;T4ZI}J2 zr~}Rq%%+u)c zi@dVc8|d8<-T#qkJ2I75#-gvx9IH2%q;|7oFUO9rB;19IAdL3Z-}OI65sZtHh<0c| z#?+`(Owc;QV(P;v$y6CHX-I02idu+19zISw=`2Ptx4@zM)TKw1d2mQ1rOUie_33`3C0&DrDJX>r%n|fJlCZ>Lc%W-Jr ze2ER6E2rY)h#JyNZdGl5@XdHiYB9JI18wnj;Q#o^O-239XbNkG`k3Wj#YcV_r<5FS zqo;A24L1>}Q625QMsp7aJPOL$RYV`V{UjV)^L|x`iQWv`E3E`Ub{aweMn6K}8XEaz zSokERnPvK8;-I)JkM+i976NRT=zc20YD0TBpMiVAbg95rnUj%hp<5aRY@y_T#1&|&DJYhFMrb5j zB43qkO)dn!1Z}SE89RQVe%4sqg8ldc6D=qfqV3EwccExRtQ9+8e-JQc9c|6mQ!q4E z9bhd0NxS_Y6P;w;4VTBbw}UN+irE0bTVf_IkAmq9D+< z>>@*paL}!8kG#Tgx-*ACC+BkxAOL9=rH_5R``f^G=aEQS&Y>_1X5p?++G(wJvJE)m z7Ds zp$#r4*ZZ;#ak8!Re{B7LZor@}!JW;Ki7xw3=nWjVOZB@1KcxMcwQ4qh)T`#K)O~St zhK5f+u9EvE$^p@P7><=20reT~-8*f0U#$mRYdMN)1nR{(kL?UI_^Zw=ty%Qs+pvrR+6z$j)={99IgN^~3f0rBh8javD?uzo{tXTFoQevZv)N`M z7WLUq5S%MQZGN~fuS?dSi`~bHbC@l8?f$V*QW_)FSQrQiw|SAUJco|ib2wvOBP|$x9m;dq7K-1{+p&g zSusE2ex~T^6NY)-(E2*p2lrM}2LDv*Koc09xTL24AP8xz$OM`(a{ zky}$kROpNS6i*S|01DX2((W0btjbeR7qLr2oo@68P*92YBfu;#w8T4E02CzRY)FxU zAZmmde_Y^YKCS4$YBCYIc^!+TOGZn80}9&gztZbF69G_|e4sEAd`pn$)qVlHUkYqZ z5hD_L3kCy?=xNjyAI;f*vLM1UMJgz8?TdI{ZTIQUHn81X|3dAkcJx)=> zwl9^#s)aLIST_UgZ*JHuHm5qB%>iSY)X$1wX zZ;?}BUN(ndcg}r@{rLM|y-Mppa0c8wlE+SIU-F!{HhvWX3?*b^6=9VEP4`rwqr&DUxNkiIdvC?fixdT2in zuO8Hj9_yWj6Rb?d(^Dhbtrrel)wRh-(RX<-GE0O;%MBTJXU&`~J09q8LAkQLx$w+| zY9eE`wrtj=OsZ+R4^^L$)etm4{Ku^PLc$7y`YgR#Bs%N0P6WW)r#77>Bxuh`S2SIZ zCMi29N7@n^+DL&!kzW1VUO~$-6?DCuaPuUntV4L*y+n`Q!f&_2RJ}8AQZE~@>YD5RiM<-` zqj!x52s^(6V@wiN+1f&`g<@U79_n_Y8%BWG~cGEeJq#kM08z{eA{(4MvV(|*1>WyOgXQF z(%Df2y2$2VzXqiq#R`il0N5X~HVl+94RLGjvX7eI2BcI<8Fm_x2R_)dXi1i%ktjJf z6z~hOv-XQsaG?Xt#;qK43`p!}G@5TRIgQg#ZS6$z&gaWDYAoob@Zab6eMOWsud9*m zf7V!9&31=Fm4|kkTDS&#@xEj&#V|H`PJW1ks@Up$WsLn$mH5LfN?HaywsHewRhj2> zkp_E-%AU3@+-8US?e2jHA5^UQPrv09p?Gd)_Q_+mD3%|=`{wre?i~xY(mF7U6L5(l zeO4rD=8Y{u{^wm9-COo28prd3AbV#Nts^y}}J9)mM2d1W#&<7G+B!W962 zoLfHfBEvXj5##~+v`;t`dQDZDucSE)IR5OcIRd~hXsOIQ`JwMnq%PoeDu4Dk&JXb# z3*RQqTO>2SzgjV;3P{t4@N2}L?`I>8_q7cXmg2xu{;BWip15D~)b^xZ)?6Y3y6Ae* z(Mm8tHCpJo1X)vb(>zW;nf`OspCE3xAfWY2TXAtyhR*;ZUe-}ywHbmf=x^s<#ojYn z-)!%)=G}CPs#-h0I@rKfg_R-Z1yeob^Gf>0F6lgh>S#%0?iWmFpxi-}fD2gT`pQLP zP|(RiTw9?f5yz7Q3mMQ&2>X{&RK=F^=l2VxtDbo&|I83fHSn{M0S_r!qTv@TxDZTr zIP*!RDo;+lXF`hn%n}*C(_B4Mr|tpXw(c01GD`972m8D3QbDZm+p3OBW%1YB5pCCJ`*zG~s936F12|sgb8o_^qi1+tou;k4 z8x6p6_&gAq1A2M6>uJ24!v3asfxgq_2c;@iqnk@H&+FKktk>X0HmfyU43(Vy`?M2$ zZTGp|)5%Q2*GJ~32NyKk9%R&!uO(;}H|g`LGf1fmsv3++#0hoqZO|bfdMRa@?0?~ETY5cUAj*BDR1yQU$?_l8~4-NvqAk8sUhNzb&f5d;q1SvWwl>b zz{I>8w&eD?>$co)#=X>q=O(GK8dl2?awH1U5QS1Pu_F=2WvkaOwI!*5+bzI@e;9Qi(iNjFXHw1u;(bdCZ<=lx7Rs6 zF-v_YDDmMbKKd|g3JgTz2=2~lVcaYuY>NL@Q~s?7t4G? zvo*Z!(#%Uef)~E<)kQh1r6G}&aqWxU{+!TdN_o{654)QokZrR2`qZSJT!{;)@xNYiy81lqX(ytbE0670etK&)f z7foJZq_#$UPdI^`&nK{j7&4 z^eX13R|3{H-o7T5f9S?nsQJuO0isD<55ItRSj6iC25uRW!vY5OC{{7)()=BR;i*#> z4dNC~Ti+f5t-o;zv6f`dkUyXuI05G$4hw=*tE@~{r+1&;lAv~MsZ-^%u6b#jKzPuz z1HnjV{L32eNMQw`VXxKeDYRVv&Tkw?^z5A|vjeqJt%=XyswoX&7v7)bUTFC+2)~n` z?D=W6Cy5+S3E$m=5SxrA_z5HZ%r;QTeEz*6TRW=@(e~Qe`+1@+NP1A%!tv>Oms45c zr>U29(Hg_}Vbf_u1%&$9+wu;`_X4=<=}=)0NufTmv<0YbRqPlFDI`^+GGm3#+_l=? zP`kfhM^#BmZqk=x^gl|Dk^$00^=da<;P&0H@B?E5>qjCq7D+<~%9U=WoJVPLSAGjA z52|s3vBVSfay68QLg5$2MLTjuhR6%ewff3AZylI%fr7SWf>YJ0gd_D5_eHB}rmbC= z4V`5_(c9lzcRmZmd9`T7Uwmg2eAgZ^a85ayG%V$mQI!ZyBrzCvl0nwm>)=d^?s@Y5 zCnAQ_`;_m=`+p+B0!7q~-VO9n31+8JI=dvtw|jWYIeAVyxE#=Qd_F!dbmcnY)vSqG zq#YP2`Fc2{%CrCu+_x*4Vz_$Yv>Y7fzyZijrI4vu zVv0w!sJ<+>$vf2{1Edt zlcgyCTDT%Wu1KM@F^zv)59)8Y)03@G0fAAY`iL!MzD_^?Zo^2%06CofU<<)rNMA%( z9pJ%rdzHspawvkMHA@y6j`67Y#3H@Z(NKLRdOe}Q%qHN6=usQ=icdnZ^QL;$fJaadUHSRI4N5=j)- z4Hw{|u<;SP{4w(qnQcNXw%_s_n>CF55I3n*=1_T5TrRlyCcR1y{Qps;RM>PgKPM z_}G>XIv`0=z0yy8QQ97-MiN!#_>&za(UOvLH9;HgL>Xw8y{|a#55n|yXnQVZE4riP zoWWyPJF3+1mOMt97=|G^%LEYx#EGRJdEAQ>FmF|0mB*3i@$s_S;7fI)bA)7$b!_yo zq#9)O=2WG2_#r8<8Ki~?n3Xas{EHtWlUc~}7c;<7q<44{43k`i?G_t}s8jQ$u~wwkHhyIGFgX8pD7i)w zdt-jX^JSCWC7fc%PfiTUr5%;3#_0p;bVckTXW($sp&97!ZL5=lk2(;F5j2*zydtF) z(?ut@LkA%GA5OI?a(2A2Z{w4Q#5Va$GZt(@C~+C;4p)|mSfJ$!een(?wPYrw?Q6-NMA*lqSJ&D znJp^;+{jvbq~UZ-#cX~}?QnUgLqp%BE_7!bdw&SW!LIRw52+%>YO1tH?$Y#!LFUwC zIgPYd`X)8Dx-pNERMADUZZR| zD}BfgRV%k!gg)TfbT;=;gPRJk)q~~qvHb=;*sD^h!D;?jS-Esw)j(rXM)Rq4sl_ZJ zzMH^^b+-q^FluRb%M}#U6#J$}VE=(4hry}-0__bU@J!J|)#F7l{W{0Z!wmt(6Vu0u z=2Tx$txXf=b#CYhF&dOs)vT38YAX2oRSHHpI%8YU;!QQJzJ3>1j9dmv<~k8YEH

5%(|CMzrob`$+0oJEpRRWX7 z)I{t+Puk_bO=V|Mr7!40szS^Qunpo%v&?V9bv722-Ae&sGt{H=c3TuB^_X`t9GQfF z=!NPXyYq5q_vnLJf>a!!7R zY9f#MQldW5o880pyu>;$baR~#un>w3@)rrB1^%~-m&+KBXY2k~r4JhT7oTaIulD$V zJk+^f6lQp|e!V{Rm`nEWM>xu-=N!d8dRo&h9ymu*tRr!(I+BkPA}SBB7q4>%wUG^0 z#-->RdXt<4$Q5q`RlQabp2^KfVjF&c>x!a z!Wj8lhPHqfPFScmZuit?%Lq_~zW(#2VDjIhHe_D`U$T!RX>E^Xrr)D?ix1duRy<-? zK-5FCa!YSe+|Y2fD6lSbEsscbTqK%>(4dU=mxD?mU*esrJ#WRFT%-W+t*9Z4=XJ&J z{)J4sAv;p=t~geX-U=IJGF`B^0@Al83*m^(*e_8*Vc!pzI;8&{khPQnhiynoL#Z(A z(~0GI(}*n*k1pildwMSpm(t@6uW6QC;eQmzYfhnNQZ$ACTMM3buGlMWphl!0; z4;%o*3%ZQ}1FOwGLC+eI`91roOL2km%PL{61*rjP<^1*Ig4Cl6>l97!>)0D1h4WDl z)!$1}XC9?@T}2&tJWjh5bH55-mU1-j2VFlLImo{vVCFu|}f8_P6x7YVo!@Am#CtcMX*+Y#@_L8?+JR^hxA zKiGStQ@3;(Tyv7R_`PSOSpu@<(6V+X@|U=xwD)r2l-(r_9gHYv9pdT)cqhc>$$-q% zqMRrpHl%O^j0ZHZTwgHc(Z)3@idctZiGRUex*xZ%b9<8dNENsax|@l6TlO~4 z8u3VgA$}bD>Ms_GhPVP)7y@_1_zvGIEb{_~!IW|=aYCx)UGXhPs{^y{!avu=rl=FM zAzJ`kmo<~*7|2|0IqYN;7;h%k?e8n(N`KRDAT=EOcj2T8=;e5u?vk-{GUNZve0<`= zfK3vp!}Z1@^Q}L=a+TghpCmY7)@?znF%dNRj7s&16EKsJnt{6j$y@-Gg}Oi*$9@^3 z8TF0JZkUT5_EReDj1)EtfwbDQE51sEnWDGT63Hj_b~A>zjrBSD zjIu4<4r$zBBxr~_#Avp8HR@h5>=d4T!}Jn)FqB6jiTzfMrrQZ>Mi-6moxLHqw%(sQ z4QwSol_9r6*x`;`+f0W;X0x(hS&v-lrAA zf?>J?Zlx;X_vzDAEIjy*yV)~H%90LdL?VrR&HC0?Y4;zg=wCSmy@W3@ALAaedt)a3 zr;kOOi=^95bYKjd_cepaw5Vr50!yYHeD%ZV`*x{YY5H!ve-!ChdMD&u((VsM!WZN4 zrtxoLHj__FKwQyD+vg0r)d zd#$l8ZQIuKM~A@A;RI3#F2AjvNGCbDdmb)&DbpbP=wKKW%VivC#^LAn9I{7EAZbP! z2BJ*;2=dm-fSX6qN@0TSx;_7n#LA*eW6Pui*SzTt+kt7le3j7n>-5@0s52b(^)%-s zYj~h1KgMjUy-qa9Iy9z}bz*^Z1trE)O4u0-I=+@=`;11CH49Va(pa9V=ifyW@kU;z zSt=c@03|znx@h9<7WT{sZenI>wO`$j?z8bBRHj@4OLPcgbH0N|8R8m4q%pdN-ln81 zk<4W;pHzEctXXl!vPh;jQN&GZfxtRpG%>10<}e>m8@I}&FNfqEZT}35D)TM$T(S)? ztP!!8CSX|UbKP`5ZL=t>;Lsadcr$CZ6Xtnjq4x(5zh<%q_A@6Y=~vv9MoLsKJw+}Q z87u;leokDMExKW?t)w6{jK;72CE$ERR$1UxacsX#e`j2Q@vQR#nva5ho+&UX+M3+f zU|qj|yYiMCPRxbO57?EqsU#iku{3@nKh`b7CN)F9RJ6Exq>#I@@DSzaMlwTDkL75TRC>rFE=EU%G9D zXg@9c8MY`$Aw)Y1&MV!kVPu^gMO7y8(Bvq%;CqU3G?(let%@}q+dQM!ztuNFg#=dL z3t0W@p~$wC0p!@nS{(3nS6%P%0f#TCiVd#b`7zWP`4HHVGdyiLXQXIMZ~e1(LYi>b!8_CZ!z@%b zN}r8%1>aCOAnKm}19>Ql4G|ZzQvl@8(ny?ul&w(hK5-IG;ntV_#FXJeFG(|}n2M_= zFk$={zoa%;uw^$X52}wr@5EvU-FF=Z@0+&5^@XbHjwv(c4>mZ4sV!~GDKC!19=i1NPaH`ID_fh7nF-5@|m3@ej8 z6B-I0>v5>y@6LNhgzd{=@;osIvMFF4%NgcrwY7jFtorSI-eBvUI%6JwwMmET>vfL+ zt*T_phE7&nDj9mpg~XJ}hl-D`s|*%)7r8lA&!{KRE5LPnf6am zUzd3wc_5hvtzzjcnQG*iLPFUQ%RKT~5qy**w<(yyc|D2;0nMBJRmY|YER&e5bJVEu zy;G=g#@kfQ;3t2Ag^^vIs;yHV!iBrrGJKm5n7~w`5uH)HgLn6}8I7%>^poOOkIYPt zZ79v;$A~@B@fv?|S1021l>!e9df4wWw_ftjkbfmIc3G_G1IZ8=fV_x`_4&|Taj=)v z8X58o$bCu4$QZ?*42^8)SOoj#E6^3oQg|P>s}GlyZ-c-cyrX2JoRw5h5sAltE(WfW z3cE80j$+kI_D*okas!qHUNJ&|s2z854-kE|FI? zUfEkIvQqYSsx=LJ+r>4(*8S`4C4BMYkYqT0fjz~xo_(;IMSjqdwH>nmufg>jS-KSD znF)sXglu9zf2&R;nANi;AX$CDu=`@h7 z?|h#QFI0Q&5~JucN5M;`pJYHhocZpH*E% zvdlncoBw}AU1NA%UDIx3+cw&mCvNPdN!r-9&BnIb#^#A_+qT&_X`19a?fW&)@4c_R z*XW*EGqYxuTMP0bXw(ipf=&eu3Cz17yR13yZ8`EeqJ1-TTyP~oc9v(_=&rkpi_bvC z{=2`B>kg3)LQRek)J*Fv-Oh^=RWDX$T+-K(s2meX3A7_Lk<{}2RE#U8`L@sCGV^OR zR1wl_bZ^R(76)C3<*e5l^wrEmQ|EJf z)Lv)w;ou>k=GBNUyb(@$Ir3#nCd!m=C0Lqh)YWp_gY;1fXLEubnY_IPXsIn zR?VKO$jmO>Kg-s%8co=@@??x|2v*rKswj3r_T%4uR<;gcQ_7gy>YPZ~=Srpy%-5TvhS6b8< zyy<<2$RmzSa$+B?y=Epdb?6MQHyqpM>Et$EuaNorUyDc82D0QnbLgDXj6FVm=UL{n zmD-n?`5Ts}qZyyt*iZ!GtGMddSSAI0>aE{eWgZft$ zb9mZCPowHUlkJ%sSqiqou0mFcI@dyJ^ukK5L^k4jQEV9@KyXHWrMqjrpKA+kEi};& zJ}6viq5|6({63wKR?y$kHV=OMtRSE4QR0+=ph4)ezRNmbC-2Z@*TgCY{wIswXZN=e zCyFQ85t%bC_A|ZG6nA9eM<4Rbrr3$$naL zCLQ2o(28oBaKy{{)w(*J!BP9PmT4EQHdxeh>q~Oc#b!KkaInW%nA~<$u^q+eI)6F} z|I0xHy(`cjwsZ!6StXmx*tl_^*^tk~80v2t=az{z-oTj3Bn7vaSBEkz4q^t%a#D;8 z8I11^QteE|d#%@(uU;f7755D@=F^#29}`n>L73qlHHx4zUiRD^Jbl7-mfUx5vFxpN zAN;M>OX{S>*w9dS{S4dSQ<(LgTdP+3E~LGy9(i<4%Nnzu#NH*%i3Y1w#l5@XS_)hA zmwx`oQD*rbz7t9T?rSy>$dhm}&^Sb_?&35J;qHp{#Uj{;QI&_>CDl=v)FO$@&${7I z+u^z1^*j@h|2GJYjz`e?>LV#92vUs*WAQ6i9cvTZt(PXLe9et73wT0W;1w*Uk&u(K zgEAou2BzkcXTI;_ByXvE3^|TBB7o{;5)}nKBC=7TX&L0^%N$|xMQGab!DL~Eizbc; zUzgcJv7fT}@MNMw@!q&mkdDIsm>7Zw;)Y|C2%?I$dGp0Bjq>mgeQN0n2|E{|*|OQ~ zCav<#Ok_wG-Z?A-?i6kr2%|vr@JUo@OeZYo4Vk7>+0?$4FqM7z{D?Nn&s_bVGWwwFQ+J?MgOu^t1nSb(FyFk7VQ#cQ zTfrxm@3L3{8?@BJnTl=fg)VfbVm+IP3u2aRCZ|w;#~9@5u}}{f%8kcxDG(Y-CbE&0 zrm2f)XTYm96o(`Z=MlTRB`xjf@1~6YM{O-^Du~+AKh*9^?Az`US=5>rn&g;VkGr>3 z5{E1w2`Q$7hg*Lf09>4E?%ZXAJ<+AKZ>dL}9ms5eiX{HK<^lvsR0E%7#y>H;W$eqw z9ojK05Jf01Ksy`1a$xy8NC1zaC#Yw3xXCbkGN*NjHLM1oqdlaX1WWOkZ%B!V zXk@Zs^)1&1GNuM%a4{y$-|^L~E?)JWC--d-m-MYnn+w+e76)og8-1J8Ioa7RTpMfFZf)<- zSv^OBa?dv050@fprk`+#e+IU;ysESvYSe_cs7V(D8Q_N^n80!4A~k>}lW_J#V)|G$ zD*RfuWgTK!{3@sjnTWw+^8vNby?4Z~7hP7Hdbf$jsw@cqLp=`CTO0e<@6atAPQ{ zhWq?XOSb->7ybS>)fTA1RE;kz)wq0S76Y%5Rfn(i;z;j(Y23j>&>K8%Vk0p5L7r$% z7CWhUy)ybl-5SfWLk}2_Xp1SLu$ZK)(&R_e_-EE^Gn^j{Xyc6uo@1!UuAouZJt8D; zDiBCEaxDfSNb(Gbvr15Rp$QHvuka&*``>u<(XU&*UlHK8j!O#dXe{04ziK`@!vQXC z8f$5gS|arnsW{hLT>W++Askqfjgxw)e_Gpfy)2zXUt}@zuiOo;k1ab`^Ar>>I#5W{Co0N+bcm#h8;OM)#0`R;3<|;HCycH5 z?$jwrHQJH_DbZC9#b^hG^jT#IcTguEU@$}XfBo|W*zyDe-;ivagIm_N&Rp8suxzZq zKAQpg7Zo2o2j=^uY@#hA*Nio(a&@#%3IT^MDz*C`IIpDZR=jHPA#+GiS2S6|J`(u- z8CqAWKtcf0gIp$C7%eiGn_7AK_vxAaY+CYEyWvci{hUO<23BfS8N;>xU{QRg65Gu1}EEbs=lCTZxF-Fk-7H?PhPq{7#ne>;=d={D+p&^<1 zvF5HF8hrOFwEEIH``~};xK`)B#1p3U%w5P53;eT=N;{hurcl==m42CEQhoTT-de#9 z*SkN3-|F$7$JdWnMP)uRM5Zkig1aTwI5&^Nt zm2F{LoV7}sMUvz5E%FTX9Qy6#4zUqBF>_TH=dVLE*MVFOgL_mZR|4RAd}`2I=f>R$ z`LejlhtuODmkS@xTRL+$0n5qs09|Nw9itFldVHyMajU~K4*@zQdC=fD;;2IMv#xcm z1fY8%{E67-PK_`cdnTt)%9dXoKNR#`!GLozk1^Rcoi zv`Zm?G7HrFNHn#0Nx@|B?b&D;-Fgqa8Vc2aS2gfv%JYtWLfAMwDnzA-wvJqz(PSWB zJAQ5^L$SCCXNDN#Ju5Ia|Lw}y5MCi`K=9CI*>N!%wQrrVacAP>qT>SLEWkY=%`8gz z4D%QV5)JvTG)Oe!L5$fgV6tM>kPiB(GaoSA^1%d?A*VUY?GybGF$RxxKDTT z1H#TvEAL(No!<|O^S_Dj*6W+>2uALIe`rOoUPwg^lBVb?JW4qnlqm$VeO1dDo||g{ zRx^G=t94UCW6#;8b2$y}0K5}aV2dJ&ANQ(5Wz95t6-CMWE#UfVtMgF&q%Ycuo;%lG zttIyCZ1{0p<)h*tMRTBjV_I8=w%P)uPHOu4!s{>(E4lek!(*2Tz-; zZ7(!^P4Z_L!{VkfJ?^UK2i(a+#oBV_$WUzCE#u^IiKHi@%N&w@(gP+s_U5I&EzB?K zn~Gu5(z$H54#?Ve^e}xN*LY*qnrb;VtH8s*OrhEhC zPEjfRwXN#7J|#B+iZVLSc4L)@e*jlkYe$HzfOP9tE>gNY9wI?bGosacdYt3*Ihq}f z(i%Vxf$9oC=X%vT?e^#`Y@EXyvfu)X>&>s5`wnjuqQZr{d0pR{F zt4Bs)0cT;+WFeh&>O51%MaDc1{hRP;g69uN{CN&dEP3`#_A?_7533U!qzs2>LSe5P zXIWeRwuv;lCNIOzbLK|8ftTYi4d3ovR;OBH!>`58Db@%3+{m#HA~oS{dQE%Hw(R4K z6oiU&s3<<}gap94n6xL0YMW&#+1jncBw{rtY)?-pVf*Vz+=6$oDKEN=;! zUEs3$Xx)1s|_68iQSF{7k!n!o>PSK)%lbde}~B-LdeRSE989#0a=5;g;z4&`!?tW-L-elMhbcBFSS5Pa^9R6`i>=?$PtJq!-Y!N=KCJDvI##2~&+EXSEM4VJ8^sg9Q~`1@ok z@>~?R&brI_`_}~z7d@H`81AT|6s`~I!$(Pd0w)MgKAkDbvflTe^yJYvUY}gxjFWdi zqO9RB<|Ya6$3iVVo0WD7;1N1rxkF3p%`Iug2nk~7ba&Ortb0K^7_%53+?JRIx97w~ zpGqeGgm3IZ&HRLF^|1e5*OaeC`O8?n^$(rGyH*aF0FRKzg({)R{^@-MULw>By>jv5 z{gi;}B%M4qmi^6lg*>pEj&|Q>`rgYefY}<;eNd$!`xFOJ5dz6TIT}q18%BY8`3VAU zBV|n*+cE+Y&>1R4%RnDFO@ejvPVPSERNFwmOC-rbq;IskQ*oTQ&i0$!y60J~1LAmP z2BxR@FkT4O<*1c;g7r;r)%B!!+Z0DI4g`stxnD*l|N0Zm;-FvwFfQ@rIB)!iwE)9F za2?a#IIglb;cOH5m2j3=xfnv+tgrv1VYbQ`^I+LyRu^(kCHb|SBdM_0O|yo@m$NH& z2xexmFC*{zD%OXQrj8P{uUm&i=Czb~$!ZR=341hN>SofyXdw;0z| zf6uk>xX#GX0d%(wR7}OsTKn1d zLw)$pN(JOblrZN=D;+h1QO0Miuy%{jy?GKT6Je_k2G+dcS|FW_0klW{zfKC>{j^#T zdWedSL6i9( zq!s3fW~1aBMJq$ra9@6*$8h zL~AC7gNS>H{ykCQs3q1!E^d4KkoBLV;bxCm5dO{wPs+2*RPSdMgsZ@ut7o~ldW(*5 zJH*cw-Bj$M#+ZGv1QxAT_yS(5pONuwA1&KjUMzBljz( zgbvj4a1|Z9f?{$gg(bKW5#qs^rR^D|B;u3?qtgQ^XpOmG{YhZ>@QmASkZ6gMqUEvfYv0w~ot`zXtBIcWVJTB|A9&Zi4QD0#_oX>U6Lh;4J8NVIe zm+Ej>E(p2cHLS9Z=g@6_PSMjz)(y(NuX5m|3Zjj|Ge+*SnN8uc8R@WlnHq!vi-(P= zZArIWvxS0xX`_W&cQQWrc?=Gb5gL84o32F^I@m#iBJlwkY@@%@*g8eYQctlla$y=D z{2W05f37G|sDiTyY$WNqD-n5M`Y0Nwp`OIp5+84dxmZ3V!~Z;7<4kT^TlnD`vz-aq zCU1`Zexm^`^!B(}DS^05j?m))wo}5n{r% zLEDUS3IWc1#8Fr*YWodSGn9+$ee-&ZUuDZ}koDuv6{OD!`JkLZ!|L?8rbV)gk$9PO z`yCQTyWqj;y(8)OgL?t2i%ND!q>-UW1lg-CN~l?HBHJECh>&O02O>w#_b{6(h!LM7 zCzdV@_r<}adgSxrHd?);FOcwYF7sw8~@aH<43FJ?buG+f0Z~1X#1&`x} zd1%^f+kbmsv_5rPT)LF8_+DgsIL$rbAAn!ccj2!SaiDN~jVdQp@gWRyD(BD+?_PfT zNOpX8x3KU2uv}mFFjDHe5>R)Rs{Ir!Ag#Sx)M1YUJ(z^-Y&hJud6w&}`(j5cO?Xl5 zOLjd%itC2XTF=0)hMPs;)!j7Qq=F+v(b=)DQoUN11O$K>)K1d z+C1spb%-=n;6eq(7fl7n1dQ#Sn}*&Xm@f`yZ2`}}p95;42Z(Z!tXNWNsilVH9d+OL z1~hAv)(_a8Gb-Yld1Rp8Q!#JXmol#5%={$yVe6_zp)(ik*QsI>)Xhf#cTe}(wKGnw zS4++l?lSKN49p=a?Zqcgkn*)qLpAPbpk-DJ|kvU+KSbQs*RJ&B~L4VMDoYY4%3QX?@~#EYF@E zCGwQV;+I!H-vFEe&t&o_uXK%fRPji2aP=A)wGFZi%U8cI`;Y3wMmhK7A}E}LJsA;^ z{ln$mH!7E{>@*SCTJR?h!lgixpI!rup2+&SS*hrppEI<^4IIcIxJB`(cc|bq+uQ6~ z`?L%Hj*9Qe3M7aE=Isi~h4SRWWP?G(M=lSi zemwp9(p;>(EnDV@^`r9F#mv$AWaZa-10Dw!QDpE>7iH`MK&u&i#Jrr_R134R5j&E( z9^Wq$V0p%=2heV8`1vDPeLJw0Xhs?tS>Gjf`=UTm8lBjKrz9sk;ku`{w< z^Rl(~IA5-$YAwG5eWVkzT(|kqE)hKJiGu))C!mNf%F`5wRxhnm) zpHV>RKO;ve%(F+$j4b*c_|tO=lD<(IO~64i#lsqvl5R-I+%YX0Jm*blo3%tF$172G z-kCF0irMuiuf_d$C-^ZuAXo7N`ok9;JdeLA3y@iJQmIrIj0}DBc zzL;A!RbH*hOWFmdU%u_sQRIA3%}drO(Iyaxd_WcOS-u09;0erfI7@Gz<_Uym-q<-$ z4=hP;bjt;?O6>&n<>hG$nqoM_^*%<3&|R@k7$lIM(DIMVy>ZN!(&IGGhUfUvDJcU+ zX1St4ZQ41*8PQd{0eJ5NaF5PeuU+lt_&P&y^P?<%^kOfdlN6s=c=vEQo z9jwS%d1rP}UD?*3SU~|ZPY?)4XPzM@PjBV*m?z90aEcsE+77rjBA|jNe~s3$&2s_( zyE~gPHt&OTDB$B7H}gjQMIQP`B*m`%T&+36w^NCee7U|hMf(fC{bw_s2(Y^{4*HJ` z)wEFk$)yw6N+NMs&YB!Klyd`nhS4Np>(c3xI%Sovs6yRi(#@k76L?LD!_DEzgull3 zG;_~mF(0-h|9O*&{OW>kv_x^@SRy{Fb%};nR)*vR0lz7$Oj9YFv&Dx{7-IJCd zGO`5!g+|~?w}-eJV9Bl1U(jQ5S8h#YjAS(joi@gsg1LlD1Fd~HTObP6EE~8E;-+fh z|MIdKLZ0JrM#>rz@JA{2}$zIP|Vbro5QbHX1WTtI6}0r>|1n$yCHo*%iU zvwsd#8@tHt%3ChHKHk2pTOy4Fo(Ea;qk5}!&i3+I-YJN2 zTZ1#D4?&G>a$2FXH+4EM^4ixg3-G%TD~*`1Xtk|(r!}UvKp@w_TdrV^kQQe0!%I+R znl}cRX=6bN^R$^$H?VYxj|G&R#ZHC}Pl-fCqcguykcnYihP?yiZEKJuhO~H}kAtC! z#kjBS*#Zs@Y0LxV^f* z?8g1e%bn|mhTX+ELRuhqzLe*kwiR+qBD+79mVMn>^!CK>txji4pbe+8KsVdW_wwqF z4+cH`oro&Md%IjPWSvEs;ga_8zln`IG_nxypG;NvZ;}eVze9{1`pJ3^=%p$Rz56i^ z2AWPQmy>6^HM$W(k$QkyhflB1%owxIhcxmZ9UC515jL`i&aoTR1%W`V=*KmCwUt(H ztBF-!yu)`I^|cqDD|He|&)Jlm8`7p73u8(irk$&A!;EaO!&Z$H37p-#YSw`6aWW0D zdVz!Fx;MtA6s6(i^Nr!+!aRiyyiS)CrsCL^_RL6U8B$Pbb1qH92mG{c6j*$YjO01O zr}3?HO&<@U(DUZ{vkCvXV8>(qWq;=)Okh)Q-<{%k%c3*iw*HDyLmd#+#}AF!Yj>R3 zvn{be5o(>+znZ97_UNa=;CTDm2>~VUkAr^6mWg?fo-y;zVGaCJEqz-JY<)~I)J%btZS2>e)e*_D5kU z!lzpjx^iI>wV>}&-nrtPOF0f8egJT=9J(Pu`(9U7DaKoqsZ3sX0xA!=m%VJFC|ikZuc zEV=!w3U@BOj-t(NDs`I;FQ!qp-3lupLen16ouSEh~Vl>RHB>s~})M|GQf% zj$rTpS^?;dH%I{mp1;D>-HO8z_+p!Dw4!mBlUh%UD@1@Ui?yX%ZA-kS5-RK#_uWNZ zwFa$YCQnvhYC!2>l?II4AQ(kqVegG`(++Hb z?t6tlO@~a81!zWyH8;1O@Y6Vq&>LQr97}#_!cQUiu41Gc6PI*?%F@QTXEEj+&ZucQdy$BE;sFuYVZ72vU&fb(!HO(jy z3jrB|r@+s#L-t9F!y)L8Dj=S9>&sCM8= zHsZ&mJY_seZtrEe5&CYI5x*&~YsbK^DNeoT(|pxd8>8pZ^#)Cj1-GWxr_UF23d;>0 zC%26e$v>%UgKNvJy7iVMhON7UJy_{1T6P8watT{{aq*Fs=yaFc%Y)UGK0C$JQXAp> zxPeB_`wfwztb}BJLX?I~gxHP7rAvQCN_yWc`o2gmS-(LRND2Xo>mTA5gu_+_8D>*Y(LsCq$6;|!Iv4Hg8j~WU7uow>w(>mWmqG3w%zm_ekv=d-Zr9R z1O#*q?snl)atEdD&kJ`LHcbRD={klFhsK1Pm97iM@kVN1i#)+r+Lf_^{6$P)FI;3I z<+JJ`5YbRh+(B4&76mP2zeEQCa}(FruIvj@MPKVGULgDKk@~Ez9lOEnd=DMTU6<&) zNV*2DoTt`@OgUn=Ey*%_sT4D0^8o1*^p^Un54e$FVt%~(0sFYrl5s`>!L>BohWnR` ztvu{dIgoJvYVsTTyRzi>EkmO0 zXN%;XEBHLAr?Rv7kxazYfYGUAFh{g~sv+x?%?-DEosNx;1(TLTpyqOWxCq7a>a%~> z?8qsyy|WO*NJx}a;>8@zKEQ(%nH(inJi-mhRxxU{j_iD{e78vH6#?4CB{=pZ9um*( zXZUsC!miGsl9%tmag=BALMlS~cJg5E@cE)Y%}>!p{HZ>)Ko{a?9<*sXovx;rSyQm< zn}R|GD>UC?cn(qaj85J}gkC3}LZL8T2Uz-CKMI8ulzxAv@f2e0Sx>5WeXuhBIR$e* zu=sXZUo*x&v^fSp!U-{U4cMGq65jLGE6j}^N0XQGv#)%`4pk0Kk&-E2vYZf8f9d_I z`4(Nusu~0xOAq1 zCJKf=AIkUN16L7sh589FY=5Bt3rjPh0)Id|LfL>hE=zL}V^}V%`1_RyIN#@w?rPAm z3L$^u>?T%6_Ac4u5Sy~br?+X5c6l6%RF~!ye=T9#K7Q9^z>B6Jt)+(CJx21sjxCC)(U*r>csnO4W7!w5CKv2|a8k=!guJF!3-SPgY%W_Z{@F932 zFR_J{>4`YJ*Mbyy_CbNSMEQsXFUFeueq0kOK4s*c2?KaW69V06ewH9*)lu5yYGy3O zDB3oZH!8JJ21b)x6nST=^na3vKG*2|MS*5Zo$|~L*b3Y2uNGb%+Yapfp~I>jZVtyaXgBgE ziH}4&vNpA)j4b;%%2rX7VHfWAWyWsDTATzzWc{uctTp1zjFag^-msT%N zC(q(C(5Yu4l)Ed$dQPCM%%V2bvHIe(ukz-T4ANlL3U@((9JLrh^N8d$1pp(aN@r# zRYFb4jc{GeGvU&x)3QMtv(hw2aG;mlMzz{r0e=}>p(4iL6~bo?6;U%dSzpvhPfJydpfeU+8)68obZ0Gj6Tm8}7ikE$ zZA1;h!z$qFn-zP*a#b9-x=Jm2?lE5xLu|GMWod))#83G4_4BQ@t{1M$OE@`?z@;78 zI=-^zHK#TcL9*1n+niWSwgbG)3=5`E2SnR(_D-&a&iyFcOxaB1J9d`KmEmvF0owuv2^D+_cw&-~Qa;>Dkq3TZE9 z1(QGubYbeM&a={(uJ~BIR==_Vcf+LX&ADdalJ}h(QQivuaPQ&xbJvEhY_rcaCEA`C zT3eTC4rgcRx-Qxj{-%h{H}p2&z{5E&7O*Wj1Vk++W(oJ zJzox|D|*fX$n=KQDv}?|+hIyQO(qIZ94+YIKO}f-#y%%Of8D-}IoL7%N$Euf&2Obj zx@L)-U=S6G{Y7GNNts$QM8dLxm_6Nl5#l~veh4uFS3|PKro$lrkoVYi8Y?Vvrr*E0 z%k(p6r{J0{S`q%{59@FK&AyPcb2EJq1;H?T-eUUuqInU(0BUO}ps?}D&JTt+?Nsf6 zJ_bSS@v?Na>W2NZjgL1I{<{5I`EtZ-x>Wp>RSM*Ao}!x7Mrcm@{c#2f^Y0JuL}$2o zer$YJMh;%Hn+E3qW}cR_udFMU`|w{y#)EejVh6G?Kn3v0Tr8S>`!$sLGO0JY7O%;+ z#RN_V&2D9`$aNeiZ##F=QA;ikgM7wy-?qcGlC8pE4c!=iJ&31(uFyc;zR}?3cl*^| z3!ecE)BFN_hjqP;-6@YmgT0REGm@Bz49lmXhEf21@=EDg9!FD z`UKIE*D}}!#)Z?we@>+S-ie)gfLAl|T4xS8UmJ;x)0PEm-Q?8H$FI|ci zM^-zh?oYlq()LPGnhIZSaD-y;%C+ACZJL6#76sfG3zG=-^?N|7MlYSPWk7uLKO;Pv z71N7uMPM|Bwc@BrGz3nanCsWZmWS{(g=$8Stn3VCtZY;|rIogR%kOH8i*K&7+{SU}9ikINsg~J~Jt)Rmm?I)xC3*s8$T*P=gfpW4bDP3>?Jd3)8A5TV;A7z@Y3v_M722Ogbb<{%caMgo}8Ddg3wr4|syZ{=Mu6 zfpB*7C~uO_m@`1^2|sLnD%Z5DPO~7hH*INGK?DM|pP4k;HNa62EI0=U2G88&?aw6G z)E9Cbn%tB4Mw=};!OvaCMbqbRlt$~UTkT#LGsCmBDj%^oLbp#Y@Hai@sJbkjHphFA zj18jho$wTTwNsLNmg6qbzvh0Jk<+N$4O@QB>RK0K&%Jg79`Ia-RC&~Hw-l5|rL`-B z9=mn)a=?%ME|hPu;tpNulh-MEo(PuV*j!W#BMth!rq&V68b7vW3W54Jr)~fnMG^$? z!%;`+tqN(ns7`sX+eXEsgw%6PLUmCN!lf6Mkg-jdh;-iA@|Cdh91GHjq|I{}1y&tBVIE>h%$i9sDjDRba?}jk^_do8DB6bxvW#5rt+XcOBMiOpuJI*P8dyWXX&AFKp=o; zFMRSxBL;S2G(v=}vmxz2N+(~&h*Dgd#Atpqp`g`FhS1X%(LTaTNHzw&g#U(#fOhDn zK&;&Zr>O6P%}W&x+%JB+Q3H~C*mw&&T_w*{*hjP5;>0WGo}lu=7VZC+7m(xw0lb*% zo5eMwFwd$)zJ7V!@OG|nZ(6rH<6kJW^4L~sKOqt{45FTo z1FmTO%aZ|K_PTIgaU5})#Ugo2=~YE(TKL2&;M&>kI}h=>K#}}?p+_KOY4E`FWsc1n zs)d2U~GFTnQo=$=!!W^e2=x=hYo12 zmXG@eNr99zY2ZdQp3`|MmtiCH7RI{VJrqoKhqaDpqBB#k+$y^)R~*Fb$ltM(Msg)U zdWn2JF8u06!zN(nj11MZs&?^*4cYkr*svA=a70)CfuC%`#^9IokO9u{8E$8^2A8(g zQW;~F(S&Qderpo(jn|EZ&}#u$V!KY~se@~a6%EY;_FgS(nl0kDP(~jLE4)sEG(N2n z&W9~LeYb3TPRGH=x}qrWUaCm3I{?)f5#&&g8xYO6bR5&>-`y2$G)h#9dC)LPietK5>zbh(m|kN|kG zxD+=wbvruF9tg_HSsIm6NFj^lHWAcvfa+ariJ;xf2YOr?rw_QUN?Vze(I$Bq{scn6 zG7`EWnjy_`e=;d!J7ew3a9alGH>H%B+p#BuXR!}0rUK)_{?cXnK|`B)ia9}JT-4#V z&QJ1p^J=^~IUdat;w(Pv9xs1zq;^c<0i)>&UY+uS7A0~_;y|DB6X+UIh#V$PSmM4+C2e4O&HfnVz{KnR3Ubvv z8IGa0)08za3<=o$g+mb-k91!Sa*fy`BtDPw3eawo{9pw-*iQdfCdrr~*CNwMDuK^n zjkRg|0cU)$h{j=8zXFKf&d#o0`ihJ^EoxEkTb|fFC!B_p!BM@2)i7i_5Aioxu<`>^ zp^m4CV9f_KF<|pK=*1%-AtQ@|$1`D}a)t>Flgoh{^NTTctD(OIkyVn>?4g#f{g51~ z5-FOWA%U`%OW%HR#PV@TFi~(@dYEB{%iD_eIP0uZ=fWcX75^=)oT&&P8+8dLGH-A@ zXEfx5stQz=L+uaud#I%m!h)M)oxl(SWc$8xkN*f2FBXyhPz>!z4_eubaL3bq_p#yY z-09eQ>Y({zh0RBUyJ-4}h%8{^(~dtm5T(oz%kTSA!8c4@pp7ke&o8(M1U<1CTvM+#E&>)}IPY zbD?t~f~s4Y1})0+;&-HlGT(yM6->H z1avz;tL-dStaUjjWe~G&`G)g*H?tF;ntvQ`v*V{Vm)sM4T+hVXT?6QRgcQ!C5-Gm( zTm!sBUO(yWuyIxO*4{4(11lHCU))CEwd*w#ei2&WwcBKDK5P-{6sPtMn6Ch~6kJv3 zJ`jh)z;7E*Mdl*$*k55<_V5jHEMwsl3xKy^Uwg^3wWjer5l^J{JF_vMZ8b`;!D5Hn zYEpFD#SZ#~W6(LSneN9j(TZ}`jne3iVy}JC7R$d7)01O$811w}ebbZ>Ts}>TnokG@ z2K^$oz0S`|DS9nfcp3%q1I|jpar%ZEyT(Lr2wP39ZH4y$D|h;af%Nq$O&IlbP~mkM z=0K>{uqHMUerS~>9QSfH096W?Vj77IO?+rHH}D`3b^2yo6XqXI;Vl*o1d4FH)60vb zLL;j`nOHsq0gUjzGMY>)GMWg z(i6?CMy_Q6K@~fGl$Ys{AqV^&D%Lt3e0K%}sWc3tesZs*a$IAGTMV>aifF;X?-F>9 zG{gb^&wrc3x!E;Vd-(O?lbEJ0>-DXSfm%M}mh~1FUpTOyd4K(o2|l|TfK!}xnf0>4 zZXEsGXyq}u?|gdGPCZ`JZqzD_6WuTH7o4XxK_P2Xts&FGpODo~d)K zIoTC9n7NGcHX>Q92j_nlK}pabVuwRs--%;~b~TvEjD|@^#s z7U%o7s{GOw3(DHE=)=dwJ_eq6yeA*M7STuurj&f3qp<4?&)K9i9^4g)Ajkc;FEHEu zP85f_GOZSIGa(|=1G0rz)e5WU+{ZO{hgb&?s(|boV8WLFzt4|%(MIAFvgyO;qwYaY z{N|;oN)aZ!BM8$?J%TLYpSHk=6>lsA(psx!>IF5_h|M~g>=vF<03jA-J z{Os>Qz&vi(ixnlz$c3(IKsFm`Oo0@y$iUKthfc?w`sew7i~mkEfclCP)uUWCCx8w> z8mSxCIhpI=)JVF1eP}p~>UlKzy%D84D{!*bp!iT~H;UA4hoq5Nt#XuEw z#`Id8Cx5S=2+J^*sm4HvN)hoNKZKbLZt@=@3xynpgq;L9sMDl4t>tW$>wI0sip+L~=AMCyA^n;f>I! z`*GeF6r3KM8n!4`mS=q{5q9~Ce*oXvf}c9YTJGXe&!T>OV@;h@)2^|qIAp5%mo9Sp ze0UC3DQPI_OsOErW@p^QPIc7mc5IY>-e?FnRYiVyz2ZUBVu%6E|7cU>(V!4ULID_wQB{R%JC@Q_gLP)_r|`A9u^+&)TpUJo&>n{{!TpayHNGSeg>-+U2c)V( zsJGxT84^2m07Bn+tQ$victAnpmT~s*vZm>O`uJx6S_Y96N3v2N zt=c6-=0evMl+TiD40;a!<|SMU#F;4sg7m8}EpA64!n&O4PfKE)%}9=}E55aTLo~q3l{3l_x+TQ)&*%s7f3UXzr#ZKpQ-+-Rc&9tFoKjwihxo| zij;JNN-HTPUD7R`8>K-&K)R#_B&54jO2AFS2BamVdvn)@BOcN7yyrRhx$p0M?&tn9 zS&TjAoMU{)m~)OX*P3h9&bW~end3IiEsLOb)BSkFLD#AC;f8J$qUs05RtYUU(?Ppx z)^V1wu<@J6U$c$k~;xn zc=I}(mtzC9^04RII^ly@esogk#3{I;Yl#GOVjx*}!*tMXDtYz=6K1Nq;Z56{rVP+H ztj0+ckL}s`=s@7+)Y)WUVCi|g9^1R=<-G+;MR+t(&y7125=VhJ<(ViuxO!2*&p#ZD zw_lJTloU8ixin?KS4(g?JnhX0y}E)o`q;Y zFYOHs3(fNIkA*y2Ug6;RL1V}CKc_FV@SqytpS!PLSm98@m7X5BHxW>oz;ZkSj2BlUj`a%Z|K(!8Sk{evECSP8aD&C6~=y|&K|hO z(|YnUthW=d;v2^C%Ujz6cCC833|zU>AU~@?jg`o1D^Ix@tI=s|%jD0y#>Gqgx&E00 z2a_E8EcaciO*N+VY(#BhH_{-=w1H{uVfaBd99JF~0%@}>N;2@>){^^JbdSfHcAtm7 zDL1@=#^F)*kY!p_udeZZXJJzrwIIGJjQ{)D%u`u$cNy z7V_g!Z<+3V-5%qTJ-t$GpX8Co{a32JI|z>t<=GURZPW%55U7Jac@^jPi^Izc6_H9; zpW^9ScF28|(q^i7DLEjl{OZNC$;g+{q@V6kBYIg2I4p-WZR;?h*ccS{bt#kFe4whH z-&=7f;QN!o6-5T>Xae`TDk2(sR0kDVIx9+IAMQMR`T%+j%ABY`rsq(y^Gv(t&zBN;uB0qa{zZ>%g<(`gE<^iLYu z9%87(W?7f!Jrbj#4{mSdVOVR51z{pj)khd`&Ryq5Ippimi@(XR)-E4ZEQo+f>2_?t zlUF;)vkrQ{f0&^;zmczO^%ZGR_!X~;um&eHZqn0$h!$@$T$4o#xjO|~^j^{kjO*4o zUNsBCo^C=%2xzP{Y}{#ABN0U z^u)UCR*iQQ-kJ>)(=B8VuW}I5#@6nGPkzaDInY(F(c_sOUknS=14K&8%2!W0x?2r0 zCMho$e`S}yrS~vyi6mcr4txFKQSPwdny{Cz9a+#;LRkoh?8bWhmVgyK?d1?0sVEJr za@^5@M@n$XDNZ?L7C_o7BwVnz^0j?WA z&akn!FjYi`vBpG<>YV-D{)*E`9x58=d1W3hiRaLG2M(VZ)8&J)I%IK)L5nX=L=?LzXTx zOah}sOWaDln#`Ze4`*nKM2}y*pn<$oPos$(&)PcTI^dl3cOpFhcx=61wx=GiKtIL< zHcaw?Vd6nQxHw#=fNn73U$Tcy1UB#VDu>f!8x}HGGEEt*>KrH@yV`=hBtq(MTl_+) zRjBkWkD};R%PR_`j#VY*p-Gy(yaPT8m&ox6CW=IdAe>lN9VicpK%XIdE!b%vhuC4u()U?V#GF^wB;L| zm3!vFuJPSShAnmQ)@%kOUKjK2#Kw5J-NX~hv0dE<`StYDt^$aczg}VACqb-7>g#Ym zuxj#%!*AMdAW|f8!6{_E70uDnNa3d}7C6diTQ34hxkYexiUr$|Wg=&hFu0v$RWf;E9k}mBSrCQ;8hJVYNoVbSa{?h@Fk%Z52cPX2uGV|n zp&3qG0zxtG9M&3AYVjsv^4Nd~_Pb;a8_X1RTLf`_R}IsLt?u0O{yxg2i060QnFe2S zOFoaw`BoTIIB?Y}ZiRa#m>4o3iAeYfc=vzHJI<2W1gajYLAg(6CW|I-SEe-US$b>o|s8Y7vQ9&<$#lR(GQM)yjHS>TNbCI z)9q%DMc(!Bm0V($Iz6A^&c2>k?Ne8iW4eR#8=&`ZRj(ErOE0lj>!>O)N-eTbYbE)i^inG0{R1 zA1n&fJ?G+RWMc^G{_#NDHRpx6L-JlO)v5V-PMr8cb$kDA*S+KH%UYc7jAksz9*zAX z{mYL!0`X!M2A?mnk$uy#=cz`)%$e_S{-~V&kTpFSb&Y^%UDzf-0wGH+*r=<8*cC6d z$|lv;%BDNsv%8#=dwzN$&g8+o3ww&W@?O(p_geAkS4|p3*M{8cU*4Nn*6Q?1Mq{ra z6rDfYeYjax>C;^<00?v4ZDJgdZPb>&Ur~NpTaKgQabRH6Qcg=`Yg;z47|l2Fi@-6)okj?Hjrg@zX4V zSeDF+XKe;5ChqS~i@r6;(ywbRDp-bFUQ*ydfUK70DcA}4^6^Zx%@j%%TkK`A<~<(O z_*kyRbaTMk>S<5><*((O@8_rU6HH!g>xg_IVBVW$#X#LIP|GnczY(0=hvrxpBE^OA z^&IC1`3v<0Sgpa05^6-IzUo%hJO}TE zxU)_4A^9RR;G~k=p$vuU$d<@gb9#{vXG#4TS5ziz?BnbggYvwtOYLKH8teX?*K zs_uJDn4r8}FuoXPAiDXCp*yTR%z+tyzFjSj8h9^&a&&7=;@+F4Xk@-MG737(M>u5~ z(}+4l8f4iT0Pl~^4V-y_&K+T$^YMgI1Gfn<`Yjx3L_SUXY1JJrmMI{45A1VEH_j(w z(29jq+GlAKHZwXGQiB&(hOhfz|DUe!6zvo85N;ucd~!_%WYn zWR@<$cdS7avih_~RbNDL^h&;tu-%rS`fpJ$>3g+4C8nB6Y`#%vUM2;->jCs%&c z_8O|m>rp%tjp9sQ#f3VtJ_t`YZ?*-y#t+gKJ7`4gpLtT zGH7p#j_TsEuYd)|jvkCzp+i~0i%v2$O*s)NQznBcjs^Xy2~O9^8=%)B-4-drfTN_% zpGzd+p_HWervAL10fr+Uwmiv;~|8swfQQFZiua~})SR-JNG zsnT&OtN8Uxhc;Ynsag3x7=sm?_Vb*`E1V&u`%-3vNUwFa-@@W=TL`Y>nMT~ZZ(WqHZN@TvUAXZlhx~dS4wf| zfn37Mvk!wRMkC?|dGCUUA4QVbA<-ZcCcBU?H(q%gQO{{y@a0Q}svQ2-<|I-E^aduC zV@f^6+1*Ag3@S&?sF~q93J$as-dAER2)$&8<`01z&S6nV!dRk?bJQ(O`4w6z9+vk| z&nATz9!^@J_SjLW!QjeHAvw!bC2*@L*<)0lwjp^hwZZxB@Vj}vx*|i~SMbFM*_IfT z^l69h-c>0un4gll&Kw?jIdCed)g@^^iyyaIbyE^rreA5%&_TIQ9hjDB%jbQaSH^TKsxAJkFWbDqHn$*ZXMm#|}84 z>U%u+A@DaHzEl?v&3?AlGHLp@GbkmOeGg9cYo5ZY%;KS|TS^IHu3~Ey;R<;v*9+}W zIV9IK8aj-{CUBfBMa`cWVN=q(5P2DF-Lnj)+EE` zSWT1dBN%JgSS6*KjXFU{AbH=B^U|y&*<0Q?_YF(sDdO=nr+8nJ`94t?O+rX6&8jyoR(03Pm1O`PybS3;c}HtR*;}*DR~tIerD*Hz zu=TP^S%yfqnahNs1u-^D`RmHVhIc#(gVIa)sG|c#r9jy|_)7!6w4$U`cNmEmAIHgU zP+2`9>85ey%$QN;Ok)R?8a|<+`!J`CLWpw1Xw%-BgAPk`Iu7UDU-t@HX&mvb9_4M$ z;&Lwn{(9Iaf?Mnk&3@%rBQc-1y#$G+@7M<&jViuM*9PxEg8I<{%aDu0?r{pNqB}XB z#I3<`hios%`VT&t0e#rU3;KFT4^kaj+NVr|A2EP0N%IZBJ&`bn-E*a^?g#3`C8`hcD^i_TKMbjY?^A(D_IxDG@)h#p>S_mW+a- zVAPH)OeYhrSs`5a#n*usD~D%S7}shu?y{B0jjpk}_}kUiL|H$a_fDTjR#m{;tU=)r znmb^a^O8m2d>S}jP_?G`z&G%r>h}BhNaN!PletN2FCyNLA(&^TeE7x)gpG+)34HME89OwK0BPE2_JX_ukO6-Ap)vZ66SawLIr?RkoH@dD`Sj zE%2cczZF8xe$8*9DaIKbe5jOA3VBI$zi4MhG2CV6W^BC0(l=QggL)NARI>l<4 z;YPQjQx?XQiAK@P9K3*^<5SBg4zD-!?x=-248QU$pU0C8 zrJ!S-C)=6_dmYH0RS&)M_% zwx(NsH}@@5^@x(m1XTgVit|KdXmyE|KB{WPY9-fL{;)bHHr=@2p@h%*8>`EK$}Cl1 zwYN#xwIhA3JLYjVlq#0xHp4r3xk0lU_3(8Mq?mHKMp>yxAVLlu`yE3m7FXUjPIhHJ z5?7q!39D)VBj8WHd&wbN5?h6w=7)U!1D#KIi!qqq?Cw!kX_O&J+fWTIuS}r+HP<-F zE$R<`{M}RsoUse4LrwXq{GTLJQ%T}hv4P{XHS`1H6t1&hb-12O>haap62Bk1fFi z=WE5m5)rf<1NWB~W}jVtTTevULSnWQJa^kQ&S#5y{WX8L-~lJ*qN;x2AzBTO`T=jP^Hbws!5I22vub>YJH!=w4vq&;cebDLMd z<9b(Y6?nJ;?;hd;XDPzLFZ+E4z_p*>87Z+r>XynK$k5j~h4UxU%6NOnSF`)d zLxiES$?I>*&dwO$5!7e2x{rN6mg7bdaF0uoaRIlmUwwAJSFs^4j?KB;SSe=@;Rv0} zdIvnbFr(^-Yyx23m=ni_@Bp z{Ug~*khr(w5-&UWEf}Id&;6 z2AZQHZB^iOvOvTRPLH?s61)Ltqn{lC!n^+BMKB56{k2Prn6FxCk9!@`g1?0GBZ)z& z8IJqJ(_d?AQ@=1xW)MOXzz%fn)ESz>4Wrl$xQCWp)fwU_6c_(v1ibFmr9Lh-paxXM zyb(4mu8P_>YK#!F@SxH77Nd6a!(5UE_(qSH$es@1lIA7zRAQVk3pF!uhDnyTt91lJ z8y>pv1O+k+#+;w6y(8k;H6~5pEA`$+EC+wUcZi|yNn5WNMt2}V&Oy5NA;r!8^=`hrK9adFb?w}hk+`~sAwyk{%kI}0@?{T4_;)>1snM!3 zVTtMHt)4Z)iV-qcdMRmjC4)tpva!MRzF?c9C|u<&IE~j7!GhD&w*w3B!7ViqWmt0m zIHxf!AKbkKN$3VVi(g7IoyCljVBn^Ahc_A4HlBpuF1!eyS>hz|P>l@gJ_vvs7jbu~K&TbVn{ z1O!B8lQS)eGoE7YyZhu62Q}UEj0brO27giClt~Kyh)l>L$r-upRUlp?I@|j zJ5g&~(V*ijJa$vk%dbEBRF{%jmocr+pt%}o&3NEF-PKrQyBBI~%Q-uFzk}_N%1M73 zFS${LMnag^_=M1`(&{}unCPH|IU8!IzYQFTPO`u$1fD?g;*V421Kuem*ZA!6B<@2l zA{QkG5pkN4p_hxMCr`06uiBg zT_W9YXa8CluN`FRAiuYI>*EU1(DmJ0(9L+Y1$I$r{gl(-bB{yk&B?BvRKtb0DL24C zBI=33?I#OHBz))-aW(0SypyAJ;Ct*kVU*O`+wW6J+HYqH$Mv}5F?nP7vt<2Pd$^rm z-F0;q0R!{gC#GoG;_y#|58?!e+V6w5La0S)E$!V00QE=YUo>b68f_3wLDQN?(X zXe@_HjIIURtCJ6tdNi*Y$dZ?jiwx9{F;x}vL!-HFamNItapFIww)%iOuS3(_`~(d@ zJA@ft2sKGq3UyOI&f#?re4lbzbUEfjD+avp=%d4n2M45C^fZt7^OA~DS$`?H)ztP)w@{`M+>}SYBt!Z4=LH5S8TH7X*%8GxiM!Z zD+HFIScc9vaeTJ@9FZVQqM%ztn{!9PE4}qu7@v9Xa&v$@sxjNxv=8OJWo^ z8!IMi>4>M>5F~gyq^`=W;yhN$mX_Ww?O)W3o}Q;LzyHR4h9|kFmqfSV3wJ}5x2YMZ zb@^od2LGaAa`?0mZM;y?lQ_dP&fZ7#LfJ@NC^C0FHyWsw?``@?z)km~+`3+PVwHUE z)#yhMa+Sr=YdL^Ohal!&W7_&5?2tl~>a=;<-uu~-jvF>fU$h~{gIC{v@xL*Pn90s3 zCixWOiaeUI$YC`36%pMD<;3|oCei++)90d0B;qjAIEf$8+q|P{M7e**v*Lwe)bVo> ze|OOkB^fQ5&X%S{ne&zGo_;V!nuW9vU{s6FcAIxOo?kTVZI`Os6~g&RzTrcUG9;o7 zrH-=N_q|uLR7f}S^$C%zU5%f}67PWZM?ME&&j|{cDa7Fuv6raV`r=d1BV>ucen9#8 zX;SHj%WnLRMjYK$%Llv16+2YQHjg1Dqs|M9mG~CRBe)*9;D^<#;zTcEbY<7jEmQ)Z zXe0#szM`hf!$~A14y<@WWSbTyqvW5Giz}+0iD(O!A-Z%GsXHz@yg98JlESvRNsUH0})gTA!cl@rk+wn6k^;lb*xfRa&-*R9;hqtT7s zh`cM_g~XSrQUwSvRl3g}T$Lcjm2wWow?;c2_T}ot_l4Vx_v3^UB9wT}%(r++oZGIL z;Cb8l^TTYrn?gBWr3hI2QI-Z#Tsc9=R1Mo|QYCF&wfWyFM-gh3+7)g-b@qNowSLQO z43U?}YMirnD)?@1Z1|YStqkkIjryemb6}Os^aT0%J^$y&SvHtM%HXYcEH-F;FVB8Cg@NrWG??--DZ zMUm_dYb#feGBS$WesE+^a*baJRhFwnwRJ~mzC}G{QO&=<+~&!KoIgSpF0w-=;$&LL zJf0tZ*q9fCgvMnGJIDKXHgO_w$E0ys2t=*ie;gX>oIr3`97U)CEEwy`TxUW%#kq>Z zE)b6e?l$H4NZdnSZaUg&Fj~!Ij&BUNQbrK<9>a?u`5x!IEn~0&q{z-qmYSi*d=NQ( z8E#kR3qOIaANFkRXC_e|rk5|S84fd95(Nv?(I}6q^5SENSQh{Z9y)Rur!sJamS{3= z8TQDc9=4u_nlBy%QwR&?VQ`a%A`SyIOuvw9CzGrGb~Bgq`OrZ@=97x3;iER8-EiTI z>TFkeluxnrIxK-%+Gm*-?eT-2!-_8EEZ*Td6@%WDci?g3xi{B~X6Ei|J2Mbp(?Yq_ zfBTTwbQy%J8Ex9DcXCpeqBQYgKh|^;48N$jb@%PWk{Wg!XdsYy3)fF)uKC^lf^6eR z0n2n9-eRL?C!(Yb5WOo4Bu{Gt%?V#G2(+`Q_<`#UUTb*ImVYJ3=Zz}j8)X`X`4|Me&3$Dth;s{z3Fv*`p_+NuKgyVJxYy?QGe ziDV%i2}}%x_cRnpb?fpcpsT@K5HLnX{o5mBg?UrTb{~;6YOfxN3(Mhn9HBEx8`DWy~xR(Sr@$- zW@Zz54fW+1Cuy*1lwNP`czbyyL;!Nq>y6Vs-a+mgEJ)ODv8C}ba1*nwxIn=4nLpTs z0KpHxeORjLn#J7ypwwFY#|gcSG)S%9QlkW-BfR2#NFP#?#53)K_6-!OYW#H>f}B zGH7eahu(SYFs(mE@7g5GdE|G#qY$)IpIATImDC2jMBaVKpBZTxi=(~T3uBYH-sax-aYh^(|ONid=lhzp|SANh; z(9pxu@Ra0QM5TB`A)QsUW1~30{3ABH>*S#SZO0)U$jg&-m=la>r|{DE2c{#Ro920M zI}aPIGU2H|l3rlMPo}OKbiTI}%)^izaC26$2k&w1`mjbAv|76oy2Rsb9<*zI%^N3* zK-S|1XHJoOp{%w?*6JpyKpqv^%zTpONqn9nNB8jutmEDQebrW&J^fwZaGICc(l53tdt`)w__VM%0;{m7a!HN_er(4 zM%T16JzQ{snpEP53~{XmMPELF;K@J)EXp@YPo~szw(FNT%*@=3Pr%_7OS!|V?q={& z$0s$RqCAcMf_EX!$oqJ?P|`ckYk9uyE`3gqko+=jVLYa+RsBytS@@&-+1x16C8oV;9aUKPpeeG0NPp*OjsLfOnhB!FgH- zpKFNa?lh+RZD%Ycrwy{7^~5pzH391l*P`%G!{t1blkHzoj2Bg-^P|>Y*c)2=eH28$ zUhR;3kciA7U^YX)-9XHKll|-eu3#U)EE7hn^;7^tY9_5J%_}4o6 zEzyXbyvn;Lwc4#hIHr`6$#-_(<+{|0QTq%nT5+qvg9s}N5gfxJL*;v+Lb5_a!7+Hb zgd$d2-VO+HBZA+9YXr^hcfhMcGx>lXH6@XD=_sR|d+a}v;;A2KJS>d>(|ToS39nYz zOJG7m@>ZJG)oID&b*_?C7V9S0(hBWcSE%!C0YY73M#Fk#GQCQ zbMjzboPE{|t0*Q$cGAG>lVj)4T5uPu4SkttD4m}$6&|76&ANMo-hei#bZ<)`ct(T! z-K0)cIWyz)#EGdUv69$CrYD>+r4M0GN{f*%zC;)43#}K+0G@@x+ou!LcNA}UJL%b? zQy1PD8aJa1`;NJ{vblNX!?@D({cHsCZHMe{D~_~)n&grqxu%pwqS}x~tDVvf8I?j+ z%ZQJ5KGxrw_0Rj7@z9vDPvuuK(GjYRBIEuhzS=~W8A)XefkyJA8+N( z%Wp071U|VUs&?S{xU_8RM&zpHqJdhBedr=>lhU-H3nfYTSrwDTcW2)^sA-r`aq^|F zb!$qKF0%=EoM^R(5$V>F=13h~^U!6Rqe%%QyOaV$F6i&I*#N$Ll!x^PX#K4}>TFs0c2WJl4zt{!>x7)uiFfmowcuuMnESv# z-AAof(VW&(X5;f%;7eas*j3HjcYzHp?>sD+a9h{UU*mY9J~Gbs)lALcCY08nDm;ek z2KM-#ys1(%9QT5bw#Kc@7;CCz3PpmDq<2H@d8DBOXj{g4^E>j-L!VaIQGCGHJ#=F) zx3_K3K_UEHw&5&Um@eF(MPoF=IvY@RZOP2w(`ZoYvG^+LHaGd=Cz}fS`242^NY&k9 zF>LfPijv~}=`@-%@iKWV9vTJ|E5IiY-woan_et+hTk>q?W?8Tm>3eU~TV(twhFx-> zY|Yat-Z9kvVRiRar}&VqPd0|!>RD1x-=9|Qioui2PER%Jf5W&T^=>fwK^{x!4s|*8 z=dZ6)1^XAD03ycU*y1KP8YnVUVWX6cO?L_T-c*r5J6{qY0C9{|WY#sjubpoJDSp<( zR{s;w(0@b|YDYkcQ;{$w0ca?l8$LWW5V?S1oJ?OwK-{%QBZ&Z3v7z;9U1Vm5>)0E@9K z0r*2Hb^+K!&aqAbaJq=~nS?OYol1CSJXqxm#=8M{fe|Rw8L*%jH)}kD0yW)0v@9Tn zzGOhUf?Qvb(MSAKWnoPnhK*f=wehdi`?T zflA58dhTASzi}^E-HYx;b-~E6ffDw+fwK53)@Kq*oJ)8*P+*lW8c+N;110)50|nO9 zF9YRYrOBBa!bCb7DAo;g%>m8{`y0s9zFI6p@Fg!P^U>)bJM*QNogGILHLsc0c9v5Q zAuPl3xMo|7yx{;o&op$k#63p~)fAzlw45WnvCC{#a@NK=8YIUx;ZCfTVX-YK=qOh{ z>E5MNc)>*E6W^8Uk-kd9PpCjA^W9X9Ifg*%8f+IW(CeAhimk`XzfSkUOlzNgH~sn7@~-MkHD`uRi@Uod`3TEfIWr3UB`;=2$6`OSEx;PZtmv%GRP(IE z$nP&bNC&jwLVNL(7F?L)K%*E!FfFcOpJ`!3XK~k_EdPe-CDnSIA*2WkYe1xASfkAg z%qQv3S>So?n*d|A4rhoGqVR{3lc7pOQuyH!ZI4gchAy;@`u@*HulkEQY=;)<<%RuWSEvQDZI9 z(4Xv}E$S5W9X-BN>o27zjfKDiwe<55O%We!5k9Tys?02kEOq1vFVO^iVC0V>p|UD= z3Bc#a&^d(+4nX1wrJ?taG)Hf08n0#4bbqSZ2rH(Cj1-N$bL3F3^r+Nz`aj}`C)kMUk#7)8^iys zK{+rsPo=$RctG3>P6?Ct;<$o|djU3>v^yO~u>b@sr_(gxlfMxy<9p95m(C3j6ZdDs z_w|nf4dDX9?7+cXH!HSeHt6%u=vD#9JH`UD(xKj}WZKz)IY|G74c5?U%?p}dXzjnj zw#B*&45?xOmLHbSgiUonkE>JC1?T;@uq_&`0z=RE9N(o_z{k=4!VEB^&a9=tvGS2P z)8i*q|7t8;V1t?clyni1pIiHHu$}3!1k6-tK60u9@-I3(fsroGg8ve>GdKTS{~cd2 z2QUp{{5qab2hAyZXT#onB$DR|=1-~u3-ijX*@R@;N@O`OJDrZ2Q$&7dJDopZq>G6B zW41qZX#7bBl3#UzkuJ{o{}#40e0>1F{xPlc{nhLXL+X!}!RC&A>Vq>LB zK*NwaTgNLFpRS6L|E%g?MM)RfU~4LjbP(lVcwuSyMbrN#v4u%{aq9d(opYZV0oL=6%?V z%=bb9@y~PavkCU+b?%=hw*QHo`)rl_IoS9cy9VYXzhrxVnLhlQ6rSdZ7t@D-%=Sn6 zaGqkGra*YWy8WlM3l=QHNEg$Ge+%1L`T*Mj_z`;31JlKycI|#_-oTLhBYh~M{UzJ` ztFiE#q!32Bh{!)@yO?5H0NXdjzv=)ZU7Q8~Eo^6-W3bfzN9fHBOi&j#s?G)t45>fT z2P4f@u?yMWU!@Nh*kD$LkuDp45QXr>ab%2pB&iMZpwljQTsr`@iVf)w6 z`)u}wA@x0d0QS0(epdCb(uWIdu=D{&x`@a>XFJp3M~YcvR8Efms}3;I#q{Cd!ghu) z!a2UM^x@`Tr4KNqzTa}tEhi8BS=GOak}j~pc12;Ni-`Plwlf`mq?o5V{JKMZ6Chm- zlVG%;5)p0D{|MVzye)E$FD%|>{dprBw)K1#PQj2m3kboI8NXzEf0Z-*CMkrGE+X>J z+0JyJ`dJ5H)AB;jzzQQ>*kwPZ{T$T(N7&Brl|09HTe5@L=;dGJ3^1h5c2Jik8v}Gi z4~~$R(ntQZnwMvmM3!=KfB}fdf12a(wV*W9dsagF}#0fc=^#$YFbZJOh+Fc(T)xU8)J%9w)8sfgJCA?QuLh&ZymCw9q_W z{kqjLx(0l?{qUeN5472}DGi;A6*vZ;OhYJZK7k^0k1CH6?MZ77b_Yo(Tu$a{_c)B9 zCm_y~cv9(4pjbmUUdYinXfcm;TT|c-=opYmpd933F_uUQn#$;!06Fh$_e8Jp9}68F zXJgI^XdLbf+;=A5*6vSzfw=8^oNVI<(?Bt%4tT0wgM9L8?M^n9F7XS1Gkids ziy%-zV(r1aeeKcKy0ifN;~vrd!}ZbH#2Od+J!xuH{wn9%s>4R<#FG~_M}9~BhnoDW ziO^on<8KECVPAbP*ZALnHo&8$YtV0prFm`#kv*UcO;D!=HmbZl?lVIKtLDV^mJJ&7OPhzHos_PcvQ^Cd3x z13#C!rha2%ce^EN0($7nujdVdau!mj$T6TdlHzAI65XWzSDz{Fr&&#_IN8tLeO6HT5 zVbFZ0%RB%UP`00z;xpp=-CK++q9}nIM!}btlmYCwe2<<*T^o$AFCw)FF2n zKMp1cy|21gO!j=%YvnpN9izmDDy;U62G$O=^@a5Pnkv6T*>rIYUjvTW-C2dPU}p7= zhrCsbwTx@iZf}gj@TV8Eui#o}+P-ygR(*LF-we%P%hVLz|Cy;NroW-7DYn0F%!!91h#dyY-y7}EM)Q;^8IYeT}kg($`L-~J7y|D z%}&NiDCZw2*4gmNK)ZM`iv&&XdEF;NctQkY3R zW+!_@C>Ivk2BhYdSq{!}Zvw^oTUhnTr;C^rhJAU>B$U|6WC-OV0>wVJ6zP$Z6*Jim z`%0KeXtI;Z6Us#eih)~L^~rULZ>(g|PfXYVUpXmeN*nflW+q|6PNqUA7aQ0%(6XgZ z-cZccJnU;@CSlD^ra>qdAJ{h7Vq-uKU&1sy?CWVJ;ml5^1H7{>ux+Si%Ygi02@~Ro z?;A4-4|Xzr55G?$Gp6^hkNCbtrxGNTEvmOMBoAee!ZH);N0Lhp^c~T9QiQEQXd2-E z9=$|Zco3;S`GJkuy~O0J$tE5&1Gg&Jqjb>!+m~Wd*x`ZeY4e%Ky9kD;&&D&78A1a;Kt%O`TA9u;di3 z0UI-1_0gEzz+@BE{$g1hGr$`Dx#!G^Fha?7_0bWC!d+O!(bFGGPPuayMu6(H|4Q-_ zM_Ej+8Q8)K5IGAnV_Z?9P}>Ctqy?p9J34Qxs;{icD%1{xp$rP!qrg9M3bj*UsFcFC zszx>>8(89?<_f*VImgFYfU1W)iU3|ayYB(zSJqSjIDocK5mW_u7Dvue`oEoQaOw-u zFy-yiO#tQNPnG}wAg>6)xOq;wrEJU$YPCWaM!Idxs4GfX)JOetS0o1Ql1+H}i{t-; zZn3!)!u& zYLnJ;hUot>^3G}7)r+vUElxW>?ef1SuZZ>*S6?WOV=9wPocn{T7e*$wbQvp3IF5$` za#th;cK$QuO~+mhK&88d`0AsvAD4v(chZ@i0kJbX{|hod;|NUVfK!>1VX71v!c?KZ zNS4=!k;8{!+*3mH8&V)$pI8{yui=x@E^$VHdUh z*q3pEZ#WXm!osN%U!5mrVpVuBD7_RAEM;*;!)C?sPvo8X$c2&K(~7Ls;{mzEk`}wk zCZheL9x(FGtqMEVYCc~W8S|X%7E5^A)B{*k&RDP>NQ7WLAphS)p0lonVIaQ`!$5%_ zhCw(CgUxaXOz{y{nBsP%FvZ7ViW}|zpCIoXE(1NU*pFbV^Ng$&lULXkLCi#f{%avY z2Q7R%Jge_4#&v7wgAV5S!1m+V78bQ@K?g|uJ3MReET(ktTFXG1TIJ{7)&vFv0=klu z_OE&zDe}(&P8pPLa%!*FCW>Xb2T5mx`% zUy^avc>r!N!v0KVKCN=~RF6i0`}438 z5N?08gf(~Zw`ad0uMg%P&mH6^f_7tf^V}S&YY)CP#wNN!msY;62|#zg;-4IDV$OA8 z3h3Wc{*UE9Se*o;99$=sBEv7&>$1^aU zE2}`8`<27eE1xlY8147FNGDwPBG0yW*Px^_j}b28!ok6zz{xxtdMfysDGW~l4o(do z0gfD?I+!xrTRbk5WYB_J=gifZS;61qec>C+T2Ax{bjMo$8G*x2l+R%5Dws2US z_B^|qP`U5|aC(7>`Y6O@_)Ylne(BeeoD-#pVV4~CKDT?tS(D*uM(hP%8C`d?^`LZ0 zcVj_Ed#~BPtnIDTLOb?&K%1rNIZtYO=_0w6K=&L=Wfh!f0t(q&Do_ah&% zgM9+K33a;)Y!}i58H@9?h8vVdubyOmRyNO41Lt%-`w;#uAInyk-Ii9qxG(%kV6I~A zXD1VtLzb!n;~9N~NFkbR1!NZbjbc;nXY96_V|nCAdQkGKA4jTu2c89VH())D+sgtg zWQ@k&DGJBCSAX|omm(Vv{Mt(Rw;;tDwKg>d~U)%sHxi~(3kO&l>0Ni zk3th462w$#!}Gpu-b*4|GX=J2stEMKHi`>b3i(Cr$gddjvlzNCKom>_yYG>|SW|Lr zD6=V#7N_?X6h$9AiA}%W6YfZ(aH(|tp^C7(ixx67qofjwa@0uI7!Eu2woZ(}p1JZe z^H9o_vFw_dM|z0M2icFr9B4*u^s&%))Nh9e24Q(4SZdkuKWtD))j^lZ+=-M2LNc=CtWh{QNC6(-o)G~K%tuXldC zTEfdYA5qyW-*^jd&1{|16Y(;u^eA4b@E-pzeX?*aa%z5EqfL^hYcKsR8)>UR)P59q zQ;A^^KHJNy`;$-A?z&ax;qCV|E+d7NEVeO?FaGg-jD0KszrCGdM z%~_bHJe-f|RVrJzAHunW>*0l_sW4laPb-VE-&=GI1^;77viUcKI^q2%d$L)Ld?mTP zDO=5acN-PI=E*GVh0wlKZA^TEZd!sDCCl(QT;XHD>glPJeO>6YQcw!-`a2w=;U%WURU*ck_zZ7x31bh(#KHUVaf?A~Os)k&+ zn!6VYyNn)N6(YZP$vS*Q@ssc<7s82Q=%?|4H~r7LgM}Qi#G>WHTvu(NrmDk52#mO2 z>@Oo2-~}cu25{iIxCxnL$Ce-vQZGL}?8$lhv8PZ?@!_s_!aG;XR7j6DsXH5aGamm8 zogpV;$l9CNRDzrZy|mtVd<3c%fFH_n-3Pew{sG^){JWF?ikippYHdv^iHJ6-%<(ZBS_cC z_bn08>f`J6=9Q2-ckOiJZ_G3p-$z&Nq$aE1Oz{-fTR(vxpDRGW*PAc?tla*nYyk3cP?b$+PuZ}P(AN167Kpq&i{0<234 z3qO+dq84K83pu zpk96Kw@^#jm8}4)Yk@i4Y4O54hNR@1%;r5ms`ADF)4E#-TbpO~ODh-l=e*PubbdtT zwErN49w(Ol!O6$6ZcCbndu) z*RfcErSKwm8y}bxnpi2<=Y5RQ8`9EAADD9-U%i48 zhfdCedQS18+x0ZJCpZs7ymgkZWm&3frK~VZficB-#S+-asLg8jk#`cj- ztk_kj3k+6L82NEAESHF)1*1&1C76H-?%YRy)ayl+<>0(kMKl=P9D&*3T@o?qLgC{_ zl;SV%^BuirglL-%_Mt)yg}1V4E0Q2R@*_xnKy3NB!0=ev`n>0O=QUkPFHC-HsE6gU zdAd#VJ;smDycr5Vrg9R>OcynU=ZPOxAro)9A~~<K15Y)`N62a9%QY~=!OKoi7#OpOs6{obyP}emU;K$5kANTDTVp+@J{v*c z%Zcpv=?7vKv$jN;7+ZTE5QXeVA{v+wmcxXuU@A!p^%FnJF$vVDFA|j*h0RqZ8*Q?< zRL3cA(JQb}@bi>7%Ov}WF)6`h-vZO|OL7{o#X}ARO8+=$2>j|a1YY#B&OZJ5zr|mX ze87sF<)*1AJU;>lDYRTw#%uWRf~6m(5*<4-}}gq>3j>6 z{0PuH$UTs#`O=~nS!L0t60-7%vlYE3^W#8cM5D(^X^J-=`B9+D@bF_mm*L?@fWE`N z!BA>?Jc|=irCvjc1jUcvoLZU~T+mi58d>FQCl&1#8ADmE{uNLz`~XUS3EOKRNI zPU=a}3miq`>b{hXgvgiCyb5s!oL!Ngwi|}R(66oI7nD5LD1EL5!FyP?2s{XU2wO|o zn~Kh*Mc@mrWFvv1GZc?rp&3?T@>J%do#|Tm{J6~pVE7T63&8MWH5Y*4L}{W)mn~pt zUvDH>dmi5=x3E80tJ;y$`b=)bTy$0mQXA?UjU;GJyrrM|@$80KM4jR#JT&R^ z$&bZMMR+l*E;ep*tsat_)ZH)?UOt9Rx*nY^HYzcdkFjoptcTZ~7B|0}|2{mN&(M!L zdOK>oxR2ms#$`{A3Tt+>k$|OAeL<%C>hwLD6InWccbfEP>uHpLAM3{f=0C^IqZ)^5 z*3|{(X^!4FZSD6PYP1-NDsvt!egrN?T3#f!C2RJdkBhcb?;wWq$w^^FUk2uqQL+(i z-#`d^`nvtpy1CTM{NaOa@96jb4&u zmZ56$R55z;EPXrT$Jl(Q@bHhw6=tX=<6$U<+zg5|*`(4R*Kzv6!BFWq1}}oqU?=cM zJp7nWX=DMGdx={{GkummP5fxf>q5aVatS-FfxWXZur*He!(0mBkT~6Il3PR z(>1_%mo}yR?&gP6QGR`Jtg3w3Ar43Xgm1|!;aW7@W)^*C-ADlH%4I;)N64MR=kiy`r&F_%JOsFi#%Bz_d;Vo3a0%ps(h z`_;cfqT)wlE}kfU)Z=1EKLUR^6A~vDaWvA02nT-yiH9G1NNMuk^Q7<^36meADAW=& z=Nj+tLB~?xx;_Nwd!-~WZJb{>eOCFgjU#YfY0u=kZTsp`{JiSfl!FIB$FOEn7tU{#1kr^|xA!#VLERl(61Mo61h6z~<{ zU$K^=Xl4f*%M?CV8pPiMA1Bf?#s|j>+^MpLZ&{$wJyyHGvTk+NAzwIDTaL=Ru9N%k z=6`Zu1OJX~Z(8tc&Qsk;>_0nypBrZ;T z=e;ZnhC0j>P(D{2(AXU?m`#5QO59dvOI@n8{_Qs$Wtor7p6uE+CMSkmM|^4;{WYmx zfT8m87-NW%otJKKH67-&FpZjHHmbn+lck*@@5YL9@7&3}*INnW1pU{s6eHAYEAsy+PY+*}x|}JL*3tuy_lj zc;v|NCPHmvI#}O!ZP3|0q@bsSAUSG3PdF@`Dd9f$`8YVWbd$Ur<`U5TeY>yTP2%Fs zen!2fN9{Mx0?3;Q9g(`8dFF%4iP&yB#W_A_C;@$98u4b{JG$eRl7$L#vE8wOZVk!f1Qu1)-3?-k7!q`zJ(f;#Pf9sr~`tup4 ziL53@NZ&Ic3)|8!FtYBG6FhUwIt-#pA ztTDiD>OpIeM9P~8^)^Y3qC5ib)TRT=YeVDWM}5>5L#gX-VGnLjR2vGuf@ekEaSSz| zN7#JEv1wXS%AIP4N{s>ZMpt^%Z6doP@$zFnBfQZK8@2K3%g1UKfP^UHhx;LpJpOv2>HkY1bdkS(%TniXVVF)0__DWWm3MUOh6 z4c|x(2R{}y8jcv2A1;Yh`T99SvFQ=Ay3t!)%J>zDsUmY$iqi*(MsuWVv4oYWngl*{ zH7)6bj+aX(_i1&hv7)7hBW7XDvvq|9*#`J+R!fO@S=Sd4^luWM{`hZy-`;#EO#X#L z%#RlxpT^jcwy&W$$S3zMvP116atN4Hs124iiBy_n@0qb|T;HQapextE(1 zlgxZlnsLrbSNbqd?F7{QO?6hI?PA*$lEX?f`t68gRU(jHI9*%!iE~DQA2CW;+_)h( zsuvieK(Z2rPDz4Z7}6MHCEYy61i!s^6yal6{-~Tjs8fpYI=He-OOcwh5^qkNyBU7Q z2Bb$S?7-~YbY-jKJ777l8d&8^knda;r_X>Jl&e**9(XUZS ztpz(BMhDJXi4{4~F&^w75*sJhb%;&10_J#+Ngi3<-ZF|M1G7qf!SZ-TN6#4wK>vv4 z(sPE2)0Y%V&six>w~f>lCOBil2&bBZpLuUta1o*MFcNu{an;oxBXUX%8p*HnfM<9fabcq7TBVp=3 zR4iAG@+~66$Ieqhm@`za&W#=SzKrNYm2&1|YC=gEP7EG9MI88xvrxrcnNX>P1ML!B zaykc;q2~4bEE%WERyP{ceD;^hbfYDQh#zZYH$?o1CA%Tw#~I(;$aKz7*!$#shusr} z8XI(jsiDCRIcW^lz7Mo-F+Q(LH7T(g4w0)Xkz zzSD3@43VK=_*?g|ejWJKoLSu{r=p1cl|u5(q==Et3oPcVWx@OdbHA6l1{tY4GmJ%9bsH^^VGoPb|dZ@qjqIa=#^;m$SFVP(P zLv5lF$WStUPdP4h?Dl1v-r6NW@nb~CNW)v2Ps~~AoF`fB9{RgCo1e2%L_cD$PU+4F zGzp9!$GNoK{G63E`Ke>#g4XPFRwCmU24lZ{YxX%S;qq|OUf!C0&PuoZRq^YgoGNy0 zM>8}6CUNp3N|&^tpRTtOdOSf!ox2P1!Vi_u%pAJN=;D71!$&V1d7qV*+qIXs`_`{!4RSh^Q zosW$Y^+keZi3CGcve71kv!vX?scf@a*Fb}j?;aFJkf`}FDi{76sV_9F|jm)Yq;B@!M#2J~Hx0**rGmvLH#66f#1X&EY#w|l-^Y>b#{0PoF$zR_x6fu9VN#n<1&PfG#DWwNjT{0saJgh3Q5`JY&F&Pt)+WP30p_=-u>mN`~q0$KXv93|$G55F^w=!M3 zK(9V}e=8Moc}al$xYw&w7=2^d(di8T*eyfd^Gm9`3bn-S3Aa<@JEu+ziRw=U%?`=k6T@`8p5pr zJ2{5HMAL;lIC2>Hk*;?b1{B>LrF-FM&?CW*oLw>!(LxKMK{o`dP3>EG%TV$ClF^Vw zAsXK?1vU-3z~z>e82tOJ2I-~K+jWE8ugk(Ki}!;;C>{o_+9uCD-rsH>Arw0 zGnAPBmL7M80`#xV?Bp0vj-4@7mp>omY|SW4Fcf`113Vffg_f(zSd&}+7JXjn@aTsJWVq=$3L#N7v>K{)sivs zV_?UoDF#53=Zc}4`Y~Mld4;|62Qv$28&izb*5I^6svZ14?au zV#T^9!;ozC#)m$D{Uh<*E#T)X>~Zm|3Q1zS7V9Wv-F(o7>R@=wP~6)sp}N%@xZO*7 zgc(u<0N_;|51c&$e+{;rB&iQW-EPp?0y{_o$ux^T# zEx!uaPj8Sl^(~QclfV~9>DCTbs=PLz~p(=MIKXzwZwGl}(#ZglGEim}; zh$F`piGm-Qh_2@#uRB5&Um-#9V-l}1q}ahmTT>=6h^y&ZAE?X0j5MmXxL1SukXwzy z+_39mqTUwUcqTPqy5*>7?KrvXK?4w7_cxiaDez*6Ggtw*lU+g#^{WfDR2AMpP6`b9`QD|tE5fY0k_ieULrv?rG-DBG zY_do~;mIH(3@Hl|0YCD92!c*zFy~x9HQ(%%#KVt93^Nksp__#yJ#!qTpkHAQ$u|r? zmjl8=7lR8>3@w(O$`kq^EL_Va=``Xf2|e8kW|fnXgC8FBW}Mu)t_H_RX%dt*7^*<; z1C4?jSbtLD#$mby(Flej(EGspPT%4mz|@`SJo;)QZ}(fIpHIKlz>;?THfe33s|iJ? zqsJ2(MxfC6y?$cf440!ybRZ#4&!wj#G21D16*ClqKEXFZTGd9oXqd@)82D>$VxmZ9`> zOs@=$QM0~#2Q0>L?VMU6hU(8aVaKI(NiaMqj@w#d0tTAg-fimA{^f8XoD-s}^ye;B zG?$^)bKU5zuidJiCr{EBB~PMr%C-o%9f^u3ff*>9rzm-)2_$z6m73p*geMtsMi4T{ zazP?s>mNCLE_iYW+`Sh&lZ1dDU3m5UvA&;}sJjI)BcW>nf5E>49jC7FW_Uk|o+p)v zk>tc}`i`NdGQt>%7m^70ae@pTrIm$&b~^NVYy={h>TEVt)1PEE}gDjn?`>{TeudDtX5=t#vMc5V?-6XYVcOk zFnE#&-0s6(=jAbU!i?}_5pRORlSW)-Jlru941Nz({3ye|f8~v>8SWU$1NWXVr^rtN z;K?F_yLqGRTF8azNH)MwtJm|Njj1%;I_PB8t95Hf>09xV*r>K~^hh*cDQ;(C!$j@w!{d)9Db^2mydZIhs3$D!a~1 zLUYw;qhUc#ld#Ts@&yM(Z!jsNt5=OAbM5aK%GQ2hP0y?N~by!Tbp(WQjj3H zvV{<%aOIUG2!?DS*`iJLpD@%j{RSWz@{9?{(N=#1rUWp%uk?Cl=$Cj~h?=49X!KWZ zB$!&2!YGE?=x*Z*&Cq&;?{q(dE^@wOs2uv{WUxDiN}w)u_KYp6tm&FOHdG{$@T3rz z%2?bnl;(UNTntHuuj`5HE;Mb;hQ2}3vgsB!Z?qS;h?(6e8>D_cJnct-)1jsov+1q<6EtO?bwxt&>~+OgY^==pcrS3 zyn8qbZ^A@C zs@jFbw&bNB1?+R9+StoYZDrYoT=1r#&25eK0X6n9iGF?(B13BPmWd^Caw0!b;V)aL zDqn9TmV!IzxU-gyo$jIT)dJ%?erZkq^Y7+=a-YM0C+~*~|0Fl{KQCT?&jMX%dDCqc z@C3f_!#}L4X5%c$(NEA-81ZMd6I<-wPL4SzR>phG2ZfQYU85>R)H+a~JB`hku%@q& ztrT@BE0v~Kb;nUkHD&)ImBsEjs;ed-3*8Q!2n#)X?1|z+=Fh4sXe8`e-qG2r8#LhB zo&fusG^tI+9Y=B21jr#v>>S(sYBH_KNY}uGCUz+ai4*VReQ-tBdL^Ce8}0~QEpl0> z4mErJ*(mIO;LSi14JVeFe%FI7Bz!Po-7V&CQgNoz>m zaa5B{Ay8dwlH!ycC1%qO=B>6q&7oYn@Cs1mM1=*8qO?=Yp=QX%Dcv;A4z7?Oe@w=8 zgnrDN-Wx!N_XG0M^@sE?$x;Lc8q;0Ky^Evr?d9n`v%SGg3vRQL%T<-=>?wEj!9AXw zq{~q_cZzP*j&b@535^qT;!RTbbOD@B@hUBn%}TeI_bA8F?f<6NnoW!_u#yPoJvLEiURbhbu>Y$H(W#JsDsPMxc1Az#+kuddN?-r}!0 z2=IpMVl*_!vkSE~wVf5p3GFostHOb5rX{Cw)KZ?p1_KI@MB8?SHX_G7-4+I*(X?-q zp|bKGI6rr8X~RQRn%d_os143GZ6Hku%(IXlgC&qf}405uA{%ezMIgT34Da+FzvnWGma#LE7>v~Pg z3*563YUa(^^hP|P2L<)EV3%Jjp}y3{B1<;QQDZyrKl9D}$l>Qi<#-SOUOx>w2lAek z@HOwjg$?o{`bA&VV$um?sT=hoONy}FGgRlc3iYMJKXC7sIs^=7=SFMq87gmG`SgFc9oL{wpsrugk7U$f-DmAE@`BkNaMFf%89{^k&YJb z`0;@KFqd!UcQC(OV-=Hh6_4ohgJIdZb-(DW*BC%40$p_pCpRlG^J#pwj=MBm-)h*+ z-Cxnz7MDcDiEX{M#E0@*T+lOFzQ~;wWW?{Dm9F_~0Ha6{tVoMZ=;guk&PzSBYl->e z@y&^y9`9L6p!-p1QMVKu8EyUMq_`u_)yZMWUj0tt$9Um=XiizUekm-kJo?ky{-DKE4WPPP|n^ z=h=yuG_|_)o}uzO4Sv5JZDM2AdxqNV$H9)Odeqp16GHimPM5C0sxf5<*@T?0;oHcu z;6%t?8;hvFI)1fLOVub^U)NI?^f1X zuCQezY{5W_P1$)Ckrd&)E-uDdA$(|7eCqgOns@bcc9B< z56clnLtI(!fy2QylOBH}Ci~SYX`f}KOz-jcMdR5@RbZ=@*&*yzr;7xs+k1|}^5bSH zh{LaBcck2{f!>ms_z@dVK`YgwzX;BFWsh7MDiJWxioP=$Qk=<-bGRyT4&97SS|gA^ zIZ>T|Nb!$)PX{gb$lH4k)(6>Q<({F4{W+ZHh%eW3p8dHe$AKUHnXYE^e7bXHXcsoo z@uQb9Kl<~H?pN+qs90>Q$0foEN2#rHj7}3826D63Cy=%eB8}D6xMaHhNCR z&();$UtV7J(11CqDvK^3C(VwNl>HhA-=C52iBGFWxdb*Ve*N<&XV3gcg(-0&ywCmu z)4lrnhD6PYFeS{QQ$0*|5?xJS{|sOgq!0SSj6?|H|$;!b(612h(R@6d^rhm6$7 za!GXDdCo=XuBN-s%rIf7&7a7IFwxG-KUhtvz}+*H=fBQ$^J741)7`9rLO5?H`pAT| zxfQChFai=aiFAeRn05#`#QHDXlQ3hoF}PRx z!xdi#4qVt=*2**fFCXqd{xnf-Ac+RYW(DWY?QF>Ep1uKHrv?*6$x-0vpn822+$o&A zwz*TKMq4%BbZ0R_v&G%mEp41wd>e)JYWn;u_?6vafLN$)Zpu=vRQBtqzv6Aa$TrUY zajV!ZOO(+q#j-Rn*?<1=(;xow#}6CQLBmm||MeTztyS;D=~E;7qjs-3L+X;|DCB?s zC?uo(0VviKt?gXJ#ZuynSj_Dsuf57J+JJsAOjYjE2ZA5lI_aH6>4{y2Cp3b^B+IdN zk@f1d@Y}{h7)gyR?m2b{IGwNevNphCda^=-l+x(^m^;ik>V+}n@ z%HRX|`Kmw{Mf7zCXz=nciv}*Nf5v7Cd4grnP?x`-ES*1l*O{)c2aXNBnA4i6++R(G z|Ckf?-QA}QMflH&VvWxRS%rE<5;H$aj z#nX}m!H=kv*ne|vI;)av30aBFdlX$=41FLQ_XALT0jwk0Vy4x~XIaPV!oS}}XJAOj z`rZ8Zhwnh)nPdXTN*?~$%~;Bf^dzn$*)SLELomR+_`1sM9>5KvC zR`9DU*GOpT;gO*D@s`OHW$2)fraL|k(vkQVNo@QmOjO^0!OaG?pCK8(Uz4dD$kjy4 zN50li4%Dxo{)+Jt_eA{aTKZT=P5!IJQ(P;Qx=||INL^+Bx086X|9-7n}N;X`T|N!IfQ*iCuJQn)FUT~I~|u6@K;oo@6IWYdtfC-{%#qT53EGKzn^LQ za5epH`02VuvbAxF_{E25NbQ5_Zf-uH`{jeF3it(8;p>phN>haTfuYLvK~>7IU}1gc zr5b6x`3pi?N|WT_YJ%4n=3BxYYPu@cbYNUL=#)h4@Q2-Rh4%=BKUCvJC4AdM>oYEI zALsWs=*}m`h#?o!P9WH)6HlM@Y!+|hwlN(XM|N!t#n~Si>Sh;(u`&4v-QRo9Q(43V zLsjf^_U8V`HMN25%U5=cQ$7nze=hQ&YiUP&O5=;eFa@YqqbxbmL`NnFa zt!u_Hj>!9r%pj*aVPJ2)u5_Va_smKw<)V}&Eb6dJ?tM&Y}>%NV*faw*qf-I`M^+Y`&5gt zOv2(wXQm95wNE2k!kprN($R4wZSOO0{0P~yF;!a_)A&aMAEx8sN4*Y=KzJ~&2RW2) zCn*I(UF?07*p#5eDt}do;k+57yIe4#QN>!4XDdU+?AK(kZExAPb=;3OT*KeJUt7%lf z`3LhO4e9BiBshM&;q|IZ5)eP)a8ZK!11mx4Zx_(InzS_BBz3oY$vbslEYxE0aDVqyJg9kbx4g^L?aj?iF^9|d zk2fE0?tZ$z`IzUZ5p(yjSl%u_tlLfb3(72(>StAn|N502558pLbWl5lbNdDESH5ue zwOY|#tR7g&PTS9A{{;X$qOw^m1QkPfSgf4xd+kMOd|wm(xpWtRQNn@q@C!1@pGOzr z|L9pH#)Th;36>6w(c!xAxkXu!Qc^`&2p+rpAbgI(d^H*C%Mv#~ZT}nlU;o)BTZz9Z zOYVJF)36Te@cs6uDqnyB7M=^;!BDWV}*xm-@4`n3reCgcF{i#-KKpCNxRRkly?f#Ef~I>jx) zP_g>3Gh3>oo1yHqr)Rw+K`dJx66G^6zMuOygl_36QEi4A(}y#MZ*Zv&ZE|Jp14ET* zY=bOt)9jmJqe41d?Nv_W1?wAQ)0^rKOOoDeQ{_jP3bj;K5tI+zXk`EBtm}i_>Wzw1 zKMgTXKLm>aY;Abv3@}MYt*$0j&1N0&BUC32*WpkVxY2C@Pzi>2>(@b&aL@xQf$DJ= z#>1_9nx01j~)!_s_)b!+lSfhSL`QTN@33 zYIx(pYu-a|;0rJrq%2+%sz0tKO8pFZ#SPk&$Dz)*C0tX2~%_`x7}yJXD+L+$BH ziNe(+roT%o_y>jp)91jOp?452_u(cIFF#^*7T%@QC0+s!1z%)?L?*q8`FWa-+?YPN z?aY(VOsLeepv44a(ZczY=;>!D9sNGeCWcbb?*xn=`$=7)B_^FFu1kJ2=v$!V$92*c z>8$QB3O2KoG|NC{6MKhEdP*AR>5q(D60W3$vEN}OyFZFR( zW|(__a5XIzpP_*CcZ1H454~Qe_9B;JR0rjw7ucT~I}Ors`SGBkylZNh%;eT+XJIa! zCq}f5#9t6&a?bu7MuJ4nj}e_jj_IK78VgJ}a0?jR$V7#YotfUxJr00tj%6C1AaBJ` zj{4*Xpap>T_*%)bUE>W6ZxAnQ<#Op7Wql_VOpx^8(S0hb_{3Esk>kOSah)6w3+Hs+ zij^_NWK4R88-3^VV_vVWe?U2fN+aaQx+)2CCR^CPckXe|vrO0e9zo{_8Znfxesv1{ zMqN0k+Bl>`;bbLjJvYv2>eKG2eZ7okP(pfL zGGqG2H>qZ@Qr{krCNlSs=myuf8nz7gSDc;}iHZ|#I}sZ63dga*ZdW(gj-;VCsv5<_HPouH+Ey}AO82>w>KXOlYb#$ z^P^q4gCL5^z4(vz>(kMj#b2enq0?#EtgR zg6$2YC|2d78v;8L8j|-uGE~?eP{D__DPWEQu7K&BR%ee_Q`Szr=a9mh&RztOpBu>q z!9!ccCVTDx)Hq{5zHFLyJO-o7BxZh`Wr}%e%F?{3#@k}KUCV~@e?2nP$DV>ZW_w}t zPfP?289B4?yg&4H1#BF1(ZDLt%MQ&n`eflpaLylym;<6FO&z>vi55(FWGI$>_83qY z8LDN|7<-pth=@)9iQOMka(^CK$!lMT|2*LQ$kh43*9P5cK(-dUGtu)SU1y*-mGFIB zL`ZcDF1PcBfFCWJ4nd)|hIE)dvXaui00wt9l?a0qe}ZpmWTuh#1OdPn|6aDSsLh{$ z?lh(`N%%!zr#>svA@ayjzM*wW&=b z8<)63(!#6BYQIuBKP1Owhv`S@Q^?N?bTEYzc$k5e433|Z=T&ed9!}JTR;x~)CQj_- z#5CoymN~9Jus#8mFG5HL$d9Ug?o2B!hIiq37Va59``jr@W=%i-5bD`MB^iGTCZrWY zZ55pn{>Vxr`&A{MA^nuZ#E*dNVRG_uAupttk)vQ;O~RUng*k$DQcO6AYI#uw5*$Cq zaT=V{XHUe%k8d0^SyZ(~L#z;Em?<449t!%x5XNfuy zsR?(iRIpt*YSgSIi$z3HFg83Fhb?`TUJtdDcV z@r)T2M-nf{LE=Z&7!DFY=4WdcO?5SGfhJfWvmG2IjZ&CngJEO&+ z#gC+oL8ZEXS?Oha7}~UA-7Vt3U^s}PIb_r1UB*x``#7{gmRDE0)vj+|suj#oH~Toq zDRHB5@nb6AVDk8JlH(u|5IV9*K-Z!pm_~|)B}$5qKmBySnBRR|ewcr7m@J9_=C~_< zs8s8^0#@+691<{NZG3EP8PkCzfZM@mZB}<~HzgCiSV>~XAAMjZktjIvleeSbL_6M& zf)me(C_>rvvs^yI{$N_TuP7X>WU2ev7>ww%M7AGUsZd8W(b}3q0UlqLUL2H$#feQ2 zu%t!DVyTxZ-{mx4XC)|2K?_-zv{!?bZ1kJ=I93|b#N4b(;IT3R6GtWxF=4sMvNWW1 z$V&a0n3%+Fn~$uto(W8-+JOhH=cO*lxRkCSfkerXHk_KdT)Ix&6ed=J&(xt?!ujO& z6BD*^R(j46nN^k5Ug%Pka-m8qmM#siYRerQzt3Rlx}>}mX2D9fd4KNQjfD~%B#U4r z$Gi_i!+fpQbRHoqW#t|O%t2{ZLwloSG@QvpG6;@rAyS=m6g=rd?06N0$VnJH8Nxmc zI5%CzEeVG+6&UKjaSt{xl^VNL!@HwsevE@th*{|o?<2OVT=sp$9qQ0sGO4feBP%81 z)3cdW&Cg0tIEt^u>=O)C*tXgE+&w9?XVxoTIN3(4Sa}3!lHf&ztZk zmKwwI3SIMb6YJu%c7 zJ`@Skp{6v%6!Tt$pmzlKH}>#evlMYuf_4Et82s4P-aLmecs!0Gz}_+<5%Qx}gm6LX zLBvpK_&p>Uo){_*r|4)TPa8j0^lmaCPYeZ#-$B~tiIoKLu{j$=CgKK}x*S<43=;xF zULf0%8HJsuE4w5kyH8is7EZq3;*sXnu}7_>Nof42%!#?PGFbxf>1rau>6|3U)l6c! zBrLu}zE=2!A$y&z|8H$7YiGR`U z+NY1X5E}`PJEw8{EG~eNvb)XU;BU0CGuaio?N3gb)(-oLp(OB$RUeUIz%*D{RF>c+831 zG*-kl;i8i;C?SP$2zMlD@;v=G;>t01SXFtmtCJ?16DK>0?P#jv8w^h;nYtj}yudhL z-gKMA=#$hKvR8B-mcx+v346y@7ipQFPwZu#hrBlzs0~MYAN}zbTCmL|wpWIo!)XM% z$07S<{88W3Y0u~*hlvyWOR{3S8i;>!#DXQEa-x0jBRK!WP$~KZrbBhhRi}%D7J5$% zb)V11II04QXF{T^(i1CX=re+$Z@57{i_6AP?Z5tiP)h>@6aWAK2mnxI*jRZ7??sFQ z0074d000;O004MwFL!TpYjbF2Wpr~db7*B{bTTe@ZETHJU31$i5dABRo_iz5N!*XI zJQF8P(>m?FlaKZpODl;6feNcQ?yv8HY}Jzsb{=ej#5r&dy9?8mHjlOjK=#~7WwWG4 zY(J!_&1-15J<=^G`ci7saHOuOQrjBfg$Fe<9gjwnwBbS}v#EdgpJBN!;2UosOYYp8 zF@4eBsvO8_&g45#(E;06 zwzu?G-Vs{fl3TdY@`os}&XRWtE1=|^#9O_(hK;5(Pnc_I{XbjvgO5iETY|+a(F@Nz zi@Mn`QNIx?OUCr%&;IEa)sy%oTyo^IsnIKD+;F0HjdN!y_31&ZLOI*-(9mZ=K%Cvd z6BvQ(X^KSW-lh2lIzI$Oj-3qvFAe}NI6|dOXwJ(6&|4_MfXabUMCOlDSoD^&hufO~ z-NyrTm;L526euBpzdC@whrCu=>PkS!h))OLH(XU6#dZjL{VMkjF5$^5wMx z)~pl~7$tKlo&!XSS4!z=Y*+q|CZ*6E;&VL2=Qu)mP011p%5lGrQ3Uo)BXbd53MfMH z6`Rf#I!l$#@YPWzu)%Fj|F$nD?sdoJxv!~` zFw)NZ(obFrgobfzbuP%{!nuxvJ0S~V+&}pq3r+_MPGiZWS0VkUUjMrY=&F;HdomdI z*Rh#iY`)+4ZTh?+X9^c`WD}>K(yZ)^>+kwyUl=BWu@amAQSUM8Y-`l~Y_D>c^9Fu( z!i2@2MGq6oYq~%b+^gwSK{!VMD@$C-G+bbR z6&miYvp-Nv0|XQR000O8P-NIxWfu*^-~<2wEhzv14FCWDcx*3oba`xLb1ryoZ0%ZE zkK#BG{wq=5cXB}zuK;Nq3GGO`qmjB-+Sfn~SnC{{m|mD)zdk|^ph7r8Got}@6T4jX zeJ+;|%8YWhqxf}=G1ImYjq|a-W-R^HF!IG3M?wB6NpZ|2%Or~e#*5j?$kPl5VJ?&+ zYS^af8c{%EeKLwS(JW%Qwn#QH8|$X78I#d6iK{AWsH+;@IEb+J9?-Eq4JessM70hg zLU*d(mNkonCYi=K9nAG*RsKyiu!^GKTG)z6oMf`rP%yWEnWxY;s+5y>MRC9QH+S|G zuM({N_4#VFGj_FC9FciK!!7^^-gIvuJ}+$C){FL`xDey2akuKvGBi}fh*mFbx>e@Tb7+Huij}=|}FALH)yk(`cw#%pH`|%WSap15AcJ@=V z``(B59HH6@;qF}`nSWW|Ua-$tS(?(n8 zh<fYKL5P;{l3rh`#rzq{o|ggl@82cuXhka?bdAR zTDjP&`PaQO&P_7?O=^Aa2D;AKqv~2c=?Nume+RtlIW8m?*F2w`HnP8+nL}(^RUrNo z0=pG#M;ypBFaOonK(>Fu)&|lI;=0k2 z2coFP086PFQ&`U*NnHOSQ~wcPxXrWSm?{U7uGD4`$)A0a);n0H6b@-EnApY zeHtj25oF=}7LY_S{W8Hu=$Hmsu$aDJRw7^FYtpBs!Y{W{WNA_|+Tdw7Qy8Q^s34o) z*ooxF%PBs^`m{c59DOg5dT`vLQ|33qF*2V11PK)zkcUzSNb{-0h^P*K(Rq@PB2qa~`YNjP3Vbx>2m&>v zjDueWQD6{V_z%)VXs;3^SV$=!=$4^~T}y}kAH9%!C9Zs6o$vcl$h4kJVF4jf76Jl^ z0P~hA(54npUb;ORqAhAxCK=%C@CO^BUD8!#}^spxgws*I?UMc9W(1U(dY=MWmp1qkSO_$ud*ag!V`=IhnvjP2@=@9Y7 zc0rgjc|W2uAX->@5&ZGbhMfI&7M|T$!eRUM=Y21PJ96^MN~XRP>CN8Zd{|T<7g$?{ zYb;O-9Y|3bWhT`Ay21~1|1*^_gX8NTT8pKPKRwDr(1~rGmQYnp`6q$z7m6Ft3Mm4E zK=WrO*spYd zkEBo0>WXbtp1~gEf~`?uOiWCnV_-k6a)}JD(utqOsSg6N?$Zi!hRHtHqSS20G`yahQgKHJv9<}^ zb{&*5YK=HHI%RQL&(L`_AEjC*B(KPUBkh+CsY9ZlL+cEB^@Elk<_uXGR@`338%eeI zMyt>a)fS|g&q ztFO*bOA{wcT}~-3x5qKPb47nLJvq1gdz&&)xSuNlTc!feyLZc`TmJj4WjB4fG2K!4 z5&~vbCW!-CpPMKsW}y3IwP5%!_3X=>jCa$A?jva=bRlEb@!98n4(SI%8uNZCo`w@& zjwiTu>(u@N%GBIznGkuDbEIm~Y7Typ&nfd^2#kw(kT7`oY}VAxf*bHP^UBEn%#Y=x z%|k3-)@*fMkt~I-mVqI=LT?W|;cu1@ID9(gfgSw?!$$Zc^F$mX<%O;iRk!WVy)ldR zQBFK{kn8@49U0@@97!QG%ru*PzgGJ2j~?=X|M~%SixjX{FAEGBAArXDx}6UXi169) z;YPP+rv?PEah8IQhevp_AAR_lAcgE&$|j(qRh+`C+6w= z{2~l|ujTZ$D?wMems~vbhjjme)kn~GH3f4AD^H%tE*(hpXm%ne z^XOB5jGWW0->sBjNij}ip%^ejt57>f?^Ch97hRi7Wt5|L?Fn;W%kdq*(_$w|mzPOP z)rz%gawDI^7X(i4xnsy6?~+BL#*U8YbW|Or36Hj5N$eYDr@BDodpPAhAByTeo&OBh zHVF#mkWxhZ3t<#j`|#QU?X0?At~u}%Ihhtz<(skdP@40D#CJ@t(eN_4M^VbHLFXdJ zH^O9YFy!pq?^XlmLF+4zml^n;kJrI^Mj8xpq&*lS&9^0w<_yTAJx**axDM=O6EI-F z_<9k5T?T>9V*HUfOn8LWui@bvo6C!q(pIAiZ#)V3p2SxuFcZM_-=h67xPX6yS6GTo z-4q1Sid*LV%0K|G0HlCY8$KxDT)@_SQ=aYH_iu>14JnL`A0$CQC7H0zE_9n9fi1)< z^|mAO#>>Jh5x30(-k$;ae+1)r33;32ZNh{L?Yx9LtuikQZ-Kte0ygU0WZ5a#d7-=s zZ3k-I2l+O=@d9}h#10VAzy0N3(*-Y>HxliD`3E<_|06E(^6;MW9iCZ$=U>h|(p~`Y SqK(`w0(u3wqS-KT1N|4GT6*sQ literal 189336 zcmY(q1yEdD6D^Fpd(eagC%C&4oPinK-Q6`fL4&)yTX2Wq9vFNA1b27)x%d5F?t4`X zr6^sJj{;GTXV7+}z?2VP3>>Zq$4ILbq zJZxoL7an7^Bd*Ngde@%F~rk=qkVt)ZCH|0%=x z914uxq>RUe!Y7PqQq(Q6BTca=GWLYx-;JA$n))JRP%%edid>Yoqwss4E{29Ncp7Q?#SB*x&1qJ#ICkzx6_Wupn*xt$X zAG{%Pa@PGUSi!Fm=eo&T(zJc&d7lLniBULzTu~P)7+DE^2WCD!(pPVO;+QTlGwUX+ zYpj(gLadq8aL7Zh}EJQGrQ%sOc{wuI~!;I`5*)#&}QnoBXCe0MqxnG zx#&5^4nGo;H!s9P{pHtg2=gVt5DK2pL!LciY6(j5J_9zP;nQuGzRD(#nKA3O(Z>kk z<&@?!frCa&9n>!wS}4?{X9hZ#HUgh)Z7LL^nXkO`UKzg1|G^=^Aei4D@nj|^Z!h^V zBBO|%M_a?!W+XW<+CKI1(CP&ZD0P$ZB5d^SON_+~psze0e;fWB&f>tMHQ;f2vhR80 zf#3gFrd`PG688UfT%9EPQ5wRV-#$P=;l4S}!-m<#!qnFE|NLhC$92b=+OfFYcz!i= zuLcv|soqTCU*l!^YzeX2mCyIGc;4Yo@ziJOQU(KiRrTpX`5=Az>ncnTsE`u>x=0uS zdF~g*412-~kE1~VJirx~j=ibd`RP7$b2A~$nee0tjSS}l-BfzA_h22?h|%worCLkK z@+s(mARfisciclNeLnHaVc-3fFn`!od2k_IfDiT5pW-B1P9f_Rwop69sWa9Q1DhVn z2z-u#=@V2RI4@N*?-e4+%4YfSbB$Zfgd>)&6CX32W)pEiR1i6 z)Hi>OZft*r==g8#5b`ErfNmN5RT1+q;4$oylxv^%vV_o29HIC;x! zz?_Mja4)t)Oc4z;IZzY}0X(nL%{|-w?Qp&gZ0A~51GUZ*3Tj8l;$%kIS;Vn$vz~^O zx%#O0r(8Xf+^MDdb9Qw1A(GtbF>5W=!lgq(N$zSP7Va+38z}mao`p;`no`R039Pr z-4{iU6ydhV67ZgMGfHmHO`v4=?kvMU=uh<-laQQ)jMqH=SafwJNqk+dG5AOISG5W_ z&-0_D%P^%J;iu>O0_iD=7rq>C)f1e_P}5d*Vc*LsO#S?B|HpIiru~G6=3w{Jc14Q+ z(>>p{Y{4}oAw?;t3K+t1JDYcre>ZU3#M?58%Vm}!OVJ{WY|@37}?IFHE1>2Qir zmQZe>eCQelR`!i$3GNMBXw81O4xZKuM~K`{2>|SwRlHS??xbc0>ZVimj&o89`$*`{ z$UtFK`?vEv%M*)djg^M*~Xvj1DX*7ToVgYUc)XMiR{I{4jIWU%Mv4eX47SKQs{(|=Sh&~ z`{?cEoI4aHZ<@T(OisFj&^)c*eK{Ixnh-MkNy_p_go38p1|RoL^V6DQ$l_00?rHAh zQS=+F&V*k_(F0RjOSpcS^}9j%0yO#uHga@_@RMAt{oRUZJu*&O;7m2n*P(K= z6+NLUQ$_2vS*@J{Fk8jN0F&@J-H*Z{uP650sN*uakNowtfuFVl{4n_j=9m0pMkb!c zrs-lnMFbb;Vb#2v(slAd-J7;)FBwPgXDIUs@(*>MV#f<{%4owQ_m^ zK`0wf_nt)KM52459=FcI6I+D81s#>_*^9eurfNH+9E`H(za;i4&;U^S;V|N_PjGKs z3k=;F%?kk){z&>O8La`PUZ`Zf*_YzVxSNi%#61+WEeb=qN;{gU4TkeSj5xWk+D(${ zzLy7?vIXIbH(Zwhu>*({KFp8V87xI)9D*~IQgr(7uNcj1_|wo3KB;MYsVNX;(6PpJ z(eT)xA%FiZ_aMFZRpF-sS}2OOon4Pml9lCz5Ps3Ro~Gkx-HGP>8yvGnNmddX55N4x zgnKl-Rp$M~c>s&9ev&QQMsKYl(7Q=vD||pezg`yN;+>MBely%Yf$FOwy)Uax4f{ zQ2NQWe`!_lZgZ;mGUZ9~bujY91>lzR&C}{KpSlTku0R6_vYbqvgq{?WL~v zN@`oWZIy|gm`2TV`F#DV&uw#e`a=BjNV(24<-$SOsZcLNb#nQ$9mp<`AmiEV^I;eT zxcuRw-~Gh>8MQmP*`5EgucG_emBAiN)A;zPMmX)?bzt?fqJOEfCQ?w~W(9gWgG4{3 z6dktOez+|5Pdt!wzOXN8t?25g8G8!q>geiTa-UQz&Y6=naW!FDZv{?$<^^N{|W9E6i#>ZzWb zlM+23C!Fbc+jsq#fu&3KrvrmYug%D9pWuQ1sT$?A1Lb)?rjl~69Elu+-H8U#92akk zsjc`ZQ1cOOxE`R+Rj;G(;YSpGPrF$ie+Qu2?8b1Pe=RkO?E<-%4Ud-*K(J4DAa&xE@%2@g^7oQZY zErv6fyheNCc4?lTO&|zZ34c?!9c8mTi(Vb+er~Mp;^9o3PwE%`EiTwrIn9jc{}`ro z47yzNyLx#jzgy8iU7>Gtf0^r2U7H`__viE8Wzc=ypyXp2&dGkc!pK?qP<8{o>R}7@ zK$xq~#62DEyA0N1a@}h0?o60CY1T5!A%jTpar>WGZ+CR5F71Mrj$R(DN@|ep1%mI5 zwJDxhTzxZcjNvvosXO-J9GN#gEJOUi$Wt*z+0v;z4`s+FjQtR!GV4QNVX)m(C`q-zHeMaG9O}D-NEy9OaqD8yOW=Q5gE9=nhn0QuozOItKt%7Rh-MY^C?zJ;~ zNU^f;K@KxSpT#f$8JU{#bKm+ba(m)YH|ZhE?O8y&Uo#WQ2ZHw0q;K^GQ?{*IBg-mx zoPfK8^3&_}iaI=BalB`cDOd~B!--wF0eF^Nx*ly+-?mCwv=$e)R?)U9s1eas5^=I+ zXWzb^Q(7~!T6-*)j!Px1)^_}vThf&7@l-++5}cCZ z`2tR+4p*@sl`3Y~&bs?4@! zkx2J6&(5_)pO2pT^bq590p+X7jR-0Hwu;&T?W*xA>iY#vce{$=Qz4kJ8|PpX;&#?s zHUdJ;afy>+d8wJG^V&1ecLGh~mGQf}s`(5-t4G%Vg{^1qoJe(OZE{WmoFcCvY0AwB zI5^(`bm%YbOt@XANEsFVL9qndaQWubZs}87sa8P8PY>-1%$o zv!oE=U!E)1tcbVe?J|M9k6AZ&IS-xt{oU6A&l$+7+u;X3D{ORnX`=dlI@?~oi8k5@=fz8c9nvN2MGf>ago=cGI@@UbxZn#M9bFF znj1&9gQTG)i&BkW*o0k#mr)_m3uNJ6!{i^j#@K{2kg3eI#Y`{*n{>ehnQrir6k;TLRk!(u*KYLWSp+ zExm;r=Wuet>Rb}TJ`1K#VO;zH#|j5t`%ib%!WTX>+h~P~Uo^rVg9P9{q9fm~9_3=r z?nD%4MHpO&si&Z#o)(!4oYJ7M318@y3l5Qgm%EEGnWc*?t2A8$P zW0p73eEPHbTzcWu-BkRE(eXRoh@@(~w}PzGOyX8P-AHFk0>`LM5GF)}Q{ zcAshM?v$A(bszBO{6A}uRS8Ptb4Py_qp8Mo(^Gk_u~1>V>dVUjb-u__Mm*~_Z&C0^ zPB`1r9usBZxER-TwgZ+Xqh6B64FhvCL|xy1?T2*g-CcQGOpMKD4JJP< z)u`3P`#SGFJ#0=`OPi%xUFB9(&nq_3E6C2g6WJw)oz$3+mk79F>L^pYQD*R7&{z_$ zI?7YKVbbQM4^9b-GcwFHm*-Du;F%Dl*4+=GPmGH&S7Y!lO=2|-phqrev>lxu^+`;+ z=l;P4xRqp3b^M@49dX?dR3XbfGA*zc(5w}iDib*GQVd?L-jZ@{s`pB5AwVNrK3v^8 zbb_VGm?MKPty}J&Guqs;Gh!-lmi}| zX$-i1x31xt13ho$uD-31lUO-OBPJakD~L-SJq6gjw2pfF?L2q)RDZ6@sVea6nQ43A z18#LjeIjC}smdrvlqz>jWdo^hC)cL&C=3V(sJWb&cRoP78EJ3flYbI9Sn@|KN(tY3 z{O*;yB5%p%rCrDVRr*nV&2Jto+g!VxZ@>&`T;pkOoEw2I#)*CTeEOIO745jdAL`dIlyK51W68DZlQ!TgtH#q-f0ckG}Sq z^AfTWe67F6+Xaw@$#S=+*?IR1n6NRxP{S&<*)bZey#(h~ESL$(Yv#%Z(#vJA{m^3> z_3GvRLH-urLxAIl`HvCTie=y?D_O`7!CLCsV^u#J8CUapJF)zOCK8|d*eM3EP1jo5 zI~EU{HLmPpCHw4Uer|62nCM-(EFAJStg8xer`?>Z35z$P=poM8S)L{TzSE`hzG!bs z`{;Px_4!&^6HLYCH*JxOWrOlH*tyeQPCrcLZp6~HpfNv87k$3XU&fLrmfa=UMgY9Y zR0iFtTa}`VzTa~QrECAO@^pi?J8W(GR02ZytT+&ImqmLcWvdPr7k0LzE-Y-QxDG2& zDCD{|)wRX4J2@V1qY&&kjH+tyDQjcM8$x4uxOGD8-}TW>T7F{L)wNSJS}G;0Osa27 z4u^HML*;+-~y(M?XMs&FJ@SyaO$)+aZR>U4QhH4)Mw> z5ybBx(Q{hgu%2%3(u$k_+}V|CAhbGBuTt)gM+R(vD@c^o!>da)54Z}FFY2mYCLK6c z{+q@-1w;b3Bw`*w2%)VIdVfKLYq*Zy=!yc^LY;H6ysfjb|BwAX$s+G#l^t{JHE;BC z8XfE9Ct2=>H46S~d+1c#uG5|Qu2<##!<(A@=EH7RCGBc*d5!vGPIIm5#v11$>owAn zjrP)s)rGcYk>>}c9>>ugw3dC7S*p?su;H?w`tSbR5{6(@QJiv+>alfJ@ThKqTFCP~ z*Lj-GFtO@J_XZWB<|gq|P0f5fr!tg7sRnt347Q|ZwFY(mS7hdidJnoSsuUeGogxO-Eo3>5Drg;ZhuJxzhJr$^0tkeox};Ijqs#tYv!zF>lI#;XjBu zm)}qbxeQGan85qZ>7b{7yeU7!5X(NG?CB#qH4&2GEtD~#0_jc-i7%@A^@`07IXwHL zNhIAQzmexaUe2gYC7M*E@Xjm(;E;Wbz9CS45}9U1oGFbjE)b-YA6qq@4Lb@mCeubZ z9mwKoZb2#BSpd_zK3}$)9_D2IoAciX`Dm3VTyyfa9$x>)n)j}a+Ls(gwM($59eoM1 z$ZNa54%8C0#gpL6Kb6-1pc8M7`7_^PKV0?J54s$3*hSMLv>-)w&$K_>pMLK5vPe|Y z-4c+qYMd|rdaGIIfADZ@BC>EVREE|{{xTiaHVuENNCg&11YTBu`1hf#GV$?CBV{B{ zY^wp_K(s^vGj;qa@V=VRyNi68@FvWRT(&&#f1;P?DII6^oBI>Ew2e94ow!U2|1k8z z9+(%l^x$Rye0pdRLL6LMqH^wkJiTRjPUnc+ls(LUY2Fk9i{jB#1YhYNkWP%SvKUrT1WwE@%fQ zTQ!S+$ZE?m=_aacv_XJcI;Pzot(`KWUSH5Nc zW`(azYQQb;IeRq2lh%I6aCq?_l_5t-@Pw164nCz<_d-*v*dOHGkq?D7ckB_@s6vPY zS7JySvH}06*)DsuspF5KEblu4ZrP|s*To(Q=NYIRu@d5np1H%d!Oy0 z8pyce9}%0&gXWy7#{EjwZev>BUlm@57(}POZ1;ENqcigC^UW^T&=~GnuN|OP_m(z& z*UKC*Y5t6jcZ0T?AzSWATef3ZyYw%}h&)fY(D@p2)31SS8;53`uC8l*W4b3JeTX=7 zR$6%C|IukSrf<3fKtycgw%0Mc-&yXRg42$G1AZx2GhNAD{QL+8Xp+g#T|hTQ23G0* zes(K3EvGXa0N$*BVz`I$-pxKD64g1V3OiRjEq%}Q!&`NOnIpB;9sOxL?<^&(PoEsx ze~J66V>`M*{ktaUsJCzaHj;bwfU^{Cl$Qsu6l|~x)8j#DCDTW%0JB3SC~E7ZQ|{Ja z5NKPicg4UrUK0*|VsW1_(b<`K3`E#=NzwMBbKs{(nLAL~qJa}1A|{^ZJ}NPl=aLfk zOP5^Koot)j?>nxv=T8CkmfjbF~C(NuH4<6?}@_Cu70&OP48*NtEQ!vavpaXo0ocjk;2B675d#-&`WejP1+3 zqaEL`(3JtnwOkw))VIc$!?Wj-UvEFYV15Q8UgX+{_DQW>_qsA?y_U(Xjd(XGTA;hi z(o{5IvalMCTh+Y>^u?wdfR){X?kzhX@*6Z5+VDD z^-wWfgtPY=LxQEshG3X6FUFaD78-l|d(EA{<7~^41U4G?ii`z2y`Gb-oz&=3}mMZ&>^CzzKH<}n6rOfx)UMzvVAAuT{ zjA?iRrkdaBxG|{&L>tY}6FtQKr{n#VtPvi63c_hNr<(n3)E~4#xD89%m&L_0B+DoOywlzS; z3eG&w(Q;H`%0!cuf$LoLasC%U*{^whs2XN7x7sIH5Y}hb$_clS2h}<=G&FCosgii0 zMUt~0y37C|KBC|gKFybM;DG>Eal}B~>49H2L+VzXfgkyhVe-Y|_D$i}c;Mf3PsNjp z1Nx9&US7)tl%~j{=u;$f(kZVvftFFHeFDeyz8>e%?*_%Uwf97z5D@N@OsaX$&Pf8k@mUHMSxCKq^eY^ELPX5&ciEvL~7 zomvTlciCbe=b30j|J=oEmeIH@bGKRalD=ImxU;@h#eC%ewl}qH)O()pBk)k7;WaOF+ z?QVmGO77obSL&zIcb}aaZs?iGASwJWo_9Ki;!OvUOCWS1ghk-Qd%O1PnbL`QC9^3S zXM2Y+?Ih#8H0MuhAm>FElpT9D8n|{l?A%6P1W1Uv!Z=alO}5hZ>NNfC6Y*qpK_-bb zFSnwDo!@)GsaP1baF0QW_d3*<0_L((@nMF^6^Yuo?4zxJYqX&e`9SMAAaf=7r~I58 z)lLoOSbFL=E58b~9HTawW*j%>BQ&&D04C&0QqQGq=)P21Zkr&+b0$dOi&#(2%_Quk zB)&+MWkO(M7x38Cn^i`j? z`hMKzTHU6ve!7C57Le1)zCS;5>)IYTam0veZ9XQ|=iBX|wrwu{#GrY4^3uAHC7W=t z{I1&nWX#R~*{V^vvLPw#moL{Zy7txM_BdC+^x6rSjw~yR4`tD50&<2r82gOY-m?#c zh0Lw{&D~+{8DwSM3uR|KH=LdGo6WAP&JEVG>$9KppxGQTx_Xb-Nq&^bqCI<0mHZ0+ zhp!VSuB7l7yeOnjFg#H(+zN(<)eMD3VhC;Ahr8Hg#v`WLo^~es`D1`}EYRNpz&7pr z_gEMVnnKyPyaf5Z{UE{A2Aqw zcN;toOf;=FKh4h_fB#=eu)|{?9-8&k-)%q4?L{`!^pys(b4R}o{6*P4j0i1Cn^c;I z85-;P5Vzp~+k!cx(D|Urdrs2#(!3%uPG2+Ep&+!gijLx3moUefVukV%B5dT&n!)hy z;!|zF%mUK?-o$5)hd4Zh>#o0>c_`BJ_NFXx;3Wn@47ezbfJZPTSJ*=KmQKBG2t!*! zwEM^L2kx+!7xW+25$G>dp4964TjKrY6PMVt91>rPhXhLp1fn%LYiBo6ZY*A399mEH z`SzZ-%(Boq2GL#ZclJ`Xclxz6=-bwu+ zK$Lqwxmhn1k@fiqa_?i7lI!^27qo?(WiiOxZs?3-2ihYeb&`2nsoxHmF|ESsK?HYS z;f?mAYK)WAe0j>5=dz!!fQ9Ce!+P($k*-D?t5fAUr7igk#PvA@4p2N=SksSAcA|7K_BC-D@$^m5r!B4Uc z(X&Os3FH2Zkp0VmYMI`@aX&b&Xe=~JJRqY_PMZ*pa=3|Cn9>#Vqq)52ZzE zFO1z=AFIgg@3!(iek1@`Lo_wz2cj=Npi(&xuC*ykEgwvd072LUKI@gRYZo8f&>FB1 zp#9R4tu1p&|4P$?&>+p`+GyCSMM17gnw=iC17FI|0vYZXPcNq(cVj-DHJs(-uLSwJ zm2`XWRX?XQjvqfgto*r0ZIQdYIY718F79*>!gW1es3{XOkI=oX-04`e%C=ZIctk*` znO_k&b~BUyUT$6*!4+F^BJS0+mU^Wz#!QWo%YE25>30^;lwb)_ZntNh_%=~blY}At zA@~E@?%DzS4=&tPZ^;3~^kdMq6vi&W|aE|HBZ=1)>S^@M!oaXAv zc0W0_PR~o|LBjsnsxzk&V9QUTNuL}^u-U|Z$r~>^FxRRZRA-? z?wFJ2wNKXUIr_GKK@?>#iSOmrQd;>KO#OaRub-H-y3OVy`i?YWS1J5FTku?#2rpyg z)!Nq4>5sn!3)xY6Z9C$!0vQwT>Jn!dZ#1$cBffD=Y9}C@Y9v$KDf400S+*6+PHdiNWAjHo-5?!Ha59&$pMGFvT>@cVl`B@ zi>d&Oe?=6hTJ&1R?=|5WN>muDnrewk;&UZ1tNAs0pF!wKa9&Ha-{DC7hIi5g-x(3Y zkD&weDXd&;={fep>gfQGp0vt|sXDK(tncl(w&{MXLjB?Q;l!9L=5+UXx$EO{Mb+Hr z*9tcZ074Glm>O6pOi*`=VT{V3fYy!)X>~Q_oDo=Uq$6TPCy>+I@oB8J#3eK??Zj6L z7d0ZI;BT%Py$i{Rv=7cuy;k|QZRy}#p3aRjndX(Zvf|xX-c&U(=IW2)-8@3Dh-n5H zzli%N1AD*2Gh**|i?%-U@vX|WwuLC z{a){uTVLi*>+##XTd6J>)6KkKyybnWq0hH#l}Nycc2K~LgBLlell zT<$o}-|E5VjmOT^h0U%Amg9Z2Om!?zr$|ygGCZKFu;bp&VHut_&SW;@_{BUD_^!ma zHIRxdh`MFO4H%K*vZJBFNpHWIgYwCTt6qi**r{k0+(Q7S8)vuL)=R*^yCME zXXtnT5X-013;f;*LmN9GR}sWAdM@iYl53smzYk55ylsTs(Izk=QS-`firuFfoXGdw zNE!_qz4II&YeAC4SSiyeNq`&u^w+6*=hCbrMtE4>mzO1|{C5CXW$F^KyZZ$2oJ5_c zV`eUQyYIgDUFY)vPwgLX&`5`)!N<@-vf-Q)A8)6aByb)P%R@{Aie>^`aejrxCuc|W zHhN_jQ0`v&`)N?x!>W7a*Yj{WYM-P-#kc#6r^wlDqS+B?zE{!t6@MGmy;8tlInh8k zP7LM2ml!3O%9wmH5mHX0l+m2EuGRpVMz8Lro~N=v+*}R4L!reT3x*1F<@&@nrk%91 zMLOaU9i5;o6g+->S~q&6BcRs|;}nWuW~Ql^!MnTG6Hoe-bIQqj4nol*O-K6xqmut# zn+8}cBN}kW$^LMlu{Q(a$2M+6!-qC{m!G5DybhjcV| zAsP{ht$kVBfkS>K!XWuv9-6i}~cXrpAzuOe*2Jtsc zu8w=#RNTM?ZayIjbTD#L%`7rQ zYm;eLKF>9an2CviY-H<|?SgQO{{mozm%kZnWQe4M?V6jNUmficL5q;hw(8VAHo2TB zQWTx9W>uoMeXyPvt#%aJ`z79eu93B0-c;+~cgoAXxt@jA>ksbUw_#7cLY3G=BTThi zhm?``qndGq4FXpv*dFsz!_qUje|^s}PJ8u}V!#6{^uvJ&y0|V0D;nVFmcNl#D4&lJ z+q5<|N>iaN>3R|^I+x*2=$_wZ9m@T#jif+ZFqo1O$aBZl{{jq#LpM9o5Bh!u*0Kq9 zA{XlQ+?&+O9g>bOY73Y-R)l-x-+~`A3&1O*m;_oiV~={~{!iueqNNHGOk^%!^eE0T0B8?3ka|Sr@lz-^I z^qWArpG+CeRLFWg>#zP@QIo!2A{4-rK&jFe5bdK;uDsS&WC^8J{4@farbSk|sBM3II2qFg%x zu3yN!BE!(T8^1`rw3NvtrtB-y+t{od0qYzf@{@+;I|Eyon?R)k^x=HDuGK|X_00+) zNvj(3`0aVWrCJLpgUluQVVtG1507{r7L>Z}Ej-+ojQMI^#MRv1ZeF~z`{jTy(edT+ z_{5**#MzqdgHU3w!}Ax%fln!QiqvUCD){s}tpPcXkf4;1T58WKF?$Mr{#`K4~{h#FCV zh99YIBsd7`q$%k%2*+#$nG0?kB9QRJ8fHOpV(33A;6eE-5pAY;F>hRmdE>&&=eg^+ z;!xTf1gOvKTh8fjPYY}`J9U!nm^_>JY4-^L76G9a}wLa4m8D>1_i; z*=}p{6yC;`Tw<09c^7wqttTnltt70>AvBw5B^fy!^Lp_CND<-Ebw8?EZvo42f2Gm} zFDhRlkS15*Eo+v-JGvlJTU6*t;23A1nmf?Mn|%lt2D81tM=u-m`*fFc2 zRblYtk(F7f-uK|)7qe}}H>6=Yqf2ra&oI)ao`!giny0DML4;{j|C4~1cksnIhh zt~ys!96TZPZU;G)%N(Y5sdyI6;~0^;)`hPc_P6|Cd!PX)Rz!)i==<5#UZ4Pcv)iEv1*J%B#0g%HiQo@ zmp`?S6dzH9)kaYtKe;y^EJzzAD)}|Wr8u9+g7$Kq81JJ9AZmRjk4O#YPq>~76{fy| zv_Z$Xf$$zgAncHHd!eeO_(W>Envl4{n=Z2>!)y6ebo`H-T3ml+KKPVY{Qm+#F`x{m z)T8_lfJctdKzgpVqd8kSlVf-HV^NMF)n+@p-#k;x$+*@7cS*t^6;U*3;35w!Z3JGNXlm)-}hkd_ac96iv#N6_3_z{P@cfP?II|n zRIw$Sw4aD_*Af3J$lEF39ku}Uo#_v-Qwe(ECI0aP3ah4Jy!qGzeHJ@kUOJqO>_e{$UK<&GpvT~9;?xxj z?RZ-7=P!Yj@oZ6Myead3x^GMV+Pjwnke9xLlSh0L#8-J^zEUIm(LvH?lz{$Zfr^(W zLF?wv60PV5e1rmQNh=~jX<-WvBp*g?gWzQE!>+9>A@xk(`w-48_0b5N+s~!l5b2k z*)o9z5FRxE;4to3Z=g)pt5#u1#?Lo+yL0vbAO1g>;c4IqL2LY@L)^1HIOVAjZWj1b zc6YrdX~)}!W5U!*tO5B_B$h*YQ~9@caDy{SCY+7>!)R(So-yTx@*|ajVJ3n6-F=h{ z@1+qdqm4Q7WV4l&PQ2M|K1eOOaa^#>vpJM}#YTqC2JU?Bd z($r)|zqoR_J1kbO@^G&lKd!l^D8^1_^viUp!RFb(;rGJBDwuwpHhA-|jYN1o_J>ia zU^tSvBF|6kN^E7nqL9m8@gsHExRp?|&1(hgTxo`}Oh5kDABhw!hMyrXB9&u|ip-uN zl`m$@v+e{WV!W2D`N?JKPsq$Kt9ninWDrUnIsQ>CJxjU0)PK>hTAgPx;$t)xf~a?& zl*hM~TNw+kc@b^&cu5>Be*EJ=ZyFH#=J!0tw_axOqeeu@n!v@M$v6k0(~0wyLqEhR zGKl8=DBIBSC)8G}E~lILJ7t4cva-I+5ZS`o$fPNg?~-U->-)`QbvvYZEdRBsnd~Sm z$T?6fc?a)f@TkN^oG<`KkP(A(9%T+X+A$Y>LW|E?x^oy3TUX5+oCumhEe|0G-t=1k z)b<)txi>JLu#$425%5TgrpaNJNv26sE(DK^->D;^(IDbIBeVENfaRpXpixNhz7CnkhB{=EK(e zD>9eE+Jxr!q*SqSI1)Ww(8c~~tOPnQn5|sg-~PWL|6o?leYUvCuL^Ukn_?TK-r;%w z@};%Q=JnVQ(noPHsq$`zO&&keSRd2fSe<3$WABqdOh4mx-I!p;{YSijzb+BKj1@D; zrx7uDW9r1axCQAFG z@WVud(xeyGS>C>ppvAz&=84+HFN;{;3IdL&B7u7Uq#YiFawzETKX#$1RHP`ABK)l& zog64(-?E{?-gXOnMV35hAT+I+!WEh8W9l`vqNQ0oZHD6wg$J^zn-^k}@ z$WeRJGjBW%DYt1#tlud%OWTtmR-7vjhN8R#o)@!my@~rC@gTL>yNqG+Xz3n?cT*mj z1K6m)=4^D2>V{*foOR=F+PyWS!}=Kh%B)2Px!$>cXiDZS+!YE45gd|*P^&zkw*~?& zL@I17l0)KobyJ3ys&7Ob$hkPlPk22o?ynBpXnurdeQ@$dB;3|6-J8ZZ0rvdUYwE(b zNYJk1U=xisZ!S#oH9hC-@PilFcB6evQ<7T|obgo5vxd&u8O%Q1}D!qK2*5F}W&Yntd@kD4bqAR7JU^R0dh2OHDd zf=rID1v;k-lV;tDuF@^^>pvYEW^;H!J?W&%fngB@3K*)`u15Q81mX0#z_QCI+HT&eA{0trgb@` z-6yzqtn^RH!TX$s$JKtFa2RE3`de1u4i~?61`^dmUYFt6b|sO|J4EKs(%1Qdn$^pV z{7QRnt=?glKBk*KfQqEcN}oih>~5DUbDq25oo`HrI!HMShA0)$mm#XQxo)^iQqs9V zyFQug5^v_QB+dC>x};o{_U?+mxSb1xEg-XCarh-5iFC>uWQ44z`%LY*b3`DFX2GnX zvcdl6&yO1xhkQW|YRe5Z%lA#s#CD}~n{lFKEGE42P(F0mkOlfRbF1$<8k+KgcbHF0RuC)+tSoamUuTc{UbgWop^kfpb@0D^~+T z>=|ZHYci9TNOtE$Xnxnz029yiDJ9z(RFRqgWzz*t3^bciD`SYVj|a zHKL4~00@5)7nXe?ARZBDLl}9x2gE}qmL=vOeT z+dsRD4+O%VTM!gE_7-N~w^?)J%I~nJIKJ~1P^H9c#WxHGkRts}R$p!u#E2Xy#JAA; za7QEMM?62*M$a*Gck`ZZEBeM^vfQg2yIVG{ZFL8@j{giMCkYq;9!~3ij?DjYe166y z<@uhTxDYTE;5e&j;{oJlthfKzIX?$q|j19}$r7Tfk;Z>-K63g==`91~73{cyb1E{oQ1K(M5l` z=|k;;2BvUV@i!U%@P!rSK^dTHkzE`p^d{nW#M3lVqB%tHzD6)t-x4ECp-hxeAY!T8 zkqtejlxT^ElZ7PXM-#Xx5C07t%cPD~aD}0F#leo2I{_U+e`xa;+nwMOoca+;R$OnV z+`GFUwkfz-@Yg6}Ec-})30aHex<7E6!;1eNq+J)644v2+P=%&=W490bI&Q&Nr6+&X zb?4=&>6GQeh?Rn%OFOc~gRU(M8j|Q5EXMaE)}Bn}lscJr8=>W9K+ll*hk# z45f(RAAc%AJ-+qP<4Ch#D9RT%X3AWejx$FU*xZ4Lvt2w#>`!;+nVxoth%N4zALF9F zst5v22$z@2bTHq#z^>54Z-8nV>b)$QN#v%+!WA4OOHlJ82k$4`16clcPRD8ncI?JEPdYj=)Jl5`qY z+Mlv(Pm`!WfWLW@nklsbILBQF0LcgwW;wVb=n-JQV(jzS;5qK)_$V~PndX-wP1}tC zsZrjloPNK=04**)?$#_mUFqisPPgU~vihJ)P}*=4Yl$=OH|2IdQ_bWd!*LJd!s(hg zM#blMLB=DG;z?C9a3TGFC4uEzRAB!fny>wDZ3lInr2`RQyh~wu-^$&7XRvtV!Yq5? z*c@F1Y+cqa4mQjKsO$@GUNirU~iE#>c+-cB3E$m<>7v|h|3G7U2d z#CoXlxeRy+XTv8TKcd_nco3!>hoN?+N<)jF`~%2F2=M)b6H@vginXY~(l->PZzy&$ zEaC7$M^*Ppd*^fKSjmPM{~uA;99{SGwA-MK)!2>gCO2-Jrm>C2w(Z8Y8r!yQ+s2K} z_qN~n*Z!4raz5wm?BJPaW@q<0TT$7vHeZ#DGL(;msU8+!=4KaAOoR{1bNo?+fJiR| z9@;0knf8rmUcKGe2b6Y;ME;c!f?XZ-Ui{&!8T0y!h;G8U?pVT~%#=i=C$C2hQQ{UaKqJ@l6$@#6!&ifL(L21y*PXNFsN+eH ztKcsGQWKPB@3BFh=D98R*gI^h`2A09mt0baSIlU+=WboP7jUe4H?V9J>b$Zm!u0N; zGHbAZaUzW+_%1lZ>n;n#yK;;xFcd}@sK?IO&PJ{-=&86DgO3*1_bZaY_Q-Kub%TCr z&gjc@i|@8fNbg;INmcrD1hM}GbowI=rX20eE|+<^A=5a1{T&%r|Fa&&Dp7DLb;gg_ ztG^isyt|=V=2wFAa&7!)>c$-`4zOn90h>Mchm@n3tHO1UBfZ0sMGq|2?Np788TOsp zi_gWB9E03WTvwXOdl>?~5%6}A3>nW$v}`5_;4;%U&+A%?H#4onZ}Lt33+0+FT1rnq zSis6fFS-Nxx)VA#l-XI)h2~%X?=5`p*tVaTeVM2Q=}_5(7-V*Rp|~mUi@Th71AVU);R2d^g>py zt=u|&Hcgxv6B*%X>AHP|VP4@IQRr%XzKN^#^k}5X^-9uwq#6HkwI7b(cyk880S|3? z$Mjyu{TPuKu-*;VeOE_z2L4bSHmx4a0H-YP1a_-$ebYg7t+GdX_*4j`XO`>q6ij=F zmw?_7yD>FIm6m%iBcAEJd_(yfEYWuWRe=h+s?Vy-1jdWo=xkK~VU9O}w?yD)wMk%* zJ2t>*NMhuOf@9&kTr~#_B7V->(9v7m?3-uoY><|DWDsGP#)76PI@4#ORl{*#FKf1~ zp%|Gx$TfD@!fbSL=D-YbPf+ zG8O#SzNoW(=1%Pp&V^1Y113?qJ^ix%$4WoE(-TdBASHFx4OyS>-;3?`YGoFRK^xX2 zrcyD}VYB|)2((D)Ym43u7a1Llv(VGt4|c$TTEzz>v3f$2SCpZhTZCPe$P78J*1wFY zb1HZ$1H(}Q-A|XAE5?M={F$#;1u^GPQx7;$1A)1PWdhy{zIwKJ@8dq`AP*_;jz~2Q z3w9EdId`hyHfkOPc^UfKFIs3-&e~Hb27ia9qb;3EIu_2%-7}wW4lnStS!HR9rMX)= z(N`#5ei5514zvjClkm`DwOX0eW%H(m->}z7nX4{F82til5s|aVs+TUQNyu}7h5U{f zJ*o!rY0#O%jgEb|>YXafONR0Xo-3}T#>!v=zR+uY848rYR(Cc<#WG%VXs!P#Mqw$@ zO+09WXY#Id_@(RzR%jYbb#+|!M;sKjXFJ7<37%<5N0wc(rH?{HuEs^~(iE43izfmT zUg|?udmovdv{8KAiQ=i!t2;vUI$vgnOYR;j%NI-tVn6oeLL|g19**#2Cw>JP8z>;p zzi5b!DH{LuZLNE|ugu(s-QPp0_T{!N-noADaDO}7{e{y)dmwk4mU@97;a1u8cD%L3 zUZB>+NoR@qCU9ok^X3_nt8~TDmFf;3Xi68maws)+Dv3&%V+jppmxP46FakNnY&wO2 zQ>57~$p-tbu=QR)<8X+|m><0W`hFvR8)aFbnas}RgiD?^$Oh>YJc0jj18$Meb|4!p z#}xQg?X!f3(|nBh!h81Q8_FA-@5cZ&8F>YgfE`k@ub`sUmxhW zoEC6tuV>dVormJ!!~z19BNo&uPEpo;-k_ z>U|v6GtF@DsE?Wp?Qrl%TN3gf5g=C(qDLJew)VQd;drosQ>aI*w|uRVANvuHRz|RA zjr^0L<_ST6#md}>(s=@ZD?E>~HW!e|^5-`Z&%XXh~Kl$I54tX$NKz1LjM zZa9C{GQT~(9KV<-nPg~ii9XOoX0GR%dm9W%)ZoDM-%QCjXF9F$RV{|S+c7v5M?75d zqU<#kZ=ljPMs*f{NJsJB-*eXHmS_Zd0~=~o_aARCHez$cCEe$NBo$HMUkD3*Ux}k| zdSZ>U0x`ms{AD=h>8RSLu>a~NPmveCoaOuz8pIyCBNJ`l2j;WfAde&Jy8FTe8V_u- zi1MUBz5{*DjxO!J&Tdlxl^Dz(%sTAmJ?nZs(EA4DfqUfgewJ_IRX}P)>u9YQ9#)h0(3`7(`_9RV} zvC&xh4guA*$`vb{M{_NJ=@XPVD1Qg%o-R@uytM)kM9kN~h2YDDq$6#psSz{O#Qx~h zAoboyI!;By>NNJ2caJWzY%-&3;&y<=v_-mZ z(0s&lnsY6@oU%F;oAhiTIO>QKaQ<$L`9Xza{aDM0_9jE|`T(esD!_(P?-f3>GFSqI z{o4_ikPU^@Q_-v`6-hGC8sT8~8ZBU89R<*Hy?-#AVO|oUeHKY(O-1`Bp#yGzaD!B5 zFi1j&)PZ2>UG3A#){8oL&ILn{iU@F$U#kLu2R;o9^GPz_-yLnuWRuUh&sNY)+c*~f zdF>@yQqB_l?O!-m&akWdSMLb4-pb3DpF>;XBJ)>b+VsAbFnreSmF3+Xp>>MA@By#* zQO|`?^lJ+2|NVV90$gDw|D8gC7{#y@ghGLhWzp$_x6ijk)!Kc5w31_g|GvI0VbZ&Pd39VlYiRM@{uWHGNnN5V`*l`& z1DZSifh*kGQ~p$cU8;hbj{ip@m2C#JJ4yz$B9tMOPmE|qE0!FEX9&x{#8G?DFhn8h z5sFbWdy*Ka-*h)6U%w$A93n?a$CrB@QHRA9H%;7W)+d|kwioTyFhAFXOpnXPK`;!wn54}7G%J+I<%wNH4662HNG4R7wE4p2r)E3pnD1H zZdp;!#YeJypwV1t_P|&bU}X=5s=263)CzCV z)Jj2L75v97R2*@$w|F44`4uiz-;{xQX`=bkyOQ%f-3M?Skrf_u#;i8WD+&weu!iCV z)LC^&p^3jbM?gu&+^Q!h!L05xQq0$#vQWW}Sd4FE+RM|*HVEG#z)lUz=(*=DaBvy_ z>7ouRFcGASM363M*93d~s2rX4R?TiKXSiUD5)#3)Yu^Xts8i2Typ(A;mxn*mE^_o;odHx1DEZ07tt?L5s~0<(IJ2sC_#oTU<{nfM zX#3?~gjsDjV4qPoV1pve>Qf_j(Mmqvvm0UDao&%c^L%X8ad9yBxHAtqYJ0Wet=Z)` zKa~_IvAIROEk4}5%&k6d09GDf_V3_B++qk5K?3EUfHqY&gO7As?q}-`3e}RE{IbH% zWF%J*h>1{gV_Sp>NyqsX2d;&(Lp((1R_aiH)u5kb-4J<)+JFR7gFe|7zkFkxif7vM z>T}7Q320Vx%tNVchTS`aCa$`KHK zZk2ilYq*Ma^7fv!BV%lZO)+=+3hiEWdi5|Wjxe8{ zPwHPJ4jnsT8;2A@1ChpouSKTS<~R4@uSoPceuE`Zfz`rm3V;6Kk6}AQn3AaTZmECk z(;rLn>IR>RwB7sQ(Wf6@gjGeF1^V=_`_Pbv>V~!CYljtx6~r<`eaRX!=ET1nIgo^; zAHmu@@7hp5*Tq@6&WBrZyPuqlFIJVkod$KE4)Yp?@%vo>UV=i-gSIhPBrNH_;S_g_ z&>7&ngA5maIzG0Q+Fvq|JE7alpeO6(vs;Ga7nR}cU*ijhKSr4OH!F>Y=|+Oqj|63< zaS6T10-KCm<7~A)c|O~@`p~hoXlfuUu+IUUt@^zEz%Y1Jb{BT}vkPY2RXE&!bR(G@ zztQiS(u6J*< zzA7|%pv#~EsSmE0yH2=}ffZdgaPS>Je#5Ae3xD zMwuSNT^Gb1X-wrgW~ymoq0t99dI!YK9Hjq+1GdZ02x9+xxk%84`~n9skq~8e*DOYC z+@}v%%-hSkAMYe_zL^)j05wdh4`5l7)G70q&X(@FXZ-nYO3-mMowXUMC~Bg%Vz7u< zl0l|qQP!&L)o#^eT#$Bg8}(R=?i3GT#T+rVNn%cSZiHbE41z1}1dL7pqZhtm+s5~D z=PV$Fc9LDP$T#YGo(VXYvod(Tf8kDCrykW>ZW2>iHX58QTGoVDv>>eOD#W5fT~UlF z#QL*jEt=%0Rci7k#22}rL>ZlVl9}S}WIkQ`#z>-hTk3;=bN`wQwRI)4-{1ZEudp;I zww{6WgfR&yA~AM!@NU&UX-ob&D!u!+x(g(MpK(t zGJ3lQ=6~Aeu)PQT@aKiB5$N;6G|m& z)lV(?mu>S1MCQ)(2~7*cM5m<$O$%(?t6$|n;~!lSR=Xq$9#c)-oxf7LZN4`jTBipz zJ?GYWFiH9T;cIRE&e-8sEU6pDFqEqRTGS9*Eyw6hJ-$Ka&L3=JIVmoUAvC2s04d*p zw2CD>e^aV+S~@P$A{lB%dKcliW9I|w$sA=PozAiLvQY zkLo!AndbTebBkZeO}++gu`XXzlF4rzAARS`Eh7m0us%2jj<85pkDuZu+AOUV*5VhG z!{ttg$LYrxqQR{xoZ5YSJ)+VA9Il=4pHFCtu#whAYdng+cXu@5?pv$3-#HTW7YE~8 zowEVohhC6Ua2Hvl;rW#gw`7G|v#I3Giu=(VfUsl*R&$YS!yP5oC#1=+DZ=x;nrj;T zh-Du%v~W4YgFIqA@h@lZ23!Av_k@`UDDoRY`}7T`Xr;w!?i_Y$^-ynf+@N}_r^;1c z<#vC?%T-Uctj4rMBISxU?(_VPGxVyRxh@Rc2EblGDD-xMoS5xDHp7G4xCyZ7hTaJf znKa7-8_Y>=6d%dy-y)hN*4!Od`Q?V}bW2+c2w(XZF?V4C7WZ<5Z1SWzPh?DNAPAy^ z!gB+cTv8ZQTc~|@*VqHLCwF&Xkjc*7KLp|Kn-@q+t4RcygHH58HMb(btlN4a;8TUf zi3nE;+Iv`oD11qq7kWzH*j*tga`PT$w%X}z+(7exm{;1@$@)yGjZ=g&rTEDhrwAAK zT}4q%+|i2xczn@g{#P%n>T>}WF zXw|DY4U}g)7-tkFzQHkK)%_tng2UHnYBbZ|*Ejh3>&jl`YR4&$rqiCZ-s#dwj>YB!1rMP29%7J}#Rrz9hJ^!qRbFln+%oYfi3IUeznz=a3 zQOU!s<2K%ADc}t4$>X^RCty#*zw z#|d?vKHC2{u3fxB--YNFr4vaJ3RAH-M0A18*^>Fq!lL*wY_%<^_%z3r&}E_j)bij8 z&sAdlQv*qrJJR$`@r^szyV|vuqrG^Yfclji4d1-d2fIfMD$dx`@t=O!Be|ooWvtOj zxAv#E^+$T-vFd2D2@LD+PC)mfn@<}CIo%7JP5jLeD6AZUA7{>K*pt%uf0M!)nxJYq zFvEO^Udd6WUX6C`vg1z57`_f7OY{n5R82)I%F878q}q-}%6}UG>#LO8qFkT^Z2(eS zFTcPh66_Se&Tw4!np~#adPf2FodC!ElZjIIhY9W1A-H&8Th}HP6>3R49a)URe?CT? zT7rUaK@Fz7WlfevC}(9N+Sx;Mek}^POTx)5)Y{QG*}okm^9KL^&&d?Gy+|)mJ3##g z%}BN2vDmTgKRY!&p8-(L(DXA7rAk?KU3iHpoj89&$yrKZ}F5PKH z71QCrW+H95J)h7YWjF0S59T2KQ6L8axj%#?473kwu+xbM(@-KthmJGlU849)q`nY3 zlokZtUGC}wfb!oKQhCEsQL;rd5vx|Ak9ao{Tqq&c>p?>{&p_db%M*4l3TWmTq~^lT z#X|TIJ)hnY8mbl5X7+&$pvOm`ABp%EbH$2liI7MF)RUfC*{V6q#?|r-ql1qO7BCNx zYx5FBN!y{~zzxMY%`#_WN9u4i88-XD(wIS_Km5R+S`r;Pl?DYu1$B&RKB88pdIC1_ zyecxcI+a-}=QH99%dNp}z9<-Z$UlRt^+yT)KviK`DxC)&381xaC|2pU&ow))is+L;i(k}m&3h`0Hao~HoySnxsr@YWUe z>4*g53DI3;G>F<4TU8p7{pyB=U@X4dQ33Z6>(KJ*7Ix;_qfX-|p|m@^CQSyhp}@Fen|oN5&oj)k3PU{ShEa zOAE#eL%iF>h#}rnSr=b!gI-9aCrh=CnEfNKs>^~FmzV!Cy~3>ldFnBezq`#` zeYO^l<_-RaZOT?uCq=bP44bGK<8M7YNxIxxpL2B_!B(DTA6Kkk`n8eDk`4YEx7k*_ z$bC(>o?#m7%TSvd=ySpuoQ3{0hXBylIH=kMO1qKt`z3AnA3^Q2!F6S;4o9ABs>C7WHS?MSO zD5e#hTSdt{rxO8BZF_&~fH>lY^Yg{pWq|zP^Sqo6vPdeLi*hlL;E3*P`bV0v=b7=A zj;l!BGWS&ce|~UFAcFXieULeMn=gsfY~-1B4*4XvpL=uLZjNKJx;0!!yWTaFl*brW zYa7#T4Q&QHu7Lyiws~&B@SuZU=(7~M7wdnjSo6lk-T%sWw>-bM5}*K|Puvlc4iqzh zIYio!MzJ@e6Agsrsv#DZWV zFP0DgpWbD{r`&$WcXned6}oS40P-$;Pnn-r)<;9+1=JbE6zM|Il=MT1KLz`)?|HS2 zF-Nml=wdTIkM$Q)|IM6x&(yunS_K)0;A;W2U;Eh`?CDtnJ7`MOA}jq3-ijp)%# z9EQ0gfV+@TkmD_RwUW`Fvk&{MYp3#*%@%y)V?}hH$AC`5@i~9N(6AT{9zKUgX5{@J zeMzC*0Gl9K^bof`17@~p6+&HqF2-ByD%ii>8!T7c#oY*^W?`I^0$^2TP!~q1M7&_i zbq?Lxa9oo@BlFo~NWProc=SX6{)Rb-Od08e9&ao>D&kHYJVBmz03RVDhE)4v{saST z>tCckBBQ(6{Vn0|^8CmRB;o!rZ`g&c!@b^>?))pDg#Ys0nDYa~{%&wbgv}{4FO?18 z!;r3Zs_=-d#{4iWy*!NZhV|G#`F6dnQxo2DQZW>kcexmnF0;hOU@;Brf03ku{aTJZ z8KXQh0j}sZU*d0!tLlGPc9AR1#ZT~@I&GXsXH#29%!#V!=Uu<qu7GlrqZM`Z1Wl#T}0~++w%eLNMc0xlL3L1AK z?;R{yq9gYo1igM`)3#WsRt=b+;s(&oLfRhhRDuhp>BFp59JxHL8kf@tdM00Cx7&RJ zuL!?)$W1+UBLHN!%z?v-%+2CAA6=2x+z_;+fPlg z)fyG}wy?b4rgdf{JF8l_N@>27s!3U_NS(F|N06^oG>b4IXC8SdlIoVtv-JJYnCUs- zPpNna9k}j>>v08rKROz$g1sBgY}ITr!uf%)JDtcN`tm zQ7Hu)1{PC2sRN@#d;yBoWqA>8Xe8VLcf8-4>u&%V+*$+D-*N!>3d{P{Qo@%5DFEk0&&TU>=LJ0~ z-lb*f@(4~O`&_k`TjMO_z$jMq{>y@Uy4uQ^O0GXizZM|l($Z@SnQ=Hd%YD|JjAyrJ z!Fc{L@GT%3^7+D$OP;Ui2ZHwCoiMG^ccUa0Sz54ryv z$kNFvRG}#;R1eLI-;398%2(M3er%-x9cFpoi5?wAd^8%d%p5MQ=F1g9Fc4cZ-Y-~A zTZ@o_Um|(W4X#lz;~Vz)R&hrsZn3SLex|g!8n$d~Nn+MUupCu+Ts6$SVjV|eXm7ug zmX`MJ8-tvN7^M>8^5SG=#>seTm$l_T0J8!WU#P{ccwuC7xypD~I znyZ#~=S_0qkV4p}j~9Ej>{f8}R!D#X(+nuw$}e<3!^!8P^*4U0dh*gOyumXJ{HWvP zrPXr*(?KA5q=M(uqu?em#G6fr5*pEVjq*3ftDq6XQ6vu{Fwlo-4(TIA*}f(OHA)IQ za&u*{A)|&5I-L|gSne-XPv@-_X>KMsrEXMQD6M;n|8~kBch%8eiXVk4oA*wNPl&YQD4MGw~Qh+Wz|aulPcK!(LrZioYU{;JLd5zVu|j z|Modu>ip#F!9w~l_ijSFws20wK8)8R=I;LGwOaidc3*M~qwSLX!AC13!}U#eA9hCM zN@nSenoHiR1{wH`V1Hk09VitO=wKQ>h`H^i0z?qOvTQnu&x{#3!PeqPAkUNs4V_Sgad}{oVU7nw%eG3a-vsqFj0XioGWc*3 z@R(VqWi+eRvgm1krAiQ}Z$uc!9>0kU(WTr^IY-f)-*C$0T22YzI6ftoX;eeP*$O56 zvQzlf_=W6`pOhkNg+kZeT_NCdeB2y9-3MS|e$xJh@gWyO={-XSZi{9Wjrc~v*W`;C z_!o{ZyhNea4F6BN&3Robsn++iZsv~LMVD{OVYMY{-}}+a(izUu{FIMBqtLaYiJ&y9|5n{3Hqt1no4P3gVzp=uH7sJp zh?;%pz12)^@|M$gYQa6n5)Px1IWe_-O9^3-pG?`uS5K5a=Et(4PW|#tVi`$%vNdX$ z?@CqPrBygSot|o1y))&_t-B~qh9-8@#@)>R5Fzte`K3J&fowjyl>TDHm~m{T7eY=c zhymfKN>4v-$W?b&ptrv2N78uruRTrL`DO#HEpfcR-uH0Hlt-5ySD5XRa!dLpc6@Io zNWNL_w5QEdmDhT|G^2y~%-{wXYt{b7RDeW&_Uq@c6-7Aqrz0j)A_P3~GE%jKP4@90 zK7yR2nYOP-grs~;hl9%&IKQ6u8&E`_)G$$B4?J>)+$+k~`X3Bi>sF;a_Yk`pC+TJE zIcwx=+TW@d%IT-de47$d#e%MJJWx`aySZ5sigUV)+w6eqt*tIE^lRp|+mbkoF36A7N5z_57Bh<`|GZD&r(CqYu#nHK8^A!Q)OiaSo zm`Zz(r;Oo# z94j|x4o^Cb6Z&wIgQRC0LGm~PXLHNZ<^4}iW7*Qqp11i)h<=KRD;-}7_CseKs^3TW zOxzSmGJd6MDSiITTHmR{dnA{r>Y!Zhao}V_yZAvf>!w!YqRR4C?FYa8av> z-U#Q+W+!h~`WfB#PxA}P^)T2TIbf<))jzQV)Yb+UbcSanF*8niwu#IIfr#opV!JH0wau=AS;ASY(0# z>gXXU$Q+5Ey6D1@qLdUGbAHyi@tSG=nd}iBq1&;)$rV^ays$CmT=cNjke*^{^idd$ zsk|#oi46Suu`p#TS63{$cnQ(|I1S@#{5;3pHPPm?5-d)R-J z9ZJ@uE5I^21;_dINKT1>16u_279g)h0YU3qc)_IUuOGrlo`xg8=-3PNQzI{Yf=a}9 zqD5j$N>TzK(^KJknFQm~o!M3 zf+tZ%x?JI-Bq;%fe{sg~?eL7$v7K$99cV86meOcmKgg9@6B+iHGJa0_WPe`eNSjAr zex0x?lbF|-F(6egwpA1gn1Mh6jit#juUSPjdK_F0UF|+&1xW)&gFp=++L1Lid&b^7qSd4IlKb2<>_0e+E1&@<(*Rnqqx@YFd|(KhpSJm1sjc54*7Y4 zY9eMutJB+?sLM{x0?m6;Kl*nZCsab{e{e6%0WAThEnx?;>gY5OetYCk0ir#~IqnNC zxsRtYfN9cdF71u7f$hyO)8*PRif-E#)J{ON9VJ|Nr1G2Y3;YzO5&AfcbM(M%1L8SX zLs-P2k1rij1`EePi-e!W*5a{E7AF_ZKSqCM`3~0VnI0x#PVO%^PA_hMN=1->;*g*5 zKAx@AHr|3o7rx|GIdLv2%90<$>6!`|*>6WlMG*R*kl9YwSa``JVu7Gc+z(6jK#WB{ za1wR2({E7B)w~x`k`+M9ahzS(Is*SV8&ppj)U{CWLowr0G2X&KPDCnOzh z*wg?p!Mb3u1ea=dxn?=2@7@4%5{Z@ig9t$W7NEeERn1OA(|m=?+17Y0D{$QG;Q9`i zB1|cRx6QF-fm>PZ z*p+)MSuJ)J?=z&jj2;_GNMYhFI*85&y&S*Bk7yH)dwLLET-S*=4}zsIKXSUe7kLyH zVN;Hr$xl*z{A!_awgW(}v#ij{)_m+hoNe`*YH-|2xzZ|s-KQRZA$Z#!)!NMxdc7EW zN=VdydsKSUQokp@$C!VbpBEeZdb=h6dUrExYFLwC=aS*@b*~h6D}msvKVrezrht0{ zLorcb_K;ywk4VD(I&O=#GS**?=_2pSv=&$?FmS25>AUTTV3)fEU!OM77u+dh0-T2ew?&BBgO@OpD?Ey%`LDeP5U zDa194l*=3~VR30!deSA;YH}AT{yO!DO<|iy=#3$nXG-8=MFCjN#ov_gK)ElhEI_kNG<% zzP7pU@bX_XeT^pFdlk!F-f_1x@~w;27Haad7Mj_RIM=&L{O|d&0yWsl(Z41IFcg5r zlj@AFXtI;rQgl%2{?!^Bu~d-jsv6Elsx^cMp|E`ZO2<6 ze&^<~kUDB54cAEUM!r;v96Pg9Qhr&Zm3KFKV!0f#r71yR!LckM-hYrcN6|I@-K3co zE_5Cp+A5T2X_U4d3kWV=IF)?lLmFG!DCE2dy_On^yZbg&IAD)Sbc_?@Xn?ai%paj} z3;v3i{mvRoI%N!I285JjyM=wc=iCiTxI_ajB>{(y^O;2>dC|9niB?0p6_D2sBA8er zDuwSQMuy}}W6|)WKr-@d1-!9@A+19GtjzI>EgKJ;Y^ zbFYlzUu)Sc=~I|;P!EaSumV}KE^?;n2IM$u5}Fw6C@oX#J>UjmX1B%l3RAX7C~wx} z@~Q&9{c+GQ3SKF}UL0@S7@y)ozPUp-TmCX<%Dd-`VU%gFRX%6>q(2h9K(CT0?33%0 zKLUDL{wTUx-+T>Q)EX7zFZgV&>Qh*7PzQg%VZ}QuFe^UeN!G=iJjFfcIjy@~zSb!Y zuAL7*nQ&eyQ<@dCvtOvw`gNB~lBJF*PxY*Ne59vsc@lfPhL_Sp(LZ4Ybtmff1-ge7x$_Khk31?y&C9)Ps7j8TZI#lt^%IBP-38nya!^?H9su z<4ZLPwv+TBobzuns{=Ja*Ns=LVl7g{b~HjYn?Az8?=ZpH3?o!=`Wd2xRm%?!0r>gj z?jz7+JHyq7aKpkg`v{q| zrFNiF(+(5YH+tgXZvNp8k+i!`H&%fU1uDMa)3N4Bb?C=RDgZUc2PE*368V7ce-+ct z>#+8anPMWSU{b}E1{&Xe!aI2O9h%I~Vgff+D%P-9$Ge@klHzU6;e@arqqGBZSrvHZ z`wS|QGP+JYcx-0Ns)g`A^GTv31g;kOwRFsn63v^Acf`%={hcG@$;i}DK-( zIRb-Lc{T3mTg(gm`k&3R@+yL`^^+vGjd;-GHz_Fp_EY@(hoz^?6k}tL!cuWtS-7be zJFRT&#-@tIv^(>+S6;6Oq|Tk*Ue*wf{Ni!Nv<95yh9dTkivnzOB1iAtydSY5mJs-e z2*R^uF__ShOJwBjxIkHr7;N(K3>g`!>_%|k-7ydGC9PqK*0n=D|0V13aeZtyp?@@P zdXJEyO|VVljnmOSYkjA_O8540X5F$MVKwHGp1RVNZn*uVEUnIVMOJE#7<*dW9gWJPF+zHDQ-9=@fv?sNm0%hCftqZ_F$Tjc#*vrE5>Fk>G1rAI zgSS&O!IA*pk~yjJw$F&Qhi9n7%!fbDjO4;wKEuhxwx=yjh~FS$pYT2xiYRKZ2P`hBu#NW#i%_2KNbKzqw&R_vo$c%5%%L4B zOP-AudAOIh(}{k+hv_`t;e2t1l`F>rE5onaOnV}ZX1v+MRobn;yMFA{U++-RijcEA z!k;m`Jw%NdSICkqZ+G5U*GzkzRS0GZG}^*g_ahp7PGpvWj7ml7^SPL~Qjwq6+=8@L z>E9!w!jjbe$6tT8h4zgZ4p=S|N*)hE;Wf|r ztH~e=(4r_?(hy2T7U0HoW({zD_DD>a3u8_WJLA%dw&U_4qZ3FVl@X~YrJ zrzG>Gne41^8YSc%bB1@P=OtArim}8Uw||x9Iqejxh4YDXNj+(_=~J;e0?Q++{2~$lhhURWezFQp-x-2n&OO^aA}8VMbTCARjt%A3!b53O zvnLn+xnatf?=y?{YKz?BL?Gk#60&(;MueLu#RgWHnIaGO<;&}0cKmeDsXVIy@O@W| z7Kz^m7l-|>+~=NTQIS77^lM2J^>l{nth^5Gn4(@Euc9hZkrj?Cn=e&H7eWqs>7xfn z7Pi)=+e_P2=J8n^ytc_p6 zfnr_7!8hsD%4t3W#STQ{?dP-DU>~{?5&FN>a53&s4y(y+{Aq)zrW?IP?uFj? z{ow#cRzGHJquP*kyV*BfrKPjW`m)ne!Q{HC_VuEj%a!LVZRk&G#A6odDiS?oN+pp@ zt!{9i0-dP+D*#M&P0*-wBol77$lvl&*#S#9V>EaYR6bUQ5*=153)lE6v%={f;R3{m zZ+)@GsWtHwwR)Cs5q}!4B5HFGzxDh;AM2G9NC{S%)8qQXC>f6}6Oj_bRREa0v2c0e zQ-HFRSOp0fAxNh_v4ROak*v!ulF=48K3!`D{Qub!UL4qr;eBzWU!9bE0`Gbx!kUB5 zruWfVAa?825DT{@&mG{{1>cl?apZh;V4com3XTXX5hU-48&+lMaS2vI?p%}^cXRRk zFr=Di@zJuKpIu}5>K#KgTnetHYMf4F#Z;Kao``YZ6iaXteU+Dp0`5oei*WWf19}btqJ;>kfGg&F@(SIP9Rz7$j{q76Uj_m(9 zb>HzGwR&Bq0}FJw^}oZVXAk6!5>3|Z^`JG1_I4y&GET2F|GRwwlciUN?1_m*467Fb z>H=GH^Jp1mD?3+%`S68$1&O)H{_S&x0ZIu^wXN7Hq#$sLHSusyDue~FvHRbB`M&pA zH|xX*5Kg#+6Wax5TQy}&==V|DI>`_vW>c|W3eWtrE`;Q98d+B>84-RRF#dOllMS#! zb^!^ai%aN2?0`OaYe(2X_*C&gc336iEHv~JI@QJ|;4jjz>T8w7;Vlhp zpP2#3{ru}OS3N8@m?Un#ZkASrV{V>b8x4P7nf}v1ZsJw%;RgAplcy8bop@dT8KU4v zD^D+*ne!I#SF;TM!43L^0O=(cH${C0a`i93pazH10la(g!B?*p9%+hX-1`||H+pd2 zZ!EjLowR>`ZW;W>G`a$%Txa4V+#}PAEz?LdLNq2TqeK%DGvK(|xBsQeM?gpAuLL%G zLKP)0i=ksAF2rdM{L1ksgq9IWm($P+YkBXi5nxP@#|Z7}r|Vn>3H@OvYLiXn;O%W< zfy7GANl4$b>}c43JXc21;)F!}KK%NuyAlbJ$f2f@_L--g;VB_@iLcqW8)DyCy#2%Y zvFXj|J!G5AOHyPe>iC2IYUqfvjN!R`%hXlfx?;+s0d2Ccn9g>~quDb=6gcKl*sP<+ z`9oTNHl38l>BbLjNh(9N^Kyby{5Zsr(`Ll0rnTJ7a@py6kMeFQH-^J5S8v#-fq7R* zi;~-vZ5Qr~qxk`vu%29QwxXg~YdQd||GBa%Y3jvNLUp|#8yXuv;T#^$86*W=*nch4 z1I@^5u-8;^mPH(_bFBfv7(C2M?_;|6@|N=wyz$3H;0axY89Vcy3ZS1nmqXIh7NR$_ zXvrvq$+J6pSmR@h%L;9CiKmL5w_Z|gU$k#MmQP#mde+*$Pqk{%?5b>mc<0L` zXycxf7i=TOuANwh*T%B~zQxU-v>|iwpuMWoEMy@^;Vt1Yc5glu-`@AT_j}74w^2_S z8-o9Be7!ncHo{P+Yb*4LMtsUkKa*Zrk&O>G(3?Q9Pe8FrSGVMAqtXBO`74Qly}|68 zhE;4#ib%jiWj^~~(}@FbZ%y|2XBoHBYh2x&a~nc**NIrAJldq|2Vo`hXT5Gd9XLGJ<;uwSZNpbI*iQ6^P)JF-h>h zr!;t1;pj~D=t6=GhKBtl<@SvLP)Y z^=?i2kk%V;wd!|6FtNz33nwL3>bOl&F#c$cj?bdRKXLLQY;ipc!gfTTDFp3B6*vK;Su(Ywcuc5Ms z+52}MJYTdRWk{6f2Gar^ce%$|*;tNq#*LkuxTD!GkUy3DSFkf)`C+yK_zftm?T-^w z+WVhFwfb8*M)Mc_UBbQ-yR+PER+Y39r(OmS=PWZt>@DM@bjx)`AIoVkd1 zh65JxaoPp+5*Qd?e}_Qm1k@OsAa=s*&gcRsv*<(S(@4p3r{13YZ$>rw|DLt1_p{;1 z;L0jUIZ4^~ix4SpK5PeLYjkH?<7JHyX}7RsNbjMCy6`1*cMCCtTC?A=N=C_X!>@_U z<@#oq~NtB8#A=)ldtcUwUM-O3{S4KgV zOtgA|OQhs$$YFm3f;0YiSU-(P6m2kcI^?io;gG{th4kzk2ApqPNVf=Db&b?--Phpf zG(0@18Xl=u-GtiyN%Lwpe}4wDoyUQ*o7Ex(EZffXsygI|@t;hj7Vu)ce-Et?pn`vI zZh4FQAXW{5Blytwnh_Clw4Wk3UMZw{z}gc@E5puB5d2g$ihdV)TCR{JBM+MtdOxqV ztK(_~`F;Dae_BdU*46CB#-ss(Wg$}w?+fBizkNZKO#u#Kh`L^z3BQ_a=eY5TJwEVO zw>^fiW zl#;a@WuIAAHSxyogiTIjpbkHP`N~}-PZ<=5*tENL^5(y+07TZbJB-W(I9fub$W`25DK|osl?Z zP(s#DN&g~b?U8lrZp~i#$a-C_o<$3@f4QeHmG3<}9meK^pvVTg5e*rh;1h^`^{N-O zU~K(WI}wM(-{*#h;-}j?3dGh{>vw$lE5*0nkFc#uAt)!F_sc)t=?3%_R)wm#@0U>$ ziebewmlTDZ77irGo^#-Acjl5sF}xsR%1XP2Vavte-%KqyDNzt9BEV&_6XBd;bRRMx zYq^u>p%sX&E!Uc&J=2^neS$nQpdKD;mV+bmdz9pjx)Ze>e&JKs<7kX6}Pu19E&FFG@n(87Lw}@7E zWuvW&N_qN)&j;6?{;n${u`=DQjFry&rB# zz8~K_p0je$mtCEeOx-98@0tO&r(`cpieQR%sOloE=1AMQpJZ4IeRF*ZFboN9?oYTe0N*L zI**uUh*R99GWA^@VY00h-|x@Vih5qDi?l9Wc=;h42z?l5bHq-_c@?klL8!-FwSqas zFaM+DR_?ayYY_#hmq&8UD@$7H4jenCW(!Lw&z+I3tfZ+j<4xwVa`+K44IYNVdnqR2 zgyj7Wo}CT%o)XF*g=!3v$%FL62~`n_Z3YX686 z`p20QkHx!OQ^Z@&SvOTP3?JN`YhixLr0Eg4pFa@&$}jZPM+*7*ht?LajPiAAh7dg# z$|(!FqUy!~`RZxT&DA-=)ckl0pXgz0NJcKiHy(y(Pl)&`gfqLOFtPypWHSPt2{~`# zBH%s}xSyG(aic+A;k1_mFxB1FFY~V&PRV=L9>1TkoRTe2F`(o}a;P+sgd^6c4v%N3TtpbR3gNlvZ8PZNuq5Zp6TAN{0dCGTkX!kcT? zoY4?JUdK*+&RjW(n_VP5%BzM`qe@nTB!TWx7n0k)dsULGjltKAJ-li7(WBM0qz z>kXxXFy;EYc+<1C-h%&X+m%K@iz~C7+#UFHyPECKO#S!pafw;zOked%_QQ_% zng^zKoEpE33$g*9PR<(*Y(_!-k8vI&HSQ{NNX{H>S5{*a^(LNu0ENsN3`WtI0~mYq zky{m`42KNv!|=a4U2$@4-Ed?LI&!>eB6N@PuVZQQ8;?+>0j^{E>u+KhB~=l zN+_!QU3j&-XXsq#q7l6E&^vh@yHfNEiVkOL!=3xbvK={vIj=FCp74jk!J_wgH++k- z-rA}@wLPBCm5)oosOwv#BUk8DdB3hACWB>bDj=9`%{R5rgEBmD9|Rcgq<)`U#>e+x zxzgv@7yMYf$~;B<`#P~4thPZuWr)0!s938cbzGr`oNVn!RW_Nj>S;LL$0U#pDUi~( z$7sGyl6(K{rx-zArcUmV*ILiAO*?R#F&FVAzXq*?FmK%rp_y7=7 zDdZieW;Og+&{N)X$0&oax4GP(V$fK*vDekenAzwqK+bp=mE4JK_%L)`?yajni^r)D zr_$LG_5F65jX~f$WcAVxLzTBlx{^PV#1c$cuAvj$mAgCg`w6c1ze!dY&^hY{ntYbx z^d=d8Aw7v}!U=P6e#agD>5;7~S)Jj8>(1cm41FI@PIM$zG$Fh@@2-0;uX$C1Rm6&1 z@N3R|1Zcb>EV7rBtH1V}WhjUk-SQKkMHlu&a~n~`Glg&5vBAiHr^@(bQHdk99#1|l zr0(;$zC#24BodS4uW~;0=7F+-ALzq_jZnRbe;b(or4o+9UJT!H4YD8%GFln#be=^g zqn(A$ThU{3cN&{Vm`!4s-E+}hq}APm-J74)3X_XivZm5&Bv{VEs!^5O(ZBvucAevc z1(AaTprNq_I%r>K;W2MG9O5*X4{#VfmN0XYb;qP|FQ)!@+eS(G0#Q4tVPGMf1_tCW z=aODxNrYH%yt}*@r6GeKW5`Mw%U$j6lbJ% zTDVcH(djP@@^T%k!1KM6i1Zk6n!b4b3~c6}+fS^0QGEA9SPb`cQr=Rd8_?A;fIDCx2?fFsBKU`Pba= zh+5C6Ju+T7W3N2gcn6Tnx3Y`@mzuTxyw(e{pD@GWa&PR}LWqQFEKrK;DgF_xf*r-g zzUctl6q_0xI_Z%CZ+9-4t&(F;*|3=l*STJwxg<{ap*GjC9hpfk91#am$xj1RFT8Jb_l zso!W(e!81JjH)U0%sxLqB#$>(hym?eUoJ4n=T4xPFF1+W1n?EU_om)e^=%_k6Z;#G zPLFfu^a+|h9{JeI?NEB$8EC7lNi{Eis6^ny!hZchjMBbZxQ+H$HrfN0Dj2y*WhueS5bSgu!S(@oY@2_zo*SRIw<_b3rvP6Y)ua( zlZIL_q<@0(btENeAV1M-G*K&FO@!urQbpK?wqM{DnZl)$ zjaw*PUiWR9HhTh#PpZq+J%-N)b;$xLPC6>q4ixPy-XEiIQt8GYb=0$)(R~+jnGlqR zF;fXzDl%p|!(F0Gy^_7z_$_EI6vF8r&)CG7gRR2=~BC)_*A3O`-R2Q$#J93 zZql^T|154x_4x2+`GVpG`(_^!D4|Y7fG6PyDiu^UXaU1bKjr+!uid+b3BzDWqW-oE zKHEn&;(~v+A7G6hqBn?lSR7$C5u5lt!yWV3Ptm{J%EI0t>bn*{nS;sCDhbA6`e|m% zj(;rlMl}`R_zqSR|KzoCb;rS$@1n1BE?k=BiU{z{)*};1D5fMbMS}=@;V=|vZEsa#FiSgD9wHo09p&>$-8^W!X z5{%YX`}<8nAcJaadCyLh0_?ZfHf`_qHJKv~_ZQCn1rWW{-A&7d+J1|?xH?oTL*NmL zSI?2u!^+AO?SG|^R8DovHt-LsOQ`a|f?1e4>ahDyDykdKS!Mb&-&eRWYJ zQnYe#-W75}{57w9D8*`PA*yp`eZHiucm5ZSVlouhG|To~w-*pQ#Ky zvqy|dk~N!GHsn)mG!NhI1Mjx?MAN=PkuR+x?12d$VSA88#{dY545$bh9s3it&L>9B z3j+(Y91XG=N5Z^iBbuj;jh)9+SWk7n(;t@mk2%E`Y|0nD&8=S!M_SgEEOU7^R^GxS|>b4P}9?~?m znYU&DA(7xCk+RmlQOhTy`jT}oR%c1oT6N2oXV7k8VNcE-o~{NuqUh;$aIiQunZlYc zi_l2qn!SydB*O+KMv_MsiV0TsJjO+t0DekH;rbea|cb%g4U8!*G*l>Jw-JDCl!&KD*!D4|inABh&K|s%U zU?Qpe@`~xKn5N6zVed9KtAtzWxr}@W8~){i7p0G{gbb@n04F}sqY@Q)ppxy%GGR); z3x@<-+Ax7_RM0p@XXS4EmRgmBwr)k%{$a1h9PUVl!S`oLGrh>Lhs$8~Q34!&os#qRQZT*mrZ3DG=-c2wic4=eGIu zfG^Y~p5w90wPGjXsRc7iGuB+=Gp!=xSU~aE%GP&DI9a`(DH0<5( zvei?+<(+d~yHXnVp)8i;LyHq zUYq+Wu}|KSi8WRe!Xxp)Y9BsBn-Qxfx>xOd2LoBXNU%(Z9hvSjLeWy8TCh*UNsZ=M z$N`UrOmG`S@>iwB?kJt` zbR6_p3$Lg94&V`P3&K+zTDgA#|D{}~_X&o6I&tsnvdbgDu`|qwe5vuFup8>B9F&O& z_9S$^_}}-d1Nk~4Uv7T-fO2uI7?F31*jzqK*hW5Vb(!%VAPfZx?~zG5+EZ&(-3x9`!nJIMS3i8YA$(U3= z3{@(hMS(Q=m=9Od%K%jALalUjMI6FJxMv{PjbdJP)Lm=@p;6TV6Evt;FiCrmq`kI7N%y~HIg(`2|mxYK#=0JOL(GCb?$?`AI-G=BU;#jbD!Z z>q<2)9~=!ImEdizOH2jq7yL8^&6CTJi%A~RVYa*)a#e@Huy<6IU3_G3p~Js(d?(qJ z=D{@2tbA!vMg~k2tfy~9z_0o0=wZ3xivT26FOc+5o!1jSn6CQFa4R^yM_-wbX}c~* z>F$iZTxE*jucZskM8xi8~wR=FlN-FO_Pi1MDkJ!qI$r)i1i$nI)t+{ zzMQJyaJ_RCNGa$N?+WveUgMHr3rxDB#RV`kJ!)*1S+3mRRW-_t^<0HC`fr}sDeIpI z+%vIxs^L4I!=q}3baZaWkc|+intS@lK`!JZ@;-pYcP=tn@uLcXh`sW{hc-vdl=U{e z7m>_WAy`R*p>-f4k%x#xzF<(P{&efs*0ZTG7>B=*7LFO?j-|mxqk7enzaZczfmk9A zOa<16t+KyZoPosj1>Q3hA=Oc|C5352?I!`z&O+j`a(X02ydM2-x6~YFg>1P;1Du@n z8(2U<+=mzUX8e;Z6lYlGjdHWRh(sn4exZKAoV3J*;(H&oo3!Px=AI5$(cChNC5$KN zLY(FrjQ!;Uy9eB`3t*BcT5dR`(9aP2ghe z5Tn|&u%ps8l6of75n-~X60e~uNwB?B2IbhR-!h*=0|S+Z0DHkm;ga9Em3L1Ic{Dl0 z?co1T3H?`7i#jgP z;~_uim~&;V-iUrXHz2uEAAoAgle$kSEyV6ywe9imZiq)NCHQ8rF?AKw95QAgGl_pj z0SNxEZ^$2j^VbdOv-rY^jLWchJYF)YJ{#dux@6FPrbkK*F&v!yY~+{QjmNgZON+0f zhB;RZ83I-36s`Nwoc6UKgH_Iug{2v;11f{ZNmJFykvLw#oAW8D(mM^iodwMW>7T{j zc3t9hSooY<5|$AN&x%X8P5?}hQ=n!eTfx|brYO<+eNzaPoa!r8+Pj&|f-KoKNWqiQ z9BLPV@FJAd*-p1C06Q5(D0C_yXS&o673>4@qn7DusBWxu&e5?FAp5V24CFP0C~C^c zrzP5h1!g<54xW5g9j!ka z-mJF#v>tD=hz5wYTN$ooV~pXD!$b%F9Z2_VKbiaMWJ6e^$Y7;r`GzP9p*4ZR-#0Oy zt~-`<4(b(K`w%wjaUKm`V{=2v$0u*VA+DP106BD?EZJJn&DET>a?-EehP7Sz(roys z)4~ewEx*5g&pBI8z3_wP{h#VHjrq1PVZ~@Kz6-3v0x3o&P!TBtj-Ur}gi5CoYUWdG-U$Sp+A|${?lF)WN6!|MQP?kQ zZ18!N$mA`eL@joIPSt|Ml=k@HC84;_!0g*VY$kSv;x5<-qfnmjNqg1W`U>w=Y5RjY3=fFMdc@>Eb23cjzF%h_LI%E9+0oK@-iss

vJy^dv-+U3D=Eh(Pe!TibxrRq zWxYxTQXSRw?@0Gsc)lDI-Zy^CeIk@9$k23Bg*7lc+=T|5l5=Z)41O2-R%N8Zg%A7V zq^vjfsLW(!Zb|9mxi^LFD)Y*#l_=EjaE{xG+CO~}8Hg$rkfh73S36vL{teHexmWSc zgf}zGL}m1TJz_HU02Dr>2nEtx5}Q+33|oa)?}Y0>00H%V?I67F#y!;Qeo@%T%3clT z=pmgY!Td}C059de>ate4<>ImAp{qU?_`$i?K;JNZh}FAokz7Wpvb|5QOTM_0hiw$b z!p}-4@{a)vkucvFG#8&I%S29+8b!er<0iz0c|F*GE_ow8YFXmdOF_Lp_SFd^XRsF} z50em!9H@PC8I#jvKjMP1B8IV2fkm6`#?Ba$HSM1+4}7A5^$MaR$|)RTUtHZ@&PCWh zA+y2`A^0q%bwBia3H^#+|kbuR7UH&wtyLf)7{89^f!Na9a zSB~AFC?g6qjDteAeJHJ3TUykNttd-fLGf;Pj|g`UROst-WTVLR%w_)e(`-h8fCCyl zA6>R3T;N3kqOEy~lTY?XE*UxW2TYBV^dzGu27H^ufeS=zQvUUIW{j;k+_4myh&Iw} z$f<5)e6SYd7Rc@@OB0}1*&|?AhV-gUG*C1dqY$ zkn&DS$f0`5tZj9;WE#>s#`^0}_^oX4vw!JPrU0CYkJ?1OC#C*Gf#xRyu6*r7w=v#F z%CkuL7SzGz0c73!f?7nvZen=bYF(%*g)zjbxUBOeN*x5`#4_JDp74vXMojJTRW8hJ z${IvJW0s5Ms5FS5TC+-Fk~@t#IC!$b?kqj2Dy_63B%0kh+I1$pFzV;@tSVVx97h(% znjEmIG?0{tJEr4un4M9kS#H{IPw{zFL@J@^;PURRvPV$u6Th1tvC}ly>s4__Qf8tp z*}?s26f(n<*A8M4{!VB3-;&bVeSMkpk8<^<95F`aCz^ODEv7r_9*!}uB3ZQ_B`uJD zI>a3Dd3@nHALAD0R&dR{@29^@BGzWYz26Irq2HTx>(Eq@Fz{HN+cj%|uk-K_LZFBK zj_EEH7P|C=Cr#>YiW-LA2)X0YXzNJWX&g^ScJf>m{4GTQmVXmklPI9p-O5HY-W?9 zWHq+-bix$8#H)s{v>Ym%X1WZbPZ>*G!FOQJbQaw}{o6w+hpoO`1$!uJCMYNr@OPb^ z-Z0wQIlnQog?t8hOG6_x7viz}PlyoF7+yWf#-~{iA5SCOQeLOMFRMSKi`2u;Ra;YI z)k!IoXSn9@c#FY_=fItnNT*;-p~nH1Hy>SpoSjmFZ+Ijq9pJ|otx-+m?5h2NL7`dr zS&e|jBmQd;Pq#eIk{}JGuTfkcx*umBRhr@BUj3-o$loPKRXOatV}hdCvIF5m@+6&> zm_)~4i?^J!kvk>nz2XjH9?Q0oilU=Vjcws1Y&tShxE6YagHh)7T93Bnez#$Es;&hz zYiR1*L9GxFrT{QCKeM^Xs;=<)YVXLr_^|`{MUM+y6n$J!mY>$9U$|+HmUjmpXOyEY z}|RM%;+ zVnn)M;rzK#v<;xFR*tVKbmfLZ^pxQKkD-_Flp5Ww=h7Y-N=BKfu0^jvz{?dHa?XGs zSRw{f_S?b6adOKAuEo_D?ojfqCiF=~NgQazy$?6V6n2T=47E_nZ+0!7WvclU<`}5C zsIlRq7aIx!{EfLKRk~~+IU||z0&@}lXybfxRz8}$uG@5T43DYjjbU|HxfV95Fk{$D zrLev-G-_UxM$s-I1u{P5pm3^d?vgN|J?U+jPwspg!CqFWWo{mO{w(4?jW3IJ``5r- z?DP(4YlAv<@7!WMRb{1I9K-m*k7OvsbhXX*A7_B(0hNva-svB1!-1DSVis_Dv zt$j92e0Jgtnz1Xv-KPQJnybm7oVf4PlS(siuj~7o638COk7z5j>t9boMbvlLHQ9D6uES7_jGRzV)*f-5gH@S90J`IxQlPC&|y`1(IT!KD<&%{2~ zSSPQG=oWc!sSMjurI}8QB0NeGYbbH?elY2U#1W*-s#bCKvNVbM3rtxpCIxhlNVX$N zE}3_^>7wg_`4 zbyt90pDhQ2qOn6%B8U3Tv`XidFXbe!_*FTs6J+=ZuXebedK{GSBCo)1@kj5<5~LcH zKiN!w6moQa?uaob^X64aO(0dqCuR4mc+MXT)4~yMT&mWQ{PY%QZGAX`UGrqmrauf; z(!4_)R1|zc?n8nl4l}6eLNY9N*y(qrC>WLs0Gf-9>U>|)4?{j=>?7+#t5*>tyz3Ou zoybG>Epu{Sf7gN$l)CYOxQ?Vve)XN|y{-PXGV&Kv;|Xmj1s^pA;O#0XL^N`^>Fm+O@>tqcl z1el@xeb7?$CQ`)hMzPSvh0vfyN?lfZoLG}_mv~GDZ}6GU{z~6K{2!KJAs(s5g}KmgbLdvqRzhN#j`!LJOlJfsFM##f18c zM%^8R9)<~e6NY|E__wG3r@wd5s9vDNF#J35s>1NNpZGyR>DU;(v1Md{9Ob2;?_t1T zfawvTAR}VGM6me`mW~Pr3hLoMy?}q;K_mHt(8CFDN6Xc=VJHSy27@8M`xntf07y2R X`ffCraJ+l1A3#yz6!6$V5UT$Jo1Ujo delta 33444 zcmY&;1yEc~(>3lM+${umcXtTx?(PyGaFO61T!Xv21lQmMmqmkXAh`XICvScASFzmM z+Nqu1?$f7x&U9@SL{B~hpd<$gg$V`*1_!q9w4w$pqF@s6`mXl%h4%U~b2L?QaddKJ zGInxe{A6#Z5F>yH!Gb3KGUD9PEYc%tB0Qy1Q-|t9z!YaDRwwG$$|AMc089O@XjOaRI~=kl*uEfWzs}c%GES;i%bxNt;^VXi_JWKi9iRZ zchUVDJ?vOi-m(A_@uy$AF@$u0F&H%OCwWrVz{w>r#k&m1gnG)GPD7P#ZVOYE9TSQ` zq2-k3QvSn)Sa57pra#^WFLeI$TNv0V*z*TJyqJiI+lw1=dEQfh2umg^)l#mT1MS7T za{w^36b}k7B=LElgW(R~%*_X6y+!!J(|HXXHUt~$oq(3-2}7TsRk5H)u>apP^>7ef zFc@z!yPc`JQ^Q3?yyf-;cRMp&}{p z^jxEKdtB&@Yo!m>@VfvpNoRXIpPA!a2mj}GA0^#N%=V`a{zIV~$5RwkpZAx*h15+3 zA0gBvo%DWb*5iLeuD6^@YLH`GD=EOi3YV+qr&?mVub~>}=Wi*S9T>d;iNN?&da1T+brPAt{FO$(KcOfxAaadp|ftY};m zUyK~i$nS^``_AM?p11 z)T^8Np+09%!sWb+j%rx2JGeW52PSR(?Kgt z)E1mvU-rIwOI4h0-|h^P;~Bhcfov0T^J7T-Y@u9JT2qpr=g05_POiuAu(Jh-ApPjm zDH2+mnnv7YDSXIcFJghkGr`s4(REzc-s$FIRU1ON6g>ku-_O7$$g<^L7^igZYX18N z1CkpZgQL1w;8BJ+23Q$A21WZJg7_a6whci1KzW^K#?|I+XnTHD$laE{M#{~eqSwly zc=Y*q?5)o8JZy2pTXYP+z%Sp3db2vI$CG%nIBB}VCv7e*r9Ua=+>7;obXVTg<~TBR zDoJl>3m|g@bpwa$>TALaMCRjZ)1zDsZNbfkKU19^pH5QfjliGQJ`49zGn2$oAAS~w z?wNzl92)!FE!NZJ33@zS+`A#ZeS|*0i=ErMJ&sV>kAQ$?m=HSC+n-T4-NE^>v<>$8 z`TKq5w=DGYyN^g^JWl=tcY9gsQVQb~IlJ9^lYjpMLXbQ3{*x)M-%*jH8Fx-cSwTwX z43|~jXA5h#juK5m$c~ekLLx5w`2A<)Nrq(``l%nPM+)KRG>~T27{&ow|SP zyDHKKKAp}euB>|N9uo@rdfgS@`!=stH9Hb^Jr>>8O-#hLA;<+{V=;y76 zE1=`^=Iv75Jzj|4wT}7n43W_1ox9D;tV^Qj^0QAxLA$r0k(>6br=ZKw@V(GTOAv{> zi9nTM@^tg_prRfTEaVUilTeiYT4n2tk zs!iV20=?4UAyIstPZvRyt8FwH!u0lmZ-3R%ZYKA8)Yy{Ar|DA1cK8h;bV+S5=0SJh zNk0a&uQ_cnp1RspX?=~kq{>!&`|$d3RLNIl-5|wY1j|rO6fP|iZ;R)%r)SDpU0?If zkzE(xam04>(&@8edeIW7N4)-8E75vg_2GGaKbkkMPx&;K)>B(|@4V9cNk#MaIQR)i zT5BG{jVdZ6GlX993nopTI4vb>CdB|i15c5Ro>s`HdWgB=04v;!fPoP@^&5tzm!N-d z19?qWZyWi!ck;VP^B+0KoH6eJl=x-BPhM5VXptivH6@CIbtK|j2`l0L$Nj*m0Ux^S zGQ8UF;M7IMS&brsU|IB?GNl#06Mac?QVR6Ac;Q|ZJx&Z!3H1F%QJxsrf^T+!eh0gP zGPV?pg?v#O+~0KpU$7`CQF2WwE%@zg5>lC7o;9|r2RIB^bKIz;pT-up5vacF7U$$s zn2h5%bkfrGdT~IZ*PnIK7P7|ClJJ&m;aQ*hdrwyytsuatfppZgQB!bIS$EkWYfd9| zyxNEs!=wfrV(Z3FS(;lF3Y(|AFCTAmGjx(AGu`Y`+ySKQV3Fd+$IZ8n6Dov83t)BDFo!o zg*B=2WQUcc3!E~^hz#&BD5I4|wwWi)a`K|uOI(?_0fcMg@DYYYGYLM)+egge6{!UYm zwIHIFl^I4;E*qtY9PXI4h8ei_t1EfULl$@9P(cZV(|EzhuHGhf$}I!O3tvEA36TYh zQaWrc9gmqxnvNa<1&oUoFr`UfN{^7cacZ{hcw|DUXykltNvulPU{MSdLj3T1ev9_Q z?{5@X<}Z0^ziY;kLTX7BEO(3ek8a&K4*isN5Wtb?R*cjY>~YEjee})TJ8)wMyoz^i zheRql(oCV$8G4t;wA6@3wc>2~ZzOIC_%yb=7N0Gq3T?eQ<^W-L!`YF~LG-7b@iRWm z`vSOsh^4i4pm|xa3R%=6$kdfi1bDEeP4M&MLY*frYK)*gy-{I0VE-9;6UVY9CWv_U zX5`uLZ`(5+#Ydz&OQ9a(TqO))kR8RORk7-@mP)Y=P6h_r?>ZD3l5ygWy0g~`;r3OY zS9+NNct)Czv&?EvECfm zl!R+3dVsBh35%diY)WZHg*J_f`U7$-vKMqjo?|F7f}n28Qwqr+ikKF}aT9ukO>i z=ov+7s}IlRyN-W^t;X3sApTmo^aB>O>UBG_{&Icdd%b@27;4rmG=l7HE_Z*1L3Dq% za8>=>er)$bD|heV`EveAt@+}4^TB0xzt214Ot1wxED%Oq1TrwOP(3FSV=E9A5Jf8> z$wxb=ViOUii4i9@S62K}k0q`MnU@3p@27B(at``0S{e(#{uFcJ?4RGdzWY3H6`gV0 z3)RjnU)78U$D6>k1;1cEIe?2G&$K|R-AGi*?_q=DO=qU2-k(kzbZC>rJT&s=*k$n) z7qqJ%i1R~I5UV6>fEO16s@bv<=#3wnW4y5_egunZ4JczeV|l`RS%^(DnFR{Z8srD_#F5Ed|o)wiOkFjEri)=(4*6)p8IKNTgdN41}LLJecb5#ALHsElKKnXp2A~)e|XluO=!l}yh|wl z15?#3jfi{*^ceIW!nGc&TC%wJv{Z$-cG_r$ZH*i=Y7rC``%L5Sf*Mfq@vPX&rIS$5!9eW ztP)Db!XsnT+l}*jurE)qEYrtdDD?1fG;egd16*<#cIVyuAME8IP2yjcik3eHw~zlO zhuT~R*X&-;OT&7BKI()khVg&--7>M3)X%hRKa;h(C+)|LL|p953oQ*FN=k)9J30l4 zpc{gU2Lr2&cQ_yOQ!##kJ)bffDRA2jAr2EJ=|3YdO|3T1>$`*BjG*B!e0k&ttUtn)gpeegg+8VHh#llDoVqSx_(QU0eMxMd9i8?w1Xky%z4#np_Hs{Ozmls`n`LCVK1WLBcowQmdnI8`=R5K+P%Qqg#%y z{q%P3^&Krd%E*FG5|QUatmnmM&j$Dl{Y#^^<8 z%|7>Ric(+%J#xa_*(+(Apmt@M%NBT{=c);%gt6k~q?XEak+bxac6OlmRdGT6T@)a@ zrPAgY#`4JdOn+++FaUpaa}Yj15udU~wh>PRYfZvt;+tcEqxB~RiHI2uE}Il*@Xgm5 zR9KDrD@H0QQmgG0lU3TiTYzm`-Myl?#qIBeU4=N?$H~TefH~^yRyAGUSw|qM19gUS zo_IPG!3RBZ!Q45%8TXQfLq5u!OC5EId0<<*QbrboMrV}{s4#|;R$-!6GY64?mW?QzQt8{n?qh|E1&#BN6%MuRI5cAbu>kt@f4V+ zQxe4+)T64pXRw8dh@Oy%g(d}eU9n$PK#b`Pu4QF)U8gddr*{-ihW>iXiYBRq;1*~1 zNx3$S%PT%UGf12|wQlF1QdaHk{&G69Z<+vwCmVR!PC0X<;lU;qs&{)0fUyO*`^XA0 zEbls{lLwfFz@^A{T}$ZnPv}X3T=-C6$+!Pj^}cA4!QYkvQK+R7-`02Y1_229Yn0-? zJ47M{1+Sr-&xpE;IC~YNRk+;hVhW(faf=V{V)d9v1%YeO14$eRi)v z0*zqS!+d={q>T|GgCIZ(CKXf>#iw-xot^Gn4e@U0;=C#IlzVnG++NYzGXX_>mL;qt zXavIt?W)D7)^BMrY>!-w9hh_jSVvqio#+wcL)a4);~;{hac{XT-AlI=+dWfCPs zz8+l7zWs44FL(!@CkL?WwWBrlZB4_w7>iEfzQdp*8S|_GZzTcEJ|}zX;&Qd>$$Etf z3p@ih79*>9Z~EuNy*b}pYfI?7t1*kzE}?~-$?|8>=%1|U^8n-gw+`-0Yrb)oPxxR3 zSFo#iU1#I6M?vm}8vzZ^%I1y=9!W!$*DcxL#7iJ+>hMbKT@z2NmgC74rQ=8*(R0sVvFTyro@f9xyzr&DcNWqc{PS4kPhmNU-g9u>qWr;Y&xjN#;KF6oSAQ?Wah*| z-Av5i_S93Sj@s}lA~$Hs^~FnxtnB{q8tJZ+!)U(2@vx-q zp{T2a7BZU)UiZ^XlvOiOZxd8@?`!x?vB{;vp?IbtVlb`WUmZ1}A(=OO!|uI8%{|y; z+dWuNIqG?1IVxdgK}VbB-SWA~83~teW6FWIsa=_t~j*%kgH;EMqnsyE&l67?V9q ztmiqPjX*e`Hqs#`l~g&RI@P7vzOK1t9>zvq8TiI!Ah)IH-brTsxc6^rNBwZYUOhE) zxH2BA8cuu))cE}nUzK=x3G7LN&8h3pPJ$)>SuHK9YF5K2&IX#sFwV?pM-Y1wj6#~* zal>@l0sk*KL0O}N75t>%21XzO1}djSaM;>W0;t>yn}@i=#1V1Soz{hLk}`>92AIuv z>Em(l?%2n_k==}2I+$r>X8Ussv~mi0Z%Yhp1Dq)qM>MTGtJ)cIbDLqr*C9=liMEI5 zI1qVfIdzo8e?X#z!`+5qCNc2^dO6(4c(Ly}k5fkT;KDlpm5as_mVLfE`YBI-k6^u1Aif=iP8mrKjc z>Uk)wm{$=nV*Xw{)Tiu4US>oz$s`G8!U@*PR!RGBpRy?!(o97R<)PGqDqSN$xjKZy zMqS4g8>Ue|=w20Y|Kc2GJKq8WP9fip`)%OnaDc*8k|`u}rx>r}e4*b_u>R*HRKd3& zjejmNcOmO0q0GLCn9J}Vv;AV>lubk+Jc^E?WieqBahr}XqatF}qk%LO4JpEb_hNL9fq zEZry=&XfdK`{zm_b=AJhq%MGa$+BD{kXzDwh~qn{!L`(j0v_`gAKek+yst==x$ndE z&u_(&j@Ru&p^(cRTt)eU+#S$Re)a=IYY-4!8UczlX0_xaaSVZGVOx4+xzb_e$>?~l zcvG`7O>UznpAg|51K&E%HCCA0_d!3+eZCK%B7Zz!$j--ev=+E@wgOaF=Ue>`>0PQ$ zEa+5FhTJ7vp7WkrbDAW4sdmOi^2$aX{-d>(k+<^)GOiW!E}xrfLE9){ z9=X@B@A2hJG5q)r1!r!=4m1e za-97Gxj9xmcL@vG^TVX96Njv`vBuJp)BIaF{$bOSI7s&$YCGR>+7sbr;>0nJ4$luy z!E=oa)fuKr{Ge_8xbZQv24at&Fu(lmuD=ZzQ4QmLwAg8fANEYJbshX@qH1*g34(Ps zrw*Vb4&fVD>vyUDVJMAY27v%iWI;WVFMYv1lHV=B2>Z6?@A=g(BF4DoAZP3_#ePI{ zuz_=jFa3mXC77rdWc(cptL$AZ=Gf#e`or&zW#W(W2}g8*?`p|jyOh|Vk;{2Q)i;LAc@TRsE!DD-fHms(63anddyL~o*jN$|E^#_BzKvs_ z8*11nXymImt{sh-{EYOC??qr*G%wayucEk(zykhpB+4B(xVWDGoo3NYaqSL8JYadg z6eA6jJ>Gg+Mtj|45jW?zI!9fwR0{`rlu79aUE`{L8@Oi2swyZiqww4)t2awYNJk#F ze5h{e`XB~a?$p0>`+no+>njV$z=fuHlzQ+U+w$%WcL`l`F$pq!nxgR#OX_5;9cx^C z>Je*B(oe|$D8O#ef58pnd|4C5j8hEdNwq_TXQ}+*YP*BZNlItPt3)j0-h-j+$HuUj zPVvmCg$uv=)N~l=BBravrNal6p8t1XrM8UXQ_nEnFq^rKmSm zwQ^=)?+YBiO+B&5pf7kfb+fa5{yGyUyh@<v%6``679xCI`)mq@@cEbGRw2v3E((1hT!~q+L$UOI}HU{ zWciBwsF!s7=-;%f^Pg&}Ea@W?wpyVzN+>LP7Y}aUAU1_NAd*Qw;96xRiTq*P4GwMj z|KONo&kNpgLT8E}dQMot3HgpBt6}8(+IrhkO4t@}q)Xqgxpv3Jo!?KDb>-&PO&1Ia zR#t$+9$GxQme!e`xGtZC9`Ov`sug%WJ!%V)A5L0Q=xc$`QN5gck~x4ayr$Zm9GJ$8 z3oRl=MW&TI+{|Ur4nmL%_fB>V%lnmJGV0X9~+(+&tM~&A#ScDQ2YbcuE2=E~B&Wvau{J*wMD54-)dj%^aN(t74^_TTsM%+iMEirAT$LofY{yB!Vc zSvz0*$v--SH^yClju>r6B%QX;HHz*_CBl9=y7O&4`Iu~p3Z(IVu1oU$A?kHuyg>mH_|hRrw~SxB8smT}O1L82J}O{rE{l6AeDt%MA5)o@GZ+Ra$1G z9DEz%9ks(2g%+=Tu{b+>{N&IsczRuO(^_uWE3B6s&_Z8Ap9Y)4paK$M{AARmM;*6G z7Po;*@jiUm8UJuC!Zk4DZOz{eLCi!!qjm63+JGV6%$L&YJizP8U45yGzsRPV1mC^I zOTSU1JX-5`f+<@jgUXnCFt8z1A_tV}zAx_H4%wWHsvezz?_YZ~mFpaT8df>OFP!bs zy>pW>RKd^issLo97yB-(KF)xJ;&JM?*ZZ=>6`7MNAkxb1=2|;NTQl-?8jIbKETCzsKM1)y@ zA2YXvw$;~Um1OdsFP!L#n3}Dpg(jY=P~ztQ$2e-q3jQPa|1nPOJEp88zd0*&&l|^^ zDJ$ES9tYhau^#>Re=IBkpQK|?s@xavX5S{|hwWTEV5Wp|&5aJMeIdt`>YbU8MZHV; zE2Qjf9Na${?&9dug(?V-e2pLFjK`QLfa6g~`(Y@&4IzW2oVdr&R70k!YUw@g&`Oj6 z)~faBWq1mn%uE-JFz?$_Rj52FK03`;xJUHP??aGN;NT@`KL!- z1~DrdMk)UU^*F*;lRX<@7>u%i#RE7oL&_bYB31J>&urvSLPP!#kduj(r;F3g) zc48r`n%6&C1dG0bUM($1XxRQ?UApKVdD~9Q--`MT@yH67S{7P|Qy=mV=CprGU~LARbLf3PAt3S<|M8R{jwLY z)zK4UUpq;OUxGgEocao$eZO#YRYMQ_8%ou4TsMp}LtC#2*bF16BU4YusYBdebTFO} z*k%e9XTYshm9&As2c06e5Ki-VQ$?MuWgj9q;=N}M1l1^u57yPN$AEBY+yb0>fB?h5>p5Yxvq;?3e zNf)5NU>GoVT;=cslW?FdG76!7HOthF$}_770_ZLJ7YPM(B)btRe+6Ij&nBv^dIUE% zsUy}p(VQXKxPJ)MwZY9Aj@f7;>+!A7Gru6`D<+rs{#tc^c6k1?HKDG(c$2OMp!R| zdy_jwEKc>C2gJkN_~<1f1|`bKZHm_P*RTWP{@rirI}$*`OT82B?POin2nlLZ)n+OY z1s$km*8!|&Eg3lNpyzeVRT>B{lKHOy zKY+n9XzaMv;g~txtVo|MPc}?gn$7E!9V+ey`k&wpXZmT~3S#ZGSgMC?Fs(FE9Dawq z8cRFH;z}z(n4YWBK0t^Q3XJyQBcze&EPYT2floZRW6k<0vay zL`r83QbLt@ShDzD8p8QYg4!Vc}jJd_lh?nsu_kzJVo0TS%C{nPscIq-xic*Xj*%)pfQ5ct?(~>MiQtY}g-< zYb>IVl1kWO?W?g4aF5p`;T=LxBOP(I{A6+qe_z;&g#2eK$~-RbpJNC{O{tfyAR^{p z9aGEiKQ+*lZ&-bNG+0wT1JbEkaJ#UtUyI4k2Bbne%6-n*gQ^`f+-xj%J~qOq$)G+& z&rk_}o(BL1n8p5zTl&|lE;k0jqlWOICzuoU&b9Kfv=$DC+C{j26A^PfuNp1H?_`iA zr1-nb_`T$!JL!J)1wtr#av=s1q}c!KYDfl+YNw&JDypN(AA1Zvii6MeVrNL$D(}}P z6)9wdG$Cas>*R@0MnM@Fx?V5mPj@&Db^yNbQ&v&F5XdA0j?(xk#n_)?Otv@B-B5ht zYmK7q@WREohbMOxo9Adizyz2{T~1vTe`-bH&$wK9wDB3jaB^g&G|6r=^srU0O$xMx zf37(~GG$(}f{=f8O(ahF!bwlFi^-HVq@UTl<({Gxk3I8?M%&KDmqN!?fC6x5>dk;C z&|O!g{0R0(;eGCXKcL1W-L#W=ZUVcIw_H;vO( zvbu|1HprU-aMn3PcsEP8eMB=@R)tliXm6mpY|ysA&U%k{D>j4O)c{i^yYl-&!uEI# z30foQZq8A$z*~QjM!-dYXli+XrfQQwx69zA5V~uj@`G;cGsHG}eFSL{??&x!f|-g` z+SkDTag%SXrFVB??jQFAHcNy)uUa^|bD2IdB~d)k@P6heoa<;WMh{X(?ag_E0CNew zhyc-U{4aD?ZR0UnAV4J>TUok~6b>YSj0W?+1i3Obni~FidY8Y38WaXaTzPM?euEm)-}$Kfq$8CVUt$1#7Y{%ieGX-N8tU4#ht zIaC2W(=j(;>j_GF#zUeywNDjA5N(Px($Pb_5I;_Hktm%`*;?9?-5bjpGM*5NCcn>x zcE!}t0w@=Gki_uS>c6$UlwUiGXEy`PrZTts(Y4%YZ;JX@X+h%k^vUu7zZ5$6qbZN~ zD1n63KHVy!@H^t>(mV8GY9(mlEjiS3khzA97ztxMlmj9)nEy_uG|}L4tt1kE zGQN_~6Pe0F+E7AhaCmy>cg|Nr$YuM40zo`*)+i;RLY$Vt?635A+Zb2m!`))dvpQP& zIe%=ZV|tTm?sb&Qe8>{zh)Wmh3uEd{QV`s0n<>L~UqrNcm zlxMpWLz@DPZ=muNZ&T+Zlnq$`)Tux0>{)L;M$0RWe1?FysR(WWS&Pkul%FoZx(l;* z89K&~)q(PtHl$wK4^IFN4f}TA2?PD+5TbW5;d)AMvq$TxuINQ=bC_l9!t5G65kda@ zu4u3F1b$I(+J3IC!_XHIa-6pzAC65HamE|S0>5{}ajc#Y@2=}xn<%iw6gJG5# zDw{(N%YL(3JP%lBNv)qU4U-?TVh=56^bpa+Z4)`cKXJ0q0Yk4sYftsgCxw+GUt1V? zp>YEDmZQco+~tb11*w7uHLHhD-^v7*u{c}RtSOHAoSEFgVH3_(QgU8iG#t=fd0~fN zmfyK^zdl@CmUzBIsO5^sAP}ZJ_!USONCc?VpK{FlvMO_1&c4ldLH+_n-mdTVaQj|d zgj5ebQ2+o>m3xR(W+yty~?tyec0usz=C7D-VK%)IvGAT&DRDr>R3F+-mru~ zUQJY&IEMd88v>?_Ca0kqPit(XJEu@<+d?DS9^maShD+-uNEB7bVrVV;rhHniV4{|h z`1k5g6{eKq72j%3ie`9A4ueST2ntOtF-{3biMNADZ}~SSZhf6J&hg%?M+5|$6CBsF zFe11>O?pXUhUWE$=jI%G$=}+n3qK^M&#ViJrU!j#P$$e^CKlDX=^pD23&@Y|Iw+42 z*Z4v$R~Y4jy}g))5EAr-{a=F$5Qs^;3XL4yaJ{v5W$vo4>CzOz{fcd-d4KVHaeZiOTE$86o^2VBw7(|+tOj0VzwUssXV@#kqY9j9+ zDOryVR{SM1Nehw6iUd84mlLZ^mRNQgbbRTcEOW4j@*Q=1ABiFPOhH)k4an1~4o=F5 zw3R);LZbUG?W9EvaWs{oJ6}fk)yhhmckQz?#UbsH;yGYR>5htpAV!&EM?i!#kHmWk z<+E$3-1xf^7J3m6#;<%AW+nVbc3#nBeRoi1EnQKU9q6Bf1#hr)6v(fqfBgK?+0Mha z73}EA8&h$Qj(Rk}>M>Qe-MFm>4v6=|>Ujf4mKx%OZ+^|fXj#8ke&H{B(r`FlU1(b! zJa`s444Hfzx{m|O zME-v!K}YrU-$A9mnpCXS{SKj#%s|m~AzpWL0;Wum0=%mnXk+*AT*5X#u_0K5XJ;1E zH>WflSK2*U8e7q3Y`?e^@^xRy1Dil+XXK$D&BCUKX*~x27`%|XrQK@xI$e8v$ls~TtA>QJ%pz^|dX~9HTjuOw zVx;b%w&LyM4Z8z$v{Y{;R z52E$y1=*{;Vp+Mw55~#bc~|5cA*38ZG#dlkzh7w zM)xC5{t`E-9Wi4(xYms^8aPN^aVC!&fq9z|%oj}ky`kxE0mG1YiKUV~7x^F`r2VubCvEVh; zN){RF)+`H@!V9!oGD|Dr1*bVHtCuSJ+!-R~C9~wtTBn7rA%NYQbEe7iMe+sVKW&uj z*U-l7Zz%4@uBd6Fjp38L%;Zg>dT$wxEXI?jths!Fy%*5ZXVvyx=fmYij!WlNMl~sI zjxk6krJ#_aN!msGuiPLQs2W&3)UK5=1fy4FyFUSP5lh#~<3eCHOZb}<2*kNM2`*e> zik2HA@&&+GORj~@ZK6qy|1lULFQ`E&N|@)eVpxB~#Mm<9DEtNgUv95QiIi-^quBs> zU6Jd0Raop*Y=d9qfqa{hDGUC^TH1m~i$>mL=s+oZ%|KnwzKHYouRfG8zj9&u(foAN z|0>yG)w{VvD=Hm={RfJqU_?P+>?QPoDG8Wi|_+4#80wecjehGkb-_Cl@MhK7Z|?=gHWtC$iCxIz}#*3jkj6d;hpv0ld(+ z$Lko<*Z zf&|KEgqa35z*EK@x$5(J-as^Gb)E)ta|rY{XHQ=B@#)u%jmh4(s z$fisZR`KX297UxO^_UTR+wrPKl`o1u;4H6`nSZscYgQP@m=E3lPv&~2Opvtu77FPD z89Q)46zF0`v86}F)3eOe`RmMwmqf6dv1S3pGVzWN(fX0f&Dx56ELS$wA-nng>C&qx z@);?ioUZas4D&|*B0HQQO5&bMz+hh`Lei=it{??=6%7cr*6@BUzv3y@hWkYy1olv=y0mJCu@_9S&#q?v+7fWOn) z?o}**T=>B|j+wUc_tMMG=WF1dm!NZ*qeejEjg`+7B~XHZ_MKTaRsp!i0A*B8s^GAvs1S zj3u)s)&Cu_3JiMyu*CsyxM?}ITIxHaL&|J(-ZF=Eh*H2Vd=}jpjUN)gwfkHKvMTd& z<>mJB`8erUB$5EjX~z{0Q5Ac@jtidG3F#2AVANkx@;WRVoJx3AsS(GO6M^@gM#v>C z0&LmIpdGxBF!8KcP%_kY~tKc;7~TuaI=9UDxdsyBFo4in^U6& z5h;NSy=IZIzxFVD79C)aD*d0D0oG^&k>eqa_wfey+k`6hu&&TOh8P@>|Qp z9AXUr&Z zR*eYUjM}PZ!`*~o*ytiGJGe=@a2Z5j*syq_At`nKMGAiiH&0z&xZ!?8+Mv@L1L^s* z@DBe$k)3FggJVyZX(U+B6uA3E=xK!!^<7~xREt%Q6ftJJIvw6f=diQ z<&;!M6^GUqZ&dqv-8EMO(;q(7udO}W`&M_}*=PxM$Q}$+pT(gUH^0Q`xjj8e*@PN3 z96oH9IB;iv7_L|$m4~`=kJb{{P;v&078|HL1=Ta-5$IXIz=leZm&xgz&70)>bj*Z- zCVxE}LwAXcM})m96JfUK(|TAow%6a-e>jdR$eun+329l3VkBt)Wc=#IZxwn!qg)h9 z@@(l_fzCpSx&&apb@=_N9Q^D?6lP3!Q$U@+ERe8zi|us zCzQ~Bgh><1KBaO$A&5);^Yi^2uA7>?f6V=8%|Ye3MoiXwH=|$fA`Hc8<9@Trjq0ZF zxI8;a7QkfS{)h=jxOLl~`wUcI(!BXRlYEXdu6i6dc&WUA9pO^Bh*&msUuNI9S=$nZ zsiO;4l0!IsHaoHJJ@ERZojQ=D{o3{<8s8rvig}3%9}K-^oEq|FQ;o(l&G@a-={Nck@7Mi#JNPwY54aox+O-oxTVU5$5a5$71oE28mShLp}Bu(6u3AUbeQNHxhM^b23r%?={2Li(qAS`K?V{}UM{&Zt_9xqgxw^B zIN878;)>x$8Iz3yj)u0#kO*mg1fN5L>#l<1(2e+e6<^X9P6kZ|?ea{!kcm4txBe6Jve4?|rnjteH5%CCnz zK>pqSsz-I4C0UJ&Bt5>Gz62FX4Z56)jeFL_&JPObmHwgl+CrWJ@ z-qj?Vley|3O6%%a8`!d3CLa|I7;_5vIX3ONw!^{ca~5y9prf_hQKEhODodTFf{EGc zfld!WDV~`}|I0buQXU3<>KLp?PD`gpWh>G9^@_I>pzreSh`dF_Yu1fiVJ{Ml$jB=J zAxmk%Ez`9VJm(#`7^Z|2R8M+ZO0|~@)({ByUk9Ot{~VooR=^t7zsT=mtXPg7JduE8 zR2RZQ!@P?0HKI9x5eD)pzV?e4VDA@oh|HYhDV-v2s;ptcO&dmV_X4ts+?a5-c4| zF2()<6P_MZw$;yD3}l6n#`Ylj>f5D&2I{}Q^)U6He)VleR&iX!%CX~kX+AaoPOtOB zO5AaodVYyp<#nQbl-CEGScffffvt)Oz+3rDY}FPKx%3ZS^KKI{nh=r89V~m01+>!U zAyWnW!g4K)C`0qM+J4;0^~BQ`AFKmj2)L}?pLOv$Y@=G~DiVm8gJg5#-%|4v%`pb> zVp!ub=vDU$9A1s0@ZX?$GindcbaCd@D863*vE-}61aG^1895z?BHdt14q&kdGGh*g z51-m${oGQfF*>zw(oJ{oi7urubiAp{eWII+=U@tdrJw&4zZsu(ZfnNoncHDb5}4j4 zs$>W^y;;*3PgD``Sj{tCu}@Uo4xdH*-Ny?)9EL(PT#C}R{R}f%Q9%2aH&li=j$9a$ zZ9Mfrep8yl$!QY{nuI-Ycv{DTCTUN(-|(|ym>lHD<~oU_ECGj6yCEIV9QlcOKpP+0RAZd(?e%NI|OTscl} zlg2cj81=^+gu@2ST8I6Q-C4=OV|e$ZUN(irp?V zN;KgFJPU3tX*fJG{80#*Y{^{4w7+H>g@11CeJiuq%LbH zH#*P7X+RFwqqJZEVmiq67?n;}I2vtvb4n6Q)wNdYBQx&@>~KqL;`-5u{ah~DwM?|psO_3_7W_MSC+t^HfM_nA3UmVuV~ znqdGjJX3Mo2hPJ6R$9*#f)+WURCV%fR<~?n?h}ycg0l#2>dGRn(cu8oj78?))T7&cZkIv;Y?jt%&atEAZV(qUs}CdRbF8bn@*$c zEMnDo4*!b$q|my+N6F*GcKC8m1tAMC!=M*&9Jq`;r%xV3#}d910@`){1bv}Pu`-oe z)yFIGttP%z6pt%B!zG-7(yF=Xs~S@~s;OiLK@nC52?5gsHRJne@>u}>l%+)^*3O8P zU|MB`J4ge@HK}D3Wp|qF;)_%gO0Z%wK7w1BMMJ@>&ADy5(VmbE-;p4oc2X);lTa;P zm>#S62U#{VUrA_%V&f`bH?n;VcEDW4DIU5@uHLX|?FGss!(pf?Ylm^!B+>!$3H_v| zsb~0gBOcyOdMO<|7|)IClTIjVvi)5hHJnni{a-p#ORT=4PLSa%m?RJH@yvNZ!`K!k zEAZry8Bq_}byZxF0BlbH*r3X?U*%EEe}gF&olp^mQ(3215!QUc{n;K^A7Ku)RPj-$ zm?T9k*1?{_dA#ke(vVT)6Tfe>cJ)K~Mo5I})r9G+9pMtzeB&0oF4)bocCd>3XGBCt zZ%Y~HPEQdu-=Ef_RZVQqP}a40q)Q==v{EX;1cAdx>lh3_P6W`4S)AAz)@48;p&P@# z;zY7cBS(GeZx5!+`50L6h4HxG6bFsO+hnvTqhmRco(Dlpb(3{_6sFkhCuuu-kI-Bz zjHIX0Yy9^&?FuRw^QW8F`)c;znnuenKkO)dJ#}u1FZSz68R?UCHT`;$Quw?~H&|l& z8_Ys_l5hl4h$MgoE2u3W1=~juk;mLgrKv|CaEN`1ywk;mx)2CS5|x6;U(iHcS4Yf` zo!b(+O0reA6SY4L=}*9eIFP9;VbJ+09GAsOmPSxbvSP^`fGVFdm$NTkGiuX=bJZp}BRXSx zPPb;xKCB~=nE@O;@fY$KCceS&i;8?_54!lw;nq zM%wTKR-+;htOf>%8t66>vb`5BveTS`V(WW+`6-0l4&dbuhD&Anewr%aBqm40s^>B$ z>jAoQiL&vMqwnW&1riYZggXhFQcuPXM?f@)5)wFOth>HW zWGeq+oN+2pA5Mm5*Z0uHP6O!V=Sl>OG#ci^PzZniQqq!uh zpXwTb>F$M*^uvKC^7d>l3T-6E$)sM&_8gt3oF$qUYhmU+_0lt^-YZ%8V58$vKZf6w z?(xJda482|Fr>rw8-$E=rVJ>VYTIjnyCnw4OsCRYz^fzB7)TeaZ-lmbB!!_*SV=)G zQ`^J9B=rsR3s%VO=e&lo;ly(p|!iN zu$_zMfZ)N1=zGAvC;&@k_Lyje`;aQj9Ad1QF zKir*CqSo1>)7n2!%z6hJ)-&=4<^ zWI4%~%)w~%{8*M(G@ZxVI?~+tv$LSWr@(Km1-WjCO!^XVEkF7WbE4igZ4SGoAUWrP zlj%AuyAh#L2HvMxw$}(;9d$F!A zp;laR?K&c`C{bN(a56tzrNsg}`y6$w1Ip57hfx0KiJL{Kw7x6n+Xq&t5;hZZCQ{;N z$|#I#4By+gO7bu9nTxDiUNhsp{hBW%Pmmp z_gEde)C?@dNF<8D03lMEW|(O@6%&$7adT`KV|8b#oJ*Eq0u?w4o?(F@f*>SD6wI?w zSMk`PE${m45T>&M%Sc4Wa~1A{sG`9GxO`&R{*7tf_L4P?Rq7IaMQ&TJ^%y5^#c2X7 zS~(UfRs(syITmA|qG`8u#xMn8HZ>$|z_frcbEP5)zzD4os_y&V(XFu~xh-b@C}1Sp zEVUkD?E%;5)$1>q2-GEHY@R)8t1pl`(#Xjsz-1(<{Qz6YD)DPMqu0Z*@o-4S&>Ok= zi@a7WJNouXKTk*h#+xE}i?*I0%{$wjzd+Oc%! z0{Js7(ed8RDe+xF@8eOK+Gvh4w{|#Df>3SP$x)2LlqKQ#vTV0da`~S)!5rzex5aQy)jXK zyQ_1YJB%DcNjEg#x72uOk-=MYY~Or+GHw@}Z^M(-ICad~`vPGz20Q!5na9a=)2GYX zPgdodu#vp9@?1Jv^t?pz$?tsz>RDH;Z4hdIHZrq7l7pXv^onIUm7!FSDezPkymXTr z+@x2n8Iqz2rd+MNi48-NkZH3VtY)CktVKf$vAKtuaFQVvZwPM08~LUQbs)Rr(++9Y z=TCd~cz#~VC1Tmy7g{2vM!dt#H=B`5Vh%u1f1oH)k0@)79sXD*-Hf4QA;amE|)-A25ZnX7*IW_TlGBLCZ%yD*=7+15#- z`+A~F{TmiIHu?4!s_Rp7D%B!WSuHvz3+0V?+l?OIb(?p7Y4I52_M(i?70dZ2lGm|;wIc{0UvMh+7iH<9PF)Y7 zH0u^k;D0E5D*#tEM7SqQV0`}AZU?o1WUWcHBfoH8+lCcj(+AGE-V3A)5^oWT)O7u6VxoT@%CnFWh2VXcp z_Ztz9Md87GKH0-TShaq~tH^CWigzA-zE_>0uCcBN`grj7 zUSn;4URT~RtSbX-HWr-e36i_WbOrnL$e13-178BEdtXUPN^>CN#5yr^Uh~3ry*JS% zO1xX@WeG(G7F3d7k}fN&43G%5zq#Vs*`oQ0Z03(C*^IX12BSq=6tlJaWu+ag$9&S zK6U1%_E9&RnIa! zF#WOz$@Ueu0rjSHjCCJ}ve>()qDrrd(#lQvh0zsTrSb5g?x1(>XcRgeMHg3wElo+V$4(`@ly3UaV23Bp3(NElAIv@Q4?!(L+r8!EQo6dU zn6o65IhkC-VTaVE<;kc5(xi)f)nyP%y75GfFQFRAIH?b6 zGpOS&$eF;6)cLq6=#_=hC@y3rh^;I8dCLB{>4QMk&ETy4qQ9CpB(D4vij^i?m842g zd#Faz#Sm>416U9_vK}TPFV8%UX=QkHU+ydt1Xn#28|LrjhlhHNO%S@u;4e0cVmc{c zt3SMbK;%vI^3r&ok-biEsq0L{(#ZK2PfrEb*oR|XRa4~OjBuZqe@?sjzRmg7{!KX9 zi4YeXG;IwndoD7#Dh*U-##IwXeEaTeq%Odx#~B4Xe3DS4MsR>Bo10_58i1vBU&;@1 zA*<2)X*(t!qKaeCJCY5l5nc7F!}4a^adDjk0e!7kt8p1~9%)|ZcXhfiQ_67Rg8M@P zXgEmubWWhoMB9U;4vm3Hn@Sx&f)mb2;$}5vPN;{O zt@4esb#w#yg?<&7-Hhegh(TF-w$(na)taz$ zB9JUTml%dDPg#XpAP^m=M-uQ#iHpWb8in#nmk|E^eu<9bxTDE;>_l)L=gL&er%y{h zB2k^j0YVl9BJAq9ryOWA_ z@UR#)Zi1KFQnNs}&c)~>gyi2B_T=O$HQ&H^w*bjb4;a&5|kbFwh6hGOL9ct`bS7B8=JS#A>(RiogL-ou@?_9v+@J3;nhh?zdnfR^*EDejM>AfS#2msIbBR_Nfw$h6>I zvL6YM|81j%ToIZDBd<#!2)ka%5;_Q)O10`-=JT!7-TF==7TSbP>$DILD30810*o|Z zDUIKSF9|a`&cROzfKxEFbO++*ApYvtrI4Ynti z2Jwg;m5By1Ujo_FO|v%X0wTb70)dDl@(9*h%ak;*9!mqzZ?Fhr;C`tTKRj5!3$7#1BXi# z_Z-t+m)4|xHoLq-^}CIVgU2p}^-Yd`;9n+#ajPw@c{eQP8`Rs?ehFIHH=?Wq?+wpC zYxk|;VT|Kz;43PyN1UyrCWRM;goCWZ^L$J=mHBQ|LtNhov|Gi6Nf}sU+9zk~ z$n$Rszr_C$tC1Q>;#dV^)N<$?f45e<*c_LH^QbRyZ}DrC4feZy-qv)I*v?G@(IH?v z_y|NB8A;+4!*?t(m6u%P=_g%)JWdnDb2a&)Y7P4WAYKAi{CvrB0 z8MOD%b?43FryNE+v7kW?ijk!pLrTN_4=pB?xus~Wx|}-$QGES%Jg3OGpwyOQYy|eSA|O=>FgilM_tH{-$yxLf}#wgDRc#A_Jo= z6)o0lrN@nO8gHFX*PwzXq<&=xz#E(*L@dZAZNu_VDWC&beLZBQFK;}AqD~pyPjwpf z5K#E5^=(Iq4ae&k=08-HUY%I?Sjoo77;Jq%(s<4t$=6QQ(e=cAM%0iy)ysrrO?1kd1dFs5d%tvT+~iI z5-Lz@qD(q4%&fYj!~=G@Vf2KTcP{ramg+neBZ3%n8>UJ^8FO2ur**x`-|A78_&2&E z6=R!dpq2${4Yw6_&VQ4O;$qbj3Zes7-*PA|#t)|+7!3o0mup@xI!GuW4p#E0FD$B# z88c~`xr)_{CR|R9)yk14zYZ|%~}(Z3P!YY!lDQSCk1A%%t1f+tikuLKDO z)Y%|l)QR7{Fuk@5TW&${li0Bs{?$QaD;Xrdi)t}+u#-VB{9=FigBWT!44{%2)EnwU zf=;c+)R_!b)n_Qii~gasck5X2f{ES^WCG9+FT;tzGVAHnFmz1o({uu5zcL9o6- zZznV-wz`BjXn?L1VVgpLZ|WrUT(7uD(lG7*Xqd|8`_YRt4x{Pis)A#(Xjl&|rl zG%OF0>QdI&Q`cec^WFvaUo`iw{VBT zz1(LeQ|7Wy4EOfomz;(o4}xx{Oc@q47G-O_(}2tLJS}Z9p&mQ+Y772qr?qFE(Ab=a61sc z^PGj`sYC4ZYP}YYQrlq((%5=mbXY;9p8?>_ojG{HF1S3#cB-VXl?V#PL(F3Sj>=xx zaH`W8RaCmId+6c4xg#nf%jmaW$|zy4-Q*cyt>G2ewA5^7`Zj*iW4bAu<}X9rNJ4m< z$xZ3@`DNMI=kWmItmG9?jyhmg&$ge<_kpphigYfEBG$ywzExz8SeBcO{|+M+3lifE zwjEL1AEDH*y~=#x5OT~h+Z^8{t<|MTlhwu~#N|u0s($&D_f6H~94-lmBOdaExYtsa zRHR8Q`u#3KT2$a>?&iFpF&1`O_$mXS-z*yB45CB|vW5W$EyU#pQL=ua;pUb$Nj}~w z$o0YkG!GwS1&LDcaLI-XgbU